# Flog Txt Version 1
# Analyzer Version: 2.3.2
# Analyzer Build Date: Nov 29 2018 14:58:43
# Log Creation Date: 04.01.2019 20:42:42.573

Process:
	id = "1"
	image_name = "boom ransomeware.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\boom ransomeware.exe"
	page_root = "0x52a0e000"
	os_pid = "0x474"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4
	        start_va = 0x110000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 5
	        start_va = 0xcb0000
	          end_va = 0xce3fff
	     entry_point = 0xcb0000
	     region_type = mapped_file
	            name = "boom ransomeware.exe"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\boom ransomeware.exe")

Region:
	              id = 6
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 7
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 8
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 9
	        start_va = 0x7feff990000
	          end_va = 0x7feff990fff
	     entry_point = 0x7feff990000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 10
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 11
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 12
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 145
	        start_va = 0x2d0000
	          end_va = 0x34ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002d0000"
	        filename = ""

Region:
	              id = 146
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x77550000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 147
	        start_va = 0x7fef4790000
	          end_va = 0x7fef47fefff
	     entry_point = 0x7fef4790000
	     region_type = mapped_file
	            name = "mscoree.dll"
	        filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")

Region:
	              id = 148
	        start_va = 0x7fefd920000
	          end_va = 0x7fefd98afff
	     entry_point = 0x7fefd920000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 149
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 150
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 151
	        start_va = 0x350000
	          end_va = 0x44ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000350000"
	        filename = ""

Region:
	              id = 152
	        start_va = 0x520000
	          end_va = 0x52ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 153
	        start_va = 0x620000
	          end_va = 0x69ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 154
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 155
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 156
	        start_va = 0x7fefdb10000
	          end_va = 0x7fefdbaefff
	     entry_point = 0x7fefdb10000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 157
	        start_va = 0x7fefe330000
	          end_va = 0x7fefe34efff
	     entry_point = 0x7fefe330000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 158
	        start_va = 0x7feff740000
	          end_va = 0x7feff81afff
	     entry_point = 0x7feff740000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 159
	        start_va = 0x7feff820000
	          end_va = 0x7feff94cfff
	     entry_point = 0x7feff820000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 160
	        start_va = 0x260000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000260000"
	        filename = ""

Region:
	              id = 161
	        start_va = 0x6a0000
	          end_va = 0x79ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006a0000"
	        filename = ""

Region:
	              id = 162
	        start_va = 0x7fef4390000
	          end_va = 0x7fef4428fff
	     entry_point = 0x7fef4390000
	     region_type = mapped_file
	            name = "mscoreei.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll")

Region:
	              id = 163
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x77450000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 164
	        start_va = 0x7fefdc90000
	          end_va = 0x7fefdcf6fff
	     entry_point = 0x7fefdc90000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 165
	        start_va = 0x7fefdd00000
	          end_va = 0x7fefddc8fff
	     entry_point = 0x7fefdd00000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 166
	        start_va = 0x7fefe350000
	          end_va = 0x7fefe35dfff
	     entry_point = 0x7fefe350000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 167
	        start_va = 0x7feff2e0000
	          end_va = 0x7feff350fff
	     entry_point = 0x7feff2e0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 168
	        start_va = 0x7a0000
	          end_va = 0x927fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007a0000"
	        filename = ""

Region:
	              id = 169
	        start_va = 0x7fefe0a0000
	          end_va = 0x7fefe1a8fff
	     entry_point = 0x7fefe0a0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 170
	        start_va = 0x7feff950000
	          end_va = 0x7feff97dfff
	     entry_point = 0x7feff950000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 171
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 172
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 173
	        start_va = 0x930000
	          end_va = 0xab0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000930000"
	        filename = ""

Region:
	              id = 174
	        start_va = 0xcf0000
	          end_va = 0x20effff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000cf0000"
	        filename = ""

Region:
	              id = 175
	        start_va = 0x7fefc780000
	          end_va = 0x7fefc78bfff
	     entry_point = 0x7fefc780000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 176
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 177
	        start_va = 0xba0000
	          end_va = 0xc1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ba0000"
	        filename = ""

Region:
	              id = 178
	        start_va = 0x751d0000
	          end_va = 0x75298fff
	     entry_point = 0x751d0000
	     region_type = mapped_file
	            name = "msvcr80.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll")

Region:
	              id = 179
	        start_va = 0x7fef39f0000
	          end_va = 0x7fef438cfff
	     entry_point = 0x7fef39f0000
	     region_type = mapped_file
	            name = "mscorwks.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll")

Region:
	              id = 180
	        start_va = 0xe0000
	          end_va = 0xe2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 181
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 182
	        start_va = 0x220000
	          end_va = 0x23ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000220000"
	        filename = ""

Region:
	              id = 183
	        start_va = 0x500000
	          end_va = 0x50ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 184
	        start_va = 0x20f0000
	          end_va = 0x21effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020f0000"
	        filename = ""

Region:
	              id = 185
	        start_va = 0x2250000
	          end_va = 0x234ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002250000"
	        filename = ""

Region:
	              id = 186
	        start_va = 0x7fefe360000
	          end_va = 0x7feff0e7fff
	     entry_point = 0x7fefe360000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 187
	        start_va = 0x7ff00010000
	          end_va = 0x7ff0001ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00010000"
	        filename = ""

Region:
	              id = 188
	        start_va = 0x7ff00020000
	          end_va = 0x7ff0002ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00020000"
	        filename = ""

Region:
	              id = 189
	        start_va = 0x7ff00030000
	          end_va = 0x7ff000cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00030000"
	        filename = ""

Region:
	              id = 190
	        start_va = 0x7ff000d0000
	          end_va = 0x7ff000dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff000d0000"
	        filename = ""

Region:
	              id = 191
	        start_va = 0x7ff000e0000
	          end_va = 0x7ff0014ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff000e0000"
	        filename = ""

Region:
	              id = 192
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 193
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000100000"
	        filename = ""

Region:
	              id = 194
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdff2fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 195
	        start_va = 0x2350000
	          end_va = 0x261efff
	     entry_point = 0x2350000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 196
	        start_va = 0x7fefd5c0000
	          end_va = 0x7fefd5cefff
	     entry_point = 0x7fefd5c0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 197
	        start_va = 0x450000
	          end_va = 0x4ccfff
	     entry_point = 0x450000
	     region_type = mapped_file
	            name = "rpcss.dll"
	        filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")

Region:
	              id = 198
	        start_va = 0x2620000
	          end_va = 0x1a61ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002620000"
	        filename = ""

Region:
	              id = 199
	        start_va = 0x1a620000
	          end_va = 0x1aceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001a620000"
	        filename = ""

Region:
	              id = 200
	        start_va = 0x1acf0000
	          end_va = 0x1adf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001acf0000"
	        filename = ""

Region:
	              id = 201
	        start_va = 0x1aee0000
	          end_va = 0x1afdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001aee0000"
	        filename = ""

Region:
	              id = 202
	        start_va = 0x7fef2b10000
	          end_va = 0x7fef39ebfff
	     entry_point = 0x7fef2b10000
	     region_type = mapped_file
	            name = "mscorlib.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll")

Region:
	              id = 203
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 204
	        start_va = 0x450000
	          end_va = 0x4ccfff
	     entry_point = 0x450000
	     region_type = mapped_file
	            name = "rpcss.dll"
	        filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")

Region:
	              id = 205
	        start_va = 0x7fefd4b0000
	          end_va = 0x7fefd4befff
	     entry_point = 0x7fefd4b0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 206
	        start_va = 0x7fefbf10000
	          end_va = 0x7fefbf65fff
	     entry_point = 0x7fefbf10000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 207
	        start_va = 0x1afe0000
	          end_va = 0x1b19ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001afe0000"
	        filename = ""

Region:
	              id = 208
	        start_va = 0x530000
	          end_va = 0x60efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000530000"
	        filename = ""

Region:
	              id = 209
	        start_va = 0x210000
	          end_va = 0x212fff
	     entry_point = 0x210000
	     region_type = mapped_file
	            name = "l_intl.nls"
	        filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls")

Region:
	              id = 210
	        start_va = 0x240000
	          end_va = 0x240fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000240000"
	        filename = ""

Region:
	              id = 211
	        start_va = 0x1afe0000
	          end_va = 0x1b0dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001afe0000"
	        filename = ""

Region:
	              id = 212
	        start_va = 0x1b120000
	          end_va = 0x1b19ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b120000"
	        filename = ""

Region:
	              id = 213
	        start_va = 0x7fef0c70000
	          end_va = 0x7fef0df3fff
	     entry_point = 0x7fef0c70000
	     region_type = mapped_file
	            name = "mscorjit.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll")

Region:
	              id = 214
	        start_va = 0x7fef0e00000
	          end_va = 0x7fef1e95fff
	     entry_point = 0x7fef0e00000
	     region_type = mapped_file
	            name = "system.windows.forms.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.windows.forms\\6c352ff9e3603b0e69d969ff7e7632f5\\system.windows.forms.ni.dll")

Region:
	              id = 215
	        start_va = 0x7fef1ea0000
	          end_va = 0x7fef20d6fff
	     entry_point = 0x7fef1ea0000
	     region_type = mapped_file
	            name = "system.drawing.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\system.drawing.ni.dll")

Region:
	              id = 216
	        start_va = 0x7fef20e0000
	          end_va = 0x7fef2b02fff
	     entry_point = 0x7fef20e0000
	     region_type = mapped_file
	            name = "system.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll")

Region:
	              id = 217
	        start_va = 0x7ff00150000
	          end_va = 0x7ff0015ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00150000"
	        filename = ""

Region:
	              id = 218
	        start_va = 0x7fffff10000
	          end_va = 0x7fffff1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff10000"
	        filename = ""

Region:
	              id = 219
	        start_va = 0x7fffff20000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff20000"
	        filename = ""

Region:
	              id = 220
	        start_va = 0x250000
	          end_va = 0x25ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 221
	        start_va = 0x270000
	          end_va = 0x27ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000270000"
	        filename = ""

Region:
	              id = 222
	        start_va = 0x280000
	          end_va = 0x28ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000280000"
	        filename = ""

Region:
	              id = 223
	        start_va = 0x290000
	          end_va = 0x29ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 224
	        start_va = 0x7ff00160000
	          end_va = 0x7ff0019ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff00160000"
	        filename = ""

Region:
	              id = 225
	        start_va = 0x2a0000
	          end_va = 0x2affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 226
	        start_va = 0x2b0000
	          end_va = 0x2bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002b0000"
	        filename = ""

Region:
	              id = 227
	        start_va = 0x2c0000
	          end_va = 0x2cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 228
	        start_va = 0x460000
	          end_va = 0x46ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 229
	        start_va = 0x470000
	          end_va = 0x47ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 230
	        start_va = 0x7fef0a60000
	          end_va = 0x7fef0c6cfff
	     entry_point = 0x7fef0a60000
	     region_type = mapped_file
	            name = "microsoft.visualbasic.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualbas#\\684eae3bcd28cb6d1e6997e6497056e2\\microsoft.visualbasic.ni.dll")

Region:
	              id = 231
	        start_va = 0x7ff001a0000
	          end_va = 0x7ff001affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001a0000"
	        filename = ""

Region:
	              id = 232
	        start_va = 0x480000
	          end_va = 0x490fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000480000"
	        filename = ""

Region:
	              id = 233
	        start_va = 0x270000
	          end_va = 0x27ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000270000"
	        filename = ""

Region:
	              id = 234
	        start_va = 0x450000
	          end_va = 0x45ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 235
	        start_va = 0x4a0000
	          end_va = 0x4affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 236
	        start_va = 0x4b0000
	          end_va = 0x4effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 237
	        start_va = 0x7fefbcf0000
	          end_va = 0x7fefbf04fff
	     entry_point = 0x7fefbcf0000
	     region_type = mapped_file
	            name = "gdiplus.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll")

Region:
	              id = 238
	        start_va = 0x1b1a0000
	          end_va = 0x1b39ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b1a0000"
	        filename = ""

Region:
	              id = 239
	        start_va = 0xac0000
	          end_va = 0xadafff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "gdipfontcachev1.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")

Region:
	              id = 240
	        start_va = 0x1b1a0000
	          end_va = 0x1b29ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b1a0000"
	        filename = ""

Region:
	              id = 241
	        start_va = 0x1b390000
	          end_va = 0x1b39ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b390000"
	        filename = ""

Region:
	              id = 242
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 243
	        start_va = 0x1b3a0000
	          end_va = 0x1b49ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b3a0000"
	        filename = ""

Region:
	              id = 244
	        start_va = 0xac0000
	          end_va = 0xb6afff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "tahoma.ttf"
	        filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")

Region:
	              id = 245
	        start_va = 0xac0000
	          end_va = 0xb6afff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "tahoma.ttf"
	        filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")

Region:
	              id = 246
	        start_va = 0x1b4a0000
	          end_va = 0x1c948fff
	     entry_point = 0x1b4a0000
	     region_type = mapped_file
	            name = "msjh.ttf"
	        filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")

Region:
	              id = 247
	        start_va = 0x1b4a0000
	          end_va = 0x1c948fff
	     entry_point = 0x1b4a0000
	     region_type = mapped_file
	            name = "msjh.ttf"
	        filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")

Region:
	              id = 248
	        start_va = 0x1b4a0000
	          end_va = 0x1c962fff
	     entry_point = 0x1b4a0000
	     region_type = mapped_file
	            name = "msyh.ttf"
	        filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")

Region:
	              id = 249
	        start_va = 0x1b4a0000
	          end_va = 0x1c962fff
	     entry_point = 0x1b4a0000
	     region_type = mapped_file
	            name = "msyh.ttf"
	        filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")

Region:
	              id = 250
	        start_va = 0x1b4a0000
	          end_va = 0x1b8c2fff
	     entry_point = 0x1b4a0000
	     region_type = mapped_file
	            name = "malgun.ttf"
	        filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")

Region:
	              id = 251
	        start_va = 0x1b4a0000
	          end_va = 0x1b8c2fff
	     entry_point = 0x1b4a0000
	     region_type = mapped_file
	            name = "malgun.ttf"
	        filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")

Region:
	              id = 252
	        start_va = 0x1b8d0000
	          end_va = 0x1bacffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b8d0000"
	        filename = ""

Region:
	              id = 253
	        start_va = 0xac0000
	          end_va = 0xb5ffff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "micross.ttf"
	        filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")

Region:
	              id = 254
	        start_va = 0xac0000
	          end_va = 0xb5ffff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "micross.ttf"
	        filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")

Region:
	              id = 255
	        start_va = 0xac0000
	          end_va = 0xb3efff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "segoeui.ttf"
	        filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")

Region:
	              id = 256
	        start_va = 0xac0000
	          end_va = 0xb3efff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "segoeui.ttf"
	        filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")

Region:
	              id = 257
	        start_va = 0xac0000
	          end_va = 0xb5efff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "tahomabd.ttf"
	        filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf")

Region:
	              id = 258
	        start_va = 0xac0000
	          end_va = 0xb5efff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "tahomabd.ttf"
	        filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf")

Region:
	              id = 259
	        start_va = 0x7ff001b0000
	          end_va = 0x7ff001bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001b0000"
	        filename = ""

Region:
	              id = 260
	        start_va = 0x7fefdbb0000
	          end_va = 0x7fefdc86fff
	     entry_point = 0x7fefdbb0000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 261
	        start_va = 0x1b560000
	          end_va = 0x1b65ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b560000"
	        filename = ""

Region:
	              id = 262
	        start_va = 0x1b6e0000
	          end_va = 0x1b7dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6e0000"
	        filename = ""

Region:
	              id = 263
	        start_va = 0x7fefceb0000
	          end_va = 0x7fefcec6fff
	     entry_point = 0x7fefceb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 264
	        start_va = 0x7fffff0e000
	          end_va = 0x7fffff0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0e000"
	        filename = ""

Region:
	              id = 265
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 266
	        start_va = 0xac0000
	          end_va = 0xb04fff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 267
	        start_va = 0xac0000
	          end_va = 0xb04fff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 268
	        start_va = 0xac0000
	          end_va = 0xb04fff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 269
	        start_va = 0xac0000
	          end_va = 0xb04fff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 270
	        start_va = 0xac0000
	          end_va = 0xb04fff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 271
	        start_va = 0x7fefcbb0000
	          end_va = 0x7fefcbf6fff
	     entry_point = 0x7fefcbb0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 272
	        start_va = 0x7fefd5a0000
	          end_va = 0x7fefd5b3fff
	     entry_point = 0x7fefd5a0000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 273
	        start_va = 0x250000
	          end_va = 0x25ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 274
	        start_va = 0x280000
	          end_va = 0x284fff
	     entry_point = 0x280000
	     region_type = mapped_file
	            name = "sorttbls.nlp"
	        filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp")

Region:
	              id = 275
	        start_va = 0x460000
	          end_va = 0x460fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000460000"
	        filename = ""

Region:
	              id = 276
	        start_va = 0xac0000
	          end_va = 0xb00fff
	     entry_point = 0xac0000
	     region_type = mapped_file
	            name = "sortkey.nlp"
	        filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp")

Region:
	              id = 277
	        start_va = 0x1bb10000
	          end_va = 0x1bc0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bb10000"
	        filename = ""

Region:
	              id = 278
	        start_va = 0x1bc70000
	          end_va = 0x1bd6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bc70000"
	        filename = ""

Region:
	              id = 279
	        start_va = 0x1bd70000
	          end_va = 0x1be6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bd70000"
	        filename = ""

Region:
	              id = 280
	        start_va = 0x642ff4a0000
	          end_va = 0x642ff4a9fff
	     entry_point = 0x642ff4a0000
	     region_type = mapped_file
	            name = "culture.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll")

Region:
	              id = 281
	        start_va = 0x7fffff0a000
	          end_va = 0x7fffff0bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0a000"
	        filename = ""

Region:
	              id = 282
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 283
	        start_va = 0xb10000
	          end_va = 0xb63fff
	     entry_point = 0xb10000
	     region_type = mapped_file
	            name = "mscorrc.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll")

Region:
	              id = 284
	        start_va = 0x7fefb970000
	          end_va = 0x7fefba99fff
	     entry_point = 0x7fefb970000
	     region_type = mapped_file
	            name = "windowscodecs.dll"
	        filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")

Region:
	              id = 285
	        start_va = 0x460000
	          end_va = 0x460fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 286
	        start_va = 0x4f0000
	          end_va = 0x4f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 287
	        start_va = 0x1be70000
	          end_va = 0x1bf8dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001be70000"
	        filename = ""

Region:
	              id = 288
	        start_va = 0x510000
	          end_va = 0x510fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 289
	        start_va = 0x1bf90000
	          end_va = 0x1c11ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 290
	        start_va = 0x7fefbae0000
	          end_va = 0x7fefbaf7fff
	     entry_point = 0x7fefbae0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 291
	        start_va = 0x1c120000
	          end_va = 0x1ca4ffff
	     entry_point = 0x1c120000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 292
	        start_va = 0x610000
	          end_va = 0x616fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000610000"
	        filename = ""

Region:
	              id = 293
	        start_va = 0xb70000
	          end_va = 0xb71fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b70000"
	        filename = ""

Region:
	              id = 294
	        start_va = 0x1ca50000
	          end_va = 0x1ce42fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000001ca50000"
	        filename = ""

Region:
	              id = 295
	        start_va = 0xb80000
	          end_va = 0xb8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b80000"
	        filename = ""

Region:
	              id = 296
	        start_va = 0xb90000
	          end_va = 0xb9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b90000"
	        filename = ""

Region:
	              id = 297
	        start_va = 0xc20000
	          end_va = 0xc2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c20000"
	        filename = ""

Region:
	              id = 298
	        start_va = 0x7ff001c0000
	          end_va = 0x7ff001cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001c0000"
	        filename = ""

Region:
	              id = 299
	        start_va = 0x7fefbf70000
	          end_va = 0x7fefc09bfff
	     entry_point = 0x7fefbf70000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 300
	        start_va = 0x290000
	          end_va = 0x291fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000290000"
	        filename = ""

Region:
	              id = 301
	        start_va = 0x7fefc0f0000
	          end_va = 0x7fefc2e3fff
	     entry_point = 0x7fefc0f0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 302
	        start_va = 0x450000
	          end_va = 0x450fff
	     entry_point = 0x450000
	     region_type = mapped_file
	            name = "windowsshell.manifest"
	        filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")

Region:
	              id = 303
	        start_va = 0xc20000
	          end_va = 0xc21fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c20000"
	        filename = ""

Region:
	              id = 304
	        start_va = 0x450000
	          end_va = 0x450fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000450000"
	        filename = ""

Region:
	              id = 305
	        start_va = 0x7fefe000000
	          end_va = 0x7fefe098fff
	     entry_point = 0x7fefe000000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 306
	        start_va = 0xc30000
	          end_va = 0xc30fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c30000"
	        filename = ""

Region:
	              id = 307
	        start_va = 0x7fefb520000
	          end_va = 0x7fefb54cfff
	     entry_point = 0x7fefb520000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 308
	        start_va = 0x7fefe1b0000
	          end_va = 0x7fefe201fff
	     entry_point = 0x7fefe1b0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 309
	        start_va = 0xc40000
	          end_va = 0xc43fff
	     entry_point = 0xc40000
	     region_type = mapped_file
	            name = "cversions.1.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")

Region:
	              id = 310
	        start_va = 0xc50000
	          end_va = 0xc6efff
	     entry_point = 0xc50000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 311
	        start_va = 0xc70000
	          end_va = 0xc70fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c70000"
	        filename = ""

Region:
	              id = 312
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 313
	        start_va = 0x1c0a0000
	          end_va = 0x1c11ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001c0a0000"
	        filename = ""

Region:
	              id = 314
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 315
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 316
	        start_va = 0xc40000
	          end_va = 0xc43fff
	     entry_point = 0xc40000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 317
	        start_va = 0xc80000
	          end_va = 0xcaffff
	     entry_point = 0xc80000
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db")

Region:
	              id = 318
	        start_va = 0x21f0000
	          end_va = 0x21f3fff
	     entry_point = 0x21f0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 319
	        start_va = 0x1ae00000
	          end_va = 0x1ae65fff
	     entry_point = 0x1ae00000
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 320
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 321
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 322
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 323
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 324
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 325
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 326
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 327
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 328
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 329
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 330
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 331
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 332
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 333
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 334
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 335
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 336
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 337
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 338
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 339
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 340
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 341
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 342
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 343
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 344
	        start_va = 0x7fefd670000
	          end_va = 0x7fefd6a5fff
	     entry_point = 0x7fefd670000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 345
	        start_va = 0x7fefd900000
	          end_va = 0x7fefd919fff
	     entry_point = 0x7fefd900000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 346
	        start_va = 0x7feff0f0000
	          end_va = 0x7feff2c6fff
	     entry_point = 0x7feff0f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 347
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 348
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 349
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 350
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 351
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 352
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 353
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 354
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 355
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 356
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 357
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 358
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 359
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 360
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 361
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 362
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 363
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 364
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 365
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 366
	        start_va = 0x1bf90000
	          end_va = 0x1c090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 367
	        start_va = 0x7fefa4d0000
	          end_va = 0x7fefa526fff
	     entry_point = 0x7fefa4d0000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 368
	        start_va = 0x7fef8a80000
	          end_va = 0x7fef8ab3fff
	     entry_point = 0x7fef8a80000
	     region_type = mapped_file
	            name = "shdocvw.dll"
	        filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll")

Region:
	              id = 369
	        start_va = 0x1ce70000
	          end_va = 0x1cf6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ce70000"
	        filename = ""

Region:
	              id = 370
	        start_va = 0x7fefd990000
	          end_va = 0x7fefdb07fff
	     entry_point = 0x7fefd990000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 371
	        start_va = 0x7fffff08000
	          end_va = 0x7fffff09fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff08000"
	        filename = ""

Region:
	              id = 372
	        start_va = 0x7feff360000
	          end_va = 0x7feff489fff
	     entry_point = 0x7feff360000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 373
	        start_va = 0x7feff4e0000
	          end_va = 0x7feff738fff
	     entry_point = 0x7feff4e0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 374
	        start_va = 0x7fefd750000
	          end_va = 0x7fefd8b6fff
	     entry_point = 0x7fefd750000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 375
	        start_va = 0x7fefd660000
	          end_va = 0x7fefd66efff
	     entry_point = 0x7fefd660000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 376
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd4a4fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 377
	        start_va = 0x2200000
	          end_va = 0x2200fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002200000"
	        filename = ""

Region:
	              id = 434
	        start_va = 0x1cf90000
	          end_va = 0x1d08ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001cf90000"
	        filename = ""

Region:
	              id = 435
	        start_va = 0x7fffff06000
	          end_va = 0x7fffff07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff06000"
	        filename = ""

Region:
	              id = 436
	        start_va = 0x270000
	          end_va = 0x271fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000270000"
	        filename = ""

Region:
	              id = 437
	        start_va = 0x270000
	          end_va = 0x270fff
	     entry_point = 0x270000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctf.dll.mui")

Region:
	              id = 438
	        start_va = 0x2a0000
	          end_va = 0x2a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002a0000"
	        filename = ""

Region:
	              id = 439
	        start_va = 0x7fef48a0000
	          end_va = 0x7fef493ffff
	     entry_point = 0x7fef48a0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll")

Region:
	              id = 440
	        start_va = 0x1d090000
	          end_va = 0x1d1affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d090000"
	        filename = ""

Region:
	              id = 441
	        start_va = 0x1bf90000
	          end_va = 0x1c08ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bf90000"
	        filename = ""

Region:
	              id = 442
	        start_va = 0x2a0000
	          end_va = 0x2b9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 443
	        start_va = 0x1b2a0000
	          end_va = 0x1b33efff
	     entry_point = 0x1b2a0000
	     region_type = mapped_file
	            name = "tahomabd.ttf"
	        filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf")

Region:
	              id = 444
	        start_va = 0x2c0000
	          end_va = 0x2c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 445
	        start_va = 0x2a0000
	          end_va = 0x2a5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 446
	        start_va = 0x2a0000
	          end_va = 0x2acfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 447
	        start_va = 0x2b0000
	          end_va = 0x2b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002b0000"
	        filename = ""

Region:
	              id = 448
	        start_va = 0x2210000
	          end_va = 0x2233fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002210000"
	        filename = ""

Region:
	              id = 449
	        start_va = 0x2c0000
	          end_va = 0x2c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 450
	        start_va = 0x1d1b0000
	          end_va = 0x1d2d5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d1b0000"
	        filename = ""

Region:
	              id = 451
	        start_va = 0x1d2e0000
	          end_va = 0x1d405fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d2e0000"
	        filename = ""

Region:
	              id = 452
	        start_va = 0x2b0000
	          end_va = 0x2b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002b0000"
	        filename = ""

Region:
	              id = 453
	        start_va = 0x2c0000
	          end_va = 0x2cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 454
	        start_va = 0x4a0000
	          end_va = 0x4affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 455
	        start_va = 0xb80000
	          end_va = 0xb8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b80000"
	        filename = ""

Region:
	              id = 456
	        start_va = 0x2210000
	          end_va = 0x221ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002210000"
	        filename = ""

Region:
	              id = 457
	        start_va = 0x2230000
	          end_va = 0x223ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002230000"
	        filename = ""

Region:
	              id = 458
	        start_va = 0x2240000
	          end_va = 0x224ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002240000"
	        filename = ""

Region:
	              id = 459
	        start_va = 0x1b380000
	          end_va = 0x1b38ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b380000"
	        filename = ""

Region:
	              id = 460
	        start_va = 0x1b6b0000
	          end_va = 0x1b6bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6b0000"
	        filename = ""

Region:
	              id = 461
	        start_va = 0x1d1b0000
	          end_va = 0x1d3affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d1b0000"
	        filename = ""

Region:
	              id = 462
	        start_va = 0x7ff001d0000
	          end_va = 0x7ff001dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001d0000"
	        filename = ""

Region:
	              id = 463
	        start_va = 0x7ff001e0000
	          end_va = 0x7ff001effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007ff001e0000"
	        filename = ""

Region:
	              id = 464
	        start_va = 0x1d3b0000
	          end_va = 0x1d522fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d3b0000"
	        filename = ""

Region:
	              id = 465
	        start_va = 0x2a0000
	          end_va = 0x2adfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 466
	        start_va = 0x1b4a0000
	          end_va = 0x1b53afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b4a0000"
	        filename = ""

Region:
	              id = 467
	        start_va = 0x1b7e0000
	          end_va = 0x1b87afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b7e0000"
	        filename = ""

Region:
	              id = 468
	        start_va = 0x1d6b0000
	          end_va = 0x1d7affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d6b0000"
	        filename = ""

Region:
	              id = 469
	        start_va = 0x77830000
	          end_va = 0x77836fff
	     entry_point = 0x77830000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")

Region:
	              id = 470
	        start_va = 0x7fef5230000
	          end_va = 0x7fef5283fff
	     entry_point = 0x7fef5230000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll")

Region:
	              id = 471
	        start_va = 0x7fef5290000
	          end_va = 0x7fef5e46fff
	     entry_point = 0x7fef5290000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll")

Region:
	              id = 472
	        start_va = 0x7fffff04000
	          end_va = 0x7fffff05fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff04000"
	        filename = ""

Region:
	              id = 735
	        start_va = 0x470000
	          end_va = 0x470fff
	     entry_point = 0x470000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll")

Region:
	              id = 736
	        start_va = 0xb90000
	          end_va = 0xb91fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b90000"
	        filename = ""

Region:
	              id = 737
	        start_va = 0x1d7b0000
	          end_va = 0x1daf2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000001d7b0000"
	        filename = ""

Region:
	              id = 921
	        start_va = 0x1d530000
	          end_va = 0x1d655fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d530000"
	        filename = ""

Region:
	              id = 922
	        start_va = 0x1d660000
	          end_va = 0x1d773fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d660000"
	        filename = ""

Region:
	              id = 1029
	        start_va = 0x1d5f0000
	          end_va = 0x1d6effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d5f0000"
	        filename = ""

Region:
	              id = 1030
	        start_va = 0x7fffff04000
	          end_va = 0x7fffff05fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff04000"
	        filename = ""

Region:
	              id = 1478
	        start_va = 0x1d530000
	          end_va = 0x1d655fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d530000"
	        filename = ""

Region:
	              id = 1479
	        start_va = 0x1d660000
	          end_va = 0x1d773fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d660000"
	        filename = ""

Region:
	              id = 1498
	        start_va = 0x1d530000
	          end_va = 0x1d62ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d530000"
	        filename = ""

Region:
	              id = 1499
	        start_va = 0x7fffff04000
	          end_va = 0x7fffff05fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff04000"
	        filename = ""

Region:
	              id = 1530
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 1531
	        start_va = 0x1bc10000
	          end_va = 0x1bd23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bc10000"
	        filename = ""

Region:
	              id = 1566
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 1567
	        start_va = 0x1bc10000
	          end_va = 0x1bd23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bc10000"
	        filename = ""

Region:
	              id = 1837
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 1838
	        start_va = 0x1bc10000
	          end_va = 0x1bd23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bc10000"
	        filename = ""

Region:
	              id = 2267
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 2268
	        start_va = 0x1bc10000
	          end_va = 0x1bd23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bc10000"
	        filename = ""

Region:
	              id = 2288
	        start_va = 0x1bc10000
	          end_va = 0x1bd0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bc10000"
	        filename = ""

Region:
	              id = 2289
	        start_va = 0x1d0a0000
	          end_va = 0x1d19ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d0a0000"
	        filename = ""

Region:
	              id = 2290
	        start_va = 0x1d1a0000
	          end_va = 0x1d1affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d1a0000"
	        filename = ""

Region:
	              id = 2291
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 2292
	        start_va = 0x7fffff0e000
	          end_va = 0x7fffff0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0e000"
	        filename = ""

Region:
	              id = 2608
	        start_va = 0x1d0a0000
	          end_va = 0x1d19ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d0a0000"
	        filename = ""

Region:
	              id = 2609
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 2655
	        start_va = 0x1b6c0000
	          end_va = 0x1b7bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 2656
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 2657
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 2658
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 2659
	        start_va = 0x1d540000
	          end_va = 0x1d63ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d540000"
	        filename = ""

Region:
	              id = 2660
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 2783
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 2784
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 2806
	        start_va = 0x1b780000
	          end_va = 0x1b87ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b780000"
	        filename = ""

Region:
	              id = 2807
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 2958
	        start_va = 0x1b6c0000
	          end_va = 0x1b7bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 2959
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 2960
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 2961
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 3347
	        start_va = 0x1b7a0000
	          end_va = 0x1b89ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b7a0000"
	        filename = ""

Region:
	              id = 3348
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 3349
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 3350
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 3675
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 3676
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 3796
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 3797
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 3798
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 3817
	        start_va = 0x1b7a0000
	          end_va = 0x1b89ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b7a0000"
	        filename = ""

Region:
	              id = 3818
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 3973
	        start_va = 0x1b6e0000
	          end_va = 0x1b7dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6e0000"
	        filename = ""

Region:
	              id = 3974
	        start_va = 0x1bad0000
	          end_va = 0x1bbf5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 3975
	        start_va = 0x1d530000
	          end_va = 0x1d643fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001d530000"
	        filename = ""

Region:
	              id = 4343
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 4344
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 4345
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 4346
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 4347
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 4348
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 4468
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 4469
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 4470
	        start_va = 0x1b6e0000
	          end_va = 0x1b7dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6e0000"
	        filename = ""

Region:
	              id = 4471
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 4641
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 4642
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 4807
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 4808
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 4832
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 4833
	        start_va = 0x1ce80000
	          end_va = 0x1cf7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ce80000"
	        filename = ""

Region:
	              id = 4834
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5007
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5008
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5053
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5054
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5055
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5056
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5332
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5333
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5379
	        start_va = 0x1bb10000
	          end_va = 0x1bc0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bb10000"
	        filename = ""

Region:
	              id = 5380
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5381
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5382
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5383
	        start_va = 0x1bad0000
	          end_va = 0x1bbcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5384
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5385
	        start_va = 0x1ce60000
	          end_va = 0x1cf5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001ce60000"
	        filename = ""

Region:
	              id = 5386
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5387
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5388
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5389
	        start_va = 0x1b760000
	          end_va = 0x1b85ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b760000"
	        filename = ""

Region:
	              id = 5390
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5510
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5511
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5668
	        start_va = 0x1b740000
	          end_va = 0x1b83ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b740000"
	        filename = ""

Region:
	              id = 5669
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5728
	        start_va = 0x1b780000
	          end_va = 0x1b87ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b780000"
	        filename = ""

Region:
	              id = 5729
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5734
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5735
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5736
	        start_va = 0x1bad0000
	          end_va = 0x1bbcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5737
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5738
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5739
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5740
	        start_va = 0x1b6e0000
	          end_va = 0x1b7dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6e0000"
	        filename = ""

Region:
	              id = 5741
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5742
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5743
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""

Region:
	              id = 5744
	        start_va = 0x1b6e0000
	          end_va = 0x1b7dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6e0000"
	        filename = ""

Region:
	              id = 5745
	        start_va = 0x7fffff0c000
	          end_va = 0x7fffff0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff0c000"
	        filename = ""

Region:
	              id = 5746
	        start_va = 0x1b6c0000
	          end_va = 0x1b7e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001b6c0000"
	        filename = ""

Region:
	              id = 5747
	        start_va = 0x1bad0000
	          end_va = 0x1bbe3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000001bad0000"
	        filename = ""


Thread:
	id = 1
	os_tid = 0x244

	[0024.974] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
	[0025.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe", nBufferLength=0x105, lpBuffer=0x20e090, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe", lpFilePart=0x0) returned 0x3a
	[0025.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe", nBufferLength=0x105, lpBuffer=0x20dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe", lpFilePart=0x0) returned 0x3a
	[0025.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x20dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
	[0025.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x20e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
	[0025.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x20dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
	[0025.713] GetVersionExW (in: lpVersionInformation=0x20e030*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x20e030*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0025.718] GetVersionExW (in: lpVersionInformation=0x20e030*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x20e030*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0028.081] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13b
	[0028.082] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc13d
	[0028.137] GetSystemMetrics (nIndex=75) returned 1
	[0028.201] AdjustWindowRectEx (in: lpRect=0x20dd80, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x20dd80) returned 1
	[0028.294] GetCurrentProcess () returned 0xffffffffffffffff
	[0028.294] GetCurrentThread () returned 0xfffffffffffffffe
	[0028.294] GetCurrentProcess () returned 0xffffffffffffffff
	[0028.296] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x20daf0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x20daf0*=0x17c) returned 1
	[0028.313] GetCurrentThreadId () returned 0x244
	[0028.380] lstrlenW (lpString="䅁") returned 1
	[0028.383] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77450000
	[0028.383] GetACP () returned 0x4e4
	[0028.410] CoTaskMemAlloc (cb=0x10) returned 0x340260
	[0028.410] GetProcAddress (hModule=0x77450000, lpProcName="DefWindowProcW") returned 0x7769b0ac
	[0028.411] CoTaskMemFree (pv=0x340260) 
	[0028.418] GetStockObject (i=5) returned 0x1900015
	[0028.420] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0028.422] CoTaskMemAlloc (cb=0x4c) returned 0x31bc00
	[0028.422] RegisterClassW (lpWndClass=0x20d7e0) returned 0xc13c
	[0028.422] CoTaskMemFree (pv=0x31bc00) 
	[0028.422] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0028.423] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x50128
	[0028.432] SetWindowLongPtrW (hWnd=0x50128, nIndex=-4, dwNewLong=0x7769b0ac) returned 0xba14bc
	[0028.436] GetWindowLongPtrW (hWnd=0x50128, nIndex=-4) returned 0x7769b0ac
	[0028.445] lstrlenW (lpString="䅁") returned 1
	[0028.448] GetVersionExW (in: lpVersionInformation=0x20b9c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x20b9c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0028.462] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x20ca78 | out: phkResult=0x20ca78*=0x184) returned 0x0
	[0028.464] RegQueryValueExW (in: hKey=0x184, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x20c9fc, lpData=0x0, lpcbData=0x20c9f8*=0x0 | out: lpType=0x20c9fc*=0x0, lpData=0x0, lpcbData=0x20c9f8*=0x0) returned 0x2
	[0028.465] RegQueryValueExW (in: hKey=0x184, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x20c9fc, lpData=0x0, lpcbData=0x20c9f8*=0x0 | out: lpType=0x20c9fc*=0x0, lpData=0x0, lpcbData=0x20c9f8*=0x0) returned 0x2
	[0028.466] RegCloseKey (hKey=0x184) returned 0x0
	[0028.469] SetWindowLongPtrW (hWnd=0x50128, nIndex=-4, dwNewLong=0xba150c) returned 0x7769b0ac
	[0028.469] GetWindowLongPtrW (hWnd=0x50128, nIndex=-4) returned 0xba150c
	[0028.469] GetWindowLongPtrW (hWnd=0x50128, nIndex=-16) returned 0x6c10000
	[0028.471] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc059
	[0028.472] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50128, Msg=0x24, wParam=0x0, lParam=0x20d220) returned 0x0
	[0028.472] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc139
	[0028.472] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50128, Msg=0x81, wParam=0x0, lParam=0x20d1a0) returned 0x1
	[0028.472] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50128, Msg=0x83, wParam=0x0, lParam=0x20d240) returned 0x0
	[0028.473] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50128, Msg=0x1, wParam=0x0, lParam=0x20d1a0) returned 0x0
	[0028.475] GetClientRect (in: hWnd=0x50128, lpRect=0x20c9f0 | out: lpRect=0x20c9f0) returned 1
	[0028.476] GetWindowRect (in: hWnd=0x50128, lpRect=0x20c9f0 | out: lpRect=0x20c9f0) returned 1
	[0028.484] GetParent (hWnd=0x50128) returned 0x0
	[0028.968] AdjustWindowRectEx (in: lpRect=0x20d080, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d080) returned 1
	[0028.991] GetSystemDefaultLCID () returned 0x409
	[0028.992] GetStockObject (i=17) returned 0x18a0025
	[0029.006] GetObjectW (in: h=0x18a0025, c=92, pv=0x20cc10 | out: pv=0x20cc10) returned 92
	[0029.008] GetDC (hWnd=0x0) returned 0x70107fc
	[0029.070] GetCurrentProcessId () returned 0x474
	[0029.074] FindAtomW (lpString="GDI+Atom_1140_1") returned 0x0
	[0029.074] AddAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0029.085] GdiplusStartup (in: token=0x20bb58, input=0x20bb70, output=0x20bb48 | out: token=0x20bb58, output=0x20bb48) returned 0x0
	[0029.091] GdipCreateFontFromLogfontW (hdc=0x70107fc, logfont=0x331ad8, font=0x20cc28) returned 0x0
	[0029.341] GdipGetFontUnit (font=0x1b3941a0, unit=0x20cb30) returned 0x0
	[0029.341] GdipGetFontSize (font=0x1b3941a0, size=0x20cb30) returned 0x0
	[0029.342] GdipGetFontStyle (font=0x1b3941a0, style=0x20cb30) returned 0x0
	[0029.342] GdipGetFamily (font=0x1b3941a0, family=0x20cb30) returned 0x0
	[0029.368] GdipGetFontSize (font=0x1b3941a0, size=0x20ca90) returned 0x0
	[0029.369] ReleaseDC (hWnd=0x0, hDC=0x70107fc) returned 1
	[0029.370] GetDC (hWnd=0x0) returned 0x4010280
	[0029.371] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20cbf0) returned 0x0
	[0029.373] GdipGetDpiY (graphics=0x1b3fd3c0, dpi=0x2630a38) returned 0x0
	[0029.374] GdipGetFontHeight (font=0x1b3941a0, graphics=0x1b3fd3c0, height=0x20cbc0) returned 0x0
	[0029.375] GdipGetEmHeight (family=0x1b39c5e0, style=0, EmHeight=0x20cbe0) returned 0x0
	[0029.375] GdipGetLineSpacing (family=0x1b39c5e0, style=0, LineSpacing=0x20cbe0) returned 0x0
	[0029.377] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0029.378] GdipDeleteGraphics (graphics=0x1b3fd3c0) returned 0x0
	[0029.378] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0029.379] GdipCreateFont (fontFamily=0x1b39c5e0, emSize=0x0, style=0, unit=0x3, font=0x20cc80) returned 0x0
	[0029.379] GdipGetFontSize (font=0x1b463a40, size=0x20cd10) returned 0x0
	[0029.383] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0029.383] GdipDeleteFont (font=0x1b3941a0) returned 0x0
	[0029.384] GetDC (hWnd=0x0) returned 0x4010280
	[0029.384] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20cd40) returned 0x0
	[0029.384] GdipGetFontHeight (font=0x1b463a40, graphics=0x1b3fd3c0, height=0x20cd10) returned 0x0
	[0029.384] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0029.384] GdipDeleteGraphics (graphics=0x1b3fd3c0) returned 0x0
	[0029.384] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0029.384] GetSystemMetrics (nIndex=5) returned 1
	[0029.384] GetSystemMetrics (nIndex=6) returned 1
	[0029.390] AdjustWindowRectEx (in: lpRect=0x20d080, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20d080) returned 1
	[0029.404] AdjustWindowRectEx (in: lpRect=0x20d080, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d080) returned 1
	[0029.416] AdjustWindowRectEx (in: lpRect=0x20d080, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d080) returned 1
	[0029.441] AdjustWindowRectEx (in: lpRect=0x20d040, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d040) returned 1
	[0029.474] AdjustWindowRectEx (in: lpRect=0x20d080, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d080) returned 1
	[0029.477] AdjustWindowRectEx (in: lpRect=0x20d080, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d080) returned 1
	[0029.482] AdjustWindowRectEx (in: lpRect=0x20d040, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d040) returned 1
	[0029.514] AdjustWindowRectEx (in: lpRect=0x20d080, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d080) returned 1
	[0029.538] AdjustWindowRectEx (in: lpRect=0x20d070, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20d070) returned 1
	[0029.591] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017
	[0029.591] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
	[0029.692] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0029.692] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0029.710] GdipGetFontSize (font=0x1b3941a0, size=0x20d110) returned 0x0
	[0029.726] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0029.760] GetProcessWindowStation () returned 0x44
	[0029.766] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x2633538, nLength=0xc, lpnLengthNeeded=0x20cb20 | out: pvInfo=0x2633538, lpnLengthNeeded=0x20cb20) returned 1
	[0029.769] SetConsoleCtrlHandler (HandlerRoutine=0xba159c, Add=1) returned 1
	[0029.770] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0029.770] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0029.771] GetClassInfoW (in: hInstance=0xcb0000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWndClass=0x26335c0 | out: lpWndClass=0x26335c0) returned 0
	[0029.773] CoTaskMemAlloc (cb=0x58) returned 0x31bc00
	[0029.773] RegisterClassW (lpWndClass=0x20ca40) returned 0xc137
	[0029.773] CoTaskMemFree (pv=0x31bc00) 
	[0029.774] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x301b8
	[0029.775] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x81, wParam=0x0, lParam=0x20c280) returned 0x1
	[0029.775] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x83, wParam=0x0, lParam=0x20c330) returned 0x0
	[0029.775] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1, wParam=0x0, lParam=0x20c220) returned 0x0
	[0029.775] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0
	[0029.775] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
	[0029.791] GetSysColor (nIndex=10) returned 0xb4b4b4
	[0029.791] GetSysColor (nIndex=2) returned 0xd1b499
	[0029.791] GetSysColor (nIndex=9) returned 0x0
	[0029.791] GetSysColor (nIndex=12) returned 0xababab
	[0029.791] GetSysColor (nIndex=15) returned 0xf0f0f0
	[0029.791] GetSysColor (nIndex=20) returned 0xffffff
	[0029.791] GetSysColor (nIndex=16) returned 0xa0a0a0
	[0029.791] GetSysColor (nIndex=15) returned 0xf0f0f0
	[0029.791] GetSysColor (nIndex=16) returned 0xa0a0a0
	[0029.791] GetSysColor (nIndex=21) returned 0x696969
	[0029.791] GetSysColor (nIndex=22) returned 0xe3e3e3
	[0029.791] GetSysColor (nIndex=20) returned 0xffffff
	[0029.792] GetSysColor (nIndex=18) returned 0x0
	[0029.792] GetSysColor (nIndex=1) returned 0x0
	[0029.792] GetSysColor (nIndex=27) returned 0xead1b9
	[0029.792] GetSysColor (nIndex=28) returned 0xf2e4d7
	[0029.792] GetSysColor (nIndex=17) returned 0x6d6d6d
	[0029.792] GetSysColor (nIndex=13) returned 0xff9933
	[0029.792] GetSysColor (nIndex=14) returned 0xffffff
	[0029.792] GetSysColor (nIndex=26) returned 0xcc6600
	[0029.792] GetSysColor (nIndex=11) returned 0xfcf7f4
	[0029.792] GetSysColor (nIndex=3) returned 0xdbcdbf
	[0029.792] GetSysColor (nIndex=19) returned 0x544e43
	[0029.792] GetSysColor (nIndex=24) returned 0xe1ffff
	[0029.792] GetSysColor (nIndex=23) returned 0x0
	[0029.792] GetSysColor (nIndex=4) returned 0xf0f0f0
	[0029.792] GetSysColor (nIndex=30) returned 0xf0f0f0
	[0029.792] GetSysColor (nIndex=29) returned 0xff9933
	[0029.792] GetSysColor (nIndex=7) returned 0x0
	[0029.792] GetSysColor (nIndex=0) returned 0xc8c8c8
	[0029.792] GetSysColor (nIndex=5) returned 0xffffff
	[0029.792] GetSysColor (nIndex=6) returned 0x646464
	[0029.792] GetSysColor (nIndex=8) returned 0x0
	[0029.795] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0029.803] GetSystemMetrics (nIndex=5) returned 1
	[0029.803] GetSystemMetrics (nIndex=6) returned 1
	[0029.803] AdjustWindowRectEx (in: lpRect=0x20cfc0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20cfc0) returned 1
	[0029.803] GetSystemMetrics (nIndex=5) returned 1
	[0029.803] GetSystemMetrics (nIndex=6) returned 1
	[0029.803] AdjustWindowRectEx (in: lpRect=0x20cfc0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20cfc0) returned 1
	[0029.811] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0029.812] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0029.812] GdipGetFontSize (font=0x1b3fd720, size=0x20d110) returned 0x0
	[0029.812] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0029.812] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0029.820] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0029.820] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0029.820] GdipGetFontSize (font=0x1b3fd760, size=0x20d110) returned 0x0
	[0029.820] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0029.820] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0029.928] OleCreatePictureIndirect () returned 0x0
	[0029.948] CoGetContextToken (in: pToken=0x20c540 | out: pToken=0x20c540) returned 0x0
	[0029.949] CoGetContextToken (in: pToken=0x20c4d0 | out: pToken=0x20c4d0) returned 0x0
	[0029.949] CObjectContext::QueryInterface () returned 0x0
	[0029.949] CObjectContext::GetCurrentApartmentType () returned 0x0
	[0029.949] Release () returned 0x0
	[0029.951] CoGetObjectContext (in: riid=0x7fef3a1d260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1afe7e38 | out: ppv=0x1afe7e38*=0x31ffa0) returned 0x0
	[0030.215] DllUnregisterServer () returned 0x80004005
	[0030.216] CoGetContextToken (in: pToken=0x20c510 | out: pToken=0x20c510) returned 0x0
	[0030.217] CoGetContextToken (in: pToken=0x20ca10 | out: pToken=0x20ca10) returned 0x0
	[0030.217] CoGetContextToken (in: pToken=0x20c950 | out: pToken=0x20c950) returned 0x0
	[0030.218] CoGetContextToken (in: pToken=0x20cc20 | out: pToken=0x20cc20) returned 0x0
	[0030.218] CoGetContextToken (in: pToken=0x20cb60 | out: pToken=0x20cb60) returned 0x0
	[0030.245] CoGetContextToken (in: pToken=0x20cdd0 | out: pToken=0x20cdd0) returned 0x0
	[0030.245] CoGetContextToken (in: pToken=0x20cd10 | out: pToken=0x20cd10) returned 0x0
	[0030.261] CoGetContextToken (in: pToken=0x20cdf0 | out: pToken=0x20cdf0) returned 0x0
	[0030.261] CoGetContextToken (in: pToken=0x20cd30 | out: pToken=0x20cd30) returned 0x0
	[0030.262] GetSystemMetrics (nIndex=13) returned 32
	[0030.262] GetSystemMetrics (nIndex=14) returned 32
	[0030.262] GetIconInfo (in: hIcon=0x80191, piconinfo=0x2635888 | out: piconinfo=0x2635888) returned 1
	[0030.262] GetObjectW (in: h=0x10050708, c=32, pv=0x26358b8 | out: pv=0x26358b8) returned 32
	[0030.263] DeleteObject (ho=0x10050708) returned 1
	[0030.263] CopyImage (h=0x80191, type=0x2, cx=32, cy=32, flags=0x0) returned 0xe00df
	[0030.266] CoGetContextToken (in: pToken=0x20cdc0 | out: pToken=0x20cdc0) returned 0x0
	[0030.266] IUnknown:Release (This=0x31ffa0) returned 0x0
	[0030.267] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0030.267] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0030.267] GdipGetFontSize (font=0x1b3fd7a0, size=0x20d110) returned 0x0
	[0030.268] AdjustWindowRectEx (in: lpRect=0x20cfc0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cfc0) returned 1
	[0030.269] AdjustWindowRectEx (in: lpRect=0x20cfc0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cfc0) returned 1
	[0030.280] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0030.281] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0030.281] GdipGetFontSize (font=0x1b3fd7e0, size=0x20d110) returned 0x0
	[0030.281] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0030.282] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0030.288] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0030.288] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0030.288] GdipGetFontSize (font=0x1b40c310, size=0x20d110) returned 0x0
	[0030.288] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0030.289] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0030.295] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0030.295] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0030.295] GdipGetFontSize (font=0x1b40c350, size=0x20d110) returned 0x0
	[0030.295] AdjustWindowRectEx (in: lpRect=0x20cfc0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cfc0) returned 1
	[0030.296] AdjustWindowRectEx (in: lpRect=0x20cfc0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cfc0) returned 1
	[0030.301] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20d0e0) returned 0x0
	[0030.302] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20d080) returned 0x0
	[0030.302] GdipGetFontSize (font=0x1b49ef90, size=0x20d110) returned 0x0
	[0030.302] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0030.302] AdjustWindowRectEx (in: lpRect=0x20cf40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cf40) returned 1
	[0030.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.config", nBufferLength=0x105, lpBuffer=0x20cb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.config", lpFilePart=0x0) returned 0x3d
	[0030.500] SetErrorMode (uMode=0x1) returned 0x0
	[0030.501] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\boom ransomeware.config"), fInfoLevelId=0x0, lpFileInformation=0x20cd80 | out: lpFileInformation=0x20cd80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0030.501] SetErrorMode (uMode=0x0) returned 0x1
	[0030.778] GdipLoadImageFromStream (stream=0x25ffa0, image=0x20c1d8) returned 0x0
	[0030.946] GdipImageForceValidation (image=0x1b494c00) returned 0x0
	[0030.959] GdipGetImageType (image=0x1b494c00, type=0x20c1f0) returned 0x0
	[0030.960] GdipGetImageRawFormat (image=0x1b494c00, format=0x20c090*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
	[0030.982] AdjustWindowRectEx (in: lpRect=0x20cfc0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cfc0) returned 1
	[0031.013] AdjustWindowRectEx (in: lpRect=0x20d030, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x20d030) returned 1
	[0031.014] GetSystemMetrics (nIndex=59) returned 1460
	[0031.014] GetSystemMetrics (nIndex=60) returned 920
	[0031.014] GetSystemMetrics (nIndex=34) returned 132
	[0031.014] GetSystemMetrics (nIndex=35) returned 38
	[0031.014] AdjustWindowRectEx (in: lpRect=0x20ccb0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x20ccb0) returned 1
	[0031.015] GetCurrentThreadId () returned 0x244
	[0031.015] GetCurrentThreadId () returned 0x244
	[0031.025] CreateCompatibleDC (hdc=0x0) returned 0x601081a
	[0031.027] GetCurrentObject (hdc=0x601081a, type=0x1) returned 0x1b00017
	[0031.027] GetCurrentObject (hdc=0x601081a, type=0x2) returned 0x1900010
	[0031.027] GetCurrentObject (hdc=0x601081a, type=0x7) returned 0x185000f
	[0031.027] GetCurrentObject (hdc=0x601081a, type=0x6) returned 0x18a002e
	[0031.044] SaveDC (hdc=0x601081a) returned 1
	[0031.044] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cdb0) returned 0x0
	[0031.046] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cd70) returned 0x0
	[0031.047] GdipSetStringFormatAlign (format=0x1b40c4a0, align=0x0) returned 0x0
	[0031.047] GdipSetStringFormatLineAlign (format=0x1b40c4a0, align=0x0) returned 0x0
	[0031.048] GdipSetStringFormatHotkeyPrefix (format=0x1b40c4a0, hotkeyPrefix=1) returned 0x0
	[0031.053] GdipGetStringFormatFlags (format=0x1b40c4a0, flags=0x20cd90) returned 0x0
	[0031.054] GdipSetStringFormatFlags (format=0x1b40c4a0, flags=2048) returned 0x0
	[0031.055] GdipMeasureString (graphics=0x1b495d70, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20ccd8, stringFormat=0x1b40c4a0, boundingBox=0x20ccc8, codepointsFitted=0x20ccc4, linesFilled=0x20ccc0) returned 0x0
	[0031.081] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.081] GdipDeleteStringFormat (format=0x1b40c4a0) returned 0x0
	[0031.081] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.081] GdipDeleteGraphics (graphics=0x1b495d70) returned 0x0
	[0031.081] AdjustWindowRectEx (in: lpRect=0x20ccd0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20ccd0) returned 1
	[0031.097] GetCurrentThreadId () returned 0x244
	[0031.097] GetCurrentThreadId () returned 0x244
	[0031.098] GetCurrentThreadId () returned 0x244
	[0031.098] GetCurrentThreadId () returned 0x244
	[0031.099] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cdb0) returned 0x0
	[0031.099] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cd70) returned 0x0
	[0031.099] GdipSetStringFormatAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.099] GdipSetStringFormatLineAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.099] GdipSetStringFormatHotkeyPrefix (format=0x1b498380, hotkeyPrefix=1) returned 0x0
	[0031.099] GdipGetStringFormatFlags (format=0x1b498380, flags=0x20cd90) returned 0x0
	[0031.099] GdipSetStringFormatFlags (format=0x1b498380, flags=2048) returned 0x0
	[0031.099] GdipMeasureString (graphics=0x1b496c60, string="You", length=3, font=0x1b40c310, layoutRect=0x20ccd8, stringFormat=0x1b498380, boundingBox=0x20ccc8, codepointsFitted=0x20ccc4, linesFilled=0x20ccc0) returned 0x0
	[0031.099] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.099] GdipDeleteStringFormat (format=0x1b498380) returned 0x0
	[0031.099] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.099] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.099] AdjustWindowRectEx (in: lpRect=0x20ccd0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20ccd0) returned 1
	[0031.099] GetCurrentThreadId () returned 0x244
	[0031.099] GetCurrentThreadId () returned 0x244
	[0031.099] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cdb0) returned 0x0
	[0031.099] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cd70) returned 0x0
	[0031.099] GdipSetStringFormatAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.099] GdipSetStringFormatLineAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.099] GdipSetStringFormatHotkeyPrefix (format=0x1b498380, hotkeyPrefix=1) returned 0x0
	[0031.099] GdipGetStringFormatFlags (format=0x1b498380, flags=0x20cd90) returned 0x0
	[0031.100] GdipSetStringFormatFlags (format=0x1b498380, flags=2048) returned 0x0
	[0031.100] GdipMeasureString (graphics=0x1b496c60, string="Welcome", length=7, font=0x1b3fd7e0, layoutRect=0x20ccd8, stringFormat=0x1b498380, boundingBox=0x20ccc8, codepointsFitted=0x20ccc4, linesFilled=0x20ccc0) returned 0x0
	[0031.100] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.100] GdipDeleteStringFormat (format=0x1b498380) returned 0x0
	[0031.100] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.100] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.100] AdjustWindowRectEx (in: lpRect=0x20ccd0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20ccd0) returned 1
	[0031.100] GetCurrentThreadId () returned 0x244
	[0031.100] GetCurrentThreadId () returned 0x244
	[0031.100] GetCurrentThreadId () returned 0x244
	[0031.100] GetCurrentThreadId () returned 0x244
	[0031.100] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cdb0) returned 0x0
	[0031.100] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cd70) returned 0x0
	[0031.100] GdipSetStringFormatAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.100] GdipSetStringFormatLineAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.100] GdipSetStringFormatHotkeyPrefix (format=0x1b498380, hotkeyPrefix=1) returned 0x0
	[0031.100] GdipGetStringFormatFlags (format=0x1b498380, flags=0x20cd90) returned 0x0
	[0031.100] GdipSetStringFormatFlags (format=0x1b498380, flags=2048) returned 0x0
	[0031.100] GdipMeasureString (graphics=0x1b496c60, string="Enter the pin to extract the password", length=37, font=0x1b3fd760, layoutRect=0x20ccd8, stringFormat=0x1b498380, boundingBox=0x20ccc8, codepointsFitted=0x20ccc4, linesFilled=0x20ccc0) returned 0x0
	[0031.100] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.100] GdipDeleteStringFormat (format=0x1b498380) returned 0x0
	[0031.100] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.101] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.101] AdjustWindowRectEx (in: lpRect=0x20ccd0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20ccd0) returned 1
	[0031.101] GetCurrentThreadId () returned 0x244
	[0031.101] GetCurrentThreadId () returned 0x244
	[0031.101] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cdb0) returned 0x0
	[0031.101] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cd70) returned 0x0
	[0031.101] GdipSetStringFormatAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.101] GdipSetStringFormatLineAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.101] GdipSetStringFormatHotkeyPrefix (format=0x1b498380, hotkeyPrefix=1) returned 0x0
	[0031.101] GdipGetStringFormatFlags (format=0x1b498380, flags=0x20cd90) returned 0x0
	[0031.101] GdipSetStringFormatFlags (format=0x1b498380, flags=2048) returned 0x0
	[0031.101] GdipMeasureString (graphics=0x1b496c60, string="Oooooooops  \r\nAll your Files have Been Encrypted\r\nTo Decrypt the\r\nEncryption enter PIN\r\nWe will Extract your password on your Desktop", length=133, font=0x1b3fd720, layoutRect=0x20ccd8, stringFormat=0x1b498380, boundingBox=0x20ccc8, codepointsFitted=0x20ccc4, linesFilled=0x20ccc0) returned 0x0
	[0031.101] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.101] GdipDeleteStringFormat (format=0x1b498380) returned 0x0
	[0031.101] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.101] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.101] AdjustWindowRectEx (in: lpRect=0x20ccd0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20ccd0) returned 1
	[0031.101] GetCurrentThreadId () returned 0x244
	[0031.101] GetCurrentThreadId () returned 0x244
	[0031.103] GetCurrentThreadId () returned 0x244
	[0031.103] GetCurrentThreadId () returned 0x244
	[0031.103] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cdb0) returned 0x0
	[0031.103] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cd70) returned 0x0
	[0031.103] GdipSetStringFormatAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.103] GdipSetStringFormatLineAlign (format=0x1b498380, align=0x0) returned 0x0
	[0031.103] GdipSetStringFormatHotkeyPrefix (format=0x1b498380, hotkeyPrefix=1) returned 0x0
	[0031.103] GdipGetStringFormatFlags (format=0x1b498380, flags=0x20cd90) returned 0x0
	[0031.103] GdipSetStringFormatFlags (format=0x1b498380, flags=2048) returned 0x0
	[0031.103] GdipMeasureString (graphics=0x1b496c60, string="in BooM Ransomeware", length=19, font=0x1b3941a0, layoutRect=0x20ccd8, stringFormat=0x1b498380, boundingBox=0x20ccc8, codepointsFitted=0x20ccc4, linesFilled=0x20ccc0) returned 0x0
	[0031.103] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.103] GdipDeleteStringFormat (format=0x1b498380) returned 0x0
	[0031.103] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.103] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.103] AdjustWindowRectEx (in: lpRect=0x20ccd0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20ccd0) returned 1
	[0031.103] GetCurrentThreadId () returned 0x244
	[0031.103] GetCurrentThreadId () returned 0x244
	[0031.114] CreateCompatibleDC (hdc=0x0) returned 0x18010806
	[0031.116] GetDC (hWnd=0x0) returned 0x4010280
	[0031.116] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20cbe0) returned 0x0
	[0031.117] GdipGetLogFontW (font=0x1b463a40, graphics=0x1b496c60, logfontW=0x331ad8) returned 0x0
	[0031.117] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.118] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.118] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0031.118] CreateFontIndirectW (lplf=0x331ad8) returned 0x30a0817
	[0031.119] SelectObject (hdc=0x18010806, h=0x30a0817) returned 0x18a002e
	[0031.119] GetTextMetricsW (in: hdc=0x18010806, lptm=0x20cd80 | out: lptm=0x20cd80) returned 1
	[0031.120] GetTextExtentPoint32W (in: hdc=0x18010806, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2686ed0 | out: psizl=0x2686ed0) returned 1
	[0031.121] SelectObject (hdc=0x18010806, h=0x18a002e) returned 0x30a0817
	[0031.122] DeleteDC (hdc=0x18010806) returned 1
	[0031.128] AdjustWindowRectEx (in: lpRect=0x20cbc0, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20cbc0) returned 1
	[0031.131] GetCursorPos (in: lpPoint=0x2686f08 | out: lpPoint=0x2686f08*(x=685, y=817)) returned 1
	[0031.131] GetSystemMetrics (nIndex=80) returned 1
	[0031.163] MonitorFromPoint (pt=0x331000002ad, dwFlags=0x2) returned 0x10001
	[0031.173] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20ca10 | out: lpmi=0x20ca10) returned 1
	[0031.173] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1a010806
	[0031.174] GetDeviceCaps (hdc=0x1a010806, index=12) returned 32
	[0031.174] GetDeviceCaps (hdc=0x1a010806, index=14) returned 1
	[0031.174] DeleteDC (hdc=0x1a010806) returned 1
	[0031.174] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20cb10 | out: lpmi=0x20cb10) returned 1
	[0031.174] AdjustWindowRectEx (in: lpRect=0x20cd90, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20cd90) returned 1
	[0031.175] AdjustWindowRectEx (in: lpRect=0x20ca50, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20ca50) returned 1
	[0031.175] GetCursorPos (in: lpPoint=0x2687368 | out: lpPoint=0x2687368*(x=685, y=817)) returned 1
	[0031.176] MonitorFromPoint (pt=0x332000002ab, dwFlags=0x2) returned 0x10001
	[0031.176] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20c8a0 | out: lpmi=0x20c8a0) returned 1
	[0031.176] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1b010806
	[0031.176] GetDeviceCaps (hdc=0x1b010806, index=12) returned 32
	[0031.176] GetDeviceCaps (hdc=0x1b010806, index=14) returned 1
	[0031.176] DeleteDC (hdc=0x1b010806) returned 1
	[0031.176] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20c9a0 | out: lpmi=0x20c9a0) returned 1
	[0031.176] AdjustWindowRectEx (in: lpRect=0x20cc20, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20cc20) returned 1
	[0031.177] GetSystemMetrics (nIndex=34) returned 132
	[0031.177] GetSystemMetrics (nIndex=35) returned 38
	[0031.179] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.179] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.179] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cac0) returned 0x0
	[0031.179] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca80) returned 0x0
	[0031.180] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.180] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.180] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0031.180] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20caa0) returned 0x0
	[0031.180] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0031.180] GdipMeasureString (graphics=0x1b496c60, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20c9e8, stringFormat=0x1b912930, boundingBox=0x20c9d8, codepointsFitted=0x20c9d4, linesFilled=0x20c9d0) returned 0x0
	[0031.180] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.180] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0031.180] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.180] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.180] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.180] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.180] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.180] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.180] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cac0) returned 0x0
	[0031.180] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca80) returned 0x0
	[0031.181] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.181] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.181] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0031.181] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20caa0) returned 0x0
	[0031.181] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0031.181] GdipMeasureString (graphics=0x1b496c60, string="You", length=3, font=0x1b40c310, layoutRect=0x20c9e8, stringFormat=0x1b912930, boundingBox=0x20c9d8, codepointsFitted=0x20c9d4, linesFilled=0x20c9d0) returned 0x0
	[0031.181] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.181] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0031.181] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.181] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.181] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.181] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.181] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cac0) returned 0x0
	[0031.181] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca80) returned 0x0
	[0031.181] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.181] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.181] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0031.181] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20caa0) returned 0x0
	[0031.181] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0031.181] GdipMeasureString (graphics=0x1b496c60, string="Welcome", length=7, font=0x1b3fd7e0, layoutRect=0x20c9e8, stringFormat=0x1b912930, boundingBox=0x20c9d8, codepointsFitted=0x20c9d4, linesFilled=0x20c9d0) returned 0x0
	[0031.182] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.182] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0031.182] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.182] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.182] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.182] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.182] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.182] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.182] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cac0) returned 0x0
	[0031.182] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca80) returned 0x0
	[0031.182] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.182] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.182] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0031.182] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20caa0) returned 0x0
	[0031.182] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0031.182] GdipMeasureString (graphics=0x1b496c60, string="Enter the pin to extract the password", length=37, font=0x1b3fd760, layoutRect=0x20c9e8, stringFormat=0x1b912930, boundingBox=0x20c9d8, codepointsFitted=0x20c9d4, linesFilled=0x20c9d0) returned 0x0
	[0031.182] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.182] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0031.182] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.182] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.183] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.183] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.183] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cac0) returned 0x0
	[0031.183] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca80) returned 0x0
	[0031.183] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.183] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.183] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0031.183] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20caa0) returned 0x0
	[0031.183] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0031.183] GdipMeasureString (graphics=0x1b496c60, string="Oooooooops  \r\nAll your Files have Been Encrypted\r\nTo Decrypt the\r\nEncryption enter PIN\r\nWe will Extract your password on your Desktop", length=133, font=0x1b3fd720, layoutRect=0x20c9e8, stringFormat=0x1b912930, boundingBox=0x20c9d8, codepointsFitted=0x20c9d4, linesFilled=0x20c9d0) returned 0x0
	[0031.184] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.184] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0031.184] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.184] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.184] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20cd30) returned 1
	[0031.184] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20cc50) returned 1
	[0031.184] GetSystemMetrics (nIndex=5) returned 1
	[0031.184] GetSystemMetrics (nIndex=6) returned 1
	[0031.184] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.184] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.184] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20cac0) returned 0x0
	[0031.184] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca80) returned 0x0
	[0031.184] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.184] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0031.184] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0031.184] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20caa0) returned 0x0
	[0031.184] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0031.184] GdipMeasureString (graphics=0x1b496c60, string="in BooM Ransomeware", length=19, font=0x1b3941a0, layoutRect=0x20c9e8, stringFormat=0x1b912930, boundingBox=0x20c9d8, codepointsFitted=0x20c9d4, linesFilled=0x20c9d0) returned 0x0
	[0031.184] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.184] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0031.184] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0031.185] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0031.185] AdjustWindowRectEx (in: lpRect=0x20cd30, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cd30) returned 1
	[0031.185] AdjustWindowRectEx (in: lpRect=0x20cc50, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20cc50) returned 1
	[0031.195] AdjustWindowRectEx (in: lpRect=0x20e310, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20e310) returned 1
	[0031.195] GetCursorPos (in: lpPoint=0x2687da0 | out: lpPoint=0x2687da0*(x=685, y=817)) returned 1
	[0031.195] MonitorFromPoint (pt=0x331000002ad, dwFlags=0x2) returned 0x10001
	[0031.195] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20e160 | out: lpmi=0x20e160) returned 1
	[0031.195] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x22010806
	[0031.195] GetDeviceCaps (hdc=0x22010806, index=12) returned 32
	[0031.195] GetDeviceCaps (hdc=0x22010806, index=14) returned 1
	[0031.195] DeleteDC (hdc=0x22010806) returned 1
	[0031.196] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20e260 | out: lpmi=0x20e260) returned 1
	[0031.196] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.196] CreateWindowExW (dwExStyle=0x10001, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName="Boom Ransomeware", dwStyle=0x2cc0000, X=383, Y=183, nWidth=674, nHeight=494, hWndParent=0x0, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x50120
	[0031.196] SetWindowLongPtrW (hWnd=0x50120, nIndex=-4, dwNewLong=0x7769b0ac) returned 0xba14bc
	[0031.197] GetWindowLongPtrW (hWnd=0x50120, nIndex=-4) returned 0x7769b0ac
	[0031.197] SetWindowLongPtrW (hWnd=0x50120, nIndex=-4, dwNewLong=0xbb320c) returned 0x7769b0ac
	[0031.197] GetWindowLongPtrW (hWnd=0x50120, nIndex=-4) returned 0xbb320c
	[0031.197] GetWindowLongPtrW (hWnd=0x50120, nIndex=-16) returned 0x6cc0000
	[0031.200] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x81, wParam=0x0, lParam=0x20db00) returned 0x1
	[0031.200] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x83, wParam=0x0, lParam=0x20dba0) returned 0x0
	[0031.284] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1, wParam=0x0, lParam=0x20dad0) returned 0x0
	[0031.284] GetClientRect (in: hWnd=0x50120, lpRect=0x20d2e0 | out: lpRect=0x20d2e0) returned 1
	[0031.284] GetWindowRect (in: hWnd=0x50120, lpRect=0x20d2e0 | out: lpRect=0x20d2e0) returned 1
	[0031.285] SetWindowTextW (hWnd=0x50120, lpString="Boom Ransomeware") returned 1
	[0031.285] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xc, wParam=0x0, lParam=0x2685bd8) returned 0x1
	[0031.288] GetStartupInfoW (in: lpStartupInfo=0x2688228 | out: lpStartupInfo=0x2688228*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0031.288] GetParent (hWnd=0x50120) returned 0x0
	[0031.289] GetStockObject (i=5) returned 0x1900015
	[0031.289] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.290] CoTaskMemAlloc (cb=0x4c) returned 0x31c7a0
	[0031.290] RegisterClassW (lpWndClass=0x20e110) returned 0xc136
	[0031.290] CoTaskMemFree (pv=0x31c7a0) 
	[0031.290] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.290] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.378734a", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x301a2
	[0031.290] SetWindowLongPtrW (hWnd=0x301a2, nIndex=-4, dwNewLong=0x7769b0ac) returned 0xbb325c
	[0031.290] GetWindowLongPtrW (hWnd=0x301a2, nIndex=-4) returned 0x7769b0ac
	[0031.290] SetWindowLongPtrW (hWnd=0x301a2, nIndex=-4, dwNewLong=0xbb32ac) returned 0x7769b0ac
	[0031.290] GetWindowLongPtrW (hWnd=0x301a2, nIndex=-4) returned 0xbb32ac
	[0031.290] GetWindowLongPtrW (hWnd=0x301a2, nIndex=-16) returned 0x4c00000
	[0031.290] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x24, wParam=0x0, lParam=0x20db50) returned 0x0
	[0031.290] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x81, wParam=0x0, lParam=0x20dad0) returned 0x1
	[0031.290] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x83, wParam=0x0, lParam=0x20db70) returned 0x0
	[0031.290] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1, wParam=0x0, lParam=0x20dad0) returned 0x0
	[0031.291] SetWindowLongPtrW (hWnd=0x50120, nIndex=-8, dwNewLong=0x301a2) returned 0x0
	[0031.291] SendMessageW (hWnd=0x50120, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
	[0031.291] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
	[0031.291] SendMessageW (hWnd=0x50120, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
	[0031.291] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
	[0031.298] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0031.298] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0031.298] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0031.300] GetSystemMenu (hWnd=0x50120, bRevert=0) returned 0xd01a5
	[0031.301] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20e320 | out: lpwndpl=0x20e320) returned 1
	[0031.301] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf020, uEnable=0x1) returned 0
	[0031.301] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf030, uEnable=0x1) returned 0
	[0031.301] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf060, uEnable=0x0) returned 0
	[0031.301] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf120, uEnable=0x1) returned 0
	[0031.301] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf000, uEnable=0x0) returned 0
	[0031.302] GetClientRect (in: hWnd=0x50120, lpRect=0x20e440 | out: lpRect=0x20e440) returned 1
	[0031.302] GetClientRect (in: hWnd=0x50120, lpRect=0x20e320 | out: lpRect=0x20e320) returned 1
	[0031.302] GetWindowRect (in: hWnd=0x50120, lpRect=0x20e320 | out: lpRect=0x20e320) returned 1
	[0031.302] SetWindowLongPtrW (hWnd=0x50120, nIndex=-8, dwNewLong=0x301a2) returned 0x301a2
	[0031.317] GetSystemMetrics (nIndex=11) returned 32
	[0031.317] GetSystemMetrics (nIndex=12) returned 32
	[0031.317] GetDC (hWnd=0x0) returned 0x4010280
	[0031.318] GetDeviceCaps (hdc=0x4010280, index=12) returned 32
	[0031.318] GetDeviceCaps (hdc=0x4010280, index=14) returned 1
	[0031.318] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0031.318] CreateIconFromResourceEx (presbits=0x268b068, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x401a3
	[0031.319] SendMessageW (hWnd=0x301a2, Msg=0x80, wParam=0x1, lParam=0x401a3) returned 0x0
	[0031.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x80, wParam=0x1, lParam=0x401a3) returned 0x0
	[0031.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b134850) returned 0x0
	[0031.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b134850) returned 0x0
	[0031.320] GetWindowLongPtrW (hWnd=0x50120, nIndex=-16) returned 0x6cc0000
	[0031.320] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0031.320] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0031.320] GetSystemMetrics (nIndex=42) returned 0
	[0031.321] CoTaskMemAlloc (cb=0x26) returned 0x1b003060
	[0031.321] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b003060, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0031.321] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b003060) returned 0x10
	[0031.321] CoTaskMemFree (pv=0x1b003060) 
	[0031.321] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0031.321] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0031.321] GetSystemMetrics (nIndex=42) returned 0
	[0031.321] CoTaskMemAlloc (cb=0x26) returned 0x1b003060
	[0031.322] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b003060, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0031.322] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b003060) returned 0x10
	[0031.322] CoTaskMemFree (pv=0x1b003060) 
	[0031.322] GetCursorPos (in: lpPoint=0x268c220 | out: lpPoint=0x268c220*(x=685, y=817)) returned 1
	[0031.322] MonitorFromPoint (pt=0x332000002af, dwFlags=0x2) returned 0x10001
	[0031.322] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20e190 | out: lpmi=0x20e190) returned 1
	[0031.322] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x3801022c
	[0031.322] GetDeviceCaps (hdc=0x3801022c, index=12) returned 32
	[0031.322] GetDeviceCaps (hdc=0x3801022c, index=14) returned 1
	[0031.322] DeleteDC (hdc=0x3801022c) returned 1
	[0031.322] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20e290 | out: lpmi=0x20e290) returned 1
	[0031.322] GetWindowLongPtrW (hWnd=0x50120, nIndex=-16) returned 0x6cc0000
	[0031.322] GetWindowLongPtrW (hWnd=0x50120, nIndex=-20) returned 0x10101
	[0031.322] SetWindowLongPtrW (hWnd=0x50120, nIndex=-16, dwNewLong=0x2cc0000) returned 0x6cc0000
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x20e360) returned 0x0
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x20e360) returned 0x0
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0031.323] SetWindowLongPtrW (hWnd=0x50120, nIndex=-20, dwNewLong=0x10001) returned 0x10101
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x20e360) returned 0x0
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x20e360) returned 0x0
	[0031.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0031.324] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0031.324] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0031.324] SetWindowPos (hWnd=0x50120, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
	[0031.324] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e400) returned 0x0
	[0031.324] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x83, wParam=0x1, lParam=0x20e3d0) returned 0x0
	[0031.325] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20de60 | out: lpwndpl=0x20de60) returned 1
	[0031.325] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e400) returned 0x0
	[0031.325] GetClientRect (in: hWnd=0x50120, lpRect=0x20dc00 | out: lpRect=0x20dc00) returned 1
	[0031.325] GetWindowRect (in: hWnd=0x50120, lpRect=0x20dc00 | out: lpRect=0x20dc00) returned 1
	[0031.326] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0031.326] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0031.326] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0031.326] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x83, wParam=0x1, lParam=0x20dd60) returned 0x0
	[0031.327] RedrawWindow (hWnd=0x50120, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0031.327] GetSystemMenu (hWnd=0x50120, bRevert=0) returned 0xd01a5
	[0031.327] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20e320 | out: lpwndpl=0x20e320) returned 1
	[0031.327] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf020, uEnable=0x1) returned 1
	[0031.327] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf030, uEnable=0x1) returned 1
	[0031.327] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf060, uEnable=0x0) returned 0
	[0031.327] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf120, uEnable=0x1) returned 1
	[0031.327] EnableMenuItem (hMenu=0xd01a5, uIDEnableItem=0xf000, uEnable=0x0) returned 0
	[0031.328] ShowWindow (hWnd=0x50120, nCmdShow=5) returned 1
	[0031.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.328] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x268c658 | out: lpWndClass=0x268c658) returned 1
	[0031.329] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.329] CoTaskMemAlloc (cb=0x48) returned 0x1affdec0
	[0031.329] RegisterClassW (lpWndClass=0x20d9e0) returned 0xc135
	[0031.329] CoTaskMemFree (pv=0x1affdec0) 
	[0031.329] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.329] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", dwStyle=0x5600000d, X=12, Y=314, nWidth=310, nHeight=83, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x401a4
	[0031.329] SetWindowLongPtrW (hWnd=0x401a4, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0031.329] GetWindowLongPtrW (hWnd=0x401a4, nIndex=-4) returned 0x776f826c
	[0031.329] SetWindowLongPtrW (hWnd=0x401a4, nIndex=-4, dwNewLong=0xbb334c) returned 0x776f826c
	[0031.329] GetWindowLongPtrW (hWnd=0x401a4, nIndex=-4) returned 0xbb334c
	[0031.329] GetWindowLongPtrW (hWnd=0x401a4, nIndex=-16) returned 0x4600000d
	[0031.329] GetWindowLongPtrW (hWnd=0x401a4, nIndex=-12) returned 0x0
	[0031.329] SetWindowLongPtrW (hWnd=0x401a4, nIndex=-12, dwNewLong=0x401a4) returned 0x0
	[0031.329] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.337] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.337] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x1, wParam=0x0, lParam=0x20d2a0) returned 0x0
	[0031.337] GetWindow (hWnd=0x401a4, uCmd=0x3) returned 0x0
	[0031.337] GetClientRect (in: hWnd=0x401a4, lpRect=0x20ca40 | out: lpRect=0x20ca40) returned 1
	[0031.337] GetWindowRect (in: hWnd=0x401a4, lpRect=0x20ca40 | out: lpRect=0x20ca40) returned 1
	[0031.337] GetParent (hWnd=0x401a4) returned 0x50120
	[0031.337] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20ca30, cPoints=0x2 | out: lpPoints=0x20ca30) returned -13894023
	[0031.338] SetWindowTextW (hWnd=0x401a4, lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 1
	[0031.338] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xc, wParam=0x0, lParam=0x2637be8) returned 0x1
	[0031.339] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x5, wParam=0x0, lParam=0x530136) returned 0x0
	[0031.339] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x3, wParam=0x0, lParam=0x13a000c) returned 0x0
	[0031.339] GetClientRect (in: hWnd=0x401a4, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.339] GetWindowRect (in: hWnd=0x401a4, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.339] GetParent (hWnd=0x401a4) returned 0x50120
	[0031.339] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.340] SendMessageW (hWnd=0x401a4, Msg=0x2210, wParam=0x1a40001, lParam=0x401a4) returned 0x0
	[0031.340] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x2210, wParam=0x1a40001, lParam=0x401a4) returned 0x0
	[0031.340] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.340] GetParent (hWnd=0x401a4) returned 0x50120
	[0031.340] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x268c9d0 | out: lpWndClass=0x268c9d0) returned 1
	[0031.340] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.341] CoTaskMemAlloc (cb=0x48) returned 0x1affdec0
	[0031.341] RegisterClassW (lpWndClass=0x20d9e0) returned 0xc134
	[0031.341] CoTaskMemFree (pv=0x1affdec0) 
	[0031.341] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.341] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.378734a", lpWindowName="Get PIN", dwStyle=0x5601000b, X=12, Y=403, nWidth=128, nHeight=41, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x401b4
	[0031.341] SetWindowLongPtrW (hWnd=0x401b4, nIndex=-4, dwNewLong=0x776f819c) returned 0xbb339c
	[0031.341] GetWindowLongPtrW (hWnd=0x401b4, nIndex=-4) returned 0x776f819c
	[0031.341] SetWindowLongPtrW (hWnd=0x401b4, nIndex=-4, dwNewLong=0xbb33ec) returned 0x776f819c
	[0031.341] GetWindowLongPtrW (hWnd=0x401b4, nIndex=-4) returned 0xbb33ec
	[0031.341] GetWindowLongPtrW (hWnd=0x401b4, nIndex=-16) returned 0x4601000b
	[0031.341] GetWindowLongPtrW (hWnd=0x401b4, nIndex=-12) returned 0x0
	[0031.341] SetWindowLongPtrW (hWnd=0x401b4, nIndex=-12, dwNewLong=0x401b4) returned 0x0
	[0031.341] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.341] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.342] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x1, wParam=0x0, lParam=0x20d380) returned 0x0
	[0031.342] GetWindow (hWnd=0x401b4, uCmd=0x3) returned 0x401a4
	[0031.342] GetClientRect (in: hWnd=0x401b4, lpRect=0x20cb20 | out: lpRect=0x20cb20) returned 1
	[0031.342] GetWindowRect (in: hWnd=0x401b4, lpRect=0x20cb20 | out: lpRect=0x20cb20) returned 1
	[0031.342] GetParent (hWnd=0x401b4) returned 0x50120
	[0031.342] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cb10, cPoints=0x2 | out: lpPoints=0x20cb10) returned -13894023
	[0031.342] SetWindowTextW (hWnd=0x401b4, lpString="Get PIN") returned 1
	[0031.342] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc, wParam=0x0, lParam=0x2637400) returned 0x1
	[0031.342] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x5, wParam=0x0, lParam=0x290080) returned 0x0
	[0031.342] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x3, wParam=0x0, lParam=0x193000c) returned 0x0
	[0031.342] GetClientRect (in: hWnd=0x401b4, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.342] GetWindowRect (in: hWnd=0x401b4, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.342] GetParent (hWnd=0x401b4) returned 0x50120
	[0031.342] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.342] SendMessageW (hWnd=0x401b4, Msg=0x2210, wParam=0x1b40001, lParam=0x401b4) returned 0x0
	[0031.342] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2210, wParam=0x1b40001, lParam=0x401b4) returned 0x0
	[0031.342] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.342] GetParent (hWnd=0x401b4) returned 0x50120
	[0031.343] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.343] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="You", dwStyle=0x5600000d, X=410, Y=34, nWidth=45, nHeight=29, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x301b6
	[0031.343] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0031.343] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-4) returned 0x776f826c
	[0031.343] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-4, dwNewLong=0xbb343c) returned 0x776f826c
	[0031.343] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-4) returned 0xbb343c
	[0031.343] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-16) returned 0x4600000d
	[0031.343] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-12) returned 0x0
	[0031.343] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-12, dwNewLong=0x301b6) returned 0x0
	[0031.343] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.343] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.343] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x1, wParam=0x0, lParam=0x20d390) returned 0x0
	[0031.343] GetWindow (hWnd=0x301b6, uCmd=0x3) returned 0x401b4
	[0031.343] GetClientRect (in: hWnd=0x301b6, lpRect=0x20cb30 | out: lpRect=0x20cb30) returned 1
	[0031.343] GetWindowRect (in: hWnd=0x301b6, lpRect=0x20cb30 | out: lpRect=0x20cb30) returned 1
	[0031.343] GetParent (hWnd=0x301b6) returned 0x50120
	[0031.343] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cb20, cPoints=0x2 | out: lpPoints=0x20cb20) returned -13894023
	[0031.344] SetWindowTextW (hWnd=0x301b6, lpString="You") returned 1
	[0031.344] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xc, wParam=0x0, lParam=0x2636df0) returned 0x1
	[0031.344] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x5, wParam=0x0, lParam=0x1d002d) returned 0x0
	[0031.344] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x3, wParam=0x0, lParam=0x22019a) returned 0x0
	[0031.344] GetClientRect (in: hWnd=0x301b6, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.344] GetWindowRect (in: hWnd=0x301b6, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.344] GetParent (hWnd=0x301b6) returned 0x50120
	[0031.344] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.344] SendMessageW (hWnd=0x301b6, Msg=0x2210, wParam=0x1b60001, lParam=0x301b6) returned 0x0
	[0031.344] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x2210, wParam=0x1b60001, lParam=0x301b6) returned 0x0
	[0031.344] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.344] GetParent (hWnd=0x301b6) returned 0x50120
	[0031.344] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.344] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="Welcome", dwStyle=0x5600000d, X=291, Y=30, nWidth=123, nHeight=35, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x401b2
	[0031.344] SetWindowLongPtrW (hWnd=0x401b2, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0031.344] GetWindowLongPtrW (hWnd=0x401b2, nIndex=-4) returned 0x776f826c
	[0031.344] SetWindowLongPtrW (hWnd=0x401b2, nIndex=-4, dwNewLong=0xbb348c) returned 0x776f826c
	[0031.344] GetWindowLongPtrW (hWnd=0x401b2, nIndex=-4) returned 0xbb348c
	[0031.344] GetWindowLongPtrW (hWnd=0x401b2, nIndex=-16) returned 0x4600000d
	[0031.344] GetWindowLongPtrW (hWnd=0x401b2, nIndex=-12) returned 0x0
	[0031.344] SetWindowLongPtrW (hWnd=0x401b2, nIndex=-12, dwNewLong=0x401b2) returned 0x0
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x1, wParam=0x0, lParam=0x20d380) returned 0x0
	[0031.345] GetWindow (hWnd=0x401b2, uCmd=0x3) returned 0x301b6
	[0031.345] GetClientRect (in: hWnd=0x401b2, lpRect=0x20cb20 | out: lpRect=0x20cb20) returned 1
	[0031.345] GetWindowRect (in: hWnd=0x401b2, lpRect=0x20cb20 | out: lpRect=0x20cb20) returned 1
	[0031.345] GetParent (hWnd=0x401b2) returned 0x50120
	[0031.345] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cb10, cPoints=0x2 | out: lpPoints=0x20cb10) returned -13894023
	[0031.345] SetWindowTextW (hWnd=0x401b2, lpString="Welcome") returned 1
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0xc, wParam=0x0, lParam=0x2636670) returned 0x1
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x5, wParam=0x0, lParam=0x23007b) returned 0x0
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x3, wParam=0x0, lParam=0x1e0123) returned 0x0
	[0031.345] GetClientRect (in: hWnd=0x401b2, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.345] GetWindowRect (in: hWnd=0x401b2, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.345] GetParent (hWnd=0x401b2) returned 0x50120
	[0031.345] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.345] SendMessageW (hWnd=0x401b2, Msg=0x2210, wParam=0x1b20001, lParam=0x401b2) returned 0x0
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x2210, wParam=0x1b20001, lParam=0x401b2) returned 0x0
	[0031.345] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.346] GetParent (hWnd=0x401b2) returned 0x50120
	[0031.346] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.346] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.378734a", lpWindowName="Extract now", dwStyle=0x5601000b, X=500, Y=314, nWidth=128, nHeight=41, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201ba
	[0031.346] SetWindowLongPtrW (hWnd=0x201ba, nIndex=-4, dwNewLong=0x776f819c) returned 0xbb339c
	[0031.346] GetWindowLongPtrW (hWnd=0x201ba, nIndex=-4) returned 0x776f819c
	[0031.346] SetWindowLongPtrW (hWnd=0x201ba, nIndex=-4, dwNewLong=0xbb34dc) returned 0x776f819c
	[0031.346] GetWindowLongPtrW (hWnd=0x201ba, nIndex=-4) returned 0xbb34dc
	[0031.346] GetWindowLongPtrW (hWnd=0x201ba, nIndex=-16) returned 0x4601000b
	[0031.346] GetWindowLongPtrW (hWnd=0x201ba, nIndex=-12) returned 0x0
	[0031.346] SetWindowLongPtrW (hWnd=0x201ba, nIndex=-12, dwNewLong=0x201ba) returned 0x0
	[0031.346] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.346] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.346] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x1, wParam=0x0, lParam=0x20d380) returned 0x0
	[0031.346] GetWindow (hWnd=0x201ba, uCmd=0x3) returned 0x401b2
	[0031.346] GetClientRect (in: hWnd=0x201ba, lpRect=0x20cb20 | out: lpRect=0x20cb20) returned 1
	[0031.346] GetWindowRect (in: hWnd=0x201ba, lpRect=0x20cb20 | out: lpRect=0x20cb20) returned 1
	[0031.346] GetParent (hWnd=0x201ba) returned 0x50120
	[0031.346] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cb10, cPoints=0x2 | out: lpPoints=0x20cb10) returned -13894023
	[0031.347] SetWindowTextW (hWnd=0x201ba, lpString="Extract now") returned 1
	[0031.347] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0xc, wParam=0x0, lParam=0x2635ef0) returned 0x1
	[0031.347] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x5, wParam=0x0, lParam=0x290080) returned 0x0
	[0031.347] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x3, wParam=0x0, lParam=0x13a01f4) returned 0x0
	[0031.347] GetClientRect (in: hWnd=0x201ba, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.347] GetWindowRect (in: hWnd=0x201ba, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.347] GetParent (hWnd=0x201ba) returned 0x50120
	[0031.347] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.347] SendMessageW (hWnd=0x201ba, Msg=0x2210, wParam=0x1ba0001, lParam=0x201ba) returned 0x0
	[0031.347] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x2210, wParam=0x1ba0001, lParam=0x201ba) returned 0x0
	[0031.347] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.347] GetParent (hWnd=0x201ba) returned 0x50120
	[0031.347] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.347] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="Enter the pin to extract the password", dwStyle=0x5600000d, X=300, Y=264, nWidth=315, nHeight=25, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201ea
	[0031.347] SetWindowLongPtrW (hWnd=0x201ea, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0031.347] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-4) returned 0x776f826c
	[0031.347] SetWindowLongPtrW (hWnd=0x201ea, nIndex=-4, dwNewLong=0xbb352c) returned 0x776f826c
	[0031.347] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-4) returned 0xbb352c
	[0031.347] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-16) returned 0x4600000d
	[0031.347] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-12) returned 0x0
	[0031.348] SetWindowLongPtrW (hWnd=0x201ea, nIndex=-12, dwNewLong=0x201ea) returned 0x0
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x1, wParam=0x0, lParam=0x20d340) returned 0x0
	[0031.348] GetWindow (hWnd=0x201ea, uCmd=0x3) returned 0x201ba
	[0031.348] GetClientRect (in: hWnd=0x201ea, lpRect=0x20cae0 | out: lpRect=0x20cae0) returned 1
	[0031.348] GetWindowRect (in: hWnd=0x201ea, lpRect=0x20cae0 | out: lpRect=0x20cae0) returned 1
	[0031.348] GetParent (hWnd=0x201ea) returned 0x50120
	[0031.348] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cad0, cPoints=0x2 | out: lpPoints=0x20cad0) returned -13894023
	[0031.348] SetWindowTextW (hWnd=0x201ea, lpString="Enter the pin to extract the password") returned 1
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0xc, wParam=0x0, lParam=0x2635070) returned 0x1
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x5, wParam=0x0, lParam=0x19013b) returned 0x0
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x3, wParam=0x0, lParam=0x108012c) returned 0x0
	[0031.348] GetClientRect (in: hWnd=0x201ea, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.348] GetWindowRect (in: hWnd=0x201ea, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.348] GetParent (hWnd=0x201ea) returned 0x50120
	[0031.348] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.348] SendMessageW (hWnd=0x201ea, Msg=0x2210, wParam=0x1ea0001, lParam=0x201ea) returned 0x0
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x2210, wParam=0x1ea0001, lParam=0x201ea) returned 0x0
	[0031.348] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.349] GetParent (hWnd=0x201ea) returned 0x50120
	[0031.349] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.349] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="Oooooooops  \r\nAll your Files have Been Encrypted\r\nTo Decrypt the\r\nEncryption enter PIN\r\nWe will Extract your password on your Desktop", dwStyle=0x5600000d, X=291, Y=119, nWidth=374, nHeight=96, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201e8
	[0031.349] SetWindowLongPtrW (hWnd=0x201e8, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0031.349] GetWindowLongPtrW (hWnd=0x201e8, nIndex=-4) returned 0x776f826c
	[0031.349] SetWindowLongPtrW (hWnd=0x201e8, nIndex=-4, dwNewLong=0xbb357c) returned 0x776f826c
	[0031.349] GetWindowLongPtrW (hWnd=0x201e8, nIndex=-4) returned 0xbb357c
	[0031.349] GetWindowLongPtrW (hWnd=0x201e8, nIndex=-16) returned 0x4600000d
	[0031.349] GetWindowLongPtrW (hWnd=0x201e8, nIndex=-12) returned 0x0
	[0031.349] SetWindowLongPtrW (hWnd=0x201e8, nIndex=-12, dwNewLong=0x201e8) returned 0x0
	[0031.349] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.349] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.349] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x1, wParam=0x0, lParam=0x20d280) returned 0x0
	[0031.349] GetWindow (hWnd=0x201e8, uCmd=0x3) returned 0x201ea
	[0031.349] GetClientRect (in: hWnd=0x201e8, lpRect=0x20ca20 | out: lpRect=0x20ca20) returned 1
	[0031.349] GetWindowRect (in: hWnd=0x201e8, lpRect=0x20ca20 | out: lpRect=0x20ca20) returned 1
	[0031.349] GetParent (hWnd=0x201e8) returned 0x50120
	[0031.349] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20ca10, cPoints=0x2 | out: lpPoints=0x20ca10) returned -13894023
	[0031.350] SetWindowTextW (hWnd=0x201e8, lpString="Oooooooops  \r\nAll your Files have Been Encrypted\r\nTo Decrypt the\r\nEncryption enter PIN\r\nWe will Extract your password on your Desktop") returned 1
	[0031.350] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0xc, wParam=0x0, lParam=0x26347d0) returned 0x1
	[0031.350] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x5, wParam=0x0, lParam=0x600176) returned 0x0
	[0031.350] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x3, wParam=0x0, lParam=0x770123) returned 0x0
	[0031.350] GetClientRect (in: hWnd=0x201e8, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.350] GetWindowRect (in: hWnd=0x201e8, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.350] GetParent (hWnd=0x201e8) returned 0x50120
	[0031.350] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.350] SendMessageW (hWnd=0x201e8, Msg=0x2210, wParam=0x1e80001, lParam=0x201e8) returned 0x0
	[0031.350] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x2210, wParam=0x1e80001, lParam=0x201e8) returned 0x0
	[0031.350] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.350] GetParent (hWnd=0x201e8) returned 0x50120
	[0031.350] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x268d3b0 | out: lpWndClass=0x268d3b0) returned 1
	[0031.350] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.350] CoTaskMemAlloc (cb=0x44) returned 0x1affdec0
	[0031.350] RegisterClassW (lpWndClass=0x20d990) returned 0xc133
	[0031.350] CoTaskMemFree (pv=0x1affdec0) 
	[0031.351] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.351] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.378734a", lpWindowName=0x0, dwStyle=0x560100c0, X=304, Y=288, nWidth=324, nHeight=20, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201bc
	[0031.351] SetWindowLongPtrW (hWnd=0x201bc, nIndex=-4, dwNewLong=0x776f820c) returned 0xbb35cc
	[0031.351] GetWindowLongPtrW (hWnd=0x201bc, nIndex=-4) returned 0x776f820c
	[0031.351] SetWindowLongPtrW (hWnd=0x201bc, nIndex=-4, dwNewLong=0xbb364c) returned 0x776f820c
	[0031.351] GetWindowLongPtrW (hWnd=0x201bc, nIndex=-4) returned 0xbb364c
	[0031.351] GetWindowLongPtrW (hWnd=0x201bc, nIndex=-16) returned 0x460100c0
	[0031.351] GetWindowLongPtrW (hWnd=0x201bc, nIndex=-12) returned 0x0
	[0031.351] SetWindowLongPtrW (hWnd=0x201bc, nIndex=-12, dwNewLong=0x201bc) returned 0x0
	[0031.351] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x81, wParam=0x0, lParam=0x20d350) returned 0x1
	[0031.362] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x83, wParam=0x0, lParam=0x20d3f0) returned 0x0
	[0031.362] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x1, wParam=0x0, lParam=0x20d350) returned 0x1
	[0031.362] GetWindow (hWnd=0x201bc, uCmd=0x3) returned 0x201e8
	[0031.363] GetClientRect (in: hWnd=0x201bc, lpRect=0x20cba0 | out: lpRect=0x20cba0) returned 1
	[0031.363] GetWindowRect (in: hWnd=0x201bc, lpRect=0x20cba0 | out: lpRect=0x20cba0) returned 1
	[0031.363] GetParent (hWnd=0x201bc) returned 0x50120
	[0031.363] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cb90, cPoints=0x2 | out: lpPoints=0x20cb90) returned -13894023
	[0031.363] SendMessageW (hWnd=0x201bc, Msg=0x30, wParam=0x30a0817, lParam=0x0) returned 0x1
	[0031.363] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x30, wParam=0x30a0817, lParam=0x0) returned 0x1
	[0031.363] SendMessageW (hWnd=0x201bc, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
	[0031.363] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
	[0031.364] GetSystemMetrics (nIndex=5) returned 1
	[0031.364] GetSystemMetrics (nIndex=6) returned 1
	[0031.364] SendMessageW (hWnd=0x201bc, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
	[0031.364] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
	[0031.364] SendMessageW (hWnd=0x201bc, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
	[0031.364] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
	[0031.381] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x5, wParam=0x0, lParam=0x100140) returned 0x0
	[0031.381] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x3, wParam=0x0, lParam=0x1220132) returned 0x0
	[0031.381] GetClientRect (in: hWnd=0x201bc, lpRect=0x20cca0 | out: lpRect=0x20cca0) returned 1
	[0031.381] GetWindowRect (in: hWnd=0x201bc, lpRect=0x20cca0 | out: lpRect=0x20cca0) returned 1
	[0031.381] GetParent (hWnd=0x201bc) returned 0x50120
	[0031.381] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc90, cPoints=0x2 | out: lpPoints=0x20cc90) returned -13894023
	[0031.381] SendMessageW (hWnd=0x201bc, Msg=0x2210, wParam=0x1bc0001, lParam=0x201bc) returned 0x0
	[0031.381] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x2210, wParam=0x1bc0001, lParam=0x201bc) returned 0x0
	[0031.381] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.381] GetParent (hWnd=0x201bc) returned 0x50120
	[0031.382] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.382] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="in BooM Ransomeware", dwStyle=0x5600000d, X=291, Y=61, nWidth=293, nHeight=35, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201be
	[0031.382] SetWindowLongPtrW (hWnd=0x201be, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0031.382] GetWindowLongPtrW (hWnd=0x201be, nIndex=-4) returned 0x776f826c
	[0031.382] SetWindowLongPtrW (hWnd=0x201be, nIndex=-4, dwNewLong=0xbb369c) returned 0x776f826c
	[0031.382] GetWindowLongPtrW (hWnd=0x201be, nIndex=-4) returned 0xbb369c
	[0031.382] GetWindowLongPtrW (hWnd=0x201be, nIndex=-16) returned 0x4600000d
	[0031.382] GetWindowLongPtrW (hWnd=0x201be, nIndex=-12) returned 0x0
	[0031.382] SetWindowLongPtrW (hWnd=0x201be, nIndex=-12, dwNewLong=0x201be) returned 0x0
	[0031.382] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.382] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.382] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x1, wParam=0x0, lParam=0x20d370) returned 0x0
	[0031.382] GetWindow (hWnd=0x201be, uCmd=0x3) returned 0x201bc
	[0031.382] GetClientRect (in: hWnd=0x201be, lpRect=0x20cb10 | out: lpRect=0x20cb10) returned 1
	[0031.382] GetWindowRect (in: hWnd=0x201be, lpRect=0x20cb10 | out: lpRect=0x20cb10) returned 1
	[0031.382] GetParent (hWnd=0x201be) returned 0x50120
	[0031.382] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cb00, cPoints=0x2 | out: lpPoints=0x20cb00) returned -13894023
	[0031.383] SetWindowTextW (hWnd=0x201be, lpString="in BooM Ransomeware") returned 1
	[0031.383] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0xc, wParam=0x0, lParam=0x2633e40) returned 0x1
	[0031.383] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x5, wParam=0x0, lParam=0x230125) returned 0x0
	[0031.383] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x3, wParam=0x0, lParam=0x3d0123) returned 0x0
	[0031.383] GetClientRect (in: hWnd=0x201be, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.383] GetWindowRect (in: hWnd=0x201be, lpRect=0x20cc40 | out: lpRect=0x20cc40) returned 1
	[0031.383] GetParent (hWnd=0x201be) returned 0x50120
	[0031.383] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cc30, cPoints=0x2 | out: lpPoints=0x20cc30) returned -13894023
	[0031.383] SendMessageW (hWnd=0x201be, Msg=0x2210, wParam=0x1be0001, lParam=0x201be) returned 0x0
	[0031.383] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x2210, wParam=0x1be0001, lParam=0x201be) returned 0x0
	[0031.383] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.383] GetParent (hWnd=0x201be) returned 0x50120
	[0031.383] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0031.383] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=658, nHeight=456, hWndParent=0x50120, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x301aa
	[0031.384] SetWindowLongPtrW (hWnd=0x301aa, nIndex=-4, dwNewLong=0x7769b0ac) returned 0xba14bc
	[0031.384] GetWindowLongPtrW (hWnd=0x301aa, nIndex=-4) returned 0x7769b0ac
	[0031.384] SetWindowLongPtrW (hWnd=0x301aa, nIndex=-4, dwNewLong=0xbb36ec) returned 0x7769b0ac
	[0031.384] GetWindowLongPtrW (hWnd=0x301aa, nIndex=-4) returned 0xbb36ec
	[0031.384] GetWindowLongPtrW (hWnd=0x301aa, nIndex=-16) returned 0x46000000
	[0031.384] GetWindowLongPtrW (hWnd=0x301aa, nIndex=-12) returned 0x0
	[0031.384] SetWindowLongPtrW (hWnd=0x301aa, nIndex=-12, dwNewLong=0x301aa) returned 0x0
	[0031.384] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x81, wParam=0x0, lParam=0x20d3a0) returned 0x1
	[0031.384] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x83, wParam=0x0, lParam=0x20d440) returned 0x0
	[0031.384] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x1, wParam=0x0, lParam=0x20d3a0) returned 0x0
	[0031.384] GetWindow (hWnd=0x301aa, uCmd=0x3) returned 0x201be
	[0031.384] GetClientRect (in: hWnd=0x301aa, lpRect=0x20cbf0 | out: lpRect=0x20cbf0) returned 1
	[0031.384] GetWindowRect (in: hWnd=0x301aa, lpRect=0x20cbf0 | out: lpRect=0x20cbf0) returned 1
	[0031.384] GetParent (hWnd=0x301aa) returned 0x50120
	[0031.384] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cbe0, cPoints=0x2 | out: lpPoints=0x20cbe0) returned -13894023
	[0031.386] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x5, wParam=0x0, lParam=0x1c80292) returned 0x0
	[0031.386] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
	[0031.386] GetClientRect (in: hWnd=0x301aa, lpRect=0x20ccf0 | out: lpRect=0x20ccf0) returned 1
	[0031.386] GetWindowRect (in: hWnd=0x301aa, lpRect=0x20ccf0 | out: lpRect=0x20ccf0) returned 1
	[0031.386] GetParent (hWnd=0x301aa) returned 0x50120
	[0031.386] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20cce0, cPoints=0x2 | out: lpPoints=0x20cce0) returned -13894023
	[0031.386] SendMessageW (hWnd=0x301aa, Msg=0x2210, wParam=0x1aa0001, lParam=0x301aa) returned 0x0
	[0031.386] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x2210, wParam=0x1aa0001, lParam=0x301aa) returned 0x0
	[0031.386] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0031.386] GetParent (hWnd=0x301aa) returned 0x50120
	[0031.387] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0031.387] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0031.387] GetSystemMetrics (nIndex=42) returned 0
	[0031.387] CoTaskMemAlloc (cb=0x26) returned 0x1b0089e0
	[0031.387] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b0089e0, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0031.387] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b0089e0) returned 0x10
	[0031.387] CoTaskMemFree (pv=0x1b0089e0) 
	[0031.485] GetFocus () returned 0x0
	[0031.485] ShowWindow (hWnd=0x50120, nCmdShow=0) returned 0
	[0031.533] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\VB and VBA Program Settings\\A\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x20dab8 | out: phkResult=0x20dab8*=0x0) returned 0x2
	[0031.538] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\VB and VBA Program Settings\\A\\0", ulOptions=0x0, samDesired=0x2001f, phkResult=0x20d9c8 | out: phkResult=0x20d9c8*=0x0) returned 0x2
	[0031.553] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\VB and VBA Program Settings\\A\\0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x20da10, lpdwDisposition=0x20da08 | out: phkResult=0x20da10*=0x230, lpdwDisposition=0x20da08*=0x1) returned 0x0
	[0031.562] RegQueryValueExW (in: hKey=0x230, lpValueName="RunCount", lpReserved=0x0, lpType=0x20d9cc, lpData=0x0, lpcbData=0x20d9c8*=0x0 | out: lpType=0x20d9cc*=0x0, lpData=0x0, lpcbData=0x20d9c8*=0x0) returned 0x2
	[0031.564] RegSetValueExW (in: hKey=0x230, lpValueName="RunCount", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0
	[0031.565] RegCloseKey (hKey=0x230) returned 0x0
	[0031.604] CoTaskMemAlloc (cb=0x20c) returned 0x339180
	[0031.605] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x339180 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
	[0031.605] CoTaskMemFree (pv=0x339180) 
	[0031.606] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x20d6e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e
	[0031.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x20d760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
	[0031.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x20d710, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
	[0031.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x20d650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
	[0031.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x20d690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
	[0031.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x20d680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
	[0031.616] SetErrorMode (uMode=0x1) returned 0x0
	[0031.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x20d890 | out: lpFileInformation=0x20d890*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x14d78f00, ftLastAccessTime.dwHighDateTime=0x1d4a46e, ftLastWriteTime.dwLowDateTime=0x14d78f00, ftLastWriteTime.dwHighDateTime=0x1d4a46e, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0031.616] SetErrorMode (uMode=0x0) returned 0x1
	[0031.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x20d680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
	[0031.616] SetErrorMode (uMode=0x1) returned 0x0
	[0031.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x20d890 | out: lpFileInformation=0x20d890*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x14d78f00, ftLastAccessTime.dwHighDateTime=0x1d4a46e, ftLastWriteTime.dwLowDateTime=0x14d78f00, ftLastWriteTime.dwHighDateTime=0x1d4a46e, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0031.616] SetErrorMode (uMode=0x0) returned 0x1
	[0031.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x20d480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
	[0031.622] SetErrorMode (uMode=0x1) returned 0x0
	[0031.624] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFindFileData=0x20d620 | out: lpFindFileData=0x20d620) returned 0x31c7a0
	[0031.626] FindNextFileW (in: hFindFile=0x31c7a0, lpFindFileData=0x20d630 | out: lpFindFileData=0x20d630) returned 0
	[0031.626] FindClose (in: hFindFile=0x31c7a0 | out: hFindFile=0x31c7a0) returned 1
	[0031.626] SetErrorMode (uMode=0x0) returned 0x1
	[0031.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\.", nBufferLength=0x105, lpBuffer=0x20d540, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
	[0031.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe", nBufferLength=0x105, lpBuffer=0x20d490, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe", lpFilePart=0x0) returned 0x3b
	[0031.697] SetErrorMode (uMode=0x1) returned 0x0
	[0031.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\tempsvchost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0031.700] GetFileType (hFile=0x230) returned 0x1
	[0031.700] SetErrorMode (uMode=0x0) returned 0x1
	[0031.700] GetFileType (hFile=0x230) returned 0x1
	[0031.702] WriteFile (in: hFile=0x230, lpBuffer=0x26926a0*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x20da48, lpOverlapped=0x0 | out: lpBuffer=0x26926a0*, lpNumberOfBytesWritten=0x20da48*=0x4e00, lpOverlapped=0x0) returned 1
	[0031.703] CloseHandle (hObject=0x230) returned 1
	[0031.746] LocalAlloc (uFlags=0x0, uBytes=0x78) returned 0x1afe3820
	[0031.746] RtlMoveMemory (in: Destination=0x1afe3820, Source=0x2692548, Length=0x78 | out: Destination=0x1afe3820) 
	[0031.765] ShellExecuteExW (in: pExecInfo=0x2697ac8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2697ac8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x38c)) returned 1
	[0034.594] LocalFree (hMem=0x1afe3820) returned 0x0
	[0087.140] ShowWindow (hWnd=0x50120, nCmdShow=5) returned 0
	[0087.140] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0087.141] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0087.141] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0087.141] GetSystemMetrics (nIndex=42) returned 0
	[0087.141] CoTaskMemAlloc (cb=0x26) returned 0x349b90
	[0087.141] GetWindowTextW (in: hWnd=0x50120, lpString=0x349b90, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0087.141] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x349b90) returned 0x10
	[0087.141] CoTaskMemFree (pv=0x349b90) 
	[0087.147] GdipImageGetFrameDimensionsCount (image=0x1b494c00, count=0x20ce10) returned 0x0
	[0087.148] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1b050380
	[0087.149] GdipImageGetFrameDimensionsList (image=0x1b494c00, dimensionIDs=0x1b050380*(Data1=0x650016, Data2=0x78, Data3=0x65, Data4=([0]=0x0, [1]=0x0, [2]=0x61, [3]=0x0, [4]=0x6d, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0
	[0087.153] LocalFree (hMem=0x1b050380) returned 0x0
	[0087.168] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20d8f0) returned 0x0
	[0087.170] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20d8f0) returned 0x0
	[0087.170] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0087.170] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0087.170] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0087.170] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0087.171] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0087.171] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0087.171] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0087.269] OleInitialize (pvReserved=0x0) returned 0x0
	[0087.270] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x20d270 | out: lplpMessageFilter=0x20d270*=0x0) returned 0x0
	[0087.285] GetFocus () returned 0x0
	[0087.287] GetFocus () returned 0x0
	[0087.287] SetFocus (hWnd=0x201bc) returned 0x0
	[0087.312] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0087.314] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0087.334] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0087.335] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0087.336] GetParent (hWnd=0x50120) returned 0x0
	[0087.339] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x1
	[0087.340] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0087.340] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x282, wParam=0xa, lParam=0x0) returned 0x0
	[0087.341] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0087.341] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x282, wParam=0xf, lParam=0x4018d) returned 0x0
	[0087.344] SetTextColor (hdc=0x10107f8, color=0x0) returned 0x0
	[0087.351] SetBkColor (hdc=0x10107f8, color=0xffffff) returned 0xffffff
	[0087.352] GetSysColorBrush (nIndex=5) returned 0x1100060
	[0087.354] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0087.354] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x282, wParam=0xb, lParam=0x0) returned 0x0
	[0087.354] SendMessageW (hWnd=0x201bc, Msg=0x2111, wParam=0x10001bc, lParam=0x201bc) returned 0x0
	[0087.498] SendMessageW (hWnd=0x201bc, Msg=0xb0, wParam=0x20ca84, lParam=0x20ca80) returned 0x0
	[0087.498] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0xb0, wParam=0x20ca84, lParam=0x20ca80) returned 0x0
	[0087.499] GetKeyState (nVirtKey=1) returned 0
	[0087.499] GetKeyState (nVirtKey=2) returned 0
	[0087.499] GetKeyState (nVirtKey=4) returned 0
	[0087.499] GetKeyState (nVirtKey=5) returned 0
	[0087.499] GetKeyState (nVirtKey=6) returned 0
	[0087.507] GetWindowTextLengthW (hWnd=0x201bc) returned 0
	[0087.507] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0087.508] SendMessageW (hWnd=0x201bc, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1
	[0087.508] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1
	[0087.508] SetTextColor (hdc=0x10107f8, color=0x0) returned 0x0
	[0087.508] SetBkColor (hdc=0x10107f8, color=0xffffff) returned 0xffffff
	[0087.509] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0087.509] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0087.509] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0087.509] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0087.511] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20d370 | out: lpwndpl=0x20d370) returned 1
	[0087.513] GetClientRect (in: hWnd=0x50120, lpRect=0x20d220 | out: lpRect=0x20d220) returned 1
	[0087.513] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0087.513] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0087.513] GetSystemMetrics (nIndex=42) returned 0
	[0087.513] CoTaskMemAlloc (cb=0x26) returned 0x1b07ddb0
	[0087.513] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b07ddb0, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0087.513] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b07ddb0) returned 0x10
	[0087.513] CoTaskMemFree (pv=0x1b07ddb0) 
	[0087.514] GetClientRect (in: hWnd=0x50120, lpRect=0x20cfc0 | out: lpRect=0x20cfc0) returned 1
	[0087.517] GdipCreateHalftonePalette () returned 0x1308070b
	[0087.517] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0087.517] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20cb90) returned 0x0
	[0087.522] GdipSetPageUnit (graphics=0x1b496c60, unit=0x2) returned 0x0
	[0087.565] GdipCreateMatrix (matrix=0x20ca80) returned 0x0
	[0087.566] GdipGetWorldTransform (graphics=0x1b496c60, matrix=0x1b49f050) returned 0x0
	[0087.567] GdipIsMatrixIdentity (matrix=0x1b49f050, result=0x20cae0) returned 0x0
	[0087.584] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0087.584] GdipDeleteMatrix (matrix=0x1b49f050) returned 0x0
	[0087.586] GdipCreateRegion (region=0x20ca80) returned 0x0
	[0087.588] GdipGetClip (graphics=0x1b496c60, region=0x1b90f1d0) returned 0x0
	[0087.589] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b496c60, result=0x20cab0) returned 0x0
	[0087.590] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0087.590] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0087.591] GdipSaveGraphics (graphics=0x1b496c60, state=0x20cb80) returned 0x0
	[0087.592] GdipCreateRegion (region=0x20ca50) returned 0x0
	[0087.592] GdipGetClip (graphics=0x1b496c60, region=0x1b90f1d0) returned 0x0
	[0087.592] GdipCreateMatrix (matrix=0x20ca50) returned 0x0
	[0087.592] GdipGetWorldTransform (graphics=0x1b496c60, matrix=0x1b49f090) returned 0x0
	[0087.593] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20cab0) returned 0x0
	[0087.618] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07b900
	[0087.619] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07b900) returned 0x0
	[0087.619] LocalFree (hMem=0x1b07b900) returned 0x0
	[0087.619] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0087.619] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0087.619] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b496c60, result=0x20cb00) returned 0x0
	[0087.619] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0087.619] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0087.619] GdipGetDC (graphics=0x1b496c60, hdc=0x20cb30) returned 0x0
	[0087.620] GetCurrentObject (hdc=0x10107f8, type=0x1) returned 0x1b00017
	[0087.620] GetCurrentObject (hdc=0x10107f8, type=0x2) returned 0x1900010
	[0087.620] GetCurrentObject (hdc=0x10107f8, type=0x7) returned 0x1050032
	[0087.620] GetCurrentObject (hdc=0x10107f8, type=0x6) returned 0x18a002e
	[0087.620] SaveDC (hdc=0x10107f8) returned 1
	[0087.621] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x263bec0 | out: lppt=0x263bec0) returned 1
	[0087.621] GetNearestColor (hdc=0x10107f8, color=0xf0f0f0) returned 0xf0f0f0
	[0088.132] CreateSolidBrush (color=0xf0f0f0) returned 0xa1007c0
	[0088.133] FillRect (hDC=0x10107f8, lprc=0x20cb00, hbr=0xa1007c0) returned 1
	[0088.134] DeleteObject (ho=0xa1007c0) returned 1
	[0088.135] RestoreDC (hdc=0x10107f8, nSavedDC=-1) returned 1
	[0088.142] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.143] GdipReleaseDC (graphics=0x1b496c60, hdc=0x10107f8) returned 0x0
	[0088.143] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.143] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0088.143] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0088.143] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.143] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.143] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0088.145] GetStockObject (i=5) returned 0x1900015
	[0088.145] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.145] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.146] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.146] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0088.146] GetStockObject (i=5) returned 0x1900015
	[0088.146] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.146] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.146] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.147] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0088.147] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.147] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.147] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20d350 | out: lpwndpl=0x20d350) returned 1
	[0088.147] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20d8f0) returned 0x0
	[0088.147] GetClientRect (in: hWnd=0x50120, lpRect=0x20d0f0 | out: lpRect=0x20d0f0) returned 1
	[0088.147] GetWindowRect (in: hWnd=0x50120, lpRect=0x20d0f0 | out: lpRect=0x20d0f0) returned 1
	[0088.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0088.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0088.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0088.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x5, wParam=0x0, lParam=0x1c80292) returned 0x0
	[0088.149] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x3, wParam=0x0, lParam=0xd50187) returned 0x0
	[0088.149] GetClientRect (in: hWnd=0x50120, lpRect=0x20d1c0 | out: lpRect=0x20d1c0) returned 1
	[0088.149] GetWindowRect (in: hWnd=0x50120, lpRect=0x20d1c0 | out: lpRect=0x20d1c0) returned 1
	[0088.164] CoTaskMemAlloc (cb=0x204) returned 0x1b078aa0
	[0088.164] GetComputerNameW (in: lpBuffer=0x1b078aa0, nSize=0x20db28 | out: lpBuffer="XDUWTFONO", nSize=0x20db28) returned 1
	[0088.165] CoTaskMemFree (pv=0x1b078aa0) 
	[0088.165] GetWindowTextLengthW (hWnd=0x301b6) returned 3
	[0088.165] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3
	[0088.165] GetSystemMetrics (nIndex=42) returned 0
	[0088.165] CoTaskMemAlloc (cb=0xc) returned 0x1b077590
	[0088.165] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b077590, nMaxCount=4 | out: lpString="You") returned 3
	[0088.165] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xd, wParam=0x4, lParam=0x1b077590) returned 0x3
	[0088.165] CoTaskMemFree (pv=0x1b077590) 
	[0088.165] GetWindowTextLengthW (hWnd=0x301b6) returned 3
	[0088.165] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3
	[0088.165] GetSystemMetrics (nIndex=42) returned 0
	[0088.165] CoTaskMemAlloc (cb=0xc) returned 0x1b077590
	[0088.165] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b077590, nMaxCount=4 | out: lpString="You") returned 3
	[0088.165] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xd, wParam=0x4, lParam=0x1b077590) returned 0x3
	[0088.165] CoTaskMemFree (pv=0x1b077590) 
	[0088.165] SetWindowTextW (hWnd=0x301b6, lpString="XDUWTFONO") returned 1
	[0088.165] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xc, wParam=0x0, lParam=0x263c3a8) returned 0x1
	[0088.166] GetStockObject (i=5) returned 0x1900015
	[0088.168] SendMessageW (hWnd=0x301b6, Msg=0x202b, wParam=0x301b6, lParam=0x20d050) returned 0x0
	[0088.168] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x202b, wParam=0x301b6, lParam=0x20d050) returned 0x0
	[0088.168] GetWindowTextLengthW (hWnd=0x301b6) returned 9
	[0088.168] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
	[0088.168] GetSystemMetrics (nIndex=42) returned 0
	[0088.168] CoTaskMemAlloc (cb=0x18) returned 0x1b077590
	[0088.168] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b077590, nMaxCount=10 | out: lpString="XDUWTFONO") returned 9
	[0088.168] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xd, wParam=0xa, lParam=0x1b077590) returned 0x9
	[0088.168] CoTaskMemFree (pv=0x1b077590) 
	[0088.168] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d890) returned 0x0
	[0088.169] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d850) returned 0x0
	[0088.169] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0088.169] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0088.169] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x20d860, fWinIni=0x0 | out: pvParam=0x20d860) returned 1
	[0088.169] SendMessageW (hWnd=0x50120, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.170] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.170] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.170] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.170] GetStockObject (i=5) returned 0x1900015
	[0088.170] SendMessageW (hWnd=0x401a4, Msg=0x202b, wParam=0x401a4, lParam=0x20b770) returned 0x0
	[0088.170] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x202b, wParam=0x401a4, lParam=0x20b770) returned 0x0
	[0088.170] RedrawWindow (hWnd=0x401a4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.170] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.170] GetStockObject (i=5) returned 0x1900015
	[0088.173] GetStockObject (i=5) returned 0x1900015
	[0088.173] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20b710) returned 0x0
	[0088.173] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20b710) returned 0x0
	[0088.173] RedrawWindow (hWnd=0x401b4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.173] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.173] GetStockObject (i=5) returned 0x1900015
	[0088.174] SendMessageW (hWnd=0x301b6, Msg=0x202b, wParam=0x301b6, lParam=0x20b770) returned 0x0
	[0088.174] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x202b, wParam=0x301b6, lParam=0x20b770) returned 0x0
	[0088.174] RedrawWindow (hWnd=0x301b6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.174] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.174] GetStockObject (i=5) returned 0x1900015
	[0088.174] SendMessageW (hWnd=0x401b2, Msg=0x202b, wParam=0x401b2, lParam=0x20b770) returned 0x0
	[0088.174] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x202b, wParam=0x401b2, lParam=0x20b770) returned 0x0
	[0088.174] RedrawWindow (hWnd=0x401b2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.174] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.174] GetStockObject (i=5) returned 0x1900015
	[0088.174] GetStockObject (i=5) returned 0x1900015
	[0088.174] SendMessageW (hWnd=0x201ba, Msg=0x202b, wParam=0x201ba, lParam=0x20b710) returned 0x0
	[0088.174] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x202b, wParam=0x201ba, lParam=0x20b710) returned 0x0
	[0088.174] RedrawWindow (hWnd=0x201ba, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.174] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.175] GetStockObject (i=5) returned 0x1900015
	[0088.175] SendMessageW (hWnd=0x201ea, Msg=0x202b, wParam=0x201ea, lParam=0x20b770) returned 0x0
	[0088.175] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x202b, wParam=0x201ea, lParam=0x20b770) returned 0x0
	[0088.175] RedrawWindow (hWnd=0x201ea, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.175] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.175] GetStockObject (i=5) returned 0x1900015
	[0088.175] SendMessageW (hWnd=0x201e8, Msg=0x202b, wParam=0x201e8, lParam=0x20b770) returned 0x0
	[0088.175] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x202b, wParam=0x201e8, lParam=0x20b770) returned 0x0
	[0088.175] RedrawWindow (hWnd=0x201e8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.175] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.175] RedrawWindow (hWnd=0x201bc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.175] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.175] GetStockObject (i=5) returned 0x1900015
	[0088.175] SendMessageW (hWnd=0x201be, Msg=0x202b, wParam=0x201be, lParam=0x20b770) returned 0x0
	[0088.175] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x202b, wParam=0x201be, lParam=0x20b770) returned 0x0
	[0088.175] RedrawWindow (hWnd=0x201be, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.175] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0088.176] RedrawWindow (hWnd=0x301aa, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.176] RedrawWindow (hWnd=0x50120, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0088.176] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0088.176] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d870) returned 0x0
	[0088.176] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0088.176] GdipMeasureString (graphics=0x1b496c60, string="XDUWTFONO", length=9, font=0x1b40c310, layoutRect=0x20d7b8, stringFormat=0x1b912930, boundingBox=0x20d7a8, codepointsFitted=0x20d7a4, linesFilled=0x20d7a0) returned 0x0
	[0088.176] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.176] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0088.176] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.176] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0088.176] SetWindowPos (hWnd=0x301b6, hWndInsertAfter=0x0, X=410, Y=34, cx=138, cy=29, uFlags=0x16) returned 1
	[0088.176] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x46, wParam=0x0, lParam=0x20d730) returned 0x0
	[0088.176] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x83, wParam=0x1, lParam=0x20d700) returned 0x0
	[0088.177] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.177] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.177] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x70107fc, lParam=0x0) returned 0x1
	[0088.177] GetStockObject (i=5) returned 0x1900015
	[0088.177] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.177] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.178] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.178] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x14, wParam=0x70107fc, lParam=0x0) returned 0x1
	[0088.178] GetStockObject (i=5) returned 0x1900015
	[0088.178] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.178] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.179] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.179] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x14, wParam=0x70107fc, lParam=0x0) returned 0x1
	[0088.179] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.179] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.179] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x47, wParam=0x0, lParam=0x20d730) returned 0x0
	[0088.179] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x5, wParam=0x0, lParam=0x1d008a) returned 0x0
	[0088.180] GetClientRect (in: hWnd=0x301b6, lpRect=0x20cec0 | out: lpRect=0x20cec0) returned 1
	[0088.180] GetWindowRect (in: hWnd=0x301b6, lpRect=0x20cec0 | out: lpRect=0x20cec0) returned 1
	[0088.180] GetParent (hWnd=0x301b6) returned 0x50120
	[0088.180] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50120, lpPoints=0x20ceb0, cPoints=0x2 | out: lpPoints=0x20ceb0) returned -13894023
	[0088.206] InvalidateRect (hWnd=0x301b6, lpRect=0x0, bErase=1) returned 1
	[0088.206] GetWindowTextLengthW (hWnd=0x301b6) returned 9
	[0088.206] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
	[0088.206] GetSystemMetrics (nIndex=42) returned 0
	[0088.206] CoTaskMemAlloc (cb=0x18) returned 0x1b077590
	[0088.206] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b077590, nMaxCount=10 | out: lpString="XDUWTFONO") returned 9
	[0088.206] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xd, wParam=0xa, lParam=0x1b077590) returned 0x9
	[0088.206] CoTaskMemFree (pv=0x1b077590) 
	[0088.206] GetParent (hWnd=0x301b6) returned 0x50120
	[0088.207] InvalidateRect (hWnd=0x301b6, lpRect=0x0, bErase=1) returned 1
	[0088.207] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0088.207] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0088.207] GetSystemMetrics (nIndex=42) returned 0
	[0088.207] CoTaskMemAlloc (cb=0x26) returned 0x1b07dde0
	[0088.207] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b07dde0, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0088.207] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b07dde0) returned 0x10
	[0088.207] CoTaskMemFree (pv=0x1b07dde0) 
	[0088.207] InvalidateRect (hWnd=0x401a4, lpRect=0x0, bErase=1) returned 1
	[0088.207] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0088.207] InvalidateRect (hWnd=0x301b6, lpRect=0x0, bErase=1) returned 1
	[0088.207] InvalidateRect (hWnd=0x401b2, lpRect=0x0, bErase=1) returned 1
	[0088.207] InvalidateRect (hWnd=0x201ba, lpRect=0x0, bErase=0) returned 1
	[0088.207] InvalidateRect (hWnd=0x201ea, lpRect=0x0, bErase=1) returned 1
	[0088.207] InvalidateRect (hWnd=0x201e8, lpRect=0x0, bErase=1) returned 1
	[0088.207] InvalidateRect (hWnd=0x201bc, lpRect=0x0, bErase=1) returned 1
	[0088.207] InvalidateRect (hWnd=0x201be, lpRect=0x0, bErase=1) returned 1
	[0088.207] InvalidateRect (hWnd=0x301aa, lpRect=0x0, bErase=1) returned 1
	[0088.222] GetWindowThreadProcessId (in: hWnd=0x50120, lpdwProcessId=0x20dc90 | out: lpdwProcessId=0x20dc90) returned 0x244
	[0088.222] GetCurrentThreadId () returned 0x244
	[0088.231] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc131
	[0088.231] PostMessageW (hWnd=0x50120, Msg=0xc131, wParam=0x0, lParam=0x0) returned 1
	[0088.231] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0088.231] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0088.231] GetSystemMetrics (nIndex=42) returned 0
	[0088.231] CoTaskMemAlloc (cb=0x26) returned 0x1b07de10
	[0088.231] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b07de10, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0088.231] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b07de10) returned 0x10
	[0088.231] CoTaskMemFree (pv=0x1b07de10) 
	[0088.232] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e660) returned 0x0
	[0088.232] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x46, wParam=0x0, lParam=0x20e660) returned 0x0
	[0088.232] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.232] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0088.232] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0088.232] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0088.234] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20e0e0 | out: lpwndpl=0x20e0e0) returned 1
	[0088.234] GetClientRect (in: hWnd=0x50120, lpRect=0x20df90 | out: lpRect=0x20df90) returned 1
	[0088.234] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0088.234] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0088.234] GetSystemMetrics (nIndex=42) returned 0
	[0088.234] CoTaskMemAlloc (cb=0x26) returned 0x1b07de10
	[0088.234] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b07de10, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0088.234] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b07de10) returned 0x10
	[0088.234] CoTaskMemFree (pv=0x1b07de10) 
	[0088.234] GetClientRect (in: hWnd=0x50120, lpRect=0x20dd30 | out: lpRect=0x20dd30) returned 1
	[0088.234] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0088.234] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d900) returned 0x0
	[0088.234] GdipSetPageUnit (graphics=0x1b496c60, unit=0x2) returned 0x0
	[0088.234] GdipCreateMatrix (matrix=0x20d7f0) returned 0x0
	[0088.234] GdipGetWorldTransform (graphics=0x1b496c60, matrix=0x1b49f050) returned 0x0
	[0088.234] GdipIsMatrixIdentity (matrix=0x1b49f050, result=0x20d850) returned 0x0
	[0088.234] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.234] GdipDeleteMatrix (matrix=0x1b49f050) returned 0x0
	[0088.235] GdipCreateRegion (region=0x20d7f0) returned 0x0
	[0088.235] GdipGetClip (graphics=0x1b496c60, region=0x1b90f1d0) returned 0x0
	[0088.235] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b496c60, result=0x20d820) returned 0x0
	[0088.235] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.235] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0088.235] GdipSaveGraphics (graphics=0x1b496c60, state=0x20d8f0) returned 0x0
	[0088.235] GdipCreateRegion (region=0x20d7c0) returned 0x0
	[0088.235] GdipGetClip (graphics=0x1b496c60, region=0x1b90f1d0) returned 0x0
	[0088.235] GdipCreateMatrix (matrix=0x20d7c0) returned 0x0
	[0088.235] GdipGetWorldTransform (graphics=0x1b496c60, matrix=0x1b49f090) returned 0x0
	[0088.235] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d820) returned 0x0
	[0088.235] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07b900
	[0088.235] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07b900) returned 0x0
	[0088.235] LocalFree (hMem=0x1b07b900) returned 0x0
	[0088.235] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.235] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0088.235] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b496c60, result=0x20d870) returned 0x0
	[0088.235] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.235] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0088.235] GdipGetDC (graphics=0x1b496c60, hdc=0x20d8a0) returned 0x0
	[0088.235] GetCurrentObject (hdc=0x4010280, type=0x1) returned 0x1b00017
	[0088.235] GetCurrentObject (hdc=0x4010280, type=0x2) returned 0x1900010
	[0088.235] GetCurrentObject (hdc=0x4010280, type=0x7) returned 0x1050032
	[0088.238] GetCurrentObject (hdc=0x4010280, type=0x6) returned 0x18a002e
	[0088.238] SaveDC (hdc=0x4010280) returned 1
	[0088.242] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x263d6c8 | out: lppt=0x263d6c8) returned 1
	[0088.242] GetNearestColor (hdc=0x4010280, color=0xf0f0f0) returned 0xf0f0f0
	[0088.242] CreateSolidBrush (color=0xf0f0f0) returned 0xb1007c0
	[0088.242] FillRect (hDC=0x4010280, lprc=0x20d870, hbr=0xb1007c0) returned 1
	[0088.242] DeleteObject (ho=0xb1007c0) returned 1
	[0088.242] RestoreDC (hdc=0x4010280, nSavedDC=-1) returned 1
	[0088.243] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.243] GdipReleaseDC (graphics=0x1b496c60, hdc=0x4010280) returned 0x0
	[0088.243] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.243] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0088.243] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0088.243] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.243] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.243] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x10107f8, lParam=0x0) returned 0x1
	[0088.243] GetStockObject (i=5) returned 0x1900015
	[0088.243] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.244] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.244] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.244] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201ba, Msg=0x14, wParam=0x10107f8, lParam=0x0) returned 0x1
	[0088.244] GetStockObject (i=5) returned 0x1900015
	[0088.244] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.244] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.245] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.249] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x14, wParam=0x10107f8, lParam=0x0) returned 0x1
	[0088.249] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.249] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0088.250] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20e0c0 | out: lpwndpl=0x20e0c0) returned 1
	[0088.250] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e660) returned 0x0
	[0088.250] GetClientRect (in: hWnd=0x50120, lpRect=0x20de60 | out: lpRect=0x20de60) returned 1
	[0088.250] GetWindowRect (in: hWnd=0x50120, lpRect=0x20de60 | out: lpRect=0x20de60) returned 1
	[0088.250] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0088.250] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0088.250] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0088.251] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.251] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1
	[0088.251] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1
	[0088.251] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1
	[0088.252] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.405] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0088.406] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0088.406] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.406] IsWindowUnicode (hWnd=0x50120) returned 1
	[0088.407] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.407] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0088.408] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0088.419] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.419] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27f01d6) returned 0x1
	[0088.419] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0088.419] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.419] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27f01d6) returned 0x1
	[0088.421] SetCursor (hCursor=0xe00df) returned 0x10007
	[0088.421] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0088.421] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0088.906] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0088.906] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0088.906] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0088.907] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0088.908] GetKeyState (nVirtKey=1) returned 0
	[0088.908] GetKeyState (nVirtKey=2) returned 0
	[0088.908] GetKeyState (nVirtKey=4) returned 0
	[0088.908] GetKeyState (nVirtKey=5) returned 0
	[0088.908] GetKeyState (nVirtKey=6) returned 0
	[0088.909] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.909] IsWindowUnicode (hWnd=0x50120) returned 1
	[0088.909] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.909] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0088.909] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0088.913] BeginPaint (in: hWnd=0x50120, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x10107f8
	[0088.913] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0088.913] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0088.913] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0088.913] GetSystemMetrics (nIndex=42) returned 0
	[0088.913] CoTaskMemAlloc (cb=0x26) returned 0x1b07df90
	[0088.913] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b07df90, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0088.913] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b07df90) returned 0x10
	[0088.913] CoTaskMemFree (pv=0x1b07df90) 
	[0088.914] EndPaint (hWnd=0x50120, lpPaint=0x20da98) returned 1
	[0088.914] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x0
	[0088.914] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.915] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0088.915] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0088.915] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0088.915] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0088.915] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0088.915] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0088.917] CreateCompatibleDC (hdc=0x70107fc) returned 0x100107d2
	[0088.918] GetObjectType (h=0x70107fc) returned 0x3
	[0088.918] CreateCompatibleBitmap (hdc=0x70107fc, cx=1, cy=1) returned 0xffffffffc10507d0
	[0088.919] GetDIBits (in: hdc=0x70107fc, hbm=0xffffffffc10507d0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0088.919] GetDIBits (in: hdc=0x70107fc, hbm=0xffffffffc10507d0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0088.919] DeleteObject (ho=0xffffffffc10507d0) returned 1
	[0088.919] CreateDIBSection (in: hdc=0x70107fc, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x210507a5
	[0088.920] SelectObject (hdc=0x100107d2, h=0x210507a5) returned 0x185000f
	[0088.920] GdipCreateFromHDC (hdc=0x100107d2, graphics=0x20d750) returned 0x0
	[0088.921] GdipTranslateWorldTransform (graphics=0x1b496c60, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0088.923] GdipSetClipRectI (graphics=0x1b496c60, x=0, y=0, width=310, height=83, combineMode=0x0) returned 0x0
	[0088.923] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0088.923] GdipGetWorldTransform (graphics=0x1b496c60, matrix=0x1b49f050) returned 0x0
	[0088.923] GdipIsMatrixIdentity (matrix=0x1b49f050, result=0x20d970) returned 0x0
	[0088.923] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0088.923] GdipGetMatrixElements (matrix=0x1b49f050, matrixOut=0x1b07bbc0) returned 0x0
	[0088.923] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0088.923] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.923] GdipDeleteMatrix (matrix=0x1b49f050) returned 0x0
	[0088.923] GdipCreateRegion (region=0x20d910) returned 0x0
	[0088.923] GdipGetClip (graphics=0x1b496c60, region=0x1b90f1d0) returned 0x0
	[0088.923] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b496c60, result=0x20d940) returned 0x0
	[0088.925] GdipSaveGraphics (graphics=0x1b496c60, state=0x20da10) returned 0x0
	[0088.925] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0088.925] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0088.925] GetSystemMetrics (nIndex=42) returned 0
	[0088.925] CoTaskMemAlloc (cb=0xf0) returned 0x1b07eac0
	[0088.926] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07eac0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0088.926] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07eac0) returned 0x75
	[0088.926] CoTaskMemFree (pv=0x1b07eac0) 
	[0088.926] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0088.980] GdipCreateRegion (region=0x20d400) returned 0x0
	[0088.980] GdipGetClip (graphics=0x1b496c60, region=0x1b90f290) returned 0x0
	[0088.980] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0088.980] GdipGetWorldTransform (graphics=0x1b496c60, matrix=0x1b49f090) returned 0x0
	[0088.980] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d460) returned 0x0
	[0088.980] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0088.981] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0088.981] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0088.981] GdipCombineRegionRegion (region=0x1b90f290, region2=0x1b90f1d0, combineMode=0x1) returned 0x0
	[0088.981] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0088.981] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0088.981] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0088.981] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.982] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0088.982] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b496c60, result=0x20d4b0) returned 0x0
	[0088.982] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b496c60, result=0x20d470) returned 0x0
	[0088.982] GdipGetRegionHRgn (region=0x1b90f290, graphics=0x1b496c60, hRgn=0x20d470) returned 0x0
	[0088.983] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.983] GdipDeleteRegion (region=0x1b90f290) returned 0x0
	[0088.983] GdipGetDC (graphics=0x1b496c60, hdc=0x20d4e0) returned 0x0
	[0088.983] GetCurrentObject (hdc=0x100107d2, type=0x1) returned 0x1b00017
	[0088.983] GetCurrentObject (hdc=0x100107d2, type=0x2) returned 0x1900010
	[0088.983] GetCurrentObject (hdc=0x100107d2, type=0x7) returned 0x210507a5
	[0088.983] GetCurrentObject (hdc=0x100107d2, type=0x6) returned 0x18a002e
	[0088.983] SaveDC (hdc=0x100107d2) returned 1
	[0088.985] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe04070d
	[0088.986] GetClipRgn (hdc=0x100107d2, hrgn=0xe04070d) returned 0
	[0088.986] SelectClipRgn (hdc=0x100107d2, hrgn=0x36040806) returned 2
	[0088.987] DeleteObject (ho=0xe04070d) returned 1
	[0088.987] DeleteObject (ho=0x36040806) returned 1
	[0088.987] OffsetViewportOrgEx (in: hdc=0x100107d2, x=0, y=0, lppt=0x263f5f8 | out: lppt=0x263f5f8) returned 1
	[0088.987] GetNearestColor (hdc=0x100107d2, color=0x0) returned 0x0
	[0088.987] CreateSolidBrush (color=0x0) returned 0xc1007c0
	[0088.987] FillRect (hDC=0x100107d2, lprc=0x20d4b0, hbr=0xc1007c0) returned 1
	[0088.988] DeleteObject (ho=0xc1007c0) returned 1
	[0088.988] RestoreDC (hdc=0x100107d2, nSavedDC=-1) returned 1
	[0088.988] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0088.988] GdipReleaseDC (graphics=0x1b496c60, hdc=0x100107d2) returned 0x0
	[0088.989] GdipRestoreGraphics (graphics=0x1b496c60, state=0xfffffffffda60dbd) returned 0x0
	[0089.107] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.107] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.107] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0089.107] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0089.107] GetSystemMetrics (nIndex=42) returned 0
	[0089.107] CoTaskMemAlloc (cb=0xf0) returned 0x1b07ebc0
	[0089.107] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07ebc0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0089.107] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07ebc0) returned 0x75
	[0089.107] CoTaskMemFree (pv=0x1b07ebc0) 
	[0089.108] GdipGetDC (graphics=0x1b496c60, hdc=0x20d530) returned 0x0
	[0089.108] GetCurrentObject (hdc=0x100107d2, type=0x1) returned 0x1b00017
	[0089.109] GetCurrentObject (hdc=0x100107d2, type=0x2) returned 0x1900010
	[0089.109] GetCurrentObject (hdc=0x100107d2, type=0x7) returned 0x210507a5
	[0089.109] GetCurrentObject (hdc=0x100107d2, type=0x6) returned 0x18a002e
	[0089.109] SaveDC (hdc=0x100107d2) returned 1
	[0089.109] GetNearestColor (hdc=0x100107d2, color=0x80) returned 0x80
	[0089.109] RestoreDC (hdc=0x100107d2, nSavedDC=-1) returned 1
	[0089.109] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.109] GdipReleaseDC (graphics=0x1b496c60, hdc=0x100107d2) returned 0x0
	[0089.109] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0089.109] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.109] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.109] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.109] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0089.109] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0089.111] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0089.113] GdipDrawString (graphics=0x1b496c60, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.414] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.414] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.506] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.506] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.506] GdipGetDC (graphics=0x1b496c60, hdc=0x20d8e0) returned 0x0
	[0089.507] BitBlt (hdc=0x70107fc, x=0, y=0, cx=310, cy=83, hdcSrc=0x100107d2, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.507] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.507] GdipReleaseDC (graphics=0x1b496c60, hdc=0x100107d2) returned 0x0
	[0089.507] SelectObject (hdc=0x100107d2, h=0x185000f) returned 0x210507a5
	[0089.508] DeleteDC (hdc=0x100107d2) returned 1
	[0089.508] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.508] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0089.508] DeleteObject (ho=0x210507a5) returned 1
	[0089.508] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.508] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0089.508] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.508] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0089.508] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.508] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.508] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.508] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0089.508] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.508] CreateCompatibleDC (hdc=0x4010280) returned 0xffffffffc40107d0
	[0089.509] GetObjectType (h=0x4010280) returned 0x3
	[0089.509] CreateCompatibleBitmap (hdc=0x4010280, cx=1, cy=1) returned 0x220507a5
	[0089.509] GetDIBits (in: hdc=0x4010280, hbm=0x220507a5, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0089.509] GetDIBits (in: hdc=0x4010280, hbm=0x220507a5, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0089.509] DeleteObject (ho=0x220507a5) returned 1
	[0089.509] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d2d0, usage=0x0, ppvBits=0x20d2c8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2c8) returned 0x110507d2
	[0089.509] SelectObject (hdc=0xffffffffc40107d0, h=0x110507d2) returned 0x185000f
	[0089.509] GdipCreateFromHDC (hdc=0xffffffffc40107d0, graphics=0x20d7e0) returned 0x0
	[0089.509] GdipTranslateWorldTransform (graphics=0x1b9157d0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.509] GdipSetClipRectI (graphics=0x1b9157d0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0089.509] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0089.509] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f010) returned 0x0
	[0089.509] GdipIsMatrixIdentity (matrix=0x1b49f010, result=0x20d970) returned 0x0
	[0089.509] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.509] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.513] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.513] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.513] GdipDeleteMatrix (matrix=0x1b49f010) returned 0x0
	[0089.513] GdipCreateRegion (region=0x20d910) returned 0x0
	[0089.513] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f7a0) returned 0x0
	[0089.513] GdipIsInfiniteRegion (region=0x1b90f7a0, graphics=0x1b9157d0, result=0x20d940) returned 0x0
	[0089.513] GdipSaveGraphics (graphics=0x1b9157d0, state=0x20da10) returned 0x0
	[0089.513] GdipRestoreGraphics (graphics=0x1b9157d0, state=0xfffffffffda40dbd) returned 0x0
	[0089.513] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.513] GdipDeleteRegion (region=0x1b90f7a0) returned 0x0
	[0089.688] SystemParametersInfoW (in: uiAction=0x42, uiParam=0x10, pvParam=0x20d590, fWinIni=0x0 | out: pvParam=0x20d590) returned 1
	[0089.688] GdipGetDC (graphics=0x1b9157d0, hdc=0x20cdf0) returned 0x0
	[0089.688] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x1) returned 0x1b00017
	[0089.689] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x2) returned 0x1900010
	[0089.689] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x7) returned 0x110507d2
	[0089.689] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x6) returned 0x18a002e
	[0089.689] SaveDC (hdc=0xffffffffc40107d0) returned 1
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0xf0f0f0) returned 0xf0f0f0
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0xa0a0a0) returned 0xa0a0a0
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0x696969) returned 0x696969
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0xa0a0a0) returned 0xa0a0a0
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0x0) returned 0x0
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0xffffff) returned 0xffffff
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0xe5e5e5) returned 0xe5e5e5
	[0089.689] GetNearestColor (hdc=0xffffffffc40107d0, color=0xd8d8d8) returned 0xd8d8d8
	[0089.690] GetNearestColor (hdc=0xffffffffc40107d0, color=0x0) returned 0x0
	[0089.690] RestoreDC (hdc=0xffffffffc40107d0, nSavedDC=-1) returned 1
	[0089.690] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.690] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc40107d0) returned 0x0
	[0089.690] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.690] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.691] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.691] CoTaskMemFree (pv=0x1b067560) 
	[0089.714] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0089.714] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.714] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.714] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.714] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0089.715] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0089.716] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0089.717] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0089.718] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0089.718] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.718] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.719] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.719] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.719] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.719] CoTaskMemFree (pv=0x1b067560) 
	[0089.772] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0089.772] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0089.772] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0089.773] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0089.774] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.774] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.774] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.774] GdipMeasureString (graphics=0x1b496c60, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0089.774] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.774] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.774] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.774] GdipDeleteGraphics (graphics=0x1b496c60) returned 0x0
	[0089.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.774] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.774] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.774] CoTaskMemFree (pv=0x1b067560) 
	[0089.775] GdipCreateRegion (region=0x20d120) returned 0x0
	[0089.775] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f7a0) returned 0x0
	[0089.775] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0089.775] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f090) returned 0x0
	[0089.775] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d180) returned 0x0
	[0089.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.775] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.775] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.775] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.775] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.775] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.775] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.775] GdipIsInfiniteRegion (region=0x1b90f7a0, graphics=0x1b9157d0, result=0x20d1d0) returned 0x0
	[0089.775] GdipIsInfiniteRegion (region=0x1b90f7a0, graphics=0x1b9157d0, result=0x20d190) returned 0x0
	[0089.775] GdipGetRegionHRgn (region=0x1b90f7a0, graphics=0x1b9157d0, hRgn=0x20d190) returned 0x0
	[0089.775] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.775] GdipDeleteRegion (region=0x1b90f7a0) returned 0x0
	[0089.775] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d200) returned 0x0
	[0089.775] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x1) returned 0x1b00017
	[0089.775] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x2) returned 0x1900010
	[0089.775] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x7) returned 0x110507d2
	[0089.775] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x6) returned 0x18a002e
	[0089.776] SaveDC (hdc=0xffffffffc40107d0) returned 1
	[0089.776] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x37040806
	[0089.776] GetClipRgn (hdc=0xffffffffc40107d0, hrgn=0x37040806) returned 0
	[0089.776] SelectClipRgn (hdc=0xffffffffc40107d0, hrgn=0xf04070d) returned 2
	[0089.776] DeleteObject (ho=0x37040806) returned 1
	[0089.776] DeleteObject (ho=0xf04070d) returned 1
	[0089.776] OffsetViewportOrgEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x26418a0 | out: lppt=0x26418a0) returned 1
	[0089.776] GetNearestColor (hdc=0xffffffffc40107d0, color=0xf0f0f0) returned 0xf0f0f0
	[0089.776] CreateSolidBrush (color=0xf0f0f0) returned 0xd1007c0
	[0089.776] FillRect (hDC=0xffffffffc40107d0, lprc=0x20d1d0, hbr=0xd1007c0) returned 1
	[0089.776] DeleteObject (ho=0xd1007c0) returned 1
	[0089.776] RestoreDC (hdc=0xffffffffc40107d0, nSavedDC=-1) returned 1
	[0089.776] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.776] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc40107d0) returned 0x0
	[0089.777] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.777] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.777] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.777] CoTaskMemFree (pv=0x1b067560) 
	[0089.777] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0089.777] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.777] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.777] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.777] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0089.777] GdipDrawString (graphics=0x1b9157d0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.778] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.778] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.778] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.778] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.778] GetFocus () returned 0x201bc
	[0089.778] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.779] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.779] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.779] CoTaskMemFree (pv=0x1b067560) 
	[0089.779] GdipCreateRegion (region=0x20d070) returned 0x0
	[0089.779] GdipGetClip (graphics=0x1b9157d0, region=0x1b498500) returned 0x0
	[0089.779] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0089.779] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f010) returned 0x0
	[0089.779] GdipIsMatrixIdentity (matrix=0x1b49f010, result=0x20d0d0) returned 0x0
	[0089.779] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.779] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.779] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.779] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.779] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.779] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.779] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.779] GdipDeleteMatrix (matrix=0x1b49f010) returned 0x0
	[0089.779] GdipIsInfiniteRegion (region=0x1b498500, graphics=0x1b9157d0, result=0x20d120) returned 0x0
	[0089.779] GdipIsInfiniteRegion (region=0x1b498500, graphics=0x1b9157d0, result=0x20d0e0) returned 0x0
	[0089.779] GdipGetRegionHRgn (region=0x1b498500, graphics=0x1b9157d0, hRgn=0x20d0e0) returned 0x0
	[0089.780] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.780] GdipDeleteRegion (region=0x1b498500) returned 0x0
	[0089.780] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d150) returned 0x0
	[0089.780] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x1) returned 0x1b00017
	[0089.780] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x2) returned 0x1900010
	[0089.780] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x7) returned 0x110507d2
	[0089.780] GetCurrentObject (hdc=0xffffffffc40107d0, type=0x6) returned 0x18a002e
	[0089.780] SaveDC (hdc=0xffffffffc40107d0) returned 1
	[0089.780] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1004070d
	[0089.780] GetClipRgn (hdc=0xffffffffc40107d0, hrgn=0x1004070d) returned 0
	[0089.780] SelectClipRgn (hdc=0xffffffffc40107d0, hrgn=0x38040806) returned 2
	[0089.780] DeleteObject (ho=0x1004070d) returned 1
	[0089.780] DeleteObject (ho=0x38040806) returned 1
	[0089.780] OffsetViewportOrgEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x2641e00 | out: lppt=0x2641e00) returned 1
	[0089.818] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.819] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.820] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.822] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x12300723
	[0089.823] SelectObject (hdc=0xffffffffc40107d0, h=0x12300723) returned 0x1b00017
	[0089.824] MoveToEx (in: hdc=0xffffffffc40107d0, x=127, y=0, lppt=0x2641e68 | out: lppt=0x2641e68) returned 1
	[0089.824] LineTo (hdc=0xffffffffc40107d0, x=0, y=0) returned 1
	[0089.826] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.826] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.826] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.826] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.826] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.826] SelectObject (hdc=0xffffffffc40107d0, h=0x12300723) returned 0x12300723
	[0089.826] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x2641e80 | out: lppt=0x2641e80) returned 1
	[0089.826] LineTo (hdc=0xffffffffc40107d0, x=0, y=40) returned 1
	[0089.827] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.827] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.827] SelectObject (hdc=0xffffffffc40107d0, h=0x1b00017) returned 0x12300723
	[0089.827] DeleteObject (ho=0x12300723) returned 1
	[0089.828] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.828] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.828] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.828] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xe300712
	[0089.828] SelectObject (hdc=0xffffffffc40107d0, h=0xe300712) returned 0x1b00017
	[0089.828] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=40, lppt=0x2641ee8 | out: lppt=0x2641ee8) returned 1
	[0089.828] LineTo (hdc=0xffffffffc40107d0, x=127, y=40) returned 1
	[0089.828] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.828] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.828] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.828] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.828] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.828] SelectObject (hdc=0xffffffffc40107d0, h=0xe300712) returned 0xe300712
	[0089.828] MoveToEx (in: hdc=0xffffffffc40107d0, x=127, y=40, lppt=0x2641f00 | out: lppt=0x2641f00) returned 1
	[0089.828] LineTo (hdc=0xffffffffc40107d0, x=127, y=-1) returned 1
	[0089.828] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.828] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.828] SelectObject (hdc=0xffffffffc40107d0, h=0x1b00017) returned 0xe300712
	[0089.828] DeleteObject (ho=0xe300712) returned 1
	[0089.828] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.828] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.828] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.828] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x13300723
	[0089.829] SelectObject (hdc=0xffffffffc40107d0, h=0x13300723) returned 0x1b00017
	[0089.829] MoveToEx (in: hdc=0xffffffffc40107d0, x=126, y=1, lppt=0x2641f68 | out: lppt=0x2641f68) returned 1
	[0089.829] LineTo (hdc=0xffffffffc40107d0, x=1, y=1) returned 1
	[0089.829] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.829] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.829] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.829] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.829] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.829] SelectObject (hdc=0xffffffffc40107d0, h=0x13300723) returned 0x13300723
	[0089.829] MoveToEx (in: hdc=0xffffffffc40107d0, x=1, y=1, lppt=0x2641f80 | out: lppt=0x2641f80) returned 1
	[0089.829] LineTo (hdc=0xffffffffc40107d0, x=1, y=39) returned 1
	[0089.829] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.829] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.829] SelectObject (hdc=0xffffffffc40107d0, h=0x1b00017) returned 0x13300723
	[0089.829] DeleteObject (ho=0x13300723) returned 1
	[0089.829] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.829] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.829] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.829] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xf300712
	[0089.829] SelectObject (hdc=0xffffffffc40107d0, h=0xf300712) returned 0x1b00017
	[0089.829] MoveToEx (in: hdc=0xffffffffc40107d0, x=1, y=39, lppt=0x2641fe8 | out: lppt=0x2641fe8) returned 1
	[0089.829] LineTo (hdc=0xffffffffc40107d0, x=126, y=39) returned 1
	[0089.829] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.829] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.830] GetROP2 (hdc=0xffffffffc40107d0) returned 13
	[0089.830] GetBkMode (hdc=0xffffffffc40107d0) returned 2
	[0089.830] SetBkMode (hdc=0xffffffffc40107d0, mode=1) returned 2
	[0089.830] SelectObject (hdc=0xffffffffc40107d0, h=0xf300712) returned 0xf300712
	[0089.830] MoveToEx (in: hdc=0xffffffffc40107d0, x=126, y=39, lppt=0x2642000 | out: lppt=0x2642000) returned 1
	[0089.830] LineTo (hdc=0xffffffffc40107d0, x=126, y=0) returned 1
	[0089.830] SetBkMode (hdc=0xffffffffc40107d0, mode=2) returned 1
	[0089.830] MoveToEx (in: hdc=0xffffffffc40107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.830] SelectObject (hdc=0xffffffffc40107d0, h=0x1b00017) returned 0xf300712
	[0089.830] DeleteObject (ho=0xf300712) returned 1
	[0089.830] RestoreDC (hdc=0xffffffffc40107d0, nSavedDC=-1) returned 1
	[0089.830] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.830] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc40107d0) returned 0x0
	[0089.830] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d8e0) returned 0x0
	[0089.830] BitBlt (hdc=0x4010280, x=0, y=0, cx=128, cy=41, hdcSrc=0xffffffffc40107d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.830] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.830] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc40107d0) returned 0x0
	[0089.830] SelectObject (hdc=0xffffffffc40107d0, h=0x185000f) returned 0x110507d2
	[0089.830] DeleteDC (hdc=0xffffffffc40107d0) returned 1
	[0089.830] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.830] GdipDeleteGraphics (graphics=0x1b9157d0) returned 0x0
	[0089.830] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.831] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0089.831] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.831] IsWindowUnicode (hWnd=0x301b6) returned 1
	[0089.831] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.831] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.831] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.831] BeginPaint (in: hWnd=0x301b6, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0089.831] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.831] CreateCompatibleDC (hdc=0x10107f8) returned 0xffffffffc60107d0
	[0089.831] DeleteObject (ho=0x110507d2) returned 1
	[0089.831] GetObjectType (h=0x10107f8) returned 0x3
	[0089.831] CreateCompatibleBitmap (hdc=0x10107f8, cx=1, cy=1) returned 0x240507a5
	[0089.831] GetDIBits (in: hdc=0x10107f8, hbm=0x240507a5, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0089.831] GetDIBits (in: hdc=0x10107f8, hbm=0x240507a5, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0089.831] DeleteObject (ho=0x240507a5) returned 1
	[0089.831] CreateDIBSection (in: hdc=0x10107f8, lpbmi=0x20d2d0, usage=0x0, ppvBits=0x20d2c8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2c8) returned 0x120507d2
	[0089.831] SelectObject (hdc=0xffffffffc60107d0, h=0x120507d2) returned 0x185000f
	[0089.831] GdipCreateFromHDC (hdc=0xffffffffc60107d0, graphics=0x20d7e0) returned 0x0
	[0089.832] GdipTranslateWorldTransform (graphics=0x1b9157d0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.832] GdipSetClipRectI (graphics=0x1b9157d0, x=0, y=0, width=138, height=29, combineMode=0x0) returned 0x0
	[0089.832] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0089.832] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f090) returned 0x0
	[0089.832] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d970) returned 0x0
	[0089.832] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.832] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.832] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.832] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.832] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.832] GdipCreateRegion (region=0x20d910) returned 0x0
	[0089.832] GdipGetClip (graphics=0x1b9157d0, region=0x1b498500) returned 0x0
	[0089.832] GdipIsInfiniteRegion (region=0x1b498500, graphics=0x1b9157d0, result=0x20d940) returned 0x0
	[0089.832] GdipSaveGraphics (graphics=0x1b9157d0, state=0x20da10) returned 0x0
	[0089.832] GetWindowTextLengthW (hWnd=0x301b6) returned 9
	[0089.832] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
	[0089.832] GetSystemMetrics (nIndex=42) returned 0
	[0089.832] CoTaskMemAlloc (cb=0x18) returned 0x1b067560
	[0089.832] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b067560, nMaxCount=10 | out: lpString="XDUWTFONO") returned 9
	[0089.832] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xd, wParam=0xa, lParam=0x1b067560) returned 0x9
	[0089.832] CoTaskMemFree (pv=0x1b067560) 
	[0089.832] GetClientRect (in: hWnd=0x301b6, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0089.832] GdipCreateRegion (region=0x20d400) returned 0x0
	[0089.832] GdipGetClip (graphics=0x1b9157d0, region=0x1b496f70) returned 0x0
	[0089.832] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0089.833] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f010) returned 0x0
	[0089.833] GdipIsMatrixIdentity (matrix=0x1b49f010, result=0x20d460) returned 0x0
	[0089.833] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.833] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.833] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.833] GdipCombineRegionRegion (region=0x1b496f70, region2=0x1b498500, combineMode=0x1) returned 0x0
	[0089.833] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.833] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.833] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.833] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.833] GdipDeleteMatrix (matrix=0x1b49f010) returned 0x0
	[0089.833] GdipIsInfiniteRegion (region=0x1b496f70, graphics=0x1b9157d0, result=0x20d4b0) returned 0x0
	[0089.833] GdipIsInfiniteRegion (region=0x1b496f70, graphics=0x1b9157d0, result=0x20d470) returned 0x0
	[0089.833] GdipGetRegionHRgn (region=0x1b496f70, graphics=0x1b9157d0, hRgn=0x20d470) returned 0x0
	[0089.833] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.833] GdipDeleteRegion (region=0x1b496f70) returned 0x0
	[0089.833] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d4e0) returned 0x0
	[0089.833] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x1) returned 0x1b00017
	[0089.833] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x2) returned 0x1900010
	[0089.833] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x7) returned 0x120507d2
	[0089.833] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x6) returned 0x18a002e
	[0089.833] SaveDC (hdc=0xffffffffc60107d0) returned 1
	[0089.833] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x39040806
	[0089.833] GetClipRgn (hdc=0xffffffffc60107d0, hrgn=0x39040806) returned 0
	[0089.833] SelectClipRgn (hdc=0xffffffffc60107d0, hrgn=0x1104070d) returned 2
	[0089.833] DeleteObject (ho=0x39040806) returned 1
	[0089.834] DeleteObject (ho=0x1104070d) returned 1
	[0089.834] OffsetViewportOrgEx (in: hdc=0xffffffffc60107d0, x=0, y=0, lppt=0x2643640 | out: lppt=0x2643640) returned 1
	[0089.834] GetNearestColor (hdc=0xffffffffc60107d0, color=0x0) returned 0x0
	[0089.834] CreateSolidBrush (color=0x0) returned 0xe1007c0
	[0089.834] FillRect (hDC=0xffffffffc60107d0, lprc=0x20d4b0, hbr=0xe1007c0) returned 1
	[0089.834] DeleteObject (ho=0xe1007c0) returned 1
	[0089.834] RestoreDC (hdc=0xffffffffc60107d0, nSavedDC=-1) returned 1
	[0089.834] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.834] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc60107d0) returned 0x0
	[0089.834] GdipRestoreGraphics (graphics=0x1b9157d0, state=0xfffffffffda10dbd) returned 0x0
	[0089.834] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.834] GdipDeleteRegion (region=0x1b498500) returned 0x0
	[0089.834] GetWindowTextLengthW (hWnd=0x301b6) returned 9
	[0089.834] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
	[0089.834] GetSystemMetrics (nIndex=42) returned 0
	[0089.834] CoTaskMemAlloc (cb=0x18) returned 0x1b067560
	[0089.834] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b067560, nMaxCount=10 | out: lpString="XDUWTFONO") returned 9
	[0089.834] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x301b6, Msg=0xd, wParam=0xa, lParam=0x1b067560) returned 0x9
	[0089.834] CoTaskMemFree (pv=0x1b067560) 
	[0089.834] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d530) returned 0x0
	[0089.834] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x1) returned 0x1b00017
	[0089.834] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x2) returned 0x1900010
	[0089.834] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x7) returned 0x120507d2
	[0089.835] GetCurrentObject (hdc=0xffffffffc60107d0, type=0x6) returned 0x18a002e
	[0089.835] SaveDC (hdc=0xffffffffc60107d0) returned 1
	[0089.835] GetNearestColor (hdc=0xffffffffc60107d0, color=0x80) returned 0x80
	[0089.835] RestoreDC (hdc=0xffffffffc60107d0, nSavedDC=-1) returned 1
	[0089.835] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.835] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc60107d0) returned 0x0
	[0089.835] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0089.835] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.835] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.835] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.835] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0089.835] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0089.835] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0089.835] GdipDrawString (graphics=0x1b9157d0, string="XDUWTFONO", length=9, font=0x1b40c310, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.836] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.836] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.836] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.836] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.836] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d8e0) returned 0x0
	[0089.836] BitBlt (hdc=0x10107f8, x=0, y=0, cx=138, cy=29, hdcSrc=0xffffffffc60107d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.837] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.837] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc60107d0) returned 0x0
	[0089.837] SelectObject (hdc=0xffffffffc60107d0, h=0x185000f) returned 0x120507d2
	[0089.837] DeleteDC (hdc=0xffffffffc60107d0) returned 1
	[0089.837] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.837] GdipDeleteGraphics (graphics=0x1b9157d0) returned 0x0
	[0089.837] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.837] EndPaint (hWnd=0x301b6, lpPaint=0x20d9e8) returned 1
	[0089.837] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.837] IsWindowUnicode (hWnd=0x401b2) returned 1
	[0089.837] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.837] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.837] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.837] BeginPaint (in: hWnd=0x401b2, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0089.837] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.837] CreateCompatibleDC (hdc=0x70107fc) returned 0xffffffffc80107d0
	[0089.837] SelectObject (hdc=0xffffffffc80107d0, h=0x120507d2) returned 0x185000f
	[0089.837] GdipCreateFromHDC (hdc=0xffffffffc80107d0, graphics=0x20d7e0) returned 0x0
	[0089.837] GdipTranslateWorldTransform (graphics=0x1b9157d0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.837] GdipSetClipRectI (graphics=0x1b9157d0, x=0, y=0, width=123, height=35, combineMode=0x0) returned 0x0
	[0089.837] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0089.837] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f090) returned 0x0
	[0089.837] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d970) returned 0x0
	[0089.838] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.838] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.838] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.838] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.838] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.838] GdipCreateRegion (region=0x20d910) returned 0x0
	[0089.838] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f1d0) returned 0x0
	[0089.838] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d940) returned 0x0
	[0089.838] GdipSaveGraphics (graphics=0x1b9157d0, state=0x20da10) returned 0x0
	[0089.838] GetWindowTextLengthW (hWnd=0x401b2) returned 7
	[0089.838] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
	[0089.838] GetSystemMetrics (nIndex=42) returned 0
	[0089.838] CoTaskMemAlloc (cb=0x14) returned 0x1b067560
	[0089.838] GetWindowTextW (in: hWnd=0x401b2, lpString=0x1b067560, nMaxCount=8 | out: lpString="Welcome") returned 7
	[0089.838] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0xd, wParam=0x8, lParam=0x1b067560) returned 0x7
	[0089.838] CoTaskMemFree (pv=0x1b067560) 
	[0089.838] GetClientRect (in: hWnd=0x401b2, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0089.838] GdipCreateRegion (region=0x20d400) returned 0x0
	[0089.839] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f290) returned 0x0
	[0089.839] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0089.839] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f010) returned 0x0
	[0089.839] GdipIsMatrixIdentity (matrix=0x1b49f010, result=0x20d460) returned 0x0
	[0089.839] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.839] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.839] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.839] GdipCombineRegionRegion (region=0x1b90f290, region2=0x1b90f1d0, combineMode=0x1) returned 0x0
	[0089.839] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.839] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.839] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.839] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.839] GdipDeleteMatrix (matrix=0x1b49f010) returned 0x0
	[0089.839] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b9157d0, result=0x20d4b0) returned 0x0
	[0089.839] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b9157d0, result=0x20d470) returned 0x0
	[0089.839] GdipGetRegionHRgn (region=0x1b90f290, graphics=0x1b9157d0, hRgn=0x20d470) returned 0x0
	[0089.839] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.839] GdipDeleteRegion (region=0x1b90f290) returned 0x0
	[0089.839] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d4e0) returned 0x0
	[0089.839] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x1) returned 0x1b00017
	[0089.839] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x2) returned 0x1900010
	[0089.839] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x7) returned 0x120507d2
	[0089.839] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x6) returned 0x18a002e
	[0089.840] SaveDC (hdc=0xffffffffc80107d0) returned 1
	[0089.840] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1204070d
	[0089.840] GetClipRgn (hdc=0xffffffffc80107d0, hrgn=0x1204070d) returned 0
	[0089.840] SelectClipRgn (hdc=0xffffffffc80107d0, hrgn=0x3a040806) returned 2
	[0089.840] DeleteObject (ho=0x1204070d) returned 1
	[0089.840] DeleteObject (ho=0x3a040806) returned 1
	[0089.840] OffsetViewportOrgEx (in: hdc=0xffffffffc80107d0, x=0, y=0, lppt=0x2644170 | out: lppt=0x2644170) returned 1
	[0089.840] GetNearestColor (hdc=0xffffffffc80107d0, color=0x0) returned 0x0
	[0089.840] CreateSolidBrush (color=0x0) returned 0xf1007c0
	[0089.840] FillRect (hDC=0xffffffffc80107d0, lprc=0x20d4b0, hbr=0xf1007c0) returned 1
	[0089.840] DeleteObject (ho=0xf1007c0) returned 1
	[0089.840] RestoreDC (hdc=0xffffffffc80107d0, nSavedDC=-1) returned 1
	[0089.840] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.840] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc80107d0) returned 0x0
	[0089.840] GdipRestoreGraphics (graphics=0x1b9157d0, state=0xfffffffffd9f0dbd) returned 0x0
	[0089.840] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.840] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.840] GetWindowTextLengthW (hWnd=0x401b2) returned 7
	[0089.840] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
	[0089.840] GetSystemMetrics (nIndex=42) returned 0
	[0089.840] CoTaskMemAlloc (cb=0x14) returned 0x1b067560
	[0089.840] GetWindowTextW (in: hWnd=0x401b2, lpString=0x1b067560, nMaxCount=8 | out: lpString="Welcome") returned 7
	[0089.840] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401b2, Msg=0xd, wParam=0x8, lParam=0x1b067560) returned 0x7
	[0089.841] CoTaskMemFree (pv=0x1b067560) 
	[0089.841] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d530) returned 0x0
	[0089.841] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x1) returned 0x1b00017
	[0089.841] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x2) returned 0x1900010
	[0089.841] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x7) returned 0x120507d2
	[0089.841] GetCurrentObject (hdc=0xffffffffc80107d0, type=0x6) returned 0x18a002e
	[0089.841] SaveDC (hdc=0xffffffffc80107d0) returned 1
	[0089.841] GetNearestColor (hdc=0xffffffffc80107d0, color=0x80) returned 0x80
	[0089.841] RestoreDC (hdc=0xffffffffc80107d0, nSavedDC=-1) returned 1
	[0089.841] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.841] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc80107d0) returned 0x0
	[0089.841] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0089.841] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.841] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.841] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.841] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0089.841] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0089.841] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0089.841] GdipDrawString (graphics=0x1b9157d0, string="Welcome", length=7, font=0x1b3fd7e0, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.843] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.843] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.843] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.843] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.843] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d8e0) returned 0x0
	[0089.843] BitBlt (hdc=0x70107fc, x=0, y=0, cx=123, cy=35, hdcSrc=0xffffffffc80107d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.843] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.844] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffc80107d0) returned 0x0
	[0089.844] SelectObject (hdc=0xffffffffc80107d0, h=0x185000f) returned 0x120507d2
	[0089.844] DeleteDC (hdc=0xffffffffc80107d0) returned 1
	[0089.844] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.844] GdipDeleteGraphics (graphics=0x1b9157d0) returned 0x0
	[0089.844] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.844] EndPaint (hWnd=0x401b2, lpPaint=0x20d9e8) returned 1
	[0089.844] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.844] IsWindowUnicode (hWnd=0x201ba) returned 1
	[0089.844] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.844] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.844] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.844] BeginPaint (in: hWnd=0x201ba, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0089.844] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.844] CreateCompatibleDC (hdc=0x4010280) returned 0xffffffffca0107d0
	[0089.844] SelectObject (hdc=0xffffffffca0107d0, h=0x120507d2) returned 0x185000f
	[0089.844] GdipCreateFromHDC (hdc=0xffffffffca0107d0, graphics=0x20d7e0) returned 0x0
	[0089.844] GdipTranslateWorldTransform (graphics=0x1b9157d0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.844] GdipSetClipRectI (graphics=0x1b9157d0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0089.844] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0089.844] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f090) returned 0x0
	[0089.844] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d970) returned 0x0
	[0089.845] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.845] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.845] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.845] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.845] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.845] GdipCreateRegion (region=0x20d910) returned 0x0
	[0089.845] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f1d0) returned 0x0
	[0089.845] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d940) returned 0x0
	[0089.845] GdipSaveGraphics (graphics=0x1b9157d0, state=0x20da10) returned 0x0
	[0089.845] GdipRestoreGraphics (graphics=0x1b9157d0, state=0xfffffffffd9d0dbd) returned 0x0
	[0089.845] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.845] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.845] GdipGetDC (graphics=0x1b9157d0, hdc=0x20cdf0) returned 0x0
	[0089.845] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x1) returned 0x1b00017
	[0089.845] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x2) returned 0x1900010
	[0089.845] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x7) returned 0x120507d2
	[0089.845] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x6) returned 0x18a002e
	[0089.845] SaveDC (hdc=0xffffffffca0107d0) returned 1
	[0089.845] GetNearestColor (hdc=0xffffffffca0107d0, color=0xf0f0f0) returned 0xf0f0f0
	[0089.845] GetNearestColor (hdc=0xffffffffca0107d0, color=0xa0a0a0) returned 0xa0a0a0
	[0089.845] GetNearestColor (hdc=0xffffffffca0107d0, color=0x696969) returned 0x696969
	[0089.845] GetNearestColor (hdc=0xffffffffca0107d0, color=0xa0a0a0) returned 0xa0a0a0
	[0089.846] GetNearestColor (hdc=0xffffffffca0107d0, color=0x0) returned 0x0
	[0089.846] GetNearestColor (hdc=0xffffffffca0107d0, color=0xffffff) returned 0xffffff
	[0089.846] GetNearestColor (hdc=0xffffffffca0107d0, color=0xe5e5e5) returned 0xe5e5e5
	[0089.846] GetNearestColor (hdc=0xffffffffca0107d0, color=0xd8d8d8) returned 0xd8d8d8
	[0089.846] GetNearestColor (hdc=0xffffffffca0107d0, color=0x0) returned 0x0
	[0089.846] RestoreDC (hdc=0xffffffffca0107d0, nSavedDC=-1) returned 1
	[0089.846] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.846] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffca0107d0) returned 0x0
	[0089.846] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.846] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.846] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.846] CoTaskMemFree (pv=0x1b067560) 
	[0089.846] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0089.846] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.846] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.847] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.847] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0089.847] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0089.847] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0089.847] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0089.847] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0089.847] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.847] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.847] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.847] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.847] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.847] CoTaskMemFree (pv=0x1b067560) 
	[0089.847] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0089.847] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0089.847] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0089.847] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0089.847] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.847] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.848] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.848] GdipMeasureString (graphics=0x1b910300, string="Extract now", length=11, font=0x1b3fd7a0, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0089.848] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.848] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.848] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.848] GdipDeleteGraphics (graphics=0x1b910300) returned 0x0
	[0089.848] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.848] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.848] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.848] CoTaskMemFree (pv=0x1b067560) 
	[0089.849] GdipCreateRegion (region=0x20d120) returned 0x0
	[0089.849] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f1d0) returned 0x0
	[0089.849] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0089.849] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f010) returned 0x0
	[0089.849] GdipIsMatrixIdentity (matrix=0x1b49f010, result=0x20d180) returned 0x0
	[0089.849] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.849] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.849] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.849] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.849] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.849] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.849] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.849] GdipDeleteMatrix (matrix=0x1b49f010) returned 0x0
	[0089.849] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d1d0) returned 0x0
	[0089.849] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d190) returned 0x0
	[0089.849] GdipGetRegionHRgn (region=0x1b90f1d0, graphics=0x1b9157d0, hRgn=0x20d190) returned 0x0
	[0089.849] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.849] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.849] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d200) returned 0x0
	[0089.849] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x1) returned 0x1b00017
	[0089.849] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x2) returned 0x1900010
	[0089.849] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x7) returned 0x120507d2
	[0089.849] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x6) returned 0x18a002e
	[0089.849] SaveDC (hdc=0xffffffffca0107d0) returned 1
	[0089.850] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b040806
	[0089.850] GetClipRgn (hdc=0xffffffffca0107d0, hrgn=0x3b040806) returned 0
	[0089.850] SelectClipRgn (hdc=0xffffffffca0107d0, hrgn=0x1304070d) returned 2
	[0089.850] DeleteObject (ho=0x3b040806) returned 1
	[0089.850] DeleteObject (ho=0x1304070d) returned 1
	[0089.850] OffsetViewportOrgEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x26451a0 | out: lppt=0x26451a0) returned 1
	[0089.850] GetNearestColor (hdc=0xffffffffca0107d0, color=0xf0f0f0) returned 0xf0f0f0
	[0089.850] CreateSolidBrush (color=0xf0f0f0) returned 0x101007c0
	[0089.850] FillRect (hDC=0xffffffffca0107d0, lprc=0x20d1d0, hbr=0x101007c0) returned 1
	[0089.850] DeleteObject (ho=0x101007c0) returned 1
	[0089.850] RestoreDC (hdc=0xffffffffca0107d0, nSavedDC=-1) returned 1
	[0089.850] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.850] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffca0107d0) returned 0x0
	[0089.850] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.850] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.850] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.851] CoTaskMemFree (pv=0x1b067560) 
	[0089.851] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0089.851] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.851] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0089.851] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.851] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0089.851] GdipDrawString (graphics=0x1b9157d0, string="Extract now", length=11, font=0x1b3fd7a0, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.851] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.851] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.851] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.851] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.851] GetFocus () returned 0x201bc
	[0089.852] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0089.852] CoTaskMemAlloc (cb=0x13) returned 0x1b067560
	[0089.852] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0089.853] CoTaskMemFree (pv=0x1b067560) 
	[0089.853] GdipCreateRegion (region=0x20d070) returned 0x0
	[0089.853] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f1d0) returned 0x0
	[0089.853] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0089.853] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f090) returned 0x0
	[0089.853] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d0d0) returned 0x0
	[0089.853] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.853] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.853] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.853] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.853] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.853] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.853] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.853] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.853] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d120) returned 0x0
	[0089.853] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d0e0) returned 0x0
	[0089.853] GdipGetRegionHRgn (region=0x1b90f1d0, graphics=0x1b9157d0, hRgn=0x20d0e0) returned 0x0
	[0089.853] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.854] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.854] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d150) returned 0x0
	[0089.854] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x1) returned 0x1b00017
	[0089.854] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x2) returned 0x1900010
	[0089.854] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x7) returned 0x120507d2
	[0089.854] GetCurrentObject (hdc=0xffffffffca0107d0, type=0x6) returned 0x18a002e
	[0089.854] SaveDC (hdc=0xffffffffca0107d0) returned 1
	[0089.854] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1404070d
	[0089.854] GetClipRgn (hdc=0xffffffffca0107d0, hrgn=0x1404070d) returned 0
	[0089.854] SelectClipRgn (hdc=0xffffffffca0107d0, hrgn=0x3c040806) returned 2
	[0089.854] DeleteObject (ho=0x1404070d) returned 1
	[0089.854] DeleteObject (ho=0x3c040806) returned 1
	[0089.854] OffsetViewportOrgEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x2645700 | out: lppt=0x2645700) returned 1
	[0089.854] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.854] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.854] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.854] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x10300712
	[0089.854] SelectObject (hdc=0xffffffffca0107d0, h=0x10300712) returned 0x1b00017
	[0089.854] MoveToEx (in: hdc=0xffffffffca0107d0, x=127, y=0, lppt=0x2645768 | out: lppt=0x2645768) returned 1
	[0089.854] LineTo (hdc=0xffffffffca0107d0, x=0, y=0) returned 1
	[0089.854] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.854] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.854] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.855] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.855] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.855] SelectObject (hdc=0xffffffffca0107d0, h=0x10300712) returned 0x10300712
	[0089.855] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x2645780 | out: lppt=0x2645780) returned 1
	[0089.855] LineTo (hdc=0xffffffffca0107d0, x=0, y=40) returned 1
	[0089.855] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.855] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.855] SelectObject (hdc=0xffffffffca0107d0, h=0x1b00017) returned 0x10300712
	[0089.855] DeleteObject (ho=0x10300712) returned 1
	[0089.855] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.855] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.855] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.855] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x14300723
	[0089.855] SelectObject (hdc=0xffffffffca0107d0, h=0x14300723) returned 0x1b00017
	[0089.855] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=40, lppt=0x26457e8 | out: lppt=0x26457e8) returned 1
	[0089.855] LineTo (hdc=0xffffffffca0107d0, x=127, y=40) returned 1
	[0089.855] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.855] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.855] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.855] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.855] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.856] SelectObject (hdc=0xffffffffca0107d0, h=0x14300723) returned 0x14300723
	[0089.856] MoveToEx (in: hdc=0xffffffffca0107d0, x=127, y=40, lppt=0x2645800 | out: lppt=0x2645800) returned 1
	[0089.856] LineTo (hdc=0xffffffffca0107d0, x=127, y=-1) returned 1
	[0089.856] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.856] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.856] SelectObject (hdc=0xffffffffca0107d0, h=0x1b00017) returned 0x14300723
	[0089.856] DeleteObject (ho=0x14300723) returned 1
	[0089.856] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.856] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.856] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.856] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x11300712
	[0089.856] SelectObject (hdc=0xffffffffca0107d0, h=0x11300712) returned 0x1b00017
	[0089.856] MoveToEx (in: hdc=0xffffffffca0107d0, x=126, y=1, lppt=0x2645868 | out: lppt=0x2645868) returned 1
	[0089.856] LineTo (hdc=0xffffffffca0107d0, x=1, y=1) returned 1
	[0089.856] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.856] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.856] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.856] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.856] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.856] SelectObject (hdc=0xffffffffca0107d0, h=0x11300712) returned 0x11300712
	[0089.856] MoveToEx (in: hdc=0xffffffffca0107d0, x=1, y=1, lppt=0x2645880 | out: lppt=0x2645880) returned 1
	[0089.856] LineTo (hdc=0xffffffffca0107d0, x=1, y=39) returned 1
	[0089.857] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.857] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.857] SelectObject (hdc=0xffffffffca0107d0, h=0x1b00017) returned 0x11300712
	[0089.857] DeleteObject (ho=0x11300712) returned 1
	[0089.857] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.857] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.857] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.857] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x15300723
	[0089.857] SelectObject (hdc=0xffffffffca0107d0, h=0x15300723) returned 0x1b00017
	[0089.857] MoveToEx (in: hdc=0xffffffffca0107d0, x=1, y=39, lppt=0x26458e8 | out: lppt=0x26458e8) returned 1
	[0089.857] LineTo (hdc=0xffffffffca0107d0, x=126, y=39) returned 1
	[0089.857] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.857] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.857] GetROP2 (hdc=0xffffffffca0107d0) returned 13
	[0089.857] GetBkMode (hdc=0xffffffffca0107d0) returned 2
	[0089.857] SetBkMode (hdc=0xffffffffca0107d0, mode=1) returned 2
	[0089.857] SelectObject (hdc=0xffffffffca0107d0, h=0x15300723) returned 0x15300723
	[0089.857] MoveToEx (in: hdc=0xffffffffca0107d0, x=126, y=39, lppt=0x2645900 | out: lppt=0x2645900) returned 1
	[0089.857] LineTo (hdc=0xffffffffca0107d0, x=126, y=0) returned 1
	[0089.857] SetBkMode (hdc=0xffffffffca0107d0, mode=2) returned 1
	[0089.857] MoveToEx (in: hdc=0xffffffffca0107d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0089.857] SelectObject (hdc=0xffffffffca0107d0, h=0x1b00017) returned 0x15300723
	[0089.857] DeleteObject (ho=0x15300723) returned 1
	[0089.857] RestoreDC (hdc=0xffffffffca0107d0, nSavedDC=-1) returned 1
	[0089.858] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.858] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffca0107d0) returned 0x0
	[0089.858] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d8e0) returned 0x0
	[0089.858] BitBlt (hdc=0x4010280, x=0, y=0, cx=128, cy=41, hdcSrc=0xffffffffca0107d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.858] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.858] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffca0107d0) returned 0x0
	[0089.858] SelectObject (hdc=0xffffffffca0107d0, h=0x185000f) returned 0x120507d2
	[0089.858] DeleteDC (hdc=0xffffffffca0107d0) returned 1
	[0089.858] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.858] GdipDeleteGraphics (graphics=0x1b9157d0) returned 0x0
	[0089.858] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.858] EndPaint (hWnd=0x201ba, lpPaint=0x20d9e8) returned 1
	[0089.858] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.858] IsWindowUnicode (hWnd=0x201ea) returned 1
	[0089.858] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.858] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.858] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.858] BeginPaint (in: hWnd=0x201ea, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0089.858] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.858] CreateCompatibleDC (hdc=0x10107f8) returned 0xffffffffcc0107d0
	[0089.858] DeleteObject (ho=0x120507d2) returned 1
	[0089.858] GetObjectType (h=0x10107f8) returned 0x3
	[0089.859] CreateCompatibleBitmap (hdc=0x10107f8, cx=1, cy=1) returned 0x260507a5
	[0089.859] GetDIBits (in: hdc=0x10107f8, hbm=0x260507a5, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0089.859] GetDIBits (in: hdc=0x10107f8, hbm=0x260507a5, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0089.859] DeleteObject (ho=0x260507a5) returned 1
	[0089.859] CreateDIBSection (in: hdc=0x10107f8, lpbmi=0x20d2d0, usage=0x0, ppvBits=0x20d2c8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2c8) returned 0x130507d2
	[0089.859] SelectObject (hdc=0xffffffffcc0107d0, h=0x130507d2) returned 0x185000f
	[0089.859] GdipCreateFromHDC (hdc=0xffffffffcc0107d0, graphics=0x20d7e0) returned 0x0
	[0089.859] GdipTranslateWorldTransform (graphics=0x1b9157d0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.859] GdipSetClipRectI (graphics=0x1b9157d0, x=0, y=0, width=315, height=25, combineMode=0x0) returned 0x0
	[0089.859] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0089.859] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f010) returned 0x0
	[0089.859] GdipIsMatrixIdentity (matrix=0x1b49f010, result=0x20d970) returned 0x0
	[0089.859] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.859] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.859] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.859] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.859] GdipDeleteMatrix (matrix=0x1b49f010) returned 0x0
	[0089.859] GdipCreateRegion (region=0x20d910) returned 0x0
	[0089.859] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f1d0) returned 0x0
	[0089.859] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d940) returned 0x0
	[0089.860] GdipSaveGraphics (graphics=0x1b9157d0, state=0x20da10) returned 0x0
	[0089.860] GetWindowTextLengthW (hWnd=0x201ea) returned 37
	[0089.860] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x25
	[0089.860] GetSystemMetrics (nIndex=42) returned 0
	[0089.860] CoTaskMemAlloc (cb=0x50) returned 0x1b015ff0
	[0089.860] GetWindowTextW (in: hWnd=0x201ea, lpString=0x1b015ff0, nMaxCount=38 | out: lpString="Enter the pin to extract the password") returned 37
	[0089.860] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0xd, wParam=0x26, lParam=0x1b015ff0) returned 0x25
	[0089.860] CoTaskMemFree (pv=0x1b015ff0) 
	[0089.860] GetClientRect (in: hWnd=0x201ea, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0089.860] GdipCreateRegion (region=0x20d400) returned 0x0
	[0089.860] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f290) returned 0x0
	[0089.860] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0089.860] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f090) returned 0x0
	[0089.860] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d460) returned 0x0
	[0089.860] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.860] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.860] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.860] GdipCombineRegionRegion (region=0x1b90f290, region2=0x1b90f1d0, combineMode=0x1) returned 0x0
	[0089.860] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.860] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.860] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.860] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.860] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.860] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b9157d0, result=0x20d4b0) returned 0x0
	[0089.860] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b9157d0, result=0x20d470) returned 0x0
	[0089.861] GdipGetRegionHRgn (region=0x1b90f290, graphics=0x1b9157d0, hRgn=0x20d470) returned 0x0
	[0089.861] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.861] GdipDeleteRegion (region=0x1b90f290) returned 0x0
	[0089.861] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d4e0) returned 0x0
	[0089.861] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x1) returned 0x1b00017
	[0089.861] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x2) returned 0x1900010
	[0089.861] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x7) returned 0x130507d2
	[0089.861] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x6) returned 0x18a002e
	[0089.861] SaveDC (hdc=0xffffffffcc0107d0) returned 1
	[0089.861] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d040806
	[0089.861] GetClipRgn (hdc=0xffffffffcc0107d0, hrgn=0x3d040806) returned 0
	[0089.861] SelectClipRgn (hdc=0xffffffffcc0107d0, hrgn=0x1504070d) returned 2
	[0089.861] DeleteObject (ho=0x3d040806) returned 1
	[0089.861] DeleteObject (ho=0x1504070d) returned 1
	[0089.861] OffsetViewportOrgEx (in: hdc=0xffffffffcc0107d0, x=0, y=0, lppt=0x2647110 | out: lppt=0x2647110) returned 1
	[0089.861] GetNearestColor (hdc=0xffffffffcc0107d0, color=0x0) returned 0x0
	[0089.861] CreateSolidBrush (color=0x0) returned 0x111007c0
	[0089.861] FillRect (hDC=0xffffffffcc0107d0, lprc=0x20d4b0, hbr=0x111007c0) returned 1
	[0089.862] DeleteObject (ho=0x111007c0) returned 1
	[0089.862] RestoreDC (hdc=0xffffffffcc0107d0, nSavedDC=-1) returned 1
	[0089.862] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.862] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffcc0107d0) returned 0x0
	[0089.862] GdipRestoreGraphics (graphics=0x1b9157d0, state=0xfffffffffd9a0dbd) returned 0x0
	[0089.862] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.862] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.862] GetWindowTextLengthW (hWnd=0x201ea) returned 37
	[0089.862] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x25
	[0089.862] GetSystemMetrics (nIndex=42) returned 0
	[0089.862] CoTaskMemAlloc (cb=0x50) returned 0x1b015ff0
	[0089.862] GetWindowTextW (in: hWnd=0x201ea, lpString=0x1b015ff0, nMaxCount=38 | out: lpString="Enter the pin to extract the password") returned 37
	[0089.862] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201ea, Msg=0xd, wParam=0x26, lParam=0x1b015ff0) returned 0x25
	[0089.862] CoTaskMemFree (pv=0x1b015ff0) 
	[0089.862] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d530) returned 0x0
	[0089.862] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x1) returned 0x1b00017
	[0089.862] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x2) returned 0x1900010
	[0089.862] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x7) returned 0x130507d2
	[0089.862] GetCurrentObject (hdc=0xffffffffcc0107d0, type=0x6) returned 0x18a002e
	[0089.862] SaveDC (hdc=0xffffffffcc0107d0) returned 1
	[0089.863] GetNearestColor (hdc=0xffffffffcc0107d0, color=0x80) returned 0x80
	[0089.863] RestoreDC (hdc=0xffffffffcc0107d0, nSavedDC=-1) returned 1
	[0089.863] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.863] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffcc0107d0) returned 0x0
	[0089.863] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0089.863] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.863] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.863] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.863] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0089.863] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0089.863] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0089.863] GdipDrawString (graphics=0x1b9157d0, string="Enter the pin to extract the password", length=37, font=0x1b3fd760, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.864] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.864] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.864] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.864] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.864] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d8e0) returned 0x0
	[0089.864] BitBlt (hdc=0x10107f8, x=0, y=0, cx=315, cy=25, hdcSrc=0xffffffffcc0107d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.864] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.864] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffcc0107d0) returned 0x0
	[0089.864] SelectObject (hdc=0xffffffffcc0107d0, h=0x185000f) returned 0x130507d2
	[0089.864] DeleteDC (hdc=0xffffffffcc0107d0) returned 1
	[0089.864] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.864] GdipDeleteGraphics (graphics=0x1b9157d0) returned 0x0
	[0089.864] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.864] EndPaint (hWnd=0x201ea, lpPaint=0x20d9e8) returned 1
	[0089.864] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.864] IsWindowUnicode (hWnd=0x201e8) returned 1
	[0089.864] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.864] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.864] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.864] BeginPaint (in: hWnd=0x201e8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0089.865] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.865] CreateCompatibleDC (hdc=0x70107fc) returned 0xffffffffce0107d0
	[0089.865] GetObjectType (h=0x70107fc) returned 0x3
	[0089.865] CreateCompatibleBitmap (hdc=0x70107fc, cx=1, cy=1) returned 0x590507a6
	[0089.865] GetDIBits (in: hdc=0x70107fc, hbm=0x590507a6, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0089.865] GetDIBits (in: hdc=0x70107fc, hbm=0x590507a6, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0089.865] DeleteObject (ho=0x590507a6) returned 1
	[0089.865] CreateDIBSection (in: hdc=0x70107fc, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0xe050710
	[0089.865] SelectObject (hdc=0xffffffffce0107d0, h=0xe050710) returned 0x185000f
	[0089.865] GdipCreateFromHDC (hdc=0xffffffffce0107d0, graphics=0x20d750) returned 0x0
	[0089.865] GdipTranslateWorldTransform (graphics=0x1b9157d0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.865] GdipSetClipRectI (graphics=0x1b9157d0, x=0, y=0, width=367, height=96, combineMode=0x0) returned 0x0
	[0089.865] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0089.865] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f010) returned 0x0
	[0089.865] GdipIsMatrixIdentity (matrix=0x1b49f010, result=0x20d970) returned 0x0
	[0089.865] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.865] GdipGetMatrixElements (matrix=0x1b49f010, matrixOut=0x1b07bbc0) returned 0x0
	[0089.865] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.865] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.865] GdipDeleteMatrix (matrix=0x1b49f010) returned 0x0
	[0089.866] GdipCreateRegion (region=0x20d910) returned 0x0
	[0089.866] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f1d0) returned 0x0
	[0089.866] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b9157d0, result=0x20d940) returned 0x0
	[0089.866] GdipSaveGraphics (graphics=0x1b9157d0, state=0x20da10) returned 0x0
	[0089.866] GetWindowTextLengthW (hWnd=0x201e8) returned 133
	[0089.866] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x85
	[0089.866] GetSystemMetrics (nIndex=42) returned 0
	[0089.866] CoTaskMemAlloc (cb=0x110) returned 0x1b04cc80
	[0089.866] GetWindowTextW (in: hWnd=0x201e8, lpString=0x1b04cc80, nMaxCount=134 | out: lpString="Oooooooops  \r\nAll your Files have Been Encrypted\r\nTo Decrypt the\r\nEncryption enter PIN\r\nWe will Extract your password on your Desktop") returned 133
	[0089.866] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0xd, wParam=0x86, lParam=0x1b04cc80) returned 0x85
	[0089.866] CoTaskMemFree (pv=0x1b04cc80) 
	[0089.866] GetClientRect (in: hWnd=0x201e8, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0089.866] GdipCreateRegion (region=0x20d400) returned 0x0
	[0089.866] GdipGetClip (graphics=0x1b9157d0, region=0x1b90f290) returned 0x0
	[0089.866] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0089.866] GdipGetWorldTransform (graphics=0x1b9157d0, matrix=0x1b49f090) returned 0x0
	[0089.866] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d460) returned 0x0
	[0089.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.866] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.866] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.866] GdipCombineRegionRegion (region=0x1b90f290, region2=0x1b90f1d0, combineMode=0x1) returned 0x0
	[0089.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.866] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.867] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.867] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.867] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.867] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b9157d0, result=0x20d4b0) returned 0x0
	[0089.867] GdipIsInfiniteRegion (region=0x1b90f290, graphics=0x1b9157d0, result=0x20d470) returned 0x0
	[0089.867] GdipGetRegionHRgn (region=0x1b90f290, graphics=0x1b9157d0, hRgn=0x20d470) returned 0x0
	[0089.867] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.867] GdipDeleteRegion (region=0x1b90f290) returned 0x0
	[0089.867] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d4e0) returned 0x0
	[0089.867] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x1) returned 0x1b00017
	[0089.867] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x2) returned 0x1900010
	[0089.867] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x7) returned 0xe050710
	[0089.867] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x6) returned 0x18a002e
	[0089.867] SaveDC (hdc=0xffffffffce0107d0) returned 1
	[0089.867] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1604070d
	[0089.867] GetClipRgn (hdc=0xffffffffce0107d0, hrgn=0x1604070d) returned 0
	[0089.867] SelectClipRgn (hdc=0xffffffffce0107d0, hrgn=0x3e040806) returned 2
	[0089.867] DeleteObject (ho=0x1604070d) returned 1
	[0089.868] DeleteObject (ho=0x3e040806) returned 1
	[0089.868] OffsetViewportOrgEx (in: hdc=0xffffffffce0107d0, x=0, y=0, lppt=0x2648e30 | out: lppt=0x2648e30) returned 1
	[0089.868] GetNearestColor (hdc=0xffffffffce0107d0, color=0x0) returned 0x0
	[0089.868] CreateSolidBrush (color=0x0) returned 0x121007c0
	[0089.868] FillRect (hDC=0xffffffffce0107d0, lprc=0x20d4b0, hbr=0x121007c0) returned 1
	[0089.869] DeleteObject (ho=0x121007c0) returned 1
	[0089.869] RestoreDC (hdc=0xffffffffce0107d0, nSavedDC=-1) returned 1
	[0089.869] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.870] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffce0107d0) returned 0x0
	[0089.870] GdipRestoreGraphics (graphics=0x1b9157d0, state=0xfffffffffd980dbd) returned 0x0
	[0089.870] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.870] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.870] GetWindowTextLengthW (hWnd=0x201e8) returned 133
	[0089.870] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x85
	[0089.870] GetSystemMetrics (nIndex=42) returned 0
	[0089.870] CoTaskMemAlloc (cb=0x110) returned 0x1b04cc80
	[0089.870] GetWindowTextW (in: hWnd=0x201e8, lpString=0x1b04cc80, nMaxCount=134 | out: lpString="Oooooooops  \r\nAll your Files have Been Encrypted\r\nTo Decrypt the\r\nEncryption enter PIN\r\nWe will Extract your password on your Desktop") returned 133
	[0089.870] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201e8, Msg=0xd, wParam=0x86, lParam=0x1b04cc80) returned 0x85
	[0089.870] CoTaskMemFree (pv=0x1b04cc80) 
	[0089.870] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d530) returned 0x0
	[0089.870] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x1) returned 0x1b00017
	[0089.870] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x2) returned 0x1900010
	[0089.870] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x7) returned 0xe050710
	[0089.870] GetCurrentObject (hdc=0xffffffffce0107d0, type=0x6) returned 0x18a002e
	[0089.870] SaveDC (hdc=0xffffffffce0107d0) returned 1
	[0089.870] GetNearestColor (hdc=0xffffffffce0107d0, color=0x80) returned 0x80
	[0089.870] RestoreDC (hdc=0xffffffffce0107d0, nSavedDC=-1) returned 1
	[0089.870] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.870] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffce0107d0) returned 0x0
	[0089.870] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0089.870] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.870] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.871] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.871] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0089.871] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0089.871] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0089.871] GdipDrawString (graphics=0x1b9157d0, string="Oooooooops  \r\nAll your Files have Been Encrypted\r\nTo Decrypt the\r\nEncryption enter PIN\r\nWe will Extract your password on your Desktop", length=133, font=0x1b3fd720, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.873] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.873] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.873] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.873] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.873] GdipGetDC (graphics=0x1b9157d0, hdc=0x20d8e0) returned 0x0
	[0089.873] BitBlt (hdc=0x70107fc, x=0, y=0, cx=374, cy=96, hdcSrc=0xffffffffce0107d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.873] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.873] GdipReleaseDC (graphics=0x1b9157d0, hdc=0xffffffffce0107d0) returned 0x0
	[0089.874] SelectObject (hdc=0xffffffffce0107d0, h=0x185000f) returned 0xe050710
	[0089.874] DeleteDC (hdc=0xffffffffce0107d0) returned 1
	[0089.874] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.874] GdipDeleteGraphics (graphics=0x1b9157d0) returned 0x0
	[0089.874] DeleteObject (ho=0xe050710) returned 1
	[0089.874] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.874] EndPaint (hWnd=0x201e8, lpPaint=0x20d9e8) returned 1
	[0089.874] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.874] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0089.874] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.874] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.874] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0089.874] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1
	[0089.874] SetTextColor (hdc=0x4010280, color=0x0) returned 0x0
	[0089.874] SetBkColor (hdc=0x4010280, color=0xffffff) returned 0xffffff
	[0089.874] SetTextColor (hdc=0x4010280, color=0x0) returned 0x0
	[0089.874] SetBkColor (hdc=0x4010280, color=0xffffff) returned 0xffffff
	[0089.875] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.875] IsWindowUnicode (hWnd=0x201be) returned 1
	[0089.875] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.875] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.875] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.875] BeginPaint (in: hWnd=0x201be, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0089.875] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.875] CreateCompatibleDC (hdc=0x10107f8) returned 0x5e0107a6
	[0089.875] SelectObject (hdc=0x5e0107a6, h=0x130507d2) returned 0x185000f
	[0089.875] GdipCreateFromHDC (hdc=0x5e0107a6, graphics=0x20d7e0) returned 0x0
	[0089.875] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.875] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=293, height=35, combineMode=0x0) returned 0x0
	[0089.875] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0089.875] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0089.875] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0089.875] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.875] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bbc0) returned 0x0
	[0089.875] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.875] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.875] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0089.875] GdipCreateRegion (region=0x20d910) returned 0x0
	[0089.876] GdipGetClip (graphics=0x1b927100, region=0x1b9151c0) returned 0x0
	[0089.876] GdipIsInfiniteRegion (region=0x1b9151c0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0089.876] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0089.876] GetWindowTextLengthW (hWnd=0x201be) returned 19
	[0089.876] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13
	[0089.876] GetSystemMetrics (nIndex=42) returned 0
	[0089.876] CoTaskMemAlloc (cb=0x2c) returned 0x1b07bbc0
	[0089.876] GetWindowTextW (in: hWnd=0x201be, lpString=0x1b07bbc0, nMaxCount=20 | out: lpString="in BooM Ransomeware") returned 19
	[0089.876] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0xd, wParam=0x14, lParam=0x1b07bbc0) returned 0x13
	[0089.876] CoTaskMemFree (pv=0x1b07bbc0) 
	[0089.876] GetClientRect (in: hWnd=0x201be, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0089.876] GdipCreateRegion (region=0x20d400) returned 0x0
	[0089.876] GdipGetClip (graphics=0x1b927100, region=0x1b90f1d0) returned 0x0
	[0089.876] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0089.876] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f090) returned 0x0
	[0089.876] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d460) returned 0x0
	[0089.876] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.876] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.876] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.876] GdipCombineRegionRegion (region=0x1b90f1d0, region2=0x1b9151c0, combineMode=0x1) returned 0x0
	[0089.877] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.877] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.877] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.877] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.877] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.877] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b927100, result=0x20d4b0) returned 0x0
	[0089.877] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b927100, result=0x20d470) returned 0x0
	[0089.877] GdipGetRegionHRgn (region=0x1b90f1d0, graphics=0x1b927100, hRgn=0x20d470) returned 0x0
	[0089.877] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.877] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.877] GdipGetDC (graphics=0x1b927100, hdc=0x20d4e0) returned 0x0
	[0089.877] GetCurrentObject (hdc=0x5e0107a6, type=0x1) returned 0x1b00017
	[0089.877] GetCurrentObject (hdc=0x5e0107a6, type=0x2) returned 0x1900010
	[0089.877] GetCurrentObject (hdc=0x5e0107a6, type=0x7) returned 0x130507d2
	[0089.877] GetCurrentObject (hdc=0x5e0107a6, type=0x6) returned 0x18a002e
	[0089.877] SaveDC (hdc=0x5e0107a6) returned 1
	[0089.877] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f040806
	[0089.877] GetClipRgn (hdc=0x5e0107a6, hrgn=0x3f040806) returned 0
	[0089.877] SelectClipRgn (hdc=0x5e0107a6, hrgn=0x1704070d) returned 2
	[0089.877] DeleteObject (ho=0x3f040806) returned 1
	[0089.877] DeleteObject (ho=0x1704070d) returned 1
	[0089.877] OffsetViewportOrgEx (in: hdc=0x5e0107a6, x=0, y=0, lppt=0x2649a70 | out: lppt=0x2649a70) returned 1
	[0089.877] GetNearestColor (hdc=0x5e0107a6, color=0x0) returned 0x0
	[0089.877] CreateSolidBrush (color=0x0) returned 0x131007c0
	[0089.877] FillRect (hDC=0x5e0107a6, lprc=0x20d4b0, hbr=0x131007c0) returned 1
	[0089.878] DeleteObject (ho=0x131007c0) returned 1
	[0089.878] RestoreDC (hdc=0x5e0107a6, nSavedDC=-1) returned 1
	[0089.878] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.878] GdipReleaseDC (graphics=0x1b927100, hdc=0x5e0107a6) returned 0x0
	[0089.878] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd960dbd) returned 0x0
	[0089.878] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.878] GdipDeleteRegion (region=0x1b9151c0) returned 0x0
	[0089.878] GetWindowTextLengthW (hWnd=0x201be) returned 19
	[0089.878] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13
	[0089.878] GetSystemMetrics (nIndex=42) returned 0
	[0089.878] CoTaskMemAlloc (cb=0x2c) returned 0x1b07bbc0
	[0089.878] GetWindowTextW (in: hWnd=0x201be, lpString=0x1b07bbc0, nMaxCount=20 | out: lpString="in BooM Ransomeware") returned 19
	[0089.878] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201be, Msg=0xd, wParam=0x14, lParam=0x1b07bbc0) returned 0x13
	[0089.878] CoTaskMemFree (pv=0x1b07bbc0) 
	[0089.878] GdipGetDC (graphics=0x1b927100, hdc=0x20d530) returned 0x0
	[0089.878] GetCurrentObject (hdc=0x5e0107a6, type=0x1) returned 0x1b00017
	[0089.878] GetCurrentObject (hdc=0x5e0107a6, type=0x2) returned 0x1900010
	[0089.878] GetCurrentObject (hdc=0x5e0107a6, type=0x7) returned 0x130507d2
	[0089.878] GetCurrentObject (hdc=0x5e0107a6, type=0x6) returned 0x18a002e
	[0089.878] SaveDC (hdc=0x5e0107a6) returned 1
	[0089.878] GetNearestColor (hdc=0x5e0107a6, color=0x80) returned 0x80
	[0089.878] RestoreDC (hdc=0x5e0107a6, nSavedDC=-1) returned 1
	[0089.878] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.879] GdipReleaseDC (graphics=0x1b927100, hdc=0x5e0107a6) returned 0x0
	[0089.879] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0089.879] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.879] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0089.879] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0089.879] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0089.879] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0089.879] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0089.879] GdipDrawString (graphics=0x1b927100, string="in BooM Ransomeware", length=19, font=0x1b3941a0, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0089.879] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.879] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0089.879] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.879] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0089.879] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0089.879] BitBlt (hdc=0x10107f8, x=0, y=0, cx=293, cy=35, hdcSrc=0x5e0107a6, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.879] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.879] GdipReleaseDC (graphics=0x1b927100, hdc=0x5e0107a6) returned 0x0
	[0089.880] SelectObject (hdc=0x5e0107a6, h=0x185000f) returned 0x130507d2
	[0089.880] DeleteDC (hdc=0x5e0107a6) returned 1
	[0089.880] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.880] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0089.880] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.880] EndPaint (hWnd=0x201be, lpPaint=0x20d9e8) returned 1
	[0089.880] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.880] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0089.880] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.880] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.880] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.880] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x70107fc
	[0089.880] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0089.880] CreateCompatibleDC (hdc=0x70107fc) returned 0x600107a6
	[0089.880] GetObjectType (h=0x70107fc) returned 0x3
	[0089.880] CreateCompatibleBitmap (hdc=0x70107fc, cx=1, cy=1) returned 0x13050710
	[0089.880] GetDIBits (in: hdc=0x70107fc, hbm=0x13050710, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0089.880] GetDIBits (in: hdc=0x70107fc, hbm=0x13050710, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0089.880] DeleteObject (ho=0x13050710) returned 1
	[0089.880] CreateDIBSection (in: hdc=0x70107fc, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0xffffffffcf0507d0
	[0089.880] SelectObject (hdc=0x600107a6, h=0xffffffffcf0507d0) returned 0x185000f
	[0089.881] GdipCreateFromHDC (hdc=0x600107a6, graphics=0x20d800) returned 0x0
	[0089.881] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0089.881] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=658, height=456, combineMode=0x0) returned 0x0
	[0089.881] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0089.881] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0089.881] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0089.881] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.881] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bbc0) returned 0x0
	[0089.881] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.881] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.881] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0089.881] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0089.881] GdipGetClip (graphics=0x1b927100, region=0x1b9151c0) returned 0x0
	[0089.881] GdipIsInfiniteRegion (region=0x1b9151c0, graphics=0x1b927100, result=0x20d9f0) returned 0x0
	[0089.881] GdipSaveGraphics (graphics=0x1b927100, state=0x20dac0) returned 0x0
	[0089.881] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0089.881] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0089.881] GetSystemMetrics (nIndex=42) returned 0
	[0089.881] CoTaskMemAlloc (cb=0x6) returned 0x1b078810
	[0089.881] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078810, nMaxCount=1 | out: lpString="") returned 0
	[0089.881] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078810) returned 0x0
	[0089.881] CoTaskMemFree (pv=0x1b078810) 
	[0089.881] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0089.882] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0089.882] GdipGetClip (graphics=0x1b927100, region=0x1b90f1d0) returned 0x0
	[0089.882] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0089.882] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f090) returned 0x0
	[0089.882] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20d510) returned 0x0
	[0089.882] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.882] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.882] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.882] GdipCombineRegionRegion (region=0x1b90f1d0, region2=0x1b9151c0, combineMode=0x1) returned 0x0
	[0089.882] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bbc0
	[0089.882] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07bbc0) returned 0x0
	[0089.882] LocalFree (hMem=0x1b07bbc0) returned 0x0
	[0089.882] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.882] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0089.882] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b927100, result=0x20d560) returned 0x0
	[0089.882] GdipIsInfiniteRegion (region=0x1b90f1d0, graphics=0x1b927100, result=0x20d520) returned 0x0
	[0089.882] GdipGetRegionHRgn (region=0x1b90f1d0, graphics=0x1b927100, hRgn=0x20d520) returned 0x0
	[0089.882] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.882] GdipDeleteRegion (region=0x1b90f1d0) returned 0x0
	[0089.882] GdipGetDC (graphics=0x1b927100, hdc=0x20d590) returned 0x0
	[0089.882] GetCurrentObject (hdc=0x600107a6, type=0x1) returned 0x1b00017
	[0089.882] GetCurrentObject (hdc=0x600107a6, type=0x2) returned 0x1900010
	[0089.882] GetCurrentObject (hdc=0x600107a6, type=0x7) returned 0xffffffffcf0507d0
	[0089.882] GetCurrentObject (hdc=0x600107a6, type=0x6) returned 0x18a002e
	[0089.883] SaveDC (hdc=0x600107a6) returned 1
	[0089.883] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1804070d
	[0089.883] GetClipRgn (hdc=0x600107a6, hrgn=0x1804070d) returned 0
	[0089.883] SelectClipRgn (hdc=0x600107a6, hrgn=0x40040806) returned 2
	[0089.883] DeleteObject (ho=0x1804070d) returned 1
	[0089.883] DeleteObject (ho=0x40040806) returned 1
	[0089.883] OffsetViewportOrgEx (in: hdc=0x600107a6, x=0, y=0, lppt=0x264b610 | out: lppt=0x264b610) returned 1
	[0089.883] GetNearestColor (hdc=0x600107a6, color=0xf0f0f0) returned 0xf0f0f0
	[0089.883] CreateSolidBrush (color=0xf0f0f0) returned 0x141007c0
	[0089.883] FillRect (hDC=0x600107a6, lprc=0x20d560, hbr=0x141007c0) returned 1
	[0089.896] DeleteObject (ho=0x141007c0) returned 1
	[0089.896] RestoreDC (hdc=0x600107a6, nSavedDC=-1) returned 1
	[0089.896] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.896] GdipReleaseDC (graphics=0x1b927100, hdc=0x600107a6) returned 0x0
	[0089.896] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd940dbd) returned 0x0
	[0089.896] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.896] GdipDeleteRegion (region=0x1b9151c0) returned 0x0
	[0089.896] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0089.896] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0089.896] GetSystemMetrics (nIndex=42) returned 0
	[0089.896] CoTaskMemAlloc (cb=0x6) returned 0x1b078810
	[0089.896] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078810, nMaxCount=1 | out: lpString="") returned 0
	[0089.896] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078810) returned 0x0
	[0089.896] CoTaskMemFree (pv=0x1b078810) 
	[0089.916] GdipDrawImageRectI (graphics=0x1b927100, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0089.967] GdipGetDC (graphics=0x1b927100, hdc=0x20d990) returned 0x0
	[0089.967] BitBlt (hdc=0x70107fc, x=0, y=0, cx=658, cy=456, hdcSrc=0x600107a6, x1=0, y1=0, rop=0xcc0020) returned 1
	[0089.967] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.967] GdipReleaseDC (graphics=0x1b927100, hdc=0x600107a6) returned 0x0
	[0089.967] SelectObject (hdc=0x600107a6, h=0x185000f) returned 0xffffffffcf0507d0
	[0089.967] DeleteDC (hdc=0x600107a6) returned 1
	[0089.968] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0089.968] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0089.968] DeleteObject (ho=0xffffffffcf0507d0) returned 1
	[0089.968] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0089.968] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0089.968] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0089.968] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.968] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.968] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0089.968] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.968] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.968] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0089.968] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.968] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.968] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0089.968] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0089.968] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0089.968] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0089.969] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a1, wParam=0x0, lParam=0x170043) returned 0x0
	[0089.969] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0089.970] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0089.970] WaitMessage () returned 1
	[0090.111] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.111] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0090.111] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.111] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0090.111] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0090.111] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.111] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.111] WaitMessage () returned 1
	[0090.369] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.370] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0090.370] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0090.370] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0090.370] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0090.372] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0090.372] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x46, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0090.372] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df30 | out: lpwndpl=0x20df30) returned 1
	[0090.372] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0090.372] GetClientRect (in: hWnd=0x50120, lpRect=0x20dcd0 | out: lpRect=0x20dcd0) returned 1
	[0090.372] GetWindowRect (in: hWnd=0x50120, lpRect=0x20dcd0 | out: lpRect=0x20dcd0) returned 1
	[0090.372] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0090.373] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0090.373] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0090.373] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x47, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0090.373] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b134850) returned 0x0
	[0090.374] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x83, wParam=0x1, lParam=0x20de30) returned 0x0
	[0090.374] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.374] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27f01d6) returned 0x1
	[0090.374] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.374] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27f01d6) returned 0x1
	[0090.374] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0090.375] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.375] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27f01d6) returned 0x1
	[0090.375] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0090.375] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0090.375] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0090.375] GetKeyState (nVirtKey=1) returned 0
	[0090.375] GetKeyState (nVirtKey=2) returned 0
	[0090.375] GetKeyState (nVirtKey=4) returned 0
	[0090.375] GetKeyState (nVirtKey=5) returned 0
	[0090.375] GetKeyState (nVirtKey=6) returned 0
	[0090.375] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.375] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0090.375] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.376] GetKeyState (nVirtKey=16) returned 0
	[0090.376] GetKeyState (nVirtKey=17) returned 0
	[0090.376] GetKeyState (nVirtKey=18) returned -127
	[0090.376] TranslateMessage (lpMsg=0x20e6b0) returned 1
	[0090.376] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0090.377] GetKeyState (nVirtKey=16) returned 0
	[0090.377] GetKeyState (nVirtKey=17) returned 0
	[0090.377] GetKeyState (nVirtKey=18) returned -127
	[0090.377] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x105, wParam=0x1b, lParam=0xe0010001) returned 0x0
	[0090.377] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.377] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.377] WaitMessage () returned 1
	[0090.378] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.378] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27f01d6) returned 0x1
	[0090.378] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0090.378] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.378] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27f01d6) returned 0x1
	[0090.378] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0090.378] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0090.378] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0090.378] GetKeyState (nVirtKey=1) returned 0
	[0090.378] GetKeyState (nVirtKey=2) returned 0
	[0090.378] GetKeyState (nVirtKey=4) returned 0
	[0090.378] GetKeyState (nVirtKey=5) returned 0
	[0090.378] GetKeyState (nVirtKey=6) returned 0
	[0090.378] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.378] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.378] WaitMessage () returned 1
	[0090.385] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.385] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0090.385] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.385] GetKeyState (nVirtKey=16) returned 0
	[0090.385] GetKeyState (nVirtKey=17) returned 0
	[0090.385] GetKeyState (nVirtKey=18) returned 1
	[0090.385] TranslateMessage (lpMsg=0x20e6b0) returned 1
	[0090.385] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0090.385] GetKeyState (nVirtKey=16) returned 0
	[0090.385] GetKeyState (nVirtKey=17) returned 0
	[0090.385] GetKeyState (nVirtKey=18) returned 1
	[0090.385] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x101, wParam=0x12, lParam=0xc0380001) returned 0x0
	[0090.385] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.385] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.385] WaitMessage () returned 1
	[0090.476] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.476] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0090.476] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.476] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0090.476] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0090.476] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.476] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.476] WaitMessage () returned 1
	[0090.632] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.632] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0090.632] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0090.632] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0090.632] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0090.632] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.632] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0090.632] WaitMessage () returned 1
	[0091.162] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0091.162] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0091.162] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0091.162] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0091.162] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0091.162] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0091.162] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0091.162] WaitMessage () returned 1
	[0091.693] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0091.693] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0091.693] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0091.693] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0091.693] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0091.693] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0091.693] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0091.693] WaitMessage () returned 1
	[0092.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.223] IsWindowUnicode (hWnd=0x201bc) returned 1
	[0092.223] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.223] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0092.223] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0092.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0092.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0092.223] WaitMessage () returned 1
	[0092.366] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.366] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27a01e5) returned 0x1
	[0092.366] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0092.366] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.366] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27a01e5) returned 0x1
	[0092.366] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0092.367] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0092.367] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0092.367] GetKeyState (nVirtKey=1) returned 0
	[0092.367] GetKeyState (nVirtKey=2) returned 0
	[0092.367] GetKeyState (nVirtKey=4) returned 0
	[0092.367] GetKeyState (nVirtKey=5) returned 0
	[0092.367] GetKeyState (nVirtKey=6) returned 0
	[0092.367] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0092.367] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0092.367] WaitMessage () returned 1
	[0092.447] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.447] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27a01e5) returned 0x1
	[0092.447] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0092.447] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.447] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27a01e5) returned 0x1
	[0092.530] GetDlgItem (hDlg=0x50120, nIDDlgItem=0) returned 0x0
	[0092.530] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x210, wParam=0x201, lParam=0x1a5005e) returned 0x0
	[0092.530] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0092.530] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0092.530] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0092.530] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0092.530] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0092.531] GetKeyState (nVirtKey=1) returned -127
	[0092.531] GetKeyState (nVirtKey=2) returned 0
	[0092.531] GetKeyState (nVirtKey=4) returned 0
	[0092.531] GetKeyState (nVirtKey=5) returned 0
	[0092.531] GetKeyState (nVirtKey=6) returned 0
	[0092.532] IsWindowVisible (hWnd=0x401b4) returned 1
	[0092.533] IsWindowEnabled (hWnd=0x401b4) returned 1
	[0092.533] SetFocus (hWnd=0x401b4) returned 0x201bc
	[0092.534] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x8, wParam=0x401b4, lParam=0x0) returned 0x1
	[0092.534] SendMessageW (hWnd=0x201bc, Msg=0x2111, wParam=0x20001bc, lParam=0x201bc) returned 0x0
	[0092.534] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201bc, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0092.534] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0092.534] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0xb, lParam=0x0) returned 0x0
	[0092.534] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0xf, lParam=0x4018d) returned 0x0
	[0092.534] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0092.554] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0092.555] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x7, wParam=0x201bc, lParam=0x0) returned 0x0
	[0092.555] GetStockObject (i=5) returned 0x1900015
	[0092.555] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d170) returned 0x0
	[0092.555] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d170) returned 0x0
	[0092.555] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0092.555] GetFocus () returned 0x401b4
	[0092.555] GetFocus () returned 0x401b4
	[0092.555] GetFocus () returned 0x401b4
	[0092.555] GetKeyState (nVirtKey=1) returned -127
	[0092.555] GetKeyState (nVirtKey=2) returned 0
	[0092.555] GetKeyState (nVirtKey=4) returned 0
	[0092.555] GetKeyState (nVirtKey=5) returned 0
	[0092.555] GetKeyState (nVirtKey=6) returned 0
	[0092.557] GetCapture () returned 0x0
	[0092.595] SetCapture (hWnd=0x401b4) returned 0x0
	[0092.595] GetKeyState (nVirtKey=1) returned -127
	[0092.595] GetKeyState (nVirtKey=2) returned 0
	[0092.595] GetKeyState (nVirtKey=4) returned 0
	[0092.595] GetKeyState (nVirtKey=5) returned 0
	[0092.595] GetKeyState (nVirtKey=6) returned 0
	[0092.597] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0092.599] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0092.599] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.599] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.599] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0092.599] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0092.599] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.599] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0092.599] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0092.599] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0092.599] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0092.601] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x264bc88, cPoints=0x1 | out: lpPoints=0x264bc88) returned 40370579
	[0092.602] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0092.602] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0092.667] UpdateWindow (hWnd=0x401b4) returned 1
	[0092.667] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0092.667] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0092.667] CreateCompatibleDC (hdc=0x70107fc) returned 0xc010716
	[0092.667] SelectObject (hdc=0xc010716, h=0x130507d2) returned 0x185000f
	[0092.667] GdipCreateFromHDC (hdc=0xc010716, graphics=0x20cfa0) returned 0x0
	[0092.667] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0092.667] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0092.667] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0092.667] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0092.667] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0092.667] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07b8c0
	[0092.667] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07b8c0) returned 0x0
	[0092.667] LocalFree (hMem=0x1b07b8c0) returned 0x0
	[0092.668] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.668] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0092.668] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0092.668] GdipGetClip (graphics=0x1b927100, region=0x1b9151c0) returned 0x0
	[0092.668] GdipIsInfiniteRegion (region=0x1b9151c0, graphics=0x1b927100, result=0x20d100) returned 0x0
	[0092.668] GdipSaveGraphics (graphics=0x1b927100, state=0x20d1d0) returned 0x0
	[0092.668] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd920dbd) returned 0x0
	[0092.668] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.668] GdipDeleteRegion (region=0x1b9151c0) returned 0x0
	[0092.668] GdipGetDC (graphics=0x1b927100, hdc=0x20c5b0) returned 0x0
	[0092.668] GetCurrentObject (hdc=0xc010716, type=0x1) returned 0x1b00017
	[0092.668] GetCurrentObject (hdc=0xc010716, type=0x2) returned 0x1900010
	[0092.668] GetCurrentObject (hdc=0xc010716, type=0x7) returned 0x130507d2
	[0092.668] GetCurrentObject (hdc=0xc010716, type=0x6) returned 0x18a002e
	[0092.668] SaveDC (hdc=0xc010716) returned 1
	[0092.669] GetNearestColor (hdc=0xc010716, color=0xf0f0f0) returned 0xf0f0f0
	[0092.669] GetNearestColor (hdc=0xc010716, color=0xa0a0a0) returned 0xa0a0a0
	[0092.669] GetNearestColor (hdc=0xc010716, color=0x696969) returned 0x696969
	[0092.669] GetNearestColor (hdc=0xc010716, color=0xa0a0a0) returned 0xa0a0a0
	[0092.669] GetNearestColor (hdc=0xc010716, color=0x0) returned 0x0
	[0092.669] GetNearestColor (hdc=0xc010716, color=0xffffff) returned 0xffffff
	[0092.669] GetNearestColor (hdc=0xc010716, color=0xe5e5e5) returned 0xe5e5e5
	[0092.669] GetNearestColor (hdc=0xc010716, color=0xd8d8d8) returned 0xd8d8d8
	[0092.669] GetNearestColor (hdc=0xc010716, color=0x0) returned 0x0
	[0092.669] RestoreDC (hdc=0xc010716, nSavedDC=-1) returned 1
	[0092.669] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.669] GdipReleaseDC (graphics=0x1b927100, hdc=0xc010716) returned 0x0
	[0092.670] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0092.670] CoTaskMemAlloc (cb=0x13) returned 0x1b067600
	[0092.670] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0092.670] CoTaskMemFree (pv=0x1b067600) 
	[0092.670] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0092.670] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0092.670] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0092.670] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0092.670] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0092.670] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0092.670] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0092.671] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0092.671] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0092.671] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.671] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0092.671] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0092.671] CoTaskMemAlloc (cb=0x13) returned 0x1b067600
	[0092.671] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0092.671] CoTaskMemFree (pv=0x1b067600) 
	[0092.671] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0092.671] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0092.671] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0092.671] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0092.671] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0092.671] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0092.672] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0092.672] GdipMeasureString (graphics=0x1b94fc50, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0092.672] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.672] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0092.672] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.672] GdipDeleteGraphics (graphics=0x1b94fc50) returned 0x0
	[0092.672] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0092.672] CoTaskMemAlloc (cb=0x13) returned 0x1b067600
	[0092.672] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0092.672] CoTaskMemFree (pv=0x1b067600) 
	[0092.672] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0092.672] GdipGetClip (graphics=0x1b927100, region=0x1b9151c0) returned 0x0
	[0092.672] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0092.672] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f090) returned 0x0
	[0092.673] GdipIsMatrixIdentity (matrix=0x1b49f090, result=0x20c940) returned 0x0
	[0092.673] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07b8c0
	[0092.673] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07b8c0) returned 0x0
	[0092.673] LocalFree (hMem=0x1b07b8c0) returned 0x0
	[0092.673] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07b8c0
	[0092.673] GdipGetMatrixElements (matrix=0x1b49f090, matrixOut=0x1b07b8c0) returned 0x0
	[0092.673] LocalFree (hMem=0x1b07b8c0) returned 0x0
	[0092.673] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.673] GdipDeleteMatrix (matrix=0x1b49f090) returned 0x0
	[0092.673] GdipIsInfiniteRegion (region=0x1b9151c0, graphics=0x1b927100, result=0x20c990) returned 0x0
	[0092.673] GdipIsInfiniteRegion (region=0x1b9151c0, graphics=0x1b927100, result=0x20c950) returned 0x0
	[0092.673] GdipGetRegionHRgn (region=0x1b9151c0, graphics=0x1b927100, hRgn=0x20c950) returned 0x0
	[0092.673] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.673] GdipDeleteRegion (region=0x1b9151c0) returned 0x0
	[0092.673] GdipGetDC (graphics=0x1b927100, hdc=0x20c9c0) returned 0x0
	[0092.673] GetCurrentObject (hdc=0xc010716, type=0x1) returned 0x1b00017
	[0092.673] GetCurrentObject (hdc=0xc010716, type=0x2) returned 0x1900010
	[0092.673] GetCurrentObject (hdc=0xc010716, type=0x7) returned 0x130507d2
	[0092.673] GetCurrentObject (hdc=0xc010716, type=0x6) returned 0x18a002e
	[0092.673] SaveDC (hdc=0xc010716) returned 1
	[0092.673] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x42040806
	[0092.674] GetClipRgn (hdc=0xc010716, hrgn=0x42040806) returned 0
	[0092.674] SelectClipRgn (hdc=0xc010716, hrgn=0x1d040710) returned 2
	[0092.674] DeleteObject (ho=0x42040806) returned 1
	[0092.674] DeleteObject (ho=0x1d040710) returned 1
	[0092.674] OffsetViewportOrgEx (in: hdc=0xc010716, x=0, y=0, lppt=0x264c908 | out: lppt=0x264c908) returned 1
	[0092.674] GetNearestColor (hdc=0xc010716, color=0xf0f0f0) returned 0xf0f0f0
	[0092.674] CreateSolidBrush (color=0xf0f0f0) returned 0x151007c0
	[0092.674] FillRect (hDC=0xc010716, lprc=0x20c990, hbr=0x151007c0) returned 1
	[0092.674] DeleteObject (ho=0x151007c0) returned 1
	[0092.674] RestoreDC (hdc=0xc010716, nSavedDC=-1) returned 1
	[0092.674] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.674] GdipReleaseDC (graphics=0x1b927100, hdc=0xc010716) returned 0x0
	[0092.674] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0092.675] CoTaskMemAlloc (cb=0x13) returned 0x1b067600
	[0092.675] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0092.675] CoTaskMemFree (pv=0x1b067600) 
	[0092.675] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0092.675] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0092.675] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0092.675] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0092.675] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0092.675] GdipDrawString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b90f1d0) returned 0x0
	[0092.675] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.675] GdipDeleteBrush (brush=0x1b90f1d0) returned 0x0
	[0092.675] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.675] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0092.675] GetFocus () returned 0x401b4
	[0092.676] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0092.676] CoTaskMemAlloc (cb=0x13) returned 0x1b067600
	[0092.676] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0092.676] CoTaskMemFree (pv=0x1b067600) 
	[0092.683] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0092.687] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0092.689] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.689] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0092.689] GdipCreateRegion (region=0x20c830) returned 0x0
	[0092.689] GdipGetClip (graphics=0x1b927100, region=0x1b957100) returned 0x0
	[0092.689] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0092.689] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0092.689] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0092.689] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07b8c0
	[0092.689] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07b8c0) returned 0x0
	[0092.689] LocalFree (hMem=0x1b07b8c0) returned 0x0
	[0092.690] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07b8c0
	[0092.690] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07b8c0) returned 0x0
	[0092.690] LocalFree (hMem=0x1b07b8c0) returned 0x0
	[0092.690] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.690] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0092.690] GdipIsInfiniteRegion (region=0x1b957100, graphics=0x1b927100, result=0x20c8e0) returned 0x0
	[0092.690] GdipIsInfiniteRegion (region=0x1b957100, graphics=0x1b927100, result=0x20c8a0) returned 0x0
	[0092.690] GdipGetRegionHRgn (region=0x1b957100, graphics=0x1b927100, hRgn=0x20c8a0) returned 0x0
	[0092.690] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.690] GdipDeleteRegion (region=0x1b957100) returned 0x0
	[0092.690] GdipGetDC (graphics=0x1b927100, hdc=0x20c910) returned 0x0
	[0092.690] GetCurrentObject (hdc=0xc010716, type=0x1) returned 0x1b00017
	[0092.690] GetCurrentObject (hdc=0xc010716, type=0x2) returned 0x1900010
	[0092.690] GetCurrentObject (hdc=0xc010716, type=0x7) returned 0x130507d2
	[0092.690] GetCurrentObject (hdc=0xc010716, type=0x6) returned 0x18a002e
	[0092.690] SaveDC (hdc=0xc010716) returned 1
	[0092.690] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040710
	[0092.690] GetClipRgn (hdc=0xc010716, hrgn=0x1e040710) returned 0
	[0092.690] SelectClipRgn (hdc=0xc010716, hrgn=0x43040806) returned 2
	[0092.690] DeleteObject (ho=0x1e040710) returned 1
	[0092.690] DeleteObject (ho=0x43040806) returned 1
	[0092.690] OffsetViewportOrgEx (in: hdc=0xc010716, x=0, y=0, lppt=0x264cea8 | out: lppt=0x264cea8) returned 1
	[0092.691] GetROP2 (hdc=0xc010716) returned 13
	[0092.691] GetBkMode (hdc=0xc010716) returned 2
	[0092.691] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.691] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x4330024f
	[0092.691] SelectObject (hdc=0xc010716, h=0x4330024f) returned 0x1b00017
	[0092.691] MoveToEx (in: hdc=0xc010716, x=126, y=1, lppt=0x264cf10 | out: lppt=0x264cf10) returned 1
	[0092.691] LineTo (hdc=0xc010716, x=1, y=1) returned 1
	[0092.691] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.691] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.691] GetROP2 (hdc=0xc010716) returned 13
	[0092.691] GetBkMode (hdc=0xc010716) returned 2
	[0092.691] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.691] SelectObject (hdc=0xc010716, h=0x4330024f) returned 0x4330024f
	[0092.691] MoveToEx (in: hdc=0xc010716, x=1, y=1, lppt=0x264cf28 | out: lppt=0x264cf28) returned 1
	[0092.691] LineTo (hdc=0xc010716, x=1, y=39) returned 1
	[0092.691] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.691] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.691] SelectObject (hdc=0xc010716, h=0x1b00017) returned 0x4330024f
	[0092.691] DeleteObject (ho=0x4330024f) returned 1
	[0092.691] GetROP2 (hdc=0xc010716) returned 13
	[0092.692] GetBkMode (hdc=0xc010716) returned 2
	[0092.692] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.692] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x19300241
	[0092.692] SelectObject (hdc=0xc010716, h=0x19300241) returned 0x1b00017
	[0092.692] MoveToEx (in: hdc=0xc010716, x=1, y=39, lppt=0x264cf90 | out: lppt=0x264cf90) returned 1
	[0092.692] LineTo (hdc=0xc010716, x=126, y=39) returned 1
	[0092.692] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.692] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.692] GetROP2 (hdc=0xc010716) returned 13
	[0092.692] GetBkMode (hdc=0xc010716) returned 2
	[0092.692] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.692] SelectObject (hdc=0xc010716, h=0x19300241) returned 0x19300241
	[0092.692] MoveToEx (in: hdc=0xc010716, x=126, y=39, lppt=0x264cfa8 | out: lppt=0x264cfa8) returned 1
	[0092.692] LineTo (hdc=0xc010716, x=126, y=0) returned 1
	[0092.692] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.692] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.692] SelectObject (hdc=0xc010716, h=0x1b00017) returned 0x19300241
	[0092.692] DeleteObject (ho=0x19300241) returned 1
	[0092.692] GetROP2 (hdc=0xc010716) returned 13
	[0092.692] GetBkMode (hdc=0xc010716) returned 2
	[0092.692] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.692] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4430024f
	[0092.692] SelectObject (hdc=0xc010716, h=0x4430024f) returned 0x1b00017
	[0092.692] MoveToEx (in: hdc=0xc010716, x=125, y=2, lppt=0x264d010 | out: lppt=0x264d010) returned 1
	[0092.692] LineTo (hdc=0xc010716, x=2, y=2) returned 1
	[0092.692] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.692] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.693] GetROP2 (hdc=0xc010716) returned 13
	[0092.693] GetBkMode (hdc=0xc010716) returned 2
	[0092.693] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.693] SelectObject (hdc=0xc010716, h=0x4430024f) returned 0x4430024f
	[0092.693] MoveToEx (in: hdc=0xc010716, x=2, y=2, lppt=0x264d028 | out: lppt=0x264d028) returned 1
	[0092.693] LineTo (hdc=0xc010716, x=2, y=38) returned 1
	[0092.693] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.693] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.693] SelectObject (hdc=0xc010716, h=0x1b00017) returned 0x4430024f
	[0092.693] DeleteObject (ho=0x4430024f) returned 1
	[0092.693] GetROP2 (hdc=0xc010716) returned 13
	[0092.693] GetBkMode (hdc=0xc010716) returned 2
	[0092.693] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.693] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1a300241
	[0092.693] SelectObject (hdc=0xc010716, h=0x1a300241) returned 0x1b00017
	[0092.693] MoveToEx (in: hdc=0xc010716, x=2, y=38, lppt=0x264d090 | out: lppt=0x264d090) returned 1
	[0092.693] LineTo (hdc=0xc010716, x=125, y=38) returned 1
	[0092.693] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.693] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.693] GetROP2 (hdc=0xc010716) returned 13
	[0092.693] GetBkMode (hdc=0xc010716) returned 2
	[0092.693] SetBkMode (hdc=0xc010716, mode=1) returned 2
	[0092.693] SelectObject (hdc=0xc010716, h=0x1a300241) returned 0x1a300241
	[0092.693] MoveToEx (in: hdc=0xc010716, x=125, y=38, lppt=0x264d0a8 | out: lppt=0x264d0a8) returned 1
	[0092.693] LineTo (hdc=0xc010716, x=125, y=1) returned 1
	[0092.693] SetBkMode (hdc=0xc010716, mode=2) returned 1
	[0092.693] MoveToEx (in: hdc=0xc010716, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0092.693] SelectObject (hdc=0xc010716, h=0x1b00017) returned 0x1a300241
	[0092.694] DeleteObject (ho=0x1a300241) returned 1
	[0092.694] RestoreDC (hdc=0xc010716, nSavedDC=-1) returned 1
	[0092.694] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.694] GdipReleaseDC (graphics=0x1b927100, hdc=0xc010716) returned 0x0
	[0092.694] GdipGetDC (graphics=0x1b927100, hdc=0x20d0a0) returned 0x0
	[0092.694] BitBlt (hdc=0x70107fc, x=0, y=0, cx=128, cy=41, hdcSrc=0xc010716, x1=0, y1=0, rop=0xcc0020) returned 1
	[0092.694] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.694] GdipReleaseDC (graphics=0x1b927100, hdc=0xc010716) returned 0x0
	[0092.694] SelectObject (hdc=0xc010716, h=0x185000f) returned 0x130507d2
	[0092.694] DeleteDC (hdc=0xc010716) returned 1
	[0092.694] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0092.694] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0092.694] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0092.694] EndPaint (hWnd=0x401b4, lpPaint=0x20d1a8) returned 1
	[0092.697] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x264d100, cPoints=0x1 | out: lpPoints=0x264d100) returned 40370579
	[0092.734] WindowFromPoint (Point=0x27a000001e5) returned 0x401b4
	[0092.734] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27a01e5) returned 0x1
	[0092.736] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0092.736] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0092.832] AdjustWindowRectEx (in: lpRect=0x20d050, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x20d050) returned 1
	[0093.201] AdjustWindowRectEx (in: lpRect=0x20c4d0, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c4d0) returned 1
	[0093.213] AdjustWindowRectEx (in: lpRect=0x20c4e0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c4e0) returned 1
	[0093.222] AdjustWindowRectEx (in: lpRect=0x20c4e0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c4e0) returned 1
	[0093.227] AdjustWindowRectEx (in: lpRect=0x20c4e0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c4e0) returned 1
	[0093.231] GetDC (hWnd=0x0) returned 0x4010280
	[0093.231] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20c1a0) returned 0x0
	[0093.231] GdipGetFontHeight (font=0x1b463a40, graphics=0x1b927100, height=0x20c170) returned 0x0
	[0093.231] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.231] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.231] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0093.231] GetSystemMetrics (nIndex=5) returned 1
	[0093.231] GetSystemMetrics (nIndex=6) returned 1
	[0093.231] AdjustWindowRectEx (in: lpRect=0x20c4e0, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c4e0) returned 1
	[0093.234] AdjustWindowRectEx (in: lpRect=0x20c4e0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c4e0) returned 1
	[0093.237] GetDC (hWnd=0x0) returned 0x4010280
	[0093.237] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20c1a0) returned 0x0
	[0093.238] GdipGetFontHeight (font=0x1b463a40, graphics=0x1b927100, height=0x20c170) returned 0x0
	[0093.238] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.238] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.238] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0093.238] GetSystemMetrics (nIndex=5) returned 1
	[0093.238] GetSystemMetrics (nIndex=6) returned 1
	[0093.238] AdjustWindowRectEx (in: lpRect=0x20c4e0, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c4e0) returned 1
	[0093.241] AdjustWindowRectEx (in: lpRect=0x20c4a0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c4a0) returned 1
	[0093.245] AdjustWindowRectEx (in: lpRect=0x20c4a0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c4a0) returned 1
	[0093.284] GdipLoadImageFromStream (stream=0x250020, image=0x20b638) returned 0x0
	[0093.298] GdipImageForceValidation (image=0x1b910300) returned 0x0
	[0093.316] GdipGetImageType (image=0x1b910300, type=0x20b650) returned 0x0
	[0093.316] GdipGetImageRawFormat (image=0x1b910300, format=0x20b4f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
	[0093.316] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c420) returned 1
	[0093.322] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.323] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.323] GdipGetFontSize (font=0x1b49f090, size=0x20c570) returned 0x0
	[0093.323] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.323] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.329] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.330] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.330] GdipGetFontSize (font=0x1b49f050, size=0x20c570) returned 0x0
	[0093.330] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.330] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.336] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.337] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.337] GdipGetFontSize (font=0x1b49f010, size=0x20c570) returned 0x0
	[0093.337] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.337] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.343] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.343] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.343] GdipGetFontSize (font=0x1b49f1d0, size=0x20c570) returned 0x0
	[0093.344] GetDC (hWnd=0x0) returned 0x4010280
	[0093.344] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20c440) returned 0x0
	[0093.344] GdipGetFontHeight (font=0x1b49f1d0, graphics=0x1b927100, height=0x20c410) returned 0x0
	[0093.344] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.344] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.344] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0093.345] GetDC (hWnd=0x0) returned 0x4010280
	[0093.345] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20c260) returned 0x0
	[0093.345] GdipGetFontHeight (font=0x1b49f1d0, graphics=0x1b927100, height=0x20c230) returned 0x0
	[0093.345] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.345] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.345] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0093.345] GetSystemMetrics (nIndex=5) returned 1
	[0093.345] GetSystemMetrics (nIndex=6) returned 1
	[0093.345] GetSystemMetrics (nIndex=5) returned 1
	[0093.345] GetSystemMetrics (nIndex=6) returned 1
	[0093.345] AdjustWindowRectEx (in: lpRect=0x20c310, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c310) returned 1
	[0093.345] GetSystemMetrics (nIndex=5) returned 1
	[0093.345] GetSystemMetrics (nIndex=6) returned 1
	[0093.345] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c420) returned 1
	[0093.346] GetSystemMetrics (nIndex=5) returned 1
	[0093.346] GetSystemMetrics (nIndex=6) returned 1
	[0093.346] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c420) returned 1
	[0093.355] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.355] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.355] GdipGetFontSize (font=0x1b49f190, size=0x20c570) returned 0x0
	[0093.356] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.356] AdjustWindowRectEx (in: lpRect=0x20c3a0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c3a0) returned 1
	[0093.362] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.362] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.362] GdipGetFontSize (font=0x1b49f110, size=0x20c570) returned 0x0
	[0093.362] GetDC (hWnd=0x0) returned 0x4010280
	[0093.362] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20c440) returned 0x0
	[0093.363] GdipGetFontHeight (font=0x1b49f110, graphics=0x1b927100, height=0x20c410) returned 0x0
	[0093.363] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.363] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.363] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0093.363] GetDC (hWnd=0x0) returned 0x4010280
	[0093.363] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20c260) returned 0x0
	[0093.363] GdipGetFontHeight (font=0x1b49f110, graphics=0x1b927100, height=0x20c230) returned 0x0
	[0093.363] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.363] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.363] ReleaseDC (hWnd=0x0, hDC=0x4010280) returned 1
	[0093.363] GetSystemMetrics (nIndex=5) returned 1
	[0093.363] GetSystemMetrics (nIndex=6) returned 1
	[0093.363] GetSystemMetrics (nIndex=5) returned 1
	[0093.363] GetSystemMetrics (nIndex=6) returned 1
	[0093.363] AdjustWindowRectEx (in: lpRect=0x20c310, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c310) returned 1
	[0093.363] GetSystemMetrics (nIndex=5) returned 1
	[0093.363] GetSystemMetrics (nIndex=6) returned 1
	[0093.363] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c420) returned 1
	[0093.364] GetSystemMetrics (nIndex=5) returned 1
	[0093.364] GetSystemMetrics (nIndex=6) returned 1
	[0093.364] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c420) returned 1
	[0093.369] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.369] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.369] GdipGetFontSize (font=0x1b49f210, size=0x20c570) returned 0x0
	[0093.369] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c420) returned 1
	[0093.369] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c420) returned 1
	[0093.373] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x20c540) returned 0x0
	[0093.373] GdipCreateFont (fontFamily=0x1b3c9970, emSize=0x0, style=1, unit=0x3, font=0x20c4e0) returned 0x0
	[0093.373] GdipGetFontSize (font=0x1b49f250, size=0x20c570) returned 0x0
	[0093.373] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c420) returned 1
	[0093.374] AdjustWindowRectEx (in: lpRect=0x20c420, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c420) returned 1
	[0093.374] AdjustWindowRectEx (in: lpRect=0x20c490, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x20c490) returned 1
	[0093.374] GetSystemMetrics (nIndex=59) returned 1460
	[0093.374] GetSystemMetrics (nIndex=60) returned 920
	[0093.374] GetSystemMetrics (nIndex=34) returned 132
	[0093.374] GetSystemMetrics (nIndex=35) returned 38
	[0093.375] AdjustWindowRectEx (in: lpRect=0x20c110, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x20c110) returned 1
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GetCurrentThreadId () returned 0x244
	[0093.375] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c210) returned 0x0
	[0093.375] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c1d0) returned 0x0
	[0093.375] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.375] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.375] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.375] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c1f0) returned 0x0
	[0093.375] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.375] GdipMeasureString (graphics=0x1b927100, string="my ID =", length=7, font=0x1b49f190, layoutRect=0x20c138, stringFormat=0x1b912930, boundingBox=0x20c128, codepointsFitted=0x20c124, linesFilled=0x20c120) returned 0x0
	[0093.375] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.375] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.376] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.376] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.376] AdjustWindowRectEx (in: lpRect=0x20c130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c130) returned 1
	[0093.376] GetCurrentThreadId () returned 0x244
	[0093.376] GetCurrentThreadId () returned 0x244
	[0093.376] GetCurrentThreadId () returned 0x244
	[0093.376] GetCurrentThreadId () returned 0x244
	[0093.376] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c210) returned 0x0
	[0093.376] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c1d0) returned 0x0
	[0093.376] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.376] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.376] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.376] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c1f0) returned 0x0
	[0093.376] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.376] GdipMeasureString (graphics=0x1b927100, string="My name =", length=9, font=0x1b49f010, layoutRect=0x20c138, stringFormat=0x1b912930, boundingBox=0x20c128, codepointsFitted=0x20c124, linesFilled=0x20c120) returned 0x0
	[0093.376] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.377] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.377] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.377] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.377] AdjustWindowRectEx (in: lpRect=0x20c130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c130) returned 1
	[0093.377] GetCurrentThreadId () returned 0x244
	[0093.377] GetCurrentThreadId () returned 0x244
	[0093.377] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c210) returned 0x0
	[0093.377] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c1d0) returned 0x0
	[0093.377] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.377] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.377] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.377] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c1f0) returned 0x0
	[0093.377] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.391] GdipMeasureString (graphics=0x1b927100, string="Search in Facebook", length=18, font=0x1b49f050, layoutRect=0x20c138, stringFormat=0x1b912930, boundingBox=0x20c128, codepointsFitted=0x20c124, linesFilled=0x20c120) returned 0x0
	[0093.392] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.392] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.392] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.392] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.392] AdjustWindowRectEx (in: lpRect=0x20c130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c130) returned 1
	[0093.392] GetCurrentThreadId () returned 0x244
	[0093.392] GetCurrentThreadId () returned 0x244
	[0093.392] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c210) returned 0x0
	[0093.392] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c1d0) returned 0x0
	[0093.392] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.392] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.392] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.392] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c1f0) returned 0x0
	[0093.392] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.392] GdipMeasureString (graphics=0x1b927100, string="Boom Ransomeware", length=16, font=0x1b49f090, layoutRect=0x20c138, stringFormat=0x1b912930, boundingBox=0x20c128, codepointsFitted=0x20c124, linesFilled=0x20c120) returned 0x0
	[0093.392] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.392] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.392] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.392] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.393] AdjustWindowRectEx (in: lpRect=0x20c130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c130) returned 1
	[0093.393] GetCurrentThreadId () returned 0x244
	[0093.393] GetCurrentThreadId () returned 0x244
	[0093.407] CreateCompatibleDC (hdc=0x0) returned 0x12010716
	[0093.407] SelectObject (hdc=0x12010716, h=0x30a0817) returned 0x18a002e
	[0093.407] GetTextMetricsW (in: hdc=0x12010716, lptm=0x20c1e0 | out: lptm=0x20c1e0) returned 1
	[0093.407] GetTextExtentPoint32W (in: hdc=0x12010716, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x265ea28 | out: psizl=0x265ea28) returned 1
	[0093.407] SelectObject (hdc=0x12010716, h=0x18a002e) returned 0x30a0817
	[0093.407] DeleteDC (hdc=0x12010716) returned 1
	[0093.407] AdjustWindowRectEx (in: lpRect=0x20c020, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20c020) returned 1
	[0093.407] GetCursorPos (in: lpPoint=0x265ea60 | out: lpPoint=0x265ea60*(x=485, y=634)) returned 1
	[0093.407] MonitorFromPoint (pt=0x27a000001e5, dwFlags=0x2) returned 0x10001
	[0093.408] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20be70 | out: lpmi=0x20be70) returned 1
	[0093.408] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x14010716
	[0093.408] GetDeviceCaps (hdc=0x14010716, index=12) returned 32
	[0093.408] GetDeviceCaps (hdc=0x14010716, index=14) returned 1
	[0093.408] DeleteDC (hdc=0x14010716) returned 1
	[0093.408] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20bf70 | out: lpmi=0x20bf70) returned 1
	[0093.408] AdjustWindowRectEx (in: lpRect=0x20c1f0, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20c1f0) returned 1
	[0093.408] AdjustWindowRectEx (in: lpRect=0x20beb0, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20beb0) returned 1
	[0093.408] GetCursorPos (in: lpPoint=0x265ed90 | out: lpPoint=0x265ed90*(x=485, y=634)) returned 1
	[0093.408] MonitorFromPoint (pt=0x27a000001e5, dwFlags=0x2) returned 0x10001
	[0093.408] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20bd00 | out: lpmi=0x20bd00) returned 1
	[0093.408] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x15010716
	[0093.408] GetDeviceCaps (hdc=0x15010716, index=12) returned 32
	[0093.409] GetDeviceCaps (hdc=0x15010716, index=14) returned 1
	[0093.409] DeleteDC (hdc=0x15010716) returned 1
	[0093.409] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20be00 | out: lpmi=0x20be00) returned 1
	[0093.409] AdjustWindowRectEx (in: lpRect=0x20c080, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20c080) returned 1
	[0093.409] GetSystemMetrics (nIndex=34) returned 132
	[0093.409] GetSystemMetrics (nIndex=35) returned 38
	[0093.409] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c190) returned 1
	[0093.409] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c0b0) returned 1
	[0093.409] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c190) returned 1
	[0093.409] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c0b0) returned 1
	[0093.410] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x560000c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c190) returned 1
	[0093.410] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x560000c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c0b0) returned 1
	[0093.410] GetSystemMetrics (nIndex=5) returned 1
	[0093.410] GetSystemMetrics (nIndex=6) returned 1
	[0093.410] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c190) returned 1
	[0093.410] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c0b0) returned 1
	[0093.410] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bf20) returned 0x0
	[0093.410] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bee0) returned 0x0
	[0093.410] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.410] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.410] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.410] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bf00) returned 0x0
	[0093.410] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.410] GdipMeasureString (graphics=0x1b927100, string="my ID =", length=7, font=0x1b49f190, layoutRect=0x20be48, stringFormat=0x1b912930, boundingBox=0x20be38, codepointsFitted=0x20be34, linesFilled=0x20be30) returned 0x0
	[0093.410] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.410] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.410] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.410] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.410] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x560000c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c190) returned 1
	[0093.410] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x560000c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x20c0b0) returned 1
	[0093.411] GetSystemMetrics (nIndex=5) returned 1
	[0093.411] GetSystemMetrics (nIndex=6) returned 1
	[0093.411] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c190) returned 1
	[0093.411] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c0b0) returned 1
	[0093.411] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bf20) returned 0x0
	[0093.411] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bee0) returned 0x0
	[0093.411] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.411] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.411] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.411] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bf00) returned 0x0
	[0093.411] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.411] GdipMeasureString (graphics=0x1b927100, string="My name =", length=9, font=0x1b49f010, layoutRect=0x20be48, stringFormat=0x1b912930, boundingBox=0x20be38, codepointsFitted=0x20be34, linesFilled=0x20be30) returned 0x0
	[0093.411] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.411] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.411] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.411] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.411] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c190) returned 1
	[0093.411] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c0b0) returned 1
	[0093.411] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bf20) returned 0x0
	[0093.411] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bee0) returned 0x0
	[0093.412] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.412] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.412] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.412] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bf00) returned 0x0
	[0093.412] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.412] GdipMeasureString (graphics=0x1b927100, string="Search in Facebook", length=18, font=0x1b49f050, layoutRect=0x20be48, stringFormat=0x1b912930, boundingBox=0x20be38, codepointsFitted=0x20be34, linesFilled=0x20be30) returned 0x0
	[0093.412] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.412] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.412] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.412] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.412] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c190) returned 1
	[0093.412] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c0b0) returned 1
	[0093.412] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bf20) returned 0x0
	[0093.412] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bee0) returned 0x0
	[0093.412] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.412] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.412] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=1) returned 0x0
	[0093.412] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bf00) returned 0x0
	[0093.412] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.412] GdipMeasureString (graphics=0x1b927100, string="Boom Ransomeware", length=16, font=0x1b49f090, layoutRect=0x20be48, stringFormat=0x1b912930, boundingBox=0x20be38, codepointsFitted=0x20be34, linesFilled=0x20be30) returned 0x0
	[0093.413] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.413] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.413] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.413] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.413] AdjustWindowRectEx (in: lpRect=0x20c190, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c190) returned 1
	[0093.413] AdjustWindowRectEx (in: lpRect=0x20c0b0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x20c0b0) returned 1
	[0093.413] AdjustWindowRectEx (in: lpRect=0x20d780, dwStyle=0x2cc0000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x20d780) returned 1
	[0093.413] GetCursorPos (in: lpPoint=0x265f5c0 | out: lpPoint=0x265f5c0*(x=485, y=634)) returned 1
	[0093.413] MonitorFromPoint (pt=0x27a000001e2, dwFlags=0x2) returned 0x10001
	[0093.413] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20d5d0 | out: lpmi=0x20d5d0) returned 1
	[0093.413] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1a010716
	[0093.413] GetDeviceCaps (hdc=0x1a010716, index=12) returned 32
	[0093.413] GetDeviceCaps (hdc=0x1a010716, index=14) returned 1
	[0093.413] DeleteDC (hdc=0x1a010716) returned 1
	[0093.413] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20d6d0 | out: lpmi=0x20d6d0) returned 1
	[0093.414] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.414] CreateWindowExW (dwExStyle=0x10001, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName="Boom Ransomeware To Get PIN", dwStyle=0x2cc0000, X=489, Y=233, nWidth=461, nHeight=394, hWndParent=0x0, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201a6
	[0093.414] SetWindowLongPtrW (hWnd=0x201a6, nIndex=-4, dwNewLong=0x7769b0ac) returned 0xba14bc
	[0093.414] GetWindowLongPtrW (hWnd=0x201a6, nIndex=-4) returned 0x7769b0ac
	[0093.414] SetWindowLongPtrW (hWnd=0x201a6, nIndex=-4, dwNewLong=0xbb373c) returned 0x7769b0ac
	[0093.414] GetWindowLongPtrW (hWnd=0x201a6, nIndex=-4) returned 0xbb373c
	[0093.414] GetWindowLongPtrW (hWnd=0x201a6, nIndex=-16) returned 0x6cc0000
	[0093.414] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x81, wParam=0x0, lParam=0x20cf70) returned 0x1
	[0093.415] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x83, wParam=0x0, lParam=0x20d010) returned 0x0
	[0093.415] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1, wParam=0x0, lParam=0x20cf20) returned 0x0
	[0093.415] GetClientRect (in: hWnd=0x201a6, lpRect=0x20c730 | out: lpRect=0x20c730) returned 1
	[0093.415] GetWindowRect (in: hWnd=0x201a6, lpRect=0x20c730 | out: lpRect=0x20c730) returned 1
	[0093.415] SetWindowTextW (hWnd=0x201a6, lpString="Boom Ransomeware To Get PIN") returned 1
	[0093.415] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xc, wParam=0x0, lParam=0x265dc60) returned 0x1
	[0093.416] GetStartupInfoW (in: lpStartupInfo=0x265fa48 | out: lpStartupInfo=0x265fa48*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BooM Ransomeware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0093.416] GetParent (hWnd=0x201a6) returned 0x0
	[0093.416] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.416] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.378734a", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201e4
	[0093.416] SetWindowLongPtrW (hWnd=0x201e4, nIndex=-4, dwNewLong=0x7769b0ac) returned 0xbb325c
	[0093.416] GetWindowLongPtrW (hWnd=0x201e4, nIndex=-4) returned 0x7769b0ac
	[0093.416] SetWindowLongPtrW (hWnd=0x201e4, nIndex=-4, dwNewLong=0xbb378c) returned 0x7769b0ac
	[0093.417] GetWindowLongPtrW (hWnd=0x201e4, nIndex=-4) returned 0xbb378c
	[0093.417] GetWindowLongPtrW (hWnd=0x201e4, nIndex=-16) returned 0x4c00000
	[0093.417] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x24, wParam=0x0, lParam=0x20cfc0) returned 0x0
	[0093.417] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x81, wParam=0x0, lParam=0x20cf40) returned 0x1
	[0093.417] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x83, wParam=0x0, lParam=0x20cfe0) returned 0x0
	[0093.417] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1, wParam=0x0, lParam=0x20cf40) returned 0x0
	[0093.417] SetWindowLongPtrW (hWnd=0x201a6, nIndex=-8, dwNewLong=0x201e4) returned 0x0
	[0093.418] SendMessageW (hWnd=0x201a6, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
	[0093.418] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
	[0093.418] SendMessageW (hWnd=0x201a6, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
	[0093.418] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
	[0093.418] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.418] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.418] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.420] GetSystemMenu (hWnd=0x201a6, bRevert=0) returned 0xb00ed
	[0093.420] GetWindowPlacement (in: hWnd=0x201a6, lpwndpl=0x20d790 | out: lpwndpl=0x20d790) returned 1
	[0093.420] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf020, uEnable=0x1) returned 0
	[0093.420] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf030, uEnable=0x1) returned 0
	[0093.420] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0
	[0093.420] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf120, uEnable=0x1) returned 0
	[0093.420] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf000, uEnable=0x0) returned 0
	[0093.420] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d8b0 | out: lpRect=0x20d8b0) returned 1
	[0093.421] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d790 | out: lpRect=0x20d790) returned 1
	[0093.421] GetWindowRect (in: hWnd=0x201a6, lpRect=0x20d790 | out: lpRect=0x20d790) returned 1
	[0093.421] SetWindowLongPtrW (hWnd=0x201a6, nIndex=-8, dwNewLong=0x201e4) returned 0x201e4
	[0093.421] SendMessageW (hWnd=0x201e4, Msg=0x80, wParam=0x1, lParam=0x401a3) returned 0x0
	[0093.421] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x80, wParam=0x1, lParam=0x401a3) returned 0x0
	[0093.421] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0xd, wParam=0x104, lParam=0x1b1352d0) returned 0x0
	[0093.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0xd, wParam=0x104, lParam=0x1b1352d0) returned 0x0
	[0093.422] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0xffffffffffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1
	[0093.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20d890) returned 0x0
	[0093.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x46, wParam=0x0, lParam=0x20d890) returned 0x0
	[0093.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x0, lParam=0x201a6) returned 0x1
	[0093.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.424] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20d890) returned 0x0
	[0093.424] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x46, wParam=0x0, lParam=0x20d890) returned 0x0
	[0093.424] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x50120) returned 0x1
	[0093.425] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.425] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.425] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.427] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x8, wParam=0x201a6, lParam=0x0) returned 0x0
	[0093.427] GetStockObject (i=5) returned 0x1900015
	[0093.427] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20cc80) returned 0x0
	[0093.427] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20cc80) returned 0x0
	[0093.427] GetCapture () returned 0x401b4
	[0093.430] ReleaseCapture () returned 1
	[0093.431] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0093.431] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0093.431] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0093.431] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0093.431] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0093.431] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0093.431] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0093.432] GetParent (hWnd=0x201a6) returned 0x0
	[0093.432] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0093.432] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7, wParam=0x401b4, lParam=0x0) returned 0x0
	[0093.433] GetWindowPlacement (in: hWnd=0x201a6, lpwndpl=0x20d2f0 | out: lpwndpl=0x20d2f0) returned 1
	[0093.433] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x47, wParam=0x0, lParam=0x20d890) returned 0x0
	[0093.433] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d090 | out: lpRect=0x20d090) returned 1
	[0093.433] GetWindowRect (in: hWnd=0x201a6, lpRect=0x20d090 | out: lpRect=0x20d090) returned 1
	[0093.433] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.433] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.433] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.434] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x83, wParam=0x1, lParam=0x20d1f0) returned 0x0
	[0093.434] GetWindowLongPtrW (hWnd=0x201a6, nIndex=-16) returned 0x6cc0000
	[0093.434] GetWindowTextLengthW (hWnd=0x201a6) returned 27
	[0093.434] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1b
	[0093.434] GetSystemMetrics (nIndex=42) returned 0
	[0093.434] CoTaskMemAlloc (cb=0x3c) returned 0x1afe5b80
	[0093.434] GetWindowTextW (in: hWnd=0x201a6, lpString=0x1afe5b80, nMaxCount=28 | out: lpString="Boom Ransomeware To Get PIN") returned 27
	[0093.434] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xd, wParam=0x1c, lParam=0x1afe5b80) returned 0x1b
	[0093.434] CoTaskMemFree (pv=0x1afe5b80) 
	[0093.434] GetWindowTextLengthW (hWnd=0x201a6) returned 27
	[0093.434] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1b
	[0093.434] GetSystemMetrics (nIndex=42) returned 0
	[0093.434] CoTaskMemAlloc (cb=0x3c) returned 0x1afe5b80
	[0093.434] GetWindowTextW (in: hWnd=0x201a6, lpString=0x1afe5b80, nMaxCount=28 | out: lpString="Boom Ransomeware To Get PIN") returned 27
	[0093.435] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xd, wParam=0x1c, lParam=0x1afe5b80) returned 0x1b
	[0093.435] CoTaskMemFree (pv=0x1afe5b80) 
	[0093.435] GetCursorPos (in: lpPoint=0x265fed0 | out: lpPoint=0x265fed0*(x=485, y=634)) returned 1
	[0093.435] MonitorFromPoint (pt=0x27a000001e5, dwFlags=0x2) returned 0x10001
	[0093.435] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20d600 | out: lpmi=0x20d600) returned 1
	[0093.435] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1301025d
	[0093.435] GetDeviceCaps (hdc=0x1301025d, index=12) returned 32
	[0093.435] GetDeviceCaps (hdc=0x1301025d, index=14) returned 1
	[0093.435] DeleteDC (hdc=0x1301025d) returned 1
	[0093.435] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x20d700 | out: lpmi=0x20d700) returned 1
	[0093.435] GetWindowLongPtrW (hWnd=0x201a6, nIndex=-16) returned 0x6cc0000
	[0093.435] GetWindowLongPtrW (hWnd=0x201a6, nIndex=-20) returned 0x10109
	[0093.435] SetWindowLongPtrW (hWnd=0x201a6, nIndex=-16, dwNewLong=0x2cc0000) returned 0x6cc0000
	[0093.436] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x20d7d0) returned 0x0
	[0093.436] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x20d7d0) returned 0x0
	[0093.436] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.436] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.436] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.436] SetWindowLongPtrW (hWnd=0x201a6, nIndex=-20, dwNewLong=0x10001) returned 0x10109
	[0093.436] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x20d7d0) returned 0x0
	[0093.436] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x20d7d0) returned 0x0
	[0093.437] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.437] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.437] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.437] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
	[0093.437] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20d870) returned 0x0
	[0093.437] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x83, wParam=0x1, lParam=0x20d840) returned 0x0
	[0093.437] GetWindowPlacement (in: hWnd=0x201a6, lpwndpl=0x20d2d0 | out: lpwndpl=0x20d2d0) returned 1
	[0093.437] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x47, wParam=0x0, lParam=0x20d870) returned 0x0
	[0093.437] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d070 | out: lpRect=0x20d070) returned 1
	[0093.437] GetWindowRect (in: hWnd=0x201a6, lpRect=0x20d070 | out: lpRect=0x20d070) returned 1
	[0093.438] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.438] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.438] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.438] RedrawWindow (hWnd=0x201a6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.439] GetSystemMenu (hWnd=0x201a6, bRevert=0) returned 0xb00ed
	[0093.439] GetWindowPlacement (in: hWnd=0x201a6, lpwndpl=0x20d790 | out: lpwndpl=0x20d790) returned 1
	[0093.439] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf020, uEnable=0x1) returned 1
	[0093.439] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf030, uEnable=0x1) returned 1
	[0093.439] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0
	[0093.439] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf120, uEnable=0x1) returned 1
	[0093.439] EnableMenuItem (hMenu=0xb00ed, uIDEnableItem=0xf000, uEnable=0x0) returned 0
	[0093.439] ShowWindow (hWnd=0x201a6, nCmdShow=5) returned 0
	[0093.439] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.439] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.439] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.378734a", lpWindowName="Back", dwStyle=0x5601000b, X=12, Y=307, nWidth=118, nHeight=37, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201e6
	[0093.439] SetWindowLongPtrW (hWnd=0x201e6, nIndex=-4, dwNewLong=0x776f819c) returned 0xbb339c
	[0093.439] GetWindowLongPtrW (hWnd=0x201e6, nIndex=-4) returned 0x776f819c
	[0093.440] SetWindowLongPtrW (hWnd=0x201e6, nIndex=-4, dwNewLong=0xbb37dc) returned 0x776f819c
	[0093.440] GetWindowLongPtrW (hWnd=0x201e6, nIndex=-4) returned 0xbb37dc
	[0093.440] GetWindowLongPtrW (hWnd=0x201e6, nIndex=-16) returned 0x4601000b
	[0093.440] GetWindowLongPtrW (hWnd=0x201e6, nIndex=-12) returned 0x0
	[0093.440] SetWindowLongPtrW (hWnd=0x201e6, nIndex=-12, dwNewLong=0x201e6) returned 0x0
	[0093.440] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x81, wParam=0x0, lParam=0x20c810) returned 0x1
	[0093.440] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x83, wParam=0x0, lParam=0x20c8b0) returned 0x0
	[0093.440] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x1, wParam=0x0, lParam=0x20c7f0) returned 0x0
	[0093.440] GetWindow (hWnd=0x201e6, uCmd=0x3) returned 0x0
	[0093.440] GetClientRect (in: hWnd=0x201e6, lpRect=0x20bf90 | out: lpRect=0x20bf90) returned 1
	[0093.440] GetWindowRect (in: hWnd=0x201e6, lpRect=0x20bf90 | out: lpRect=0x20bf90) returned 1
	[0093.440] GetParent (hWnd=0x201e6) returned 0x201a6
	[0093.440] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bf80, cPoints=0x2 | out: lpPoints=0x20bf80) returned -17170929
	[0093.441] SetWindowTextW (hWnd=0x201e6, lpString="Back") returned 1
	[0093.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0xc, wParam=0x0, lParam=0x265ca80) returned 0x1
	[0093.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x5, wParam=0x0, lParam=0x250076) returned 0x0
	[0093.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x3, wParam=0x0, lParam=0x133000c) returned 0x0
	[0093.441] GetClientRect (in: hWnd=0x201e6, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.441] GetWindowRect (in: hWnd=0x201e6, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.441] GetParent (hWnd=0x201e6) returned 0x201a6
	[0093.441] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c0a0, cPoints=0x2 | out: lpPoints=0x20c0a0) returned -17170929
	[0093.441] SendMessageW (hWnd=0x201e6, Msg=0x2210, wParam=0x1e60001, lParam=0x201e6) returned 0x0
	[0093.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x2210, wParam=0x1e60001, lParam=0x201e6) returned 0x0
	[0093.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.442] GetParent (hWnd=0x201e6) returned 0x201a6
	[0093.442] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.442] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.378734a", lpWindowName="Open in the browser", dwStyle=0x5601000b, X=220, Y=204, nWidth=166, nHeight=43, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201d8
	[0093.442] SetWindowLongPtrW (hWnd=0x201d8, nIndex=-4, dwNewLong=0x776f819c) returned 0xbb339c
	[0093.442] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-4) returned 0x776f819c
	[0093.442] SetWindowLongPtrW (hWnd=0x201d8, nIndex=-4, dwNewLong=0xbb382c) returned 0x776f819c
	[0093.442] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-4) returned 0xbb382c
	[0093.442] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-16) returned 0x4601000b
	[0093.442] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-12) returned 0x0
	[0093.442] SetWindowLongPtrW (hWnd=0x201d8, nIndex=-12, dwNewLong=0x201d8) returned 0x0
	[0093.443] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x81, wParam=0x0, lParam=0x20c810) returned 0x1
	[0093.443] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x83, wParam=0x0, lParam=0x20c8b0) returned 0x0
	[0093.443] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1, wParam=0x0, lParam=0x20c7e0) returned 0x0
	[0093.443] GetWindow (hWnd=0x201d8, uCmd=0x3) returned 0x201e6
	[0093.443] GetClientRect (in: hWnd=0x201d8, lpRect=0x20bf80 | out: lpRect=0x20bf80) returned 1
	[0093.443] GetWindowRect (in: hWnd=0x201d8, lpRect=0x20bf80 | out: lpRect=0x20bf80) returned 1
	[0093.443] GetParent (hWnd=0x201d8) returned 0x201a6
	[0093.443] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bf70, cPoints=0x2 | out: lpPoints=0x20bf70) returned -17170929
	[0093.444] SetWindowTextW (hWnd=0x201d8, lpString="Open in the browser") returned 1
	[0093.444] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc, wParam=0x0, lParam=0x265c440) returned 0x1
	[0093.444] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x5, wParam=0x0, lParam=0x2b00a6) returned 0x0
	[0093.444] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x3, wParam=0x0, lParam=0xcc00dc) returned 0x0
	[0093.444] GetClientRect (in: hWnd=0x201d8, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.444] GetWindowRect (in: hWnd=0x201d8, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.444] GetParent (hWnd=0x201d8) returned 0x201a6
	[0093.444] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c0a0, cPoints=0x2 | out: lpPoints=0x20c0a0) returned -17170929
	[0093.444] SendMessageW (hWnd=0x201d8, Msg=0x2210, wParam=0x1d80001, lParam=0x201d8) returned 0x0
	[0093.444] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2210, wParam=0x1d80001, lParam=0x201d8) returned 0x0
	[0093.444] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.444] GetParent (hWnd=0x201d8) returned 0x201a6
	[0093.444] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.444] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.378734a", lpWindowName="100027091457754", dwStyle=0x560000c0, X=136, Y=177, nWidth=250, nHeight=21, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201da
	[0093.445] SetWindowLongPtrW (hWnd=0x201da, nIndex=-4, dwNewLong=0x776f820c) returned 0xbb35cc
	[0093.445] GetWindowLongPtrW (hWnd=0x201da, nIndex=-4) returned 0x776f820c
	[0093.445] SetWindowLongPtrW (hWnd=0x201da, nIndex=-4, dwNewLong=0xbb387c) returned 0x776f820c
	[0093.445] GetWindowLongPtrW (hWnd=0x201da, nIndex=-4) returned 0xbb387c
	[0093.445] GetWindowLongPtrW (hWnd=0x201da, nIndex=-16) returned 0x460000c0
	[0093.445] GetWindowLongPtrW (hWnd=0x201da, nIndex=-12) returned 0x0
	[0093.445] SetWindowLongPtrW (hWnd=0x201da, nIndex=-12, dwNewLong=0x201da) returned 0x0
	[0093.445] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x81, wParam=0x0, lParam=0x20c7c0) returned 0x1
	[0093.445] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x83, wParam=0x0, lParam=0x20c860) returned 0x0
	[0093.445] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x1, wParam=0x0, lParam=0x20c790) returned 0x1
	[0093.446] SendMessageW (hWnd=0x201da, Msg=0x2111, wParam=0x40001da, lParam=0x201da) returned 0x0
	[0093.446] SendMessageW (hWnd=0x201da, Msg=0x2111, wParam=0x30001da, lParam=0x201da) returned 0x0
	[0093.446] GetWindow (hWnd=0x201da, uCmd=0x3) returned 0x201d8
	[0093.446] GetClientRect (in: hWnd=0x201da, lpRect=0x20bfe0 | out: lpRect=0x20bfe0) returned 1
	[0093.446] GetWindowRect (in: hWnd=0x201da, lpRect=0x20bfe0 | out: lpRect=0x20bfe0) returned 1
	[0093.446] GetParent (hWnd=0x201da) returned 0x201a6
	[0093.446] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bfd0, cPoints=0x2 | out: lpPoints=0x20bfd0) returned -17170929
	[0093.446] GetDC (hWnd=0x0) returned 0x10107f8
	[0093.446] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20bbf0) returned 0x0
	[0093.447] GdipGetLogFontW (font=0x1b49f110, graphics=0x1b927100, logfontW=0x331b10) returned 0x0
	[0093.447] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.447] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.447] ReleaseDC (hWnd=0x0, hDC=0x10107f8) returned 1
	[0093.447] CreateFontIndirectW (lplf=0x331b10) returned 0x180a025d
	[0093.447] SendMessageW (hWnd=0x201da, Msg=0x30, wParam=0x180a025d, lParam=0x0) returned 0x1
	[0093.447] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x30, wParam=0x180a025d, lParam=0x0) returned 0x1
	[0093.449] SendMessageW (hWnd=0x201da, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
	[0093.449] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
	[0093.450] SetWindowTextW (hWnd=0x201da, lpString="100027091457754") returned 1
	[0093.450] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0xc, wParam=0x0, lParam=0x265be28) returned 0x1
	[0093.450] SendMessageW (hWnd=0x201da, Msg=0x2111, wParam=0x40001da, lParam=0x201da) returned 0x0
	[0093.450] SendMessageW (hWnd=0x201da, Msg=0x2111, wParam=0x30001da, lParam=0x201da) returned 0x0
	[0093.450] GetSystemMetrics (nIndex=5) returned 1
	[0093.450] GetSystemMetrics (nIndex=6) returned 1
	[0093.450] SendMessageW (hWnd=0x201da, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
	[0093.450] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
	[0093.450] SendMessageW (hWnd=0x201da, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
	[0093.450] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
	[0093.450] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x5, wParam=0x0, lParam=0x1100f6) returned 0x0
	[0093.450] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x3, wParam=0x0, lParam=0xb3008a) returned 0x0
	[0093.450] GetClientRect (in: hWnd=0x201da, lpRect=0x20c110 | out: lpRect=0x20c110) returned 1
	[0093.450] GetWindowRect (in: hWnd=0x201da, lpRect=0x20c110 | out: lpRect=0x20c110) returned 1
	[0093.450] GetParent (hWnd=0x201da) returned 0x201a6
	[0093.451] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c100, cPoints=0x2 | out: lpPoints=0x20c100) returned -17170929
	[0093.451] SendMessageW (hWnd=0x201da, Msg=0x2210, wParam=0x1da0001, lParam=0x201da) returned 0x0
	[0093.451] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x2210, wParam=0x1da0001, lParam=0x201da) returned 0x0
	[0093.451] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.451] GetParent (hWnd=0x201da) returned 0x201a6
	[0093.451] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.451] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="my ID =", dwStyle=0x5600000d, X=40, Y=175, nWidth=89, nHeight=29, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201d4
	[0093.451] SetWindowLongPtrW (hWnd=0x201d4, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0093.451] GetWindowLongPtrW (hWnd=0x201d4, nIndex=-4) returned 0x776f826c
	[0093.452] SetWindowLongPtrW (hWnd=0x201d4, nIndex=-4, dwNewLong=0xbb38cc) returned 0x776f826c
	[0093.452] GetWindowLongPtrW (hWnd=0x201d4, nIndex=-4) returned 0xbb38cc
	[0093.452] GetWindowLongPtrW (hWnd=0x201d4, nIndex=-16) returned 0x4600000d
	[0093.452] GetWindowLongPtrW (hWnd=0x201d4, nIndex=-12) returned 0x0
	[0093.452] SetWindowLongPtrW (hWnd=0x201d4, nIndex=-12, dwNewLong=0x201d4) returned 0x0
	[0093.452] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x81, wParam=0x0, lParam=0x20c810) returned 0x1
	[0093.452] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x83, wParam=0x0, lParam=0x20c8b0) returned 0x0
	[0093.452] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x1, wParam=0x0, lParam=0x20c7f0) returned 0x0
	[0093.452] GetWindow (hWnd=0x201d4, uCmd=0x3) returned 0x201da
	[0093.452] GetClientRect (in: hWnd=0x201d4, lpRect=0x20bf90 | out: lpRect=0x20bf90) returned 1
	[0093.452] GetWindowRect (in: hWnd=0x201d4, lpRect=0x20bf90 | out: lpRect=0x20bf90) returned 1
	[0093.452] GetParent (hWnd=0x201d4) returned 0x201a6
	[0093.452] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bf80, cPoints=0x2 | out: lpPoints=0x20bf80) returned -17170929
	[0093.453] SetWindowTextW (hWnd=0x201d4, lpString="my ID =") returned 1
	[0093.453] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0xc, wParam=0x0, lParam=0x265b7f8) returned 0x1
	[0093.453] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x5, wParam=0x0, lParam=0x1d0059) returned 0x0
	[0093.453] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x3, wParam=0x0, lParam=0xaf0028) returned 0x0
	[0093.453] GetClientRect (in: hWnd=0x201d4, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.453] GetWindowRect (in: hWnd=0x201d4, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.453] GetParent (hWnd=0x201d4) returned 0x201a6
	[0093.453] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c0a0, cPoints=0x2 | out: lpPoints=0x20c0a0) returned -17170929
	[0093.453] SendMessageW (hWnd=0x201d4, Msg=0x2210, wParam=0x1d40001, lParam=0x201d4) returned 0x0
	[0093.453] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x2210, wParam=0x1d40001, lParam=0x201d4) returned 0x0
	[0093.453] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.453] GetParent (hWnd=0x201d4) returned 0x201a6
	[0093.454] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.454] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.378734a", lpWindowName="Mohamed Naser Ahmed", dwStyle=0x560000c0, X=136, Y=134, nWidth=250, nHeight=21, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201d6
	[0093.454] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-4, dwNewLong=0x776f820c) returned 0xbb35cc
	[0093.454] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-4) returned 0x776f820c
	[0093.454] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-4, dwNewLong=0xbb391c) returned 0x776f820c
	[0093.454] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-4) returned 0xbb391c
	[0093.454] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-16) returned 0x460000c0
	[0093.454] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-12) returned 0x0
	[0093.454] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-12, dwNewLong=0x201d6) returned 0x0
	[0093.454] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x81, wParam=0x0, lParam=0x20c7c0) returned 0x1
	[0093.454] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x83, wParam=0x0, lParam=0x20c860) returned 0x0
	[0093.454] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x1, wParam=0x0, lParam=0x20c790) returned 0x1
	[0093.455] SendMessageW (hWnd=0x201d6, Msg=0x2111, wParam=0x40001d6, lParam=0x201d6) returned 0x0
	[0093.455] SendMessageW (hWnd=0x201d6, Msg=0x2111, wParam=0x30001d6, lParam=0x201d6) returned 0x0
	[0093.455] GetWindow (hWnd=0x201d6, uCmd=0x3) returned 0x201d4
	[0093.455] GetClientRect (in: hWnd=0x201d6, lpRect=0x20bfe0 | out: lpRect=0x20bfe0) returned 1
	[0093.455] GetWindowRect (in: hWnd=0x201d6, lpRect=0x20bfe0 | out: lpRect=0x20bfe0) returned 1
	[0093.455] GetParent (hWnd=0x201d6) returned 0x201a6
	[0093.455] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bfd0, cPoints=0x2 | out: lpPoints=0x20bfd0) returned -17170929
	[0093.455] GetDC (hWnd=0x0) returned 0x10107f8
	[0093.455] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20bbf0) returned 0x0
	[0093.455] GdipGetLogFontW (font=0x1b49f1d0, graphics=0x1b927100, logfontW=0x331b10) returned 0x0
	[0093.456] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.456] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.456] ReleaseDC (hWnd=0x0, hDC=0x10107f8) returned 1
	[0093.456] CreateFontIndirectW (lplf=0x331b10) returned 0x1d0a07d4
	[0093.456] SendMessageW (hWnd=0x201d6, Msg=0x30, wParam=0x1d0a07d4, lParam=0x0) returned 0x1
	[0093.456] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x30, wParam=0x1d0a07d4, lParam=0x0) returned 0x1
	[0093.456] SendMessageW (hWnd=0x201d6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
	[0093.456] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
	[0093.457] SetWindowTextW (hWnd=0x201d6, lpString="Mohamed Naser Ahmed") returned 1
	[0093.457] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0xc, wParam=0x0, lParam=0x265b160) returned 0x1
	[0093.457] SendMessageW (hWnd=0x201d6, Msg=0x2111, wParam=0x40001d6, lParam=0x201d6) returned 0x0
	[0093.457] SendMessageW (hWnd=0x201d6, Msg=0x2111, wParam=0x30001d6, lParam=0x201d6) returned 0x0
	[0093.457] GetSystemMetrics (nIndex=5) returned 1
	[0093.457] GetSystemMetrics (nIndex=6) returned 1
	[0093.457] SendMessageW (hWnd=0x201d6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
	[0093.457] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
	[0093.457] SendMessageW (hWnd=0x201d6, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
	[0093.457] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
	[0093.457] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x5, wParam=0x0, lParam=0x1100f6) returned 0x0
	[0093.457] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x3, wParam=0x0, lParam=0x88008a) returned 0x0
	[0093.457] GetClientRect (in: hWnd=0x201d6, lpRect=0x20c110 | out: lpRect=0x20c110) returned 1
	[0093.457] GetWindowRect (in: hWnd=0x201d6, lpRect=0x20c110 | out: lpRect=0x20c110) returned 1
	[0093.457] GetParent (hWnd=0x201d6) returned 0x201a6
	[0093.457] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c100, cPoints=0x2 | out: lpPoints=0x20c100) returned -17170929
	[0093.457] SendMessageW (hWnd=0x201d6, Msg=0x2210, wParam=0x1d60001, lParam=0x201d6) returned 0x0
	[0093.457] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x2210, wParam=0x1d60001, lParam=0x201d6) returned 0x0
	[0093.457] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.458] GetParent (hWnd=0x201d6) returned 0x201a6
	[0093.458] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.458] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="My name =", dwStyle=0x5600000d, X=12, Y=131, nWidth=118, nHeight=29, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201d0
	[0093.458] SetWindowLongPtrW (hWnd=0x201d0, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0093.458] GetWindowLongPtrW (hWnd=0x201d0, nIndex=-4) returned 0x776f826c
	[0093.458] SetWindowLongPtrW (hWnd=0x201d0, nIndex=-4, dwNewLong=0xbb396c) returned 0x776f826c
	[0093.458] GetWindowLongPtrW (hWnd=0x201d0, nIndex=-4) returned 0xbb396c
	[0093.458] GetWindowLongPtrW (hWnd=0x201d0, nIndex=-16) returned 0x4600000d
	[0093.458] GetWindowLongPtrW (hWnd=0x201d0, nIndex=-12) returned 0x0
	[0093.458] SetWindowLongPtrW (hWnd=0x201d0, nIndex=-12, dwNewLong=0x201d0) returned 0x0
	[0093.458] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x81, wParam=0x0, lParam=0x20c810) returned 0x1
	[0093.458] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x83, wParam=0x0, lParam=0x20c8b0) returned 0x0
	[0093.459] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x1, wParam=0x0, lParam=0x20c7f0) returned 0x0
	[0093.459] GetWindow (hWnd=0x201d0, uCmd=0x3) returned 0x201d6
	[0093.459] GetClientRect (in: hWnd=0x201d0, lpRect=0x20bf90 | out: lpRect=0x20bf90) returned 1
	[0093.459] GetWindowRect (in: hWnd=0x201d0, lpRect=0x20bf90 | out: lpRect=0x20bf90) returned 1
	[0093.459] GetParent (hWnd=0x201d0) returned 0x201a6
	[0093.459] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bf80, cPoints=0x2 | out: lpPoints=0x20bf80) returned -17170929
	[0093.459] SetWindowTextW (hWnd=0x201d0, lpString="My name =") returned 1
	[0093.459] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0xc, wParam=0x0, lParam=0x265ab20) returned 0x1
	[0093.459] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x5, wParam=0x0, lParam=0x1d0076) returned 0x0
	[0093.459] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x3, wParam=0x0, lParam=0x83000c) returned 0x0
	[0093.459] GetClientRect (in: hWnd=0x201d0, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.459] GetWindowRect (in: hWnd=0x201d0, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.459] GetParent (hWnd=0x201d0) returned 0x201a6
	[0093.460] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c0a0, cPoints=0x2 | out: lpPoints=0x20c0a0) returned -17170929
	[0093.460] SendMessageW (hWnd=0x201d0, Msg=0x2210, wParam=0x1d00001, lParam=0x201d0) returned 0x0
	[0093.460] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x2210, wParam=0x1d00001, lParam=0x201d0) returned 0x0
	[0093.460] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.460] GetParent (hWnd=0x201d0) returned 0x201a6
	[0093.460] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.460] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="Search in Facebook", dwStyle=0x5600000d, X=12, Y=71, nWidth=197, nHeight=29, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201d2
	[0093.460] SetWindowLongPtrW (hWnd=0x201d2, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0093.460] GetWindowLongPtrW (hWnd=0x201d2, nIndex=-4) returned 0x776f826c
	[0093.460] SetWindowLongPtrW (hWnd=0x201d2, nIndex=-4, dwNewLong=0xbb39bc) returned 0x776f826c
	[0093.460] GetWindowLongPtrW (hWnd=0x201d2, nIndex=-4) returned 0xbb39bc
	[0093.460] GetWindowLongPtrW (hWnd=0x201d2, nIndex=-16) returned 0x4600000d
	[0093.460] GetWindowLongPtrW (hWnd=0x201d2, nIndex=-12) returned 0x0
	[0093.460] SetWindowLongPtrW (hWnd=0x201d2, nIndex=-12, dwNewLong=0x201d2) returned 0x0
	[0093.461] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x81, wParam=0x0, lParam=0x20c810) returned 0x1
	[0093.461] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x83, wParam=0x0, lParam=0x20c8b0) returned 0x0
	[0093.461] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x1, wParam=0x0, lParam=0x20c7e0) returned 0x0
	[0093.461] GetWindow (hWnd=0x201d2, uCmd=0x3) returned 0x201d0
	[0093.461] GetClientRect (in: hWnd=0x201d2, lpRect=0x20bf80 | out: lpRect=0x20bf80) returned 1
	[0093.461] GetWindowRect (in: hWnd=0x201d2, lpRect=0x20bf80 | out: lpRect=0x20bf80) returned 1
	[0093.461] GetParent (hWnd=0x201d2) returned 0x201a6
	[0093.461] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bf70, cPoints=0x2 | out: lpPoints=0x20bf70) returned -17170929
	[0093.461] SetWindowTextW (hWnd=0x201d2, lpString="Search in Facebook") returned 1
	[0093.461] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0xc, wParam=0x0, lParam=0x265a448) returned 0x1
	[0093.462] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x5, wParam=0x0, lParam=0x1d00c5) returned 0x0
	[0093.462] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x3, wParam=0x0, lParam=0x47000c) returned 0x0
	[0093.462] GetClientRect (in: hWnd=0x201d2, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.462] GetWindowRect (in: hWnd=0x201d2, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.462] GetParent (hWnd=0x201d2) returned 0x201a6
	[0093.462] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c0a0, cPoints=0x2 | out: lpPoints=0x20c0a0) returned -17170929
	[0093.462] SendMessageW (hWnd=0x201d2, Msg=0x2210, wParam=0x1d20001, lParam=0x201d2) returned 0x0
	[0093.462] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x2210, wParam=0x1d20001, lParam=0x201d2) returned 0x0
	[0093.462] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.462] GetParent (hWnd=0x201d2) returned 0x201a6
	[0093.462] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.462] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.378734a", lpWindowName="Boom Ransomeware", dwStyle=0x5600000d, X=78, Y=13, nWidth=297, nHeight=39, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201cc
	[0093.462] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-4, dwNewLong=0x776f826c) returned 0xbb32fc
	[0093.462] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-4) returned 0x776f826c
	[0093.463] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-4, dwNewLong=0xbb3a0c) returned 0x776f826c
	[0093.463] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-4) returned 0xbb3a0c
	[0093.463] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-16) returned 0x4600000d
	[0093.463] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-12) returned 0x0
	[0093.463] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-12, dwNewLong=0x201cc) returned 0x0
	[0093.463] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x81, wParam=0x0, lParam=0x20c810) returned 0x1
	[0093.463] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x83, wParam=0x0, lParam=0x20c8b0) returned 0x0
	[0093.463] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x1, wParam=0x0, lParam=0x20c7e0) returned 0x0
	[0093.463] GetWindow (hWnd=0x201cc, uCmd=0x3) returned 0x201d2
	[0093.463] GetClientRect (in: hWnd=0x201cc, lpRect=0x20bf80 | out: lpRect=0x20bf80) returned 1
	[0093.463] GetWindowRect (in: hWnd=0x201cc, lpRect=0x20bf80 | out: lpRect=0x20bf80) returned 1
	[0093.463] GetParent (hWnd=0x201cc) returned 0x201a6
	[0093.463] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20bf70, cPoints=0x2 | out: lpPoints=0x20bf70) returned -17170929
	[0093.464] SetWindowTextW (hWnd=0x201cc, lpString="Boom Ransomeware") returned 1
	[0093.464] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0xc, wParam=0x0, lParam=0x2659c88) returned 0x1
	[0093.464] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x5, wParam=0x0, lParam=0x270129) returned 0x0
	[0093.464] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x3, wParam=0x0, lParam=0xd004e) returned 0x0
	[0093.464] GetClientRect (in: hWnd=0x201cc, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.464] GetWindowRect (in: hWnd=0x201cc, lpRect=0x20c0b0 | out: lpRect=0x20c0b0) returned 1
	[0093.464] GetParent (hWnd=0x201cc) returned 0x201a6
	[0093.464] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c0a0, cPoints=0x2 | out: lpPoints=0x20c0a0) returned -17170929
	[0093.464] SendMessageW (hWnd=0x201cc, Msg=0x2210, wParam=0x1cc0001, lParam=0x201cc) returned 0x0
	[0093.464] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x2210, wParam=0x1cc0001, lParam=0x201cc) returned 0x0
	[0093.464] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.464] GetParent (hWnd=0x201cc) returned 0x201a6
	[0093.464] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000
	[0093.464] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=445, nHeight=356, hWndParent=0x201a6, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x201ce
	[0093.464] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-4, dwNewLong=0x7769b0ac) returned 0xba14bc
	[0093.465] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-4) returned 0x7769b0ac
	[0093.465] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-4, dwNewLong=0xbb3a5c) returned 0x7769b0ac
	[0093.465] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-4) returned 0xbb3a5c
	[0093.465] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-16) returned 0x46000000
	[0093.465] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-12) returned 0x0
	[0093.465] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-12, dwNewLong=0x201ce) returned 0x0
	[0093.465] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x81, wParam=0x0, lParam=0x20c810) returned 0x1
	[0093.465] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x83, wParam=0x0, lParam=0x20c8b0) returned 0x0
	[0093.465] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x1, wParam=0x0, lParam=0x20c810) returned 0x0
	[0093.465] GetWindow (hWnd=0x201ce, uCmd=0x3) returned 0x201cc
	[0093.465] GetClientRect (in: hWnd=0x201ce, lpRect=0x20c060 | out: lpRect=0x20c060) returned 1
	[0093.465] GetWindowRect (in: hWnd=0x201ce, lpRect=0x20c060 | out: lpRect=0x20c060) returned 1
	[0093.465] GetParent (hWnd=0x201ce) returned 0x201a6
	[0093.465] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c050, cPoints=0x2 | out: lpPoints=0x20c050) returned -17170929
	[0093.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x5, wParam=0x0, lParam=0x16401bd) returned 0x0
	[0093.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
	[0093.466] GetClientRect (in: hWnd=0x201ce, lpRect=0x20c160 | out: lpRect=0x20c160) returned 1
	[0093.466] GetWindowRect (in: hWnd=0x201ce, lpRect=0x20c160 | out: lpRect=0x20c160) returned 1
	[0093.466] GetParent (hWnd=0x201ce) returned 0x201a6
	[0093.466] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201a6, lpPoints=0x20c150, cPoints=0x2 | out: lpPoints=0x20c150) returned -17170929
	[0093.466] SendMessageW (hWnd=0x201ce, Msg=0x2210, wParam=0x1ce0001, lParam=0x201ce) returned 0x0
	[0093.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x2210, wParam=0x1ce0001, lParam=0x201ce) returned 0x0
	[0093.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
	[0093.466] GetParent (hWnd=0x201ce) returned 0x201a6
	[0093.466] GetWindowTextLengthW (hWnd=0x201a6) returned 27
	[0093.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1b
	[0093.466] GetSystemMetrics (nIndex=42) returned 0
	[0093.466] CoTaskMemAlloc (cb=0x3c) returned 0x1afe5b80
	[0093.466] GetWindowTextW (in: hWnd=0x201a6, lpString=0x1afe5b80, nMaxCount=28 | out: lpString="Boom Ransomeware To Get PIN") returned 27
	[0093.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xd, wParam=0x1c, lParam=0x1afe5b80) returned 0x1b
	[0093.466] CoTaskMemFree (pv=0x1afe5b80) 
	[0093.477] InvalidateRect (hWnd=0x201e6, lpRect=0x0, bErase=0) returned 1
	[0093.477] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0093.477] InvalidateRect (hWnd=0x201da, lpRect=0x0, bErase=1) returned 1
	[0093.477] InvalidateRect (hWnd=0x201d4, lpRect=0x0, bErase=1) returned 1
	[0093.477] InvalidateRect (hWnd=0x201d6, lpRect=0x0, bErase=1) returned 1
	[0093.477] InvalidateRect (hWnd=0x201d0, lpRect=0x0, bErase=1) returned 1
	[0093.477] InvalidateRect (hWnd=0x201d2, lpRect=0x0, bErase=1) returned 1
	[0093.478] InvalidateRect (hWnd=0x201cc, lpRect=0x0, bErase=1) returned 1
	[0093.478] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=1) returned 1
	[0093.478] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x20d100 | out: lpdwProcessId=0x20d100) returned 0x244
	[0093.478] GetCurrentThreadId () returned 0x244
	[0093.478] PostMessageW (hWnd=0x201a6, Msg=0xc131, wParam=0x0, lParam=0x0) returned 1
	[0093.478] GetWindowTextLengthW (hWnd=0x201a6) returned 27
	[0093.478] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1b
	[0093.478] GetSystemMetrics (nIndex=42) returned 0
	[0093.478] CoTaskMemAlloc (cb=0x3c) returned 0x1afe5b80
	[0093.478] GetWindowTextW (in: hWnd=0x201a6, lpString=0x1afe5b80, nMaxCount=28 | out: lpString="Boom Ransomeware To Get PIN") returned 27
	[0093.478] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xd, wParam=0x1c, lParam=0x1afe5b80) returned 0x1b
	[0093.478] CoTaskMemFree (pv=0x1afe5b80) 
	[0093.478] GdipImageGetFrameDimensionsCount (image=0x1b910300, count=0x20cff0) returned 0x0
	[0093.478] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1b0678e0
	[0093.478] GdipImageGetFrameDimensionsList (image=0x1b910300, dimensionIDs=0x1b0678e0*(Data1=0xf0c9002c, Data2=0x7fe, Data3=0x0, Data4=([0]=0x90, [1]=0x2a, [2]=0x8, [3]=0x1b, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0
	[0093.478] LocalFree (hMem=0x1b0678e0) returned 0x0
	[0093.478] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20dad0) returned 0x0
	[0093.479] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x46, wParam=0x0, lParam=0x20dad0) returned 0x0
	[0093.479] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.479] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.479] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.479] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.481] GetWindowPlacement (in: hWnd=0x201a6, lpwndpl=0x20d550 | out: lpwndpl=0x20d550) returned 1
	[0093.481] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d400 | out: lpRect=0x20d400) returned 1
	[0093.481] GetWindowTextLengthW (hWnd=0x201a6) returned 27
	[0093.481] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1b
	[0093.481] GetSystemMetrics (nIndex=42) returned 0
	[0093.481] CoTaskMemAlloc (cb=0x3c) returned 0x1afe5b80
	[0093.481] GetWindowTextW (in: hWnd=0x201a6, lpString=0x1afe5b80, nMaxCount=28 | out: lpString="Boom Ransomeware To Get PIN") returned 27
	[0093.481] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xd, wParam=0x1c, lParam=0x1afe5b80) returned 0x1b
	[0093.481] CoTaskMemFree (pv=0x1afe5b80) 
	[0093.481] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d1a0 | out: lpRect=0x20d1a0) returned 1
	[0093.481] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.481] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20cd70) returned 0x0
	[0093.481] GdipSetPageUnit (graphics=0x1b927100, unit=0x2) returned 0x0
	[0093.481] GdipCreateMatrix (matrix=0x20cc60) returned 0x0
	[0093.481] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.481] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20ccc0) returned 0x0
	[0093.481] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.482] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.482] GdipCreateRegion (region=0x20cc60) returned 0x0
	[0093.482] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.482] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20cc90) returned 0x0
	[0093.482] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.482] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.482] GdipSaveGraphics (graphics=0x1b927100, state=0x20cd60) returned 0x0
	[0093.482] GdipCreateRegion (region=0x20cc30) returned 0x0
	[0093.482] GdipGetClip (graphics=0x1b927100, region=0x1b94ff60) returned 0x0
	[0093.482] GdipCreateMatrix (matrix=0x20cc30) returned 0x0
	[0093.482] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.482] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cc90) returned 0x0
	[0093.482] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.482] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.482] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.482] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.482] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.482] GdipIsInfiniteRegion (region=0x1b94ff60, graphics=0x1b927100, result=0x20cce0) returned 0x0
	[0093.482] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.482] GdipDeleteRegion (region=0x1b94ff60) returned 0x0
	[0093.482] GdipGetDC (graphics=0x1b927100, hdc=0x20cd10) returned 0x0
	[0093.482] GetCurrentObject (hdc=0x10107f8, type=0x1) returned 0x1b00017
	[0093.482] GetCurrentObject (hdc=0x10107f8, type=0x2) returned 0x1900010
	[0093.482] GetCurrentObject (hdc=0x10107f8, type=0x7) returned 0x1050032
	[0093.482] GetCurrentObject (hdc=0x10107f8, type=0x6) returned 0x18a002e
	[0093.483] SaveDC (hdc=0x10107f8) returned 1
	[0093.483] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x2662068 | out: lppt=0x2662068) returned 1
	[0093.483] GetNearestColor (hdc=0x10107f8, color=0xf0f0f0) returned 0xf0f0f0
	[0093.483] CreateSolidBrush (color=0xf0f0f0) returned 0x161007c0
	[0093.483] FillRect (hDC=0x10107f8, lprc=0x20cce0, hbr=0x161007c0) returned 1
	[0093.483] DeleteObject (ho=0x161007c0) returned 1
	[0093.483] RestoreDC (hdc=0x10107f8, nSavedDC=-1) returned 1
	[0093.483] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.483] GdipReleaseDC (graphics=0x1b927100, hdc=0x10107f8) returned 0x0
	[0093.483] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.483] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.483] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.483] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.483] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x14, wParam=0x70107fc, lParam=0x0) returned 0x1
	[0093.484] GetStockObject (i=5) returned 0x1900015
	[0093.484] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.484] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0093.484] GetStockObject (i=5) returned 0x1900015
	[0093.484] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.484] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x14, wParam=0x10107f8, lParam=0x0) returned 0x1
	[0093.484] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.484] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.485] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0093.485] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.485] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.485] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.485] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.486] GetWindowPlacement (in: hWnd=0x201a6, lpwndpl=0x20d530 | out: lpwndpl=0x20d530) returned 1
	[0093.486] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x47, wParam=0x0, lParam=0x20dad0) returned 0x0
	[0093.486] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d2d0 | out: lpRect=0x20d2d0) returned 1
	[0093.486] GetWindowRect (in: hWnd=0x201a6, lpRect=0x20d2d0 | out: lpRect=0x20d2d0) returned 1
	[0093.486] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0093.486] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0093.486] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0093.486] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x5, wParam=0x0, lParam=0x16401bd) returned 0x0
	[0093.486] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x3, wParam=0x0, lParam=0x10701f1) returned 0x0
	[0093.486] GetClientRect (in: hWnd=0x201a6, lpRect=0x20d3a0 | out: lpRect=0x20d3a0) returned 1
	[0093.486] GetWindowRect (in: hWnd=0x201a6, lpRect=0x20d3a0 | out: lpRect=0x20d3a0) returned 1
	[0093.487] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0093.487] GetFocus () returned 0x201a6
	[0093.487] GetFocus () returned 0x201a6
	[0093.487] SetFocus (hWnd=0x201d8) returned 0x201a6
	[0093.487] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x8, wParam=0x201d8, lParam=0x0) returned 0x0
	[0093.487] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0093.487] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0093.488] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0093.488] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x201a6, lParam=0x0) returned 0x0
	[0093.488] GetStockObject (i=5) returned 0x1900015
	[0093.488] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20cd50) returned 0x0
	[0093.488] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20cd50) returned 0x0
	[0093.488] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0093.488] GetFocus () returned 0x201d8
	[0093.488] GetCapture () returned 0x0
	[0093.488] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.488] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0093.489] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.489] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.489] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.489] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.489] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.489] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.489] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0093.489] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.489] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27a01e5) returned 0x1
	[0093.489] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0093.489] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.489] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27a01e5) returned 0x1
	[0093.489] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0093.489] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.489] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.489] GetKeyState (nVirtKey=1) returned 1
	[0093.489] GetKeyState (nVirtKey=2) returned 0
	[0093.489] GetKeyState (nVirtKey=4) returned 0
	[0093.489] GetKeyState (nVirtKey=5) returned 0
	[0093.489] GetKeyState (nVirtKey=6) returned 0
	[0093.489] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.489] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0093.489] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.489] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.489] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.489] BeginPaint (in: hWnd=0x201a6, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x10107f8
	[0093.489] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.489] GetWindowTextLengthW (hWnd=0x201a6) returned 27
	[0093.490] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1b
	[0093.490] GetSystemMetrics (nIndex=42) returned 0
	[0093.490] CoTaskMemAlloc (cb=0x3c) returned 0x1afe5b80
	[0093.490] GetWindowTextW (in: hWnd=0x201a6, lpString=0x1afe5b80, nMaxCount=28 | out: lpString="Boom Ransomeware To Get PIN") returned 27
	[0093.490] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xd, wParam=0x1c, lParam=0x1afe5b80) returned 0x1b
	[0093.490] CoTaskMemFree (pv=0x1afe5b80) 
	[0093.490] EndPaint (hWnd=0x201a6, lpPaint=0x20da98) returned 1
	[0093.490] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x0
	[0093.490] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.490] IsWindowUnicode (hWnd=0x201e6) returned 1
	[0093.490] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.490] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.490] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.490] BeginPaint (in: hWnd=0x201e6, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0093.490] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.490] CreateCompatibleDC (hdc=0x4010280) returned 0x25010803
	[0093.490] SelectObject (hdc=0x25010803, h=0x130507d2) returned 0x185000f
	[0093.490] GdipCreateFromHDC (hdc=0x25010803, graphics=0x20d7e0) returned 0x0
	[0093.490] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.490] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=118, height=37, combineMode=0x0) returned 0x0
	[0093.491] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.491] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.491] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0093.491] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.491] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.491] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.491] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.491] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.491] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.491] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.491] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.491] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.491] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd7d0dbd) returned 0x0
	[0093.491] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.491] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.491] GdipGetDC (graphics=0x1b927100, hdc=0x20cdf0) returned 0x0
	[0093.491] GetCurrentObject (hdc=0x25010803, type=0x1) returned 0x1b00017
	[0093.491] GetCurrentObject (hdc=0x25010803, type=0x2) returned 0x1900010
	[0093.491] GetCurrentObject (hdc=0x25010803, type=0x7) returned 0x130507d2
	[0093.491] GetCurrentObject (hdc=0x25010803, type=0x6) returned 0x18a002e
	[0093.491] SaveDC (hdc=0x25010803) returned 1
	[0093.491] GetNearestColor (hdc=0x25010803, color=0xf0f0f0) returned 0xf0f0f0
	[0093.492] GetNearestColor (hdc=0x25010803, color=0xa0a0a0) returned 0xa0a0a0
	[0093.492] GetNearestColor (hdc=0x25010803, color=0x696969) returned 0x696969
	[0093.492] GetNearestColor (hdc=0x25010803, color=0xa0a0a0) returned 0xa0a0a0
	[0093.492] GetNearestColor (hdc=0x25010803, color=0x0) returned 0x0
	[0093.492] GetNearestColor (hdc=0x25010803, color=0xffffff) returned 0xffffff
	[0093.492] GetNearestColor (hdc=0x25010803, color=0xe5e5e5) returned 0xe5e5e5
	[0093.492] GetNearestColor (hdc=0x25010803, color=0xd8d8d8) returned 0xd8d8d8
	[0093.492] GetNearestColor (hdc=0x25010803, color=0x0) returned 0x0
	[0093.492] RestoreDC (hdc=0x25010803, nSavedDC=-1) returned 1
	[0093.492] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.492] GdipReleaseDC (graphics=0x1b927100, hdc=0x25010803) returned 0x0
	[0093.492] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.493] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.493] CoTaskMemFree (pv=0x1b067780) 
	[0093.493] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0093.493] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.493] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.493] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x20d4f0, fWinIni=0x0 | out: pvParam=0x20d4f0) returned 1
	[0093.493] SendMessageW (hWnd=0x201a6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.493] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.493] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.493] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.493] GetStockObject (i=5) returned 0x1900015
	[0093.493] GetStockObject (i=5) returned 0x1900015
	[0093.493] SendMessageW (hWnd=0x201e6, Msg=0x202b, wParam=0x201e6, lParam=0x20b3a0) returned 0x0
	[0093.493] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x202b, wParam=0x201e6, lParam=0x20b3a0) returned 0x0
	[0093.494] RedrawWindow (hWnd=0x201e6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.494] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.494] GetStockObject (i=5) returned 0x1900015
	[0093.494] GetStockObject (i=5) returned 0x1900015
	[0093.494] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20b3a0) returned 0x0
	[0093.494] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20b3a0) returned 0x0
	[0093.494] RedrawWindow (hWnd=0x201d8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.494] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.494] RedrawWindow (hWnd=0x201da, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.494] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.494] GetStockObject (i=5) returned 0x1900015
	[0093.494] SendMessageW (hWnd=0x201d4, Msg=0x202b, wParam=0x201d4, lParam=0x20b400) returned 0x0
	[0093.494] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x202b, wParam=0x201d4, lParam=0x20b400) returned 0x0
	[0093.495] RedrawWindow (hWnd=0x201d4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.495] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.495] RedrawWindow (hWnd=0x201d6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.495] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.495] GetStockObject (i=5) returned 0x1900015
	[0093.495] SendMessageW (hWnd=0x201d0, Msg=0x202b, wParam=0x201d0, lParam=0x20b400) returned 0x0
	[0093.495] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x202b, wParam=0x201d0, lParam=0x20b400) returned 0x0
	[0093.495] RedrawWindow (hWnd=0x201d0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.495] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.495] GetStockObject (i=5) returned 0x1900015
	[0093.495] SendMessageW (hWnd=0x201d2, Msg=0x202b, wParam=0x201d2, lParam=0x20b400) returned 0x0
	[0093.495] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x202b, wParam=0x201d2, lParam=0x20b400) returned 0x0
	[0093.495] RedrawWindow (hWnd=0x201d2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.495] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.496] GetStockObject (i=5) returned 0x1900015
	[0093.496] SendMessageW (hWnd=0x201cc, Msg=0x202b, wParam=0x201cc, lParam=0x20b400) returned 0x0
	[0093.496] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x202b, wParam=0x201cc, lParam=0x20b400) returned 0x0
	[0093.496] RedrawWindow (hWnd=0x201cc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.496] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
	[0093.496] RedrawWindow (hWnd=0x201ce, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.496] RedrawWindow (hWnd=0x201a6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
	[0093.496] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.496] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0093.496] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0093.496] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0093.496] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0093.496] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0093.496] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.496] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.496] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.497] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.497] CoTaskMemFree (pv=0x1b067780) 
	[0093.497] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0093.497] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0093.497] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0093.497] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0093.497] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.497] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.497] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.497] GdipMeasureString (graphics=0x1b94fc50, string="Back", length=4, font=0x1b49f250, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0093.497] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.497] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.497] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.497] GdipDeleteGraphics (graphics=0x1b94fc50) returned 0x0
	[0093.497] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.498] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.498] CoTaskMemFree (pv=0x1b067780) 
	[0093.498] GdipCreateRegion (region=0x20d120) returned 0x0
	[0093.498] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.498] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0093.498] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.498] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0093.498] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.498] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.498] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.498] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.498] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.498] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.498] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.498] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.498] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d1d0) returned 0x0
	[0093.498] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d190) returned 0x0
	[0093.499] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d190) returned 0x0
	[0093.499] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.499] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.499] GdipGetDC (graphics=0x1b927100, hdc=0x20d200) returned 0x0
	[0093.499] GetCurrentObject (hdc=0x25010803, type=0x1) returned 0x1b00017
	[0093.499] GetCurrentObject (hdc=0x25010803, type=0x2) returned 0x1900010
	[0093.499] GetCurrentObject (hdc=0x25010803, type=0x7) returned 0x130507d2
	[0093.499] GetCurrentObject (hdc=0x25010803, type=0x6) returned 0x18a002e
	[0093.499] SaveDC (hdc=0x25010803) returned 1
	[0093.499] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x320407f9
	[0093.499] GetClipRgn (hdc=0x25010803, hrgn=0x320407f9) returned 0
	[0093.499] SelectClipRgn (hdc=0x25010803, hrgn=0x2d040710) returned 2
	[0093.499] DeleteObject (ho=0x320407f9) returned 1
	[0093.499] DeleteObject (ho=0x2d040710) returned 1
	[0093.499] OffsetViewportOrgEx (in: hdc=0x25010803, x=0, y=0, lppt=0x2663358 | out: lppt=0x2663358) returned 1
	[0093.499] GetNearestColor (hdc=0x25010803, color=0xf0f0f0) returned 0xf0f0f0
	[0093.499] CreateSolidBrush (color=0xf0f0f0) returned 0x171007c0
	[0093.499] FillRect (hDC=0x25010803, lprc=0x20d1d0, hbr=0x171007c0) returned 1
	[0093.500] DeleteObject (ho=0x171007c0) returned 1
	[0093.500] RestoreDC (hdc=0x25010803, nSavedDC=-1) returned 1
	[0093.500] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.500] GdipReleaseDC (graphics=0x1b927100, hdc=0x25010803) returned 0x0
	[0093.500] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.500] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.500] CoTaskMemFree (pv=0x1b067780) 
	[0093.500] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0093.500] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.500] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.500] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.500] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0093.500] GdipDrawString (graphics=0x1b927100, string="Back", length=4, font=0x1b49f250, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.500] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.500] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.501] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.501] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.501] GetFocus () returned 0x201d8
	[0093.501] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0093.501] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.501] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.501] CoTaskMemFree (pv=0x1b067780) 
	[0093.501] GdipCreateRegion (region=0x20d070) returned 0x0
	[0093.501] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.501] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0093.501] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.501] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0093.501] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.501] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.501] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.501] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.501] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.501] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.501] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.501] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.502] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d120) returned 0x0
	[0093.502] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d0e0) returned 0x0
	[0093.502] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d0e0) returned 0x0
	[0093.502] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.502] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.502] GdipGetDC (graphics=0x1b927100, hdc=0x20d150) returned 0x0
	[0093.502] GetCurrentObject (hdc=0x25010803, type=0x1) returned 0x1b00017
	[0093.502] GetCurrentObject (hdc=0x25010803, type=0x2) returned 0x1900010
	[0093.502] GetCurrentObject (hdc=0x25010803, type=0x7) returned 0x130507d2
	[0093.502] GetCurrentObject (hdc=0x25010803, type=0x6) returned 0x18a002e
	[0093.502] SaveDC (hdc=0x25010803) returned 1
	[0093.502] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2e040710
	[0093.502] GetClipRgn (hdc=0x25010803, hrgn=0x2e040710) returned 0
	[0093.502] SelectClipRgn (hdc=0x25010803, hrgn=0x330407f9) returned 2
	[0093.502] DeleteObject (ho=0x2e040710) returned 1
	[0093.503] DeleteObject (ho=0x330407f9) returned 1
	[0093.503] OffsetViewportOrgEx (in: hdc=0x25010803, x=0, y=0, lppt=0x26638b8 | out: lppt=0x26638b8) returned 1
	[0093.503] GetROP2 (hdc=0x25010803) returned 13
	[0093.503] GetBkMode (hdc=0x25010803) returned 2
	[0093.503] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.503] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xa300802
	[0093.503] SelectObject (hdc=0x25010803, h=0xa300802) returned 0x1b00017
	[0093.503] MoveToEx (in: hdc=0x25010803, x=117, y=0, lppt=0x2663920 | out: lppt=0x2663920) returned 1
	[0093.503] LineTo (hdc=0x25010803, x=0, y=0) returned 1
	[0093.503] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.503] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.503] GetROP2 (hdc=0x25010803) returned 13
	[0093.503] GetBkMode (hdc=0x25010803) returned 2
	[0093.503] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.503] SelectObject (hdc=0x25010803, h=0xa300802) returned 0xa300802
	[0093.503] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x2663938 | out: lppt=0x2663938) returned 1
	[0093.503] LineTo (hdc=0x25010803, x=0, y=36) returned 1
	[0093.503] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.503] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.503] SelectObject (hdc=0x25010803, h=0x1b00017) returned 0xa300802
	[0093.503] DeleteObject (ho=0xa300802) returned 1
	[0093.503] GetROP2 (hdc=0x25010803) returned 13
	[0093.503] GetBkMode (hdc=0x25010803) returned 2
	[0093.503] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.503] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x113001e7
	[0093.504] SelectObject (hdc=0x25010803, h=0x113001e7) returned 0x1b00017
	[0093.504] MoveToEx (in: hdc=0x25010803, x=0, y=36, lppt=0x26639a0 | out: lppt=0x26639a0) returned 1
	[0093.504] LineTo (hdc=0x25010803, x=117, y=36) returned 1
	[0093.504] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.504] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.504] GetROP2 (hdc=0x25010803) returned 13
	[0093.504] GetBkMode (hdc=0x25010803) returned 2
	[0093.504] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.504] SelectObject (hdc=0x25010803, h=0x113001e7) returned 0x113001e7
	[0093.504] MoveToEx (in: hdc=0x25010803, x=117, y=36, lppt=0x26639b8 | out: lppt=0x26639b8) returned 1
	[0093.504] LineTo (hdc=0x25010803, x=117, y=-1) returned 1
	[0093.504] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.504] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.504] SelectObject (hdc=0x25010803, h=0x1b00017) returned 0x113001e7
	[0093.504] DeleteObject (ho=0x113001e7) returned 1
	[0093.504] GetROP2 (hdc=0x25010803) returned 13
	[0093.504] GetBkMode (hdc=0x25010803) returned 2
	[0093.504] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.504] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xb300802
	[0093.504] SelectObject (hdc=0x25010803, h=0xb300802) returned 0x1b00017
	[0093.504] MoveToEx (in: hdc=0x25010803, x=116, y=1, lppt=0x2663a20 | out: lppt=0x2663a20) returned 1
	[0093.504] LineTo (hdc=0x25010803, x=1, y=1) returned 1
	[0093.504] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.504] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.504] GetROP2 (hdc=0x25010803) returned 13
	[0093.504] GetBkMode (hdc=0x25010803) returned 2
	[0093.504] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.505] SelectObject (hdc=0x25010803, h=0xb300802) returned 0xb300802
	[0093.505] MoveToEx (in: hdc=0x25010803, x=1, y=1, lppt=0x2663a38 | out: lppt=0x2663a38) returned 1
	[0093.505] LineTo (hdc=0x25010803, x=1, y=35) returned 1
	[0093.505] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.505] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.505] SelectObject (hdc=0x25010803, h=0x1b00017) returned 0xb300802
	[0093.505] DeleteObject (ho=0xb300802) returned 1
	[0093.505] GetROP2 (hdc=0x25010803) returned 13
	[0093.505] GetBkMode (hdc=0x25010803) returned 2
	[0093.505] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.505] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x123001e7
	[0093.505] SelectObject (hdc=0x25010803, h=0x123001e7) returned 0x1b00017
	[0093.505] MoveToEx (in: hdc=0x25010803, x=1, y=35, lppt=0x2663aa0 | out: lppt=0x2663aa0) returned 1
	[0093.505] LineTo (hdc=0x25010803, x=116, y=35) returned 1
	[0093.505] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.505] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.505] GetROP2 (hdc=0x25010803) returned 13
	[0093.505] GetBkMode (hdc=0x25010803) returned 2
	[0093.505] SetBkMode (hdc=0x25010803, mode=1) returned 2
	[0093.505] SelectObject (hdc=0x25010803, h=0x123001e7) returned 0x123001e7
	[0093.505] MoveToEx (in: hdc=0x25010803, x=116, y=35, lppt=0x2663ab8 | out: lppt=0x2663ab8) returned 1
	[0093.505] LineTo (hdc=0x25010803, x=116, y=0) returned 1
	[0093.505] SetBkMode (hdc=0x25010803, mode=2) returned 1
	[0093.505] MoveToEx (in: hdc=0x25010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.505] SelectObject (hdc=0x25010803, h=0x1b00017) returned 0x123001e7
	[0093.506] DeleteObject (ho=0x123001e7) returned 1
	[0093.506] RestoreDC (hdc=0x25010803, nSavedDC=-1) returned 1
	[0093.506] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.506] GdipReleaseDC (graphics=0x1b927100, hdc=0x25010803) returned 0x0
	[0093.506] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.506] BitBlt (hdc=0x4010280, x=0, y=0, cx=118, cy=37, hdcSrc=0x25010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.506] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.506] GdipReleaseDC (graphics=0x1b927100, hdc=0x25010803) returned 0x0
	[0093.506] SelectObject (hdc=0x25010803, h=0x185000f) returned 0x130507d2
	[0093.506] DeleteDC (hdc=0x25010803) returned 1
	[0093.506] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.506] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.506] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.506] EndPaint (hWnd=0x201e6, lpPaint=0x20d9e8) returned 1
	[0093.506] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.506] IsWindowUnicode (hWnd=0x201e6) returned 1
	[0093.506] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.506] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.506] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.506] BeginPaint (in: hWnd=0x201e6, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0093.507] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.507] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201e6, Msg=0x14, wParam=0x70107fc, lParam=0x0) returned 0x1
	[0093.507] GetStockObject (i=5) returned 0x1900015
	[0093.507] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.507] CreateCompatibleDC (hdc=0x70107fc) returned 0x28010803
	[0093.507] SelectObject (hdc=0x28010803, h=0x130507d2) returned 0x185000f
	[0093.507] GdipCreateFromHDC (hdc=0x28010803, graphics=0x20d7e0) returned 0x0
	[0093.507] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.507] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=118, height=37, combineMode=0x0) returned 0x0
	[0093.507] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.507] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.507] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0093.507] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.507] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.507] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.507] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.507] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.507] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.507] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.508] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.508] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.508] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd7a0dbd) returned 0x0
	[0093.508] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.508] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.508] GdipGetDC (graphics=0x1b927100, hdc=0x20cdf0) returned 0x0
	[0093.508] GetCurrentObject (hdc=0x28010803, type=0x1) returned 0x1b00017
	[0093.508] GetCurrentObject (hdc=0x28010803, type=0x2) returned 0x1900010
	[0093.508] GetCurrentObject (hdc=0x28010803, type=0x7) returned 0x130507d2
	[0093.508] GetCurrentObject (hdc=0x28010803, type=0x6) returned 0x18a002e
	[0093.508] SaveDC (hdc=0x28010803) returned 1
	[0093.508] GetNearestColor (hdc=0x28010803, color=0xf0f0f0) returned 0xf0f0f0
	[0093.508] GetNearestColor (hdc=0x28010803, color=0xa0a0a0) returned 0xa0a0a0
	[0093.508] GetNearestColor (hdc=0x28010803, color=0x696969) returned 0x696969
	[0093.508] GetNearestColor (hdc=0x28010803, color=0xa0a0a0) returned 0xa0a0a0
	[0093.508] GetNearestColor (hdc=0x28010803, color=0x0) returned 0x0
	[0093.508] GetNearestColor (hdc=0x28010803, color=0xffffff) returned 0xffffff
	[0093.508] GetNearestColor (hdc=0x28010803, color=0xe5e5e5) returned 0xe5e5e5
	[0093.508] GetNearestColor (hdc=0x28010803, color=0xd8d8d8) returned 0xd8d8d8
	[0093.508] GetNearestColor (hdc=0x28010803, color=0x0) returned 0x0
	[0093.509] RestoreDC (hdc=0x28010803, nSavedDC=-1) returned 1
	[0093.509] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.509] GdipReleaseDC (graphics=0x1b927100, hdc=0x28010803) returned 0x0
	[0093.509] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.509] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.509] CoTaskMemFree (pv=0x1b067780) 
	[0093.509] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0093.509] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.509] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.509] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.509] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0093.509] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0093.509] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0093.509] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0093.509] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0093.509] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.509] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.510] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.510] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.510] CoTaskMemFree (pv=0x1b067780) 
	[0093.510] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0093.510] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0093.510] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0093.510] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0093.510] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.510] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.510] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.510] GdipMeasureString (graphics=0x1b94fc50, string="Back", length=4, font=0x1b49f250, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0093.510] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.510] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.510] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.510] GdipDeleteGraphics (graphics=0x1b94fc50) returned 0x0
	[0093.510] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.510] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.511] CoTaskMemFree (pv=0x1b067780) 
	[0093.511] GdipCreateRegion (region=0x20d120) returned 0x0
	[0093.511] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.511] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0093.511] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.511] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0093.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.511] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.511] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.511] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.511] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.511] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.511] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.511] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d1d0) returned 0x0
	[0093.511] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d190) returned 0x0
	[0093.511] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d190) returned 0x0
	[0093.511] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.511] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.511] GdipGetDC (graphics=0x1b927100, hdc=0x20d200) returned 0x0
	[0093.511] GetCurrentObject (hdc=0x28010803, type=0x1) returned 0x1b00017
	[0093.511] GetCurrentObject (hdc=0x28010803, type=0x2) returned 0x1900010
	[0093.511] GetCurrentObject (hdc=0x28010803, type=0x7) returned 0x130507d2
	[0093.512] GetCurrentObject (hdc=0x28010803, type=0x6) returned 0x18a002e
	[0093.512] SaveDC (hdc=0x28010803) returned 1
	[0093.512] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x340407f9
	[0093.512] GetClipRgn (hdc=0x28010803, hrgn=0x340407f9) returned 0
	[0093.512] SelectClipRgn (hdc=0x28010803, hrgn=0x2f040710) returned 2
	[0093.512] DeleteObject (ho=0x340407f9) returned 1
	[0093.512] DeleteObject (ho=0x2f040710) returned 1
	[0093.512] OffsetViewportOrgEx (in: hdc=0x28010803, x=0, y=0, lppt=0x2664718 | out: lppt=0x2664718) returned 1
	[0093.512] GetNearestColor (hdc=0x28010803, color=0xf0f0f0) returned 0xf0f0f0
	[0093.512] CreateSolidBrush (color=0xf0f0f0) returned 0x181007c0
	[0093.512] FillRect (hDC=0x28010803, lprc=0x20d1d0, hbr=0x181007c0) returned 1
	[0093.512] DeleteObject (ho=0x181007c0) returned 1
	[0093.512] RestoreDC (hdc=0x28010803, nSavedDC=-1) returned 1
	[0093.512] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.512] GdipReleaseDC (graphics=0x1b927100, hdc=0x28010803) returned 0x0
	[0093.512] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.512] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.512] CoTaskMemFree (pv=0x1b067780) 
	[0093.513] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0093.513] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.513] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.513] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.513] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0093.513] GdipDrawString (graphics=0x1b927100, string="Back", length=4, font=0x1b49f250, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.513] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.513] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.513] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.513] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.513] GetFocus () returned 0x201d8
	[0093.513] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0093.513] CoTaskMemAlloc (cb=0x13) returned 0x1b067780
	[0093.513] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.513] CoTaskMemFree (pv=0x1b067780) 
	[0093.513] GdipCreateRegion (region=0x20d070) returned 0x0
	[0093.513] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.513] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0093.514] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.514] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0093.514] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.514] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.514] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.514] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.514] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.514] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.514] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.514] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.514] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d120) returned 0x0
	[0093.514] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d0e0) returned 0x0
	[0093.514] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d0e0) returned 0x0
	[0093.514] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.514] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.514] GdipGetDC (graphics=0x1b927100, hdc=0x20d150) returned 0x0
	[0093.514] GetCurrentObject (hdc=0x28010803, type=0x1) returned 0x1b00017
	[0093.514] GetCurrentObject (hdc=0x28010803, type=0x2) returned 0x1900010
	[0093.514] GetCurrentObject (hdc=0x28010803, type=0x7) returned 0x130507d2
	[0093.514] GetCurrentObject (hdc=0x28010803, type=0x6) returned 0x18a002e
	[0093.514] SaveDC (hdc=0x28010803) returned 1
	[0093.514] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x30040710
	[0093.514] GetClipRgn (hdc=0x28010803, hrgn=0x30040710) returned 0
	[0093.514] SelectClipRgn (hdc=0x28010803, hrgn=0x350407f9) returned 2
	[0093.514] DeleteObject (ho=0x30040710) returned 1
	[0093.514] DeleteObject (ho=0x350407f9) returned 1
	[0093.515] OffsetViewportOrgEx (in: hdc=0x28010803, x=0, y=0, lppt=0x2664c78 | out: lppt=0x2664c78) returned 1
	[0093.515] GetROP2 (hdc=0x28010803) returned 13
	[0093.515] GetBkMode (hdc=0x28010803) returned 2
	[0093.515] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.515] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x133001e7
	[0093.515] SelectObject (hdc=0x28010803, h=0x133001e7) returned 0x1b00017
	[0093.515] MoveToEx (in: hdc=0x28010803, x=117, y=0, lppt=0x2664ce0 | out: lppt=0x2664ce0) returned 1
	[0093.515] LineTo (hdc=0x28010803, x=0, y=0) returned 1
	[0093.515] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.515] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.515] GetROP2 (hdc=0x28010803) returned 13
	[0093.515] GetBkMode (hdc=0x28010803) returned 2
	[0093.515] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.515] SelectObject (hdc=0x28010803, h=0x133001e7) returned 0x133001e7
	[0093.515] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x2664cf8 | out: lppt=0x2664cf8) returned 1
	[0093.515] LineTo (hdc=0x28010803, x=0, y=36) returned 1
	[0093.515] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.515] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.515] SelectObject (hdc=0x28010803, h=0x1b00017) returned 0x133001e7
	[0093.515] DeleteObject (ho=0x133001e7) returned 1
	[0093.515] GetROP2 (hdc=0x28010803) returned 13
	[0093.515] GetBkMode (hdc=0x28010803) returned 2
	[0093.515] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.515] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xc300802
	[0093.515] SelectObject (hdc=0x28010803, h=0xc300802) returned 0x1b00017
	[0093.516] MoveToEx (in: hdc=0x28010803, x=0, y=36, lppt=0x2664d60 | out: lppt=0x2664d60) returned 1
	[0093.516] LineTo (hdc=0x28010803, x=117, y=36) returned 1
	[0093.516] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.516] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.516] GetROP2 (hdc=0x28010803) returned 13
	[0093.516] GetBkMode (hdc=0x28010803) returned 2
	[0093.516] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.516] SelectObject (hdc=0x28010803, h=0xc300802) returned 0xc300802
	[0093.516] MoveToEx (in: hdc=0x28010803, x=117, y=36, lppt=0x2664d78 | out: lppt=0x2664d78) returned 1
	[0093.516] LineTo (hdc=0x28010803, x=117, y=-1) returned 1
	[0093.516] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.516] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.516] SelectObject (hdc=0x28010803, h=0x1b00017) returned 0xc300802
	[0093.516] DeleteObject (ho=0xc300802) returned 1
	[0093.516] GetROP2 (hdc=0x28010803) returned 13
	[0093.516] GetBkMode (hdc=0x28010803) returned 2
	[0093.516] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.516] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x143001e7
	[0093.516] SelectObject (hdc=0x28010803, h=0x143001e7) returned 0x1b00017
	[0093.516] MoveToEx (in: hdc=0x28010803, x=116, y=1, lppt=0x2664de0 | out: lppt=0x2664de0) returned 1
	[0093.516] LineTo (hdc=0x28010803, x=1, y=1) returned 1
	[0093.516] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.516] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.516] GetROP2 (hdc=0x28010803) returned 13
	[0093.516] GetBkMode (hdc=0x28010803) returned 2
	[0093.516] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.517] SelectObject (hdc=0x28010803, h=0x143001e7) returned 0x143001e7
	[0093.517] MoveToEx (in: hdc=0x28010803, x=1, y=1, lppt=0x2664df8 | out: lppt=0x2664df8) returned 1
	[0093.517] LineTo (hdc=0x28010803, x=1, y=35) returned 1
	[0093.517] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.517] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.517] SelectObject (hdc=0x28010803, h=0x1b00017) returned 0x143001e7
	[0093.517] DeleteObject (ho=0x143001e7) returned 1
	[0093.517] GetROP2 (hdc=0x28010803) returned 13
	[0093.517] GetBkMode (hdc=0x28010803) returned 2
	[0093.517] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.517] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xd300802
	[0093.517] SelectObject (hdc=0x28010803, h=0xd300802) returned 0x1b00017
	[0093.517] MoveToEx (in: hdc=0x28010803, x=1, y=35, lppt=0x2664e60 | out: lppt=0x2664e60) returned 1
	[0093.517] LineTo (hdc=0x28010803, x=116, y=35) returned 1
	[0093.517] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.517] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.517] GetROP2 (hdc=0x28010803) returned 13
	[0093.517] GetBkMode (hdc=0x28010803) returned 2
	[0093.517] SetBkMode (hdc=0x28010803, mode=1) returned 2
	[0093.517] SelectObject (hdc=0x28010803, h=0xd300802) returned 0xd300802
	[0093.517] MoveToEx (in: hdc=0x28010803, x=116, y=35, lppt=0x2664e78 | out: lppt=0x2664e78) returned 1
	[0093.517] LineTo (hdc=0x28010803, x=116, y=0) returned 1
	[0093.517] SetBkMode (hdc=0x28010803, mode=2) returned 1
	[0093.517] MoveToEx (in: hdc=0x28010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.517] SelectObject (hdc=0x28010803, h=0x1b00017) returned 0xd300802
	[0093.517] DeleteObject (ho=0xd300802) returned 1
	[0093.518] RestoreDC (hdc=0x28010803, nSavedDC=-1) returned 1
	[0093.518] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.518] GdipReleaseDC (graphics=0x1b927100, hdc=0x28010803) returned 0x0
	[0093.521] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.521] BitBlt (hdc=0x70107fc, x=0, y=0, cx=118, cy=37, hdcSrc=0x28010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.521] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.521] GdipReleaseDC (graphics=0x1b927100, hdc=0x28010803) returned 0x0
	[0093.521] SelectObject (hdc=0x28010803, h=0x185000f) returned 0x130507d2
	[0093.521] DeleteDC (hdc=0x28010803) returned 1
	[0093.521] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.521] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.521] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.521] EndPaint (hWnd=0x201e6, lpPaint=0x20d9e8) returned 1
	[0093.521] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.521] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e9033f) returned 0x1
	[0093.521] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0093.521] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.521] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.521] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.522] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0093.522] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0093.522] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.522] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e9033f) returned 0x1
	[0093.522] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0093.522] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.522] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e9033f) returned 0x1
	[0093.522] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0093.522] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.522] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.523] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0093.523] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0093.523] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0093.523] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0093.523] GetKeyState (nVirtKey=1) returned 1
	[0093.523] GetKeyState (nVirtKey=2) returned 0
	[0093.523] GetKeyState (nVirtKey=4) returned 0
	[0093.523] GetKeyState (nVirtKey=5) returned 0
	[0093.523] GetKeyState (nVirtKey=6) returned 0
	[0093.523] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.523] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0093.523] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.523] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.523] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.523] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0093.523] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.523] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0093.523] GetStockObject (i=5) returned 0x1900015
	[0093.523] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.523] CreateCompatibleDC (hdc=0x4010280) returned 0x2b010803
	[0093.523] DeleteObject (ho=0x130507d2) returned 1
	[0093.524] GetObjectType (h=0x4010280) returned 0x3
	[0093.524] CreateCompatibleBitmap (hdc=0x4010280, cx=1, cy=1) returned 0x280507a5
	[0093.524] GetDIBits (in: hdc=0x4010280, hbm=0x280507a5, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0093.524] GetDIBits (in: hdc=0x4010280, hbm=0x280507a5, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d0f8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d0f8) returned 1
	[0093.524] DeleteObject (ho=0x280507a5) returned 1
	[0093.524] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d2d0, usage=0x0, ppvBits=0x20d2c8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2c8) returned 0x140507d2
	[0093.524] SelectObject (hdc=0x2b010803, h=0x140507d2) returned 0x185000f
	[0093.524] GdipCreateFromHDC (hdc=0x2b010803, graphics=0x20d7e0) returned 0x0
	[0093.524] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.524] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0093.524] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.524] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.524] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0093.524] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.524] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.524] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.524] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.525] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.525] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.525] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.525] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.525] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.525] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd770dbd) returned 0x0
	[0093.525] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.525] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.525] GdipGetDC (graphics=0x1b927100, hdc=0x20cdf0) returned 0x0
	[0093.525] GetCurrentObject (hdc=0x2b010803, type=0x1) returned 0x1b00017
	[0093.525] GetCurrentObject (hdc=0x2b010803, type=0x2) returned 0x1900010
	[0093.525] GetCurrentObject (hdc=0x2b010803, type=0x7) returned 0x140507d2
	[0093.525] GetCurrentObject (hdc=0x2b010803, type=0x6) returned 0x18a002e
	[0093.525] SaveDC (hdc=0x2b010803) returned 1
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0xf0f0f0) returned 0xf0f0f0
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0xa0a0a0) returned 0xa0a0a0
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0x696969) returned 0x696969
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0xa0a0a0) returned 0xa0a0a0
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0x0) returned 0x0
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0xffffff) returned 0xffffff
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0xe5e5e5) returned 0xe5e5e5
	[0093.525] GetNearestColor (hdc=0x2b010803, color=0xd8d8d8) returned 0xd8d8d8
	[0093.526] GetNearestColor (hdc=0x2b010803, color=0x0) returned 0x0
	[0093.526] RestoreDC (hdc=0x2b010803, nSavedDC=-1) returned 1
	[0093.526] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.526] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010803) returned 0x0
	[0093.526] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.526] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.526] CoTaskMemFree (pv=0x1b067800) 
	[0093.526] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0093.526] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.526] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.526] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.526] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0093.526] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0093.526] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0093.526] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0093.526] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0093.526] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.526] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.527] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.527] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.527] CoTaskMemFree (pv=0x1b067800) 
	[0093.527] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0093.527] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0093.527] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0093.527] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0093.527] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.527] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.527] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.527] GdipMeasureString (graphics=0x1b94fc50, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0093.527] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.527] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.527] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.527] GdipDeleteGraphics (graphics=0x1b94fc50) returned 0x0
	[0093.527] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.527] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.527] CoTaskMemFree (pv=0x1b067800) 
	[0093.528] GdipCreateRegion (region=0x20d120) returned 0x0
	[0093.528] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.528] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0093.528] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.528] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0093.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.528] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.528] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.528] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.528] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.528] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.528] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.528] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d1d0) returned 0x0
	[0093.528] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d190) returned 0x0
	[0093.528] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d190) returned 0x0
	[0093.528] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.528] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.528] GdipGetDC (graphics=0x1b927100, hdc=0x20d200) returned 0x0
	[0093.528] GetCurrentObject (hdc=0x2b010803, type=0x1) returned 0x1b00017
	[0093.528] GetCurrentObject (hdc=0x2b010803, type=0x2) returned 0x1900010
	[0093.528] GetCurrentObject (hdc=0x2b010803, type=0x7) returned 0x140507d2
	[0093.528] GetCurrentObject (hdc=0x2b010803, type=0x6) returned 0x18a002e
	[0093.528] SaveDC (hdc=0x2b010803) returned 1
	[0093.529] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x360407f9
	[0093.529] GetClipRgn (hdc=0x2b010803, hrgn=0x360407f9) returned 0
	[0093.529] SelectClipRgn (hdc=0x2b010803, hrgn=0x31040710) returned 2
	[0093.529] DeleteObject (ho=0x360407f9) returned 1
	[0093.529] DeleteObject (ho=0x31040710) returned 1
	[0093.529] OffsetViewportOrgEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x2666c10 | out: lppt=0x2666c10) returned 1
	[0093.529] GetNearestColor (hdc=0x2b010803, color=0xf0f0f0) returned 0xf0f0f0
	[0093.529] CreateSolidBrush (color=0xf0f0f0) returned 0x191007c0
	[0093.529] FillRect (hDC=0x2b010803, lprc=0x20d1d0, hbr=0x191007c0) returned 1
	[0093.529] DeleteObject (ho=0x191007c0) returned 1
	[0093.529] RestoreDC (hdc=0x2b010803, nSavedDC=-1) returned 1
	[0093.529] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.529] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010803) returned 0x0
	[0093.530] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.530] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.530] CoTaskMemFree (pv=0x1b067800) 
	[0093.530] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0093.530] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.530] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.530] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.530] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0093.530] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.530] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.530] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.530] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.530] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.530] GetFocus () returned 0x201d8
	[0093.531] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0093.531] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.531] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.531] CoTaskMemFree (pv=0x1b067800) 
	[0093.531] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0093.531] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0093.531] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.531] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0093.531] GdipCreateRegion (region=0x20d070) returned 0x0
	[0093.531] GdipGetClip (graphics=0x1b927100, region=0x1b9500e0) returned 0x0
	[0093.531] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0093.531] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.531] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0093.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.531] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.531] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.531] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.531] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.532] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.532] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.532] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.532] GdipIsInfiniteRegion (region=0x1b9500e0, graphics=0x1b927100, result=0x20d120) returned 0x0
	[0093.532] GdipIsInfiniteRegion (region=0x1b9500e0, graphics=0x1b927100, result=0x20d0e0) returned 0x0
	[0093.532] GdipGetRegionHRgn (region=0x1b9500e0, graphics=0x1b927100, hRgn=0x20d0e0) returned 0x0
	[0093.532] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.532] GdipDeleteRegion (region=0x1b9500e0) returned 0x0
	[0093.532] GdipGetDC (graphics=0x1b927100, hdc=0x20d150) returned 0x0
	[0093.532] GetCurrentObject (hdc=0x2b010803, type=0x1) returned 0x1b00017
	[0093.532] GetCurrentObject (hdc=0x2b010803, type=0x2) returned 0x1900010
	[0093.532] GetCurrentObject (hdc=0x2b010803, type=0x7) returned 0x140507d2
	[0093.532] GetCurrentObject (hdc=0x2b010803, type=0x6) returned 0x18a002e
	[0093.532] SaveDC (hdc=0x2b010803) returned 1
	[0093.532] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x32040710
	[0093.532] GetClipRgn (hdc=0x2b010803, hrgn=0x32040710) returned 0
	[0093.532] SelectClipRgn (hdc=0x2b010803, hrgn=0x370407f9) returned 2
	[0093.532] DeleteObject (ho=0x32040710) returned 1
	[0093.532] DeleteObject (ho=0x370407f9) returned 1
	[0093.532] OffsetViewportOrgEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x26671b0 | out: lppt=0x26671b0) returned 1
	[0093.532] GetROP2 (hdc=0x2b010803) returned 13
	[0093.532] GetBkMode (hdc=0x2b010803) returned 2
	[0093.532] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.532] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xe300802
	[0093.533] SelectObject (hdc=0x2b010803, h=0xe300802) returned 0x1b00017
	[0093.533] MoveToEx (in: hdc=0x2b010803, x=164, y=1, lppt=0x2667218 | out: lppt=0x2667218) returned 1
	[0093.533] LineTo (hdc=0x2b010803, x=1, y=1) returned 1
	[0093.533] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.533] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.533] GetROP2 (hdc=0x2b010803) returned 13
	[0093.533] GetBkMode (hdc=0x2b010803) returned 2
	[0093.533] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.533] SelectObject (hdc=0x2b010803, h=0xe300802) returned 0xe300802
	[0093.533] MoveToEx (in: hdc=0x2b010803, x=1, y=1, lppt=0x2667230 | out: lppt=0x2667230) returned 1
	[0093.533] LineTo (hdc=0x2b010803, x=1, y=41) returned 1
	[0093.533] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.533] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.533] SelectObject (hdc=0x2b010803, h=0x1b00017) returned 0xe300802
	[0093.533] DeleteObject (ho=0xe300802) returned 1
	[0093.533] GetROP2 (hdc=0x2b010803) returned 13
	[0093.533] GetBkMode (hdc=0x2b010803) returned 2
	[0093.533] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.533] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x153001e7
	[0093.533] SelectObject (hdc=0x2b010803, h=0x153001e7) returned 0x1b00017
	[0093.534] MoveToEx (in: hdc=0x2b010803, x=1, y=41, lppt=0x2667298 | out: lppt=0x2667298) returned 1
	[0093.534] LineTo (hdc=0x2b010803, x=164, y=41) returned 1
	[0093.534] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.534] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.534] GetROP2 (hdc=0x2b010803) returned 13
	[0093.534] GetBkMode (hdc=0x2b010803) returned 2
	[0093.534] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.534] SelectObject (hdc=0x2b010803, h=0x153001e7) returned 0x153001e7
	[0093.534] MoveToEx (in: hdc=0x2b010803, x=164, y=41, lppt=0x26672b0 | out: lppt=0x26672b0) returned 1
	[0093.534] LineTo (hdc=0x2b010803, x=164, y=0) returned 1
	[0093.534] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.534] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.534] SelectObject (hdc=0x2b010803, h=0x1b00017) returned 0x153001e7
	[0093.534] DeleteObject (ho=0x153001e7) returned 1
	[0093.534] GetROP2 (hdc=0x2b010803) returned 13
	[0093.534] GetBkMode (hdc=0x2b010803) returned 2
	[0093.534] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.534] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xf300802
	[0093.534] SelectObject (hdc=0x2b010803, h=0xf300802) returned 0x1b00017
	[0093.534] MoveToEx (in: hdc=0x2b010803, x=163, y=2, lppt=0x2667318 | out: lppt=0x2667318) returned 1
	[0093.534] LineTo (hdc=0x2b010803, x=2, y=2) returned 1
	[0093.534] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.534] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.534] GetROP2 (hdc=0x2b010803) returned 13
	[0093.534] GetBkMode (hdc=0x2b010803) returned 2
	[0093.534] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.535] SelectObject (hdc=0x2b010803, h=0xf300802) returned 0xf300802
	[0093.535] MoveToEx (in: hdc=0x2b010803, x=2, y=2, lppt=0x2667330 | out: lppt=0x2667330) returned 1
	[0093.535] LineTo (hdc=0x2b010803, x=2, y=40) returned 1
	[0093.535] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.535] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.535] SelectObject (hdc=0x2b010803, h=0x1b00017) returned 0xf300802
	[0093.535] DeleteObject (ho=0xf300802) returned 1
	[0093.535] GetROP2 (hdc=0x2b010803) returned 13
	[0093.535] GetBkMode (hdc=0x2b010803) returned 2
	[0093.535] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.535] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x163001e7
	[0093.535] SelectObject (hdc=0x2b010803, h=0x163001e7) returned 0x1b00017
	[0093.535] MoveToEx (in: hdc=0x2b010803, x=2, y=40, lppt=0x2667398 | out: lppt=0x2667398) returned 1
	[0093.535] LineTo (hdc=0x2b010803, x=163, y=40) returned 1
	[0093.535] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.535] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.535] GetROP2 (hdc=0x2b010803) returned 13
	[0093.535] GetBkMode (hdc=0x2b010803) returned 2
	[0093.535] SetBkMode (hdc=0x2b010803, mode=1) returned 2
	[0093.535] SelectObject (hdc=0x2b010803, h=0x163001e7) returned 0x163001e7
	[0093.535] MoveToEx (in: hdc=0x2b010803, x=163, y=40, lppt=0x26673b0 | out: lppt=0x26673b0) returned 1
	[0093.535] LineTo (hdc=0x2b010803, x=163, y=1) returned 1
	[0093.535] SetBkMode (hdc=0x2b010803, mode=2) returned 1
	[0093.535] MoveToEx (in: hdc=0x2b010803, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.535] SelectObject (hdc=0x2b010803, h=0x1b00017) returned 0x163001e7
	[0093.535] DeleteObject (ho=0x163001e7) returned 1
	[0093.535] RestoreDC (hdc=0x2b010803, nSavedDC=-1) returned 1
	[0093.536] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.536] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010803) returned 0x0
	[0093.536] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.536] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x2b010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.536] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.536] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010803) returned 0x0
	[0093.536] SelectObject (hdc=0x2b010803, h=0x185000f) returned 0x140507d2
	[0093.536] DeleteDC (hdc=0x2b010803) returned 1
	[0093.536] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.536] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.536] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.536] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0093.536] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.536] IsWindowUnicode (hWnd=0x201da) returned 1
	[0093.536] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.536] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.536] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0093.536] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1
	[0093.536] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.537] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201da, Msg=0x14, wParam=0x10107f8, lParam=0x0) returned 0x1
	[0093.537] SetTextColor (hdc=0x10107f8, color=0x0) returned 0x0
	[0093.537] SetBkColor (hdc=0x10107f8, color=0xffffff) returned 0xffffff
	[0093.537] GetSysColorBrush (nIndex=5) returned 0x1100060
	[0093.537] SetTextColor (hdc=0x10107f8, color=0x0) returned 0x0
	[0093.537] SetBkColor (hdc=0x10107f8, color=0xffffff) returned 0xffffff
	[0093.692] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.692] IsWindowUnicode (hWnd=0x201d4) returned 1
	[0093.692] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.692] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.692] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.692] BeginPaint (in: hWnd=0x201d4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0093.692] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.692] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.692] CreateCompatibleDC (hdc=0x70107fc) returned 0x31010803
	[0093.692] SelectObject (hdc=0x31010803, h=0x140507d2) returned 0x185000f
	[0093.692] GdipCreateFromHDC (hdc=0x31010803, graphics=0x20d7e0) returned 0x0
	[0093.692] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.692] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=89, height=29, combineMode=0x0) returned 0x0
	[0093.693] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.693] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.693] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0093.693] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.693] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.693] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.693] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.693] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.693] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.693] GdipGetClip (graphics=0x1b927100, region=0x1b9500e0) returned 0x0
	[0093.693] GdipIsInfiniteRegion (region=0x1b9500e0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.693] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.693] GetWindowTextLengthW (hWnd=0x201d4) returned 7
	[0093.693] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
	[0093.693] GetSystemMetrics (nIndex=42) returned 0
	[0093.693] CoTaskMemAlloc (cb=0x14) returned 0x1b067800
	[0093.693] GetWindowTextW (in: hWnd=0x201d4, lpString=0x1b067800, nMaxCount=8 | out: lpString="my ID =") returned 7
	[0093.693] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0xd, wParam=0x8, lParam=0x1b067800) returned 0x7
	[0093.693] CoTaskMemFree (pv=0x1b067800) 
	[0093.693] GetClientRect (in: hWnd=0x201d4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0093.693] GdipCreateRegion (region=0x20d400) returned 0x0
	[0093.693] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.693] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0093.693] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.693] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0093.693] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.694] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.694] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.694] GdipCombineRegionRegion (region=0x1b94fc50, region2=0x1b9500e0, combineMode=0x1) returned 0x0
	[0093.694] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.694] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.694] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.694] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.694] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.694] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d4b0) returned 0x0
	[0093.694] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d470) returned 0x0
	[0093.694] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d470) returned 0x0
	[0093.694] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.694] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.694] GdipGetDC (graphics=0x1b927100, hdc=0x20d4e0) returned 0x0
	[0093.694] GetCurrentObject (hdc=0x31010803, type=0x1) returned 0x1b00017
	[0093.694] GetCurrentObject (hdc=0x31010803, type=0x2) returned 0x1900010
	[0093.694] GetCurrentObject (hdc=0x31010803, type=0x7) returned 0x140507d2
	[0093.694] GetCurrentObject (hdc=0x31010803, type=0x6) returned 0x18a002e
	[0093.694] SaveDC (hdc=0x31010803) returned 1
	[0093.694] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x380407f9
	[0093.694] GetClipRgn (hdc=0x31010803, hrgn=0x380407f9) returned 0
	[0093.694] SelectClipRgn (hdc=0x31010803, hrgn=0x33040710) returned 2
	[0093.694] DeleteObject (ho=0x380407f9) returned 1
	[0093.694] DeleteObject (ho=0x33040710) returned 1
	[0093.695] OffsetViewportOrgEx (in: hdc=0x31010803, x=0, y=0, lppt=0x2667b18 | out: lppt=0x2667b18) returned 1
	[0093.695] GetNearestColor (hdc=0x31010803, color=0x0) returned 0x0
	[0093.695] CreateSolidBrush (color=0x0) returned 0x1a1007c0
	[0093.695] FillRect (hDC=0x31010803, lprc=0x20d4b0, hbr=0x1a1007c0) returned 1
	[0093.695] DeleteObject (ho=0x1a1007c0) returned 1
	[0093.695] RestoreDC (hdc=0x31010803, nSavedDC=-1) returned 1
	[0093.695] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.695] GdipReleaseDC (graphics=0x1b927100, hdc=0x31010803) returned 0x0
	[0093.695] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd740dbd) returned 0x0
	[0093.695] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.695] GdipDeleteRegion (region=0x1b9500e0) returned 0x0
	[0093.695] GetWindowTextLengthW (hWnd=0x201d4) returned 7
	[0093.695] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
	[0093.695] GetSystemMetrics (nIndex=42) returned 0
	[0093.695] CoTaskMemAlloc (cb=0x14) returned 0x1b067800
	[0093.695] GetWindowTextW (in: hWnd=0x201d4, lpString=0x1b067800, nMaxCount=8 | out: lpString="my ID =") returned 7
	[0093.695] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d4, Msg=0xd, wParam=0x8, lParam=0x1b067800) returned 0x7
	[0093.695] CoTaskMemFree (pv=0x1b067800) 
	[0093.695] GdipGetDC (graphics=0x1b927100, hdc=0x20d530) returned 0x0
	[0093.695] GetCurrentObject (hdc=0x31010803, type=0x1) returned 0x1b00017
	[0093.695] GetCurrentObject (hdc=0x31010803, type=0x2) returned 0x1900010
	[0093.695] GetCurrentObject (hdc=0x31010803, type=0x7) returned 0x140507d2
	[0093.695] GetCurrentObject (hdc=0x31010803, type=0x6) returned 0x18a002e
	[0093.695] SaveDC (hdc=0x31010803) returned 1
	[0093.695] GetNearestColor (hdc=0x31010803, color=0x80) returned 0x80
	[0093.696] RestoreDC (hdc=0x31010803, nSavedDC=-1) returned 1
	[0093.696] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.696] GdipReleaseDC (graphics=0x1b927100, hdc=0x31010803) returned 0x0
	[0093.696] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0093.696] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.696] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.696] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.696] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0093.696] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.696] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0093.696] GdipDrawString (graphics=0x1b927100, string="my ID =", length=7, font=0x1b49f190, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.696] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.696] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.696] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.696] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.696] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.696] BitBlt (hdc=0x70107fc, x=0, y=0, cx=89, cy=29, hdcSrc=0x31010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.696] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.696] GdipReleaseDC (graphics=0x1b927100, hdc=0x31010803) returned 0x0
	[0093.696] SelectObject (hdc=0x31010803, h=0x185000f) returned 0x140507d2
	[0093.696] DeleteDC (hdc=0x31010803) returned 1
	[0093.697] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.697] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.697] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.697] EndPaint (hWnd=0x201d4, lpPaint=0x20d9e8) returned 1
	[0093.697] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.697] IsWindowUnicode (hWnd=0x201d6) returned 1
	[0093.697] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.697] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.697] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0093.697] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1
	[0093.697] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.697] CallWindowProcW (lpPrevWndFunc=0x776f820c, hWnd=0x201d6, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0093.697] SetTextColor (hdc=0x4010280, color=0x0) returned 0x0
	[0093.697] SetBkColor (hdc=0x4010280, color=0xffffff) returned 0xffffff
	[0093.697] GetSysColorBrush (nIndex=5) returned 0x1100060
	[0093.697] SetTextColor (hdc=0x4010280, color=0x0) returned 0x0
	[0093.697] SetBkColor (hdc=0x4010280, color=0xffffff) returned 0xffffff
	[0093.700] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.700] IsWindowUnicode (hWnd=0x201d0) returned 1
	[0093.700] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.700] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.700] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.700] BeginPaint (in: hWnd=0x201d0, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0093.700] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.701] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.701] CreateCompatibleDC (hdc=0x10107f8) returned 0x37010803
	[0093.701] SelectObject (hdc=0x37010803, h=0x140507d2) returned 0x185000f
	[0093.701] GdipCreateFromHDC (hdc=0x37010803, graphics=0x20d7e0) returned 0x0
	[0093.701] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.701] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=118, height=29, combineMode=0x0) returned 0x0
	[0093.701] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.701] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.701] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0093.701] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.701] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.701] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.701] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.701] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.701] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.701] GdipGetClip (graphics=0x1b927100, region=0x1b9500e0) returned 0x0
	[0093.701] GdipIsInfiniteRegion (region=0x1b9500e0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.701] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.701] GetWindowTextLengthW (hWnd=0x201d0) returned 9
	[0093.701] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
	[0093.701] GetSystemMetrics (nIndex=42) returned 0
	[0093.701] CoTaskMemAlloc (cb=0x18) returned 0x1b067800
	[0093.701] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1b067800, nMaxCount=10 | out: lpString="My name =") returned 9
	[0093.701] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0xd, wParam=0xa, lParam=0x1b067800) returned 0x9
	[0093.702] CoTaskMemFree (pv=0x1b067800) 
	[0093.702] GetClientRect (in: hWnd=0x201d0, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0093.702] GdipCreateRegion (region=0x20d400) returned 0x0
	[0093.702] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.702] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0093.702] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.702] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0093.702] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.702] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.702] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.702] GdipCombineRegionRegion (region=0x1b94fc50, region2=0x1b9500e0, combineMode=0x1) returned 0x0
	[0093.702] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.702] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.702] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.702] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.702] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.702] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d4b0) returned 0x0
	[0093.702] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d470) returned 0x0
	[0093.702] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d470) returned 0x0
	[0093.702] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.702] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.702] GdipGetDC (graphics=0x1b927100, hdc=0x20d4e0) returned 0x0
	[0093.702] GetCurrentObject (hdc=0x37010803, type=0x1) returned 0x1b00017
	[0093.702] GetCurrentObject (hdc=0x37010803, type=0x2) returned 0x1900010
	[0093.702] GetCurrentObject (hdc=0x37010803, type=0x7) returned 0x140507d2
	[0093.702] GetCurrentObject (hdc=0x37010803, type=0x6) returned 0x18a002e
	[0093.703] SaveDC (hdc=0x37010803) returned 1
	[0093.703] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x34040710
	[0093.703] GetClipRgn (hdc=0x37010803, hrgn=0x34040710) returned 0
	[0093.703] SelectClipRgn (hdc=0x37010803, hrgn=0x390407f9) returned 2
	[0093.703] DeleteObject (ho=0x34040710) returned 1
	[0093.703] DeleteObject (ho=0x390407f9) returned 1
	[0093.703] OffsetViewportOrgEx (in: hdc=0x37010803, x=0, y=0, lppt=0x2668638 | out: lppt=0x2668638) returned 1
	[0093.703] GetNearestColor (hdc=0x37010803, color=0x0) returned 0x0
	[0093.703] CreateSolidBrush (color=0x0) returned 0x1b1007c0
	[0093.703] FillRect (hDC=0x37010803, lprc=0x20d4b0, hbr=0x1b1007c0) returned 1
	[0093.703] DeleteObject (ho=0x1b1007c0) returned 1
	[0093.703] RestoreDC (hdc=0x37010803, nSavedDC=-1) returned 1
	[0093.703] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.703] GdipReleaseDC (graphics=0x1b927100, hdc=0x37010803) returned 0x0
	[0093.703] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd720dbd) returned 0x0
	[0093.703] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.703] GdipDeleteRegion (region=0x1b9500e0) returned 0x0
	[0093.703] GetWindowTextLengthW (hWnd=0x201d0) returned 9
	[0093.703] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
	[0093.703] GetSystemMetrics (nIndex=42) returned 0
	[0093.703] CoTaskMemAlloc (cb=0x18) returned 0x1b067800
	[0093.703] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1b067800, nMaxCount=10 | out: lpString="My name =") returned 9
	[0093.703] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d0, Msg=0xd, wParam=0xa, lParam=0x1b067800) returned 0x9
	[0093.703] CoTaskMemFree (pv=0x1b067800) 
	[0093.703] GdipGetDC (graphics=0x1b927100, hdc=0x20d530) returned 0x0
	[0093.704] GetCurrentObject (hdc=0x37010803, type=0x1) returned 0x1b00017
	[0093.704] GetCurrentObject (hdc=0x37010803, type=0x2) returned 0x1900010
	[0093.704] GetCurrentObject (hdc=0x37010803, type=0x7) returned 0x140507d2
	[0093.704] GetCurrentObject (hdc=0x37010803, type=0x6) returned 0x18a002e
	[0093.704] SaveDC (hdc=0x37010803) returned 1
	[0093.704] GetNearestColor (hdc=0x37010803, color=0x80) returned 0x80
	[0093.704] RestoreDC (hdc=0x37010803, nSavedDC=-1) returned 1
	[0093.704] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.704] GdipReleaseDC (graphics=0x1b927100, hdc=0x37010803) returned 0x0
	[0093.704] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0093.704] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.704] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.704] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.704] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0093.704] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.704] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0093.704] GdipDrawString (graphics=0x1b927100, string="My name =", length=9, font=0x1b49f010, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.704] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.704] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.704] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.704] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.705] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.705] BitBlt (hdc=0x10107f8, x=0, y=0, cx=118, cy=29, hdcSrc=0x37010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.705] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.705] GdipReleaseDC (graphics=0x1b927100, hdc=0x37010803) returned 0x0
	[0093.705] SelectObject (hdc=0x37010803, h=0x185000f) returned 0x140507d2
	[0093.705] DeleteDC (hdc=0x37010803) returned 1
	[0093.705] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.705] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.705] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.705] EndPaint (hWnd=0x201d0, lpPaint=0x20d9e8) returned 1
	[0093.705] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.705] IsWindowUnicode (hWnd=0x201d2) returned 1
	[0093.705] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.705] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.705] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.705] BeginPaint (in: hWnd=0x201d2, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0093.705] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.705] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.705] CreateCompatibleDC (hdc=0x70107fc) returned 0x3a010803
	[0093.706] SelectObject (hdc=0x3a010803, h=0x140507d2) returned 0x185000f
	[0093.706] GdipCreateFromHDC (hdc=0x3a010803, graphics=0x20d7e0) returned 0x0
	[0093.706] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.706] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=197, height=29, combineMode=0x0) returned 0x0
	[0093.706] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.706] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.706] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0093.706] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.706] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.706] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.706] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.706] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.706] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.706] GdipGetClip (graphics=0x1b927100, region=0x1b9500e0) returned 0x0
	[0093.706] GdipIsInfiniteRegion (region=0x1b9500e0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.706] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.706] GetWindowTextLengthW (hWnd=0x201d2) returned 18
	[0093.706] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12
	[0093.706] GetSystemMetrics (nIndex=42) returned 0
	[0093.706] CoTaskMemAlloc (cb=0x2a) returned 0x1b07bcc0
	[0093.706] GetWindowTextW (in: hWnd=0x201d2, lpString=0x1b07bcc0, nMaxCount=19 | out: lpString="Search in Facebook") returned 18
	[0093.706] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0xd, wParam=0x13, lParam=0x1b07bcc0) returned 0x12
	[0093.706] CoTaskMemFree (pv=0x1b07bcc0) 
	[0093.706] GetClientRect (in: hWnd=0x201d2, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0093.706] GdipCreateRegion (region=0x20d400) returned 0x0
	[0093.707] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.707] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0093.707] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.707] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0093.707] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.707] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.707] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.707] GdipCombineRegionRegion (region=0x1b94fc50, region2=0x1b9500e0, combineMode=0x1) returned 0x0
	[0093.707] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.707] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.707] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.707] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.707] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.707] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d4b0) returned 0x0
	[0093.707] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d470) returned 0x0
	[0093.707] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d470) returned 0x0
	[0093.707] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.707] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.707] GdipGetDC (graphics=0x1b927100, hdc=0x20d4e0) returned 0x0
	[0093.707] GetCurrentObject (hdc=0x3a010803, type=0x1) returned 0x1b00017
	[0093.707] GetCurrentObject (hdc=0x3a010803, type=0x2) returned 0x1900010
	[0093.707] GetCurrentObject (hdc=0x3a010803, type=0x7) returned 0x140507d2
	[0093.707] GetCurrentObject (hdc=0x3a010803, type=0x6) returned 0x18a002e
	[0093.707] SaveDC (hdc=0x3a010803) returned 1
	[0093.707] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a0407f9
	[0093.707] GetClipRgn (hdc=0x3a010803, hrgn=0x3a0407f9) returned 0
	[0093.708] SelectClipRgn (hdc=0x3a010803, hrgn=0x35040710) returned 2
	[0093.708] DeleteObject (ho=0x3a0407f9) returned 1
	[0093.708] DeleteObject (ho=0x35040710) returned 1
	[0093.708] OffsetViewportOrgEx (in: hdc=0x3a010803, x=0, y=0, lppt=0x2669178 | out: lppt=0x2669178) returned 1
	[0093.708] GetNearestColor (hdc=0x3a010803, color=0x0) returned 0x0
	[0093.708] CreateSolidBrush (color=0x0) returned 0x1c1007c0
	[0093.708] FillRect (hDC=0x3a010803, lprc=0x20d4b0, hbr=0x1c1007c0) returned 1
	[0093.708] DeleteObject (ho=0x1c1007c0) returned 1
	[0093.708] RestoreDC (hdc=0x3a010803, nSavedDC=-1) returned 1
	[0093.708] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.708] GdipReleaseDC (graphics=0x1b927100, hdc=0x3a010803) returned 0x0
	[0093.708] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd700dbd) returned 0x0
	[0093.708] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.708] GdipDeleteRegion (region=0x1b9500e0) returned 0x0
	[0093.708] GetWindowTextLengthW (hWnd=0x201d2) returned 18
	[0093.708] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12
	[0093.708] GetSystemMetrics (nIndex=42) returned 0
	[0093.708] CoTaskMemAlloc (cb=0x2a) returned 0x1b07bcc0
	[0093.708] GetWindowTextW (in: hWnd=0x201d2, lpString=0x1b07bcc0, nMaxCount=19 | out: lpString="Search in Facebook") returned 18
	[0093.708] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201d2, Msg=0xd, wParam=0x13, lParam=0x1b07bcc0) returned 0x12
	[0093.708] CoTaskMemFree (pv=0x1b07bcc0) 
	[0093.708] GdipGetDC (graphics=0x1b927100, hdc=0x20d530) returned 0x0
	[0093.708] GetCurrentObject (hdc=0x3a010803, type=0x1) returned 0x1b00017
	[0093.708] GetCurrentObject (hdc=0x3a010803, type=0x2) returned 0x1900010
	[0093.708] GetCurrentObject (hdc=0x3a010803, type=0x7) returned 0x140507d2
	[0093.709] GetCurrentObject (hdc=0x3a010803, type=0x6) returned 0x18a002e
	[0093.709] SaveDC (hdc=0x3a010803) returned 1
	[0093.709] GetNearestColor (hdc=0x3a010803, color=0x80) returned 0x80
	[0093.709] RestoreDC (hdc=0x3a010803, nSavedDC=-1) returned 1
	[0093.709] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.709] GdipReleaseDC (graphics=0x1b927100, hdc=0x3a010803) returned 0x0
	[0093.709] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0093.709] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.709] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.709] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.709] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0093.709] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.709] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0093.709] GdipDrawString (graphics=0x1b927100, string="Search in Facebook", length=18, font=0x1b49f050, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.709] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.709] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.709] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.710] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.710] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.710] BitBlt (hdc=0x70107fc, x=0, y=0, cx=197, cy=29, hdcSrc=0x3a010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.710] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.710] GdipReleaseDC (graphics=0x1b927100, hdc=0x3a010803) returned 0x0
	[0093.710] SelectObject (hdc=0x3a010803, h=0x185000f) returned 0x140507d2
	[0093.710] DeleteDC (hdc=0x3a010803) returned 1
	[0093.710] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.710] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.710] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.710] EndPaint (hWnd=0x201d2, lpPaint=0x20d9e8) returned 1
	[0093.710] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.710] IsWindowUnicode (hWnd=0x201cc) returned 1
	[0093.710] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.710] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.710] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.710] BeginPaint (in: hWnd=0x201cc, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0093.710] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.711] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.711] CreateCompatibleDC (hdc=0x4010280) returned 0x3d010803
	[0093.711] SelectObject (hdc=0x3d010803, h=0x140507d2) returned 0x185000f
	[0093.711] GdipCreateFromHDC (hdc=0x3d010803, graphics=0x20d7e0) returned 0x0
	[0093.711] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.711] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=297, height=39, combineMode=0x0) returned 0x0
	[0093.711] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.711] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.711] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0093.711] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.711] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.711] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.711] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.711] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.711] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.711] GdipGetClip (graphics=0x1b927100, region=0x1b9500e0) returned 0x0
	[0093.711] GdipIsInfiniteRegion (region=0x1b9500e0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.711] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.711] GetWindowTextLengthW (hWnd=0x201cc) returned 16
	[0093.711] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0093.712] GetSystemMetrics (nIndex=42) returned 0
	[0093.712] CoTaskMemAlloc (cb=0x26) returned 0x1b07e5f0
	[0093.712] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b07e5f0, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0093.712] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0xd, wParam=0x11, lParam=0x1b07e5f0) returned 0x10
	[0093.712] CoTaskMemFree (pv=0x1b07e5f0) 
	[0093.712] GetClientRect (in: hWnd=0x201cc, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0093.712] GdipCreateRegion (region=0x20d400) returned 0x0
	[0093.712] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.712] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0093.712] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.712] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0093.712] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.712] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.712] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.712] GdipCombineRegionRegion (region=0x1b94fc50, region2=0x1b9500e0, combineMode=0x1) returned 0x0
	[0093.712] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.712] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.712] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.712] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.712] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.712] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d4b0) returned 0x0
	[0093.712] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d470) returned 0x0
	[0093.712] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d470) returned 0x0
	[0093.712] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.712] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.712] GdipGetDC (graphics=0x1b927100, hdc=0x20d4e0) returned 0x0
	[0093.712] GetCurrentObject (hdc=0x3d010803, type=0x1) returned 0x1b00017
	[0093.713] GetCurrentObject (hdc=0x3d010803, type=0x2) returned 0x1900010
	[0093.713] GetCurrentObject (hdc=0x3d010803, type=0x7) returned 0x140507d2
	[0093.713] GetCurrentObject (hdc=0x3d010803, type=0x6) returned 0x18a002e
	[0093.713] SaveDC (hdc=0x3d010803) returned 1
	[0093.713] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x36040710
	[0093.713] GetClipRgn (hdc=0x3d010803, hrgn=0x36040710) returned 0
	[0093.713] SelectClipRgn (hdc=0x3d010803, hrgn=0x3b0407f9) returned 2
	[0093.713] DeleteObject (ho=0x36040710) returned 1
	[0093.713] DeleteObject (ho=0x3b0407f9) returned 1
	[0093.713] OffsetViewportOrgEx (in: hdc=0x3d010803, x=0, y=0, lppt=0x2669cc8 | out: lppt=0x2669cc8) returned 1
	[0093.713] GetNearestColor (hdc=0x3d010803, color=0x0) returned 0x0
	[0093.713] CreateSolidBrush (color=0x0) returned 0x1d1007c0
	[0093.713] FillRect (hDC=0x3d010803, lprc=0x20d4b0, hbr=0x1d1007c0) returned 1
	[0093.713] DeleteObject (ho=0x1d1007c0) returned 1
	[0093.713] RestoreDC (hdc=0x3d010803, nSavedDC=-1) returned 1
	[0093.713] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.713] GdipReleaseDC (graphics=0x1b927100, hdc=0x3d010803) returned 0x0
	[0093.713] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd6e0dbd) returned 0x0
	[0093.713] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.713] GdipDeleteRegion (region=0x1b9500e0) returned 0x0
	[0093.713] GetWindowTextLengthW (hWnd=0x201cc) returned 16
	[0093.713] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0093.713] GetSystemMetrics (nIndex=42) returned 0
	[0093.713] CoTaskMemAlloc (cb=0x26) returned 0x1b07e5f0
	[0093.713] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b07e5f0, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0093.713] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x201cc, Msg=0xd, wParam=0x11, lParam=0x1b07e5f0) returned 0x10
	[0093.714] CoTaskMemFree (pv=0x1b07e5f0) 
	[0093.714] GdipGetDC (graphics=0x1b927100, hdc=0x20d530) returned 0x0
	[0093.714] GetCurrentObject (hdc=0x3d010803, type=0x1) returned 0x1b00017
	[0093.714] GetCurrentObject (hdc=0x3d010803, type=0x2) returned 0x1900010
	[0093.714] GetCurrentObject (hdc=0x3d010803, type=0x7) returned 0x140507d2
	[0093.714] GetCurrentObject (hdc=0x3d010803, type=0x6) returned 0x18a002e
	[0093.714] SaveDC (hdc=0x3d010803) returned 1
	[0093.714] GetNearestColor (hdc=0x3d010803, color=0x80) returned 0x80
	[0093.714] RestoreDC (hdc=0x3d010803, nSavedDC=-1) returned 1
	[0093.714] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.714] GdipReleaseDC (graphics=0x1b927100, hdc=0x3d010803) returned 0x0
	[0093.714] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0093.714] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.714] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0093.714] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.714] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0093.714] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0093.714] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0093.714] GdipDrawString (graphics=0x1b927100, string="Boom Ransomeware", length=16, font=0x1b49f090, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.716] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.716] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.716] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.716] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.716] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.716] BitBlt (hdc=0x4010280, x=0, y=0, cx=297, cy=39, hdcSrc=0x3d010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.716] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.716] GdipReleaseDC (graphics=0x1b927100, hdc=0x3d010803) returned 0x0
	[0093.716] SelectObject (hdc=0x3d010803, h=0x185000f) returned 0x140507d2
	[0093.716] DeleteDC (hdc=0x3d010803) returned 1
	[0093.716] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.716] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.716] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.716] EndPaint (hWnd=0x201cc, lpPaint=0x20d9e8) returned 1
	[0093.716] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.716] IsWindowUnicode (hWnd=0x201ce) returned 1
	[0093.716] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.716] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.716] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.716] BeginPaint (in: hWnd=0x201ce, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x10107f8
	[0093.716] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0093.717] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.717] CreateCompatibleDC (hdc=0x10107f8) returned 0x40010803
	[0093.717] GetObjectType (h=0x10107f8) returned 0x3
	[0093.717] CreateCompatibleBitmap (hdc=0x10107f8, cx=1, cy=1) returned 0x2a050804
	[0093.717] GetDIBits (in: hdc=0x10107f8, hbm=0x2a050804, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0093.717] GetDIBits (in: hdc=0x10107f8, hbm=0x2a050804, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0093.717] DeleteObject (ho=0x2a050804) returned 1
	[0093.717] CreateDIBSection (in: hdc=0x10107f8, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0x170501e7
	[0093.717] SelectObject (hdc=0x40010803, h=0x170501e7) returned 0x185000f
	[0093.717] GdipCreateFromHDC (hdc=0x40010803, graphics=0x20d800) returned 0x0
	[0093.717] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.717] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=445, height=356, combineMode=0x0) returned 0x0
	[0093.717] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0093.717] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.717] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0093.717] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.717] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.718] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.718] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.718] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.718] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0093.718] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.718] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d9f0) returned 0x0
	[0093.718] GdipSaveGraphics (graphics=0x1b927100, state=0x20dac0) returned 0x0
	[0093.718] GetWindowTextLengthW (hWnd=0x201ce) returned 0
	[0093.718] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0093.718] GetSystemMetrics (nIndex=42) returned 0
	[0093.718] CoTaskMemAlloc (cb=0x6) returned 0x334a70
	[0093.718] GetWindowTextW (in: hWnd=0x201ce, lpString=0x334a70, nMaxCount=1 | out: lpString="") returned 0
	[0093.718] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0xd, wParam=0x1, lParam=0x334a70) returned 0x0
	[0093.718] CoTaskMemFree (pv=0x334a70) 
	[0093.718] GetClientRect (in: hWnd=0x201ce, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0093.718] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0093.718] GdipGetClip (graphics=0x1b927100, region=0x1b94fd10) returned 0x0
	[0093.718] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0093.718] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.718] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0093.718] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.718] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.718] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.718] GdipCombineRegionRegion (region=0x1b94fd10, region2=0x1b94fc50, combineMode=0x1) returned 0x0
	[0093.718] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.718] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.718] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.719] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.719] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.719] GdipIsInfiniteRegion (region=0x1b94fd10, graphics=0x1b927100, result=0x20d560) returned 0x0
	[0093.719] GdipIsInfiniteRegion (region=0x1b94fd10, graphics=0x1b927100, result=0x20d520) returned 0x0
	[0093.719] GdipGetRegionHRgn (region=0x1b94fd10, graphics=0x1b927100, hRgn=0x20d520) returned 0x0
	[0093.719] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.719] GdipDeleteRegion (region=0x1b94fd10) returned 0x0
	[0093.719] GdipGetDC (graphics=0x1b927100, hdc=0x20d590) returned 0x0
	[0093.719] GetCurrentObject (hdc=0x40010803, type=0x1) returned 0x1b00017
	[0093.719] GetCurrentObject (hdc=0x40010803, type=0x2) returned 0x1900010
	[0093.719] GetCurrentObject (hdc=0x40010803, type=0x7) returned 0x170501e7
	[0093.719] GetCurrentObject (hdc=0x40010803, type=0x6) returned 0x18a002e
	[0093.719] SaveDC (hdc=0x40010803) returned 1
	[0093.719] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3c0407f9
	[0093.719] GetClipRgn (hdc=0x40010803, hrgn=0x3c0407f9) returned 0
	[0093.719] SelectClipRgn (hdc=0x40010803, hrgn=0x37040710) returned 2
	[0093.719] DeleteObject (ho=0x3c0407f9) returned 1
	[0093.719] DeleteObject (ho=0x37040710) returned 1
	[0093.719] OffsetViewportOrgEx (in: hdc=0x40010803, x=0, y=0, lppt=0x266b860 | out: lppt=0x266b860) returned 1
	[0093.719] GetNearestColor (hdc=0x40010803, color=0xf0f0f0) returned 0xf0f0f0
	[0093.719] CreateSolidBrush (color=0xf0f0f0) returned 0x1e1007c0
	[0093.719] FillRect (hDC=0x40010803, lprc=0x20d560, hbr=0x1e1007c0) returned 1
	[0093.727] DeleteObject (ho=0x1e1007c0) returned 1
	[0093.727] RestoreDC (hdc=0x40010803, nSavedDC=-1) returned 1
	[0093.727] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.727] GdipReleaseDC (graphics=0x1b927100, hdc=0x40010803) returned 0x0
	[0093.727] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd6c0dbd) returned 0x0
	[0093.727] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.727] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.727] GetWindowTextLengthW (hWnd=0x201ce) returned 0
	[0093.727] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0093.727] GetSystemMetrics (nIndex=42) returned 0
	[0093.727] CoTaskMemAlloc (cb=0x6) returned 0x334a70
	[0093.727] GetWindowTextW (in: hWnd=0x201ce, lpString=0x334a70, nMaxCount=1 | out: lpString="") returned 0
	[0093.727] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ce, Msg=0xd, wParam=0x1, lParam=0x334a70) returned 0x0
	[0093.727] CoTaskMemFree (pv=0x334a70) 
	[0093.727] GdipDrawImageRectI (graphics=0x1b927100, image=0x1b910300, x=0, y=0, width=445, height=356) returned 0x0
	[0093.759] GdipGetDC (graphics=0x1b927100, hdc=0x20d990) returned 0x0
	[0093.759] BitBlt (hdc=0x10107f8, x=0, y=0, cx=445, cy=356, hdcSrc=0x40010803, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.759] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.759] GdipReleaseDC (graphics=0x1b927100, hdc=0x40010803) returned 0x0
	[0093.759] SelectObject (hdc=0x40010803, h=0x185000f) returned 0x170501e7
	[0093.759] DeleteDC (hdc=0x40010803) returned 1
	[0093.759] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.759] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.759] DeleteObject (ho=0x170501e7) returned 1
	[0093.759] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.759] EndPaint (hWnd=0x201ce, lpPaint=0x20da98) returned 1
	[0093.760] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.760] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0093.760] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.760] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.760] DispatchMessageW (lpMsg=0x20e6b0) returned 0x2
	[0093.760] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0093.760] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.760] CreateCompatibleDC (hdc=0x70107fc) returned 0x2d010804
	[0093.760] SelectObject (hdc=0x2d010804, h=0x140507d2) returned 0x185000f
	[0093.760] GdipCreateFromHDC (hdc=0x2d010804, graphics=0x20d7e0) returned 0x0
	[0093.760] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.760] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0093.760] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0093.760] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.760] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0093.760] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.760] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.760] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.760] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.760] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.760] GdipCreateRegion (region=0x20d910) returned 0x0
	[0093.760] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.761] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0093.761] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0093.761] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd6a0dbd) returned 0x0
	[0093.761] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.761] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.761] GdipGetDC (graphics=0x1b927100, hdc=0x20cdf0) returned 0x0
	[0093.761] GetCurrentObject (hdc=0x2d010804, type=0x1) returned 0x1b00017
	[0093.761] GetCurrentObject (hdc=0x2d010804, type=0x2) returned 0x1900010
	[0093.761] GetCurrentObject (hdc=0x2d010804, type=0x7) returned 0x140507d2
	[0093.761] GetCurrentObject (hdc=0x2d010804, type=0x6) returned 0x18a002e
	[0093.761] SaveDC (hdc=0x2d010804) returned 1
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0xf0f0f0) returned 0xf0f0f0
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0xa0a0a0) returned 0xa0a0a0
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0x696969) returned 0x696969
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0xa0a0a0) returned 0xa0a0a0
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0x0) returned 0x0
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0xffffff) returned 0xffffff
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0xe5e5e5) returned 0xe5e5e5
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0xd8d8d8) returned 0xd8d8d8
	[0093.761] GetNearestColor (hdc=0x2d010804, color=0x0) returned 0x0
	[0093.762] RestoreDC (hdc=0x2d010804, nSavedDC=-1) returned 1
	[0093.762] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.762] GdipReleaseDC (graphics=0x1b927100, hdc=0x2d010804) returned 0x0
	[0093.762] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.762] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.762] CoTaskMemFree (pv=0x1b067800) 
	[0093.762] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0093.762] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.762] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.762] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.762] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0093.762] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0093.762] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0093.762] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0093.762] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0093.762] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.762] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.762] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.763] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.763] CoTaskMemFree (pv=0x1b067800) 
	[0093.763] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0093.763] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0093.763] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0093.763] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0093.763] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.763] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.763] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.763] GdipMeasureString (graphics=0x1b495ce0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0093.763] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.763] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.763] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.763] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0093.763] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.763] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.763] CoTaskMemFree (pv=0x1b067800) 
	[0093.763] GdipCreateRegion (region=0x20d120) returned 0x0
	[0093.763] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.763] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0093.763] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.764] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0093.764] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.764] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.764] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.764] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.764] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.764] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.764] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.764] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.764] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d1d0) returned 0x0
	[0093.764] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d190) returned 0x0
	[0093.764] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d190) returned 0x0
	[0093.764] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.764] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.764] GdipGetDC (graphics=0x1b927100, hdc=0x20d200) returned 0x0
	[0093.764] GetCurrentObject (hdc=0x2d010804, type=0x1) returned 0x1b00017
	[0093.764] GetCurrentObject (hdc=0x2d010804, type=0x2) returned 0x1900010
	[0093.764] GetCurrentObject (hdc=0x2d010804, type=0x7) returned 0x140507d2
	[0093.764] GetCurrentObject (hdc=0x2d010804, type=0x6) returned 0x18a002e
	[0093.764] SaveDC (hdc=0x2d010804) returned 1
	[0093.764] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x38040710
	[0093.764] GetClipRgn (hdc=0x2d010804, hrgn=0x38040710) returned 0
	[0093.764] SelectClipRgn (hdc=0x2d010804, hrgn=0x3d0407f9) returned 2
	[0093.764] DeleteObject (ho=0x38040710) returned 1
	[0093.765] DeleteObject (ho=0x3d0407f9) returned 1
	[0093.765] OffsetViewportOrgEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x266c580 | out: lppt=0x266c580) returned 1
	[0093.765] GetNearestColor (hdc=0x2d010804, color=0xf0f0f0) returned 0xf0f0f0
	[0093.765] CreateSolidBrush (color=0xf0f0f0) returned 0x1f1007c0
	[0093.765] FillRect (hDC=0x2d010804, lprc=0x20d1d0, hbr=0x1f1007c0) returned 1
	[0093.765] DeleteObject (ho=0x1f1007c0) returned 1
	[0093.765] RestoreDC (hdc=0x2d010804, nSavedDC=-1) returned 1
	[0093.765] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.765] GdipReleaseDC (graphics=0x1b927100, hdc=0x2d010804) returned 0x0
	[0093.765] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.765] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.765] CoTaskMemFree (pv=0x1b067800) 
	[0093.765] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0093.765] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.765] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.765] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.765] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0093.765] GdipDrawString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.765] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.765] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.766] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.766] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.766] GetFocus () returned 0x201d8
	[0093.766] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0093.766] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.766] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.766] CoTaskMemFree (pv=0x1b067800) 
	[0093.766] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0093.766] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0093.766] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.766] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0093.766] GdipCreateRegion (region=0x20d070) returned 0x0
	[0093.766] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.766] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0093.766] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.766] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0093.766] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.766] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.766] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.767] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.767] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.767] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.767] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.767] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.767] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d120) returned 0x0
	[0093.767] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d0e0) returned 0x0
	[0093.767] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d0e0) returned 0x0
	[0093.767] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.767] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.767] GdipGetDC (graphics=0x1b927100, hdc=0x20d150) returned 0x0
	[0093.767] GetCurrentObject (hdc=0x2d010804, type=0x1) returned 0x1b00017
	[0093.767] GetCurrentObject (hdc=0x2d010804, type=0x2) returned 0x1900010
	[0093.767] GetCurrentObject (hdc=0x2d010804, type=0x7) returned 0x140507d2
	[0093.767] GetCurrentObject (hdc=0x2d010804, type=0x6) returned 0x18a002e
	[0093.767] SaveDC (hdc=0x2d010804) returned 1
	[0093.767] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3e0407f9
	[0093.767] GetClipRgn (hdc=0x2d010804, hrgn=0x3e0407f9) returned 0
	[0093.767] SelectClipRgn (hdc=0x2d010804, hrgn=0x39040710) returned 2
	[0093.767] DeleteObject (ho=0x3e0407f9) returned 1
	[0093.767] DeleteObject (ho=0x39040710) returned 1
	[0093.769] OffsetViewportOrgEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x266cb20 | out: lppt=0x266cb20) returned 1
	[0093.769] GetROP2 (hdc=0x2d010804) returned 13
	[0093.769] GetBkMode (hdc=0x2d010804) returned 2
	[0093.769] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.769] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x41300803
	[0093.769] SelectObject (hdc=0x2d010804, h=0x41300803) returned 0x1b00017
	[0093.769] MoveToEx (in: hdc=0x2d010804, x=126, y=1, lppt=0x266cb88 | out: lppt=0x266cb88) returned 1
	[0093.769] LineTo (hdc=0x2d010804, x=1, y=1) returned 1
	[0093.769] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.769] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.769] GetROP2 (hdc=0x2d010804) returned 13
	[0093.769] GetBkMode (hdc=0x2d010804) returned 2
	[0093.769] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.770] SelectObject (hdc=0x2d010804, h=0x41300803) returned 0x41300803
	[0093.770] MoveToEx (in: hdc=0x2d010804, x=1, y=1, lppt=0x266cba0 | out: lppt=0x266cba0) returned 1
	[0093.770] LineTo (hdc=0x2d010804, x=1, y=39) returned 1
	[0093.770] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.770] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.770] SelectObject (hdc=0x2d010804, h=0x1b00017) returned 0x41300803
	[0093.770] DeleteObject (ho=0x41300803) returned 1
	[0093.770] GetROP2 (hdc=0x2d010804) returned 13
	[0093.770] GetBkMode (hdc=0x2d010804) returned 2
	[0093.770] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.770] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x12300802
	[0093.770] SelectObject (hdc=0x2d010804, h=0x12300802) returned 0x1b00017
	[0093.770] MoveToEx (in: hdc=0x2d010804, x=1, y=39, lppt=0x266cc08 | out: lppt=0x266cc08) returned 1
	[0093.770] LineTo (hdc=0x2d010804, x=126, y=39) returned 1
	[0093.770] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.770] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.770] GetROP2 (hdc=0x2d010804) returned 13
	[0093.770] GetBkMode (hdc=0x2d010804) returned 2
	[0093.770] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.770] SelectObject (hdc=0x2d010804, h=0x12300802) returned 0x12300802
	[0093.770] MoveToEx (in: hdc=0x2d010804, x=126, y=39, lppt=0x266cc20 | out: lppt=0x266cc20) returned 1
	[0093.770] LineTo (hdc=0x2d010804, x=126, y=0) returned 1
	[0093.770] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.770] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.770] SelectObject (hdc=0x2d010804, h=0x1b00017) returned 0x12300802
	[0093.771] DeleteObject (ho=0x12300802) returned 1
	[0093.771] GetROP2 (hdc=0x2d010804) returned 13
	[0093.771] GetBkMode (hdc=0x2d010804) returned 2
	[0093.771] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.771] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x42300803
	[0093.771] SelectObject (hdc=0x2d010804, h=0x42300803) returned 0x1b00017
	[0093.771] MoveToEx (in: hdc=0x2d010804, x=125, y=2, lppt=0x266cc88 | out: lppt=0x266cc88) returned 1
	[0093.771] LineTo (hdc=0x2d010804, x=2, y=2) returned 1
	[0093.771] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.771] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.771] GetROP2 (hdc=0x2d010804) returned 13
	[0093.771] GetBkMode (hdc=0x2d010804) returned 2
	[0093.771] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.771] SelectObject (hdc=0x2d010804, h=0x42300803) returned 0x42300803
	[0093.771] MoveToEx (in: hdc=0x2d010804, x=2, y=2, lppt=0x266cca0 | out: lppt=0x266cca0) returned 1
	[0093.771] LineTo (hdc=0x2d010804, x=2, y=38) returned 1
	[0093.771] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.771] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.771] SelectObject (hdc=0x2d010804, h=0x1b00017) returned 0x42300803
	[0093.771] DeleteObject (ho=0x42300803) returned 1
	[0093.771] GetROP2 (hdc=0x2d010804) returned 13
	[0093.771] GetBkMode (hdc=0x2d010804) returned 2
	[0093.771] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.771] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x13300802
	[0093.771] SelectObject (hdc=0x2d010804, h=0x13300802) returned 0x1b00017
	[0093.771] MoveToEx (in: hdc=0x2d010804, x=2, y=38, lppt=0x266cd08 | out: lppt=0x266cd08) returned 1
	[0093.772] LineTo (hdc=0x2d010804, x=125, y=38) returned 1
	[0093.772] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.772] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.772] GetROP2 (hdc=0x2d010804) returned 13
	[0093.772] GetBkMode (hdc=0x2d010804) returned 2
	[0093.772] SetBkMode (hdc=0x2d010804, mode=1) returned 2
	[0093.772] SelectObject (hdc=0x2d010804, h=0x13300802) returned 0x13300802
	[0093.772] MoveToEx (in: hdc=0x2d010804, x=125, y=38, lppt=0x266cd20 | out: lppt=0x266cd20) returned 1
	[0093.772] LineTo (hdc=0x2d010804, x=125, y=1) returned 1
	[0093.772] SetBkMode (hdc=0x2d010804, mode=2) returned 1
	[0093.772] MoveToEx (in: hdc=0x2d010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.772] SelectObject (hdc=0x2d010804, h=0x1b00017) returned 0x13300802
	[0093.772] DeleteObject (ho=0x13300802) returned 1
	[0093.772] RestoreDC (hdc=0x2d010804, nSavedDC=-1) returned 1
	[0093.772] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.772] GdipReleaseDC (graphics=0x1b927100, hdc=0x2d010804) returned 0x0
	[0093.772] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0093.772] BitBlt (hdc=0x70107fc, x=0, y=0, cx=128, cy=41, hdcSrc=0x2d010804, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.772] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.772] GdipReleaseDC (graphics=0x1b927100, hdc=0x2d010804) returned 0x0
	[0093.772] SelectObject (hdc=0x2d010804, h=0x185000f) returned 0x140507d2
	[0093.772] DeleteDC (hdc=0x2d010804) returned 1
	[0093.772] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.773] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.773] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.773] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0093.773] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.773] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e9033f) returned 0x1
	[0093.773] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0093.773] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.773] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e9033f) returned 0x1
	[0093.773] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0093.773] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe2014e) returned 0x0
	[0093.773] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0093.773] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0093.773] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0093.773] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.773] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.773] GetKeyState (nVirtKey=1) returned -128
	[0093.773] GetKeyState (nVirtKey=2) returned 0
	[0093.773] GetKeyState (nVirtKey=4) returned 0
	[0093.773] GetKeyState (nVirtKey=5) returned 0
	[0093.773] GetKeyState (nVirtKey=6) returned 0
	[0093.773] IsWindowVisible (hWnd=0x201d8) returned 1
	[0093.773] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0093.773] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0093.773] GetFocus () returned 0x201d8
	[0093.773] GetFocus () returned 0x201d8
	[0093.773] GetFocus () returned 0x201d8
	[0093.774] GetKeyState (nVirtKey=1) returned -128
	[0093.774] GetKeyState (nVirtKey=2) returned 0
	[0093.774] GetKeyState (nVirtKey=4) returned 0
	[0093.774] GetKeyState (nVirtKey=5) returned 0
	[0093.774] GetKeyState (nVirtKey=6) returned 0
	[0093.774] GetCapture () returned 0x0
	[0093.774] SetCapture (hWnd=0x201d8) returned 0x0
	[0093.774] GetKeyState (nVirtKey=1) returned -128
	[0093.774] GetKeyState (nVirtKey=2) returned 0
	[0093.774] GetKeyState (nVirtKey=4) returned 0
	[0093.774] GetKeyState (nVirtKey=5) returned 0
	[0093.774] GetKeyState (nVirtKey=6) returned 0
	[0093.774] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0093.774] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0093.774] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.774] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.774] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.774] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0093.774] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.774] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0093.774] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0093.774] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0093.774] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0093.774] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x266cdd8, cPoints=0x1 | out: lpPoints=0x266cdd8) returned 30606029
	[0093.774] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0093.774] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0093.774] UpdateWindow (hWnd=0x201d8) returned 1
	[0093.774] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0093.774] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0093.774] CreateCompatibleDC (hdc=0x10107f8) returned 0x2f010804
	[0093.774] SelectObject (hdc=0x2f010804, h=0x140507d2) returned 0x185000f
	[0093.774] GdipCreateFromHDC (hdc=0x2f010804, graphics=0x20cfa0) returned 0x0
	[0093.775] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0093.775] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0093.775] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0093.775] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.775] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0093.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.775] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.775] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.775] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.775] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.775] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0093.775] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.775] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d100) returned 0x0
	[0093.775] GdipSaveGraphics (graphics=0x1b927100, state=0x20d1d0) returned 0x0
	[0093.775] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd670dbd) returned 0x0
	[0093.775] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.775] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.775] GdipGetDC (graphics=0x1b927100, hdc=0x20c5b0) returned 0x0
	[0093.775] GetCurrentObject (hdc=0x2f010804, type=0x1) returned 0x1b00017
	[0093.775] GetCurrentObject (hdc=0x2f010804, type=0x2) returned 0x1900010
	[0093.775] GetCurrentObject (hdc=0x2f010804, type=0x7) returned 0x140507d2
	[0093.775] GetCurrentObject (hdc=0x2f010804, type=0x6) returned 0x18a002e
	[0093.776] SaveDC (hdc=0x2f010804) returned 1
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0xf0f0f0) returned 0xf0f0f0
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0xa0a0a0) returned 0xa0a0a0
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0x696969) returned 0x696969
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0xa0a0a0) returned 0xa0a0a0
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0x0) returned 0x0
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0xffffff) returned 0xffffff
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0xe5e5e5) returned 0xe5e5e5
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0xd8d8d8) returned 0xd8d8d8
	[0093.776] GetNearestColor (hdc=0x2f010804, color=0x0) returned 0x0
	[0093.776] RestoreDC (hdc=0x2f010804, nSavedDC=-1) returned 1
	[0093.776] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.776] GdipReleaseDC (graphics=0x1b927100, hdc=0x2f010804) returned 0x0
	[0093.776] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.776] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.776] CoTaskMemFree (pv=0x1b067800) 
	[0093.777] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0093.777] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.777] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.777] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.777] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0093.777] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0093.777] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0093.777] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0093.777] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0093.777] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.777] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.777] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.777] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.777] CoTaskMemFree (pv=0x1b067800) 
	[0093.777] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0093.777] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0093.777] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0093.777] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0093.777] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.777] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.778] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.778] GdipMeasureString (graphics=0x1b495ce0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0093.778] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.778] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.778] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.778] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0093.778] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.778] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.778] CoTaskMemFree (pv=0x1b067800) 
	[0093.778] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0093.778] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.778] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0093.778] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0093.778] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0093.778] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.778] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.778] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.778] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.778] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07bcc0) returned 0x0
	[0093.778] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.778] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.779] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0093.779] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20c990) returned 0x0
	[0093.779] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20c950) returned 0x0
	[0093.779] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20c950) returned 0x0
	[0093.779] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.779] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.779] GdipGetDC (graphics=0x1b927100, hdc=0x20c9c0) returned 0x0
	[0093.779] GetCurrentObject (hdc=0x2f010804, type=0x1) returned 0x1b00017
	[0093.779] GetCurrentObject (hdc=0x2f010804, type=0x2) returned 0x1900010
	[0093.779] GetCurrentObject (hdc=0x2f010804, type=0x7) returned 0x140507d2
	[0093.779] GetCurrentObject (hdc=0x2f010804, type=0x6) returned 0x18a002e
	[0093.779] SaveDC (hdc=0x2f010804) returned 1
	[0093.779] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a040710
	[0093.779] GetClipRgn (hdc=0x2f010804, hrgn=0x3a040710) returned 0
	[0093.779] SelectClipRgn (hdc=0x2f010804, hrgn=0x3f0407f9) returned 2
	[0093.779] DeleteObject (ho=0x3a040710) returned 1
	[0093.779] DeleteObject (ho=0x3f0407f9) returned 1
	[0093.779] OffsetViewportOrgEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x266da58 | out: lppt=0x266da58) returned 1
	[0093.779] GetNearestColor (hdc=0x2f010804, color=0xf0f0f0) returned 0xf0f0f0
	[0093.779] CreateSolidBrush (color=0xf0f0f0) returned 0x201007c0
	[0093.779] FillRect (hDC=0x2f010804, lprc=0x20c990, hbr=0x201007c0) returned 1
	[0093.779] DeleteObject (ho=0x201007c0) returned 1
	[0093.779] RestoreDC (hdc=0x2f010804, nSavedDC=-1) returned 1
	[0093.780] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.780] GdipReleaseDC (graphics=0x1b927100, hdc=0x2f010804) returned 0x0
	[0093.780] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.780] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.780] CoTaskMemFree (pv=0x1b067800) 
	[0093.780] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0093.780] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.780] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0093.780] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0093.780] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0093.780] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0093.780] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.780] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0093.780] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.780] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0093.780] GetFocus () returned 0x201d8
	[0093.780] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0093.781] CoTaskMemAlloc (cb=0x13) returned 0x1b067800
	[0093.781] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0093.781] CoTaskMemFree (pv=0x1b067800) 
	[0093.781] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0093.781] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0093.781] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.781] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0093.781] GdipCreateRegion (region=0x20c830) returned 0x0
	[0093.781] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0093.781] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0093.781] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0093.781] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0093.781] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.781] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.781] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.781] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07bcc0
	[0093.781] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07bcc0) returned 0x0
	[0093.781] LocalFree (hMem=0x1b07bcc0) returned 0x0
	[0093.781] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.781] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0093.781] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20c8e0) returned 0x0
	[0093.781] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20c8a0) returned 0x0
	[0093.781] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20c8a0) returned 0x0
	[0093.782] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.782] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0093.782] GdipGetDC (graphics=0x1b927100, hdc=0x20c910) returned 0x0
	[0093.782] GetCurrentObject (hdc=0x2f010804, type=0x1) returned 0x1b00017
	[0093.782] GetCurrentObject (hdc=0x2f010804, type=0x2) returned 0x1900010
	[0093.782] GetCurrentObject (hdc=0x2f010804, type=0x7) returned 0x140507d2
	[0093.782] GetCurrentObject (hdc=0x2f010804, type=0x6) returned 0x18a002e
	[0093.782] SaveDC (hdc=0x2f010804) returned 1
	[0093.782] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x400407f9
	[0093.782] GetClipRgn (hdc=0x2f010804, hrgn=0x400407f9) returned 0
	[0093.782] SelectClipRgn (hdc=0x2f010804, hrgn=0x3b040710) returned 2
	[0093.782] DeleteObject (ho=0x400407f9) returned 1
	[0093.782] DeleteObject (ho=0x3b040710) returned 1
	[0093.782] OffsetViewportOrgEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x266dff8 | out: lppt=0x266dff8) returned 1
	[0093.782] GetROP2 (hdc=0x2f010804) returned 13
	[0093.782] GetBkMode (hdc=0x2f010804) returned 2
	[0093.782] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.782] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x14300802
	[0093.782] SelectObject (hdc=0x2f010804, h=0x14300802) returned 0x1b00017
	[0093.782] MoveToEx (in: hdc=0x2f010804, x=164, y=1, lppt=0x266e060 | out: lppt=0x266e060) returned 1
	[0093.782] LineTo (hdc=0x2f010804, x=1, y=1) returned 1
	[0093.782] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.782] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.782] GetROP2 (hdc=0x2f010804) returned 13
	[0093.782] GetBkMode (hdc=0x2f010804) returned 2
	[0093.783] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.783] SelectObject (hdc=0x2f010804, h=0x14300802) returned 0x14300802
	[0093.783] MoveToEx (in: hdc=0x2f010804, x=1, y=1, lppt=0x266e078 | out: lppt=0x266e078) returned 1
	[0093.783] LineTo (hdc=0x2f010804, x=1, y=41) returned 1
	[0093.783] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.783] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.783] SelectObject (hdc=0x2f010804, h=0x1b00017) returned 0x14300802
	[0093.783] DeleteObject (ho=0x14300802) returned 1
	[0093.787] GetROP2 (hdc=0x2f010804) returned 13
	[0093.787] GetBkMode (hdc=0x2f010804) returned 2
	[0093.787] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.787] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x43300803
	[0093.787] SelectObject (hdc=0x2f010804, h=0x43300803) returned 0x1b00017
	[0093.787] MoveToEx (in: hdc=0x2f010804, x=1, y=41, lppt=0x266e0e0 | out: lppt=0x266e0e0) returned 1
	[0093.787] LineTo (hdc=0x2f010804, x=164, y=41) returned 1
	[0093.787] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.787] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.788] GetROP2 (hdc=0x2f010804) returned 13
	[0093.788] GetBkMode (hdc=0x2f010804) returned 2
	[0093.788] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.788] SelectObject (hdc=0x2f010804, h=0x43300803) returned 0x43300803
	[0093.788] MoveToEx (in: hdc=0x2f010804, x=164, y=41, lppt=0x266e0f8 | out: lppt=0x266e0f8) returned 1
	[0093.788] LineTo (hdc=0x2f010804, x=164, y=0) returned 1
	[0093.788] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.788] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.788] SelectObject (hdc=0x2f010804, h=0x1b00017) returned 0x43300803
	[0093.788] DeleteObject (ho=0x43300803) returned 1
	[0093.788] GetROP2 (hdc=0x2f010804) returned 13
	[0093.788] GetBkMode (hdc=0x2f010804) returned 2
	[0093.788] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.788] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x15300802
	[0093.788] SelectObject (hdc=0x2f010804, h=0x15300802) returned 0x1b00017
	[0093.788] MoveToEx (in: hdc=0x2f010804, x=163, y=2, lppt=0x266e160 | out: lppt=0x266e160) returned 1
	[0093.788] LineTo (hdc=0x2f010804, x=2, y=2) returned 1
	[0093.788] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.788] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.788] GetROP2 (hdc=0x2f010804) returned 13
	[0093.788] GetBkMode (hdc=0x2f010804) returned 2
	[0093.788] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.788] SelectObject (hdc=0x2f010804, h=0x15300802) returned 0x15300802
	[0093.789] MoveToEx (in: hdc=0x2f010804, x=2, y=2, lppt=0x266e178 | out: lppt=0x266e178) returned 1
	[0093.789] LineTo (hdc=0x2f010804, x=2, y=40) returned 1
	[0093.789] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.789] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.789] SelectObject (hdc=0x2f010804, h=0x1b00017) returned 0x15300802
	[0093.789] DeleteObject (ho=0x15300802) returned 1
	[0093.789] GetROP2 (hdc=0x2f010804) returned 13
	[0093.789] GetBkMode (hdc=0x2f010804) returned 2
	[0093.789] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.789] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x44300803
	[0093.789] SelectObject (hdc=0x2f010804, h=0x44300803) returned 0x1b00017
	[0093.789] MoveToEx (in: hdc=0x2f010804, x=2, y=40, lppt=0x266e1e0 | out: lppt=0x266e1e0) returned 1
	[0093.789] LineTo (hdc=0x2f010804, x=163, y=40) returned 1
	[0093.789] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.789] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.789] GetROP2 (hdc=0x2f010804) returned 13
	[0093.789] GetBkMode (hdc=0x2f010804) returned 2
	[0093.789] SetBkMode (hdc=0x2f010804, mode=1) returned 2
	[0093.789] SelectObject (hdc=0x2f010804, h=0x44300803) returned 0x44300803
	[0093.789] MoveToEx (in: hdc=0x2f010804, x=163, y=40, lppt=0x266e1f8 | out: lppt=0x266e1f8) returned 1
	[0093.789] LineTo (hdc=0x2f010804, x=163, y=1) returned 1
	[0093.789] SetBkMode (hdc=0x2f010804, mode=2) returned 1
	[0093.789] MoveToEx (in: hdc=0x2f010804, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0093.789] SelectObject (hdc=0x2f010804, h=0x1b00017) returned 0x44300803
	[0093.790] DeleteObject (ho=0x44300803) returned 1
	[0093.790] RestoreDC (hdc=0x2f010804, nSavedDC=-1) returned 1
	[0093.790] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.790] GdipReleaseDC (graphics=0x1b927100, hdc=0x2f010804) returned 0x0
	[0093.790] GdipGetDC (graphics=0x1b927100, hdc=0x20d0a0) returned 0x0
	[0093.790] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x2f010804, x1=0, y1=0, rop=0xcc0020) returned 1
	[0093.790] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.790] GdipReleaseDC (graphics=0x1b927100, hdc=0x2f010804) returned 0x0
	[0093.790] SelectObject (hdc=0x2f010804, h=0x185000f) returned 0x140507d2
	[0093.790] DeleteDC (hdc=0x2f010804) returned 1
	[0093.790] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0093.790] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0093.790] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0093.790] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0093.790] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x266e250, cPoints=0x1 | out: lpPoints=0x266e250) returned 30606029
	[0093.790] WindowFromPoint (Point=0x1e90000033f) returned 0x201d8
	[0093.790] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e9033f) returned 0x1
	[0093.790] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0093.790] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0093.804] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0093.804] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x266e340, Length=0x70 | out: Destination=0x1afe53a0) 
	[0093.805] ShellExecuteExW (in: pExecInfo=0x266e550*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x266e550*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0094.002] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x160072) returned 0x0
	[0094.341] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x3e0, wParam=0x201c8, lParam=0xffffffffc17ac17b) returned 0x0
	[0094.407] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x3e0, wParam=0x201c8, lParam=0xffffffffc17ac17b) returned 0x0
	[0094.408] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x3e0, wParam=0x201c8, lParam=0xffffffffc17ac17b) returned 0x0
	[0094.408] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x3e0, wParam=0x201c8, lParam=0xffffffffc17ac17b) returned 0x0
	[0094.408] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x3e0, wParam=0x201c8, lParam=0xffffffffc17ac17b) returned 0x0
	[0095.419] GetKeyState (nVirtKey=1) returned 0
	[0095.419] GetKeyState (nVirtKey=2) returned 0
	[0095.420] GetKeyState (nVirtKey=4) returned 0
	[0095.420] GetKeyState (nVirtKey=5) returned 0
	[0095.420] GetKeyState (nVirtKey=6) returned 0
	[0096.992] GetKeyState (nVirtKey=1) returned 0
	[0096.992] GetKeyState (nVirtKey=2) returned 0
	[0096.993] GetKeyState (nVirtKey=4) returned 0
	[0096.993] GetKeyState (nVirtKey=5) returned 0
	[0096.993] GetKeyState (nVirtKey=6) returned 0
	[0097.098] GetKeyState (nVirtKey=1) returned -127
	[0097.098] GetKeyState (nVirtKey=2) returned 0
	[0097.098] GetKeyState (nVirtKey=4) returned 0
	[0097.098] GetKeyState (nVirtKey=5) returned 0
	[0097.098] GetKeyState (nVirtKey=6) returned 0
	[0097.098] IsWindowVisible (hWnd=0x201d8) returned 1
	[0097.098] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0097.098] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0097.098] GetFocus () returned 0x201d8
	[0097.098] GetFocus () returned 0x201d8
	[0097.098] GetFocus () returned 0x201d8
	[0097.098] GetKeyState (nVirtKey=1) returned -127
	[0097.098] GetKeyState (nVirtKey=2) returned 0
	[0097.098] GetKeyState (nVirtKey=4) returned 0
	[0097.098] GetKeyState (nVirtKey=5) returned 0
	[0097.098] GetKeyState (nVirtKey=6) returned 0
	[0097.098] GetCapture () returned 0x201d8
	[0097.099] GetKeyState (nVirtKey=1) returned -127
	[0097.099] GetKeyState (nVirtKey=2) returned 0
	[0097.099] GetKeyState (nVirtKey=4) returned 0
	[0097.099] GetKeyState (nVirtKey=5) returned 0
	[0097.099] GetKeyState (nVirtKey=6) returned 0
	[0097.099] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0097.099] InvalidateRect (hWnd=0x201d8, lpRect=0x20cf20, bErase=0) returned 1
	[0097.099] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x266e6a0, cPoints=0x1 | out: lpPoints=0x266e6a0) returned 30606029
	[0097.099] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0097.099] InvalidateRect (hWnd=0x201d8, lpRect=0x20ce70, bErase=0) returned 1
	[0097.099] UpdateWindow (hWnd=0x201d8) returned 1
	[0097.099] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20c388 | out: lpPaint=0x20c388) returned 0x10107f8
	[0097.099] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0097.099] CreateCompatibleDC (hdc=0x10107f8) returned 0x17010252
	[0097.099] SelectObject (hdc=0x17010252, h=0x140507d2) returned 0x185000f
	[0097.099] GdipCreateFromHDC (hdc=0x17010252, graphics=0x20c190) returned 0x0
	[0097.099] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0097.100] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0097.100] GdipCreateMatrix (matrix=0x20c2c0) returned 0x0
	[0097.100] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0097.100] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c320) returned 0x0
	[0097.100] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0097.100] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0097.100] LocalFree (hMem=0x1b07c780) returned 0x0
	[0097.100] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.100] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0097.100] GdipCreateRegion (region=0x20c2c0) returned 0x0
	[0097.100] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0097.100] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20c2f0) returned 0x0
	[0097.100] GdipSaveGraphics (graphics=0x1b927100, state=0x20c3c0) returned 0x0
	[0097.100] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd640dbd) returned 0x0
	[0097.100] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.100] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0097.101] GdipGetDC (graphics=0x1b927100, hdc=0x20b7a0) returned 0x0
	[0097.101] GetCurrentObject (hdc=0x17010252, type=0x1) returned 0x1b00017
	[0097.101] GetCurrentObject (hdc=0x17010252, type=0x2) returned 0x1900010
	[0097.101] GetCurrentObject (hdc=0x17010252, type=0x7) returned 0x140507d2
	[0097.101] GetCurrentObject (hdc=0x17010252, type=0x6) returned 0x18a002e
	[0097.101] SaveDC (hdc=0x17010252) returned 1
	[0097.102] GetNearestColor (hdc=0x17010252, color=0xf0f0f0) returned 0xf0f0f0
	[0097.102] GetNearestColor (hdc=0x17010252, color=0xa0a0a0) returned 0xa0a0a0
	[0097.102] GetNearestColor (hdc=0x17010252, color=0x696969) returned 0x696969
	[0097.102] GetNearestColor (hdc=0x17010252, color=0xa0a0a0) returned 0xa0a0a0
	[0097.102] GetNearestColor (hdc=0x17010252, color=0x0) returned 0x0
	[0097.102] GetNearestColor (hdc=0x17010252, color=0xffffff) returned 0xffffff
	[0097.102] GetNearestColor (hdc=0x17010252, color=0xe5e5e5) returned 0xe5e5e5
	[0097.102] GetNearestColor (hdc=0x17010252, color=0xd8d8d8) returned 0xd8d8d8
	[0097.102] GetNearestColor (hdc=0x17010252, color=0x0) returned 0x0
	[0097.102] RestoreDC (hdc=0x17010252, nSavedDC=-1) returned 1
	[0097.103] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.103] GdipReleaseDC (graphics=0x1b927100, hdc=0x17010252) returned 0x0
	[0097.104] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0097.104] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0097.104] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0097.104] CoTaskMemFree (pv=0x1b067960) 
	[0097.104] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20be90) returned 0x0
	[0097.105] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0097.105] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0097.105] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0097.105] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bec0) returned 0x0
	[0097.105] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20bec0) returned 0x0
	[0097.105] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20bec0) returned 0x0
	[0097.105] GdipGetFontSize (font=0x1b912930, size=0x20bec0) returned 0x0
	[0097.105] GdipGetFontStyle (font=0x1b912930, style=0x20bec0) returned 0x0
	[0097.105] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.105] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0097.105] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0097.105] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0097.105] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0097.106] CoTaskMemFree (pv=0x1b067960) 
	[0097.106] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bb50) returned 0x0
	[0097.106] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bb60) returned 0x0
	[0097.106] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0097.106] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0097.106] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0097.106] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0097.106] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0097.106] GdipMeasureString (graphics=0x1b495ce0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20ba78, stringFormat=0x1b912930, boundingBox=0x20ba68, codepointsFitted=0x20ba64, linesFilled=0x20ba60) returned 0x0
	[0097.106] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.106] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0097.106] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.106] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0097.107] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0097.107] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0097.107] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0097.107] CoTaskMemFree (pv=0x1b067960) 
	[0097.107] GdipCreateRegion (region=0x20bad0) returned 0x0
	[0097.107] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0097.107] GdipCreateMatrix (matrix=0x20bad0) returned 0x0
	[0097.107] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0097.108] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20bb30) returned 0x0
	[0097.108] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0097.108] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0097.108] LocalFree (hMem=0x1b07c780) returned 0x0
	[0097.108] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0097.108] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0097.108] LocalFree (hMem=0x1b07c780) returned 0x0
	[0097.108] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.108] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0097.108] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20bb80) returned 0x0
	[0097.108] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20bb40) returned 0x0
	[0097.108] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20bb40) returned 0x0
	[0097.108] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.108] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0097.108] GdipGetDC (graphics=0x1b927100, hdc=0x20bbb0) returned 0x0
	[0097.109] GetCurrentObject (hdc=0x17010252, type=0x1) returned 0x1b00017
	[0097.109] GetCurrentObject (hdc=0x17010252, type=0x2) returned 0x1900010
	[0097.109] GetCurrentObject (hdc=0x17010252, type=0x7) returned 0x140507d2
	[0097.109] GetCurrentObject (hdc=0x17010252, type=0x6) returned 0x18a002e
	[0097.109] SaveDC (hdc=0x17010252) returned 1
	[0097.109] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3c040710
	[0097.109] GetClipRgn (hdc=0x17010252, hrgn=0x3c040710) returned 0
	[0097.109] SelectClipRgn (hdc=0x17010252, hrgn=0x410407f9) returned 2
	[0097.109] DeleteObject (ho=0x3c040710) returned 1
	[0097.109] DeleteObject (ho=0x410407f9) returned 1
	[0097.109] OffsetViewportOrgEx (in: hdc=0x17010252, x=0, y=0, lppt=0x266f320 | out: lppt=0x266f320) returned 1
	[0097.110] GetNearestColor (hdc=0x17010252, color=0xf0f0f0) returned 0xf0f0f0
	[0097.110] CreateSolidBrush (color=0xf0f0f0) returned 0x211007c0
	[0097.110] FillRect (hDC=0x17010252, lprc=0x20bb80, hbr=0x211007c0) returned 1
	[0097.110] DeleteObject (ho=0x211007c0) returned 1
	[0097.110] RestoreDC (hdc=0x17010252, nSavedDC=-1) returned 1
	[0097.110] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.110] GdipReleaseDC (graphics=0x1b927100, hdc=0x17010252) returned 0x0
	[0097.111] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0097.111] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0097.111] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0097.111] CoTaskMemFree (pv=0x1b067960) 
	[0097.111] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bbf0) returned 0x0
	[0097.111] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0097.111] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0097.111] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0097.111] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20bc60) returned 0x0
	[0097.111] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20bb70, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0097.111] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.112] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0097.112] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.112] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0097.112] GetFocus () returned 0x201d8
	[0097.112] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0097.112] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0097.112] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0097.112] CoTaskMemFree (pv=0x1b067960) 
	[0097.112] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20bf50) returned 0x0
	[0097.113] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0097.113] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.113] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0097.113] GdipCreateRegion (region=0x20ba20) returned 0x0
	[0097.113] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0097.113] GdipCreateMatrix (matrix=0x20ba20) returned 0x0
	[0097.113] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0097.113] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20ba80) returned 0x0
	[0097.113] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0097.113] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0097.113] LocalFree (hMem=0x1b07c780) returned 0x0
	[0097.113] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0097.114] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0097.114] LocalFree (hMem=0x1b07c780) returned 0x0
	[0097.114] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.114] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0097.114] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20bad0) returned 0x0
	[0097.114] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20ba90) returned 0x0
	[0097.114] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20ba90) returned 0x0
	[0097.114] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.114] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0097.114] GdipGetDC (graphics=0x1b927100, hdc=0x20bb00) returned 0x0
	[0097.114] GetCurrentObject (hdc=0x17010252, type=0x1) returned 0x1b00017
	[0097.114] GetCurrentObject (hdc=0x17010252, type=0x2) returned 0x1900010
	[0097.114] GetCurrentObject (hdc=0x17010252, type=0x7) returned 0x140507d2
	[0097.115] GetCurrentObject (hdc=0x17010252, type=0x6) returned 0x18a002e
	[0097.115] SaveDC (hdc=0x17010252) returned 1
	[0097.115] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x420407f9
	[0097.115] GetClipRgn (hdc=0x17010252, hrgn=0x420407f9) returned 0
	[0097.115] SelectClipRgn (hdc=0x17010252, hrgn=0x3d040710) returned 2
	[0097.115] DeleteObject (ho=0x420407f9) returned 1
	[0097.115] DeleteObject (ho=0x3d040710) returned 1
	[0097.115] OffsetViewportOrgEx (in: hdc=0x17010252, x=0, y=0, lppt=0x266f8c0 | out: lppt=0x266f8c0) returned 1
	[0097.115] GetROP2 (hdc=0x17010252) returned 13
	[0097.115] GetBkMode (hdc=0x17010252) returned 2
	[0097.115] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.116] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xf3001e6
	[0097.116] SelectObject (hdc=0x17010252, h=0xf3001e6) returned 0x1b00017
	[0097.116] MoveToEx (in: hdc=0x17010252, x=164, y=1, lppt=0x266f928 | out: lppt=0x266f928) returned 1
	[0097.116] LineTo (hdc=0x17010252, x=1, y=1) returned 1
	[0097.116] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.116] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.116] GetROP2 (hdc=0x17010252) returned 13
	[0097.116] GetBkMode (hdc=0x17010252) returned 2
	[0097.116] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.116] SelectObject (hdc=0x17010252, h=0xf3001e6) returned 0xf3001e6
	[0097.116] MoveToEx (in: hdc=0x17010252, x=1, y=1, lppt=0x266f940 | out: lppt=0x266f940) returned 1
	[0097.116] LineTo (hdc=0x17010252, x=1, y=41) returned 1
	[0097.116] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.116] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.116] SelectObject (hdc=0x17010252, h=0x1b00017) returned 0xf3001e6
	[0097.117] DeleteObject (ho=0xf3001e6) returned 1
	[0097.117] GetROP2 (hdc=0x17010252) returned 13
	[0097.117] GetBkMode (hdc=0x17010252) returned 2
	[0097.117] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.117] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1f30022a
	[0097.117] SelectObject (hdc=0x17010252, h=0x1f30022a) returned 0x1b00017
	[0097.117] MoveToEx (in: hdc=0x17010252, x=1, y=41, lppt=0x266f9a8 | out: lppt=0x266f9a8) returned 1
	[0097.117] LineTo (hdc=0x17010252, x=164, y=41) returned 1
	[0097.117] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.117] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.117] GetROP2 (hdc=0x17010252) returned 13
	[0097.117] GetBkMode (hdc=0x17010252) returned 2
	[0097.117] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.117] SelectObject (hdc=0x17010252, h=0x1f30022a) returned 0x1f30022a
	[0097.118] MoveToEx (in: hdc=0x17010252, x=164, y=41, lppt=0x266f9c0 | out: lppt=0x266f9c0) returned 1
	[0097.118] LineTo (hdc=0x17010252, x=164, y=0) returned 1
	[0097.118] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.118] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.118] SelectObject (hdc=0x17010252, h=0x1b00017) returned 0x1f30022a
	[0097.118] DeleteObject (ho=0x1f30022a) returned 1
	[0097.118] GetROP2 (hdc=0x17010252) returned 13
	[0097.118] GetBkMode (hdc=0x17010252) returned 2
	[0097.118] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.118] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x103001e6
	[0097.118] SelectObject (hdc=0x17010252, h=0x103001e6) returned 0x1b00017
	[0097.118] MoveToEx (in: hdc=0x17010252, x=163, y=2, lppt=0x266fa28 | out: lppt=0x266fa28) returned 1
	[0097.118] LineTo (hdc=0x17010252, x=2, y=2) returned 1
	[0097.118] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.118] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.119] GetROP2 (hdc=0x17010252) returned 13
	[0097.119] GetBkMode (hdc=0x17010252) returned 2
	[0097.119] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.119] SelectObject (hdc=0x17010252, h=0x103001e6) returned 0x103001e6
	[0097.119] MoveToEx (in: hdc=0x17010252, x=2, y=2, lppt=0x266fa40 | out: lppt=0x266fa40) returned 1
	[0097.119] LineTo (hdc=0x17010252, x=2, y=40) returned 1
	[0097.119] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.119] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.119] SelectObject (hdc=0x17010252, h=0x1b00017) returned 0x103001e6
	[0097.119] DeleteObject (ho=0x103001e6) returned 1
	[0097.119] GetROP2 (hdc=0x17010252) returned 13
	[0097.119] GetBkMode (hdc=0x17010252) returned 2
	[0097.119] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.119] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2030022a
	[0097.119] SelectObject (hdc=0x17010252, h=0x2030022a) returned 0x1b00017
	[0097.119] MoveToEx (in: hdc=0x17010252, x=2, y=40, lppt=0x266faa8 | out: lppt=0x266faa8) returned 1
	[0097.119] LineTo (hdc=0x17010252, x=163, y=40) returned 1
	[0097.119] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.119] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.119] GetROP2 (hdc=0x17010252) returned 13
	[0097.120] GetBkMode (hdc=0x17010252) returned 2
	[0097.120] SetBkMode (hdc=0x17010252, mode=1) returned 2
	[0097.120] SelectObject (hdc=0x17010252, h=0x2030022a) returned 0x2030022a
	[0097.120] MoveToEx (in: hdc=0x17010252, x=163, y=40, lppt=0x266fac0 | out: lppt=0x266fac0) returned 1
	[0097.120] LineTo (hdc=0x17010252, x=163, y=1) returned 1
	[0097.120] SetBkMode (hdc=0x17010252, mode=2) returned 1
	[0097.120] MoveToEx (in: hdc=0x17010252, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0097.120] SelectObject (hdc=0x17010252, h=0x1b00017) returned 0x2030022a
	[0097.120] DeleteObject (ho=0x2030022a) returned 1
	[0097.120] RestoreDC (hdc=0x17010252, nSavedDC=-1) returned 1
	[0097.120] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.120] GdipReleaseDC (graphics=0x1b927100, hdc=0x17010252) returned 0x0
	[0097.120] GdipGetDC (graphics=0x1b927100, hdc=0x20c290) returned 0x0
	[0097.120] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x17010252, x1=0, y1=0, rop=0xcc0020) returned 1
	[0097.120] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.120] GdipReleaseDC (graphics=0x1b927100, hdc=0x17010252) returned 0x0
	[0097.120] SelectObject (hdc=0x17010252, h=0x185000f) returned 0x140507d2
	[0097.120] DeleteDC (hdc=0x17010252) returned 1
	[0097.120] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0097.121] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0097.121] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0097.121] EndPaint (hWnd=0x201d8, lpPaint=0x20c398) returned 1
	[0097.121] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x266fb18, cPoints=0x1 | out: lpPoints=0x266fb18) returned 30606029
	[0097.121] WindowFromPoint (Point=0x1ea00000340) returned 0x201d8
	[0097.121] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.121] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0097.121] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0097.122] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1b096060
	[0097.122] RtlMoveMemory (in: Destination=0x1b096060, Source=0x266fc08, Length=0x70 | out: Destination=0x1b096060) 
	[0097.122] ShellExecuteExW (in: pExecInfo=0x266fe18*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x266fe18*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0097.254] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x3e0, wParam=0x201e0, lParam=0xffffffffc17ac17b) returned 0x0
	[0097.361] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x3e0, wParam=0x201e0, lParam=0xffffffffc17ac17b) returned 0x0
	[0097.361] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x3e0, wParam=0x201e0, lParam=0xffffffffc17ac17b) returned 0x0
	[0097.373] LocalFree (hMem=0x1b096060) returned 0x0
	[0097.373] GetCapture () returned 0x201d8
	[0097.373] ReleaseCapture () returned 1
	[0097.373] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0097.373] LocalFree (hMem=0x1afe53a0) returned 0x0
	[0097.373] GetCapture () returned 0x0
	[0097.373] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.373] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.373] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.373] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.373] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.373] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.373] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.373] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.373] GetKeyState (nVirtKey=1) returned 1
	[0097.373] GetKeyState (nVirtKey=2) returned 0
	[0097.373] GetKeyState (nVirtKey=4) returned 0
	[0097.373] GetKeyState (nVirtKey=5) returned 0
	[0097.374] GetKeyState (nVirtKey=6) returned 0
	[0097.374] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.374] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.374] WaitMessage () returned 1
	[0097.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.472] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.472] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.472] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.472] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.472] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.473] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.473] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.473] GetKeyState (nVirtKey=1) returned 1
	[0097.473] GetKeyState (nVirtKey=2) returned 0
	[0097.473] GetKeyState (nVirtKey=4) returned 0
	[0097.473] GetKeyState (nVirtKey=5) returned 0
	[0097.473] GetKeyState (nVirtKey=6) returned 0
	[0097.473] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.473] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.473] WaitMessage () returned 1
	[0097.475] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.475] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.475] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.475] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.475] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.475] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.475] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.475] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.475] GetKeyState (nVirtKey=1) returned 1
	[0097.475] GetKeyState (nVirtKey=2) returned 0
	[0097.475] GetKeyState (nVirtKey=4) returned 0
	[0097.475] GetKeyState (nVirtKey=5) returned 0
	[0097.475] GetKeyState (nVirtKey=6) returned 0
	[0097.475] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.475] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.476] WaitMessage () returned 1
	[0097.477] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.477] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.477] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.477] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.477] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.477] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.477] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.477] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.477] GetKeyState (nVirtKey=1) returned 1
	[0097.477] GetKeyState (nVirtKey=2) returned 0
	[0097.477] GetKeyState (nVirtKey=4) returned 0
	[0097.477] GetKeyState (nVirtKey=5) returned 0
	[0097.477] GetKeyState (nVirtKey=6) returned 0
	[0097.477] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.477] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.477] WaitMessage () returned 1
	[0097.483] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.483] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.483] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.483] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.483] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.483] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.483] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.484] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.484] GetKeyState (nVirtKey=1) returned 1
	[0097.484] GetKeyState (nVirtKey=2) returned 0
	[0097.484] GetKeyState (nVirtKey=4) returned 0
	[0097.484] GetKeyState (nVirtKey=5) returned 0
	[0097.484] GetKeyState (nVirtKey=6) returned 0
	[0097.484] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.484] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.484] WaitMessage () returned 1
	[0097.496] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.496] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.496] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.496] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.496] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.496] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.496] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.496] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.496] GetKeyState (nVirtKey=1) returned 1
	[0097.496] GetKeyState (nVirtKey=2) returned 0
	[0097.496] GetKeyState (nVirtKey=4) returned 0
	[0097.496] GetKeyState (nVirtKey=5) returned 0
	[0097.496] GetKeyState (nVirtKey=6) returned 0
	[0097.496] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.496] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.496] WaitMessage () returned 1
	[0097.525] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.525] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.525] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.525] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.525] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.525] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.525] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.525] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.525] GetKeyState (nVirtKey=1) returned 1
	[0097.525] GetKeyState (nVirtKey=2) returned 0
	[0097.525] GetKeyState (nVirtKey=4) returned 0
	[0097.525] GetKeyState (nVirtKey=5) returned 0
	[0097.525] GetKeyState (nVirtKey=6) returned 0
	[0097.525] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.525] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.525] WaitMessage () returned 1
	[0097.526] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.526] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.526] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.526] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.526] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.526] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.526] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.526] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.526] GetKeyState (nVirtKey=1) returned 1
	[0097.526] GetKeyState (nVirtKey=2) returned 0
	[0097.526] GetKeyState (nVirtKey=4) returned 0
	[0097.526] GetKeyState (nVirtKey=5) returned 0
	[0097.526] GetKeyState (nVirtKey=6) returned 0
	[0097.526] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.526] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.526] WaitMessage () returned 1
	[0097.527] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.527] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.527] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.527] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.527] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.527] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.527] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.527] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.527] GetKeyState (nVirtKey=1) returned 1
	[0097.527] GetKeyState (nVirtKey=2) returned 0
	[0097.527] GetKeyState (nVirtKey=4) returned 0
	[0097.527] GetKeyState (nVirtKey=5) returned 0
	[0097.527] GetKeyState (nVirtKey=6) returned 0
	[0097.527] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.527] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.527] WaitMessage () returned 1
	[0097.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.528] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.528] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.528] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.528] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.528] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.528] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.528] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.528] GetKeyState (nVirtKey=1) returned 1
	[0097.528] GetKeyState (nVirtKey=2) returned 0
	[0097.528] GetKeyState (nVirtKey=4) returned 0
	[0097.528] GetKeyState (nVirtKey=5) returned 0
	[0097.528] GetKeyState (nVirtKey=6) returned 0
	[0097.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.528] WaitMessage () returned 1
	[0097.530] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.530] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.530] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.530] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.530] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.530] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.530] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.530] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.530] GetKeyState (nVirtKey=1) returned 1
	[0097.530] GetKeyState (nVirtKey=2) returned 0
	[0097.530] GetKeyState (nVirtKey=4) returned 0
	[0097.530] GetKeyState (nVirtKey=5) returned 0
	[0097.530] GetKeyState (nVirtKey=6) returned 0
	[0097.530] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.530] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.530] WaitMessage () returned 1
	[0097.539] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.539] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.539] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.539] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.539] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.539] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.539] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.539] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.539] GetKeyState (nVirtKey=1) returned 1
	[0097.539] GetKeyState (nVirtKey=2) returned 0
	[0097.539] GetKeyState (nVirtKey=4) returned 0
	[0097.539] GetKeyState (nVirtKey=5) returned 0
	[0097.539] GetKeyState (nVirtKey=6) returned 0
	[0097.539] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.539] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.539] WaitMessage () returned 1
	[0097.540] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.540] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.540] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.540] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.540] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.540] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.540] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.540] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.540] GetKeyState (nVirtKey=1) returned 1
	[0097.540] GetKeyState (nVirtKey=2) returned 0
	[0097.540] GetKeyState (nVirtKey=4) returned 0
	[0097.540] GetKeyState (nVirtKey=5) returned 0
	[0097.540] GetKeyState (nVirtKey=6) returned 0
	[0097.540] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.540] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.540] WaitMessage () returned 1
	[0097.541] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.541] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.541] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.541] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.541] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.542] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.542] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.542] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.542] GetKeyState (nVirtKey=1) returned 1
	[0097.542] GetKeyState (nVirtKey=2) returned 0
	[0097.542] GetKeyState (nVirtKey=4) returned 0
	[0097.542] GetKeyState (nVirtKey=5) returned 0
	[0097.542] GetKeyState (nVirtKey=6) returned 0
	[0097.542] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.542] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.542] WaitMessage () returned 1
	[0097.542] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.542] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.542] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.542] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.542] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.542] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.543] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.543] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.543] GetKeyState (nVirtKey=1) returned 1
	[0097.543] GetKeyState (nVirtKey=2) returned 0
	[0097.543] GetKeyState (nVirtKey=4) returned 0
	[0097.543] GetKeyState (nVirtKey=5) returned 0
	[0097.543] GetKeyState (nVirtKey=6) returned 0
	[0097.543] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.543] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.543] WaitMessage () returned 1
	[0097.544] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.544] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.545] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.545] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.545] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.545] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.545] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.545] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.545] GetKeyState (nVirtKey=1) returned 1
	[0097.545] GetKeyState (nVirtKey=2) returned 0
	[0097.545] GetKeyState (nVirtKey=4) returned 0
	[0097.545] GetKeyState (nVirtKey=5) returned 0
	[0097.545] GetKeyState (nVirtKey=6) returned 0
	[0097.545] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.545] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.545] WaitMessage () returned 1
	[0097.546] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.546] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.546] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.546] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.546] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.546] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.546] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.546] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.546] GetKeyState (nVirtKey=1) returned 1
	[0097.546] GetKeyState (nVirtKey=2) returned 0
	[0097.546] GetKeyState (nVirtKey=4) returned 0
	[0097.546] GetKeyState (nVirtKey=5) returned 0
	[0097.546] GetKeyState (nVirtKey=6) returned 0
	[0097.546] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.546] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.546] WaitMessage () returned 1
	[0097.546] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.546] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.546] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.547] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.547] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.547] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.547] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.547] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.547] GetKeyState (nVirtKey=1) returned 1
	[0097.547] GetKeyState (nVirtKey=2) returned 0
	[0097.547] GetKeyState (nVirtKey=4) returned 0
	[0097.547] GetKeyState (nVirtKey=5) returned 0
	[0097.547] GetKeyState (nVirtKey=6) returned 0
	[0097.547] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.547] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.547] WaitMessage () returned 1
	[0097.549] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.549] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.549] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.549] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.549] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.549] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.549] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.549] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.549] GetKeyState (nVirtKey=1) returned 1
	[0097.549] GetKeyState (nVirtKey=2) returned 0
	[0097.549] GetKeyState (nVirtKey=4) returned 0
	[0097.549] GetKeyState (nVirtKey=5) returned 0
	[0097.549] GetKeyState (nVirtKey=6) returned 0
	[0097.549] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.549] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.549] WaitMessage () returned 1
	[0097.550] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.550] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.550] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.550] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.550] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.550] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.550] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.550] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.550] GetKeyState (nVirtKey=1) returned 1
	[0097.550] GetKeyState (nVirtKey=2) returned 0
	[0097.550] GetKeyState (nVirtKey=4) returned 0
	[0097.550] GetKeyState (nVirtKey=5) returned 0
	[0097.550] GetKeyState (nVirtKey=6) returned 0
	[0097.550] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.550] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.550] WaitMessage () returned 1
	[0097.551] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.551] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.551] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.551] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.551] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.551] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.551] GetKeyState (nVirtKey=1) returned 1
	[0097.551] GetKeyState (nVirtKey=2) returned 0
	[0097.551] GetKeyState (nVirtKey=4) returned 0
	[0097.551] GetKeyState (nVirtKey=5) returned 0
	[0097.551] GetKeyState (nVirtKey=6) returned 0
	[0097.551] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.551] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.551] WaitMessage () returned 1
	[0097.565] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.566] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.566] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.566] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.566] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.566] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.566] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.566] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.566] GetKeyState (nVirtKey=1) returned 1
	[0097.566] GetKeyState (nVirtKey=2) returned 0
	[0097.566] GetKeyState (nVirtKey=4) returned 0
	[0097.566] GetKeyState (nVirtKey=5) returned 0
	[0097.566] GetKeyState (nVirtKey=6) returned 0
	[0097.566] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.566] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.566] WaitMessage () returned 1
	[0097.566] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.566] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.567] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.567] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.567] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.567] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.567] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.567] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.567] GetKeyState (nVirtKey=1) returned 1
	[0097.567] GetKeyState (nVirtKey=2) returned 0
	[0097.567] GetKeyState (nVirtKey=4) returned 0
	[0097.567] GetKeyState (nVirtKey=5) returned 0
	[0097.567] GetKeyState (nVirtKey=6) returned 0
	[0097.567] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.567] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.567] WaitMessage () returned 1
	[0097.567] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.567] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.567] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.567] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.567] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.568] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.568] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.568] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.568] GetKeyState (nVirtKey=1) returned 1
	[0097.568] GetKeyState (nVirtKey=2) returned 0
	[0097.568] GetKeyState (nVirtKey=4) returned 0
	[0097.568] GetKeyState (nVirtKey=5) returned 0
	[0097.568] GetKeyState (nVirtKey=6) returned 0
	[0097.568] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.568] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.568] WaitMessage () returned 1
	[0097.568] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.568] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.568] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.568] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.568] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.568] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.568] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.568] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.568] GetKeyState (nVirtKey=1) returned 1
	[0097.568] GetKeyState (nVirtKey=2) returned 0
	[0097.569] GetKeyState (nVirtKey=4) returned 0
	[0097.569] GetKeyState (nVirtKey=5) returned 0
	[0097.569] GetKeyState (nVirtKey=6) returned 0
	[0097.569] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.569] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.569] WaitMessage () returned 1
	[0097.569] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.569] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.569] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.569] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.569] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.570] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.570] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.570] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.570] GetKeyState (nVirtKey=1) returned 1
	[0097.570] GetKeyState (nVirtKey=2) returned 0
	[0097.570] GetKeyState (nVirtKey=4) returned 0
	[0097.570] GetKeyState (nVirtKey=5) returned 0
	[0097.570] GetKeyState (nVirtKey=6) returned 0
	[0097.570] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.570] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.570] WaitMessage () returned 1
	[0097.571] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.571] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.571] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.571] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.571] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.571] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.571] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.571] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.571] GetKeyState (nVirtKey=1) returned 1
	[0097.571] GetKeyState (nVirtKey=2) returned 0
	[0097.571] GetKeyState (nVirtKey=4) returned 0
	[0097.571] GetKeyState (nVirtKey=5) returned 0
	[0097.571] GetKeyState (nVirtKey=6) returned 0
	[0097.571] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.571] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.571] WaitMessage () returned 1
	[0097.572] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.572] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.572] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.572] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.572] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.572] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.572] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.572] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.572] GetKeyState (nVirtKey=1) returned 1
	[0097.572] GetKeyState (nVirtKey=2) returned 0
	[0097.572] GetKeyState (nVirtKey=4) returned 0
	[0097.572] GetKeyState (nVirtKey=5) returned 0
	[0097.572] GetKeyState (nVirtKey=6) returned 0
	[0097.572] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.572] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.572] WaitMessage () returned 1
	[0097.573] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.573] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.573] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.573] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.573] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.573] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.573] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.573] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.573] GetKeyState (nVirtKey=1) returned 1
	[0097.573] GetKeyState (nVirtKey=2) returned 0
	[0097.573] GetKeyState (nVirtKey=4) returned 0
	[0097.573] GetKeyState (nVirtKey=5) returned 0
	[0097.573] GetKeyState (nVirtKey=6) returned 0
	[0097.573] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.573] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.573] WaitMessage () returned 1
	[0097.574] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.574] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.574] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.574] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.574] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.574] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.574] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.574] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.574] GetKeyState (nVirtKey=1) returned 1
	[0097.574] GetKeyState (nVirtKey=2) returned 0
	[0097.574] GetKeyState (nVirtKey=4) returned 0
	[0097.574] GetKeyState (nVirtKey=5) returned 0
	[0097.574] GetKeyState (nVirtKey=6) returned 0
	[0097.574] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.574] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.574] WaitMessage () returned 1
	[0097.575] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.575] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.575] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.575] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.575] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.575] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.575] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.575] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.575] GetKeyState (nVirtKey=1) returned 1
	[0097.575] GetKeyState (nVirtKey=2) returned 0
	[0097.575] GetKeyState (nVirtKey=4) returned 0
	[0097.575] GetKeyState (nVirtKey=5) returned 0
	[0097.575] GetKeyState (nVirtKey=6) returned 0
	[0097.575] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.575] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.575] WaitMessage () returned 1
	[0097.575] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.575] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.576] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.576] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.576] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.576] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.576] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.576] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.576] GetKeyState (nVirtKey=1) returned 1
	[0097.576] GetKeyState (nVirtKey=2) returned 0
	[0097.576] GetKeyState (nVirtKey=4) returned 0
	[0097.576] GetKeyState (nVirtKey=5) returned 0
	[0097.576] GetKeyState (nVirtKey=6) returned 0
	[0097.576] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.576] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.576] WaitMessage () returned 1
	[0097.576] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.577] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.577] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.577] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.577] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.577] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.577] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.577] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.577] GetKeyState (nVirtKey=1) returned 1
	[0097.577] GetKeyState (nVirtKey=2) returned 0
	[0097.577] GetKeyState (nVirtKey=4) returned 0
	[0097.577] GetKeyState (nVirtKey=5) returned 0
	[0097.577] GetKeyState (nVirtKey=6) returned 0
	[0097.577] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.577] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.577] WaitMessage () returned 1
	[0097.578] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.578] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.578] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.578] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.578] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.578] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.578] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.578] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.578] GetKeyState (nVirtKey=1) returned 1
	[0097.578] GetKeyState (nVirtKey=2) returned 0
	[0097.578] GetKeyState (nVirtKey=4) returned 0
	[0097.578] GetKeyState (nVirtKey=5) returned 0
	[0097.578] GetKeyState (nVirtKey=6) returned 0
	[0097.578] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.578] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.578] WaitMessage () returned 1
	[0097.578] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.578] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.579] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.579] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.579] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.579] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.579] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.579] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.579] GetKeyState (nVirtKey=1) returned 1
	[0097.579] GetKeyState (nVirtKey=2) returned 0
	[0097.579] GetKeyState (nVirtKey=4) returned 0
	[0097.579] GetKeyState (nVirtKey=5) returned 0
	[0097.579] GetKeyState (nVirtKey=6) returned 0
	[0097.579] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.579] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.579] WaitMessage () returned 1
	[0097.579] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.579] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.579] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.579] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.579] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.580] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.580] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.580] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.580] GetKeyState (nVirtKey=1) returned 1
	[0097.580] GetKeyState (nVirtKey=2) returned 0
	[0097.580] GetKeyState (nVirtKey=4) returned 0
	[0097.580] GetKeyState (nVirtKey=5) returned 0
	[0097.580] GetKeyState (nVirtKey=6) returned 0
	[0097.580] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.580] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.580] WaitMessage () returned 1
	[0097.580] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.580] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.580] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.580] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.580] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.581] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.581] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.581] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.581] GetKeyState (nVirtKey=1) returned 1
	[0097.581] GetKeyState (nVirtKey=2) returned 0
	[0097.581] GetKeyState (nVirtKey=4) returned 0
	[0097.581] GetKeyState (nVirtKey=5) returned 0
	[0097.581] GetKeyState (nVirtKey=6) returned 0
	[0097.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.581] WaitMessage () returned 1
	[0097.584] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.584] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.584] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.584] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.584] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.584] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.584] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.584] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.584] GetKeyState (nVirtKey=1) returned 1
	[0097.584] GetKeyState (nVirtKey=2) returned 0
	[0097.584] GetKeyState (nVirtKey=4) returned 0
	[0097.584] GetKeyState (nVirtKey=5) returned 0
	[0097.584] GetKeyState (nVirtKey=6) returned 0
	[0097.585] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.585] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.585] WaitMessage () returned 1
	[0097.599] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.599] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.599] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.599] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.599] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.599] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.599] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.600] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.600] GetKeyState (nVirtKey=1) returned 1
	[0097.600] GetKeyState (nVirtKey=2) returned 0
	[0097.600] GetKeyState (nVirtKey=4) returned 0
	[0097.600] GetKeyState (nVirtKey=5) returned 0
	[0097.600] GetKeyState (nVirtKey=6) returned 0
	[0097.600] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.600] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.600] WaitMessage () returned 1
	[0097.600] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.600] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.600] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.600] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.600] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.600] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.600] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.600] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.600] GetKeyState (nVirtKey=1) returned 1
	[0097.600] GetKeyState (nVirtKey=2) returned 0
	[0097.600] GetKeyState (nVirtKey=4) returned 0
	[0097.600] GetKeyState (nVirtKey=5) returned 0
	[0097.600] GetKeyState (nVirtKey=6) returned 0
	[0097.601] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.601] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.601] WaitMessage () returned 1
	[0097.601] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.601] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.601] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.601] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.601] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.601] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.601] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.601] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.601] GetKeyState (nVirtKey=1) returned 1
	[0097.601] GetKeyState (nVirtKey=2) returned 0
	[0097.602] GetKeyState (nVirtKey=4) returned 0
	[0097.602] GetKeyState (nVirtKey=5) returned 0
	[0097.602] GetKeyState (nVirtKey=6) returned 0
	[0097.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.602] WaitMessage () returned 1
	[0097.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.602] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.602] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.602] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.603] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.603] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.603] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.603] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.603] GetKeyState (nVirtKey=1) returned 1
	[0097.603] GetKeyState (nVirtKey=2) returned 0
	[0097.603] GetKeyState (nVirtKey=4) returned 0
	[0097.603] GetKeyState (nVirtKey=5) returned 0
	[0097.603] GetKeyState (nVirtKey=6) returned 0
	[0097.603] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.603] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.603] WaitMessage () returned 1
	[0097.603] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.603] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.603] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.603] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.603] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.603] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.604] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.604] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.604] GetKeyState (nVirtKey=1) returned 1
	[0097.604] GetKeyState (nVirtKey=2) returned 0
	[0097.604] GetKeyState (nVirtKey=4) returned 0
	[0097.604] GetKeyState (nVirtKey=5) returned 0
	[0097.604] GetKeyState (nVirtKey=6) returned 0
	[0097.604] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.604] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.604] WaitMessage () returned 1
	[0097.604] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.604] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.604] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.604] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.604] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.604] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.604] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.604] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.604] GetKeyState (nVirtKey=1) returned 1
	[0097.605] GetKeyState (nVirtKey=2) returned 0
	[0097.605] GetKeyState (nVirtKey=4) returned 0
	[0097.605] GetKeyState (nVirtKey=5) returned 0
	[0097.605] GetKeyState (nVirtKey=6) returned 0
	[0097.605] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.605] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.605] WaitMessage () returned 1
	[0097.605] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.605] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.605] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.605] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.605] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.606] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.606] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.606] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.606] GetKeyState (nVirtKey=1) returned 1
	[0097.606] GetKeyState (nVirtKey=2) returned 0
	[0097.606] GetKeyState (nVirtKey=4) returned 0
	[0097.606] GetKeyState (nVirtKey=5) returned 0
	[0097.606] GetKeyState (nVirtKey=6) returned 0
	[0097.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.606] WaitMessage () returned 1
	[0097.608] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.608] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.608] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.608] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.608] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.608] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.608] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.608] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.608] GetKeyState (nVirtKey=1) returned 1
	[0097.608] GetKeyState (nVirtKey=2) returned 0
	[0097.608] GetKeyState (nVirtKey=4) returned 0
	[0097.608] GetKeyState (nVirtKey=5) returned 0
	[0097.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.609] WaitMessage () returned 1
	[0097.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.609] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.609] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.609] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.609] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.609] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.609] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.609] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.610] WaitMessage () returned 1
	[0097.610] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.610] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.610] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.610] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.610] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.610] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.610] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.610] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.610] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.610] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.611] WaitMessage () returned 1
	[0097.657] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.657] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.657] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.657] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.657] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.657] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.657] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.657] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.657] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.657] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.657] WaitMessage () returned 1
	[0097.660] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.660] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.660] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.660] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.660] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.660] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.660] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.660] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.660] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.660] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.660] WaitMessage () returned 1
	[0097.661] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.661] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.661] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.661] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.661] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.661] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.661] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.661] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.662] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.662] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.662] WaitMessage () returned 1
	[0097.662] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.662] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.662] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.662] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.662] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.662] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.662] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.662] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.663] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.663] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.663] WaitMessage () returned 1
	[0097.663] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.663] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.663] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.663] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.663] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.663] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.663] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.663] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.664] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.664] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.664] WaitMessage () returned 1
	[0097.664] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.664] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.664] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.664] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.664] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.664] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.664] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.664] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.664] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.664] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.664] WaitMessage () returned 1
	[0097.665] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.665] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.665] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.665] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.665] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.665] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.665] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.665] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.665] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.665] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.665] WaitMessage () returned 1
	[0097.666] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.666] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.666] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.666] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.666] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.666] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.666] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.666] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.666] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.666] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.666] WaitMessage () returned 1
	[0097.667] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.667] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.667] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.667] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.667] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.667] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.667] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.667] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.667] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.667] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.667] WaitMessage () returned 1
	[0097.668] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.668] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.668] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.668] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.668] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.668] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.669] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.669] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.669] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.669] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.669] WaitMessage () returned 1
	[0097.669] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.669] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.669] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.669] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.669] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.669] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.670] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.670] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.670] WaitMessage () returned 1
	[0097.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.670] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.670] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0097.670] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0097.670] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.670] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.670] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0097.670] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0097.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.670] WaitMessage () returned 1
	[0097.671] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.671] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.671] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.671] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.671] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.671] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.671] WaitMessage () returned 1
	[0097.860] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.860] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.860] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.860] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.860] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.861] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.861] WaitMessage () returned 1
	[0097.863] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.864] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.864] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.864] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.864] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.864] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.864] WaitMessage () returned 1
	[0097.868] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.868] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.868] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.868] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.868] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.868] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.868] WaitMessage () returned 1
	[0097.874] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.874] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.874] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.874] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.874] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.874] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.874] WaitMessage () returned 1
	[0097.875] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.875] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.875] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.875] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.875] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.875] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.875] WaitMessage () returned 1
	[0097.876] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.876] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.876] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.876] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.876] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.876] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.876] WaitMessage () returned 1
	[0097.876] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.876] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.876] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.877] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.877] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.877] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.877] WaitMessage () returned 1
	[0097.878] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.878] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.878] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.878] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.878] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.878] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.878] WaitMessage () returned 1
	[0097.879] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.879] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.879] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.879] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.879] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.879] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.879] WaitMessage () returned 1
	[0097.880] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.880] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.880] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.880] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.880] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.880] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.880] WaitMessage () returned 1
	[0097.897] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.897] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.897] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.897] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.897] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.897] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.897] WaitMessage () returned 1
	[0097.898] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0097.898] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.898] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0097.898] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0097.898] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.898] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0097.898] WaitMessage () returned 1
	[0098.269] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.269] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.269] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.269] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.270] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.270] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.270] WaitMessage () returned 1
	[0098.270] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.270] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.270] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.270] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.270] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.270] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.270] WaitMessage () returned 1
	[0098.271] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.271] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.271] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.271] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.271] WaitMessage () returned 1
	[0098.271] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.271] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.271] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.272] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.272] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.272] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.272] WaitMessage () returned 1
	[0098.273] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.273] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.273] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.273] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.273] WaitMessage () returned 1
	[0098.274] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.274] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.274] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.274] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.274] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.274] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.274] WaitMessage () returned 1
	[0098.274] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.274] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.274] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.274] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.275] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.275] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.275] WaitMessage () returned 1
	[0098.275] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.275] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.275] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.275] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.275] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.275] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.275] WaitMessage () returned 1
	[0098.276] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.276] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.276] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.276] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.276] WaitMessage () returned 1
	[0098.277] PeekMessageW (lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) 
	[0098.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.277] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0098.277] WaitMessage () returned 1
	[0098.278] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.278] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.278] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.278] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.278] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.278] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.279] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.279] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.279] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.279] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.279] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.280] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.281] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.281] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.281] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.281] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.281] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.281] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.282] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.282] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.282] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.283] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.283] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.283] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.285] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.285] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.285] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.285] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.285] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.285] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.286] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.287] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.287] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.287] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.287] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.287] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.288] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.288] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.288] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.289] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.290] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1ea0340) returned 0x1
	[0098.290] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0098.293] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) 
	[0098.294] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0098.294] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0098.294] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0098.297] GetCapture () returned 0x0
	[0098.297] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0098.298] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0098.298] CreateCompatibleDC (hdc=0x4010280) returned 0xd0108c2
	[0098.298] SelectObject (hdc=0xd0108c2, h=0x140507d2) returned 0x185000f
	[0098.298] GdipCreateFromHDC (hdc=0xd0108c2, graphics=0x20d7e0) returned 0x0
	[0098.298] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0098.298] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0098.298] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0098.298] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0098.298] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0098.298] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0098.298] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.298] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.298] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.298] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0098.298] GdipCreateRegion (region=0x20d910) returned 0x0
	[0098.299] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0098.299] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0098.299] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0098.299] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd610dbd) returned 0x0
	[0098.299] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.299] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0098.299] GdipGetDC (graphics=0x1b927100, hdc=0x20cdf0) returned 0x0
	[0098.299] GetCurrentObject (hdc=0xd0108c2, type=0x1) returned 0x1b00017
	[0098.299] GetCurrentObject (hdc=0xd0108c2, type=0x2) returned 0x1900010
	[0098.299] GetCurrentObject (hdc=0xd0108c2, type=0x7) returned 0x140507d2
	[0098.299] GetCurrentObject (hdc=0xd0108c2, type=0x6) returned 0x18a002e
	[0098.299] SaveDC (hdc=0xd0108c2) returned 1
	[0098.299] GetNearestColor (hdc=0xd0108c2, color=0xf0f0f0) returned 0xf0f0f0
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0xa0a0a0) returned 0xa0a0a0
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0x696969) returned 0x696969
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0xa0a0a0) returned 0xa0a0a0
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0x0) returned 0x0
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0xffffff) returned 0xffffff
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0xe5e5e5) returned 0xe5e5e5
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0xd8d8d8) returned 0xd8d8d8
	[0098.300] GetNearestColor (hdc=0xd0108c2, color=0x0) returned 0x0
	[0098.300] RestoreDC (hdc=0xd0108c2, nSavedDC=-1) returned 1
	[0098.300] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.300] GdipReleaseDC (graphics=0x1b927100, hdc=0xd0108c2) returned 0x0
	[0098.301] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0098.301] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0098.301] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.301] CoTaskMemFree (pv=0x1b067580) 
	[0098.301] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0098.301] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.301] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.301] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0098.301] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0098.301] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0098.301] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0098.301] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0098.301] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0098.301] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.301] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0098.301] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0098.301] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0098.302] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.302] CoTaskMemFree (pv=0x1b067580) 
	[0098.302] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0098.302] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0098.302] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0098.302] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0098.302] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0098.302] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.302] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.302] GdipMeasureString (graphics=0x1b495ce0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0098.302] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.302] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0098.302] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.302] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0098.302] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0098.302] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0098.302] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.302] CoTaskMemFree (pv=0x1b067580) 
	[0098.303] GdipCreateRegion (region=0x20d120) returned 0x0
	[0098.303] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0098.303] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0098.303] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0098.303] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0098.303] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0098.303] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0098.303] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.303] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0098.303] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0098.303] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.303] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.303] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0098.303] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d1d0) returned 0x0
	[0098.303] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d190) returned 0x0
	[0098.303] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d190) returned 0x0
	[0098.303] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.303] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0098.303] GdipGetDC (graphics=0x1b927100, hdc=0x20d200) returned 0x0
	[0098.303] GetCurrentObject (hdc=0xd0108c2, type=0x1) returned 0x1b00017
	[0098.303] GetCurrentObject (hdc=0xd0108c2, type=0x2) returned 0x1900010
	[0098.303] GetCurrentObject (hdc=0xd0108c2, type=0x7) returned 0x140507d2
	[0098.304] GetCurrentObject (hdc=0xd0108c2, type=0x6) returned 0x18a002e
	[0098.304] SaveDC (hdc=0xd0108c2) returned 1
	[0098.304] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3e040710
	[0098.304] GetClipRgn (hdc=0xd0108c2, hrgn=0x3e040710) returned 0
	[0098.304] SelectClipRgn (hdc=0xd0108c2, hrgn=0x450407f9) returned 2
	[0098.304] DeleteObject (ho=0x3e040710) returned 1
	[0098.304] DeleteObject (ho=0x450407f9) returned 1
	[0098.304] OffsetViewportOrgEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x2672f80 | out: lppt=0x2672f80) returned 1
	[0098.304] GetNearestColor (hdc=0xd0108c2, color=0xf0f0f0) returned 0xf0f0f0
	[0098.304] CreateSolidBrush (color=0xf0f0f0) returned 0x221007c0
	[0098.304] FillRect (hDC=0xd0108c2, lprc=0x20d1d0, hbr=0x221007c0) returned 1
	[0098.304] DeleteObject (ho=0x221007c0) returned 1
	[0098.304] RestoreDC (hdc=0xd0108c2, nSavedDC=-1) returned 1
	[0098.304] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.304] GdipReleaseDC (graphics=0x1b927100, hdc=0xd0108c2) returned 0x0
	[0098.305] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0098.305] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0098.305] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.305] CoTaskMemFree (pv=0x1b067580) 
	[0098.305] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0098.305] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.305] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.305] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0098.305] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0098.305] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0098.305] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.305] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0098.305] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.305] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0098.306] GetFocus () returned 0x0
	[0098.306] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0098.306] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0098.306] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.306] CoTaskMemFree (pv=0x1b067580) 
	[0098.306] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0098.306] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0098.306] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.306] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0098.306] GdipCreateRegion (region=0x20d070) returned 0x0
	[0098.306] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0098.306] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0098.306] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0098.306] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0098.306] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0098.307] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.307] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.307] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0098.307] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.307] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.307] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.307] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0098.307] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d120) returned 0x0
	[0098.307] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d0e0) returned 0x0
	[0098.311] GdipGetRegionHRgn (region=0x1b94fc50, graphics=0x1b927100, hRgn=0x20d0e0) returned 0x0
	[0098.311] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.311] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0098.311] GdipGetDC (graphics=0x1b927100, hdc=0x20d150) returned 0x0
	[0098.311] GetCurrentObject (hdc=0xd0108c2, type=0x1) returned 0x1b00017
	[0098.311] GetCurrentObject (hdc=0xd0108c2, type=0x2) returned 0x1900010
	[0098.311] GetCurrentObject (hdc=0xd0108c2, type=0x7) returned 0x140507d2
	[0098.311] GetCurrentObject (hdc=0xd0108c2, type=0x6) returned 0x18a002e
	[0098.311] SaveDC (hdc=0xd0108c2) returned 1
	[0098.311] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x460407f9
	[0098.311] GetClipRgn (hdc=0xd0108c2, hrgn=0x460407f9) returned 0
	[0098.311] SelectClipRgn (hdc=0xd0108c2, hrgn=0x3f040710) returned 2
	[0098.311] DeleteObject (ho=0x460407f9) returned 1
	[0098.311] DeleteObject (ho=0x3f040710) returned 1
	[0098.311] OffsetViewportOrgEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x2673520 | out: lppt=0x2673520) returned 1
	[0098.311] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.311] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.311] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.311] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x83008ca
	[0098.312] SelectObject (hdc=0xd0108c2, h=0x83008ca) returned 0x1b00017
	[0098.312] MoveToEx (in: hdc=0xd0108c2, x=164, y=1, lppt=0x2673588 | out: lppt=0x2673588) returned 1
	[0098.312] LineTo (hdc=0xd0108c2, x=1, y=1) returned 1
	[0098.312] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.312] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.312] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.312] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.312] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.312] SelectObject (hdc=0xd0108c2, h=0x83008ca) returned 0x83008ca
	[0098.312] MoveToEx (in: hdc=0xd0108c2, x=1, y=1, lppt=0x26735a0 | out: lppt=0x26735a0) returned 1
	[0098.312] LineTo (hdc=0xd0108c2, x=1, y=41) returned 1
	[0098.312] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.312] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.312] SelectObject (hdc=0xd0108c2, h=0x1b00017) returned 0x83008ca
	[0098.312] DeleteObject (ho=0x83008ca) returned 1
	[0098.312] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.312] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.312] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.312] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xc3008c5
	[0098.312] SelectObject (hdc=0xd0108c2, h=0xc3008c5) returned 0x1b00017
	[0098.312] MoveToEx (in: hdc=0xd0108c2, x=1, y=41, lppt=0x2673608 | out: lppt=0x2673608) returned 1
	[0098.312] LineTo (hdc=0xd0108c2, x=164, y=41) returned 1
	[0098.312] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.312] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.312] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.312] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.313] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.313] SelectObject (hdc=0xd0108c2, h=0xc3008c5) returned 0xc3008c5
	[0098.313] MoveToEx (in: hdc=0xd0108c2, x=164, y=41, lppt=0x2673620 | out: lppt=0x2673620) returned 1
	[0098.313] LineTo (hdc=0xd0108c2, x=164, y=0) returned 1
	[0098.313] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.313] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.313] SelectObject (hdc=0xd0108c2, h=0x1b00017) returned 0xc3008c5
	[0098.313] DeleteObject (ho=0xc3008c5) returned 1
	[0098.313] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.313] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.313] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.313] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x93008ca
	[0098.313] SelectObject (hdc=0xd0108c2, h=0x93008ca) returned 0x1b00017
	[0098.313] MoveToEx (in: hdc=0xd0108c2, x=163, y=2, lppt=0x2673688 | out: lppt=0x2673688) returned 1
	[0098.313] LineTo (hdc=0xd0108c2, x=2, y=2) returned 1
	[0098.313] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.313] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.313] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.313] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.313] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.313] SelectObject (hdc=0xd0108c2, h=0x93008ca) returned 0x93008ca
	[0098.313] MoveToEx (in: hdc=0xd0108c2, x=2, y=2, lppt=0x26736a0 | out: lppt=0x26736a0) returned 1
	[0098.313] LineTo (hdc=0xd0108c2, x=2, y=40) returned 1
	[0098.313] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.313] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.313] SelectObject (hdc=0xd0108c2, h=0x1b00017) returned 0x93008ca
	[0098.313] DeleteObject (ho=0x93008ca) returned 1
	[0098.314] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.314] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.314] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.314] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xd3008c5
	[0098.314] SelectObject (hdc=0xd0108c2, h=0xd3008c5) returned 0x1b00017
	[0098.314] MoveToEx (in: hdc=0xd0108c2, x=2, y=40, lppt=0x2673708 | out: lppt=0x2673708) returned 1
	[0098.314] LineTo (hdc=0xd0108c2, x=163, y=40) returned 1
	[0098.314] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.314] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.314] GetROP2 (hdc=0xd0108c2) returned 13
	[0098.314] GetBkMode (hdc=0xd0108c2) returned 2
	[0098.314] SetBkMode (hdc=0xd0108c2, mode=1) returned 2
	[0098.314] SelectObject (hdc=0xd0108c2, h=0xd3008c5) returned 0xd3008c5
	[0098.314] MoveToEx (in: hdc=0xd0108c2, x=163, y=40, lppt=0x2673720 | out: lppt=0x2673720) returned 1
	[0098.314] LineTo (hdc=0xd0108c2, x=163, y=1) returned 1
	[0098.314] SetBkMode (hdc=0xd0108c2, mode=2) returned 1
	[0098.314] MoveToEx (in: hdc=0xd0108c2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0098.314] SelectObject (hdc=0xd0108c2, h=0x1b00017) returned 0xd3008c5
	[0098.314] DeleteObject (ho=0xd3008c5) returned 1
	[0098.314] RestoreDC (hdc=0xd0108c2, nSavedDC=-1) returned 1
	[0098.314] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.314] GdipReleaseDC (graphics=0x1b927100, hdc=0xd0108c2) returned 0x0
	[0098.314] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0098.314] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0xd0108c2, x1=0, y1=0, rop=0xcc0020) returned 1
	[0098.315] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.315] GdipReleaseDC (graphics=0x1b927100, hdc=0xd0108c2) returned 0x0
	[0098.315] SelectObject (hdc=0xd0108c2, h=0x185000f) returned 0x140507d2
	[0098.315] DeleteDC (hdc=0xd0108c2) returned 1
	[0098.315] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.315] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0098.315] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0098.315] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0098.543] CoTaskMemAlloc (cb=0x26) returned 0x1b085770
	[0098.543] GetWindowTextW (hWnd=0x50120, lpString=0x1b085770, nMaxCount=17) 
	[0098.543] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b085770) returned 0x10
	[0098.543] CoTaskMemFree (pv=0x1b085770) 
	[0098.543] GetClientRect (in: hWnd=0x50120, lpRect=0x20dba0 | out: lpRect=0x20dba0) returned 1
	[0098.543] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0098.543] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d770) returned 0x0
	[0098.543] GdipSetPageUnit (graphics=0x1b927100, unit=0x2) returned 0x0
	[0098.543] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0098.543] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0098.543] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d6c0) returned 0x0
	[0098.543] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.543] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0098.543] GdipCreateRegion (region=0x20d660) returned 0x0
	[0098.543] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0098.543] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d690) returned 0x0
	[0098.543] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.544] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0098.544] GdipSaveGraphics (graphics=0x1b927100, state=0x20d760) returned 0x0
	[0098.544] GdipCreateRegion (region=0x20d630) returned 0x0
	[0098.544] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0098.544] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0098.544] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0098.544] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d690) returned 0x0
	[0098.544] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0098.544] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.544] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.544] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.544] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0098.544] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d6e0) returned 0x0
	[0098.544] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.544] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0098.544] GdipGetDC (graphics=0x1b927100, hdc=0x20d710) returned 0x0
	[0098.544] SaveDC (hdc=0x10107f8) returned 1
	[0098.544] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x2673cb0 | out: lppt=0x2673cb0) returned 1
	[0098.544] GetNearestColor (hdc=0x10107f8, color=0xf0f0f0) returned 0xf0f0f0
	[0098.544] CreateSolidBrush (color=0xf0f0f0) returned 0x231007c0
	[0098.545] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.545] GdipReleaseDC (graphics=0x1b927100, hdc=0x10107f8) returned 0x0
	[0098.545] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0098.545] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0098.545] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0098.548] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x105, wParam=0x1b, lParam=0xe0010001) returned 0x0
	[0098.548] GetDIBits (in: hdc=0x4010280, hbm=0x120508e6, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0098.548] GetDIBits (in: hdc=0x4010280, hbm=0x120508e6, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0098.548] DeleteObject (ho=0x120508e6) returned 1
	[0098.548] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x20508e7
	[0098.548] SelectObject (hdc=0x170108e4, h=0x20508e7) returned 0x185000f
	[0098.548] GdipCreateFromHDC (hdc=0x170108e4, graphics=0x20d750) returned 0x0
	[0098.548] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0098.548] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0098.548] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0098.548] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f0d0) returned 0x0
	[0098.548] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0098.548] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0098.549] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.549] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0098.549] GdipCreateRegion (region=0x20d910) returned 0x0
	[0098.549] GdipGetClip (graphics=0x1b927100, region=0x1b94fc50) returned 0x0
	[0098.549] GdipIsInfiniteRegion (region=0x1b94fc50, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0098.549] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0098.549] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0098.549] GetWindowTextW (hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118) 
	[0098.549] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0098.549] CoTaskMemFree (pv=0x1b07f5c0) 
	[0098.549] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0098.549] GdipCreateRegion (region=0x20d400) returned 0x0
	[0098.549] GdipGetClip (graphics=0x1b927100, region=0x1b94fd10) returned 0x0
	[0098.549] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0098.549] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0098.549] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0098.549] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.549] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.549] GdipCombineRegionRegion (region=0x1b94fd10, region2=0x1b94fc50, combineMode=0x1) returned 0x0
	[0098.549] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.549] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.550] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0098.550] GdipIsInfiniteRegion (region=0x1b94fd10, graphics=0x1b927100, result=0x20d4b0) returned 0x0
	[0098.550] GdipIsInfiniteRegion (region=0x1b94fd10, graphics=0x1b927100, result=0x20d470) returned 0x0
	[0098.550] GdipGetRegionHRgn (region=0x1b94fd10, graphics=0x1b927100, hRgn=0x20d470) returned 0x0
	[0098.550] GdipDeleteRegion (region=0x1b94fd10) returned 0x0
	[0098.550] GdipGetDC (graphics=0x1b927100, hdc=0x20d4e0) returned 0x0
	[0098.550] OffsetViewportOrgEx (in: hdc=0x170108e4, x=0, y=0, lppt=0x2675510 | out: lppt=0x2675510) returned 1
	[0098.550] CreateSolidBrush (color=0x0) returned 0x241007c0
	[0098.551] GdipReleaseDC (graphics=0x1b927100, hdc=0x170108e4) returned 0x0
	[0098.551] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd5c0dbd) returned 0x0
	[0098.551] GdipDeleteRegion (region=0x1b94fc50) returned 0x0
	[0098.551] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0098.551] GetWindowTextW (hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118) 
	[0098.551] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0098.551] CoTaskMemFree (pv=0x1b07f5c0) 
	[0098.551] GdipGetDC (graphics=0x1b927100, hdc=0x20d530) returned 0x0
	[0098.551] SaveDC (hdc=0x170108e4) returned 1
	[0098.551] GetNearestColor (hdc=0x170108e4, color=0x80) returned 0x80
	[0098.552] RestoreDC (hdc=0x170108e4, nSavedDC=-1) returned 1
	[0098.552] GdipReleaseDC (graphics=0x1b927100, hdc=0x170108e4) returned 0x0
	[0098.552] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0098.552] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0098.552] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0098.552] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0098.552] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0098.552] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0098.552] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0098.552] GdipDrawString (graphics=0x1b927100, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b94fc50) returned 0x0
	[0098.552] GdipDeleteBrush (brush=0x1b94fc50) returned 0x0
	[0098.552] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0098.552] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0098.552] GdipReleaseDC (graphics=0x1b927100, hdc=0x170108e4) returned 0x0
	[0098.552] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0098.553] GdipCreateFromHDC (hdc=0x60108e2, graphics=0x20d7e0) returned 0x0
	[0098.553] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0098.553] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0098.553] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0098.553] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0098.553] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0098.553] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0098.553] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.553] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0098.553] GdipCreateRegion (region=0x20d910) returned 0x0
	[0098.553] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0098.553] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0098.553] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0098.553] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd5a0dbd) returned 0x0
	[0098.553] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0098.554] GdipGetDC (graphics=0x1b927100, hdc=0x20cdf0) returned 0x0
	[0098.554] GetNearestColor (hdc=0x60108e2, color=0xa0a0a0) returned 0xa0a0a0
	[0098.554] GetNearestColor (hdc=0x60108e2, color=0x696969) returned 0x696969
	[0098.554] GetNearestColor (hdc=0x60108e2, color=0xa0a0a0) returned 0xa0a0a0
	[0098.554] GetNearestColor (hdc=0x60108e2, color=0x0) returned 0x0
	[0098.554] GetNearestColor (hdc=0x60108e2, color=0xffffff) returned 0xffffff
	[0098.554] GetNearestColor (hdc=0x60108e2, color=0xe5e5e5) returned 0xe5e5e5
	[0098.554] GetNearestColor (hdc=0x60108e2, color=0xd8d8d8) returned 0xd8d8d8
	[0098.555] GetNearestColor (hdc=0x60108e2, color=0x0) returned 0x0
	[0098.555] RestoreDC (hdc=0x60108e2, nSavedDC=-1) returned 1
	[0098.555] GdipReleaseDC (graphics=0x1b927100, hdc=0x60108e2) returned 0x0
	[0098.555] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0098.555] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.555] CoTaskMemFree (pv=0x1b0679c0) 
	[0098.555] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0098.555] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.555] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.555] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0098.555] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0098.555] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0098.556] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0098.556] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0098.556] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0098.556] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0098.556] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0098.556] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.556] CoTaskMemFree (pv=0x1b0679c0) 
	[0098.556] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0098.556] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0098.556] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0098.556] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0098.556] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0098.556] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.556] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.556] GdipMeasureString (graphics=0x1b495ce0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0098.557] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0098.557] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0098.557] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0098.557] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.557] CoTaskMemFree (pv=0x1b0679c0) 
	[0098.557] GdipCreateRegion (region=0x20d120) returned 0x0
	[0098.557] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0098.557] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0098.557] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0098.557] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0098.557] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.558] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.558] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.558] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.558] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0098.558] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d1d0) returned 0x0
	[0098.558] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d190) returned 0x0
	[0098.558] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20d190) returned 0x0
	[0098.558] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0098.558] GdipGetDC (graphics=0x1b927100, hdc=0x20d200) returned 0x0
	[0098.558] OffsetViewportOrgEx (in: hdc=0x60108e2, x=0, y=0, lppt=0x2676600 | out: lppt=0x2676600) returned 1
	[0098.558] CreateSolidBrush (color=0xf0f0f0) returned 0x251007c0
	[0098.558] GdipReleaseDC (graphics=0x1b927100, hdc=0x60108e2) returned 0x0
	[0098.558] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0098.559] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.559] CoTaskMemFree (pv=0x1b0679c0) 
	[0098.559] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0098.559] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.559] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0098.559] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0098.559] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0098.559] GdipDrawString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0098.559] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0098.559] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0098.559] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0098.559] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0098.559] CoTaskMemFree (pv=0x1b0679c0) 
	[0098.560] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0098.560] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0098.560] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0098.560] GdipCreateRegion (region=0x20d070) returned 0x0
	[0098.560] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0098.560] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0098.560] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0098.560] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0098.560] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0098.560] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.560] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0098.560] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.560] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0098.560] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d120) returned 0x0
	[0098.560] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d0e0) returned 0x0
	[0098.561] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20d0e0) returned 0x0
	[0098.561] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0098.561] GdipGetDC (graphics=0x1b927100, hdc=0x20d150) returned 0x0
	[0098.561] OffsetViewportOrgEx (in: hdc=0x60108e2, x=0, y=0, lppt=0x2676ba0 | out: lppt=0x2676ba0) returned 1
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x53008e0
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] GetROP2 (hdc=0x60108e2) returned 13
	[0098.561] GdipReleaseDC (graphics=0x1b927100, hdc=0x60108e2) returned 0x0
	[0098.562] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0098.562] GdipReleaseDC (graphics=0x1b927100, hdc=0x60108e2) returned 0x0
	[0098.562] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0098.562] GetDIBits (in: hdc=0x70107fc, hbm=0x70508e0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0098.562] GetDIBits (in: hdc=0x70107fc, hbm=0x70508e0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0098.562] DeleteObject (ho=0x70508e0) returned 1
	[0098.562] CreateDIBSection (in: hdc=0x70107fc, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0x30508e7
	[0098.562] SelectObject (hdc=0x160108e6, h=0x30508e7) returned 0x185000f
	[0098.562] GdipCreateFromHDC (hdc=0x160108e6, graphics=0x20d800) returned 0x0
	[0098.562] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0098.562] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0098.562] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0098.563] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0098.563] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20da20) returned 0x0
	[0098.563] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0098.563] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.563] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0098.563] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0098.563] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0098.563] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d9f0) returned 0x0
	[0098.563] GdipSaveGraphics (graphics=0x1b927100, state=0x20dac0) returned 0x0
	[0098.563] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0098.563] GetWindowTextW (hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1) 
	[0098.563] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0098.563] CoTaskMemFree (pv=0x1b078870) 
	[0098.563] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0098.563] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0098.563] GdipGetClip (graphics=0x1b927100, region=0x1b913db0) returned 0x0
	[0098.563] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0098.563] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0098.563] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0098.564] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0098.564] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.564] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0098.564] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0098.564] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0098.564] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0098.564] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b927100, result=0x20d560) returned 0x0
	[0098.564] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b927100, result=0x20d520) returned 0x0
	[0098.564] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b927100, hRgn=0x20d520) returned 0x0
	[0098.564] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0098.564] GdipGetDC (graphics=0x1b927100, hdc=0x20d590) returned 0x0
	[0098.564] OffsetViewportOrgEx (in: hdc=0x160108e6, x=0, y=0, lppt=0x2678450 | out: lppt=0x2678450) returned 1
	[0098.564] CreateSolidBrush (color=0xf0f0f0) returned 0x261007c0
	[0098.583] GdipReleaseDC (graphics=0x1b927100, hdc=0x160108e6) returned 0x0
	[0098.583] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd570dbd) returned 0x0
	[0098.583] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0098.583] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0098.583] GetWindowTextW (hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1) 
	[0098.583] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0098.583] CoTaskMemFree (pv=0x1b078870) 
	[0098.583] GdipDrawImageRectI (graphics=0x1b927100, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0098.602] GdipGetDC (graphics=0x1b927100, hdc=0x20d990) returned 0x0
	[0098.603] GdipReleaseDC (graphics=0x1b927100, hdc=0x160108e6) returned 0x0
	[0098.603] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0100.159] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0100.159] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0100.159] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0100.159] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0100.159] UpdateWindow (hWnd=0x201d8) 
	[0100.159] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0100.159] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0100.159] GdipCreateFromHDC (hdc=0xd010939, graphics=0x20cfa0) returned 0x0
	[0100.160] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0100.160] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0100.160] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0100.160] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.160] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0100.160] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0100.160] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0100.160] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.160] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0100.160] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.160] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d100) returned 0x0
	[0100.160] GdipSaveGraphics (graphics=0x1b927100, state=0x20d1d0) returned 0x0
	[0100.160] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd550dbd) returned 0x0
	[0100.160] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.161] GdipGetDC (graphics=0x1b927100, hdc=0x20c5b0) returned 0x0
	[0100.161] GetNearestColor (hdc=0xd010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.161] GetNearestColor (hdc=0xd010939, color=0x696969) returned 0x696969
	[0100.161] GetNearestColor (hdc=0xd010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.161] GetNearestColor (hdc=0xd010939, color=0x0) returned 0x0
	[0100.162] GetNearestColor (hdc=0xd010939, color=0xffffff) returned 0xffffff
	[0100.162] GetNearestColor (hdc=0xd010939, color=0xe5e5e5) returned 0xe5e5e5
	[0100.162] GetNearestColor (hdc=0xd010939, color=0xd8d8d8) returned 0xd8d8d8
	[0100.162] GetNearestColor (hdc=0xd010939, color=0x0) returned 0x0
	[0100.162] RestoreDC (hdc=0xd010939, nSavedDC=-1) returned 1
	[0100.162] GdipReleaseDC (graphics=0x1b927100, hdc=0xd010939) returned 0x0
	[0100.162] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0100.162] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.163] CoTaskMemFree (pv=0x1b0679c0) 
	[0100.163] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0100.163] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.163] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.163] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.163] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0100.163] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0100.163] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0100.163] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0100.163] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0100.163] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.163] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0100.163] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.164] CoTaskMemFree (pv=0x1b0679c0) 
	[0100.164] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0100.164] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0100.164] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0100.164] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0100.164] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.164] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.164] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.164] GdipMeasureString (graphics=0x1b495ce0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0100.164] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.164] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0100.164] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0100.165] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.165] CoTaskMemFree (pv=0x1b0679c0) 
	[0100.165] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0100.165] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.165] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0100.165] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.165] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0100.165] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0100.165] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0100.165] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0100.165] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0100.165] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.165] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c990) returned 0x0
	[0100.165] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c950) returned 0x0
	[0100.166] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c950) returned 0x0
	[0100.166] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.166] GdipGetDC (graphics=0x1b927100, hdc=0x20c9c0) returned 0x0
	[0100.166] OffsetViewportOrgEx (in: hdc=0xd010939, x=0, y=0, lppt=0x2679df8 | out: lppt=0x2679df8) returned 1
	[0100.166] CreateSolidBrush (color=0xf0f0f0) returned 0x271007c0
	[0100.166] GdipReleaseDC (graphics=0x1b927100, hdc=0xd010939) returned 0x0
	[0100.166] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0100.166] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.166] CoTaskMemFree (pv=0x1b0679c0) 
	[0100.166] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0100.166] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.167] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.167] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.167] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0100.167] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0100.167] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0100.167] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.167] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0100.167] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.167] CoTaskMemFree (pv=0x1b0679c0) 
	[0100.167] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0100.167] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0100.167] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0100.168] GdipCreateRegion (region=0x20c830) returned 0x0
	[0100.168] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.168] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0100.168] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.168] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0100.168] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0100.168] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0100.168] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0100.168] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0100.168] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.168] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c8e0) returned 0x0
	[0100.168] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c8a0) returned 0x0
	[0100.168] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c8a0) returned 0x0
	[0100.168] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.168] GdipGetDC (graphics=0x1b927100, hdc=0x20c910) returned 0x0
	[0100.169] SaveDC (hdc=0xd010939) returned 1
	[0100.169] OffsetViewportOrgEx (in: hdc=0xd010939, x=0, y=0, lppt=0x267a398 | out: lppt=0x267a398) returned 1
	[0100.169] GetROP2 (hdc=0xd010939) returned 13
	[0100.169] GetROP2 (hdc=0xd010939) returned 13
	[0100.169] GetROP2 (hdc=0xd010939) returned 13
	[0100.169] GetROP2 (hdc=0xd010939) returned 13
	[0100.169] GetROP2 (hdc=0xd010939) returned 13
	[0100.170] GetROP2 (hdc=0xd010939) returned 13
	[0100.170] GetROP2 (hdc=0xd010939) returned 13
	[0100.170] GetROP2 (hdc=0xd010939) returned 13
	[0100.170] GdipReleaseDC (graphics=0x1b927100, hdc=0xd010939) returned 0x0
	[0100.170] GdipGetDC (graphics=0x1b927100, hdc=0x20d0a0) returned 0x0
	[0100.170] GdipReleaseDC (graphics=0x1b927100, hdc=0xd010939) returned 0x0
	[0100.170] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0100.170] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0100.170] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0100.171] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0100.171] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x267a6e0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0100.171] ShellExecuteExW (pExecInfo=0x267a8f0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0100.234] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x1b067580
	[0100.235] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0100.235] GdipCreateFromHDC (hdc=0x19010939, graphics=0x20c9d0) returned 0x0
	[0100.235] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0100.236] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0100.236] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0100.236] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.236] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0100.236] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.236] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.236] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.236] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0100.236] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.236] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20cb30) returned 0x0
	[0100.236] GdipSaveGraphics (graphics=0x1b927100, state=0x20cc00) returned 0x0
	[0100.236] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd520dbd) returned 0x0
	[0100.236] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.237] GdipGetDC (graphics=0x1b927100, hdc=0x20bfe0) returned 0x0
	[0100.237] GetNearestColor (hdc=0x19010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.237] GetNearestColor (hdc=0x19010939, color=0x696969) returned 0x696969
	[0100.237] GetNearestColor (hdc=0x19010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.237] GetNearestColor (hdc=0x19010939, color=0x0) returned 0x0
	[0100.237] GetNearestColor (hdc=0x19010939, color=0xffffff) returned 0xffffff
	[0100.237] GetNearestColor (hdc=0x19010939, color=0xe5e5e5) returned 0xe5e5e5
	[0100.237] GetNearestColor (hdc=0x19010939, color=0xd8d8d8) returned 0xd8d8d8
	[0100.237] GetNearestColor (hdc=0x19010939, color=0x0) returned 0x0
	[0100.237] RestoreDC (hdc=0x19010939, nSavedDC=-1) returned 1
	[0100.237] GdipReleaseDC (graphics=0x1b927100, hdc=0x19010939) returned 0x0
	[0100.238] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.238] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.238] CoTaskMemFree (pv=0x1b067580) 
	[0100.238] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0100.238] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.238] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.238] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.238] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0100.238] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0100.238] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0100.238] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0100.238] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0100.238] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.238] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.239] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.239] CoTaskMemFree (pv=0x1b067580) 
	[0100.239] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0100.239] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0100.239] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0100.239] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0100.239] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.239] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.239] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.239] GdipMeasureString (graphics=0x1b495ce0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0100.239] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.239] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0100.239] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.239] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.239] CoTaskMemFree (pv=0x1b067580) 
	[0100.239] GdipCreateRegion (region=0x20c310) returned 0x0
	[0100.240] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.240] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0100.240] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.240] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0100.240] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.240] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.240] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.240] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.240] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.240] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c3c0) returned 0x0
	[0100.240] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c380) returned 0x0
	[0100.240] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c380) returned 0x0
	[0100.240] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.240] GdipGetDC (graphics=0x1b927100, hdc=0x20c3f0) returned 0x0
	[0100.240] OffsetViewportOrgEx (in: hdc=0x19010939, x=0, y=0, lppt=0x267b5d0 | out: lppt=0x267b5d0) returned 1
	[0100.240] CreateSolidBrush (color=0xf0f0f0) returned 0x281007c0
	[0100.240] GdipReleaseDC (graphics=0x1b927100, hdc=0x19010939) returned 0x0
	[0100.241] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.241] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.241] CoTaskMemFree (pv=0x1b067580) 
	[0100.241] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0100.241] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.241] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.241] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.241] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0100.241] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0100.241] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0100.241] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.241] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.242] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.242] CoTaskMemFree (pv=0x1b067580) 
	[0100.242] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0100.242] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0100.242] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0100.242] GdipCreateRegion (region=0x20c260) returned 0x0
	[0100.242] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.242] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0100.242] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.242] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0100.242] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.242] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.242] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.242] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.242] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.242] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c310) returned 0x0
	[0100.242] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c2d0) returned 0x0
	[0100.242] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c2d0) returned 0x0
	[0100.243] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.243] GdipGetDC (graphics=0x1b927100, hdc=0x20c340) returned 0x0
	[0100.243] OffsetViewportOrgEx (in: hdc=0x19010939, x=0, y=0, lppt=0x267bb70 | out: lppt=0x267bb70) returned 1
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GetROP2 (hdc=0x19010939) returned 13
	[0100.243] GdipReleaseDC (graphics=0x1b927100, hdc=0x19010939) returned 0x0
	[0100.243] GdipGetDC (graphics=0x1b927100, hdc=0x20cad0) returned 0x0
	[0100.243] GdipReleaseDC (graphics=0x1b927100, hdc=0x19010939) returned 0x0
	[0100.243] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0100.244] GdipCreateFromHDC (hdc=0x1b010939, graphics=0x20c9d0) returned 0x0
	[0100.244] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0100.244] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0100.244] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0100.244] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.244] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0100.244] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.244] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.244] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.244] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0100.244] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.244] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20cb30) returned 0x0
	[0100.244] GdipSaveGraphics (graphics=0x1b927100, state=0x20cc00) returned 0x0
	[0100.244] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd4f0dbd) returned 0x0
	[0100.244] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.245] GdipGetDC (graphics=0x1b927100, hdc=0x20bfe0) returned 0x0
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0x696969) returned 0x696969
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0x0) returned 0x0
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0xffffff) returned 0xffffff
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0xe5e5e5) returned 0xe5e5e5
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0xd8d8d8) returned 0xd8d8d8
	[0100.245] GetNearestColor (hdc=0x1b010939, color=0x0) returned 0x0
	[0100.245] RestoreDC (hdc=0x1b010939, nSavedDC=-1) returned 1
	[0100.246] GdipReleaseDC (graphics=0x1b927100, hdc=0x1b010939) returned 0x0
	[0100.246] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.246] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.246] CoTaskMemFree (pv=0x1b067580) 
	[0100.246] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0100.246] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.246] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.246] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.246] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0100.246] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0100.246] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0100.246] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0100.246] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0100.246] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.246] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.247] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.247] CoTaskMemFree (pv=0x1b067580) 
	[0100.247] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0100.247] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0100.247] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0100.247] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0100.247] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.247] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.247] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.247] GdipMeasureString (graphics=0x1b495ce0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0100.247] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.247] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0100.247] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.247] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.247] CoTaskMemFree (pv=0x1b067580) 
	[0100.247] GdipCreateRegion (region=0x20c310) returned 0x0
	[0100.248] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.248] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0100.248] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.248] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0100.248] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.248] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.248] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.248] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.248] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.248] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c3c0) returned 0x0
	[0100.248] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c380) returned 0x0
	[0100.248] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c380) returned 0x0
	[0100.248] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.248] GdipGetDC (graphics=0x1b927100, hdc=0x20c3f0) returned 0x0
	[0100.248] OffsetViewportOrgEx (in: hdc=0x1b010939, x=0, y=0, lppt=0x267c9f8 | out: lppt=0x267c9f8) returned 1
	[0100.248] CreateSolidBrush (color=0xf0f0f0) returned 0x291007c0
	[0100.249] GdipReleaseDC (graphics=0x1b927100, hdc=0x1b010939) returned 0x0
	[0100.249] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.249] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.249] CoTaskMemFree (pv=0x1b067580) 
	[0100.249] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0100.249] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.249] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.249] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.249] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0100.249] GdipDrawString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0100.249] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0100.249] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.249] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.250] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.250] CoTaskMemFree (pv=0x1b067580) 
	[0100.250] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0100.250] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0100.250] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0100.250] GdipCreateRegion (region=0x20c260) returned 0x0
	[0100.250] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.250] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0100.250] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.250] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0100.250] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.250] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.250] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.250] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.250] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.251] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c310) returned 0x0
	[0100.251] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c2d0) returned 0x0
	[0100.251] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c2d0) returned 0x0
	[0100.251] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.251] GdipGetDC (graphics=0x1b927100, hdc=0x20c340) returned 0x0
	[0100.251] OffsetViewportOrgEx (in: hdc=0x1b010939, x=0, y=0, lppt=0x267cf98 | out: lppt=0x267cf98) returned 1
	[0100.251] GetROP2 (hdc=0x1b010939) returned 13
	[0100.251] GetROP2 (hdc=0x1b010939) returned 13
	[0100.251] GetROP2 (hdc=0x1b010939) returned 13
	[0100.251] GetROP2 (hdc=0x1b010939) returned 13
	[0100.251] GetROP2 (hdc=0x1b010939) returned 13
	[0100.251] GetROP2 (hdc=0x1b010939) returned 13
	[0100.251] GetROP2 (hdc=0x1b010939) returned 13
	[0100.252] GetROP2 (hdc=0x1b010939) returned 13
	[0100.252] GdipReleaseDC (graphics=0x1b927100, hdc=0x1b010939) returned 0x0
	[0100.252] GdipGetDC (graphics=0x1b927100, hdc=0x20cad0) returned 0x0
	[0100.252] GdipReleaseDC (graphics=0x1b927100, hdc=0x1b010939) returned 0x0
	[0100.252] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0100.461] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0100.461] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0100.461] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0100.461] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0100.462] GdipCreateFromHDC (hdc=0x2b010939, graphics=0x20c9d0) returned 0x0
	[0100.462] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0100.462] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0100.462] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0100.462] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.462] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0100.462] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.462] LocalFree (hMem=0x1b07c740) returned 0x0
	[0100.462] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.462] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0100.462] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.462] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20cb30) returned 0x0
	[0100.462] GdipSaveGraphics (graphics=0x1b927100, state=0x20cc00) returned 0x0
	[0100.463] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd4c0dbd) returned 0x0
	[0100.463] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.463] GdipGetDC (graphics=0x1b927100, hdc=0x20bfe0) returned 0x0
	[0100.463] GetNearestColor (hdc=0x2b010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.463] GetNearestColor (hdc=0x2b010939, color=0x696969) returned 0x696969
	[0100.463] GetNearestColor (hdc=0x2b010939, color=0xa0a0a0) returned 0xa0a0a0
	[0100.464] GetNearestColor (hdc=0x2b010939, color=0x0) returned 0x0
	[0100.464] GetNearestColor (hdc=0x2b010939, color=0xffffff) returned 0xffffff
	[0100.464] GetNearestColor (hdc=0x2b010939, color=0xe5e5e5) returned 0xe5e5e5
	[0100.464] GetNearestColor (hdc=0x2b010939, color=0xd8d8d8) returned 0xd8d8d8
	[0100.464] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010939) returned 0x0
	[0100.464] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.464] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.464] CoTaskMemFree (pv=0x1b067580) 
	[0100.465] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0100.465] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.465] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.465] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.465] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0100.465] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0100.465] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0100.465] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0100.465] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0100.465] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.465] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.465] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.466] CoTaskMemFree (pv=0x1b067580) 
	[0100.466] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0100.466] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0100.466] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0100.466] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0100.466] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.466] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.466] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.466] GdipMeasureString (graphics=0x1b495ce0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0100.466] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.466] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0100.466] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.467] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.467] CoTaskMemFree (pv=0x1b067580) 
	[0100.467] GdipCreateRegion (region=0x20c310) returned 0x0
	[0100.467] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.467] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0100.467] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.467] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0100.467] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.467] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.467] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.467] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c3c0) returned 0x0
	[0100.467] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c380) returned 0x0
	[0100.467] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c380) returned 0x0
	[0100.467] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.467] GdipGetDC (graphics=0x1b927100, hdc=0x20c3f0) returned 0x0
	[0100.467] OffsetViewportOrgEx (in: hdc=0x2b010939, x=0, y=0, lppt=0x267de90 | out: lppt=0x267de90) returned 1
	[0100.468] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010939) returned 0x0
	[0100.468] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.468] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.468] CoTaskMemFree (pv=0x1b067580) 
	[0100.468] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0100.468] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.468] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.468] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.468] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0100.469] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0100.469] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0100.469] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.469] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.469] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.469] CoTaskMemFree (pv=0x1b067580) 
	[0100.469] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0100.469] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0100.469] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0100.469] GdipCreateRegion (region=0x20c260) returned 0x0
	[0100.469] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.469] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0100.469] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.470] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0100.470] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.470] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.470] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.470] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c310) returned 0x0
	[0100.470] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c2d0) returned 0x0
	[0100.470] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c2d0) returned 0x0
	[0100.470] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.470] GdipGetDC (graphics=0x1b927100, hdc=0x20c340) returned 0x0
	[0100.470] OffsetViewportOrgEx (in: hdc=0x2b010939, x=0, y=0, lppt=0x267e430 | out: lppt=0x267e430) returned 1
	[0100.470] GetROP2 (hdc=0x2b010939) returned 13
	[0100.470] GetROP2 (hdc=0x2b010939) returned 13
	[0100.470] GetROP2 (hdc=0x2b010939) returned 13
	[0100.470] GetROP2 (hdc=0x2b010939) returned 13
	[0100.470] GetROP2 (hdc=0x2b010939) returned 13
	[0100.471] GetROP2 (hdc=0x2b010939) returned 13
	[0100.471] GetROP2 (hdc=0x2b010939) returned 13
	[0100.471] GetROP2 (hdc=0x2b010939) returned 13
	[0100.471] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010939) returned 0x0
	[0100.471] GdipGetDC (graphics=0x1b927100, hdc=0x20cad0) returned 0x0
	[0100.471] GdipReleaseDC (graphics=0x1b927100, hdc=0x2b010939) returned 0x0
	[0100.471] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0100.471] GdipCreateFromHDC (hdc=0x2c010939, graphics=0x20c9d0) returned 0x0
	[0100.471] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0100.471] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0100.471] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0100.471] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.471] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0100.472] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.472] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.472] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0100.472] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.472] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20cb30) returned 0x0
	[0100.472] GdipSaveGraphics (graphics=0x1b927100, state=0x20cc00) returned 0x0
	[0100.472] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd490dbd) returned 0x0
	[0100.472] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.472] GdipGetDC (graphics=0x1b927100, hdc=0x20bfe0) returned 0x0
	[0100.472] GdipReleaseDC (graphics=0x1b927100, hdc=0x2c010939) returned 0x0
	[0100.472] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.472] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.472] CoTaskMemFree (pv=0x1b067580) 
	[0100.473] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0100.473] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.473] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.473] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.473] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0100.473] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0100.473] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0100.473] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0100.473] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0100.473] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.473] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.473] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.473] CoTaskMemFree (pv=0x1b067580) 
	[0100.473] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0100.474] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0100.474] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0100.474] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0100.474] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.474] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.474] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.474] GdipMeasureString (graphics=0x1b495ce0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0100.474] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.474] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0100.474] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.474] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.474] CoTaskMemFree (pv=0x1b067580) 
	[0100.474] GdipCreateRegion (region=0x20c310) returned 0x0
	[0100.474] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.475] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0100.475] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.475] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0100.475] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.475] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.475] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.475] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c3c0) returned 0x0
	[0100.475] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c380) returned 0x0
	[0100.475] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c380) returned 0x0
	[0100.475] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.475] GdipGetDC (graphics=0x1b927100, hdc=0x20c3f0) returned 0x0
	[0100.476] OffsetViewportOrgEx (in: hdc=0x2c010939, x=0, y=0, lppt=0x267f290 | out: lppt=0x267f290) returned 1
	[0100.476] GdipReleaseDC (graphics=0x1b927100, hdc=0x2c010939) returned 0x0
	[0100.476] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.477] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.477] CoTaskMemFree (pv=0x1b067580) 
	[0100.477] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0100.477] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.477] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.477] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.477] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0100.477] GdipDrawString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0100.477] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0100.477] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.477] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0100.477] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.477] CoTaskMemFree (pv=0x1b067580) 
	[0100.477] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0100.478] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0100.478] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0100.478] GdipCreateRegion (region=0x20c260) returned 0x0
	[0100.478] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.478] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0100.478] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.478] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0100.478] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.478] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.478] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.478] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c310) returned 0x0
	[0100.478] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c2d0) returned 0x0
	[0100.478] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c2d0) returned 0x0
	[0100.478] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.478] GdipGetDC (graphics=0x1b927100, hdc=0x20c340) returned 0x0
	[0100.478] OffsetViewportOrgEx (in: hdc=0x2c010939, x=0, y=0, lppt=0x267f830 | out: lppt=0x267f830) returned 1
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GetROP2 (hdc=0x2c010939) returned 13
	[0100.479] GdipReleaseDC (graphics=0x1b927100, hdc=0x2c010939) returned 0x0
	[0100.479] GdipGetDC (graphics=0x1b927100, hdc=0x20cad0) returned 0x0
	[0100.479] GdipReleaseDC (graphics=0x1b927100, hdc=0x2c010939) returned 0x0
	[0100.479] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0100.697] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0100.697] InvalidateRect (hWnd=0x401b4, lpRect=0x20cf20, bErase=0) returned 1
	[0100.697] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0100.697] InvalidateRect (hWnd=0x401b4, lpRect=0x20ce70, bErase=0) returned 1
	[0100.697] UpdateWindow (hWnd=0x401b4) 
	[0100.697] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20c388 | out: lpPaint=0x20c388) returned 0x70107fc
	[0100.697] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0100.697] GdipCreateFromHDC (hdc=0x1801093c, graphics=0x20c190) returned 0x0
	[0100.697] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0100.697] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0100.697] GdipCreateMatrix (matrix=0x20c2c0) returned 0x0
	[0100.698] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.698] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c320) returned 0x0
	[0100.698] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.698] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.698] GdipCreateRegion (region=0x20c2c0) returned 0x0
	[0100.698] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.698] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c2f0) returned 0x0
	[0100.698] GdipSaveGraphics (graphics=0x1b927100, state=0x20c3c0) returned 0x0
	[0100.698] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd460dbd) returned 0x0
	[0100.698] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.698] GdipGetDC (graphics=0x1b927100, hdc=0x20b7a0) returned 0x0
	[0100.698] GdipReleaseDC (graphics=0x1b927100, hdc=0x1801093c) returned 0x0
	[0100.698] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0100.698] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.698] CoTaskMemFree (pv=0x1b067660) 
	[0100.699] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20be90) returned 0x0
	[0100.699] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.699] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.699] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.699] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bec0) returned 0x0
	[0100.699] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20bec0) returned 0x0
	[0100.699] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20bec0) returned 0x0
	[0100.699] GdipGetFontSize (font=0x1b912930, size=0x20bec0) returned 0x0
	[0100.699] GdipGetFontStyle (font=0x1b912930, style=0x20bec0) returned 0x0
	[0100.699] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.699] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0100.699] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.699] CoTaskMemFree (pv=0x1b067660) 
	[0100.699] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bb50) returned 0x0
	[0100.699] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bb60) returned 0x0
	[0100.699] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0100.699] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0100.699] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.700] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.700] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.700] GdipMeasureString (graphics=0x1b495ce0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20ba78, stringFormat=0x1b912930, boundingBox=0x20ba68, codepointsFitted=0x20ba64, linesFilled=0x20ba60) returned 0x0
	[0100.700] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.700] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0100.700] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0100.700] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.700] CoTaskMemFree (pv=0x1b067660) 
	[0100.700] GdipCreateRegion (region=0x20bad0) returned 0x0
	[0100.700] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.700] GdipCreateMatrix (matrix=0x20bad0) returned 0x0
	[0100.700] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0100.700] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20bb30) returned 0x0
	[0100.700] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.700] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0100.700] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0100.700] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20bb80) returned 0x0
	[0100.700] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20bb40) returned 0x0
	[0100.701] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20bb40) returned 0x0
	[0100.701] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.701] GdipGetDC (graphics=0x1b927100, hdc=0x20bbb0) returned 0x0
	[0100.701] OffsetViewportOrgEx (in: hdc=0x1801093c, x=0, y=0, lppt=0x26807b8 | out: lppt=0x26807b8) returned 1
	[0100.701] GdipReleaseDC (graphics=0x1b927100, hdc=0x1801093c) returned 0x0
	[0100.701] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0100.701] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.701] CoTaskMemFree (pv=0x1b067660) 
	[0100.701] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bbf0) returned 0x0
	[0100.701] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.701] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0100.701] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0100.701] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20bc60) returned 0x0
	[0100.701] GdipDrawString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20bb70, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0100.701] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0100.701] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0100.702] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0100.702] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0100.702] CoTaskMemFree (pv=0x1b067660) 
	[0100.702] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20bf50) returned 0x0
	[0100.702] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0100.702] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0100.702] GdipCreateRegion (region=0x20ba20) returned 0x0
	[0100.702] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0100.702] GdipCreateMatrix (matrix=0x20ba20) returned 0x0
	[0100.702] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0100.702] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20ba80) returned 0x0
	[0100.702] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.702] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0100.702] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0100.702] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20bad0) returned 0x0
	[0100.702] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20ba90) returned 0x0
	[0100.702] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20ba90) returned 0x0
	[0100.702] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0100.702] GdipGetDC (graphics=0x1b927100, hdc=0x20bb00) returned 0x0
	[0100.703] OffsetViewportOrgEx (in: hdc=0x1801093c, x=0, y=0, lppt=0x2680d58 | out: lppt=0x2680d58) returned 1
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GetROP2 (hdc=0x1801093c) returned 13
	[0100.703] GdipReleaseDC (graphics=0x1b927100, hdc=0x1801093c) returned 0x0
	[0100.703] GdipGetDC (graphics=0x1b927100, hdc=0x20c290) returned 0x0
	[0100.703] GdipReleaseDC (graphics=0x1b927100, hdc=0x1801093c) returned 0x0
	[0100.703] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0100.703] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0100.703] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0100.704] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0100.704] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20cc80) returned 0x0
	[0100.704] GetCapture () returned 0x401b4
	[0100.704] ReleaseCapture () 
	[0100.704] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0101.378] GdipCreateFromHDC (hdc=0x201094b, graphics=0x20c9d0) returned 0x0
	[0101.378] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0101.378] GdipSetClipRectI (graphics=0x1b927100, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0101.378] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0101.378] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0101.378] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0101.378] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0101.378] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0101.378] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0101.378] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0101.378] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20cb30) returned 0x0
	[0101.378] GdipSaveGraphics (graphics=0x1b927100, state=0x20cc00) returned 0x0
	[0101.378] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd430dbd) returned 0x0
	[0101.378] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0101.378] GdipGetDC (graphics=0x1b927100, hdc=0x20bfe0) returned 0x0
	[0101.379] GdipReleaseDC (graphics=0x1b927100, hdc=0x201094b) returned 0x0
	[0101.379] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0101.379] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0101.379] CoTaskMemFree (pv=0x1b067660) 
	[0101.379] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0101.379] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0101.379] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0101.379] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0101.379] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0101.379] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0101.379] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0101.379] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0101.379] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0101.379] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0101.379] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0101.380] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0101.380] CoTaskMemFree (pv=0x1b067660) 
	[0101.380] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0101.380] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0101.380] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0101.380] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0101.380] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0101.380] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0101.380] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0101.380] GdipMeasureString (graphics=0x1b495ce0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0101.380] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0101.380] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0101.380] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0101.381] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0101.381] CoTaskMemFree (pv=0x1b067660) 
	[0101.381] GdipCreateRegion (region=0x20c310) returned 0x0
	[0101.381] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0101.381] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0101.381] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0101.381] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0101.381] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0101.381] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0101.381] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0101.381] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c3c0) returned 0x0
	[0101.381] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c380) returned 0x0
	[0101.381] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c380) returned 0x0
	[0101.381] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0101.381] GdipGetDC (graphics=0x1b927100, hdc=0x20c3f0) returned 0x0
	[0101.381] OffsetViewportOrgEx (in: hdc=0x201094b, x=0, y=0, lppt=0x2681c30 | out: lppt=0x2681c30) returned 1
	[0101.381] GdipReleaseDC (graphics=0x1b927100, hdc=0x201094b) returned 0x0
	[0101.381] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0101.382] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0101.382] CoTaskMemFree (pv=0x1b067660) 
	[0101.382] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0101.382] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0101.382] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0101.382] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0101.382] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0101.382] GdipDrawString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0101.382] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0101.382] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0101.382] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0101.382] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0101.382] CoTaskMemFree (pv=0x1b067660) 
	[0101.382] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0101.382] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0101.383] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0101.383] GdipCreateRegion (region=0x20c260) returned 0x0
	[0101.383] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0101.383] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0101.383] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0101.383] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0101.383] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0101.383] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0101.383] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0101.383] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c310) returned 0x0
	[0101.383] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20c2d0) returned 0x0
	[0101.383] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20c2d0) returned 0x0
	[0101.383] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0101.383] GdipGetDC (graphics=0x1b927100, hdc=0x20c340) returned 0x0
	[0101.383] OffsetViewportOrgEx (in: hdc=0x201094b, x=0, y=0, lppt=0x26821d0 | out: lppt=0x26821d0) returned 1
	[0101.383] GetROP2 (hdc=0x201094b) returned 13
	[0101.383] GetROP2 (hdc=0x201094b) returned 13
	[0101.383] GetROP2 (hdc=0x201094b) returned 13
	[0101.383] GetROP2 (hdc=0x201094b) returned 13
	[0101.383] GetROP2 (hdc=0x201094b) returned 13
	[0101.384] GetROP2 (hdc=0x201094b) returned 13
	[0101.384] GetROP2 (hdc=0x201094b) returned 13
	[0101.384] GetROP2 (hdc=0x201094b) returned 13
	[0101.384] GdipReleaseDC (graphics=0x1b927100, hdc=0x201094b) returned 0x0
	[0101.384] GdipGetDC (graphics=0x1b927100, hdc=0x20cad0) returned 0x0
	[0101.384] GdipReleaseDC (graphics=0x1b927100, hdc=0x201094b) returned 0x0
	[0101.384] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.295] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0107.295] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0107.295] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0107.295] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0107.295] GdipCreateFromHDC (hdc=0x20010948, graphics=0x20d7e0) returned 0x0
	[0107.295] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.296] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0107.296] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0107.296] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0107.296] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0107.296] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.296] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.296] GdipCreateRegion (region=0x20d910) returned 0x0
	[0107.296] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0107.296] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0107.296] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0107.296] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd400dbd) returned 0x0
	[0107.296] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.296] GdipGetDC (graphics=0x1b927100, hdc=0x20cdf0) returned 0x0
	[0107.296] GdipReleaseDC (graphics=0x1b927100, hdc=0x20010948) returned 0x0
	[0107.296] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.297] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.297] CoTaskMemFree (pv=0x1b067980) 
	[0107.297] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0107.297] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.297] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.297] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.297] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0107.297] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0107.297] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0107.297] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0107.297] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0107.297] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.297] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.298] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.298] CoTaskMemFree (pv=0x1b067980) 
	[0107.298] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0107.298] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0107.298] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.298] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.298] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.298] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.298] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.298] GdipMeasureString (graphics=0x1b495ce0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0107.298] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.298] GdipDeleteGraphics (graphics=0x1b495ce0) returned 0x0
	[0107.298] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.298] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.298] CoTaskMemFree (pv=0x1b067980) 
	[0107.299] GdipCreateRegion (region=0x20d120) returned 0x0
	[0107.299] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0107.299] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0107.299] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0107.299] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0107.299] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0107.299] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0107.299] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0107.299] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d1d0) returned 0x0
	[0107.299] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d190) returned 0x0
	[0107.299] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20d190) returned 0x0
	[0107.299] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.299] GdipGetDC (graphics=0x1b927100, hdc=0x20d200) returned 0x0
	[0107.299] OffsetViewportOrgEx (in: hdc=0x20010948, x=0, y=0, lppt=0x26830c8 | out: lppt=0x26830c8) returned 1
	[0107.300] GdipReleaseDC (graphics=0x1b927100, hdc=0x20010948) returned 0x0
	[0107.300] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.300] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.300] CoTaskMemFree (pv=0x1b067980) 
	[0107.300] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0107.300] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.300] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.300] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.300] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0107.300] GdipDrawString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.300] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.300] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.300] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.301] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.301] CoTaskMemFree (pv=0x1b067980) 
	[0107.301] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0107.301] GdipDrawRectangleI (graphics=0x1b927100, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0107.301] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.301] GdipCreateRegion (region=0x20d070) returned 0x0
	[0107.301] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0107.301] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0107.301] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0107.301] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0107.301] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.301] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.301] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.301] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d120) returned 0x0
	[0107.301] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d0e0) returned 0x0
	[0107.301] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b927100, hRgn=0x20d0e0) returned 0x0
	[0107.301] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.301] GdipGetDC (graphics=0x1b927100, hdc=0x20d150) returned 0x0
	[0107.302] OffsetViewportOrgEx (in: hdc=0x20010948, x=0, y=0, lppt=0x2683668 | out: lppt=0x2683668) returned 1
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GetROP2 (hdc=0x20010948) returned 13
	[0107.302] GdipReleaseDC (graphics=0x1b927100, hdc=0x20010948) returned 0x0
	[0107.302] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0107.302] GdipReleaseDC (graphics=0x1b927100, hdc=0x20010948) returned 0x0
	[0107.302] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.310] CoTaskMemAlloc (cb=0x26) returned 0x1b085890
	[0107.310] GetWindowTextW (hWnd=0x50120, lpString=0x1b085890, nMaxCount=17) 
	[0107.310] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b085890) returned 0x10
	[0107.310] CoTaskMemFree (pv=0x1b085890) 
	[0107.310] GetClientRect (in: hWnd=0x50120, lpRect=0x20d0e0 | out: lpRect=0x20d0e0) returned 1
	[0107.310] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20ccb0) returned 0x0
	[0107.310] GdipSetPageUnit (graphics=0x1b927100, unit=0x2) returned 0x0
	[0107.311] GdipCreateMatrix (matrix=0x20cba0) returned 0x0
	[0107.311] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0107.311] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cc00) returned 0x0
	[0107.311] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0107.311] GdipCreateRegion (region=0x20cba0) returned 0x0
	[0107.311] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0107.311] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20cbd0) returned 0x0
	[0107.311] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.311] GdipSaveGraphics (graphics=0x1b927100, state=0x20cca0) returned 0x0
	[0107.311] GdipCreateRegion (region=0x20cb70) returned 0x0
	[0107.311] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0107.311] GdipCreateMatrix (matrix=0x20cb70) returned 0x0
	[0107.311] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0107.311] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cbd0) returned 0x0
	[0107.311] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.311] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.311] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20cc20) returned 0x0
	[0107.311] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.311] GdipGetDC (graphics=0x1b927100, hdc=0x20cc50) returned 0x0
	[0107.311] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x2683df8 | out: lppt=0x2683df8) returned 1
	[0107.312] GdipReleaseDC (graphics=0x1b927100, hdc=0x4010280) returned 0x0
	[0107.312] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.312] GetDIBits (in: hdc=0x10107f8, hbm=0x505094d, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0107.312] GetDIBits (in: hdc=0x10107f8, hbm=0x505094d, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0107.312] GdipCreateFromHDC (hdc=0x1501094b, graphics=0x20d750) returned 0x0
	[0107.312] GdipTranslateWorldTransform (graphics=0x1b927100, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.312] GdipSetClipRectI (graphics=0x1b927100, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0107.312] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0107.312] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f290) returned 0x0
	[0107.312] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0107.312] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0107.312] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0107.312] GdipCreateRegion (region=0x20d910) returned 0x0
	[0107.313] GdipGetClip (graphics=0x1b927100, region=0x1b913cf0) returned 0x0
	[0107.313] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b927100, result=0x20d940) returned 0x0
	[0107.313] GdipSaveGraphics (graphics=0x1b927100, state=0x20da10) returned 0x0
	[0107.313] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0107.313] GetWindowTextW (hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118) 
	[0107.313] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0107.313] CoTaskMemFree (pv=0x1b07f5c0) 
	[0107.313] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0107.313] GdipCreateRegion (region=0x20d400) returned 0x0
	[0107.313] GdipGetClip (graphics=0x1b927100, region=0x1b913db0) returned 0x0
	[0107.313] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0107.313] GdipGetWorldTransform (graphics=0x1b927100, matrix=0x1b49f310) returned 0x0
	[0107.313] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0107.313] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.313] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0107.313] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.313] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.313] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b927100, result=0x20d4b0) returned 0x0
	[0107.313] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b927100, result=0x20d470) returned 0x0
	[0107.313] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b927100, hRgn=0x20d470) returned 0x0
	[0107.313] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0107.314] GdipGetDC (graphics=0x1b927100, hdc=0x20d4e0) returned 0x0
	[0107.314] OffsetViewportOrgEx (in: hdc=0x1501094b, x=0, y=0, lppt=0x26855d8 | out: lppt=0x26855d8) returned 1
	[0107.314] GdipReleaseDC (graphics=0x1b927100, hdc=0x1501094b) returned 0x0
	[0107.314] GdipRestoreGraphics (graphics=0x1b927100, state=0xfffffffffd3b0dbd) returned 0x0
	[0107.314] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.314] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0107.314] GetWindowTextW (hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118) 
	[0107.314] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0107.314] CoTaskMemFree (pv=0x1b07f5c0) 
	[0107.314] GdipGetDC (graphics=0x1b927100, hdc=0x20d530) returned 0x0
	[0107.314] GdipReleaseDC (graphics=0x1b927100, hdc=0x1501094b) returned 0x0
	[0107.314] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0107.314] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0107.314] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0107.314] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.314] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0107.314] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0107.314] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0107.314] GdipDrawString (graphics=0x1b927100, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.315] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.315] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.315] GdipGetDC (graphics=0x1b927100, hdc=0x20d8e0) returned 0x0
	[0107.315] GdipReleaseDC (graphics=0x1b927100, hdc=0x1501094b) returned 0x0
	[0107.315] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.315] GdipCreateFromHDC (hdc=0x26010948, graphics=0x20d7e0) returned 0x0
	[0107.315] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.315] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=23, combineMode=0x0) returned 0x0
	[0107.315] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0107.315] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.315] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0107.315] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0107.315] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.315] GdipCreateRegion (region=0x20d910) returned 0x0
	[0107.316] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.316] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0107.316] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0107.316] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd390dbd) returned 0x0
	[0107.316] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.316] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0107.316] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010948) returned 0x0
	[0107.316] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.316] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.316] CoTaskMemFree (pv=0x1b067980) 
	[0107.316] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0107.316] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.316] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.316] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.316] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0107.316] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0107.317] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0107.317] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0107.317] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0107.317] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.317] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.317] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.317] CoTaskMemFree (pv=0x1b067980) 
	[0107.317] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0107.317] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0107.317] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.317] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.317] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.317] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.317] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.317] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0107.317] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.317] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.317] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.318] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.318] CoTaskMemFree (pv=0x1b067980) 
	[0107.318] GdipCreateRegion (region=0x20d120) returned 0x0
	[0107.318] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.318] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0107.318] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.318] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0107.318] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.318] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.318] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.318] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0107.318] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0107.318] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0107.318] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.318] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0107.319] OffsetViewportOrgEx (in: hdc=0x26010948, x=0, y=0, lppt=0x26866c8 | out: lppt=0x26866c8) returned 1
	[0107.319] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010948) returned 0x0
	[0107.319] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.319] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.319] CoTaskMemFree (pv=0x1b067980) 
	[0107.319] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0107.319] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.319] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.319] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.319] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0107.319] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.319] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.319] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.320] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.320] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.320] CoTaskMemFree (pv=0x1b067980) 
	[0107.320] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0107.320] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0107.320] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.320] GdipCreateRegion (region=0x20d070) returned 0x0
	[0107.320] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.320] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0107.320] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.320] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0107.320] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0107.320] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0107.320] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.320] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0107.321] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0107.321] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0107.321] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.321] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0107.321] OffsetViewportOrgEx (in: hdc=0x26010948, x=0, y=0, lppt=0x2686c68 | out: lppt=0x2686c68) returned 1
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GetROP2 (hdc=0x26010948) returned 13
	[0107.321] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010948) returned 0x0
	[0107.321] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0107.321] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010948) returned 0x0
	[0107.321] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.322] GetDIBits (in: hdc=0x4010280, hbm=0x27050948, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0107.322] GetDIBits (in: hdc=0x4010280, hbm=0x27050948, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0107.322] GdipCreateFromHDC (hdc=0x2801094e, graphics=0x20d800) returned 0x0
	[0107.322] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.322] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0107.322] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0107.322] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.322] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0107.322] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.322] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.322] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0107.322] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.322] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0107.322] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0107.322] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0107.322] GetWindowTextW (hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1) 
	[0107.322] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0107.322] CoTaskMemFree (pv=0x1b078860) 
	[0107.322] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0107.323] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0107.323] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0107.323] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0107.323] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.323] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0107.323] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0107.323] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0107.323] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0107.323] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.323] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0107.323] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0107.323] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0107.323] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0107.323] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0107.323] OffsetViewportOrgEx (in: hdc=0x2801094e, x=0, y=0, lppt=0x2688518 | out: lppt=0x2688518) returned 1
	[0107.324] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2801094e) returned 0x0
	[0107.324] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd360dbd) returned 0x0
	[0107.324] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.324] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0107.324] GetWindowTextW (hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1) 
	[0107.324] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0107.324] CoTaskMemFree (pv=0x1b078860) 
	[0107.324] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0107.331] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0107.331] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2801094e) returned 0x0
	[0107.331] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.522] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0107.522] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0107.522] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0107.522] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0107.522] UpdateWindow (hWnd=0x201d8) 
	[0107.522] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0107.522] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0107.522] GdipCreateFromHDC (hdc=0xd0109af, graphics=0x20cfa0) returned 0x0
	[0107.522] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.522] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0107.522] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0107.522] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.523] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0107.523] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.523] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.523] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0107.523] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.523] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0107.523] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0107.523] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd340dbd) returned 0x0
	[0107.523] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.523] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0107.523] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0109af) returned 0x0
	[0107.523] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.523] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.523] CoTaskMemFree (pv=0x1b067980) 
	[0107.524] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0107.524] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.524] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.524] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.524] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0107.524] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0107.524] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0107.524] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0107.524] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0107.524] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.524] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.524] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.524] CoTaskMemFree (pv=0x1b067980) 
	[0107.524] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0107.524] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0107.525] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.525] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.525] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.525] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.525] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.525] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0107.525] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.525] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.525] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.525] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.525] CoTaskMemFree (pv=0x1b067980) 
	[0107.525] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0107.525] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.525] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0107.525] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.525] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0107.525] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0107.525] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0107.526] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.526] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0107.526] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0107.526] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0107.526] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.526] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0107.526] OffsetViewportOrgEx (in: hdc=0xd0109af, x=0, y=0, lppt=0x2689588 | out: lppt=0x2689588) returned 1
	[0107.526] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0109af) returned 0x0
	[0107.526] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.526] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.526] CoTaskMemFree (pv=0x1b067980) 
	[0107.526] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0107.526] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.526] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.526] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.526] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0107.527] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.527] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.527] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.527] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0107.527] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.527] CoTaskMemFree (pv=0x1b067980) 
	[0107.527] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0107.527] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0107.527] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.527] GdipCreateRegion (region=0x20c830) returned 0x0
	[0107.527] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.527] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0107.527] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.527] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0107.527] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.528] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0107.528] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.528] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0107.528] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0107.528] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0107.528] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.528] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0107.528] OffsetViewportOrgEx (in: hdc=0xd0109af, x=0, y=0, lppt=0x2689b28 | out: lppt=0x2689b28) returned 1
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GetROP2 (hdc=0xd0109af) returned 13
	[0107.528] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0109af) returned 0x0
	[0107.528] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0107.529] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0109af) returned 0x0
	[0107.529] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.529] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0107.529] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0107.529] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0107.529] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2689e70, Length=0x70 | out: Destination=0x1afe53a0) 
	[0107.529] ShellExecuteExW (pExecInfo=0x268a080*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0107.669] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0107.669] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0107.670] GdipCreateFromHDC (hdc=0x150109af, graphics=0x20c9d0) returned 0x0
	[0107.670] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.670] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0107.670] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0107.670] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.670] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0107.670] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.670] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.670] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0107.670] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.670] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0107.670] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0107.670] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd310dbd) returned 0x0
	[0107.671] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.671] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0107.671] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150109af) returned 0x0
	[0107.671] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.671] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.671] CoTaskMemFree (pv=0x1b067580) 
	[0107.671] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0107.671] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.671] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.671] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.671] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0107.671] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0107.671] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0107.671] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0107.671] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0107.671] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.672] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.672] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.672] CoTaskMemFree (pv=0x1b067580) 
	[0107.672] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0107.672] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0107.672] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.672] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.672] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.672] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.672] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.672] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0107.672] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.672] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.672] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.672] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.673] CoTaskMemFree (pv=0x1b067580) 
	[0107.673] GdipCreateRegion (region=0x20c310) returned 0x0
	[0107.673] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.673] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0107.673] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.673] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0107.673] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.673] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.673] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.673] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0107.673] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0107.673] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0107.673] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.673] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0107.673] OffsetViewportOrgEx (in: hdc=0x150109af, x=0, y=0, lppt=0x268ad60 | out: lppt=0x268ad60) returned 1
	[0107.673] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150109af) returned 0x0
	[0107.673] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.674] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.674] CoTaskMemFree (pv=0x1b067580) 
	[0107.674] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0107.674] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.674] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.674] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.674] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0107.674] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.674] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.674] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.674] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.674] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.674] CoTaskMemFree (pv=0x1b067580) 
	[0107.674] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0107.674] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0107.675] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.675] GdipCreateRegion (region=0x20c260) returned 0x0
	[0107.675] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.675] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0107.675] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.675] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0107.675] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.675] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.675] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.675] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0107.675] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0107.675] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0107.675] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.675] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0107.675] OffsetViewportOrgEx (in: hdc=0x150109af, x=0, y=0, lppt=0x268b300 | out: lppt=0x268b300) returned 1
	[0107.675] GetROP2 (hdc=0x150109af) returned 13
	[0107.675] GetROP2 (hdc=0x150109af) returned 13
	[0107.675] GetROP2 (hdc=0x150109af) returned 13
	[0107.675] GetROP2 (hdc=0x150109af) returned 13
	[0107.675] GetROP2 (hdc=0x150109af) returned 13
	[0107.676] GetROP2 (hdc=0x150109af) returned 13
	[0107.676] GetROP2 (hdc=0x150109af) returned 13
	[0107.676] GetROP2 (hdc=0x150109af) returned 13
	[0107.676] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150109af) returned 0x0
	[0107.676] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0107.676] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150109af) returned 0x0
	[0107.676] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.676] GdipCreateFromHDC (hdc=0x170109af, graphics=0x20c9d0) returned 0x0
	[0107.676] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.676] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0107.676] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0107.676] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.676] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0107.676] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.676] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.676] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0107.676] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.677] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0107.677] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0107.677] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd2e0dbd) returned 0x0
	[0107.677] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.677] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0107.677] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170109af) returned 0x0
	[0107.677] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.677] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.677] CoTaskMemFree (pv=0x1b067580) 
	[0107.677] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0107.677] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.677] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.677] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.677] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0107.677] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0107.677] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0107.677] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0107.678] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0107.678] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.678] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.678] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.678] CoTaskMemFree (pv=0x1b067580) 
	[0107.678] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0107.678] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0107.678] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.678] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.678] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.678] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.678] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.678] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0107.678] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.678] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.678] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.679] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.679] CoTaskMemFree (pv=0x1b067580) 
	[0107.679] GdipCreateRegion (region=0x20c310) returned 0x0
	[0107.679] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.679] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0107.679] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.679] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0107.679] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.679] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.679] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.679] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0107.679] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0107.679] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0107.679] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.679] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0107.679] OffsetViewportOrgEx (in: hdc=0x170109af, x=0, y=0, lppt=0x268c188 | out: lppt=0x268c188) returned 1
	[0107.679] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170109af) returned 0x0
	[0107.679] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.680] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.680] CoTaskMemFree (pv=0x1b067580) 
	[0107.680] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0107.680] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.680] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.680] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.680] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0107.680] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.680] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.680] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.680] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.680] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.680] CoTaskMemFree (pv=0x1b067580) 
	[0107.680] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0107.680] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0107.680] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.680] GdipCreateRegion (region=0x20c260) returned 0x0
	[0107.681] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.681] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0107.681] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.681] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0107.681] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.681] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.681] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.681] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0107.681] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0107.681] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0107.681] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.681] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0107.681] OffsetViewportOrgEx (in: hdc=0x170109af, x=0, y=0, lppt=0x268c728 | out: lppt=0x268c728) returned 1
	[0107.681] GetROP2 (hdc=0x170109af) returned 13
	[0107.681] GetROP2 (hdc=0x170109af) returned 13
	[0107.681] GetROP2 (hdc=0x170109af) returned 13
	[0107.681] GetROP2 (hdc=0x170109af) returned 13
	[0107.681] GetROP2 (hdc=0x170109af) returned 13
	[0107.682] GetROP2 (hdc=0x170109af) returned 13
	[0107.682] GetROP2 (hdc=0x170109af) returned 13
	[0107.682] GetROP2 (hdc=0x170109af) returned 13
	[0107.682] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170109af) returned 0x0
	[0107.682] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0107.682] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170109af) returned 0x0
	[0107.682] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.697] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0107.697] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0107.697] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0107.697] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0107.697] GdipCreateFromHDC (hdc=0x180109af, graphics=0x20c9d0) returned 0x0
	[0107.697] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.697] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0107.697] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0107.697] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.697] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0107.697] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.697] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.698] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0107.698] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.698] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0107.698] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0107.698] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd2b0dbd) returned 0x0
	[0107.698] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.698] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0107.698] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180109af) returned 0x0
	[0107.698] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.698] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.698] CoTaskMemFree (pv=0x1b067580) 
	[0107.698] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0107.698] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.698] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.699] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.699] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0107.699] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0107.699] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0107.699] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0107.699] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0107.699] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.699] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.699] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.699] CoTaskMemFree (pv=0x1b067580) 
	[0107.699] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0107.699] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0107.699] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.699] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.699] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.699] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.699] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.700] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0107.700] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.700] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.700] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.700] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.700] CoTaskMemFree (pv=0x1b067580) 
	[0107.700] GdipCreateRegion (region=0x20c310) returned 0x0
	[0107.700] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.700] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0107.700] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.700] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0107.700] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.700] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.700] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.700] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0107.700] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0107.700] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0107.700] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.701] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0107.701] OffsetViewportOrgEx (in: hdc=0x180109af, x=0, y=0, lppt=0x268d620 | out: lppt=0x268d620) returned 1
	[0107.701] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180109af) returned 0x0
	[0107.701] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.701] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.701] CoTaskMemFree (pv=0x1b067580) 
	[0107.701] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0107.701] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.701] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.701] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.701] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0107.701] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.701] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.701] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.701] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.702] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.702] CoTaskMemFree (pv=0x1b067580) 
	[0107.702] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0107.702] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0107.702] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.702] GdipCreateRegion (region=0x20c260) returned 0x0
	[0107.702] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.702] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0107.702] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.702] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0107.702] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.702] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.702] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.702] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0107.702] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0107.702] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0107.702] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.702] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0107.703] OffsetViewportOrgEx (in: hdc=0x180109af, x=0, y=0, lppt=0x268dbc0 | out: lppt=0x268dbc0) returned 1
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GetROP2 (hdc=0x180109af) returned 13
	[0107.703] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180109af) returned 0x0
	[0107.703] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0107.703] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180109af) returned 0x0
	[0107.703] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.703] GdipCreateFromHDC (hdc=0x190109af, graphics=0x20c9d0) returned 0x0
	[0107.703] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.703] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0107.703] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0107.704] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.704] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0107.704] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.704] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.704] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0107.704] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.704] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0107.704] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0107.704] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd280dbd) returned 0x0
	[0107.704] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.704] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0107.704] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190109af) returned 0x0
	[0107.704] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.704] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.704] CoTaskMemFree (pv=0x1b067580) 
	[0107.704] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0107.704] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.705] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.705] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.705] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0107.705] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0107.705] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0107.705] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0107.705] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0107.705] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.705] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.705] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.705] CoTaskMemFree (pv=0x1b067580) 
	[0107.705] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0107.705] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0107.705] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.705] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.705] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.705] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.705] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.705] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0107.706] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.706] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.706] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.706] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.706] CoTaskMemFree (pv=0x1b067580) 
	[0107.706] GdipCreateRegion (region=0x20c310) returned 0x0
	[0107.706] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.706] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0107.706] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.706] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0107.706] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.706] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.706] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.706] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0107.706] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0107.706] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0107.706] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.706] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0107.707] OffsetViewportOrgEx (in: hdc=0x190109af, x=0, y=0, lppt=0x268ea20 | out: lppt=0x268ea20) returned 1
	[0107.707] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190109af) returned 0x0
	[0107.707] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.707] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.707] CoTaskMemFree (pv=0x1b067580) 
	[0107.707] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0107.707] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.707] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.707] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.707] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0107.707] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.707] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.707] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.707] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0107.708] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.708] CoTaskMemFree (pv=0x1b067580) 
	[0107.708] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0107.708] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0107.708] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.708] GdipCreateRegion (region=0x20c260) returned 0x0
	[0107.708] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.708] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0107.708] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.708] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0107.708] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.708] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.708] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.708] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0107.708] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0107.708] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0107.708] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.708] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0107.708] OffsetViewportOrgEx (in: hdc=0x190109af, x=0, y=0, lppt=0x268efc0 | out: lppt=0x268efc0) returned 1
	[0107.708] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GetROP2 (hdc=0x190109af) returned 13
	[0107.709] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190109af) returned 0x0
	[0107.709] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0107.709] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190109af) returned 0x0
	[0107.709] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.930] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0107.930] InvalidateRect (hWnd=0x401b4, lpRect=0x20cf20, bErase=0) returned 1
	[0107.930] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0107.930] InvalidateRect (hWnd=0x401b4, lpRect=0x20ce70, bErase=0) returned 1
	[0107.930] UpdateWindow (hWnd=0x401b4) returned 0
	[0107.930] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20c388 | out: lpPaint=0x20c388) returned 0x10107f8
	[0107.930] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0107.930] GdipCreateFromHDC (hdc=0x1f0109af, graphics=0x20c190) returned 0x0
	[0107.930] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0107.930] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0107.930] GdipCreateMatrix (matrix=0x20c2c0) returned 0x0
	[0107.931] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.931] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c320) returned 0x0
	[0107.931] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.931] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.931] GdipCreateRegion (region=0x20c2c0) returned 0x0
	[0107.931] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.931] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2f0) returned 0x0
	[0107.931] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20c3c0) returned 0x0
	[0107.931] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd250dbd) returned 0x0
	[0107.931] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.931] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20b7a0) returned 0x0
	[0107.931] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0109af) returned 0x0
	[0107.931] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0107.932] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.932] CoTaskMemFree (pv=0x1b067660) 
	[0107.932] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20be90) returned 0x0
	[0107.932] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.932] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.932] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.932] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bec0) returned 0x0
	[0107.932] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20bec0) returned 0x0
	[0107.932] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20bec0) returned 0x0
	[0107.932] GdipGetFontSize (font=0x1b912930, size=0x20bec0) returned 0x0
	[0107.932] GdipGetFontStyle (font=0x1b912930, style=0x20bec0) returned 0x0
	[0107.932] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.932] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0107.933] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.933] CoTaskMemFree (pv=0x1b067660) 
	[0107.933] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bb50) returned 0x0
	[0107.933] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bb60) returned 0x0
	[0107.933] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0107.933] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0107.933] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.933] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.933] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.933] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20ba78, stringFormat=0x1b912930, boundingBox=0x20ba68, codepointsFitted=0x20ba64, linesFilled=0x20ba60) returned 0x0
	[0107.933] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.933] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0107.933] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0107.933] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.933] CoTaskMemFree (pv=0x1b067660) 
	[0107.934] GdipCreateRegion (region=0x20bad0) returned 0x0
	[0107.934] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.934] GdipCreateMatrix (matrix=0x20bad0) returned 0x0
	[0107.934] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0107.934] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20bb30) returned 0x0
	[0107.934] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.934] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0107.934] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0107.934] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20bb80) returned 0x0
	[0107.934] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20bb40) returned 0x0
	[0107.934] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20bb40) returned 0x0
	[0107.934] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.934] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bbb0) returned 0x0
	[0107.934] OffsetViewportOrgEx (in: hdc=0x1f0109af, x=0, y=0, lppt=0x268ff70 | out: lppt=0x268ff70) returned 1
	[0107.934] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0109af) returned 0x0
	[0107.934] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0107.935] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.935] CoTaskMemFree (pv=0x1b067660) 
	[0107.935] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bbf0) returned 0x0
	[0107.935] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.935] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0107.935] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0107.935] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20bc60) returned 0x0
	[0107.935] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20bb70, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0107.935] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0107.935] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0107.935] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0107.935] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0107.935] CoTaskMemFree (pv=0x1b067660) 
	[0107.935] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20bf50) returned 0x0
	[0107.935] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0107.935] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0107.935] GdipCreateRegion (region=0x20ba20) returned 0x0
	[0107.936] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0107.936] GdipCreateMatrix (matrix=0x20ba20) returned 0x0
	[0107.936] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0107.936] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20ba80) returned 0x0
	[0107.936] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.936] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0107.936] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0107.936] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20bad0) returned 0x0
	[0107.936] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20ba90) returned 0x0
	[0107.936] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20ba90) returned 0x0
	[0107.936] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0107.936] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bb00) returned 0x0
	[0107.936] OffsetViewportOrgEx (in: hdc=0x1f0109af, x=0, y=0, lppt=0x2690510 | out: lppt=0x2690510) returned 1
	[0107.936] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.936] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.936] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.936] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.936] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.936] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.937] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.937] GetROP2 (hdc=0x1f0109af) returned 13
	[0107.937] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0109af) returned 0x0
	[0107.937] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c290) returned 0x0
	[0107.937] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0109af) returned 0x0
	[0107.937] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0107.937] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0107.937] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0107.937] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0107.937] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20cc80) returned 0x0
	[0107.937] GetCapture () returned 0x401b4
	[0107.937] ReleaseCapture () returned 0
	[0107.937] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0108.164] GdipCreateFromHDC (hdc=0x20109b2, graphics=0x20c9d0) returned 0x0
	[0108.165] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0108.165] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0108.165] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0108.165] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0108.165] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0108.165] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0108.165] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0108.165] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0108.165] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0108.165] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0108.165] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0108.165] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd220dbd) returned 0x0
	[0108.165] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0108.165] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0108.165] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20109b2) returned 0x0
	[0108.165] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0108.166] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0108.166] CoTaskMemFree (pv=0x1b067660) 
	[0108.166] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0108.166] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0108.166] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0108.166] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0108.166] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0108.166] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0108.166] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0108.166] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0108.166] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0108.166] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0108.166] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0108.167] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0108.167] CoTaskMemFree (pv=0x1b067660) 
	[0108.167] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0108.167] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0108.167] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0108.167] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0108.167] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0108.167] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0108.167] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0108.167] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0108.167] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0108.167] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0108.167] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0108.168] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0108.168] CoTaskMemFree (pv=0x1b067660) 
	[0108.168] GdipCreateRegion (region=0x20c310) returned 0x0
	[0108.168] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0108.168] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0108.168] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0108.168] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0108.168] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0108.168] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0108.168] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0108.168] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0108.168] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0108.168] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0108.168] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0108.168] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0108.169] OffsetViewportOrgEx (in: hdc=0x20109b2, x=0, y=0, lppt=0x26913e8 | out: lppt=0x26913e8) returned 1
	[0108.169] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20109b2) returned 0x0
	[0108.169] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0108.169] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0108.169] CoTaskMemFree (pv=0x1b067660) 
	[0108.169] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0108.169] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0108.169] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0108.169] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0108.169] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0108.169] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0108.169] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0108.169] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0108.169] CoTaskMemAlloc (cb=0x13) returned 0x1b067660
	[0108.170] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0108.170] CoTaskMemFree (pv=0x1b067660) 
	[0108.170] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0108.170] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0108.170] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0108.170] GdipCreateRegion (region=0x20c260) returned 0x0
	[0108.170] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0108.170] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0108.170] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0108.170] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0108.170] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0108.170] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0108.170] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0108.170] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0108.170] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0108.170] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0108.170] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0108.170] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0108.170] OffsetViewportOrgEx (in: hdc=0x20109b2, x=0, y=0, lppt=0x2691988 | out: lppt=0x2691988) returned 1
	[0108.170] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GetROP2 (hdc=0x20109b2) returned 13
	[0108.171] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20109b2) returned 0x0
	[0108.171] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0108.171] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20109b2) returned 0x0
	[0108.171] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0110.399] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0110.399] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0110.399] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0110.399] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0110.399] GdipCreateFromHDC (hdc=0x2f0109ad, graphics=0x20d7e0) returned 0x0
	[0110.400] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0110.400] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0110.400] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0110.400] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.400] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0110.400] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0110.400] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.400] GdipCreateRegion (region=0x20d910) returned 0x0
	[0110.400] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.400] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0110.400] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0110.401] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd1f0dbd) returned 0x0
	[0110.401] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.401] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0110.401] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0109ad) returned 0x0
	[0110.401] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0110.401] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.401] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.401] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.401] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0110.401] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0110.402] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0110.402] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0110.402] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0110.402] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.402] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0110.402] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0110.402] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0110.402] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0110.402] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.402] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.402] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.403] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0110.403] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.403] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0110.403] GdipCreateRegion (region=0x20d120) returned 0x0
	[0110.403] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.403] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0110.403] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.403] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0110.403] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0110.403] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0110.403] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.404] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0110.404] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0110.404] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0110.404] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.404] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0110.404] OffsetViewportOrgEx (in: hdc=0x2f0109ad, x=0, y=0, lppt=0x26928f0 | out: lppt=0x26928f0) returned 1
	[0110.404] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0109ad) returned 0x0
	[0110.404] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0110.404] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.404] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.404] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.405] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0110.405] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0110.405] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0110.405] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.405] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0110.405] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0110.405] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0110.405] GdipCreateRegion (region=0x20d070) returned 0x0
	[0110.405] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.405] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0110.406] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.406] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0110.406] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0110.406] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0110.406] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.406] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0110.406] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0110.406] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0110.406] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.406] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0110.406] OffsetViewportOrgEx (in: hdc=0x2f0109ad, x=0, y=0, lppt=0x2692e90 | out: lppt=0x2692e90) returned 1
	[0110.406] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GetROP2 (hdc=0x2f0109ad) returned 13
	[0110.407] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0109ad) returned 0x0
	[0110.407] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0110.407] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0109ad) returned 0x0
	[0110.408] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0110.644] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0110.644] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0110.644] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0110.644] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0110.644] UpdateWindow (hWnd=0x201d8) 
	[0110.644] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0110.644] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0110.644] GdipCreateFromHDC (hdc=0xffffffffae0109c6, graphics=0x20cfa0) returned 0x0
	[0110.644] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0110.645] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0110.645] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0110.645] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.645] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0110.645] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0110.645] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.645] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0110.645] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.645] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0110.645] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0110.645] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd1c0dbd) returned 0x0
	[0110.646] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.646] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0110.646] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffae0109c6) returned 0x0
	[0110.646] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0110.646] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.646] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.646] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.646] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0110.646] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0110.646] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0110.647] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0110.647] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0110.647] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.647] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0110.647] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0110.647] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0110.647] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0110.647] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.647] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.648] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.648] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0110.648] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.648] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0110.648] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0110.648] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.648] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0110.648] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.648] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0110.648] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0110.648] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0110.649] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.649] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0110.649] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0110.649] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0110.649] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.649] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0110.649] OffsetViewportOrgEx (in: hdc=0xffffffffae0109c6, x=0, y=0, lppt=0x2693ec0 | out: lppt=0x2693ec0) returned 1
	[0110.649] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffae0109c6) returned 0x0
	[0110.649] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0110.649] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.649] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.650] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.650] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0110.650] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0110.650] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0110.650] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.650] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0110.650] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0110.650] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0110.650] GdipCreateRegion (region=0x20c830) returned 0x0
	[0110.650] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.651] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0110.651] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.651] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0110.651] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0110.651] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0110.651] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.651] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0110.651] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0110.651] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0110.651] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.651] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0110.651] OffsetViewportOrgEx (in: hdc=0xffffffffae0109c6, x=0, y=0, lppt=0x2694460 | out: lppt=0x2694460) returned 1
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GetROP2 (hdc=0xffffffffae0109c6) returned 13
	[0110.652] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffae0109c6) returned 0x0
	[0110.652] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0110.653] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffae0109c6) returned 0x0
	[0110.653] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0110.653] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0110.653] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0110.654] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0110.654] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26947a8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0110.654] ShellExecuteExW (pExecInfo=0x26949b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0110.683] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0110.684] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0110.684] GdipCreateFromHDC (hdc=0xffffffffb80109c7, graphics=0x20c9d0) returned 0x0
	[0110.685] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0110.685] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0110.685] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0110.685] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.685] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0110.685] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0110.685] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.685] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0110.685] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.685] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0110.686] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0110.686] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd190dbd) returned 0x0
	[0110.686] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.686] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0110.686] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80109c7) returned 0x0
	[0110.686] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0110.686] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.686] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.686] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.686] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0110.687] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0110.687] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0110.687] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0110.687] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0110.687] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.687] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0110.687] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0110.687] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0110.687] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0110.687] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.687] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.688] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.688] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0110.688] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.688] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0110.688] GdipCreateRegion (region=0x20c310) returned 0x0
	[0110.688] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.688] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0110.688] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.688] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0110.688] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0110.688] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0110.689] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.689] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0110.689] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0110.689] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0110.689] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.689] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0110.689] OffsetViewportOrgEx (in: hdc=0xffffffffb80109c7, x=0, y=0, lppt=0x2695698 | out: lppt=0x2695698) returned 1
	[0110.689] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80109c7) returned 0x0
	[0110.689] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0110.689] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.690] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.690] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.690] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0110.690] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0110.690] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0110.690] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.690] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0110.690] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0110.690] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0110.690] GdipCreateRegion (region=0x20c260) returned 0x0
	[0110.691] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.691] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0110.691] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.691] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0110.691] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0110.691] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0110.691] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.691] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0110.691] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0110.691] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0110.691] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.692] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0110.692] OffsetViewportOrgEx (in: hdc=0xffffffffb80109c7, x=0, y=0, lppt=0x2695c38 | out: lppt=0x2695c38) returned 1
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GetROP2 (hdc=0xffffffffb80109c7) returned 13
	[0110.692] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80109c7) returned 0x0
	[0110.693] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0110.693] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80109c7) returned 0x0
	[0110.693] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0110.693] GdipCreateFromHDC (hdc=0xffffffffba0109c7, graphics=0x20c9d0) returned 0x0
	[0110.693] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0110.693] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0110.693] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0110.693] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.694] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0110.694] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0110.694] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.694] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0110.694] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.694] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0110.694] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0110.694] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd160dbd) returned 0x0
	[0110.694] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.694] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0110.694] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0109c7) returned 0x0
	[0110.695] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0110.695] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.695] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.695] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.695] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0110.695] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0110.695] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0110.695] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0110.695] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0110.695] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.695] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0110.696] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0110.696] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0110.696] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0110.696] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.696] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.696] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.696] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0110.696] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.696] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0110.696] GdipCreateRegion (region=0x20c310) returned 0x0
	[0110.696] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.697] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0110.697] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.697] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0110.697] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0110.697] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0110.697] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.697] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0110.697] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0110.697] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0110.697] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.697] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0110.698] OffsetViewportOrgEx (in: hdc=0xffffffffba0109c7, x=0, y=0, lppt=0x2696ac0 | out: lppt=0x2696ac0) returned 1
	[0110.698] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0109c7) returned 0x0
	[0110.698] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0110.698] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.698] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.698] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.698] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0110.698] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0110.698] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0110.698] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.698] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0110.699] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0110.699] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0110.699] GdipCreateRegion (region=0x20c260) returned 0x0
	[0110.699] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.699] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0110.699] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.699] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0110.699] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0110.699] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0110.699] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.699] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0110.700] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0110.700] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0110.700] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.700] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0110.700] OffsetViewportOrgEx (in: hdc=0xffffffffba0109c7, x=0, y=0, lppt=0x2697060 | out: lppt=0x2697060) returned 1
	[0110.700] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.700] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.700] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.700] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.700] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.700] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.701] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.701] GetROP2 (hdc=0xffffffffba0109c7) returned 13
	[0110.701] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0109c7) returned 0x0
	[0110.701] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0110.701] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0109c7) returned 0x0
	[0110.701] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0110.882] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0110.882] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0110.882] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0110.882] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0110.882] GdipCreateFromHDC (hdc=0xfffffffff20109c7, graphics=0x20d7e0) returned 0x0
	[0110.882] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0110.883] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0110.883] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0110.883] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.883] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0110.883] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0110.883] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.883] GdipCreateRegion (region=0x20d910) returned 0x0
	[0110.883] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.883] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0110.883] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0110.883] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd130dbd) returned 0x0
	[0110.884] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.884] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0110.884] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff20109c7) returned 0x0
	[0110.884] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0110.884] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.884] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.884] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.884] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0110.884] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0110.884] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0110.885] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0110.885] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0110.885] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.885] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0110.885] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0110.885] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0110.885] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0110.885] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.885] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.885] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.886] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0110.886] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.886] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0110.886] GdipCreateRegion (region=0x20d120) returned 0x0
	[0110.886] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.886] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0110.886] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.886] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0110.886] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0110.886] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0110.886] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.887] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0110.887] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0110.887] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0110.887] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.887] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0110.887] OffsetViewportOrgEx (in: hdc=0xfffffffff20109c7, x=0, y=0, lppt=0x2698378 | out: lppt=0x2698378) returned 1
	[0110.887] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff20109c7) returned 0x0
	[0110.887] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0110.887] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.887] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.888] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.888] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0110.888] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0110.888] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0110.888] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.888] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0110.888] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0110.888] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0110.888] GdipCreateRegion (region=0x20d070) returned 0x0
	[0110.888] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.889] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0110.889] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.889] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0110.889] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0110.889] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0110.889] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.889] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0110.889] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0110.889] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0110.889] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.889] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0110.890] OffsetViewportOrgEx (in: hdc=0xfffffffff20109c7, x=0, y=0, lppt=0x2698918 | out: lppt=0x2698918) returned 1
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GetROP2 (hdc=0xfffffffff20109c7) returned 13
	[0110.890] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff20109c7) returned 0x0
	[0110.891] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0110.891] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff20109c7) returned 0x0
	[0110.891] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0110.891] GdipCreateFromHDC (hdc=0xfffffffff40109c7, graphics=0x20d7e0) returned 0x0
	[0110.891] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0110.891] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0110.891] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0110.891] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.891] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0110.892] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0110.892] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.892] GdipCreateRegion (region=0x20d910) returned 0x0
	[0110.892] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.892] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0110.892] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0110.892] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd100dbd) returned 0x0
	[0110.892] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.892] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0110.892] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff40109c7) returned 0x0
	[0110.893] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0110.893] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.893] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.893] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.893] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0110.893] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0110.893] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0110.893] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0110.893] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0110.894] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.894] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0110.894] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0110.894] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0110.894] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0110.894] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.894] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.894] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.894] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0110.894] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.895] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0110.895] GdipCreateRegion (region=0x20d120) returned 0x0
	[0110.895] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.895] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0110.895] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0110.895] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0110.895] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0110.895] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0110.895] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0110.895] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0110.896] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0110.896] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0110.896] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.896] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0110.896] OffsetViewportOrgEx (in: hdc=0xfffffffff40109c7, x=0, y=0, lppt=0x2699778 | out: lppt=0x2699778) returned 1
	[0110.896] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff40109c7) returned 0x0
	[0110.896] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0110.897] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.897] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0110.897] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0110.897] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0110.897] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0110.897] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0110.897] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0110.897] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0110.897] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0110.897] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0110.898] GdipCreateRegion (region=0x20d070) returned 0x0
	[0110.898] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0110.898] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0110.898] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0110.898] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0110.898] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0110.898] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0110.898] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0110.898] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0110.898] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0110.898] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0110.899] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0110.899] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0110.899] OffsetViewportOrgEx (in: hdc=0xfffffffff40109c7, x=0, y=0, lppt=0x2699d18 | out: lppt=0x2699d18) returned 1
	[0110.899] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.899] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.899] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.899] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.899] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.899] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.899] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.900] GetROP2 (hdc=0xfffffffff40109c7) returned 13
	[0110.900] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff40109c7) returned 0x0
	[0110.900] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0110.900] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xfffffffff40109c7) returned 0x0
	[0110.900] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0111.117] GdipCreateFromHDC (hdc=0x70107fc, graphics=0x20d7b0) returned 0x0
	[0111.117] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0111.117] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0111.117] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0111.117] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d700) returned 0x0
	[0111.117] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0111.117] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0111.117] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0111.118] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6d0) returned 0x0
	[0111.118] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0111.118] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d7a0) returned 0x0
	[0111.118] GdipCreateRegion (region=0x20d670) returned 0x0
	[0111.118] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0111.118] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0111.118] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0111.118] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d6d0) returned 0x0
	[0111.118] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0111.118] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0111.118] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d720) returned 0x0
	[0111.119] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0111.119] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d750) returned 0x0
	[0111.119] OffsetViewportOrgEx (in: hdc=0x70107fc, x=0, y=0, lppt=0x269a480 | out: lppt=0x269a480) returned 1
	[0111.119] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70107fc) returned 0x0
	[0111.119] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0111.120] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0111.120] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0111.120] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0111.120] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0111.120] UpdateWindow (hWnd=0x401b4) 
	[0111.120] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0111.120] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0111.121] GdipCreateFromHDC (hdc=0xa0109c7, graphics=0x20cfa0) returned 0x0
	[0111.121] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0111.121] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0111.121] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0111.121] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0111.121] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0111.121] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0111.121] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0111.121] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0111.121] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0111.121] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0111.122] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0111.122] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd0b0dbd) returned 0x0
	[0111.122] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0111.122] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0111.122] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0109c7) returned 0x0
	[0111.122] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0111.122] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0111.122] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0111.122] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0111.122] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0111.123] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0111.123] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0111.123] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0111.124] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0111.124] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0111.124] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0111.124] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0111.124] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0111.124] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0111.124] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0111.124] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0111.124] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0111.124] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0111.125] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0111.125] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0111.125] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0111.125] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0111.125] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0111.125] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0111.125] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0111.125] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0111.125] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0111.125] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0111.126] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0111.126] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0111.126] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0111.126] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0111.126] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0111.126] OffsetViewportOrgEx (in: hdc=0xa0109c7, x=0, y=0, lppt=0x269b270 | out: lppt=0x269b270) returned 1
	[0111.126] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0109c7) returned 0x0
	[0111.126] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0111.126] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0111.127] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0111.127] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0111.127] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0111.127] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0111.127] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0111.127] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0111.127] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0111.127] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0111.127] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0111.127] GdipCreateRegion (region=0x20c830) returned 0x0
	[0111.128] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0111.128] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0111.128] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0111.128] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0111.128] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0111.128] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0111.128] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0111.128] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0111.128] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0111.128] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0111.129] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0111.129] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0111.129] OffsetViewportOrgEx (in: hdc=0xa0109c7, x=0, y=0, lppt=0x269b810 | out: lppt=0x269b810) returned 1
	[0111.129] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.129] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.129] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.129] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.129] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.129] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.129] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.130] GetROP2 (hdc=0xa0109c7) returned 13
	[0111.130] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0109c7) returned 0x0
	[0111.130] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0111.130] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0109c7) returned 0x0
	[0111.130] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0111.130] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0111.130] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0111.130] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0111.130] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0111.130] GetCapture () returned 0x401b4
	[0111.131] ReleaseCapture () 
	[0111.131] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0111.131] GetDIBits (in: hdc=0x4010280, hbm=0x3f0508fc, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0111.131] GetDIBits (in: hdc=0x4010280, hbm=0x3f0508fc, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0111.131] GdipCreateFromHDC (hdc=0x240109bf, graphics=0x20d750) returned 0x0
	[0111.131] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0111.131] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0111.131] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0111.131] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0111.131] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0111.132] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0111.132] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0111.132] GdipCreateRegion (region=0x20d910) returned 0x0
	[0111.132] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0111.132] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0111.132] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0111.132] GdipCreateRegion (region=0x20d400) returned 0x0
	[0111.132] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0111.132] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0111.132] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0111.133] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d460) returned 0x0
	[0111.133] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0111.133] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0111.133] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0111.133] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0111.133] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0111.133] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0111.133] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0111.133] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0111.133] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0111.133] OffsetViewportOrgEx (in: hdc=0x240109bf, x=0, y=0, lppt=0x269d1c8 | out: lppt=0x269d1c8) returned 1
	[0111.134] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x240109bf) returned 0x0
	[0111.134] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffd080dbd) returned 0x0
	[0111.134] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0111.134] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0111.134] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x240109bf) returned 0x0
	[0111.134] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0111.134] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0111.134] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0111.134] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0111.135] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0111.135] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0111.135] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0111.135] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0111.135] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0111.135] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0111.135] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0111.135] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x240109bf) returned 0x0
	[0111.135] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0111.136] GetDIBits (in: hdc=0x10107f8, hbm=0x410508fc, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0111.136] GetDIBits (in: hdc=0x10107f8, hbm=0x410508fc, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0111.136] GdipCreateFromHDC (hdc=0x290109bd, graphics=0x20d800) returned 0x0
	[0111.136] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0111.136] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0111.136] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0111.136] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0111.136] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0111.136] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0111.137] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0111.137] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0111.137] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0111.137] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0111.137] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0111.137] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0111.137] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0111.137] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0111.137] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0111.137] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0111.138] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0111.138] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0111.138] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0111.138] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0111.138] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0111.138] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0111.138] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0111.138] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0111.138] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0111.138] OffsetViewportOrgEx (in: hdc=0x290109bd, x=0, y=0, lppt=0x269ed08 | out: lppt=0x269ed08) returned 1
	[0111.139] GdipReleaseDC (graphics=0x1b929550, hdc=0x290109bd) returned 0x0
	[0111.139] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffd060dbd) returned 0x0
	[0111.139] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0111.139] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0111.146] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0111.147] GdipReleaseDC (graphics=0x1b929550, hdc=0x290109bd) returned 0x0
	[0111.147] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0113.503] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0113.503] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0113.503] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0113.503] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0113.503] GdipCreateFromHDC (hdc=0x170109c6, graphics=0x20d7e0) returned 0x0
	[0113.504] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0113.504] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0113.504] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0113.504] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.504] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0113.504] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.504] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.504] GdipCreateRegion (region=0x20d910) returned 0x0
	[0113.505] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.505] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0113.505] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0113.505] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffd040dbd) returned 0x0
	[0113.505] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.505] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0113.505] GdipReleaseDC (graphics=0x1b929550, hdc=0x170109c6) returned 0x0
	[0113.505] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0113.506] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.506] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.506] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.506] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0113.506] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0113.506] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0113.506] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0113.506] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0113.507] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.507] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0113.507] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0113.507] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0113.507] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0113.507] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.507] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.507] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.508] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0113.508] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.508] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0113.508] GdipCreateRegion (region=0x20d120) returned 0x0
	[0113.508] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.508] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0113.508] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0113.508] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0113.509] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0113.509] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0113.509] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0113.509] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0113.509] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0113.509] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0113.509] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.509] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0113.510] OffsetViewportOrgEx (in: hdc=0x170109c6, x=0, y=0, lppt=0x269fbc8 | out: lppt=0x269fbc8) returned 1
	[0113.510] GdipReleaseDC (graphics=0x1b929550, hdc=0x170109c6) returned 0x0
	[0113.510] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0113.510] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.510] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.510] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.510] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0113.510] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0113.511] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0113.511] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.511] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0113.511] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0113.511] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0113.511] GdipCreateRegion (region=0x20d070) returned 0x0
	[0113.511] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.511] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0113.512] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.512] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0113.512] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.512] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.512] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.512] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0113.512] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0113.512] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0113.512] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.513] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0113.513] OffsetViewportOrgEx (in: hdc=0x170109c6, x=0, y=0, lppt=0x26a0168 | out: lppt=0x26a0168) returned 1
	[0113.513] GetROP2 (hdc=0x170109c6) returned 13
	[0113.513] GetROP2 (hdc=0x170109c6) returned 13
	[0113.513] GetROP2 (hdc=0x170109c6) returned 13
	[0113.513] GetROP2 (hdc=0x170109c6) returned 13
	[0113.513] GetROP2 (hdc=0x170109c6) returned 13
	[0113.513] GetROP2 (hdc=0x170109c6) returned 13
	[0113.514] GetROP2 (hdc=0x170109c6) returned 13
	[0113.514] GetROP2 (hdc=0x170109c6) returned 13
	[0113.514] GdipReleaseDC (graphics=0x1b929550, hdc=0x170109c6) returned 0x0
	[0113.514] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0113.514] GdipReleaseDC (graphics=0x1b929550, hdc=0x170109c6) returned 0x0
	[0113.514] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0113.514] GdipCreateFromHDC (hdc=0x190109c6, graphics=0x20d7e0) returned 0x0
	[0113.515] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0113.515] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0113.515] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0113.515] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0113.515] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0113.515] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0113.515] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0113.515] GdipCreateRegion (region=0x20d910) returned 0x0
	[0113.515] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.516] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0113.516] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0113.516] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffd010dbd) returned 0x0
	[0113.516] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.520] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0113.520] GdipReleaseDC (graphics=0x1b929550, hdc=0x190109c6) returned 0x0
	[0113.520] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0113.520] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.520] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.521] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.521] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0113.521] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0113.521] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0113.521] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0113.521] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0113.521] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.521] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0113.522] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0113.522] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0113.522] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0113.522] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.522] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.522] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.522] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0113.522] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.522] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0113.523] GdipCreateRegion (region=0x20d120) returned 0x0
	[0113.523] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.523] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0113.523] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.523] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0113.523] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.523] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.523] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.523] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0113.523] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0113.524] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0113.524] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.524] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0113.524] OffsetViewportOrgEx (in: hdc=0x190109c6, x=0, y=0, lppt=0x26a0fc8 | out: lppt=0x26a0fc8) returned 1
	[0113.524] GdipReleaseDC (graphics=0x1b929550, hdc=0x190109c6) returned 0x0
	[0113.524] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0113.524] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.524] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.525] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.525] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0113.525] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0113.525] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0113.525] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.525] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0113.525] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0113.525] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0113.525] GdipCreateRegion (region=0x20d070) returned 0x0
	[0113.525] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.526] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0113.526] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0113.526] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0113.526] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0113.526] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0113.526] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0113.526] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0113.526] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0113.526] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0113.526] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.527] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0113.527] OffsetViewportOrgEx (in: hdc=0x190109c6, x=0, y=0, lppt=0x26a1568 | out: lppt=0x26a1568) returned 1
	[0113.527] GetROP2 (hdc=0x190109c6) returned 13
	[0113.527] GetROP2 (hdc=0x190109c6) returned 13
	[0113.527] GetROP2 (hdc=0x190109c6) returned 13
	[0113.527] GetROP2 (hdc=0x190109c6) returned 13
	[0113.527] GetROP2 (hdc=0x190109c6) returned 13
	[0113.527] GetROP2 (hdc=0x190109c6) returned 13
	[0113.527] GetROP2 (hdc=0x190109c6) returned 13
	[0113.528] GetROP2 (hdc=0x190109c6) returned 13
	[0113.528] GdipReleaseDC (graphics=0x1b929550, hdc=0x190109c6) returned 0x0
	[0113.528] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0113.528] GdipReleaseDC (graphics=0x1b929550, hdc=0x190109c6) returned 0x0
	[0113.528] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0113.751] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0113.752] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0113.752] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0113.752] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0113.752] UpdateWindow (hWnd=0x201d8) 
	[0113.752] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0113.752] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0113.752] GdipCreateFromHDC (hdc=0x7d0109ba, graphics=0x20cfa0) returned 0x0
	[0113.752] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0113.752] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0113.752] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0113.753] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.753] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0113.753] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.753] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.753] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0113.753] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.753] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0113.753] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0113.753] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcfe0dbd) returned 0x0
	[0113.754] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.754] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0113.754] GdipReleaseDC (graphics=0x1b929550, hdc=0x7d0109ba) returned 0x0
	[0113.754] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0113.754] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.755] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.755] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.755] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0113.755] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0113.755] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0113.755] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0113.755] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0113.755] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.755] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0113.756] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0113.756] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0113.756] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0113.756] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.756] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.756] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.756] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0113.756] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.756] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0113.756] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0113.756] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.757] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0113.757] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0113.757] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0113.757] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0113.757] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0113.757] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0113.757] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0113.757] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0113.757] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0113.757] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.757] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0113.758] OffsetViewportOrgEx (in: hdc=0x7d0109ba, x=0, y=0, lppt=0x26a2598 | out: lppt=0x26a2598) returned 1
	[0113.758] GdipReleaseDC (graphics=0x1b929550, hdc=0x7d0109ba) returned 0x0
	[0113.758] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0113.758] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.758] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.758] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.758] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0113.758] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0113.758] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0113.758] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.759] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0113.759] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0113.759] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0113.759] GdipCreateRegion (region=0x20c830) returned 0x0
	[0113.759] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.759] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0113.759] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.759] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0113.759] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.759] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0113.760] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.760] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0113.760] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0113.760] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0113.760] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.760] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0113.760] OffsetViewportOrgEx (in: hdc=0x7d0109ba, x=0, y=0, lppt=0x26a2b38 | out: lppt=0x26a2b38) returned 1
	[0113.760] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.760] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.760] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.760] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.761] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.761] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.761] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.761] GetROP2 (hdc=0x7d0109ba) returned 13
	[0113.761] GdipReleaseDC (graphics=0x1b929550, hdc=0x7d0109ba) returned 0x0
	[0113.761] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0113.761] GdipReleaseDC (graphics=0x1b929550, hdc=0x7d0109ba) returned 0x0
	[0113.761] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0113.761] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0113.761] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0113.762] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0113.762] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26a2e80, Length=0x70 | out: Destination=0x1afe53a0) 
	[0113.762] ShellExecuteExW (in: pExecInfo=0x26a3090*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26a3090*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="\xffff\x74\x74\x70\x73\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x72\x6f\x66\x69\x6c\x65\x2e\x70\x68\x70\x3f\x69\x64\x3d\x31\x30\x30\x30\x32\x37\x30\x39\x31\x34\x35\x37\x37\x35\x34", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0113.898] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0113.898] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0113.899] GdipCreateFromHDC (hdc=0x4e0109cc, graphics=0x20d7e0) returned 0x0
	[0113.899] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0113.899] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0113.899] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0113.899] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0113.900] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0113.900] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.900] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0113.900] GdipCreateRegion (region=0x20d910) returned 0x0
	[0113.900] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.900] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0113.900] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0113.900] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcfb0dbd) returned 0x0
	[0113.900] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.900] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0113.901] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e0109cc) returned 0x0
	[0113.901] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0113.901] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.901] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.901] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.901] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0113.901] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0113.901] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0113.901] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0113.901] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0113.902] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.902] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0113.902] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0113.902] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0113.902] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0113.902] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.902] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.902] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.902] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0113.902] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.903] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0113.903] GdipCreateRegion (region=0x20d120) returned 0x0
	[0113.903] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.903] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0113.903] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.903] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0113.903] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.903] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.903] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.903] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0113.904] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0113.904] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0113.904] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.904] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0113.904] OffsetViewportOrgEx (in: hdc=0x4e0109cc, x=0, y=0, lppt=0x26a3d98 | out: lppt=0x26a3d98) returned 1
	[0113.904] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e0109cc) returned 0x0
	[0113.904] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0113.904] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.904] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.904] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.905] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0113.905] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0113.905] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0113.905] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.905] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0113.905] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0113.905] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0113.905] GdipCreateRegion (region=0x20d070) returned 0x0
	[0113.905] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.906] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0113.906] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0113.906] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0113.906] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.906] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.906] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0113.906] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0113.906] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0113.906] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0113.906] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.906] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0113.907] OffsetViewportOrgEx (in: hdc=0x4e0109cc, x=0, y=0, lppt=0x26a4338 | out: lppt=0x26a4338) returned 1
	[0113.907] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.907] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.907] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.918] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.918] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.918] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.918] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.918] GetROP2 (hdc=0x4e0109cc) returned 13
	[0113.918] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e0109cc) returned 0x0
	[0113.918] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0113.918] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e0109cc) returned 0x0
	[0113.919] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0113.919] GdipCreateFromHDC (hdc=0x500109cc, graphics=0x20d7e0) returned 0x0
	[0113.919] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0113.919] GdipSetClipRectI (graphics=0x1b929550, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0113.919] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0113.919] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.919] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0113.919] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.919] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.920] GdipCreateRegion (region=0x20d910) returned 0x0
	[0113.920] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.920] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0113.920] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0113.920] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcf80dbd) returned 0x0
	[0113.920] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.920] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0113.920] GdipReleaseDC (graphics=0x1b929550, hdc=0x500109cc) returned 0x0
	[0113.920] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0113.920] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.921] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.921] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.921] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0113.921] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0113.921] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0113.921] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0113.921] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0113.921] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.921] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0113.921] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0113.921] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0113.922] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0113.922] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.922] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.922] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.922] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0113.922] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.922] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0113.922] GdipCreateRegion (region=0x20d120) returned 0x0
	[0113.922] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.922] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0113.923] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0113.923] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0113.923] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.923] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.923] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0113.923] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0113.923] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0113.923] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0113.924] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.924] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0113.924] OffsetViewportOrgEx (in: hdc=0x500109cc, x=0, y=0, lppt=0x26a5198 | out: lppt=0x26a5198) returned 1
	[0113.924] GdipReleaseDC (graphics=0x1b929550, hdc=0x500109cc) returned 0x0
	[0113.924] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0113.924] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.924] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0113.924] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0113.924] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0113.924] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0113.925] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0113.925] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0113.925] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0113.925] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0113.925] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0113.925] GdipCreateRegion (region=0x20d070) returned 0x0
	[0113.925] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0113.925] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0113.925] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0113.925] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0113.926] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.926] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0113.926] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0113.926] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0113.926] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0113.926] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0113.926] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0113.926] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0113.926] OffsetViewportOrgEx (in: hdc=0x500109cc, x=0, y=0, lppt=0x26a5738 | out: lppt=0x26a5738) returned 1
	[0113.926] GetROP2 (hdc=0x500109cc) returned 13
	[0113.926] GetROP2 (hdc=0x500109cc) returned 13
	[0113.927] GetROP2 (hdc=0x500109cc) returned 13
	[0113.927] GetROP2 (hdc=0x500109cc) returned 13
	[0113.927] GetROP2 (hdc=0x500109cc) returned 13
	[0113.927] GetROP2 (hdc=0x500109cc) returned 13
	[0113.927] GetROP2 (hdc=0x500109cc) returned 13
	[0113.927] GetROP2 (hdc=0x500109cc) returned 13
	[0113.927] GdipReleaseDC (graphics=0x1b929550, hdc=0x500109cc) returned 0x0
	[0113.927] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0113.927] GdipReleaseDC (graphics=0x1b929550, hdc=0x500109cc) returned 0x0
	[0113.927] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0114.018] GdipCreateFromHDC (hdc=0x55010840, graphics=0x20d7e0) returned 0x0
	[0114.019] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0114.019] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0114.019] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0114.019] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0114.019] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0114.019] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0114.019] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0114.019] GdipCreateRegion (region=0x20d910) returned 0x0
	[0114.019] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0114.019] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0114.019] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0114.020] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcf50dbd) returned 0x0
	[0114.020] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0114.020] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0114.020] GdipReleaseDC (graphics=0x1b929550, hdc=0x55010840) returned 0x0
	[0114.020] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0114.020] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0114.020] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0114.020] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0114.020] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0114.021] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0114.021] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0114.021] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0114.021] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0114.021] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0114.021] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0114.021] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0114.021] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0114.021] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0114.021] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0114.022] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0114.022] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0114.022] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0114.022] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0114.022] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0114.022] GdipCreateRegion (region=0x20d120) returned 0x0
	[0114.022] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0114.022] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0114.022] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0114.022] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0114.022] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0114.023] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0114.023] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0114.023] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0114.023] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0114.023] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0114.023] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0114.023] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0114.023] OffsetViewportOrgEx (in: hdc=0x55010840, x=0, y=0, lppt=0x26a6798 | out: lppt=0x26a6798) returned 1
	[0114.023] GdipReleaseDC (graphics=0x1b929550, hdc=0x55010840) returned 0x0
	[0114.023] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0114.024] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0114.024] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0114.024] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0114.024] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0114.024] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0114.024] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0114.024] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0114.024] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0114.024] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0114.024] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0114.025] GdipCreateRegion (region=0x20d070) returned 0x0
	[0114.025] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0114.025] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0114.025] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0114.025] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0114.025] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0114.025] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0114.025] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0114.025] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0114.025] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0114.026] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0114.026] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0114.026] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0114.026] OffsetViewportOrgEx (in: hdc=0x55010840, x=0, y=0, lppt=0x26a6d38 | out: lppt=0x26a6d38) returned 1
	[0114.026] GetROP2 (hdc=0x55010840) returned 13
	[0114.026] GetROP2 (hdc=0x55010840) returned 13
	[0114.026] GetROP2 (hdc=0x55010840) returned 13
	[0114.026] GetROP2 (hdc=0x55010840) returned 13
	[0114.026] GetROP2 (hdc=0x55010840) returned 13
	[0114.027] GetROP2 (hdc=0x55010840) returned 13
	[0114.027] GetROP2 (hdc=0x55010840) returned 13
	[0114.027] GetROP2 (hdc=0x55010840) returned 13
	[0114.027] GdipReleaseDC (graphics=0x1b929550, hdc=0x55010840) returned 0x0
	[0114.027] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0114.027] GdipReleaseDC (graphics=0x1b929550, hdc=0x55010840) returned 0x0
	[0114.027] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0116.545] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0116.545] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0116.545] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0116.545] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0116.545] GdipCreateFromHDC (hdc=0xffffffff9d0109ba, graphics=0x20d7e0) returned 0x0
	[0116.545] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0116.546] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0116.546] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0116.546] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0116.546] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0116.546] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.546] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0116.546] GdipCreateRegion (region=0x20d910) returned 0x0
	[0116.546] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0116.546] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0116.546] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0116.547] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcf20dbd) returned 0x0
	[0116.547] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0116.547] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0116.547] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d0109ba) returned 0x0
	[0116.547] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0116.547] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.547] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.547] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0116.547] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0116.548] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0116.548] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0116.548] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0116.548] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0116.548] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0116.548] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0116.548] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0116.548] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0116.548] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0116.548] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0116.549] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.549] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.549] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0116.549] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0116.549] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0116.549] GdipCreateRegion (region=0x20d120) returned 0x0
	[0116.549] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0116.549] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0116.549] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0116.549] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0116.549] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.550] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.550] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0116.550] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0116.550] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0116.550] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0116.550] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0116.550] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0116.550] OffsetViewportOrgEx (in: hdc=0xffffffff9d0109ba, x=0, y=0, lppt=0x26a7c68 | out: lppt=0x26a7c68) returned 1
	[0116.550] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d0109ba) returned 0x0
	[0116.551] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0116.551] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.551] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.551] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0116.551] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0116.551] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0116.551] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0116.551] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0116.551] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0116.551] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0116.552] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0116.552] GdipCreateRegion (region=0x20d070) returned 0x0
	[0116.552] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0116.552] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0116.552] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0116.552] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0116.552] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.552] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.552] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0116.552] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0116.553] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0116.553] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0116.553] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0116.553] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0116.553] OffsetViewportOrgEx (in: hdc=0xffffffff9d0109ba, x=0, y=0, lppt=0x26a8208 | out: lppt=0x26a8208) returned 1
	[0116.553] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.553] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.553] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.553] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.553] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.554] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.554] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.554] GetROP2 (hdc=0xffffffff9d0109ba) returned 13
	[0116.554] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d0109ba) returned 0x0
	[0116.554] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0116.554] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d0109ba) returned 0x0
	[0116.554] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0116.774] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0116.774] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0116.774] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0116.774] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0116.774] UpdateWindow (hWnd=0x201d8) 
	[0116.774] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0116.774] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0116.775] GdipCreateFromHDC (hdc=0xffffffffe1010839, graphics=0x20cfa0) returned 0x0
	[0116.775] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0116.775] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0116.775] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0116.775] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0116.775] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0116.775] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.775] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0116.775] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0116.776] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0116.776] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0116.776] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0116.776] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcef0dbd) returned 0x0
	[0116.776] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0116.776] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0116.776] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe1010839) returned 0x0
	[0116.776] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0116.776] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.777] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.777] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0116.777] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0116.777] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0116.777] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0116.777] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0116.777] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0116.777] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0116.777] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0116.778] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0116.778] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0116.778] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0116.778] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0116.778] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.778] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.778] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0116.778] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0116.778] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0116.778] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0116.779] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0116.779] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0116.779] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0116.779] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0116.779] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.779] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.779] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0116.779] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0116.779] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0116.779] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0116.779] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0116.780] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0116.780] OffsetViewportOrgEx (in: hdc=0xffffffffe1010839, x=0, y=0, lppt=0x26a9200 | out: lppt=0x26a9200) returned 1
	[0116.780] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe1010839) returned 0x0
	[0116.780] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0116.780] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.780] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0116.780] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0116.780] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0116.780] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0116.781] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0116.781] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0116.781] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0116.781] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0116.781] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0116.781] GdipCreateRegion (region=0x20c830) returned 0x0
	[0116.781] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0116.781] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0116.781] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0116.781] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0116.781] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.782] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0116.782] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0116.782] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0116.782] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0116.782] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0116.782] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0116.782] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0116.782] OffsetViewportOrgEx (in: hdc=0xffffffffe1010839, x=0, y=0, lppt=0x26a97a0 | out: lppt=0x26a97a0) returned 1
	[0116.782] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.782] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.783] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.783] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.783] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.783] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.783] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.783] GetROP2 (hdc=0xffffffffe1010839) returned 13
	[0116.783] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe1010839) returned 0x0
	[0116.783] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0116.783] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe1010839) returned 0x0
	[0116.783] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0116.784] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0116.784] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0116.784] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0116.784] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26a9ae8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0116.784] ShellExecuteExW (pExecInfo=0x26a9cf8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0116.978] GetKeyState (nVirtKey=1) returned 1
	[0116.978] GetKeyState (nVirtKey=2) returned 0
	[0116.978] GetKeyState (nVirtKey=4) returned 0
	[0116.978] GetKeyState (nVirtKey=5) returned 0
	[0116.978] GetKeyState (nVirtKey=6) returned 0
	[0117.001] GdipCreateFromHDC (hdc=0x730108fd, graphics=0x20c9d0) returned 0x0
	[0117.002] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0117.002] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0117.002] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0117.002] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0117.002] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0117.002] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0117.002] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0117.002] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0117.003] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0117.003] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0117.003] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0117.003] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcec0dbd) returned 0x0
	[0117.003] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0117.003] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0117.003] GdipReleaseDC (graphics=0x1b929550, hdc=0x730108fd) returned 0x0
	[0117.003] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0117.003] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.004] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.004] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0117.004] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0117.004] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0117.004] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0117.004] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0117.004] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0117.004] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0117.004] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0117.004] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0117.005] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0117.005] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0117.005] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0117.005] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.005] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.005] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0117.005] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0117.005] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0117.005] GdipCreateRegion (region=0x20c310) returned 0x0
	[0117.005] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0117.006] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0117.006] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0117.006] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0117.006] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0117.006] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0117.006] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0117.006] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0117.006] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0117.006] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0117.006] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0117.006] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0117.007] OffsetViewportOrgEx (in: hdc=0x730108fd, x=0, y=0, lppt=0x26aaa00 | out: lppt=0x26aaa00) returned 1
	[0117.007] GdipReleaseDC (graphics=0x1b929550, hdc=0x730108fd) returned 0x0
	[0117.007] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0117.007] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.007] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.007] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0117.007] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0117.007] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0117.007] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0117.008] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0117.008] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0117.008] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0117.008] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0117.008] GdipCreateRegion (region=0x20c260) returned 0x0
	[0117.008] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0117.008] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0117.008] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0117.008] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0117.008] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0117.008] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0117.009] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0117.009] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0117.009] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0117.009] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0117.009] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0117.009] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0117.009] OffsetViewportOrgEx (in: hdc=0x730108fd, x=0, y=0, lppt=0x26aafa0 | out: lppt=0x26aafa0) returned 1
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GetROP2 (hdc=0x730108fd) returned 13
	[0117.010] GdipReleaseDC (graphics=0x1b929550, hdc=0x730108fd) returned 0x0
	[0117.010] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0117.011] GdipReleaseDC (graphics=0x1b929550, hdc=0x730108fd) returned 0x0
	[0117.011] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0117.095] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d770) returned 0x0
	[0117.096] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0117.096] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0117.096] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0117.096] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d6c0) returned 0x0
	[0117.096] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0117.096] GdipCreateRegion (region=0x20d660) returned 0x0
	[0117.096] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0117.096] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0117.096] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0117.096] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0117.097] GdipCreateRegion (region=0x20d630) returned 0x0
	[0117.097] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0117.097] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0117.097] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0117.097] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d690) returned 0x0
	[0117.097] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0117.097] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0117.097] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0117.097] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0117.097] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0117.098] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x26ab988 | out: lppt=0x26ab988) returned 1
	[0117.098] GdipReleaseDC (graphics=0x1b929550, hdc=0x10107f8) returned 0x0
	[0117.098] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0117.099] GetDIBits (in: hdc=0x70107fc, hbm=0x390509cd, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0117.099] GetDIBits (in: hdc=0x70107fc, hbm=0x390509cd, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0117.099] GdipCreateFromHDC (hdc=0xffffffffdc0109ba, graphics=0x20d750) returned 0x0
	[0117.099] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0117.099] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0117.099] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0117.099] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0117.099] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0117.100] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0117.100] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0117.100] GdipCreateRegion (region=0x20d910) returned 0x0
	[0117.100] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0117.100] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0117.100] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0117.100] GdipCreateRegion (region=0x20d400) returned 0x0
	[0117.100] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0117.100] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0117.100] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0117.100] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0117.101] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0117.101] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0117.101] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0117.101] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0117.101] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0117.101] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0117.101] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0117.101] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0117.101] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0117.101] OffsetViewportOrgEx (in: hdc=0xffffffffdc0109ba, x=0, y=0, lppt=0x26ad1b8 | out: lppt=0x26ad1b8) returned 1
	[0117.102] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffdc0109ba) returned 0x0
	[0117.102] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffce70dbd) returned 0x0
	[0117.102] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0117.102] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0117.102] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffdc0109ba) returned 0x0
	[0117.102] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0117.102] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0117.102] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0117.102] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0117.102] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0117.103] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0117.103] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0117.103] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0117.103] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0117.103] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0117.103] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0117.103] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffdc0109ba) returned 0x0
	[0117.103] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0117.104] GdipCreateFromHDC (hdc=0xffffffff880109bd, graphics=0x20d7e0) returned 0x0
	[0117.104] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0117.104] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0117.104] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0117.104] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0117.104] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0117.104] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0117.104] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0117.104] GdipCreateRegion (region=0x20d910) returned 0x0
	[0117.105] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0117.105] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0117.105] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0117.105] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffce50dbd) returned 0x0
	[0117.105] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0117.105] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0117.105] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff880109bd) returned 0x0
	[0117.106] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0117.106] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.106] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.106] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0117.106] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0117.106] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0117.106] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0117.107] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0117.107] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0117.107] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0117.107] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0117.107] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0117.107] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0117.107] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0117.107] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0117.107] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.108] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.108] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0117.108] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0117.108] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0117.108] GdipCreateRegion (region=0x20d120) returned 0x0
	[0117.108] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0117.108] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0117.108] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0117.108] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0117.108] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0117.109] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0117.109] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0117.109] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0117.109] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0117.109] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0117.109] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0117.109] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0117.109] OffsetViewportOrgEx (in: hdc=0xffffffff880109bd, x=0, y=0, lppt=0x26ae2a8 | out: lppt=0x26ae2a8) returned 1
	[0117.109] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff880109bd) returned 0x0
	[0117.109] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0117.110] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.110] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0117.110] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0117.110] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0117.110] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0117.110] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0117.110] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0117.110] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0117.110] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0117.111] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0117.111] GdipCreateRegion (region=0x20d070) returned 0x0
	[0117.111] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0117.111] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0117.111] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0117.111] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0117.111] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0117.111] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0117.111] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0117.111] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0117.111] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0117.112] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0117.112] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0117.112] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0117.112] OffsetViewportOrgEx (in: hdc=0xffffffff880109bd, x=0, y=0, lppt=0x26ae848 | out: lppt=0x26ae848) returned 1
	[0117.112] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.112] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.112] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.112] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.112] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.112] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.113] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.113] GetROP2 (hdc=0xffffffff880109bd) returned 13
	[0117.113] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff880109bd) returned 0x0
	[0117.113] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0117.113] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff880109bd) returned 0x0
	[0117.113] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0117.113] GetDIBits (in: hdc=0x4010280, hbm=0xffffffffbc0508c8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0117.113] GetDIBits (in: hdc=0x4010280, hbm=0xffffffffbc0508c8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0117.113] GdipCreateFromHDC (hdc=0x3d0109cd, graphics=0x20d800) returned 0x0
	[0117.114] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0117.114] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0117.114] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0117.114] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0117.114] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0117.114] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0117.115] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0117.115] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0117.115] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0117.115] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0117.115] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0117.115] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0117.115] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0117.115] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0117.115] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0117.115] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0117.116] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0117.116] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0117.116] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0117.116] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0117.116] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0117.116] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0117.116] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0117.116] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0117.116] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0117.116] OffsetViewportOrgEx (in: hdc=0x3d0109cd, x=0, y=0, lppt=0x26b0110 | out: lppt=0x26b0110) returned 1
	[0117.117] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3d0109cd) returned 0x0
	[0117.117] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffce20dbd) returned 0x0
	[0117.117] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0117.117] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0117.124] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0117.124] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3d0109cd) returned 0x0
	[0117.124] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0119.121] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0119.121] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0119.121] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0119.121] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0119.122] GdipCreateFromHDC (hdc=0xffffffffb80108d8, graphics=0x20d7e0) returned 0x0
	[0119.122] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0119.122] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0119.122] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0119.122] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.122] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0119.122] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.122] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.123] GdipCreateRegion (region=0x20d910) returned 0x0
	[0119.123] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.123] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0119.123] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0119.123] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffce00dbd) returned 0x0
	[0119.123] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.123] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0119.123] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80108d8) returned 0x0
	[0119.124] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0119.124] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.124] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.124] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.124] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0119.124] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0119.124] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0119.124] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0119.124] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0119.125] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.125] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0119.125] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0119.125] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0119.125] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0119.125] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.125] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.125] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.125] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0119.126] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.126] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0119.126] GdipCreateRegion (region=0x20d120) returned 0x0
	[0119.126] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.126] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0119.126] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.126] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0119.126] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.126] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.127] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.127] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0119.127] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0119.127] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0119.127] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.127] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0119.127] OffsetViewportOrgEx (in: hdc=0xffffffffb80108d8, x=0, y=0, lppt=0x26b1490 | out: lppt=0x26b1490) returned 1
	[0119.127] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80108d8) returned 0x0
	[0119.128] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0119.128] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.128] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.128] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.128] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0119.128] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0119.128] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0119.128] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.128] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0119.129] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0119.129] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0119.129] GdipCreateRegion (region=0x20d070) returned 0x0
	[0119.129] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.129] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0119.129] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.129] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0119.129] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.129] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.130] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.130] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0119.130] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0119.130] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0119.130] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.130] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0119.131] OffsetViewportOrgEx (in: hdc=0xffffffffb80108d8, x=0, y=0, lppt=0x26b1a30 | out: lppt=0x26b1a30) returned 1
	[0119.131] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.131] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.131] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.131] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.131] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.131] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.131] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.132] GetROP2 (hdc=0xffffffffb80108d8) returned 13
	[0119.132] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80108d8) returned 0x0
	[0119.132] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0119.132] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb80108d8) returned 0x0
	[0119.132] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0119.132] GdipCreateFromHDC (hdc=0xffffffffba0108d8, graphics=0x20d7e0) returned 0x0
	[0119.132] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0119.132] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0119.133] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0119.133] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.133] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0119.133] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.133] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.133] GdipCreateRegion (region=0x20d910) returned 0x0
	[0119.133] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.134] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0119.134] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0119.134] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcdd0dbd) returned 0x0
	[0119.134] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.134] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0119.134] GetCurrentObject (hdc=0xffffffffba0108d8, type=0x1) returned 0x1b00017
	[0119.134] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0108d8) returned 0x0
	[0119.135] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0119.135] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.135] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.135] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.135] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0119.135] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0119.135] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0119.135] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0119.135] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0119.136] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.136] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0119.136] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0119.136] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0119.136] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0119.136] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.136] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.136] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.136] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0119.137] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.137] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0119.137] GdipCreateRegion (region=0x20d120) returned 0x0
	[0119.137] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.137] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0119.137] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.137] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0119.137] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.137] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.138] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.138] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0119.138] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0119.138] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0119.138] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.138] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0119.138] OffsetViewportOrgEx (in: hdc=0xffffffffba0108d8, x=0, y=0, lppt=0x26b2890 | out: lppt=0x26b2890) returned 1
	[0119.138] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0108d8) returned 0x0
	[0119.138] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0119.139] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.139] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.139] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.139] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0119.139] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0119.139] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0119.139] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.139] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0119.139] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0119.140] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0119.140] GdipCreateRegion (region=0x20d070) returned 0x0
	[0119.140] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.140] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0119.140] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.140] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0119.140] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.140] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.140] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.141] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0119.141] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0119.141] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0119.141] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.141] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0119.141] OffsetViewportOrgEx (in: hdc=0xffffffffba0108d8, x=0, y=0, lppt=0x26b2e30 | out: lppt=0x26b2e30) returned 1
	[0119.141] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.141] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.141] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.142] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.142] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.142] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.142] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.142] GetROP2 (hdc=0xffffffffba0108d8) returned 13
	[0119.142] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0108d8) returned 0x0
	[0119.142] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0119.142] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba0108d8) returned 0x0
	[0119.143] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0119.354] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0119.354] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0119.355] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0119.355] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0119.355] UpdateWindow (hWnd=0x401b4) 
	[0119.355] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0119.355] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0119.355] GdipCreateFromHDC (hdc=0xffffffffc50108d8, graphics=0x20cfa0) returned 0x0
	[0119.355] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0119.355] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0119.355] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0119.355] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.355] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0119.355] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.356] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.356] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0119.356] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.356] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0119.356] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0119.356] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcda0dbd) returned 0x0
	[0119.356] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.356] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0119.356] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffc50108d8) returned 0x0
	[0119.357] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0119.357] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.357] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.357] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.357] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0119.357] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0119.357] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0119.357] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0119.357] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0119.357] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.357] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0119.358] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0119.358] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0119.358] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0119.358] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.358] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.358] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.358] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0119.358] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.358] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0119.359] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0119.359] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.359] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0119.359] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.359] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0119.359] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.359] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.359] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.359] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0119.359] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0119.359] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0119.360] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.360] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0119.360] OffsetViewportOrgEx (in: hdc=0xffffffffc50108d8, x=0, y=0, lppt=0x26b3dd8 | out: lppt=0x26b3dd8) returned 1
	[0119.360] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffc50108d8) returned 0x0
	[0119.360] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0119.360] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.360] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.360] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.360] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0119.361] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0119.361] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0119.361] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.361] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0119.361] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0119.361] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0119.361] GdipCreateRegion (region=0x20c830) returned 0x0
	[0119.361] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.361] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0119.361] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.362] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0119.362] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.362] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.362] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.362] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0119.362] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0119.362] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0119.362] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.362] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0119.362] OffsetViewportOrgEx (in: hdc=0xffffffffc50108d8, x=0, y=0, lppt=0x26b4378 | out: lppt=0x26b4378) returned 1
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GetROP2 (hdc=0xffffffffc50108d8) returned 13
	[0119.363] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffc50108d8) returned 0x0
	[0119.364] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0119.364] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffc50108d8) returned 0x0
	[0119.364] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0119.364] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0119.364] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0119.364] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0119.364] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0119.364] GetCapture () returned 0x401b4
	[0119.364] ReleaseCapture () 
	[0119.364] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0119.568] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0119.568] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0119.568] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0119.568] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0119.569] GdipCreateFromHDC (hdc=0x50010840, graphics=0x20d7e0) returned 0x0
	[0119.569] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0119.569] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0119.569] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0119.569] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.569] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0119.569] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.570] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.570] GdipCreateRegion (region=0x20d910) returned 0x0
	[0119.570] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.570] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0119.570] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0119.570] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcd70dbd) returned 0x0
	[0119.570] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.570] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0119.571] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x50010840) returned 0x0
	[0119.571] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0119.571] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.571] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.571] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.573] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0119.573] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0119.573] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0119.573] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0119.574] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0119.574] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.574] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0119.574] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0119.574] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0119.574] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0119.574] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.574] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.574] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.575] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0119.575] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.575] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0119.575] GdipCreateRegion (region=0x20d120) returned 0x0
	[0119.575] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.575] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0119.575] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.575] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0119.575] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.575] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.576] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.576] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0119.576] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0119.576] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0119.576] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.576] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0119.576] OffsetViewportOrgEx (in: hdc=0x50010840, x=0, y=0, lppt=0x26b52e8 | out: lppt=0x26b52e8) returned 1
	[0119.576] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x50010840) returned 0x0
	[0119.576] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0119.576] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.577] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.577] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.577] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0119.577] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0119.577] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0119.577] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.577] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0119.577] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0119.577] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0119.578] GdipCreateRegion (region=0x20d070) returned 0x0
	[0119.578] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.578] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0119.578] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.578] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0119.578] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.578] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.578] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.578] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0119.578] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0119.579] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0119.579] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.579] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0119.579] OffsetViewportOrgEx (in: hdc=0x50010840, x=0, y=0, lppt=0x26b5888 | out: lppt=0x26b5888) returned 1
	[0119.579] GetROP2 (hdc=0x50010840) returned 13
	[0119.579] GetROP2 (hdc=0x50010840) returned 13
	[0119.579] GetROP2 (hdc=0x50010840) returned 13
	[0119.579] GetROP2 (hdc=0x50010840) returned 13
	[0119.579] GetROP2 (hdc=0x50010840) returned 13
	[0119.579] GetROP2 (hdc=0x50010840) returned 13
	[0119.580] GetROP2 (hdc=0x50010840) returned 13
	[0119.580] GetROP2 (hdc=0x50010840) returned 13
	[0119.580] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x50010840) returned 0x0
	[0119.580] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0119.580] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x50010840) returned 0x0
	[0119.580] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0119.581] GdipCreateFromHDC (hdc=0x52010840, graphics=0x20d7e0) returned 0x0
	[0119.581] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0119.581] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0119.581] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0119.581] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.581] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0119.581] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.581] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.581] GdipCreateRegion (region=0x20d910) returned 0x0
	[0119.581] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.582] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0119.582] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0119.582] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcd40dbd) returned 0x0
	[0119.582] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.582] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0119.582] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x52010840) returned 0x0
	[0119.582] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0119.582] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.582] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.583] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.583] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0119.583] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0119.583] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0119.583] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0119.583] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0119.583] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.583] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0119.583] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0119.584] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0119.584] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0119.584] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.584] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.584] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.584] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0119.584] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.585] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0119.585] GdipCreateRegion (region=0x20d120) returned 0x0
	[0119.585] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.585] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0119.585] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.585] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0119.585] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.585] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.586] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.586] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0119.586] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0119.586] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0119.586] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.586] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0119.586] OffsetViewportOrgEx (in: hdc=0x52010840, x=0, y=0, lppt=0x26b66e8 | out: lppt=0x26b66e8) returned 1
	[0119.586] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x52010840) returned 0x0
	[0119.587] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0119.587] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.587] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.587] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.587] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0119.587] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0119.587] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0119.587] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.587] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0119.588] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0119.588] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0119.588] GdipCreateRegion (region=0x20d070) returned 0x0
	[0119.588] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.588] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0119.588] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.588] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0119.588] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.588] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.588] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.589] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0119.589] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0119.589] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0119.589] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.589] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0119.589] OffsetViewportOrgEx (in: hdc=0x52010840, x=0, y=0, lppt=0x26b6c88 | out: lppt=0x26b6c88) returned 1
	[0119.589] GetROP2 (hdc=0x52010840) returned 13
	[0119.589] GetROP2 (hdc=0x52010840) returned 13
	[0119.589] GetROP2 (hdc=0x52010840) returned 13
	[0119.590] GetROP2 (hdc=0x52010840) returned 13
	[0119.590] GetROP2 (hdc=0x52010840) returned 13
	[0119.590] GetROP2 (hdc=0x52010840) returned 13
	[0119.590] GetROP2 (hdc=0x52010840) returned 13
	[0119.590] GetROP2 (hdc=0x52010840) returned 13
	[0119.592] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x52010840) returned 0x0
	[0119.592] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0119.592] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x52010840) returned 0x0
	[0119.593] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0119.791] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0119.791] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0119.791] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0119.791] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0119.791] UpdateWindow (hWnd=0x201d8) 
	[0119.791] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0119.791] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0119.791] GdipCreateFromHDC (hdc=0xffffffffff0109c6, graphics=0x20cfa0) returned 0x0
	[0119.791] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0119.791] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0119.792] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0119.792] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.792] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0119.792] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.792] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.792] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0119.792] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.792] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0119.792] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0119.793] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcd10dbd) returned 0x0
	[0119.793] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.793] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0119.793] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffff0109c6) returned 0x0
	[0119.793] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0119.793] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.793] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.793] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.793] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0119.794] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0119.794] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0119.794] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0119.794] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0119.794] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.794] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0119.794] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0119.794] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0119.794] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0119.795] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.795] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.795] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.795] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0119.795] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.795] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0119.795] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0119.796] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.796] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0119.796] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0119.796] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0119.796] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.796] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0119.796] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0119.796] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0119.796] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0119.796] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0119.797] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.797] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0119.797] OffsetViewportOrgEx (in: hdc=0xffffffffff0109c6, x=0, y=0, lppt=0x26b7cb8 | out: lppt=0x26b7cb8) returned 1
	[0119.797] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffff0109c6) returned 0x0
	[0119.797] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0119.797] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.797] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0119.797] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0119.797] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0119.798] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0119.798] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0119.798] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0119.798] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0119.798] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0119.798] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0119.798] GdipCreateRegion (region=0x20c830) returned 0x0
	[0119.798] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0119.799] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0119.799] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0119.799] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0119.799] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.799] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0119.799] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0119.799] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0119.799] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0119.799] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0119.799] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0119.800] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0119.800] OffsetViewportOrgEx (in: hdc=0xffffffffff0109c6, x=0, y=0, lppt=0x26b8258 | out: lppt=0x26b8258) returned 1
	[0119.800] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.800] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.800] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.800] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.800] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.800] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.800] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.801] GetROP2 (hdc=0xffffffffff0109c6) returned 13
	[0119.801] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffff0109c6) returned 0x0
	[0119.801] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0119.801] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffff0109c6) returned 0x0
	[0119.801] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0119.801] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0119.801] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0119.802] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0119.802] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26b85a0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0119.802] ShellExecuteExW (pExecInfo=0x26b87b0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0120.009] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0120.009] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0120.010] GdipCreateFromHDC (hdc=0xffffffffd40108fc, graphics=0x20c9d0) returned 0x0
	[0120.010] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0120.010] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0120.010] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0120.010] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0120.010] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0120.010] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0120.010] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0120.011] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0120.011] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0120.011] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0120.011] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0120.011] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcce0dbd) returned 0x0
	[0120.011] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0120.011] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0120.011] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd40108fc) returned 0x0
	[0120.011] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0120.012] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.012] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.012] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0120.012] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0120.012] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0120.012] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0120.012] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0120.012] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0120.012] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0120.013] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0120.013] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0120.013] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0120.013] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0120.013] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0120.013] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.014] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.014] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0120.014] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0120.014] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0120.014] GdipCreateRegion (region=0x20c310) returned 0x0
	[0120.014] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0120.014] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0120.014] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0120.014] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0120.015] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0120.015] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0120.015] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0120.015] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0120.015] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0120.015] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0120.015] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0120.015] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0120.015] OffsetViewportOrgEx (in: hdc=0xffffffffd40108fc, x=0, y=0, lppt=0x26b9490 | out: lppt=0x26b9490) returned 1
	[0120.016] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd40108fc) returned 0x0
	[0120.016] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0120.016] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.016] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.016] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0120.016] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0120.016] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0120.016] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0120.017] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0120.017] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0120.017] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0120.017] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0120.017] GdipCreateRegion (region=0x20c260) returned 0x0
	[0120.017] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0120.017] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0120.017] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0120.018] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0120.018] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0120.018] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0120.018] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0120.018] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0120.018] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0120.018] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0120.018] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0120.018] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0120.019] OffsetViewportOrgEx (in: hdc=0xffffffffd40108fc, x=0, y=0, lppt=0x26b9a30 | out: lppt=0x26b9a30) returned 1
	[0120.019] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.019] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.019] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.019] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.019] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.019] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.019] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.020] GetROP2 (hdc=0xffffffffd40108fc) returned 13
	[0120.020] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd40108fc) returned 0x0
	[0120.020] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0120.020] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd40108fc) returned 0x0
	[0120.020] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0120.020] GdipCreateFromHDC (hdc=0xffffffffd60108fc, graphics=0x20c9d0) returned 0x0
	[0120.020] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0120.020] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0120.021] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0120.021] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0120.021] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0120.021] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0120.021] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0120.021] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0120.021] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0120.021] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0120.022] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0120.022] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffccb0dbd) returned 0x0
	[0120.022] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0120.022] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0120.022] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd60108fc) returned 0x0
	[0120.023] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0120.023] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.023] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.023] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0120.023] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0120.023] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0120.023] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0120.024] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0120.024] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0120.024] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0120.024] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0120.024] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0120.024] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0120.024] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0120.024] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0120.024] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.025] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.025] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0120.025] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0120.025] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0120.025] GdipCreateRegion (region=0x20c310) returned 0x0
	[0120.025] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0120.025] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0120.025] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0120.025] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0120.026] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0120.026] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0120.026] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0120.026] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0120.026] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0120.026] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0120.026] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0120.026] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0120.026] OffsetViewportOrgEx (in: hdc=0xffffffffd60108fc, x=0, y=0, lppt=0x26ba8b8 | out: lppt=0x26ba8b8) returned 1
	[0120.027] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd60108fc) returned 0x0
	[0120.027] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0120.027] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.027] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0120.027] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0120.027] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0120.027] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0120.027] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0120.027] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0120.028] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0120.028] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0120.028] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0120.028] GdipCreateRegion (region=0x20c260) returned 0x0
	[0120.028] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0120.028] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0120.028] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0120.028] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0120.028] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0120.029] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0120.029] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0120.029] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0120.029] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0120.029] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0120.029] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0120.029] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0120.029] OffsetViewportOrgEx (in: hdc=0xffffffffd60108fc, x=0, y=0, lppt=0x26bae58 | out: lppt=0x26bae58) returned 1
	[0120.029] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.029] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.030] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.030] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.030] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.030] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.030] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.030] GetROP2 (hdc=0xffffffffd60108fc) returned 13
	[0120.030] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd60108fc) returned 0x0
	[0120.030] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0120.030] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffd60108fc) returned 0x0
	[0120.031] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0122.160] GdipCreateFromHDC (hdc=0x780109ca, graphics=0x20d7e0) returned 0x0
	[0122.161] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0122.161] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0122.161] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0122.161] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0122.161] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0122.161] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0122.161] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0122.161] GdipCreateRegion (region=0x20d910) returned 0x0
	[0122.161] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0122.162] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0122.162] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0122.162] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcc80dbd) returned 0x0
	[0122.162] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0122.162] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0122.162] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x780109ca) returned 0x0
	[0122.162] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0122.163] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0122.163] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0122.163] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0122.163] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0122.163] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0122.163] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0122.163] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0122.163] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0122.164] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0122.164] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0122.164] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0122.164] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0122.164] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0122.164] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0122.164] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0122.164] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0122.165] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0122.165] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0122.165] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0122.165] GdipCreateRegion (region=0x20d120) returned 0x0
	[0122.165] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0122.165] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0122.165] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0122.165] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0122.166] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0122.166] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0122.166] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0122.166] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0122.166] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0122.166] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0122.166] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0122.166] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0122.166] OffsetViewportOrgEx (in: hdc=0x780109ca, x=0, y=0, lppt=0x26bbf40 | out: lppt=0x26bbf40) returned 1
	[0122.167] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x780109ca) returned 0x0
	[0122.167] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0122.167] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0122.167] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0122.167] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0122.167] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0122.167] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0122.167] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0122.168] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0122.168] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0122.168] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0122.168] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0122.168] GdipCreateRegion (region=0x20d070) returned 0x0
	[0122.168] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0122.168] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0122.168] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0122.168] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0122.169] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0122.169] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0122.169] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0122.169] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0122.169] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0122.169] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0122.169] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0122.169] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0122.169] OffsetViewportOrgEx (in: hdc=0x780109ca, x=0, y=0, lppt=0x26bc4e0 | out: lppt=0x26bc4e0) returned 1
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.170] GetROP2 (hdc=0x780109ca) returned 13
	[0122.171] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x780109ca) returned 0x0
	[0122.171] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0122.171] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x780109ca) returned 0x0
	[0122.171] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0123.058] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0123.058] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x20
	[0123.058] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0123.058] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0123.059] GdipCreateFromHDC (hdc=0x260109cc, graphics=0x20d7e0) returned 0x0
	[0123.059] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0123.059] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0123.059] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0123.059] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0123.059] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0123.059] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0123.059] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0123.059] GdipCreateRegion (region=0x20d910) returned 0x0
	[0123.059] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.059] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0123.059] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0123.059] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcc50dbd) returned 0x0
	[0123.059] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.059] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0123.060] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x260109cc) returned 0x0
	[0123.060] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0123.060] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.060] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.060] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.060] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0123.060] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0123.060] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0123.060] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0123.060] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0123.060] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.060] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0123.061] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0123.061] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0123.061] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0123.061] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.061] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.061] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.061] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0123.061] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.061] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0123.061] GdipCreateRegion (region=0x20d120) returned 0x0
	[0123.061] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.061] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0123.061] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0123.061] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0123.061] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0123.061] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0123.061] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0123.062] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0123.062] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0123.062] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0123.062] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.062] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0123.062] OffsetViewportOrgEx (in: hdc=0x260109cc, x=0, y=0, lppt=0x26bd3d8 | out: lppt=0x26bd3d8) returned 1
	[0123.062] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x260109cc) returned 0x0
	[0123.062] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0123.062] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.062] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.062] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.062] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0123.062] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0123.062] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0123.062] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.062] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0123.063] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0123.063] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0123.063] GdipCreateRegion (region=0x20d070) returned 0x0
	[0123.063] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.063] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0123.063] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0123.063] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0123.063] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0123.063] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0123.063] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0123.063] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0123.063] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0123.063] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0123.063] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.063] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0123.063] OffsetViewportOrgEx (in: hdc=0x260109cc, x=0, y=0, lppt=0x26bd978 | out: lppt=0x26bd978) returned 1
	[0123.063] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GetROP2 (hdc=0x260109cc) returned 13
	[0123.064] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x260109cc) returned 0x0
	[0123.064] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0123.064] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x260109cc) returned 0x0
	[0123.064] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0123.298] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0123.298] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0123.298] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0123.298] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0123.298] UpdateWindow (hWnd=0x201d8) 
	[0123.298] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0123.299] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0123.299] GdipCreateFromHDC (hdc=0x1c0109e2, graphics=0x20cfa0) returned 0x0
	[0123.299] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0123.299] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0123.299] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0123.299] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0123.299] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0123.299] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0123.299] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0123.299] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0123.299] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.299] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0123.300] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0123.300] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcc20dbd) returned 0x0
	[0123.300] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.300] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0123.300] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0109e2) returned 0x0
	[0123.300] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0123.300] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.300] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.300] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.300] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0123.300] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0123.300] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0123.301] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0123.301] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0123.301] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.301] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0123.301] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0123.301] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0123.301] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0123.301] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.301] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.301] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.301] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0123.301] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.301] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0123.302] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0123.302] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.302] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0123.302] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0123.302] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0123.302] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0123.302] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0123.302] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0123.302] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0123.302] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0123.302] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0123.302] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.302] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0123.302] OffsetViewportOrgEx (in: hdc=0x1c0109e2, x=0, y=0, lppt=0x26be9d0 | out: lppt=0x26be9d0) returned 1
	[0123.303] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0109e2) returned 0x0
	[0123.303] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0123.303] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.303] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.303] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.303] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0123.303] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0123.303] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0123.303] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.303] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0123.303] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0123.303] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0123.304] GdipCreateRegion (region=0x20c830) returned 0x0
	[0123.304] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.304] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0123.304] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0123.304] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0123.304] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0123.304] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0123.304] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0123.304] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0123.304] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0123.304] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0123.304] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.304] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0123.304] OffsetViewportOrgEx (in: hdc=0x1c0109e2, x=0, y=0, lppt=0x26bef70 | out: lppt=0x26bef70) returned 1
	[0123.304] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GetROP2 (hdc=0x1c0109e2) returned 13
	[0123.305] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0109e2) returned 0x0
	[0123.305] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0123.305] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0109e2) returned 0x0
	[0123.305] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0123.305] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0123.305] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0123.306] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0123.306] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26bf2b8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0123.306] ShellExecuteExW (pExecInfo=0x26bf4c8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0123.352] GetKeyState (nVirtKey=1) returned 0
	[0123.352] GetKeyState (nVirtKey=2) returned 0
	[0123.352] GetKeyState (nVirtKey=4) returned 0
	[0123.352] GetKeyState (nVirtKey=5) returned 0
	[0123.352] GetKeyState (nVirtKey=6) returned 0
	[0123.390] GdipCreateFromHDC (hdc=0x47010839, graphics=0x20c9d0) returned 0x0
	[0123.390] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0123.391] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0123.391] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0123.391] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0123.391] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0123.391] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0123.391] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0123.391] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0123.391] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.391] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0123.391] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0123.391] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcbf0dbd) returned 0x0
	[0123.391] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.391] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0123.391] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x47010839) returned 0x0
	[0123.392] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0123.399] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.399] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.399] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.399] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0123.399] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0123.399] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0123.399] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0123.399] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0123.399] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.399] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0123.400] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0123.400] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0123.400] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0123.400] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.400] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.400] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.400] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0123.400] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.400] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0123.400] GdipCreateRegion (region=0x20c310) returned 0x0
	[0123.400] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.400] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0123.400] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0123.400] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0123.401] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0123.401] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0123.401] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0123.401] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0123.401] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0123.401] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0123.401] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.401] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0123.401] OffsetViewportOrgEx (in: hdc=0x47010839, x=0, y=0, lppt=0x26c01d0 | out: lppt=0x26c01d0) returned 1
	[0123.401] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x47010839) returned 0x0
	[0123.401] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0123.401] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.401] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.401] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.402] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0123.402] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0123.402] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0123.402] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.402] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0123.402] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0123.402] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0123.402] GdipCreateRegion (region=0x20c260) returned 0x0
	[0123.402] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.402] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0123.402] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0123.402] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0123.402] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0123.402] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0123.403] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0123.403] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0123.403] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0123.403] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0123.403] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.403] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0123.403] OffsetViewportOrgEx (in: hdc=0x47010839, x=0, y=0, lppt=0x26c0770 | out: lppt=0x26c0770) returned 1
	[0123.403] GetROP2 (hdc=0x47010839) returned 13
	[0123.403] GetROP2 (hdc=0x47010839) returned 13
	[0123.403] GetROP2 (hdc=0x47010839) returned 13
	[0123.403] GetROP2 (hdc=0x47010839) returned 13
	[0123.403] GetROP2 (hdc=0x47010839) returned 13
	[0123.403] GetROP2 (hdc=0x47010839) returned 13
	[0123.403] GetROP2 (hdc=0x47010839) returned 13
	[0123.404] GetROP2 (hdc=0x47010839) returned 13
	[0123.404] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x47010839) returned 0x0
	[0123.404] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0123.404] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x47010839) returned 0x0
	[0123.404] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0123.579] GdipCreateFromHDC (hdc=0x80109f0, graphics=0x20d7e0) returned 0x0
	[0123.580] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0123.580] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0123.580] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0123.580] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0123.580] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0123.580] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0123.580] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0123.580] GdipCreateRegion (region=0x20d910) returned 0x0
	[0123.580] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.580] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0123.580] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0123.581] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcbc0dbd) returned 0x0
	[0123.581] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.581] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0123.581] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80109f0) returned 0x0
	[0123.581] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0123.581] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.581] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.581] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.581] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0123.581] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0123.581] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0123.581] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0123.582] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0123.582] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.582] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0123.582] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0123.582] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0123.582] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0123.582] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.582] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.582] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.582] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0123.582] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.583] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0123.583] GdipCreateRegion (region=0x20d120) returned 0x0
	[0123.583] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.583] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0123.583] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0123.583] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0123.583] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0123.583] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0123.583] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0123.583] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0123.583] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0123.583] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0123.583] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.584] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0123.584] OffsetViewportOrgEx (in: hdc=0x80109f0, x=0, y=0, lppt=0x26c16f0 | out: lppt=0x26c16f0) returned 1
	[0123.584] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80109f0) returned 0x0
	[0123.584] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0123.584] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.584] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0123.584] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0123.584] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0123.584] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0123.585] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0123.585] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0123.585] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0123.585] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0123.585] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0123.585] GdipCreateRegion (region=0x20d070) returned 0x0
	[0123.585] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0123.585] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0123.585] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0123.585] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0123.585] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0123.585] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0123.586] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0123.586] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0123.586] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0123.586] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0123.586] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0123.586] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0123.586] OffsetViewportOrgEx (in: hdc=0x80109f0, x=0, y=0, lppt=0x26c1c90 | out: lppt=0x26c1c90) returned 1
	[0123.586] GetROP2 (hdc=0x80109f0) returned 13
	[0123.586] GetROP2 (hdc=0x80109f0) returned 13
	[0123.586] GetROP2 (hdc=0x80109f0) returned 13
	[0123.586] GetROP2 (hdc=0x80109f0) returned 13
	[0123.587] GetROP2 (hdc=0x80109f0) returned 13
	[0123.587] GetROP2 (hdc=0x80109f0) returned 13
	[0123.587] GetROP2 (hdc=0x80109f0) returned 13
	[0123.587] GetROP2 (hdc=0x80109f0) returned 13
	[0123.587] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80109f0) returned 0x0
	[0123.587] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0123.587] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80109f0) returned 0x0
	[0123.587] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0125.223] CoTaskMemAlloc (cb=0x26) returned 0x349e30
	[0125.223] GetWindowTextW (hWnd=0x50120, lpString=0x349e30, nMaxCount=17) 
	[0125.223] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x349e30) returned 0x10
	[0125.224] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d770) returned 0x0
	[0125.224] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0125.224] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0125.224] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0125.224] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d6c0) returned 0x0
	[0125.224] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0125.224] GdipCreateRegion (region=0x20d660) returned 0x0
	[0125.225] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0125.225] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d690) returned 0x0
	[0125.225] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0125.225] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d760) returned 0x0
	[0125.225] GdipCreateRegion (region=0x20d630) returned 0x0
	[0125.225] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0125.225] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0125.226] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0125.226] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d690) returned 0x0
	[0125.226] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.226] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0125.226] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6e0) returned 0x0
	[0125.226] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0125.226] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d710) returned 0x0
	[0125.226] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x26c23f8 | out: lppt=0x26c23f8) returned 1
	[0125.227] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4010280) returned 0x0
	[0125.227] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0125.228] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0125.228] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0125.228] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0125.228] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0125.228] GetDIBits (in: hdc=0x10107f8, hbm=0x12050a29, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0125.229] GetDIBits (in: hdc=0x10107f8, hbm=0x12050a29, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0125.229] GdipCreateFromHDC (hdc=0x17010a27, graphics=0x20d750) returned 0x0
	[0125.229] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0125.229] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0125.229] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0125.229] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0125.229] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0125.230] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0125.230] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0125.230] GdipCreateRegion (region=0x20d910) returned 0x0
	[0125.230] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0125.230] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0125.230] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0125.230] GdipCreateRegion (region=0x20d400) returned 0x0
	[0125.230] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0125.231] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0125.231] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0125.231] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0125.231] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.231] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0125.231] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.231] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0125.231] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0125.232] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0125.232] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0125.232] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0125.232] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0125.232] OffsetViewportOrgEx (in: hdc=0x17010a27, x=0, y=0, lppt=0x26c3c78 | out: lppt=0x26c3c78) returned 1
	[0125.232] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17010a27) returned 0x0
	[0125.232] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffcb70dbd) returned 0x0
	[0125.233] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0125.233] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0125.233] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17010a27) returned 0x0
	[0125.233] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0125.233] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0125.233] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0125.234] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.234] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0125.234] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0125.234] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0125.234] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0125.235] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0125.235] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.235] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0125.235] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17010a27) returned 0x0
	[0125.236] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0125.236] GdipCreateFromHDC (hdc=0x1a0109e5, graphics=0x20d7e0) returned 0x0
	[0125.236] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0125.236] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0125.236] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0125.236] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0125.236] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0125.237] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.237] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0125.237] GdipCreateRegion (region=0x20d910) returned 0x0
	[0125.237] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.237] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0125.237] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0125.237] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcb50dbd) returned 0x0
	[0125.238] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.238] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0125.238] GdipReleaseDC (graphics=0x1b929550, hdc=0x1a0109e5) returned 0x0
	[0125.238] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0125.238] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.238] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.238] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.239] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0125.239] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0125.239] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0125.239] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0125.239] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0125.239] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.239] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0125.239] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0125.240] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0125.240] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0125.240] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.240] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.240] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.240] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0125.240] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.241] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0125.241] GdipCreateRegion (region=0x20d120) returned 0x0
	[0125.241] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.241] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0125.241] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0125.241] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0125.241] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.241] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.241] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0125.242] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0125.242] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0125.242] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0125.242] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.242] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0125.242] OffsetViewportOrgEx (in: hdc=0x1a0109e5, x=0, y=0, lppt=0x26c4d80 | out: lppt=0x26c4d80) returned 1
	[0125.242] GdipReleaseDC (graphics=0x1b929550, hdc=0x1a0109e5) returned 0x0
	[0125.243] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0125.243] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.243] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.243] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.243] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0125.243] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0125.243] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0125.244] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.244] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0125.244] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0125.244] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0125.244] GdipCreateRegion (region=0x20d070) returned 0x0
	[0125.244] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.244] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0125.244] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0125.245] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0125.245] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.245] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.245] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0125.245] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0125.245] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0125.245] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0125.245] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.246] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0125.246] OffsetViewportOrgEx (in: hdc=0x1a0109e5, x=0, y=0, lppt=0x26c5320 | out: lppt=0x26c5320) returned 1
	[0125.246] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.246] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.246] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.246] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.246] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.247] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.247] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.247] GetROP2 (hdc=0x1a0109e5) returned 13
	[0125.247] GdipReleaseDC (graphics=0x1b929550, hdc=0x1a0109e5) returned 0x0
	[0125.247] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0125.247] GdipReleaseDC (graphics=0x1b929550, hdc=0x1a0109e5) returned 0x0
	[0125.247] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0125.248] GetDIBits (in: hdc=0x70107fc, hbm=0x6050a25, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0125.248] GetDIBits (in: hdc=0x70107fc, hbm=0x6050a25, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0125.248] GdipCreateFromHDC (hdc=0x16010a29, graphics=0x20d800) returned 0x0
	[0125.248] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0125.249] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0125.249] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0125.249] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0125.249] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0125.249] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.249] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0125.249] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0125.249] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.250] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0125.250] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0125.250] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0125.250] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0125.250] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0125.250] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0125.250] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0125.250] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.251] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0125.251] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.251] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0125.251] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0125.251] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0125.251] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0125.251] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0125.252] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0125.252] OffsetViewportOrgEx (in: hdc=0x16010a29, x=0, y=0, lppt=0x26c6bd0 | out: lppt=0x26c6bd0) returned 1
	[0125.252] GdipReleaseDC (graphics=0x1b929550, hdc=0x16010a29) returned 0x0
	[0125.252] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcb20dbd) returned 0x0
	[0125.252] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.253] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0125.262] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0125.262] GdipReleaseDC (graphics=0x1b929550, hdc=0x16010a29) returned 0x0
	[0125.263] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0125.722] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0125.722] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0125.722] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0125.722] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0125.723] GdipCreateFromHDC (hdc=0x51010839, graphics=0x20d7e0) returned 0x0
	[0125.723] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0125.723] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0125.723] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0125.723] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0125.723] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0125.724] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.724] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0125.724] GdipCreateRegion (region=0x20d910) returned 0x0
	[0125.724] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.724] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0125.724] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0125.724] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcb00dbd) returned 0x0
	[0125.724] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.725] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0125.725] GdipReleaseDC (graphics=0x1b929550, hdc=0x51010839) returned 0x0
	[0125.725] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0125.725] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.725] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.725] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.725] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0125.726] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0125.726] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0125.726] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0125.726] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0125.726] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.726] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0125.726] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0125.726] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0125.727] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0125.727] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.727] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.727] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.727] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0125.727] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.727] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0125.728] GdipCreateRegion (region=0x20d120) returned 0x0
	[0125.728] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.728] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0125.728] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0125.728] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0125.728] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.728] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.728] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0125.729] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0125.729] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0125.729] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0125.729] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.729] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0125.729] OffsetViewportOrgEx (in: hdc=0x51010839, x=0, y=0, lppt=0x26c81b0 | out: lppt=0x26c81b0) returned 1
	[0125.729] GdipReleaseDC (graphics=0x1b929550, hdc=0x51010839) returned 0x0
	[0125.730] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0125.730] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.730] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.730] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.730] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0125.730] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0125.730] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0125.731] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.731] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0125.731] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0125.731] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0125.731] GdipCreateRegion (region=0x20d070) returned 0x0
	[0125.731] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.731] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0125.731] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0125.732] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0125.732] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.732] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.732] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0125.732] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0125.732] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0125.733] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0125.733] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.733] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0125.733] OffsetViewportOrgEx (in: hdc=0x51010839, x=0, y=0, lppt=0x26c8750 | out: lppt=0x26c8750) returned 1
	[0125.733] GetROP2 (hdc=0x51010839) returned 13
	[0125.733] GetROP2 (hdc=0x51010839) returned 13
	[0125.733] GetROP2 (hdc=0x51010839) returned 13
	[0125.733] GetROP2 (hdc=0x51010839) returned 13
	[0125.734] GetROP2 (hdc=0x51010839) returned 13
	[0125.734] GetROP2 (hdc=0x51010839) returned 13
	[0125.734] GetROP2 (hdc=0x51010839) returned 13
	[0125.734] GetROP2 (hdc=0x51010839) returned 13
	[0125.734] GdipReleaseDC (graphics=0x1b929550, hdc=0x51010839) returned 0x0
	[0125.734] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0125.734] GdipReleaseDC (graphics=0x1b929550, hdc=0x51010839) returned 0x0
	[0125.735] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0125.735] GdipCreateFromHDC (hdc=0x53010839, graphics=0x20d7e0) returned 0x0
	[0125.735] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0125.735] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0125.735] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0125.735] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0125.735] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0125.736] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.736] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0125.736] GdipCreateRegion (region=0x20d910) returned 0x0
	[0125.736] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.736] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0125.736] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0125.736] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcad0dbd) returned 0x0
	[0125.737] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.737] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0125.737] GdipReleaseDC (graphics=0x1b929550, hdc=0x53010839) returned 0x0
	[0125.737] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0125.737] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.737] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.737] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.737] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0125.738] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0125.738] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0125.738] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0125.738] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0125.738] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.738] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0125.738] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0125.739] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0125.739] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0125.739] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.739] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.739] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.739] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0125.739] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.739] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0125.740] GdipCreateRegion (region=0x20d120) returned 0x0
	[0125.740] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.740] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0125.740] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0125.740] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0125.740] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.740] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0125.741] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0125.741] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0125.741] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0125.741] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0125.741] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.741] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0125.741] OffsetViewportOrgEx (in: hdc=0x53010839, x=0, y=0, lppt=0x26c95b0 | out: lppt=0x26c95b0) returned 1
	[0125.741] GdipReleaseDC (graphics=0x1b929550, hdc=0x53010839) returned 0x0
	[0125.742] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0125.742] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.742] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0125.742] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0125.742] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0125.742] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0125.742] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0125.743] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0125.743] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0125.743] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0125.743] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0125.743] GdipCreateRegion (region=0x20d070) returned 0x0
	[0125.743] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0125.743] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0125.743] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0125.744] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0125.744] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.744] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0125.744] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0125.744] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0125.744] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0125.744] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0125.744] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0125.745] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0125.745] OffsetViewportOrgEx (in: hdc=0x53010839, x=0, y=0, lppt=0x26c9b50 | out: lppt=0x26c9b50) returned 1
	[0125.745] GetROP2 (hdc=0x53010839) returned 13
	[0125.745] GetROP2 (hdc=0x53010839) returned 13
	[0125.745] GetROP2 (hdc=0x53010839) returned 13
	[0125.745] GetROP2 (hdc=0x53010839) returned 13
	[0125.745] GetROP2 (hdc=0x53010839) returned 13
	[0125.746] GetROP2 (hdc=0x53010839) returned 13
	[0125.746] GetROP2 (hdc=0x53010839) returned 13
	[0125.746] GetROP2 (hdc=0x53010839) returned 13
	[0125.746] GdipReleaseDC (graphics=0x1b929550, hdc=0x53010839) returned 0x0
	[0125.746] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0125.746] GdipReleaseDC (graphics=0x1b929550, hdc=0x53010839) returned 0x0
	[0125.746] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0126.032] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0126.032] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0126.032] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0126.032] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0126.032] UpdateWindow (hWnd=0x201d8) 
	[0126.032] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0126.032] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0126.033] GdipCreateFromHDC (hdc=0x4c0109ec, graphics=0x20cfa0) returned 0x0
	[0126.033] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0126.033] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0126.033] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0126.033] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0126.033] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0126.033] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0126.034] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0126.034] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0126.034] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.034] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0126.034] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0126.034] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffcaa0dbd) returned 0x0
	[0126.035] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.035] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0126.035] GdipReleaseDC (graphics=0x1b929550, hdc=0x4c0109ec) returned 0x0
	[0126.035] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0126.035] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.035] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.036] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.036] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0126.036] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0126.036] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0126.036] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0126.036] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0126.036] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.037] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0126.037] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0126.037] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0126.037] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0126.037] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.037] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.037] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.038] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0126.038] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.038] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0126.038] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0126.038] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.038] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0126.039] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0126.039] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0126.039] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0126.039] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0126.039] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0126.039] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0126.040] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0126.040] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0126.040] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.040] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0126.040] OffsetViewportOrgEx (in: hdc=0x4c0109ec, x=0, y=0, lppt=0x26cb2a0 | out: lppt=0x26cb2a0) returned 1
	[0126.040] GdipReleaseDC (graphics=0x1b929550, hdc=0x4c0109ec) returned 0x0
	[0126.041] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0126.041] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.041] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.041] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.041] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0126.041] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0126.042] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0126.042] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.042] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0126.042] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0126.042] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0126.042] GdipCreateRegion (region=0x20c830) returned 0x0
	[0126.043] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.043] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0126.043] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0126.043] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0126.043] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0126.043] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0126.043] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0126.043] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0126.044] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0126.050] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0126.050] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.050] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0126.050] OffsetViewportOrgEx (in: hdc=0x4c0109ec, x=0, y=0, lppt=0x26cb840 | out: lppt=0x26cb840) returned 1
	[0126.050] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.051] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.051] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.051] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.051] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.051] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.051] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.052] GetROP2 (hdc=0x4c0109ec) returned 13
	[0126.052] GdipReleaseDC (graphics=0x1b929550, hdc=0x4c0109ec) returned 0x0
	[0126.052] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0126.052] GdipReleaseDC (graphics=0x1b929550, hdc=0x4c0109ec) returned 0x0
	[0126.052] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0126.052] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0126.052] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0126.053] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0126.053] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26cbb88, Length=0x70 | out: Destination=0x1afe53a0) 
	[0126.053] ShellExecuteExW (in: pExecInfo=0x26cbd98*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26cbd98*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="\xffff\x74\x74\x70\x73\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x72\x6f\x66\x69\x6c\x65\x2e\x70\x68\x70\x3f\x69\x64\x3d\x31\x30\x30\x30\x32\x37\x30\x39\x31\x34\x35\x37\x37\x35\x34", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0126.176] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0126.176] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0126.177] GdipCreateFromHDC (hdc=0x5a0109ec, graphics=0x20c9d0) returned 0x0
	[0126.177] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0126.178] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0126.178] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0126.178] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0126.178] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0126.178] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0126.178] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0126.178] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0126.179] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.179] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0126.179] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0126.179] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffca70dbd) returned 0x0
	[0126.179] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.179] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0126.180] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a0109ec) returned 0x0
	[0126.180] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0126.180] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.180] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.180] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.180] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0126.180] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0126.181] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0126.181] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0126.181] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0126.181] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.181] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0126.181] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0126.181] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0126.181] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0126.182] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.182] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.182] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.182] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0126.182] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.182] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0126.182] GdipCreateRegion (region=0x20c310) returned 0x0
	[0126.183] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.183] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0126.183] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0126.183] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0126.183] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0126.183] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0126.183] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0126.184] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0126.184] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0126.184] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0126.184] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.184] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0126.184] OffsetViewportOrgEx (in: hdc=0x5a0109ec, x=0, y=0, lppt=0x26cca78 | out: lppt=0x26cca78) returned 1
	[0126.185] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a0109ec) returned 0x0
	[0126.185] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0126.185] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.185] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.185] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.186] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0126.186] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0126.186] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0126.186] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.186] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0126.186] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0126.187] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0126.187] GdipCreateRegion (region=0x20c260) returned 0x0
	[0126.187] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.187] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0126.187] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0126.187] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0126.187] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0126.188] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0126.188] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0126.188] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0126.188] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0126.188] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0126.188] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.188] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0126.189] OffsetViewportOrgEx (in: hdc=0x5a0109ec, x=0, y=0, lppt=0x26cd018 | out: lppt=0x26cd018) returned 1
	[0126.189] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.189] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.189] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.189] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.189] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.189] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.190] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.190] GetROP2 (hdc=0x5a0109ec) returned 13
	[0126.190] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a0109ec) returned 0x0
	[0126.190] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0126.190] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a0109ec) returned 0x0
	[0126.190] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0126.191] GdipCreateFromHDC (hdc=0x5c0109ec, graphics=0x20c9d0) returned 0x0
	[0126.191] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0126.191] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0126.191] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0126.191] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0126.192] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0126.192] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0126.192] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0126.192] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0126.192] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.192] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0126.192] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0126.193] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffca40dbd) returned 0x0
	[0126.193] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.193] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0126.193] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c0109ec) returned 0x0
	[0126.193] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0126.194] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.194] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.194] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.194] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0126.194] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0126.194] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0126.195] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0126.195] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0126.195] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.195] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0126.195] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0126.195] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0126.195] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0126.196] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.196] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.196] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.196] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0126.196] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.196] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0126.196] GdipCreateRegion (region=0x20c310) returned 0x0
	[0126.197] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.197] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0126.197] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0126.197] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0126.197] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0126.197] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0126.197] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0126.198] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0126.198] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0126.198] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0126.198] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.198] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0126.198] OffsetViewportOrgEx (in: hdc=0x5c0109ec, x=0, y=0, lppt=0x26cdea0 | out: lppt=0x26cdea0) returned 1
	[0126.199] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c0109ec) returned 0x0
	[0126.199] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0126.199] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.199] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0126.199] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0126.199] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0126.200] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0126.200] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0126.229] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0126.229] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0126.229] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0126.229] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0126.230] GdipCreateRegion (region=0x20c260) returned 0x0
	[0126.230] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0126.230] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0126.230] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0126.230] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0126.230] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0126.231] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0126.231] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0126.232] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0126.233] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0126.233] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0126.233] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0126.233] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0126.233] OffsetViewportOrgEx (in: hdc=0x5c0109ec, x=0, y=0, lppt=0x26ce440 | out: lppt=0x26ce440) returned 1
	[0126.233] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.234] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.234] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.234] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.234] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.234] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.234] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.235] GetROP2 (hdc=0x5c0109ec) returned 13
	[0126.235] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c0109ec) returned 0x0
	[0126.235] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0126.235] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c0109ec) returned 0x0
	[0126.235] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0127.203] GdipCreateFromHDC (hdc=0x110109be, graphics=0x20d7e0) returned 0x0
	[0127.203] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0127.203] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0127.203] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0127.204] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0127.204] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0127.204] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0127.204] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0127.204] GdipCreateRegion (region=0x20d910) returned 0x0
	[0127.204] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0127.204] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0127.205] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0127.205] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffca10dbd) returned 0x0
	[0127.205] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0127.205] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0127.205] GdipReleaseDC (graphics=0x1b929550, hdc=0x110109be) returned 0x0
	[0127.205] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0127.205] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0127.206] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0127.206] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0127.206] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0127.206] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0127.206] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0127.206] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0127.206] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0127.206] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0127.207] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0127.207] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0127.207] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0127.207] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0127.207] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0127.207] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0127.207] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0127.208] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0127.208] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0127.208] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0127.208] GdipCreateRegion (region=0x20d120) returned 0x0
	[0127.208] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0127.208] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0127.208] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0127.209] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0127.209] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0127.209] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0127.209] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0127.209] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0127.209] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0127.209] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0127.210] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0127.210] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0127.211] SaveDC (hdc=0x110109be) returned 1
	[0127.211] OffsetViewportOrgEx (in: hdc=0x110109be, x=0, y=0, lppt=0x26cf3d0 | out: lppt=0x26cf3d0) returned 1
	[0127.212] GdipReleaseDC (graphics=0x1b929550, hdc=0x110109be) returned 0x0
	[0127.212] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0127.212] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0127.212] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0127.213] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0127.213] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0127.213] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0127.213] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0127.213] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0127.214] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0127.214] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0127.214] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0127.214] GdipCreateRegion (region=0x20d070) returned 0x0
	[0127.214] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0127.215] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0127.215] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0127.215] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0127.215] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0127.215] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0127.215] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0127.215] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0127.215] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0127.216] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0127.216] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0127.216] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0127.216] OffsetViewportOrgEx (in: hdc=0x110109be, x=0, y=0, lppt=0x26cf970 | out: lppt=0x26cf970) returned 1
	[0127.216] GetROP2 (hdc=0x110109be) returned 13
	[0127.216] GetROP2 (hdc=0x110109be) returned 13
	[0127.216] GetROP2 (hdc=0x110109be) returned 13
	[0127.217] GetROP2 (hdc=0x110109be) returned 13
	[0127.217] GetROP2 (hdc=0x110109be) returned 13
	[0127.217] GetROP2 (hdc=0x110109be) returned 13
	[0127.217] GetROP2 (hdc=0x110109be) returned 13
	[0127.217] GetROP2 (hdc=0x110109be) returned 13
	[0127.217] GdipReleaseDC (graphics=0x1b929550, hdc=0x110109be) returned 0x0
	[0127.217] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0127.218] GdipReleaseDC (graphics=0x1b929550, hdc=0x110109be) returned 0x0
	[0127.218] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0129.113] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0129.113] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0129.113] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0129.113] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0129.114] GdipCreateFromHDC (hdc=0x38010b88, graphics=0x20d7e0) returned 0x0
	[0129.114] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0129.114] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0129.114] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0129.114] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0129.115] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0129.115] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0129.115] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0129.115] GdipCreateRegion (region=0x20d910) returned 0x0
	[0129.115] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.115] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0129.115] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0129.116] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc9e0dbd) returned 0x0
	[0129.116] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.116] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0129.116] GdipReleaseDC (graphics=0x1b929550, hdc=0x38010b88) returned 0x0
	[0129.116] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0129.116] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.117] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.117] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.117] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0129.117] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0129.117] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0129.118] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0129.118] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0129.118] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.118] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0129.118] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0129.118] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0129.119] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0129.119] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.119] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.119] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.119] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0129.119] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.120] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0129.120] GdipCreateRegion (region=0x20d120) returned 0x0
	[0129.120] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.120] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0129.120] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0129.120] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0129.121] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0129.121] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0129.121] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0129.121] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0129.121] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0129.121] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0129.121] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.121] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0129.122] OffsetViewportOrgEx (in: hdc=0x38010b88, x=0, y=0, lppt=0x26d0868 | out: lppt=0x26d0868) returned 1
	[0129.122] GdipReleaseDC (graphics=0x1b929550, hdc=0x38010b88) returned 0x0
	[0129.122] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0129.122] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.122] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.122] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.123] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0129.123] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0129.123] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0129.123] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.123] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0129.123] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0129.124] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0129.124] GdipCreateRegion (region=0x20d070) returned 0x0
	[0129.124] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.124] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0129.124] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0129.124] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0129.124] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0129.125] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0129.125] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0129.125] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0129.125] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0129.125] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0129.125] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.125] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0129.125] OffsetViewportOrgEx (in: hdc=0x38010b88, x=0, y=0, lppt=0x26d0e08 | out: lppt=0x26d0e08) returned 1
	[0129.126] GetROP2 (hdc=0x38010b88) returned 13
	[0129.126] GetROP2 (hdc=0x38010b88) returned 13
	[0129.126] GetROP2 (hdc=0x38010b88) returned 13
	[0129.126] GetROP2 (hdc=0x38010b88) returned 13
	[0129.126] GetROP2 (hdc=0x38010b88) returned 13
	[0129.126] GetROP2 (hdc=0x38010b88) returned 13
	[0129.126] GetROP2 (hdc=0x38010b88) returned 13
	[0129.127] GetROP2 (hdc=0x38010b88) returned 13
	[0129.127] GdipReleaseDC (graphics=0x1b929550, hdc=0x38010b88) returned 0x0
	[0129.127] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0129.127] GdipReleaseDC (graphics=0x1b929550, hdc=0x38010b88) returned 0x0
	[0129.127] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0129.249] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0129.249] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0129.249] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0129.249] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0129.249] UpdateWindow (hWnd=0x201d8) 
	[0129.249] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0129.249] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0129.249] GdipCreateFromHDC (hdc=0x3c010b88, graphics=0x20cfa0) returned 0x0
	[0129.249] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0129.249] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0129.250] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0129.250] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0129.250] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0129.250] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0129.250] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0129.250] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0129.250] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.251] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0129.251] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0129.251] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc9b0dbd) returned 0x0
	[0129.251] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.251] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0129.251] GdipReleaseDC (graphics=0x1b929550, hdc=0x3c010b88) returned 0x0
	[0129.251] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0129.252] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.252] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.252] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.252] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0129.252] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0129.252] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0129.252] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0129.253] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0129.253] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.253] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0129.253] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0129.253] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0129.253] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0129.253] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.318] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.318] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.318] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0129.318] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.319] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0129.319] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0129.319] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.319] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0129.319] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0129.319] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0129.319] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0129.320] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0129.320] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0129.320] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0129.320] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0129.320] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0129.320] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.320] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0129.321] OffsetViewportOrgEx (in: hdc=0x3c010b88, x=0, y=0, lppt=0x26d1e00 | out: lppt=0x26d1e00) returned 1
	[0129.321] GdipReleaseDC (graphics=0x1b929550, hdc=0x3c010b88) returned 0x0
	[0129.321] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0129.321] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.321] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.321] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.321] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0129.322] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0129.322] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0129.322] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.322] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0129.322] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0129.323] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0129.323] GdipCreateRegion (region=0x20c830) returned 0x0
	[0129.323] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.323] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0129.323] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0129.323] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0129.323] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0129.324] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0129.324] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0129.324] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0129.324] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0129.324] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0129.324] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.324] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0129.325] OffsetViewportOrgEx (in: hdc=0x3c010b88, x=0, y=0, lppt=0x26d23a0 | out: lppt=0x26d23a0) returned 1
	[0129.325] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.325] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.325] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.325] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.325] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.325] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.326] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.326] GetROP2 (hdc=0x3c010b88) returned 13
	[0129.326] GdipReleaseDC (graphics=0x1b929550, hdc=0x3c010b88) returned 0x0
	[0129.326] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0129.326] GdipReleaseDC (graphics=0x1b929550, hdc=0x3c010b88) returned 0x0
	[0129.326] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0129.327] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0129.327] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0129.328] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0129.328] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26d26e8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0129.328] ShellExecuteExW (pExecInfo=0x26d28f8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0129.457] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0129.457] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0129.458] GdipCreateFromHDC (hdc=0x4e010b88, graphics=0x20c9d0) returned 0x0
	[0129.458] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0129.458] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0129.458] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0129.459] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0129.459] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0129.459] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0129.459] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0129.459] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0129.459] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.459] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0129.460] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0129.460] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc980dbd) returned 0x0
	[0129.460] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.460] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0129.460] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010b88) returned 0x0
	[0129.460] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0129.461] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.461] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.461] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.461] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0129.461] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0129.461] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0129.461] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0129.462] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0129.462] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.462] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0129.462] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0129.462] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0129.462] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0129.463] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.463] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.463] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.463] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0129.463] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.463] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0129.463] GdipCreateRegion (region=0x20c310) returned 0x0
	[0129.464] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.464] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0129.464] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0129.464] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0129.464] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0129.464] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0129.464] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0129.465] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0129.465] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0129.465] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0129.465] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.465] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0129.465] OffsetViewportOrgEx (in: hdc=0x4e010b88, x=0, y=0, lppt=0x26d35d8 | out: lppt=0x26d35d8) returned 1
	[0129.465] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010b88) returned 0x0
	[0129.466] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0129.466] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.466] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0129.466] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0129.466] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0129.466] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0129.466] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0129.467] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0129.467] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0129.467] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0129.467] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0129.467] GdipCreateRegion (region=0x20c260) returned 0x0
	[0129.467] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0129.467] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0129.468] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0129.468] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0129.468] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0129.468] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0129.468] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0129.468] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0129.468] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0129.469] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0129.469] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0129.469] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0129.469] OffsetViewportOrgEx (in: hdc=0x4e010b88, x=0, y=0, lppt=0x26d3b78 | out: lppt=0x26d3b78) returned 1
	[0129.469] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.469] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.469] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.470] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.470] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.470] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.470] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.470] GetROP2 (hdc=0x4e010b88) returned 13
	[0129.470] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010b88) returned 0x0
	[0129.470] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0129.471] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010b88) returned 0x0
	[0129.471] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0130.308] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d770) returned 0x0
	[0130.308] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0130.308] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0130.308] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0130.308] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d6c0) returned 0x0
	[0130.309] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0130.309] GdipCreateRegion (region=0x20d660) returned 0x0
	[0130.309] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0130.309] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0130.309] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0130.309] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0130.309] GdipCreateRegion (region=0x20d630) returned 0x0
	[0130.310] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0130.310] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0130.310] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0130.310] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d690) returned 0x0
	[0130.310] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0130.311] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0130.311] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0130.311] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0130.311] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0130.311] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x26d48a8 | out: lppt=0x26d48a8) returned 1
	[0130.311] GdipReleaseDC (graphics=0x1b929550, hdc=0x10107f8) returned 0x0
	[0130.311] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0130.313] GetDIBits (in: hdc=0x70107fc, hbm=0x1c050bc4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0130.313] GetDIBits (in: hdc=0x70107fc, hbm=0x1c050bc4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0130.313] GdipCreateFromHDC (hdc=0x20010bc2, graphics=0x20d750) returned 0x0
	[0130.313] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0130.313] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0130.314] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0130.314] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0130.314] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0130.314] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0130.314] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0130.314] GdipCreateRegion (region=0x20d910) returned 0x0
	[0130.314] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0130.315] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0130.315] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0130.315] GdipCreateRegion (region=0x20d400) returned 0x0
	[0130.315] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0130.315] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0130.315] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0130.315] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0130.316] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0130.316] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0130.316] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0130.316] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0130.316] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0130.316] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0130.316] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0130.317] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0130.317] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0130.317] OffsetViewportOrgEx (in: hdc=0x20010bc2, x=0, y=0, lppt=0x26d60d8 | out: lppt=0x26d60d8) returned 1
	[0130.317] GdipReleaseDC (graphics=0x1b929550, hdc=0x20010bc2) returned 0x0
	[0130.317] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc930dbd) returned 0x0
	[0130.318] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0130.318] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0130.318] GdipReleaseDC (graphics=0x1b929550, hdc=0x20010bc2) returned 0x0
	[0130.318] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0130.319] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0130.319] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0130.319] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0130.319] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0130.319] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0130.320] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0130.320] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0130.320] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0130.320] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0130.320] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0130.321] GdipReleaseDC (graphics=0x1b929550, hdc=0x20010bc2) returned 0x0
	[0130.321] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0130.321] GdipCreateFromHDC (hdc=0x37010bbc, graphics=0x20d7e0) returned 0x0
	[0130.321] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0130.321] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0130.321] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0130.322] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0130.322] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0130.322] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0130.322] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0130.322] GdipCreateRegion (region=0x20d910) returned 0x0
	[0130.322] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0130.322] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0130.323] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0130.323] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc910dbd) returned 0x0
	[0130.323] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0130.323] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0130.323] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010bbc) returned 0x0
	[0130.323] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0130.324] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0130.324] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0130.324] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0130.324] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0130.324] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0130.324] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0130.324] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0130.325] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0130.325] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0130.325] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0130.325] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0130.325] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0130.325] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0130.325] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0130.326] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0130.326] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0130.326] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0130.326] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0130.326] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0130.326] GdipCreateRegion (region=0x20d120) returned 0x0
	[0130.326] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0130.327] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0130.327] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0130.327] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0130.327] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0130.327] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0130.327] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0130.327] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0130.328] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0130.328] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0130.328] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0130.328] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0130.328] OffsetViewportOrgEx (in: hdc=0x37010bbc, x=0, y=0, lppt=0x26d71e0 | out: lppt=0x26d71e0) returned 1
	[0130.328] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010bbc) returned 0x0
	[0130.329] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0130.329] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0130.329] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0130.329] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0130.329] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0130.329] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0130.329] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0130.330] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0130.330] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0130.330] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0130.330] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0130.330] GdipCreateRegion (region=0x20d070) returned 0x0
	[0130.331] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0130.331] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0130.331] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0130.331] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0130.331] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0130.332] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0130.332] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0130.332] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0130.332] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0130.332] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0130.332] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0130.332] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0130.333] OffsetViewportOrgEx (in: hdc=0x37010bbc, x=0, y=0, lppt=0x26d7780 | out: lppt=0x26d7780) returned 1
	[0130.333] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.333] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.333] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.333] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.333] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.334] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.336] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.336] GetROP2 (hdc=0x37010bbc) returned 13
	[0130.336] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010bbc) returned 0x0
	[0130.336] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0130.336] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010bbc) returned 0x0
	[0130.337] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0130.337] GetDIBits (in: hdc=0x4010280, hbm=0x3f050bb8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0130.337] GetDIBits (in: hdc=0x4010280, hbm=0x3f050bb8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0130.337] GdipCreateFromHDC (hdc=0x20010bc4, graphics=0x20d800) returned 0x0
	[0130.337] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0130.338] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0130.338] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0130.338] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0130.338] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0130.338] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0130.338] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0130.338] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0130.339] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0130.339] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0130.339] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0130.339] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0130.339] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0130.339] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0130.339] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0130.340] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0130.340] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0130.340] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0130.340] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0130.340] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0130.340] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0130.340] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0130.341] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0130.341] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0130.341] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0130.341] OffsetViewportOrgEx (in: hdc=0x20010bc4, x=0, y=0, lppt=0x26d9048 | out: lppt=0x26d9048) returned 1
	[0130.341] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20010bc4) returned 0x0
	[0130.342] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc8e0dbd) returned 0x0
	[0130.342] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0130.342] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0130.348] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0130.349] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20010bc4) returned 0x0
	[0130.349] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0132.179] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0132.179] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0132.180] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0132.180] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0132.180] UpdateWindow (hWnd=0x201d8) 
	[0132.180] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0132.180] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0132.180] GdipCreateFromHDC (hdc=0x37010be0, graphics=0x20cfa0) returned 0x0
	[0132.180] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0132.180] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0132.181] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0132.181] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.181] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0132.181] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x34cc20) returned 0x0
	[0132.181] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.181] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0132.181] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.182] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0132.182] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0132.182] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc8c0dbd) returned 0x0
	[0132.182] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.182] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0132.182] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010be0) returned 0x0
	[0132.183] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0132.183] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.183] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.183] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.183] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0132.183] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0132.184] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0132.184] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0132.184] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0132.184] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.184] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0132.184] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0132.185] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0132.185] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0132.185] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.185] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.185] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.185] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0132.186] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.186] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0132.186] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0132.186] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.186] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0132.186] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0132.186] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0132.187] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x34cc20) returned 0x0
	[0132.187] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x34cc20) returned 0x0
	[0132.187] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0132.187] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0132.187] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0132.187] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0132.187] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.190] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0132.190] OffsetViewportOrgEx (in: hdc=0x37010be0, x=0, y=0, lppt=0x26da210 | out: lppt=0x26da210) returned 1
	[0132.191] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010be0) returned 0x0
	[0132.191] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0132.191] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.191] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.191] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.191] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0132.191] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0132.192] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0132.192] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.192] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0132.192] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0132.192] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0132.192] GdipCreateRegion (region=0x20c830) returned 0x0
	[0132.194] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.194] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0132.194] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.194] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0132.194] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x34cc20) returned 0x0
	[0132.194] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x34cc20) returned 0x0
	[0132.194] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.195] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0132.195] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0132.195] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0132.195] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.195] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0132.195] OffsetViewportOrgEx (in: hdc=0x37010be0, x=0, y=0, lppt=0x26da7b0 | out: lppt=0x26da7b0) returned 1
	[0132.195] GetROP2 (hdc=0x37010be0) returned 13
	[0132.196] GetROP2 (hdc=0x37010be0) returned 13
	[0132.196] GetROP2 (hdc=0x37010be0) returned 13
	[0132.196] GetROP2 (hdc=0x37010be0) returned 13
	[0132.196] GetROP2 (hdc=0x37010be0) returned 13
	[0132.196] GetROP2 (hdc=0x37010be0) returned 13
	[0132.196] GetROP2 (hdc=0x37010be0) returned 13
	[0132.196] GetROP2 (hdc=0x37010be0) returned 13
	[0132.197] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010be0) returned 0x0
	[0132.197] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0132.197] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x37010be0) returned 0x0
	[0132.197] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0132.197] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0132.197] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0132.199] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0132.199] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26daaf8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0132.199] ShellExecuteExW (in: pExecInfo=0x26dad08*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26dad08*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0132.275] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0132.275] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0132.275] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0132.275] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0132.275] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0132.275] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0132.276] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0132.276] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0132.276] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0132.276] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0132.276] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0132.276] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0132.276] GetStockObject (i=5) returned 0x1900015
	[0132.277] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0132.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0132.277] GetCapture () returned 0x0
	[0132.277] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0132.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0132.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0132.277] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x4010280
	[0132.277] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0132.277] CreateCompatibleDC (hdc=0x4010280) returned 0x29010be7
	[0132.278] SelectObject (hdc=0x29010be7, h=0x140507d2) returned 0x185000f
	[0132.278] GdipCreateFromHDC (hdc=0x29010be7, graphics=0x20c9d0) returned 0x0
	[0132.278] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0132.278] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0132.278] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0132.278] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0132.278] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0132.279] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.279] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0132.279] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0132.279] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.279] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0132.280] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0132.280] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc890dbd) returned 0x0
	[0132.280] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.280] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0132.280] GetCurrentObject (hdc=0x29010be7, type=0x1) returned 0x1b00017
	[0132.280] GetCurrentObject (hdc=0x29010be7, type=0x2) returned 0x1900010
	[0132.280] GetCurrentObject (hdc=0x29010be7, type=0x7) returned 0x140507d2
	[0132.281] GetCurrentObject (hdc=0x29010be7, type=0x6) returned 0x18a002e
	[0132.281] SaveDC (hdc=0x29010be7) returned 1
	[0132.281] GetNearestColor (hdc=0x29010be7, color=0xf0f0f0) returned 0xf0f0f0
	[0132.281] GetNearestColor (hdc=0x29010be7, color=0xa0a0a0) returned 0xa0a0a0
	[0132.281] GetNearestColor (hdc=0x29010be7, color=0x696969) returned 0x696969
	[0132.281] GetNearestColor (hdc=0x29010be7, color=0xa0a0a0) returned 0xa0a0a0
	[0132.281] GetNearestColor (hdc=0x29010be7, color=0x0) returned 0x0
	[0132.282] GetNearestColor (hdc=0x29010be7, color=0xffffff) returned 0xffffff
	[0132.282] GetNearestColor (hdc=0x29010be7, color=0xe5e5e5) returned 0xe5e5e5
	[0132.282] GetNearestColor (hdc=0x29010be7, color=0xd8d8d8) returned 0xd8d8d8
	[0132.282] GetNearestColor (hdc=0x29010be7, color=0x0) returned 0x0
	[0132.282] RestoreDC (hdc=0x29010be7, nSavedDC=-1) returned 1
	[0132.283] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x29010be7) returned 0x0
	[0132.283] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.283] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.283] CoTaskMemFree (pv=0x1b077150) 
	[0132.283] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0132.284] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.284] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.284] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.284] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0132.284] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0132.284] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0132.284] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0132.285] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0132.285] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.285] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.285] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.285] CoTaskMemFree (pv=0x1b077150) 
	[0132.285] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0132.285] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0132.285] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0132.286] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0132.286] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.286] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.286] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.286] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0132.286] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.286] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0132.287] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.287] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.287] CoTaskMemFree (pv=0x1b077150) 
	[0132.287] GdipCreateRegion (region=0x20c310) returned 0x0
	[0132.287] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.287] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0132.287] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.288] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0132.288] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.288] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.288] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.288] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0132.288] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0132.290] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0132.290] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.290] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0132.290] GetCurrentObject (hdc=0x29010be7, type=0x1) returned 0x1b00017
	[0132.290] GetCurrentObject (hdc=0x29010be7, type=0x2) returned 0x1900010
	[0132.290] GetCurrentObject (hdc=0x29010be7, type=0x7) returned 0x140507d2
	[0132.290] GetCurrentObject (hdc=0x29010be7, type=0x6) returned 0x18a002e
	[0132.291] SaveDC (hdc=0x29010be7) returned 1
	[0132.291] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc2040710
	[0132.291] GetClipRgn (hdc=0x29010be7, hrgn=0xffffffffc2040710) returned 0
	[0132.291] SelectClipRgn (hdc=0x29010be7, hrgn=0x200407f9) returned 2
	[0132.291] DeleteObject (ho=0xffffffffc2040710) returned 1
	[0132.291] DeleteObject (ho=0x200407f9) returned 1
	[0132.292] OffsetViewportOrgEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x26db9e8 | out: lppt=0x26db9e8) returned 1
	[0132.292] GetNearestColor (hdc=0x29010be7, color=0xf0f0f0) returned 0xf0f0f0
	[0132.292] CreateSolidBrush (color=0xf0f0f0) returned 0x701007c0
	[0132.292] FillRect (hDC=0x29010be7, lprc=0x20c3c0, hbr=0x701007c0) returned 1
	[0132.292] DeleteObject (ho=0x701007c0) returned 1
	[0132.292] RestoreDC (hdc=0x29010be7, nSavedDC=-1) returned 1
	[0132.293] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x29010be7) returned 0x0
	[0132.293] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.293] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.293] CoTaskMemFree (pv=0x1b077150) 
	[0132.293] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0132.293] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.293] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.293] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.294] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0132.294] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0132.294] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0132.294] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.294] GetFocus () returned 0x0
	[0132.294] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.294] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.295] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.295] CoTaskMemFree (pv=0x1b077150) 
	[0132.295] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0132.295] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0132.295] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0132.295] GdipCreateRegion (region=0x20c260) returned 0x0
	[0132.295] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.295] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0132.295] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0132.296] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0132.296] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.296] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.296] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0132.296] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0132.296] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0132.296] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0132.297] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.297] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0132.297] GetCurrentObject (hdc=0x29010be7, type=0x1) returned 0x1b00017
	[0132.297] GetCurrentObject (hdc=0x29010be7, type=0x2) returned 0x1900010
	[0132.297] GetCurrentObject (hdc=0x29010be7, type=0x7) returned 0x140507d2
	[0132.297] GetCurrentObject (hdc=0x29010be7, type=0x6) returned 0x18a002e
	[0132.297] SaveDC (hdc=0x29010be7) returned 1
	[0132.298] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x210407f9
	[0132.298] GetClipRgn (hdc=0x29010be7, hrgn=0x210407f9) returned 0
	[0132.298] SelectClipRgn (hdc=0x29010be7, hrgn=0xffffffffc3040710) returned 2
	[0132.298] DeleteObject (ho=0x210407f9) returned 1
	[0132.298] DeleteObject (ho=0xffffffffc3040710) returned 1
	[0132.298] OffsetViewportOrgEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x26dbf88 | out: lppt=0x26dbf88) returned 1
	[0132.298] GetROP2 (hdc=0x29010be7) returned 13
	[0132.299] GetBkMode (hdc=0x29010be7) returned 2
	[0132.299] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.299] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x42300be5
	[0132.299] SelectObject (hdc=0x29010be7, h=0x42300be5) returned 0x1b00017
	[0132.299] MoveToEx (in: hdc=0x29010be7, x=164, y=1, lppt=0x26dbff0 | out: lppt=0x26dbff0) returned 1
	[0132.299] LineTo (hdc=0x29010be7, x=1, y=1) returned 1
	[0132.300] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.300] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.301] GetROP2 (hdc=0x29010be7) returned 13
	[0132.301] GetBkMode (hdc=0x29010be7) returned 2
	[0132.301] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.301] SelectObject (hdc=0x29010be7, h=0x42300be5) returned 0x42300be5
	[0132.301] MoveToEx (in: hdc=0x29010be7, x=1, y=1, lppt=0x26dc008 | out: lppt=0x26dc008) returned 1
	[0132.301] LineTo (hdc=0x29010be7, x=1, y=41) returned 1
	[0132.301] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.302] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.302] SelectObject (hdc=0x29010be7, h=0x1b00017) returned 0x42300be5
	[0132.302] DeleteObject (ho=0x42300be5) returned 1
	[0132.302] GetROP2 (hdc=0x29010be7) returned 13
	[0132.302] GetBkMode (hdc=0x29010be7) returned 2
	[0132.302] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.302] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1b300beb
	[0132.302] SelectObject (hdc=0x29010be7, h=0x1b300beb) returned 0x1b00017
	[0132.303] MoveToEx (in: hdc=0x29010be7, x=1, y=41, lppt=0x26dc070 | out: lppt=0x26dc070) returned 1
	[0132.303] LineTo (hdc=0x29010be7, x=164, y=41) returned 1
	[0132.303] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.303] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.303] GetROP2 (hdc=0x29010be7) returned 13
	[0132.303] GetBkMode (hdc=0x29010be7) returned 2
	[0132.303] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.304] SelectObject (hdc=0x29010be7, h=0x1b300beb) returned 0x1b300beb
	[0132.304] MoveToEx (in: hdc=0x29010be7, x=164, y=41, lppt=0x26dc088 | out: lppt=0x26dc088) returned 1
	[0132.304] LineTo (hdc=0x29010be7, x=164, y=0) returned 1
	[0132.304] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.304] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.304] SelectObject (hdc=0x29010be7, h=0x1b00017) returned 0x1b300beb
	[0132.304] DeleteObject (ho=0x1b300beb) returned 1
	[0132.305] GetROP2 (hdc=0x29010be7) returned 13
	[0132.305] GetBkMode (hdc=0x29010be7) returned 2
	[0132.305] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.305] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x43300be5
	[0132.305] SelectObject (hdc=0x29010be7, h=0x43300be5) returned 0x1b00017
	[0132.305] MoveToEx (in: hdc=0x29010be7, x=163, y=2, lppt=0x26dc0f0 | out: lppt=0x26dc0f0) returned 1
	[0132.306] LineTo (hdc=0x29010be7, x=2, y=2) returned 1
	[0132.306] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.306] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.306] GetROP2 (hdc=0x29010be7) returned 13
	[0132.306] GetBkMode (hdc=0x29010be7) returned 2
	[0132.306] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.307] SelectObject (hdc=0x29010be7, h=0x43300be5) returned 0x43300be5
	[0132.307] MoveToEx (in: hdc=0x29010be7, x=2, y=2, lppt=0x26dc108 | out: lppt=0x26dc108) returned 1
	[0132.307] LineTo (hdc=0x29010be7, x=2, y=40) returned 1
	[0132.307] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.307] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.307] SelectObject (hdc=0x29010be7, h=0x1b00017) returned 0x43300be5
	[0132.307] DeleteObject (ho=0x43300be5) returned 1
	[0132.308] GetROP2 (hdc=0x29010be7) returned 13
	[0132.308] GetBkMode (hdc=0x29010be7) returned 2
	[0132.308] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.308] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1c300beb
	[0132.308] SelectObject (hdc=0x29010be7, h=0x1c300beb) returned 0x1b00017
	[0132.308] MoveToEx (in: hdc=0x29010be7, x=2, y=40, lppt=0x26dc170 | out: lppt=0x26dc170) returned 1
	[0132.308] LineTo (hdc=0x29010be7, x=163, y=40) returned 1
	[0132.309] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.309] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.309] GetROP2 (hdc=0x29010be7) returned 13
	[0132.309] GetBkMode (hdc=0x29010be7) returned 2
	[0132.309] SetBkMode (hdc=0x29010be7, mode=1) returned 2
	[0132.309] SelectObject (hdc=0x29010be7, h=0x1c300beb) returned 0x1c300beb
	[0132.309] MoveToEx (in: hdc=0x29010be7, x=163, y=40, lppt=0x26dc188 | out: lppt=0x26dc188) returned 1
	[0132.310] LineTo (hdc=0x29010be7, x=163, y=1) returned 1
	[0132.310] SetBkMode (hdc=0x29010be7, mode=2) returned 1
	[0132.310] MoveToEx (in: hdc=0x29010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.310] SelectObject (hdc=0x29010be7, h=0x1b00017) returned 0x1c300beb
	[0132.310] DeleteObject (ho=0x1c300beb) returned 1
	[0132.310] RestoreDC (hdc=0x29010be7, nSavedDC=-1) returned 1
	[0132.310] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x29010be7) returned 0x0
	[0132.311] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0132.311] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x29010be7, x1=0, y1=0, rop=0xcc0020) returned 1
	[0132.311] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x29010be7) returned 0x0
	[0132.311] SelectObject (hdc=0x29010be7, h=0x185000f) returned 0x140507d2
	[0132.311] DeleteDC (hdc=0x29010be7) returned 1
	[0132.311] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0132.311] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0132.312] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0132.312] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27201b6) returned 0x1
	[0132.312] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0132.312] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0132.312] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0132.312] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0132.312] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0132.312] GetKeyState (nVirtKey=1) returned 1
	[0132.312] GetKeyState (nVirtKey=2) returned 0
	[0132.312] GetKeyState (nVirtKey=4) returned 0
	[0132.312] GetKeyState (nVirtKey=5) returned 0
	[0132.312] GetKeyState (nVirtKey=6) returned 0
	[0132.312] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0132.312] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0132.312] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x4010280
	[0132.312] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0132.312] CreateCompatibleDC (hdc=0x4010280) returned 0x2a010be7
	[0132.312] SelectObject (hdc=0x2a010be7, h=0x140507d2) returned 0x185000f
	[0132.313] GdipCreateFromHDC (hdc=0x2a010be7, graphics=0x20c9d0) returned 0x0
	[0132.313] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0132.313] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0132.313] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0132.313] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.313] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0132.313] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0132.313] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.313] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.313] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0132.313] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.313] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0132.313] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0132.313] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc860dbd) returned 0x0
	[0132.313] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.313] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.313] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0132.314] GetCurrentObject (hdc=0x2a010be7, type=0x1) returned 0x1b00017
	[0132.314] GetCurrentObject (hdc=0x2a010be7, type=0x2) returned 0x1900010
	[0132.314] GetCurrentObject (hdc=0x2a010be7, type=0x7) returned 0x140507d2
	[0132.314] GetCurrentObject (hdc=0x2a010be7, type=0x6) returned 0x18a002e
	[0132.315] SaveDC (hdc=0x2a010be7) returned 1
	[0132.315] GetNearestColor (hdc=0x2a010be7, color=0xf0f0f0) returned 0xf0f0f0
	[0132.315] GetNearestColor (hdc=0x2a010be7, color=0xa0a0a0) returned 0xa0a0a0
	[0132.316] GetNearestColor (hdc=0x2a010be7, color=0x696969) returned 0x696969
	[0132.316] GetNearestColor (hdc=0x2a010be7, color=0xa0a0a0) returned 0xa0a0a0
	[0132.316] GetNearestColor (hdc=0x2a010be7, color=0x0) returned 0x0
	[0132.316] GetNearestColor (hdc=0x2a010be7, color=0xffffff) returned 0xffffff
	[0132.316] GetNearestColor (hdc=0x2a010be7, color=0xe5e5e5) returned 0xe5e5e5
	[0132.316] GetNearestColor (hdc=0x2a010be7, color=0xd8d8d8) returned 0xd8d8d8
	[0132.317] GetNearestColor (hdc=0x2a010be7, color=0x0) returned 0x0
	[0132.317] RestoreDC (hdc=0x2a010be7, nSavedDC=-1) returned 1
	[0132.317] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.317] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010be7) returned 0x0
	[0132.317] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.317] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.317] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.317] CoTaskMemFree (pv=0x1b077150) 
	[0132.317] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0132.317] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.318] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.318] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.318] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0132.318] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0132.318] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0132.318] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0132.318] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0132.318] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.318] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.318] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.318] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.318] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.318] CoTaskMemFree (pv=0x1b077150) 
	[0132.318] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0132.318] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0132.318] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0132.318] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0132.319] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.319] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.319] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.319] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0132.319] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.319] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.319] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.319] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0132.319] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.319] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.319] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.319] CoTaskMemFree (pv=0x1b077150) 
	[0132.320] GdipCreateRegion (region=0x20c310) returned 0x0
	[0132.320] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.320] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0132.320] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0132.320] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0132.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0132.320] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.320] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.320] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0132.320] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0132.320] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0132.320] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0132.320] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.320] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.320] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0132.320] GetCurrentObject (hdc=0x2a010be7, type=0x1) returned 0x1b00017
	[0132.320] GetCurrentObject (hdc=0x2a010be7, type=0x2) returned 0x1900010
	[0132.320] GetCurrentObject (hdc=0x2a010be7, type=0x7) returned 0x140507d2
	[0132.320] GetCurrentObject (hdc=0x2a010be7, type=0x6) returned 0x18a002e
	[0132.321] SaveDC (hdc=0x2a010be7) returned 1
	[0132.321] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc4040710
	[0132.321] GetClipRgn (hdc=0x2a010be7, hrgn=0xffffffffc4040710) returned 0
	[0132.321] SelectClipRgn (hdc=0x2a010be7, hrgn=0x220407f9) returned 2
	[0132.321] DeleteObject (ho=0xffffffffc4040710) returned 1
	[0132.321] DeleteObject (ho=0x220407f9) returned 1
	[0132.321] OffsetViewportOrgEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x26dce80 | out: lppt=0x26dce80) returned 1
	[0132.321] GetNearestColor (hdc=0x2a010be7, color=0xf0f0f0) returned 0xf0f0f0
	[0132.321] CreateSolidBrush (color=0xf0f0f0) returned 0x711007c0
	[0132.321] FillRect (hDC=0x2a010be7, lprc=0x20c3c0, hbr=0x711007c0) returned 1
	[0132.321] DeleteObject (ho=0x711007c0) returned 1
	[0132.321] RestoreDC (hdc=0x2a010be7, nSavedDC=-1) returned 1
	[0132.321] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.321] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010be7) returned 0x0
	[0132.321] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.322] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.322] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.322] CoTaskMemFree (pv=0x1b077150) 
	[0132.322] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0132.322] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.322] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.322] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.322] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0132.322] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0132.322] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.322] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0132.322] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.322] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.322] GetFocus () returned 0x0
	[0132.322] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.322] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.323] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.323] CoTaskMemFree (pv=0x1b077150) 
	[0132.323] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0132.323] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0132.323] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.323] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0132.323] GdipCreateRegion (region=0x20c260) returned 0x0
	[0132.323] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.323] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0132.323] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.323] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0132.323] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0132.323] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.323] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.323] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.324] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0132.324] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0132.324] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0132.324] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.324] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.324] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0132.324] GetCurrentObject (hdc=0x2a010be7, type=0x1) returned 0x1b00017
	[0132.324] GetCurrentObject (hdc=0x2a010be7, type=0x2) returned 0x1900010
	[0132.324] GetCurrentObject (hdc=0x2a010be7, type=0x7) returned 0x140507d2
	[0132.324] GetCurrentObject (hdc=0x2a010be7, type=0x6) returned 0x18a002e
	[0132.324] SaveDC (hdc=0x2a010be7) returned 1
	[0132.324] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x230407f9
	[0132.324] GetClipRgn (hdc=0x2a010be7, hrgn=0x230407f9) returned 0
	[0132.324] SelectClipRgn (hdc=0x2a010be7, hrgn=0xffffffffc5040710) returned 2
	[0132.324] DeleteObject (ho=0x230407f9) returned 1
	[0132.324] DeleteObject (ho=0xffffffffc5040710) returned 1
	[0132.324] OffsetViewportOrgEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x26dd420 | out: lppt=0x26dd420) returned 1
	[0132.324] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.325] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.325] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.325] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1d300beb
	[0132.325] SelectObject (hdc=0x2a010be7, h=0x1d300beb) returned 0x1b00017
	[0132.325] MoveToEx (in: hdc=0x2a010be7, x=164, y=1, lppt=0x26dd488 | out: lppt=0x26dd488) returned 1
	[0132.325] LineTo (hdc=0x2a010be7, x=1, y=1) returned 1
	[0132.325] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.325] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.325] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.325] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.325] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.325] SelectObject (hdc=0x2a010be7, h=0x1d300beb) returned 0x1d300beb
	[0132.325] MoveToEx (in: hdc=0x2a010be7, x=1, y=1, lppt=0x26dd4a0 | out: lppt=0x26dd4a0) returned 1
	[0132.325] LineTo (hdc=0x2a010be7, x=1, y=41) returned 1
	[0132.325] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.325] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.325] SelectObject (hdc=0x2a010be7, h=0x1b00017) returned 0x1d300beb
	[0132.325] DeleteObject (ho=0x1d300beb) returned 1
	[0132.325] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.325] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.325] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.325] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x44300be5
	[0132.326] SelectObject (hdc=0x2a010be7, h=0x44300be5) returned 0x1b00017
	[0132.326] MoveToEx (in: hdc=0x2a010be7, x=1, y=41, lppt=0x26dd508 | out: lppt=0x26dd508) returned 1
	[0132.326] LineTo (hdc=0x2a010be7, x=164, y=41) returned 1
	[0132.326] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.326] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.326] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.326] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.326] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.326] SelectObject (hdc=0x2a010be7, h=0x44300be5) returned 0x44300be5
	[0132.326] MoveToEx (in: hdc=0x2a010be7, x=164, y=41, lppt=0x26dd520 | out: lppt=0x26dd520) returned 1
	[0132.326] LineTo (hdc=0x2a010be7, x=164, y=0) returned 1
	[0132.326] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.326] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.326] SelectObject (hdc=0x2a010be7, h=0x1b00017) returned 0x44300be5
	[0132.326] DeleteObject (ho=0x44300be5) returned 1
	[0132.326] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.326] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.326] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.326] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x1e300beb
	[0132.326] SelectObject (hdc=0x2a010be7, h=0x1e300beb) returned 0x1b00017
	[0132.326] MoveToEx (in: hdc=0x2a010be7, x=163, y=2, lppt=0x26dd588 | out: lppt=0x26dd588) returned 1
	[0132.326] LineTo (hdc=0x2a010be7, x=2, y=2) returned 1
	[0132.326] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.327] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.327] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.327] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.327] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.327] SelectObject (hdc=0x2a010be7, h=0x1e300beb) returned 0x1e300beb
	[0132.327] MoveToEx (in: hdc=0x2a010be7, x=2, y=2, lppt=0x26dd5a0 | out: lppt=0x26dd5a0) returned 1
	[0132.327] LineTo (hdc=0x2a010be7, x=2, y=40) returned 1
	[0132.327] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.327] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.327] SelectObject (hdc=0x2a010be7, h=0x1b00017) returned 0x1e300beb
	[0132.327] DeleteObject (ho=0x1e300beb) returned 1
	[0132.327] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.327] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.327] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.327] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x45300be5
	[0132.327] SelectObject (hdc=0x2a010be7, h=0x45300be5) returned 0x1b00017
	[0132.327] MoveToEx (in: hdc=0x2a010be7, x=2, y=40, lppt=0x26dd608 | out: lppt=0x26dd608) returned 1
	[0132.327] LineTo (hdc=0x2a010be7, x=163, y=40) returned 1
	[0132.327] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.327] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.327] GetROP2 (hdc=0x2a010be7) returned 13
	[0132.327] GetBkMode (hdc=0x2a010be7) returned 2
	[0132.327] SetBkMode (hdc=0x2a010be7, mode=1) returned 2
	[0132.328] SelectObject (hdc=0x2a010be7, h=0x45300be5) returned 0x45300be5
	[0132.328] MoveToEx (in: hdc=0x2a010be7, x=163, y=40, lppt=0x26dd620 | out: lppt=0x26dd620) returned 1
	[0132.328] LineTo (hdc=0x2a010be7, x=163, y=1) returned 1
	[0132.328] SetBkMode (hdc=0x2a010be7, mode=2) returned 1
	[0132.328] MoveToEx (in: hdc=0x2a010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.328] SelectObject (hdc=0x2a010be7, h=0x1b00017) returned 0x45300be5
	[0132.328] DeleteObject (ho=0x45300be5) returned 1
	[0132.328] RestoreDC (hdc=0x2a010be7, nSavedDC=-1) returned 1
	[0132.328] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.328] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010be7) returned 0x0
	[0132.328] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0132.328] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x2a010be7, x1=0, y1=0, rop=0xcc0020) returned 1
	[0132.328] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.328] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010be7) returned 0x0
	[0132.328] SelectObject (hdc=0x2a010be7, h=0x185000f) returned 0x140507d2
	[0132.328] DeleteDC (hdc=0x2a010be7) returned 1
	[0132.328] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.328] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0132.328] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0132.328] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0132.328] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x70107fc
	[0132.329] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0132.329] CreateCompatibleDC (hdc=0x70107fc) returned 0x2c010be7
	[0132.329] SelectObject (hdc=0x2c010be7, h=0x140507d2) returned 0x185000f
	[0132.329] GdipCreateFromHDC (hdc=0x2c010be7, graphics=0x20c9d0) returned 0x0
	[0132.329] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0132.329] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0132.329] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0132.329] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0132.329] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0132.329] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0132.329] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.329] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0132.329] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0132.329] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.329] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0132.329] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0132.329] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc830dbd) returned 0x0
	[0132.329] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0132.329] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.330] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0132.330] GetCurrentObject (hdc=0x2c010be7, type=0x1) returned 0x1b00017
	[0132.330] GetCurrentObject (hdc=0x2c010be7, type=0x2) returned 0x1900010
	[0132.330] GetCurrentObject (hdc=0x2c010be7, type=0x7) returned 0x140507d2
	[0132.330] GetCurrentObject (hdc=0x2c010be7, type=0x6) returned 0x18a002e
	[0132.330] SaveDC (hdc=0x2c010be7) returned 1
	[0132.330] GetNearestColor (hdc=0x2c010be7, color=0xf0f0f0) returned 0xf0f0f0
	[0132.330] GetNearestColor (hdc=0x2c010be7, color=0xa0a0a0) returned 0xa0a0a0
	[0132.330] GetNearestColor (hdc=0x2c010be7, color=0x696969) returned 0x696969
	[0132.331] GetNearestColor (hdc=0x2c010be7, color=0xa0a0a0) returned 0xa0a0a0
	[0132.331] GetNearestColor (hdc=0x2c010be7, color=0x0) returned 0x0
	[0132.331] GetNearestColor (hdc=0x2c010be7, color=0xffffff) returned 0xffffff
	[0132.331] GetNearestColor (hdc=0x2c010be7, color=0xe5e5e5) returned 0xe5e5e5
	[0132.331] GetNearestColor (hdc=0x2c010be7, color=0xd8d8d8) returned 0xd8d8d8
	[0132.332] GetNearestColor (hdc=0x2c010be7, color=0x0) returned 0x0
	[0132.332] RestoreDC (hdc=0x2c010be7, nSavedDC=-1) returned 1
	[0132.332] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c010be7) returned 0x0
	[0132.332] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.332] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.332] CoTaskMemFree (pv=0x1b077150) 
	[0132.332] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0132.332] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.333] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.333] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.333] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0132.333] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0132.333] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0132.333] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0132.333] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0132.334] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.334] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.334] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.334] CoTaskMemFree (pv=0x1b077150) 
	[0132.334] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0132.334] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0132.334] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0132.334] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0132.334] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.335] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.335] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.335] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0132.335] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.335] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0132.335] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.335] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.336] CoTaskMemFree (pv=0x1b077150) 
	[0132.336] GdipCreateRegion (region=0x20c310) returned 0x0
	[0132.336] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.336] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0132.336] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.336] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0132.336] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.337] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.337] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.337] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0132.337] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0132.337] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0132.337] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.338] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0132.338] GetCurrentObject (hdc=0x2c010be7, type=0x1) returned 0x1b00017
	[0132.338] GetCurrentObject (hdc=0x2c010be7, type=0x2) returned 0x1900010
	[0132.338] GetCurrentObject (hdc=0x2c010be7, type=0x7) returned 0x140507d2
	[0132.338] GetCurrentObject (hdc=0x2c010be7, type=0x6) returned 0x18a002e
	[0132.338] SaveDC (hdc=0x2c010be7) returned 1
	[0132.338] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc6040710
	[0132.339] GetClipRgn (hdc=0x2c010be7, hrgn=0xffffffffc6040710) returned 0
	[0132.339] SelectClipRgn (hdc=0x2c010be7, hrgn=0x240407f9) returned 2
	[0132.339] DeleteObject (ho=0xffffffffc6040710) returned 1
	[0132.339] DeleteObject (ho=0x240407f9) returned 1
	[0132.339] OffsetViewportOrgEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x26de280 | out: lppt=0x26de280) returned 1
	[0132.339] GetNearestColor (hdc=0x2c010be7, color=0xf0f0f0) returned 0xf0f0f0
	[0132.339] CreateSolidBrush (color=0xf0f0f0) returned 0x721007c0
	[0132.340] FillRect (hDC=0x2c010be7, lprc=0x20c3c0, hbr=0x721007c0) returned 1
	[0132.340] DeleteObject (ho=0x721007c0) returned 1
	[0132.340] RestoreDC (hdc=0x2c010be7, nSavedDC=-1) returned 1
	[0132.340] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c010be7) returned 0x0
	[0132.340] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.340] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.341] CoTaskMemFree (pv=0x1b077150) 
	[0132.341] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0132.341] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.341] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.341] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.341] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0132.341] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0132.341] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0132.342] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.342] GetFocus () returned 0x0
	[0132.342] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.342] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.342] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.342] CoTaskMemFree (pv=0x1b077150) 
	[0132.342] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0132.342] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0132.343] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0132.343] GdipCreateRegion (region=0x20c260) returned 0x0
	[0132.343] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.343] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0132.343] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0132.343] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0132.343] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.344] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.344] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0132.344] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0132.344] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0132.344] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0132.344] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.344] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0132.345] GetCurrentObject (hdc=0x2c010be7, type=0x1) returned 0x1b00017
	[0132.345] GetCurrentObject (hdc=0x2c010be7, type=0x2) returned 0x1900010
	[0132.345] GetCurrentObject (hdc=0x2c010be7, type=0x7) returned 0x140507d2
	[0132.345] GetCurrentObject (hdc=0x2c010be7, type=0x6) returned 0x18a002e
	[0132.345] SaveDC (hdc=0x2c010be7) returned 1
	[0132.345] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x250407f9
	[0132.345] GetClipRgn (hdc=0x2c010be7, hrgn=0x250407f9) returned 0
	[0132.346] SelectClipRgn (hdc=0x2c010be7, hrgn=0xffffffffc7040710) returned 2
	[0132.346] DeleteObject (ho=0x250407f9) returned 1
	[0132.346] DeleteObject (ho=0xffffffffc7040710) returned 1
	[0132.346] OffsetViewportOrgEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x26de820 | out: lppt=0x26de820) returned 1
	[0132.347] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.347] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.347] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.347] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x46300be5
	[0132.348] SelectObject (hdc=0x2c010be7, h=0x46300be5) returned 0x1b00017
	[0132.348] MoveToEx (in: hdc=0x2c010be7, x=126, y=1, lppt=0x26de888 | out: lppt=0x26de888) returned 1
	[0132.348] LineTo (hdc=0x2c010be7, x=1, y=1) returned 1
	[0132.348] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.348] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.348] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.348] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.348] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.349] SelectObject (hdc=0x2c010be7, h=0x46300be5) returned 0x46300be5
	[0132.349] MoveToEx (in: hdc=0x2c010be7, x=1, y=1, lppt=0x26de8a0 | out: lppt=0x26de8a0) returned 1
	[0132.349] LineTo (hdc=0x2c010be7, x=1, y=39) returned 1
	[0132.349] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.349] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.349] SelectObject (hdc=0x2c010be7, h=0x1b00017) returned 0x46300be5
	[0132.349] DeleteObject (ho=0x46300be5) returned 1
	[0132.350] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.350] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.350] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.350] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1f300beb
	[0132.350] SelectObject (hdc=0x2c010be7, h=0x1f300beb) returned 0x1b00017
	[0132.350] MoveToEx (in: hdc=0x2c010be7, x=1, y=39, lppt=0x26de908 | out: lppt=0x26de908) returned 1
	[0132.350] LineTo (hdc=0x2c010be7, x=126, y=39) returned 1
	[0132.351] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.351] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.351] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.351] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.351] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.351] SelectObject (hdc=0x2c010be7, h=0x1f300beb) returned 0x1f300beb
	[0132.351] MoveToEx (in: hdc=0x2c010be7, x=126, y=39, lppt=0x26de920 | out: lppt=0x26de920) returned 1
	[0132.352] LineTo (hdc=0x2c010be7, x=126, y=0) returned 1
	[0132.352] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.352] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.352] SelectObject (hdc=0x2c010be7, h=0x1b00017) returned 0x1f300beb
	[0132.352] DeleteObject (ho=0x1f300beb) returned 1
	[0132.352] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.352] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.353] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.353] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x47300be5
	[0132.353] SelectObject (hdc=0x2c010be7, h=0x47300be5) returned 0x1b00017
	[0132.353] MoveToEx (in: hdc=0x2c010be7, x=125, y=2, lppt=0x26de988 | out: lppt=0x26de988) returned 1
	[0132.353] LineTo (hdc=0x2c010be7, x=2, y=2) returned 1
	[0132.353] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.353] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.354] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.354] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.354] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.354] SelectObject (hdc=0x2c010be7, h=0x47300be5) returned 0x47300be5
	[0132.354] MoveToEx (in: hdc=0x2c010be7, x=2, y=2, lppt=0x26de9a0 | out: lppt=0x26de9a0) returned 1
	[0132.354] LineTo (hdc=0x2c010be7, x=2, y=38) returned 1
	[0132.354] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.354] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.355] SelectObject (hdc=0x2c010be7, h=0x1b00017) returned 0x47300be5
	[0132.355] DeleteObject (ho=0x47300be5) returned 1
	[0132.355] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.355] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.355] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.355] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x20300beb
	[0132.355] SelectObject (hdc=0x2c010be7, h=0x20300beb) returned 0x1b00017
	[0132.356] MoveToEx (in: hdc=0x2c010be7, x=2, y=38, lppt=0x26dea08 | out: lppt=0x26dea08) returned 1
	[0132.356] LineTo (hdc=0x2c010be7, x=125, y=38) returned 1
	[0132.356] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.356] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.356] GetROP2 (hdc=0x2c010be7) returned 13
	[0132.356] GetBkMode (hdc=0x2c010be7) returned 2
	[0132.356] SetBkMode (hdc=0x2c010be7, mode=1) returned 2
	[0132.357] SelectObject (hdc=0x2c010be7, h=0x20300beb) returned 0x20300beb
	[0132.357] MoveToEx (in: hdc=0x2c010be7, x=125, y=38, lppt=0x26dea20 | out: lppt=0x26dea20) returned 1
	[0132.357] LineTo (hdc=0x2c010be7, x=125, y=1) returned 1
	[0132.357] SetBkMode (hdc=0x2c010be7, mode=2) returned 1
	[0132.357] MoveToEx (in: hdc=0x2c010be7, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.357] SelectObject (hdc=0x2c010be7, h=0x1b00017) returned 0x20300beb
	[0132.357] DeleteObject (ho=0x20300beb) returned 1
	[0132.357] RestoreDC (hdc=0x2c010be7, nSavedDC=-1) returned 1
	[0132.358] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c010be7) returned 0x0
	[0132.358] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0132.358] BitBlt (hdc=0x70107fc, x=0, y=0, cx=128, cy=41, hdcSrc=0x2c010be7, x1=0, y1=0, rop=0xcc0020) returned 1
	[0132.358] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c010be7) returned 0x0
	[0132.358] SelectObject (hdc=0x2c010be7, h=0x185000f) returned 0x140507d2
	[0132.358] DeleteDC (hdc=0x2c010be7) returned 1
	[0132.359] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0132.359] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0132.359] EndPaint (hWnd=0x401b4, lpPaint=0x20cbd8) returned 1
	[0132.396] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0132.396] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0132.396] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x10107f8
	[0132.397] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0132.397] CreateCompatibleDC (hdc=0x10107f8) returned 0xffffffff95010839
	[0132.397] SelectObject (hdc=0xffffffff95010839, h=0x140507d2) returned 0x185000f
	[0132.397] GdipCreateFromHDC (hdc=0xffffffff95010839, graphics=0x20c9d0) returned 0x0
	[0132.397] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0132.397] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0132.398] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0132.398] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.398] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0132.398] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.398] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.398] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0132.398] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.399] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0132.399] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0132.399] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc800dbd) returned 0x0
	[0132.399] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.399] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0132.399] GetCurrentObject (hdc=0xffffffff95010839, type=0x1) returned 0x1b00017
	[0132.399] GetCurrentObject (hdc=0xffffffff95010839, type=0x2) returned 0x1900010
	[0132.400] GetCurrentObject (hdc=0xffffffff95010839, type=0x7) returned 0x140507d2
	[0132.400] GetCurrentObject (hdc=0xffffffff95010839, type=0x6) returned 0x18a002e
	[0132.400] SaveDC (hdc=0xffffffff95010839) returned 1
	[0132.400] GetNearestColor (hdc=0xffffffff95010839, color=0xf0f0f0) returned 0xf0f0f0
	[0132.400] GetNearestColor (hdc=0xffffffff95010839, color=0xa0a0a0) returned 0xa0a0a0
	[0132.400] GetNearestColor (hdc=0xffffffff95010839, color=0x696969) returned 0x696969
	[0132.400] GetNearestColor (hdc=0xffffffff95010839, color=0xa0a0a0) returned 0xa0a0a0
	[0132.401] GetNearestColor (hdc=0xffffffff95010839, color=0x0) returned 0x0
	[0132.401] GetNearestColor (hdc=0xffffffff95010839, color=0xffffff) returned 0xffffff
	[0132.401] GetNearestColor (hdc=0xffffffff95010839, color=0xe5e5e5) returned 0xe5e5e5
	[0132.401] GetNearestColor (hdc=0xffffffff95010839, color=0xd8d8d8) returned 0xd8d8d8
	[0132.401] GetNearestColor (hdc=0xffffffff95010839, color=0x0) returned 0x0
	[0132.401] RestoreDC (hdc=0xffffffff95010839, nSavedDC=-1) returned 1
	[0132.401] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff95010839) returned 0x0
	[0132.402] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.402] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.402] CoTaskMemFree (pv=0x1b077150) 
	[0132.402] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0132.402] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.402] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.403] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.403] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0132.403] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0132.403] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0132.403] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0132.403] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0132.404] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.404] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.404] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.404] CoTaskMemFree (pv=0x1b077150) 
	[0132.404] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0132.404] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0132.404] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0132.405] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0132.405] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.405] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.405] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.405] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0132.405] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.406] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0132.406] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.406] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.406] CoTaskMemFree (pv=0x1b077150) 
	[0132.406] GdipCreateRegion (region=0x20c310) returned 0x0
	[0132.406] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.406] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0132.407] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0132.407] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0132.407] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.407] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.407] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0132.407] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0132.407] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0132.407] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0132.408] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.408] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0132.408] GetCurrentObject (hdc=0xffffffff95010839, type=0x1) returned 0x1b00017
	[0132.408] GetCurrentObject (hdc=0xffffffff95010839, type=0x2) returned 0x1900010
	[0132.408] GetCurrentObject (hdc=0xffffffff95010839, type=0x7) returned 0x140507d2
	[0132.408] GetCurrentObject (hdc=0xffffffff95010839, type=0x6) returned 0x18a002e
	[0132.408] SaveDC (hdc=0xffffffff95010839) returned 1
	[0132.409] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc8040710
	[0132.409] GetClipRgn (hdc=0xffffffff95010839, hrgn=0xffffffffc8040710) returned 0
	[0132.409] SelectClipRgn (hdc=0xffffffff95010839, hrgn=0x260407f9) returned 2
	[0132.410] DeleteObject (ho=0xffffffffc8040710) returned 1
	[0132.410] DeleteObject (ho=0x260407f9) returned 1
	[0132.410] OffsetViewportOrgEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x26df6b8 | out: lppt=0x26df6b8) returned 1
	[0132.410] GetNearestColor (hdc=0xffffffff95010839, color=0xf0f0f0) returned 0xf0f0f0
	[0132.410] CreateSolidBrush (color=0xf0f0f0) returned 0x731007c0
	[0132.410] FillRect (hDC=0xffffffff95010839, lprc=0x20c3c0, hbr=0x731007c0) returned 1
	[0132.410] DeleteObject (ho=0x731007c0) returned 1
	[0132.411] RestoreDC (hdc=0xffffffff95010839, nSavedDC=-1) returned 1
	[0132.411] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff95010839) returned 0x0
	[0132.411] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.411] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.411] CoTaskMemFree (pv=0x1b077150) 
	[0132.411] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0132.412] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.412] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0132.412] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0132.412] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0132.412] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0132.412] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0132.412] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0132.413] GetFocus () returned 0x0
	[0132.413] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0132.413] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0132.413] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0132.413] CoTaskMemFree (pv=0x1b077150) 
	[0132.413] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0132.413] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0132.413] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0132.413] GdipCreateRegion (region=0x20c260) returned 0x0
	[0132.414] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0132.414] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0132.414] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0132.414] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0132.414] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.414] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0132.414] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0132.415] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0132.415] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0132.415] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0132.415] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0132.415] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0132.415] GetCurrentObject (hdc=0xffffffff95010839, type=0x1) returned 0x1b00017
	[0132.415] GetCurrentObject (hdc=0xffffffff95010839, type=0x2) returned 0x1900010
	[0132.416] GetCurrentObject (hdc=0xffffffff95010839, type=0x7) returned 0x140507d2
	[0132.416] GetCurrentObject (hdc=0xffffffff95010839, type=0x6) returned 0x18a002e
	[0132.416] SaveDC (hdc=0xffffffff95010839) returned 1
	[0132.416] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x270407f9
	[0132.416] GetClipRgn (hdc=0xffffffff95010839, hrgn=0x270407f9) returned 0
	[0132.416] SelectClipRgn (hdc=0xffffffff95010839, hrgn=0xffffffffc9040710) returned 2
	[0132.416] DeleteObject (ho=0x270407f9) returned 1
	[0132.417] DeleteObject (ho=0xffffffffc9040710) returned 1
	[0132.417] OffsetViewportOrgEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x26dfc58 | out: lppt=0x26dfc58) returned 1
	[0132.417] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.417] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.417] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.417] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x4300bec
	[0132.417] SelectObject (hdc=0xffffffff95010839, h=0x4300bec) returned 0x1b00017
	[0132.418] MoveToEx (in: hdc=0xffffffff95010839, x=126, y=1, lppt=0x26dfcc0 | out: lppt=0x26dfcc0) returned 1
	[0132.418] LineTo (hdc=0xffffffff95010839, x=1, y=1) returned 1
	[0132.418] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.418] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.418] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.418] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.419] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.419] SelectObject (hdc=0xffffffff95010839, h=0x4300bec) returned 0x4300bec
	[0132.419] MoveToEx (in: hdc=0xffffffff95010839, x=1, y=1, lppt=0x26dfcd8 | out: lppt=0x26dfcd8) returned 1
	[0132.419] LineTo (hdc=0xffffffff95010839, x=1, y=39) returned 1
	[0132.419] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.419] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.419] SelectObject (hdc=0xffffffff95010839, h=0x1b00017) returned 0x4300bec
	[0132.420] DeleteObject (ho=0x4300bec) returned 1
	[0132.420] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.420] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.420] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.420] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x51300be5
	[0132.420] SelectObject (hdc=0xffffffff95010839, h=0x51300be5) returned 0x1b00017
	[0132.420] MoveToEx (in: hdc=0xffffffff95010839, x=1, y=39, lppt=0x26dfd40 | out: lppt=0x26dfd40) returned 1
	[0132.421] LineTo (hdc=0xffffffff95010839, x=126, y=39) returned 1
	[0132.421] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.421] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.421] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.421] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.421] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.421] SelectObject (hdc=0xffffffff95010839, h=0x51300be5) returned 0x51300be5
	[0132.421] MoveToEx (in: hdc=0xffffffff95010839, x=126, y=39, lppt=0x26dfd58 | out: lppt=0x26dfd58) returned 1
	[0132.422] LineTo (hdc=0xffffffff95010839, x=126, y=0) returned 1
	[0132.422] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.422] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.422] SelectObject (hdc=0xffffffff95010839, h=0x1b00017) returned 0x51300be5
	[0132.422] DeleteObject (ho=0x51300be5) returned 1
	[0132.422] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.423] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.423] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.423] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x5300bec
	[0132.423] SelectObject (hdc=0xffffffff95010839, h=0x5300bec) returned 0x1b00017
	[0132.423] MoveToEx (in: hdc=0xffffffff95010839, x=125, y=2, lppt=0x26dfdc0 | out: lppt=0x26dfdc0) returned 1
	[0132.423] LineTo (hdc=0xffffffff95010839, x=2, y=2) returned 1
	[0132.423] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.423] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.424] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.424] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.424] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.424] SelectObject (hdc=0xffffffff95010839, h=0x5300bec) returned 0x5300bec
	[0132.424] MoveToEx (in: hdc=0xffffffff95010839, x=2, y=2, lppt=0x26dfdd8 | out: lppt=0x26dfdd8) returned 1
	[0132.425] LineTo (hdc=0xffffffff95010839, x=2, y=38) returned 1
	[0132.425] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.425] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.425] SelectObject (hdc=0xffffffff95010839, h=0x1b00017) returned 0x5300bec
	[0132.425] DeleteObject (ho=0x5300bec) returned 1
	[0132.425] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.425] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.426] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.426] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x52300be5
	[0132.426] SelectObject (hdc=0xffffffff95010839, h=0x52300be5) returned 0x1b00017
	[0132.426] MoveToEx (in: hdc=0xffffffff95010839, x=2, y=38, lppt=0x26dfe40 | out: lppt=0x26dfe40) returned 1
	[0132.426] LineTo (hdc=0xffffffff95010839, x=125, y=38) returned 1
	[0132.426] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.426] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.427] GetROP2 (hdc=0xffffffff95010839) returned 13
	[0132.427] GetBkMode (hdc=0xffffffff95010839) returned 2
	[0132.427] SetBkMode (hdc=0xffffffff95010839, mode=1) returned 2
	[0132.427] SelectObject (hdc=0xffffffff95010839, h=0x52300be5) returned 0x52300be5
	[0132.427] MoveToEx (in: hdc=0xffffffff95010839, x=125, y=38, lppt=0x26dfe58 | out: lppt=0x26dfe58) returned 1
	[0132.427] LineTo (hdc=0xffffffff95010839, x=125, y=1) returned 1
	[0132.427] SetBkMode (hdc=0xffffffff95010839, mode=2) returned 1
	[0132.427] MoveToEx (in: hdc=0xffffffff95010839, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0132.428] SelectObject (hdc=0xffffffff95010839, h=0x1b00017) returned 0x52300be5
	[0132.428] DeleteObject (ho=0x52300be5) returned 1
	[0132.428] RestoreDC (hdc=0xffffffff95010839, nSavedDC=-1) returned 1
	[0132.428] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff95010839) returned 0x0
	[0132.428] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0132.428] BitBlt (hdc=0x10107f8, x=0, y=0, cx=128, cy=41, hdcSrc=0xffffffff95010839, x1=0, y1=0, rop=0xcc0020) returned 1
	[0132.429] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff95010839) returned 0x0
	[0132.429] SelectObject (hdc=0xffffffff95010839, h=0x185000f) returned 0x140507d2
	[0132.429] DeleteDC (hdc=0xffffffff95010839) returned 1
	[0132.429] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0132.429] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0132.429] EndPaint (hWnd=0x401b4, lpPaint=0x20cbd8) returned 1
	[0132.486] GetCapture () returned 0x0
	[0132.486] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0132.486] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0132.486] WaitMessage () returned 1
	[0132.601] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0132.601] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0132.601] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0132.601] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0132.602] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0132.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0132.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0132.602] WaitMessage () returned 1
	[0135.110] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.110] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.110] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0135.110] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.110] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.110] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0135.110] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.110] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.110] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0135.110] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0135.110] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0135.111] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0135.111] GetKeyState (nVirtKey=1) returned 1
	[0135.111] GetKeyState (nVirtKey=2) returned 0
	[0135.111] GetKeyState (nVirtKey=4) returned 0
	[0135.111] GetKeyState (nVirtKey=5) returned 0
	[0135.111] GetKeyState (nVirtKey=6) returned 0
	[0135.111] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.111] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0135.111] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.111] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.111] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.111] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0135.111] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0135.111] CreateCompatibleDC (hdc=0x4010280) returned 0x25010cba
	[0135.112] SelectObject (hdc=0x25010cba, h=0x140507d2) returned 0x185000f
	[0135.112] GdipCreateFromHDC (hdc=0x25010cba, graphics=0x20d7e0) returned 0x0
	[0135.112] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0135.112] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0135.112] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0135.112] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0135.112] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0135.113] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0135.113] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0135.113] GdipCreateRegion (region=0x20d910) returned 0x0
	[0135.113] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.113] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0135.113] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0135.113] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc7d0dbd) returned 0x0
	[0135.114] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.114] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0135.114] GetCurrentObject (hdc=0x25010cba, type=0x1) returned 0x1b00017
	[0135.114] GetCurrentObject (hdc=0x25010cba, type=0x2) returned 0x1900010
	[0135.114] GetCurrentObject (hdc=0x25010cba, type=0x7) returned 0x140507d2
	[0135.114] GetCurrentObject (hdc=0x25010cba, type=0x6) returned 0x18a002e
	[0135.115] SaveDC (hdc=0x25010cba) returned 1
	[0135.115] GetNearestColor (hdc=0x25010cba, color=0xf0f0f0) returned 0xf0f0f0
	[0135.115] GetNearestColor (hdc=0x25010cba, color=0xa0a0a0) returned 0xa0a0a0
	[0135.115] GetNearestColor (hdc=0x25010cba, color=0x696969) returned 0x696969
	[0135.115] GetNearestColor (hdc=0x25010cba, color=0xa0a0a0) returned 0xa0a0a0
	[0135.115] GetNearestColor (hdc=0x25010cba, color=0x0) returned 0x0
	[0135.115] GetNearestColor (hdc=0x25010cba, color=0xffffff) returned 0xffffff
	[0135.116] GetNearestColor (hdc=0x25010cba, color=0xe5e5e5) returned 0xe5e5e5
	[0135.116] GetNearestColor (hdc=0x25010cba, color=0xd8d8d8) returned 0xd8d8d8
	[0135.116] GetNearestColor (hdc=0x25010cba, color=0x0) returned 0x0
	[0135.116] RestoreDC (hdc=0x25010cba, nSavedDC=-1) returned 1
	[0135.116] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010cba) returned 0x0
	[0135.116] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0135.117] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.117] CoTaskMemFree (pv=0x1b067a20) 
	[0135.117] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0135.117] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.117] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.117] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.117] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0135.117] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0135.118] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0135.118] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0135.118] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0135.118] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.118] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0135.118] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.118] CoTaskMemFree (pv=0x1b067a20) 
	[0135.118] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0135.119] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0135.119] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0135.119] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0135.119] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.119] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.119] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.120] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0135.120] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.120] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0135.120] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0135.120] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.120] CoTaskMemFree (pv=0x1b067a20) 
	[0135.120] GdipCreateRegion (region=0x20d120) returned 0x0
	[0135.120] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.121] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0135.121] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0135.121] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0135.121] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0135.121] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0135.121] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0135.121] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0135.122] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0135.122] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0135.122] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.122] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0135.122] GetCurrentObject (hdc=0x25010cba, type=0x1) returned 0x1b00017
	[0135.122] GetCurrentObject (hdc=0x25010cba, type=0x2) returned 0x1900010
	[0135.123] GetCurrentObject (hdc=0x25010cba, type=0x7) returned 0x140507d2
	[0135.123] GetCurrentObject (hdc=0x25010cba, type=0x6) returned 0x18a002e
	[0135.123] SaveDC (hdc=0x25010cba) returned 1
	[0135.123] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffca040710
	[0135.123] GetClipRgn (hdc=0x25010cba, hrgn=0xffffffffca040710) returned 0
	[0135.123] SelectClipRgn (hdc=0x25010cba, hrgn=0x280407f9) returned 2
	[0135.124] DeleteObject (ho=0xffffffffca040710) returned 1
	[0135.124] DeleteObject (ho=0x280407f9) returned 1
	[0135.124] OffsetViewportOrgEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x26e0b88 | out: lppt=0x26e0b88) returned 1
	[0135.124] GetNearestColor (hdc=0x25010cba, color=0xf0f0f0) returned 0xf0f0f0
	[0135.124] CreateSolidBrush (color=0xf0f0f0) returned 0x741007c0
	[0135.124] FillRect (hDC=0x25010cba, lprc=0x20d1d0, hbr=0x741007c0) returned 1
	[0135.124] DeleteObject (ho=0x741007c0) returned 1
	[0135.125] RestoreDC (hdc=0x25010cba, nSavedDC=-1) returned 1
	[0135.125] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010cba) returned 0x0
	[0135.125] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0135.125] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.125] CoTaskMemFree (pv=0x1b067a20) 
	[0135.125] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0135.125] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.125] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.126] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.126] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0135.126] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0135.126] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0135.126] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.127] GetFocus () returned 0x0
	[0135.127] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0135.127] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0135.127] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.127] CoTaskMemFree (pv=0x1b067a20) 
	[0135.127] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0135.127] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0135.127] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0135.127] GdipCreateRegion (region=0x20d070) returned 0x0
	[0135.128] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.128] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0135.128] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0135.128] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0135.128] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0135.128] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0135.128] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0135.129] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0135.129] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0135.129] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0135.129] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.129] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0135.129] GetCurrentObject (hdc=0x25010cba, type=0x1) returned 0x1b00017
	[0135.129] GetCurrentObject (hdc=0x25010cba, type=0x2) returned 0x1900010
	[0135.130] GetCurrentObject (hdc=0x25010cba, type=0x7) returned 0x140507d2
	[0135.130] GetCurrentObject (hdc=0x25010cba, type=0x6) returned 0x18a002e
	[0135.130] SaveDC (hdc=0x25010cba) returned 1
	[0135.130] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x290407f9
	[0135.130] GetClipRgn (hdc=0x25010cba, hrgn=0x290407f9) returned 0
	[0135.130] SelectClipRgn (hdc=0x25010cba, hrgn=0xffffffffcb040710) returned 2
	[0135.130] DeleteObject (ho=0x290407f9) returned 1
	[0135.131] DeleteObject (ho=0xffffffffcb040710) returned 1
	[0135.131] OffsetViewportOrgEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x26e1128 | out: lppt=0x26e1128) returned 1
	[0135.131] GetROP2 (hdc=0x25010cba) returned 13
	[0135.131] GetBkMode (hdc=0x25010cba) returned 2
	[0135.131] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.131] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x51300be0
	[0135.132] SelectObject (hdc=0x25010cba, h=0x51300be0) returned 0x1b00017
	[0135.132] MoveToEx (in: hdc=0x25010cba, x=164, y=1, lppt=0x26e1190 | out: lppt=0x26e1190) returned 1
	[0135.132] LineTo (hdc=0x25010cba, x=1, y=1) returned 1
	[0135.132] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.132] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.132] GetROP2 (hdc=0x25010cba) returned 13
	[0135.132] GetBkMode (hdc=0x25010cba) returned 2
	[0135.133] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.133] SelectObject (hdc=0x25010cba, h=0x51300be0) returned 0x51300be0
	[0135.133] MoveToEx (in: hdc=0x25010cba, x=1, y=1, lppt=0x26e11a8 | out: lppt=0x26e11a8) returned 1
	[0135.133] LineTo (hdc=0x25010cba, x=1, y=41) returned 1
	[0135.133] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.133] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.133] SelectObject (hdc=0x25010cba, h=0x1b00017) returned 0x51300be0
	[0135.134] DeleteObject (ho=0x51300be0) returned 1
	[0135.134] GetROP2 (hdc=0x25010cba) returned 13
	[0135.134] GetBkMode (hdc=0x25010cba) returned 2
	[0135.134] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.134] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x3d300cb5
	[0135.134] SelectObject (hdc=0x25010cba, h=0x3d300cb5) returned 0x1b00017
	[0135.134] MoveToEx (in: hdc=0x25010cba, x=1, y=41, lppt=0x26e1210 | out: lppt=0x26e1210) returned 1
	[0135.135] LineTo (hdc=0x25010cba, x=164, y=41) returned 1
	[0135.135] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.135] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.135] GetROP2 (hdc=0x25010cba) returned 13
	[0135.135] GetBkMode (hdc=0x25010cba) returned 2
	[0135.135] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.135] SelectObject (hdc=0x25010cba, h=0x3d300cb5) returned 0x3d300cb5
	[0135.135] MoveToEx (in: hdc=0x25010cba, x=164, y=41, lppt=0x26e1228 | out: lppt=0x26e1228) returned 1
	[0135.136] LineTo (hdc=0x25010cba, x=164, y=0) returned 1
	[0135.136] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.136] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.136] SelectObject (hdc=0x25010cba, h=0x1b00017) returned 0x3d300cb5
	[0135.136] DeleteObject (ho=0x3d300cb5) returned 1
	[0135.136] GetROP2 (hdc=0x25010cba) returned 13
	[0135.136] GetBkMode (hdc=0x25010cba) returned 2
	[0135.137] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.137] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x52300be0
	[0135.137] SelectObject (hdc=0x25010cba, h=0x52300be0) returned 0x1b00017
	[0135.137] MoveToEx (in: hdc=0x25010cba, x=163, y=2, lppt=0x26e1290 | out: lppt=0x26e1290) returned 1
	[0135.137] LineTo (hdc=0x25010cba, x=2, y=2) returned 1
	[0135.137] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.137] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.138] GetROP2 (hdc=0x25010cba) returned 13
	[0135.138] GetBkMode (hdc=0x25010cba) returned 2
	[0135.138] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.138] SelectObject (hdc=0x25010cba, h=0x52300be0) returned 0x52300be0
	[0135.138] MoveToEx (in: hdc=0x25010cba, x=2, y=2, lppt=0x26e12a8 | out: lppt=0x26e12a8) returned 1
	[0135.138] LineTo (hdc=0x25010cba, x=2, y=40) returned 1
	[0135.138] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.138] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.139] SelectObject (hdc=0x25010cba, h=0x1b00017) returned 0x52300be0
	[0135.139] DeleteObject (ho=0x52300be0) returned 1
	[0135.139] GetROP2 (hdc=0x25010cba) returned 13
	[0135.139] GetBkMode (hdc=0x25010cba) returned 2
	[0135.139] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.139] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x3e300cb5
	[0135.140] SelectObject (hdc=0x25010cba, h=0x3e300cb5) returned 0x1b00017
	[0135.140] MoveToEx (in: hdc=0x25010cba, x=2, y=40, lppt=0x26e1310 | out: lppt=0x26e1310) returned 1
	[0135.140] LineTo (hdc=0x25010cba, x=163, y=40) returned 1
	[0135.140] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.140] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.140] GetROP2 (hdc=0x25010cba) returned 13
	[0135.140] GetBkMode (hdc=0x25010cba) returned 2
	[0135.141] SetBkMode (hdc=0x25010cba, mode=1) returned 2
	[0135.141] SelectObject (hdc=0x25010cba, h=0x3e300cb5) returned 0x3e300cb5
	[0135.141] MoveToEx (in: hdc=0x25010cba, x=163, y=40, lppt=0x26e1328 | out: lppt=0x26e1328) returned 1
	[0135.141] LineTo (hdc=0x25010cba, x=163, y=1) returned 1
	[0135.141] SetBkMode (hdc=0x25010cba, mode=2) returned 1
	[0135.141] MoveToEx (in: hdc=0x25010cba, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.141] SelectObject (hdc=0x25010cba, h=0x1b00017) returned 0x3e300cb5
	[0135.142] DeleteObject (ho=0x3e300cb5) returned 1
	[0135.142] RestoreDC (hdc=0x25010cba, nSavedDC=-1) returned 1
	[0135.142] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010cba) returned 0x0
	[0135.142] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0135.142] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x25010cba, x1=0, y1=0, rop=0xcc0020) returned 1
	[0135.142] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010cba) returned 0x0
	[0135.143] SelectObject (hdc=0x25010cba, h=0x185000f) returned 0x140507d2
	[0135.143] DeleteDC (hdc=0x25010cba) returned 1
	[0135.143] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0135.143] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0135.143] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0135.143] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.143] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.143] WaitMessage () returned 1
	[0135.217] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.217] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0135.217] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.217] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.217] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.217] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.217] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0135.217] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.217] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.217] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.217] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x1d0033) returned 0x0
	[0135.217] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.217] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.217] WaitMessage () returned 1
	[0135.345] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.345] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.345] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0135.345] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.345] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.345] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0135.345] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe9010f) returned 0x0
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0135.346] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0135.346] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0135.347] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0135.347] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0135.347] GetFocus () returned 0x0
	[0135.347] SetFocus (hWnd=0x201d8) returned 0x0
	[0135.347] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0135.347] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0135.348] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0135.348] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0135.348] GetStockObject (i=5) returned 0x1900015
	[0135.348] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0135.348] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0135.348] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0135.348] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0135.348] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.348] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.348] GetKeyState (nVirtKey=1) returned -128
	[0135.348] GetKeyState (nVirtKey=2) returned 0
	[0135.348] GetKeyState (nVirtKey=4) returned 0
	[0135.348] GetKeyState (nVirtKey=5) returned 0
	[0135.348] GetKeyState (nVirtKey=6) returned 0
	[0135.348] IsWindowVisible (hWnd=0x201d8) returned 1
	[0135.348] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0135.349] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0135.349] GetFocus () returned 0x201d8
	[0135.349] GetFocus () returned 0x201d8
	[0135.349] GetFocus () returned 0x201d8
	[0135.349] GetKeyState (nVirtKey=1) returned -128
	[0135.349] GetKeyState (nVirtKey=2) returned 0
	[0135.349] GetKeyState (nVirtKey=4) returned 0
	[0135.349] GetKeyState (nVirtKey=5) returned 0
	[0135.349] GetKeyState (nVirtKey=6) returned 0
	[0135.349] GetCapture () returned 0x0
	[0135.349] SetCapture (hWnd=0x201d8) returned 0x0
	[0135.349] GetKeyState (nVirtKey=1) returned -128
	[0135.349] GetKeyState (nVirtKey=2) returned 0
	[0135.349] GetKeyState (nVirtKey=4) returned 0
	[0135.349] GetKeyState (nVirtKey=5) returned 0
	[0135.349] GetKeyState (nVirtKey=6) returned 0
	[0135.349] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0135.349] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0135.349] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.349] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.349] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.349] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0135.349] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.349] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.349] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.349] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0135.349] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.349] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0135.349] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.349] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.349] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.349] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26e14a0, cPoints=0x1 | out: lpPoints=0x26e14a0) returned 30606029
	[0135.349] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0135.349] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0135.349] UpdateWindow (hWnd=0x201d8) returned 1
	[0135.349] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0135.350] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0135.350] CreateCompatibleDC (hdc=0x10107f8) returned 0x4a010cb5
	[0135.350] SelectObject (hdc=0x4a010cb5, h=0x140507d2) returned 0x185000f
	[0135.350] GdipCreateFromHDC (hdc=0x4a010cb5, graphics=0x20cfa0) returned 0x0
	[0135.350] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0135.350] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0135.351] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0135.351] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0135.351] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0135.351] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0135.351] LocalFree (hMem=0x1b07c780) returned 0x0
	[0135.351] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0135.351] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0135.352] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.352] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0135.352] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0135.352] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc7a0dbd) returned 0x0
	[0135.352] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.353] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0135.353] GetCurrentObject (hdc=0x4a010cb5, type=0x1) returned 0x1b00017
	[0135.353] GetCurrentObject (hdc=0x4a010cb5, type=0x2) returned 0x1900010
	[0135.353] GetCurrentObject (hdc=0x4a010cb5, type=0x7) returned 0x140507d2
	[0135.353] GetCurrentObject (hdc=0x4a010cb5, type=0x6) returned 0x18a002e
	[0135.353] SaveDC (hdc=0x4a010cb5) returned 1
	[0135.353] GetNearestColor (hdc=0x4a010cb5, color=0xf0f0f0) returned 0xf0f0f0
	[0135.354] GetNearestColor (hdc=0x4a010cb5, color=0xa0a0a0) returned 0xa0a0a0
	[0135.354] GetNearestColor (hdc=0x4a010cb5, color=0x696969) returned 0x696969
	[0135.354] GetNearestColor (hdc=0x4a010cb5, color=0xa0a0a0) returned 0xa0a0a0
	[0135.354] GetNearestColor (hdc=0x4a010cb5, color=0x0) returned 0x0
	[0135.354] GetNearestColor (hdc=0x4a010cb5, color=0xffffff) returned 0xffffff
	[0135.355] GetNearestColor (hdc=0x4a010cb5, color=0xe5e5e5) returned 0xe5e5e5
	[0135.355] GetNearestColor (hdc=0x4a010cb5, color=0xd8d8d8) returned 0xd8d8d8
	[0135.355] GetNearestColor (hdc=0x4a010cb5, color=0x0) returned 0x0
	[0135.355] RestoreDC (hdc=0x4a010cb5, nSavedDC=-1) returned 1
	[0135.355] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4a010cb5) returned 0x0
	[0135.356] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0135.356] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.356] CoTaskMemFree (pv=0x1b067980) 
	[0135.356] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0135.356] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.356] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.356] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.356] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0135.357] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0135.357] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0135.357] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0135.361] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0135.361] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.361] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0135.362] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.362] CoTaskMemFree (pv=0x1b067980) 
	[0135.362] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0135.362] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0135.362] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0135.362] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0135.362] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.362] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.363] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.363] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0135.363] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.363] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0135.363] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0135.364] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.364] CoTaskMemFree (pv=0x1b067980) 
	[0135.364] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0135.364] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.364] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0135.364] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0135.364] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0135.365] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0135.365] LocalFree (hMem=0x1b07c780) returned 0x0
	[0135.365] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0135.365] LocalFree (hMem=0x1b07c780) returned 0x0
	[0135.365] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0135.365] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0135.366] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0135.366] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0135.366] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.366] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0135.366] GetCurrentObject (hdc=0x4a010cb5, type=0x1) returned 0x1b00017
	[0135.366] GetCurrentObject (hdc=0x4a010cb5, type=0x2) returned 0x1900010
	[0135.366] GetCurrentObject (hdc=0x4a010cb5, type=0x7) returned 0x140507d2
	[0135.367] GetCurrentObject (hdc=0x4a010cb5, type=0x6) returned 0x18a002e
	[0135.367] SaveDC (hdc=0x4a010cb5) returned 1
	[0135.368] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffcc040710
	[0135.368] GetClipRgn (hdc=0x4a010cb5, hrgn=0xffffffffcc040710) returned 0
	[0135.368] SelectClipRgn (hdc=0x4a010cb5, hrgn=0x2c0407f9) returned 2
	[0135.368] DeleteObject (ho=0xffffffffcc040710) returned 1
	[0135.368] DeleteObject (ho=0x2c0407f9) returned 1
	[0135.368] OffsetViewportOrgEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x26e2120 | out: lppt=0x26e2120) returned 1
	[0135.368] GetNearestColor (hdc=0x4a010cb5, color=0xf0f0f0) returned 0xf0f0f0
	[0135.369] CreateSolidBrush (color=0xf0f0f0) returned 0x751007c0
	[0135.369] FillRect (hDC=0x4a010cb5, lprc=0x20c990, hbr=0x751007c0) returned 1
	[0135.369] DeleteObject (ho=0x751007c0) returned 1
	[0135.369] RestoreDC (hdc=0x4a010cb5, nSavedDC=-1) returned 1
	[0135.369] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4a010cb5) returned 0x0
	[0135.369] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0135.370] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.370] CoTaskMemFree (pv=0x1b067980) 
	[0135.370] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0135.370] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.370] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.370] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.370] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0135.370] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0135.371] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0135.371] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.371] GetFocus () returned 0x201d8
	[0135.371] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0135.371] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0135.371] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.371] CoTaskMemFree (pv=0x1b067980) 
	[0135.371] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0135.372] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0135.372] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0135.372] GdipCreateRegion (region=0x20c830) returned 0x0
	[0135.372] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.372] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0135.372] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0135.373] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0135.373] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0135.373] LocalFree (hMem=0x1b07c780) returned 0x0
	[0135.373] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0135.373] LocalFree (hMem=0x1b07c780) returned 0x0
	[0135.373] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0135.374] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0135.374] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0135.374] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0135.374] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.374] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0135.374] GetCurrentObject (hdc=0x4a010cb5, type=0x1) returned 0x1b00017
	[0135.374] GetCurrentObject (hdc=0x4a010cb5, type=0x2) returned 0x1900010
	[0135.374] GetCurrentObject (hdc=0x4a010cb5, type=0x7) returned 0x140507d2
	[0135.375] GetCurrentObject (hdc=0x4a010cb5, type=0x6) returned 0x18a002e
	[0135.375] SaveDC (hdc=0x4a010cb5) returned 1
	[0135.375] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2d0407f9
	[0135.375] GetClipRgn (hdc=0x4a010cb5, hrgn=0x2d0407f9) returned 0
	[0135.375] SelectClipRgn (hdc=0x4a010cb5, hrgn=0xffffffffcd040710) returned 2
	[0135.375] DeleteObject (ho=0x2d0407f9) returned 1
	[0135.376] DeleteObject (ho=0xffffffffcd040710) returned 1
	[0135.376] OffsetViewportOrgEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x26e26c0 | out: lppt=0x26e26c0) returned 1
	[0135.376] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.376] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.376] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.376] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x2e300cbb
	[0135.376] SelectObject (hdc=0x4a010cb5, h=0x2e300cbb) returned 0x1b00017
	[0135.377] MoveToEx (in: hdc=0x4a010cb5, x=164, y=1, lppt=0x26e2728 | out: lppt=0x26e2728) returned 1
	[0135.377] LineTo (hdc=0x4a010cb5, x=1, y=1) returned 1
	[0135.377] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.377] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.377] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.377] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.377] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.377] SelectObject (hdc=0x4a010cb5, h=0x2e300cbb) returned 0x2e300cbb
	[0135.378] MoveToEx (in: hdc=0x4a010cb5, x=1, y=1, lppt=0x26e2740 | out: lppt=0x26e2740) returned 1
	[0135.378] LineTo (hdc=0x4a010cb5, x=1, y=41) returned 1
	[0135.378] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.378] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.378] SelectObject (hdc=0x4a010cb5, h=0x1b00017) returned 0x2e300cbb
	[0135.378] DeleteObject (ho=0x2e300cbb) returned 1
	[0135.379] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.379] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.379] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.379] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x58300be0
	[0135.379] SelectObject (hdc=0x4a010cb5, h=0x58300be0) returned 0x1b00017
	[0135.379] MoveToEx (in: hdc=0x4a010cb5, x=1, y=41, lppt=0x26e27a8 | out: lppt=0x26e27a8) returned 1
	[0135.379] LineTo (hdc=0x4a010cb5, x=164, y=41) returned 1
	[0135.379] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.380] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.380] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.380] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.380] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.380] SelectObject (hdc=0x4a010cb5, h=0x58300be0) returned 0x58300be0
	[0135.380] MoveToEx (in: hdc=0x4a010cb5, x=164, y=41, lppt=0x26e27c0 | out: lppt=0x26e27c0) returned 1
	[0135.380] LineTo (hdc=0x4a010cb5, x=164, y=0) returned 1
	[0135.381] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.381] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.381] SelectObject (hdc=0x4a010cb5, h=0x1b00017) returned 0x58300be0
	[0135.381] DeleteObject (ho=0x58300be0) returned 1
	[0135.381] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.381] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.381] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.382] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2f300cbb
	[0135.382] SelectObject (hdc=0x4a010cb5, h=0x2f300cbb) returned 0x1b00017
	[0135.382] MoveToEx (in: hdc=0x4a010cb5, x=163, y=2, lppt=0x26e2828 | out: lppt=0x26e2828) returned 1
	[0135.382] LineTo (hdc=0x4a010cb5, x=2, y=2) returned 1
	[0135.382] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.382] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.383] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.383] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.383] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.383] SelectObject (hdc=0x4a010cb5, h=0x2f300cbb) returned 0x2f300cbb
	[0135.383] MoveToEx (in: hdc=0x4a010cb5, x=2, y=2, lppt=0x26e2840 | out: lppt=0x26e2840) returned 1
	[0135.383] LineTo (hdc=0x4a010cb5, x=2, y=40) returned 1
	[0135.384] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.384] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.384] SelectObject (hdc=0x4a010cb5, h=0x1b00017) returned 0x2f300cbb
	[0135.384] DeleteObject (ho=0x2f300cbb) returned 1
	[0135.384] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.384] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.385] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.385] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x59300be0
	[0135.385] SelectObject (hdc=0x4a010cb5, h=0x59300be0) returned 0x1b00017
	[0135.385] MoveToEx (in: hdc=0x4a010cb5, x=2, y=40, lppt=0x26e28a8 | out: lppt=0x26e28a8) returned 1
	[0135.385] LineTo (hdc=0x4a010cb5, x=163, y=40) returned 1
	[0135.385] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.386] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.386] GetROP2 (hdc=0x4a010cb5) returned 13
	[0135.386] GetBkMode (hdc=0x4a010cb5) returned 2
	[0135.386] SetBkMode (hdc=0x4a010cb5, mode=1) returned 2
	[0135.386] SelectObject (hdc=0x4a010cb5, h=0x59300be0) returned 0x59300be0
	[0135.386] MoveToEx (in: hdc=0x4a010cb5, x=163, y=40, lppt=0x26e28c0 | out: lppt=0x26e28c0) returned 1
	[0135.386] LineTo (hdc=0x4a010cb5, x=163, y=1) returned 1
	[0135.387] SetBkMode (hdc=0x4a010cb5, mode=2) returned 1
	[0135.387] MoveToEx (in: hdc=0x4a010cb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.387] SelectObject (hdc=0x4a010cb5, h=0x1b00017) returned 0x59300be0
	[0135.387] DeleteObject (ho=0x59300be0) returned 1
	[0135.387] RestoreDC (hdc=0x4a010cb5, nSavedDC=-1) returned 1
	[0135.387] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4a010cb5) returned 0x0
	[0135.388] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0135.388] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x4a010cb5, x1=0, y1=0, rop=0xcc0020) returned 1
	[0135.388] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4a010cb5) returned 0x0
	[0135.388] SelectObject (hdc=0x4a010cb5, h=0x185000f) returned 0x140507d2
	[0135.389] DeleteDC (hdc=0x4a010cb5) returned 1
	[0135.389] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0135.389] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0135.389] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0135.389] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26e2918, cPoints=0x1 | out: lpPoints=0x26e2918) returned 30606029
	[0135.389] WindowFromPoint (Point=0x1f000000300) returned 0x201d8
	[0135.389] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.389] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0135.389] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0135.390] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0135.390] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26e2a08, Length=0x70 | out: Destination=0x1afe53a0) 
	[0135.390] ShellExecuteExW (in: pExecInfo=0x26e2c18*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26e2c18*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0135.523] GetKeyState (nVirtKey=16) returned 0
	[0135.523] GetKeyState (nVirtKey=17) returned 0
	[0135.523] GetKeyState (nVirtKey=18) returned -128
	[0135.524] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x104, wParam=0x12, lParam=0x20380001) returned 0x0
	[0135.535] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0135.535] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0135.535] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0135.535] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0135.535] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0135.535] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0135.535] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0135.536] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0135.536] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0135.536] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0135.536] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0135.536] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0135.536] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0135.536] GetStockObject (i=5) returned 0x1900015
	[0135.537] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0135.537] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0135.537] GetCapture () returned 0x0
	[0135.537] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0135.537] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0135.537] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0135.537] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x10107f8
	[0135.537] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0135.537] CreateCompatibleDC (hdc=0x10107f8) returned 0x8010cc9
	[0135.538] SelectObject (hdc=0x8010cc9, h=0x140507d2) returned 0x185000f
	[0135.538] GdipCreateFromHDC (hdc=0x8010cc9, graphics=0x20c9d0) returned 0x0
	[0135.538] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0135.538] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0135.538] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0135.538] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0135.539] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0135.539] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0135.539] LocalFree (hMem=0x1b07c740) returned 0x0
	[0135.539] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0135.539] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0135.539] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.540] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0135.540] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0135.540] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc770dbd) returned 0x0
	[0135.540] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.541] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0135.541] GetCurrentObject (hdc=0x8010cc9, type=0x1) returned 0x1b00017
	[0135.541] GetCurrentObject (hdc=0x8010cc9, type=0x2) returned 0x1900010
	[0135.541] GetCurrentObject (hdc=0x8010cc9, type=0x7) returned 0x140507d2
	[0135.541] GetCurrentObject (hdc=0x8010cc9, type=0x6) returned 0x18a002e
	[0135.541] SaveDC (hdc=0x8010cc9) returned 1
	[0135.542] GetNearestColor (hdc=0x8010cc9, color=0xf0f0f0) returned 0xf0f0f0
	[0135.542] GetNearestColor (hdc=0x8010cc9, color=0xa0a0a0) returned 0xa0a0a0
	[0135.542] GetNearestColor (hdc=0x8010cc9, color=0x696969) returned 0x696969
	[0135.543] GetNearestColor (hdc=0x8010cc9, color=0xa0a0a0) returned 0xa0a0a0
	[0135.543] GetNearestColor (hdc=0x8010cc9, color=0x0) returned 0x0
	[0135.543] GetNearestColor (hdc=0x8010cc9, color=0xffffff) returned 0xffffff
	[0135.543] GetNearestColor (hdc=0x8010cc9, color=0xe5e5e5) returned 0xe5e5e5
	[0135.544] GetNearestColor (hdc=0x8010cc9, color=0xd8d8d8) returned 0xd8d8d8
	[0135.544] GetNearestColor (hdc=0x8010cc9, color=0x0) returned 0x0
	[0135.548] RestoreDC (hdc=0x8010cc9, nSavedDC=-1) returned 1
	[0135.548] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x8010cc9) returned 0x0
	[0135.549] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0135.549] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.549] CoTaskMemFree (pv=0x1b077150) 
	[0135.549] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0135.549] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.549] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.549] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.549] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0135.550] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0135.550] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0135.550] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0135.550] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0135.550] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.550] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0135.551] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.551] CoTaskMemFree (pv=0x1b077150) 
	[0135.551] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0135.551] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0135.551] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0135.551] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0135.551] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.551] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.552] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.552] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0135.552] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.552] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0135.552] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0135.552] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.553] CoTaskMemFree (pv=0x1b077150) 
	[0135.553] GdipCreateRegion (region=0x20c310) returned 0x0
	[0135.553] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.553] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0135.553] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0135.553] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0135.554] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0135.554] LocalFree (hMem=0x1b07c740) returned 0x0
	[0135.554] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0135.554] LocalFree (hMem=0x1b07c740) returned 0x0
	[0135.555] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0135.555] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0135.555] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0135.555] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0135.555] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.555] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0135.555] GetCurrentObject (hdc=0x8010cc9, type=0x1) returned 0x1b00017
	[0135.556] GetCurrentObject (hdc=0x8010cc9, type=0x2) returned 0x1900010
	[0135.556] GetCurrentObject (hdc=0x8010cc9, type=0x7) returned 0x140507d2
	[0135.556] GetCurrentObject (hdc=0x8010cc9, type=0x6) returned 0x18a002e
	[0135.556] SaveDC (hdc=0x8010cc9) returned 1
	[0135.556] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffce040710
	[0135.556] GetClipRgn (hdc=0x8010cc9, hrgn=0xffffffffce040710) returned 0
	[0135.556] SelectClipRgn (hdc=0x8010cc9, hrgn=0x300407f9) returned 2
	[0135.557] DeleteObject (ho=0xffffffffce040710) returned 1
	[0135.557] DeleteObject (ho=0x300407f9) returned 1
	[0135.557] OffsetViewportOrgEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x26e3910 | out: lppt=0x26e3910) returned 1
	[0135.557] GetNearestColor (hdc=0x8010cc9, color=0xf0f0f0) returned 0xf0f0f0
	[0135.557] CreateSolidBrush (color=0xf0f0f0) returned 0x761007c0
	[0135.558] FillRect (hDC=0x8010cc9, lprc=0x20c3c0, hbr=0x761007c0) returned 1
	[0135.558] DeleteObject (ho=0x761007c0) returned 1
	[0135.558] RestoreDC (hdc=0x8010cc9, nSavedDC=-1) returned 1
	[0135.558] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x8010cc9) returned 0x0
	[0135.558] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0135.558] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.559] CoTaskMemFree (pv=0x1b077150) 
	[0135.559] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0135.559] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.559] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0135.559] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0135.559] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0135.559] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0135.560] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0135.560] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0135.560] GetFocus () returned 0x0
	[0135.560] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0135.560] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0135.560] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0135.560] CoTaskMemFree (pv=0x1b077150) 
	[0135.561] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0135.561] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0135.561] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0135.561] GdipCreateRegion (region=0x20c260) returned 0x0
	[0135.561] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0135.561] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0135.562] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0135.562] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0135.562] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0135.562] LocalFree (hMem=0x1b07c740) returned 0x0
	[0135.562] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0135.562] LocalFree (hMem=0x1b07c740) returned 0x0
	[0135.562] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0135.563] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0135.563] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0135.563] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0135.563] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0135.563] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0135.563] GetCurrentObject (hdc=0x8010cc9, type=0x1) returned 0x1b00017
	[0135.564] GetCurrentObject (hdc=0x8010cc9, type=0x2) returned 0x1900010
	[0135.564] GetCurrentObject (hdc=0x8010cc9, type=0x7) returned 0x140507d2
	[0135.564] GetCurrentObject (hdc=0x8010cc9, type=0x6) returned 0x18a002e
	[0135.564] SaveDC (hdc=0x8010cc9) returned 1
	[0135.564] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x310407f9
	[0135.564] GetClipRgn (hdc=0x8010cc9, hrgn=0x310407f9) returned 0
	[0135.564] SelectClipRgn (hdc=0x8010cc9, hrgn=0xffffffffcf040710) returned 2
	[0135.565] DeleteObject (ho=0x310407f9) returned 1
	[0135.565] DeleteObject (ho=0xffffffffcf040710) returned 1
	[0135.565] OffsetViewportOrgEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x26e3eb0 | out: lppt=0x26e3eb0) returned 1
	[0135.565] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.565] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.565] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.566] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xa300cc3
	[0135.566] SelectObject (hdc=0x8010cc9, h=0xa300cc3) returned 0x1b00017
	[0135.566] MoveToEx (in: hdc=0x8010cc9, x=164, y=1, lppt=0x26e3f18 | out: lppt=0x26e3f18) returned 1
	[0135.566] LineTo (hdc=0x8010cc9, x=1, y=1) returned 1
	[0135.566] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.566] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.566] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.567] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.567] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.567] SelectObject (hdc=0x8010cc9, h=0xa300cc3) returned 0xa300cc3
	[0135.567] MoveToEx (in: hdc=0x8010cc9, x=1, y=1, lppt=0x26e3f30 | out: lppt=0x26e3f30) returned 1
	[0135.567] LineTo (hdc=0x8010cc9, x=1, y=41) returned 1
	[0135.567] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.567] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.568] SelectObject (hdc=0x8010cc9, h=0x1b00017) returned 0xa300cc3
	[0135.568] DeleteObject (ho=0xa300cc3) returned 1
	[0135.568] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.568] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.568] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.568] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x2300ccb
	[0135.569] SelectObject (hdc=0x8010cc9, h=0x2300ccb) returned 0x1b00017
	[0135.569] MoveToEx (in: hdc=0x8010cc9, x=1, y=41, lppt=0x26e3f98 | out: lppt=0x26e3f98) returned 1
	[0135.569] LineTo (hdc=0x8010cc9, x=164, y=41) returned 1
	[0135.569] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.569] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.569] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.569] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.570] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.570] SelectObject (hdc=0x8010cc9, h=0x2300ccb) returned 0x2300ccb
	[0135.570] MoveToEx (in: hdc=0x8010cc9, x=164, y=41, lppt=0x26e3fb0 | out: lppt=0x26e3fb0) returned 1
	[0135.570] LineTo (hdc=0x8010cc9, x=164, y=0) returned 1
	[0135.570] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.570] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.570] SelectObject (hdc=0x8010cc9, h=0x1b00017) returned 0x2300ccb
	[0135.571] DeleteObject (ho=0x2300ccb) returned 1
	[0135.571] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.571] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.571] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.571] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xb300cc3
	[0135.571] SelectObject (hdc=0x8010cc9, h=0xb300cc3) returned 0x1b00017
	[0135.572] MoveToEx (in: hdc=0x8010cc9, x=163, y=2, lppt=0x26e4018 | out: lppt=0x26e4018) returned 1
	[0135.572] LineTo (hdc=0x8010cc9, x=2, y=2) returned 1
	[0135.572] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.572] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.572] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.572] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.572] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.573] SelectObject (hdc=0x8010cc9, h=0xb300cc3) returned 0xb300cc3
	[0135.573] MoveToEx (in: hdc=0x8010cc9, x=2, y=2, lppt=0x26e4030 | out: lppt=0x26e4030) returned 1
	[0135.573] LineTo (hdc=0x8010cc9, x=2, y=40) returned 1
	[0135.573] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.573] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.573] SelectObject (hdc=0x8010cc9, h=0x1b00017) returned 0xb300cc3
	[0135.574] DeleteObject (ho=0xb300cc3) returned 1
	[0135.574] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.574] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.574] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.574] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x3300ccb
	[0135.574] SelectObject (hdc=0x8010cc9, h=0x3300ccb) returned 0x1b00017
	[0135.575] MoveToEx (in: hdc=0x8010cc9, x=2, y=40, lppt=0x26e4098 | out: lppt=0x26e4098) returned 1
	[0135.575] LineTo (hdc=0x8010cc9, x=163, y=40) returned 1
	[0135.575] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.575] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.575] GetROP2 (hdc=0x8010cc9) returned 13
	[0135.575] GetBkMode (hdc=0x8010cc9) returned 2
	[0135.576] SetBkMode (hdc=0x8010cc9, mode=1) returned 2
	[0135.576] SelectObject (hdc=0x8010cc9, h=0x3300ccb) returned 0x3300ccb
	[0135.576] MoveToEx (in: hdc=0x8010cc9, x=163, y=40, lppt=0x26e40b0 | out: lppt=0x26e40b0) returned 1
	[0135.576] LineTo (hdc=0x8010cc9, x=163, y=1) returned 1
	[0135.576] SetBkMode (hdc=0x8010cc9, mode=2) returned 1
	[0135.576] MoveToEx (in: hdc=0x8010cc9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0135.576] SelectObject (hdc=0x8010cc9, h=0x1b00017) returned 0x3300ccb
	[0135.577] DeleteObject (ho=0x3300ccb) returned 1
	[0135.577] RestoreDC (hdc=0x8010cc9, nSavedDC=-1) returned 1
	[0135.577] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x8010cc9) returned 0x0
	[0135.577] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0135.577] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x8010cc9, x1=0, y1=0, rop=0xcc0020) returned 1
	[0135.577] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x8010cc9) returned 0x0
	[0135.577] SelectObject (hdc=0x8010cc9, h=0x185000f) returned 0x140507d2
	[0135.578] DeleteDC (hdc=0x8010cc9) returned 1
	[0135.578] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0135.578] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0135.578] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0135.578] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.578] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0135.578] GetKeyState (nVirtKey=1) returned 0
	[0135.578] GetKeyState (nVirtKey=2) returned 0
	[0135.578] GetKeyState (nVirtKey=4) returned 0
	[0135.578] GetKeyState (nVirtKey=5) returned 0
	[0135.578] GetKeyState (nVirtKey=6) returned 0
	[0135.615] GetCapture () returned 0x0
	[0135.615] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.615] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.615] WaitMessage () returned 1
	[0135.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.638] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0135.638] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0135.638] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0135.638] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.638] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.638] GetKeyState (nVirtKey=1) returned 0
	[0135.638] GetKeyState (nVirtKey=2) returned 0
	[0135.638] GetKeyState (nVirtKey=4) returned 0
	[0135.638] GetKeyState (nVirtKey=5) returned 0
	[0135.638] GetKeyState (nVirtKey=6) returned 0
	[0135.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.638] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0135.638] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.638] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.638] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.638] WaitMessage () returned 1
	[0135.841] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.841] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0135.841] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0135.841] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0135.841] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0135.841] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.841] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0135.841] WaitMessage () returned 1
	[0136.605] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0136.605] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0136.606] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0136.606] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0136.606] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0136.606] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0136.606] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0136.606] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0136.606] GetKeyState (nVirtKey=1) returned 0
	[0136.606] GetKeyState (nVirtKey=2) returned 0
	[0136.606] GetKeyState (nVirtKey=4) returned 0
	[0136.606] GetKeyState (nVirtKey=5) returned 0
	[0136.606] GetKeyState (nVirtKey=6) returned 0
	[0136.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0136.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0136.606] WaitMessage () returned 1
	[0136.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0136.606] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0136.607] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0136.607] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0136.607] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00300) returned 0x1
	[0136.607] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0136.607] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0136.607] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0136.607] GetKeyState (nVirtKey=1) returned 0
	[0136.607] GetKeyState (nVirtKey=2) returned 0
	[0136.607] GetKeyState (nVirtKey=4) returned 0
	[0136.607] GetKeyState (nVirtKey=5) returned 0
	[0136.607] GetKeyState (nVirtKey=6) returned 0
	[0136.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0136.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0136.607] WaitMessage () returned 1
	[0137.548] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0137.548] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0137.548] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0137.548] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0137.548] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0137.548] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0137.548] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0137.548] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0137.548] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0137.548] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0137.548] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0137.548] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0137.548] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0137.548] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0137.548] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0137.548] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0137.549] CreateCompatibleDC (hdc=0x10107f8) returned 0x1c010ce2
	[0137.549] SelectObject (hdc=0x1c010ce2, h=0x140507d2) returned 0x185000f
	[0137.549] GdipCreateFromHDC (hdc=0x1c010ce2, graphics=0x20d7e0) returned 0x0
	[0137.549] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0137.549] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0137.549] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0137.549] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0137.550] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0137.550] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0137.550] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0137.550] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0137.550] GdipCreateRegion (region=0x20d910) returned 0x0
	[0137.550] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0137.550] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0137.551] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0137.551] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc740dbd) returned 0x0
	[0137.551] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0137.551] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0137.552] GetCurrentObject (hdc=0x1c010ce2, type=0x1) returned 0x1b00017
	[0137.552] GetCurrentObject (hdc=0x1c010ce2, type=0x2) returned 0x1900010
	[0137.552] GetCurrentObject (hdc=0x1c010ce2, type=0x7) returned 0x140507d2
	[0137.552] GetCurrentObject (hdc=0x1c010ce2, type=0x6) returned 0x18a002e
	[0137.552] SaveDC (hdc=0x1c010ce2) returned 1
	[0137.552] GetNearestColor (hdc=0x1c010ce2, color=0xf0f0f0) returned 0xf0f0f0
	[0137.552] GetNearestColor (hdc=0x1c010ce2, color=0xa0a0a0) returned 0xa0a0a0
	[0137.553] GetNearestColor (hdc=0x1c010ce2, color=0x696969) returned 0x696969
	[0137.553] GetNearestColor (hdc=0x1c010ce2, color=0xa0a0a0) returned 0xa0a0a0
	[0137.553] GetNearestColor (hdc=0x1c010ce2, color=0x0) returned 0x0
	[0137.553] GetNearestColor (hdc=0x1c010ce2, color=0xffffff) returned 0xffffff
	[0137.553] GetNearestColor (hdc=0x1c010ce2, color=0xe5e5e5) returned 0xe5e5e5
	[0137.554] GetNearestColor (hdc=0x1c010ce2, color=0xd8d8d8) returned 0xd8d8d8
	[0137.554] GetNearestColor (hdc=0x1c010ce2, color=0x0) returned 0x0
	[0137.554] RestoreDC (hdc=0x1c010ce2, nSavedDC=-1) returned 1
	[0137.554] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c010ce2) returned 0x0
	[0137.554] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0137.555] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0137.555] CoTaskMemFree (pv=0x1b067a40) 
	[0137.555] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0137.555] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0137.555] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0137.555] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0137.555] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0137.555] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0137.556] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0137.556] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0137.556] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0137.556] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0137.556] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0137.556] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0137.556] CoTaskMemFree (pv=0x1b067a40) 
	[0137.556] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0137.557] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0137.557] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0137.557] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0137.557] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0137.557] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0137.557] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0137.557] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0137.558] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0137.558] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0137.558] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0137.558] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0137.558] CoTaskMemFree (pv=0x1b067a40) 
	[0137.558] GdipCreateRegion (region=0x20d120) returned 0x0
	[0137.558] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0137.559] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0137.559] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0137.559] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0137.559] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0137.559] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0137.559] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0137.559] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0137.560] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0137.560] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0137.560] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0137.560] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0137.560] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0137.560] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0137.560] GetCurrentObject (hdc=0x1c010ce2, type=0x1) returned 0x1b00017
	[0137.561] GetCurrentObject (hdc=0x1c010ce2, type=0x2) returned 0x1900010
	[0137.561] GetCurrentObject (hdc=0x1c010ce2, type=0x7) returned 0x140507d2
	[0137.561] GetCurrentObject (hdc=0x1c010ce2, type=0x6) returned 0x18a002e
	[0137.561] SaveDC (hdc=0x1c010ce2) returned 1
	[0137.561] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd0040710
	[0137.561] GetClipRgn (hdc=0x1c010ce2, hrgn=0xffffffffd0040710) returned 0
	[0137.561] SelectClipRgn (hdc=0x1c010ce2, hrgn=0x320407f9) returned 2
	[0137.562] DeleteObject (ho=0xffffffffd0040710) returned 1
	[0137.562] DeleteObject (ho=0x320407f9) returned 1
	[0137.562] OffsetViewportOrgEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x26e4f38 | out: lppt=0x26e4f38) returned 1
	[0137.562] GetNearestColor (hdc=0x1c010ce2, color=0xf0f0f0) returned 0xf0f0f0
	[0137.562] CreateSolidBrush (color=0xf0f0f0) returned 0x771007c0
	[0137.562] FillRect (hDC=0x1c010ce2, lprc=0x20d1d0, hbr=0x771007c0) returned 1
	[0137.563] DeleteObject (ho=0x771007c0) returned 1
	[0137.563] RestoreDC (hdc=0x1c010ce2, nSavedDC=-1) returned 1
	[0137.563] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c010ce2) returned 0x0
	[0137.563] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0137.563] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0137.563] CoTaskMemFree (pv=0x1b067a40) 
	[0137.563] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0137.564] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0137.564] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0137.564] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0137.564] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0137.564] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0137.564] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0137.564] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0137.565] GetFocus () returned 0x0
	[0137.565] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0137.565] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0137.565] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0137.565] CoTaskMemFree (pv=0x1b067a40) 
	[0137.565] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0137.565] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0137.565] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0137.566] GdipCreateRegion (region=0x20d070) returned 0x0
	[0137.566] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0137.566] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0137.566] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0137.566] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0137.566] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0137.567] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0137.567] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0137.567] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0137.567] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0137.567] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0137.567] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0137.567] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0137.568] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0137.568] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0137.568] GetCurrentObject (hdc=0x1c010ce2, type=0x1) returned 0x1b00017
	[0137.568] GetCurrentObject (hdc=0x1c010ce2, type=0x2) returned 0x1900010
	[0137.568] GetCurrentObject (hdc=0x1c010ce2, type=0x7) returned 0x140507d2
	[0137.568] GetCurrentObject (hdc=0x1c010ce2, type=0x6) returned 0x18a002e
	[0137.568] SaveDC (hdc=0x1c010ce2) returned 1
	[0137.569] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x330407f9
	[0137.569] GetClipRgn (hdc=0x1c010ce2, hrgn=0x330407f9) returned 0
	[0137.569] SelectClipRgn (hdc=0x1c010ce2, hrgn=0xffffffffd1040710) returned 2
	[0137.569] DeleteObject (ho=0x330407f9) returned 1
	[0137.569] DeleteObject (ho=0xffffffffd1040710) returned 1
	[0137.569] OffsetViewportOrgEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x26e54d8 | out: lppt=0x26e54d8) returned 1
	[0137.569] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.570] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.570] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.570] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3d300ccd
	[0137.570] SelectObject (hdc=0x1c010ce2, h=0x3d300ccd) returned 0x1b00017
	[0137.570] MoveToEx (in: hdc=0x1c010ce2, x=164, y=1, lppt=0x26e5540 | out: lppt=0x26e5540) returned 1
	[0137.570] LineTo (hdc=0x1c010ce2, x=1, y=1) returned 1
	[0137.570] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.570] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.571] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.571] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.571] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.571] SelectObject (hdc=0x1c010ce2, h=0x3d300ccd) returned 0x3d300ccd
	[0137.571] MoveToEx (in: hdc=0x1c010ce2, x=1, y=1, lppt=0x26e5558 | out: lppt=0x26e5558) returned 1
	[0137.571] LineTo (hdc=0x1c010ce2, x=1, y=41) returned 1
	[0137.571] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.572] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.572] SelectObject (hdc=0x1c010ce2, h=0x1b00017) returned 0x3d300ccd
	[0137.572] DeleteObject (ho=0x3d300ccd) returned 1
	[0137.572] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.573] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.573] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.573] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x3300cea
	[0137.573] SelectObject (hdc=0x1c010ce2, h=0x3300cea) returned 0x1b00017
	[0137.573] MoveToEx (in: hdc=0x1c010ce2, x=1, y=41, lppt=0x26e55c0 | out: lppt=0x26e55c0) returned 1
	[0137.574] LineTo (hdc=0x1c010ce2, x=164, y=41) returned 1
	[0137.574] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.574] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.574] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.574] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.574] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.574] SelectObject (hdc=0x1c010ce2, h=0x3300cea) returned 0x3300cea
	[0137.575] MoveToEx (in: hdc=0x1c010ce2, x=164, y=41, lppt=0x26e55d8 | out: lppt=0x26e55d8) returned 1
	[0137.575] LineTo (hdc=0x1c010ce2, x=164, y=0) returned 1
	[0137.575] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.575] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.575] SelectObject (hdc=0x1c010ce2, h=0x1b00017) returned 0x3300cea
	[0137.575] DeleteObject (ho=0x3300cea) returned 1
	[0137.575] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.575] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.576] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.576] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x3e300ccd
	[0137.576] SelectObject (hdc=0x1c010ce2, h=0x3e300ccd) returned 0x1b00017
	[0137.576] MoveToEx (in: hdc=0x1c010ce2, x=163, y=2, lppt=0x26e5640 | out: lppt=0x26e5640) returned 1
	[0137.576] LineTo (hdc=0x1c010ce2, x=2, y=2) returned 1
	[0137.576] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.576] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.577] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.577] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.577] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.577] SelectObject (hdc=0x1c010ce2, h=0x3e300ccd) returned 0x3e300ccd
	[0137.577] MoveToEx (in: hdc=0x1c010ce2, x=2, y=2, lppt=0x26e5658 | out: lppt=0x26e5658) returned 1
	[0137.577] LineTo (hdc=0x1c010ce2, x=2, y=40) returned 1
	[0137.577] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.577] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.578] SelectObject (hdc=0x1c010ce2, h=0x1b00017) returned 0x3e300ccd
	[0137.578] DeleteObject (ho=0x3e300ccd) returned 1
	[0137.578] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.578] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.578] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.578] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x4300cea
	[0137.578] SelectObject (hdc=0x1c010ce2, h=0x4300cea) returned 0x1b00017
	[0137.579] MoveToEx (in: hdc=0x1c010ce2, x=2, y=40, lppt=0x26e56c0 | out: lppt=0x26e56c0) returned 1
	[0137.579] LineTo (hdc=0x1c010ce2, x=163, y=40) returned 1
	[0137.579] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.579] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.579] GetROP2 (hdc=0x1c010ce2) returned 13
	[0137.579] GetBkMode (hdc=0x1c010ce2) returned 2
	[0137.579] SetBkMode (hdc=0x1c010ce2, mode=1) returned 2
	[0137.580] SelectObject (hdc=0x1c010ce2, h=0x4300cea) returned 0x4300cea
	[0137.580] MoveToEx (in: hdc=0x1c010ce2, x=163, y=40, lppt=0x26e56d8 | out: lppt=0x26e56d8) returned 1
	[0137.580] LineTo (hdc=0x1c010ce2, x=163, y=1) returned 1
	[0137.580] SetBkMode (hdc=0x1c010ce2, mode=2) returned 1
	[0137.580] MoveToEx (in: hdc=0x1c010ce2, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0137.580] SelectObject (hdc=0x1c010ce2, h=0x1b00017) returned 0x4300cea
	[0137.580] DeleteObject (ho=0x4300cea) returned 1
	[0137.580] RestoreDC (hdc=0x1c010ce2, nSavedDC=-1) returned 1
	[0137.581] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c010ce2) returned 0x0
	[0137.581] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0137.581] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x1c010ce2, x1=0, y1=0, rop=0xcc0020) returned 1
	[0137.581] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c010ce2) returned 0x0
	[0137.581] SelectObject (hdc=0x1c010ce2, h=0x185000f) returned 0x140507d2
	[0137.581] DeleteDC (hdc=0x1c010ce2) returned 1
	[0137.581] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0137.582] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0137.582] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0137.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0137.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0137.582] WaitMessage () returned 1
	[0138.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.472] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e60318) returned 0x1
	[0138.472] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0138.472] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.472] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e60318) returned 0x1
	[0138.472] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0138.472] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.472] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0138.472] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0138.472] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0138.472] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0138.472] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0138.472] GetKeyState (nVirtKey=1) returned 0
	[0138.472] GetKeyState (nVirtKey=2) returned 0
	[0138.472] GetKeyState (nVirtKey=4) returned 0
	[0138.472] GetKeyState (nVirtKey=5) returned 0
	[0138.472] GetKeyState (nVirtKey=6) returned 0
	[0138.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.472] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0138.472] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.472] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.472] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0138.473] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0138.473] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0138.473] CreateCompatibleDC (hdc=0x70107fc) returned 0x20010ce9
	[0138.473] SelectObject (hdc=0x20010ce9, h=0x140507d2) returned 0x185000f
	[0138.473] GdipCreateFromHDC (hdc=0x20010ce9, graphics=0x20d7e0) returned 0x0
	[0138.474] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0138.474] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0138.474] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0138.475] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0138.475] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0138.475] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.475] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.475] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0138.475] GdipCreateRegion (region=0x20d910) returned 0x0
	[0138.475] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0138.476] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0138.476] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0138.476] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc710dbd) returned 0x0
	[0138.476] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0138.477] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0138.477] GetCurrentObject (hdc=0x20010ce9, type=0x1) returned 0x1b00017
	[0138.477] GetCurrentObject (hdc=0x20010ce9, type=0x2) returned 0x1900010
	[0138.478] GetCurrentObject (hdc=0x20010ce9, type=0x7) returned 0x140507d2
	[0138.478] GetCurrentObject (hdc=0x20010ce9, type=0x6) returned 0x18a002e
	[0138.478] SaveDC (hdc=0x20010ce9) returned 1
	[0138.478] GetNearestColor (hdc=0x20010ce9, color=0xf0f0f0) returned 0xf0f0f0
	[0138.478] GetNearestColor (hdc=0x20010ce9, color=0xa0a0a0) returned 0xa0a0a0
	[0138.479] GetNearestColor (hdc=0x20010ce9, color=0x696969) returned 0x696969
	[0138.479] GetNearestColor (hdc=0x20010ce9, color=0xa0a0a0) returned 0xa0a0a0
	[0138.479] GetNearestColor (hdc=0x20010ce9, color=0x0) returned 0x0
	[0138.479] GetNearestColor (hdc=0x20010ce9, color=0xffffff) returned 0xffffff
	[0138.479] GetNearestColor (hdc=0x20010ce9, color=0xe5e5e5) returned 0xe5e5e5
	[0138.479] GetNearestColor (hdc=0x20010ce9, color=0xd8d8d8) returned 0xd8d8d8
	[0138.480] GetNearestColor (hdc=0x20010ce9, color=0x0) returned 0x0
	[0138.480] RestoreDC (hdc=0x20010ce9, nSavedDC=-1) returned 1
	[0138.480] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20010ce9) returned 0x0
	[0138.480] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0138.481] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.481] CoTaskMemFree (pv=0x1b067a40) 
	[0138.481] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0138.481] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.481] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.481] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0138.481] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0138.481] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0138.482] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0138.482] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0138.482] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0138.482] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0138.482] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0138.482] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.482] CoTaskMemFree (pv=0x1b067a40) 
	[0138.482] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0138.483] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0138.483] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0138.483] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0138.483] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0138.483] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.483] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.484] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0138.484] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0138.484] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0138.484] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0138.484] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.484] CoTaskMemFree (pv=0x1b067a40) 
	[0138.484] GdipCreateRegion (region=0x20d120) returned 0x0
	[0138.485] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0138.485] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0138.485] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0138.485] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0138.485] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.485] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.485] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.486] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.486] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0138.486] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0138.486] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0138.486] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0138.486] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0138.486] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0138.487] GetCurrentObject (hdc=0x20010ce9, type=0x1) returned 0x1b00017
	[0138.487] GetCurrentObject (hdc=0x20010ce9, type=0x2) returned 0x1900010
	[0138.487] GetCurrentObject (hdc=0x20010ce9, type=0x7) returned 0x140507d2
	[0138.487] GetCurrentObject (hdc=0x20010ce9, type=0x6) returned 0x18a002e
	[0138.487] SaveDC (hdc=0x20010ce9) returned 1
	[0138.487] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd2040710
	[0138.487] GetClipRgn (hdc=0x20010ce9, hrgn=0xffffffffd2040710) returned 0
	[0138.488] SelectClipRgn (hdc=0x20010ce9, hrgn=0x340407f9) returned 2
	[0138.488] DeleteObject (ho=0xffffffffd2040710) returned 1
	[0138.488] DeleteObject (ho=0x340407f9) returned 1
	[0138.488] OffsetViewportOrgEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x26e63d0 | out: lppt=0x26e63d0) returned 1
	[0138.488] GetNearestColor (hdc=0x20010ce9, color=0xf0f0f0) returned 0xf0f0f0
	[0138.488] CreateSolidBrush (color=0xf0f0f0) returned 0x781007c0
	[0138.489] FillRect (hDC=0x20010ce9, lprc=0x20d1d0, hbr=0x781007c0) returned 1
	[0138.489] DeleteObject (ho=0x781007c0) returned 1
	[0138.489] RestoreDC (hdc=0x20010ce9, nSavedDC=-1) returned 1
	[0138.489] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20010ce9) returned 0x0
	[0138.489] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0138.489] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.489] CoTaskMemFree (pv=0x1b067a40) 
	[0138.490] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0138.490] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.490] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.490] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0138.490] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0138.490] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0138.490] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0138.491] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0138.491] GetFocus () returned 0x0
	[0138.491] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0138.491] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0138.491] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.491] CoTaskMemFree (pv=0x1b067a40) 
	[0138.491] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0138.491] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0138.491] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0138.492] GdipCreateRegion (region=0x20d070) returned 0x0
	[0138.492] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0138.492] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0138.492] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0138.492] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0138.492] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.493] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.493] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.493] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.494] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0138.494] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0138.494] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0138.494] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0138.494] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0138.494] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0138.494] GetCurrentObject (hdc=0x20010ce9, type=0x1) returned 0x1b00017
	[0138.494] GetCurrentObject (hdc=0x20010ce9, type=0x2) returned 0x1900010
	[0138.495] GetCurrentObject (hdc=0x20010ce9, type=0x7) returned 0x140507d2
	[0138.495] GetCurrentObject (hdc=0x20010ce9, type=0x6) returned 0x18a002e
	[0138.495] SaveDC (hdc=0x20010ce9) returned 1
	[0138.495] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x350407f9
	[0138.495] GetClipRgn (hdc=0x20010ce9, hrgn=0x350407f9) returned 0
	[0138.495] SelectClipRgn (hdc=0x20010ce9, hrgn=0xffffffffd3040710) returned 2
	[0138.495] DeleteObject (ho=0x350407f9) returned 1
	[0138.496] DeleteObject (ho=0xffffffffd3040710) returned 1
	[0138.496] OffsetViewportOrgEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x26e6970 | out: lppt=0x26e6970) returned 1
	[0138.496] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.496] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.496] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.496] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1300d13
	[0138.496] SelectObject (hdc=0x20010ce9, h=0x1300d13) returned 0x1b00017
	[0138.497] MoveToEx (in: hdc=0x20010ce9, x=164, y=1, lppt=0x26e69d8 | out: lppt=0x26e69d8) returned 1
	[0138.497] LineTo (hdc=0x20010ce9, x=1, y=1) returned 1
	[0138.497] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.497] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.497] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.497] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.497] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.498] SelectObject (hdc=0x20010ce9, h=0x1300d13) returned 0x1300d13
	[0138.498] MoveToEx (in: hdc=0x20010ce9, x=1, y=1, lppt=0x26e69f0 | out: lppt=0x26e69f0) returned 1
	[0138.498] LineTo (hdc=0x20010ce9, x=1, y=41) returned 1
	[0138.498] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.498] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.498] SelectObject (hdc=0x20010ce9, h=0x1b00017) returned 0x1300d13
	[0138.499] DeleteObject (ho=0x1300d13) returned 1
	[0138.499] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.499] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.499] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.499] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1300d14
	[0138.499] SelectObject (hdc=0x20010ce9, h=0x1300d14) returned 0x1b00017
	[0138.499] MoveToEx (in: hdc=0x20010ce9, x=1, y=41, lppt=0x26e6a58 | out: lppt=0x26e6a58) returned 1
	[0138.500] LineTo (hdc=0x20010ce9, x=164, y=41) returned 1
	[0138.500] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.500] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.500] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.500] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.500] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.500] SelectObject (hdc=0x20010ce9, h=0x1300d14) returned 0x1300d14
	[0138.501] MoveToEx (in: hdc=0x20010ce9, x=164, y=41, lppt=0x26e6a70 | out: lppt=0x26e6a70) returned 1
	[0138.501] LineTo (hdc=0x20010ce9, x=164, y=0) returned 1
	[0138.501] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.501] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.501] SelectObject (hdc=0x20010ce9, h=0x1b00017) returned 0x1300d14
	[0138.501] DeleteObject (ho=0x1300d14) returned 1
	[0138.501] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.501] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.502] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.502] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2300d13
	[0138.502] SelectObject (hdc=0x20010ce9, h=0x2300d13) returned 0x1b00017
	[0138.502] MoveToEx (in: hdc=0x20010ce9, x=163, y=2, lppt=0x26e6ad8 | out: lppt=0x26e6ad8) returned 1
	[0138.502] LineTo (hdc=0x20010ce9, x=2, y=2) returned 1
	[0138.502] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.502] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.503] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.503] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.503] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.503] SelectObject (hdc=0x20010ce9, h=0x2300d13) returned 0x2300d13
	[0138.503] MoveToEx (in: hdc=0x20010ce9, x=2, y=2, lppt=0x26e6af0 | out: lppt=0x26e6af0) returned 1
	[0138.503] LineTo (hdc=0x20010ce9, x=2, y=40) returned 1
	[0138.503] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.504] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.504] SelectObject (hdc=0x20010ce9, h=0x1b00017) returned 0x2300d13
	[0138.504] DeleteObject (ho=0x2300d13) returned 1
	[0138.504] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.504] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.504] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.504] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2300d14
	[0138.505] SelectObject (hdc=0x20010ce9, h=0x2300d14) returned 0x1b00017
	[0138.505] MoveToEx (in: hdc=0x20010ce9, x=2, y=40, lppt=0x26e6b58 | out: lppt=0x26e6b58) returned 1
	[0138.505] LineTo (hdc=0x20010ce9, x=163, y=40) returned 1
	[0138.505] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.505] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.505] GetROP2 (hdc=0x20010ce9) returned 13
	[0138.505] GetBkMode (hdc=0x20010ce9) returned 2
	[0138.506] SetBkMode (hdc=0x20010ce9, mode=1) returned 2
	[0138.506] SelectObject (hdc=0x20010ce9, h=0x2300d14) returned 0x2300d14
	[0138.506] MoveToEx (in: hdc=0x20010ce9, x=163, y=40, lppt=0x26e6b70 | out: lppt=0x26e6b70) returned 1
	[0138.506] LineTo (hdc=0x20010ce9, x=163, y=1) returned 1
	[0138.506] SetBkMode (hdc=0x20010ce9, mode=2) returned 1
	[0138.506] MoveToEx (in: hdc=0x20010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.506] SelectObject (hdc=0x20010ce9, h=0x1b00017) returned 0x2300d14
	[0138.507] DeleteObject (ho=0x2300d14) returned 1
	[0138.507] RestoreDC (hdc=0x20010ce9, nSavedDC=-1) returned 1
	[0138.507] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20010ce9) returned 0x0
	[0138.507] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0138.507] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x20010ce9, x1=0, y1=0, rop=0xcc0020) returned 1
	[0138.507] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20010ce9) returned 0x0
	[0138.508] SelectObject (hdc=0x20010ce9, h=0x185000f) returned 0x140507d2
	[0138.508] DeleteDC (hdc=0x20010ce9) returned 1
	[0138.508] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0138.508] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0138.509] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0138.509] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0138.509] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0138.509] WaitMessage () returned 1
	[0138.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.622] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0138.622] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.622] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.622] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0138.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.622] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0138.622] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.622] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.622] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0138.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x13004b) returned 0x0
	[0138.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0138.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0138.622] WaitMessage () returned 1
	[0138.676] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.676] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e60318) returned 0x1
	[0138.676] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0138.676] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.676] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e60318) returned 0x1
	[0138.676] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0138.676] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xdf0127) returned 0x0
	[0138.676] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0138.676] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0138.677] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0138.677] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0138.678] GetFocus () returned 0x0
	[0138.678] SetFocus (hWnd=0x201d8) returned 0x0
	[0138.678] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0138.678] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0138.678] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0138.679] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0138.679] GetStockObject (i=5) returned 0x1900015
	[0138.679] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0138.679] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0138.679] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0138.679] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0138.679] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.679] DispatchMessageW (lpMsg=0x20e6b0) returned 0x201d8
	[0138.679] GetKeyState (nVirtKey=1) returned -127
	[0138.679] GetKeyState (nVirtKey=2) returned 0
	[0138.679] GetKeyState (nVirtKey=4) returned 0
	[0138.680] GetKeyState (nVirtKey=5) returned 0
	[0138.680] GetKeyState (nVirtKey=6) returned 0
	[0138.680] IsWindowVisible (hWnd=0x201d8) returned 1
	[0138.680] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0138.680] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0138.683] GetFocus () returned 0x201d8
	[0138.683] GetFocus () returned 0x201d8
	[0138.683] GetFocus () returned 0x201d8
	[0138.683] GetKeyState (nVirtKey=1) returned -127
	[0138.683] GetKeyState (nVirtKey=2) returned 0
	[0138.683] GetKeyState (nVirtKey=4) returned 0
	[0138.683] GetKeyState (nVirtKey=5) returned 0
	[0138.683] GetKeyState (nVirtKey=6) returned 0
	[0138.683] GetCapture () returned 0x0
	[0138.683] SetCapture (hWnd=0x201d8) returned 0x0
	[0138.683] GetKeyState (nVirtKey=1) returned -127
	[0138.683] GetKeyState (nVirtKey=2) returned 0
	[0138.684] GetKeyState (nVirtKey=4) returned 0
	[0138.684] GetKeyState (nVirtKey=5) returned 0
	[0138.684] GetKeyState (nVirtKey=6) returned 0
	[0138.684] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0138.684] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0138.684] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.684] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.684] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.684] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0138.684] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.684] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.684] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.684] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0138.684] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.684] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0138.684] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0138.684] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0138.684] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0138.684] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26e6ce8, cPoints=0x1 | out: lpPoints=0x26e6ce8) returned 30606029
	[0138.684] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0138.684] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0138.684] UpdateWindow (hWnd=0x201d8) returned 1
	[0138.684] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0138.684] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0138.684] CreateCompatibleDC (hdc=0x4010280) returned 0x25010ce9
	[0138.684] SelectObject (hdc=0x25010ce9, h=0x140507d2) returned 0x185000f
	[0138.684] GdipCreateFromHDC (hdc=0x25010ce9, graphics=0x20cfa0) returned 0x0
	[0138.684] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0138.684] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0138.685] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0138.685] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0138.685] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0138.685] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0138.685] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.685] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.685] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.685] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0138.685] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0138.685] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0138.685] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0138.685] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0138.685] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc6e0dbd) returned 0x0
	[0138.685] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.685] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0138.685] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0138.685] GetCurrentObject (hdc=0x25010ce9, type=0x1) returned 0x1b00017
	[0138.686] GetCurrentObject (hdc=0x25010ce9, type=0x2) returned 0x1900010
	[0138.686] GetCurrentObject (hdc=0x25010ce9, type=0x7) returned 0x140507d2
	[0138.686] GetCurrentObject (hdc=0x25010ce9, type=0x6) returned 0x18a002e
	[0138.686] SaveDC (hdc=0x25010ce9) returned 1
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0xf0f0f0) returned 0xf0f0f0
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0xa0a0a0) returned 0xa0a0a0
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0x696969) returned 0x696969
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0xa0a0a0) returned 0xa0a0a0
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0x0) returned 0x0
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0xffffff) returned 0xffffff
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0xe5e5e5) returned 0xe5e5e5
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0xd8d8d8) returned 0xd8d8d8
	[0138.686] GetNearestColor (hdc=0x25010ce9, color=0x0) returned 0x0
	[0138.687] RestoreDC (hdc=0x25010ce9, nSavedDC=-1) returned 1
	[0138.687] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.687] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010ce9) returned 0x0
	[0138.687] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0138.687] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0138.687] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.687] CoTaskMemFree (pv=0x1b067a80) 
	[0138.687] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0138.687] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.687] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.687] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0138.687] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0138.687] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0138.687] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0138.687] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0138.687] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0138.687] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.688] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0138.688] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0138.688] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0138.688] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.688] CoTaskMemFree (pv=0x1b067a80) 
	[0138.688] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0138.688] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0138.688] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0138.688] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0138.688] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0138.688] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.688] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.688] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0138.688] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.688] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0138.688] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.688] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0138.689] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0138.689] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0138.689] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.689] CoTaskMemFree (pv=0x1b067a80) 
	[0138.689] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0138.689] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0138.689] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0138.689] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0138.689] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0138.689] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0138.689] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.689] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.689] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0138.689] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.689] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.689] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.689] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0138.689] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0138.689] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0138.689] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0138.690] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.690] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0138.690] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0138.690] GetCurrentObject (hdc=0x25010ce9, type=0x1) returned 0x1b00017
	[0138.690] GetCurrentObject (hdc=0x25010ce9, type=0x2) returned 0x1900010
	[0138.690] GetCurrentObject (hdc=0x25010ce9, type=0x7) returned 0x140507d2
	[0138.690] GetCurrentObject (hdc=0x25010ce9, type=0x6) returned 0x18a002e
	[0138.690] SaveDC (hdc=0x25010ce9) returned 1
	[0138.690] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd4040710
	[0138.690] GetClipRgn (hdc=0x25010ce9, hrgn=0xffffffffd4040710) returned 0
	[0138.690] SelectClipRgn (hdc=0x25010ce9, hrgn=0x380407f9) returned 2
	[0138.690] DeleteObject (ho=0xffffffffd4040710) returned 1
	[0138.690] DeleteObject (ho=0x380407f9) returned 1
	[0138.690] OffsetViewportOrgEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x26e7968 | out: lppt=0x26e7968) returned 1
	[0138.690] GetNearestColor (hdc=0x25010ce9, color=0xf0f0f0) returned 0xf0f0f0
	[0138.691] CreateSolidBrush (color=0xf0f0f0) returned 0x791007c0
	[0138.691] FillRect (hDC=0x25010ce9, lprc=0x20c990, hbr=0x791007c0) returned 1
	[0138.691] DeleteObject (ho=0x791007c0) returned 1
	[0138.691] RestoreDC (hdc=0x25010ce9, nSavedDC=-1) returned 1
	[0138.691] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.691] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010ce9) returned 0x0
	[0138.691] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0138.691] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0138.691] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.691] CoTaskMemFree (pv=0x1b067a80) 
	[0138.691] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0138.691] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.691] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0138.691] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0138.691] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0138.691] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0138.692] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.692] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0138.692] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.692] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0138.692] GetFocus () returned 0x201d8
	[0138.692] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0138.692] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0138.692] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0138.692] CoTaskMemFree (pv=0x1b067a80) 
	[0138.692] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0138.692] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0138.692] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.692] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0138.692] GdipCreateRegion (region=0x20c830) returned 0x0
	[0138.692] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0138.692] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0138.693] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0138.693] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0138.693] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0138.693] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.693] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.693] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0138.693] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0138.693] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0138.693] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.693] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0138.693] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0138.693] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0138.693] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0138.693] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.693] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0138.693] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0138.693] GetCurrentObject (hdc=0x25010ce9, type=0x1) returned 0x1b00017
	[0138.693] GetCurrentObject (hdc=0x25010ce9, type=0x2) returned 0x1900010
	[0138.693] GetCurrentObject (hdc=0x25010ce9, type=0x7) returned 0x140507d2
	[0138.693] GetCurrentObject (hdc=0x25010ce9, type=0x6) returned 0x18a002e
	[0138.693] SaveDC (hdc=0x25010ce9) returned 1
	[0138.693] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x390407f9
	[0138.693] GetClipRgn (hdc=0x25010ce9, hrgn=0x390407f9) returned 0
	[0138.694] SelectClipRgn (hdc=0x25010ce9, hrgn=0xffffffffd5040710) returned 2
	[0138.694] DeleteObject (ho=0x390407f9) returned 1
	[0138.694] DeleteObject (ho=0xffffffffd5040710) returned 1
	[0138.694] OffsetViewportOrgEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x26e7f08 | out: lppt=0x26e7f08) returned 1
	[0138.694] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.694] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.694] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.694] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3300d14
	[0138.694] SelectObject (hdc=0x25010ce9, h=0x3300d14) returned 0x1b00017
	[0138.694] MoveToEx (in: hdc=0x25010ce9, x=164, y=1, lppt=0x26e7f70 | out: lppt=0x26e7f70) returned 1
	[0138.694] LineTo (hdc=0x25010ce9, x=1, y=1) returned 1
	[0138.694] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.694] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.694] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.694] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.694] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.694] SelectObject (hdc=0x25010ce9, h=0x3300d14) returned 0x3300d14
	[0138.694] MoveToEx (in: hdc=0x25010ce9, x=1, y=1, lppt=0x26e7f88 | out: lppt=0x26e7f88) returned 1
	[0138.694] LineTo (hdc=0x25010ce9, x=1, y=41) returned 1
	[0138.694] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.694] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.694] SelectObject (hdc=0x25010ce9, h=0x1b00017) returned 0x3300d14
	[0138.694] DeleteObject (ho=0x3300d14) returned 1
	[0138.695] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.695] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.695] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.695] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x3300d13
	[0138.695] SelectObject (hdc=0x25010ce9, h=0x3300d13) returned 0x1b00017
	[0138.695] MoveToEx (in: hdc=0x25010ce9, x=1, y=41, lppt=0x26e7ff0 | out: lppt=0x26e7ff0) returned 1
	[0138.695] LineTo (hdc=0x25010ce9, x=164, y=41) returned 1
	[0138.695] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.695] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.695] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.695] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.695] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.695] SelectObject (hdc=0x25010ce9, h=0x3300d13) returned 0x3300d13
	[0138.695] MoveToEx (in: hdc=0x25010ce9, x=164, y=41, lppt=0x26e8008 | out: lppt=0x26e8008) returned 1
	[0138.695] LineTo (hdc=0x25010ce9, x=164, y=0) returned 1
	[0138.695] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.695] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.695] SelectObject (hdc=0x25010ce9, h=0x1b00017) returned 0x3300d13
	[0138.695] DeleteObject (ho=0x3300d13) returned 1
	[0138.695] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.696] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.696] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.696] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4300d14
	[0138.696] SelectObject (hdc=0x25010ce9, h=0x4300d14) returned 0x1b00017
	[0138.696] MoveToEx (in: hdc=0x25010ce9, x=163, y=2, lppt=0x26e8070 | out: lppt=0x26e8070) returned 1
	[0138.696] LineTo (hdc=0x25010ce9, x=2, y=2) returned 1
	[0138.696] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.696] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.696] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.696] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.696] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.696] SelectObject (hdc=0x25010ce9, h=0x4300d14) returned 0x4300d14
	[0138.696] MoveToEx (in: hdc=0x25010ce9, x=2, y=2, lppt=0x26e8088 | out: lppt=0x26e8088) returned 1
	[0138.696] LineTo (hdc=0x25010ce9, x=2, y=40) returned 1
	[0138.696] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.696] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.696] SelectObject (hdc=0x25010ce9, h=0x1b00017) returned 0x4300d14
	[0138.696] DeleteObject (ho=0x4300d14) returned 1
	[0138.696] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.696] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.696] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.696] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x4300d13
	[0138.696] SelectObject (hdc=0x25010ce9, h=0x4300d13) returned 0x1b00017
	[0138.696] MoveToEx (in: hdc=0x25010ce9, x=2, y=40, lppt=0x26e80f0 | out: lppt=0x26e80f0) returned 1
	[0138.696] LineTo (hdc=0x25010ce9, x=163, y=40) returned 1
	[0138.696] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.696] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.697] GetROP2 (hdc=0x25010ce9) returned 13
	[0138.697] GetBkMode (hdc=0x25010ce9) returned 2
	[0138.697] SetBkMode (hdc=0x25010ce9, mode=1) returned 2
	[0138.697] SelectObject (hdc=0x25010ce9, h=0x4300d13) returned 0x4300d13
	[0138.697] MoveToEx (in: hdc=0x25010ce9, x=163, y=40, lppt=0x26e8108 | out: lppt=0x26e8108) returned 1
	[0138.697] LineTo (hdc=0x25010ce9, x=163, y=1) returned 1
	[0138.697] SetBkMode (hdc=0x25010ce9, mode=2) returned 1
	[0138.697] MoveToEx (in: hdc=0x25010ce9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0138.697] SelectObject (hdc=0x25010ce9, h=0x1b00017) returned 0x4300d13
	[0138.697] DeleteObject (ho=0x4300d13) returned 1
	[0138.697] RestoreDC (hdc=0x25010ce9, nSavedDC=-1) returned 1
	[0138.697] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.697] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010ce9) returned 0x0
	[0138.697] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0138.697] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x25010ce9, x1=0, y1=0, rop=0xcc0020) returned 1
	[0138.697] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.697] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x25010ce9) returned 0x0
	[0138.697] SelectObject (hdc=0x25010ce9, h=0x185000f) returned 0x140507d2
	[0138.697] DeleteDC (hdc=0x25010ce9) returned 1
	[0138.697] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0138.697] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0138.697] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0138.697] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0138.697] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26e8160, cPoints=0x1 | out: lpPoints=0x26e8160) returned 30606029
	[0138.698] WindowFromPoint (Point=0x1e600000318) returned 0x201d8
	[0138.698] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e60318) returned 0x1
	[0138.698] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0138.698] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0138.698] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0138.698] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26e8250, Length=0x70 | out: Destination=0x1afe53a0) 
	[0138.698] ShellExecuteExW (in: pExecInfo=0x26e8460*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26e8460*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0139.017] GetKeyState (nVirtKey=1) returned 1
	[0139.017] GetKeyState (nVirtKey=2) returned 0
	[0139.017] GetKeyState (nVirtKey=4) returned 0
	[0139.017] GetKeyState (nVirtKey=5) returned 0
	[0139.017] GetKeyState (nVirtKey=6) returned 0
	[0139.125] GetKeyState (nVirtKey=1) returned 1
	[0139.125] GetKeyState (nVirtKey=2) returned 0
	[0139.125] GetKeyState (nVirtKey=4) returned 0
	[0139.125] GetKeyState (nVirtKey=5) returned 0
	[0139.125] GetKeyState (nVirtKey=6) returned 0
	[0139.125] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0139.125] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0139.125] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x70107fc
	[0139.125] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0139.125] CreateCompatibleDC (hdc=0x70107fc) returned 0x2a010cfa
	[0139.125] SelectObject (hdc=0x2a010cfa, h=0x140507d2) returned 0x185000f
	[0139.125] GdipCreateFromHDC (hdc=0x2a010cfa, graphics=0x20c9d0) returned 0x0
	[0139.125] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0139.126] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0139.126] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0139.126] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0139.126] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0139.126] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c740
	[0139.126] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0139.126] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.126] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0139.126] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0139.126] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0139.126] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0139.126] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0139.126] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0139.126] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc6b0dbd) returned 0x0
	[0139.126] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0139.126] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0139.127] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0139.127] GetCurrentObject (hdc=0x2a010cfa, type=0x1) returned 0x1b00017
	[0139.127] GetCurrentObject (hdc=0x2a010cfa, type=0x2) returned 0x1900010
	[0139.127] GetCurrentObject (hdc=0x2a010cfa, type=0x7) returned 0x140507d2
	[0139.127] GetCurrentObject (hdc=0x2a010cfa, type=0x6) returned 0x18a002e
	[0139.127] SaveDC (hdc=0x2a010cfa) returned 1
	[0139.128] GetNearestColor (hdc=0x2a010cfa, color=0xf0f0f0) returned 0xf0f0f0
	[0139.128] GetNearestColor (hdc=0x2a010cfa, color=0xa0a0a0) returned 0xa0a0a0
	[0139.128] GetNearestColor (hdc=0x2a010cfa, color=0x696969) returned 0x696969
	[0139.128] GetNearestColor (hdc=0x2a010cfa, color=0xa0a0a0) returned 0xa0a0a0
	[0139.128] GetNearestColor (hdc=0x2a010cfa, color=0x0) returned 0x0
	[0139.129] GetNearestColor (hdc=0x2a010cfa, color=0xffffff) returned 0xffffff
	[0139.129] GetNearestColor (hdc=0x2a010cfa, color=0xe5e5e5) returned 0xe5e5e5
	[0139.129] GetNearestColor (hdc=0x2a010cfa, color=0xd8d8d8) returned 0xd8d8d8
	[0139.129] GetNearestColor (hdc=0x2a010cfa, color=0x0) returned 0x0
	[0139.129] RestoreDC (hdc=0x2a010cfa, nSavedDC=-1) returned 1
	[0139.129] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010cfa) returned 0x0
	[0139.130] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0139.130] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.130] CoTaskMemFree (pv=0x1b067a20) 
	[0139.130] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0139.130] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.130] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.130] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0139.131] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0139.131] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0139.131] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0139.131] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0139.131] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0139.131] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0139.131] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0139.132] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.132] CoTaskMemFree (pv=0x1b067a20) 
	[0139.132] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0139.132] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0139.132] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0139.132] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0139.133] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0139.133] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.133] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.133] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0139.133] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0139.133] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0139.133] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0139.134] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.134] CoTaskMemFree (pv=0x1b067a20) 
	[0139.134] GdipCreateRegion (region=0x20c310) returned 0x0
	[0139.134] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0139.134] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0139.134] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0139.134] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0139.135] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0139.135] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.135] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0139.135] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.135] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0139.135] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0139.135] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0139.136] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0139.136] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0139.136] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0139.136] GetCurrentObject (hdc=0x2a010cfa, type=0x1) returned 0x1b00017
	[0139.136] GetCurrentObject (hdc=0x2a010cfa, type=0x2) returned 0x1900010
	[0139.136] GetCurrentObject (hdc=0x2a010cfa, type=0x7) returned 0x140507d2
	[0139.136] GetCurrentObject (hdc=0x2a010cfa, type=0x6) returned 0x18a002e
	[0139.137] SaveDC (hdc=0x2a010cfa) returned 1
	[0139.137] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd6040710
	[0139.137] GetClipRgn (hdc=0x2a010cfa, hrgn=0xffffffffd6040710) returned 0
	[0139.137] SelectClipRgn (hdc=0x2a010cfa, hrgn=0x3a0407f9) returned 2
	[0139.137] DeleteObject (ho=0xffffffffd6040710) returned 1
	[0139.137] DeleteObject (ho=0x3a0407f9) returned 1
	[0139.137] OffsetViewportOrgEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x26e9190 | out: lppt=0x26e9190) returned 1
	[0139.138] GetNearestColor (hdc=0x2a010cfa, color=0xf0f0f0) returned 0xf0f0f0
	[0139.138] CreateSolidBrush (color=0xf0f0f0) returned 0x7a1007c0
	[0139.138] FillRect (hDC=0x2a010cfa, lprc=0x20c3c0, hbr=0x7a1007c0) returned 1
	[0139.138] DeleteObject (ho=0x7a1007c0) returned 1
	[0139.138] RestoreDC (hdc=0x2a010cfa, nSavedDC=-1) returned 1
	[0139.138] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010cfa) returned 0x0
	[0139.139] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0139.139] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.139] CoTaskMemFree (pv=0x1b067a20) 
	[0139.139] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0139.139] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.139] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.139] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0139.139] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0139.140] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0139.140] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0139.140] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0139.140] GetFocus () returned 0x201d8
	[0139.140] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0139.141] CoTaskMemAlloc (cb=0x13) returned 0x1b067a20
	[0139.141] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.141] CoTaskMemFree (pv=0x1b067a20) 
	[0139.141] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0139.141] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0139.141] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0139.141] GdipCreateRegion (region=0x20c260) returned 0x0
	[0139.142] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0139.142] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0139.142] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0139.142] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0139.142] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0139.142] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.142] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0139.143] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.143] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0139.143] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0139.143] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0139.143] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0139.143] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0139.143] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0139.144] GetCurrentObject (hdc=0x2a010cfa, type=0x1) returned 0x1b00017
	[0139.144] GetCurrentObject (hdc=0x2a010cfa, type=0x2) returned 0x1900010
	[0139.144] GetCurrentObject (hdc=0x2a010cfa, type=0x7) returned 0x140507d2
	[0139.144] GetCurrentObject (hdc=0x2a010cfa, type=0x6) returned 0x18a002e
	[0139.144] SaveDC (hdc=0x2a010cfa) returned 1
	[0139.144] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b0407f9
	[0139.144] GetClipRgn (hdc=0x2a010cfa, hrgn=0x3b0407f9) returned 0
	[0139.145] SelectClipRgn (hdc=0x2a010cfa, hrgn=0xffffffffd7040710) returned 2
	[0139.145] DeleteObject (ho=0x3b0407f9) returned 1
	[0139.145] DeleteObject (ho=0xffffffffd7040710) returned 1
	[0139.145] OffsetViewportOrgEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x26e9730 | out: lppt=0x26e9730) returned 1
	[0139.145] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.145] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.145] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.146] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1b300cf4
	[0139.146] SelectObject (hdc=0x2a010cfa, h=0x1b300cf4) returned 0x1b00017
	[0139.146] MoveToEx (in: hdc=0x2a010cfa, x=164, y=1, lppt=0x26e9798 | out: lppt=0x26e9798) returned 1
	[0139.146] LineTo (hdc=0x2a010cfa, x=1, y=1) returned 1
	[0139.146] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.146] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.146] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.147] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.147] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.147] SelectObject (hdc=0x2a010cfa, h=0x1b300cf4) returned 0x1b300cf4
	[0139.147] MoveToEx (in: hdc=0x2a010cfa, x=1, y=1, lppt=0x26e97b0 | out: lppt=0x26e97b0) returned 1
	[0139.147] LineTo (hdc=0x2a010cfa, x=1, y=41) returned 1
	[0139.147] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.147] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.147] SelectObject (hdc=0x2a010cfa, h=0x1b00017) returned 0x1b300cf4
	[0139.148] DeleteObject (ho=0x1b300cf4) returned 1
	[0139.148] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.148] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.148] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.148] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x16300cf3
	[0139.149] SelectObject (hdc=0x2a010cfa, h=0x16300cf3) returned 0x1b00017
	[0139.149] MoveToEx (in: hdc=0x2a010cfa, x=1, y=41, lppt=0x26e9818 | out: lppt=0x26e9818) returned 1
	[0139.149] LineTo (hdc=0x2a010cfa, x=164, y=41) returned 1
	[0139.149] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.149] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.149] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.149] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.150] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.150] SelectObject (hdc=0x2a010cfa, h=0x16300cf3) returned 0x16300cf3
	[0139.150] MoveToEx (in: hdc=0x2a010cfa, x=164, y=41, lppt=0x26e9830 | out: lppt=0x26e9830) returned 1
	[0139.150] LineTo (hdc=0x2a010cfa, x=164, y=0) returned 1
	[0139.150] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.150] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.150] SelectObject (hdc=0x2a010cfa, h=0x1b00017) returned 0x16300cf3
	[0139.150] DeleteObject (ho=0x16300cf3) returned 1
	[0139.151] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.151] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.151] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.151] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x1c300cf4
	[0139.151] SelectObject (hdc=0x2a010cfa, h=0x1c300cf4) returned 0x1b00017
	[0139.151] MoveToEx (in: hdc=0x2a010cfa, x=163, y=2, lppt=0x26e9898 | out: lppt=0x26e9898) returned 1
	[0139.151] LineTo (hdc=0x2a010cfa, x=2, y=2) returned 1
	[0139.152] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.152] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.152] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.152] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.152] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.152] SelectObject (hdc=0x2a010cfa, h=0x1c300cf4) returned 0x1c300cf4
	[0139.152] MoveToEx (in: hdc=0x2a010cfa, x=2, y=2, lppt=0x26e98b0 | out: lppt=0x26e98b0) returned 1
	[0139.153] LineTo (hdc=0x2a010cfa, x=2, y=40) returned 1
	[0139.153] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.153] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.153] SelectObject (hdc=0x2a010cfa, h=0x1b00017) returned 0x1c300cf4
	[0139.153] DeleteObject (ho=0x1c300cf4) returned 1
	[0139.153] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.153] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.154] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.154] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x17300cf3
	[0139.154] SelectObject (hdc=0x2a010cfa, h=0x17300cf3) returned 0x1b00017
	[0139.154] MoveToEx (in: hdc=0x2a010cfa, x=2, y=40, lppt=0x26e9918 | out: lppt=0x26e9918) returned 1
	[0139.154] LineTo (hdc=0x2a010cfa, x=163, y=40) returned 1
	[0139.154] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.154] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.154] GetROP2 (hdc=0x2a010cfa) returned 13
	[0139.155] GetBkMode (hdc=0x2a010cfa) returned 2
	[0139.155] SetBkMode (hdc=0x2a010cfa, mode=1) returned 2
	[0139.155] SelectObject (hdc=0x2a010cfa, h=0x17300cf3) returned 0x17300cf3
	[0139.155] MoveToEx (in: hdc=0x2a010cfa, x=163, y=40, lppt=0x26e9930 | out: lppt=0x26e9930) returned 1
	[0139.155] LineTo (hdc=0x2a010cfa, x=163, y=1) returned 1
	[0139.155] SetBkMode (hdc=0x2a010cfa, mode=2) returned 1
	[0139.156] MoveToEx (in: hdc=0x2a010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.156] SelectObject (hdc=0x2a010cfa, h=0x1b00017) returned 0x17300cf3
	[0139.156] DeleteObject (ho=0x17300cf3) returned 1
	[0139.156] RestoreDC (hdc=0x2a010cfa, nSavedDC=-1) returned 1
	[0139.156] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010cfa) returned 0x0
	[0139.156] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0139.156] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x2a010cfa, x1=0, y1=0, rop=0xcc0020) returned 1
	[0139.157] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a010cfa) returned 0x0
	[0139.157] SelectObject (hdc=0x2a010cfa, h=0x185000f) returned 0x140507d2
	[0139.157] DeleteDC (hdc=0x2a010cfa) returned 1
	[0139.157] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0139.157] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0139.157] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0139.177] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0139.177] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0139.178] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0139.178] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0139.178] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0139.178] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0139.179] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0139.179] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0139.179] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0139.179] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0139.179] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0139.179] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0139.179] GetStockObject (i=5) returned 0x1900015
	[0139.181] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0139.181] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0139.181] GetCapture () returned 0x0
	[0139.181] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0139.181] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0139.181] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0139.181] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x4010280
	[0139.181] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0139.181] CreateCompatibleDC (hdc=0x4010280) returned 0x3d010cfa
	[0139.182] SelectObject (hdc=0x3d010cfa, h=0x140507d2) returned 0x185000f
	[0139.182] GdipCreateFromHDC (hdc=0x3d010cfa, graphics=0x20c9d0) returned 0x0
	[0139.182] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0139.182] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0139.182] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0139.182] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0139.182] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0139.183] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0139.183] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.183] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0139.183] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0139.183] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0139.183] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0139.183] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0139.184] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc680dbd) returned 0x0
	[0139.184] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0139.184] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0139.184] GetCurrentObject (hdc=0x3d010cfa, type=0x1) returned 0x1b00017
	[0139.184] GetCurrentObject (hdc=0x3d010cfa, type=0x2) returned 0x1900010
	[0139.185] GetCurrentObject (hdc=0x3d010cfa, type=0x7) returned 0x140507d2
	[0139.185] GetCurrentObject (hdc=0x3d010cfa, type=0x6) returned 0x18a002e
	[0139.185] SaveDC (hdc=0x3d010cfa) returned 1
	[0139.185] GetNearestColor (hdc=0x3d010cfa, color=0xf0f0f0) returned 0xf0f0f0
	[0139.185] GetNearestColor (hdc=0x3d010cfa, color=0xa0a0a0) returned 0xa0a0a0
	[0139.185] GetNearestColor (hdc=0x3d010cfa, color=0x696969) returned 0x696969
	[0139.186] GetNearestColor (hdc=0x3d010cfa, color=0xa0a0a0) returned 0xa0a0a0
	[0139.186] GetNearestColor (hdc=0x3d010cfa, color=0x0) returned 0x0
	[0139.186] GetNearestColor (hdc=0x3d010cfa, color=0xffffff) returned 0xffffff
	[0139.186] GetNearestColor (hdc=0x3d010cfa, color=0xe5e5e5) returned 0xe5e5e5
	[0139.186] GetNearestColor (hdc=0x3d010cfa, color=0xd8d8d8) returned 0xd8d8d8
	[0139.187] GetNearestColor (hdc=0x3d010cfa, color=0x0) returned 0x0
	[0139.187] RestoreDC (hdc=0x3d010cfa, nSavedDC=-1) returned 1
	[0139.187] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3d010cfa) returned 0x0
	[0139.187] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0139.187] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.187] CoTaskMemFree (pv=0x1b077150) 
	[0139.187] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0139.188] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.188] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.188] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0139.188] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0139.188] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0139.188] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0139.188] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0139.189] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0139.189] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0139.189] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0139.189] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.189] CoTaskMemFree (pv=0x1b077150) 
	[0139.189] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0139.189] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0139.189] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0139.190] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0139.190] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0139.190] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.190] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.190] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0139.190] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0139.190] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0139.191] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0139.191] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.191] CoTaskMemFree (pv=0x1b077150) 
	[0139.191] GdipCreateRegion (region=0x20c310) returned 0x0
	[0139.191] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0139.191] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0139.191] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0139.191] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0139.192] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0139.192] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.192] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0139.192] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.192] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0139.192] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0139.192] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0139.193] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0139.193] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0139.193] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0139.193] GetCurrentObject (hdc=0x3d010cfa, type=0x1) returned 0x1b00017
	[0139.193] GetCurrentObject (hdc=0x3d010cfa, type=0x2) returned 0x1900010
	[0139.193] GetCurrentObject (hdc=0x3d010cfa, type=0x7) returned 0x140507d2
	[0139.193] GetCurrentObject (hdc=0x3d010cfa, type=0x6) returned 0x18a002e
	[0139.194] SaveDC (hdc=0x3d010cfa) returned 1
	[0139.194] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd8040710
	[0139.194] GetClipRgn (hdc=0x3d010cfa, hrgn=0xffffffffd8040710) returned 0
	[0139.194] SelectClipRgn (hdc=0x3d010cfa, hrgn=0x3e0407f9) returned 2
	[0139.194] DeleteObject (ho=0xffffffffd8040710) returned 1
	[0139.194] DeleteObject (ho=0x3e0407f9) returned 1
	[0139.195] OffsetViewportOrgEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x26ea5c8 | out: lppt=0x26ea5c8) returned 1
	[0139.195] GetNearestColor (hdc=0x3d010cfa, color=0xf0f0f0) returned 0xf0f0f0
	[0139.195] CreateSolidBrush (color=0xf0f0f0) returned 0x7b1007c0
	[0139.195] FillRect (hDC=0x3d010cfa, lprc=0x20c3c0, hbr=0x7b1007c0) returned 1
	[0139.195] DeleteObject (ho=0x7b1007c0) returned 1
	[0139.196] RestoreDC (hdc=0x3d010cfa, nSavedDC=-1) returned 1
	[0139.196] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3d010cfa) returned 0x0
	[0139.196] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0139.196] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.196] CoTaskMemFree (pv=0x1b077150) 
	[0139.196] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0139.196] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.196] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0139.197] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0139.197] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0139.197] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0139.197] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0139.197] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0139.197] GetFocus () returned 0x0
	[0139.197] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0139.197] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0139.198] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0139.198] CoTaskMemFree (pv=0x1b077150) 
	[0139.198] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0139.198] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0139.198] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0139.198] GdipCreateRegion (region=0x20c260) returned 0x0
	[0139.198] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0139.199] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0139.199] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0139.199] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0139.199] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0139.199] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.199] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0139.199] LocalFree (hMem=0x1b07c740) returned 0x0
	[0139.200] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0139.200] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0139.200] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0139.200] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0139.200] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0139.200] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0139.200] GetCurrentObject (hdc=0x3d010cfa, type=0x1) returned 0x1b00017
	[0139.201] GetCurrentObject (hdc=0x3d010cfa, type=0x2) returned 0x1900010
	[0139.201] GetCurrentObject (hdc=0x3d010cfa, type=0x7) returned 0x140507d2
	[0139.201] GetCurrentObject (hdc=0x3d010cfa, type=0x6) returned 0x18a002e
	[0139.201] SaveDC (hdc=0x3d010cfa) returned 1
	[0139.201] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f0407f9
	[0139.201] GetClipRgn (hdc=0x3d010cfa, hrgn=0x3f0407f9) returned 0
	[0139.201] SelectClipRgn (hdc=0x3d010cfa, hrgn=0xffffffffd9040710) returned 2
	[0139.202] DeleteObject (ho=0x3f0407f9) returned 1
	[0139.202] DeleteObject (ho=0xffffffffd9040710) returned 1
	[0139.202] OffsetViewportOrgEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x26eab68 | out: lppt=0x26eab68) returned 1
	[0139.202] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.202] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.202] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.203] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x18300cf3
	[0139.203] SelectObject (hdc=0x3d010cfa, h=0x18300cf3) returned 0x1b00017
	[0139.203] MoveToEx (in: hdc=0x3d010cfa, x=164, y=1, lppt=0x26eabd0 | out: lppt=0x26eabd0) returned 1
	[0139.203] LineTo (hdc=0x3d010cfa, x=1, y=1) returned 1
	[0139.203] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.203] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.203] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.204] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.204] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.204] SelectObject (hdc=0x3d010cfa, h=0x18300cf3) returned 0x18300cf3
	[0139.204] MoveToEx (in: hdc=0x3d010cfa, x=1, y=1, lppt=0x26eabe8 | out: lppt=0x26eabe8) returned 1
	[0139.204] LineTo (hdc=0x3d010cfa, x=1, y=41) returned 1
	[0139.204] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.204] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.205] SelectObject (hdc=0x3d010cfa, h=0x1b00017) returned 0x18300cf3
	[0139.205] DeleteObject (ho=0x18300cf3) returned 1
	[0139.205] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.205] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.205] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.205] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1d300cf4
	[0139.206] SelectObject (hdc=0x3d010cfa, h=0x1d300cf4) returned 0x1b00017
	[0139.206] MoveToEx (in: hdc=0x3d010cfa, x=1, y=41, lppt=0x26eac50 | out: lppt=0x26eac50) returned 1
	[0139.206] LineTo (hdc=0x3d010cfa, x=164, y=41) returned 1
	[0139.206] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.206] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.206] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.206] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.207] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.207] SelectObject (hdc=0x3d010cfa, h=0x1d300cf4) returned 0x1d300cf4
	[0139.207] MoveToEx (in: hdc=0x3d010cfa, x=164, y=41, lppt=0x26eac68 | out: lppt=0x26eac68) returned 1
	[0139.207] LineTo (hdc=0x3d010cfa, x=164, y=0) returned 1
	[0139.207] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.207] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.208] SelectObject (hdc=0x3d010cfa, h=0x1b00017) returned 0x1d300cf4
	[0139.208] DeleteObject (ho=0x1d300cf4) returned 1
	[0139.208] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.208] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.208] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.208] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x19300cf3
	[0139.208] SelectObject (hdc=0x3d010cfa, h=0x19300cf3) returned 0x1b00017
	[0139.209] MoveToEx (in: hdc=0x3d010cfa, x=163, y=2, lppt=0x26eacd0 | out: lppt=0x26eacd0) returned 1
	[0139.209] LineTo (hdc=0x3d010cfa, x=2, y=2) returned 1
	[0139.209] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.209] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.209] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.209] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.209] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.209] SelectObject (hdc=0x3d010cfa, h=0x19300cf3) returned 0x19300cf3
	[0139.210] MoveToEx (in: hdc=0x3d010cfa, x=2, y=2, lppt=0x26eace8 | out: lppt=0x26eace8) returned 1
	[0139.210] LineTo (hdc=0x3d010cfa, x=2, y=40) returned 1
	[0139.210] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.210] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.210] SelectObject (hdc=0x3d010cfa, h=0x1b00017) returned 0x19300cf3
	[0139.211] DeleteObject (ho=0x19300cf3) returned 1
	[0139.211] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.211] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.211] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.211] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1e300cf4
	[0139.211] SelectObject (hdc=0x3d010cfa, h=0x1e300cf4) returned 0x1b00017
	[0139.211] MoveToEx (in: hdc=0x3d010cfa, x=2, y=40, lppt=0x26ead50 | out: lppt=0x26ead50) returned 1
	[0139.212] LineTo (hdc=0x3d010cfa, x=163, y=40) returned 1
	[0139.212] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.212] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.212] GetROP2 (hdc=0x3d010cfa) returned 13
	[0139.212] GetBkMode (hdc=0x3d010cfa) returned 2
	[0139.212] SetBkMode (hdc=0x3d010cfa, mode=1) returned 2
	[0139.212] SelectObject (hdc=0x3d010cfa, h=0x1e300cf4) returned 0x1e300cf4
	[0139.213] MoveToEx (in: hdc=0x3d010cfa, x=163, y=40, lppt=0x26ead68 | out: lppt=0x26ead68) returned 1
	[0139.213] LineTo (hdc=0x3d010cfa, x=163, y=1) returned 1
	[0139.213] SetBkMode (hdc=0x3d010cfa, mode=2) returned 1
	[0139.213] MoveToEx (in: hdc=0x3d010cfa, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0139.213] SelectObject (hdc=0x3d010cfa, h=0x1b00017) returned 0x1e300cf4
	[0139.213] DeleteObject (ho=0x1e300cf4) returned 1
	[0139.213] RestoreDC (hdc=0x3d010cfa, nSavedDC=-1) returned 1
	[0139.213] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3d010cfa) returned 0x0
	[0139.214] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0139.214] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x3d010cfa, x1=0, y1=0, rop=0xcc0020) returned 1
	[0139.214] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3d010cfa) returned 0x0
	[0139.214] SelectObject (hdc=0x3d010cfa, h=0x185000f) returned 0x140507d2
	[0139.214] DeleteDC (hdc=0x3d010cfa) returned 1
	[0139.214] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0139.215] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0139.215] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0139.278] GetCapture () returned 0x0
	[0139.278] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0139.278] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0139.278] WaitMessage () returned 1
	[0139.491] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0139.491] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0139.491] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0139.491] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0139.491] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0139.491] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0139.491] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0139.491] WaitMessage () returned 1
	[0140.575] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.576] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0140.576] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x46, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0140.576] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0140.576] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0140.576] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0140.576] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0140.577] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df50 | out: lpwndpl=0x20df50) returned 1
	[0140.577] GetClientRect (in: hWnd=0x50120, lpRect=0x20de00 | out: lpRect=0x20de00) returned 1
	[0140.577] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0140.577] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0140.577] GetSystemMetrics (nIndex=42) returned 0
	[0140.577] CoTaskMemAlloc (cb=0x26) returned 0x1aff3920
	[0140.577] GetWindowTextW (in: hWnd=0x50120, lpString=0x1aff3920, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0140.577] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1aff3920) returned 0x10
	[0140.579] CoTaskMemFree (pv=0x1aff3920) 
	[0140.579] GetClientRect (in: hWnd=0x50120, lpRect=0x20dba0 | out: lpRect=0x20dba0) returned 1
	[0140.579] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0140.579] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d770) returned 0x0
	[0140.579] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0140.579] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0140.580] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0140.580] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d6c0) returned 0x0
	[0140.580] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0140.580] GdipCreateRegion (region=0x20d660) returned 0x0
	[0140.580] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0140.580] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d690) returned 0x0
	[0140.580] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0140.580] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d760) returned 0x0
	[0140.581] GdipCreateRegion (region=0x20d630) returned 0x0
	[0140.581] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0140.581] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0140.581] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0140.581] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d690) returned 0x0
	[0140.581] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0140.581] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.582] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0140.582] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6e0) returned 0x0
	[0140.582] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0140.582] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d710) returned 0x0
	[0140.582] GetCurrentObject (hdc=0x10107f8, type=0x1) returned 0x1b00017
	[0140.582] GetCurrentObject (hdc=0x10107f8, type=0x2) returned 0x1900010
	[0140.582] GetCurrentObject (hdc=0x10107f8, type=0x7) returned 0x1050032
	[0140.583] GetCurrentObject (hdc=0x10107f8, type=0x6) returned 0x18a002e
	[0140.583] SaveDC (hdc=0x10107f8) returned 1
	[0140.583] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x26eb2d0 | out: lppt=0x26eb2d0) returned 1
	[0140.636] GetNearestColor (hdc=0x10107f8, color=0xf0f0f0) returned 0xf0f0f0
	[0140.636] CreateSolidBrush (color=0xf0f0f0) returned 0x7c1007c0
	[0140.636] FillRect (hDC=0x10107f8, lprc=0x20d6e0, hbr=0x7c1007c0) returned 1
	[0140.637] DeleteObject (ho=0x7c1007c0) returned 1
	[0140.637] RestoreDC (hdc=0x10107f8, nSavedDC=-1) returned 1
	[0140.637] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x10107f8) returned 0x0
	[0140.637] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0140.637] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0140.638] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0xb040d42, lParam=0x0) returned 0x0
	[0140.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0xc040d42, lParam=0x0) returned 0x0
	[0140.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0140.638] GetStockObject (i=5) returned 0x1900015
	[0140.638] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0xd040d42, lParam=0x0) returned 0x0
	[0140.639] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df30 | out: lpwndpl=0x20df30) returned 1
	[0140.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0140.639] GetClientRect (in: hWnd=0x50120, lpRect=0x20dcd0 | out: lpRect=0x20dcd0) returned 1
	[0140.639] GetWindowRect (in: hWnd=0x50120, lpRect=0x20dcd0 | out: lpRect=0x20dcd0) returned 1
	[0140.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0140.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0140.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0140.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x47, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0140.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b1352d0) returned 0x0
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x96c) returned 0x0
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x96c) returned 0x0
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x96c) returned 0x0
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x96c) returned 0x0
	[0140.640] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x96c) returned 0x0
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0140.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0140.641] GetFocus () returned 0x0
	[0140.641] SetFocus (hWnd=0x401b4) returned 0x0
	[0140.641] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0140.641] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0140.641] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0140.641] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0140.641] GetStockObject (i=5) returned 0x1900015
	[0140.642] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1a0) returned 0x0
	[0140.642] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1a0) returned 0x0
	[0140.642] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0140.642] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0140.642] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.642] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.642] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.642] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.642] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.643] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.643] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.643] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.643] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.643] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.643] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.643] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0140.643] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0140.643] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0140.643] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0140.643] GetKeyState (nVirtKey=1) returned 1
	[0140.643] GetKeyState (nVirtKey=2) returned 0
	[0140.643] GetKeyState (nVirtKey=4) returned 0
	[0140.643] GetKeyState (nVirtKey=5) returned 0
	[0140.643] GetKeyState (nVirtKey=6) returned 0
	[0140.643] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.643] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.643] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.643] GetKeyState (nVirtKey=16) returned 0
	[0140.643] GetKeyState (nVirtKey=17) returned 0
	[0140.643] GetKeyState (nVirtKey=18) returned -127
	[0140.643] TranslateMessage (lpMsg=0x20e6b0) returned 1
	[0140.643] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.643] GetKeyState (nVirtKey=16) returned 0
	[0140.643] GetKeyState (nVirtKey=17) returned 0
	[0140.643] GetKeyState (nVirtKey=18) returned -127
	[0140.643] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x105, wParam=0x1b, lParam=0xe0010001) returned 0x0
	[0140.643] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.643] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.643] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.643] GetKeyState (nVirtKey=16) returned 0
	[0140.643] GetKeyState (nVirtKey=17) returned 0
	[0140.643] GetKeyState (nVirtKey=18) returned 1
	[0140.643] TranslateMessage (lpMsg=0x20e6b0) returned 1
	[0140.643] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.643] GetKeyState (nVirtKey=16) returned 0
	[0140.644] GetKeyState (nVirtKey=17) returned 0
	[0140.644] GetKeyState (nVirtKey=18) returned 1
	[0140.644] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x101, wParam=0x12, lParam=0xc0380001) returned 0x0
	[0140.644] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.644] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.644] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.644] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.644] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.644] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.644] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.644] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.644] GetKeyState (nVirtKey=1) returned 1
	[0140.644] GetKeyState (nVirtKey=2) returned 0
	[0140.644] GetKeyState (nVirtKey=4) returned 0
	[0140.644] GetKeyState (nVirtKey=5) returned 0
	[0140.644] GetKeyState (nVirtKey=6) returned 0
	[0140.644] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.644] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0140.644] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.644] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.644] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.644] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0140.644] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0140.645] CreateCompatibleDC (hdc=0x4010280) returned 0x1e010d39
	[0140.645] GetObjectType (h=0x4010280) returned 0x3
	[0140.645] CreateCompatibleBitmap (hdc=0x4010280, cx=1, cy=1) returned 0x1c050d45
	[0140.645] GetDIBits (in: hdc=0x4010280, hbm=0x1c050d45, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0140.645] GetDIBits (in: hdc=0x4010280, hbm=0x1c050d45, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0140.645] DeleteObject (ho=0x1c050d45) returned 1
	[0140.646] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0xe050d41
	[0140.646] SelectObject (hdc=0x1e010d39, h=0xe050d41) returned 0x185000f
	[0140.646] GdipCreateFromHDC (hdc=0x1e010d39, graphics=0x20d750) returned 0x0
	[0140.646] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0140.646] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0140.646] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0140.647] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0140.647] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0140.647] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0140.647] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.647] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0140.647] GdipCreateRegion (region=0x20d910) returned 0x0
	[0140.647] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0140.648] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0140.648] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0140.648] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0140.648] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0140.648] GetSystemMetrics (nIndex=42) returned 0
	[0140.648] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0140.648] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0140.648] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0140.648] CoTaskMemFree (pv=0x1b07f5c0) 
	[0140.648] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0140.648] GdipCreateRegion (region=0x20d400) returned 0x0
	[0140.648] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0140.648] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0140.649] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0140.649] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0140.649] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0140.649] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.649] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0140.649] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0140.649] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.650] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0140.650] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0140.650] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0140.650] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0140.650] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0140.650] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0140.650] GetCurrentObject (hdc=0x1e010d39, type=0x1) returned 0x1b00017
	[0140.651] GetCurrentObject (hdc=0x1e010d39, type=0x2) returned 0x1900010
	[0140.651] GetCurrentObject (hdc=0x1e010d39, type=0x7) returned 0xe050d41
	[0140.651] GetCurrentObject (hdc=0x1e010d39, type=0x6) returned 0x18a002e
	[0140.651] SaveDC (hdc=0x1e010d39) returned 1
	[0140.651] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffda040710
	[0140.651] GetClipRgn (hdc=0x1e010d39, hrgn=0xffffffffda040710) returned 0
	[0140.651] SelectClipRgn (hdc=0x1e010d39, hrgn=0x450407f9) returned 2
	[0140.652] DeleteObject (ho=0xffffffffda040710) returned 1
	[0140.652] DeleteObject (ho=0x450407f9) returned 1
	[0140.652] OffsetViewportOrgEx (in: hdc=0x1e010d39, x=0, y=0, lppt=0x26ecb90 | out: lppt=0x26ecb90) returned 1
	[0140.652] GetNearestColor (hdc=0x1e010d39, color=0x0) returned 0x0
	[0140.652] CreateSolidBrush (color=0x0) returned 0x7d1007c0
	[0140.652] FillRect (hDC=0x1e010d39, lprc=0x20d4b0, hbr=0x7d1007c0) returned 1
	[0140.653] DeleteObject (ho=0x7d1007c0) returned 1
	[0140.653] RestoreDC (hdc=0x1e010d39, nSavedDC=-1) returned 1
	[0140.653] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e010d39) returned 0x0
	[0140.653] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc630dbd) returned 0x0
	[0140.653] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0140.653] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0140.653] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0140.653] GetSystemMetrics (nIndex=42) returned 0
	[0140.653] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0140.653] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0140.653] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0140.653] CoTaskMemFree (pv=0x1b07f5c0) 
	[0140.653] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0140.654] GetCurrentObject (hdc=0x1e010d39, type=0x1) returned 0x1b00017
	[0140.654] GetCurrentObject (hdc=0x1e010d39, type=0x2) returned 0x1900010
	[0140.654] GetCurrentObject (hdc=0x1e010d39, type=0x7) returned 0xe050d41
	[0140.654] GetCurrentObject (hdc=0x1e010d39, type=0x6) returned 0x18a002e
	[0140.654] SaveDC (hdc=0x1e010d39) returned 1
	[0140.654] GetNearestColor (hdc=0x1e010d39, color=0x80) returned 0x80
	[0140.655] RestoreDC (hdc=0x1e010d39, nSavedDC=-1) returned 1
	[0140.655] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e010d39) returned 0x0
	[0140.655] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0140.655] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0140.655] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0140.655] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0140.655] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0140.656] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0140.656] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0140.656] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0140.656] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0140.656] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0140.657] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0140.657] BitBlt (hdc=0x4010280, x=0, y=0, cx=310, cy=83, hdcSrc=0x1e010d39, x1=0, y1=0, rop=0xcc0020) returned 1
	[0140.657] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e010d39) returned 0x0
	[0140.657] SelectObject (hdc=0x1e010d39, h=0x185000f) returned 0xe050d41
	[0140.657] DeleteDC (hdc=0x1e010d39) returned 1
	[0140.657] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0140.657] DeleteObject (ho=0xe050d41) returned 1
	[0140.659] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0140.659] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0140.659] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.659] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.659] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.659] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.659] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.659] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0140.659] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0140.659] CreateCompatibleDC (hdc=0x10107f8) returned 0xffffffff99010a9a
	[0140.659] SelectObject (hdc=0xffffffff99010a9a, h=0x140507d2) returned 0x185000f
	[0140.659] GdipCreateFromHDC (hdc=0xffffffff99010a9a, graphics=0x20d7e0) returned 0x0
	[0140.660] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0140.660] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0140.660] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0140.660] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0140.660] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0140.660] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0140.660] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.661] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0140.661] GdipCreateRegion (region=0x20d910) returned 0x0
	[0140.661] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0140.661] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0140.661] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0140.661] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc610dbd) returned 0x0
	[0140.662] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0140.662] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0140.662] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x1) returned 0x1b00017
	[0140.662] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x2) returned 0x1900010
	[0140.663] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x7) returned 0x140507d2
	[0140.663] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x6) returned 0x18a002e
	[0140.663] SaveDC (hdc=0xffffffff99010a9a) returned 1
	[0140.663] GetNearestColor (hdc=0xffffffff99010a9a, color=0xf0f0f0) returned 0xf0f0f0
	[0140.663] GetNearestColor (hdc=0xffffffff99010a9a, color=0xa0a0a0) returned 0xa0a0a0
	[0140.663] GetNearestColor (hdc=0xffffffff99010a9a, color=0x696969) returned 0x696969
	[0140.664] GetNearestColor (hdc=0xffffffff99010a9a, color=0xa0a0a0) returned 0xa0a0a0
	[0140.664] GetNearestColor (hdc=0xffffffff99010a9a, color=0x0) returned 0x0
	[0140.664] GetNearestColor (hdc=0xffffffff99010a9a, color=0xffffff) returned 0xffffff
	[0140.664] GetNearestColor (hdc=0xffffffff99010a9a, color=0xe5e5e5) returned 0xe5e5e5
	[0140.664] GetNearestColor (hdc=0xffffffff99010a9a, color=0xd8d8d8) returned 0xd8d8d8
	[0140.665] GetNearestColor (hdc=0xffffffff99010a9a, color=0x0) returned 0x0
	[0140.665] RestoreDC (hdc=0xffffffff99010a9a, nSavedDC=-1) returned 1
	[0140.665] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff99010a9a) returned 0x0
	[0140.665] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0140.665] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0140.665] CoTaskMemFree (pv=0x1b067980) 
	[0140.665] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0140.666] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0140.666] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0140.666] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0140.666] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0140.666] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0140.666] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0140.667] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0140.667] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0140.667] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0140.667] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0140.667] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0140.667] CoTaskMemFree (pv=0x1b067980) 
	[0140.667] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0140.667] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0140.668] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0140.668] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0140.668] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0140.668] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0140.668] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0140.668] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0140.669] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0140.669] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0140.669] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0140.669] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0140.669] CoTaskMemFree (pv=0x1b067980) 
	[0140.669] GdipCreateRegion (region=0x20d120) returned 0x0
	[0140.669] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0140.670] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0140.670] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0140.670] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0140.670] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0140.670] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.670] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0140.670] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.671] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0140.671] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0140.671] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0140.671] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0140.671] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0140.671] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0140.671] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x1) returned 0x1b00017
	[0140.672] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x2) returned 0x1900010
	[0140.672] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x7) returned 0x140507d2
	[0140.672] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x6) returned 0x18a002e
	[0140.672] SaveDC (hdc=0xffffffff99010a9a) returned 1
	[0140.672] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x460407f9
	[0140.672] GetClipRgn (hdc=0xffffffff99010a9a, hrgn=0x460407f9) returned 0
	[0140.672] SelectClipRgn (hdc=0xffffffff99010a9a, hrgn=0xffffffffdb040710) returned 2
	[0140.673] DeleteObject (ho=0x460407f9) returned 1
	[0140.673] DeleteObject (ho=0xffffffffdb040710) returned 1
	[0140.673] OffsetViewportOrgEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x26edc80 | out: lppt=0x26edc80) returned 1
	[0140.673] GetNearestColor (hdc=0xffffffff99010a9a, color=0xf0f0f0) returned 0xf0f0f0
	[0140.673] CreateSolidBrush (color=0xf0f0f0) returned 0x7e1007c0
	[0140.673] FillRect (hDC=0xffffffff99010a9a, lprc=0x20d1d0, hbr=0x7e1007c0) returned 1
	[0140.673] DeleteObject (ho=0x7e1007c0) returned 1
	[0140.674] RestoreDC (hdc=0xffffffff99010a9a, nSavedDC=-1) returned 1
	[0140.674] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff99010a9a) returned 0x0
	[0140.674] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0140.674] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0140.674] CoTaskMemFree (pv=0x1b067980) 
	[0140.674] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0140.674] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0140.674] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0140.675] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0140.675] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0140.675] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0140.675] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0140.675] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0140.675] GetFocus () returned 0x401b4
	[0140.675] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0140.676] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0140.676] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0140.676] CoTaskMemFree (pv=0x1b067980) 
	[0140.676] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0140.676] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0140.676] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0140.676] GdipCreateRegion (region=0x20d070) returned 0x0
	[0140.676] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0140.690] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0140.690] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0140.690] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0140.690] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0140.690] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.690] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0140.691] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.691] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0140.691] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0140.691] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0140.691] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0140.691] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0140.692] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0140.692] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x1) returned 0x1b00017
	[0140.692] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x2) returned 0x1900010
	[0140.692] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x7) returned 0x140507d2
	[0140.693] GetCurrentObject (hdc=0xffffffff99010a9a, type=0x6) returned 0x18a002e
	[0140.693] SaveDC (hdc=0xffffffff99010a9a) returned 1
	[0140.693] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffdc040710
	[0140.693] GetClipRgn (hdc=0xffffffff99010a9a, hrgn=0xffffffffdc040710) returned 0
	[0140.693] SelectClipRgn (hdc=0xffffffff99010a9a, hrgn=0x470407f9) returned 2
	[0140.693] DeleteObject (ho=0xffffffffdc040710) returned 1
	[0140.694] DeleteObject (ho=0x470407f9) returned 1
	[0140.694] OffsetViewportOrgEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x26ee220 | out: lppt=0x26ee220) returned 1
	[0140.694] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.694] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.694] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.694] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xd300d43
	[0140.694] SelectObject (hdc=0xffffffff99010a9a, h=0xd300d43) returned 0x1b00017
	[0140.695] MoveToEx (in: hdc=0xffffffff99010a9a, x=126, y=1, lppt=0x26ee288 | out: lppt=0x26ee288) returned 1
	[0140.695] LineTo (hdc=0xffffffff99010a9a, x=1, y=1) returned 1
	[0140.695] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.695] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.695] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.695] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.696] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.696] SelectObject (hdc=0xffffffff99010a9a, h=0xd300d43) returned 0xd300d43
	[0140.696] MoveToEx (in: hdc=0xffffffff99010a9a, x=1, y=1, lppt=0x26ee2a0 | out: lppt=0x26ee2a0) returned 1
	[0140.696] LineTo (hdc=0xffffffff99010a9a, x=1, y=39) returned 1
	[0140.696] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.696] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.696] SelectObject (hdc=0xffffffff99010a9a, h=0x1b00017) returned 0xd300d43
	[0140.696] DeleteObject (ho=0xd300d43) returned 1
	[0140.697] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.697] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.697] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.697] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1e300d45
	[0140.697] SelectObject (hdc=0xffffffff99010a9a, h=0x1e300d45) returned 0x1b00017
	[0140.697] MoveToEx (in: hdc=0xffffffff99010a9a, x=1, y=39, lppt=0x26ee308 | out: lppt=0x26ee308) returned 1
	[0140.697] LineTo (hdc=0xffffffff99010a9a, x=126, y=39) returned 1
	[0140.698] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.698] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.698] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.698] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.698] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.698] SelectObject (hdc=0xffffffff99010a9a, h=0x1e300d45) returned 0x1e300d45
	[0140.698] MoveToEx (in: hdc=0xffffffff99010a9a, x=126, y=39, lppt=0x26ee320 | out: lppt=0x26ee320) returned 1
	[0140.699] LineTo (hdc=0xffffffff99010a9a, x=126, y=0) returned 1
	[0140.699] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.699] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.699] SelectObject (hdc=0xffffffff99010a9a, h=0x1b00017) returned 0x1e300d45
	[0140.699] DeleteObject (ho=0x1e300d45) returned 1
	[0140.699] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.699] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.700] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.700] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xe300d43
	[0140.700] SelectObject (hdc=0xffffffff99010a9a, h=0xe300d43) returned 0x1b00017
	[0140.700] MoveToEx (in: hdc=0xffffffff99010a9a, x=125, y=2, lppt=0x26ee388 | out: lppt=0x26ee388) returned 1
	[0140.700] LineTo (hdc=0xffffffff99010a9a, x=2, y=2) returned 1
	[0140.700] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.700] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.701] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.701] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.701] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.701] SelectObject (hdc=0xffffffff99010a9a, h=0xe300d43) returned 0xe300d43
	[0140.701] MoveToEx (in: hdc=0xffffffff99010a9a, x=2, y=2, lppt=0x26ee3a0 | out: lppt=0x26ee3a0) returned 1
	[0140.701] LineTo (hdc=0xffffffff99010a9a, x=2, y=38) returned 1
	[0140.701] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.701] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.702] SelectObject (hdc=0xffffffff99010a9a, h=0x1b00017) returned 0xe300d43
	[0140.702] DeleteObject (ho=0xe300d43) returned 1
	[0140.702] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.702] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.702] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.702] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1f300d45
	[0140.703] SelectObject (hdc=0xffffffff99010a9a, h=0x1f300d45) returned 0x1b00017
	[0140.703] MoveToEx (in: hdc=0xffffffff99010a9a, x=2, y=38, lppt=0x26ee408 | out: lppt=0x26ee408) returned 1
	[0140.703] LineTo (hdc=0xffffffff99010a9a, x=125, y=38) returned 1
	[0140.703] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.703] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.703] GetROP2 (hdc=0xffffffff99010a9a) returned 13
	[0140.703] GetBkMode (hdc=0xffffffff99010a9a) returned 2
	[0140.704] SetBkMode (hdc=0xffffffff99010a9a, mode=1) returned 2
	[0140.704] SelectObject (hdc=0xffffffff99010a9a, h=0x1f300d45) returned 0x1f300d45
	[0140.704] MoveToEx (in: hdc=0xffffffff99010a9a, x=125, y=38, lppt=0x26ee420 | out: lppt=0x26ee420) returned 1
	[0140.704] LineTo (hdc=0xffffffff99010a9a, x=125, y=1) returned 1
	[0140.704] SetBkMode (hdc=0xffffffff99010a9a, mode=2) returned 1
	[0140.704] MoveToEx (in: hdc=0xffffffff99010a9a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0140.704] SelectObject (hdc=0xffffffff99010a9a, h=0x1b00017) returned 0x1f300d45
	[0140.704] DeleteObject (ho=0x1f300d45) returned 1
	[0140.705] RestoreDC (hdc=0xffffffff99010a9a, nSavedDC=-1) returned 1
	[0140.705] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff99010a9a) returned 0x0
	[0140.705] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0140.705] BitBlt (hdc=0x10107f8, x=0, y=0, cx=128, cy=41, hdcSrc=0xffffffff99010a9a, x1=0, y1=0, rop=0xcc0020) returned 1
	[0140.705] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff99010a9a) returned 0x0
	[0140.705] SelectObject (hdc=0xffffffff99010a9a, h=0x185000f) returned 0x140507d2
	[0140.706] DeleteDC (hdc=0xffffffff99010a9a) returned 1
	[0140.706] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0140.706] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0140.706] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0140.706] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.706] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0140.706] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.706] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.706] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.706] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x70107fc
	[0140.706] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0140.706] CreateCompatibleDC (hdc=0x70107fc) returned 0x20010d45
	[0140.707] GetObjectType (h=0x70107fc) returned 0x3
	[0140.707] CreateCompatibleBitmap (hdc=0x70107fc, cx=1, cy=1) returned 0xf050d43
	[0140.707] GetDIBits (in: hdc=0x70107fc, hbm=0xf050d43, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0140.707] GetDIBits (in: hdc=0x70107fc, hbm=0xf050d43, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0140.707] DeleteObject (ho=0xf050d43) returned 1
	[0140.707] CreateDIBSection (in: hdc=0x70107fc, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0xf050d41
	[0140.708] SelectObject (hdc=0x20010d45, h=0xf050d41) returned 0x185000f
	[0140.708] GdipCreateFromHDC (hdc=0x20010d45, graphics=0x20d800) returned 0x0
	[0140.708] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0140.708] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0140.708] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0140.708] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0140.709] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0140.709] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0140.709] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.709] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0140.709] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0140.709] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0140.709] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0140.710] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0140.710] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0140.710] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0140.710] GetSystemMetrics (nIndex=42) returned 0
	[0140.710] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0140.710] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0140.710] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0140.710] CoTaskMemFree (pv=0x1b078870) 
	[0140.710] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0140.710] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0140.710] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0140.710] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0140.710] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0140.711] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0140.711] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0140.711] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.711] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0140.711] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0140.711] LocalFree (hMem=0x1b07c780) returned 0x0
	[0140.711] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0140.712] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0140.712] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0140.712] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0140.712] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0140.712] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0140.712] GetCurrentObject (hdc=0x20010d45, type=0x1) returned 0x1b00017
	[0140.712] GetCurrentObject (hdc=0x20010d45, type=0x2) returned 0x1900010
	[0140.713] GetCurrentObject (hdc=0x20010d45, type=0x7) returned 0xf050d41
	[0140.713] GetCurrentObject (hdc=0x20010d45, type=0x6) returned 0x18a002e
	[0140.713] SaveDC (hdc=0x20010d45) returned 1
	[0140.713] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x480407f9
	[0140.713] GetClipRgn (hdc=0x20010d45, hrgn=0x480407f9) returned 0
	[0140.713] SelectClipRgn (hdc=0x20010d45, hrgn=0xffffffffdd040710) returned 2
	[0140.714] DeleteObject (ho=0x480407f9) returned 1
	[0140.714] DeleteObject (ho=0xffffffffdd040710) returned 1
	[0140.714] OffsetViewportOrgEx (in: hdc=0x20010d45, x=0, y=0, lppt=0x26efad0 | out: lppt=0x26efad0) returned 1
	[0140.714] GetNearestColor (hdc=0x20010d45, color=0xf0f0f0) returned 0xf0f0f0
	[0140.714] CreateSolidBrush (color=0xf0f0f0) returned 0x7f1007c0
	[0140.714] FillRect (hDC=0x20010d45, lprc=0x20d560, hbr=0x7f1007c0) returned 1
	[0140.715] DeleteObject (ho=0x7f1007c0) returned 1
	[0140.715] RestoreDC (hdc=0x20010d45, nSavedDC=-1) returned 1
	[0140.715] GdipReleaseDC (graphics=0x1b929550, hdc=0x20010d45) returned 0x0
	[0140.715] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc5e0dbd) returned 0x0
	[0140.715] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0140.716] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0140.716] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0140.716] GetSystemMetrics (nIndex=42) returned 0
	[0140.716] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0140.716] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0140.716] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0140.716] CoTaskMemFree (pv=0x1b078870) 
	[0140.716] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0140.724] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0140.724] BitBlt (hdc=0x70107fc, x=0, y=0, cx=658, cy=456, hdcSrc=0x20010d45, x1=0, y1=0, rop=0xcc0020) returned 1
	[0140.725] GdipReleaseDC (graphics=0x1b929550, hdc=0x20010d45) returned 0x0
	[0140.725] SelectObject (hdc=0x20010d45, h=0x185000f) returned 0xf050d41
	[0140.725] DeleteDC (hdc=0x20010d45) returned 1
	[0140.725] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0140.725] DeleteObject (ho=0xf050d41) returned 1
	[0140.732] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0140.732] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0140.733] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.733] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.733] WaitMessage () returned 1
	[0140.740] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.740] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.740] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.740] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.740] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.740] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.740] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.740] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.740] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.740] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.740] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a1, wParam=0x0, lParam=0x140045) returned 0x0
	[0140.740] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.740] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0140.740] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.740] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.740] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.741] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.741] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.741] WaitMessage () returned 1
	[0140.744] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.745] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.745] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.745] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.745] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.745] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.745] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.745] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.745] GetKeyState (nVirtKey=1) returned 1
	[0140.745] GetKeyState (nVirtKey=2) returned 0
	[0140.745] GetKeyState (nVirtKey=4) returned 0
	[0140.745] GetKeyState (nVirtKey=5) returned 0
	[0140.745] GetKeyState (nVirtKey=6) returned 0
	[0140.745] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.745] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.745] WaitMessage () returned 1
	[0140.748] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.748] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.748] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.748] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.748] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.748] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.748] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.749] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.749] GetKeyState (nVirtKey=1) returned 1
	[0140.749] GetKeyState (nVirtKey=2) returned 0
	[0140.749] GetKeyState (nVirtKey=4) returned 0
	[0140.749] GetKeyState (nVirtKey=5) returned 0
	[0140.749] GetKeyState (nVirtKey=6) returned 0
	[0140.749] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.749] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.749] WaitMessage () returned 1
	[0140.750] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.750] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.750] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.750] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.750] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.751] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.751] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.751] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.751] GetKeyState (nVirtKey=1) returned 1
	[0140.751] GetKeyState (nVirtKey=2) returned 0
	[0140.751] GetKeyState (nVirtKey=4) returned 0
	[0140.751] GetKeyState (nVirtKey=5) returned 0
	[0140.751] GetKeyState (nVirtKey=6) returned 0
	[0140.751] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.751] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.751] WaitMessage () returned 1
	[0140.751] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.751] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.751] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.751] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.751] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.752] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.752] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.752] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.752] GetKeyState (nVirtKey=1) returned 1
	[0140.752] GetKeyState (nVirtKey=2) returned 0
	[0140.752] GetKeyState (nVirtKey=4) returned 0
	[0140.752] GetKeyState (nVirtKey=5) returned 0
	[0140.752] GetKeyState (nVirtKey=6) returned 0
	[0140.752] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.752] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.752] WaitMessage () returned 1
	[0140.762] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.762] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.763] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.763] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.763] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.763] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.763] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.763] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.763] GetKeyState (nVirtKey=1) returned 1
	[0140.763] GetKeyState (nVirtKey=2) returned 0
	[0140.763] GetKeyState (nVirtKey=4) returned 0
	[0140.763] GetKeyState (nVirtKey=5) returned 0
	[0140.763] GetKeyState (nVirtKey=6) returned 0
	[0140.763] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.763] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.763] WaitMessage () returned 1
	[0140.773] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.773] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.773] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.773] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.773] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.774] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.774] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.774] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.774] GetKeyState (nVirtKey=1) returned 1
	[0140.774] GetKeyState (nVirtKey=2) returned 0
	[0140.774] GetKeyState (nVirtKey=4) returned 0
	[0140.774] GetKeyState (nVirtKey=5) returned 0
	[0140.774] GetKeyState (nVirtKey=6) returned 0
	[0140.774] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.774] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.774] WaitMessage () returned 1
	[0140.775] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.775] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.775] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.775] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.775] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.775] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.775] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.775] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.775] GetKeyState (nVirtKey=1) returned 1
	[0140.775] GetKeyState (nVirtKey=2) returned 0
	[0140.775] GetKeyState (nVirtKey=4) returned 0
	[0140.775] GetKeyState (nVirtKey=5) returned 0
	[0140.775] GetKeyState (nVirtKey=6) returned 0
	[0140.775] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.775] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.775] WaitMessage () returned 1
	[0140.777] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.777] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.777] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.777] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.777] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.777] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.777] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.777] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.777] GetKeyState (nVirtKey=1) returned 1
	[0140.777] GetKeyState (nVirtKey=2) returned 0
	[0140.777] GetKeyState (nVirtKey=4) returned 0
	[0140.777] GetKeyState (nVirtKey=5) returned 0
	[0140.777] GetKeyState (nVirtKey=6) returned 0
	[0140.777] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.777] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.777] WaitMessage () returned 1
	[0140.778] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.778] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.778] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.778] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.778] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.778] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.778] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.778] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.778] GetKeyState (nVirtKey=1) returned 1
	[0140.778] GetKeyState (nVirtKey=2) returned 0
	[0140.778] GetKeyState (nVirtKey=4) returned 0
	[0140.778] GetKeyState (nVirtKey=5) returned 0
	[0140.778] GetKeyState (nVirtKey=6) returned 0
	[0140.778] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.778] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.778] WaitMessage () returned 1
	[0140.779] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.779] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.779] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.779] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.779] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.780] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.780] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.780] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.780] GetKeyState (nVirtKey=1) returned 1
	[0140.780] GetKeyState (nVirtKey=2) returned 0
	[0140.780] GetKeyState (nVirtKey=4) returned 0
	[0140.780] GetKeyState (nVirtKey=5) returned 0
	[0140.780] GetKeyState (nVirtKey=6) returned 0
	[0140.780] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.780] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.780] WaitMessage () returned 1
	[0140.781] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.781] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.781] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.781] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.781] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.781] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.781] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.781] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.781] GetKeyState (nVirtKey=1) returned 1
	[0140.781] GetKeyState (nVirtKey=2) returned 0
	[0140.781] GetKeyState (nVirtKey=4) returned 0
	[0140.781] GetKeyState (nVirtKey=5) returned 0
	[0140.781] GetKeyState (nVirtKey=6) returned 0
	[0140.781] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.781] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.781] WaitMessage () returned 1
	[0140.782] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.782] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.782] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.782] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.782] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.782] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.782] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.782] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.782] GetKeyState (nVirtKey=1) returned 1
	[0140.782] GetKeyState (nVirtKey=2) returned 0
	[0140.782] GetKeyState (nVirtKey=4) returned 0
	[0140.782] GetKeyState (nVirtKey=5) returned 0
	[0140.782] GetKeyState (nVirtKey=6) returned 0
	[0140.782] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.782] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.782] WaitMessage () returned 1
	[0140.783] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.783] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.784] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.784] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.784] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.784] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.784] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.784] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.784] GetKeyState (nVirtKey=1) returned 1
	[0140.784] GetKeyState (nVirtKey=2) returned 0
	[0140.784] GetKeyState (nVirtKey=4) returned 0
	[0140.784] GetKeyState (nVirtKey=5) returned 0
	[0140.784] GetKeyState (nVirtKey=6) returned 0
	[0140.784] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.784] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.784] WaitMessage () returned 1
	[0140.785] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.785] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.785] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.785] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.785] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.785] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.785] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.785] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.785] GetKeyState (nVirtKey=1) returned 1
	[0140.785] GetKeyState (nVirtKey=2) returned 0
	[0140.785] GetKeyState (nVirtKey=4) returned 0
	[0140.785] GetKeyState (nVirtKey=5) returned 0
	[0140.785] GetKeyState (nVirtKey=6) returned 0
	[0140.785] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.785] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.785] WaitMessage () returned 1
	[0140.786] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.786] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.786] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.786] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.786] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.786] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.786] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.786] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.786] GetKeyState (nVirtKey=1) returned 1
	[0140.786] GetKeyState (nVirtKey=2) returned 0
	[0140.786] GetKeyState (nVirtKey=4) returned 0
	[0140.786] GetKeyState (nVirtKey=5) returned 0
	[0140.786] GetKeyState (nVirtKey=6) returned 0
	[0140.786] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.786] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.786] WaitMessage () returned 1
	[0140.787] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.787] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.788] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.788] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.788] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.788] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.788] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.788] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.788] GetKeyState (nVirtKey=1) returned 1
	[0140.788] GetKeyState (nVirtKey=2) returned 0
	[0140.788] GetKeyState (nVirtKey=4) returned 0
	[0140.788] GetKeyState (nVirtKey=5) returned 0
	[0140.788] GetKeyState (nVirtKey=6) returned 0
	[0140.788] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.788] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.788] WaitMessage () returned 1
	[0140.789] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.789] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.789] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.789] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.789] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.789] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.789] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.789] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.789] GetKeyState (nVirtKey=1) returned 1
	[0140.789] GetKeyState (nVirtKey=2) returned 0
	[0140.789] GetKeyState (nVirtKey=4) returned 0
	[0140.789] GetKeyState (nVirtKey=5) returned 0
	[0140.789] GetKeyState (nVirtKey=6) returned 0
	[0140.789] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.789] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.789] WaitMessage () returned 1
	[0140.790] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.790] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.790] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0140.790] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0140.790] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0140.790] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0140.790] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0140.790] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0140.790] GetKeyState (nVirtKey=1) returned 1
	[0140.790] GetKeyState (nVirtKey=2) returned 0
	[0140.790] GetKeyState (nVirtKey=4) returned 0
	[0140.790] GetKeyState (nVirtKey=5) returned 0
	[0140.790] GetKeyState (nVirtKey=6) returned 0
	[0140.790] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.790] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0140.790] WaitMessage () returned 1
	[0141.035] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.035] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0141.035] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.036] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.036] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.036] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.036] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.036] WaitMessage () returned 1
	[0141.101] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.101] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.101] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.101] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.101] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.101] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.101] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.101] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.101] GetKeyState (nVirtKey=1) returned 1
	[0141.101] GetKeyState (nVirtKey=2) returned 0
	[0141.101] GetKeyState (nVirtKey=4) returned 0
	[0141.101] GetKeyState (nVirtKey=5) returned 0
	[0141.101] GetKeyState (nVirtKey=6) returned 0
	[0141.101] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.101] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.101] WaitMessage () returned 1
	[0141.103] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.103] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.103] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.103] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.103] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.103] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.103] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.103] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.103] GetKeyState (nVirtKey=1) returned 1
	[0141.103] GetKeyState (nVirtKey=2) returned 0
	[0141.103] GetKeyState (nVirtKey=4) returned 0
	[0141.103] GetKeyState (nVirtKey=5) returned 0
	[0141.103] GetKeyState (nVirtKey=6) returned 0
	[0141.103] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.103] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.103] WaitMessage () returned 1
	[0141.104] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.104] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.104] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.104] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.104] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.104] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.104] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.104] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.104] GetKeyState (nVirtKey=1) returned 1
	[0141.104] GetKeyState (nVirtKey=2) returned 0
	[0141.104] GetKeyState (nVirtKey=4) returned 0
	[0141.104] GetKeyState (nVirtKey=5) returned 0
	[0141.104] GetKeyState (nVirtKey=6) returned 0
	[0141.104] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.105] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.105] WaitMessage () returned 1
	[0141.105] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.105] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.105] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.105] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.105] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.105] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.105] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.105] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.105] GetKeyState (nVirtKey=1) returned 1
	[0141.105] GetKeyState (nVirtKey=2) returned 0
	[0141.105] GetKeyState (nVirtKey=4) returned 0
	[0141.105] GetKeyState (nVirtKey=5) returned 0
	[0141.105] GetKeyState (nVirtKey=6) returned 0
	[0141.106] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.106] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.106] WaitMessage () returned 1
	[0141.106] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.107] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.107] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.107] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.107] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.107] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.107] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.107] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.107] GetKeyState (nVirtKey=1) returned 1
	[0141.107] GetKeyState (nVirtKey=2) returned 0
	[0141.107] GetKeyState (nVirtKey=4) returned 0
	[0141.107] GetKeyState (nVirtKey=5) returned 0
	[0141.107] GetKeyState (nVirtKey=6) returned 0
	[0141.107] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.107] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.107] WaitMessage () returned 1
	[0141.108] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.108] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.108] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.108] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.108] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.108] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.108] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.108] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.108] GetKeyState (nVirtKey=1) returned 1
	[0141.108] GetKeyState (nVirtKey=2) returned 0
	[0141.108] GetKeyState (nVirtKey=4) returned 0
	[0141.108] GetKeyState (nVirtKey=5) returned 0
	[0141.108] GetKeyState (nVirtKey=6) returned 0
	[0141.108] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.108] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.108] WaitMessage () returned 1
	[0141.109] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.109] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.109] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.109] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.109] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.109] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.109] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.109] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.109] GetKeyState (nVirtKey=1) returned 1
	[0141.109] GetKeyState (nVirtKey=2) returned 0
	[0141.109] GetKeyState (nVirtKey=4) returned 0
	[0141.109] GetKeyState (nVirtKey=5) returned 0
	[0141.109] GetKeyState (nVirtKey=6) returned 0
	[0141.109] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.109] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.109] WaitMessage () returned 1
	[0141.110] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.110] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.110] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.110] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.110] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x27c01d8) returned 0x1
	[0141.110] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.110] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.110] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.110] GetKeyState (nVirtKey=1) returned 1
	[0141.110] GetKeyState (nVirtKey=2) returned 0
	[0141.110] GetKeyState (nVirtKey=4) returned 0
	[0141.110] GetKeyState (nVirtKey=5) returned 0
	[0141.110] GetKeyState (nVirtKey=6) returned 0
	[0141.110] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.111] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.111] WaitMessage () returned 1
	[0141.113] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.113] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.113] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.113] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.113] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.113] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.113] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0141.113] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0141.113] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.113] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.114] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.114] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.114] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.114] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.114] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.114] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.114] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0141.114] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0141.114] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0141.114] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0141.114] GetKeyState (nVirtKey=1) returned 1
	[0141.114] GetKeyState (nVirtKey=2) returned 0
	[0141.114] GetKeyState (nVirtKey=4) returned 0
	[0141.114] GetKeyState (nVirtKey=5) returned 0
	[0141.114] GetKeyState (nVirtKey=6) returned 0
	[0141.114] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.114] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.114] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.114] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.114] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0141.114] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0141.114] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0141.115] CreateCompatibleDC (hdc=0x70107fc) returned 0xa010d62
	[0141.115] SelectObject (hdc=0xa010d62, h=0x140507d2) returned 0x185000f
	[0141.115] GdipCreateFromHDC (hdc=0xa010d62, graphics=0x20d7e0) returned 0x0
	[0141.115] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0141.115] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0141.116] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0141.116] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.116] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0141.116] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.116] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.116] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.116] GdipCreateRegion (region=0x20d910) returned 0x0
	[0141.118] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.118] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0141.118] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0141.118] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc5c0dbd) returned 0x0
	[0141.118] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.119] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0141.119] GetCurrentObject (hdc=0xa010d62, type=0x1) returned 0x1b00017
	[0141.119] GetCurrentObject (hdc=0xa010d62, type=0x2) returned 0x1900010
	[0141.119] GetCurrentObject (hdc=0xa010d62, type=0x7) returned 0x140507d2
	[0141.119] GetCurrentObject (hdc=0xa010d62, type=0x6) returned 0x18a002e
	[0141.119] SaveDC (hdc=0xa010d62) returned 1
	[0141.120] GetNearestColor (hdc=0xa010d62, color=0xf0f0f0) returned 0xf0f0f0
	[0141.120] GetNearestColor (hdc=0xa010d62, color=0xa0a0a0) returned 0xa0a0a0
	[0141.120] GetNearestColor (hdc=0xa010d62, color=0x696969) returned 0x696969
	[0141.120] GetNearestColor (hdc=0xa010d62, color=0xa0a0a0) returned 0xa0a0a0
	[0141.120] GetNearestColor (hdc=0xa010d62, color=0x0) returned 0x0
	[0141.121] GetNearestColor (hdc=0xa010d62, color=0xffffff) returned 0xffffff
	[0141.122] GetNearestColor (hdc=0xa010d62, color=0xe5e5e5) returned 0xe5e5e5
	[0141.122] GetNearestColor (hdc=0xa010d62, color=0xd8d8d8) returned 0xd8d8d8
	[0141.122] GetNearestColor (hdc=0xa010d62, color=0x0) returned 0x0
	[0141.122] RestoreDC (hdc=0xa010d62, nSavedDC=-1) returned 1
	[0141.122] GdipReleaseDC (graphics=0x1b929550, hdc=0xa010d62) returned 0x0
	[0141.123] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.123] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.123] CoTaskMemFree (pv=0x1b067980) 
	[0141.123] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0141.123] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.123] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.123] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.124] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0141.124] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0141.124] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0141.124] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0141.124] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0141.124] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.124] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.125] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.125] CoTaskMemFree (pv=0x1b067980) 
	[0141.125] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0141.127] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0141.128] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0141.128] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0141.128] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.128] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.128] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.128] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0141.129] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.129] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0141.129] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.129] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.130] CoTaskMemFree (pv=0x1b067980) 
	[0141.130] GdipCreateRegion (region=0x20d120) returned 0x0
	[0141.130] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.130] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0141.130] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0141.130] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0141.130] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0141.131] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.131] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0141.131] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.131] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0141.131] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0141.131] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0141.131] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0141.132] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.132] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0141.132] GetCurrentObject (hdc=0xa010d62, type=0x1) returned 0x1b00017
	[0141.132] GetCurrentObject (hdc=0xa010d62, type=0x2) returned 0x1900010
	[0141.132] GetCurrentObject (hdc=0xa010d62, type=0x7) returned 0x140507d2
	[0141.132] GetCurrentObject (hdc=0xa010d62, type=0x6) returned 0x18a002e
	[0141.132] SaveDC (hdc=0xa010d62) returned 1
	[0141.133] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffde040710
	[0141.133] GetClipRgn (hdc=0xa010d62, hrgn=0xffffffffde040710) returned 0
	[0141.133] SelectClipRgn (hdc=0xa010d62, hrgn=0x490407f9) returned 2
	[0141.133] DeleteObject (ho=0xffffffffde040710) returned 1
	[0141.134] DeleteObject (ho=0x490407f9) returned 1
	[0141.134] OffsetViewportOrgEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x26f12f0 | out: lppt=0x26f12f0) returned 1
	[0141.134] GetNearestColor (hdc=0xa010d62, color=0xf0f0f0) returned 0xf0f0f0
	[0141.134] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff801007c0
	[0141.134] FillRect (hDC=0xa010d62, lprc=0x20d1d0, hbr=0xffffffff801007c0) returned 1
	[0141.134] DeleteObject (ho=0xffffffff801007c0) returned 1
	[0141.135] RestoreDC (hdc=0xa010d62, nSavedDC=-1) returned 1
	[0141.135] GdipReleaseDC (graphics=0x1b929550, hdc=0xa010d62) returned 0x0
	[0141.135] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.135] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.135] CoTaskMemFree (pv=0x1b067980) 
	[0141.135] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0141.135] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.136] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.136] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.136] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0141.136] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0141.136] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0141.136] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.136] GetFocus () returned 0x401b4
	[0141.137] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.137] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.137] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.137] CoTaskMemFree (pv=0x1b067980) 
	[0141.137] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0141.137] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0141.137] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0141.137] GdipCreateRegion (region=0x20d070) returned 0x0
	[0141.138] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.138] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0141.138] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.138] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0141.138] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.138] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.138] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.139] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.139] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.139] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0141.139] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0141.139] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0141.139] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.139] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0141.140] GetCurrentObject (hdc=0xa010d62, type=0x1) returned 0x1b00017
	[0141.140] GetCurrentObject (hdc=0xa010d62, type=0x2) returned 0x1900010
	[0141.140] GetCurrentObject (hdc=0xa010d62, type=0x7) returned 0x140507d2
	[0141.140] GetCurrentObject (hdc=0xa010d62, type=0x6) returned 0x18a002e
	[0141.140] SaveDC (hdc=0xa010d62) returned 1
	[0141.140] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4a0407f9
	[0141.140] GetClipRgn (hdc=0xa010d62, hrgn=0x4a0407f9) returned 0
	[0141.141] SelectClipRgn (hdc=0xa010d62, hrgn=0xffffffffdf040710) returned 2
	[0141.141] DeleteObject (ho=0x4a0407f9) returned 1
	[0141.141] DeleteObject (ho=0xffffffffdf040710) returned 1
	[0141.141] OffsetViewportOrgEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x26f1890 | out: lppt=0x26f1890) returned 1
	[0141.141] GetROP2 (hdc=0xa010d62) returned 13
	[0141.141] GetBkMode (hdc=0xa010d62) returned 2
	[0141.141] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.142] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3300d64
	[0141.142] SelectObject (hdc=0xa010d62, h=0x3300d64) returned 0x1b00017
	[0141.142] MoveToEx (in: hdc=0xa010d62, x=164, y=1, lppt=0x26f18f8 | out: lppt=0x26f18f8) returned 1
	[0141.142] LineTo (hdc=0xa010d62, x=1, y=1) returned 1
	[0141.142] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.142] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.142] GetROP2 (hdc=0xa010d62) returned 13
	[0141.143] GetBkMode (hdc=0xa010d62) returned 2
	[0141.143] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.143] SelectObject (hdc=0xa010d62, h=0x3300d64) returned 0x3300d64
	[0141.143] MoveToEx (in: hdc=0xa010d62, x=1, y=1, lppt=0x26f1910 | out: lppt=0x26f1910) returned 1
	[0141.143] LineTo (hdc=0xa010d62, x=1, y=41) returned 1
	[0141.143] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.143] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.143] SelectObject (hdc=0xa010d62, h=0x1b00017) returned 0x3300d64
	[0141.144] DeleteObject (ho=0x3300d64) returned 1
	[0141.144] GetROP2 (hdc=0xa010d62) returned 13
	[0141.144] GetBkMode (hdc=0xa010d62) returned 2
	[0141.144] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.144] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1300d65
	[0141.144] SelectObject (hdc=0xa010d62, h=0x1300d65) returned 0x1b00017
	[0141.145] MoveToEx (in: hdc=0xa010d62, x=1, y=41, lppt=0x26f1978 | out: lppt=0x26f1978) returned 1
	[0141.168] LineTo (hdc=0xa010d62, x=164, y=41) returned 1
	[0141.168] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.168] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.168] GetROP2 (hdc=0xa010d62) returned 13
	[0141.168] GetBkMode (hdc=0xa010d62) returned 2
	[0141.168] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.168] SelectObject (hdc=0xa010d62, h=0x1300d65) returned 0x1300d65
	[0141.169] MoveToEx (in: hdc=0xa010d62, x=164, y=41, lppt=0x26f1990 | out: lppt=0x26f1990) returned 1
	[0141.169] LineTo (hdc=0xa010d62, x=164, y=0) returned 1
	[0141.169] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.169] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.169] SelectObject (hdc=0xa010d62, h=0x1b00017) returned 0x1300d65
	[0141.169] DeleteObject (ho=0x1300d65) returned 1
	[0141.169] GetROP2 (hdc=0xa010d62) returned 13
	[0141.170] GetBkMode (hdc=0xa010d62) returned 2
	[0141.170] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.170] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4300d64
	[0141.170] SelectObject (hdc=0xa010d62, h=0x4300d64) returned 0x1b00017
	[0141.170] MoveToEx (in: hdc=0xa010d62, x=163, y=2, lppt=0x26f19f8 | out: lppt=0x26f19f8) returned 1
	[0141.170] LineTo (hdc=0xa010d62, x=2, y=2) returned 1
	[0141.171] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.171] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.171] GetROP2 (hdc=0xa010d62) returned 13
	[0141.171] GetBkMode (hdc=0xa010d62) returned 2
	[0141.171] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.171] SelectObject (hdc=0xa010d62, h=0x4300d64) returned 0x4300d64
	[0141.171] MoveToEx (in: hdc=0xa010d62, x=2, y=2, lppt=0x26f1a10 | out: lppt=0x26f1a10) returned 1
	[0141.171] LineTo (hdc=0xa010d62, x=2, y=40) returned 1
	[0141.172] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.172] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.172] SelectObject (hdc=0xa010d62, h=0x1b00017) returned 0x4300d64
	[0141.172] DeleteObject (ho=0x4300d64) returned 1
	[0141.172] GetROP2 (hdc=0xa010d62) returned 13
	[0141.172] GetBkMode (hdc=0xa010d62) returned 2
	[0141.172] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.173] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2300d65
	[0141.173] SelectObject (hdc=0xa010d62, h=0x2300d65) returned 0x1b00017
	[0141.173] MoveToEx (in: hdc=0xa010d62, x=2, y=40, lppt=0x26f1a78 | out: lppt=0x26f1a78) returned 1
	[0141.173] LineTo (hdc=0xa010d62, x=163, y=40) returned 1
	[0141.173] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.173] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.173] GetROP2 (hdc=0xa010d62) returned 13
	[0141.174] GetBkMode (hdc=0xa010d62) returned 2
	[0141.174] SetBkMode (hdc=0xa010d62, mode=1) returned 2
	[0141.174] SelectObject (hdc=0xa010d62, h=0x2300d65) returned 0x2300d65
	[0141.174] MoveToEx (in: hdc=0xa010d62, x=163, y=40, lppt=0x26f1a90 | out: lppt=0x26f1a90) returned 1
	[0141.174] LineTo (hdc=0xa010d62, x=163, y=1) returned 1
	[0141.174] SetBkMode (hdc=0xa010d62, mode=2) returned 1
	[0141.174] MoveToEx (in: hdc=0xa010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.175] SelectObject (hdc=0xa010d62, h=0x1b00017) returned 0x2300d65
	[0141.175] DeleteObject (ho=0x2300d65) returned 1
	[0141.175] RestoreDC (hdc=0xa010d62, nSavedDC=-1) returned 1
	[0141.175] GdipReleaseDC (graphics=0x1b929550, hdc=0xa010d62) returned 0x0
	[0141.175] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0141.175] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0xa010d62, x1=0, y1=0, rop=0xcc0020) returned 1
	[0141.175] GdipReleaseDC (graphics=0x1b929550, hdc=0xa010d62) returned 0x0
	[0141.176] SelectObject (hdc=0xa010d62, h=0x185000f) returned 0x140507d2
	[0141.176] DeleteDC (hdc=0xa010d62) returned 1
	[0141.176] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0141.176] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0141.176] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0141.176] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.176] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.176] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.177] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.177] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.177] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.177] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.177] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.177] GetKeyState (nVirtKey=1) returned 1
	[0141.177] GetKeyState (nVirtKey=2) returned 0
	[0141.177] GetKeyState (nVirtKey=4) returned 0
	[0141.177] GetKeyState (nVirtKey=5) returned 0
	[0141.177] GetKeyState (nVirtKey=6) returned 0
	[0141.177] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.177] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0141.177] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.177] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.177] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.177] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0141.177] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0141.177] CreateCompatibleDC (hdc=0x4010280) returned 0xc010d62
	[0141.177] SelectObject (hdc=0xc010d62, h=0x140507d2) returned 0x185000f
	[0141.178] GdipCreateFromHDC (hdc=0xc010d62, graphics=0x20d7e0) returned 0x0
	[0141.178] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0141.178] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0141.178] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0141.178] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0141.178] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0141.178] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0141.179] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.179] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0141.179] GdipCreateRegion (region=0x20d910) returned 0x0
	[0141.179] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.179] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0141.179] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0141.179] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc590dbd) returned 0x0
	[0141.180] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.180] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0141.180] GetCurrentObject (hdc=0xc010d62, type=0x1) returned 0x1b00017
	[0141.180] GetCurrentObject (hdc=0xc010d62, type=0x2) returned 0x1900010
	[0141.180] GetCurrentObject (hdc=0xc010d62, type=0x7) returned 0x140507d2
	[0141.181] GetCurrentObject (hdc=0xc010d62, type=0x6) returned 0x18a002e
	[0141.181] SaveDC (hdc=0xc010d62) returned 1
	[0141.181] GetNearestColor (hdc=0xc010d62, color=0xf0f0f0) returned 0xf0f0f0
	[0141.182] GetNearestColor (hdc=0xc010d62, color=0xa0a0a0) returned 0xa0a0a0
	[0141.182] GetNearestColor (hdc=0xc010d62, color=0x696969) returned 0x696969
	[0141.182] GetNearestColor (hdc=0xc010d62, color=0xa0a0a0) returned 0xa0a0a0
	[0141.182] GetNearestColor (hdc=0xc010d62, color=0x0) returned 0x0
	[0141.182] GetNearestColor (hdc=0xc010d62, color=0xffffff) returned 0xffffff
	[0141.182] GetNearestColor (hdc=0xc010d62, color=0xe5e5e5) returned 0xe5e5e5
	[0141.183] GetNearestColor (hdc=0xc010d62, color=0xd8d8d8) returned 0xd8d8d8
	[0141.183] GetNearestColor (hdc=0xc010d62, color=0x0) returned 0x0
	[0141.183] RestoreDC (hdc=0xc010d62, nSavedDC=-1) returned 1
	[0141.183] GdipReleaseDC (graphics=0x1b929550, hdc=0xc010d62) returned 0x0
	[0141.183] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.184] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.184] CoTaskMemFree (pv=0x1b067980) 
	[0141.184] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0141.184] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.184] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.184] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.184] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0141.184] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0141.184] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0141.185] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0141.185] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0141.185] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.185] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.185] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.185] CoTaskMemFree (pv=0x1b067980) 
	[0141.185] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0141.185] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0141.186] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0141.186] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0141.186] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.186] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.186] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.186] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0141.186] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.187] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0141.187] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.187] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.187] CoTaskMemFree (pv=0x1b067980) 
	[0141.187] GdipCreateRegion (region=0x20d120) returned 0x0
	[0141.187] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.187] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0141.187] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.188] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0141.188] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.188] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.188] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.188] LocalFree (hMem=0x1b07c780) returned 0x0
	[0141.188] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.188] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0141.189] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0141.189] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0141.189] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.189] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0141.189] GetCurrentObject (hdc=0xc010d62, type=0x1) returned 0x1b00017
	[0141.189] GetCurrentObject (hdc=0xc010d62, type=0x2) returned 0x1900010
	[0141.189] GetCurrentObject (hdc=0xc010d62, type=0x7) returned 0x140507d2
	[0141.190] GetCurrentObject (hdc=0xc010d62, type=0x6) returned 0x18a002e
	[0141.190] SaveDC (hdc=0xc010d62) returned 1
	[0141.190] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe0040710
	[0141.190] GetClipRgn (hdc=0xc010d62, hrgn=0xffffffffe0040710) returned 0
	[0141.190] SelectClipRgn (hdc=0xc010d62, hrgn=0x4b0407f9) returned 2
	[0141.190] DeleteObject (ho=0xffffffffe0040710) returned 1
	[0141.190] DeleteObject (ho=0x4b0407f9) returned 1
	[0141.191] OffsetViewportOrgEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x26f2718 | out: lppt=0x26f2718) returned 1
	[0141.191] GetNearestColor (hdc=0xc010d62, color=0xf0f0f0) returned 0xf0f0f0
	[0141.191] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff811007c0
	[0141.191] FillRect (hDC=0xc010d62, lprc=0x20d1d0, hbr=0xffffffff811007c0) returned 1
	[0141.191] DeleteObject (ho=0xffffffff811007c0) returned 1
	[0141.192] RestoreDC (hdc=0xc010d62, nSavedDC=-1) returned 1
	[0141.192] GdipReleaseDC (graphics=0x1b929550, hdc=0xc010d62) returned 0x0
	[0141.192] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.192] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.192] CoTaskMemFree (pv=0x1b067980) 
	[0141.192] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0141.192] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.192] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.193] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.193] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0141.193] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0141.193] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0141.193] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.193] GetFocus () returned 0x401b4
	[0141.194] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.194] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0141.194] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.194] CoTaskMemFree (pv=0x1b067980) 
	[0141.194] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0141.194] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0141.195] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0141.195] GdipCreateRegion (region=0x20d070) returned 0x0
	[0141.195] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.195] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0141.195] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0141.196] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0141.196] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0141.196] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0141.196] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0141.196] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0141.196] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0141.197] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0141.197] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.197] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0141.197] GetCurrentObject (hdc=0xc010d62, type=0x1) returned 0x1b00017
	[0141.197] GetCurrentObject (hdc=0xc010d62, type=0x2) returned 0x1900010
	[0141.197] GetCurrentObject (hdc=0xc010d62, type=0x7) returned 0x140507d2
	[0141.197] GetCurrentObject (hdc=0xc010d62, type=0x6) returned 0x18a002e
	[0141.198] SaveDC (hdc=0xc010d62) returned 1
	[0141.198] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4c0407f9
	[0141.198] GetClipRgn (hdc=0xc010d62, hrgn=0x4c0407f9) returned 0
	[0141.198] SelectClipRgn (hdc=0xc010d62, hrgn=0xffffffffe1040710) returned 2
	[0141.198] DeleteObject (ho=0x4c0407f9) returned 1
	[0141.198] DeleteObject (ho=0xffffffffe1040710) returned 1
	[0141.198] OffsetViewportOrgEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x26f2cb8 | out: lppt=0x26f2cb8) returned 1
	[0141.199] GetROP2 (hdc=0xc010d62) returned 13
	[0141.199] GetBkMode (hdc=0xc010d62) returned 2
	[0141.199] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.199] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3300d65
	[0141.199] SelectObject (hdc=0xc010d62, h=0x3300d65) returned 0x1b00017
	[0141.199] MoveToEx (in: hdc=0xc010d62, x=126, y=1, lppt=0x26f2d20 | out: lppt=0x26f2d20) returned 1
	[0141.199] LineTo (hdc=0xc010d62, x=1, y=1) returned 1
	[0141.200] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.200] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.200] GetROP2 (hdc=0xc010d62) returned 13
	[0141.200] GetBkMode (hdc=0xc010d62) returned 2
	[0141.200] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.200] SelectObject (hdc=0xc010d62, h=0x3300d65) returned 0x3300d65
	[0141.200] MoveToEx (in: hdc=0xc010d62, x=1, y=1, lppt=0x26f2d38 | out: lppt=0x26f2d38) returned 1
	[0141.201] LineTo (hdc=0xc010d62, x=1, y=39) returned 1
	[0141.201] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.201] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.201] SelectObject (hdc=0xc010d62, h=0x1b00017) returned 0x3300d65
	[0141.201] DeleteObject (ho=0x3300d65) returned 1
	[0141.201] GetROP2 (hdc=0xc010d62) returned 13
	[0141.201] GetBkMode (hdc=0xc010d62) returned 2
	[0141.201] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.202] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x5300d64
	[0141.202] SelectObject (hdc=0xc010d62, h=0x5300d64) returned 0x1b00017
	[0141.202] MoveToEx (in: hdc=0xc010d62, x=1, y=39, lppt=0x26f2da0 | out: lppt=0x26f2da0) returned 1
	[0141.202] LineTo (hdc=0xc010d62, x=126, y=39) returned 1
	[0141.202] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.202] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.203] GetROP2 (hdc=0xc010d62) returned 13
	[0141.203] GetBkMode (hdc=0xc010d62) returned 2
	[0141.203] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.203] SelectObject (hdc=0xc010d62, h=0x5300d64) returned 0x5300d64
	[0141.203] MoveToEx (in: hdc=0xc010d62, x=126, y=39, lppt=0x26f2db8 | out: lppt=0x26f2db8) returned 1
	[0141.203] LineTo (hdc=0xc010d62, x=126, y=0) returned 1
	[0141.203] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.204] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.204] SelectObject (hdc=0xc010d62, h=0x1b00017) returned 0x5300d64
	[0141.204] DeleteObject (ho=0x5300d64) returned 1
	[0141.204] GetROP2 (hdc=0xc010d62) returned 13
	[0141.204] GetBkMode (hdc=0xc010d62) returned 2
	[0141.204] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.204] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4300d65
	[0141.205] SelectObject (hdc=0xc010d62, h=0x4300d65) returned 0x1b00017
	[0141.205] MoveToEx (in: hdc=0xc010d62, x=125, y=2, lppt=0x26f2e20 | out: lppt=0x26f2e20) returned 1
	[0141.205] LineTo (hdc=0xc010d62, x=2, y=2) returned 1
	[0141.205] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.205] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.205] GetROP2 (hdc=0xc010d62) returned 13
	[0141.205] GetBkMode (hdc=0xc010d62) returned 2
	[0141.206] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.206] SelectObject (hdc=0xc010d62, h=0x4300d65) returned 0x4300d65
	[0141.206] MoveToEx (in: hdc=0xc010d62, x=2, y=2, lppt=0x26f2e38 | out: lppt=0x26f2e38) returned 1
	[0141.206] LineTo (hdc=0xc010d62, x=2, y=38) returned 1
	[0141.206] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.206] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.206] SelectObject (hdc=0xc010d62, h=0x1b00017) returned 0x4300d65
	[0141.206] DeleteObject (ho=0x4300d65) returned 1
	[0141.207] GetROP2 (hdc=0xc010d62) returned 13
	[0141.207] GetBkMode (hdc=0xc010d62) returned 2
	[0141.207] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.207] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x6300d64
	[0141.208] SelectObject (hdc=0xc010d62, h=0x6300d64) returned 0x1b00017
	[0141.208] MoveToEx (in: hdc=0xc010d62, x=2, y=38, lppt=0x26f2ea0 | out: lppt=0x26f2ea0) returned 1
	[0141.208] LineTo (hdc=0xc010d62, x=125, y=38) returned 1
	[0141.208] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.208] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.208] GetROP2 (hdc=0xc010d62) returned 13
	[0141.208] GetBkMode (hdc=0xc010d62) returned 2
	[0141.209] SetBkMode (hdc=0xc010d62, mode=1) returned 2
	[0141.209] SelectObject (hdc=0xc010d62, h=0x6300d64) returned 0x6300d64
	[0141.209] MoveToEx (in: hdc=0xc010d62, x=125, y=38, lppt=0x26f2eb8 | out: lppt=0x26f2eb8) returned 1
	[0141.209] LineTo (hdc=0xc010d62, x=125, y=1) returned 1
	[0141.209] SetBkMode (hdc=0xc010d62, mode=2) returned 1
	[0141.209] MoveToEx (in: hdc=0xc010d62, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.209] SelectObject (hdc=0xc010d62, h=0x1b00017) returned 0x6300d64
	[0141.210] DeleteObject (ho=0x6300d64) returned 1
	[0141.210] RestoreDC (hdc=0xc010d62, nSavedDC=-1) returned 1
	[0141.210] GdipReleaseDC (graphics=0x1b929550, hdc=0xc010d62) returned 0x0
	[0141.210] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0141.210] BitBlt (hdc=0x4010280, x=0, y=0, cx=128, cy=41, hdcSrc=0xc010d62, x1=0, y1=0, rop=0xcc0020) returned 1
	[0141.210] GdipReleaseDC (graphics=0x1b929550, hdc=0xc010d62) returned 0x0
	[0141.211] SelectObject (hdc=0xc010d62, h=0x185000f) returned 0x140507d2
	[0141.211] DeleteDC (hdc=0xc010d62) returned 1
	[0141.211] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0141.211] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0141.211] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0141.211] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.211] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.211] WaitMessage () returned 1
	[0141.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.223] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.223] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.223] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.223] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.223] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.223] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.223] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.223] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.223] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x140054) returned 0x0
	[0141.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.223] WaitMessage () returned 1
	[0141.265] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.265] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.265] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.265] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.265] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.265] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.265] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.265] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.265] GetKeyState (nVirtKey=1) returned 1
	[0141.265] GetKeyState (nVirtKey=2) returned 0
	[0141.265] GetKeyState (nVirtKey=4) returned 0
	[0141.265] GetKeyState (nVirtKey=5) returned 0
	[0141.265] GetKeyState (nVirtKey=6) returned 0
	[0141.265] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.265] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.266] WaitMessage () returned 1
	[0141.266] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.266] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.267] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.267] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.267] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.267] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.267] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.267] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.267] GetKeyState (nVirtKey=1) returned 1
	[0141.267] GetKeyState (nVirtKey=2) returned 0
	[0141.267] GetKeyState (nVirtKey=4) returned 0
	[0141.267] GetKeyState (nVirtKey=5) returned 0
	[0141.267] GetKeyState (nVirtKey=6) returned 0
	[0141.267] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.267] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.267] WaitMessage () returned 1
	[0141.268] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.268] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.268] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.268] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.268] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.268] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.268] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.268] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.268] GetKeyState (nVirtKey=1) returned 1
	[0141.268] GetKeyState (nVirtKey=2) returned 0
	[0141.268] GetKeyState (nVirtKey=4) returned 0
	[0141.268] GetKeyState (nVirtKey=5) returned 0
	[0141.268] GetKeyState (nVirtKey=6) returned 0
	[0141.268] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.268] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.268] WaitMessage () returned 1
	[0141.269] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.269] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.269] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.269] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.269] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.269] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.269] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.269] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.269] GetKeyState (nVirtKey=1) returned 1
	[0141.269] GetKeyState (nVirtKey=2) returned 0
	[0141.269] GetKeyState (nVirtKey=4) returned 0
	[0141.269] GetKeyState (nVirtKey=5) returned 0
	[0141.269] GetKeyState (nVirtKey=6) returned 0
	[0141.269] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.269] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.269] WaitMessage () returned 1
	[0141.270] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.270] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.270] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.270] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.270] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.271] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.271] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.271] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.271] GetKeyState (nVirtKey=1) returned 1
	[0141.271] GetKeyState (nVirtKey=2) returned 0
	[0141.271] GetKeyState (nVirtKey=4) returned 0
	[0141.271] GetKeyState (nVirtKey=5) returned 0
	[0141.271] GetKeyState (nVirtKey=6) returned 0
	[0141.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.271] WaitMessage () returned 1
	[0141.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.271] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.272] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.272] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.272] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.272] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.272] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.272] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.272] GetKeyState (nVirtKey=1) returned 1
	[0141.272] GetKeyState (nVirtKey=2) returned 0
	[0141.272] GetKeyState (nVirtKey=4) returned 0
	[0141.272] GetKeyState (nVirtKey=5) returned 0
	[0141.272] GetKeyState (nVirtKey=6) returned 0
	[0141.272] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.272] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.272] WaitMessage () returned 1
	[0141.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.273] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.273] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.273] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.273] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.273] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.273] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.273] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.273] GetKeyState (nVirtKey=1) returned 1
	[0141.273] GetKeyState (nVirtKey=2) returned 0
	[0141.273] GetKeyState (nVirtKey=4) returned 0
	[0141.273] GetKeyState (nVirtKey=5) returned 0
	[0141.273] GetKeyState (nVirtKey=6) returned 0
	[0141.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.273] WaitMessage () returned 1
	[0141.274] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.274] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.274] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.274] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.274] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.274] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.274] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.274] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.274] GetKeyState (nVirtKey=1) returned 1
	[0141.274] GetKeyState (nVirtKey=2) returned 0
	[0141.274] GetKeyState (nVirtKey=4) returned 0
	[0141.274] GetKeyState (nVirtKey=5) returned 0
	[0141.274] GetKeyState (nVirtKey=6) returned 0
	[0141.274] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.274] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.274] WaitMessage () returned 1
	[0141.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.276] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.276] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.276] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.276] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.276] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.276] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.276] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.276] GetKeyState (nVirtKey=1) returned 1
	[0141.276] GetKeyState (nVirtKey=2) returned 0
	[0141.276] GetKeyState (nVirtKey=4) returned 0
	[0141.276] GetKeyState (nVirtKey=5) returned 0
	[0141.276] GetKeyState (nVirtKey=6) returned 0
	[0141.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.276] WaitMessage () returned 1
	[0141.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.277] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.277] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.277] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.277] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.277] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.277] GetKeyState (nVirtKey=1) returned 1
	[0141.277] GetKeyState (nVirtKey=2) returned 0
	[0141.277] GetKeyState (nVirtKey=4) returned 0
	[0141.277] GetKeyState (nVirtKey=5) returned 0
	[0141.278] GetKeyState (nVirtKey=6) returned 0
	[0141.278] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.278] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.278] WaitMessage () returned 1
	[0141.280] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.280] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.280] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.280] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.280] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.280] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.280] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.280] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.280] GetKeyState (nVirtKey=1) returned 1
	[0141.280] GetKeyState (nVirtKey=2) returned 0
	[0141.280] GetKeyState (nVirtKey=4) returned 0
	[0141.280] GetKeyState (nVirtKey=5) returned 0
	[0141.281] GetKeyState (nVirtKey=6) returned 0
	[0141.281] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.281] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.281] WaitMessage () returned 1
	[0141.284] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.284] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.284] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.284] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.284] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.284] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.284] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.284] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.284] GetKeyState (nVirtKey=1) returned 1
	[0141.284] GetKeyState (nVirtKey=2) returned 0
	[0141.284] GetKeyState (nVirtKey=4) returned 0
	[0141.284] GetKeyState (nVirtKey=5) returned 0
	[0141.284] GetKeyState (nVirtKey=6) returned 0
	[0141.284] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.284] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.284] WaitMessage () returned 1
	[0141.286] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.286] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.286] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.286] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.286] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.286] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.286] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.286] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.286] GetKeyState (nVirtKey=1) returned 1
	[0141.286] GetKeyState (nVirtKey=2) returned 0
	[0141.286] GetKeyState (nVirtKey=4) returned 0
	[0141.286] GetKeyState (nVirtKey=5) returned 0
	[0141.286] GetKeyState (nVirtKey=6) returned 0
	[0141.286] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.286] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0141.286] WaitMessage () returned 1
	[0141.350] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.350] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.350] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.351] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.351] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.351] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0141.351] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe00130) returned 0x0
	[0141.351] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0141.351] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0141.351] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x0, lParam=0x201a6) returned 0x1
	[0141.351] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0141.351] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0141.352] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0141.353] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x50120) returned 0x1
	[0141.353] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0141.353] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0141.353] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0141.354] GetFocus () returned 0x401b4
	[0141.354] SetFocus (hWnd=0x201d8) returned 0x401b4
	[0141.354] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x8, wParam=0x201d8, lParam=0x0) returned 0x0
	[0141.354] GetStockObject (i=5) returned 0x1900015
	[0141.354] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0141.354] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0141.354] GetCapture () returned 0x0
	[0141.354] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0141.355] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0141.355] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0141.355] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0141.355] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0141.355] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0141.355] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x401b4, lParam=0x0) returned 0x0
	[0141.355] GetStockObject (i=5) returned 0x1900015
	[0141.355] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0141.355] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0141.356] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0141.356] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0141.356] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.356] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0141.356] GetKeyState (nVirtKey=1) returned -128
	[0141.356] GetKeyState (nVirtKey=2) returned 0
	[0141.356] GetKeyState (nVirtKey=4) returned 0
	[0141.356] GetKeyState (nVirtKey=5) returned 0
	[0141.356] GetKeyState (nVirtKey=6) returned 0
	[0141.356] IsWindowVisible (hWnd=0x201d8) returned 1
	[0141.356] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0141.356] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0141.356] GetFocus () returned 0x201d8
	[0141.356] GetFocus () returned 0x201d8
	[0141.356] GetFocus () returned 0x201d8
	[0141.356] GetKeyState (nVirtKey=1) returned -128
	[0141.356] GetKeyState (nVirtKey=2) returned 0
	[0141.356] GetKeyState (nVirtKey=4) returned 0
	[0141.356] GetKeyState (nVirtKey=5) returned 0
	[0141.356] GetKeyState (nVirtKey=6) returned 0
	[0141.356] GetCapture () returned 0x0
	[0141.356] SetCapture (hWnd=0x201d8) returned 0x0
	[0141.356] GetKeyState (nVirtKey=1) returned -128
	[0141.356] GetKeyState (nVirtKey=2) returned 0
	[0141.356] GetKeyState (nVirtKey=4) returned 0
	[0141.356] GetKeyState (nVirtKey=5) returned 0
	[0141.356] GetKeyState (nVirtKey=6) returned 0
	[0141.356] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0141.356] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0141.356] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.356] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.356] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.357] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0141.357] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.357] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.357] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.357] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0141.357] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.357] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0141.357] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0141.357] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0141.357] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0141.357] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26f3548, cPoints=0x1 | out: lpPoints=0x26f3548) returned 30606029
	[0141.357] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0141.357] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0141.357] UpdateWindow (hWnd=0x201d8) returned 1
	[0141.357] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0141.357] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0141.357] CreateCompatibleDC (hdc=0x4010280) returned 0x5a010cee
	[0141.357] SelectObject (hdc=0x5a010cee, h=0x140507d2) returned 0x185000f
	[0141.358] GdipCreateFromHDC (hdc=0x5a010cee, graphics=0x20cfa0) returned 0x0
	[0141.358] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0141.358] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0141.358] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0141.358] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.358] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0141.358] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.359] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.359] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0141.359] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.359] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0141.359] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0141.359] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc560dbd) returned 0x0
	[0141.359] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.360] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0141.360] GetCurrentObject (hdc=0x5a010cee, type=0x1) returned 0x1b00017
	[0141.360] GetCurrentObject (hdc=0x5a010cee, type=0x2) returned 0x1900010
	[0141.360] GetCurrentObject (hdc=0x5a010cee, type=0x7) returned 0x140507d2
	[0141.360] GetCurrentObject (hdc=0x5a010cee, type=0x6) returned 0x18a002e
	[0141.360] SaveDC (hdc=0x5a010cee) returned 1
	[0141.361] GetNearestColor (hdc=0x5a010cee, color=0xf0f0f0) returned 0xf0f0f0
	[0141.361] GetNearestColor (hdc=0x5a010cee, color=0xa0a0a0) returned 0xa0a0a0
	[0141.361] GetNearestColor (hdc=0x5a010cee, color=0x696969) returned 0x696969
	[0141.361] GetNearestColor (hdc=0x5a010cee, color=0xa0a0a0) returned 0xa0a0a0
	[0141.361] GetNearestColor (hdc=0x5a010cee, color=0x0) returned 0x0
	[0141.361] GetNearestColor (hdc=0x5a010cee, color=0xffffff) returned 0xffffff
	[0141.361] GetNearestColor (hdc=0x5a010cee, color=0xe5e5e5) returned 0xe5e5e5
	[0141.362] GetNearestColor (hdc=0x5a010cee, color=0xd8d8d8) returned 0xd8d8d8
	[0141.362] GetNearestColor (hdc=0x5a010cee, color=0x0) returned 0x0
	[0141.362] RestoreDC (hdc=0x5a010cee, nSavedDC=-1) returned 1
	[0141.362] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010cee) returned 0x0
	[0141.362] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0141.363] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.363] CoTaskMemFree (pv=0x1b067a60) 
	[0141.363] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0141.363] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.363] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.363] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.363] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0141.363] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0141.363] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0141.364] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0141.364] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0141.364] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.364] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0141.364] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.364] CoTaskMemFree (pv=0x1b067a60) 
	[0141.364] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0141.365] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0141.365] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0141.365] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0141.365] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.365] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.365] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.365] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0141.366] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.366] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0141.366] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0141.366] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.366] CoTaskMemFree (pv=0x1b067a60) 
	[0141.366] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0141.366] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.367] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0141.367] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0141.367] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0141.367] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0141.367] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0141.367] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0141.368] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0141.368] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0141.368] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0141.368] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.368] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0141.368] GetCurrentObject (hdc=0x5a010cee, type=0x1) returned 0x1b00017
	[0141.368] GetCurrentObject (hdc=0x5a010cee, type=0x2) returned 0x1900010
	[0141.369] GetCurrentObject (hdc=0x5a010cee, type=0x7) returned 0x140507d2
	[0141.369] GetCurrentObject (hdc=0x5a010cee, type=0x6) returned 0x18a002e
	[0141.369] SaveDC (hdc=0x5a010cee) returned 1
	[0141.369] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe2040710
	[0141.369] GetClipRgn (hdc=0x5a010cee, hrgn=0xffffffffe2040710) returned 0
	[0141.369] SelectClipRgn (hdc=0x5a010cee, hrgn=0x510407f9) returned 2
	[0141.369] DeleteObject (ho=0xffffffffe2040710) returned 1
	[0141.370] DeleteObject (ho=0x510407f9) returned 1
	[0141.370] OffsetViewportOrgEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x26f41c8 | out: lppt=0x26f41c8) returned 1
	[0141.370] GetNearestColor (hdc=0x5a010cee, color=0xf0f0f0) returned 0xf0f0f0
	[0141.370] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff821007c0
	[0141.370] FillRect (hDC=0x5a010cee, lprc=0x20c990, hbr=0xffffffff821007c0) returned 1
	[0141.370] DeleteObject (ho=0xffffffff821007c0) returned 1
	[0141.370] RestoreDC (hdc=0x5a010cee, nSavedDC=-1) returned 1
	[0141.371] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010cee) returned 0x0
	[0141.371] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0141.371] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.371] CoTaskMemFree (pv=0x1b067a60) 
	[0141.371] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0141.371] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.371] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.372] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.372] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0141.372] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0141.372] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0141.372] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.372] GetFocus () returned 0x201d8
	[0141.373] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.373] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0141.373] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.373] CoTaskMemFree (pv=0x1b067a60) 
	[0141.373] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0141.373] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0141.373] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0141.373] GdipCreateRegion (region=0x20c830) returned 0x0
	[0141.373] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.374] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0141.374] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.374] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0141.374] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.374] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0141.375] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.375] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0141.375] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0141.375] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0141.375] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.375] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0141.375] GetCurrentObject (hdc=0x5a010cee, type=0x1) returned 0x1b00017
	[0141.376] GetCurrentObject (hdc=0x5a010cee, type=0x2) returned 0x1900010
	[0141.376] GetCurrentObject (hdc=0x5a010cee, type=0x7) returned 0x140507d2
	[0141.376] GetCurrentObject (hdc=0x5a010cee, type=0x6) returned 0x18a002e
	[0141.376] SaveDC (hdc=0x5a010cee) returned 1
	[0141.376] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x520407f9
	[0141.377] GetClipRgn (hdc=0x5a010cee, hrgn=0x520407f9) returned 0
	[0141.377] SelectClipRgn (hdc=0x5a010cee, hrgn=0xffffffffe3040710) returned 2
	[0141.378] DeleteObject (ho=0x520407f9) returned 1
	[0141.378] DeleteObject (ho=0xffffffffe3040710) returned 1
	[0141.378] OffsetViewportOrgEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x26f4768 | out: lppt=0x26f4768) returned 1
	[0141.378] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.378] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.378] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.378] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x65300d66
	[0141.379] SelectObject (hdc=0x5a010cee, h=0x65300d66) returned 0x1b00017
	[0141.379] MoveToEx (in: hdc=0x5a010cee, x=164, y=1, lppt=0x26f47d0 | out: lppt=0x26f47d0) returned 1
	[0141.379] LineTo (hdc=0x5a010cee, x=1, y=1) returned 1
	[0141.379] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.379] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.380] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.380] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.380] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.380] SelectObject (hdc=0x5a010cee, h=0x65300d66) returned 0x65300d66
	[0141.380] MoveToEx (in: hdc=0x5a010cee, x=1, y=1, lppt=0x26f47e8 | out: lppt=0x26f47e8) returned 1
	[0141.380] LineTo (hdc=0x5a010cee, x=1, y=41) returned 1
	[0141.380] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.380] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.381] SelectObject (hdc=0x5a010cee, h=0x1b00017) returned 0x65300d66
	[0141.381] DeleteObject (ho=0x65300d66) returned 1
	[0141.381] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.381] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.381] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.381] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x40300d63
	[0141.381] SelectObject (hdc=0x5a010cee, h=0x40300d63) returned 0x1b00017
	[0141.382] MoveToEx (in: hdc=0x5a010cee, x=1, y=41, lppt=0x26f4850 | out: lppt=0x26f4850) returned 1
	[0141.382] LineTo (hdc=0x5a010cee, x=164, y=41) returned 1
	[0141.382] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.382] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.382] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.382] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.382] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.383] SelectObject (hdc=0x5a010cee, h=0x40300d63) returned 0x40300d63
	[0141.383] MoveToEx (in: hdc=0x5a010cee, x=164, y=41, lppt=0x26f4868 | out: lppt=0x26f4868) returned 1
	[0141.383] LineTo (hdc=0x5a010cee, x=164, y=0) returned 1
	[0141.383] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.383] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.383] SelectObject (hdc=0x5a010cee, h=0x1b00017) returned 0x40300d63
	[0141.383] DeleteObject (ho=0x40300d63) returned 1
	[0141.384] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.384] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.384] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.384] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x66300d66
	[0141.384] SelectObject (hdc=0x5a010cee, h=0x66300d66) returned 0x1b00017
	[0141.384] MoveToEx (in: hdc=0x5a010cee, x=163, y=2, lppt=0x26f48d0 | out: lppt=0x26f48d0) returned 1
	[0141.384] LineTo (hdc=0x5a010cee, x=2, y=2) returned 1
	[0141.385] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.385] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.385] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.385] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.385] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.385] SelectObject (hdc=0x5a010cee, h=0x66300d66) returned 0x66300d66
	[0141.385] MoveToEx (in: hdc=0x5a010cee, x=2, y=2, lppt=0x26f48e8 | out: lppt=0x26f48e8) returned 1
	[0141.385] LineTo (hdc=0x5a010cee, x=2, y=40) returned 1
	[0141.386] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.386] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.386] SelectObject (hdc=0x5a010cee, h=0x1b00017) returned 0x66300d66
	[0141.386] DeleteObject (ho=0x66300d66) returned 1
	[0141.386] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.386] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.386] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.387] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x41300d63
	[0141.387] SelectObject (hdc=0x5a010cee, h=0x41300d63) returned 0x1b00017
	[0141.387] MoveToEx (in: hdc=0x5a010cee, x=2, y=40, lppt=0x26f4950 | out: lppt=0x26f4950) returned 1
	[0141.387] LineTo (hdc=0x5a010cee, x=163, y=40) returned 1
	[0141.387] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.387] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.387] GetROP2 (hdc=0x5a010cee) returned 13
	[0141.388] GetBkMode (hdc=0x5a010cee) returned 2
	[0141.388] SetBkMode (hdc=0x5a010cee, mode=1) returned 2
	[0141.388] SelectObject (hdc=0x5a010cee, h=0x41300d63) returned 0x41300d63
	[0141.388] MoveToEx (in: hdc=0x5a010cee, x=163, y=40, lppt=0x26f4968 | out: lppt=0x26f4968) returned 1
	[0141.388] LineTo (hdc=0x5a010cee, x=163, y=1) returned 1
	[0141.388] SetBkMode (hdc=0x5a010cee, mode=2) returned 1
	[0141.388] MoveToEx (in: hdc=0x5a010cee, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.388] SelectObject (hdc=0x5a010cee, h=0x1b00017) returned 0x41300d63
	[0141.389] DeleteObject (ho=0x41300d63) returned 1
	[0141.389] RestoreDC (hdc=0x5a010cee, nSavedDC=-1) returned 1
	[0141.389] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010cee) returned 0x0
	[0141.389] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0141.389] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x5a010cee, x1=0, y1=0, rop=0xcc0020) returned 1
	[0141.389] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010cee) returned 0x0
	[0141.390] SelectObject (hdc=0x5a010cee, h=0x185000f) returned 0x140507d2
	[0141.390] DeleteDC (hdc=0x5a010cee) returned 1
	[0141.390] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0141.390] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0141.390] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0141.390] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26f49c0, cPoints=0x1 | out: lpPoints=0x26f49c0) returned 30606029
	[0141.390] WindowFromPoint (Point=0x1e700000321) returned 0x201d8
	[0141.390] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.390] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0141.390] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0141.391] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0141.391] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26f4ab0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0141.391] ShellExecuteExW (pExecInfo=0x26f4cc0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0141.452] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0141.452] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0141.452] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0141.452] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0141.452] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0141.452] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0141.453] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0141.453] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0141.454] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0141.454] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0141.454] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) 
	[0141.454] GetStockObject (i=5) returned 0x1900015
	[0141.454] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) 
	[0141.454] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0141.455] GetCapture () returned 0x0
	[0141.455] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0141.455] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0141.455] CreateCompatibleDC (hdc=0x70107fc) returned 0x4e010d63
	[0141.455] SelectObject (hdc=0x4e010d63, h=0x140507d2) returned 0x185000f
	[0141.455] GdipCreateFromHDC (hdc=0x4e010d63, graphics=0x20c9d0) returned 0x0
	[0141.456] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0141.456] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0141.456] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0141.456] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0141.456] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0141.456] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0141.456] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0141.457] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0141.457] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.457] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0141.457] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0141.457] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc530dbd) returned 0x0
	[0141.457] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.457] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.457] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0141.457] GetCurrentObject (hdc=0x4e010d63, type=0x1) returned 0x1b00017
	[0141.457] GetCurrentObject (hdc=0x4e010d63, type=0x2) returned 0x1900010
	[0141.457] GetCurrentObject (hdc=0x4e010d63, type=0x7) returned 0x140507d2
	[0141.457] GetCurrentObject (hdc=0x4e010d63, type=0x6) returned 0x18a002e
	[0141.458] SaveDC (hdc=0x4e010d63) returned 1
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0xf0f0f0) returned 0xf0f0f0
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0xa0a0a0) returned 0xa0a0a0
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0x696969) returned 0x696969
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0xa0a0a0) returned 0xa0a0a0
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0x0) returned 0x0
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0xffffff) returned 0xffffff
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0xe5e5e5) returned 0xe5e5e5
	[0141.458] GetNearestColor (hdc=0x4e010d63, color=0xd8d8d8) returned 0xd8d8d8
	[0141.459] GetNearestColor (hdc=0x4e010d63, color=0x0) returned 0x0
	[0141.459] RestoreDC (hdc=0x4e010d63, nSavedDC=-1) returned 1
	[0141.459] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.459] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010d63) returned 0x0
	[0141.459] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.459] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.459] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.459] CoTaskMemFree (pv=0x1b077150) 
	[0141.460] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0141.460] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.460] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.460] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.460] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0141.460] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0141.460] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0141.460] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0141.460] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0141.460] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.460] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.460] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.460] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.460] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.460] CoTaskMemFree (pv=0x1b077150) 
	[0141.460] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0141.460] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0141.460] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0141.461] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0141.461] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.461] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.461] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.461] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0141.461] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.461] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.461] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.461] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0141.461] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.461] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.461] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.461] CoTaskMemFree (pv=0x1b077150) 
	[0141.461] GdipCreateRegion (region=0x20c310) returned 0x0
	[0141.461] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.461] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0141.461] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.462] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0141.462] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c740
	[0141.462] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0141.462] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0141.462] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.462] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0141.462] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0141.462] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0141.462] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.462] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.462] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0141.462] GetCurrentObject (hdc=0x4e010d63, type=0x1) returned 0x1b00017
	[0141.462] GetCurrentObject (hdc=0x4e010d63, type=0x2) returned 0x1900010
	[0141.462] GetCurrentObject (hdc=0x4e010d63, type=0x7) returned 0x140507d2
	[0141.462] GetCurrentObject (hdc=0x4e010d63, type=0x6) returned 0x18a002e
	[0141.462] SaveDC (hdc=0x4e010d63) returned 1
	[0141.462] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe4040710
	[0141.462] GetClipRgn (hdc=0x4e010d63, hrgn=0xffffffffe4040710) returned 0
	[0141.463] SelectClipRgn (hdc=0x4e010d63, hrgn=0x550407f9) returned 2
	[0141.463] DeleteObject (ho=0xffffffffe4040710) returned 1
	[0141.463] DeleteObject (ho=0x550407f9) returned 1
	[0141.463] OffsetViewportOrgEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x26f59a0 | out: lppt=0x26f59a0) returned 1
	[0141.463] GetNearestColor (hdc=0x4e010d63, color=0xf0f0f0) returned 0xf0f0f0
	[0141.463] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff831007c0
	[0141.463] FillRect (hDC=0x4e010d63, lprc=0x20c3c0, hbr=0xffffffff831007c0) returned 1
	[0141.463] DeleteObject (ho=0xffffffff831007c0) returned 1
	[0141.463] RestoreDC (hdc=0x4e010d63, nSavedDC=-1) returned 1
	[0141.463] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.463] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010d63) returned 0x0
	[0141.463] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.463] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.463] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.463] CoTaskMemFree (pv=0x1b077150) 
	[0141.463] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0141.464] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.464] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.464] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.464] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0141.464] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0141.464] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.464] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0141.464] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.464] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.464] GetFocus () returned 0x0
	[0141.464] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.464] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.464] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.464] CoTaskMemFree (pv=0x1b077150) 
	[0141.464] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0141.464] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0141.464] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.464] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0141.465] GdipCreateRegion (region=0x20c260) returned 0x0
	[0141.465] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.465] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0141.465] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0141.465] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0141.465] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c740
	[0141.465] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0141.465] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0141.465] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0141.465] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0141.465] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0141.465] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0141.465] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.465] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.465] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0141.465] GetCurrentObject (hdc=0x4e010d63, type=0x1) returned 0x1b00017
	[0141.465] GetCurrentObject (hdc=0x4e010d63, type=0x2) returned 0x1900010
	[0141.465] GetCurrentObject (hdc=0x4e010d63, type=0x7) returned 0x140507d2
	[0141.465] GetCurrentObject (hdc=0x4e010d63, type=0x6) returned 0x18a002e
	[0141.466] SaveDC (hdc=0x4e010d63) returned 1
	[0141.466] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x560407f9
	[0141.466] GetClipRgn (hdc=0x4e010d63, hrgn=0x560407f9) returned 0
	[0141.466] SelectClipRgn (hdc=0x4e010d63, hrgn=0xffffffffe5040710) returned 2
	[0141.466] DeleteObject (ho=0x560407f9) returned 1
	[0141.466] DeleteObject (ho=0xffffffffe5040710) returned 1
	[0141.466] OffsetViewportOrgEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x26f5f40 | out: lppt=0x26f5f40) returned 1
	[0141.466] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.466] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.466] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.466] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x2e300caf
	[0141.466] SelectObject (hdc=0x4e010d63, h=0x2e300caf) returned 0x1b00017
	[0141.466] MoveToEx (in: hdc=0x4e010d63, x=164, y=1, lppt=0x26f5fa8 | out: lppt=0x26f5fa8) returned 1
	[0141.466] LineTo (hdc=0x4e010d63, x=1, y=1) returned 1
	[0141.466] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.466] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.466] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.466] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.466] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.466] SelectObject (hdc=0x4e010d63, h=0x2e300caf) returned 0x2e300caf
	[0141.466] MoveToEx (in: hdc=0x4e010d63, x=1, y=1, lppt=0x26f5fc0 | out: lppt=0x26f5fc0) returned 1
	[0141.467] LineTo (hdc=0x4e010d63, x=1, y=41) returned 1
	[0141.467] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.467] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.467] SelectObject (hdc=0x4e010d63, h=0x1b00017) returned 0x2e300caf
	[0141.467] DeleteObject (ho=0x2e300caf) returned 1
	[0141.467] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.467] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.467] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.467] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x68300d66
	[0141.467] SelectObject (hdc=0x4e010d63, h=0x68300d66) returned 0x1b00017
	[0141.467] MoveToEx (in: hdc=0x4e010d63, x=1, y=41, lppt=0x26f6028 | out: lppt=0x26f6028) returned 1
	[0141.467] LineTo (hdc=0x4e010d63, x=164, y=41) returned 1
	[0141.467] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.467] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.467] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.467] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.467] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.467] SelectObject (hdc=0x4e010d63, h=0x68300d66) returned 0x68300d66
	[0141.467] MoveToEx (in: hdc=0x4e010d63, x=164, y=41, lppt=0x26f6040 | out: lppt=0x26f6040) returned 1
	[0141.467] LineTo (hdc=0x4e010d63, x=164, y=0) returned 1
	[0141.467] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.467] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.467] SelectObject (hdc=0x4e010d63, h=0x1b00017) returned 0x68300d66
	[0141.467] DeleteObject (ho=0x68300d66) returned 1
	[0141.468] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.468] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.468] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.468] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2f300caf
	[0141.468] SelectObject (hdc=0x4e010d63, h=0x2f300caf) returned 0x1b00017
	[0141.468] MoveToEx (in: hdc=0x4e010d63, x=163, y=2, lppt=0x26f60a8 | out: lppt=0x26f60a8) returned 1
	[0141.468] LineTo (hdc=0x4e010d63, x=2, y=2) returned 1
	[0141.468] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.468] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.468] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.468] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.468] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.468] SelectObject (hdc=0x4e010d63, h=0x2f300caf) returned 0x2f300caf
	[0141.468] MoveToEx (in: hdc=0x4e010d63, x=2, y=2, lppt=0x26f60c0 | out: lppt=0x26f60c0) returned 1
	[0141.468] LineTo (hdc=0x4e010d63, x=2, y=40) returned 1
	[0141.468] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.468] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.468] SelectObject (hdc=0x4e010d63, h=0x1b00017) returned 0x2f300caf
	[0141.468] DeleteObject (ho=0x2f300caf) returned 1
	[0141.468] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.468] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.468] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.468] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x69300d66
	[0141.469] SelectObject (hdc=0x4e010d63, h=0x69300d66) returned 0x1b00017
	[0141.469] MoveToEx (in: hdc=0x4e010d63, x=2, y=40, lppt=0x26f6128 | out: lppt=0x26f6128) returned 1
	[0141.469] LineTo (hdc=0x4e010d63, x=163, y=40) returned 1
	[0141.469] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.469] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.469] GetROP2 (hdc=0x4e010d63) returned 13
	[0141.469] GetBkMode (hdc=0x4e010d63) returned 2
	[0141.469] SetBkMode (hdc=0x4e010d63, mode=1) returned 2
	[0141.469] SelectObject (hdc=0x4e010d63, h=0x69300d66) returned 0x69300d66
	[0141.469] MoveToEx (in: hdc=0x4e010d63, x=163, y=40, lppt=0x26f6140 | out: lppt=0x26f6140) returned 1
	[0141.469] LineTo (hdc=0x4e010d63, x=163, y=1) returned 1
	[0141.469] SetBkMode (hdc=0x4e010d63, mode=2) returned 1
	[0141.469] MoveToEx (in: hdc=0x4e010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.469] SelectObject (hdc=0x4e010d63, h=0x1b00017) returned 0x69300d66
	[0141.469] DeleteObject (ho=0x69300d66) returned 1
	[0141.469] RestoreDC (hdc=0x4e010d63, nSavedDC=-1) returned 1
	[0141.469] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.469] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010d63) returned 0x0
	[0141.469] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0141.469] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x4e010d63, x1=0, y1=0, rop=0xcc0020) returned 1
	[0141.470] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.470] GdipReleaseDC (graphics=0x1b929550, hdc=0x4e010d63) returned 0x0
	[0141.470] SelectObject (hdc=0x4e010d63, h=0x185000f) returned 0x140507d2
	[0141.470] DeleteDC (hdc=0x4e010d63) returned 1
	[0141.470] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.470] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0141.470] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0141.470] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0141.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e70321) returned 0x1
	[0141.470] GetKeyState (nVirtKey=1) returned 0
	[0141.470] GetKeyState (nVirtKey=2) returned 0
	[0141.470] GetKeyState (nVirtKey=4) returned 0
	[0141.470] GetKeyState (nVirtKey=5) returned 0
	[0141.470] GetKeyState (nVirtKey=6) returned 0
	[0141.470] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0141.470] CreateCompatibleDC (hdc=0x10107f8) returned 0x50010d63
	[0141.470] SelectObject (hdc=0x50010d63, h=0x140507d2) returned 0x185000f
	[0141.471] GdipCreateFromHDC (hdc=0x50010d63, graphics=0x20c9d0) returned 0x0
	[0141.471] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0141.471] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0141.471] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0141.471] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.471] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0141.471] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c740
	[0141.471] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0141.471] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.471] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0141.471] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.471] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0141.471] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0141.471] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc500dbd) returned 0x0
	[0141.471] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.471] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.471] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0141.472] GetCurrentObject (hdc=0x50010d63, type=0x1) returned 0x1b00017
	[0141.472] GetCurrentObject (hdc=0x50010d63, type=0x2) returned 0x1900010
	[0141.472] GetCurrentObject (hdc=0x50010d63, type=0x7) returned 0x140507d2
	[0141.472] GetCurrentObject (hdc=0x50010d63, type=0x6) returned 0x18a002e
	[0141.472] SaveDC (hdc=0x50010d63) returned 1
	[0141.472] GetNearestColor (hdc=0x50010d63, color=0xf0f0f0) returned 0xf0f0f0
	[0141.472] GetNearestColor (hdc=0x50010d63, color=0xa0a0a0) returned 0xa0a0a0
	[0141.505] GetNearestColor (hdc=0x50010d63, color=0x696969) returned 0x696969
	[0141.505] GetNearestColor (hdc=0x50010d63, color=0xa0a0a0) returned 0xa0a0a0
	[0141.505] GetNearestColor (hdc=0x50010d63, color=0x0) returned 0x0
	[0141.505] GetNearestColor (hdc=0x50010d63, color=0xffffff) returned 0xffffff
	[0141.505] GetNearestColor (hdc=0x50010d63, color=0xe5e5e5) returned 0xe5e5e5
	[0141.505] GetNearestColor (hdc=0x50010d63, color=0xd8d8d8) returned 0xd8d8d8
	[0141.506] GetNearestColor (hdc=0x50010d63, color=0x0) returned 0x0
	[0141.506] RestoreDC (hdc=0x50010d63, nSavedDC=-1) returned 1
	[0141.506] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0141.506] GdipReleaseDC (graphics=0x1b929550, hdc=0x50010d63) returned 0x0
	[0141.506] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0141.506] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.506] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.506] CoTaskMemFree (pv=0x1b077150) 
	[0141.506] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0141.507] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.507] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.507] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.507] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0141.507] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0141.507] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0141.507] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0141.507] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0141.507] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.508] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.508] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.508] CoTaskMemFree (pv=0x1b077150) 
	[0141.508] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0141.508] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0141.508] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0141.508] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0141.509] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.509] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.509] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.509] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0141.509] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.509] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0141.510] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.510] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.510] CoTaskMemFree (pv=0x1b077150) 
	[0141.510] GdipCreateRegion (region=0x20c310) returned 0x0
	[0141.510] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.510] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0141.510] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0141.511] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0141.511] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0141.511] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0141.511] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0141.511] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0141.511] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0141.512] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0141.512] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.512] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0141.512] GetCurrentObject (hdc=0x50010d63, type=0x1) returned 0x1b00017
	[0141.512] GetCurrentObject (hdc=0x50010d63, type=0x2) returned 0x1900010
	[0141.512] GetCurrentObject (hdc=0x50010d63, type=0x7) returned 0x140507d2
	[0141.512] GetCurrentObject (hdc=0x50010d63, type=0x6) returned 0x18a002e
	[0141.513] SaveDC (hdc=0x50010d63) returned 1
	[0141.513] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe6040710
	[0141.513] GetClipRgn (hdc=0x50010d63, hrgn=0xffffffffe6040710) returned 0
	[0141.513] SelectClipRgn (hdc=0x50010d63, hrgn=0x570407f9) returned 2
	[0141.513] DeleteObject (ho=0xffffffffe6040710) returned 1
	[0141.514] DeleteObject (ho=0x570407f9) returned 1
	[0141.514] OffsetViewportOrgEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x26f6dc8 | out: lppt=0x26f6dc8) returned 1
	[0141.514] GetNearestColor (hdc=0x50010d63, color=0xf0f0f0) returned 0xf0f0f0
	[0141.514] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff841007c0
	[0141.514] GdipReleaseDC (graphics=0x1b929550, hdc=0x50010d63) returned 0x0
	[0141.514] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.515] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.515] CoTaskMemFree (pv=0x1b077150) 
	[0141.515] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0141.515] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.515] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0141.515] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0141.515] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0141.516] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0141.516] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0141.516] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0141.516] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0141.516] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0141.516] CoTaskMemFree (pv=0x1b077150) 
	[0141.516] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0141.517] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0141.517] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0141.517] GdipCreateRegion (region=0x20c260) returned 0x0
	[0141.517] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0141.517] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0141.517] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0141.518] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0141.518] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0141.518] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0141.518] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0141.518] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0141.518] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0141.518] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0141.519] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0141.519] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0141.519] GetCurrentObject (hdc=0x50010d63, type=0x1) returned 0x1b00017
	[0141.520] GetCurrentObject (hdc=0x50010d63, type=0x2) returned 0x1900010
	[0141.520] GetCurrentObject (hdc=0x50010d63, type=0x7) returned 0x140507d2
	[0141.520] GetCurrentObject (hdc=0x50010d63, type=0x6) returned 0x18a002e
	[0141.520] GetClipRgn (hdc=0x50010d63, hrgn=0x580407f9) returned 0
	[0141.520] OffsetViewportOrgEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x26f7368 | out: lppt=0x26f7368) returned 1
	[0141.520] GetROP2 (hdc=0x50010d63) returned 13
	[0141.520] GetBkMode (hdc=0x50010d63) returned 2
	[0141.521] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x4300d69
	[0141.521] MoveToEx (in: hdc=0x50010d63, x=126, y=1, lppt=0x26f73d0 | out: lppt=0x26f73d0) returned 1
	[0141.521] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.521] GetROP2 (hdc=0x50010d63) returned 13
	[0141.521] GetBkMode (hdc=0x50010d63) returned 2
	[0141.521] MoveToEx (in: hdc=0x50010d63, x=1, y=1, lppt=0x26f73e8 | out: lppt=0x26f73e8) returned 1
	[0141.521] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.522] GetROP2 (hdc=0x50010d63) returned 13
	[0141.522] GetBkMode (hdc=0x50010d63) returned 2
	[0141.522] MoveToEx (in: hdc=0x50010d63, x=1, y=39, lppt=0x26f7450 | out: lppt=0x26f7450) returned 1
	[0141.522] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.522] GetROP2 (hdc=0x50010d63) returned 13
	[0141.522] GetBkMode (hdc=0x50010d63) returned 2
	[0141.522] MoveToEx (in: hdc=0x50010d63, x=126, y=39, lppt=0x26f7468 | out: lppt=0x26f7468) returned 1
	[0141.523] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.523] GetROP2 (hdc=0x50010d63) returned 13
	[0141.523] GetBkMode (hdc=0x50010d63) returned 2
	[0141.523] MoveToEx (in: hdc=0x50010d63, x=125, y=2, lppt=0x26f74d0 | out: lppt=0x26f74d0) returned 1
	[0141.523] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.523] GetROP2 (hdc=0x50010d63) returned 13
	[0141.523] GetBkMode (hdc=0x50010d63) returned 2
	[0141.524] MoveToEx (in: hdc=0x50010d63, x=2, y=2, lppt=0x26f74e8 | out: lppt=0x26f74e8) returned 1
	[0141.524] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.524] GetROP2 (hdc=0x50010d63) returned 13
	[0141.524] GetBkMode (hdc=0x50010d63) returned 2
	[0141.524] MoveToEx (in: hdc=0x50010d63, x=2, y=38, lppt=0x26f7550 | out: lppt=0x26f7550) returned 1
	[0141.524] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.524] GetROP2 (hdc=0x50010d63) returned 13
	[0141.525] GetBkMode (hdc=0x50010d63) returned 2
	[0141.525] MoveToEx (in: hdc=0x50010d63, x=125, y=38, lppt=0x26f7568 | out: lppt=0x26f7568) returned 1
	[0141.525] MoveToEx (in: hdc=0x50010d63, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0141.525] GdipReleaseDC (graphics=0x1b929550, hdc=0x50010d63) returned 0x0
	[0141.525] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0141.556] GdipReleaseDC (graphics=0x1b929550, hdc=0x50010d63) returned 0x0
	[0141.556] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0141.556] GetKeyState (nVirtKey=1) returned 0
	[0141.556] GetKeyState (nVirtKey=2) returned 0
	[0141.560] GetCapture () returned 0x0
	[0142.634] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0142.634] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0xd4400500001
	[0142.635] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0142.635] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0142.635] GdipCreateFromHDC (hdc=0xb010d7f, graphics=0x20d7e0) returned 0x0
	[0142.635] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0142.635] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0142.635] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0142.635] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0142.636] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0142.636] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0142.636] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0142.636] GdipCreateRegion (region=0x20d910) returned 0x0
	[0142.636] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.636] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0142.636] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0142.637] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc4d0dbd) returned 0x0
	[0142.637] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.637] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0142.637] GetCurrentObject (hdc=0xb010d7f, type=0x1) returned 0x1b00017
	[0142.637] GetCurrentObject (hdc=0xb010d7f, type=0x2) returned 0x1900010
	[0142.637] GetCurrentObject (hdc=0xb010d7f, type=0x7) returned 0x140507d2
	[0142.638] GetCurrentObject (hdc=0xb010d7f, type=0x6) returned 0x18a002e
	[0142.639] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010d7f) returned 0x0
	[0142.639] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.639] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.639] CoTaskMemFree (pv=0x1b067a80) 
	[0142.639] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0142.640] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.640] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.640] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0142.640] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0142.641] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0142.642] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0142.642] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0142.642] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0142.642] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0142.642] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.643] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.643] CoTaskMemFree (pv=0x1b067a80) 
	[0142.643] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0142.643] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0142.643] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0142.644] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0142.644] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0142.644] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.644] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.644] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0142.644] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0142.645] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0142.645] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.645] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.645] CoTaskMemFree (pv=0x1b067a80) 
	[0142.645] GdipCreateRegion (region=0x20d120) returned 0x0
	[0142.645] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.645] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0142.646] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0142.646] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0142.646] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0142.647] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0142.647] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0142.648] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0142.648] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0142.648] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0142.648] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.648] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0142.648] GetCurrentObject (hdc=0xb010d7f, type=0x1) returned 0x1b00017
	[0142.648] GetCurrentObject (hdc=0xb010d7f, type=0x2) returned 0x1900010
	[0142.649] GetCurrentObject (hdc=0xb010d7f, type=0x7) returned 0x140507d2
	[0142.649] GetCurrentObject (hdc=0xb010d7f, type=0x6) returned 0x18a002e
	[0142.649] OffsetViewportOrgEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x26f8418 | out: lppt=0x26f8418) returned 1
	[0142.649] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010d7f) returned 0x0
	[0142.649] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.650] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.650] CoTaskMemFree (pv=0x1b067a80) 
	[0142.652] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0142.652] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.652] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.652] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0142.652] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0142.653] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0142.653] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0142.653] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0142.653] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.653] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.653] CoTaskMemFree (pv=0x1b067a80) 
	[0142.653] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0142.653] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0142.654] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0142.654] GdipCreateRegion (region=0x20d070) returned 0x0
	[0142.654] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.654] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0142.654] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0142.654] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0142.655] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0142.655] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0142.655] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0142.655] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0142.655] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0142.655] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0142.655] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.655] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0142.656] GetCurrentObject (hdc=0xb010d7f, type=0x1) returned 0x1b00017
	[0142.656] GetCurrentObject (hdc=0xb010d7f, type=0x2) returned 0x1900010
	[0142.656] GetCurrentObject (hdc=0xb010d7f, type=0x7) returned 0x140507d2
	[0142.656] GetCurrentObject (hdc=0xb010d7f, type=0x6) returned 0x18a002e
	[0142.656] OffsetViewportOrgEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x26f89b8 | out: lppt=0x26f89b8) returned 1
	[0142.656] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.656] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.657] MoveToEx (in: hdc=0xb010d7f, x=164, y=1, lppt=0x26f8a20 | out: lppt=0x26f8a20) returned 1
	[0142.657] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.657] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.657] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.657] MoveToEx (in: hdc=0xb010d7f, x=1, y=1, lppt=0x26f8a38 | out: lppt=0x26f8a38) returned 1
	[0142.657] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.657] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.658] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.660] MoveToEx (in: hdc=0xb010d7f, x=1, y=41, lppt=0x26f8aa0 | out: lppt=0x26f8aa0) returned 1
	[0142.660] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.660] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.660] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.660] MoveToEx (in: hdc=0xb010d7f, x=164, y=41, lppt=0x26f8ab8 | out: lppt=0x26f8ab8) returned 1
	[0142.660] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.660] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.661] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.661] MoveToEx (in: hdc=0xb010d7f, x=163, y=2, lppt=0x26f8b20 | out: lppt=0x26f8b20) returned 1
	[0142.661] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.661] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.661] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.661] MoveToEx (in: hdc=0xb010d7f, x=2, y=2, lppt=0x26f8b38 | out: lppt=0x26f8b38) returned 1
	[0142.661] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.662] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.662] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.662] MoveToEx (in: hdc=0xb010d7f, x=2, y=40, lppt=0x26f8ba0 | out: lppt=0x26f8ba0) returned 1
	[0142.662] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.662] GetROP2 (hdc=0xb010d7f) returned 13
	[0142.662] GetBkMode (hdc=0xb010d7f) returned 2
	[0142.662] MoveToEx (in: hdc=0xb010d7f, x=163, y=40, lppt=0x26f8bb8 | out: lppt=0x26f8bb8) returned 1
	[0142.663] MoveToEx (in: hdc=0xb010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.663] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010d7f) returned 0x0
	[0142.664] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0142.664] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010d7f) returned 0x0
	[0142.664] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0142.664] GdipCreateFromHDC (hdc=0xd010d7f, graphics=0x20d7e0) returned 0x0
	[0142.665] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0142.665] GdipSetClipRectI (graphics=0x1b929550, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0142.665] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0142.665] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0142.665] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0142.665] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0142.665] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0142.666] GdipCreateRegion (region=0x20d910) returned 0x0
	[0142.666] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.666] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0142.666] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0142.669] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc4a0dbd) returned 0x0
	[0142.670] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.670] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0142.670] GetCurrentObject (hdc=0xd010d7f, type=0x1) returned 0x1b00017
	[0142.670] GetCurrentObject (hdc=0xd010d7f, type=0x2) returned 0x1900010
	[0142.670] GetCurrentObject (hdc=0xd010d7f, type=0x7) returned 0x140507d2
	[0142.670] GetCurrentObject (hdc=0xd010d7f, type=0x6) returned 0x18a002e
	[0142.671] GdipReleaseDC (graphics=0x1b929550, hdc=0xd010d7f) returned 0x0
	[0142.671] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.671] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.671] CoTaskMemFree (pv=0x1b067a80) 
	[0142.671] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0142.671] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.671] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.672] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0142.672] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0142.672] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0142.673] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0142.673] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0142.673] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0142.673] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0142.674] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.674] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.674] CoTaskMemFree (pv=0x1b067a80) 
	[0142.674] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0142.674] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0142.674] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0142.674] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0142.675] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0142.675] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.675] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.675] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0142.675] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0142.675] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0142.675] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.677] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.677] CoTaskMemFree (pv=0x1b067a80) 
	[0142.677] GdipCreateRegion (region=0x20d120) returned 0x0
	[0142.677] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.677] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0142.677] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0142.677] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0142.678] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0142.678] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0142.678] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0142.678] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0142.678] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0142.678] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0142.678] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.679] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0142.679] GetCurrentObject (hdc=0xd010d7f, type=0x1) returned 0x1b00017
	[0142.679] GetCurrentObject (hdc=0xd010d7f, type=0x2) returned 0x1900010
	[0142.679] GetCurrentObject (hdc=0xd010d7f, type=0x7) returned 0x140507d2
	[0142.679] GetCurrentObject (hdc=0xd010d7f, type=0x6) returned 0x18a002e
	[0142.679] OffsetViewportOrgEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x26f9818 | out: lppt=0x26f9818) returned 1
	[0142.680] GdipReleaseDC (graphics=0x1b929550, hdc=0xd010d7f) returned 0x0
	[0142.680] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.680] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.680] CoTaskMemFree (pv=0x1b067a80) 
	[0142.680] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0142.680] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.680] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.681] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0142.681] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0142.681] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0142.681] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0142.681] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0142.681] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0142.681] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.681] CoTaskMemFree (pv=0x1b067a80) 
	[0142.682] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0142.682] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0142.682] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0142.682] GdipCreateRegion (region=0x20d070) returned 0x0
	[0142.682] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.682] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0142.682] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0142.683] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0142.683] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0142.683] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0142.683] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0142.683] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0142.683] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0142.683] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0142.683] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.684] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0142.684] GetCurrentObject (hdc=0xd010d7f, type=0x1) returned 0x1b00017
	[0142.684] GetCurrentObject (hdc=0xd010d7f, type=0x2) returned 0x1900010
	[0142.684] GetCurrentObject (hdc=0xd010d7f, type=0x7) returned 0x140507d2
	[0142.684] GetCurrentObject (hdc=0xd010d7f, type=0x6) returned 0x18a002e
	[0142.684] OffsetViewportOrgEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x26f9db8 | out: lppt=0x26f9db8) returned 1
	[0142.685] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.685] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.686] MoveToEx (in: hdc=0xd010d7f, x=126, y=1, lppt=0x26f9e20 | out: lppt=0x26f9e20) returned 1
	[0142.686] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.686] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.686] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.687] MoveToEx (in: hdc=0xd010d7f, x=1, y=1, lppt=0x26f9e38 | out: lppt=0x26f9e38) returned 1
	[0142.687] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.688] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.688] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.688] MoveToEx (in: hdc=0xd010d7f, x=1, y=39, lppt=0x26f9ea0 | out: lppt=0x26f9ea0) returned 1
	[0142.688] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.689] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.689] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.689] MoveToEx (in: hdc=0xd010d7f, x=126, y=39, lppt=0x26f9eb8 | out: lppt=0x26f9eb8) returned 1
	[0142.689] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.689] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.689] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.690] MoveToEx (in: hdc=0xd010d7f, x=125, y=2, lppt=0x26f9f20 | out: lppt=0x26f9f20) returned 1
	[0142.690] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.690] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.690] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.690] MoveToEx (in: hdc=0xd010d7f, x=2, y=2, lppt=0x26f9f38 | out: lppt=0x26f9f38) returned 1
	[0142.690] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.690] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.691] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.691] MoveToEx (in: hdc=0xd010d7f, x=2, y=38, lppt=0x26f9fa0 | out: lppt=0x26f9fa0) returned 1
	[0142.691] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.691] GetROP2 (hdc=0xd010d7f) returned 13
	[0142.691] GetBkMode (hdc=0xd010d7f) returned 2
	[0142.691] MoveToEx (in: hdc=0xd010d7f, x=125, y=38, lppt=0x26f9fb8 | out: lppt=0x26f9fb8) returned 1
	[0142.691] MoveToEx (in: hdc=0xd010d7f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0142.692] GdipReleaseDC (graphics=0x1b929550, hdc=0xd010d7f) returned 0x0
	[0142.692] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0142.692] GdipReleaseDC (graphics=0x1b929550, hdc=0xd010d7f) returned 0x0
	[0142.692] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0142.881] CoTaskMemAlloc (cb=0x26) returned 0x1aff3920
	[0142.881] GetWindowTextW (hWnd=0x50120, lpString=0x1aff3920, nMaxCount=17) 
	[0142.881] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1aff3920) returned 0x10
	[0142.882] CoTaskMemFree (pv=0x1aff3920) 
	[0142.882] GetClientRect (in: hWnd=0x50120, lpRect=0x20dbe0 | out: lpRect=0x20dbe0) returned 1
	[0142.882] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d7b0) returned 0x0
	[0142.882] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0142.882] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0142.882] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0142.882] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d700) returned 0x0
	[0142.883] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0142.883] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0142.883] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.883] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6d0) returned 0x0
	[0142.883] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.883] GdipSaveGraphics (graphics=0x1b929550, state=0x20d7a0) returned 0x0
	[0142.884] GdipCreateRegion (region=0x20d670) returned 0x0
	[0142.884] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.884] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0142.884] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0142.884] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d6d0) returned 0x0
	[0142.884] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0142.884] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0142.884] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d720) returned 0x0
	[0142.885] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.885] GdipGetDC (graphics=0x1b929550, hdc=0x20d750) returned 0x0
	[0142.885] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x26fa520 | out: lppt=0x26fa520) returned 1
	[0142.885] GdipReleaseDC (graphics=0x1b929550, hdc=0x4010280) returned 0x0
	[0142.885] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0142.886] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0142.886] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0142.886] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0142.886] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0142.886] UpdateWindow (hWnd=0x401b4) 
	[0142.887] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0142.887] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0142.887] GdipCreateFromHDC (hdc=0x25010d7c, graphics=0x20cfa0) returned 0x0
	[0142.887] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0142.887] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0142.887] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0142.887] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0142.887] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0142.888] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0142.888] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0142.888] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0142.888] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0142.888] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0142.888] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0142.888] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc450dbd) returned 0x0
	[0142.889] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0142.890] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0142.890] GdipReleaseDC (graphics=0x1b929550, hdc=0x25010d7c) returned 0x0
	[0142.890] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0142.890] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0142.890] CoTaskMemFree (pv=0x1b0679c0) 
	[0142.891] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0142.891] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.891] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0142.891] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0142.891] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0142.891] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0142.891] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0142.891] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0142.892] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0143.015] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0143.015] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0143.016] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0143.016] CoTaskMemFree (pv=0x1b0679c0) 
	[0143.016] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0143.016] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0143.016] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0143.016] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0143.016] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0143.016] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0143.017] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0143.017] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0143.017] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0143.017] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0143.017] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0143.017] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0143.017] CoTaskMemFree (pv=0x1b0679c0) 
	[0143.018] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0143.018] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0143.018] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0143.018] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0143.018] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0143.018] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0143.018] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0143.019] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0143.019] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0143.019] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0143.019] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0143.019] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0143.019] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0143.019] OffsetViewportOrgEx (in: hdc=0x25010d7c, x=0, y=0, lppt=0x26fb2e8 | out: lppt=0x26fb2e8) returned 1
	[0143.020] GdipReleaseDC (graphics=0x1b929550, hdc=0x25010d7c) returned 0x0
	[0143.020] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0143.020] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0143.020] CoTaskMemFree (pv=0x1b0679c0) 
	[0143.020] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0143.020] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0143.020] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0143.021] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0143.021] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0143.021] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0143.021] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0143.021] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0143.021] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0143.021] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0143.021] CoTaskMemFree (pv=0x1b0679c0) 
	[0143.021] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0143.022] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0143.022] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0143.022] GdipCreateRegion (region=0x20c830) returned 0x0
	[0143.022] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0143.022] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0143.022] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0143.022] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0143.023] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0143.023] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0143.023] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0143.023] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0143.023] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0143.023] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0143.023] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0143.024] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0143.024] OffsetViewportOrgEx (in: hdc=0x25010d7c, x=0, y=0, lppt=0x26fb888 | out: lppt=0x26fb888) returned 1
	[0143.024] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.024] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.024] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.024] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.024] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.025] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.025] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.025] GetROP2 (hdc=0x25010d7c) returned 13
	[0143.025] GdipReleaseDC (graphics=0x1b929550, hdc=0x25010d7c) returned 0x0
	[0143.025] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0143.025] GdipReleaseDC (graphics=0x1b929550, hdc=0x25010d7c) returned 0x0
	[0143.026] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0143.026] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0143.026] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0143.026] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0143.026] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0143.026] GetCapture () returned 0x401b4
	[0143.026] ReleaseCapture () 
	[0143.026] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0143.026] GetDIBits (in: hdc=0x10107f8, hbm=0x2d050d68, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0143.026] GetDIBits (in: hdc=0x10107f8, hbm=0x2d050d68, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0143.026] GdipCreateFromHDC (hdc=0x16010d80, graphics=0x20d750) returned 0x0
	[0143.027] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0143.027] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0143.027] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0143.027] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0143.027] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0143.027] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0143.027] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0143.028] GdipCreateRegion (region=0x20d910) returned 0x0
	[0143.028] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0143.028] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0143.028] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0143.028] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0143.028] GetWindowTextW (hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118) 
	[0143.028] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0143.028] CoTaskMemFree (pv=0x1b07f5c0) 
	[0143.028] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0143.028] GdipCreateRegion (region=0x20d400) returned 0x0
	[0143.029] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0143.029] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0143.029] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0143.029] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0143.029] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0143.029] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0143.029] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0143.030] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0143.030] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0143.030] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0143.030] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0143.030] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0143.030] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0143.030] OffsetViewportOrgEx (in: hdc=0x16010d80, x=0, y=0, lppt=0x26fd240 | out: lppt=0x26fd240) returned 1
	[0143.031] GdipReleaseDC (graphics=0x1b929550, hdc=0x16010d80) returned 0x0
	[0143.031] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc420dbd) returned 0x0
	[0143.031] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0143.031] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0143.031] GetWindowTextW (hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118) 
	[0143.031] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0143.031] CoTaskMemFree (pv=0x1b07f5c0) 
	[0143.031] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0143.032] GdipReleaseDC (graphics=0x1b929550, hdc=0x16010d80) returned 0x0
	[0143.032] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0143.032] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0143.032] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0143.032] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0143.032] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0143.033] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0143.033] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0143.033] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0143.033] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0143.033] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0143.034] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0143.034] GdipReleaseDC (graphics=0x1b929550, hdc=0x16010d80) returned 0x0
	[0143.034] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0143.034] GetDIBits (in: hdc=0x70107fc, hbm=0x2f050d68, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0143.034] GetDIBits (in: hdc=0x70107fc, hbm=0x2f050d68, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0143.034] GdipCreateFromHDC (hdc=0xffffffff84010cf5, graphics=0x20d800) returned 0x0
	[0143.035] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0143.035] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0143.035] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0143.035] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0143.035] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0143.035] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0143.035] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0143.036] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0143.036] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0143.036] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0143.036] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0143.036] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0143.036] GetWindowTextW (hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1) 
	[0143.036] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0143.036] CoTaskMemFree (pv=0x1b078860) 
	[0143.036] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0143.036] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0143.037] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0143.037] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0143.037] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0143.037] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0143.037] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0143.037] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0143.037] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0143.038] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0143.038] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0143.038] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0143.038] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0143.038] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0143.038] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0143.039] OffsetViewportOrgEx (in: hdc=0xffffffff84010cf5, x=0, y=0, lppt=0x26fed80 | out: lppt=0x26fed80) returned 1
	[0143.039] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff84010cf5) returned 0x0
	[0143.039] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc400dbd) returned 0x0
	[0143.039] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0143.040] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0143.040] GetWindowTextW (hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1) 
	[0143.040] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0143.040] CoTaskMemFree (pv=0x1b078860) 
	[0143.040] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0143.046] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0143.047] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff84010cf5) returned 0x0
	[0143.047] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0144.143] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0144.143] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0144.143] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0144.143] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0144.144] GdipCreateFromHDC (hdc=0x19010d81, graphics=0x20d7e0) returned 0x0
	[0144.144] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0144.144] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0144.144] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0144.144] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.144] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0144.145] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.145] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.145] GdipCreateRegion (region=0x20d910) returned 0x0
	[0144.145] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.145] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0144.145] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0144.146] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc3e0dbd) returned 0x0
	[0144.146] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.146] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0144.146] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19010d81) returned 0x0
	[0144.146] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.146] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.147] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.147] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0144.147] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.147] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.147] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.147] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0144.147] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0144.147] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0144.148] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0144.148] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0144.148] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.148] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.148] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.148] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.148] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0144.149] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0144.149] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0144.149] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0144.149] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.149] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.149] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.149] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0144.150] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.150] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0144.150] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.150] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.150] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.150] GdipCreateRegion (region=0x20d120) returned 0x0
	[0144.150] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.151] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0144.151] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0144.151] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0144.151] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0144.151] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0144.151] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0144.151] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0144.152] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0144.152] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0144.152] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.152] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0144.152] OffsetViewportOrgEx (in: hdc=0x19010d81, x=0, y=0, lppt=0x26ffd28 | out: lppt=0x26ffd28) returned 1
	[0144.152] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19010d81) returned 0x0
	[0144.153] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.153] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.153] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.153] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0144.153] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.153] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.153] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.154] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0144.154] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0144.154] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0144.154] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.154] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.154] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.155] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.155] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0144.155] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0144.155] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0144.155] GdipCreateRegion (region=0x20d070) returned 0x0
	[0144.155] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.156] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0144.156] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.156] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0144.156] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.156] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.157] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.157] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0144.157] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0144.157] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0144.157] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.157] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0144.158] OffsetViewportOrgEx (in: hdc=0x19010d81, x=0, y=0, lppt=0x27002c8 | out: lppt=0x27002c8) returned 1
	[0144.158] GetROP2 (hdc=0x19010d81) returned 13
	[0144.158] GetROP2 (hdc=0x19010d81) returned 13
	[0144.158] GetROP2 (hdc=0x19010d81) returned 13
	[0144.158] GetROP2 (hdc=0x19010d81) returned 13
	[0144.158] GetROP2 (hdc=0x19010d81) returned 13
	[0144.158] GetROP2 (hdc=0x19010d81) returned 13
	[0144.159] GetROP2 (hdc=0x19010d81) returned 13
	[0144.159] GetROP2 (hdc=0x19010d81) returned 13
	[0144.159] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19010d81) returned 0x0
	[0144.159] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0144.159] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19010d81) returned 0x0
	[0144.160] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0144.160] GdipCreateFromHDC (hdc=0x1b010d81, graphics=0x20d7e0) returned 0x0
	[0144.160] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0144.160] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0144.160] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0144.160] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0144.161] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0144.161] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0144.161] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0144.161] GdipCreateRegion (region=0x20d910) returned 0x0
	[0144.161] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.161] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0144.161] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0144.162] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc3b0dbd) returned 0x0
	[0144.162] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.162] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0144.162] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b010d81) returned 0x0
	[0144.162] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.163] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.163] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.165] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0144.165] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.165] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.165] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.165] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0144.166] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0144.166] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0144.166] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0144.166] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0144.166] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.166] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.167] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.167] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.167] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0144.167] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0144.167] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0144.167] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0144.167] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.168] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.168] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.168] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0144.168] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.168] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0144.168] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.169] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.169] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.169] GdipCreateRegion (region=0x20d120) returned 0x0
	[0144.169] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.169] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0144.169] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.169] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0144.169] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.170] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.170] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.170] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0144.170] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0144.170] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0144.170] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.171] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0144.171] OffsetViewportOrgEx (in: hdc=0x1b010d81, x=0, y=0, lppt=0x2701128 | out: lppt=0x2701128) returned 1
	[0144.171] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b010d81) returned 0x0
	[0144.171] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.171] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.171] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.172] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0144.172] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.172] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.172] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.172] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0144.172] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0144.173] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0144.173] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.173] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0144.173] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.173] CoTaskMemFree (pv=0x1b0679c0) 
	[0144.173] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0144.173] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0144.174] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0144.174] GdipCreateRegion (region=0x20d070) returned 0x0
	[0144.174] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.174] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0144.174] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0144.174] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0144.174] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0144.175] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0144.175] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0144.175] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0144.175] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0144.175] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0144.175] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.176] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0144.176] OffsetViewportOrgEx (in: hdc=0x1b010d81, x=0, y=0, lppt=0x27016c8 | out: lppt=0x27016c8) returned 1
	[0144.176] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.176] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.176] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.176] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.176] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.177] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.177] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.177] GetROP2 (hdc=0x1b010d81) returned 13
	[0144.177] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b010d81) returned 0x0
	[0144.177] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0144.177] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b010d81) returned 0x0
	[0144.178] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0144.369] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0144.369] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0144.369] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0144.369] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0144.369] UpdateWindow (hWnd=0x201d8) 
	[0144.369] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0144.369] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0144.370] GdipCreateFromHDC (hdc=0x17010d86, graphics=0x20cfa0) returned 0x0
	[0144.370] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0144.370] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0144.370] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0144.370] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.370] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0144.370] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.371] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.371] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0144.371] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.371] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0144.371] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0144.371] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc380dbd) returned 0x0
	[0144.372] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.372] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0144.372] GetNearestColor (hdc=0x17010d86, color=0xf0f0f0) returned 0xf0f0f0
	[0144.372] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17010d86) returned 0x0
	[0144.373] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0144.373] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.373] CoTaskMemFree (pv=0x1b067a80) 
	[0144.373] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0144.373] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.373] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.373] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.373] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0144.374] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0144.374] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0144.374] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0144.374] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0144.374] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.374] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0144.375] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.375] CoTaskMemFree (pv=0x1b067a80) 
	[0144.375] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0144.375] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0144.377] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0144.377] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0144.377] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.377] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.377] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.377] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0144.377] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.378] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0144.378] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0144.378] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.378] CoTaskMemFree (pv=0x1b067a80) 
	[0144.378] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0144.378] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.380] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0144.380] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0144.380] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0144.380] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0144.380] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0144.380] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0144.380] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0144.381] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0144.381] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0144.381] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.381] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0144.381] OffsetViewportOrgEx (in: hdc=0x17010d86, x=0, y=0, lppt=0x27026f8 | out: lppt=0x27026f8) returned 1
	[0144.381] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17010d86) returned 0x0
	[0144.381] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0144.382] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.382] CoTaskMemFree (pv=0x1b067a80) 
	[0144.382] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0144.382] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.400] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.400] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.400] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0144.400] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0144.400] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0144.400] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.401] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0144.401] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.401] CoTaskMemFree (pv=0x1b067a80) 
	[0144.401] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0144.401] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0144.401] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0144.401] GdipCreateRegion (region=0x20c830) returned 0x0
	[0144.402] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.402] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0144.402] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.402] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0144.402] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.402] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0144.402] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.402] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0144.403] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0144.403] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0144.403] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.403] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0144.403] OffsetViewportOrgEx (in: hdc=0x17010d86, x=0, y=0, lppt=0x2702c98 | out: lppt=0x2702c98) returned 1
	[0144.403] GetROP2 (hdc=0x17010d86) returned 13
	[0144.404] GetROP2 (hdc=0x17010d86) returned 13
	[0144.404] GetROP2 (hdc=0x17010d86) returned 13
	[0144.404] GetROP2 (hdc=0x17010d86) returned 13
	[0144.404] GetROP2 (hdc=0x17010d86) returned 13
	[0144.404] GetROP2 (hdc=0x17010d86) returned 13
	[0144.404] GetROP2 (hdc=0x17010d86) returned 13
	[0144.404] GetROP2 (hdc=0x17010d86) returned 13
	[0144.405] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17010d86) returned 0x0
	[0144.405] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0144.405] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17010d86) returned 0x0
	[0144.411] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0144.411] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0144.411] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0144.412] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0144.412] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2702fe0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0144.412] ShellExecuteExW (pExecInfo=0x27031f0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0144.451] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0144.451] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0144.452] GdipCreateFromHDC (hdc=0x26010d84, graphics=0x20c9d0) returned 0x0
	[0144.454] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0144.454] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0144.454] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0144.454] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0144.455] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0144.455] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0144.455] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0144.455] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0144.455] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.455] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0144.456] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0144.456] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc350dbd) returned 0x0
	[0144.456] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.456] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0144.456] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010d84) returned 0x0
	[0144.456] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.457] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.457] CoTaskMemFree (pv=0x1b077150) 
	[0144.457] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0144.457] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.457] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.457] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.457] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0144.458] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0144.458] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0144.458] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0144.458] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0144.458] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.458] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.459] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.459] CoTaskMemFree (pv=0x1b077150) 
	[0144.459] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0144.459] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0144.459] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0144.459] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0144.459] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.459] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.460] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.460] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0144.460] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.460] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0144.460] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.460] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.460] CoTaskMemFree (pv=0x1b077150) 
	[0144.461] GdipCreateRegion (region=0x20c310) returned 0x0
	[0144.461] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.461] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0144.461] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.461] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0144.461] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0144.461] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0144.462] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.462] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0144.462] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0144.462] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0144.462] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.462] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0144.464] OffsetViewportOrgEx (in: hdc=0x26010d84, x=0, y=0, lppt=0x2703ed0 | out: lppt=0x2703ed0) returned 1
	[0144.464] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010d84) returned 0x0
	[0144.464] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.465] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.465] CoTaskMemFree (pv=0x1b077150) 
	[0144.465] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0144.465] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.465] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.465] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.465] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0144.465] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0144.466] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0144.466] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.466] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.466] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.466] CoTaskMemFree (pv=0x1b077150) 
	[0144.466] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0144.466] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0144.466] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0144.467] GdipCreateRegion (region=0x20c260) returned 0x0
	[0144.467] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.467] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0144.467] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0144.467] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0144.468] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0144.468] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0144.468] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0144.469] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0144.469] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0144.469] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0144.469] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.469] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0144.469] OffsetViewportOrgEx (in: hdc=0x26010d84, x=0, y=0, lppt=0x2704470 | out: lppt=0x2704470) returned 1
	[0144.469] GetROP2 (hdc=0x26010d84) returned 13
	[0144.470] GetROP2 (hdc=0x26010d84) returned 13
	[0144.470] GetROP2 (hdc=0x26010d84) returned 13
	[0144.470] GetROP2 (hdc=0x26010d84) returned 13
	[0144.470] GetROP2 (hdc=0x26010d84) returned 13
	[0144.470] GetROP2 (hdc=0x26010d84) returned 13
	[0144.471] GetROP2 (hdc=0x26010d84) returned 13
	[0144.471] GetROP2 (hdc=0x26010d84) returned 13
	[0144.471] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010d84) returned 0x0
	[0144.471] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0144.471] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x26010d84) returned 0x0
	[0144.471] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0144.472] GdipCreateFromHDC (hdc=0x28010d84, graphics=0x20c9d0) returned 0x0
	[0144.472] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0144.472] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0144.472] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0144.472] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.472] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0144.473] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0144.473] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.473] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0144.473] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.473] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0144.473] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0144.474] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc320dbd) returned 0x0
	[0144.474] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.474] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0144.474] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d84) returned 0x0
	[0144.474] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.474] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.474] CoTaskMemFree (pv=0x1b077150) 
	[0144.475] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0144.475] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.475] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.475] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.475] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0144.475] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0144.475] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0144.476] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0144.476] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0144.476] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.476] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.476] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.476] CoTaskMemFree (pv=0x1b077150) 
	[0144.476] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0144.476] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0144.477] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0144.477] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0144.477] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.477] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.477] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.477] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0144.477] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.478] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0144.478] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.478] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.478] CoTaskMemFree (pv=0x1b077150) 
	[0144.478] GdipCreateRegion (region=0x20c310) returned 0x0
	[0144.478] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.479] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0144.479] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0144.479] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0144.479] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0144.479] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0144.479] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0144.479] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0144.479] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0144.480] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0144.480] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.480] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0144.480] OffsetViewportOrgEx (in: hdc=0x28010d84, x=0, y=0, lppt=0x27052f8 | out: lppt=0x27052f8) returned 1
	[0144.480] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d84) returned 0x0
	[0144.480] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.481] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.481] CoTaskMemFree (pv=0x1b077150) 
	[0144.481] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0144.481] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.481] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0144.481] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0144.481] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0144.481] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0144.482] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0144.482] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0144.482] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0144.482] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0144.482] CoTaskMemFree (pv=0x1b077150) 
	[0144.482] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0144.482] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0144.482] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0144.483] GdipCreateRegion (region=0x20c260) returned 0x0
	[0144.483] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0144.483] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0144.484] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0144.484] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0144.484] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0144.484] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0144.485] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0144.485] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0144.485] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0144.485] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0144.485] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0144.485] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0144.485] OffsetViewportOrgEx (in: hdc=0x28010d84, x=0, y=0, lppt=0x2705898 | out: lppt=0x2705898) returned 1
	[0144.486] GetROP2 (hdc=0x28010d84) returned 13
	[0144.486] GetROP2 (hdc=0x28010d84) returned 13
	[0144.486] GetROP2 (hdc=0x28010d84) returned 13
	[0144.486] GetROP2 (hdc=0x28010d84) returned 13
	[0144.486] GetROP2 (hdc=0x28010d84) returned 13
	[0144.486] GetROP2 (hdc=0x28010d84) returned 13
	[0144.487] GetROP2 (hdc=0x28010d84) returned 13
	[0144.487] GetROP2 (hdc=0x28010d84) returned 13
	[0144.487] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d84) returned 0x0
	[0144.487] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0144.487] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d84) returned 0x0
	[0144.487] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0145.711] GdipCreateFromHDC (hdc=0x28010d85, graphics=0x20d7e0) returned 0x0
	[0145.712] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0145.712] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0145.712] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0145.712] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0145.712] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0145.712] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0145.713] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0145.713] GdipCreateRegion (region=0x20d910) returned 0x0
	[0145.713] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0145.713] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0145.713] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0145.713] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc2f0dbd) returned 0x0
	[0145.713] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0145.714] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0145.714] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d85) returned 0x0
	[0145.714] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0145.714] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0145.714] CoTaskMemFree (pv=0x1b067a60) 
	[0145.714] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0145.715] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0145.715] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0145.715] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0145.715] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0145.715] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0145.715] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0145.716] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0145.716] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0145.716] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0145.716] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0145.716] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0145.717] CoTaskMemFree (pv=0x1b067a60) 
	[0145.717] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0145.717] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0145.717] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0145.717] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0145.718] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0145.718] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0145.718] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0145.718] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0145.718] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0145.718] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0145.719] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0145.719] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0145.719] CoTaskMemFree (pv=0x1b067a60) 
	[0145.719] GdipCreateRegion (region=0x20d120) returned 0x0
	[0145.719] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0145.719] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0145.719] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0145.719] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0145.720] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0145.720] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0145.720] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0145.720] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0145.720] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0145.720] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0145.720] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0145.721] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0145.721] OffsetViewportOrgEx (in: hdc=0x28010d85, x=0, y=0, lppt=0x2706828 | out: lppt=0x2706828) returned 1
	[0145.721] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d85) returned 0x0
	[0145.721] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0145.721] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0145.721] CoTaskMemFree (pv=0x1b067a60) 
	[0145.721] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0145.721] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0145.722] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0145.722] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0145.722] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0145.722] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0145.722] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0145.722] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0145.723] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0145.723] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0145.723] CoTaskMemFree (pv=0x1b067a60) 
	[0145.723] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0145.723] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0145.723] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0145.723] GdipCreateRegion (region=0x20d070) returned 0x0
	[0145.723] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0145.724] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0145.724] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0145.724] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0145.724] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0145.724] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0145.724] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0145.724] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0145.725] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0145.725] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0145.725] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0145.725] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0145.725] OffsetViewportOrgEx (in: hdc=0x28010d85, x=0, y=0, lppt=0x2706dc8 | out: lppt=0x2706dc8) returned 1
	[0145.725] GetROP2 (hdc=0x28010d85) returned 13
	[0145.725] GetROP2 (hdc=0x28010d85) returned 13
	[0145.726] GetROP2 (hdc=0x28010d85) returned 13
	[0145.726] GetROP2 (hdc=0x28010d85) returned 13
	[0145.726] GetROP2 (hdc=0x28010d85) returned 13
	[0145.726] GetROP2 (hdc=0x28010d85) returned 13
	[0145.726] GetROP2 (hdc=0x28010d85) returned 13
	[0145.726] GetROP2 (hdc=0x28010d85) returned 13
	[0145.727] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d85) returned 0x0
	[0145.727] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0145.727] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x28010d85) returned 0x0
	[0145.727] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0147.509] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0147.509] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0147.509] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0147.509] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0147.509] GdipCreateFromHDC (hdc=0x16010d91, graphics=0x20d7e0) returned 0x0
	[0147.510] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0147.510] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0147.510] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0147.511] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0147.511] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0147.511] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0147.511] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0147.511] GdipCreateRegion (region=0x20d910) returned 0x0
	[0147.511] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.512] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0147.512] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0147.512] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc2c0dbd) returned 0x0
	[0147.512] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.512] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0147.512] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x16010d91) returned 0x0
	[0147.513] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0147.513] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.513] CoTaskMemFree (pv=0x1b067a60) 
	[0147.513] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0147.513] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.513] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.513] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.514] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0147.514] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0147.514] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0147.514] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0147.514] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0147.514] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.514] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0147.515] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.515] CoTaskMemFree (pv=0x1b067a60) 
	[0147.515] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0147.515] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0147.515] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0147.515] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0147.515] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.516] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.516] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.516] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0147.516] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.516] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0147.516] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0147.517] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.517] CoTaskMemFree (pv=0x1b067a60) 
	[0147.517] GdipCreateRegion (region=0x20d120) returned 0x0
	[0147.517] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.517] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0147.517] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0147.517] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0147.517] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0147.518] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0147.518] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0147.518] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0147.518] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0147.518] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0147.518] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.518] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0147.519] OffsetViewportOrgEx (in: hdc=0x16010d91, x=0, y=0, lppt=0x2707cc0 | out: lppt=0x2707cc0) returned 1
	[0147.519] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x16010d91) returned 0x0
	[0147.519] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0147.519] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.519] CoTaskMemFree (pv=0x1b067a60) 
	[0147.519] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0147.519] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.519] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.520] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.520] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0147.520] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0147.520] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0147.520] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.520] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0147.521] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.521] CoTaskMemFree (pv=0x1b067a60) 
	[0147.521] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0147.521] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0147.521] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0147.521] GdipCreateRegion (region=0x20d070) returned 0x0
	[0147.521] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.521] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0147.522] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0147.522] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0147.522] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0147.522] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0147.522] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0147.522] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0147.523] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0147.523] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0147.523] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.523] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0147.523] OffsetViewportOrgEx (in: hdc=0x16010d91, x=0, y=0, lppt=0x2708260 | out: lppt=0x2708260) returned 1
	[0147.523] GetROP2 (hdc=0x16010d91) returned 13
	[0147.524] GetROP2 (hdc=0x16010d91) returned 13
	[0147.524] GetROP2 (hdc=0x16010d91) returned 13
	[0147.524] GetROP2 (hdc=0x16010d91) returned 13
	[0147.524] GetROP2 (hdc=0x16010d91) returned 13
	[0147.524] GetROP2 (hdc=0x16010d91) returned 13
	[0147.524] GetROP2 (hdc=0x16010d91) returned 13
	[0147.524] GetROP2 (hdc=0x16010d91) returned 13
	[0147.525] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x16010d91) returned 0x0
	[0147.525] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0147.525] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x16010d91) returned 0x0
	[0147.525] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0147.769] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0147.769] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0147.770] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0147.770] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0147.770] UpdateWindow (hWnd=0x201d8) 
	[0147.770] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0147.770] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0147.770] GdipCreateFromHDC (hdc=0x70010d55, graphics=0x20cfa0) returned 0x0
	[0147.770] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0147.771] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0147.771] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0147.771] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0147.771] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0147.771] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0147.771] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0147.771] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0147.772] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.772] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0147.772] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0147.772] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc290dbd) returned 0x0
	[0147.772] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.772] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0147.773] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70010d55) returned 0x0
	[0147.773] CoTaskMemAlloc (cb=0x13) returned 0x1b067620
	[0147.773] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.773] CoTaskMemFree (pv=0x1b067620) 
	[0147.773] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0147.773] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.773] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.774] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.774] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0147.774] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0147.774] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0147.774] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0147.774] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0147.775] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.775] CoTaskMemAlloc (cb=0x13) returned 0x1b067620
	[0147.775] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.775] CoTaskMemFree (pv=0x1b067620) 
	[0147.775] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0147.776] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0147.776] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0147.776] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0147.776] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.776] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.776] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.776] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0147.777] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.777] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0147.777] CoTaskMemAlloc (cb=0x13) returned 0x1b067620
	[0147.777] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.777] CoTaskMemFree (pv=0x1b067620) 
	[0147.777] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0147.777] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.778] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0147.778] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0147.778] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0147.778] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0147.778] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0147.778] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0147.778] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0147.779] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0147.779] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0147.779] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.779] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0147.779] OffsetViewportOrgEx (in: hdc=0x70010d55, x=0, y=0, lppt=0x27093d8 | out: lppt=0x27093d8) returned 1
	[0147.779] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70010d55) returned 0x0
	[0147.780] CoTaskMemAlloc (cb=0x13) returned 0x1b067620
	[0147.780] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.780] CoTaskMemFree (pv=0x1b067620) 
	[0147.780] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0147.780] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.780] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.780] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.781] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0147.781] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0147.781] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0147.781] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.781] CoTaskMemAlloc (cb=0x13) returned 0x1b067620
	[0147.782] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.782] CoTaskMemFree (pv=0x1b067620) 
	[0147.782] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0147.782] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0147.782] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0147.782] GdipCreateRegion (region=0x20c830) returned 0x0
	[0147.782] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.782] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0147.783] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0147.783] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0147.783] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0147.783] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0147.783] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0147.783] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0147.784] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0147.784] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0147.784] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.784] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0147.784] OffsetViewportOrgEx (in: hdc=0x70010d55, x=0, y=0, lppt=0x2709978 | out: lppt=0x2709978) returned 1
	[0147.784] GetROP2 (hdc=0x70010d55) returned 13
	[0147.785] GetROP2 (hdc=0x70010d55) returned 13
	[0147.785] GetROP2 (hdc=0x70010d55) returned 13
	[0147.785] GetROP2 (hdc=0x70010d55) returned 13
	[0147.785] GetROP2 (hdc=0x70010d55) returned 13
	[0147.785] GetROP2 (hdc=0x70010d55) returned 13
	[0147.785] GetROP2 (hdc=0x70010d55) returned 13
	[0147.786] GetROP2 (hdc=0x70010d55) returned 13
	[0147.786] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70010d55) returned 0x0
	[0147.786] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0147.786] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70010d55) returned 0x0
	[0147.786] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0147.786] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0147.786] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0147.787] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0147.787] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2709cc0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0147.787] ShellExecuteExW (pExecInfo=0x2709ed0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0147.847] GdipCreateFromHDC (hdc=0x1d010e72, graphics=0x20c9d0) returned 0x0
	[0147.848] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0147.848] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0147.848] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0147.848] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0147.848] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0147.848] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0147.849] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0147.849] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0147.849] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.849] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0147.849] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0147.849] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc260dbd) returned 0x0
	[0147.850] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.850] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0147.850] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010e72) returned 0x0
	[0147.850] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0147.850] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.851] CoTaskMemFree (pv=0x1b077150) 
	[0147.851] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0147.851] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.851] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.851] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.851] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0147.851] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0147.851] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0147.852] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0147.852] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0147.852] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.852] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0147.852] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.852] CoTaskMemFree (pv=0x1b077150) 
	[0147.852] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0147.853] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0147.853] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0147.853] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0147.853] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.854] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.854] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.854] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0147.854] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.854] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0147.854] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0147.855] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.855] CoTaskMemFree (pv=0x1b077150) 
	[0147.855] GdipCreateRegion (region=0x20c310) returned 0x0
	[0147.855] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.855] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0147.855] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0147.855] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0147.855] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0147.856] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0147.856] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0147.856] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0147.856] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0147.856] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0147.856] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.856] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0147.857] OffsetViewportOrgEx (in: hdc=0x1d010e72, x=0, y=0, lppt=0x270ac00 | out: lppt=0x270ac00) returned 1
	[0147.857] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010e72) returned 0x0
	[0147.857] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0147.857] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.857] CoTaskMemFree (pv=0x1b077150) 
	[0147.857] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0147.857] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.857] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0147.858] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0147.858] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0147.858] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0147.858] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0147.858] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0147.858] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0147.859] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0147.859] CoTaskMemFree (pv=0x1b077150) 
	[0147.859] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0147.859] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0147.859] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0147.859] GdipCreateRegion (region=0x20c260) returned 0x0
	[0147.859] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0147.859] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0147.860] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0147.860] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0147.860] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0147.860] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0147.860] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0147.860] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0147.860] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0147.860] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0147.861] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0147.861] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0147.861] OffsetViewportOrgEx (in: hdc=0x1d010e72, x=0, y=0, lppt=0x270b1a0 | out: lppt=0x270b1a0) returned 1
	[0147.861] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.861] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.861] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.862] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.862] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.862] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.862] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.862] GetROP2 (hdc=0x1d010e72) returned 13
	[0147.862] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010e72) returned 0x0
	[0147.862] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0147.863] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010e72) returned 0x0
	[0147.863] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0148.796] GdipCreateFromHDC (hdc=0x70107fc, graphics=0x20d770) returned 0x0
	[0148.796] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0148.796] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0148.796] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0148.796] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d6c0) returned 0x0
	[0148.797] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0148.797] GdipCreateRegion (region=0x20d660) returned 0x0
	[0148.797] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0148.797] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d690) returned 0x0
	[0148.797] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0148.797] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d760) returned 0x0
	[0148.797] GdipCreateRegion (region=0x20d630) returned 0x0
	[0148.798] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0148.798] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0148.798] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0148.798] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d690) returned 0x0
	[0148.798] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0148.798] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0148.798] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6e0) returned 0x0
	[0148.799] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0148.799] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d710) returned 0x0
	[0148.799] OffsetViewportOrgEx (in: hdc=0x70107fc, x=0, y=0, lppt=0x270c3b0 | out: lppt=0x270c3b0) returned 1
	[0148.799] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70107fc) returned 0x0
	[0148.799] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0148.800] GetDIBits (in: hdc=0x4010280, hbm=0x12050eab, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0148.800] GetDIBits (in: hdc=0x4010280, hbm=0x12050eab, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0148.800] GdipCreateFromHDC (hdc=0x27010ea8, graphics=0x20d750) returned 0x0
	[0148.800] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0148.801] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0148.801] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0148.801] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0148.801] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0148.801] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0148.801] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0148.802] GdipCreateRegion (region=0x20d910) returned 0x0
	[0148.802] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0148.802] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0148.802] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0148.802] GdipCreateRegion (region=0x20d400) returned 0x0
	[0148.802] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0148.802] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0148.803] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0148.803] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0148.803] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0148.803] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0148.803] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0148.803] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0148.804] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0148.804] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0148.804] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0148.804] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0148.804] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0148.805] OffsetViewportOrgEx (in: hdc=0x27010ea8, x=0, y=0, lppt=0x270dbe0 | out: lppt=0x270dbe0) returned 1
	[0148.805] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x27010ea8) returned 0x0
	[0148.805] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffc210dbd) returned 0x0
	[0148.805] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0148.805] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0148.805] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x27010ea8) returned 0x0
	[0148.806] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0148.806] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0148.806] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0148.806] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0148.806] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0148.807] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0148.807] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0148.807] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0148.807] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0148.807] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0148.808] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0148.808] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x27010ea8) returned 0x0
	[0148.808] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0148.808] GdipCreateFromHDC (hdc=0x17010bee, graphics=0x20d7e0) returned 0x0
	[0148.808] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0148.809] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0148.809] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0148.809] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0148.809] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0148.809] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0148.809] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0148.809] GdipCreateRegion (region=0x20d910) returned 0x0
	[0148.810] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0148.810] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0148.810] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0148.810] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc1f0dbd) returned 0x0
	[0148.810] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0148.810] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0148.811] GdipReleaseDC (graphics=0x1b929550, hdc=0x17010bee) returned 0x0
	[0148.811] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0148.811] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0148.811] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0148.811] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0148.811] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0148.812] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0148.812] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0148.812] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0148.812] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0148.812] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0148.812] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0148.813] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0148.813] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0148.813] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0148.813] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0148.813] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0148.813] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0148.814] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0148.814] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0148.814] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0148.814] GdipCreateRegion (region=0x20d120) returned 0x0
	[0148.815] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0148.815] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0148.815] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0148.815] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0148.815] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0148.815] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0148.816] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0148.816] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0148.816] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0148.816] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0148.816] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0148.816] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0148.817] OffsetViewportOrgEx (in: hdc=0x17010bee, x=0, y=0, lppt=0x270ece8 | out: lppt=0x270ece8) returned 1
	[0148.817] GdipReleaseDC (graphics=0x1b929550, hdc=0x17010bee) returned 0x0
	[0148.817] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0148.817] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0148.817] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0148.817] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0148.818] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0148.818] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0148.818] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0148.818] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0148.818] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0148.818] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0148.819] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0148.819] GdipCreateRegion (region=0x20d070) returned 0x0
	[0148.819] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0148.819] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0148.819] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0148.819] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0148.820] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0148.820] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0148.820] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0148.820] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0148.820] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0148.821] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0148.821] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0148.821] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0148.821] OffsetViewportOrgEx (in: hdc=0x17010bee, x=0, y=0, lppt=0x270f288 | out: lppt=0x270f288) returned 1
	[0148.821] GetROP2 (hdc=0x17010bee) returned 13
	[0148.821] GetROP2 (hdc=0x17010bee) returned 13
	[0148.822] GetROP2 (hdc=0x17010bee) returned 13
	[0148.822] GetROP2 (hdc=0x17010bee) returned 13
	[0148.822] GetROP2 (hdc=0x17010bee) returned 13
	[0148.822] GetROP2 (hdc=0x17010bee) returned 13
	[0148.822] GetROP2 (hdc=0x17010bee) returned 13
	[0148.822] GetROP2 (hdc=0x17010bee) returned 13
	[0148.823] GdipReleaseDC (graphics=0x1b929550, hdc=0x17010bee) returned 0x0
	[0148.823] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0148.823] GdipReleaseDC (graphics=0x1b929550, hdc=0x17010bee) returned 0x0
	[0148.823] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0148.823] GetDIBits (in: hdc=0x10107f8, hbm=0x7050bef, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0148.824] GetDIBits (in: hdc=0x10107f8, hbm=0x7050bef, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0148.824] GdipCreateFromHDC (hdc=0x16010eab, graphics=0x20d800) returned 0x0
	[0148.824] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0148.824] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0148.824] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0148.824] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0148.825] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0148.825] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0148.825] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0148.825] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0148.825] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0148.825] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0148.826] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0148.826] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0148.826] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0148.826] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0148.826] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0148.826] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0148.827] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0148.827] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0148.827] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0148.827] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0148.827] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0148.827] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0148.827] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0148.828] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0148.828] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0148.828] OffsetViewportOrgEx (in: hdc=0x16010eab, x=0, y=0, lppt=0x2710b50 | out: lppt=0x2710b50) returned 1
	[0148.829] GdipReleaseDC (graphics=0x1b929550, hdc=0x16010eab) returned 0x0
	[0148.829] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc1c0dbd) returned 0x0
	[0148.829] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0148.829] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0148.843] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0148.843] GdipReleaseDC (graphics=0x1b929550, hdc=0x16010eab) returned 0x0
	[0148.843] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0150.351] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0150.351] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0150.352] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0150.352] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0150.352] UpdateWindow (hWnd=0x201d8) 
	[0150.352] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0150.352] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0150.353] GdipCreateFromHDC (hdc=0x77010eab, graphics=0x20cfa0) returned 0x0
	[0150.353] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0150.353] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0150.353] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0150.353] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.354] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0150.354] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0150.354] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.354] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0150.354] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.354] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0150.354] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0150.355] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc1a0dbd) returned 0x0
	[0150.355] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.355] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0150.355] GdipReleaseDC (graphics=0x1b929550, hdc=0x77010eab) returned 0x0
	[0150.355] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0150.356] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.356] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.356] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.356] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0150.356] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0150.356] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0150.357] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0150.357] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0150.357] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.357] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0150.357] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0150.357] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0150.358] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0150.358] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.358] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.358] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.358] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0150.358] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.359] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0150.359] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0150.359] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.359] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0150.359] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0150.359] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0150.359] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0150.360] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0150.360] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0150.360] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0150.360] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0150.360] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0150.360] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.360] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0150.361] OffsetViewportOrgEx (in: hdc=0x77010eab, x=0, y=0, lppt=0x2711d40 | out: lppt=0x2711d40) returned 1
	[0150.361] GdipReleaseDC (graphics=0x1b929550, hdc=0x77010eab) returned 0x0
	[0150.361] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0150.361] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.361] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.361] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.362] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0150.362] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0150.362] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0150.362] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.362] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0150.363] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0150.363] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0150.363] GdipCreateRegion (region=0x20c830) returned 0x0
	[0150.363] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.363] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0150.363] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.363] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0150.364] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0150.364] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0150.364] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0150.364] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.365] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0150.365] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0150.365] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0150.365] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.365] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0150.365] OffsetViewportOrgEx (in: hdc=0x77010eab, x=0, y=0, lppt=0x27122e0 | out: lppt=0x27122e0) returned 1
	[0150.366] GetROP2 (hdc=0x77010eab) returned 13
	[0150.366] GetROP2 (hdc=0x77010eab) returned 13
	[0150.366] GetROP2 (hdc=0x77010eab) returned 13
	[0150.366] GetROP2 (hdc=0x77010eab) returned 13
	[0150.366] GetROP2 (hdc=0x77010eab) returned 13
	[0150.366] GetROP2 (hdc=0x77010eab) returned 13
	[0150.367] GetROP2 (hdc=0x77010eab) returned 13
	[0150.367] GetROP2 (hdc=0x77010eab) returned 13
	[0150.367] GdipReleaseDC (graphics=0x1b929550, hdc=0x77010eab) returned 0x0
	[0150.367] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0150.367] GdipReleaseDC (graphics=0x1b929550, hdc=0x77010eab) returned 0x0
	[0150.368] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0150.368] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0150.368] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0150.369] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0150.369] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2712628, Length=0x70 | out: Destination=0x1afe53a0) 
	[0150.369] ShellExecuteExW (in: pExecInfo=0x2712838*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2712838*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0150.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0150.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0150.552] GdipCreateFromHDC (hdc=0x5a010bef, graphics=0x20c9d0) returned 0x0
	[0150.552] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0150.553] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0150.553] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0150.553] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0150.553] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0150.553] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.553] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0150.553] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0150.554] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.554] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0150.554] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0150.554] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc170dbd) returned 0x0
	[0150.554] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.554] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0150.555] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010bef) returned 0x0
	[0150.555] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0150.555] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.555] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.555] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.555] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0150.555] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0150.556] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0150.556] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0150.556] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0150.556] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.556] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0150.556] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0150.556] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0150.557] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0150.557] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.557] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.557] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.557] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0150.557] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.558] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0150.558] GdipCreateRegion (region=0x20c310) returned 0x0
	[0150.558] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.558] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0150.558] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.558] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0150.558] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.559] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.559] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.559] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0150.559] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0150.559] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0150.559] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.560] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0150.560] OffsetViewportOrgEx (in: hdc=0x5a010bef, x=0, y=0, lppt=0x2713518 | out: lppt=0x2713518) returned 1
	[0150.560] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010bef) returned 0x0
	[0150.560] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0150.560] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.560] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.560] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.561] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0150.561] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0150.561] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0150.561] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.561] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0150.561] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0150.562] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0150.562] GdipCreateRegion (region=0x20c260) returned 0x0
	[0150.562] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.562] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0150.562] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0150.562] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0150.562] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.563] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.563] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0150.563] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0150.563] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0150.563] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0150.563] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.563] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0150.564] OffsetViewportOrgEx (in: hdc=0x5a010bef, x=0, y=0, lppt=0x2713ab8 | out: lppt=0x2713ab8) returned 1
	[0150.564] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.564] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.564] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.564] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.564] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.565] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.565] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.565] GetROP2 (hdc=0x5a010bef) returned 13
	[0150.565] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010bef) returned 0x0
	[0150.565] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0150.566] GdipReleaseDC (graphics=0x1b929550, hdc=0x5a010bef) returned 0x0
	[0150.566] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0150.566] GdipCreateFromHDC (hdc=0x5c010bef, graphics=0x20c9d0) returned 0x0
	[0150.566] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0150.566] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0150.567] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0150.567] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.567] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0150.567] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.567] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.567] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0150.568] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.568] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0150.568] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0150.568] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc140dbd) returned 0x0
	[0150.568] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.568] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0150.569] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c010bef) returned 0x0
	[0150.569] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0150.569] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.569] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.569] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.569] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0150.570] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0150.570] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0150.570] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0150.570] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0150.570] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.570] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0150.571] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0150.571] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0150.571] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0150.571] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.571] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.571] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.571] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0150.572] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.572] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0150.572] GdipCreateRegion (region=0x20c310) returned 0x0
	[0150.572] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.572] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0150.572] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0150.573] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0150.573] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.573] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.573] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0150.573] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0150.573] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0150.573] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0150.574] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.574] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0150.574] OffsetViewportOrgEx (in: hdc=0x5c010bef, x=0, y=0, lppt=0x2714940 | out: lppt=0x2714940) returned 1
	[0150.574] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c010bef) returned 0x0
	[0150.574] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0150.574] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.575] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.575] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.575] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0150.575] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0150.575] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0150.575] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.575] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0150.576] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0150.576] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0150.576] GdipCreateRegion (region=0x20c260) returned 0x0
	[0150.576] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.576] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0150.576] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.577] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0150.577] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.577] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.577] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.577] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0150.577] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0150.577] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0150.578] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.578] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0150.578] OffsetViewportOrgEx (in: hdc=0x5c010bef, x=0, y=0, lppt=0x2714ee0 | out: lppt=0x2714ee0) returned 1
	[0150.578] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.578] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.578] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.579] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.579] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.579] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.579] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.579] GetROP2 (hdc=0x5c010bef) returned 13
	[0150.579] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c010bef) returned 0x0
	[0150.580] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0150.580] GdipReleaseDC (graphics=0x1b929550, hdc=0x5c010bef) returned 0x0
	[0150.580] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0150.784] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0150.784] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x1
	[0150.784] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0150.784] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0150.784] GdipCreateFromHDC (hdc=0x5d010bef, graphics=0x20c9d0) returned 0x0
	[0150.785] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0150.785] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0150.785] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0150.785] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0150.785] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0150.785] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.786] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0150.786] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0150.786] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.786] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0150.786] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0150.786] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc110dbd) returned 0x0
	[0150.787] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.787] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0150.787] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d010bef) returned 0x0
	[0150.787] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0150.787] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.787] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.788] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.788] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0150.788] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0150.788] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0150.788] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0150.788] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0150.788] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.789] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0150.789] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0150.789] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0150.789] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0150.789] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.789] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.790] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.790] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0150.790] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.790] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0150.790] GdipCreateRegion (region=0x20c310) returned 0x0
	[0150.791] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.791] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0150.791] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.791] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0150.791] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.791] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.791] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.792] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0150.792] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0150.792] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0150.792] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.792] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0150.792] OffsetViewportOrgEx (in: hdc=0x5d010bef, x=0, y=0, lppt=0x2715dd8 | out: lppt=0x2715dd8) returned 1
	[0150.793] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d010bef) returned 0x0
	[0150.793] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0150.793] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.793] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.794] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.794] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0150.794] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0150.794] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0150.794] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.794] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0150.795] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0150.795] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0150.795] GdipCreateRegion (region=0x20c260) returned 0x0
	[0150.795] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.796] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0150.796] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0150.796] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0150.796] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.796] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.796] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0150.796] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0150.797] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0150.797] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0150.797] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.797] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0150.797] OffsetViewportOrgEx (in: hdc=0x5d010bef, x=0, y=0, lppt=0x2716378 | out: lppt=0x2716378) returned 1
	[0150.797] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.798] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.798] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.798] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.798] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.798] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.798] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.799] GetROP2 (hdc=0x5d010bef) returned 13
	[0150.799] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d010bef) returned 0x0
	[0150.799] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0150.799] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d010bef) returned 0x0
	[0150.799] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0150.800] GdipCreateFromHDC (hdc=0x5e010bef, graphics=0x20c9d0) returned 0x0
	[0150.800] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0150.800] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0150.800] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0150.800] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.800] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0150.801] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.801] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.801] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0150.802] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.802] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0150.802] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0150.802] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc0e0dbd) returned 0x0
	[0150.803] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.803] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0150.803] GdipReleaseDC (graphics=0x1b929550, hdc=0x5e010bef) returned 0x0
	[0150.803] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0150.803] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.803] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.804] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.804] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0150.804] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0150.804] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0150.804] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0150.804] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0150.804] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.805] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0150.805] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0150.805] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0150.805] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0150.805] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.805] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.806] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.806] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0150.806] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.806] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0150.806] GdipCreateRegion (region=0x20c310) returned 0x0
	[0150.806] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.807] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0150.807] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0150.807] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0150.807] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.807] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0150.807] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0150.808] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0150.808] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0150.808] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0150.808] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.808] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0150.808] OffsetViewportOrgEx (in: hdc=0x5e010bef, x=0, y=0, lppt=0x27171d8 | out: lppt=0x27171d8) returned 1
	[0150.809] GdipReleaseDC (graphics=0x1b929550, hdc=0x5e010bef) returned 0x0
	[0150.809] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0150.809] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.809] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0150.809] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0150.810] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0150.810] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0150.810] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0150.810] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0150.810] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0150.810] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0150.811] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0150.811] GdipCreateRegion (region=0x20c260) returned 0x0
	[0150.811] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0150.811] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0150.811] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0150.812] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0150.812] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.812] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0150.812] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0150.812] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0150.812] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0150.812] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0150.813] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0150.813] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0150.813] OffsetViewportOrgEx (in: hdc=0x5e010bef, x=0, y=0, lppt=0x2717778 | out: lppt=0x2717778) returned 1
	[0150.813] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.813] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.813] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.814] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.814] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.814] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.814] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.814] GetROP2 (hdc=0x5e010bef) returned 13
	[0150.814] GdipReleaseDC (graphics=0x1b929550, hdc=0x5e010bef) returned 0x0
	[0150.814] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0150.815] GdipReleaseDC (graphics=0x1b929550, hdc=0x5e010bef) returned 0x0
	[0150.815] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0151.052] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0151.053] InvalidateRect (hWnd=0x401b4, lpRect=0x20cf20, bErase=0) returned 1
	[0151.053] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0151.053] InvalidateRect (hWnd=0x401b4, lpRect=0x20ce70, bErase=0) returned 1
	[0151.053] UpdateWindow (hWnd=0x401b4) 
	[0151.053] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20c388 | out: lpPaint=0x20c388) returned 0x4010280
	[0151.053] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0151.053] GdipCreateFromHDC (hdc=0x6010eb7, graphics=0x20c190) returned 0x0
	[0151.053] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0151.054] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0151.054] GdipCreateMatrix (matrix=0x20c2c0) returned 0x0
	[0151.054] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0151.054] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c320) returned 0x0
	[0151.054] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0151.054] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0151.055] GdipCreateRegion (region=0x20c2c0) returned 0x0
	[0151.055] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0151.055] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2f0) returned 0x0
	[0151.055] GdipSaveGraphics (graphics=0x1b929550, state=0x20c3c0) returned 0x0
	[0151.055] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc0b0dbd) returned 0x0
	[0151.055] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0151.055] GdipGetDC (graphics=0x1b929550, hdc=0x20b7a0) returned 0x0
	[0151.056] GdipReleaseDC (graphics=0x1b929550, hdc=0x6010eb7) returned 0x0
	[0151.056] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20be90) returned 0x0
	[0151.056] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.056] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.056] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0151.056] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20bec0) returned 0x0
	[0151.057] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20bec0) returned 0x0
	[0151.057] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20bec0) returned 0x0
	[0151.057] GdipGetFontSize (font=0x1b912930, size=0x20bec0) returned 0x0
	[0151.057] GdipGetFontStyle (font=0x1b912930, style=0x20bec0) returned 0x0
	[0151.057] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0151.057] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20bb50) returned 0x0
	[0151.058] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bb60) returned 0x0
	[0151.058] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0151.058] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0151.058] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0151.058] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.058] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.058] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20ba78, stringFormat=0x1b912930, boundingBox=0x20ba68, codepointsFitted=0x20ba64, linesFilled=0x20ba60) returned 0x0
	[0151.059] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0151.059] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0151.059] GdipCreateRegion (region=0x20bad0) returned 0x0
	[0151.059] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0151.059] GdipCreateMatrix (matrix=0x20bad0) returned 0x0
	[0151.059] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0151.060] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20bb30) returned 0x0
	[0151.060] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0151.060] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0151.060] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0151.060] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20bb80) returned 0x0
	[0151.060] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20bb40) returned 0x0
	[0151.060] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20bb40) returned 0x0
	[0151.061] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0151.061] GdipGetDC (graphics=0x1b929550, hdc=0x20bbb0) returned 0x0
	[0151.061] OffsetViewportOrgEx (in: hdc=0x6010eb7, x=0, y=0, lppt=0x2718700 | out: lppt=0x2718700) returned 1
	[0151.061] GdipReleaseDC (graphics=0x1b929550, hdc=0x6010eb7) returned 0x0
	[0151.061] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20bbf0) returned 0x0
	[0151.061] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.062] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.062] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0151.062] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20bc60) returned 0x0
	[0151.062] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20bb70, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0151.062] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0151.062] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0151.063] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20bf50) returned 0x0
	[0151.063] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0151.063] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0151.063] GdipCreateRegion (region=0x20ba20) returned 0x0
	[0151.063] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0151.063] GdipCreateMatrix (matrix=0x20ba20) returned 0x0
	[0151.063] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0151.064] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20ba80) returned 0x0
	[0151.064] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0151.064] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0151.064] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0151.064] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20bad0) returned 0x0
	[0151.064] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20ba90) returned 0x0
	[0151.065] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20ba90) returned 0x0
	[0151.065] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0151.065] GdipGetDC (graphics=0x1b929550, hdc=0x20bb00) returned 0x0
	[0151.065] OffsetViewportOrgEx (in: hdc=0x6010eb7, x=0, y=0, lppt=0x2718ca0 | out: lppt=0x2718ca0) returned 1
	[0151.065] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.065] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.065] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.066] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.066] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.066] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.066] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.066] GetROP2 (hdc=0x6010eb7) returned 13
	[0151.066] GdipReleaseDC (graphics=0x1b929550, hdc=0x6010eb7) returned 0x0
	[0151.067] GdipGetDC (graphics=0x1b929550, hdc=0x20c290) returned 0x0
	[0151.067] GdipReleaseDC (graphics=0x1b929550, hdc=0x6010eb7) returned 0x0
	[0151.067] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0151.067] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0151.067] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0151.067] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0151.067] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20cc80) returned 0x0
	[0151.067] GetCapture () returned 0x401b4
	[0151.067] ReleaseCapture () 
	[0151.067] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0151.563] GdipCreateFromHDC (hdc=0x9010ee3, graphics=0x20c9d0) returned 0x0
	[0151.563] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0151.563] GdipSetClipRectI (graphics=0x1b929550, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0151.563] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0151.564] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0151.564] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0151.564] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0151.564] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0151.564] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0151.564] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0151.564] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0151.565] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0151.565] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc080dbd) returned 0x0
	[0151.565] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0151.565] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0151.565] GdipReleaseDC (graphics=0x1b929550, hdc=0x9010ee3) returned 0x0
	[0151.566] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0151.566] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.566] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.566] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0151.566] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0151.566] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0151.567] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0151.567] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0151.567] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0151.567] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0151.567] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0151.567] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0151.568] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0151.568] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0151.568] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0151.568] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.568] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.568] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0151.568] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0151.569] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0151.569] GdipCreateRegion (region=0x20c310) returned 0x0
	[0151.569] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0151.569] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0151.569] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0151.569] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0151.569] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0151.570] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0151.570] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0151.570] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0151.570] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0151.570] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0151.570] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0151.571] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0151.571] OffsetViewportOrgEx (in: hdc=0x9010ee3, x=0, y=0, lppt=0x2719b78 | out: lppt=0x2719b78) returned 1
	[0151.571] GdipReleaseDC (graphics=0x1b929550, hdc=0x9010ee3) returned 0x0
	[0151.571] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0151.571] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.571] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0151.571] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0151.572] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0151.572] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0151.572] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0151.572] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0151.572] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0151.572] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0151.573] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0151.573] GdipCreateRegion (region=0x20c260) returned 0x0
	[0151.573] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0151.573] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0151.573] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0151.573] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0151.573] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0151.574] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0151.574] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0151.574] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0151.574] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0151.574] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0151.574] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0151.575] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0151.575] OffsetViewportOrgEx (in: hdc=0x9010ee3, x=0, y=0, lppt=0x271a118 | out: lppt=0x271a118) returned 1
	[0151.575] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.575] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.575] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.576] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.576] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.576] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.576] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.576] GetROP2 (hdc=0x9010ee3) returned 13
	[0151.576] GdipReleaseDC (graphics=0x1b929550, hdc=0x9010ee3) returned 0x0
	[0151.577] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0151.577] GdipReleaseDC (graphics=0x1b929550, hdc=0x9010ee3) returned 0x0
	[0151.577] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0153.301] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0153.301] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0153.301] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0153.301] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0153.301] GdipCreateFromHDC (hdc=0xe010ee0, graphics=0x20d7e0) returned 0x0
	[0153.302] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0153.302] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0153.302] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0153.302] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.302] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0153.302] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0153.302] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.303] GdipCreateRegion (region=0x20d910) returned 0x0
	[0153.303] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.303] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0153.303] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0153.303] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc050dbd) returned 0x0
	[0153.303] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.304] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0153.304] GdipReleaseDC (graphics=0x1b929550, hdc=0xe010ee0) returned 0x0
	[0153.304] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0153.304] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.304] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.305] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.305] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0153.305] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0153.305] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0153.305] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0153.305] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0153.306] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.306] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0153.306] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0153.306] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0153.306] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0153.306] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.307] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.307] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.307] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0153.307] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.307] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0153.307] GdipCreateRegion (region=0x20d120) returned 0x0
	[0153.307] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.308] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0153.308] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0153.308] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0153.308] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0153.308] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0153.309] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0153.309] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0153.309] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0153.309] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0153.309] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.310] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0153.310] OffsetViewportOrgEx (in: hdc=0xe010ee0, x=0, y=0, lppt=0x271b128 | out: lppt=0x271b128) returned 1
	[0153.310] GdipReleaseDC (graphics=0x1b929550, hdc=0xe010ee0) returned 0x0
	[0153.310] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0153.311] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.311] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.311] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.311] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0153.312] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0153.312] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0153.312] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.312] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0153.313] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0153.313] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0153.313] GdipCreateRegion (region=0x20d070) returned 0x0
	[0153.313] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.313] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0153.314] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.314] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0153.314] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0153.314] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0153.315] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.315] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0153.315] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0153.315] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0153.315] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.316] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0153.316] OffsetViewportOrgEx (in: hdc=0xe010ee0, x=0, y=0, lppt=0x271b6c8 | out: lppt=0x271b6c8) returned 1
	[0153.316] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.316] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.316] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.317] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.317] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.317] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.317] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.317] GetROP2 (hdc=0xe010ee0) returned 13
	[0153.318] GdipReleaseDC (graphics=0x1b929550, hdc=0xe010ee0) returned 0x0
	[0153.318] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0153.318] GdipReleaseDC (graphics=0x1b929550, hdc=0xe010ee0) returned 0x0
	[0153.318] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0153.530] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0153.530] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0153.530] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0153.530] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0153.530] UpdateWindow (hWnd=0x201d8) 
	[0153.530] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0153.530] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0153.530] GdipCreateFromHDC (hdc=0x3f010f96, graphics=0x20cfa0) returned 0x0
	[0153.531] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0153.531] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0153.531] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0153.536] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0153.536] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0153.536] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0153.536] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0153.536] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0153.536] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.536] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0153.537] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0153.537] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffc020dbd) returned 0x0
	[0153.537] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.537] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0153.537] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f010f96) returned 0x0
	[0153.538] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0153.538] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.538] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.538] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.538] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0153.538] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0153.539] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0153.539] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0153.539] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0153.539] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.539] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0153.539] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0153.539] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0153.540] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0153.540] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.540] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.540] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.540] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0153.540] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.541] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0153.541] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0153.541] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.541] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0153.541] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.541] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0153.542] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0153.542] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0153.542] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.542] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0153.542] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0153.542] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0153.542] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.543] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0153.543] OffsetViewportOrgEx (in: hdc=0x3f010f96, x=0, y=0, lppt=0x271c6f8 | out: lppt=0x271c6f8) returned 1
	[0153.543] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f010f96) returned 0x0
	[0153.543] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0153.543] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.543] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.544] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.544] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0153.544] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0153.544] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0153.544] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.545] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0153.545] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0153.545] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0153.545] GdipCreateRegion (region=0x20c830) returned 0x0
	[0153.545] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.545] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0153.546] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0153.546] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0153.546] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0153.546] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0153.546] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0153.546] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0153.546] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0153.547] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0153.547] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.547] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0153.547] OffsetViewportOrgEx (in: hdc=0x3f010f96, x=0, y=0, lppt=0x271cc98 | out: lppt=0x271cc98) returned 1
	[0153.547] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.548] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.548] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.548] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.548] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.548] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.549] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.549] GetROP2 (hdc=0x3f010f96) returned 13
	[0153.549] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f010f96) returned 0x0
	[0153.549] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0153.549] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f010f96) returned 0x0
	[0153.549] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0153.550] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0153.550] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0153.550] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0153.551] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x271cfe0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0153.551] ShellExecuteExW (pExecInfo=0x271d1f0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0153.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0153.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0153.626] GdipCreateFromHDC (hdc=0x63010f96, graphics=0x20c9d0) returned 0x0
	[0153.627] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0153.627] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0153.627] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0153.627] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.627] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0153.628] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0153.628] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.628] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0153.628] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.628] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0153.628] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0153.629] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbff0dbd) returned 0x0
	[0153.629] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.629] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0153.629] GdipReleaseDC (graphics=0x1b929550, hdc=0x63010f96) returned 0x0
	[0153.629] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0153.630] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.630] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.630] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.630] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0153.630] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0153.630] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0153.631] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0153.631] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0153.631] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.631] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0153.631] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0153.631] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0153.632] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0153.632] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.632] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.632] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.632] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0153.633] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.633] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0153.633] GdipCreateRegion (region=0x20c310) returned 0x0
	[0153.633] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.633] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0153.633] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0153.634] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0153.634] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0153.634] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0153.634] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0153.634] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0153.634] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0153.635] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0153.635] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.635] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0153.635] OffsetViewportOrgEx (in: hdc=0x63010f96, x=0, y=0, lppt=0x271def8 | out: lppt=0x271def8) returned 1
	[0153.635] GdipReleaseDC (graphics=0x1b929550, hdc=0x63010f96) returned 0x0
	[0153.635] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0153.636] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.636] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.636] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.636] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0153.636] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0153.636] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0153.637] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.637] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0153.637] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0153.637] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0153.637] GdipCreateRegion (region=0x20c260) returned 0x0
	[0153.637] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.638] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0153.638] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.638] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0153.638] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0153.638] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0153.638] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.638] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0153.639] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0153.639] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0153.639] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.639] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0153.639] OffsetViewportOrgEx (in: hdc=0x63010f96, x=0, y=0, lppt=0x271e498 | out: lppt=0x271e498) returned 1
	[0153.639] GetROP2 (hdc=0x63010f96) returned 13
	[0153.639] GetROP2 (hdc=0x63010f96) returned 13
	[0153.640] GetROP2 (hdc=0x63010f96) returned 13
	[0153.640] GetROP2 (hdc=0x63010f96) returned 13
	[0153.640] GetROP2 (hdc=0x63010f96) returned 13
	[0153.640] GetROP2 (hdc=0x63010f96) returned 13
	[0153.640] GetROP2 (hdc=0x63010f96) returned 13
	[0153.641] GetROP2 (hdc=0x63010f96) returned 13
	[0153.641] GdipReleaseDC (graphics=0x1b929550, hdc=0x63010f96) returned 0x0
	[0153.641] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0153.641] GdipReleaseDC (graphics=0x1b929550, hdc=0x63010f96) returned 0x0
	[0153.641] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0153.642] GdipCreateFromHDC (hdc=0x65010f96, graphics=0x20c9d0) returned 0x0
	[0153.642] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0153.642] GdipSetClipRectI (graphics=0x1b929550, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0153.642] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0153.642] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0153.642] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0153.642] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0153.643] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0153.643] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0153.643] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.643] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0153.643] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0153.643] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbfc0dbd) returned 0x0
	[0153.644] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.644] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0153.644] GdipReleaseDC (graphics=0x1b929550, hdc=0x65010f96) returned 0x0
	[0153.644] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0153.644] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.644] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.644] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.645] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0153.645] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0153.645] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0153.645] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0153.645] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0153.645] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.646] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0153.646] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0153.646] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0153.646] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0153.646] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.646] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.646] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.647] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0153.647] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.647] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0153.647] GdipCreateRegion (region=0x20c310) returned 0x0
	[0153.647] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.647] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0153.648] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.648] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0153.648] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0153.648] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0153.648] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.648] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0153.648] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0153.649] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0153.649] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.649] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0153.649] OffsetViewportOrgEx (in: hdc=0x65010f96, x=0, y=0, lppt=0x271f2f8 | out: lppt=0x271f2f8) returned 1
	[0153.649] GdipReleaseDC (graphics=0x1b929550, hdc=0x65010f96) returned 0x0
	[0153.649] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0153.650] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.650] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.650] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.650] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0153.650] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0153.651] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0153.651] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.651] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0153.651] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0153.651] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0153.652] GdipCreateRegion (region=0x20c260) returned 0x0
	[0153.652] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.652] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0153.652] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0153.652] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0153.652] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0153.652] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0153.653] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0153.653] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0153.653] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0153.653] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0153.653] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.653] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0153.654] OffsetViewportOrgEx (in: hdc=0x65010f96, x=0, y=0, lppt=0x271f898 | out: lppt=0x271f898) returned 1
	[0153.654] GetROP2 (hdc=0x65010f96) returned 13
	[0153.654] GetROP2 (hdc=0x65010f96) returned 13
	[0153.654] GetROP2 (hdc=0x65010f96) returned 13
	[0153.654] GetROP2 (hdc=0x65010f96) returned 13
	[0153.654] GetROP2 (hdc=0x65010f96) returned 13
	[0153.655] GetROP2 (hdc=0x65010f96) returned 13
	[0153.655] GetROP2 (hdc=0x65010f96) returned 13
	[0153.655] GetROP2 (hdc=0x65010f96) returned 13
	[0153.655] GdipReleaseDC (graphics=0x1b929550, hdc=0x65010f96) returned 0x0
	[0153.655] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0153.655] GdipReleaseDC (graphics=0x1b929550, hdc=0x65010f96) returned 0x0
	[0153.656] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0153.888] GdipCreateFromHDC (hdc=0x27010f99, graphics=0x20d7e0) returned 0x0
	[0153.888] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0153.888] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0153.889] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0153.889] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.889] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0153.889] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0153.889] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.889] GdipCreateRegion (region=0x20d910) returned 0x0
	[0153.889] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.890] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0153.890] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0153.890] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbf90dbd) returned 0x0
	[0153.890] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.891] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0153.891] GdipReleaseDC (graphics=0x1b929550, hdc=0x27010f99) returned 0x0
	[0153.891] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0153.891] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.891] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.891] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.892] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0153.892] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0153.892] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0153.892] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0153.892] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0153.892] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.892] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0153.893] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0153.893] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0153.893] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0153.893] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.893] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.893] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.893] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0153.894] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.894] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0153.894] GdipCreateRegion (region=0x20d120) returned 0x0
	[0153.894] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.894] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0153.894] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0153.895] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0153.895] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0153.895] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0153.895] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0153.895] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0153.895] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0153.895] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0153.896] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.896] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0153.896] OffsetViewportOrgEx (in: hdc=0x27010f99, x=0, y=0, lppt=0x2720920 | out: lppt=0x2720920) returned 1
	[0153.896] GdipReleaseDC (graphics=0x1b929550, hdc=0x27010f99) returned 0x0
	[0153.896] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0153.896] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.897] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0153.897] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0153.897] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0153.897] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0153.897] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0153.897] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0153.898] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0153.898] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0153.898] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0153.898] GdipCreateRegion (region=0x20d070) returned 0x0
	[0153.898] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0153.898] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0153.899] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0153.899] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0153.899] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0153.899] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0153.899] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0153.900] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0153.900] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0153.900] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0153.900] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0153.900] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0153.900] OffsetViewportOrgEx (in: hdc=0x27010f99, x=0, y=0, lppt=0x2720ec0 | out: lppt=0x2720ec0) returned 1
	[0153.900] GetROP2 (hdc=0x27010f99) returned 13
	[0153.901] GetROP2 (hdc=0x27010f99) returned 13
	[0153.901] GetROP2 (hdc=0x27010f99) returned 13
	[0153.901] GetROP2 (hdc=0x27010f99) returned 13
	[0153.901] GetROP2 (hdc=0x27010f99) returned 13
	[0153.901] GetROP2 (hdc=0x27010f99) returned 13
	[0153.901] GetROP2 (hdc=0x27010f99) returned 13
	[0153.902] GetROP2 (hdc=0x27010f99) returned 13
	[0153.902] GdipReleaseDC (graphics=0x1b929550, hdc=0x27010f99) returned 0x0
	[0153.902] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0153.902] GdipReleaseDC (graphics=0x1b929550, hdc=0x27010f99) returned 0x0
	[0153.902] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0156.435] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0156.435] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0xd
	[0156.435] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0156.435] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0156.435] GdipCreateFromHDC (hdc=0xb010ede, graphics=0x20d7e0) returned 0x0
	[0156.435] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0156.436] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0156.436] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0156.436] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0156.436] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0156.436] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0156.436] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.437] GdipCreateRegion (region=0x20d910) returned 0x0
	[0156.437] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.437] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0156.437] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0156.437] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbf60dbd) returned 0x0
	[0156.437] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.437] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0156.438] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010ede) returned 0x0
	[0156.438] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0156.438] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.438] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.438] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.438] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0156.439] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0156.439] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0156.439] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0156.439] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0156.439] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.439] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0156.439] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0156.440] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0156.440] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0156.440] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.440] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.440] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.440] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0156.440] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.441] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0156.441] GdipCreateRegion (region=0x20d120) returned 0x0
	[0156.441] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.441] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0156.441] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0156.441] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0156.442] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0156.442] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0156.442] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0156.442] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0156.442] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0156.442] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0156.442] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.443] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0156.443] OffsetViewportOrgEx (in: hdc=0xb010ede, x=0, y=0, lppt=0x2721df0 | out: lppt=0x2721df0) returned 1
	[0156.443] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010ede) returned 0x0
	[0156.443] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0156.443] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.443] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.443] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.444] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0156.444] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0156.444] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0156.444] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.445] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0156.445] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0156.445] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0156.445] GdipCreateRegion (region=0x20d070) returned 0x0
	[0156.445] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.445] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0156.446] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0156.446] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0156.446] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0156.446] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0156.446] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.446] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0156.446] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0156.447] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0156.447] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.447] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0156.447] OffsetViewportOrgEx (in: hdc=0xb010ede, x=0, y=0, lppt=0x2722390 | out: lppt=0x2722390) returned 1
	[0156.447] GetROP2 (hdc=0xb010ede) returned 13
	[0156.448] GetROP2 (hdc=0xb010ede) returned 13
	[0156.448] GetROP2 (hdc=0xb010ede) returned 13
	[0156.448] GetROP2 (hdc=0xb010ede) returned 13
	[0156.448] GetROP2 (hdc=0xb010ede) returned 13
	[0156.448] GetROP2 (hdc=0xb010ede) returned 13
	[0156.449] GetROP2 (hdc=0xb010ede) returned 13
	[0156.449] GetROP2 (hdc=0xb010ede) returned 13
	[0156.449] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010ede) returned 0x0
	[0156.449] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0156.449] GdipReleaseDC (graphics=0x1b929550, hdc=0xb010ede) returned 0x0
	[0156.449] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0156.655] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0156.655] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0156.655] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0156.655] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0156.656] UpdateWindow (hWnd=0x201d8) returned 0
	[0156.656] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0156.656] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0156.656] GdipCreateFromHDC (hdc=0xf010ede, graphics=0x20cfa0) returned 0x0
	[0156.656] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0156.656] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0156.656] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0156.656] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0156.657] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0156.657] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0156.657] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0156.657] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0156.657] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.657] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0156.657] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0156.658] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbf30dbd) returned 0x0
	[0156.658] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.658] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0156.658] GdipReleaseDC (graphics=0x1b929550, hdc=0xf010ede) returned 0x0
	[0156.658] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0156.658] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.659] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.659] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.659] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0156.659] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0156.659] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0156.659] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0156.659] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0156.660] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.660] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0156.660] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0156.660] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0156.660] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0156.661] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.661] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.661] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.661] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0156.661] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.661] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0156.661] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0156.662] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.662] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0156.662] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0156.662] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0156.662] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0156.662] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0156.663] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.663] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0156.663] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0156.663] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0156.663] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.663] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0156.663] OffsetViewportOrgEx (in: hdc=0xf010ede, x=0, y=0, lppt=0x2723388 | out: lppt=0x2723388) returned 1
	[0156.664] GdipReleaseDC (graphics=0x1b929550, hdc=0xf010ede) returned 0x0
	[0156.664] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0156.665] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.665] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.665] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.665] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0156.665] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0156.665] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0156.666] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.666] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0156.666] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0156.666] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0156.666] GdipCreateRegion (region=0x20c830) returned 0x0
	[0156.666] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.676] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0156.677] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0156.677] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0156.677] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0156.677] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0156.677] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0156.677] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0156.678] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0156.678] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0156.678] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.678] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0156.678] OffsetViewportOrgEx (in: hdc=0xf010ede, x=0, y=0, lppt=0x2723928 | out: lppt=0x2723928) returned 1
	[0156.678] GetROP2 (hdc=0xf010ede) returned 13
	[0156.679] GetROP2 (hdc=0xf010ede) returned 13
	[0156.679] GetROP2 (hdc=0xf010ede) returned 13
	[0156.679] GetROP2 (hdc=0xf010ede) returned 13
	[0156.679] GetROP2 (hdc=0xf010ede) returned 13
	[0156.679] GetROP2 (hdc=0xf010ede) returned 13
	[0156.679] GetROP2 (hdc=0xf010ede) returned 13
	[0156.679] GetROP2 (hdc=0xf010ede) returned 13
	[0156.680] GdipReleaseDC (graphics=0x1b929550, hdc=0xf010ede) returned 0x0
	[0156.680] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0156.680] GdipReleaseDC (graphics=0x1b929550, hdc=0xf010ede) returned 0x0
	[0156.680] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0156.680] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0156.680] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0156.681] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0156.681] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2723c70, Length=0x70 | out: Destination=0x1afe53a0) 
	[0156.681] ShellExecuteExW (in: pExecInfo=0x2723e80*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2723e80*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0156.755] GdipCreateFromHDC (hdc=0x7c010e6d, graphics=0x20c9d0) returned 0x0
	[0156.756] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0156.756] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0156.756] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0156.756] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0156.756] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0156.756] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0156.757] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.757] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0156.757] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.757] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0156.757] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0156.757] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbf00dbd) returned 0x0
	[0156.758] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.758] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0156.758] GdipReleaseDC (graphics=0x1b929550, hdc=0x7c010e6d) returned 0x0
	[0156.758] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0156.758] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.759] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.759] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.759] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0156.759] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0156.759] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0156.759] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0156.759] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0156.760] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.760] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0156.760] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0156.760] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0156.760] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0156.761] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.761] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.761] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.761] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0156.761] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.761] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0156.761] GdipCreateRegion (region=0x20c310) returned 0x0
	[0156.762] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.762] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0156.762] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0156.762] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0156.762] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0156.762] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0156.762] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0156.763] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0156.763] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0156.763] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0156.763] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.763] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0156.763] OffsetViewportOrgEx (in: hdc=0x7c010e6d, x=0, y=0, lppt=0x2724b88 | out: lppt=0x2724b88) returned 1
	[0156.764] GdipReleaseDC (graphics=0x1b929550, hdc=0x7c010e6d) returned 0x0
	[0156.764] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0156.764] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.764] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.764] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.764] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0156.765] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0156.765] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0156.765] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.765] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0156.765] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0156.765] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0156.765] GdipCreateRegion (region=0x20c260) returned 0x0
	[0156.766] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.766] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0156.766] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0156.766] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0156.766] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0156.766] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0156.766] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.767] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0156.767] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0156.767] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0156.767] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.767] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0156.768] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbb0407f9
	[0156.768] OffsetViewportOrgEx (in: hdc=0x7c010e6d, x=0, y=0, lppt=0x2725128 | out: lppt=0x2725128) returned 1
	[0156.768] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.768] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.768] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.769] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.769] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.769] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.769] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.769] GetROP2 (hdc=0x7c010e6d) returned 13
	[0156.769] GdipReleaseDC (graphics=0x1b929550, hdc=0x7c010e6d) returned 0x0
	[0156.769] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0156.770] GdipReleaseDC (graphics=0x1b929550, hdc=0x7c010e6d) returned 0x0
	[0156.770] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0156.848] GdipCreateFromHDC (hdc=0x70107fc, graphics=0x20d770) returned 0x0
	[0156.848] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0156.848] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0156.848] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0156.848] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d6c0) returned 0x0
	[0156.849] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0156.849] GdipCreateRegion (region=0x20d660) returned 0x0
	[0156.849] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.849] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0156.849] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.849] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0156.849] GdipCreateRegion (region=0x20d630) returned 0x0
	[0156.850] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.850] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0156.850] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0156.850] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d690) returned 0x0
	[0156.850] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0156.850] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.851] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0156.851] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.851] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0156.851] OffsetViewportOrgEx (in: hdc=0x70107fc, x=0, y=0, lppt=0x27258d0 | out: lppt=0x27258d0) returned 1
	[0156.851] GdipReleaseDC (graphics=0x1b929550, hdc=0x70107fc) returned 0x0
	[0156.852] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0156.852] GetDIBits (in: hdc=0x10107f8, hbm=0x14051003, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0156.853] GetDIBits (in: hdc=0x10107f8, hbm=0x14051003, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0156.853] GdipCreateFromHDC (hdc=0xffffffffb3010fec, graphics=0x20d750) returned 0x0
	[0156.853] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0156.853] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0156.853] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0156.853] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0156.854] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0156.855] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0156.855] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0156.855] GdipCreateRegion (region=0x20d910) returned 0x0
	[0156.855] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0156.855] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0156.856] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0156.856] GdipCreateRegion (region=0x20d400) returned 0x0
	[0156.856] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0156.856] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0156.856] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0156.856] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0156.857] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0156.857] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0156.857] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0156.857] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.857] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0156.857] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0156.858] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0156.858] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0156.858] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0156.858] OffsetViewportOrgEx (in: hdc=0xffffffffb3010fec, x=0, y=0, lppt=0x2727100 | out: lppt=0x2727100) returned 1
	[0156.858] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffb3010fec) returned 0x0
	[0156.859] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbeb0dbd) returned 0x0
	[0156.859] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0156.859] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0156.859] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffb3010fec) returned 0x0
	[0156.859] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0156.859] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0156.859] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0156.860] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.860] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0156.860] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0156.860] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0156.860] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0156.861] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0156.861] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.861] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0156.861] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffb3010fec) returned 0x0
	[0156.861] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0156.862] GdipCreateFromHDC (hdc=0x3b010ff8, graphics=0x20d7e0) returned 0x0
	[0156.862] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0156.862] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0156.862] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0156.862] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0156.862] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0156.863] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0156.863] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0156.863] GdipCreateRegion (region=0x20d910) returned 0x0
	[0156.863] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0156.863] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0156.863] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0156.863] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbe90dbd) returned 0x0
	[0156.864] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0156.864] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0156.864] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3b010ff8) returned 0x0
	[0156.864] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0156.864] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.864] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.865] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.865] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0156.865] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0156.865] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0156.865] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0156.865] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0156.866] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.866] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0156.866] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0156.866] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0156.867] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0156.867] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.867] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.867] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.867] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0156.868] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.868] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0156.868] GdipCreateRegion (region=0x20d120) returned 0x0
	[0156.868] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0156.868] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0156.868] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0156.869] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0156.869] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0156.869] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0156.869] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.869] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0156.869] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0156.869] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0156.870] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0156.870] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0156.870] OffsetViewportOrgEx (in: hdc=0x3b010ff8, x=0, y=0, lppt=0x2728208 | out: lppt=0x2728208) returned 1
	[0156.870] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3b010ff8) returned 0x0
	[0156.870] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0156.870] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.871] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0156.871] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0156.871] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0156.871] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0156.871] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0156.871] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0156.872] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0156.872] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0156.872] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0156.872] GdipCreateRegion (region=0x20d070) returned 0x0
	[0156.872] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0156.872] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0156.873] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0156.873] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0156.873] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0156.873] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0156.873] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0156.873] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0156.874] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0156.874] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0156.874] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0156.874] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0156.874] OffsetViewportOrgEx (in: hdc=0x3b010ff8, x=0, y=0, lppt=0x27287a8 | out: lppt=0x27287a8) returned 1
	[0156.874] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.875] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.875] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.875] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.875] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.875] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.875] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.875] GetROP2 (hdc=0x3b010ff8) returned 13
	[0156.876] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3b010ff8) returned 0x0
	[0156.876] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0156.876] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3b010ff8) returned 0x0
	[0156.876] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0156.876] GetDIBits (in: hdc=0x4010280, hbm=0x1c050ffc, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0156.877] GetDIBits (in: hdc=0x4010280, hbm=0x1c050ffc, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0156.877] GdipCreateFromHDC (hdc=0x18011003, graphics=0x20d800) returned 0x0
	[0156.877] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0156.877] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0156.877] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0156.877] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0156.877] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0156.878] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0156.878] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0156.878] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0156.878] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0156.878] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0156.878] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0156.878] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0156.879] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0156.879] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0156.879] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0156.879] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d510) returned 0x0
	[0156.879] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0156.879] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0156.880] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0156.880] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0156.880] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0156.880] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0156.880] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0156.880] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0156.880] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0156.881] OffsetViewportOrgEx (in: hdc=0x18011003, x=0, y=0, lppt=0x272a070 | out: lppt=0x272a070) returned 1
	[0156.881] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x18011003) returned 0x0
	[0156.881] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbe60dbd) returned 0x0
	[0156.882] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0156.882] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0156.889] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0156.889] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x18011003) returned 0x0
	[0156.889] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0158.879] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0158.879] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0158.879] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0158.879] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0158.879] GdipCreateFromHDC (hdc=0x3e01102c, graphics=0x20d7e0) returned 0x0
	[0158.880] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0158.880] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0158.880] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0158.880] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0158.880] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0158.880] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0158.881] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0158.881] GdipCreateRegion (region=0x20d910) returned 0x0
	[0158.881] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0158.881] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0158.881] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0158.881] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbe40dbd) returned 0x0
	[0158.882] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0158.882] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0158.882] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e01102c) returned 0x0
	[0158.882] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0158.882] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.883] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.883] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0158.883] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0158.883] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0158.883] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0158.883] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0158.883] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0158.884] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0158.884] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0158.884] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0158.884] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0158.884] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0158.884] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0158.885] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.885] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.885] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0158.885] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0158.885] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0158.885] GdipCreateRegion (region=0x20d120) returned 0x0
	[0158.885] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0158.886] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0158.886] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0158.886] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0158.886] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0158.886] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0158.886] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0158.887] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0158.887] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0158.887] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0158.887] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0158.887] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0158.887] OffsetViewportOrgEx (in: hdc=0x3e01102c, x=0, y=0, lppt=0x272c3d0 | out: lppt=0x272c3d0) returned 1
	[0158.887] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e01102c) returned 0x0
	[0158.888] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0158.888] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.888] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.888] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0158.888] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0158.888] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0158.889] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0158.889] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0158.889] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0158.889] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0158.889] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0158.889] GdipCreateRegion (region=0x20d070) returned 0x0
	[0158.890] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0158.890] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0158.890] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0158.890] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0158.890] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0158.890] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0158.890] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0158.891] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0158.891] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0158.891] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0158.891] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0158.891] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0158.891] OffsetViewportOrgEx (in: hdc=0x3e01102c, x=0, y=0, lppt=0x272c970 | out: lppt=0x272c970) returned 1
	[0158.892] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.892] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.892] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.892] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.892] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.892] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.893] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.893] GetROP2 (hdc=0x3e01102c) returned 13
	[0158.893] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e01102c) returned 0x0
	[0158.893] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0158.893] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e01102c) returned 0x0
	[0158.893] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0158.894] GdipCreateFromHDC (hdc=0x4001102c, graphics=0x20d7e0) returned 0x0
	[0158.894] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0158.894] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0158.894] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0158.894] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0158.894] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0158.895] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0158.895] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0158.895] GdipCreateRegion (region=0x20d910) returned 0x0
	[0158.895] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0158.895] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0158.895] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0158.895] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbe10dbd) returned 0x0
	[0158.896] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0158.896] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0158.896] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4001102c) returned 0x0
	[0158.896] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0158.896] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.896] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.897] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0158.897] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0158.897] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0158.897] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0158.897] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0158.972] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0158.972] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0158.973] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0158.973] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0158.973] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0158.973] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0158.973] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0158.973] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.973] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.974] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0158.974] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0158.974] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0158.974] GdipCreateRegion (region=0x20d120) returned 0x0
	[0158.974] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0158.974] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0158.975] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0158.975] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0158.975] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0158.975] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0158.975] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0158.976] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0158.976] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0158.976] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0158.976] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0158.976] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0158.976] OffsetViewportOrgEx (in: hdc=0x4001102c, x=0, y=0, lppt=0x272d7d0 | out: lppt=0x272d7d0) returned 1
	[0158.977] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4001102c) returned 0x0
	[0158.977] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0158.977] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.977] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0158.977] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0158.977] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0158.977] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0158.978] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0158.978] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0158.978] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0158.978] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0158.978] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0158.978] GdipCreateRegion (region=0x20d070) returned 0x0
	[0158.979] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0158.979] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0158.979] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0158.979] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0158.979] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0158.979] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0158.979] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0158.980] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0158.980] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0158.980] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0158.980] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0158.980] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0158.980] OffsetViewportOrgEx (in: hdc=0x4001102c, x=0, y=0, lppt=0x272dd70 | out: lppt=0x272dd70) returned 1
	[0158.981] GetROP2 (hdc=0x4001102c) returned 13
	[0158.981] GetROP2 (hdc=0x4001102c) returned 13
	[0158.981] GetROP2 (hdc=0x4001102c) returned 13
	[0158.981] GetROP2 (hdc=0x4001102c) returned 13
	[0158.981] GetROP2 (hdc=0x4001102c) returned 13
	[0158.981] GetROP2 (hdc=0x4001102c) returned 13
	[0158.982] GetROP2 (hdc=0x4001102c) returned 13
	[0158.982] GetROP2 (hdc=0x4001102c) returned 13
	[0158.982] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4001102c) returned 0x0
	[0158.982] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0158.982] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4001102c) returned 0x0
	[0158.982] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0159.118] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0159.118] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0159.119] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0159.119] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0159.119] UpdateWindow (hWnd=0x401b4) 
	[0159.119] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0159.119] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0159.119] GdipCreateFromHDC (hdc=0x4101102c, graphics=0x20cfa0) returned 0x0
	[0159.119] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0159.120] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0159.120] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0159.120] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.120] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0159.120] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.120] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.121] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0159.121] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.121] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0159.121] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0159.121] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbde0dbd) returned 0x0
	[0159.121] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.121] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0159.122] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4101102c) returned 0x0
	[0159.122] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0159.122] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.122] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.122] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.123] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0159.123] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0159.123] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0159.123] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0159.123] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0159.123] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.124] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0159.124] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0159.124] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0159.124] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0159.124] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.125] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.125] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.125] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0159.125] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.125] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0159.125] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0159.125] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.126] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0159.126] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.126] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0159.126] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.126] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.126] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.127] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0159.127] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0159.127] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0159.127] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.127] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0159.127] OffsetViewportOrgEx (in: hdc=0x4101102c, x=0, y=0, lppt=0x272ece0 | out: lppt=0x272ece0) returned 1
	[0159.128] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4101102c) returned 0x0
	[0159.128] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0159.128] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.128] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.128] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.128] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0159.129] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0159.129] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0159.129] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.129] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0159.129] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0159.129] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0159.130] GdipCreateRegion (region=0x20c830) returned 0x0
	[0159.130] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.130] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0159.130] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.130] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0159.130] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.130] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.131] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.131] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0159.131] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0159.131] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0159.131] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.132] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0159.132] OffsetViewportOrgEx (in: hdc=0x4101102c, x=0, y=0, lppt=0x272f280 | out: lppt=0x272f280) returned 1
	[0159.132] GetROP2 (hdc=0x4101102c) returned 13
	[0159.132] GetROP2 (hdc=0x4101102c) returned 13
	[0159.132] GetROP2 (hdc=0x4101102c) returned 13
	[0159.132] GetROP2 (hdc=0x4101102c) returned 13
	[0159.133] GetROP2 (hdc=0x4101102c) returned 13
	[0159.133] GetROP2 (hdc=0x4101102c) returned 13
	[0159.133] GetROP2 (hdc=0x4101102c) returned 13
	[0159.133] GetROP2 (hdc=0x4101102c) returned 13
	[0159.133] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4101102c) returned 0x0
	[0159.133] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0159.134] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4101102c) returned 0x0
	[0159.134] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0159.134] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0159.134] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0159.134] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0159.134] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0159.134] GetCapture () returned 0x401b4
	[0159.134] ReleaseCapture () 
	[0159.134] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0159.573] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0159.573] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0159.574] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0159.574] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0159.574] GdipCreateFromHDC (hdc=0x4201102c, graphics=0x20d7e0) returned 0x0
	[0159.574] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0159.574] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0159.574] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0159.575] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.575] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0159.575] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.575] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.575] GdipCreateRegion (region=0x20d910) returned 0x0
	[0159.575] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.575] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0159.576] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0159.576] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbdb0dbd) returned 0x0
	[0159.576] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.576] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0159.576] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4201102c) returned 0x0
	[0159.576] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0159.577] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.577] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.577] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.577] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0159.577] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0159.577] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0159.578] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0159.578] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0159.578] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.578] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0159.578] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0159.578] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0159.578] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0159.579] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.579] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.579] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.579] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0159.579] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.579] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0159.580] GdipCreateRegion (region=0x20d120) returned 0x0
	[0159.580] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.580] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0159.580] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.580] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0159.580] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.581] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.581] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.581] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0159.581] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0159.581] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0159.581] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.582] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0159.582] OffsetViewportOrgEx (in: hdc=0x4201102c, x=0, y=0, lppt=0x27301f0 | out: lppt=0x27301f0) returned 1
	[0159.582] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4201102c) returned 0x0
	[0159.582] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0159.582] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.582] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.583] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.583] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0159.583] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0159.583] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0159.583] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.583] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0159.584] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0159.584] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0159.584] GdipCreateRegion (region=0x20d070) returned 0x0
	[0159.584] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.584] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0159.584] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.585] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0159.585] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.585] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.585] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.585] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0159.585] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0159.585] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0159.586] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.586] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0159.586] OffsetViewportOrgEx (in: hdc=0x4201102c, x=0, y=0, lppt=0x2730790 | out: lppt=0x2730790) returned 1
	[0159.586] GetROP2 (hdc=0x4201102c) returned 13
	[0159.586] GetROP2 (hdc=0x4201102c) returned 13
	[0159.586] GetROP2 (hdc=0x4201102c) returned 13
	[0159.587] GetROP2 (hdc=0x4201102c) returned 13
	[0159.587] GetROP2 (hdc=0x4201102c) returned 13
	[0159.587] GetROP2 (hdc=0x4201102c) returned 13
	[0159.587] GetROP2 (hdc=0x4201102c) returned 13
	[0159.587] GetROP2 (hdc=0x4201102c) returned 13
	[0159.587] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4201102c) returned 0x0
	[0159.587] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0159.588] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4201102c) returned 0x0
	[0159.588] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0159.588] GdipCreateFromHDC (hdc=0x4301102c, graphics=0x20d7e0) returned 0x0
	[0159.588] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0159.588] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0159.589] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0159.589] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.589] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0159.589] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.589] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.589] GdipCreateRegion (region=0x20d910) returned 0x0
	[0159.589] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.590] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0159.590] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0159.590] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbd80dbd) returned 0x0
	[0159.590] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.590] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0159.590] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4301102c) returned 0x0
	[0159.591] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0159.591] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.591] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.591] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.591] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0159.591] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0159.591] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0159.592] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0159.592] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0159.592] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.592] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0159.592] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0159.592] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0159.592] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0159.593] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.593] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.593] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.593] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0159.593] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.593] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0159.594] GdipCreateRegion (region=0x20d120) returned 0x0
	[0159.594] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.594] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0159.594] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.594] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0159.594] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.594] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.595] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.595] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0159.595] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0159.595] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0159.595] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.595] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0159.595] OffsetViewportOrgEx (in: hdc=0x4301102c, x=0, y=0, lppt=0x27315f0 | out: lppt=0x27315f0) returned 1
	[0159.596] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4301102c) returned 0x0
	[0159.596] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0159.596] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.596] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.596] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.596] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0159.597] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0159.597] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0159.597] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.597] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0159.597] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0159.597] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0159.597] GdipCreateRegion (region=0x20d070) returned 0x0
	[0159.598] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.598] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0159.598] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.598] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0159.598] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.598] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.598] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.599] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0159.599] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0159.599] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0159.599] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.599] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0159.600] OffsetViewportOrgEx (in: hdc=0x4301102c, x=0, y=0, lppt=0x2731b90 | out: lppt=0x2731b90) returned 1
	[0159.600] GetROP2 (hdc=0x4301102c) returned 13
	[0159.600] GetROP2 (hdc=0x4301102c) returned 13
	[0159.601] GetROP2 (hdc=0x4301102c) returned 13
	[0159.601] GetROP2 (hdc=0x4301102c) returned 13
	[0159.601] GetROP2 (hdc=0x4301102c) returned 13
	[0159.601] GetROP2 (hdc=0x4301102c) returned 13
	[0159.601] GetROP2 (hdc=0x4301102c) returned 13
	[0159.601] GetROP2 (hdc=0x4301102c) returned 13
	[0159.601] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4301102c) returned 0x0
	[0159.602] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0159.602] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4301102c) returned 0x0
	[0159.602] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0159.773] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0159.773] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0159.774] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0159.774] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0159.774] UpdateWindow (hWnd=0x201d8) 
	[0159.774] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0159.774] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0159.774] GdipCreateFromHDC (hdc=0x4c01102c, graphics=0x20cfa0) returned 0x0
	[0159.774] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0159.775] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0159.775] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0159.775] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.775] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0159.775] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.776] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.776] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0159.776] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.776] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0159.776] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0159.776] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbd50dbd) returned 0x0
	[0159.776] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.777] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0159.777] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4c01102c) returned 0x0
	[0159.777] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0159.777] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.777] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.777] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.778] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0159.778] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0159.778] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0159.778] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0159.778] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0159.778] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.779] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0159.779] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0159.779] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0159.779] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0159.779] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.779] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.779] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.780] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0159.780] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.780] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0159.780] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0159.780] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.780] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0159.781] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.781] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0159.781] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.781] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0159.781] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.781] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0159.781] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0159.782] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0159.782] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.782] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0159.782] OffsetViewportOrgEx (in: hdc=0x4c01102c, x=0, y=0, lppt=0x2732bc0 | out: lppt=0x2732bc0) returned 1
	[0159.782] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4c01102c) returned 0x0
	[0159.782] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0159.783] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.783] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.783] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.783] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0159.783] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0159.783] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0159.784] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.784] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0159.784] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0159.784] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0159.784] GdipCreateRegion (region=0x20c830) returned 0x0
	[0159.784] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.784] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0159.785] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.785] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0159.785] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.785] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0159.785] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.785] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0159.786] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0159.786] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0159.786] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.786] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0159.786] OffsetViewportOrgEx (in: hdc=0x4c01102c, x=0, y=0, lppt=0x2733160 | out: lppt=0x2733160) returned 1
	[0159.786] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.787] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.787] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.787] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.787] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.787] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.788] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.788] GetROP2 (hdc=0x4c01102c) returned 13
	[0159.788] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4c01102c) returned 0x0
	[0159.788] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0159.788] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4c01102c) returned 0x0
	[0159.788] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0159.789] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0159.789] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0159.789] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0159.789] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27334a8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0159.789] ShellExecuteExW (pExecInfo=0x27336b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0159.826] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0159.826] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0159.827] GdipCreateFromHDC (hdc=0x5401102c, graphics=0x20c9d0) returned 0x0
	[0159.827] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0159.827] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0159.827] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0159.827] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.828] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0159.828] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0159.828] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.828] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0159.828] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.828] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0159.829] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0159.829] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbd20dbd) returned 0x0
	[0159.829] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.829] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0159.829] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5401102c) returned 0x0
	[0159.829] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0159.830] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.830] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.830] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.830] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0159.830] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0159.830] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0159.830] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0159.831] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0159.831] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.831] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0159.831] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0159.831] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0159.831] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0159.832] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.832] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.832] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.832] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0159.832] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.832] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0159.832] GdipCreateRegion (region=0x20c310) returned 0x0
	[0159.833] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.833] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0159.833] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.833] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0159.833] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0159.835] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0159.835] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.835] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0159.835] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0159.836] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0159.836] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.836] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0159.836] OffsetViewportOrgEx (in: hdc=0x5401102c, x=0, y=0, lppt=0x2734398 | out: lppt=0x2734398) returned 1
	[0159.836] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5401102c) returned 0x0
	[0159.836] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0159.837] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.837] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.837] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.837] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0159.837] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0159.837] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0159.838] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.838] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0159.838] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0159.838] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0159.838] GdipCreateRegion (region=0x20c260) returned 0x0
	[0159.838] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.839] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0159.839] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.839] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0159.839] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0159.839] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0159.839] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.839] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0159.840] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0159.840] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0159.840] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.840] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0159.840] OffsetViewportOrgEx (in: hdc=0x5401102c, x=0, y=0, lppt=0x2734938 | out: lppt=0x2734938) returned 1
	[0159.840] GetROP2 (hdc=0x5401102c) returned 13
	[0159.841] GetROP2 (hdc=0x5401102c) returned 13
	[0159.841] GetROP2 (hdc=0x5401102c) returned 13
	[0159.841] GetROP2 (hdc=0x5401102c) returned 13
	[0159.841] GetROP2 (hdc=0x5401102c) returned 13
	[0159.841] GetROP2 (hdc=0x5401102c) returned 13
	[0159.841] GetROP2 (hdc=0x5401102c) returned 13
	[0159.841] GetROP2 (hdc=0x5401102c) returned 13
	[0159.842] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5401102c) returned 0x0
	[0159.842] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0159.842] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5401102c) returned 0x0
	[0159.842] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0159.842] GdipCreateFromHDC (hdc=0x5601102c, graphics=0x20c9d0) returned 0x0
	[0159.843] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0159.843] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0159.843] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0159.843] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.843] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0159.843] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0159.843] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.844] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0159.844] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.844] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0159.844] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0159.844] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbcf0dbd) returned 0x0
	[0159.844] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.844] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0159.845] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5601102c) returned 0x0
	[0159.845] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0159.845] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.845] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.845] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.845] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0159.846] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0159.846] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0159.846] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0159.846] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0159.846] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.846] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0159.847] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0159.847] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0159.847] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0159.847] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.847] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.847] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.847] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0159.848] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.848] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0159.848] GdipCreateRegion (region=0x20c310) returned 0x0
	[0159.848] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.848] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0159.848] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0159.849] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0159.849] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0159.849] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0159.850] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0159.850] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0159.850] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0159.850] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0159.850] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.850] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0159.851] OffsetViewportOrgEx (in: hdc=0x5601102c, x=0, y=0, lppt=0x27357c0 | out: lppt=0x27357c0) returned 1
	[0159.851] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5601102c) returned 0x0
	[0159.851] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0159.851] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.851] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0159.852] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0159.852] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0159.852] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0159.852] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0159.852] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0159.852] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0159.853] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0159.853] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0159.853] GdipCreateRegion (region=0x20c260) returned 0x0
	[0159.853] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0159.853] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0159.853] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0159.853] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0159.854] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0159.854] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0159.854] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0159.854] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0159.854] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0159.854] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0159.855] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0159.855] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0159.855] OffsetViewportOrgEx (in: hdc=0x5601102c, x=0, y=0, lppt=0x2735d60 | out: lppt=0x2735d60) returned 1
	[0159.855] GetROP2 (hdc=0x5601102c) returned 13
	[0159.855] GetROP2 (hdc=0x5601102c) returned 13
	[0159.855] GetROP2 (hdc=0x5601102c) returned 13
	[0159.856] GetROP2 (hdc=0x5601102c) returned 13
	[0159.856] GetROP2 (hdc=0x5601102c) returned 13
	[0159.856] GetROP2 (hdc=0x5601102c) returned 13
	[0159.856] GetROP2 (hdc=0x5601102c) returned 13
	[0159.856] GetROP2 (hdc=0x5601102c) returned 13
	[0159.856] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5601102c) returned 0x0
	[0159.856] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0159.857] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5601102c) returned 0x0
	[0159.857] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0161.983] GdipCreateFromHDC (hdc=0x14010f9b, graphics=0x20d7e0) returned 0x0
	[0161.983] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0161.983] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0161.984] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0161.984] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0161.984] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0161.984] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0161.984] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0161.984] GdipCreateRegion (region=0x20d910) returned 0x0
	[0161.985] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0161.985] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0161.985] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0161.985] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbcc0dbd) returned 0x0
	[0161.985] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0161.986] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0161.986] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14010f9b) returned 0x0
	[0161.986] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0161.986] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0161.986] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0161.986] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0161.987] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0161.987] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0161.987] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0161.987] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0161.987] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0161.987] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0161.988] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0161.988] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0161.988] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0161.988] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0161.988] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0161.988] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0161.989] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0161.989] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0161.989] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0161.989] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0161.989] GdipCreateRegion (region=0x20d120) returned 0x0
	[0161.989] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0161.989] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0161.990] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0161.990] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0161.990] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0161.990] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0161.990] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0161.991] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0161.991] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0161.991] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0161.991] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0161.991] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0161.991] OffsetViewportOrgEx (in: hdc=0x14010f9b, x=0, y=0, lppt=0x2737b90 | out: lppt=0x2737b90) returned 1
	[0161.992] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14010f9b) returned 0x0
	[0161.992] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0161.992] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0161.992] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0161.992] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0161.992] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0161.993] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0161.993] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0161.993] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0161.993] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0161.993] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0161.993] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0161.994] GdipCreateRegion (region=0x20d070) returned 0x0
	[0161.994] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0161.994] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0161.994] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0161.994] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0161.994] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0161.995] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0161.995] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0161.995] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0161.995] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0161.995] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0161.995] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0161.995] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0161.996] OffsetViewportOrgEx (in: hdc=0x14010f9b, x=0, y=0, lppt=0x2738130 | out: lppt=0x2738130) returned 1
	[0161.996] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.996] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.996] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.996] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.996] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.997] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.997] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.997] GetROP2 (hdc=0x14010f9b) returned 13
	[0161.997] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14010f9b) returned 0x0
	[0161.997] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0161.997] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14010f9b) returned 0x0
	[0161.998] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0163.107] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0163.108] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0163.108] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0163.108] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0163.108] GdipCreateFromHDC (hdc=0x35010819, graphics=0x20d7e0) returned 0x0
	[0163.108] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0163.108] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0163.109] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0163.109] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0163.109] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0163.109] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0163.110] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0163.110] GdipCreateRegion (region=0x20d910) returned 0x0
	[0163.110] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.110] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0163.110] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0163.110] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbc90dbd) returned 0x0
	[0163.111] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.111] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0163.111] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35010819) returned 0x0
	[0163.111] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0163.111] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.112] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.112] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.112] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0163.112] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0163.112] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0163.112] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0163.113] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0163.113] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.113] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0163.113] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0163.113] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0163.113] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0163.114] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.114] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.114] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.114] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0163.114] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.114] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0163.115] GdipCreateRegion (region=0x20d120) returned 0x0
	[0163.115] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.115] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0163.115] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0163.115] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0163.116] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0163.116] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0163.116] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0163.116] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0163.116] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0163.116] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0163.117] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.117] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0163.117] OffsetViewportOrgEx (in: hdc=0x35010819, x=0, y=0, lppt=0x2739028 | out: lppt=0x2739028) returned 1
	[0163.117] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35010819) returned 0x0
	[0163.117] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0163.118] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.118] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.118] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.118] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0163.118] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0163.119] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0163.119] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.119] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0163.119] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0163.119] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0163.119] GdipCreateRegion (region=0x20d070) returned 0x0
	[0163.120] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.120] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0163.120] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0163.120] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0163.120] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0163.120] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0163.121] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0163.121] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0163.121] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0163.121] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0163.121] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.121] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0163.122] OffsetViewportOrgEx (in: hdc=0x35010819, x=0, y=0, lppt=0x27395c8 | out: lppt=0x27395c8) returned 1
	[0163.122] GetROP2 (hdc=0x35010819) returned 13
	[0163.122] GetROP2 (hdc=0x35010819) returned 13
	[0163.122] GetROP2 (hdc=0x35010819) returned 13
	[0163.122] GetROP2 (hdc=0x35010819) returned 13
	[0163.123] GetROP2 (hdc=0x35010819) returned 13
	[0163.123] GetROP2 (hdc=0x35010819) returned 13
	[0163.123] GetROP2 (hdc=0x35010819) returned 13
	[0163.123] GetROP2 (hdc=0x35010819) returned 13
	[0163.123] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35010819) returned 0x0
	[0163.123] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0163.124] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35010819) returned 0x0
	[0163.124] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0163.341] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0163.341] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0163.342] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0163.342] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0163.342] UpdateWindow (hWnd=0x201d8) returned 0
	[0163.342] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0163.342] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0163.342] GdipCreateFromHDC (hdc=0x41010819, graphics=0x20cfa0) returned 0x0
	[0163.342] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0163.342] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0163.343] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0163.343] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0163.343] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0163.343] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0163.343] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0163.344] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0163.344] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.344] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0163.344] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0163.344] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbc60dbd) returned 0x0
	[0163.344] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.345] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0163.345] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x41010819) returned 0x0
	[0163.345] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0163.345] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.345] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.345] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.346] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0163.346] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0163.346] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0163.346] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0163.346] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0163.346] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.347] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0163.347] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0163.347] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0163.347] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0163.347] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.347] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.348] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.348] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0163.348] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.348] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0163.348] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0163.348] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.349] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0163.349] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0163.349] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0163.349] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0163.349] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0163.349] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0163.350] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0163.350] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0163.350] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0163.350] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.350] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0163.350] OffsetViewportOrgEx (in: hdc=0x41010819, x=0, y=0, lppt=0x273a5c0 | out: lppt=0x273a5c0) returned 1
	[0163.351] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x41010819) returned 0x0
	[0163.351] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0163.351] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.351] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.351] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.351] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0163.352] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0163.352] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0163.352] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.352] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0163.352] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0163.352] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0163.353] GdipCreateRegion (region=0x20c830) returned 0x0
	[0163.353] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.353] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0163.353] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0163.353] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0163.353] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0163.354] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0163.354] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0163.354] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0163.354] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0163.354] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0163.354] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.354] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0163.355] OffsetViewportOrgEx (in: hdc=0x41010819, x=0, y=0, lppt=0x273ab60 | out: lppt=0x273ab60) returned 1
	[0163.355] GetROP2 (hdc=0x41010819) returned 13
	[0163.355] GetROP2 (hdc=0x41010819) returned 13
	[0163.355] GetROP2 (hdc=0x41010819) returned 13
	[0163.355] GetROP2 (hdc=0x41010819) returned 13
	[0163.356] GetROP2 (hdc=0x41010819) returned 13
	[0163.356] GetROP2 (hdc=0x41010819) returned 13
	[0163.356] GetROP2 (hdc=0x41010819) returned 13
	[0163.356] GetROP2 (hdc=0x41010819) returned 13
	[0163.356] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x41010819) returned 0x0
	[0163.356] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0163.356] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x41010819) returned 0x0
	[0163.357] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0163.357] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0163.357] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0163.358] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0163.358] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x273aea8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0163.358] ShellExecuteExW (pExecInfo=0x273b0b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0163.423] GdipCreateFromHDC (hdc=0x7d010ede, graphics=0x20c9d0) returned 0x0
	[0163.424] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0163.424] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0163.424] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0163.424] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0163.424] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0163.424] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0163.425] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0163.425] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0163.425] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.425] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0163.425] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0163.425] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbc30dbd) returned 0x0
	[0163.425] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.426] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0163.426] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d010ede) returned 0x0
	[0163.426] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0163.426] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.426] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.427] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.427] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0163.427] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0163.427] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0163.427] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0163.427] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0163.427] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.428] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0163.428] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0163.428] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0163.428] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0163.428] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.428] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.429] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.429] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0163.429] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.429] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0163.429] GdipCreateRegion (region=0x20c310) returned 0x0
	[0163.429] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.430] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0163.430] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0163.430] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0163.430] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0163.430] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0163.430] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0163.431] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0163.431] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0163.431] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0163.431] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.431] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0163.431] OffsetViewportOrgEx (in: hdc=0x7d010ede, x=0, y=0, lppt=0x273bdc0 | out: lppt=0x273bdc0) returned 1
	[0163.432] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d010ede) returned 0x0
	[0163.432] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0163.432] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.432] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0163.432] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0163.432] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0163.433] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0163.433] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0163.433] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0163.433] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0163.433] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0163.433] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0163.434] GdipCreateRegion (region=0x20c260) returned 0x0
	[0163.434] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0163.434] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0163.434] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0163.434] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0163.434] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0163.435] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0163.435] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0163.435] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0163.435] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0163.435] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0163.435] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0163.436] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0163.436] OffsetViewportOrgEx (in: hdc=0x7d010ede, x=0, y=0, lppt=0x273c360 | out: lppt=0x273c360) returned 1
	[0163.436] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.436] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.436] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.436] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.437] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.437] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.437] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.437] GetROP2 (hdc=0x7d010ede) returned 13
	[0163.438] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d010ede) returned 0x0
	[0163.438] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0163.438] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d010ede) returned 0x0
	[0163.438] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0165.056] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d770) returned 0x0
	[0165.056] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0165.056] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0165.056] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0165.056] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d6c0) returned 0x0
	[0165.056] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0165.057] GdipCreateRegion (region=0x20d660) returned 0x0
	[0165.057] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0165.057] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d690) returned 0x0
	[0165.057] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0165.057] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d760) returned 0x0
	[0165.057] GdipCreateRegion (region=0x20d630) returned 0x0
	[0165.058] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0165.058] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0165.058] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0165.058] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d690) returned 0x0
	[0165.058] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0165.058] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0165.058] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6e0) returned 0x0
	[0165.059] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0165.059] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d710) returned 0x0
	[0165.059] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x273d980 | out: lppt=0x273d980) returned 1
	[0165.059] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4010280) returned 0x0
	[0165.065] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0165.067] GetDIBits (in: hdc=0x10107f8, hbm=0x14051152, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0165.067] GetDIBits (in: hdc=0x10107f8, hbm=0x14051152, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0165.067] GdipCreateFromHDC (hdc=0x1c011150, graphics=0x20d750) returned 0x0
	[0165.068] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0165.068] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0165.068] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0165.068] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0165.068] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0165.069] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0165.069] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0165.069] GdipCreateRegion (region=0x20d910) returned 0x0
	[0165.069] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0165.069] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0165.069] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0165.069] GdipCreateRegion (region=0x20d400) returned 0x0
	[0165.070] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0165.070] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0165.070] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0165.070] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0165.070] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0165.070] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0165.071] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0165.071] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0165.071] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0165.071] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0165.071] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0165.071] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0165.071] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0165.072] OffsetViewportOrgEx (in: hdc=0x1c011150, x=0, y=0, lppt=0x273f1c8 | out: lppt=0x273f1c8) returned 1
	[0165.072] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c011150) returned 0x0
	[0165.072] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffbbe0dbd) returned 0x0
	[0165.072] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0165.072] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0165.072] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c011150) returned 0x0
	[0165.073] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0165.073] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0165.073] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0165.073] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0165.073] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0165.073] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0165.073] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0165.074] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0165.074] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0165.074] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0165.075] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0165.075] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c011150) returned 0x0
	[0165.075] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0165.075] GdipCreateFromHDC (hdc=0x3e01114d, graphics=0x20d7e0) returned 0x0
	[0165.076] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0165.076] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0165.076] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0165.076] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0165.076] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0165.076] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0165.076] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0165.077] GdipCreateRegion (region=0x20d910) returned 0x0
	[0165.077] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0165.077] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0165.077] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0165.077] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbbc0dbd) returned 0x0
	[0165.077] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0165.077] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0165.078] GdipReleaseDC (graphics=0x1b929550, hdc=0x3e01114d) returned 0x0
	[0165.078] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0165.078] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0165.078] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0165.078] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0165.078] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0165.079] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0165.079] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0165.079] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0165.079] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0165.079] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0165.079] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0165.079] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0165.080] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0165.080] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0165.080] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0165.080] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0165.080] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0165.080] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0165.081] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0165.081] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0165.081] GdipCreateRegion (region=0x20d120) returned 0x0
	[0165.081] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0165.081] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0165.081] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0165.081] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0165.082] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0165.082] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0165.082] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0165.082] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0165.082] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0165.082] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0165.083] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0165.083] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0165.083] OffsetViewportOrgEx (in: hdc=0x3e01114d, x=0, y=0, lppt=0x27402d0 | out: lppt=0x27402d0) returned 1
	[0165.083] GdipReleaseDC (graphics=0x1b929550, hdc=0x3e01114d) returned 0x0
	[0165.083] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0165.083] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0165.083] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0165.084] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0165.084] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0165.084] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0165.084] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0165.084] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0165.084] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0165.085] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0165.085] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0165.085] GdipCreateRegion (region=0x20d070) returned 0x0
	[0165.085] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0165.085] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0165.086] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0165.086] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0165.086] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0165.086] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0165.086] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0165.086] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0165.086] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0165.087] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0165.087] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0165.087] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0165.087] OffsetViewportOrgEx (in: hdc=0x3e01114d, x=0, y=0, lppt=0x2740870 | out: lppt=0x2740870) returned 1
	[0165.087] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.087] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.088] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.088] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.088] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.088] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.088] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.088] GetROP2 (hdc=0x3e01114d) returned 13
	[0165.089] GdipReleaseDC (graphics=0x1b929550, hdc=0x3e01114d) returned 0x0
	[0165.089] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0165.089] GdipReleaseDC (graphics=0x1b929550, hdc=0x3e01114d) returned 0x0
	[0165.089] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0165.089] GetDIBits (in: hdc=0x70107fc, hbm=0x3a051147, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0165.089] GetDIBits (in: hdc=0x70107fc, hbm=0x3a051147, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0165.090] GdipCreateFromHDC (hdc=0x18011152, graphics=0x20d800) returned 0x0
	[0165.090] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0165.090] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0165.090] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0165.090] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0165.090] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0165.090] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0165.091] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0165.091] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0165.091] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0165.091] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0165.091] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0165.092] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0165.092] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0165.092] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0165.092] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0165.092] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0165.092] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0165.093] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0165.093] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0165.093] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0165.093] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0165.093] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0165.093] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0165.093] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0165.094] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0165.094] SaveDC (hdc=0x18011152) returned 1
	[0165.094] OffsetViewportOrgEx (in: hdc=0x18011152, x=0, y=0, lppt=0x2742120 | out: lppt=0x2742120) returned 1
	[0165.095] GdipReleaseDC (graphics=0x1b929550, hdc=0x18011152) returned 0x0
	[0165.095] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbb90dbd) returned 0x0
	[0165.095] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0165.095] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0165.102] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0165.102] GdipReleaseDC (graphics=0x1b929550, hdc=0x18011152) returned 0x0
	[0165.102] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0166.027] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0166.027] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0166.027] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0166.027] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0166.027] UpdateWindow (hWnd=0x201d8) 
	[0166.028] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0166.028] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0166.028] GdipCreateFromHDC (hdc=0xffffffffed010ff8, graphics=0x20cfa0) returned 0x0
	[0166.028] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0166.028] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0166.028] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0166.028] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0166.029] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0166.029] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0166.029] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0166.029] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0166.029] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.029] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0166.030] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0166.030] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbb70dbd) returned 0x0
	[0166.030] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.030] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0166.030] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed010ff8) returned 0x0
	[0166.030] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0166.031] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.031] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.031] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.031] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0166.031] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0166.031] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0166.031] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0166.032] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0166.032] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.032] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0166.032] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0166.032] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0166.032] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0166.032] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.033] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.033] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.033] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0166.033] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.033] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0166.033] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0166.034] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.034] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0166.034] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0166.034] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0166.034] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0166.045] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0166.049] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0166.051] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0166.051] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0166.051] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0166.051] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.051] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0166.051] OffsetViewportOrgEx (in: hdc=0xffffffffed010ff8, x=0, y=0, lppt=0x27431c8 | out: lppt=0x27431c8) returned 1
	[0166.052] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed010ff8) returned 0x0
	[0166.052] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0166.052] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.052] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.052] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.053] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0166.053] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0166.053] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0166.053] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.053] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0166.054] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0166.054] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0166.054] GdipCreateRegion (region=0x20c830) returned 0x0
	[0166.054] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.054] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0166.054] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0166.055] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0166.055] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0166.055] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0166.055] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0166.055] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0166.055] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0166.056] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0166.056] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.056] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0166.056] OffsetViewportOrgEx (in: hdc=0xffffffffed010ff8, x=0, y=0, lppt=0x2743768 | out: lppt=0x2743768) returned 1
	[0166.056] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.056] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.057] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.057] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.057] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.057] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.057] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.057] GetROP2 (hdc=0xffffffffed010ff8) returned 13
	[0166.058] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed010ff8) returned 0x0
	[0166.071] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0166.071] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed010ff8) returned 0x0
	[0166.071] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0166.071] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0166.071] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0166.072] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0166.072] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2743ab0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0166.072] ShellExecuteExW (pExecInfo=0x2743cc0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0166.121] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0166.121] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0166.122] GdipCreateFromHDC (hdc=0xfffffffff4010ff8, graphics=0x20c9d0) returned 0x0
	[0166.122] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0166.123] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0166.123] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0166.123] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0166.123] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0166.123] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0166.123] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0166.124] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0166.124] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.124] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0166.124] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0166.124] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbb40dbd) returned 0x0
	[0166.124] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.125] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0166.125] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff4010ff8) returned 0x0
	[0166.125] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0166.125] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.126] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.126] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.126] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0166.126] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0166.126] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0166.126] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0166.127] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0166.127] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.127] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0166.127] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0166.127] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0166.128] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0166.128] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.128] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.128] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.128] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0166.129] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.129] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0166.129] GdipCreateRegion (region=0x20c310) returned 0x0
	[0166.129] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.129] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0166.129] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0166.130] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0166.130] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0166.130] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0166.130] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0166.130] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0166.130] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0166.131] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0166.131] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.131] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0166.131] OffsetViewportOrgEx (in: hdc=0xfffffffff4010ff8, x=0, y=0, lppt=0x27449a0 | out: lppt=0x27449a0) returned 1
	[0166.131] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff4010ff8) returned 0x0
	[0166.132] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0166.132] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.132] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.132] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.132] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0166.132] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0166.132] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0166.133] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.133] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0166.133] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0166.133] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0166.133] GdipCreateRegion (region=0x20c260) returned 0x0
	[0166.133] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.134] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0166.134] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0166.134] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0166.134] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0166.134] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0166.134] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0166.134] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0166.135] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0166.135] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0166.135] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.135] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0166.135] OffsetViewportOrgEx (in: hdc=0xfffffffff4010ff8, x=0, y=0, lppt=0x2744f40 | out: lppt=0x2744f40) returned 1
	[0166.135] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.136] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.136] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.136] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.136] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.136] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.137] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.137] GetROP2 (hdc=0xfffffffff4010ff8) returned 13
	[0166.137] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff4010ff8) returned 0x0
	[0166.137] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0166.137] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff4010ff8) returned 0x0
	[0166.137] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0166.138] GdipCreateFromHDC (hdc=0xfffffffff6010ff8, graphics=0x20c9d0) returned 0x0
	[0166.138] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0166.138] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0166.138] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0166.138] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0166.139] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0166.139] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0166.139] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0166.139] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0166.139] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.139] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0166.139] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0166.140] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbb10dbd) returned 0x0
	[0166.140] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.140] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0166.140] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff6010ff8) returned 0x0
	[0166.140] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0166.140] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.141] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.141] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.141] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0166.141] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0166.141] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0166.141] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0166.142] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0166.142] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.142] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0166.142] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0166.142] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0166.142] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0166.143] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.143] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.143] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.143] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0166.143] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.143] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0166.144] GdipCreateRegion (region=0x20c310) returned 0x0
	[0166.144] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.144] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0166.144] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0166.144] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0166.144] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0166.144] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0166.145] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0166.145] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0166.145] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0166.145] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0166.145] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.145] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0166.146] OffsetViewportOrgEx (in: hdc=0xfffffffff6010ff8, x=0, y=0, lppt=0x2745dc8 | out: lppt=0x2745dc8) returned 1
	[0166.146] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff6010ff8) returned 0x0
	[0166.146] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0166.146] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.146] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0166.146] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0166.147] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0166.147] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0166.147] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0166.147] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0166.147] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0166.147] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0166.148] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0166.148] GdipCreateRegion (region=0x20c260) returned 0x0
	[0166.148] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0166.148] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0166.148] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0166.148] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0166.149] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0166.149] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0166.149] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0166.149] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0166.149] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0166.149] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0166.150] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0166.150] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0166.150] OffsetViewportOrgEx (in: hdc=0xfffffffff6010ff8, x=0, y=0, lppt=0x2746368 | out: lppt=0x2746368) returned 1
	[0166.150] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.150] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.150] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.150] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.151] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.151] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.151] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.151] GetROP2 (hdc=0xfffffffff6010ff8) returned 13
	[0166.151] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff6010ff8) returned 0x0
	[0166.152] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0166.152] GdipReleaseDC (graphics=0x1b929550, hdc=0xfffffffff6010ff8) returned 0x0
	[0166.152] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0167.135] GdipCreateFromHDC (hdc=0x31010aba, graphics=0x20d7e0) returned 0x0
	[0167.136] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0167.136] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0167.136] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0167.136] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0167.136] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0167.137] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0167.137] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0167.137] GdipCreateRegion (region=0x20d910) returned 0x0
	[0167.137] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0167.137] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0167.137] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0167.138] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbae0dbd) returned 0x0
	[0167.138] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0167.138] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0167.138] GdipReleaseDC (graphics=0x1b929550, hdc=0x31010aba) returned 0x0
	[0167.138] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0167.138] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0167.139] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0167.139] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0167.139] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0167.139] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0167.139] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0167.139] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0167.139] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0167.140] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0167.140] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0167.140] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0167.140] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0167.140] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0167.140] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0167.141] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0167.141] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0167.141] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0167.141] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0167.141] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0167.141] GdipCreateRegion (region=0x20d120) returned 0x0
	[0167.142] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0167.142] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0167.142] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0167.142] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0167.142] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0167.142] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0167.142] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0167.143] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0167.143] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0167.143] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0167.143] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0167.143] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0167.143] OffsetViewportOrgEx (in: hdc=0x31010aba, x=0, y=0, lppt=0x2748050 | out: lppt=0x2748050) returned 1
	[0167.144] GdipReleaseDC (graphics=0x1b929550, hdc=0x31010aba) returned 0x0
	[0167.144] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0167.144] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0167.144] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0167.144] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0167.144] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0167.144] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0167.145] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0167.145] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0167.145] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0167.145] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0167.145] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0167.145] GdipCreateRegion (region=0x20d070) returned 0x0
	[0167.146] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0167.146] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0167.146] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0167.146] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0167.146] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0167.146] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0167.146] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0167.147] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0167.147] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0167.147] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0167.147] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0167.147] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0167.147] OffsetViewportOrgEx (in: hdc=0x31010aba, x=0, y=0, lppt=0x27485f0 | out: lppt=0x27485f0) returned 1
	[0167.147] GetROP2 (hdc=0x31010aba) returned 13
	[0167.148] GetROP2 (hdc=0x31010aba) returned 13
	[0167.148] GetROP2 (hdc=0x31010aba) returned 13
	[0167.148] GetROP2 (hdc=0x31010aba) returned 13
	[0167.148] GetROP2 (hdc=0x31010aba) returned 13
	[0167.148] GetROP2 (hdc=0x31010aba) returned 13
	[0167.148] GetROP2 (hdc=0x31010aba) returned 13
	[0167.149] GetROP2 (hdc=0x31010aba) returned 13
	[0167.149] GdipReleaseDC (graphics=0x1b929550, hdc=0x31010aba) returned 0x0
	[0167.149] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0167.149] GdipReleaseDC (graphics=0x1b929550, hdc=0x31010aba) returned 0x0
	[0167.149] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0169.029] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0169.029] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0169.029] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0169.029] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0169.029] GdipCreateFromHDC (hdc=0x1d010f9b, graphics=0x20d7e0) returned 0x0
	[0169.029] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0169.030] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0169.030] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0169.030] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0169.030] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0169.030] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0169.030] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0169.030] GdipCreateRegion (region=0x20d910) returned 0x0
	[0169.031] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.031] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0169.031] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0169.031] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffbab0dbd) returned 0x0
	[0169.031] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.031] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0169.032] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d010f9b) returned 0x0
	[0169.032] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0169.032] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.032] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.032] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.032] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0169.032] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0169.033] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0169.033] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0169.033] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0169.033] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.033] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0169.033] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0169.034] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0169.034] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0169.034] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.034] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.034] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.034] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0169.035] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.035] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0169.035] GdipCreateRegion (region=0x20d120) returned 0x0
	[0169.035] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.035] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0169.036] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0169.036] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0169.036] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0169.036] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0169.036] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0169.036] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0169.036] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0169.037] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0169.037] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.037] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0169.037] OffsetViewportOrgEx (in: hdc=0x1d010f9b, x=0, y=0, lppt=0x27494e8 | out: lppt=0x27494e8) returned 1
	[0169.037] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d010f9b) returned 0x0
	[0169.038] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0169.038] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.038] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.038] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.038] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0169.038] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0169.039] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0169.039] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.039] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0169.039] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0169.039] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0169.039] GdipCreateRegion (region=0x20d070) returned 0x0
	[0169.040] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.040] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0169.040] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0169.040] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0169.040] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0169.040] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0169.041] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0169.041] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0169.041] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0169.041] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0169.041] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.041] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0169.041] OffsetViewportOrgEx (in: hdc=0x1d010f9b, x=0, y=0, lppt=0x2749a88 | out: lppt=0x2749a88) returned 1
	[0169.042] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.042] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.042] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.042] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.042] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.042] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.043] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.043] GetROP2 (hdc=0x1d010f9b) returned 13
	[0169.043] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d010f9b) returned 0x0
	[0169.043] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0169.043] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d010f9b) returned 0x0
	[0169.043] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0169.243] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0169.243] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0169.243] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0169.243] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0169.243] UpdateWindow (hWnd=0x201d8) 
	[0169.243] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0169.244] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0169.244] GdipCreateFromHDC (hdc=0x21010f9b, graphics=0x20cfa0) returned 0x0
	[0169.244] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0169.244] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0169.244] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0169.244] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0169.245] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0169.245] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0169.245] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0169.245] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0169.245] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.245] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0169.246] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0169.246] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffba80dbd) returned 0x0
	[0169.246] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.246] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0169.246] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010f9b) returned 0x0
	[0169.246] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0169.247] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.247] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.247] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.247] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0169.247] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0169.248] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0169.248] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0169.248] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0169.248] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.248] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0169.248] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0169.249] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0169.249] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0169.249] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.249] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.249] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.250] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0169.250] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.250] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0169.250] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0169.250] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.251] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0169.251] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0169.251] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0169.251] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0169.251] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0169.251] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0169.252] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0169.252] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0169.252] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0169.252] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.252] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0169.252] OffsetViewportOrgEx (in: hdc=0x21010f9b, x=0, y=0, lppt=0x274aa80 | out: lppt=0x274aa80) returned 1
	[0169.253] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010f9b) returned 0x0
	[0169.253] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0169.253] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.253] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.253] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.253] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0169.254] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0169.254] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0169.254] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.254] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0169.254] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0169.254] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0169.255] GdipCreateRegion (region=0x20c830) returned 0x0
	[0169.255] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.255] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0169.255] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0169.255] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0169.255] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0169.256] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0169.256] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0169.256] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0169.257] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0169.257] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0169.257] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.257] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0169.257] OffsetViewportOrgEx (in: hdc=0x21010f9b, x=0, y=0, lppt=0x274b020 | out: lppt=0x274b020) returned 1
	[0169.257] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.258] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.258] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.258] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.258] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.258] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.258] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.259] GetROP2 (hdc=0x21010f9b) returned 13
	[0169.259] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010f9b) returned 0x0
	[0169.259] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0169.259] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010f9b) returned 0x0
	[0169.259] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0169.259] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0169.259] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0169.260] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0169.260] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x274b368, Length=0x70 | out: Destination=0x1afe53a0) 
	[0169.260] ShellExecuteExW (in: pExecInfo=0x274b578*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x274b578*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0169.326] GdipCreateFromHDC (hdc=0xffffffffaa010819, graphics=0x20c9d0) returned 0x0
	[0169.327] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0169.327] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0169.327] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0169.327] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0169.327] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0169.328] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0169.328] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0169.328] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0169.328] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.328] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0169.328] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0169.329] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffba50dbd) returned 0x0
	[0169.329] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.329] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0169.329] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffaa010819) returned 0x0
	[0169.329] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0169.329] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.330] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.330] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.330] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0169.330] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0169.330] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0169.330] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0169.331] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0169.331] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.331] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0169.331] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0169.331] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0169.331] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0169.332] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.332] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.332] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.332] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0169.332] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.332] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0169.333] GdipCreateRegion (region=0x20c310) returned 0x0
	[0169.333] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.333] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0169.333] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0169.333] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0169.333] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0169.334] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0169.336] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0169.336] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0169.336] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0169.337] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0169.337] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.337] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0169.337] OffsetViewportOrgEx (in: hdc=0xffffffffaa010819, x=0, y=0, lppt=0x274c280 | out: lppt=0x274c280) returned 1
	[0169.337] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffaa010819) returned 0x0
	[0169.337] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0169.338] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.338] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0169.338] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0169.338] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0169.338] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0169.338] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0169.339] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0169.339] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0169.339] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0169.339] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0169.339] GdipCreateRegion (region=0x20c260) returned 0x0
	[0169.339] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0169.340] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0169.341] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0169.341] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0169.341] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0169.341] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0169.341] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0169.341] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0169.342] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0169.342] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0169.342] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0169.342] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0169.342] OffsetViewportOrgEx (in: hdc=0xffffffffaa010819, x=0, y=0, lppt=0x274c820 | out: lppt=0x274c820) returned 1
	[0169.342] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.343] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.343] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.343] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.343] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.343] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.343] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.344] GetROP2 (hdc=0xffffffffaa010819) returned 13
	[0169.344] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffaa010819) returned 0x0
	[0169.344] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0169.344] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffaa010819) returned 0x0
	[0169.344] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0170.161] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d770) returned 0x0
	[0170.162] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0170.162] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0170.162] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0170.162] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d6c0) returned 0x0
	[0170.162] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0170.163] GdipCreateRegion (region=0x20d660) returned 0x0
	[0170.163] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0170.163] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0170.163] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0170.163] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0170.164] GdipCreateRegion (region=0x20d630) returned 0x0
	[0170.164] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0170.164] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0170.164] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0170.164] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d690) returned 0x0
	[0170.164] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0170.165] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0170.165] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0170.165] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0170.165] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0170.165] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x274cfd8 | out: lppt=0x274cfd8) returned 1
	[0170.166] GdipReleaseDC (graphics=0x1b929550, hdc=0x10107f8) returned 0x0
	[0170.166] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0170.167] GetDIBits (in: hdc=0x48010f97, hbm=0x1705119e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0170.168] GetDIBits (in: hdc=0x48010f97, hbm=0x1705119e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0170.168] GdipCreateFromHDC (hdc=0x1801119c, graphics=0x20d750) returned 0x0
	[0170.168] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0170.168] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0170.169] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0170.169] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0170.169] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0170.169] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0170.169] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0170.169] GdipCreateRegion (region=0x20d910) returned 0x0
	[0170.170] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0170.170] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0170.170] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0170.170] GdipCreateRegion (region=0x20d400) returned 0x0
	[0170.170] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0170.170] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0170.171] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0170.171] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0170.171] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0170.171] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0170.171] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0170.172] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0170.172] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0170.173] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0170.173] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0170.173] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0170.173] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0170.173] OffsetViewportOrgEx (in: hdc=0x1801119c, x=0, y=0, lppt=0x274e838 | out: lppt=0x274e838) returned 1
	[0170.174] GdipReleaseDC (graphics=0x1b929550, hdc=0x1801119c) returned 0x0
	[0170.174] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffba00dbd) returned 0x0
	[0170.174] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0170.174] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0170.174] GdipReleaseDC (graphics=0x1b929550, hdc=0x1801119c) returned 0x0
	[0170.174] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0170.175] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0170.175] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0170.175] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0170.175] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0170.175] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0170.175] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0170.176] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0170.177] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0170.177] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0170.177] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0170.177] GdipReleaseDC (graphics=0x1b929550, hdc=0x1801119c) returned 0x0
	[0170.178] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0170.178] GdipCreateFromHDC (hdc=0x701119b, graphics=0x20d7e0) returned 0x0
	[0170.178] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0170.178] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0170.178] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0170.179] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0170.179] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0170.179] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0170.179] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0170.179] GdipCreateRegion (region=0x20d910) returned 0x0
	[0170.179] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0170.180] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0170.181] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0170.181] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb9e0dbd) returned 0x0
	[0170.181] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0170.181] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0170.181] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x701119b) returned 0x0
	[0170.182] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0170.182] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0170.182] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0170.182] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0170.182] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0170.182] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0170.183] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0170.183] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0170.183] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0170.183] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0170.183] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0170.183] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0170.184] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0170.184] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0170.184] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0170.184] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0170.184] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0170.184] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0170.185] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0170.185] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0170.185] GdipCreateRegion (region=0x20d120) returned 0x0
	[0170.185] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0170.185] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0170.185] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0170.185] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0170.186] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0170.186] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0170.186] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0170.186] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0170.186] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0170.186] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0170.187] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0170.187] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0170.187] OffsetViewportOrgEx (in: hdc=0x701119b, x=0, y=0, lppt=0x274f928 | out: lppt=0x274f928) returned 1
	[0170.187] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x701119b) returned 0x0
	[0170.187] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0170.187] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0170.188] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0170.188] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0170.188] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0170.188] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0170.188] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0170.188] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0170.189] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0170.189] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0170.189] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0170.189] GdipCreateRegion (region=0x20d070) returned 0x0
	[0170.189] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0170.189] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0170.190] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0170.190] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0170.190] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0170.190] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0170.190] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0170.190] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0170.191] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0170.191] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0170.191] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0170.191] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0170.191] OffsetViewportOrgEx (in: hdc=0x701119b, x=0, y=0, lppt=0x274fec8 | out: lppt=0x274fec8) returned 1
	[0170.191] GetROP2 (hdc=0x701119b) returned 13
	[0170.192] GetROP2 (hdc=0x701119b) returned 13
	[0170.192] GetROP2 (hdc=0x701119b) returned 13
	[0170.192] GetROP2 (hdc=0x701119b) returned 13
	[0170.192] GetROP2 (hdc=0x701119b) returned 13
	[0170.192] GetROP2 (hdc=0x701119b) returned 13
	[0170.193] GetROP2 (hdc=0x701119b) returned 13
	[0170.193] GetROP2 (hdc=0x701119b) returned 13
	[0170.193] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x701119b) returned 0x0
	[0170.193] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0170.193] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x701119b) returned 0x0
	[0170.193] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0170.194] GetDIBits (in: hdc=0x70107fc, hbm=0x705119a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0170.194] GetDIBits (in: hdc=0x70107fc, hbm=0x705119a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0170.194] GdipCreateFromHDC (hdc=0x1b01119e, graphics=0x20d800) returned 0x0
	[0170.194] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0170.194] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0170.194] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0170.195] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0170.195] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0170.195] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0170.195] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0170.195] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0170.195] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0170.196] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0170.196] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0170.196] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0170.196] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0170.196] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0170.196] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0170.197] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0170.197] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0170.197] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0170.197] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0170.197] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0170.197] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0170.197] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0170.198] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0170.198] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0170.198] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0170.198] OffsetViewportOrgEx (in: hdc=0x1b01119e, x=0, y=0, lppt=0x2751778 | out: lppt=0x2751778) returned 1
	[0170.199] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b01119e) returned 0x0
	[0170.199] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb9b0dbd) returned 0x0
	[0170.199] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0170.199] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0170.206] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0170.206] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b01119e) returned 0x0
	[0170.206] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.097] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0172.097] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0172.098] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0172.098] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0172.098] UpdateWindow (hWnd=0x201d8) 
	[0172.098] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0172.098] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0172.098] GdipCreateFromHDC (hdc=0x401114d, graphics=0x20cfa0) returned 0x0
	[0172.099] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.099] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0172.099] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0172.099] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.099] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0172.099] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0172.099] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.100] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0172.100] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.100] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0172.100] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0172.100] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb990dbd) returned 0x0
	[0172.100] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.101] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0172.101] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x401114d) returned 0x0
	[0172.101] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0172.101] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.101] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.101] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.102] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0172.102] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0172.102] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0172.102] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0172.102] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0172.102] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.102] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0172.103] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0172.103] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0172.103] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0172.103] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.103] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.103] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.104] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0172.104] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.104] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0172.104] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0172.104] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.104] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0172.104] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.105] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0172.105] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0172.105] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0172.105] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.105] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0172.105] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0172.106] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0172.106] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.106] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0172.106] OffsetViewportOrgEx (in: hdc=0x401114d, x=0, y=0, lppt=0x2752c40 | out: lppt=0x2752c40) returned 1
	[0172.106] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x401114d) returned 0x0
	[0172.107] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0172.107] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.107] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.107] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.107] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0172.107] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0172.108] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0172.108] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.108] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0172.108] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0172.108] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0172.108] GdipCreateRegion (region=0x20c830) returned 0x0
	[0172.108] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.109] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0172.109] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.109] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0172.109] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0172.109] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0172.109] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.110] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0172.110] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0172.110] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0172.110] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.110] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0172.110] OffsetViewportOrgEx (in: hdc=0x401114d, x=0, y=0, lppt=0x27531e0 | out: lppt=0x27531e0) returned 1
	[0172.111] GetROP2 (hdc=0x401114d) returned 13
	[0172.111] GetROP2 (hdc=0x401114d) returned 13
	[0172.111] GetROP2 (hdc=0x401114d) returned 13
	[0172.111] GetROP2 (hdc=0x401114d) returned 13
	[0172.112] GetROP2 (hdc=0x401114d) returned 13
	[0172.112] GetROP2 (hdc=0x401114d) returned 13
	[0172.112] GetROP2 (hdc=0x401114d) returned 13
	[0172.112] GetROP2 (hdc=0x401114d) returned 13
	[0172.112] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x401114d) returned 0x0
	[0172.112] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0172.113] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x401114d) returned 0x0
	[0172.113] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.113] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0172.113] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0172.114] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0172.114] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2753528, Length=0x70 | out: Destination=0x1afe53a0) 
	[0172.114] ShellExecuteExW (pExecInfo=0x2753738*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0172.154] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0172.154] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0172.156] GdipCreateFromHDC (hdc=0xc01114d, graphics=0x20c9d0) returned 0x0
	[0172.156] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.156] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0172.156] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0172.156] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.157] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0172.157] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0172.157] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.157] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0172.157] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.157] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0172.158] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0172.158] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb960dbd) returned 0x0
	[0172.158] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.158] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0172.158] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc01114d) returned 0x0
	[0172.158] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0172.159] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.159] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.159] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.159] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0172.159] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0172.159] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0172.160] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0172.160] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0172.160] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.160] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0172.160] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0172.160] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0172.161] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0172.161] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.161] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.161] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.161] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0172.161] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.161] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0172.162] GdipCreateRegion (region=0x20c310) returned 0x0
	[0172.162] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.162] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0172.162] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.162] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0172.162] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0172.163] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0172.163] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.163] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0172.163] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0172.163] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0172.163] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.163] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0172.164] OffsetViewportOrgEx (in: hdc=0xc01114d, x=0, y=0, lppt=0x2754418 | out: lppt=0x2754418) returned 1
	[0172.164] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc01114d) returned 0x0
	[0172.164] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0172.164] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.164] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.164] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.165] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0172.165] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0172.165] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0172.165] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.165] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0172.165] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0172.166] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0172.166] GdipCreateRegion (region=0x20c260) returned 0x0
	[0172.166] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.166] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0172.166] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.166] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0172.166] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0172.167] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0172.167] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.167] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0172.167] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0172.167] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0172.167] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.167] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0172.168] OffsetViewportOrgEx (in: hdc=0xc01114d, x=0, y=0, lppt=0x27549b8 | out: lppt=0x27549b8) returned 1
	[0172.168] GetROP2 (hdc=0xc01114d) returned 13
	[0172.168] GetROP2 (hdc=0xc01114d) returned 13
	[0172.168] GetROP2 (hdc=0xc01114d) returned 13
	[0172.168] GetROP2 (hdc=0xc01114d) returned 13
	[0172.168] GetROP2 (hdc=0xc01114d) returned 13
	[0172.169] GetROP2 (hdc=0xc01114d) returned 13
	[0172.169] GetROP2 (hdc=0xc01114d) returned 13
	[0172.169] GetROP2 (hdc=0xc01114d) returned 13
	[0172.169] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc01114d) returned 0x0
	[0172.169] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0172.169] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc01114d) returned 0x0
	[0172.170] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.170] GdipCreateFromHDC (hdc=0xe01114d, graphics=0x20c9d0) returned 0x0
	[0172.170] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.170] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0172.170] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0172.170] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.171] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0172.171] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0172.171] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.171] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0172.171] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.171] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0172.171] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0172.172] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb930dbd) returned 0x0
	[0172.172] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.172] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0172.172] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xe01114d) returned 0x0
	[0172.172] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0172.172] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.173] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.173] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.173] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0172.173] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0172.173] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0172.173] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0172.174] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0172.174] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.174] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0172.174] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0172.174] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0172.174] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0172.174] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.175] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.175] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.175] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0172.175] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.175] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0172.175] GdipCreateRegion (region=0x20c310) returned 0x0
	[0172.176] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.176] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0172.176] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.176] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0172.176] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0172.176] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0172.176] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.177] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0172.177] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0172.177] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0172.177] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.177] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0172.177] OffsetViewportOrgEx (in: hdc=0xe01114d, x=0, y=0, lppt=0x2755840 | out: lppt=0x2755840) returned 1
	[0172.178] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xe01114d) returned 0x0
	[0172.178] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0172.178] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.178] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.178] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.178] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0172.178] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0172.179] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0172.179] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.179] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0172.179] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0172.179] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0172.179] GdipCreateRegion (region=0x20c260) returned 0x0
	[0172.180] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.180] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0172.180] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.180] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0172.180] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0172.180] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0172.180] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.181] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0172.181] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0172.181] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0172.181] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.181] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0172.181] OffsetViewportOrgEx (in: hdc=0xe01114d, x=0, y=0, lppt=0x2755de0 | out: lppt=0x2755de0) returned 1
	[0172.182] GetROP2 (hdc=0xe01114d) returned 13
	[0172.182] GetROP2 (hdc=0xe01114d) returned 13
	[0172.182] GetROP2 (hdc=0xe01114d) returned 13
	[0172.182] GetROP2 (hdc=0xe01114d) returned 13
	[0172.182] GetROP2 (hdc=0xe01114d) returned 13
	[0172.182] GetROP2 (hdc=0xe01114d) returned 13
	[0172.182] GetROP2 (hdc=0xe01114d) returned 13
	[0172.183] GetROP2 (hdc=0xe01114d) returned 13
	[0172.183] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xe01114d) returned 0x0
	[0172.183] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0172.183] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xe01114d) returned 0x0
	[0172.183] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.249] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0172.249] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0172.249] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0172.249] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0172.249] GdipCreateFromHDC (hdc=0x100111a0, graphics=0x20d7e0) returned 0x0
	[0172.249] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.250] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0172.250] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0172.250] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.250] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0172.250] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.250] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.251] GdipCreateRegion (region=0x20d910) returned 0x0
	[0172.251] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.251] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0172.251] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0172.251] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb900dbd) returned 0x0
	[0172.251] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.252] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0172.252] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x100111a0) returned 0x0
	[0172.252] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0172.252] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.252] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.252] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.253] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0172.253] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0172.253] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0172.253] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0172.253] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0172.253] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.253] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0172.254] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0172.254] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0172.254] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0172.254] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.254] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.254] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.255] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0172.255] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.255] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0172.255] GdipCreateRegion (region=0x20d120) returned 0x0
	[0172.255] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.255] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0172.255] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.256] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0172.256] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.256] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.256] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.256] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0172.256] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0172.257] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0172.257] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.257] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0172.257] OffsetViewportOrgEx (in: hdc=0x100111a0, x=0, y=0, lppt=0x2756d60 | out: lppt=0x2756d60) returned 1
	[0172.257] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x100111a0) returned 0x0
	[0172.258] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0172.258] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.258] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.258] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.258] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0172.258] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0172.259] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0172.259] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.259] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0172.259] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0172.259] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0172.259] GdipCreateRegion (region=0x20d070) returned 0x0
	[0172.260] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.260] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0172.260] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.260] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0172.260] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.260] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.261] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.261] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0172.261] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0172.261] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0172.261] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.261] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0172.261] OffsetViewportOrgEx (in: hdc=0x100111a0, x=0, y=0, lppt=0x2757300 | out: lppt=0x2757300) returned 1
	[0172.262] GetROP2 (hdc=0x100111a0) returned 13
	[0172.262] GetROP2 (hdc=0x100111a0) returned 13
	[0172.262] GetROP2 (hdc=0x100111a0) returned 13
	[0172.262] GetROP2 (hdc=0x100111a0) returned 13
	[0172.262] GetROP2 (hdc=0x100111a0) returned 13
	[0172.262] GetROP2 (hdc=0x100111a0) returned 13
	[0172.263] GetROP2 (hdc=0x100111a0) returned 13
	[0172.263] GetROP2 (hdc=0x100111a0) returned 13
	[0172.263] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x100111a0) returned 0x0
	[0172.263] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0172.263] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x100111a0) returned 0x0
	[0172.263] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.264] GdipCreateFromHDC (hdc=0x120111a0, graphics=0x20d7e0) returned 0x0
	[0172.264] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.264] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0172.264] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0172.264] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.264] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0172.265] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.265] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.265] GdipCreateRegion (region=0x20d910) returned 0x0
	[0172.265] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.265] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0172.265] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0172.266] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb8d0dbd) returned 0x0
	[0172.266] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.266] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0172.266] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x120111a0) returned 0x0
	[0172.266] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0172.266] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.267] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.267] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.267] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0172.267] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0172.268] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0172.268] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0172.268] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0172.268] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.268] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0172.268] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0172.269] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0172.269] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0172.269] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.269] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.269] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.269] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0172.269] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.270] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0172.270] GdipCreateRegion (region=0x20d120) returned 0x0
	[0172.270] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.270] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0172.270] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.270] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0172.271] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.271] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.271] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.271] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0172.271] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0172.271] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0172.271] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.272] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0172.272] OffsetViewportOrgEx (in: hdc=0x120111a0, x=0, y=0, lppt=0x2758160 | out: lppt=0x2758160) returned 1
	[0172.272] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x120111a0) returned 0x0
	[0172.272] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0172.272] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.273] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.273] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.273] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0172.273] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0172.273] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0172.273] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.274] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0172.274] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0172.274] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0172.274] GdipCreateRegion (region=0x20d070) returned 0x0
	[0172.274] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.274] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0172.275] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.275] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0172.275] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.275] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.275] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.275] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0172.276] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0172.276] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0172.276] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.276] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0172.276] OffsetViewportOrgEx (in: hdc=0x120111a0, x=0, y=0, lppt=0x2758700 | out: lppt=0x2758700) returned 1
	[0172.276] GetROP2 (hdc=0x120111a0) returned 13
	[0172.276] GetROP2 (hdc=0x120111a0) returned 13
	[0172.277] GetROP2 (hdc=0x120111a0) returned 13
	[0172.277] GetROP2 (hdc=0x120111a0) returned 13
	[0172.277] GetROP2 (hdc=0x120111a0) returned 13
	[0172.277] GetROP2 (hdc=0x120111a0) returned 13
	[0172.277] GetROP2 (hdc=0x120111a0) returned 13
	[0172.277] GetROP2 (hdc=0x120111a0) returned 13
	[0172.278] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x120111a0) returned 0x0
	[0172.278] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0172.278] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x120111a0) returned 0x0
	[0172.278] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.472] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d7b0) returned 0x0
	[0172.473] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0172.473] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0172.473] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.473] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d700) returned 0x0
	[0172.473] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.474] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0172.474] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.474] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6d0) returned 0x0
	[0172.474] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.474] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d7a0) returned 0x0
	[0172.474] GdipCreateRegion (region=0x20d670) returned 0x0
	[0172.475] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.475] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0172.475] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.475] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d6d0) returned 0x0
	[0172.475] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.476] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.476] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d720) returned 0x0
	[0172.476] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.476] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d750) returned 0x0
	[0172.476] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x2758ea0 | out: lppt=0x2758ea0) returned 1
	[0172.476] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4010280) returned 0x0
	[0172.477] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.478] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0172.478] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0172.478] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0172.478] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0172.478] UpdateWindow (hWnd=0x401b4) 
	[0172.478] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0172.478] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0172.478] GdipCreateFromHDC (hdc=0x3101119e, graphics=0x20cfa0) returned 0x0
	[0172.479] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.479] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0172.479] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0172.479] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.479] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0172.479] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.480] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.480] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0172.480] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.480] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0172.480] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0172.481] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb880dbd) returned 0x0
	[0172.481] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.481] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0172.481] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3101119e) returned 0x0
	[0172.483] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0172.485] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.485] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.486] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.486] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0172.486] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0172.486] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0172.486] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0172.487] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0172.487] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.487] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0172.487] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0172.487] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0172.488] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0172.488] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.488] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.488] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.488] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0172.489] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.489] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0172.489] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0172.489] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.489] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0172.489] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.490] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0172.490] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.490] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.490] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.490] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0172.490] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0172.491] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0172.491] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.491] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0172.491] OffsetViewportOrgEx (in: hdc=0x3101119e, x=0, y=0, lppt=0x2759c68 | out: lppt=0x2759c68) returned 1
	[0172.491] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3101119e) returned 0x0
	[0172.491] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0172.492] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.492] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0172.492] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.492] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0172.492] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0172.492] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0172.493] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.493] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0172.493] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0172.493] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0172.493] GdipCreateRegion (region=0x20c830) returned 0x0
	[0172.493] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.493] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0172.494] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.494] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0172.494] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.494] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.494] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.494] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0172.495] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0172.495] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0172.495] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.495] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0172.495] OffsetViewportOrgEx (in: hdc=0x3101119e, x=0, y=0, lppt=0x275a208 | out: lppt=0x275a208) returned 1
	[0172.495] GetROP2 (hdc=0x3101119e) returned 13
	[0172.496] GetROP2 (hdc=0x3101119e) returned 13
	[0172.496] GetROP2 (hdc=0x3101119e) returned 13
	[0172.496] GetROP2 (hdc=0x3101119e) returned 13
	[0172.496] GetROP2 (hdc=0x3101119e) returned 13
	[0172.496] GetROP2 (hdc=0x3101119e) returned 13
	[0172.496] GetROP2 (hdc=0x3101119e) returned 13
	[0172.497] GetROP2 (hdc=0x3101119e) returned 13
	[0172.497] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3101119e) returned 0x0
	[0172.497] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0172.497] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3101119e) returned 0x0
	[0172.497] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.497] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0172.497] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0172.497] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0172.498] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0172.498] GetCapture () returned 0x401b4
	[0172.498] ReleaseCapture () 
	[0172.498] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0172.498] GetDIBits (in: hdc=0x48010f97, hbm=0xffffffffa205119d, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0172.498] GetDIBits (in: hdc=0x48010f97, hbm=0xffffffffa205119d, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0172.498] GdipCreateFromHDC (hdc=0x5b0111a1, graphics=0x20d750) returned 0x0
	[0172.498] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.499] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0172.499] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0172.499] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0172.499] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0172.499] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.499] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0172.499] GdipCreateRegion (region=0x20d910) returned 0x0
	[0172.500] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0172.500] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0172.500] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0172.500] GdipCreateRegion (region=0x20d400) returned 0x0
	[0172.500] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0172.500] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0172.505] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0172.506] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d460) returned 0x0
	[0172.506] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.506] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0172.506] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.506] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.506] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0172.506] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0172.507] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0172.507] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0172.507] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0172.507] OffsetViewportOrgEx (in: hdc=0x5b0111a1, x=0, y=0, lppt=0x275bbc0 | out: lppt=0x275bbc0) returned 1
	[0172.507] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5b0111a1) returned 0x0
	[0172.508] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb850dbd) returned 0x0
	[0172.508] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.508] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0172.508] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5b0111a1) returned 0x0
	[0172.508] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0172.508] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0172.509] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0172.509] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0172.509] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0172.509] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0172.509] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0172.509] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0172.510] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0172.510] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0172.510] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0172.510] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5b0111a1) returned 0x0
	[0172.510] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0172.511] GetDIBits (in: hdc=0x10107f8, hbm=0xffffffffa405119d, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0172.511] GetDIBits (in: hdc=0x10107f8, hbm=0xffffffffa405119d, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0172.511] GdipCreateFromHDC (hdc=0x150111a0, graphics=0x20d800) returned 0x0
	[0172.511] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0172.511] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0172.512] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0172.512] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0172.512] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0172.512] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0172.512] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0172.512] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0172.512] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0172.513] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0172.513] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0172.513] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0172.513] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0172.513] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0172.514] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0172.514] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0172.514] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.514] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0172.514] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0172.514] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0172.515] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0172.515] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0172.515] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0172.515] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0172.515] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0172.516] OffsetViewportOrgEx (in: hdc=0x150111a0, x=0, y=0, lppt=0x275d700 | out: lppt=0x275d700) returned 1
	[0172.516] GdipReleaseDC (graphics=0x1b929550, hdc=0x150111a0) returned 0x0
	[0172.550] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb830dbd) returned 0x0
	[0172.551] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0172.551] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0172.558] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0172.558] GdipReleaseDC (graphics=0x1b929550, hdc=0x150111a0) returned 0x0
	[0172.558] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0175.027] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0175.027] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0175.027] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0175.027] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0175.027] GdipCreateFromHDC (hdc=0xffffffff92011156, graphics=0x20d7e0) returned 0x0
	[0175.027] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0175.027] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0175.028] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0175.028] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.028] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0175.028] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.028] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.029] GdipCreateRegion (region=0x20d910) returned 0x0
	[0175.029] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.029] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0175.029] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0175.029] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb810dbd) returned 0x0
	[0175.029] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.029] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0175.030] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff92011156) returned 0x0
	[0175.030] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0175.030] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.030] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.030] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.031] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0175.031] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0175.031] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0175.031] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0175.031] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0175.031] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.031] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0175.032] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0175.032] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0175.032] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0175.032] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.032] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.032] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.033] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0175.033] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.033] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0175.033] GdipCreateRegion (region=0x20d120) returned 0x0
	[0175.033] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.033] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0175.034] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.034] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0175.034] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0175.034] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0175.034] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.034] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0175.034] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0175.035] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0175.035] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.035] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0175.035] OffsetViewportOrgEx (in: hdc=0xffffffff92011156, x=0, y=0, lppt=0x275e588 | out: lppt=0x275e588) returned 1
	[0175.035] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff92011156) returned 0x0
	[0175.036] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0175.036] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.036] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.036] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.036] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0175.036] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0175.036] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0175.037] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.037] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0175.037] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0175.037] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0175.037] GdipCreateRegion (region=0x20d070) returned 0x0
	[0175.037] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.038] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0175.038] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.038] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0175.038] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.038] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.038] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.039] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0175.039] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0175.039] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0175.039] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.039] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0175.039] OffsetViewportOrgEx (in: hdc=0xffffffff92011156, x=0, y=0, lppt=0x275eb28 | out: lppt=0x275eb28) returned 1
	[0175.039] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.040] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.040] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.040] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.040] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.040] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.040] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.041] GetROP2 (hdc=0xffffffff92011156) returned 13
	[0175.041] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff92011156) returned 0x0
	[0175.041] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0175.041] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff92011156) returned 0x0
	[0175.041] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0175.041] GdipCreateFromHDC (hdc=0xffffffff94011156, graphics=0x20d7e0) returned 0x0
	[0175.042] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0175.042] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0175.042] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0175.042] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.042] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0175.042] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0175.043] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.043] GdipCreateRegion (region=0x20d910) returned 0x0
	[0175.043] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.043] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0175.043] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0175.044] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb7e0dbd) returned 0x0
	[0175.044] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.044] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0175.044] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff94011156) returned 0x0
	[0175.044] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0175.044] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.045] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.045] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.045] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0175.045] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0175.045] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0175.045] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0175.045] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0175.046] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.046] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0175.046] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0175.046] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0175.046] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0175.046] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.047] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.047] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.047] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0175.047] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.047] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0175.047] GdipCreateRegion (region=0x20d120) returned 0x0
	[0175.048] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.048] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0175.048] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.048] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0175.048] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.048] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.048] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.049] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0175.049] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0175.049] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0175.049] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.049] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0175.049] OffsetViewportOrgEx (in: hdc=0xffffffff94011156, x=0, y=0, lppt=0x275f988 | out: lppt=0x275f988) returned 1
	[0175.050] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff94011156) returned 0x0
	[0175.050] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0175.050] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.050] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.050] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.050] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0175.050] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0175.051] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0175.051] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.051] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0175.051] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0175.051] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0175.051] GdipCreateRegion (region=0x20d070) returned 0x0
	[0175.052] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.052] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0175.052] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.052] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0175.052] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0175.052] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0175.053] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.053] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0175.053] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0175.053] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0175.053] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.053] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0175.053] OffsetViewportOrgEx (in: hdc=0xffffffff94011156, x=0, y=0, lppt=0x275ff28 | out: lppt=0x275ff28) returned 1
	[0175.054] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.054] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.054] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.054] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.054] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.054] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.055] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.055] GetROP2 (hdc=0xffffffff94011156) returned 13
	[0175.055] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff94011156) returned 0x0
	[0175.055] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0175.055] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff94011156) returned 0x0
	[0175.055] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0175.284] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0175.284] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0175.284] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0175.284] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0175.285] UpdateWindow (hWnd=0x201d8) 
	[0175.285] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0175.285] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0175.285] GdipCreateFromHDC (hdc=0xffffffff9d011156, graphics=0x20cfa0) returned 0x0
	[0175.285] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0175.285] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0175.285] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0175.285] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.286] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0175.286] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.286] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.286] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0175.286] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.286] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0175.287] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0175.287] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb7b0dbd) returned 0x0
	[0175.287] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.287] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0175.287] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d011156) returned 0x0
	[0175.288] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0175.288] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.288] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.288] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.288] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0175.288] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0175.289] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0175.289] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0175.289] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0175.289] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.289] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0175.289] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0175.290] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0175.290] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0175.290] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.290] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.290] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.290] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0175.291] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.291] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0175.291] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0175.291] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.291] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0175.291] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.292] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0175.292] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0175.292] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0175.292] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.292] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0175.292] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0175.292] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0175.293] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.293] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0175.293] OffsetViewportOrgEx (in: hdc=0xffffffff9d011156, x=0, y=0, lppt=0x2760f58 | out: lppt=0x2760f58) returned 1
	[0175.293] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d011156) returned 0x0
	[0175.293] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0175.294] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.294] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.294] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.294] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0175.294] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0175.295] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0175.295] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.295] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0175.295] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0175.295] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0175.295] GdipCreateRegion (region=0x20c830) returned 0x0
	[0175.296] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.296] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0175.296] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.296] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0175.296] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.296] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0175.296] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.297] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0175.297] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0175.297] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0175.297] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.297] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0175.297] OffsetViewportOrgEx (in: hdc=0xffffffff9d011156, x=0, y=0, lppt=0x27614f8 | out: lppt=0x27614f8) returned 1
	[0175.298] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.298] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.298] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.298] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.298] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.298] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.298] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.299] GetROP2 (hdc=0xffffffff9d011156) returned 13
	[0175.299] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d011156) returned 0x0
	[0175.299] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0175.299] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9d011156) returned 0x0
	[0175.299] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0175.300] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0175.300] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0175.300] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0175.300] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2761840, Length=0x70 | out: Destination=0x1afe53a0) 
	[0175.300] ShellExecuteExW (pExecInfo=0x2761a50*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0175.352] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0175.352] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0175.354] GdipCreateFromHDC (hdc=0xffffffffa6011156, graphics=0x20c9d0) returned 0x0
	[0175.354] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0175.354] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0175.354] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0175.354] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.354] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0175.355] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0175.355] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.355] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0175.355] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.355] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0175.355] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0175.356] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb780dbd) returned 0x0
	[0175.356] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.356] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0175.357] GetNearestColor (hdc=0xffffffffa6011156, color=0xf0f0f0) returned 0xf0f0f0
	[0175.357] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011156) returned 0x0
	[0175.357] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0175.357] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.357] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.357] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.357] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0175.358] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0175.358] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0175.358] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0175.358] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0175.358] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.358] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0175.359] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0175.359] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0175.359] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0175.359] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.359] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.359] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.359] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0175.360] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.360] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0175.360] GdipCreateRegion (region=0x20c310) returned 0x0
	[0175.360] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.360] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0175.360] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.361] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0175.361] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0175.361] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0175.361] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.361] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0175.361] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0175.362] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0175.362] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.362] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0175.362] OffsetViewportOrgEx (in: hdc=0xffffffffa6011156, x=0, y=0, lppt=0x2762730 | out: lppt=0x2762730) returned 1
	[0175.362] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011156) returned 0x0
	[0175.362] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0175.363] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.363] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.363] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.363] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0175.363] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0175.363] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0175.364] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.364] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0175.364] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0175.364] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0175.364] GdipCreateRegion (region=0x20c260) returned 0x0
	[0175.364] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.365] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0175.365] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.365] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0175.365] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0175.365] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0175.365] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.365] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0175.366] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0175.366] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0175.366] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.366] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0175.366] OffsetViewportOrgEx (in: hdc=0xffffffffa6011156, x=0, y=0, lppt=0x2762cd0 | out: lppt=0x2762cd0) returned 1
	[0175.366] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.366] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.367] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.367] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.367] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.367] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.367] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.367] GetROP2 (hdc=0xffffffffa6011156) returned 13
	[0175.367] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011156) returned 0x0
	[0175.368] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0175.368] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011156) returned 0x0
	[0175.368] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0175.368] GdipCreateFromHDC (hdc=0xffffffffa8011156, graphics=0x20c9d0) returned 0x0
	[0175.368] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0175.369] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0175.369] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0175.369] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.369] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0175.369] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0175.369] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.369] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0175.370] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.370] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0175.370] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0175.370] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb750dbd) returned 0x0
	[0175.370] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.370] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0175.370] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa8011156) returned 0x0
	[0175.371] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0175.371] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.371] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.371] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.371] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0175.371] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0175.372] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0175.372] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0175.372] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0175.372] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.372] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0175.373] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0175.373] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0175.373] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0175.373] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.373] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.373] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.374] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0175.374] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.374] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0175.374] GdipCreateRegion (region=0x20c310) returned 0x0
	[0175.374] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.375] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0175.375] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.375] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0175.375] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0175.375] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0175.375] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.376] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0175.376] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0175.376] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0175.376] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.376] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0175.376] OffsetViewportOrgEx (in: hdc=0xffffffffa8011156, x=0, y=0, lppt=0x2763b58 | out: lppt=0x2763b58) returned 1
	[0175.377] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa8011156) returned 0x0
	[0175.377] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0175.377] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.377] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.377] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.377] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0175.378] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0175.378] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0175.378] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.378] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0175.378] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0175.378] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0175.379] GdipCreateRegion (region=0x20c260) returned 0x0
	[0175.379] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.379] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0175.379] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.379] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0175.379] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0175.379] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0175.380] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.380] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0175.380] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0175.380] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0175.380] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.380] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0175.381] OffsetViewportOrgEx (in: hdc=0xffffffffa8011156, x=0, y=0, lppt=0x27640f8 | out: lppt=0x27640f8) returned 1
	[0175.381] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.381] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.381] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.381] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.381] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.381] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.382] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.382] GetROP2 (hdc=0xffffffffa8011156) returned 13
	[0175.382] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa8011156) returned 0x0
	[0175.382] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0175.382] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa8011156) returned 0x0
	[0175.382] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0175.459] GdipCreateFromHDC (hdc=0x250111a0, graphics=0x20d7e0) returned 0x0
	[0175.459] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0175.459] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0175.459] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0175.459] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.460] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0175.460] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0175.460] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.460] GdipCreateRegion (region=0x20d910) returned 0x0
	[0175.460] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.460] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0175.460] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0175.461] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb720dbd) returned 0x0
	[0175.461] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.461] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0175.461] GdipReleaseDC (graphics=0x1b929550, hdc=0x250111a0) returned 0x0
	[0175.461] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0175.461] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.462] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.462] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.462] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0175.462] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0175.462] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0175.462] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0175.463] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0175.463] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.463] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0175.463] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0175.463] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0175.463] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0175.463] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.464] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.464] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.464] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0175.464] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.464] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0175.465] GdipCreateRegion (region=0x20d120) returned 0x0
	[0175.465] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.465] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0175.465] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0175.465] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0175.465] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0175.466] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0175.466] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0175.466] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0175.466] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0175.466] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0175.466] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.467] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0175.467] OffsetViewportOrgEx (in: hdc=0x250111a0, x=0, y=0, lppt=0x2765088 | out: lppt=0x2765088) returned 1
	[0175.467] GdipReleaseDC (graphics=0x1b929550, hdc=0x250111a0) returned 0x0
	[0175.467] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0175.467] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.468] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0175.468] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0175.468] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0175.468] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0175.468] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0175.468] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0175.469] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0175.469] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0175.469] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0175.469] GdipCreateRegion (region=0x20d070) returned 0x0
	[0175.469] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0175.470] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0175.470] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0175.470] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0175.470] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0175.470] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0175.470] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0175.471] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0175.471] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0175.471] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0175.471] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0175.471] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0175.471] OffsetViewportOrgEx (in: hdc=0x250111a0, x=0, y=0, lppt=0x2765628 | out: lppt=0x2765628) returned 1
	[0175.472] GetROP2 (hdc=0x250111a0) returned 13
	[0175.472] GetROP2 (hdc=0x250111a0) returned 13
	[0175.472] GetROP2 (hdc=0x250111a0) returned 13
	[0175.472] GetROP2 (hdc=0x250111a0) returned 13
	[0175.473] GetROP2 (hdc=0x250111a0) returned 13
	[0175.473] GetROP2 (hdc=0x250111a0) returned 13
	[0175.473] GetROP2 (hdc=0x250111a0) returned 13
	[0175.473] GetROP2 (hdc=0x250111a0) returned 13
	[0175.473] GdipReleaseDC (graphics=0x1b929550, hdc=0x250111a0) returned 0x0
	[0175.473] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0175.474] GdipReleaseDC (graphics=0x1b929550, hdc=0x250111a0) returned 0x0
	[0175.474] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0178.083] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0178.083] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0178.083] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0178.083] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0178.084] GdipCreateFromHDC (hdc=0x2d0111a3, graphics=0x20d7e0) returned 0x0
	[0178.084] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0178.084] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0178.084] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0178.084] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0178.085] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0178.085] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0178.085] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.085] GdipCreateRegion (region=0x20d910) returned 0x0
	[0178.085] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.086] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0178.086] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0178.086] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb6f0dbd) returned 0x0
	[0178.086] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.086] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0178.086] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d0111a3) returned 0x0
	[0178.087] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0178.087] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.087] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.087] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.087] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0178.087] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0178.088] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0178.088] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0178.088] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0178.088] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.088] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0178.088] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0178.089] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0178.089] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0178.089] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.089] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.089] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.089] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0178.090] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.090] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0178.090] GdipCreateRegion (region=0x20d120) returned 0x0
	[0178.090] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.090] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0178.090] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0178.091] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0178.091] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0178.091] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0178.091] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0178.091] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0178.092] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0178.092] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0178.092] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.092] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0178.092] OffsetViewportOrgEx (in: hdc=0x2d0111a3, x=0, y=0, lppt=0x2766558 | out: lppt=0x2766558) returned 1
	[0178.092] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d0111a3) returned 0x0
	[0178.093] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0178.093] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.093] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.093] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.093] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0178.093] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0178.094] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0178.094] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.094] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0178.094] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0178.094] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0178.094] GdipCreateRegion (region=0x20d070) returned 0x0
	[0178.095] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.095] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0178.095] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0178.095] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0178.095] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0178.095] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0178.096] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.096] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0178.096] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0178.096] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0178.096] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.096] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0178.096] OffsetViewportOrgEx (in: hdc=0x2d0111a3, x=0, y=0, lppt=0x2766af8 | out: lppt=0x2766af8) returned 1
	[0178.097] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.097] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.097] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.097] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.097] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.097] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.098] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.098] GetROP2 (hdc=0x2d0111a3) returned 13
	[0178.098] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d0111a3) returned 0x0
	[0178.098] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0178.098] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d0111a3) returned 0x0
	[0178.098] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0178.319] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0178.324] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0178.325] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0178.325] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0178.325] UpdateWindow (hWnd=0x201d8) 
	[0178.325] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0178.325] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0178.325] GdipCreateFromHDC (hdc=0x1901128b, graphics=0x20cfa0) returned 0x0
	[0178.325] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0178.326] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0178.326] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0178.326] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0178.326] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0178.326] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0178.326] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0178.327] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0178.327] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.327] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0178.327] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0178.327] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb6c0dbd) returned 0x0
	[0178.327] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.328] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0178.328] GdipReleaseDC (graphics=0x1b929550, hdc=0x1901128b) returned 0x0
	[0178.328] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0178.328] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.329] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.329] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.329] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0178.329] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0178.329] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0178.329] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0178.330] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0178.330] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.330] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0178.330] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0178.330] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0178.330] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0178.331] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.331] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.331] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.331] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0178.331] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.332] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0178.332] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0178.332] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.332] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0178.332] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0178.332] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0178.333] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0178.333] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0178.333] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.333] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0178.333] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0178.333] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0178.334] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.334] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0178.334] OffsetViewportOrgEx (in: hdc=0x1901128b, x=0, y=0, lppt=0x2767af0 | out: lppt=0x2767af0) returned 1
	[0178.334] GdipReleaseDC (graphics=0x1b929550, hdc=0x1901128b) returned 0x0
	[0178.334] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0178.335] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.335] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.335] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.335] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0178.335] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0178.336] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0178.336] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.336] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0178.336] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0178.336] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0178.337] GdipCreateRegion (region=0x20c830) returned 0x0
	[0178.337] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.337] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0178.337] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0178.337] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0178.337] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0178.338] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0178.338] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0178.338] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0178.338] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0178.338] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0178.338] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.339] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0178.339] OffsetViewportOrgEx (in: hdc=0x1901128b, x=0, y=0, lppt=0x2768090 | out: lppt=0x2768090) returned 1
	[0178.339] GetROP2 (hdc=0x1901128b) returned 13
	[0178.339] GetROP2 (hdc=0x1901128b) returned 13
	[0178.339] GetROP2 (hdc=0x1901128b) returned 13
	[0178.340] GetROP2 (hdc=0x1901128b) returned 13
	[0178.340] GetROP2 (hdc=0x1901128b) returned 13
	[0178.340] GetROP2 (hdc=0x1901128b) returned 13
	[0178.340] GetROP2 (hdc=0x1901128b) returned 13
	[0178.340] GetROP2 (hdc=0x1901128b) returned 13
	[0178.340] GdipReleaseDC (graphics=0x1b929550, hdc=0x1901128b) returned 0x0
	[0178.341] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0178.341] GdipReleaseDC (graphics=0x1b929550, hdc=0x1901128b) returned 0x0
	[0178.341] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0178.341] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0178.341] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0178.342] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0178.342] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27683d8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0178.342] ShellExecuteExW (pExecInfo=0x27685e8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0178.438] GdipCreateFromHDC (hdc=0x44011291, graphics=0x20c9d0) returned 0x0
	[0178.438] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0178.439] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0178.439] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0178.439] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0178.439] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0178.439] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.439] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.440] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0178.440] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.440] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0178.440] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0178.440] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb690dbd) returned 0x0
	[0178.440] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.441] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0178.441] GdipReleaseDC (graphics=0x1b929550, hdc=0x44011291) returned 0x0
	[0178.441] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0178.441] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.441] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.442] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.442] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0178.442] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0178.442] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0178.442] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0178.442] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0178.443] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.443] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0178.443] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0178.443] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0178.443] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0178.444] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.444] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.444] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.444] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0178.445] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.445] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0178.445] GdipCreateRegion (region=0x20c310) returned 0x0
	[0178.446] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.446] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0178.446] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0178.446] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0178.446] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0178.446] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0178.447] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0178.447] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0178.447] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0178.447] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0178.447] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.447] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0178.448] OffsetViewportOrgEx (in: hdc=0x44011291, x=0, y=0, lppt=0x27692f0 | out: lppt=0x27692f0) returned 1
	[0178.448] GdipReleaseDC (graphics=0x1b929550, hdc=0x44011291) returned 0x0
	[0178.448] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0178.448] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.448] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.449] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.449] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0178.449] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0178.449] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0178.449] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.449] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0178.450] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0178.450] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0178.450] GdipCreateRegion (region=0x20c260) returned 0x0
	[0178.450] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.450] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0178.451] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0178.451] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0178.451] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.451] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.451] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.451] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0178.452] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0178.452] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0178.452] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.452] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0178.452] OffsetViewportOrgEx (in: hdc=0x44011291, x=0, y=0, lppt=0x2769890 | out: lppt=0x2769890) returned 1
	[0178.452] GetROP2 (hdc=0x44011291) returned 13
	[0178.453] GetROP2 (hdc=0x44011291) returned 13
	[0178.453] GetROP2 (hdc=0x44011291) returned 13
	[0178.453] GetROP2 (hdc=0x44011291) returned 13
	[0178.453] GetROP2 (hdc=0x44011291) returned 13
	[0178.453] GetROP2 (hdc=0x44011291) returned 13
	[0178.453] GetROP2 (hdc=0x44011291) returned 13
	[0178.454] GetROP2 (hdc=0x44011291) returned 13
	[0178.454] GdipReleaseDC (graphics=0x1b929550, hdc=0x44011291) returned 0x0
	[0178.454] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0178.454] GdipReleaseDC (graphics=0x1b929550, hdc=0x44011291) returned 0x0
	[0178.454] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0178.522] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20c950) returned 0x0
	[0178.523] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0178.523] GdipCreateMatrix (matrix=0x20c840) returned 0x0
	[0178.523] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0178.523] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c8a0) returned 0x0
	[0178.524] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0178.524] GdipCreateRegion (region=0x20c840) returned 0x0
	[0178.524] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.524] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c870) returned 0x0
	[0178.524] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.525] GdipSaveGraphics (graphics=0x1b929550, state=0x20c940) returned 0x0
	[0178.525] GdipCreateRegion (region=0x20c810) returned 0x0
	[0178.525] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.525] GdipCreateMatrix (matrix=0x20c810) returned 0x0
	[0178.525] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0178.526] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c870) returned 0x0
	[0178.526] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.526] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.526] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8c0) returned 0x0
	[0178.526] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.526] GdipGetDC (graphics=0x1b929550, hdc=0x20c8f0) returned 0x0
	[0178.527] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x276a000 | out: lppt=0x276a000) returned 1
	[0178.527] GdipReleaseDC (graphics=0x1b929550, hdc=0x4010280) returned 0x0
	[0178.527] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0178.529] GetDIBits (in: hdc=0x48010f97, hbm=0x23051294, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20c258, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20c258) returned 1
	[0178.529] GetDIBits (in: hdc=0x48010f97, hbm=0x23051294, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20c258, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20c258) returned 1
	[0178.529] GdipCreateFromHDC (hdc=0x570111a3, graphics=0x20c940) returned 0x0
	[0178.529] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0178.530] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0178.530] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0178.530] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0178.531] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0178.531] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0178.531] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0178.532] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0178.532] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0178.532] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0178.532] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0178.532] GdipCreateRegion (region=0x20c5f0) returned 0x0
	[0178.533] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0178.533] GdipCreateMatrix (matrix=0x20c5f0) returned 0x0
	[0178.533] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0178.533] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c650) returned 0x0
	[0178.533] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.534] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0178.534] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.534] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.534] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20c6a0) returned 0x0
	[0178.534] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20c660) returned 0x0
	[0178.535] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20c660) returned 0x0
	[0178.535] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0178.535] GdipGetDC (graphics=0x1b929550, hdc=0x20c6d0) returned 0x0
	[0178.535] OffsetViewportOrgEx (in: hdc=0x570111a3, x=0, y=0, lppt=0x276b848 | out: lppt=0x276b848) returned 1
	[0178.536] GdipReleaseDC (graphics=0x1b929550, hdc=0x570111a3) returned 0x0
	[0178.536] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb640dbd) returned 0x0
	[0178.536] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0178.536] GdipGetDC (graphics=0x1b929550, hdc=0x20c720) returned 0x0
	[0178.536] GdipReleaseDC (graphics=0x1b929550, hdc=0x570111a3) returned 0x0
	[0178.537] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6b0) returned 0x0
	[0178.537] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0178.537] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0178.537] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.537] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c6d0) returned 0x0
	[0178.538] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0178.538] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20c720) returned 0x0
	[0178.538] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20c630, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0178.539] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0178.539] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.539] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0178.539] GdipReleaseDC (graphics=0x1b929550, hdc=0x570111a3) returned 0x0
	[0178.540] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0178.540] GdipCreateFromHDC (hdc=0x3e010bdf, graphics=0x20c9d0) returned 0x0
	[0178.540] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0178.541] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0178.541] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0178.541] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0178.541] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0178.541] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0178.542] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0178.542] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0178.542] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0178.542] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0178.542] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0178.543] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb620dbd) returned 0x0
	[0178.543] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0178.543] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0178.543] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e010bdf) returned 0x0
	[0178.543] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0178.544] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.544] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.544] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.544] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0178.544] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0178.545] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0178.545] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0178.545] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0178.545] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.545] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0178.546] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0178.546] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0178.546] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0178.546] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.547] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.547] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.547] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0178.547] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.547] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0178.548] GdipCreateRegion (region=0x20c310) returned 0x0
	[0178.548] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0178.548] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0178.548] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0178.548] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0178.549] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.549] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.549] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.549] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0178.549] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0178.550] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0178.550] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0178.550] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0178.550] OffsetViewportOrgEx (in: hdc=0x3e010bdf, x=0, y=0, lppt=0x276c950 | out: lppt=0x276c950) returned 1
	[0178.551] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e010bdf) returned 0x0
	[0178.551] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0178.551] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.551] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0178.551] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0178.552] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0178.552] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0178.552] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0178.552] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0178.552] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0178.553] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0178.553] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0178.553] GdipCreateRegion (region=0x20c260) returned 0x0
	[0178.553] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0178.554] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0178.554] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0178.554] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0178.554] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0178.554] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0178.555] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0178.555] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0178.555] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0178.555] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0178.555] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0178.556] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0178.556] OffsetViewportOrgEx (in: hdc=0x3e010bdf, x=0, y=0, lppt=0x276cef0 | out: lppt=0x276cef0) returned 1
	[0178.556] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.556] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.557] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.557] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.557] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.557] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.557] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.558] GetROP2 (hdc=0x3e010bdf) returned 13
	[0178.558] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e010bdf) returned 0x0
	[0178.558] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0178.558] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3e010bdf) returned 0x0
	[0178.558] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0178.559] GetDIBits (in: hdc=0x10107f8, hbm=0x7d0511a2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20c308, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20c308) returned 1
	[0178.559] GetDIBits (in: hdc=0x10107f8, hbm=0x7d0511a2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20c308, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20c308) returned 1
	[0178.559] GdipCreateFromHDC (hdc=0x27011294, graphics=0x20c9f0) returned 0x0
	[0178.559] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0178.560] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0178.560] GdipCreateMatrix (matrix=0x20cbb0) returned 0x0
	[0178.560] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0178.560] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cc10) returned 0x0
	[0178.560] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0178.561] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0178.561] GdipCreateRegion (region=0x20cbb0) returned 0x0
	[0178.561] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0178.561] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cbe0) returned 0x0
	[0178.561] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20ccb0) returned 0x0
	[0178.562] GdipCreateRegion (region=0x20c6a0) returned 0x0
	[0178.562] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0178.562] GdipCreateMatrix (matrix=0x20c6a0) returned 0x0
	[0178.562] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0178.562] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c700) returned 0x0
	[0178.563] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0178.563] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0178.563] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0178.563] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0178.563] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20c750) returned 0x0
	[0178.564] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20c710) returned 0x0
	[0178.564] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20c710) returned 0x0
	[0178.564] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0178.564] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c780) returned 0x0
	[0178.564] OffsetViewportOrgEx (in: hdc=0x27011294, x=0, y=0, lppt=0x276e7a0 | out: lppt=0x276e7a0) returned 1
	[0178.565] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x27011294) returned 0x0
	[0178.565] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb5f0dbd) returned 0x0
	[0178.566] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0178.566] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0178.579] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cb80) returned 0x0
	[0178.580] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x27011294) returned 0x0
	[0178.580] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0180.491] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0180.491] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0180.491] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0180.491] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0180.491] GdipCreateFromHDC (hdc=0xd0112c4, graphics=0x20d7e0) returned 0x0
	[0180.492] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0180.492] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0180.492] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0180.492] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0180.492] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0180.492] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.493] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0180.493] GdipCreateRegion (region=0x20d910) returned 0x0
	[0180.493] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.493] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0180.493] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0180.493] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb5d0dbd) returned 0x0
	[0180.493] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.494] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0180.494] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0112c4) returned 0x0
	[0180.494] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0180.494] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.494] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.495] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.495] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0180.495] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0180.495] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0180.495] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0180.495] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0180.495] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.496] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0180.496] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0180.496] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0180.496] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0180.496] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.496] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.497] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.497] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0180.497] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.497] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0180.497] GdipCreateRegion (region=0x20d120) returned 0x0
	[0180.498] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.498] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0180.498] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0180.498] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0180.498] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0180.498] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0180.499] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0180.499] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0180.499] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0180.499] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0180.499] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.500] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0180.500] OffsetViewportOrgEx (in: hdc=0xd0112c4, x=0, y=0, lppt=0x2770638 | out: lppt=0x2770638) returned 1
	[0180.500] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0112c4) returned 0x0
	[0180.500] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0180.500] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.501] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.501] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.501] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0180.501] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0180.501] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0180.501] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.502] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0180.502] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0180.502] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0180.502] GdipCreateRegion (region=0x20d070) returned 0x0
	[0180.502] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.502] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0180.502] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0180.503] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0180.503] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.503] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.503] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0180.503] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0180.504] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0180.504] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0180.504] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.504] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0180.504] OffsetViewportOrgEx (in: hdc=0xd0112c4, x=0, y=0, lppt=0x2770bd8 | out: lppt=0x2770bd8) returned 1
	[0180.504] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.505] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.505] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.505] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.505] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.505] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.505] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.506] GetROP2 (hdc=0xd0112c4) returned 13
	[0180.506] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0112c4) returned 0x0
	[0180.506] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0180.506] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd0112c4) returned 0x0
	[0180.506] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0180.506] GdipCreateFromHDC (hdc=0xf0112c4, graphics=0x20d7e0) returned 0x0
	[0180.507] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0180.507] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0180.507] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0180.507] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0180.507] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0180.508] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0180.508] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0180.508] GdipCreateRegion (region=0x20d910) returned 0x0
	[0180.508] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.508] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0180.508] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0180.508] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb5a0dbd) returned 0x0
	[0180.509] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.509] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0180.509] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0112c4) returned 0x0
	[0180.509] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0180.509] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.510] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.510] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.510] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0180.510] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0180.510] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0180.510] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0180.510] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0180.511] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.511] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0180.511] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0180.511] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0180.511] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0180.511] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.512] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.512] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.512] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0180.512] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.512] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0180.512] GdipCreateRegion (region=0x20d120) returned 0x0
	[0180.513] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.513] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0180.513] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0180.513] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0180.513] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.513] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.514] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0180.514] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0180.514] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0180.514] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0180.514] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.514] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0180.515] OffsetViewportOrgEx (in: hdc=0xf0112c4, x=0, y=0, lppt=0x2771a38 | out: lppt=0x2771a38) returned 1
	[0180.515] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0112c4) returned 0x0
	[0180.515] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0180.515] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.515] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.516] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.516] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0180.516] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0180.516] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0180.516] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.516] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0180.517] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0180.517] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0180.517] GdipCreateRegion (region=0x20d070) returned 0x0
	[0180.517] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.517] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0180.517] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0180.518] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0180.518] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0180.518] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0180.518] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0180.518] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0180.518] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0180.519] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0180.519] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.519] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0180.520] OffsetViewportOrgEx (in: hdc=0xf0112c4, x=0, y=0, lppt=0x2771fd8 | out: lppt=0x2771fd8) returned 1
	[0180.520] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.520] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.520] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.520] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.520] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.521] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.521] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.521] GetROP2 (hdc=0xf0112c4) returned 13
	[0180.521] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0112c4) returned 0x0
	[0180.521] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0180.521] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0112c4) returned 0x0
	[0180.522] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0180.739] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0180.739] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0180.740] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0180.740] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0180.740] UpdateWindow (hWnd=0x401b4) 
	[0180.740] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0180.740] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0180.740] GdipCreateFromHDC (hdc=0xc0112c5, graphics=0x20cfa0) returned 0x0
	[0180.740] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0180.740] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0180.741] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0180.741] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0180.741] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0180.741] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.741] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0180.741] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0180.742] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.742] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0180.742] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0180.742] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb570dbd) returned 0x0
	[0180.742] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.743] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0180.743] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc0112c5) returned 0x0
	[0180.743] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0180.743] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.743] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.743] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.744] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0180.744] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0180.744] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0180.744] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0180.744] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0180.744] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.745] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0180.745] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0180.745] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0180.745] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0180.745] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.745] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.746] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.746] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0180.746] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.746] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0180.746] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0180.746] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.747] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0180.747] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0180.747] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0180.747] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0180.747] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0180.747] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0180.748] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0180.748] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0180.748] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0180.748] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.748] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0180.748] OffsetViewportOrgEx (in: hdc=0xc0112c5, x=0, y=0, lppt=0x2772f80 | out: lppt=0x2772f80) returned 1
	[0180.749] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc0112c5) returned 0x0
	[0180.749] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0180.749] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.749] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0180.749] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0180.749] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0180.749] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0180.750] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0180.750] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0180.750] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0180.750] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0180.750] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0180.751] GdipCreateRegion (region=0x20c830) returned 0x0
	[0180.751] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0180.751] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0180.751] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0180.751] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0180.751] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.752] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0180.752] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0180.752] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0180.752] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0180.752] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0180.752] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0180.753] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0180.753] OffsetViewportOrgEx (in: hdc=0xc0112c5, x=0, y=0, lppt=0x2773520 | out: lppt=0x2773520) returned 1
	[0180.753] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.754] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.754] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.754] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.754] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.754] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.754] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.755] GetROP2 (hdc=0xc0112c5) returned 13
	[0180.755] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc0112c5) returned 0x0
	[0180.755] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0180.755] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc0112c5) returned 0x0
	[0180.756] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0180.756] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0180.756] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0180.756] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0180.756] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0180.756] GetCapture () returned 0x401b4
	[0180.756] ReleaseCapture () 
	[0180.756] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0181.181] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0181.181] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0181.181] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0181.181] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0181.181] GdipCreateFromHDC (hdc=0x90112bc, graphics=0x20d7e0) returned 0x0
	[0181.181] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0181.181] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0181.182] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0181.182] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.182] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0181.182] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.182] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.182] GdipCreateRegion (region=0x20d910) returned 0x0
	[0181.183] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.183] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0181.183] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0181.183] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb540dbd) returned 0x0
	[0181.183] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.183] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0181.184] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90112bc) returned 0x0
	[0181.184] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0181.184] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.184] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.184] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.184] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0181.185] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0181.185] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0181.185] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0181.185] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0181.185] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.185] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0181.186] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0181.186] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0181.186] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0181.186] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.186] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.186] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.187] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0181.187] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.187] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0181.187] GdipCreateRegion (region=0x20d120) returned 0x0
	[0181.187] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.187] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0181.187] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0181.188] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0181.188] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0181.188] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0181.188] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0181.188] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0181.188] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0181.189] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0181.189] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.189] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0181.189] OffsetViewportOrgEx (in: hdc=0x90112bc, x=0, y=0, lppt=0x27745b0 | out: lppt=0x27745b0) returned 1
	[0181.189] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90112bc) returned 0x0
	[0181.189] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0181.190] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.191] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.191] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.191] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0181.191] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0181.191] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0181.191] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.192] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0181.192] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0181.192] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0181.192] GdipCreateRegion (region=0x20d070) returned 0x0
	[0181.192] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.192] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0181.193] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.193] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0181.193] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.193] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.193] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.193] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0181.193] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0181.194] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0181.194] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.194] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0181.194] OffsetViewportOrgEx (in: hdc=0x90112bc, x=0, y=0, lppt=0x2774b50 | out: lppt=0x2774b50) returned 1
	[0181.194] GetROP2 (hdc=0x90112bc) returned 13
	[0181.194] GetROP2 (hdc=0x90112bc) returned 13
	[0181.195] GetROP2 (hdc=0x90112bc) returned 13
	[0181.195] GetROP2 (hdc=0x90112bc) returned 13
	[0181.195] GetROP2 (hdc=0x90112bc) returned 13
	[0181.195] GetROP2 (hdc=0x90112bc) returned 13
	[0181.195] GetROP2 (hdc=0x90112bc) returned 13
	[0181.195] GetROP2 (hdc=0x90112bc) returned 13
	[0181.195] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90112bc) returned 0x0
	[0181.196] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0181.196] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90112bc) returned 0x0
	[0181.196] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0181.196] GdipCreateFromHDC (hdc=0xa0112bc, graphics=0x20d7e0) returned 0x0
	[0181.196] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0181.197] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0181.197] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0181.197] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0181.197] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0181.197] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0181.197] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0181.197] GdipCreateRegion (region=0x20d910) returned 0x0
	[0181.198] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.198] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0181.198] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0181.198] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb510dbd) returned 0x0
	[0181.198] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.199] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0181.199] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0112bc) returned 0x0
	[0181.199] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0181.199] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.199] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.199] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.200] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0181.200] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0181.200] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0181.200] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0181.200] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0181.200] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.201] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0181.201] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0181.201] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0181.201] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0181.201] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.201] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.202] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.202] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0181.202] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.202] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0181.202] GdipCreateRegion (region=0x20d120) returned 0x0
	[0181.202] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.203] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0181.203] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.203] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0181.203] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.203] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.203] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.204] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0181.204] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0181.204] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0181.204] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.204] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0181.204] OffsetViewportOrgEx (in: hdc=0xa0112bc, x=0, y=0, lppt=0x27759b0 | out: lppt=0x27759b0) returned 1
	[0181.205] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0112bc) returned 0x0
	[0181.205] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0181.205] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.205] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.205] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.206] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0181.206] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0181.206] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0181.206] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.206] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0181.206] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0181.207] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0181.207] GdipCreateRegion (region=0x20d070) returned 0x0
	[0181.207] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.207] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0181.207] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0181.207] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0181.208] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0181.208] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0181.208] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0181.208] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0181.208] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0181.208] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0181.209] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.209] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0181.209] OffsetViewportOrgEx (in: hdc=0xa0112bc, x=0, y=0, lppt=0x2775f50 | out: lppt=0x2775f50) returned 1
	[0181.209] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.209] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.209] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.210] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.210] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.210] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.210] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.210] GetROP2 (hdc=0xa0112bc) returned 13
	[0181.210] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0112bc) returned 0x0
	[0181.211] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0181.211] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa0112bc) returned 0x0
	[0181.211] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0181.350] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0181.350] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0181.350] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0181.350] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0181.351] UpdateWindow (hWnd=0x201d8) returned 0
	[0181.351] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0181.351] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0181.351] GdipCreateFromHDC (hdc=0x130112bc, graphics=0x20cfa0) returned 0x0
	[0181.351] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0181.351] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0181.351] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0181.352] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.352] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0181.352] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.352] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.352] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0181.352] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.352] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0181.353] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0181.353] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb4e0dbd) returned 0x0
	[0181.353] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.353] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0181.353] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130112bc) returned 0x0
	[0181.354] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0181.354] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.354] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.354] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.354] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0181.354] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0181.355] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0181.355] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0181.355] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0181.355] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.355] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0181.355] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0181.356] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0181.356] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0181.356] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.356] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.356] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.356] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0181.357] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.357] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0181.357] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0181.357] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.357] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0181.357] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0181.358] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0181.358] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0181.358] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0181.358] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0181.358] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0181.358] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0181.359] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0181.359] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.359] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0181.359] OffsetViewportOrgEx (in: hdc=0x130112bc, x=0, y=0, lppt=0x2776f80 | out: lppt=0x2776f80) returned 1
	[0181.359] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130112bc) returned 0x0
	[0181.360] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0181.360] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.360] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.360] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.360] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0181.360] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0181.361] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0181.361] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.361] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0181.361] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0181.368] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0181.368] GdipCreateRegion (region=0x20c830) returned 0x0
	[0181.368] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.368] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0181.369] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.369] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0181.369] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.369] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0181.369] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.370] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0181.370] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0181.370] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0181.370] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.370] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0181.371] OffsetViewportOrgEx (in: hdc=0x130112bc, x=0, y=0, lppt=0x2777520 | out: lppt=0x2777520) returned 1
	[0181.371] GetROP2 (hdc=0x130112bc) returned 13
	[0181.371] GetROP2 (hdc=0x130112bc) returned 13
	[0181.371] GetROP2 (hdc=0x130112bc) returned 13
	[0181.371] GetROP2 (hdc=0x130112bc) returned 13
	[0181.371] GetROP2 (hdc=0x130112bc) returned 13
	[0181.372] GetROP2 (hdc=0x130112bc) returned 13
	[0181.372] GetROP2 (hdc=0x130112bc) returned 13
	[0181.372] GetROP2 (hdc=0x130112bc) returned 13
	[0181.372] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130112bc) returned 0x0
	[0181.372] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0181.373] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130112bc) returned 0x0
	[0181.373] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0181.373] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0181.373] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0181.374] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0181.374] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2777868, Length=0x70 | out: Destination=0x1afe53a0) 
	[0181.374] ShellExecuteExW (pExecInfo=0x2777a78*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0181.463] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0181.463] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0181.464] GdipCreateFromHDC (hdc=0x1a0112bc, graphics=0x20c9d0) returned 0x0
	[0181.464] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0181.465] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0181.465] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0181.465] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0181.465] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0181.465] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0181.465] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0181.466] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0181.466] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.466] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0181.466] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0181.466] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb4b0dbd) returned 0x0
	[0181.467] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.467] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0181.467] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1a0112bc) returned 0x0
	[0181.467] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0181.468] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.468] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.468] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.468] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0181.468] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0181.469] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0181.469] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0181.469] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0181.469] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.469] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0181.470] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0181.470] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0181.470] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0181.470] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.470] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.471] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.471] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0181.471] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.472] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0181.472] GdipCreateRegion (region=0x20c310) returned 0x0
	[0181.472] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.472] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0181.472] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.473] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0181.473] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0181.473] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0181.473] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.473] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0181.474] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0181.474] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0181.474] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.474] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0181.474] OffsetViewportOrgEx (in: hdc=0x1a0112bc, x=0, y=0, lppt=0x2778758 | out: lppt=0x2778758) returned 1
	[0181.474] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1a0112bc) returned 0x0
	[0181.475] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0181.475] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.475] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.475] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.475] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0181.476] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0181.476] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0181.476] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.476] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0181.476] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0181.477] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0181.477] GdipCreateRegion (region=0x20c260) returned 0x0
	[0181.477] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.477] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0181.477] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0181.477] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0181.478] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0181.478] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0181.478] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0181.478] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0181.478] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0181.478] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0181.479] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.479] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0181.479] OffsetViewportOrgEx (in: hdc=0x1a0112bc, x=0, y=0, lppt=0x2778cf8 | out: lppt=0x2778cf8) returned 1
	[0181.479] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.479] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.480] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.480] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.480] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.480] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.480] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.480] GetROP2 (hdc=0x1a0112bc) returned 13
	[0181.481] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1a0112bc) returned 0x0
	[0181.481] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0181.481] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1a0112bc) returned 0x0
	[0181.481] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0181.481] GdipCreateFromHDC (hdc=0x1c0112bc, graphics=0x20c9d0) returned 0x0
	[0181.482] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0181.482] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0181.482] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0181.482] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.483] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0181.483] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0181.483] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.483] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0181.483] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.483] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0181.483] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0181.484] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb480dbd) returned 0x0
	[0181.484] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.484] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0181.484] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0112bc) returned 0x0
	[0181.484] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0181.484] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.485] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.485] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.485] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0181.485] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0181.485] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0181.486] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0181.486] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0181.486] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.486] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0181.502] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0181.502] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0181.502] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0181.503] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.503] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.503] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.503] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0181.503] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.503] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0181.504] GdipCreateRegion (region=0x20c310) returned 0x0
	[0181.504] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.504] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0181.504] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0181.504] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0181.504] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0181.505] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0181.505] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0181.505] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0181.505] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0181.505] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0181.505] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.506] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0181.506] OffsetViewportOrgEx (in: hdc=0x1c0112bc, x=0, y=0, lppt=0x2779b80 | out: lppt=0x2779b80) returned 1
	[0181.506] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0112bc) returned 0x0
	[0181.506] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0181.506] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.507] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0181.507] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0181.507] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0181.507] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0181.507] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0181.507] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0181.508] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0181.508] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0181.508] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0181.508] GdipCreateRegion (region=0x20c260) returned 0x0
	[0181.508] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0181.508] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0181.509] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0181.509] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0181.509] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0181.509] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0181.509] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0181.509] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0181.509] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0181.510] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0181.510] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0181.510] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0181.510] OffsetViewportOrgEx (in: hdc=0x1c0112bc, x=0, y=0, lppt=0x277a120 | out: lppt=0x277a120) returned 1
	[0181.510] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.511] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.511] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.511] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.511] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.511] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.511] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.512] GetROP2 (hdc=0x1c0112bc) returned 13
	[0181.512] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0112bc) returned 0x0
	[0181.512] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0181.512] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1c0112bc) returned 0x0
	[0181.512] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0183.528] GdipCreateFromHDC (hdc=0x70113bd, graphics=0x20d7e0) returned 0x0
	[0183.529] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0183.529] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0183.529] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0183.529] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0183.529] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0183.529] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0183.529] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0183.530] GdipCreateRegion (region=0x20d910) returned 0x0
	[0183.530] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0183.530] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0183.530] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0183.530] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb450dbd) returned 0x0
	[0183.531] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0183.531] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0183.531] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70113bd) returned 0x0
	[0183.531] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0183.531] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0183.531] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0183.532] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0183.532] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0183.532] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0183.532] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0183.532] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0183.532] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0183.533] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0183.533] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0183.533] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0183.533] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0183.533] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0183.533] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0183.534] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0183.534] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0183.534] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0183.534] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0183.534] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0183.534] GdipCreateRegion (region=0x20d120) returned 0x0
	[0183.535] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0183.535] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0183.535] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0183.535] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0183.535] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0183.535] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0183.536] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0183.536] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0183.536] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0183.536] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0183.536] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0183.536] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0183.537] OffsetViewportOrgEx (in: hdc=0x70113bd, x=0, y=0, lppt=0x277c338 | out: lppt=0x277c338) returned 1
	[0183.537] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70113bd) returned 0x0
	[0183.537] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0183.537] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0183.537] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0183.537] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0183.538] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0183.538] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0183.538] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0183.538] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0183.538] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0183.539] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0183.539] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0183.539] GdipCreateRegion (region=0x20d070) returned 0x0
	[0183.539] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0183.539] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0183.539] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0183.539] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0183.540] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0183.540] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0183.540] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0183.540] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0183.540] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0183.540] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0183.541] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0183.541] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0183.541] OffsetViewportOrgEx (in: hdc=0x70113bd, x=0, y=0, lppt=0x277c8d8 | out: lppt=0x277c8d8) returned 1
	[0183.541] GetROP2 (hdc=0x70113bd) returned 13
	[0183.541] GetROP2 (hdc=0x70113bd) returned 13
	[0183.541] GetROP2 (hdc=0x70113bd) returned 13
	[0183.542] GetROP2 (hdc=0x70113bd) returned 13
	[0183.542] GetROP2 (hdc=0x70113bd) returned 13
	[0183.542] GetROP2 (hdc=0x70113bd) returned 13
	[0183.542] GetROP2 (hdc=0x70113bd) returned 13
	[0183.542] GetROP2 (hdc=0x70113bd) returned 13
	[0183.542] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70113bd) returned 0x0
	[0183.542] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0183.543] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70113bd) returned 0x0
	[0183.543] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0184.401] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0184.401] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0184.401] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0184.401] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0184.402] GdipCreateFromHDC (hdc=0x2f01117c, graphics=0x20d7e0) returned 0x0
	[0184.402] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0184.402] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0184.402] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0184.402] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0184.403] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0184.403] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0184.403] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0184.403] GdipCreateRegion (region=0x20d910) returned 0x0
	[0184.403] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.404] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0184.404] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0184.404] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb420dbd) returned 0x0
	[0184.404] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.404] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0184.405] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f01117c) returned 0x0
	[0184.405] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0184.405] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.405] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.406] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.406] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0184.406] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0184.406] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0184.406] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0184.406] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0184.406] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.407] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0184.407] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0184.407] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0184.407] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0184.407] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.407] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.408] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.408] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0184.408] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.408] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0184.408] GdipCreateRegion (region=0x20d120) returned 0x0
	[0184.408] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.409] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0184.409] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0184.409] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0184.409] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0184.409] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0184.409] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0184.409] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0184.410] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0184.410] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0184.410] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.410] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0184.410] OffsetViewportOrgEx (in: hdc=0x2f01117c, x=0, y=0, lppt=0x277d7d0 | out: lppt=0x277d7d0) returned 1
	[0184.410] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f01117c) returned 0x0
	[0184.411] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0184.411] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.411] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.411] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.411] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0184.411] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0184.412] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0184.412] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.412] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0184.412] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0184.412] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0184.412] GdipCreateRegion (region=0x20d070) returned 0x0
	[0184.413] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.413] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0184.413] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0184.413] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0184.413] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0184.413] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0184.413] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0184.414] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0184.414] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0184.414] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0184.414] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.414] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0184.414] OffsetViewportOrgEx (in: hdc=0x2f01117c, x=0, y=0, lppt=0x277dd70 | out: lppt=0x277dd70) returned 1
	[0184.415] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.415] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.415] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.415] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.415] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.415] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.416] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.416] GetROP2 (hdc=0x2f01117c) returned 13
	[0184.416] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f01117c) returned 0x0
	[0184.416] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0184.416] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f01117c) returned 0x0
	[0184.416] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0184.670] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0184.670] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0184.670] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0184.670] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0184.670] UpdateWindow (hWnd=0x201d8) 
	[0184.670] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0184.670] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0184.670] GdipCreateFromHDC (hdc=0x7d01128b, graphics=0x20cfa0) returned 0x0
	[0184.671] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0184.671] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0184.671] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0184.671] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0184.671] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0184.671] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0184.672] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0184.672] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0184.672] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.672] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0184.672] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0184.672] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb3f0dbd) returned 0x0
	[0184.673] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.673] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0184.673] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d01128b) returned 0x0
	[0184.673] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0184.673] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.673] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.674] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.674] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0184.674] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0184.674] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0184.674] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0184.674] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0184.674] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.675] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0184.675] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0184.675] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0184.675] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0184.675] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.675] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.676] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.676] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0184.676] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.676] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0184.676] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0184.676] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.677] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0184.677] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0184.677] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0184.677] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0184.677] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0184.677] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0184.678] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0184.678] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0184.678] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0184.678] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.678] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0184.678] OffsetViewportOrgEx (in: hdc=0x7d01128b, x=0, y=0, lppt=0x277ed68 | out: lppt=0x277ed68) returned 1
	[0184.679] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d01128b) returned 0x0
	[0184.679] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0184.679] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.679] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.679] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.679] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0184.680] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0184.680] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0184.680] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.680] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0184.680] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0184.680] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0184.681] GdipCreateRegion (region=0x20c830) returned 0x0
	[0184.681] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.681] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0184.681] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0184.681] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0184.681] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0184.682] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0184.682] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0184.682] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0184.682] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0184.682] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0184.682] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.682] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0184.683] OffsetViewportOrgEx (in: hdc=0x7d01128b, x=0, y=0, lppt=0x277f308 | out: lppt=0x277f308) returned 1
	[0184.683] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.683] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.683] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.683] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.683] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.684] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.684] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.684] GetROP2 (hdc=0x7d01128b) returned 13
	[0184.684] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d01128b) returned 0x0
	[0184.686] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0184.686] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7d01128b) returned 0x0
	[0184.686] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0184.686] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0184.686] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0184.687] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0184.687] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x277f650, Length=0x70 | out: Destination=0x1afe53a0) 
	[0184.687] ShellExecuteExW (pExecInfo=0x277f860*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0184.818] GdipCreateFromHDC (hdc=0x130113d0, graphics=0x20d7e0) returned 0x0
	[0184.832] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0184.833] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0184.833] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0184.833] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0184.833] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0184.833] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0184.833] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0184.834] GdipCreateRegion (region=0x20d910) returned 0x0
	[0184.834] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.834] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0184.834] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0184.834] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb3c0dbd) returned 0x0
	[0184.834] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.835] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0184.835] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130113d0) returned 0x0
	[0184.835] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0184.835] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.835] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.835] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.836] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0184.836] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0184.836] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0184.836] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0184.836] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0184.836] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.837] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0184.837] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0184.837] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0184.837] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0184.837] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.837] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.838] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.838] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0184.838] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.838] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0184.838] GdipCreateRegion (region=0x20d120) returned 0x0
	[0184.838] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.839] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0184.839] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0184.839] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0184.839] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0184.839] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0184.839] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0184.839] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0184.840] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0184.840] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0184.840] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.840] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0184.841] OffsetViewportOrgEx (in: hdc=0x130113d0, x=0, y=0, lppt=0x2780590 | out: lppt=0x2780590) returned 1
	[0184.841] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130113d0) returned 0x0
	[0184.841] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0184.841] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.842] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.842] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.842] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0184.842] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0184.842] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0184.842] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.843] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0184.843] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0184.843] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0184.843] GdipCreateRegion (region=0x20d070) returned 0x0
	[0184.843] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.843] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0184.844] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0184.844] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0184.844] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0184.844] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0184.844] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0184.844] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0184.844] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0184.845] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0184.845] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.845] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0184.845] OffsetViewportOrgEx (in: hdc=0x130113d0, x=0, y=0, lppt=0x2780b30 | out: lppt=0x2780b30) returned 1
	[0184.845] GetROP2 (hdc=0x130113d0) returned 13
	[0184.845] GetROP2 (hdc=0x130113d0) returned 13
	[0184.846] GetROP2 (hdc=0x130113d0) returned 13
	[0184.846] GetROP2 (hdc=0x130113d0) returned 13
	[0184.846] GetROP2 (hdc=0x130113d0) returned 13
	[0184.846] GetROP2 (hdc=0x130113d0) returned 13
	[0184.846] GetROP2 (hdc=0x130113d0) returned 13
	[0184.846] GetROP2 (hdc=0x130113d0) returned 13
	[0184.847] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130113d0) returned 0x0
	[0184.847] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0184.847] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130113d0) returned 0x0
	[0184.847] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0184.922] GdipCreateFromHDC (hdc=0x80113bf, graphics=0x20d7e0) returned 0x0
	[0184.922] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0184.922] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0184.923] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0184.923] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0184.923] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0184.923] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0184.923] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0184.923] GdipCreateRegion (region=0x20d910) returned 0x0
	[0184.923] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.924] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0184.924] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0184.924] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb390dbd) returned 0x0
	[0184.924] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.924] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0184.925] SaveDC (hdc=0x80113bf) returned 1
	[0184.925] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80113bf) returned 0x0
	[0184.925] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0184.925] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.926] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.926] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.926] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0184.926] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0184.926] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0184.926] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0184.927] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0184.927] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.927] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0184.927] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0184.927] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0184.927] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0184.928] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.928] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.928] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.928] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0184.928] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.928] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0184.929] GdipCreateRegion (region=0x20d120) returned 0x0
	[0184.929] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.929] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0184.929] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0184.929] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0184.929] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0184.930] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0184.930] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0184.930] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0184.930] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0184.930] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0184.930] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.931] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0184.931] OffsetViewportOrgEx (in: hdc=0x80113bf, x=0, y=0, lppt=0x2781a38 | out: lppt=0x2781a38) returned 1
	[0184.931] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80113bf) returned 0x0
	[0184.931] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0184.931] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.931] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0184.932] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0184.932] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0184.932] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0184.932] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0184.932] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0184.933] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0184.933] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0184.933] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0184.933] GdipCreateRegion (region=0x20d070) returned 0x0
	[0184.933] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0184.933] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0184.934] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0184.934] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0184.934] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0184.934] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0184.934] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0184.934] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0184.935] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0184.935] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0184.935] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0184.935] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0184.936] OffsetViewportOrgEx (in: hdc=0x80113bf, x=0, y=0, lppt=0x2781fd8 | out: lppt=0x2781fd8) returned 1
	[0184.936] GetROP2 (hdc=0x80113bf) returned 13
	[0184.936] GetROP2 (hdc=0x80113bf) returned 13
	[0184.936] GetROP2 (hdc=0x80113bf) returned 13
	[0184.937] GetROP2 (hdc=0x80113bf) returned 13
	[0184.937] GetROP2 (hdc=0x80113bf) returned 13
	[0184.937] GetROP2 (hdc=0x80113bf) returned 13
	[0184.937] GetROP2 (hdc=0x80113bf) returned 13
	[0184.937] GetROP2 (hdc=0x80113bf) returned 13
	[0184.937] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80113bf) returned 0x0
	[0184.938] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0184.938] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80113bf) returned 0x0
	[0184.938] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0186.664] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d770) returned 0x0
	[0186.664] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0186.665] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0186.665] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0186.665] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d6c0) returned 0x0
	[0186.665] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0186.665] GdipCreateRegion (region=0x20d660) returned 0x0
	[0186.665] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0186.665] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d690) returned 0x0
	[0186.666] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0186.666] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d760) returned 0x0
	[0186.666] GdipCreateRegion (region=0x20d630) returned 0x0
	[0186.666] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0186.666] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0186.667] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0186.667] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d690) returned 0x0
	[0186.667] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0186.667] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0186.667] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6e0) returned 0x0
	[0186.667] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0186.668] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d710) returned 0x0
	[0186.668] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x2782740 | out: lppt=0x2782740) returned 1
	[0186.668] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x10107f8) returned 0x0
	[0186.668] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0186.669] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0186.669] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0186.669] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0186.669] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0186.670] GetDIBits (in: hdc=0x4010280, hbm=0x3205141b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0186.670] GetDIBits (in: hdc=0x4010280, hbm=0x3205141b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0186.670] GdipCreateFromHDC (hdc=0x53011413, graphics=0x20d750) returned 0x0
	[0186.670] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0186.671] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0186.671] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0186.671] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0186.671] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0186.671] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0186.671] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0186.672] GdipCreateRegion (region=0x20d910) returned 0x0
	[0186.672] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0186.672] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0186.672] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0186.672] GdipCreateRegion (region=0x20d400) returned 0x0
	[0186.672] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0186.673] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0186.673] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0186.673] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0186.673] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0186.673] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0186.673] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0186.674] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0186.674] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0186.674] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0186.674] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0186.674] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0186.674] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0186.675] OffsetViewportOrgEx (in: hdc=0x53011413, x=0, y=0, lppt=0x2783fa8 | out: lppt=0x2783fa8) returned 1
	[0186.675] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x53011413) returned 0x0
	[0186.675] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb340dbd) returned 0x0
	[0186.675] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0186.675] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0186.675] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x53011413) returned 0x0
	[0186.676] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0186.676] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0186.676] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0186.676] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0186.676] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0186.676] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0186.677] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0186.677] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0186.677] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0186.677] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0186.677] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0186.678] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x53011413) returned 0x0
	[0186.678] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0186.678] GdipCreateFromHDC (hdc=0x220113cd, graphics=0x20d7e0) returned 0x0
	[0186.678] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0186.678] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0186.679] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0186.679] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0186.679] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0186.679] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0186.679] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0186.679] GdipCreateRegion (region=0x20d910) returned 0x0
	[0186.680] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0186.680] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0186.680] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0186.680] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb320dbd) returned 0x0
	[0186.680] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0186.680] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0186.681] GdipReleaseDC (graphics=0x1b929550, hdc=0x220113cd) returned 0x0
	[0186.681] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0186.681] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0186.681] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0186.681] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0186.682] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0186.682] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0186.682] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0186.682] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0186.683] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0186.683] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0186.683] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0186.683] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0186.683] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0186.683] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0186.684] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0186.684] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0186.684] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0186.684] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0186.684] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0186.684] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0186.685] GdipCreateRegion (region=0x20d120) returned 0x0
	[0186.685] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0186.685] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0186.685] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0186.685] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0186.685] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0186.686] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0186.686] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0186.686] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0186.686] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0186.686] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0186.686] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0186.687] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0186.687] OffsetViewportOrgEx (in: hdc=0x220113cd, x=0, y=0, lppt=0x27850b0 | out: lppt=0x27850b0) returned 1
	[0186.687] GdipReleaseDC (graphics=0x1b929550, hdc=0x220113cd) returned 0x0
	[0186.687] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0186.687] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0186.687] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0186.688] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0186.688] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0186.688] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0186.688] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0186.688] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0186.688] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0186.689] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0186.689] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0186.689] GdipCreateRegion (region=0x20d070) returned 0x0
	[0186.689] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0186.689] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0186.689] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0186.690] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0186.690] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0186.690] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0186.690] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0186.690] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0186.690] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0186.691] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0186.691] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0186.691] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0186.691] OffsetViewportOrgEx (in: hdc=0x220113cd, x=0, y=0, lppt=0x2785650 | out: lppt=0x2785650) returned 1
	[0186.691] GetROP2 (hdc=0x220113cd) returned 13
	[0186.691] GetROP2 (hdc=0x220113cd) returned 13
	[0186.692] GetROP2 (hdc=0x220113cd) returned 13
	[0186.692] GetROP2 (hdc=0x220113cd) returned 13
	[0186.692] GetROP2 (hdc=0x220113cd) returned 13
	[0186.692] GetROP2 (hdc=0x220113cd) returned 13
	[0186.692] GetROP2 (hdc=0x220113cd) returned 13
	[0186.692] GetROP2 (hdc=0x220113cd) returned 13
	[0186.692] GdipReleaseDC (graphics=0x1b929550, hdc=0x220113cd) returned 0x0
	[0186.693] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0186.693] GdipReleaseDC (graphics=0x1b929550, hdc=0x220113cd) returned 0x0
	[0186.693] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0186.693] GetDIBits (in: hdc=0x70107fc, hbm=0x2905141a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0186.694] GetDIBits (in: hdc=0x70107fc, hbm=0x2905141a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0186.694] GdipCreateFromHDC (hdc=0x3601141b, graphics=0x20d800) returned 0x0
	[0186.694] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0186.694] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0186.694] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0186.694] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0186.695] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0186.695] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0186.695] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0186.695] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0186.695] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0186.695] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0186.695] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0186.696] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0186.696] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0186.696] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0186.696] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0186.696] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d510) returned 0x0
	[0186.696] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0186.697] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0186.697] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0186.697] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0186.697] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0186.697] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0186.698] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0186.698] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0186.698] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0186.698] OffsetViewportOrgEx (in: hdc=0x3601141b, x=0, y=0, lppt=0x2786f18 | out: lppt=0x2786f18) returned 1
	[0186.699] GdipReleaseDC (graphics=0x1b929550, hdc=0x3601141b) returned 0x0
	[0186.699] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb2f0dbd) returned 0x0
	[0186.699] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0186.699] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0186.706] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0186.707] GdipReleaseDC (graphics=0x1b929550, hdc=0x3601141b) returned 0x0
	[0186.707] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0187.202] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0187.202] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0187.202] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0187.202] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0187.203] GdipCreateFromHDC (hdc=0x66011431, graphics=0x20d7e0) returned 0x0
	[0187.203] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0187.203] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0187.203] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0187.204] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.204] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0187.204] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.204] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.204] GdipCreateRegion (region=0x20d910) returned 0x0
	[0187.204] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.204] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0187.205] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0187.205] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb2d0dbd) returned 0x0
	[0187.205] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.205] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0187.205] GdipReleaseDC (graphics=0x1b929550, hdc=0x66011431) returned 0x0
	[0187.206] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0187.206] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.206] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.206] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.206] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0187.206] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0187.206] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0187.207] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0187.207] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0187.207] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.207] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0187.207] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0187.208] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0187.208] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0187.208] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.208] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.208] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.208] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0187.209] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.209] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0187.209] GdipCreateRegion (region=0x20d120) returned 0x0
	[0187.209] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.209] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0187.209] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0187.210] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0187.210] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0187.210] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0187.210] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0187.210] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0187.210] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0187.211] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0187.211] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.211] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0187.211] OffsetViewportOrgEx (in: hdc=0x66011431, x=0, y=0, lppt=0x2788318 | out: lppt=0x2788318) returned 1
	[0187.212] GdipReleaseDC (graphics=0x1b929550, hdc=0x66011431) returned 0x0
	[0187.212] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0187.212] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.212] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.212] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.212] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0187.213] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0187.213] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0187.213] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.213] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0187.213] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0187.214] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0187.214] GdipCreateRegion (region=0x20d070) returned 0x0
	[0187.214] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.214] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0187.214] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.214] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0187.215] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.215] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.215] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.215] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0187.215] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0187.215] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0187.216] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.216] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0187.216] OffsetViewportOrgEx (in: hdc=0x66011431, x=0, y=0, lppt=0x27888b8 | out: lppt=0x27888b8) returned 1
	[0187.216] GetROP2 (hdc=0x66011431) returned 13
	[0187.216] GetROP2 (hdc=0x66011431) returned 13
	[0187.216] GetROP2 (hdc=0x66011431) returned 13
	[0187.217] GetROP2 (hdc=0x66011431) returned 13
	[0187.217] GetROP2 (hdc=0x66011431) returned 13
	[0187.217] GetROP2 (hdc=0x66011431) returned 13
	[0187.217] GetROP2 (hdc=0x66011431) returned 13
	[0187.217] GetROP2 (hdc=0x66011431) returned 13
	[0187.217] GdipReleaseDC (graphics=0x1b929550, hdc=0x66011431) returned 0x0
	[0187.218] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0187.218] GdipReleaseDC (graphics=0x1b929550, hdc=0x66011431) returned 0x0
	[0187.218] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0187.218] GdipCreateFromHDC (hdc=0x68011431, graphics=0x20d7e0) returned 0x0
	[0187.218] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0187.219] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0187.219] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0187.219] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0187.219] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0187.219] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0187.219] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0187.220] GdipCreateRegion (region=0x20d910) returned 0x0
	[0187.220] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.220] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0187.220] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0187.220] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb2a0dbd) returned 0x0
	[0187.220] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.221] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0187.221] GdipReleaseDC (graphics=0x1b929550, hdc=0x68011431) returned 0x0
	[0187.221] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0187.221] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.221] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.221] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.222] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0187.222] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0187.222] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0187.222] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0187.222] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0187.222] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.223] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0187.223] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0187.223] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0187.223] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0187.223] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.223] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.224] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.224] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0187.224] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.224] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0187.224] GdipCreateRegion (region=0x20d120) returned 0x0
	[0187.225] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.225] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0187.225] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.225] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0187.225] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.225] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.226] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.226] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0187.226] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0187.226] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0187.226] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.226] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0187.227] OffsetViewportOrgEx (in: hdc=0x68011431, x=0, y=0, lppt=0x2789718 | out: lppt=0x2789718) returned 1
	[0187.227] GdipReleaseDC (graphics=0x1b929550, hdc=0x68011431) returned 0x0
	[0187.227] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0187.228] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.228] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.228] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.228] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0187.228] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0187.228] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0187.229] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.229] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0187.229] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0187.229] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0187.229] GdipCreateRegion (region=0x20d070) returned 0x0
	[0187.230] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.230] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0187.230] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0187.230] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0187.230] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0187.231] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0187.231] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0187.231] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0187.231] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0187.231] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0187.231] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.232] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0187.232] OffsetViewportOrgEx (in: hdc=0x68011431, x=0, y=0, lppt=0x2789cb8 | out: lppt=0x2789cb8) returned 1
	[0187.232] GetROP2 (hdc=0x68011431) returned 13
	[0187.232] GetROP2 (hdc=0x68011431) returned 13
	[0187.232] GetROP2 (hdc=0x68011431) returned 13
	[0187.232] GetROP2 (hdc=0x68011431) returned 13
	[0187.233] GetROP2 (hdc=0x68011431) returned 13
	[0187.233] GetROP2 (hdc=0x68011431) returned 13
	[0187.233] GetROP2 (hdc=0x68011431) returned 13
	[0187.233] GetROP2 (hdc=0x68011431) returned 13
	[0187.233] GdipReleaseDC (graphics=0x1b929550, hdc=0x68011431) returned 0x0
	[0187.234] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0187.234] GdipReleaseDC (graphics=0x1b929550, hdc=0x68011431) returned 0x0
	[0187.234] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0187.448] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0187.448] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0187.448] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0187.448] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0187.448] UpdateWindow (hWnd=0x201d8) 
	[0187.448] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0187.448] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0187.449] GdipCreateFromHDC (hdc=0x18011434, graphics=0x20cfa0) returned 0x0
	[0187.449] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0187.449] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0187.449] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0187.449] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.449] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0187.450] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.450] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.450] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0187.450] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.450] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0187.450] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0187.451] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb270dbd) returned 0x0
	[0187.451] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.451] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0187.451] GdipReleaseDC (graphics=0x1b929550, hdc=0x18011434) returned 0x0
	[0187.451] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0187.451] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.452] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.452] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.452] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0187.452] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0187.452] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0187.452] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0187.452] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0187.453] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.453] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0187.453] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0187.453] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0187.453] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0187.453] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.454] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.454] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.454] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0187.454] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.454] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0187.454] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0187.455] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.455] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0187.455] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0187.455] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0187.455] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0187.455] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0187.456] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0187.456] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0187.456] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0187.456] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0187.456] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.456] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0187.457] OffsetViewportOrgEx (in: hdc=0x18011434, x=0, y=0, lppt=0x278ad48 | out: lppt=0x278ad48) returned 1
	[0187.457] GdipReleaseDC (graphics=0x1b929550, hdc=0x18011434) returned 0x0
	[0187.457] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0187.457] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.457] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.458] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.458] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0187.458] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0187.458] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0187.458] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.458] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0187.459] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0187.459] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0187.459] GdipCreateRegion (region=0x20c830) returned 0x0
	[0187.459] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.459] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0187.459] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.460] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0187.460] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.460] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0187.460] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.460] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0187.460] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0187.461] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0187.461] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.461] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0187.466] OffsetViewportOrgEx (in: hdc=0x18011434, x=0, y=0, lppt=0x278b2e8 | out: lppt=0x278b2e8) returned 1
	[0187.466] GetROP2 (hdc=0x18011434) returned 13
	[0187.466] GetROP2 (hdc=0x18011434) returned 13
	[0187.467] GetROP2 (hdc=0x18011434) returned 13
	[0187.467] GetROP2 (hdc=0x18011434) returned 13
	[0187.467] GetROP2 (hdc=0x18011434) returned 13
	[0187.467] GetROP2 (hdc=0x18011434) returned 13
	[0187.467] GetROP2 (hdc=0x18011434) returned 13
	[0187.467] GetROP2 (hdc=0x18011434) returned 13
	[0187.468] GdipReleaseDC (graphics=0x1b929550, hdc=0x18011434) returned 0x0
	[0187.468] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0187.468] GdipReleaseDC (graphics=0x1b929550, hdc=0x18011434) returned 0x0
	[0187.468] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0187.468] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0187.468] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0187.469] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0187.469] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x278b630, Length=0x70 | out: Destination=0x1afe53a0) 
	[0187.469] ShellExecuteExW (pExecInfo=0x278b840*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0187.504] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0187.504] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0187.505] GdipCreateFromHDC (hdc=0x22011434, graphics=0x20c9d0) returned 0x0
	[0187.505] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0187.505] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0187.505] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0187.506] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0187.506] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0187.506] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0187.506] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0187.506] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0187.506] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.507] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0187.507] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0187.507] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb240dbd) returned 0x0
	[0187.507] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.507] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0187.507] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011434) returned 0x0
	[0187.508] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0187.508] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.508] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.508] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.508] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0187.509] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0187.509] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0187.509] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0187.509] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0187.509] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.509] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0187.510] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0187.510] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0187.510] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0187.510] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.510] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.510] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.510] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0187.511] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.511] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0187.511] GdipCreateRegion (region=0x20c310) returned 0x0
	[0187.511] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.511] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0187.511] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.512] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0187.512] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0187.512] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0187.512] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.512] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0187.512] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0187.513] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0187.513] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.513] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0187.513] OffsetViewportOrgEx (in: hdc=0x22011434, x=0, y=0, lppt=0x278c520 | out: lppt=0x278c520) returned 1
	[0187.513] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011434) returned 0x0
	[0187.513] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0187.514] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.514] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.514] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.514] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0187.514] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0187.514] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0187.515] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.515] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0187.515] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0187.515] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0187.515] GdipCreateRegion (region=0x20c260) returned 0x0
	[0187.515] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.516] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0187.516] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0187.516] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0187.516] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0187.516] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0187.516] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0187.516] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0187.517] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0187.517] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0187.517] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.517] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0187.517] OffsetViewportOrgEx (in: hdc=0x22011434, x=0, y=0, lppt=0x278cac0 | out: lppt=0x278cac0) returned 1
	[0187.517] GetROP2 (hdc=0x22011434) returned 13
	[0187.518] GetROP2 (hdc=0x22011434) returned 13
	[0187.518] GetROP2 (hdc=0x22011434) returned 13
	[0187.518] GetROP2 (hdc=0x22011434) returned 13
	[0187.518] GetROP2 (hdc=0x22011434) returned 13
	[0187.518] GetROP2 (hdc=0x22011434) returned 13
	[0187.518] GetROP2 (hdc=0x22011434) returned 13
	[0187.519] GetROP2 (hdc=0x22011434) returned 13
	[0187.519] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011434) returned 0x0
	[0187.519] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0187.519] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011434) returned 0x0
	[0187.519] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0187.520] GdipCreateFromHDC (hdc=0x24011434, graphics=0x20c9d0) returned 0x0
	[0187.520] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0187.520] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0187.520] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0187.520] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.520] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0187.520] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0187.521] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.521] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0187.521] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.521] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0187.521] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0187.521] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb210dbd) returned 0x0
	[0187.522] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.522] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0187.522] GdipReleaseDC (graphics=0x1b929550, hdc=0x24011434) returned 0x0
	[0187.522] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0187.522] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.522] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.523] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.523] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0187.523] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0187.523] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0187.523] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0187.525] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0187.525] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.525] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0187.525] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0187.525] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0187.525] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0187.526] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.526] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.526] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.526] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0187.526] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.526] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0187.527] GdipCreateRegion (region=0x20c310) returned 0x0
	[0187.527] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.527] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0187.527] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0187.527] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0187.527] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0187.528] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0187.528] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0187.528] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0187.528] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0187.528] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0187.528] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.529] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0187.529] OffsetViewportOrgEx (in: hdc=0x24011434, x=0, y=0, lppt=0x278d948 | out: lppt=0x278d948) returned 1
	[0187.529] GdipReleaseDC (graphics=0x1b929550, hdc=0x24011434) returned 0x0
	[0187.529] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0187.529] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.530] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0187.530] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0187.530] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0187.530] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0187.530] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0187.530] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0187.531] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0187.531] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0187.531] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0187.531] GdipCreateRegion (region=0x20c260) returned 0x0
	[0187.531] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0187.531] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0187.532] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0187.532] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0187.532] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0187.532] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0187.532] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0187.533] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0187.533] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0187.533] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0187.533] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0187.533] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0187.533] OffsetViewportOrgEx (in: hdc=0x24011434, x=0, y=0, lppt=0x278dee8 | out: lppt=0x278dee8) returned 1
	[0187.533] GetROP2 (hdc=0x24011434) returned 13
	[0187.534] GetROP2 (hdc=0x24011434) returned 13
	[0187.534] GetROP2 (hdc=0x24011434) returned 13
	[0187.534] GetROP2 (hdc=0x24011434) returned 13
	[0187.534] GetROP2 (hdc=0x24011434) returned 13
	[0187.534] GetROP2 (hdc=0x24011434) returned 13
	[0187.534] GetROP2 (hdc=0x24011434) returned 13
	[0187.535] GetROP2 (hdc=0x24011434) returned 13
	[0187.535] GdipReleaseDC (graphics=0x1b929550, hdc=0x24011434) returned 0x0
	[0187.535] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0187.535] GdipReleaseDC (graphics=0x1b929550, hdc=0x24011434) returned 0x0
	[0187.535] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0188.629] GdipCreateFromHDC (hdc=0x180113d0, graphics=0x20d7e0) returned 0x0
	[0188.629] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0188.630] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0188.630] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0188.630] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0188.630] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0188.630] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0188.631] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0188.631] GdipCreateRegion (region=0x20d910) returned 0x0
	[0188.631] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0188.631] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0188.631] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0188.632] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb1e0dbd) returned 0x0
	[0188.632] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0188.632] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0188.632] GdipReleaseDC (graphics=0x1b929550, hdc=0x180113d0) returned 0x0
	[0188.632] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0188.633] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0188.633] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0188.633] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0188.633] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0188.633] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0188.633] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0188.634] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0188.634] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0188.634] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0188.634] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0188.634] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0188.634] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0188.635] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0188.635] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0188.635] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0188.635] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0188.635] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0188.635] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0188.635] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0188.636] GdipCreateRegion (region=0x20d120) returned 0x0
	[0188.636] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0188.636] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0188.636] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0188.636] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0188.636] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0188.637] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0188.637] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0188.637] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0188.637] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0188.637] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0188.637] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0188.638] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0188.638] OffsetViewportOrgEx (in: hdc=0x180113d0, x=0, y=0, lppt=0x278fcb8 | out: lppt=0x278fcb8) returned 1
	[0188.638] GdipReleaseDC (graphics=0x1b929550, hdc=0x180113d0) returned 0x0
	[0188.638] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0188.638] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0188.638] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0188.639] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0188.639] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0188.639] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0188.639] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0188.639] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0188.639] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0188.640] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0188.640] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0188.640] GdipCreateRegion (region=0x20d070) returned 0x0
	[0188.640] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0188.640] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0188.640] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0188.641] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0188.641] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0188.641] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0188.641] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0188.641] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0188.641] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0188.642] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0188.642] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0188.642] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0188.642] OffsetViewportOrgEx (in: hdc=0x180113d0, x=0, y=0, lppt=0x2790258 | out: lppt=0x2790258) returned 1
	[0188.642] GetROP2 (hdc=0x180113d0) returned 13
	[0188.642] GetROP2 (hdc=0x180113d0) returned 13
	[0188.643] GetROP2 (hdc=0x180113d0) returned 13
	[0188.643] GetROP2 (hdc=0x180113d0) returned 13
	[0188.643] GetROP2 (hdc=0x180113d0) returned 13
	[0188.643] GetROP2 (hdc=0x180113d0) returned 13
	[0188.643] GetROP2 (hdc=0x180113d0) returned 13
	[0188.643] GetROP2 (hdc=0x180113d0) returned 13
	[0188.643] GdipReleaseDC (graphics=0x1b929550, hdc=0x180113d0) returned 0x0
	[0188.644] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0188.644] GdipReleaseDC (graphics=0x1b929550, hdc=0x180113d0) returned 0x0
	[0188.644] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0190.287] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0190.287] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0190.287] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0190.287] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0190.287] GdipCreateFromHDC (hdc=0x1b0113d0, graphics=0x20d7e0) returned 0x0
	[0190.288] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0190.288] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0190.288] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0190.288] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0190.288] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0190.288] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0190.289] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0190.289] GdipCreateRegion (region=0x20d910) returned 0x0
	[0190.289] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.289] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0190.289] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0190.289] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb1b0dbd) returned 0x0
	[0190.290] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.290] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0190.290] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0113d0) returned 0x0
	[0190.290] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0190.290] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.290] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.291] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.291] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0190.291] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0190.291] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0190.291] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0190.291] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0190.292] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.292] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0190.292] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0190.292] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0190.292] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0190.292] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.293] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.293] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.293] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0190.293] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.293] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0190.294] GdipCreateRegion (region=0x20d120) returned 0x0
	[0190.294] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.294] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0190.294] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0190.294] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0190.294] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0190.294] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0190.295] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0190.295] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0190.295] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0190.295] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0190.295] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.295] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0190.296] OffsetViewportOrgEx (in: hdc=0x1b0113d0, x=0, y=0, lppt=0x2791150 | out: lppt=0x2791150) returned 1
	[0190.296] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0113d0) returned 0x0
	[0190.296] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0190.296] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.296] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.297] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.297] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0190.297] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0190.297] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0190.297] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.297] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0190.298] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0190.298] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0190.298] GdipCreateRegion (region=0x20d070) returned 0x0
	[0190.298] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.298] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0190.298] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0190.299] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0190.299] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0190.299] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0190.299] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0190.299] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0190.299] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0190.300] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0190.300] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.300] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0190.300] OffsetViewportOrgEx (in: hdc=0x1b0113d0, x=0, y=0, lppt=0x27916f0 | out: lppt=0x27916f0) returned 1
	[0190.301] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.301] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.301] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.301] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.301] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.301] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.302] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.302] GetROP2 (hdc=0x1b0113d0) returned 13
	[0190.302] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0113d0) returned 0x0
	[0190.302] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0190.302] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0113d0) returned 0x0
	[0190.303] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0190.518] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0190.518] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0190.518] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0190.522] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0190.522] UpdateWindow (hWnd=0x201d8) 
	[0190.522] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0190.523] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0190.523] GdipCreateFromHDC (hdc=0x1f0113d0, graphics=0x20cfa0) returned 0x0
	[0190.523] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0190.523] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0190.524] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0190.524] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0190.524] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0190.524] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0190.524] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0190.524] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0190.525] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.525] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0190.525] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0190.525] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb180dbd) returned 0x0
	[0190.525] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.525] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0190.526] GetNearestColor (hdc=0x1f0113d0, color=0xf0f0f0) returned 0xf0f0f0
	[0190.526] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f0113d0) returned 0x0
	[0190.526] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0190.527] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.527] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.527] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.527] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0190.527] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0190.527] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0190.527] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0190.528] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0190.528] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.528] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0190.528] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0190.528] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0190.528] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0190.529] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.529] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.529] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.529] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0190.529] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.529] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0190.530] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0190.530] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.530] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0190.530] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0190.530] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0190.530] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0190.531] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0190.531] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0190.531] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0190.531] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0190.531] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0190.532] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.532] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0190.532] OffsetViewportOrgEx (in: hdc=0x1f0113d0, x=0, y=0, lppt=0x27926e8 | out: lppt=0x27926e8) returned 1
	[0190.532] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f0113d0) returned 0x0
	[0190.532] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0190.533] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.533] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.533] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.533] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0190.533] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0190.533] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0190.534] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.534] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0190.534] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0190.534] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0190.534] GdipCreateRegion (region=0x20c830) returned 0x0
	[0190.535] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.535] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0190.535] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0190.535] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0190.535] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0190.535] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0190.536] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0190.536] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0190.536] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0190.536] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0190.536] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.536] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0190.537] OffsetViewportOrgEx (in: hdc=0x1f0113d0, x=0, y=0, lppt=0x2792c88 | out: lppt=0x2792c88) returned 1
	[0190.537] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.537] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.537] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.537] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.537] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.537] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.538] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.538] GetROP2 (hdc=0x1f0113d0) returned 13
	[0190.538] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f0113d0) returned 0x0
	[0190.538] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0190.538] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f0113d0) returned 0x0
	[0190.539] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0190.539] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0190.539] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0190.539] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0190.539] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2792fd0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0190.540] ShellExecuteExW (pExecInfo=0x27931e0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0190.604] GdipCreateFromHDC (hdc=0xffffffff9f01117c, graphics=0x20c9d0) returned 0x0
	[0190.604] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0190.605] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0190.605] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0190.605] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0190.605] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0190.605] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0190.605] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0190.606] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0190.606] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.606] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0190.606] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0190.606] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb150dbd) returned 0x0
	[0190.607] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.607] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0190.607] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9f01117c) returned 0x0
	[0190.607] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0190.607] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.607] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.608] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.608] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0190.608] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0190.608] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0190.608] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0190.608] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0190.609] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.609] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0190.609] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0190.609] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0190.609] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0190.609] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.610] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.610] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.610] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0190.610] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.610] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0190.610] GdipCreateRegion (region=0x20c310) returned 0x0
	[0190.611] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.611] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0190.611] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0190.611] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0190.611] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0190.611] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0190.612] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0190.612] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0190.612] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0190.612] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0190.613] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.613] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0190.613] OffsetViewportOrgEx (in: hdc=0xffffffff9f01117c, x=0, y=0, lppt=0x2793ee8 | out: lppt=0x2793ee8) returned 1
	[0190.613] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9f01117c) returned 0x0
	[0190.614] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0190.614] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.614] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0190.614] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0190.614] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0190.614] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0190.615] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0190.615] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0190.615] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0190.615] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0190.615] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0190.616] GdipCreateRegion (region=0x20c260) returned 0x0
	[0190.616] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0190.616] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0190.616] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0190.616] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0190.616] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0190.617] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0190.617] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0190.617] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0190.617] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0190.617] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0190.617] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0190.617] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0190.618] OffsetViewportOrgEx (in: hdc=0xffffffff9f01117c, x=0, y=0, lppt=0x2794488 | out: lppt=0x2794488) returned 1
	[0190.618] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.618] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.618] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.618] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.618] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.619] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.619] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.619] GetROP2 (hdc=0xffffffff9f01117c) returned 13
	[0190.619] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9f01117c) returned 0x0
	[0190.619] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0190.620] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff9f01117c) returned 0x0
	[0190.620] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0191.745] GdipCreateFromHDC (hdc=0x48010f97, graphics=0x20d770) returned 0x0
	[0191.745] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0191.745] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0191.745] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0191.746] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d6c0) returned 0x0
	[0191.746] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0191.746] GdipCreateRegion (region=0x20d660) returned 0x0
	[0191.746] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0191.746] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0191.747] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0191.747] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0191.747] GdipCreateRegion (region=0x20d630) returned 0x0
	[0191.747] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0191.747] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0191.748] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0191.748] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d690) returned 0x0
	[0191.748] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0191.748] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0191.748] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0191.748] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0191.749] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0191.749] OffsetViewportOrgEx (in: hdc=0x48010f97, x=0, y=0, lppt=0x27956c0 | out: lppt=0x27956c0) returned 1
	[0191.749] GdipReleaseDC (graphics=0x1b929550, hdc=0x48010f97) returned 0x0
	[0191.749] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0191.751] GetDIBits (in: hdc=0x10107f8, hbm=0x1d0514a9, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0191.751] GetDIBits (in: hdc=0x10107f8, hbm=0x1d0514a9, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0191.751] GdipCreateFromHDC (hdc=0x250114a6, graphics=0x20d750) returned 0x0
	[0191.752] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0191.752] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0191.752] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0191.752] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0191.752] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0191.752] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0191.753] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0191.753] GdipCreateRegion (region=0x20d910) returned 0x0
	[0191.753] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0191.753] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0191.753] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0191.753] GdipCreateRegion (region=0x20d400) returned 0x0
	[0191.754] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0191.754] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0191.754] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0191.754] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0191.754] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0191.754] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0191.755] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0191.755] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0191.755] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0191.755] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0191.755] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0191.755] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0191.756] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0191.756] OffsetViewportOrgEx (in: hdc=0x250114a6, x=0, y=0, lppt=0x2796f20 | out: lppt=0x2796f20) returned 1
	[0191.756] GdipReleaseDC (graphics=0x1b929550, hdc=0x250114a6) returned 0x0
	[0191.756] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffb100dbd) returned 0x0
	[0191.756] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0191.757] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0191.757] GdipReleaseDC (graphics=0x1b929550, hdc=0x250114a6) returned 0x0
	[0191.757] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0191.757] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0191.757] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0191.757] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0191.758] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0191.758] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0191.758] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0191.758] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0191.758] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0191.759] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0191.759] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0191.759] GdipReleaseDC (graphics=0x1b929550, hdc=0x250114a6) returned 0x0
	[0191.759] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0191.759] GdipCreateFromHDC (hdc=0x1f0114a1, graphics=0x20d7e0) returned 0x0
	[0191.759] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0191.760] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0191.760] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0191.760] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0191.760] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0191.760] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0191.760] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0191.761] GdipCreateRegion (region=0x20d910) returned 0x0
	[0191.761] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0191.761] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0191.761] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0191.761] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb0e0dbd) returned 0x0
	[0191.761] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0191.762] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0191.762] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0114a1) returned 0x0
	[0191.762] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0191.762] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0191.762] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0191.762] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0191.763] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0191.763] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0191.763] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0191.763] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0191.763] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0191.763] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0191.764] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0191.764] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0191.764] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0191.764] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0191.764] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0191.764] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0191.765] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0191.765] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0191.765] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0191.765] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0191.765] GdipCreateRegion (region=0x20d120) returned 0x0
	[0191.765] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0191.766] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0191.766] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0191.766] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0191.766] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0191.766] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0191.766] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0191.767] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0191.768] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0191.768] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0191.768] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0191.768] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0191.768] OffsetViewportOrgEx (in: hdc=0x1f0114a1, x=0, y=0, lppt=0x2798010 | out: lppt=0x2798010) returned 1
	[0191.768] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0114a1) returned 0x0
	[0191.769] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0191.769] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0191.769] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0191.769] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0191.769] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0191.769] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0191.770] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0191.770] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0191.770] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0191.770] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0191.770] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0191.771] GdipCreateRegion (region=0x20d070) returned 0x0
	[0191.771] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0191.771] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0191.771] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0191.771] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0191.771] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0191.771] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0191.772] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0191.772] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0191.772] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0191.772] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0191.772] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0191.772] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0191.773] OffsetViewportOrgEx (in: hdc=0x1f0114a1, x=0, y=0, lppt=0x27985b0 | out: lppt=0x27985b0) returned 1
	[0191.773] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.773] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.773] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.773] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.773] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.774] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.774] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.774] GetROP2 (hdc=0x1f0114a1) returned 13
	[0191.774] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0114a1) returned 0x0
	[0191.774] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0191.774] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f0114a1) returned 0x0
	[0191.775] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0191.775] GetDIBits (in: hdc=0x4010280, hbm=0x170514a3, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0191.775] GetDIBits (in: hdc=0x4010280, hbm=0x170514a3, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0191.775] GdipCreateFromHDC (hdc=0x210114a9, graphics=0x20d800) returned 0x0
	[0191.775] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0191.775] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0191.776] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0191.776] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0191.776] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0191.776] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0191.776] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0191.776] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0191.777] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0191.777] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0191.777] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0191.777] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0191.777] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0191.777] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0191.778] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0191.778] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0191.778] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0191.778] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0191.778] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0191.778] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0191.778] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0191.779] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0191.779] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0191.779] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0191.779] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0191.779] OffsetViewportOrgEx (in: hdc=0x210114a9, x=0, y=0, lppt=0x2799e60 | out: lppt=0x2799e60) returned 1
	[0191.780] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x210114a9) returned 0x0
	[0191.780] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb0b0dbd) returned 0x0
	[0191.780] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0191.780] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0191.788] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0191.788] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x210114a9) returned 0x0
	[0191.788] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0193.435] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0193.435] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0193.435] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0193.435] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0193.435] UpdateWindow (hWnd=0x201d8) 
	[0193.435] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0193.436] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0193.436] GdipCreateFromHDC (hdc=0x2301119f, graphics=0x20cfa0) returned 0x0
	[0193.436] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0193.436] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0193.436] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0193.437] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.437] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0193.437] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0193.437] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.437] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0193.438] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.438] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0193.438] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0193.438] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb090dbd) returned 0x0
	[0193.438] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.438] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0193.439] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2301119f) returned 0x0
	[0193.439] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0193.439] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.439] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.439] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.439] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0193.440] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0193.440] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0193.440] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0193.440] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0193.440] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.440] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0193.441] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0193.441] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0193.441] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0193.441] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.441] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.441] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.442] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0193.442] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.442] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0193.442] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0193.442] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.442] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0193.443] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.443] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0193.443] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0193.443] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0193.443] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.443] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0193.444] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0193.444] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0193.444] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.444] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0193.444] OffsetViewportOrgEx (in: hdc=0x2301119f, x=0, y=0, lppt=0x279b388 | out: lppt=0x279b388) returned 1
	[0193.444] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2301119f) returned 0x0
	[0193.445] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0193.445] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.445] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.445] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.445] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0193.445] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0193.446] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0193.446] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.446] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0193.446] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0193.446] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0193.447] GdipCreateRegion (region=0x20c830) returned 0x0
	[0193.447] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.447] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0193.447] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.447] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0193.447] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0193.447] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0193.448] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.448] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0193.448] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0193.448] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0193.448] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.448] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0193.449] OffsetViewportOrgEx (in: hdc=0x2301119f, x=0, y=0, lppt=0x279b928 | out: lppt=0x279b928) returned 1
	[0193.449] GetROP2 (hdc=0x2301119f) returned 13
	[0193.449] GetROP2 (hdc=0x2301119f) returned 13
	[0193.449] GetROP2 (hdc=0x2301119f) returned 13
	[0193.449] GetROP2 (hdc=0x2301119f) returned 13
	[0193.449] GetROP2 (hdc=0x2301119f) returned 13
	[0193.450] GetROP2 (hdc=0x2301119f) returned 13
	[0193.450] GetROP2 (hdc=0x2301119f) returned 13
	[0193.450] GetROP2 (hdc=0x2301119f) returned 13
	[0193.450] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2301119f) returned 0x0
	[0193.450] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0193.450] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2301119f) returned 0x0
	[0193.451] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0193.451] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0193.451] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0193.452] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0193.452] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x279bc70, Length=0x70 | out: Destination=0x1afe53a0) 
	[0193.452] ShellExecuteExW (pExecInfo=0x279be80*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0193.489] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0193.489] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0193.491] GdipCreateFromHDC (hdc=0x2b01119f, graphics=0x20c9d0) returned 0x0
	[0193.491] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0193.491] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0193.491] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0193.492] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.492] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0193.492] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0193.492] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.492] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0193.492] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.493] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0193.493] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0193.493] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb060dbd) returned 0x0
	[0193.493] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.493] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0193.493] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2b01119f) returned 0x0
	[0193.494] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0193.494] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.494] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.494] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.494] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0193.494] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0193.495] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0193.495] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0193.495] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0193.495] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.495] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0193.496] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0193.496] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0193.496] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0193.496] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.496] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.496] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.497] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0193.497] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.497] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0193.497] GdipCreateRegion (region=0x20c310) returned 0x0
	[0193.497] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.497] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0193.498] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.498] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0193.498] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0193.498] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0193.498] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.498] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0193.499] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0193.499] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0193.499] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.499] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0193.499] OffsetViewportOrgEx (in: hdc=0x2b01119f, x=0, y=0, lppt=0x279cb60 | out: lppt=0x279cb60) returned 1
	[0193.499] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2b01119f) returned 0x0
	[0193.500] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0193.500] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.500] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.500] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.500] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0193.500] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0193.501] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0193.501] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.501] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0193.501] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0193.501] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0193.501] GdipCreateRegion (region=0x20c260) returned 0x0
	[0193.502] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.502] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0193.502] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.502] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0193.502] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0193.502] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0193.503] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.503] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0193.503] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0193.503] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0193.503] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.503] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0193.504] OffsetViewportOrgEx (in: hdc=0x2b01119f, x=0, y=0, lppt=0x279d100 | out: lppt=0x279d100) returned 1
	[0193.504] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.504] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.504] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.504] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.504] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.505] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.505] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.505] GetROP2 (hdc=0x2b01119f) returned 13
	[0193.505] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2b01119f) returned 0x0
	[0193.505] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0193.506] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2b01119f) returned 0x0
	[0193.506] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0193.506] GdipCreateFromHDC (hdc=0x2d01119f, graphics=0x20c9d0) returned 0x0
	[0193.506] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0193.506] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0193.507] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0193.507] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.507] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0193.507] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0193.507] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.507] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0193.508] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.508] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0193.508] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0193.508] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb030dbd) returned 0x0
	[0193.508] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.508] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0193.509] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2d01119f) returned 0x0
	[0193.509] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0193.509] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.509] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.509] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.509] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0193.510] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0193.510] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0193.510] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0193.510] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0193.510] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.510] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0193.511] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0193.511] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0193.511] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0193.511] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.511] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.511] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.512] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0193.512] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.512] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0193.512] GdipCreateRegion (region=0x20c310) returned 0x0
	[0193.512] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.512] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0193.513] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.513] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0193.513] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0193.513] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0193.513] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.513] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0193.513] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0193.514] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0193.514] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.514] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0193.514] OffsetViewportOrgEx (in: hdc=0x2d01119f, x=0, y=0, lppt=0x279df88 | out: lppt=0x279df88) returned 1
	[0193.515] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2d01119f) returned 0x0
	[0193.515] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0193.515] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.515] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.515] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.516] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0193.516] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0193.516] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0193.516] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.516] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0193.517] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0193.517] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0193.517] GdipCreateRegion (region=0x20c260) returned 0x0
	[0193.517] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.517] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0193.518] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.518] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0193.518] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0193.518] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0193.518] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.518] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0193.519] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0193.519] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0193.519] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.519] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0193.519] OffsetViewportOrgEx (in: hdc=0x2d01119f, x=0, y=0, lppt=0x279e528 | out: lppt=0x279e528) returned 1
	[0193.520] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.520] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.520] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.520] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.520] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.520] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.520] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.521] GetROP2 (hdc=0x2d01119f) returned 13
	[0193.521] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2d01119f) returned 0x0
	[0193.521] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0193.521] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2d01119f) returned 0x0
	[0193.521] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0193.735] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0193.735] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0193.735] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0193.736] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0193.736] GdipCreateFromHDC (hdc=0x680114a3, graphics=0x20d7e0) returned 0x0
	[0193.736] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0193.736] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0193.736] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0193.737] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.737] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0193.737] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0193.737] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.737] GdipCreateRegion (region=0x20d910) returned 0x0
	[0193.737] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.738] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0193.738] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0193.738] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffb000dbd) returned 0x0
	[0193.738] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.738] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0193.739] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x680114a3) returned 0x0
	[0193.739] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0193.739] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.739] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.739] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.739] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0193.740] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0193.740] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0193.740] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0193.740] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0193.740] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.740] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0193.741] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0193.741] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0193.741] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0193.741] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.741] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.742] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.742] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0193.742] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.742] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0193.742] GdipCreateRegion (region=0x20d120) returned 0x0
	[0193.742] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.743] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0193.743] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.743] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0193.743] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0193.743] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0193.743] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.744] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0193.744] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0193.744] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0193.744] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.744] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0193.744] OffsetViewportOrgEx (in: hdc=0x680114a3, x=0, y=0, lppt=0x279f4b8 | out: lppt=0x279f4b8) returned 1
	[0193.745] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x680114a3) returned 0x0
	[0193.745] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0193.745] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.745] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.745] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.745] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0193.746] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0193.746] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0193.746] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.746] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0193.746] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0193.746] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0193.747] GdipCreateRegion (region=0x20d070) returned 0x0
	[0193.747] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.747] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0193.747] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.747] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0193.747] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0193.747] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0193.748] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.748] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0193.748] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0193.749] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0193.749] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.749] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0193.749] OffsetViewportOrgEx (in: hdc=0x680114a3, x=0, y=0, lppt=0x279fa58 | out: lppt=0x279fa58) returned 1
	[0193.749] GetROP2 (hdc=0x680114a3) returned 13
	[0193.749] GetROP2 (hdc=0x680114a3) returned 13
	[0193.750] GetROP2 (hdc=0x680114a3) returned 13
	[0193.750] GetROP2 (hdc=0x680114a3) returned 13
	[0193.750] GetROP2 (hdc=0x680114a3) returned 13
	[0193.750] GetROP2 (hdc=0x680114a3) returned 13
	[0193.750] GetROP2 (hdc=0x680114a3) returned 13
	[0193.750] GetROP2 (hdc=0x680114a3) returned 13
	[0193.751] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x680114a3) returned 0x0
	[0193.751] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0193.751] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x680114a3) returned 0x0
	[0193.751] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0193.751] GdipCreateFromHDC (hdc=0x6a0114a3, graphics=0x20d7e0) returned 0x0
	[0193.752] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0193.752] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0193.752] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0193.752] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.752] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0193.752] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0193.753] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.753] GdipCreateRegion (region=0x20d910) returned 0x0
	[0193.753] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.753] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0193.753] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0193.753] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffafd0dbd) returned 0x0
	[0193.754] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.754] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0193.754] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x6a0114a3) returned 0x0
	[0193.754] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0193.754] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.754] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.755] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.755] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0193.755] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0193.755] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0193.755] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0193.755] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0193.756] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.756] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0193.756] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0193.756] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0193.756] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0193.756] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.757] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.757] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.757] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0193.757] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.757] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0193.757] GdipCreateRegion (region=0x20d120) returned 0x0
	[0193.758] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.758] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0193.758] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.758] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0193.758] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0193.758] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0193.759] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.759] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0193.759] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0193.759] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0193.759] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.759] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0193.760] OffsetViewportOrgEx (in: hdc=0x6a0114a3, x=0, y=0, lppt=0x27a08b8 | out: lppt=0x27a08b8) returned 1
	[0193.760] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x6a0114a3) returned 0x0
	[0193.760] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0193.760] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.760] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0193.760] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0193.761] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0193.761] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0193.761] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0193.761] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0193.761] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0193.762] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0193.762] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0193.762] GdipCreateRegion (region=0x20d070) returned 0x0
	[0193.762] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.762] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0193.762] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.762] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0193.763] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0193.763] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0193.763] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.763] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0193.763] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0193.764] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0193.764] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.764] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0193.764] OffsetViewportOrgEx (in: hdc=0x6a0114a3, x=0, y=0, lppt=0x27a0e58 | out: lppt=0x27a0e58) returned 1
	[0193.764] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.764] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.765] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.765] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.765] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.765] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.765] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.765] GetROP2 (hdc=0x6a0114a3) returned 13
	[0193.766] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x6a0114a3) returned 0x0
	[0193.766] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0193.766] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x6a0114a3) returned 0x0
	[0193.766] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0193.992] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d7b0) returned 0x0
	[0193.992] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0193.992] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0193.992] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0193.992] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d700) returned 0x0
	[0193.993] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0193.993] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0193.993] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.993] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6d0) returned 0x0
	[0193.993] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.993] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d7a0) returned 0x0
	[0193.993] GdipCreateRegion (region=0x20d670) returned 0x0
	[0193.994] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0193.994] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0193.994] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0193.994] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d6d0) returned 0x0
	[0193.994] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0193.994] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0193.995] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d720) returned 0x0
	[0193.995] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0193.995] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d750) returned 0x0
	[0193.995] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x27a15f8 | out: lppt=0x27a15f8) returned 1
	[0193.995] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x10107f8) returned 0x0
	[0193.995] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0193.996] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0193.996] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0193.997] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0193.997] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0193.997] UpdateWindow (hWnd=0x401b4) 
	[0193.997] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0193.997] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0193.997] GdipCreateFromHDC (hdc=0xffffffff9c0114ad, graphics=0x20cfa0) returned 0x0
	[0193.997] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0194.103] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0194.104] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0194.104] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0194.104] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0194.104] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0194.104] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0194.104] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0194.105] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0194.105] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0194.105] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0194.105] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffaf80dbd) returned 0x0
	[0194.105] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0194.105] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0194.106] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9c0114ad) returned 0x0
	[0194.106] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0194.106] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0194.106] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0194.106] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0194.106] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0194.107] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0194.107] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0194.107] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0194.107] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0194.107] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0194.108] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0194.108] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0194.108] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0194.109] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0194.109] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0194.109] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0194.109] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0194.109] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0194.109] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0194.110] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0194.110] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0194.110] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0194.110] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0194.110] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0194.111] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0194.111] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0194.111] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0194.111] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0194.111] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0194.111] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0194.112] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0194.112] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0194.112] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0194.112] OffsetViewportOrgEx (in: hdc=0xffffffff9c0114ad, x=0, y=0, lppt=0x27a23e8 | out: lppt=0x27a23e8) returned 1
	[0194.112] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9c0114ad) returned 0x0
	[0194.113] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0194.113] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0194.113] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0194.113] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0194.113] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0194.113] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0194.114] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0194.114] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0194.114] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0194.114] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0194.114] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0194.114] GdipCreateRegion (region=0x20c830) returned 0x0
	[0194.115] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0194.115] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0194.115] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0194.115] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0194.115] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0194.115] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0194.116] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0194.116] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0194.116] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0194.116] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0194.116] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0194.116] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0194.116] OffsetViewportOrgEx (in: hdc=0xffffffff9c0114ad, x=0, y=0, lppt=0x27a2988 | out: lppt=0x27a2988) returned 1
	[0194.117] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.117] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.117] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.117] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.117] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.117] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.118] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.118] GetROP2 (hdc=0xffffffff9c0114ad) returned 13
	[0194.118] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9c0114ad) returned 0x0
	[0194.118] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0194.118] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9c0114ad) returned 0x0
	[0194.118] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0194.119] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0194.119] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0194.119] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0194.119] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0194.119] GetCapture () returned 0x401b4
	[0194.119] ReleaseCapture () 
	[0194.119] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0194.119] GetDIBits (in: hdc=0x48010f97, hbm=0xffffffff900514ac, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0194.119] GetDIBits (in: hdc=0x48010f97, hbm=0xffffffff900514ac, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0194.120] GdipCreateFromHDC (hdc=0x5b0114b2, graphics=0x20d750) returned 0x0
	[0194.120] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0194.120] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0194.120] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0194.120] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0194.121] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0194.121] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0194.121] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0194.121] GdipCreateRegion (region=0x20d910) returned 0x0
	[0194.121] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0194.121] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0194.122] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0194.122] GdipCreateRegion (region=0x20d400) returned 0x0
	[0194.122] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0194.122] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0194.122] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0194.123] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d460) returned 0x0
	[0194.123] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0194.123] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0194.123] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0194.123] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0194.123] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0194.124] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0194.124] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0194.124] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0194.124] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0194.124] OffsetViewportOrgEx (in: hdc=0x5b0114b2, x=0, y=0, lppt=0x27a4340 | out: lppt=0x27a4340) returned 1
	[0194.124] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5b0114b2) returned 0x0
	[0194.125] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffaf50dbd) returned 0x0
	[0194.125] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0194.125] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0194.125] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5b0114b2) returned 0x0
	[0194.125] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0194.126] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0194.126] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0194.126] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0194.126] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0194.126] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0194.126] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0194.127] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0194.127] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0194.127] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0194.127] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0194.128] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5b0114b2) returned 0x0
	[0194.128] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0194.128] GetDIBits (in: hdc=0x4010280, hbm=0xffffffff920514ac, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0194.128] GetDIBits (in: hdc=0x4010280, hbm=0xffffffff920514ac, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0194.128] GdipCreateFromHDC (hdc=0x6d0114a3, graphics=0x20d800) returned 0x0
	[0194.129] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0194.129] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0194.129] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0194.129] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0194.129] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20da20) returned 0x0
	[0194.130] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0194.130] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0194.130] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0194.130] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0194.130] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0194.130] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0194.131] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0194.131] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0194.131] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0194.131] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0194.131] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0194.132] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0194.132] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0194.132] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0194.132] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0194.132] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0194.133] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0194.133] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0194.133] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0194.133] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0194.133] OffsetViewportOrgEx (in: hdc=0x6d0114a3, x=0, y=0, lppt=0x27a5e80 | out: lppt=0x27a5e80) returned 1
	[0194.134] GdipReleaseDC (graphics=0x1b929550, hdc=0x6d0114a3) returned 0x0
	[0194.134] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffaf30dbd) returned 0x0
	[0194.134] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0194.135] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0194.145] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0194.145] GdipReleaseDC (graphics=0x1b929550, hdc=0x6d0114a3) returned 0x0
	[0194.145] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0196.419] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0196.419] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0196.419] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0196.419] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0196.419] GdipCreateFromHDC (hdc=0xf011108, graphics=0x20d7e0) returned 0x0
	[0196.420] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0196.420] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0196.420] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0196.420] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.420] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0196.420] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.421] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.421] GdipCreateRegion (region=0x20d910) returned 0x0
	[0196.421] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.421] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0196.421] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0196.421] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffaf10dbd) returned 0x0
	[0196.422] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.422] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0196.422] GdipReleaseDC (graphics=0x1b929550, hdc=0xf011108) returned 0x0
	[0196.422] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0196.422] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.422] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.423] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.423] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0196.423] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0196.423] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0196.423] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0196.423] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0196.424] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.424] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0196.424] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0196.424] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0196.424] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0196.424] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.425] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.425] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.425] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0196.425] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.425] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0196.425] GdipCreateRegion (region=0x20d120) returned 0x0
	[0196.426] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.426] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0196.426] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.426] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0196.426] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.426] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.426] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.427] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0196.427] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0196.427] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0196.427] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.427] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0196.428] OffsetViewportOrgEx (in: hdc=0xf011108, x=0, y=0, lppt=0x27a8088 | out: lppt=0x27a8088) returned 1
	[0196.428] GdipReleaseDC (graphics=0x1b929550, hdc=0xf011108) returned 0x0
	[0196.428] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0196.428] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.428] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.428] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.429] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0196.429] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0196.429] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0196.429] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.429] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0196.430] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0196.430] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0196.430] GdipCreateRegion (region=0x20d070) returned 0x0
	[0196.430] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.430] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0196.430] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.431] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0196.431] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.431] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.431] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.431] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0196.432] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0196.434] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0196.434] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.435] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0196.435] OffsetViewportOrgEx (in: hdc=0xf011108, x=0, y=0, lppt=0x27a8628 | out: lppt=0x27a8628) returned 1
	[0196.435] GetROP2 (hdc=0xf011108) returned 13
	[0196.435] GetROP2 (hdc=0xf011108) returned 13
	[0196.435] GetROP2 (hdc=0xf011108) returned 13
	[0196.435] GetROP2 (hdc=0xf011108) returned 13
	[0196.436] GetROP2 (hdc=0xf011108) returned 13
	[0196.436] GetROP2 (hdc=0xf011108) returned 13
	[0196.436] GetROP2 (hdc=0xf011108) returned 13
	[0196.436] GetROP2 (hdc=0xf011108) returned 13
	[0196.436] GdipReleaseDC (graphics=0x1b929550, hdc=0xf011108) returned 0x0
	[0196.436] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0196.437] GdipReleaseDC (graphics=0x1b929550, hdc=0xf011108) returned 0x0
	[0196.437] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0196.437] GdipCreateFromHDC (hdc=0x11011108, graphics=0x20d7e0) returned 0x0
	[0196.437] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0196.437] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0196.438] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0196.438] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.438] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0196.438] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.438] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.438] GdipCreateRegion (region=0x20d910) returned 0x0
	[0196.439] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.439] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0196.439] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0196.439] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffaee0dbd) returned 0x0
	[0196.439] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.439] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0196.440] GdipReleaseDC (graphics=0x1b929550, hdc=0x11011108) returned 0x0
	[0196.440] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0196.440] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.440] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.440] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.440] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0196.440] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0196.441] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0196.441] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0196.441] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0196.441] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.441] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0196.441] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0196.442] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0196.442] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0196.442] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.442] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.442] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.442] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0196.443] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.443] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0196.443] GdipCreateRegion (region=0x20d120) returned 0x0
	[0196.443] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.443] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0196.443] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.444] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0196.444] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.444] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.444] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.444] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0196.444] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0196.445] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0196.445] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.445] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0196.445] OffsetViewportOrgEx (in: hdc=0x11011108, x=0, y=0, lppt=0x27a9488 | out: lppt=0x27a9488) returned 1
	[0196.445] GdipReleaseDC (graphics=0x1b929550, hdc=0x11011108) returned 0x0
	[0196.445] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0196.446] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.446] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.446] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.446] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0196.446] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0196.446] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0196.447] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.447] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0196.447] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0196.447] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0196.447] GdipCreateRegion (region=0x20d070) returned 0x0
	[0196.448] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.448] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0196.448] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.448] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0196.448] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.448] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.449] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.449] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0196.449] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0196.449] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0196.449] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.449] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0196.450] OffsetViewportOrgEx (in: hdc=0x11011108, x=0, y=0, lppt=0x27a9a28 | out: lppt=0x27a9a28) returned 1
	[0196.450] GetROP2 (hdc=0x11011108) returned 13
	[0196.450] GetROP2 (hdc=0x11011108) returned 13
	[0196.450] GetROP2 (hdc=0x11011108) returned 13
	[0196.450] GetROP2 (hdc=0x11011108) returned 13
	[0196.450] GetROP2 (hdc=0x11011108) returned 13
	[0196.451] GetROP2 (hdc=0x11011108) returned 13
	[0196.451] GetROP2 (hdc=0x11011108) returned 13
	[0196.451] GetROP2 (hdc=0x11011108) returned 13
	[0196.451] GdipReleaseDC (graphics=0x1b929550, hdc=0x11011108) returned 0x0
	[0196.451] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0196.451] GdipReleaseDC (graphics=0x1b929550, hdc=0x11011108) returned 0x0
	[0196.452] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0196.738] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0196.738] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0196.738] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0196.738] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0196.738] UpdateWindow (hWnd=0x201d8) 
	[0196.738] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0196.738] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0196.738] GdipCreateFromHDC (hdc=0x23011108, graphics=0x20cfa0) returned 0x0
	[0196.738] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0196.739] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0196.739] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0196.739] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.739] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0196.739] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.739] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.740] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0196.740] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.740] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0196.740] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0196.740] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffaeb0dbd) returned 0x0
	[0196.740] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.741] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0196.741] GdipReleaseDC (graphics=0x1b929550, hdc=0x23011108) returned 0x0
	[0196.741] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0196.741] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.742] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.742] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.742] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0196.742] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0196.742] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0196.742] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0196.743] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0196.743] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.743] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0196.743] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0196.744] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0196.744] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0196.744] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.744] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.744] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.744] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0196.745] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.745] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0196.745] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0196.745] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.745] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0196.746] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.746] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0196.746] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.746] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.746] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.746] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0196.747] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0196.747] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0196.747] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.747] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0196.747] OffsetViewportOrgEx (in: hdc=0x23011108, x=0, y=0, lppt=0x27aaa58 | out: lppt=0x27aaa58) returned 1
	[0196.748] GdipReleaseDC (graphics=0x1b929550, hdc=0x23011108) returned 0x0
	[0196.748] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0196.748] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.748] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.748] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.748] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0196.749] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0196.749] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0196.749] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.749] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0196.749] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0196.750] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0196.750] GdipCreateRegion (region=0x20c830) returned 0x0
	[0196.750] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.750] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0196.750] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.750] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0196.751] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.751] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.751] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.751] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0196.751] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0196.751] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0196.752] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.752] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0196.752] OffsetViewportOrgEx (in: hdc=0x23011108, x=0, y=0, lppt=0x27aaff8 | out: lppt=0x27aaff8) returned 1
	[0196.752] GetROP2 (hdc=0x23011108) returned 13
	[0196.752] GetROP2 (hdc=0x23011108) returned 13
	[0196.753] GetROP2 (hdc=0x23011108) returned 13
	[0196.753] GetROP2 (hdc=0x23011108) returned 13
	[0196.753] GetROP2 (hdc=0x23011108) returned 13
	[0196.753] GetROP2 (hdc=0x23011108) returned 13
	[0196.753] GetROP2 (hdc=0x23011108) returned 13
	[0196.753] GetROP2 (hdc=0x23011108) returned 13
	[0196.754] GdipReleaseDC (graphics=0x1b929550, hdc=0x23011108) returned 0x0
	[0196.754] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0196.754] GdipReleaseDC (graphics=0x1b929550, hdc=0x23011108) returned 0x0
	[0196.754] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0196.754] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0196.754] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0196.755] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0196.755] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27ab340, Length=0x70 | out: Destination=0x1afe53a0) 
	[0196.755] ShellExecuteExW (pExecInfo=0x27ab550*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0196.803] GdipCreateFromHDC (hdc=0x2f011108, graphics=0x20c9d0) returned 0x0
	[0196.803] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0196.803] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0196.803] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0196.804] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.804] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0196.804] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.804] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.804] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0196.805] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.805] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0196.805] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0196.805] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffae80dbd) returned 0x0
	[0196.806] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.806] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0196.807] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011108) returned 0x0
	[0196.807] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0196.807] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.807] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.807] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.808] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0196.808] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0196.808] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0196.808] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0196.808] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0196.809] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.809] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0196.809] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0196.809] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0196.809] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0196.810] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.810] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.810] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.810] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0196.810] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.811] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0196.811] GdipCreateRegion (region=0x20c310) returned 0x0
	[0196.811] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.811] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0196.811] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.812] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0196.812] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.812] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0196.812] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.812] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0196.812] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0196.813] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0196.813] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.813] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0196.813] OffsetViewportOrgEx (in: hdc=0x2f011108, x=0, y=0, lppt=0x27ac220 | out: lppt=0x27ac220) returned 1
	[0196.813] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011108) returned 0x0
	[0196.814] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0196.814] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.814] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.814] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.814] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0196.814] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0196.815] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0196.815] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.815] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0196.815] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0196.815] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0196.816] GdipCreateRegion (region=0x20c260) returned 0x0
	[0196.816] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.816] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0196.816] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.816] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0196.817] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.817] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0196.817] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.817] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0196.817] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0196.817] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0196.818] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.818] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0196.818] OffsetViewportOrgEx (in: hdc=0x2f011108, x=0, y=0, lppt=0x27ac7c0 | out: lppt=0x27ac7c0) returned 1
	[0196.818] GetROP2 (hdc=0x2f011108) returned 13
	[0196.818] GetROP2 (hdc=0x2f011108) returned 13
	[0196.819] GetROP2 (hdc=0x2f011108) returned 13
	[0196.819] GetROP2 (hdc=0x2f011108) returned 13
	[0196.819] GetROP2 (hdc=0x2f011108) returned 13
	[0196.819] GetROP2 (hdc=0x2f011108) returned 13
	[0196.819] GetROP2 (hdc=0x2f011108) returned 13
	[0196.820] GetROP2 (hdc=0x2f011108) returned 13
	[0196.820] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011108) returned 0x0
	[0196.820] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0196.820] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011108) returned 0x0
	[0196.820] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0196.855] GdipCreateFromHDC (hdc=0x36011108, graphics=0x20c9d0) returned 0x0
	[0196.855] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0196.856] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0196.856] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0196.856] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.856] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0196.856] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0196.856] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.857] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0196.857] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.857] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0196.857] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0196.857] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffae50dbd) returned 0x0
	[0196.857] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.857] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0196.858] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011108) returned 0x0
	[0196.858] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0196.858] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.858] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.858] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.858] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0196.859] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0196.859] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0196.859] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0196.859] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0196.859] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.859] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0196.860] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0196.860] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0196.860] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0196.860] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.860] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.860] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.861] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0196.861] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.861] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0196.861] GdipCreateRegion (region=0x20c310) returned 0x0
	[0196.861] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.861] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0196.862] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.862] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0196.862] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0196.862] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0196.862] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.862] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0196.863] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0196.863] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0196.863] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.863] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0196.863] OffsetViewportOrgEx (in: hdc=0x36011108, x=0, y=0, lppt=0x27ad658 | out: lppt=0x27ad658) returned 1
	[0196.863] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011108) returned 0x0
	[0196.864] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0196.864] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.864] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.864] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.864] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0196.864] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0196.865] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0196.865] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.865] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0196.865] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0196.865] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0196.865] GdipCreateRegion (region=0x20c260) returned 0x0
	[0196.866] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.866] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0196.866] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.866] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0196.866] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0196.866] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0196.867] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.867] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0196.867] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0196.867] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0196.867] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.867] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0196.868] OffsetViewportOrgEx (in: hdc=0x36011108, x=0, y=0, lppt=0x27adbf8 | out: lppt=0x27adbf8) returned 1
	[0196.868] GetROP2 (hdc=0x36011108) returned 13
	[0196.868] GetROP2 (hdc=0x36011108) returned 13
	[0196.868] GetROP2 (hdc=0x36011108) returned 13
	[0196.868] GetROP2 (hdc=0x36011108) returned 13
	[0196.868] GetROP2 (hdc=0x36011108) returned 13
	[0196.869] GetROP2 (hdc=0x36011108) returned 13
	[0196.869] GetROP2 (hdc=0x36011108) returned 13
	[0196.869] GetROP2 (hdc=0x36011108) returned 13
	[0196.869] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011108) returned 0x0
	[0196.869] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0196.870] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011108) returned 0x0
	[0196.870] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0196.966] GdipCreateFromHDC (hdc=0x1e011466, graphics=0x20d7e0) returned 0x0
	[0196.967] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0196.967] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0196.967] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0196.967] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.967] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0196.967] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0196.967] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.968] GdipCreateRegion (region=0x20d910) returned 0x0
	[0196.968] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.968] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0196.968] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0196.968] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffae20dbd) returned 0x0
	[0196.968] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.969] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0196.969] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011466) returned 0x0
	[0196.969] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0196.969] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.969] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.970] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.970] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0196.970] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0196.970] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0196.970] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0196.970] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0196.970] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.971] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0196.971] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0196.971] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0196.971] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0196.971] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.971] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.972] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.972] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0196.972] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.972] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0196.972] GdipCreateRegion (region=0x20d120) returned 0x0
	[0196.972] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.973] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0196.973] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0196.973] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0196.973] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0196.973] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0196.973] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0196.974] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0196.974] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0196.974] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0196.974] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.974] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0196.974] OffsetViewportOrgEx (in: hdc=0x1e011466, x=0, y=0, lppt=0x27aed58 | out: lppt=0x27aed58) returned 1
	[0196.975] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011466) returned 0x0
	[0196.975] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0196.975] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.975] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0196.975] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0196.975] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0196.976] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0196.976] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0196.976] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0196.976] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0196.976] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0196.977] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0196.977] GdipCreateRegion (region=0x20d070) returned 0x0
	[0196.978] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0196.978] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0196.978] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0196.978] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0196.978] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0196.978] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0196.979] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0196.979] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0196.979] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0196.979] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0196.979] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0196.979] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0196.980] OffsetViewportOrgEx (in: hdc=0x1e011466, x=0, y=0, lppt=0x27af2f8 | out: lppt=0x27af2f8) returned 1
	[0196.980] GetROP2 (hdc=0x1e011466) returned 13
	[0196.980] GetROP2 (hdc=0x1e011466) returned 13
	[0196.980] GetROP2 (hdc=0x1e011466) returned 13
	[0196.980] GetROP2 (hdc=0x1e011466) returned 13
	[0196.980] GetROP2 (hdc=0x1e011466) returned 13
	[0196.980] GetROP2 (hdc=0x1e011466) returned 13
	[0196.981] GetROP2 (hdc=0x1e011466) returned 13
	[0196.981] GetROP2 (hdc=0x1e011466) returned 13
	[0196.981] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011466) returned 0x0
	[0196.981] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0196.981] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011466) returned 0x0
	[0196.982] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0199.498] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0199.498] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0199.498] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0199.498] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0199.498] GdipCreateFromHDC (hdc=0x2b0110e9, graphics=0x20d7e0) returned 0x0
	[0199.499] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0199.499] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0199.499] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0199.499] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0199.499] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0199.499] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0199.499] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0199.500] GdipCreateRegion (region=0x20d910) returned 0x0
	[0199.500] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.500] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0199.500] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0199.500] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffadf0dbd) returned 0x0
	[0199.500] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.501] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0199.501] GdipReleaseDC (graphics=0x1b929550, hdc=0x2b0110e9) returned 0x0
	[0199.501] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0199.501] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.501] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.502] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.502] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0199.502] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0199.502] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0199.502] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0199.502] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0199.503] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.503] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0199.503] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0199.503] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0199.504] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0199.504] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.504] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.504] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.505] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0199.505] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.505] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0199.505] GdipCreateRegion (region=0x20d120) returned 0x0
	[0199.505] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.506] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0199.506] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0199.506] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0199.506] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0199.506] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0199.506] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0199.507] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0199.507] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0199.507] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0199.507] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.507] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0199.508] OffsetViewportOrgEx (in: hdc=0x2b0110e9, x=0, y=0, lppt=0x27b0228 | out: lppt=0x27b0228) returned 1
	[0199.508] GdipReleaseDC (graphics=0x1b929550, hdc=0x2b0110e9) returned 0x0
	[0199.508] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0199.508] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.508] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.508] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.509] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0199.509] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0199.509] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0199.509] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.509] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0199.510] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0199.510] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0199.510] GdipCreateRegion (region=0x20d070) returned 0x0
	[0199.510] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.510] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0199.510] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0199.511] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0199.511] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0199.511] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0199.511] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0199.511] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0199.512] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0199.512] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0199.512] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.512] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0199.512] OffsetViewportOrgEx (in: hdc=0x2b0110e9, x=0, y=0, lppt=0x27b07c8 | out: lppt=0x27b07c8) returned 1
	[0199.512] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.513] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.513] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.513] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.513] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.513] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.514] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.514] GetROP2 (hdc=0x2b0110e9) returned 13
	[0199.514] GdipReleaseDC (graphics=0x1b929550, hdc=0x2b0110e9) returned 0x0
	[0199.514] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0199.514] GdipReleaseDC (graphics=0x1b929550, hdc=0x2b0110e9) returned 0x0
	[0199.515] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0199.742] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0199.742] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0199.742] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0199.742] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0199.742] UpdateWindow (hWnd=0x201d8) 
	[0199.742] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0199.742] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0199.743] GdipCreateFromHDC (hdc=0x2f0110e9, graphics=0x20cfa0) returned 0x0
	[0199.743] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0199.743] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0199.743] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0199.743] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0199.743] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0199.744] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0199.744] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0199.744] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0199.744] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.744] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0199.744] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0199.745] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffadc0dbd) returned 0x0
	[0199.745] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.745] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0199.745] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f0110e9) returned 0x0
	[0199.745] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0199.745] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.746] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.746] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.746] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0199.746] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0199.746] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0199.746] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0199.747] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0199.747] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.747] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0199.747] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0199.747] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0199.747] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0199.748] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.748] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.748] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.748] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0199.748] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.748] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0199.749] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0199.749] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.749] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0199.749] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0199.749] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0199.749] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0199.750] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0199.750] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0199.750] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0199.750] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0199.750] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0199.750] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.751] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0199.751] OffsetViewportOrgEx (in: hdc=0x2f0110e9, x=0, y=0, lppt=0x27b17c0 | out: lppt=0x27b17c0) returned 1
	[0199.751] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f0110e9) returned 0x0
	[0199.751] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0199.751] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.751] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.752] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.752] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0199.752] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0199.752] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0199.752] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.752] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0199.753] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0199.753] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0199.753] GdipCreateRegion (region=0x20c830) returned 0x0
	[0199.753] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.753] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0199.753] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0199.754] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0199.754] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0199.754] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0199.754] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0199.754] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0199.755] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0199.755] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0199.755] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.755] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0199.755] OffsetViewportOrgEx (in: hdc=0x2f0110e9, x=0, y=0, lppt=0x27b1d60 | out: lppt=0x27b1d60) returned 1
	[0199.755] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.756] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.756] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.756] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.756] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.756] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.756] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.757] GetROP2 (hdc=0x2f0110e9) returned 13
	[0199.757] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f0110e9) returned 0x0
	[0199.757] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0199.757] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f0110e9) returned 0x0
	[0199.757] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0199.757] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0199.757] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0199.759] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0199.759] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27b20a8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0199.759] ShellExecuteExW (in: pExecInfo=0x27b22b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x27b22b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="\xffff\x74\x74\x70\x73\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x72\x6f\x66\x69\x6c\x65\x2e\x70\x68\x70\x3f\x69\x64\x3d\x31\x30\x30\x30\x32\x37\x30\x39\x31\x34\x35\x37\x37\x35\x34", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0199.872] GdipCreateFromHDC (hdc=0xffffffffb80114a1, graphics=0x20c9d0) returned 0x0
	[0199.873] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0199.873] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0199.873] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0199.873] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0199.873] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0199.873] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0199.874] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0199.874] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0199.874] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.874] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0199.874] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0199.874] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffad90dbd) returned 0x0
	[0199.875] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.875] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0199.875] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffb80114a1) returned 0x0
	[0199.875] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0199.875] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.876] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.876] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.876] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0199.876] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0199.876] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0199.876] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0199.876] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0199.877] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.877] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0199.877] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0199.877] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0199.877] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0199.877] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.878] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.878] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.878] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0199.878] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.878] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0199.878] GdipCreateRegion (region=0x20c310) returned 0x0
	[0199.879] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.879] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0199.880] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0199.880] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0199.880] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0199.880] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0199.880] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0199.880] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0199.880] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0199.881] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0199.881] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.881] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0199.881] OffsetViewportOrgEx (in: hdc=0xffffffffb80114a1, x=0, y=0, lppt=0x27b2fc0 | out: lppt=0x27b2fc0) returned 1
	[0199.881] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffb80114a1) returned 0x0
	[0199.881] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0199.882] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.882] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0199.882] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0199.882] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0199.882] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0199.883] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0199.883] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0199.883] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0199.883] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0199.883] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0199.883] GdipCreateRegion (region=0x20c260) returned 0x0
	[0199.883] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0199.884] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0199.884] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0199.884] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0199.884] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0199.884] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0199.884] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0199.885] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0199.885] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0199.885] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0199.885] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0199.885] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0199.885] OffsetViewportOrgEx (in: hdc=0xffffffffb80114a1, x=0, y=0, lppt=0x27b3560 | out: lppt=0x27b3560) returned 1
	[0199.886] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.886] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.886] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.886] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.886] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.886] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.887] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.887] GetROP2 (hdc=0xffffffffb80114a1) returned 13
	[0199.887] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffb80114a1) returned 0x0
	[0199.887] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0199.887] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffb80114a1) returned 0x0
	[0199.887] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0200.132] GdipCreateFromHDC (hdc=0x70107fc, graphics=0x20c950) returned 0x0
	[0200.132] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0200.132] GdipCreateMatrix (matrix=0x20c840) returned 0x0
	[0200.133] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0200.133] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c8a0) returned 0x0
	[0200.133] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0200.133] GdipCreateRegion (region=0x20c840) returned 0x0
	[0200.133] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0200.133] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c870) returned 0x0
	[0200.134] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0200.134] GdipSaveGraphics (graphics=0x1b929550, state=0x20c940) returned 0x0
	[0200.134] GdipCreateRegion (region=0x20c810) returned 0x0
	[0200.134] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0200.134] GdipCreateMatrix (matrix=0x20c810) returned 0x0
	[0200.134] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0200.134] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c870) returned 0x0
	[0200.135] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0200.135] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0200.135] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8c0) returned 0x0
	[0200.135] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0200.135] GdipGetDC (graphics=0x1b929550, hdc=0x20c8f0) returned 0x0
	[0200.135] OffsetViewportOrgEx (in: hdc=0x70107fc, x=0, y=0, lppt=0x27b3c80 | out: lppt=0x27b3c80) returned 1
	[0200.136] GdipReleaseDC (graphics=0x1b929550, hdc=0x70107fc) returned 0x0
	[0200.136] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0200.137] GetDIBits (in: hdc=0x48010f97, hbm=0x14051500, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0200.137] GetDIBits (in: hdc=0x48010f97, hbm=0x14051500, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0200.138] GdipCreateFromHDC (hdc=0x6b0114f7, graphics=0x20d750) returned 0x0
	[0200.138] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0200.138] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0200.138] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0200.138] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0200.138] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0200.139] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0200.139] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0200.139] GdipCreateRegion (region=0x20d910) returned 0x0
	[0200.139] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0200.139] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0200.139] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0200.140] GdipCreateRegion (region=0x20d400) returned 0x0
	[0200.140] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0200.140] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0200.140] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0200.140] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0200.140] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0200.141] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0200.141] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0200.141] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0200.141] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0200.141] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0200.141] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0200.142] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0200.142] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0200.142] OffsetViewportOrgEx (in: hdc=0x6b0114f7, x=0, y=0, lppt=0x27b5508 | out: lppt=0x27b5508) returned 1
	[0200.142] GdipReleaseDC (graphics=0x1b929550, hdc=0x6b0114f7) returned 0x0
	[0200.142] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffad40dbd) returned 0x0
	[0200.142] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0200.143] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0200.143] GdipReleaseDC (graphics=0x1b929550, hdc=0x6b0114f7) returned 0x0
	[0200.143] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0200.143] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0200.143] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0200.143] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0200.144] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0200.146] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0200.146] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0200.146] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0200.146] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0200.146] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0200.147] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0200.147] GdipReleaseDC (graphics=0x1b929550, hdc=0x6b0114f7) returned 0x0
	[0200.147] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0200.147] GdipCreateFromHDC (hdc=0x300114f6, graphics=0x20d7e0) returned 0x0
	[0200.147] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0200.148] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0200.148] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0200.148] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0200.148] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0200.148] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0200.148] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0200.149] GdipCreateRegion (region=0x20d910) returned 0x0
	[0200.149] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0200.149] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0200.149] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0200.149] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffad20dbd) returned 0x0
	[0200.149] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0200.150] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0200.150] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x300114f6) returned 0x0
	[0200.150] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0200.150] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0200.150] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0200.150] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0200.151] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0200.151] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0200.151] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0200.151] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0200.151] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0200.151] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0200.152] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0200.152] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0200.152] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0200.152] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0200.152] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0200.152] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0200.153] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0200.153] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0200.153] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0200.153] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0200.153] GdipCreateRegion (region=0x20d120) returned 0x0
	[0200.153] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0200.153] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0200.154] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0200.154] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0200.154] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0200.154] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0200.154] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0200.154] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0200.155] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0200.155] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0200.155] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0200.155] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0200.155] OffsetViewportOrgEx (in: hdc=0x300114f6, x=0, y=0, lppt=0x27b65f8 | out: lppt=0x27b65f8) returned 1
	[0200.155] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x300114f6) returned 0x0
	[0200.156] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0200.156] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0200.156] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0200.156] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0200.156] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0200.156] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0200.157] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0200.157] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0200.157] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0200.157] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0200.157] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0200.157] GdipCreateRegion (region=0x20d070) returned 0x0
	[0200.158] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0200.158] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0200.158] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0200.158] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0200.158] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0200.158] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0200.159] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0200.159] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0200.159] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0200.159] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0200.159] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0200.160] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0200.160] OffsetViewportOrgEx (in: hdc=0x300114f6, x=0, y=0, lppt=0x27b6b98 | out: lppt=0x27b6b98) returned 1
	[0200.160] GetROP2 (hdc=0x300114f6) returned 13
	[0200.160] GetROP2 (hdc=0x300114f6) returned 13
	[0200.160] GetROP2 (hdc=0x300114f6) returned 13
	[0200.160] GetROP2 (hdc=0x300114f6) returned 13
	[0200.161] GetROP2 (hdc=0x300114f6) returned 13
	[0200.161] GetROP2 (hdc=0x300114f6) returned 13
	[0200.161] GetROP2 (hdc=0x300114f6) returned 13
	[0200.161] GetROP2 (hdc=0x300114f6) returned 13
	[0200.161] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x300114f6) returned 0x0
	[0200.161] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0200.162] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x300114f6) returned 0x0
	[0200.162] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0200.162] GetDIBits (in: hdc=0x70107fc, hbm=0x2d0514f9, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0200.162] GetDIBits (in: hdc=0x70107fc, hbm=0x2d0514f9, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0200.162] GdipCreateFromHDC (hdc=0x18011500, graphics=0x20d800) returned 0x0
	[0200.162] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0200.163] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0200.163] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0200.163] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0200.163] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20da20) returned 0x0
	[0200.163] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0200.163] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0200.164] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0200.164] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0200.164] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0200.164] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0200.164] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0200.164] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0200.165] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0200.165] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0200.165] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d510) returned 0x0
	[0200.165] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0200.165] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0200.165] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0200.166] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0200.166] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0200.166] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0200.166] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0200.166] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0200.166] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0200.166] OffsetViewportOrgEx (in: hdc=0x18011500, x=0, y=0, lppt=0x27b8448 | out: lppt=0x27b8448) returned 1
	[0200.167] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x18011500) returned 0x0
	[0200.167] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffacf0dbd) returned 0x0
	[0200.167] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0200.167] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0200.174] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0200.175] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x18011500) returned 0x0
	[0200.299] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0202.154] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0202.155] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0202.155] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0202.155] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0202.155] GdipCreateFromHDC (hdc=0x190114fa, graphics=0x20d7e0) returned 0x0
	[0202.155] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0202.155] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0202.156] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0202.156] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.156] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0202.156] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.156] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.156] GdipCreateRegion (region=0x20d910) returned 0x0
	[0202.157] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.157] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0202.157] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0202.157] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffacd0dbd) returned 0x0
	[0202.157] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.157] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0202.158] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190114fa) returned 0x0
	[0202.158] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0202.158] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.158] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.158] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.159] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0202.159] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0202.159] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0202.159] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0202.159] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0202.159] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.160] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0202.160] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0202.160] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0202.160] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0202.160] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.160] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.161] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.161] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0202.161] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.161] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0202.161] GdipCreateRegion (region=0x20d120) returned 0x0
	[0202.161] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.162] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0202.162] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.162] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0202.162] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.162] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.162] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.163] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0202.163] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0202.163] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0202.163] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.163] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0202.163] OffsetViewportOrgEx (in: hdc=0x190114fa, x=0, y=0, lppt=0x27b9298 | out: lppt=0x27b9298) returned 1
	[0202.164] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190114fa) returned 0x0
	[0202.164] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0202.164] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.164] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.164] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.164] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0202.165] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0202.165] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0202.165] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.165] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0202.165] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0202.165] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0202.166] GdipCreateRegion (region=0x20d070) returned 0x0
	[0202.166] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.166] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0202.166] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.166] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0202.166] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.167] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.167] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.167] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0202.167] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0202.167] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0202.168] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.168] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0202.168] OffsetViewportOrgEx (in: hdc=0x190114fa, x=0, y=0, lppt=0x27b9838 | out: lppt=0x27b9838) returned 1
	[0202.168] GetROP2 (hdc=0x190114fa) returned 13
	[0202.168] GetROP2 (hdc=0x190114fa) returned 13
	[0202.168] GetROP2 (hdc=0x190114fa) returned 13
	[0202.169] GetROP2 (hdc=0x190114fa) returned 13
	[0202.169] GetROP2 (hdc=0x190114fa) returned 13
	[0202.169] GetROP2 (hdc=0x190114fa) returned 13
	[0202.169] GetROP2 (hdc=0x190114fa) returned 13
	[0202.169] GetROP2 (hdc=0x190114fa) returned 13
	[0202.169] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190114fa) returned 0x0
	[0202.170] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0202.170] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x190114fa) returned 0x0
	[0202.170] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0202.170] GdipCreateFromHDC (hdc=0x1b0114fa, graphics=0x20d7e0) returned 0x0
	[0202.171] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0202.171] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0202.171] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0202.171] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.171] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0202.171] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.171] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.172] GdipCreateRegion (region=0x20d910) returned 0x0
	[0202.172] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.172] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0202.172] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0202.172] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffaca0dbd) returned 0x0
	[0202.173] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.173] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0202.173] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b0114fa) returned 0x0
	[0202.173] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0202.173] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.173] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.174] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.174] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0202.174] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0202.174] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0202.174] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0202.174] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0202.175] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.175] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0202.175] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0202.175] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0202.175] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0202.176] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.176] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.176] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.176] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0202.176] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.177] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0202.177] GdipCreateRegion (region=0x20d120) returned 0x0
	[0202.177] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.177] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0202.177] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.177] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0202.178] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.178] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.178] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.178] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0202.178] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0202.178] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0202.179] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.179] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0202.179] OffsetViewportOrgEx (in: hdc=0x1b0114fa, x=0, y=0, lppt=0x27ba698 | out: lppt=0x27ba698) returned 1
	[0202.179] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b0114fa) returned 0x0
	[0202.179] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0202.179] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.180] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.180] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.180] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0202.180] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0202.180] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0202.180] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.181] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0202.181] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0202.181] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0202.181] GdipCreateRegion (region=0x20d070) returned 0x0
	[0202.181] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.181] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0202.182] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.182] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0202.182] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.182] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.182] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.182] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0202.182] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0202.183] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0202.183] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.183] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0202.183] OffsetViewportOrgEx (in: hdc=0x1b0114fa, x=0, y=0, lppt=0x27bac38 | out: lppt=0x27bac38) returned 1
	[0202.183] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.183] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.184] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.184] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.184] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.184] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.184] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.184] GetROP2 (hdc=0x1b0114fa) returned 13
	[0202.185] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b0114fa) returned 0x0
	[0202.185] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0202.185] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b0114fa) returned 0x0
	[0202.185] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0202.443] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0202.443] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0202.444] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0202.444] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0202.444] UpdateWindow (hWnd=0x401b4) returned 0
	[0202.444] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0202.444] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0202.444] GdipCreateFromHDC (hdc=0x1d010d19, graphics=0x20cfa0) returned 0x0
	[0202.444] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0202.444] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0202.445] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0202.445] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.445] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0202.445] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.445] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.445] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0202.445] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.446] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0202.446] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0202.446] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffac70dbd) returned 0x0
	[0202.446] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.447] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0202.447] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010d19) returned 0x0
	[0202.447] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0202.447] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.447] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.447] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.448] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0202.448] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0202.448] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0202.448] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0202.448] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0202.448] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.449] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0202.449] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0202.449] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0202.449] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0202.449] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.449] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.450] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.450] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0202.450] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.450] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0202.450] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0202.451] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.451] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0202.451] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.451] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0202.451] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.452] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.452] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.452] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0202.452] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0202.452] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0202.452] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.453] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0202.453] OffsetViewportOrgEx (in: hdc=0x1d010d19, x=0, y=0, lppt=0x27bbbe0 | out: lppt=0x27bbbe0) returned 1
	[0202.453] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010d19) returned 0x0
	[0202.454] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0202.454] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.454] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.454] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.454] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0202.455] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0202.455] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0202.455] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.455] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0202.455] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0202.455] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0202.456] GdipCreateRegion (region=0x20c830) returned 0x0
	[0202.456] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.456] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0202.456] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.456] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0202.457] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.457] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.457] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.457] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0202.457] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0202.457] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0202.458] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.458] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0202.458] OffsetViewportOrgEx (in: hdc=0x1d010d19, x=0, y=0, lppt=0x27bc180 | out: lppt=0x27bc180) returned 1
	[0202.458] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.458] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.458] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.459] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.459] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.459] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.459] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.459] GetROP2 (hdc=0x1d010d19) returned 13
	[0202.459] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010d19) returned 0x0
	[0202.460] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0202.460] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d010d19) returned 0x0
	[0202.460] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0202.460] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0202.460] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0202.460] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0202.460] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0202.460] GetCapture () returned 0x401b4
	[0202.460] ReleaseCapture () 
	[0202.460] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0202.682] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0202.682] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0202.682] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0202.682] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0202.683] GdipCreateFromHDC (hdc=0x1e010d19, graphics=0x20d7e0) returned 0x0
	[0202.683] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0202.683] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0202.683] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0202.683] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.684] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0202.684] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.684] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.684] GdipCreateRegion (region=0x20d910) returned 0x0
	[0202.684] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.684] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0202.685] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0202.685] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffac40dbd) returned 0x0
	[0202.685] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.685] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0202.685] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e010d19) returned 0x0
	[0202.686] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0202.686] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.686] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.686] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.686] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0202.686] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0202.687] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0202.687] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0202.687] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0202.688] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.688] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0202.688] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0202.688] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0202.688] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0202.689] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.689] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.689] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.689] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0202.689] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.690] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0202.690] GdipCreateRegion (region=0x20d120) returned 0x0
	[0202.690] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.690] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0202.690] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.690] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0202.691] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.691] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.691] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.691] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0202.691] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0202.691] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0202.692] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.692] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0202.692] OffsetViewportOrgEx (in: hdc=0x1e010d19, x=0, y=0, lppt=0x27bd0f0 | out: lppt=0x27bd0f0) returned 1
	[0202.692] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e010d19) returned 0x0
	[0202.692] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0202.692] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.693] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.693] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.693] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0202.693] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0202.693] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0202.693] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.694] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0202.694] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0202.694] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0202.694] GdipCreateRegion (region=0x20d070) returned 0x0
	[0202.694] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.694] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0202.695] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.695] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0202.695] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.695] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.695] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.695] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0202.695] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0202.696] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0202.696] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.696] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0202.696] OffsetViewportOrgEx (in: hdc=0x1e010d19, x=0, y=0, lppt=0x27bd690 | out: lppt=0x27bd690) returned 1
	[0202.696] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.696] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.697] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.697] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.697] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.697] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.697] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.698] GetROP2 (hdc=0x1e010d19) returned 13
	[0202.698] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e010d19) returned 0x0
	[0202.698] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0202.698] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e010d19) returned 0x0
	[0202.698] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0202.699] GdipCreateFromHDC (hdc=0x1f010d19, graphics=0x20d7e0) returned 0x0
	[0202.699] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0202.699] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0202.699] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0202.699] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.699] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0202.700] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.700] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.700] GdipCreateRegion (region=0x20d910) returned 0x0
	[0202.700] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.700] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0202.701] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0202.701] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffac10dbd) returned 0x0
	[0202.701] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.701] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0202.701] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f010d19) returned 0x0
	[0202.701] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0202.702] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.702] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.702] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.702] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0202.703] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0202.703] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0202.703] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0202.703] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0202.703] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.703] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0202.704] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0202.704] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0202.704] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0202.704] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.704] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.704] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.705] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0202.705] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.705] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0202.705] GdipCreateRegion (region=0x20d120) returned 0x0
	[0202.705] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.706] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0202.706] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.706] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0202.706] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.706] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.706] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.707] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0202.707] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0202.707] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0202.707] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.707] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0202.707] OffsetViewportOrgEx (in: hdc=0x1f010d19, x=0, y=0, lppt=0x27be4f0 | out: lppt=0x27be4f0) returned 1
	[0202.708] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f010d19) returned 0x0
	[0202.708] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0202.708] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.708] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.708] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.708] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0202.708] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0202.709] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0202.709] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.709] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0202.709] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0202.709] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0202.709] GdipCreateRegion (region=0x20d070) returned 0x0
	[0202.710] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.710] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0202.710] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.710] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0202.710] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.710] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.711] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.711] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0202.711] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0202.711] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0202.711] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.711] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0202.712] OffsetViewportOrgEx (in: hdc=0x1f010d19, x=0, y=0, lppt=0x27bea90 | out: lppt=0x27bea90) returned 1
	[0202.712] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.712] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.712] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.712] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.712] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.713] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.713] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.713] GetROP2 (hdc=0x1f010d19) returned 13
	[0202.713] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f010d19) returned 0x0
	[0202.713] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0202.713] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1f010d19) returned 0x0
	[0202.714] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0202.893] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0202.893] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0202.894] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0202.894] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0202.894] UpdateWindow (hWnd=0x201d8) 
	[0202.894] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0202.894] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0202.894] GdipCreateFromHDC (hdc=0xb011437, graphics=0x20cfa0) returned 0x0
	[0202.894] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0202.894] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0202.894] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0202.895] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.895] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0202.895] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.895] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.895] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0202.895] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.896] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0202.896] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0202.896] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffabe0dbd) returned 0x0
	[0202.896] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.896] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0202.896] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xb011437) returned 0x0
	[0202.897] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0202.897] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.897] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.897] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.897] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0202.898] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0202.898] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0202.898] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0202.898] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0202.898] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.898] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0202.899] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0202.899] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0202.899] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0202.899] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.899] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.899] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.900] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0202.900] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.900] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0202.900] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0202.900] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.900] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0202.901] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0202.901] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0202.901] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.901] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0202.901] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0202.901] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0202.902] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0202.902] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0202.902] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.902] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0202.902] OffsetViewportOrgEx (in: hdc=0xb011437, x=0, y=0, lppt=0x27bfaf8 | out: lppt=0x27bfaf8) returned 1
	[0202.902] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xb011437) returned 0x0
	[0202.903] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0202.903] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.903] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0202.903] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0202.903] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0202.904] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0202.904] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0202.904] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0202.904] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0202.904] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0202.904] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0202.905] GdipCreateRegion (region=0x20c830) returned 0x0
	[0202.905] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0202.918] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0202.918] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0202.918] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0202.918] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.918] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0202.919] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0202.919] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0202.919] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0202.919] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0202.919] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0202.920] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0202.920] OffsetViewportOrgEx (in: hdc=0xb011437, x=0, y=0, lppt=0x27c0098 | out: lppt=0x27c0098) returned 1
	[0202.920] GetROP2 (hdc=0xb011437) returned 13
	[0202.920] GetROP2 (hdc=0xb011437) returned 13
	[0202.920] GetROP2 (hdc=0xb011437) returned 13
	[0202.921] GetROP2 (hdc=0xb011437) returned 13
	[0202.921] GetROP2 (hdc=0xb011437) returned 13
	[0202.921] GetROP2 (hdc=0xb011437) returned 13
	[0202.921] GetROP2 (hdc=0xb011437) returned 13
	[0202.922] GetROP2 (hdc=0xb011437) returned 13
	[0202.922] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xb011437) returned 0x0
	[0202.922] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0202.922] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xb011437) returned 0x0
	[0202.922] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0202.923] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0202.923] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0202.923] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0202.923] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27c03e0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0202.923] ShellExecuteExW (in: pExecInfo=0x27c05f0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x27c05f0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="\xffff\x74\x74\x70\x73\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x72\x6f\x66\x69\x6c\x65\x2e\x70\x68\x70\x3f\x69\x64\x3d\x31\x30\x30\x30\x32\x37\x30\x39\x31\x34\x35\x37\x37\x35\x34", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0202.997] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0202.997] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0202.998] GdipCreateFromHDC (hdc=0x12011437, graphics=0x20c9d0) returned 0x0
	[0202.998] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0203.109] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0203.109] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0203.109] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0203.109] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0203.110] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0203.110] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0203.110] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0203.110] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0203.110] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0203.111] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0203.111] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffabb0dbd) returned 0x0
	[0203.111] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0203.111] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0203.111] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011437) returned 0x0
	[0203.112] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0203.112] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.112] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.112] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0203.112] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0203.112] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0203.113] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0203.113] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0203.113] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0203.113] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0203.113] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0203.114] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0203.114] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0203.114] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0203.114] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0203.114] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.115] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.115] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0203.115] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0203.115] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0203.116] GdipCreateRegion (region=0x20c310) returned 0x0
	[0203.116] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0203.116] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0203.116] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0203.116] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0203.116] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0203.117] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0203.117] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0203.117] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0203.117] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0203.117] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0203.117] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0203.118] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0203.118] OffsetViewportOrgEx (in: hdc=0x12011437, x=0, y=0, lppt=0x27c12d0 | out: lppt=0x27c12d0) returned 1
	[0203.118] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011437) returned 0x0
	[0203.118] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0203.118] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.119] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.119] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0203.119] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0203.119] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0203.119] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0203.120] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0203.120] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0203.120] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0203.120] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0203.120] GdipCreateRegion (region=0x20c260) returned 0x0
	[0203.120] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0203.121] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0203.121] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0203.121] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0203.121] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0203.121] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0203.121] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0203.122] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0203.122] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0203.122] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0203.122] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0203.122] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0203.122] OffsetViewportOrgEx (in: hdc=0x12011437, x=0, y=0, lppt=0x27c1870 | out: lppt=0x27c1870) returned 1
	[0203.123] GetROP2 (hdc=0x12011437) returned 13
	[0203.123] GetROP2 (hdc=0x12011437) returned 13
	[0203.123] GetROP2 (hdc=0x12011437) returned 13
	[0203.123] GetROP2 (hdc=0x12011437) returned 13
	[0203.123] GetROP2 (hdc=0x12011437) returned 13
	[0203.123] GetROP2 (hdc=0x12011437) returned 13
	[0203.124] GetROP2 (hdc=0x12011437) returned 13
	[0203.124] GetROP2 (hdc=0x12011437) returned 13
	[0203.124] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011437) returned 0x0
	[0203.124] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0203.124] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011437) returned 0x0
	[0203.124] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0203.125] GdipCreateFromHDC (hdc=0x14011437, graphics=0x20c9d0) returned 0x0
	[0203.125] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0203.125] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0203.125] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0203.125] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0203.126] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0203.126] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0203.126] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0203.126] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0203.126] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0203.126] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0203.127] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0203.127] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffab80dbd) returned 0x0
	[0203.127] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0203.127] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0203.128] GetNearestColor (hdc=0x14011437, color=0xf0f0f0) returned 0xf0f0f0
	[0203.128] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011437) returned 0x0
	[0203.128] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0203.128] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.129] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.129] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0203.129] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0203.129] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0203.129] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0203.129] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0203.130] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0203.130] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0203.130] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0203.130] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0203.130] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0203.131] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0203.131] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0203.131] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.131] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.131] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0203.132] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0203.132] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0203.132] GdipCreateRegion (region=0x20c310) returned 0x0
	[0203.132] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0203.132] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0203.132] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0203.133] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0203.133] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0203.133] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0203.133] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0203.133] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0203.133] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0203.134] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0203.134] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0203.134] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0203.134] OffsetViewportOrgEx (in: hdc=0x14011437, x=0, y=0, lppt=0x27c26f8 | out: lppt=0x27c26f8) returned 1
	[0203.134] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011437) returned 0x0
	[0203.134] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0203.135] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.135] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0203.135] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0203.135] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0203.135] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0203.135] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0203.136] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0203.136] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0203.136] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0203.136] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0203.136] GdipCreateRegion (region=0x20c260) returned 0x0
	[0203.136] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0203.137] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0203.137] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0203.137] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0203.137] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0203.137] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0203.137] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0203.138] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0203.138] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0203.138] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0203.138] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0203.138] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0203.138] OffsetViewportOrgEx (in: hdc=0x14011437, x=0, y=0, lppt=0x27c2c98 | out: lppt=0x27c2c98) returned 1
	[0203.139] GetROP2 (hdc=0x14011437) returned 13
	[0203.139] GetROP2 (hdc=0x14011437) returned 13
	[0203.139] GetROP2 (hdc=0x14011437) returned 13
	[0203.140] GetROP2 (hdc=0x14011437) returned 13
	[0203.140] GetROP2 (hdc=0x14011437) returned 13
	[0203.140] GetROP2 (hdc=0x14011437) returned 13
	[0203.140] GetROP2 (hdc=0x14011437) returned 13
	[0203.140] GetROP2 (hdc=0x14011437) returned 13
	[0203.141] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011437) returned 0x0
	[0203.141] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0203.141] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011437) returned 0x0
	[0203.141] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0205.238] GdipCreateFromHDC (hdc=0x19011437, graphics=0x20d7e0) returned 0x0
	[0205.238] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0205.239] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0205.239] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0205.239] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0205.239] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0205.239] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0205.239] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0205.240] GdipCreateRegion (region=0x20d910) returned 0x0
	[0205.240] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0205.240] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0205.240] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0205.240] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffab50dbd) returned 0x0
	[0205.240] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0205.241] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0205.241] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19011437) returned 0x0
	[0205.241] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0205.241] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0205.241] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0205.242] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0205.242] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0205.242] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0205.242] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0205.242] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0205.242] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0205.243] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0205.243] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0205.243] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0205.243] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0205.243] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0205.244] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0205.244] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0205.244] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0205.244] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0205.244] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0205.244] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0205.244] GdipCreateRegion (region=0x20d120) returned 0x0
	[0205.245] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0205.245] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0205.245] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0205.245] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0205.246] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0205.246] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0205.246] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0205.246] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0205.246] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0205.246] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0205.246] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0205.247] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0205.247] OffsetViewportOrgEx (in: hdc=0x19011437, x=0, y=0, lppt=0x27c3c28 | out: lppt=0x27c3c28) returned 1
	[0205.247] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19011437) returned 0x0
	[0205.247] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0205.247] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0205.247] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0205.248] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0205.248] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0205.248] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0205.248] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0205.248] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0205.248] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0205.249] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0205.249] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0205.249] GdipCreateRegion (region=0x20d070) returned 0x0
	[0205.249] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0205.249] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0205.249] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0205.250] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0205.250] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0205.250] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0205.250] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0205.250] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0205.250] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0205.251] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0205.251] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0205.251] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0205.251] OffsetViewportOrgEx (in: hdc=0x19011437, x=0, y=0, lppt=0x27c41c8 | out: lppt=0x27c41c8) returned 1
	[0205.251] GetROP2 (hdc=0x19011437) returned 13
	[0205.251] GetROP2 (hdc=0x19011437) returned 13
	[0205.252] GetROP2 (hdc=0x19011437) returned 13
	[0205.252] GetROP2 (hdc=0x19011437) returned 13
	[0205.252] GetROP2 (hdc=0x19011437) returned 13
	[0205.252] GetROP2 (hdc=0x19011437) returned 13
	[0205.252] GetROP2 (hdc=0x19011437) returned 13
	[0205.253] GetROP2 (hdc=0x19011437) returned 13
	[0205.253] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19011437) returned 0x0
	[0205.253] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0205.253] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x19011437) returned 0x0
	[0205.253] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0206.052] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0206.052] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0206.052] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0206.052] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0206.052] GdipCreateFromHDC (hdc=0x2f0114fa, graphics=0x20d7e0) returned 0x0
	[0206.052] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0206.053] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0206.053] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0206.053] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0206.053] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0206.053] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0206.053] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0206.054] GdipCreateRegion (region=0x20d910) returned 0x0
	[0206.054] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.054] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0206.054] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0206.054] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffab20dbd) returned 0x0
	[0206.054] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.055] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0206.055] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0114fa) returned 0x0
	[0206.055] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0206.055] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.055] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.056] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.056] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0206.056] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0206.056] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0206.057] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0206.057] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0206.057] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.057] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0206.057] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0206.058] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0206.058] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0206.058] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.058] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.058] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.058] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0206.058] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.059] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0206.059] GdipCreateRegion (region=0x20d120) returned 0x0
	[0206.059] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.059] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0206.059] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0206.059] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0206.060] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0206.060] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0206.060] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0206.060] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0206.060] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0206.060] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0206.061] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.061] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0206.061] OffsetViewportOrgEx (in: hdc=0x2f0114fa, x=0, y=0, lppt=0x27c50c0 | out: lppt=0x27c50c0) returned 1
	[0206.061] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0114fa) returned 0x0
	[0206.061] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0206.061] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.062] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.062] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.062] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0206.062] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0206.062] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0206.062] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.063] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0206.063] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0206.063] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0206.063] GdipCreateRegion (region=0x20d070) returned 0x0
	[0206.063] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.063] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0206.064] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0206.064] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0206.064] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0206.064] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0206.064] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0206.064] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0206.065] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0206.065] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0206.065] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.065] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0206.065] OffsetViewportOrgEx (in: hdc=0x2f0114fa, x=0, y=0, lppt=0x27c5660 | out: lppt=0x27c5660) returned 1
	[0206.065] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.066] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.066] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.066] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.066] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.066] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.066] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.067] GetROP2 (hdc=0x2f0114fa) returned 13
	[0206.067] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0114fa) returned 0x0
	[0206.067] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0206.067] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2f0114fa) returned 0x0
	[0206.067] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0206.282] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0206.282] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0206.283] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0206.283] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0206.283] UpdateWindow (hWnd=0x201d8) 
	[0206.283] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0206.283] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0206.283] GdipCreateFromHDC (hdc=0xa011546, graphics=0x20cfa0) returned 0x0
	[0206.283] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0206.283] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0206.283] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0206.284] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0206.284] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0206.284] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0206.284] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0206.284] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0206.284] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.285] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0206.285] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0206.285] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffaaf0dbd) returned 0x0
	[0206.285] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.285] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0206.286] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011546) returned 0x0
	[0206.286] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0206.286] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.286] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.286] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.286] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0206.287] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0206.287] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0206.287] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0206.287] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0206.287] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.287] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0206.288] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0206.288] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0206.288] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0206.288] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.288] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.289] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.289] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0206.289] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.289] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0206.289] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0206.289] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.290] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0206.290] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0206.290] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0206.294] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0206.294] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0206.294] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0206.294] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0206.295] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0206.295] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0206.295] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.295] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0206.295] OffsetViewportOrgEx (in: hdc=0xa011546, x=0, y=0, lppt=0x27c6ad8 | out: lppt=0x27c6ad8) returned 1
	[0206.296] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011546) returned 0x0
	[0206.296] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0206.296] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.296] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.296] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.296] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0206.297] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0206.297] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0206.297] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.297] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0206.297] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0206.298] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0206.298] GdipCreateRegion (region=0x20c830) returned 0x0
	[0206.298] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.298] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0206.298] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0206.298] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0206.299] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0206.299] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0206.299] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0206.299] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0206.299] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0206.299] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0206.300] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.300] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0206.300] OffsetViewportOrgEx (in: hdc=0xa011546, x=0, y=0, lppt=0x27c7078 | out: lppt=0x27c7078) returned 1
	[0206.300] GetROP2 (hdc=0xa011546) returned 13
	[0206.300] GetROP2 (hdc=0xa011546) returned 13
	[0206.300] GetROP2 (hdc=0xa011546) returned 13
	[0206.301] GetROP2 (hdc=0xa011546) returned 13
	[0206.301] GetROP2 (hdc=0xa011546) returned 13
	[0206.301] GetROP2 (hdc=0xa011546) returned 13
	[0206.301] GetROP2 (hdc=0xa011546) returned 13
	[0206.301] GetROP2 (hdc=0xa011546) returned 13
	[0206.301] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011546) returned 0x0
	[0206.302] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0206.302] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011546) returned 0x0
	[0206.302] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0206.302] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0206.302] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0206.303] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0206.303] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27c73c0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0206.303] ShellExecuteExW (pExecInfo=0x27c75d0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0206.369] GdipCreateFromHDC (hdc=0xffffffff9e0110e9, graphics=0x20c9d0) returned 0x0
	[0206.370] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0206.370] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0206.370] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0206.370] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0206.370] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0206.371] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0206.371] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0206.371] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0206.371] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.371] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0206.372] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0206.372] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffaac0dbd) returned 0x0
	[0206.372] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.372] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0206.372] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9e0110e9) returned 0x0
	[0206.372] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0206.373] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.373] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.373] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.373] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0206.373] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0206.373] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0206.374] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0206.374] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0206.374] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.374] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0206.374] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0206.374] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0206.375] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0206.375] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.375] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.375] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.375] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0206.375] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.375] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0206.376] GdipCreateRegion (region=0x20c310) returned 0x0
	[0206.376] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.376] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0206.376] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0206.376] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0206.376] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0206.377] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0206.377] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0206.377] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0206.377] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0206.377] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0206.377] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.378] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0206.378] OffsetViewportOrgEx (in: hdc=0xffffffff9e0110e9, x=0, y=0, lppt=0x27c82d8 | out: lppt=0x27c82d8) returned 1
	[0206.378] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9e0110e9) returned 0x0
	[0206.378] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0206.378] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.378] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.379] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.379] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0206.379] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0206.379] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0206.379] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.379] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0206.380] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0206.380] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0206.380] GdipCreateRegion (region=0x20c260) returned 0x0
	[0206.380] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.380] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0206.380] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0206.381] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0206.381] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0206.381] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0206.381] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0206.381] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0206.381] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0206.381] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0206.382] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.382] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0206.382] OffsetViewportOrgEx (in: hdc=0xffffffff9e0110e9, x=0, y=0, lppt=0x27c8878 | out: lppt=0x27c8878) returned 1
	[0206.382] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.382] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.382] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.383] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.383] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.383] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.383] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.383] GetROP2 (hdc=0xffffffff9e0110e9) returned 13
	[0206.383] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9e0110e9) returned 0x0
	[0206.384] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0206.384] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff9e0110e9) returned 0x0
	[0206.384] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0206.570] GdipCreateFromHDC (hdc=0x21011466, graphics=0x20c9d0) returned 0x0
	[0206.570] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0206.570] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0206.571] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0206.571] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0206.571] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0206.571] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0206.571] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0206.572] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0206.572] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.572] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0206.572] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0206.572] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffaa90dbd) returned 0x0
	[0206.573] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.573] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0206.573] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x21011466) returned 0x0
	[0206.573] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0206.573] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.574] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.574] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.574] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0206.574] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0206.574] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0206.575] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0206.575] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0206.575] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.575] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0206.575] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0206.576] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0206.576] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0206.576] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.576] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.576] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.576] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0206.577] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.577] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0206.577] GdipCreateRegion (region=0x20c310) returned 0x0
	[0206.577] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.577] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0206.578] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0206.578] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0206.578] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0206.578] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0206.578] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0206.578] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0206.578] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0206.579] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0206.579] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.579] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0206.579] OffsetViewportOrgEx (in: hdc=0x21011466, x=0, y=0, lppt=0x27c9878 | out: lppt=0x27c9878) returned 1
	[0206.579] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x21011466) returned 0x0
	[0206.580] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0206.580] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.580] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0206.580] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0206.580] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0206.580] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0206.581] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0206.581] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0206.581] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0206.581] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0206.581] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0206.581] GdipCreateRegion (region=0x20c260) returned 0x0
	[0206.582] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0206.582] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0206.582] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0206.582] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0206.582] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0206.582] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0206.583] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0206.583] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0206.583] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0206.583] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0206.583] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0206.584] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0206.584] OffsetViewportOrgEx (in: hdc=0x21011466, x=0, y=0, lppt=0x27c9e18 | out: lppt=0x27c9e18) returned 1
	[0206.584] GetROP2 (hdc=0x21011466) returned 13
	[0206.584] GetROP2 (hdc=0x21011466) returned 13
	[0206.584] GetROP2 (hdc=0x21011466) returned 13
	[0206.585] GetROP2 (hdc=0x21011466) returned 13
	[0206.585] GetROP2 (hdc=0x21011466) returned 13
	[0206.585] GetROP2 (hdc=0x21011466) returned 13
	[0206.585] GetROP2 (hdc=0x21011466) returned 13
	[0206.585] GetROP2 (hdc=0x21011466) returned 13
	[0206.585] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x21011466) returned 0x0
	[0206.586] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0206.586] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x21011466) returned 0x0
	[0206.586] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0208.316] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d770) returned 0x0
	[0208.316] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0208.316] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0208.316] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0208.317] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d6c0) returned 0x0
	[0208.317] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0208.317] GdipCreateRegion (region=0x20d660) returned 0x0
	[0208.317] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0208.317] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d690) returned 0x0
	[0208.317] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0208.318] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d760) returned 0x0
	[0208.318] GdipCreateRegion (region=0x20d630) returned 0x0
	[0208.318] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0208.318] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0208.318] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0208.319] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d690) returned 0x0
	[0208.319] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.319] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0208.319] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6e0) returned 0x0
	[0208.319] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0208.319] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d710) returned 0x0
	[0208.320] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x27ca548 | out: lppt=0x27ca548) returned 1
	[0208.320] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4010280) returned 0x0
	[0208.320] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0208.321] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0208.321] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0208.321] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0208.321] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0208.321] GetDIBits (in: hdc=0x70107fc, hbm=0x120515ee, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0208.321] GetDIBits (in: hdc=0x70107fc, hbm=0x120515ee, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0208.321] GdipCreateFromHDC (hdc=0x170115ec, graphics=0x20d750) returned 0x0
	[0208.322] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0208.322] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0208.322] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0208.323] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0208.323] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0208.323] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0208.323] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0208.323] GdipCreateRegion (region=0x20d910) returned 0x0
	[0208.323] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0208.324] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0208.324] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0208.324] GdipCreateRegion (region=0x20d400) returned 0x0
	[0208.324] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0208.324] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0208.324] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0208.325] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0208.325] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.325] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0208.325] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.325] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0208.325] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0208.325] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0208.326] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0208.326] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0208.326] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0208.326] OffsetViewportOrgEx (in: hdc=0x170115ec, x=0, y=0, lppt=0x27cbdb0 | out: lppt=0x27cbdb0) returned 1
	[0208.326] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170115ec) returned 0x0
	[0208.327] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffaa40dbd) returned 0x0
	[0208.327] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0208.327] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0208.327] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170115ec) returned 0x0
	[0208.327] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0208.327] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0208.328] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0208.328] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.328] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0208.328] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0208.328] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0208.328] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0208.329] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0208.329] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.329] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0208.329] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170115ec) returned 0x0
	[0208.329] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0208.330] GdipCreateFromHDC (hdc=0xb0115da, graphics=0x20d7e0) returned 0x0
	[0208.330] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0208.330] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0208.330] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0208.330] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0208.331] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0208.331] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.331] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0208.331] GdipCreateRegion (region=0x20d910) returned 0x0
	[0208.331] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.331] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0208.332] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0208.332] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffaa20dbd) returned 0x0
	[0208.332] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.332] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0208.332] GdipReleaseDC (graphics=0x1b929550, hdc=0xb0115da) returned 0x0
	[0208.332] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0208.333] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.333] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.333] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.333] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0208.333] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0208.333] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0208.334] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0208.339] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0208.339] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.339] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0208.339] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0208.339] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0208.340] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0208.340] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.340] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.340] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.340] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0208.340] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.341] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0208.341] GdipCreateRegion (region=0x20d120) returned 0x0
	[0208.341] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.341] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0208.341] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0208.341] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0208.342] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.342] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.342] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0208.342] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0208.342] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0208.342] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0208.343] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.343] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0208.343] OffsetViewportOrgEx (in: hdc=0xb0115da, x=0, y=0, lppt=0x27cceb8 | out: lppt=0x27cceb8) returned 1
	[0208.343] GdipReleaseDC (graphics=0x1b929550, hdc=0xb0115da) returned 0x0
	[0208.343] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0208.343] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.344] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.344] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.344] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0208.344] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0208.344] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0208.344] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.345] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0208.345] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0208.345] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0208.345] GdipCreateRegion (region=0x20d070) returned 0x0
	[0208.345] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.345] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0208.346] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0208.346] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0208.346] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.346] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.346] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0208.346] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0208.347] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0208.347] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0208.347] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.347] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0208.347] OffsetViewportOrgEx (in: hdc=0xb0115da, x=0, y=0, lppt=0x27cd458 | out: lppt=0x27cd458) returned 1
	[0208.347] GetROP2 (hdc=0xb0115da) returned 13
	[0208.348] GetROP2 (hdc=0xb0115da) returned 13
	[0208.348] GetROP2 (hdc=0xb0115da) returned 13
	[0208.348] GetROP2 (hdc=0xb0115da) returned 13
	[0208.348] GetROP2 (hdc=0xb0115da) returned 13
	[0208.348] GetROP2 (hdc=0xb0115da) returned 13
	[0208.348] GetROP2 (hdc=0xb0115da) returned 13
	[0208.348] GetROP2 (hdc=0xb0115da) returned 13
	[0208.349] GdipReleaseDC (graphics=0x1b929550, hdc=0xb0115da) returned 0x0
	[0208.349] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0208.349] GdipReleaseDC (graphics=0x1b929550, hdc=0xb0115da) returned 0x0
	[0208.349] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0208.350] GetDIBits (in: hdc=0x48010f97, hbm=0x90515eb, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0208.350] GetDIBits (in: hdc=0x48010f97, hbm=0x90515eb, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0208.350] GdipCreateFromHDC (hdc=0x160115ee, graphics=0x20d800) returned 0x0
	[0208.350] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0208.350] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0208.350] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0208.351] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0208.351] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20da20) returned 0x0
	[0208.351] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.351] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0208.351] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0208.351] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.352] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0208.352] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0208.352] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0208.352] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0208.352] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0208.352] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0208.353] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0208.353] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.353] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0208.353] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.353] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0208.353] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0208.354] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0208.354] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0208.354] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0208.354] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0208.354] OffsetViewportOrgEx (in: hdc=0x160115ee, x=0, y=0, lppt=0x27ced20 | out: lppt=0x27ced20) returned 1
	[0208.355] GdipReleaseDC (graphics=0x1b929550, hdc=0x160115ee) returned 0x0
	[0208.355] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa9f0dbd) returned 0x0
	[0208.355] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.355] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0208.362] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0208.362] GdipReleaseDC (graphics=0x1b929550, hdc=0x160115ee) returned 0x0
	[0208.362] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0208.755] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0208.755] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0208.755] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0208.755] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0208.756] GdipCreateFromHDC (hdc=0xffffffffd50114f7, graphics=0x20d7e0) returned 0x0
	[0208.756] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0208.756] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0208.756] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0208.756] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0208.757] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0208.757] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.757] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0208.757] GdipCreateRegion (region=0x20d910) returned 0x0
	[0208.757] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.757] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0208.758] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0208.758] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa9d0dbd) returned 0x0
	[0208.758] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.758] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0208.758] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd50114f7) returned 0x0
	[0208.758] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0208.759] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.759] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.759] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.759] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0208.759] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0208.759] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0208.760] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0208.760] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0208.760] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.760] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0208.760] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0208.760] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0208.761] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0208.761] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.761] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.761] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.761] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0208.761] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.762] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0208.762] GdipCreateRegion (region=0x20d120) returned 0x0
	[0208.762] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.762] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0208.762] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0208.762] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0208.763] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.763] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.763] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0208.763] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0208.763] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0208.763] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0208.764] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.764] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0208.764] OffsetViewportOrgEx (in: hdc=0xffffffffd50114f7, x=0, y=0, lppt=0x27cfc40 | out: lppt=0x27cfc40) returned 1
	[0208.764] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd50114f7) returned 0x0
	[0208.764] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0208.765] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.765] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.765] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.765] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0208.765] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0208.765] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0208.766] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.766] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0208.766] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0208.766] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0208.766] GdipCreateRegion (region=0x20d070) returned 0x0
	[0208.766] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.767] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0208.767] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0208.767] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0208.767] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.767] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.767] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0208.768] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0208.768] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0208.768] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0208.768] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.768] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0208.769] OffsetViewportOrgEx (in: hdc=0xffffffffd50114f7, x=0, y=0, lppt=0x27d01e0 | out: lppt=0x27d01e0) returned 1
	[0208.769] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.769] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.769] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.769] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.769] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.770] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.770] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.770] GetROP2 (hdc=0xffffffffd50114f7) returned 13
	[0208.770] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd50114f7) returned 0x0
	[0208.770] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0208.770] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd50114f7) returned 0x0
	[0208.771] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0208.771] GdipCreateFromHDC (hdc=0xffffffffd70114f7, graphics=0x20d7e0) returned 0x0
	[0208.771] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0208.771] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0208.772] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0208.772] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0208.772] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0208.772] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.772] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0208.772] GdipCreateRegion (region=0x20d910) returned 0x0
	[0208.773] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.773] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0208.773] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0208.773] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa9a0dbd) returned 0x0
	[0208.773] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.773] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0208.774] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd70114f7) returned 0x0
	[0208.774] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0208.774] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.774] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.774] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.774] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0208.775] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0208.775] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0208.775] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0208.775] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0208.775] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.775] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0208.776] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0208.776] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0208.776] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0208.776] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.776] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.776] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.777] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0208.777] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.777] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0208.777] GdipCreateRegion (region=0x20d120) returned 0x0
	[0208.777] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.777] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0208.778] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0208.778] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0208.778] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.778] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0208.778] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0208.778] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0208.779] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0208.779] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0208.779] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.779] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0208.779] OffsetViewportOrgEx (in: hdc=0xffffffffd70114f7, x=0, y=0, lppt=0x27d1040 | out: lppt=0x27d1040) returned 1
	[0208.779] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd70114f7) returned 0x0
	[0208.780] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0208.780] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.780] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0208.780] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0208.780] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0208.780] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0208.781] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0208.781] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0208.781] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0208.781] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0208.781] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0208.781] GdipCreateRegion (region=0x20d070) returned 0x0
	[0208.782] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0208.782] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0208.782] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0208.782] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0208.782] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.782] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0208.783] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0208.783] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0208.783] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0208.783] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0208.783] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0208.783] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0208.784] OffsetViewportOrgEx (in: hdc=0xffffffffd70114f7, x=0, y=0, lppt=0x27d15e0 | out: lppt=0x27d15e0) returned 1
	[0208.784] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.784] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.784] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.784] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.784] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.785] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.785] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.785] GetROP2 (hdc=0xffffffffd70114f7) returned 13
	[0208.785] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd70114f7) returned 0x0
	[0208.785] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0208.785] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffd70114f7) returned 0x0
	[0208.786] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0209.148] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0209.148] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0209.148] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0209.148] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0209.148] UpdateWindow (hWnd=0x201d8) 
	[0209.149] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0209.149] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0209.149] GdipCreateFromHDC (hdc=0xffffffffe00114f7, graphics=0x20cfa0) returned 0x0
	[0209.149] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0209.149] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0209.149] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0209.149] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0209.150] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0209.150] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0209.150] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0209.150] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0209.150] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.150] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0209.151] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0209.151] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa970dbd) returned 0x0
	[0209.151] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.151] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0209.151] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe00114f7) returned 0x0
	[0209.152] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0209.152] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0209.152] CoTaskMemFree (pv=0x1b067a80) 
	[0209.152] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0209.152] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.152] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.153] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.153] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0209.153] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0209.153] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0209.153] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0209.153] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0209.154] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.154] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0209.154] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0209.154] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0209.154] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0209.154] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.155] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.155] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.155] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0209.155] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.155] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0209.155] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0209.156] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.156] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0209.156] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0209.156] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0209.156] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0209.156] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0209.157] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0209.157] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0209.157] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0209.157] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0209.157] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.157] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0209.158] OffsetViewportOrgEx (in: hdc=0xffffffffe00114f7, x=0, y=0, lppt=0x27d2610 | out: lppt=0x27d2610) returned 1
	[0209.158] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe00114f7) returned 0x0
	[0209.158] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0209.158] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.158] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.158] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.159] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0209.159] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0209.159] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0209.159] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.159] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0209.159] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0209.160] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0209.160] GdipCreateRegion (region=0x20c830) returned 0x0
	[0209.160] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.160] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0209.160] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0209.165] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0209.165] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0209.165] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0209.166] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0209.166] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0209.166] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0209.166] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0209.166] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.166] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0209.167] OffsetViewportOrgEx (in: hdc=0xffffffffe00114f7, x=0, y=0, lppt=0x27d2bb0 | out: lppt=0x27d2bb0) returned 1
	[0209.167] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.167] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.167] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.167] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.167] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.168] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.168] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.168] GetROP2 (hdc=0xffffffffe00114f7) returned 13
	[0209.168] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe00114f7) returned 0x0
	[0209.168] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0209.169] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe00114f7) returned 0x0
	[0209.169] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0209.169] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0209.169] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0209.170] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0209.170] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27d2ef8, Length=0x70 | out: Destination=0x1afe53a0) 
	[0209.170] ShellExecuteExW (pExecInfo=0x27d3108*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0209.225] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0209.225] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0209.226] GdipCreateFromHDC (hdc=0xffffffffe80114f7, graphics=0x20c9d0) returned 0x0
	[0209.226] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0209.226] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0209.226] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0209.226] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0209.227] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0209.227] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0209.227] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0209.227] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0209.227] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.227] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0209.228] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0209.228] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa940dbd) returned 0x0
	[0209.228] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.228] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0209.228] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe80114f7) returned 0x0
	[0209.228] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0209.229] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.229] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.229] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.229] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0209.229] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0209.229] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0209.229] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0209.230] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0209.230] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.230] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0209.230] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0209.230] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0209.230] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0209.231] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.231] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.231] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.231] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0209.231] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.231] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0209.232] GdipCreateRegion (region=0x20c310) returned 0x0
	[0209.232] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.232] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0209.232] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0209.232] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0209.232] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0209.233] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0209.233] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0209.233] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0209.233] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0209.233] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0209.233] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.234] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0209.234] OffsetViewportOrgEx (in: hdc=0xffffffffe80114f7, x=0, y=0, lppt=0x27d3de8 | out: lppt=0x27d3de8) returned 1
	[0209.234] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe80114f7) returned 0x0
	[0209.234] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0209.234] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.235] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.235] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.235] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0209.235] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0209.235] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0209.235] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.236] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0209.236] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0209.236] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0209.236] GdipCreateRegion (region=0x20c260) returned 0x0
	[0209.236] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.236] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0209.237] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0209.237] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0209.237] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0209.237] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0209.237] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0209.237] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0209.238] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0209.238] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0209.238] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.238] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0209.238] OffsetViewportOrgEx (in: hdc=0xffffffffe80114f7, x=0, y=0, lppt=0x27d4388 | out: lppt=0x27d4388) returned 1
	[0209.238] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.287] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.287] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.287] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.287] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.288] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.288] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.288] GetROP2 (hdc=0xffffffffe80114f7) returned 13
	[0209.288] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe80114f7) returned 0x0
	[0209.288] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0209.289] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffe80114f7) returned 0x0
	[0209.289] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0209.289] GdipCreateFromHDC (hdc=0xffffffffea0114f7, graphics=0x20c9d0) returned 0x0
	[0209.289] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0209.289] GdipSetClipRectI (graphics=0x1b929550, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0209.290] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0209.290] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0209.290] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0209.290] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0209.290] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0209.290] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0209.291] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.291] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0209.291] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0209.291] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa910dbd) returned 0x0
	[0209.291] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.292] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0209.292] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffea0114f7) returned 0x0
	[0209.292] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0209.292] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.292] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.292] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.293] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0209.293] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0209.293] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0209.293] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0209.293] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0209.294] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.294] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0209.294] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0209.294] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0209.294] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0209.295] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.295] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.295] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.295] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0209.295] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.296] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0209.296] GdipCreateRegion (region=0x20c310) returned 0x0
	[0209.296] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.296] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0209.296] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0209.297] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0209.297] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0209.297] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0209.297] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0209.297] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0209.298] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0209.298] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0209.298] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.298] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0209.298] OffsetViewportOrgEx (in: hdc=0xffffffffea0114f7, x=0, y=0, lppt=0x27d5210 | out: lppt=0x27d5210) returned 1
	[0209.299] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffea0114f7) returned 0x0
	[0209.299] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0209.299] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.299] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0209.299] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0209.300] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0209.300] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0209.300] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0209.300] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0209.300] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0209.300] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0209.301] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0209.301] GdipCreateRegion (region=0x20c260) returned 0x0
	[0209.301] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0209.301] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0209.301] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0209.302] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0209.302] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0209.302] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0209.302] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0209.302] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0209.302] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0209.302] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0209.303] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0209.303] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0209.303] OffsetViewportOrgEx (in: hdc=0xffffffffea0114f7, x=0, y=0, lppt=0x27d57b0 | out: lppt=0x27d57b0) returned 1
	[0209.303] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.303] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.304] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.304] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.304] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.304] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.304] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.304] GetROP2 (hdc=0xffffffffea0114f7) returned 13
	[0209.305] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffea0114f7) returned 0x0
	[0209.305] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0209.305] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffea0114f7) returned 0x0
	[0209.305] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0210.380] GdipCreateFromHDC (hdc=0x70114f7, graphics=0x20d7e0) returned 0x0
	[0210.380] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0210.380] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0210.380] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0210.381] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0210.381] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0210.381] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0210.381] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0210.381] GdipCreateRegion (region=0x20d910) returned 0x0
	[0210.381] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0210.382] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0210.382] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0210.382] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa8e0dbd) returned 0x0
	[0210.382] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0210.382] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0210.383] GdipReleaseDC (graphics=0x1b929550, hdc=0x70114f7) returned 0x0
	[0210.383] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0210.383] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0210.383] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0210.383] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0210.384] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0210.384] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0210.384] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0210.384] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0210.384] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0210.384] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0210.385] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0210.385] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0210.385] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0210.385] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0210.385] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0210.385] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0210.386] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0210.386] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0210.386] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0210.386] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0210.386] GdipCreateRegion (region=0x20d120) returned 0x0
	[0210.387] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0210.387] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0210.387] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0210.387] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0210.387] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0210.387] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0210.388] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0210.388] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0210.388] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0210.388] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0210.388] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0210.388] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0210.389] OffsetViewportOrgEx (in: hdc=0x70114f7, x=0, y=0, lppt=0x27d6848 | out: lppt=0x27d6848) returned 1
	[0210.389] GdipReleaseDC (graphics=0x1b929550, hdc=0x70114f7) returned 0x0
	[0210.389] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0210.389] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0210.389] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0210.390] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0210.390] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0210.390] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0210.390] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0210.390] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0210.391] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0210.391] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0210.391] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0210.391] GdipCreateRegion (region=0x20d070) returned 0x0
	[0210.391] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0210.391] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0210.392] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0210.392] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0210.392] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0210.392] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0210.392] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0210.392] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0210.393] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0210.393] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0210.393] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0210.394] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0210.394] OffsetViewportOrgEx (in: hdc=0x70114f7, x=0, y=0, lppt=0x27d6de8 | out: lppt=0x27d6de8) returned 1
	[0210.394] GetROP2 (hdc=0x70114f7) returned 13
	[0210.394] GetROP2 (hdc=0x70114f7) returned 13
	[0210.394] GetROP2 (hdc=0x70114f7) returned 13
	[0210.395] GetROP2 (hdc=0x70114f7) returned 13
	[0210.395] GetROP2 (hdc=0x70114f7) returned 13
	[0210.395] GetROP2 (hdc=0x70114f7) returned 13
	[0210.395] GetROP2 (hdc=0x70114f7) returned 13
	[0210.395] GetROP2 (hdc=0x70114f7) returned 13
	[0210.395] GdipReleaseDC (graphics=0x1b929550, hdc=0x70114f7) returned 0x0
	[0210.396] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0210.396] GdipReleaseDC (graphics=0x1b929550, hdc=0x70114f7) returned 0x0
	[0210.396] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0211.883] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0211.883] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x1afe53a0
	[0211.883] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0211.883] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0211.883] GdipCreateFromHDC (hdc=0x140115f1, graphics=0x20d7e0) returned 0x0
	[0211.883] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0211.883] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0211.884] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0211.884] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0211.884] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0211.884] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0211.884] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0211.884] GdipCreateRegion (region=0x20d910) returned 0x0
	[0211.885] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0211.885] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0211.885] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0211.885] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa8b0dbd) returned 0x0
	[0211.885] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0211.886] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0211.886] GdipReleaseDC (graphics=0x1b929550, hdc=0x140115f1) returned 0x0
	[0211.886] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0211.886] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.886] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.886] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0211.887] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0211.887] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0211.887] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0211.887] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0211.887] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0211.887] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0211.888] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0211.888] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0211.888] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0211.888] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0211.888] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0211.888] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.889] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.889] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0211.889] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0211.889] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0211.889] GdipCreateRegion (region=0x20d120) returned 0x0
	[0211.890] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0211.890] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0211.890] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0211.890] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0211.890] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0211.891] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0211.891] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0211.891] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0211.892] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0211.892] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0211.892] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0211.892] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0211.892] OffsetViewportOrgEx (in: hdc=0x140115f1, x=0, y=0, lppt=0x27d7ce0 | out: lppt=0x27d7ce0) returned 1
	[0211.893] GdipReleaseDC (graphics=0x1b929550, hdc=0x140115f1) returned 0x0
	[0211.893] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0211.893] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.893] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.893] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0211.894] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0211.894] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0211.894] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0211.894] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0211.894] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0211.894] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0211.895] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0211.895] GdipCreateRegion (region=0x20d070) returned 0x0
	[0211.895] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0211.895] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0211.895] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0211.895] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0211.896] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0211.896] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0211.896] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0211.896] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0211.896] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0211.896] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0211.897] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0211.897] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0211.897] OffsetViewportOrgEx (in: hdc=0x140115f1, x=0, y=0, lppt=0x27d8280 | out: lppt=0x27d8280) returned 1
	[0211.897] GetROP2 (hdc=0x140115f1) returned 13
	[0211.897] GetROP2 (hdc=0x140115f1) returned 13
	[0211.897] GetROP2 (hdc=0x140115f1) returned 13
	[0211.898] GetROP2 (hdc=0x140115f1) returned 13
	[0211.898] GetROP2 (hdc=0x140115f1) returned 13
	[0211.898] GetROP2 (hdc=0x140115f1) returned 13
	[0211.898] GetROP2 (hdc=0x140115f1) returned 13
	[0211.898] GetROP2 (hdc=0x140115f1) returned 13
	[0211.898] GdipReleaseDC (graphics=0x1b929550, hdc=0x140115f1) returned 0x0
	[0211.899] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0211.899] GdipReleaseDC (graphics=0x1b929550, hdc=0x140115f1) returned 0x0
	[0211.899] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0211.948] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0211.948] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0211.948] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0211.948] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0211.948] UpdateWindow (hWnd=0x201d8) returned 0
	[0211.948] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0211.948] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0211.949] GdipCreateFromHDC (hdc=0x210115f1, graphics=0x20cfa0) returned 0x0
	[0211.949] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0211.949] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0211.949] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0211.949] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0211.949] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0211.950] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0211.950] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0211.950] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0211.950] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0211.950] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0211.951] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0211.951] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa880dbd) returned 0x0
	[0211.951] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0211.951] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0211.951] GdipReleaseDC (graphics=0x1b929550, hdc=0x210115f1) returned 0x0
	[0211.952] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0211.952] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.952] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.952] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0211.952] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0211.952] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0211.952] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0211.953] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0211.953] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0211.953] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0211.953] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0211.954] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0211.954] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0211.954] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0211.954] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0211.954] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.955] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.955] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0211.955] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0211.955] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0211.955] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0211.955] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0211.956] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0211.956] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0211.956] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0211.957] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0211.957] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0211.957] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0211.957] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0211.957] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0211.957] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0211.958] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0211.958] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0211.958] OffsetViewportOrgEx (in: hdc=0x210115f1, x=0, y=0, lppt=0x27d9240 | out: lppt=0x27d9240) returned 1
	[0211.958] GdipReleaseDC (graphics=0x1b929550, hdc=0x210115f1) returned 0x0
	[0211.958] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0211.959] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.959] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0211.959] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0211.959] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0211.959] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0211.960] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0211.960] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0211.960] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0211.960] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0211.960] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0211.960] GdipCreateRegion (region=0x20c830) returned 0x0
	[0211.961] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0211.961] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0211.961] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0211.961] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0211.961] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0211.961] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0211.962] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0211.962] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0211.962] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0211.962] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0211.962] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0211.962] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0211.963] OffsetViewportOrgEx (in: hdc=0x210115f1, x=0, y=0, lppt=0x27d97e0 | out: lppt=0x27d97e0) returned 1
	[0211.963] GetROP2 (hdc=0x210115f1) returned 13
	[0211.963] GetROP2 (hdc=0x210115f1) returned 13
	[0211.963] GetROP2 (hdc=0x210115f1) returned 13
	[0211.963] GetROP2 (hdc=0x210115f1) returned 13
	[0211.963] GetROP2 (hdc=0x210115f1) returned 13
	[0211.964] GetROP2 (hdc=0x210115f1) returned 13
	[0211.964] GetROP2 (hdc=0x210115f1) returned 13
	[0211.964] GetROP2 (hdc=0x210115f1) returned 13
	[0211.964] GdipReleaseDC (graphics=0x1b929550, hdc=0x210115f1) returned 0x0
	[0211.964] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0211.964] GdipReleaseDC (graphics=0x1b929550, hdc=0x210115f1) returned 0x0
	[0211.965] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0211.965] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0211.965] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0211.966] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0211.966] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27d9b28, Length=0x70 | out: Destination=0x1afe53a0) 
	[0211.966] ShellExecuteExW (in: pExecInfo=0x27d9d38*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x27d9d38*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0212.363] GdipCreateFromHDC (hdc=0x22011646, graphics=0x20c9d0) returned 0x0
	[0212.364] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0212.364] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0212.365] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0212.365] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0212.365] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0212.365] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0212.365] LocalFree (hMem=0x1b07c740) returned 0x0
	[0212.365] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0212.366] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0212.366] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0212.366] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0212.366] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0212.366] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa850dbd) returned 0x0
	[0212.366] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0212.367] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0212.367] GetNearestColor (hdc=0x22011646, color=0xa0a0a0) returned 0xa0a0a0
	[0212.367] GetNearestColor (hdc=0x22011646, color=0x696969) returned 0x696969
	[0212.368] GetNearestColor (hdc=0x22011646, color=0xa0a0a0) returned 0xa0a0a0
	[0212.368] GetNearestColor (hdc=0x22011646, color=0x0) returned 0x0
	[0212.368] GetNearestColor (hdc=0x22011646, color=0xffffff) returned 0xffffff
	[0212.369] GetNearestColor (hdc=0x22011646, color=0xe5e5e5) returned 0xe5e5e5
	[0212.369] GetNearestColor (hdc=0x22011646, color=0xd8d8d8) returned 0xd8d8d8
	[0212.369] GetNearestColor (hdc=0x22011646, color=0x0) returned 0x0
	[0212.369] RestoreDC (hdc=0x22011646, nSavedDC=-1) returned 1
	[0212.369] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011646) returned 0x0
	[0212.370] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0212.370] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0212.370] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0212.370] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0212.370] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0212.370] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0212.370] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0212.371] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0212.371] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0212.371] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0212.371] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0212.371] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0212.372] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0212.372] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0212.372] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0212.372] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0212.372] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0212.372] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0212.372] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0212.373] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0212.373] GdipCreateRegion (region=0x20c310) returned 0x0
	[0212.373] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0212.373] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0212.373] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0212.374] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0212.374] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0212.374] LocalFree (hMem=0x1b07c740) returned 0x0
	[0212.374] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0212.375] LocalFree (hMem=0x1b07c740) returned 0x0
	[0212.375] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0212.375] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0212.375] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0212.375] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0212.375] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0212.376] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0212.377] SaveDC (hdc=0x22011646) returned 1
	[0212.377] OffsetViewportOrgEx (in: hdc=0x22011646, x=0, y=0, lppt=0x27daab8 | out: lppt=0x27daab8) returned 1
	[0212.378] CreateSolidBrush (color=0xf0f0f0) returned 0x291007c0
	[0212.378] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011646) returned 0x0
	[0212.378] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0212.378] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0212.378] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0212.379] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0212.379] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0212.379] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0212.379] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0212.380] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0212.380] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0212.380] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0212.380] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0212.380] GdipCreateRegion (region=0x20c260) returned 0x0
	[0212.381] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0212.381] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0212.381] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0212.381] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0212.381] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0212.381] LocalFree (hMem=0x1b07c740) returned 0x0
	[0212.382] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0212.382] LocalFree (hMem=0x1b07c740) returned 0x0
	[0212.382] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0212.382] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0212.382] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0212.382] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0212.383] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0212.383] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0212.383] OffsetViewportOrgEx (in: hdc=0x22011646, x=0, y=0, lppt=0x27db058 | out: lppt=0x27db058) returned 1
	[0212.383] GetROP2 (hdc=0x22011646) returned 13
	[0212.383] GetROP2 (hdc=0x22011646) returned 13
	[0212.383] GetROP2 (hdc=0x22011646) returned 13
	[0212.384] GetROP2 (hdc=0x22011646) returned 13
	[0212.384] GetROP2 (hdc=0x22011646) returned 13
	[0212.384] GetROP2 (hdc=0x22011646) returned 13
	[0212.384] GetROP2 (hdc=0x22011646) returned 13
	[0212.384] GetROP2 (hdc=0x22011646) returned 13
	[0212.384] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011646) returned 0x0
	[0212.385] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0212.385] GdipReleaseDC (graphics=0x1b929550, hdc=0x22011646) returned 0x0
	[0212.385] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0213.488] CoTaskMemFree (pv=0x1b065c50) 
	[0213.488] GetClientRect (in: hWnd=0x50120, lpRect=0x20dba0 | out: lpRect=0x20dba0) returned 1
	[0213.488] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0213.489] GdipCreateFromHDC (hdc=0x48010f97, graphics=0x20d770) returned 0x0
	[0213.489] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0213.489] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0213.489] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0213.489] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d6c0) returned 0x0
	[0213.490] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0213.490] GdipCreateRegion (region=0x20d660) returned 0x0
	[0213.490] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0213.490] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0213.490] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0213.490] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0213.491] GdipCreateRegion (region=0x20d630) returned 0x0
	[0213.491] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0213.491] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0213.491] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0213.491] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d690) returned 0x0
	[0213.491] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0213.492] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.492] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0213.492] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0213.492] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0213.492] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0213.492] OffsetViewportOrgEx (in: hdc=0x48010f97, x=0, y=0, lppt=0x27db800 | out: lppt=0x27db800) returned 1
	[0213.493] CreateSolidBrush (color=0xf0f0f0) returned 0x2a1007c0
	[0213.493] GdipReleaseDC (graphics=0x1b929550, hdc=0x48010f97) returned 0x0
	[0213.493] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0213.494] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0213.495] GetDIBits (in: hdc=0x10107f8, hbm=0x1705166c, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0213.495] GetDIBits (in: hdc=0x10107f8, hbm=0x1705166c, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0213.495] DeleteObject (ho=0x1705166c) returned 1
	[0213.496] CreateDIBSection (in: hdc=0x10107f8, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x4051667
	[0213.496] SelectObject (hdc=0x1c011670, h=0x4051667) returned 0x185000f
	[0213.496] GdipCreateFromHDC (hdc=0x1c011670, graphics=0x20d750) returned 0x0
	[0213.496] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0213.496] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0213.496] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0213.497] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0213.497] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0213.497] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0213.497] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.498] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0213.498] GdipCreateRegion (region=0x20d910) returned 0x0
	[0213.498] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0213.498] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0213.498] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0213.498] CoTaskMemFree (pv=0x1b07f5c0) 
	[0213.499] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0213.499] GdipCreateRegion (region=0x20d400) returned 0x0
	[0213.499] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0213.499] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0213.499] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0213.499] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d460) returned 0x0
	[0213.499] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0213.500] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.500] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0213.500] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0213.500] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.500] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0213.500] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0213.501] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0213.501] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0213.501] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0213.501] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0213.501] OffsetViewportOrgEx (in: hdc=0x1c011670, x=0, y=0, lppt=0x27dd048 | out: lppt=0x27dd048) returned 1
	[0213.502] CreateSolidBrush (color=0x0) returned 0x2b1007c0
	[0213.502] GdipReleaseDC (graphics=0x1b929550, hdc=0x1c011670) returned 0x0
	[0213.502] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa800dbd) returned 0x0
	[0213.502] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0213.502] CoTaskMemFree (pv=0x1b07f5c0) 
	[0213.502] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0213.503] GetNearestColor (hdc=0x1c011670, color=0x80) returned 0x80
	[0213.503] RestoreDC (hdc=0x1c011670, nSavedDC=-1) returned 1
	[0213.503] GdipReleaseDC (graphics=0x1b929550, hdc=0x1c011670) returned 0x0
	[0213.503] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0213.503] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0213.504] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0213.504] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0213.504] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0213.504] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0213.504] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0213.504] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0213.505] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0213.505] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0213.505] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0213.505] GdipReleaseDC (graphics=0x1b929550, hdc=0x1c011670) returned 0x0
	[0213.506] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0213.506] GdipCreateFromHDC (hdc=0x270108fb, graphics=0x20d7e0) returned 0x0
	[0213.506] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0213.507] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0213.507] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0213.507] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0213.507] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0213.507] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0213.508] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.508] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0213.508] GdipCreateRegion (region=0x20d910) returned 0x0
	[0213.508] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0213.508] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0213.509] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0213.509] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa7e0dbd) returned 0x0
	[0213.509] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0213.509] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0213.510] GetNearestColor (hdc=0x270108fb, color=0xa0a0a0) returned 0xa0a0a0
	[0213.510] GetNearestColor (hdc=0x270108fb, color=0x696969) returned 0x696969
	[0213.510] GetNearestColor (hdc=0x270108fb, color=0xa0a0a0) returned 0xa0a0a0
	[0213.510] GetNearestColor (hdc=0x270108fb, color=0x0) returned 0x0
	[0213.511] GetNearestColor (hdc=0x270108fb, color=0xffffff) returned 0xffffff
	[0213.511] GetNearestColor (hdc=0x270108fb, color=0xe5e5e5) returned 0xe5e5e5
	[0213.511] GetNearestColor (hdc=0x270108fb, color=0xd8d8d8) returned 0xd8d8d8
	[0213.511] GetNearestColor (hdc=0x270108fb, color=0x0) returned 0x0
	[0213.511] RestoreDC (hdc=0x270108fb, nSavedDC=-1) returned 1
	[0213.512] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x270108fb) returned 0x0
	[0213.512] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0213.512] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0213.512] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0213.512] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0213.512] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0213.513] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0213.513] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0213.513] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0213.513] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0213.514] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0213.514] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0213.514] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0213.514] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0213.514] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0213.514] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0213.515] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0213.515] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0213.515] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0213.515] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0213.515] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0213.516] GdipCreateRegion (region=0x20d120) returned 0x0
	[0213.516] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0213.516] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0213.516] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0213.516] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0213.516] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0213.517] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.517] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0213.517] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.517] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0213.517] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0213.517] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0213.518] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0213.518] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0213.518] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0213.518] OffsetViewportOrgEx (in: hdc=0x270108fb, x=0, y=0, lppt=0x27de138 | out: lppt=0x27de138) returned 1
	[0213.518] CreateSolidBrush (color=0xf0f0f0) returned 0x2c1007c0
	[0213.519] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x270108fb) returned 0x0
	[0213.519] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0213.519] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0213.519] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0213.519] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0213.520] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0213.520] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0213.520] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0213.520] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0213.520] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0213.520] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0213.521] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0213.521] GdipCreateRegion (region=0x20d070) returned 0x0
	[0213.521] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0213.521] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0213.521] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0213.522] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0213.522] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0213.522] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.522] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0213.522] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.522] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0213.523] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0213.523] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0213.523] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0213.523] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0213.523] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0213.523] OffsetViewportOrgEx (in: hdc=0x270108fb, x=0, y=0, lppt=0x27de6d8 | out: lppt=0x27de6d8) returned 1
	[0213.524] GetROP2 (hdc=0x270108fb) returned 13
	[0213.524] GetROP2 (hdc=0x270108fb) returned 13
	[0213.524] GetROP2 (hdc=0x270108fb) returned 13
	[0213.524] GetROP2 (hdc=0x270108fb) returned 13
	[0213.524] GetROP2 (hdc=0x270108fb) returned 13
	[0213.524] GetROP2 (hdc=0x270108fb) returned 13
	[0213.525] GetROP2 (hdc=0x270108fb) returned 13
	[0213.525] GetROP2 (hdc=0x270108fb) returned 13
	[0213.525] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x270108fb) returned 0x0
	[0213.525] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0213.525] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x270108fb) returned 0x0
	[0213.525] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0213.526] GetDIBits (in: hdc=0x4010280, hbm=0x1b0508f9, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0213.526] GetDIBits (in: hdc=0x4010280, hbm=0x1b0508f9, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0213.526] DeleteObject (ho=0x1b0508f9) returned 1
	[0213.526] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0x5051667
	[0213.526] SelectObject (hdc=0x1b01166c, h=0x5051667) returned 0x185000f
	[0213.526] GdipCreateFromHDC (hdc=0x1b01166c, graphics=0x20d800) returned 0x0
	[0213.527] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0213.527] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0213.527] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0213.527] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0213.527] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20da20) returned 0x0
	[0213.527] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0213.528] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.528] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0213.528] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0213.528] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0213.528] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0213.528] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0213.529] CoTaskMemFree (pv=0x1b078870) 
	[0213.529] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0213.529] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0213.530] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0213.530] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0213.530] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0213.530] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0213.530] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0213.530] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.531] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0213.531] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0213.531] LocalFree (hMem=0x1b07c780) returned 0x0
	[0213.531] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0213.531] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0213.531] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0213.532] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0213.532] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0213.532] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0213.532] OffsetViewportOrgEx (in: hdc=0x1b01166c, x=0, y=0, lppt=0x27dffa0 | out: lppt=0x27dffa0) returned 1
	[0213.532] CreateSolidBrush (color=0xf0f0f0) returned 0x2d1007c0
	[0213.533] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b01166c) returned 0x0
	[0213.533] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa7b0dbd) returned 0x0
	[0213.533] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0213.533] CoTaskMemFree (pv=0x1b078870) 
	[0213.533] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0213.540] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0213.540] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b01166c) returned 0x0
	[0213.540] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.066] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0215.066] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0215.066] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0215.066] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0215.066] UpdateWindow (hWnd=0x201d8) returned 0
	[0215.066] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0215.066] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0215.067] GdipCreateFromHDC (hdc=0x4b0112ec, graphics=0x20cfa0) returned 0x0
	[0215.067] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.067] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0215.067] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0215.067] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.068] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0215.068] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0215.068] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.068] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.068] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0215.068] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.069] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0215.069] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0215.069] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa790dbd) returned 0x0
	[0215.069] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.070] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0215.070] GetNearestColor (hdc=0x4b0112ec, color=0xa0a0a0) returned 0xa0a0a0
	[0215.070] GetNearestColor (hdc=0x4b0112ec, color=0x696969) returned 0x696969
	[0215.071] GetNearestColor (hdc=0x4b0112ec, color=0xa0a0a0) returned 0xa0a0a0
	[0215.071] GetNearestColor (hdc=0x4b0112ec, color=0x0) returned 0x0
	[0215.071] GetNearestColor (hdc=0x4b0112ec, color=0xffffff) returned 0xffffff
	[0215.071] GetNearestColor (hdc=0x4b0112ec, color=0xe5e5e5) returned 0xe5e5e5
	[0215.072] GetNearestColor (hdc=0x4b0112ec, color=0xd8d8d8) returned 0xd8d8d8
	[0215.072] GetNearestColor (hdc=0x4b0112ec, color=0x0) returned 0x0
	[0215.072] RestoreDC (hdc=0x4b0112ec, nSavedDC=-1) returned 1
	[0215.072] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4b0112ec) returned 0x0
	[0215.072] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0215.072] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.073] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.073] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.073] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0215.073] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0215.073] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0215.074] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0215.074] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0215.074] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.074] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0215.074] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0215.074] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0215.075] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0215.075] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.075] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.075] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.075] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0215.075] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.076] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0215.076] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0215.076] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.076] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0215.076] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.077] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0215.077] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0215.077] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.077] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0215.077] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.077] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.077] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0215.078] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0215.078] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0215.078] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.078] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0215.078] GetCurrentObject (hdc=0x4b0112ec, type=0x1) returned 0x1b00017
	[0215.079] OffsetViewportOrgEx (in: hdc=0x4b0112ec, x=0, y=0, lppt=0x27e21e8 | out: lppt=0x27e21e8) returned 1
	[0215.079] CreateSolidBrush (color=0xf0f0f0) returned 0x2e1007c0
	[0215.079] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4b0112ec) returned 0x0
	[0215.079] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0215.079] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.079] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.080] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.080] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0215.080] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0215.080] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0215.080] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.080] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0215.081] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0215.081] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0215.081] GdipCreateRegion (region=0x20c830) returned 0x0
	[0215.081] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.081] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0215.082] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.082] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0215.082] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0215.082] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.082] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0215.082] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.083] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.083] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0215.083] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0215.083] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0215.083] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.083] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0215.083] OffsetViewportOrgEx (in: hdc=0x4b0112ec, x=0, y=0, lppt=0x27e2788 | out: lppt=0x27e2788) returned 1
	[0215.084] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.084] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.084] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.084] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.084] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.085] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.085] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.085] GetROP2 (hdc=0x4b0112ec) returned 13
	[0215.085] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4b0112ec) returned 0x0
	[0215.085] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0215.085] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4b0112ec) returned 0x0
	[0215.086] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.086] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0215.086] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0215.087] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0215.087] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27e2ad0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0215.087] ShellExecuteExW (pExecInfo=0x27e2ce0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0215.245] GdipCreateFromHDC (hdc=0x540115da, graphics=0x20c9d0) returned 0x0
	[0215.246] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.246] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0215.247] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0215.247] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.247] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0215.247] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0215.247] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.247] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.248] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0215.248] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.248] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0215.248] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0215.248] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa760dbd) returned 0x0
	[0215.248] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.249] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0215.249] GetNearestColor (hdc=0x540115da, color=0xa0a0a0) returned 0xa0a0a0
	[0215.249] GetNearestColor (hdc=0x540115da, color=0x696969) returned 0x696969
	[0215.250] GetNearestColor (hdc=0x540115da, color=0xa0a0a0) returned 0xa0a0a0
	[0215.250] GetNearestColor (hdc=0x540115da, color=0x0) returned 0x0
	[0215.250] GetNearestColor (hdc=0x540115da, color=0xffffff) returned 0xffffff
	[0215.250] GetNearestColor (hdc=0x540115da, color=0xe5e5e5) returned 0xe5e5e5
	[0215.251] GetNearestColor (hdc=0x540115da, color=0xd8d8d8) returned 0xd8d8d8
	[0215.251] GetNearestColor (hdc=0x540115da, color=0x0) returned 0x0
	[0215.251] RestoreDC (hdc=0x540115da, nSavedDC=-1) returned 1
	[0215.251] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x540115da) returned 0x0
	[0215.251] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0215.252] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.252] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.252] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.252] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0215.252] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0215.252] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0215.253] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0215.253] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0215.253] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.253] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0215.253] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0215.254] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0215.254] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0215.254] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.254] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.254] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.254] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0215.255] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.255] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0215.255] GdipCreateRegion (region=0x20c310) returned 0x0
	[0215.255] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.255] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0215.256] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.256] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0215.256] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0215.256] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.256] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0215.257] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.257] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.257] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0215.257] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0215.257] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0215.258] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.258] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0215.258] OffsetViewportOrgEx (in: hdc=0x540115da, x=0, y=0, lppt=0x27e39b0 | out: lppt=0x27e39b0) returned 1
	[0215.258] CreateSolidBrush (color=0xf0f0f0) returned 0x2f1007c0
	[0215.258] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x540115da) returned 0x0
	[0215.259] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0215.259] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.259] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.259] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.259] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0215.260] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0215.260] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0215.260] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.260] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0215.262] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0215.262] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0215.262] GdipCreateRegion (region=0x20c260) returned 0x0
	[0215.263] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.263] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0215.263] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.263] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0215.263] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0215.264] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.264] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0215.264] LocalFree (hMem=0x1b07c780) returned 0x0
	[0215.264] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.264] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0215.264] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0215.265] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0215.265] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.265] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0215.265] OffsetViewportOrgEx (in: hdc=0x540115da, x=0, y=0, lppt=0x27e3f50 | out: lppt=0x27e3f50) returned 1
	[0215.265] GetROP2 (hdc=0x540115da) returned 13
	[0215.266] GetROP2 (hdc=0x540115da) returned 13
	[0215.266] GetROP2 (hdc=0x540115da) returned 13
	[0215.266] GetROP2 (hdc=0x540115da) returned 13
	[0215.266] GetROP2 (hdc=0x540115da) returned 13
	[0215.266] GetROP2 (hdc=0x540115da) returned 13
	[0215.267] GetROP2 (hdc=0x540115da) returned 13
	[0215.267] GetROP2 (hdc=0x540115da) returned 13
	[0215.267] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x540115da) returned 0x0
	[0215.267] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0215.267] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x540115da) returned 0x0
	[0215.268] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.319] GdipCreateFromHDC (hdc=0x7e0115da, graphics=0x20c9d0) returned 0x0
	[0215.319] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.319] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0215.319] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0215.319] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.320] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0215.320] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.320] LocalFree (hMem=0x1b07c740) returned 0x0
	[0215.320] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.321] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0215.321] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.321] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0215.321] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0215.321] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa730dbd) returned 0x0
	[0215.322] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.322] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0215.323] GetNearestColor (hdc=0x7e0115da, color=0xa0a0a0) returned 0xa0a0a0
	[0215.323] GetNearestColor (hdc=0x7e0115da, color=0x696969) returned 0x696969
	[0215.323] GetNearestColor (hdc=0x7e0115da, color=0xa0a0a0) returned 0xa0a0a0
	[0215.323] GetNearestColor (hdc=0x7e0115da, color=0x0) returned 0x0
	[0215.324] GetNearestColor (hdc=0x7e0115da, color=0xffffff) returned 0xffffff
	[0215.324] GetNearestColor (hdc=0x7e0115da, color=0xe5e5e5) returned 0xe5e5e5
	[0215.324] GetNearestColor (hdc=0x7e0115da, color=0xd8d8d8) returned 0xd8d8d8
	[0215.324] GetNearestColor (hdc=0x7e0115da, color=0x0) returned 0x0
	[0215.325] RestoreDC (hdc=0x7e0115da, nSavedDC=-1) returned 1
	[0215.325] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7e0115da) returned 0x0
	[0215.325] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0215.325] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.326] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.326] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.326] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0215.326] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0215.326] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0215.326] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0215.327] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0215.327] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.327] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0215.327] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0215.327] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0215.328] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0215.328] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.328] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.328] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.328] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0215.329] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.329] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0215.329] GdipCreateRegion (region=0x20c310) returned 0x0
	[0215.329] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.329] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0215.330] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.330] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0215.330] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0215.330] LocalFree (hMem=0x1b07c740) returned 0x0
	[0215.330] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0215.331] LocalFree (hMem=0x1b07c740) returned 0x0
	[0215.331] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.331] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0215.331] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0215.331] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0215.331] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.332] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0215.332] OffsetViewportOrgEx (in: hdc=0x7e0115da, x=0, y=0, lppt=0x27e4de8 | out: lppt=0x27e4de8) returned 1
	[0215.332] CreateSolidBrush (color=0xf0f0f0) returned 0x301007c0
	[0215.332] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7e0115da) returned 0x0
	[0215.333] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0215.333] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.333] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.333] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.333] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0215.333] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0215.334] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0215.334] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.334] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0215.334] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0215.334] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0215.335] GdipCreateRegion (region=0x20c260) returned 0x0
	[0215.335] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.335] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0215.335] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.336] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0215.336] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.336] LocalFree (hMem=0x1b07c740) returned 0x0
	[0215.336] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.336] LocalFree (hMem=0x1b07c740) returned 0x0
	[0215.337] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.337] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0215.337] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0215.337] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0215.337] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.338] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0215.338] OffsetViewportOrgEx (in: hdc=0x7e0115da, x=0, y=0, lppt=0x27e5388 | out: lppt=0x27e5388) returned 1
	[0215.338] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.338] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.339] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.339] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.339] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.339] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.339] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.340] GetROP2 (hdc=0x7e0115da) returned 13
	[0215.340] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7e0115da) returned 0x0
	[0215.340] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0215.340] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7e0115da) returned 0x0
	[0215.340] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.482] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0215.482] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0215.482] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0215.482] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0215.483] GdipCreateFromHDC (hdc=0x160116bb, graphics=0x20c9d0) returned 0x0
	[0215.483] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.483] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0215.483] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0215.483] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.483] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0215.484] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0215.484] LocalFree (hMem=0x1b07c740) returned 0x0
	[0215.484] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.484] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0215.484] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.484] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0215.485] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0215.485] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa700dbd) returned 0x0
	[0215.485] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.485] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0215.486] GetNearestColor (hdc=0x160116bb, color=0xa0a0a0) returned 0xa0a0a0
	[0215.486] GetNearestColor (hdc=0x160116bb, color=0x696969) returned 0x696969
	[0215.486] GetNearestColor (hdc=0x160116bb, color=0xa0a0a0) returned 0xa0a0a0
	[0215.486] GetNearestColor (hdc=0x160116bb, color=0x0) returned 0x0
	[0215.487] GetNearestColor (hdc=0x160116bb, color=0xffffff) returned 0xffffff
	[0215.487] GetNearestColor (hdc=0x160116bb, color=0xe5e5e5) returned 0xe5e5e5
	[0215.487] GetNearestColor (hdc=0x160116bb, color=0xd8d8d8) returned 0xd8d8d8
	[0215.487] GetNearestColor (hdc=0x160116bb, color=0x0) returned 0x0
	[0215.487] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x160116bb) returned 0x0
	[0215.488] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0215.488] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.488] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.488] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.488] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0215.488] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0215.489] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0215.489] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0215.489] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0215.489] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.489] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0215.489] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0215.490] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0215.490] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0215.490] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.490] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.490] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.490] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0215.491] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.491] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0215.491] GdipCreateRegion (region=0x20c310) returned 0x0
	[0215.491] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.491] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0215.492] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.492] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0215.492] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.492] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.492] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.492] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0215.493] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0215.493] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0215.493] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.493] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0215.493] OffsetViewportOrgEx (in: hdc=0x160116bb, x=0, y=0, lppt=0x27e62d0 | out: lppt=0x27e62d0) returned 1
	[0215.493] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x160116bb) returned 0x0
	[0215.494] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0215.494] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.494] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.494] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.495] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0215.495] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0215.495] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0215.495] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.495] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0215.495] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0215.496] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0215.496] GdipCreateRegion (region=0x20c260) returned 0x0
	[0215.496] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.496] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0215.496] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.496] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0215.497] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0215.497] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0215.497] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.497] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0215.497] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0215.497] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0215.498] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.498] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0215.498] OffsetViewportOrgEx (in: hdc=0x160116bb, x=0, y=0, lppt=0x27e6870 | out: lppt=0x27e6870) returned 1
	[0215.498] GetROP2 (hdc=0x160116bb) returned 13
	[0215.498] GetROP2 (hdc=0x160116bb) returned 13
	[0215.499] GetROP2 (hdc=0x160116bb) returned 13
	[0215.499] GetROP2 (hdc=0x160116bb) returned 13
	[0215.499] GetROP2 (hdc=0x160116bb) returned 13
	[0215.499] GetROP2 (hdc=0x160116bb) returned 13
	[0215.499] GetROP2 (hdc=0x160116bb) returned 13
	[0215.499] GetROP2 (hdc=0x160116bb) returned 13
	[0215.500] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x160116bb) returned 0x0
	[0215.500] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0215.500] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x160116bb) returned 0x0
	[0215.500] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.500] GdipCreateFromHDC (hdc=0x180116bb, graphics=0x20c9d0) returned 0x0
	[0215.501] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.501] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0215.501] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0215.501] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.501] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0215.501] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.502] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.502] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0215.502] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.502] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0215.502] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0215.502] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa6d0dbd) returned 0x0
	[0215.503] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.503] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0215.503] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180116bb) returned 0x0
	[0215.503] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0215.503] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.503] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.504] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.504] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0215.504] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0215.504] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0215.504] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0215.504] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0215.505] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.505] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0215.505] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0215.505] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0215.505] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0215.505] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.506] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.506] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.506] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0215.506] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.506] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0215.507] GdipCreateRegion (region=0x20c310) returned 0x0
	[0215.507] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.507] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0215.507] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.507] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0215.507] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0215.508] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0215.508] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.508] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0215.508] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0215.508] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0215.508] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.508] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0215.509] OffsetViewportOrgEx (in: hdc=0x180116bb, x=0, y=0, lppt=0x27e76d0 | out: lppt=0x27e76d0) returned 1
	[0215.509] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180116bb) returned 0x0
	[0215.509] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0215.509] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.509] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.510] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.510] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0215.510] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0215.510] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0215.510] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.510] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0215.511] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0215.511] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0215.511] GdipCreateRegion (region=0x20c260) returned 0x0
	[0215.511] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.511] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0215.511] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.512] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0215.512] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.512] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0215.512] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.512] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0215.512] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0215.513] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0215.513] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.513] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0215.513] OffsetViewportOrgEx (in: hdc=0x180116bb, x=0, y=0, lppt=0x27e7c70 | out: lppt=0x27e7c70) returned 1
	[0215.513] GetROP2 (hdc=0x180116bb) returned 13
	[0215.513] GetROP2 (hdc=0x180116bb) returned 13
	[0215.514] GetROP2 (hdc=0x180116bb) returned 13
	[0215.514] GetROP2 (hdc=0x180116bb) returned 13
	[0215.514] GetROP2 (hdc=0x180116bb) returned 13
	[0215.514] GetROP2 (hdc=0x180116bb) returned 13
	[0215.514] GetROP2 (hdc=0x180116bb) returned 13
	[0215.514] GetROP2 (hdc=0x180116bb) returned 13
	[0215.515] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180116bb) returned 0x0
	[0215.515] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0215.515] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180116bb) returned 0x0
	[0215.515] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.740] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d7b0) returned 0x0
	[0215.741] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0215.741] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0215.741] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.741] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d700) returned 0x0
	[0215.742] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.742] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0215.742] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.742] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6d0) returned 0x0
	[0215.742] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.742] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d7a0) returned 0x0
	[0215.743] GdipCreateRegion (region=0x20d670) returned 0x0
	[0215.743] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.743] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0215.743] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.743] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d6d0) returned 0x0
	[0215.744] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0215.752] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.752] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d720) returned 0x0
	[0215.753] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.753] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d750) returned 0x0
	[0215.753] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x27e8618 | out: lppt=0x27e8618) returned 1
	[0215.753] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4010280) returned 0x0
	[0215.753] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.755] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0215.755] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0215.756] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0215.756] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0215.756] UpdateWindow (hWnd=0x401b4) 
	[0215.756] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0215.756] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0215.756] GdipCreateFromHDC (hdc=0x3c0116a4, graphics=0x20cfa0) returned 0x0
	[0215.757] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.757] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0215.757] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0215.757] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.757] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0215.758] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.758] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.758] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0215.758] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.759] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0215.759] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0215.759] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa680dbd) returned 0x0
	[0215.759] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.761] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0215.761] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3c0116a4) returned 0x0
	[0215.761] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0215.761] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.761] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.762] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.762] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0215.762] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0215.762] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0215.762] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0215.762] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0215.763] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.763] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0215.763] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0215.763] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0215.763] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0215.764] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.764] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.764] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.764] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0215.764] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.764] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0215.765] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0215.765] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.765] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0215.765] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.765] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0215.765] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0215.766] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0215.766] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.766] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0215.766] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0215.766] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0215.766] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.767] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0215.767] OffsetViewportOrgEx (in: hdc=0x3c0116a4, x=0, y=0, lppt=0x27e93e0 | out: lppt=0x27e93e0) returned 1
	[0215.767] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3c0116a4) returned 0x0
	[0215.767] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0215.767] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.767] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0215.768] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.768] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0215.768] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0215.768] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0215.768] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.769] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0215.769] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0215.769] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0215.769] GdipCreateRegion (region=0x20c830) returned 0x0
	[0215.769] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.769] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0215.770] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.770] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0215.770] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.770] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.770] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.770] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0215.771] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0215.771] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0215.771] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.771] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0215.771] OffsetViewportOrgEx (in: hdc=0x3c0116a4, x=0, y=0, lppt=0x27e9980 | out: lppt=0x27e9980) returned 1
	[0215.772] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.772] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.772] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.772] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.772] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.772] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.773] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.773] GetROP2 (hdc=0x3c0116a4) returned 13
	[0215.773] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3c0116a4) returned 0x0
	[0215.773] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0215.773] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3c0116a4) returned 0x0
	[0215.774] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.774] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0215.774] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0215.774] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0215.774] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0215.774] GetCapture () returned 0x401b4
	[0215.774] ReleaseCapture () 
	[0215.774] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0215.774] GetDIBits (in: hdc=0x4010280, hbm=0x360516b4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0215.775] GetDIBits (in: hdc=0x4010280, hbm=0x360516b4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0215.775] GdipCreateFromHDC (hdc=0xffffffff980115f3, graphics=0x20d750) returned 0x0
	[0215.781] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.781] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0215.782] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0215.782] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0215.782] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0215.782] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0215.782] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0215.782] GdipCreateRegion (region=0x20d910) returned 0x0
	[0215.783] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0215.783] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0215.783] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0215.783] GdipCreateRegion (region=0x20d400) returned 0x0
	[0215.783] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0215.783] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0215.784] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0215.784] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d460) returned 0x0
	[0215.784] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.784] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0215.784] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.784] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.785] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0215.785] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0215.785] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0215.785] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0215.785] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0215.786] OffsetViewportOrgEx (in: hdc=0xffffffff980115f3, x=0, y=0, lppt=0x27eb338 | out: lppt=0x27eb338) returned 1
	[0215.786] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff980115f3) returned 0x0
	[0215.786] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa650dbd) returned 0x0
	[0215.786] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.786] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0215.787] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff980115f3) returned 0x0
	[0215.787] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0215.787] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0215.787] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0215.787] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0215.787] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0215.788] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0215.788] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0215.788] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0215.788] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0215.788] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0215.789] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0215.789] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff980115f3) returned 0x0
	[0215.789] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0215.789] GetDIBits (in: hdc=0x70107fc, hbm=0x380516b4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0215.790] GetDIBits (in: hdc=0x70107fc, hbm=0x380516b4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0215.790] GdipCreateFromHDC (hdc=0x6d011644, graphics=0x20d800) returned 0x0
	[0215.790] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0215.790] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0215.790] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0215.790] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0215.793] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0215.793] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.793] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0215.793] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0215.793] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0215.793] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0215.794] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0215.794] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0215.794] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0215.794] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0215.794] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0215.795] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0215.795] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.795] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0215.795] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0215.795] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0215.795] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0215.796] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0215.796] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0215.796] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0215.796] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0215.796] OffsetViewportOrgEx (in: hdc=0x6d011644, x=0, y=0, lppt=0x27ece78 | out: lppt=0x27ece78) returned 1
	[0215.797] GdipReleaseDC (graphics=0x1b929550, hdc=0x6d011644) returned 0x0
	[0215.797] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa630dbd) returned 0x0
	[0215.797] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0215.797] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0215.804] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0215.805] GdipReleaseDC (graphics=0x1b929550, hdc=0x6d011644) returned 0x0
	[0215.805] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0218.111] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0218.111] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0218.111] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0218.111] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0218.112] GdipCreateFromHDC (hdc=0xffffffffeb0115f3, graphics=0x20d7e0) returned 0x0
	[0218.112] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0218.112] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0218.112] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0218.112] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.113] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0218.113] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.113] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.113] GdipCreateRegion (region=0x20d910) returned 0x0
	[0218.113] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.114] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0218.114] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0218.114] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa610dbd) returned 0x0
	[0218.114] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.114] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0218.115] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffeb0115f3) returned 0x0
	[0218.115] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0218.115] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.115] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.115] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.116] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0218.116] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0218.116] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0218.116] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0218.116] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0218.116] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.117] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0218.117] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0218.117] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0218.117] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0218.117] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.118] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.118] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.118] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0218.118] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.118] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0218.119] GdipCreateRegion (region=0x20d120) returned 0x0
	[0218.119] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.119] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0218.119] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.119] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0218.120] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.120] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.120] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.120] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0218.120] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0218.121] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0218.121] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.121] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0218.121] OffsetViewportOrgEx (in: hdc=0xffffffffeb0115f3, x=0, y=0, lppt=0x27ede58 | out: lppt=0x27ede58) returned 1
	[0218.121] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffeb0115f3) returned 0x0
	[0218.122] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0218.122] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.122] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.122] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.122] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0218.123] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0218.123] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0218.123] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.123] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0218.123] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0218.124] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0218.124] GdipCreateRegion (region=0x20d070) returned 0x0
	[0218.124] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.124] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0218.124] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.125] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0218.125] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.125] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.125] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.125] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0218.125] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0218.126] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0218.126] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.126] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0218.126] OffsetViewportOrgEx (in: hdc=0xffffffffeb0115f3, x=0, y=0, lppt=0x27ee3f8 | out: lppt=0x27ee3f8) returned 1
	[0218.126] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.127] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.127] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.127] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.127] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.127] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.127] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.128] GetROP2 (hdc=0xffffffffeb0115f3) returned 13
	[0218.128] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffeb0115f3) returned 0x0
	[0218.128] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0218.128] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffeb0115f3) returned 0x0
	[0218.128] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0218.129] GdipCreateFromHDC (hdc=0xffffffffed0115f3, graphics=0x20d7e0) returned 0x0
	[0218.129] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0218.129] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0218.129] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0218.130] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.130] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0218.130] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.130] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.130] GdipCreateRegion (region=0x20d910) returned 0x0
	[0218.130] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.131] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0218.131] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0218.131] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa5e0dbd) returned 0x0
	[0218.131] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.131] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0218.132] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed0115f3) returned 0x0
	[0218.132] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0218.132] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.132] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.132] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.133] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0218.133] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0218.133] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0218.133] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0218.133] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0218.133] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.134] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0218.134] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0218.134] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0218.134] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0218.134] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.134] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.135] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.135] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0218.135] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.135] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0218.135] GdipCreateRegion (region=0x20d120) returned 0x0
	[0218.135] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.136] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0218.136] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.136] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0218.136] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.136] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.136] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.137] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0218.137] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0218.137] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0218.137] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.137] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0218.137] OffsetViewportOrgEx (in: hdc=0xffffffffed0115f3, x=0, y=0, lppt=0x27ef258 | out: lppt=0x27ef258) returned 1
	[0218.138] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed0115f3) returned 0x0
	[0218.138] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0218.138] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.138] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.138] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.138] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0218.139] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0218.139] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0218.139] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.139] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0218.139] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0218.140] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0218.140] GdipCreateRegion (region=0x20d070) returned 0x0
	[0218.140] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.140] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0218.140] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.140] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0218.141] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.141] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.141] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.141] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0218.141] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0218.141] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0218.142] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.142] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0218.142] OffsetViewportOrgEx (in: hdc=0xffffffffed0115f3, x=0, y=0, lppt=0x27ef7f8 | out: lppt=0x27ef7f8) returned 1
	[0218.142] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.142] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.142] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.143] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.143] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.143] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.143] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.143] GetROP2 (hdc=0xffffffffed0115f3) returned 13
	[0218.144] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed0115f3) returned 0x0
	[0218.144] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0218.144] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffed0115f3) returned 0x0
	[0218.144] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0218.245] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0218.245] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0218.246] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0218.246] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0218.246] UpdateWindow (hWnd=0x201d8) 
	[0218.246] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0218.246] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0218.246] GdipCreateFromHDC (hdc=0x5d0116bf, graphics=0x20cfa0) returned 0x0
	[0218.246] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0218.247] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0218.247] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0218.247] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.247] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0218.247] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.247] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.248] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0218.248] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.248] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0218.248] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0218.248] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa5b0dbd) returned 0x0
	[0218.249] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.249] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0218.249] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d0116bf) returned 0x0
	[0218.249] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0218.249] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.250] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.250] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.250] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0218.250] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0218.250] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0218.251] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0218.251] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0218.251] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.251] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0218.251] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0218.252] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0218.252] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0218.252] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.252] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.252] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.253] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0218.253] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.253] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0218.253] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0218.253] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.254] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0218.254] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.254] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0218.254] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.254] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.254] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.255] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0218.255] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0218.255] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0218.255] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.255] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0218.255] OffsetViewportOrgEx (in: hdc=0x5d0116bf, x=0, y=0, lppt=0x27f0828 | out: lppt=0x27f0828) returned 1
	[0218.256] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d0116bf) returned 0x0
	[0218.256] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0218.256] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.256] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.256] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.257] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0218.257] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0218.257] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0218.257] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.257] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0218.257] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0218.258] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0218.258] GdipCreateRegion (region=0x20c830) returned 0x0
	[0218.258] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.258] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0218.258] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.259] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0218.259] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.259] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0218.259] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.259] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0218.259] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0218.260] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0218.260] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.260] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0218.260] OffsetViewportOrgEx (in: hdc=0x5d0116bf, x=0, y=0, lppt=0x27f0dc8 | out: lppt=0x27f0dc8) returned 1
	[0218.260] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.261] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.261] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.261] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.261] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.261] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.262] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.262] GetROP2 (hdc=0x5d0116bf) returned 13
	[0218.262] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d0116bf) returned 0x0
	[0218.262] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0218.262] GdipReleaseDC (graphics=0x1b929550, hdc=0x5d0116bf) returned 0x0
	[0218.263] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0218.263] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0218.263] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0218.264] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0218.264] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27f1110, Length=0x70 | out: Destination=0x1afe53a0) 
	[0218.264] ShellExecuteExW (pExecInfo=0x27f1320*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0218.299] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0218.299] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0218.300] GdipCreateFromHDC (hdc=0x670116bf, graphics=0x20c9d0) returned 0x0
	[0218.300] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0218.300] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0218.300] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0218.300] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.301] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0218.301] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0218.301] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.301] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0218.301] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.301] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0218.302] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0218.302] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa580dbd) returned 0x0
	[0218.302] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.302] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0218.302] GdipReleaseDC (graphics=0x1b929550, hdc=0x670116bf) returned 0x0
	[0218.303] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0218.303] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.303] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.303] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.303] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0218.303] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0218.303] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0218.304] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0218.304] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0218.304] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.304] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0218.304] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0218.305] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0218.305] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0218.305] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.305] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.305] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.305] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0218.306] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.306] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0218.306] GdipCreateRegion (region=0x20c310) returned 0x0
	[0218.306] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.306] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0218.306] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.307] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0218.307] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0218.307] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0218.307] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.307] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0218.307] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0218.308] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0218.308] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.308] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0218.308] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1a040710
	[0218.309] OffsetViewportOrgEx (in: hdc=0x670116bf, x=0, y=0, lppt=0x27f2000 | out: lppt=0x27f2000) returned 1
	[0218.309] GdipReleaseDC (graphics=0x1b929550, hdc=0x670116bf) returned 0x0
	[0218.309] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0218.309] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.309] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.309] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.310] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0218.310] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0218.310] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0218.310] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.311] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0218.311] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0218.311] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0218.311] GdipCreateRegion (region=0x20c260) returned 0x0
	[0218.311] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.311] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0218.312] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.312] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0218.312] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0218.312] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0218.312] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.313] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0218.313] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0218.313] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0218.313] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.313] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0218.313] OffsetViewportOrgEx (in: hdc=0x670116bf, x=0, y=0, lppt=0x27f25a0 | out: lppt=0x27f25a0) returned 1
	[0218.314] GetROP2 (hdc=0x670116bf) returned 13
	[0218.314] GetROP2 (hdc=0x670116bf) returned 13
	[0218.314] GetROP2 (hdc=0x670116bf) returned 13
	[0218.314] GetROP2 (hdc=0x670116bf) returned 13
	[0218.314] GetROP2 (hdc=0x670116bf) returned 13
	[0218.314] GetROP2 (hdc=0x670116bf) returned 13
	[0218.315] GetROP2 (hdc=0x670116bf) returned 13
	[0218.315] GetROP2 (hdc=0x670116bf) returned 13
	[0218.315] GdipReleaseDC (graphics=0x1b929550, hdc=0x670116bf) returned 0x0
	[0218.315] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0218.315] GdipReleaseDC (graphics=0x1b929550, hdc=0x670116bf) returned 0x0
	[0218.316] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0218.316] GdipCreateFromHDC (hdc=0x690116bf, graphics=0x20c9d0) returned 0x0
	[0218.316] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0218.316] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0218.316] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0218.316] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.317] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0218.317] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0218.317] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.317] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0218.317] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.318] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0218.318] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0218.319] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa550dbd) returned 0x0
	[0218.319] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.319] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0218.319] GdipReleaseDC (graphics=0x1b929550, hdc=0x690116bf) returned 0x0
	[0218.319] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0218.319] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.320] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.320] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.320] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0218.320] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0218.320] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0218.321] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0218.321] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0218.321] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.321] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0218.321] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0218.322] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0218.322] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0218.322] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.322] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.322] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.322] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0218.323] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.323] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0218.323] GdipCreateRegion (region=0x20c310) returned 0x0
	[0218.323] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.323] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0218.324] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.324] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0218.324] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0218.324] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0218.324] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.325] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0218.325] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0218.325] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0218.325] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.325] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0218.325] OffsetViewportOrgEx (in: hdc=0x690116bf, x=0, y=0, lppt=0x27f3428 | out: lppt=0x27f3428) returned 1
	[0218.326] GdipReleaseDC (graphics=0x1b929550, hdc=0x690116bf) returned 0x0
	[0218.326] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0218.326] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.326] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.326] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.327] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0218.327] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0218.327] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0218.327] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.327] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0218.328] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0218.328] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0218.328] GdipCreateRegion (region=0x20c260) returned 0x0
	[0218.328] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.328] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0218.328] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.329] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0218.329] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0218.329] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0218.329] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.329] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0218.329] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0218.330] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0218.330] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.330] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0218.330] OffsetViewportOrgEx (in: hdc=0x690116bf, x=0, y=0, lppt=0x27f39c8 | out: lppt=0x27f39c8) returned 1
	[0218.330] GetROP2 (hdc=0x690116bf) returned 13
	[0218.330] GetROP2 (hdc=0x690116bf) returned 13
	[0218.331] GetROP2 (hdc=0x690116bf) returned 13
	[0218.331] GetROP2 (hdc=0x690116bf) returned 13
	[0218.331] GetROP2 (hdc=0x690116bf) returned 13
	[0218.331] GetROP2 (hdc=0x690116bf) returned 13
	[0218.331] GetROP2 (hdc=0x690116bf) returned 13
	[0218.331] GetROP2 (hdc=0x690116bf) returned 13
	[0218.332] GdipReleaseDC (graphics=0x1b929550, hdc=0x690116bf) returned 0x0
	[0218.332] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0218.332] GdipReleaseDC (graphics=0x1b929550, hdc=0x690116bf) returned 0x0
	[0218.332] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0218.526] GdipCreateFromHDC (hdc=0x7011617, graphics=0x20d7e0) returned 0x0
	[0218.526] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0218.526] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0218.526] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0218.527] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.527] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0218.527] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0218.527] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.527] GdipCreateRegion (region=0x20d910) returned 0x0
	[0218.527] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.528] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0218.528] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0218.528] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa520dbd) returned 0x0
	[0218.528] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.528] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0218.529] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011617) returned 0x0
	[0218.529] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0218.529] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.529] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.529] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.529] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0218.530] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0218.530] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0218.530] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0218.530] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0218.530] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.531] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0218.531] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0218.531] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0218.531] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0218.531] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.531] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.532] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.532] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0218.532] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.532] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0218.532] GdipCreateRegion (region=0x20d120) returned 0x0
	[0218.533] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.533] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0218.533] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0218.533] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0218.533] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0218.533] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0218.533] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0218.534] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0218.534] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0218.534] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0218.534] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.534] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0218.534] OffsetViewportOrgEx (in: hdc=0x7011617, x=0, y=0, lppt=0x27f4970 | out: lppt=0x27f4970) returned 1
	[0218.535] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011617) returned 0x0
	[0218.535] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0218.535] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.535] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0218.535] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0218.535] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0218.536] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0218.536] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0218.536] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0218.537] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0218.537] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0218.537] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0218.537] GdipCreateRegion (region=0x20d070) returned 0x0
	[0218.537] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0218.538] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0218.538] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0218.538] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0218.538] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0218.538] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0218.539] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0218.539] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0218.539] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0218.539] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0218.539] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0218.539] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0218.540] OffsetViewportOrgEx (in: hdc=0x7011617, x=0, y=0, lppt=0x27f4f10 | out: lppt=0x27f4f10) returned 1
	[0218.540] GetROP2 (hdc=0x7011617) returned 13
	[0218.540] GetROP2 (hdc=0x7011617) returned 13
	[0218.540] GetROP2 (hdc=0x7011617) returned 13
	[0218.540] GetROP2 (hdc=0x7011617) returned 13
	[0218.541] GetROP2 (hdc=0x7011617) returned 13
	[0218.541] GetROP2 (hdc=0x7011617) returned 13
	[0218.541] GetROP2 (hdc=0x7011617) returned 13
	[0218.541] GetROP2 (hdc=0x7011617) returned 13
	[0218.541] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011617) returned 0x0
	[0218.541] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0218.542] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011617) returned 0x0
	[0218.542] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0221.047] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0221.047] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0221.048] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0221.048] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0221.048] GdipCreateFromHDC (hdc=0x1b0116c4, graphics=0x20d7e0) returned 0x0
	[0221.048] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0221.048] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0221.049] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0221.049] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0221.049] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0221.049] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0221.049] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.050] GdipCreateRegion (region=0x20d910) returned 0x0
	[0221.050] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.050] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0221.050] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0221.050] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa4f0dbd) returned 0x0
	[0221.050] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.051] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0221.051] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0116c4) returned 0x0
	[0221.051] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0221.051] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.051] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.051] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.052] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0221.052] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0221.052] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0221.052] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0221.052] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0221.052] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.053] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0221.053] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0221.053] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0221.053] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0221.053] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.053] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.054] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.054] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0221.054] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.054] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0221.054] GdipCreateRegion (region=0x20d120) returned 0x0
	[0221.054] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.055] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0221.055] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0221.055] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0221.055] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0221.055] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0221.055] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0221.056] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0221.056] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0221.056] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0221.056] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.056] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0221.056] OffsetViewportOrgEx (in: hdc=0x1b0116c4, x=0, y=0, lppt=0x27f5e40 | out: lppt=0x27f5e40) returned 1
	[0221.057] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0116c4) returned 0x0
	[0221.057] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0221.057] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.057] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.057] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.058] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0221.058] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0221.058] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0221.058] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.058] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0221.059] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0221.059] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0221.059] GdipCreateRegion (region=0x20d070) returned 0x0
	[0221.059] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.059] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0221.059] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0221.060] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0221.060] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0221.060] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0221.060] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.060] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0221.060] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0221.061] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0221.061] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.061] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0221.061] OffsetViewportOrgEx (in: hdc=0x1b0116c4, x=0, y=0, lppt=0x27f63e0 | out: lppt=0x27f63e0) returned 1
	[0221.061] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.062] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.062] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.062] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.062] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.062] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.062] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.063] GetROP2 (hdc=0x1b0116c4) returned 13
	[0221.063] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0116c4) returned 0x0
	[0221.063] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0221.063] GdipReleaseDC (graphics=0x1b929550, hdc=0x1b0116c4) returned 0x0
	[0221.063] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0221.302] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0221.302] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0221.302] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0221.302] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0221.302] UpdateWindow (hWnd=0x201d8) 
	[0221.302] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0221.302] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0221.303] GdipCreateFromHDC (hdc=0xffffffff84011699, graphics=0x20cfa0) returned 0x0
	[0221.303] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0221.303] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0221.303] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0221.303] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0221.304] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0221.304] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0221.304] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0221.304] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0221.304] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.304] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0221.305] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0221.305] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa4c0dbd) returned 0x0
	[0221.305] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.305] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0221.305] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff84011699) returned 0x0
	[0221.306] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0221.306] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.306] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.306] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.306] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0221.307] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0221.307] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0221.307] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0221.307] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0221.307] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.307] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0221.308] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0221.308] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0221.308] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0221.308] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.308] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.308] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.309] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0221.309] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.309] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0221.309] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0221.309] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.309] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0221.310] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0221.310] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0221.310] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0221.310] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0221.310] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.310] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0221.311] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0221.311] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0221.311] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.311] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0221.311] OffsetViewportOrgEx (in: hdc=0xffffffff84011699, x=0, y=0, lppt=0x27f73d8 | out: lppt=0x27f73d8) returned 1
	[0221.311] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff84011699) returned 0x0
	[0221.312] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0221.312] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.312] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.312] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.312] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0221.312] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0221.313] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0221.313] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.313] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0221.313] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0221.314] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0221.314] GdipCreateRegion (region=0x20c830) returned 0x0
	[0221.314] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.314] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0221.314] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0221.315] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0221.315] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0221.315] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0221.315] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0221.315] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0221.316] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0221.316] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0221.316] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.316] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0221.316] OffsetViewportOrgEx (in: hdc=0xffffffff84011699, x=0, y=0, lppt=0x27f7978 | out: lppt=0x27f7978) returned 1
	[0221.316] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.317] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.317] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.317] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.317] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.317] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.318] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.318] GetROP2 (hdc=0xffffffff84011699) returned 13
	[0221.318] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff84011699) returned 0x0
	[0221.318] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0221.318] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff84011699) returned 0x0
	[0221.318] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0221.319] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0221.319] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0221.319] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0221.319] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x27f7cc0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0221.320] ShellExecuteExW (pExecInfo=0x27f7ed0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0221.414] GdipCreateFromHDC (hdc=0xffffffff8c011699, graphics=0x20c9d0) returned 0x0
	[0221.414] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0221.414] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0221.415] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0221.415] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0221.415] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0221.415] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0221.415] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.416] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0221.416] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.416] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0221.416] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0221.416] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa490dbd) returned 0x0
	[0221.416] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.417] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0221.417] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff8c011699) returned 0x0
	[0221.417] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0221.417] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.417] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.417] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.418] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0221.418] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0221.418] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0221.418] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0221.418] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0221.418] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.419] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0221.419] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0221.419] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0221.419] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0221.419] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.420] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.420] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.420] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0221.420] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.420] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0221.420] GdipCreateRegion (region=0x20c310) returned 0x0
	[0221.421] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.421] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0221.421] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0221.421] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0221.421] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0221.422] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0221.422] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0221.422] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0221.422] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0221.423] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0221.423] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.423] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0221.423] OffsetViewportOrgEx (in: hdc=0xffffffff8c011699, x=0, y=0, lppt=0x27f8bd8 | out: lppt=0x27f8bd8) returned 1
	[0221.423] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff8c011699) returned 0x0
	[0221.423] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0221.424] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.424] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.424] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.424] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0221.424] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0221.424] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0221.425] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.425] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0221.425] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0221.425] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0221.425] GdipCreateRegion (region=0x20c260) returned 0x0
	[0221.425] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.426] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0221.426] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0221.426] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0221.426] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0221.426] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0221.427] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.427] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0221.427] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0221.427] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0221.427] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.427] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0221.428] OffsetViewportOrgEx (in: hdc=0xffffffff8c011699, x=0, y=0, lppt=0x27f9178 | out: lppt=0x27f9178) returned 1
	[0221.428] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.428] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.428] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.428] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.428] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.429] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.429] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.429] GetROP2 (hdc=0xffffffff8c011699) returned 13
	[0221.429] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff8c011699) returned 0x0
	[0221.429] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0221.429] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff8c011699) returned 0x0
	[0221.430] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0221.588] GdipCreateFromHDC (hdc=0x48010f97, graphics=0x20d770) returned 0x0
	[0221.588] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0221.588] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0221.589] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0221.589] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d6c0) returned 0x0
	[0221.589] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0221.589] GdipCreateRegion (region=0x20d660) returned 0x0
	[0221.589] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.589] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0221.590] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.590] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0221.590] GdipCreateRegion (region=0x20d630) returned 0x0
	[0221.590] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.590] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0221.590] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0221.591] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d690) returned 0x0
	[0221.591] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0221.591] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.591] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0221.591] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.591] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0221.592] OffsetViewportOrgEx (in: hdc=0x48010f97, x=0, y=0, lppt=0x27f99d0 | out: lppt=0x27f99d0) returned 1
	[0221.592] GdipReleaseDC (graphics=0x1b929550, hdc=0x48010f97) returned 0x0
	[0221.592] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0221.593] GetDIBits (in: hdc=0x4010280, hbm=0x1a05179e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0221.593] GetDIBits (in: hdc=0x4010280, hbm=0x1a05179e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0221.593] GdipCreateFromHDC (hdc=0x2c01179d, graphics=0x20d750) returned 0x0
	[0221.594] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0221.594] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0221.594] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0221.595] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0221.595] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0221.595] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0221.595] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0221.595] GdipCreateRegion (region=0x20d910) returned 0x0
	[0221.595] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0221.596] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0221.596] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0221.596] GdipCreateRegion (region=0x20d400) returned 0x0
	[0221.596] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0221.596] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0221.596] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0221.597] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0221.597] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0221.597] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0221.597] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0221.597] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.597] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0221.597] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0221.598] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0221.598] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0221.598] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0221.598] OffsetViewportOrgEx (in: hdc=0x2c01179d, x=0, y=0, lppt=0x27fb200 | out: lppt=0x27fb200) returned 1
	[0221.599] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c01179d) returned 0x0
	[0221.599] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa440dbd) returned 0x0
	[0221.599] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0221.599] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0221.599] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c01179d) returned 0x0
	[0221.600] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0221.600] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0221.600] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0221.600] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.600] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0221.600] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0221.600] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0221.601] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0221.601] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0221.601] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.601] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0221.602] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c01179d) returned 0x0
	[0221.602] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0221.602] GdipCreateFromHDC (hdc=0x770110ec, graphics=0x20d7e0) returned 0x0
	[0221.602] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0221.603] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0221.603] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0221.603] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0221.603] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0221.603] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0221.603] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0221.604] GdipCreateRegion (region=0x20d910) returned 0x0
	[0221.604] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0221.604] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0221.604] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0221.604] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa420dbd) returned 0x0
	[0221.604] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0221.605] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0221.605] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x770110ec) returned 0x0
	[0221.605] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0221.605] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.605] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.605] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.606] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0221.606] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0221.606] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0221.606] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0221.607] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0221.607] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.607] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0221.607] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0221.607] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0221.608] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0221.608] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.608] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.608] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.608] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0221.608] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.609] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0221.609] GdipCreateRegion (region=0x20d120) returned 0x0
	[0221.609] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0221.609] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0221.609] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0221.610] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0221.610] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0221.610] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0221.611] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.611] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0221.611] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0221.611] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0221.611] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0221.611] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0221.612] OffsetViewportOrgEx (in: hdc=0x770110ec, x=0, y=0, lppt=0x27fc308 | out: lppt=0x27fc308) returned 1
	[0221.612] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x770110ec) returned 0x0
	[0221.612] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0221.612] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.612] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0221.613] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0221.613] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0221.613] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0221.613] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0221.613] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0221.613] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0221.614] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0221.614] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0221.614] GdipCreateRegion (region=0x20d070) returned 0x0
	[0221.614] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0221.614] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0221.614] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0221.615] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0221.615] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0221.615] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0221.615] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0221.615] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0221.615] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0221.616] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0221.616] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0221.616] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0221.616] OffsetViewportOrgEx (in: hdc=0x770110ec, x=0, y=0, lppt=0x27fc8a8 | out: lppt=0x27fc8a8) returned 1
	[0221.616] GetROP2 (hdc=0x770110ec) returned 13
	[0221.616] GetROP2 (hdc=0x770110ec) returned 13
	[0221.617] GetROP2 (hdc=0x770110ec) returned 13
	[0221.617] GetROP2 (hdc=0x770110ec) returned 13
	[0221.617] GetROP2 (hdc=0x770110ec) returned 13
	[0221.617] GetROP2 (hdc=0x770110ec) returned 13
	[0221.617] GetROP2 (hdc=0x770110ec) returned 13
	[0221.617] GetROP2 (hdc=0x770110ec) returned 13
	[0221.618] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x770110ec) returned 0x0
	[0221.618] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0221.618] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x770110ec) returned 0x0
	[0221.618] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0221.619] GetDIBits (in: hdc=0x10107f8, hbm=0xffffffff8a0516bb, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0221.619] GetDIBits (in: hdc=0x10107f8, hbm=0xffffffff8a0516bb, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0221.619] GdipCreateFromHDC (hdc=0x1e01179e, graphics=0x20d800) returned 0x0
	[0221.619] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0221.619] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0221.619] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0221.619] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0221.620] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0221.620] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0221.620] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0221.620] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0221.620] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0221.620] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0221.621] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0221.621] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0221.621] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0221.621] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0221.621] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0221.621] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0221.622] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0221.622] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0221.622] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0221.622] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0221.622] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0221.622] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0221.622] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0221.623] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0221.623] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0221.623] OffsetViewportOrgEx (in: hdc=0x1e01179e, x=0, y=0, lppt=0x27fe170 | out: lppt=0x27fe170) returned 1
	[0221.623] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e01179e) returned 0x0
	[0221.624] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa3f0dbd) returned 0x0
	[0221.624] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0221.624] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0221.631] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0221.632] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e01179e) returned 0x0
	[0221.632] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0223.642] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0223.642] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0223.642] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0223.642] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0223.643] GdipCreateFromHDC (hdc=0x60117e7, graphics=0x20d7e0) returned 0x0
	[0223.643] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0223.643] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0223.643] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0223.643] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0223.644] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0223.644] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.644] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0223.644] GdipCreateRegion (region=0x20d910) returned 0x0
	[0223.644] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.644] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0223.645] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0223.645] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa3d0dbd) returned 0x0
	[0223.645] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.645] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0223.645] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x60117e7) returned 0x0
	[0223.645] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0223.646] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.646] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.646] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.646] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0223.646] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0223.646] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0223.647] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0223.647] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0223.647] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.647] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0223.647] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0223.647] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0223.648] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0223.648] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.648] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.648] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.648] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0223.648] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.649] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0223.649] GdipCreateRegion (region=0x20d120) returned 0x0
	[0223.649] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.649] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0223.649] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0223.649] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0223.650] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0223.650] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0223.650] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0223.650] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0223.650] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0223.650] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0223.651] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.651] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0223.651] OffsetViewportOrgEx (in: hdc=0x60117e7, x=0, y=0, lppt=0x27ffb10 | out: lppt=0x27ffb10) returned 1
	[0223.651] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x60117e7) returned 0x0
	[0223.651] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0223.652] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.652] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.652] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.652] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0223.652] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0223.652] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0223.653] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.653] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0223.653] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0223.653] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0223.654] GdipCreateRegion (region=0x20d070) returned 0x0
	[0223.654] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.654] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0223.654] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0223.654] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0223.654] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.655] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.655] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0223.655] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0223.655] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0223.655] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0223.655] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.656] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0223.656] OffsetViewportOrgEx (in: hdc=0x60117e7, x=0, y=0, lppt=0x28000b0 | out: lppt=0x28000b0) returned 1
	[0223.656] GetROP2 (hdc=0x60117e7) returned 13
	[0223.656] GetROP2 (hdc=0x60117e7) returned 13
	[0223.656] GetROP2 (hdc=0x60117e7) returned 13
	[0223.656] GetROP2 (hdc=0x60117e7) returned 13
	[0223.657] GetROP2 (hdc=0x60117e7) returned 13
	[0223.657] GetROP2 (hdc=0x60117e7) returned 13
	[0223.657] GetROP2 (hdc=0x60117e7) returned 13
	[0223.657] GetROP2 (hdc=0x60117e7) returned 13
	[0223.657] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x60117e7) returned 0x0
	[0223.657] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0223.658] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x60117e7) returned 0x0
	[0223.658] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0223.658] GdipCreateFromHDC (hdc=0x80117e7, graphics=0x20d7e0) returned 0x0
	[0223.658] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0223.658] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0223.659] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0223.659] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0223.659] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0223.659] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0223.659] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0223.659] GdipCreateRegion (region=0x20d910) returned 0x0
	[0223.660] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.660] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0223.660] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0223.660] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa3a0dbd) returned 0x0
	[0223.660] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.660] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0223.661] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80117e7) returned 0x0
	[0223.661] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0223.661] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.661] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.661] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.661] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0223.662] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0223.662] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0223.662] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0223.662] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0223.662] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.662] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0223.663] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0223.663] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0223.663] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0223.663] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.663] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.664] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.664] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0223.664] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.664] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0223.664] GdipCreateRegion (region=0x20d120) returned 0x0
	[0223.664] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.665] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0223.665] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0223.665] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0223.665] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.665] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.666] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0223.666] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0223.666] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0223.666] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0223.666] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.666] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0223.667] OffsetViewportOrgEx (in: hdc=0x80117e7, x=0, y=0, lppt=0x2800f10 | out: lppt=0x2800f10) returned 1
	[0223.667] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80117e7) returned 0x0
	[0223.667] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0223.667] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.667] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.668] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.668] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0223.668] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0223.668] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0223.668] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.670] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0223.670] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0223.670] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0223.670] GdipCreateRegion (region=0x20d070) returned 0x0
	[0223.671] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.671] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0223.671] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0223.671] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0223.671] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0223.671] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0223.672] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0223.672] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0223.672] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0223.672] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0223.672] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.672] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0223.673] OffsetViewportOrgEx (in: hdc=0x80117e7, x=0, y=0, lppt=0x28014b0 | out: lppt=0x28014b0) returned 1
	[0223.673] GetROP2 (hdc=0x80117e7) returned 13
	[0223.673] GetROP2 (hdc=0x80117e7) returned 13
	[0223.673] GetROP2 (hdc=0x80117e7) returned 13
	[0223.673] GetROP2 (hdc=0x80117e7) returned 13
	[0223.673] GetROP2 (hdc=0x80117e7) returned 13
	[0223.674] GetROP2 (hdc=0x80117e7) returned 13
	[0223.674] GetROP2 (hdc=0x80117e7) returned 13
	[0223.674] GetROP2 (hdc=0x80117e7) returned 13
	[0223.674] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80117e7) returned 0x0
	[0223.674] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0223.674] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x80117e7) returned 0x0
	[0223.675] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0223.874] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0223.874] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0223.874] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0223.874] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0223.874] UpdateWindow (hWnd=0x401b4) 
	[0223.874] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0223.874] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0223.874] GdipCreateFromHDC (hdc=0x220117da, graphics=0x20cfa0) returned 0x0
	[0223.875] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0223.875] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0223.875] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0223.875] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0223.875] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0223.876] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.876] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0223.876] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0223.876] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.876] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0223.876] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0223.876] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa370dbd) returned 0x0
	[0223.877] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.877] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0223.877] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x220117da) returned 0x0
	[0223.878] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0223.878] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.878] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.878] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.878] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0223.878] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0223.879] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0223.879] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0223.879] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0223.879] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.879] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0223.880] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0223.880] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0223.880] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0223.880] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.880] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.880] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.880] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0223.881] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.881] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0223.881] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0223.881] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.881] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0223.881] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0223.882] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0223.882] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0223.882] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0223.882] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0223.882] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0223.882] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0223.883] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0223.883] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.883] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0223.883] OffsetViewportOrgEx (in: hdc=0x220117da, x=0, y=0, lppt=0x28029c0 | out: lppt=0x28029c0) returned 1
	[0223.883] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x220117da) returned 0x0
	[0223.884] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0223.884] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.884] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0223.884] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0223.884] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0223.884] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0223.885] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0223.885] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0223.885] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0223.885] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0223.885] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0223.886] GdipCreateRegion (region=0x20c830) returned 0x0
	[0223.886] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0223.886] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0223.886] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0223.886] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0223.886] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.887] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0223.887] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0223.887] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0223.887] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0223.887] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0223.888] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0223.888] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0223.888] OffsetViewportOrgEx (in: hdc=0x220117da, x=0, y=0, lppt=0x2802f60 | out: lppt=0x2802f60) returned 1
	[0223.888] GetROP2 (hdc=0x220117da) returned 13
	[0223.888] GetROP2 (hdc=0x220117da) returned 13
	[0223.888] GetROP2 (hdc=0x220117da) returned 13
	[0223.889] GetROP2 (hdc=0x220117da) returned 13
	[0223.889] GetROP2 (hdc=0x220117da) returned 13
	[0223.889] GetROP2 (hdc=0x220117da) returned 13
	[0223.889] GetROP2 (hdc=0x220117da) returned 13
	[0223.889] GetROP2 (hdc=0x220117da) returned 13
	[0223.889] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x220117da) returned 0x0
	[0223.890] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0223.890] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x220117da) returned 0x0
	[0223.890] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0223.890] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0223.890] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0223.890] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0223.890] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0223.890] GetCapture () returned 0x401b4
	[0223.891] ReleaseCapture () 
	[0223.891] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0224.076] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0224.076] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0224.076] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0224.076] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0224.077] GdipCreateFromHDC (hdc=0x150117e9, graphics=0x20d7e0) returned 0x0
	[0224.077] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0224.077] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0224.077] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0224.077] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.077] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0224.078] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.078] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.078] GdipCreateRegion (region=0x20d910) returned 0x0
	[0224.078] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.078] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0224.078] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0224.079] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa340dbd) returned 0x0
	[0224.079] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.079] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0224.079] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150117e9) returned 0x0
	[0224.079] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0224.080] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.080] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.080] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.080] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0224.080] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0224.081] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0224.081] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0224.081] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0224.081] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.081] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0224.081] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0224.082] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0224.082] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0224.082] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.082] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.082] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.082] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0224.083] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.083] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0224.083] GdipCreateRegion (region=0x20d120) returned 0x0
	[0224.083] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.083] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0224.083] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0224.084] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0224.084] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.084] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.084] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0224.084] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0224.084] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0224.085] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0224.085] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.085] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0224.085] OffsetViewportOrgEx (in: hdc=0x150117e9, x=0, y=0, lppt=0x2803f30 | out: lppt=0x2803f30) returned 1
	[0224.085] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150117e9) returned 0x0
	[0224.086] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0224.086] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.086] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.086] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.086] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0224.086] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0224.087] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0224.087] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.087] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0224.087] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0224.087] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0224.088] GdipCreateRegion (region=0x20d070) returned 0x0
	[0224.088] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.088] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0224.088] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.088] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0224.088] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.089] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.089] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.089] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0224.089] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0224.089] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0224.089] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.090] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0224.090] OffsetViewportOrgEx (in: hdc=0x150117e9, x=0, y=0, lppt=0x28044d0 | out: lppt=0x28044d0) returned 1
	[0224.090] GetROP2 (hdc=0x150117e9) returned 13
	[0224.091] GetROP2 (hdc=0x150117e9) returned 13
	[0224.091] GetROP2 (hdc=0x150117e9) returned 13
	[0224.091] GetROP2 (hdc=0x150117e9) returned 13
	[0224.091] GetROP2 (hdc=0x150117e9) returned 13
	[0224.091] GetROP2 (hdc=0x150117e9) returned 13
	[0224.091] GetROP2 (hdc=0x150117e9) returned 13
	[0224.092] GetROP2 (hdc=0x150117e9) returned 13
	[0224.092] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150117e9) returned 0x0
	[0224.092] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0224.092] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x150117e9) returned 0x0
	[0224.092] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0224.093] GdipCreateFromHDC (hdc=0x170117e9, graphics=0x20d7e0) returned 0x0
	[0224.093] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0224.093] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0224.093] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0224.093] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0224.094] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0224.094] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.094] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0224.094] GdipCreateRegion (region=0x20d910) returned 0x0
	[0224.094] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.094] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0224.095] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0224.095] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa310dbd) returned 0x0
	[0224.095] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.095] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0224.096] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170117e9) returned 0x0
	[0224.096] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0224.096] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.096] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.096] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.097] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0224.097] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0224.097] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0224.097] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0224.097] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0224.097] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.098] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0224.098] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0224.098] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0224.098] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0224.098] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.099] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.099] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.099] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0224.099] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.099] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0224.100] GdipCreateRegion (region=0x20d120) returned 0x0
	[0224.100] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.100] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0224.100] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.100] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0224.101] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.101] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.101] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.101] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0224.101] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0224.101] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0224.102] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.102] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0224.102] OffsetViewportOrgEx (in: hdc=0x170117e9, x=0, y=0, lppt=0x2805330 | out: lppt=0x2805330) returned 1
	[0224.102] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170117e9) returned 0x0
	[0224.103] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0224.103] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.103] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.103] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.103] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0224.104] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0224.104] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0224.104] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.104] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0224.104] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0224.105] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0224.105] GdipCreateRegion (region=0x20d070) returned 0x0
	[0224.105] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.105] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0224.105] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0224.106] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0224.106] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.106] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.106] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0224.107] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0224.107] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0224.107] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0224.107] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.107] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0224.108] OffsetViewportOrgEx (in: hdc=0x170117e9, x=0, y=0, lppt=0x28058d0 | out: lppt=0x28058d0) returned 1
	[0224.108] GetROP2 (hdc=0x170117e9) returned 13
	[0224.108] GetROP2 (hdc=0x170117e9) returned 13
	[0224.108] GetROP2 (hdc=0x170117e9) returned 13
	[0224.108] GetROP2 (hdc=0x170117e9) returned 13
	[0224.108] GetROP2 (hdc=0x170117e9) returned 13
	[0224.109] GetROP2 (hdc=0x170117e9) returned 13
	[0224.109] GetROP2 (hdc=0x170117e9) returned 13
	[0224.109] GetROP2 (hdc=0x170117e9) returned 13
	[0224.109] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170117e9) returned 0x0
	[0224.109] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0224.110] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x170117e9) returned 0x0
	[0224.110] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0224.312] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0224.312] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0224.312] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0224.313] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0224.313] UpdateWindow (hWnd=0x201d8) returned 0
	[0224.313] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0224.313] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0224.313] GdipCreateFromHDC (hdc=0xf0117f6, graphics=0x20cfa0) returned 0x0
	[0224.313] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0224.313] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0224.313] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0224.314] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.314] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0224.314] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.314] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.314] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0224.315] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.315] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0224.315] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0224.315] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa2e0dbd) returned 0x0
	[0224.315] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.316] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0224.316] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0117f6) returned 0x0
	[0224.316] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0224.316] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.316] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.317] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.317] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0224.317] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0224.317] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0224.317] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0224.318] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0224.318] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.318] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0224.318] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0224.318] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0224.318] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0224.319] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.319] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.319] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.319] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0224.319] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.319] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0224.320] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0224.320] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.320] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0224.320] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0224.320] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0224.320] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.321] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.321] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0224.321] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0224.321] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0224.321] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0224.322] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.322] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0224.322] OffsetViewportOrgEx (in: hdc=0xf0117f6, x=0, y=0, lppt=0x2806960 | out: lppt=0x2806960) returned 1
	[0224.322] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0117f6) returned 0x0
	[0224.322] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0224.323] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.323] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.323] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.323] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0224.323] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0224.323] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0224.324] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.324] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0224.324] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0224.325] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0224.325] GdipCreateRegion (region=0x20c830) returned 0x0
	[0224.325] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.325] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0224.325] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.325] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0224.326] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.326] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.326] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.326] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0224.326] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0224.327] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0224.327] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.327] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0224.327] OffsetViewportOrgEx (in: hdc=0xf0117f6, x=0, y=0, lppt=0x2806f00 | out: lppt=0x2806f00) returned 1
	[0224.327] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.327] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.328] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.328] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.328] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.328] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.328] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.329] GetROP2 (hdc=0xf0117f6) returned 13
	[0224.329] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0117f6) returned 0x0
	[0224.329] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0224.329] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf0117f6) returned 0x0
	[0224.329] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0224.330] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0224.330] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0224.330] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0224.330] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2807248, Length=0x70 | out: Destination=0x1afe53a0) 
	[0224.331] ShellExecuteExW (in: pExecInfo=0x2807458*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2807458*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0224.387] GdipCreateFromHDC (hdc=0x90117f0, graphics=0x20c9d0) returned 0x0
	[0224.388] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0224.388] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0224.388] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0224.388] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0224.388] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0224.388] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.389] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0224.389] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0224.389] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.389] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0224.389] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0224.389] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa2b0dbd) returned 0x0
	[0224.390] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.390] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0224.390] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90117f0) returned 0x0
	[0224.390] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0224.390] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.390] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.391] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.391] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0224.391] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0224.391] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0224.391] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0224.391] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0224.392] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.392] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0224.392] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0224.392] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0224.392] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0224.392] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.393] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.393] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.393] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0224.393] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.393] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0224.393] GdipCreateRegion (region=0x20c310) returned 0x0
	[0224.394] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.394] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0224.394] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.394] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0224.394] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.394] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0224.395] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.395] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0224.395] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0224.395] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0224.395] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.395] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0224.396] OffsetViewportOrgEx (in: hdc=0x90117f0, x=0, y=0, lppt=0x2808128 | out: lppt=0x2808128) returned 1
	[0224.396] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90117f0) returned 0x0
	[0224.396] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0224.396] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.396] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.396] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.397] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0224.397] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0224.397] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0224.397] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.397] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0224.397] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0224.398] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0224.398] GdipCreateRegion (region=0x20c260) returned 0x0
	[0224.398] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.398] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0224.398] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0224.399] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0224.399] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.399] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0224.399] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0224.399] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0224.399] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0224.400] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0224.400] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.400] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0224.400] OffsetViewportOrgEx (in: hdc=0x90117f0, x=0, y=0, lppt=0x28086c8 | out: lppt=0x28086c8) returned 1
	[0224.400] GetROP2 (hdc=0x90117f0) returned 13
	[0224.401] GetROP2 (hdc=0x90117f0) returned 13
	[0224.401] GetROP2 (hdc=0x90117f0) returned 13
	[0224.401] GetROP2 (hdc=0x90117f0) returned 13
	[0224.401] GetROP2 (hdc=0x90117f0) returned 13
	[0224.401] GetROP2 (hdc=0x90117f0) returned 13
	[0224.401] GetROP2 (hdc=0x90117f0) returned 13
	[0224.402] GetROP2 (hdc=0x90117f0) returned 13
	[0224.402] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90117f0) returned 0x0
	[0224.402] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0224.402] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x90117f0) returned 0x0
	[0224.402] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0224.432] GdipCreateFromHDC (hdc=0x130117f0, graphics=0x20c9d0) returned 0x0
	[0224.432] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0224.432] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0224.433] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0224.433] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.433] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0224.433] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0224.433] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.433] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0224.434] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.434] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0224.434] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0224.434] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa280dbd) returned 0x0
	[0224.434] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.434] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0224.435] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130117f0) returned 0x0
	[0224.435] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0224.435] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.435] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.435] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.436] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0224.436] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0224.436] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0224.436] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0224.436] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0224.436] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.437] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0224.437] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0224.437] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0224.437] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0224.437] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.437] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.438] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.438] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0224.438] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.438] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0224.438] GdipCreateRegion (region=0x20c310) returned 0x0
	[0224.438] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.439] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0224.439] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0224.439] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0224.439] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0224.439] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0224.439] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0224.440] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0224.440] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0224.440] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0224.440] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.440] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0224.441] OffsetViewportOrgEx (in: hdc=0x130117f0, x=0, y=0, lppt=0x2809560 | out: lppt=0x2809560) returned 1
	[0224.441] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130117f0) returned 0x0
	[0224.441] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0224.441] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.441] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0224.441] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0224.442] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0224.442] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0224.442] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0224.442] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0224.442] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0224.442] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0224.443] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0224.443] GdipCreateRegion (region=0x20c260) returned 0x0
	[0224.443] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0224.443] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0224.443] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0224.443] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0224.444] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0224.444] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0224.444] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0224.444] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0224.444] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0224.444] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0224.445] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0224.445] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0224.445] OffsetViewportOrgEx (in: hdc=0x130117f0, x=0, y=0, lppt=0x2809b00 | out: lppt=0x2809b00) returned 1
	[0224.445] GetROP2 (hdc=0x130117f0) returned 13
	[0224.445] GetROP2 (hdc=0x130117f0) returned 13
	[0224.445] GetROP2 (hdc=0x130117f0) returned 13
	[0224.446] GetROP2 (hdc=0x130117f0) returned 13
	[0224.446] GetROP2 (hdc=0x130117f0) returned 13
	[0224.446] GetROP2 (hdc=0x130117f0) returned 13
	[0224.446] GetROP2 (hdc=0x130117f0) returned 13
	[0224.446] GetROP2 (hdc=0x130117f0) returned 13
	[0224.446] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130117f0) returned 0x0
	[0224.447] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0224.447] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x130117f0) returned 0x0
	[0224.447] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0226.327] GetDIBits (in: hdc=0x4010280, hbm=0x405184d, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0226.327] GetDIBits (in: hdc=0x4010280, hbm=0x405184d, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0226.328] GdipCreateFromHDC (hdc=0x401184a, graphics=0x20d750) returned 0x0
	[0226.328] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0226.328] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0226.328] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0226.328] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0226.329] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0226.329] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0226.329] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0226.329] GdipCreateRegion (region=0x20d910) returned 0x0
	[0226.329] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0226.329] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0226.330] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0226.330] GdipCreateRegion (region=0x20d400) returned 0x0
	[0226.330] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0226.330] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0226.330] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0226.331] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0226.331] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.331] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0226.331] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.331] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.331] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0226.332] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0226.332] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0226.332] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0226.332] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0226.332] OffsetViewportOrgEx (in: hdc=0x401184a, x=0, y=0, lppt=0x280bcb8 | out: lppt=0x280bcb8) returned 1
	[0226.332] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x401184a) returned 0x0
	[0226.333] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa250dbd) returned 0x0
	[0226.333] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0226.333] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0226.333] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x401184a) returned 0x0
	[0226.333] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0226.334] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0226.334] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0226.334] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.334] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0226.334] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0226.334] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0226.335] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0226.335] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0226.335] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.335] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0226.336] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x401184a) returned 0x0
	[0226.336] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0226.336] GdipCreateFromHDC (hdc=0x7011843, graphics=0x20d7e0) returned 0x0
	[0226.337] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0226.337] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=23, combineMode=0x0) returned 0x0
	[0226.337] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0226.337] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.337] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0226.337] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.338] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.338] GdipCreateRegion (region=0x20d910) returned 0x0
	[0226.338] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.338] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0226.338] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0226.338] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa230dbd) returned 0x0
	[0226.339] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.339] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0226.339] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011843) returned 0x0
	[0226.339] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0226.339] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.340] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.340] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.340] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0226.340] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0226.340] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0226.340] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0226.341] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0226.341] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.341] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0226.341] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0226.341] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0226.341] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0226.342] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.342] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.342] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.342] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0226.342] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.343] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0226.343] GdipCreateRegion (region=0x20d120) returned 0x0
	[0226.343] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.343] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0226.343] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.344] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0226.344] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.344] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.344] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.344] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0226.345] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0226.345] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0226.345] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.345] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0226.345] OffsetViewportOrgEx (in: hdc=0x7011843, x=0, y=0, lppt=0x280cda8 | out: lppt=0x280cda8) returned 1
	[0226.346] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011843) returned 0x0
	[0226.346] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0226.346] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.346] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.346] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.347] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0226.347] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0226.347] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0226.347] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.347] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0226.348] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0226.348] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0226.348] GdipCreateRegion (region=0x20d070) returned 0x0
	[0226.348] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.348] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0226.348] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.349] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0226.349] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.349] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.349] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.349] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0226.349] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0226.350] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0226.350] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.350] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0226.350] OffsetViewportOrgEx (in: hdc=0x7011843, x=0, y=0, lppt=0x280d348 | out: lppt=0x280d348) returned 1
	[0226.350] GetROP2 (hdc=0x7011843) returned 13
	[0226.350] GetROP2 (hdc=0x7011843) returned 13
	[0226.351] GetROP2 (hdc=0x7011843) returned 13
	[0226.351] GetROP2 (hdc=0x7011843) returned 13
	[0226.351] GetROP2 (hdc=0x7011843) returned 13
	[0226.351] GetROP2 (hdc=0x7011843) returned 13
	[0226.351] GetROP2 (hdc=0x7011843) returned 13
	[0226.351] GetROP2 (hdc=0x7011843) returned 13
	[0226.352] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011843) returned 0x0
	[0226.352] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0226.352] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011843) returned 0x0
	[0226.352] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0226.353] GetDIBits (in: hdc=0x4010280, hbm=0x8051843, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0226.353] GetDIBits (in: hdc=0x4010280, hbm=0x8051843, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0226.353] GdipCreateFromHDC (hdc=0xd011848, graphics=0x20d800) returned 0x0
	[0226.353] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0226.353] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0226.354] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0226.354] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.354] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0226.354] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.354] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.354] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0226.355] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.355] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0226.355] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0226.355] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0226.355] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0226.355] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0226.356] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.356] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0226.356] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.356] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0226.356] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.356] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.357] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0226.357] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0226.357] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0226.357] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0226.357] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0226.357] OffsetViewportOrgEx (in: hdc=0xd011848, x=0, y=0, lppt=0x280ebf8 | out: lppt=0x280ebf8) returned 1
	[0226.358] GdipReleaseDC (graphics=0x1b929550, hdc=0xd011848) returned 0x0
	[0226.358] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa200dbd) returned 0x0
	[0226.358] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.358] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0226.365] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0226.366] GdipReleaseDC (graphics=0x1b929550, hdc=0xd011848) returned 0x0
	[0226.366] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0226.671] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0226.671] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x1
	[0226.671] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0226.671] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0226.672] GdipCreateFromHDC (hdc=0x1d011830, graphics=0x20d7e0) returned 0x0
	[0226.672] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0226.672] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0226.672] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0226.672] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.673] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0226.673] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.673] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.673] GdipCreateRegion (region=0x20d910) returned 0x0
	[0226.673] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.673] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0226.674] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0226.674] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa1e0dbd) returned 0x0
	[0226.674] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.674] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0226.674] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d011830) returned 0x0
	[0226.675] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0226.675] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.675] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.675] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.675] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0226.675] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0226.676] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0226.676] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0226.676] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0226.676] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.676] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0226.677] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0226.677] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0226.677] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0226.677] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.677] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.677] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.678] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0226.678] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.678] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0226.678] GdipCreateRegion (region=0x20d120) returned 0x0
	[0226.678] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.678] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0226.679] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.679] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0226.679] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.679] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.679] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.680] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0226.680] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0226.680] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0226.681] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.681] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0226.681] OffsetViewportOrgEx (in: hdc=0x1d011830, x=0, y=0, lppt=0x280faa8 | out: lppt=0x280faa8) returned 1
	[0226.681] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d011830) returned 0x0
	[0226.682] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0226.682] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.682] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.682] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.682] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0226.683] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0226.683] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0226.683] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.683] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0226.683] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0226.684] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0226.684] GdipCreateRegion (region=0x20d070) returned 0x0
	[0226.684] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.684] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0226.684] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.685] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0226.685] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.685] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.685] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.685] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0226.686] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0226.686] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0226.686] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.686] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0226.686] OffsetViewportOrgEx (in: hdc=0x1d011830, x=0, y=0, lppt=0x2810048 | out: lppt=0x2810048) returned 1
	[0226.686] GetROP2 (hdc=0x1d011830) returned 13
	[0226.687] GetROP2 (hdc=0x1d011830) returned 13
	[0226.687] GetROP2 (hdc=0x1d011830) returned 13
	[0226.687] GetROP2 (hdc=0x1d011830) returned 13
	[0226.687] GetROP2 (hdc=0x1d011830) returned 13
	[0226.687] GetROP2 (hdc=0x1d011830) returned 13
	[0226.687] GetROP2 (hdc=0x1d011830) returned 13
	[0226.688] GetROP2 (hdc=0x1d011830) returned 13
	[0226.688] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d011830) returned 0x0
	[0226.688] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0226.688] GdipReleaseDC (graphics=0x1b929550, hdc=0x1d011830) returned 0x0
	[0226.688] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0226.689] GdipCreateFromHDC (hdc=0x1f011830, graphics=0x20d7e0) returned 0x0
	[0226.689] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0226.689] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0226.689] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0226.689] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.689] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0226.690] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.690] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.690] GdipCreateRegion (region=0x20d910) returned 0x0
	[0226.690] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.690] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0226.690] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0226.690] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa1b0dbd) returned 0x0
	[0226.691] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.691] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0226.691] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011830) returned 0x0
	[0226.691] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0226.691] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.691] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.692] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.692] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0226.692] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0226.692] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0226.692] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0226.692] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0226.693] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.693] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0226.693] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0226.693] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0226.693] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0226.693] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.694] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.694] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.694] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0226.694] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.694] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0226.694] GdipCreateRegion (region=0x20d120) returned 0x0
	[0226.695] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.695] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0226.695] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.696] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0226.696] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.696] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.696] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.696] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0226.696] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0226.697] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0226.697] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.697] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0226.697] OffsetViewportOrgEx (in: hdc=0x1f011830, x=0, y=0, lppt=0x2810ea8 | out: lppt=0x2810ea8) returned 1
	[0226.697] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011830) returned 0x0
	[0226.697] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0226.698] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.698] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.698] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.698] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0226.698] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0226.698] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0226.699] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.699] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0226.699] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0226.699] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0226.699] GdipCreateRegion (region=0x20d070) returned 0x0
	[0226.699] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.700] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0226.700] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.700] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0226.700] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.700] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.700] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.701] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0226.701] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0226.701] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0226.701] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.701] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0226.701] OffsetViewportOrgEx (in: hdc=0x1f011830, x=0, y=0, lppt=0x2811448 | out: lppt=0x2811448) returned 1
	[0226.702] GetROP2 (hdc=0x1f011830) returned 13
	[0226.702] GetROP2 (hdc=0x1f011830) returned 13
	[0226.702] GetROP2 (hdc=0x1f011830) returned 13
	[0226.702] GetROP2 (hdc=0x1f011830) returned 13
	[0226.702] GetROP2 (hdc=0x1f011830) returned 13
	[0226.702] GetROP2 (hdc=0x1f011830) returned 13
	[0226.703] GetROP2 (hdc=0x1f011830) returned 13
	[0226.703] GetROP2 (hdc=0x1f011830) returned 13
	[0226.703] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011830) returned 0x0
	[0226.703] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0226.703] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011830) returned 0x0
	[0226.703] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0226.964] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d7b0) returned 0x0
	[0226.965] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0226.965] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0226.965] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.965] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d700) returned 0x0
	[0226.966] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.966] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0226.966] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.966] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6d0) returned 0x0
	[0226.966] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.966] GdipSaveGraphics (graphics=0x1b929550, state=0x20d7a0) returned 0x0
	[0226.967] GdipCreateRegion (region=0x20d670) returned 0x0
	[0226.967] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.967] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0226.967] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.967] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d6d0) returned 0x0
	[0226.968] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.968] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.968] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d720) returned 0x0
	[0226.968] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.968] GdipGetDC (graphics=0x1b929550, hdc=0x20d750) returned 0x0
	[0226.968] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x2811d90 | out: lppt=0x2811d90) returned 1
	[0226.969] GdipReleaseDC (graphics=0x1b929550, hdc=0x10107f8) returned 0x0
	[0226.969] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0226.970] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0226.970] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0226.970] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0226.970] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0226.970] UpdateWindow (hWnd=0x401b4) 
	[0226.970] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0226.970] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0226.971] GdipCreateFromHDC (hdc=0xffffffffa6011856, graphics=0x20cfa0) returned 0x0
	[0226.971] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0226.971] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0226.971] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0226.972] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.972] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0226.972] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.972] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.972] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0226.973] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.973] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0226.973] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0226.973] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa160dbd) returned 0x0
	[0226.973] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.973] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0226.974] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011856) returned 0x0
	[0226.974] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0226.974] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.974] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.974] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.974] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0226.975] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0226.975] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0226.975] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0226.975] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0226.975] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.975] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0226.976] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0226.976] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0226.977] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0226.977] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.977] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.977] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.977] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0226.977] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.978] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0226.978] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0226.978] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.978] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0226.978] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.978] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0226.979] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.979] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.979] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.979] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0226.979] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0226.979] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0226.979] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.980] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0226.980] OffsetViewportOrgEx (in: hdc=0xffffffffa6011856, x=0, y=0, lppt=0x2812b58 | out: lppt=0x2812b58) returned 1
	[0226.980] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011856) returned 0x0
	[0226.980] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0226.980] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.980] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0226.981] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0226.981] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0226.981] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0226.981] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0226.981] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0226.981] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0226.982] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0226.982] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0226.982] GdipCreateRegion (region=0x20c830) returned 0x0
	[0226.982] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.982] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0226.982] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.983] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0226.983] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.983] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.983] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.983] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0226.983] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0226.983] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0226.984] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0226.984] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0226.984] OffsetViewportOrgEx (in: hdc=0xffffffffa6011856, x=0, y=0, lppt=0x28130f8 | out: lppt=0x28130f8) returned 1
	[0226.984] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.984] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.984] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.985] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.985] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.985] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.985] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.985] GetROP2 (hdc=0xffffffffa6011856) returned 13
	[0226.985] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011856) returned 0x0
	[0226.986] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0226.986] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffffa6011856) returned 0x0
	[0226.986] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0226.986] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0226.986] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0226.986] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0226.986] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0226.986] GetCapture () returned 0x401b4
	[0226.986] ReleaseCapture () returned 1
	[0226.987] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0226.987] GetDIBits (in: hdc=0x70107fc, hbm=0x48051300, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0226.987] GetDIBits (in: hdc=0x70107fc, hbm=0x48051300, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0226.987] GdipCreateFromHDC (hdc=0x2501185d, graphics=0x20d750) returned 0x0
	[0226.987] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0226.987] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0226.988] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0226.988] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0226.988] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0226.988] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0226.988] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0226.988] GdipCreateRegion (region=0x20d910) returned 0x0
	[0226.988] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0226.989] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0226.989] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0226.989] GdipCreateRegion (region=0x20d400) returned 0x0
	[0226.989] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0226.989] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0226.989] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0226.990] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0226.990] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.990] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0226.990] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0226.990] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0226.990] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0226.991] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0226.991] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0226.991] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0226.991] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0226.991] OffsetViewportOrgEx (in: hdc=0x2501185d, x=0, y=0, lppt=0x2814ab0 | out: lppt=0x2814ab0) returned 1
	[0227.124] GdipReleaseDC (graphics=0x1b929550, hdc=0x2501185d) returned 0x0
	[0227.125] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffffa130dbd) returned 0x0
	[0227.125] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0227.125] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0227.125] GdipReleaseDC (graphics=0x1b929550, hdc=0x2501185d) returned 0x0
	[0227.125] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0227.125] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0227.126] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0227.126] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.126] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0227.126] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0227.126] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0227.126] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0227.127] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0227.127] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.127] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0227.127] GdipReleaseDC (graphics=0x1b929550, hdc=0x2501185d) returned 0x0
	[0227.127] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0227.128] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0227.128] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0227.128] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0227.128] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0227.128] GdipCreateFromHDC (hdc=0xffffffffaa011856, graphics=0x20d7e0) returned 0x0
	[0227.128] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0227.128] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0227.129] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0227.129] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.129] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0227.129] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.129] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.129] GdipCreateRegion (region=0x20d910) returned 0x0
	[0227.130] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.130] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0227.130] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0227.130] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa110dbd) returned 0x0
	[0227.130] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.130] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0227.131] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffaa011856) returned 0x0
	[0227.131] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0227.131] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.131] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.131] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.131] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0227.132] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0227.132] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0227.132] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0227.132] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0227.132] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.133] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0227.133] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0227.133] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0227.133] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0227.133] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.134] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.134] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.134] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0227.134] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.134] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0227.134] GdipCreateRegion (region=0x20d120) returned 0x0
	[0227.135] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.135] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0227.135] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.135] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0227.135] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.135] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.136] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.136] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0227.136] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0227.136] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0227.136] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.136] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0227.137] OffsetViewportOrgEx (in: hdc=0xffffffffaa011856, x=0, y=0, lppt=0x2815c38 | out: lppt=0x2815c38) returned 1
	[0227.137] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffaa011856) returned 0x0
	[0227.137] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0227.137] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.137] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.137] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.138] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0227.138] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0227.138] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0227.138] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.138] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0227.139] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0227.139] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0227.139] GdipCreateRegion (region=0x20d070) returned 0x0
	[0227.139] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.139] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0227.139] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.140] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0227.140] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.140] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.140] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.140] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0227.140] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0227.140] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0227.141] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.141] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0227.141] OffsetViewportOrgEx (in: hdc=0xffffffffaa011856, x=0, y=0, lppt=0x28161d8 | out: lppt=0x28161d8) returned 1
	[0227.141] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.141] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.141] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.142] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.142] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.142] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.142] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.142] GetROP2 (hdc=0xffffffffaa011856) returned 13
	[0227.142] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffaa011856) returned 0x0
	[0227.143] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0227.143] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffaa011856) returned 0x0
	[0227.143] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0227.143] GdipCreateFromHDC (hdc=0xffffffffab011856, graphics=0x20d7e0) returned 0x0
	[0227.143] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0227.144] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0227.144] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0227.144] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.144] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0227.144] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.144] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.145] GdipCreateRegion (region=0x20d910) returned 0x0
	[0227.145] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.145] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0227.145] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0227.145] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa0e0dbd) returned 0x0
	[0227.145] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.146] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0227.146] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffab011856) returned 0x0
	[0227.146] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0227.146] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.146] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.146] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.147] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0227.147] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0227.147] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0227.147] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0227.147] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0227.147] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.148] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0227.148] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0227.148] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0227.148] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0227.148] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.148] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.149] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.149] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0227.149] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.149] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0227.149] GdipCreateRegion (region=0x20d120) returned 0x0
	[0227.149] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.150] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0227.150] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.150] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0227.150] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.150] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.150] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.151] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0227.151] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0227.151] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0227.151] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.151] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0227.151] OffsetViewportOrgEx (in: hdc=0xffffffffab011856, x=0, y=0, lppt=0x2817038 | out: lppt=0x2817038) returned 1
	[0227.152] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffab011856) returned 0x0
	[0227.152] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0227.152] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.152] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.152] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.152] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0227.153] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0227.153] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0227.153] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.153] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0227.153] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0227.153] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0227.154] GdipCreateRegion (region=0x20d070) returned 0x0
	[0227.154] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.154] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0227.154] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.154] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0227.154] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.155] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.155] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.155] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0227.155] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0227.155] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0227.155] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.156] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0227.156] OffsetViewportOrgEx (in: hdc=0xffffffffab011856, x=0, y=0, lppt=0x28175d8 | out: lppt=0x28175d8) returned 1
	[0227.156] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.156] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.156] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.156] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.157] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.157] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.157] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.157] GetROP2 (hdc=0xffffffffab011856) returned 13
	[0227.157] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffab011856) returned 0x0
	[0227.157] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0227.158] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffab011856) returned 0x0
	[0227.158] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0227.158] GetDIBits (in: hdc=0x10107f8, hbm=0x4e051300, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0227.158] GetDIBits (in: hdc=0x10107f8, hbm=0x4e051300, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0227.159] GdipCreateFromHDC (hdc=0x3f011848, graphics=0x20d800) returned 0x0
	[0227.159] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0227.159] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0227.159] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0227.159] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.159] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20da20) returned 0x0
	[0227.160] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.160] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.160] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0227.160] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.160] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0227.160] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0227.161] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0227.161] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0227.161] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0227.161] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.161] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0227.161] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.162] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0227.162] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.162] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.162] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0227.162] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0227.162] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0227.163] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0227.163] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0227.163] OffsetViewportOrgEx (in: hdc=0x3f011848, x=0, y=0, lppt=0x2818e88 | out: lppt=0x2818e88) returned 1
	[0227.164] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3f011848) returned 0x0
	[0227.164] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa0b0dbd) returned 0x0
	[0227.164] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.164] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0227.171] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0227.171] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x3f011848) returned 0x0
	[0227.171] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0227.364] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0227.364] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0227.365] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0227.365] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0227.365] UpdateWindow (hWnd=0x201d8) 
	[0227.365] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0227.365] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0227.365] GdipCreateFromHDC (hdc=0xffffffff8a0116b6, graphics=0x20cfa0) returned 0x0
	[0227.365] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0227.365] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0227.366] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0227.370] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.371] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0227.371] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.371] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.371] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0227.371] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.371] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0227.372] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0227.372] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa090dbd) returned 0x0
	[0227.372] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.372] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0227.372] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff8a0116b6) returned 0x0
	[0227.372] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0227.373] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.373] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.373] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.373] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0227.373] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0227.373] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0227.373] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0227.374] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0227.374] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.374] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0227.374] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0227.374] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0227.375] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0227.375] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.375] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.375] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.375] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0227.375] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.375] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0227.376] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0227.376] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.376] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0227.376] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.376] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0227.376] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.377] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0227.377] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.377] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0227.377] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0227.377] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0227.378] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.378] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0227.378] OffsetViewportOrgEx (in: hdc=0xffffffff8a0116b6, x=0, y=0, lppt=0x2819e38 | out: lppt=0x2819e38) returned 1
	[0227.378] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff8a0116b6) returned 0x0
	[0227.378] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0227.378] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.379] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.379] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.379] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0227.379] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0227.379] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0227.379] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.380] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0227.380] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0227.380] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0227.380] GdipCreateRegion (region=0x20c830) returned 0x0
	[0227.380] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.380] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0227.381] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.381] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0227.381] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.381] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0227.381] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.382] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0227.382] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0227.382] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0227.382] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.382] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0227.382] OffsetViewportOrgEx (in: hdc=0xffffffff8a0116b6, x=0, y=0, lppt=0x281a3d8 | out: lppt=0x281a3d8) returned 1
	[0227.383] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.383] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.383] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.383] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.383] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.383] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.384] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.384] GetROP2 (hdc=0xffffffff8a0116b6) returned 13
	[0227.384] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff8a0116b6) returned 0x0
	[0227.384] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0227.384] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffff8a0116b6) returned 0x0
	[0227.384] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0227.385] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0227.385] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0227.385] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0227.385] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x281a720, Length=0x70 | out: Destination=0x1afe53a0) 
	[0227.385] ShellExecuteExW (pExecInfo=0x281a930*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0227.466] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0227.466] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0227.467] GdipCreateFromHDC (hdc=0x7701185a, graphics=0x20c9d0) returned 0x0
	[0227.467] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0227.468] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0227.468] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0227.468] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.468] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0227.468] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0227.468] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.469] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0227.469] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.469] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0227.469] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0227.469] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa060dbd) returned 0x0
	[0227.469] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.470] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0227.470] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7701185a) returned 0x0
	[0227.470] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0227.470] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.470] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.470] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.471] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0227.471] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0227.471] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0227.471] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0227.471] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0227.471] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.472] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0227.472] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0227.472] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0227.472] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0227.472] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.472] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.473] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.473] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0227.473] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.473] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0227.473] GdipCreateRegion (region=0x20c310) returned 0x0
	[0227.473] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.474] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0227.474] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.474] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0227.474] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0227.474] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0227.474] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.475] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0227.475] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0227.475] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0227.475] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.475] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0227.476] OffsetViewportOrgEx (in: hdc=0x7701185a, x=0, y=0, lppt=0x281b610 | out: lppt=0x281b610) returned 1
	[0227.476] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7701185a) returned 0x0
	[0227.476] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0227.476] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.476] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.477] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.477] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0227.477] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0227.477] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0227.477] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.477] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0227.478] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0227.478] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0227.478] GdipCreateRegion (region=0x20c260) returned 0x0
	[0227.478] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.478] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0227.478] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.479] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0227.479] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0227.479] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0227.479] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.479] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0227.479] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0227.480] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0227.480] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.480] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0227.480] OffsetViewportOrgEx (in: hdc=0x7701185a, x=0, y=0, lppt=0x281bbb0 | out: lppt=0x281bbb0) returned 1
	[0227.480] GetROP2 (hdc=0x7701185a) returned 13
	[0227.481] GetROP2 (hdc=0x7701185a) returned 13
	[0227.481] GetROP2 (hdc=0x7701185a) returned 13
	[0227.481] GetROP2 (hdc=0x7701185a) returned 13
	[0227.481] GetROP2 (hdc=0x7701185a) returned 13
	[0227.481] GetROP2 (hdc=0x7701185a) returned 13
	[0227.481] GetROP2 (hdc=0x7701185a) returned 13
	[0227.482] GetROP2 (hdc=0x7701185a) returned 13
	[0227.482] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7701185a) returned 0x0
	[0227.482] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0227.482] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7701185a) returned 0x0
	[0227.482] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0227.483] GdipCreateFromHDC (hdc=0x7901185a, graphics=0x20c9d0) returned 0x0
	[0227.483] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0227.483] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0227.483] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0227.484] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.484] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0227.484] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0227.484] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.484] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0227.485] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.485] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0227.485] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0227.485] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa030dbd) returned 0x0
	[0227.485] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.486] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0227.486] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7901185a) returned 0x0
	[0227.486] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0227.486] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.486] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.487] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.487] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0227.487] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0227.487] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0227.487] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0227.487] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0227.488] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.488] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0227.488] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0227.488] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0227.488] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0227.488] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.489] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.489] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.489] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0227.489] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.489] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0227.490] GdipCreateRegion (region=0x20c310) returned 0x0
	[0227.490] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.490] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0227.490] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0227.490] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0227.490] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0227.491] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0227.491] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0227.492] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0227.492] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0227.492] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0227.492] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.492] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0227.492] OffsetViewportOrgEx (in: hdc=0x7901185a, x=0, y=0, lppt=0x281ca38 | out: lppt=0x281ca38) returned 1
	[0227.493] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7901185a) returned 0x0
	[0227.493] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0227.493] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.493] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0227.493] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0227.494] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0227.494] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0227.494] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0227.494] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0227.494] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0227.494] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0227.495] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0227.495] GdipCreateRegion (region=0x20c260) returned 0x0
	[0227.495] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0227.495] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0227.495] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0227.495] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0227.496] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0227.496] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0227.496] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0227.496] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0227.496] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0227.496] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0227.497] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0227.497] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0227.497] OffsetViewportOrgEx (in: hdc=0x7901185a, x=0, y=0, lppt=0x281cfd8 | out: lppt=0x281cfd8) returned 1
	[0227.497] GetROP2 (hdc=0x7901185a) returned 13
	[0227.497] GetROP2 (hdc=0x7901185a) returned 13
	[0227.497] GetROP2 (hdc=0x7901185a) returned 13
	[0227.498] GetROP2 (hdc=0x7901185a) returned 13
	[0227.498] GetROP2 (hdc=0x7901185a) returned 13
	[0227.498] GetROP2 (hdc=0x7901185a) returned 13
	[0227.498] GetROP2 (hdc=0x7901185a) returned 13
	[0227.498] GetROP2 (hdc=0x7901185a) returned 13
	[0227.498] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7901185a) returned 0x0
	[0227.499] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0227.499] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x7901185a) returned 0x0
	[0227.499] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0229.680] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0229.680] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0229.680] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0229.680] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0229.680] GdipCreateFromHDC (hdc=0x1501191d, graphics=0x20d7e0) returned 0x0
	[0229.681] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0229.681] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0229.681] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0229.681] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0229.681] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0229.681] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.682] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0229.682] GdipCreateRegion (region=0x20d910) returned 0x0
	[0229.682] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.682] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0229.682] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0229.682] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffffa000dbd) returned 0x0
	[0229.683] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.683] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0229.683] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1501191d) returned 0x0
	[0229.683] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0229.683] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.683] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.684] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.684] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0229.684] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0229.684] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0229.684] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0229.684] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0229.685] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.685] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0229.685] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0229.685] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0229.685] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0229.685] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.686] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.686] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.686] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0229.686] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.686] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0229.686] GdipCreateRegion (region=0x20d120) returned 0x0
	[0229.687] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.687] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0229.687] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0229.687] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0229.687] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.687] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.688] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0229.688] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0229.688] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0229.688] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0229.688] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.688] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0229.689] OffsetViewportOrgEx (in: hdc=0x1501191d, x=0, y=0, lppt=0x281e770 | out: lppt=0x281e770) returned 1
	[0229.689] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1501191d) returned 0x0
	[0229.689] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0229.689] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.689] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.690] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.690] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0229.690] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0229.691] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0229.691] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.691] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0229.691] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0229.692] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0229.692] GdipCreateRegion (region=0x20d070) returned 0x0
	[0229.692] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.692] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0229.692] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0229.693] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0229.693] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.693] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.693] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0229.693] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0229.694] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0229.694] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0229.694] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.694] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0229.694] OffsetViewportOrgEx (in: hdc=0x1501191d, x=0, y=0, lppt=0x281ed10 | out: lppt=0x281ed10) returned 1
	[0229.694] GetROP2 (hdc=0x1501191d) returned 13
	[0229.695] GetROP2 (hdc=0x1501191d) returned 13
	[0229.695] GetROP2 (hdc=0x1501191d) returned 13
	[0229.695] GetROP2 (hdc=0x1501191d) returned 13
	[0229.695] GetROP2 (hdc=0x1501191d) returned 13
	[0229.695] GetROP2 (hdc=0x1501191d) returned 13
	[0229.695] GetROP2 (hdc=0x1501191d) returned 13
	[0229.696] GetROP2 (hdc=0x1501191d) returned 13
	[0229.696] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1501191d) returned 0x0
	[0229.696] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0229.696] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1501191d) returned 0x0
	[0229.696] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0229.696] GdipCreateFromHDC (hdc=0x1701191d, graphics=0x20d7e0) returned 0x0
	[0229.697] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0229.697] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0229.697] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0229.697] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0229.697] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0229.698] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.698] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0229.698] GdipCreateRegion (region=0x20d910) returned 0x0
	[0229.698] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.698] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0229.698] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0229.699] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9fd0dbd) returned 0x0
	[0229.699] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.699] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0229.699] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1701191d) returned 0x0
	[0229.699] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0229.700] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.700] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.700] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.700] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0229.700] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0229.700] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0229.701] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0229.701] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0229.701] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.701] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0229.701] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0229.701] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0229.702] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0229.702] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.702] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.702] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.702] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0229.703] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.703] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0229.703] GdipCreateRegion (region=0x20d120) returned 0x0
	[0229.703] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.703] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0229.703] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0229.704] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0229.704] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.704] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.704] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0229.704] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0229.704] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0229.705] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0229.705] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.705] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0229.705] OffsetViewportOrgEx (in: hdc=0x1701191d, x=0, y=0, lppt=0x281fb70 | out: lppt=0x281fb70) returned 1
	[0229.705] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1701191d) returned 0x0
	[0229.706] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0229.706] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.707] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.707] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.707] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0229.707] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0229.707] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0229.708] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.708] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0229.708] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0229.708] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0229.708] GdipCreateRegion (region=0x20d070) returned 0x0
	[0229.708] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.709] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0229.709] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0229.709] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0229.709] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.709] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.709] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0229.709] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0229.710] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0229.710] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0229.710] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.710] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0229.710] OffsetViewportOrgEx (in: hdc=0x1701191d, x=0, y=0, lppt=0x2820110 | out: lppt=0x2820110) returned 1
	[0229.711] GetROP2 (hdc=0x1701191d) returned 13
	[0229.711] GetROP2 (hdc=0x1701191d) returned 13
	[0229.711] GetROP2 (hdc=0x1701191d) returned 13
	[0229.711] GetROP2 (hdc=0x1701191d) returned 13
	[0229.711] GetROP2 (hdc=0x1701191d) returned 13
	[0229.712] GetROP2 (hdc=0x1701191d) returned 13
	[0229.712] GetROP2 (hdc=0x1701191d) returned 13
	[0229.712] GetROP2 (hdc=0x1701191d) returned 13
	[0229.712] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1701191d) returned 0x0
	[0229.712] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0229.713] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1701191d) returned 0x0
	[0229.713] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0229.919] GdipCreateFromHDC (hdc=0x70107fc, graphics=0x20d7b0) returned 0x0
	[0229.919] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0229.919] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0229.920] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0229.920] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d700) returned 0x0
	[0229.920] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0229.920] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0229.920] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.921] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6d0) returned 0x0
	[0229.921] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.921] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d7a0) returned 0x0
	[0229.921] GdipCreateRegion (region=0x20d670) returned 0x0
	[0229.921] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.921] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0229.922] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0229.922] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d6d0) returned 0x0
	[0229.922] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.922] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0229.922] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d720) returned 0x0
	[0229.922] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.923] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d750) returned 0x0
	[0229.923] OffsetViewportOrgEx (in: hdc=0x70107fc, x=0, y=0, lppt=0x2820db8 | out: lppt=0x2820db8) returned 1
	[0229.923] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70107fc) returned 0x0
	[0229.923] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0229.931] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0229.931] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0229.931] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0229.931] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0229.931] UpdateWindow (hWnd=0x401b4) 
	[0229.931] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0229.931] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0229.931] GdipCreateFromHDC (hdc=0x2a01192a, graphics=0x20cfa0) returned 0x0
	[0229.932] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0229.932] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0229.932] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0229.932] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0229.932] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0229.932] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.933] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0229.933] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0229.933] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.933] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0229.933] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0229.933] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9f80dbd) returned 0x0
	[0229.934] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.934] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0229.934] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a01192a) returned 0x0
	[0229.934] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0229.934] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.934] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.935] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.935] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0229.935] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0229.935] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0229.935] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0229.935] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0229.936] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.936] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0229.936] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0229.936] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0229.936] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0229.937] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.937] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.937] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.937] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0229.937] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.938] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0229.938] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0229.938] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.938] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0229.938] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0229.939] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0229.939] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.939] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.939] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0229.939] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0229.939] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0229.940] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0229.940] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.941] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0229.941] OffsetViewportOrgEx (in: hdc=0x2a01192a, x=0, y=0, lppt=0x2821b80 | out: lppt=0x2821b80) returned 1
	[0229.941] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a01192a) returned 0x0
	[0229.941] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0229.942] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.942] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0229.942] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0229.942] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0229.942] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0229.943] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0229.943] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0229.943] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0229.943] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0229.944] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0229.944] GdipCreateRegion (region=0x20c830) returned 0x0
	[0229.944] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.944] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0229.944] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0229.945] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0229.945] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.945] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.945] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0229.945] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0229.946] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0229.946] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0229.946] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0229.946] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0229.947] SaveDC (hdc=0x2a01192a) returned 1
	[0229.947] OffsetViewportOrgEx (in: hdc=0x2a01192a, x=0, y=0, lppt=0x2822120 | out: lppt=0x2822120) returned 1
	[0229.947] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.947] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.947] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.948] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.948] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.948] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.948] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.948] GetROP2 (hdc=0x2a01192a) returned 13
	[0229.949] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a01192a) returned 0x0
	[0229.949] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0229.949] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2a01192a) returned 0x0
	[0229.949] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0229.949] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0229.949] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0229.949] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0229.949] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0229.950] GetCapture () returned 0x401b4
	[0229.950] ReleaseCapture () 
	[0229.950] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0229.950] GetDIBits (in: hdc=0x4010280, hbm=0x1d05192d, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0229.950] GetDIBits (in: hdc=0x4010280, hbm=0x1d05192d, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0229.950] GdipCreateFromHDC (hdc=0x1401192f, graphics=0x20d750) returned 0x0
	[0229.951] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0229.951] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0229.951] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0229.951] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0229.951] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0229.951] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0229.952] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0229.952] GdipCreateRegion (region=0x20d910) returned 0x0
	[0229.952] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0229.952] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0229.952] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0229.952] GdipCreateRegion (region=0x20d400) returned 0x0
	[0229.953] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0229.953] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0229.953] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0229.953] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0229.953] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.953] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0229.954] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0229.954] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0229.954] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0229.954] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0229.954] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0229.955] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0229.955] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0229.955] OffsetViewportOrgEx (in: hdc=0x1401192f, x=0, y=0, lppt=0x2823ad8 | out: lppt=0x2823ad8) returned 1
	[0230.129] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1401192f) returned 0x0
	[0230.129] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9f50dbd) returned 0x0
	[0230.129] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0230.129] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0230.130] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1401192f) returned 0x0
	[0230.130] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0230.130] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0230.130] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0230.130] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.130] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0230.131] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0230.131] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0230.131] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0230.131] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0230.131] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.132] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0230.132] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1401192f) returned 0x0
	[0230.132] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0230.132] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0230.132] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0230.132] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0230.132] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0230.133] GdipCreateFromHDC (hdc=0x2e01192a, graphics=0x20d7e0) returned 0x0
	[0230.133] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0230.133] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0230.133] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0230.133] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.133] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0230.134] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.134] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.134] GdipCreateRegion (region=0x20d910) returned 0x0
	[0230.134] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.134] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0230.134] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0230.135] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9f30dbd) returned 0x0
	[0230.135] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.135] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0230.135] GdipReleaseDC (graphics=0x1b929550, hdc=0x2e01192a) returned 0x0
	[0230.135] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0230.136] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.136] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.136] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.136] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0230.136] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0230.136] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0230.137] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0230.137] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0230.137] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.137] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0230.137] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0230.137] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0230.138] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0230.138] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.138] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.138] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.138] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0230.138] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.139] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0230.139] GdipCreateRegion (region=0x20d120) returned 0x0
	[0230.139] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.139] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0230.139] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.139] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0230.140] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.140] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.140] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.140] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0230.140] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0230.140] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0230.141] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.141] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0230.141] OffsetViewportOrgEx (in: hdc=0x2e01192a, x=0, y=0, lppt=0x2824c60 | out: lppt=0x2824c60) returned 1
	[0230.141] GdipReleaseDC (graphics=0x1b929550, hdc=0x2e01192a) returned 0x0
	[0230.141] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0230.142] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.142] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.142] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.142] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0230.142] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0230.142] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0230.144] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.144] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0230.144] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0230.144] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0230.144] GdipCreateRegion (region=0x20d070) returned 0x0
	[0230.145] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.145] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0230.145] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.145] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0230.145] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.145] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.146] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.146] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0230.146] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0230.146] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0230.146] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.146] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0230.147] OffsetViewportOrgEx (in: hdc=0x2e01192a, x=0, y=0, lppt=0x2825200 | out: lppt=0x2825200) returned 1
	[0230.147] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.147] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.147] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.147] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.147] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.148] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.148] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.148] GetROP2 (hdc=0x2e01192a) returned 13
	[0230.148] GdipReleaseDC (graphics=0x1b929550, hdc=0x2e01192a) returned 0x0
	[0230.148] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0230.149] GdipReleaseDC (graphics=0x1b929550, hdc=0x2e01192a) returned 0x0
	[0230.149] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0230.149] GdipCreateFromHDC (hdc=0x3001192a, graphics=0x20d7e0) returned 0x0
	[0230.149] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0230.149] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0230.150] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0230.150] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.150] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0230.150] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.150] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.150] GdipCreateRegion (region=0x20d910) returned 0x0
	[0230.151] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.151] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0230.151] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0230.151] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9f00dbd) returned 0x0
	[0230.151] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.151] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0230.152] GdipReleaseDC (graphics=0x1b929550, hdc=0x3001192a) returned 0x0
	[0230.152] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0230.152] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.152] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.152] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.152] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0230.153] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0230.153] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0230.153] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0230.153] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0230.153] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.153] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0230.154] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0230.154] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0230.154] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0230.154] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.154] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.154] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.155] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0230.155] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.155] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0230.155] GdipCreateRegion (region=0x20d120) returned 0x0
	[0230.155] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.155] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0230.156] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.156] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0230.156] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.156] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.156] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.156] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0230.157] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0230.157] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0230.157] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.157] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0230.157] OffsetViewportOrgEx (in: hdc=0x3001192a, x=0, y=0, lppt=0x2826060 | out: lppt=0x2826060) returned 1
	[0230.158] GdipReleaseDC (graphics=0x1b929550, hdc=0x3001192a) returned 0x0
	[0230.158] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0230.158] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.159] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.159] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.159] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0230.159] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0230.160] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0230.160] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.160] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0230.160] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0230.160] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0230.160] GdipCreateRegion (region=0x20d070) returned 0x0
	[0230.161] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.161] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0230.161] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.161] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0230.161] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.161] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.162] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.162] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0230.162] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0230.162] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0230.162] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.162] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0230.163] OffsetViewportOrgEx (in: hdc=0x3001192a, x=0, y=0, lppt=0x2826600 | out: lppt=0x2826600) returned 1
	[0230.163] GetROP2 (hdc=0x3001192a) returned 13
	[0230.163] GetROP2 (hdc=0x3001192a) returned 13
	[0230.163] GetROP2 (hdc=0x3001192a) returned 13
	[0230.163] GetROP2 (hdc=0x3001192a) returned 13
	[0230.164] GetROP2 (hdc=0x3001192a) returned 13
	[0230.164] GetROP2 (hdc=0x3001192a) returned 13
	[0230.164] GetROP2 (hdc=0x3001192a) returned 13
	[0230.164] GetROP2 (hdc=0x3001192a) returned 13
	[0230.164] GdipReleaseDC (graphics=0x1b929550, hdc=0x3001192a) returned 0x0
	[0230.164] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0230.165] GdipReleaseDC (graphics=0x1b929550, hdc=0x3001192a) returned 0x0
	[0230.165] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0230.165] GetDIBits (in: hdc=0x4010280, hbm=0x2305192d, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0230.165] GetDIBits (in: hdc=0x4010280, hbm=0x2305192d, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0230.165] GdipCreateFromHDC (hdc=0xffffffff850116c4, graphics=0x20d800) returned 0x0
	[0230.166] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0230.166] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0230.166] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0230.166] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.166] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0230.166] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.167] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.167] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0230.167] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.167] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0230.167] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0230.168] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0230.168] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0230.168] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0230.168] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.168] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0230.168] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.169] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0230.169] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.169] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.169] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0230.169] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0230.169] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0230.169] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0230.170] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0230.170] OffsetViewportOrgEx (in: hdc=0xffffffff850116c4, x=0, y=0, lppt=0x2827eb0 | out: lppt=0x2827eb0) returned 1
	[0230.170] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff850116c4) returned 0x0
	[0230.171] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9ed0dbd) returned 0x0
	[0230.171] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.171] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0230.178] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0230.179] GdipReleaseDC (graphics=0x1b929550, hdc=0xffffffff850116c4) returned 0x0
	[0230.179] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0230.311] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0230.311] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0230.311] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0230.311] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0230.311] UpdateWindow (hWnd=0x201d8) 
	[0230.312] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0230.312] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0230.312] GdipCreateFromHDC (hdc=0x2a011924, graphics=0x20cfa0) returned 0x0
	[0230.312] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0230.312] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0230.312] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0230.313] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.313] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0230.313] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.313] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.313] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0230.314] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.314] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0230.314] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0230.314] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9eb0dbd) returned 0x0
	[0230.314] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.315] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0230.315] GdipReleaseDC (graphics=0x1b929550, hdc=0x2a011924) returned 0x0
	[0230.315] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0230.315] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.315] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.316] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.316] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0230.316] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0230.316] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0230.316] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0230.316] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0230.317] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.317] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0230.317] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0230.317] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0230.317] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0230.317] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.318] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.318] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.318] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0230.318] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.318] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0230.319] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0230.319] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.319] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0230.319] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.319] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0230.319] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.319] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0230.320] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.320] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0230.320] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0230.320] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0230.320] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.320] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0230.321] OffsetViewportOrgEx (in: hdc=0x2a011924, x=0, y=0, lppt=0x2828da0 | out: lppt=0x2828da0) returned 1
	[0230.321] GdipReleaseDC (graphics=0x1b929550, hdc=0x2a011924) returned 0x0
	[0230.321] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0230.321] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.321] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.322] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.322] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0230.322] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0230.322] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0230.322] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.322] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0230.323] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0230.323] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0230.323] GdipCreateRegion (region=0x20c830) returned 0x0
	[0230.323] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.323] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0230.324] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.324] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0230.324] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.324] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0230.324] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.324] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0230.325] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0230.325] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0230.325] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.325] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0230.325] OffsetViewportOrgEx (in: hdc=0x2a011924, x=0, y=0, lppt=0x2829340 | out: lppt=0x2829340) returned 1
	[0230.325] GetROP2 (hdc=0x2a011924) returned 13
	[0230.326] GetROP2 (hdc=0x2a011924) returned 13
	[0230.326] GetROP2 (hdc=0x2a011924) returned 13
	[0230.326] GetROP2 (hdc=0x2a011924) returned 13
	[0230.326] GetROP2 (hdc=0x2a011924) returned 13
	[0230.326] GetROP2 (hdc=0x2a011924) returned 13
	[0230.326] GetROP2 (hdc=0x2a011924) returned 13
	[0230.327] GetROP2 (hdc=0x2a011924) returned 13
	[0230.327] GdipReleaseDC (graphics=0x1b929550, hdc=0x2a011924) returned 0x0
	[0230.327] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0230.327] GdipReleaseDC (graphics=0x1b929550, hdc=0x2a011924) returned 0x0
	[0230.327] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0230.328] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0230.328] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0230.328] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0230.328] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2829688, Length=0x70 | out: Destination=0x1afe53a0) 
	[0230.328] ShellExecuteExW (pExecInfo=0x2829898*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 
	[0230.360] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) 
	[0230.360] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0230.362] GdipCreateFromHDC (hdc=0x34011924, graphics=0x20c9d0) returned 0x0
	[0230.363] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0230.363] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0230.363] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0230.363] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.363] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0230.363] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0230.364] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.364] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0230.364] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.364] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0230.364] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0230.364] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9e80dbd) returned 0x0
	[0230.365] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.365] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0230.365] GdipReleaseDC (graphics=0x1b929550, hdc=0x34011924) returned 0x0
	[0230.365] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0230.365] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.365] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.366] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.366] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0230.366] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0230.366] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0230.366] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0230.366] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0230.367] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.367] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0230.367] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0230.367] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0230.367] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0230.368] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.368] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.368] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.368] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0230.368] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.368] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0230.369] GdipCreateRegion (region=0x20c310) returned 0x0
	[0230.369] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.369] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0230.369] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.369] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0230.369] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0230.370] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0230.370] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.370] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0230.370] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0230.370] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0230.370] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.371] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0230.371] OffsetViewportOrgEx (in: hdc=0x34011924, x=0, y=0, lppt=0x282a578 | out: lppt=0x282a578) returned 1
	[0230.371] GdipReleaseDC (graphics=0x1b929550, hdc=0x34011924) returned 0x0
	[0230.371] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0230.371] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.372] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.372] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.372] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0230.372] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0230.372] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0230.373] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.373] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0230.373] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0230.373] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0230.373] GdipCreateRegion (region=0x20c260) returned 0x0
	[0230.373] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.374] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0230.374] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.374] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0230.374] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0230.374] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0230.374] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.375] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0230.375] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0230.375] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0230.375] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.375] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0230.376] OffsetViewportOrgEx (in: hdc=0x34011924, x=0, y=0, lppt=0x282ab18 | out: lppt=0x282ab18) returned 1
	[0230.376] GetROP2 (hdc=0x34011924) returned 13
	[0230.376] GetROP2 (hdc=0x34011924) returned 13
	[0230.376] GetROP2 (hdc=0x34011924) returned 13
	[0230.376] GetROP2 (hdc=0x34011924) returned 13
	[0230.376] GetROP2 (hdc=0x34011924) returned 13
	[0230.377] GetROP2 (hdc=0x34011924) returned 13
	[0230.377] GetROP2 (hdc=0x34011924) returned 13
	[0230.377] GetROP2 (hdc=0x34011924) returned 13
	[0230.377] GdipReleaseDC (graphics=0x1b929550, hdc=0x34011924) returned 0x0
	[0230.377] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0230.378] GdipReleaseDC (graphics=0x1b929550, hdc=0x34011924) returned 0x0
	[0230.378] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0230.378] GdipCreateFromHDC (hdc=0x36011924, graphics=0x20c9d0) returned 0x0
	[0230.378] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0230.379] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0230.379] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0230.379] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.379] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0230.379] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0230.380] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.380] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0230.380] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.380] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0230.380] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0230.381] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9e50dbd) returned 0x0
	[0230.381] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.381] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0230.381] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011924) returned 0x0
	[0230.381] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0230.382] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.382] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.382] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.382] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0230.382] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0230.382] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0230.383] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0230.383] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0230.383] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.383] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0230.383] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0230.384] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0230.384] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0230.384] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.384] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.384] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.384] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0230.385] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.385] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0230.385] GdipCreateRegion (region=0x20c310) returned 0x0
	[0230.385] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.385] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0230.386] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0230.386] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0230.386] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0230.386] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0230.386] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0230.386] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0230.387] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0230.387] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0230.387] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.387] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0230.387] OffsetViewportOrgEx (in: hdc=0x36011924, x=0, y=0, lppt=0x282b9a0 | out: lppt=0x282b9a0) returned 1
	[0230.387] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011924) returned 0x0
	[0230.388] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0230.388] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.388] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0230.388] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0230.388] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0230.389] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0230.389] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0230.389] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0230.389] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0230.389] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0230.389] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0230.390] GdipCreateRegion (region=0x20c260) returned 0x0
	[0230.390] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0230.390] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0230.390] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0230.390] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0230.390] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0230.391] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0230.391] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0230.391] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0230.391] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0230.391] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0230.391] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0230.392] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0230.392] OffsetViewportOrgEx (in: hdc=0x36011924, x=0, y=0, lppt=0x282bf40 | out: lppt=0x282bf40) returned 1
	[0230.392] GetROP2 (hdc=0x36011924) returned 13
	[0230.392] GetROP2 (hdc=0x36011924) returned 13
	[0230.392] GetROP2 (hdc=0x36011924) returned 13
	[0230.393] GetROP2 (hdc=0x36011924) returned 13
	[0230.393] GetROP2 (hdc=0x36011924) returned 13
	[0230.393] GetROP2 (hdc=0x36011924) returned 13
	[0230.393] GetROP2 (hdc=0x36011924) returned 13
	[0230.393] GetROP2 (hdc=0x36011924) returned 13
	[0230.393] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011924) returned 0x0
	[0230.394] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0230.394] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011924) returned 0x0
	[0230.394] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0232.693] GdipCreateFromHDC (hdc=0x7011734, graphics=0x20d7e0) returned 0x0
	[0232.694] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0232.694] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0232.694] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0232.694] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0232.694] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0232.695] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0232.695] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0232.695] GdipCreateRegion (region=0x20d910) returned 0x0
	[0232.695] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0232.695] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0232.695] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0232.695] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9e20dbd) returned 0x0
	[0232.696] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0232.696] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0232.696] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011734) returned 0x0
	[0232.697] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0232.697] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0232.697] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0232.698] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0232.698] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0232.698] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0232.699] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0232.700] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0232.700] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0232.701] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0232.701] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0232.701] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0232.701] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0232.702] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0232.702] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0232.702] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0232.702] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0232.702] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0232.702] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0232.703] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0232.703] GdipCreateRegion (region=0x20d120) returned 0x0
	[0232.703] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0232.703] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0232.703] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0232.704] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0232.704] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0232.704] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0232.704] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0232.704] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0232.704] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0232.704] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0232.705] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0232.705] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0232.705] OffsetViewportOrgEx (in: hdc=0x7011734, x=0, y=0, lppt=0x282df50 | out: lppt=0x282df50) returned 1
	[0232.706] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011734) returned 0x0
	[0232.706] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0232.706] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0232.706] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0232.706] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0232.707] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0232.707] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0232.707] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0232.707] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0232.707] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0232.708] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0232.708] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0232.708] GdipCreateRegion (region=0x20d070) returned 0x0
	[0232.708] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0232.708] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0232.708] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0232.709] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0232.709] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0232.709] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0232.709] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0232.709] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0232.709] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0232.710] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0232.710] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0232.710] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0232.710] OffsetViewportOrgEx (in: hdc=0x7011734, x=0, y=0, lppt=0x282e4f0 | out: lppt=0x282e4f0) returned 1
	[0232.710] GetROP2 (hdc=0x7011734) returned 13
	[0232.711] GetROP2 (hdc=0x7011734) returned 13
	[0232.711] GetROP2 (hdc=0x7011734) returned 13
	[0232.711] GetROP2 (hdc=0x7011734) returned 13
	[0232.711] GetROP2 (hdc=0x7011734) returned 13
	[0232.711] GetROP2 (hdc=0x7011734) returned 13
	[0232.711] GetROP2 (hdc=0x7011734) returned 13
	[0232.711] GetROP2 (hdc=0x7011734) returned 13
	[0232.712] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011734) returned 0x0
	[0232.712] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0232.712] GdipReleaseDC (graphics=0x1b929550, hdc=0x7011734) returned 0x0
	[0232.712] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0233.523] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0233.523] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0233.523] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0233.523] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0233.523] GdipCreateFromHDC (hdc=0x2c011986, graphics=0x20d7e0) returned 0x0
	[0233.524] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0233.524] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0233.524] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0233.524] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0233.524] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0233.525] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0233.525] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0233.525] GdipCreateRegion (region=0x20d910) returned 0x0
	[0233.525] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.525] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0233.525] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0233.526] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9df0dbd) returned 0x0
	[0233.526] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.526] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0233.526] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c011986) returned 0x0
	[0233.526] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0233.527] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.527] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.527] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.527] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0233.527] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0233.527] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0233.528] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0233.528] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0233.528] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.528] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0233.529] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0233.529] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0233.529] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0233.529] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.529] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.530] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.530] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0233.530] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.530] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0233.530] GdipCreateRegion (region=0x20d120) returned 0x0
	[0233.531] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.531] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0233.531] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0233.531] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0233.531] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0233.531] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0233.532] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0233.532] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0233.532] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0233.532] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0233.532] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.532] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0233.533] OffsetViewportOrgEx (in: hdc=0x2c011986, x=0, y=0, lppt=0x282f3e8 | out: lppt=0x282f3e8) returned 1
	[0233.533] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c011986) returned 0x0
	[0233.533] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0233.533] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.533] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.533] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.534] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0233.534] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0233.534] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0233.534] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.534] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0233.535] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0233.535] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0233.535] GdipCreateRegion (region=0x20d070) returned 0x0
	[0233.535] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.535] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0233.535] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0233.535] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0233.536] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0233.536] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0233.536] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0233.536] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0233.536] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0233.536] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0233.537] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.537] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0233.537] OffsetViewportOrgEx (in: hdc=0x2c011986, x=0, y=0, lppt=0x282f988 | out: lppt=0x282f988) returned 1
	[0233.537] GetROP2 (hdc=0x2c011986) returned 13
	[0233.537] GetROP2 (hdc=0x2c011986) returned 13
	[0233.537] GetROP2 (hdc=0x2c011986) returned 13
	[0233.538] GetROP2 (hdc=0x2c011986) returned 13
	[0233.538] GetROP2 (hdc=0x2c011986) returned 13
	[0233.538] GetROP2 (hdc=0x2c011986) returned 13
	[0233.538] GetROP2 (hdc=0x2c011986) returned 13
	[0233.538] GetROP2 (hdc=0x2c011986) returned 13
	[0233.539] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c011986) returned 0x0
	[0233.539] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0233.539] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c011986) returned 0x0
	[0233.539] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0233.745] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0233.745] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0233.745] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0233.745] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0233.746] UpdateWindow (hWnd=0x201d8) 
	[0233.746] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0233.746] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0233.746] GdipCreateFromHDC (hdc=0x36011986, graphics=0x20cfa0) returned 0x0
	[0233.746] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0233.777] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0233.777] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0233.778] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0233.778] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0233.778] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0233.778] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0233.778] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0233.779] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.779] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0233.779] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0233.779] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9dc0dbd) returned 0x0
	[0233.779] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.779] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0233.780] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011986) returned 0x0
	[0233.780] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0233.780] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.780] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.780] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.780] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0233.781] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0233.781] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0233.781] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0233.781] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0233.781] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.781] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0233.782] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0233.782] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0233.782] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0233.782] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.782] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.782] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.783] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0233.783] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.783] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0233.783] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0233.783] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.783] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0233.784] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0233.784] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0233.784] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0233.784] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0233.784] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0233.784] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0233.785] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0233.785] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0233.785] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.785] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0233.785] OffsetViewportOrgEx (in: hdc=0x36011986, x=0, y=0, lppt=0x2830980 | out: lppt=0x2830980) returned 1
	[0233.785] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011986) returned 0x0
	[0233.786] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0233.786] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.786] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.786] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.786] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0233.787] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0233.787] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0233.787] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.787] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0233.787] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0233.787] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0233.788] GdipCreateRegion (region=0x20c830) returned 0x0
	[0233.788] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.788] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0233.788] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0233.788] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0233.788] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0233.789] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0233.789] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0233.789] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0233.789] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0233.789] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0233.789] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.789] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0233.790] OffsetViewportOrgEx (in: hdc=0x36011986, x=0, y=0, lppt=0x2830f20 | out: lppt=0x2830f20) returned 1
	[0233.790] GetROP2 (hdc=0x36011986) returned 13
	[0233.790] GetROP2 (hdc=0x36011986) returned 13
	[0233.790] GetROP2 (hdc=0x36011986) returned 13
	[0233.790] GetROP2 (hdc=0x36011986) returned 13
	[0233.791] GetROP2 (hdc=0x36011986) returned 13
	[0233.791] GetROP2 (hdc=0x36011986) returned 13
	[0233.791] GetROP2 (hdc=0x36011986) returned 13
	[0233.791] GetROP2 (hdc=0x36011986) returned 13
	[0233.791] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011986) returned 0x0
	[0233.791] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0233.792] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011986) returned 0x0
	[0233.792] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0233.792] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0233.792] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0233.793] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0233.793] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2831268, Length=0x70 | out: Destination=0x1afe53a0) 
	[0233.793] ShellExecuteExW (in: pExecInfo=0x2831478*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2831478*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="\xffff\x74\x74\x70\x73\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x72\x6f\x66\x69\x6c\x65\x2e\x70\x68\x70\x3f\x69\x64\x3d\x31\x30\x30\x30\x32\x37\x30\x39\x31\x34\x35\x37\x37\x35\x34", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0
	[0233.828] GdipCreateFromHDC (hdc=0x3f011986, graphics=0x20c9d0) returned 0x0
	[0233.828] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0233.828] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0233.829] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0233.829] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0233.829] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0233.829] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0233.829] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0233.829] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0233.830] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.830] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0233.830] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0233.830] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9d90dbd) returned 0x0
	[0233.830] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.830] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0233.831] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f011986) returned 0x0
	[0233.831] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0233.831] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.831] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.831] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.831] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0233.832] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0233.832] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0233.832] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0233.832] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0233.832] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.832] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0233.833] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0233.833] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0233.833] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0233.833] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.833] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.833] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.834] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0233.834] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.834] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0233.834] GdipCreateRegion (region=0x20c310) returned 0x0
	[0233.834] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.834] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0233.835] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0233.835] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0233.835] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0233.835] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0233.835] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0233.835] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0233.836] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0233.836] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0233.836] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.836] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0233.837] SaveDC (hdc=0x3f011986) returned 1
	[0233.837] OffsetViewportOrgEx (in: hdc=0x3f011986, x=0, y=0, lppt=0x2832180 | out: lppt=0x2832180) returned 1
	[0233.837] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f011986) returned 0x0
	[0233.837] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0233.837] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.838] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0233.838] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0233.838] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0233.838] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0233.838] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0233.838] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0233.839] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0233.839] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0233.839] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0233.839] GdipCreateRegion (region=0x20c260) returned 0x0
	[0233.839] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0233.839] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0233.840] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0233.841] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0233.842] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0233.842] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0233.842] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0233.842] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0233.842] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0233.843] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0233.843] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0233.843] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0233.843] OffsetViewportOrgEx (in: hdc=0x3f011986, x=0, y=0, lppt=0x2832720 | out: lppt=0x2832720) returned 1
	[0233.843] GetROP2 (hdc=0x3f011986) returned 13
	[0233.843] GetROP2 (hdc=0x3f011986) returned 13
	[0233.844] GetROP2 (hdc=0x3f011986) returned 13
	[0233.844] GetROP2 (hdc=0x3f011986) returned 13
	[0233.844] GetROP2 (hdc=0x3f011986) returned 13
	[0233.844] GetROP2 (hdc=0x3f011986) returned 13
	[0233.844] GetROP2 (hdc=0x3f011986) returned 13
	[0233.844] GetROP2 (hdc=0x3f011986) returned 13
	[0233.845] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f011986) returned 0x0
	[0233.845] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0233.845] GdipReleaseDC (graphics=0x1b929550, hdc=0x3f011986) returned 0x0
	[0233.845] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0234.070] GdipCreateFromHDC (hdc=0x21010ab2, graphics=0x20d7e0) returned 0x0
	[0234.071] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0234.071] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0234.071] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0234.071] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0234.071] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0234.072] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0234.072] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0234.072] GdipCreateRegion (region=0x20d910) returned 0x0
	[0234.072] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0234.072] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0234.072] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0234.073] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9d60dbd) returned 0x0
	[0234.073] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0234.073] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0234.073] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010ab2) returned 0x0
	[0234.073] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0234.074] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0234.074] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0234.074] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0234.074] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0234.074] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0234.074] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0234.075] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0234.075] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0234.075] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0234.075] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0234.075] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0234.075] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0234.076] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0234.076] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0234.076] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0234.076] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0234.076] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0234.076] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0234.077] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0234.077] GdipCreateRegion (region=0x20d120) returned 0x0
	[0234.077] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0234.077] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0234.077] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0234.077] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0234.078] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0234.078] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0234.078] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0234.078] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0234.078] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0234.078] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0234.079] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0234.079] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0234.079] OffsetViewportOrgEx (in: hdc=0x21010ab2, x=0, y=0, lppt=0x28336a0 | out: lppt=0x28336a0) returned 1
	[0234.079] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010ab2) returned 0x0
	[0234.079] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0234.080] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0234.080] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0234.080] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0234.080] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0234.080] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0234.080] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0234.081] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0234.081] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0234.081] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0234.081] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0234.081] GdipCreateRegion (region=0x20d070) returned 0x0
	[0234.082] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0234.082] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0234.082] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0234.082] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0234.082] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0234.082] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0234.083] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0234.083] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0234.083] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0234.083] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0234.083] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0234.083] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0234.084] OffsetViewportOrgEx (in: hdc=0x21010ab2, x=0, y=0, lppt=0x2833c40 | out: lppt=0x2833c40) returned 1
	[0234.084] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.084] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.084] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.084] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.085] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.085] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.085] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.085] GetROP2 (hdc=0x21010ab2) returned 13
	[0234.085] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010ab2) returned 0x0
	[0234.085] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0234.086] GdipReleaseDC (graphics=0x1b929550, hdc=0x21010ab2) returned 0x0
	[0234.086] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0235.721] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d770) returned 0x0
	[0235.721] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0235.721] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0235.722] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0235.722] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d6c0) returned 0x0
	[0235.722] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0235.722] GdipCreateRegion (region=0x20d660) returned 0x0
	[0235.722] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0235.722] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d690) returned 0x0
	[0235.723] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0235.723] GdipSaveGraphics (graphics=0x1b929550, state=0x20d760) returned 0x0
	[0235.723] GdipCreateRegion (region=0x20d630) returned 0x0
	[0235.723] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0235.723] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0235.723] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0235.724] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d690) returned 0x0
	[0235.724] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0235.724] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0235.724] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6e0) returned 0x0
	[0235.724] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0235.724] GdipGetDC (graphics=0x1b929550, hdc=0x20d710) returned 0x0
	[0235.725] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x28343a8 | out: lppt=0x28343a8) returned 1
	[0235.725] GdipReleaseDC (graphics=0x1b929550, hdc=0x10107f8) returned 0x0
	[0235.725] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0235.726] _TrackMouseEvent (in: lpEventTrack=0x263d9e8 | out: lpEventTrack=0x263d9e8) returned 1
	[0235.726] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) 
	[0235.726] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0235.726] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0235.726] GetDIBits (in: hdc=0x48010f97, hbm=0x140519d6, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0235.727] GetDIBits (in: hdc=0x48010f97, hbm=0x140519d6, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0235.727] GdipCreateFromHDC (hdc=0x480119d3, graphics=0x20d750) returned 0x0
	[0235.727] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0235.727] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0235.727] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0235.728] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0235.728] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0235.728] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0235.728] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0235.728] GdipCreateRegion (region=0x20d910) returned 0x0
	[0235.729] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0235.729] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0235.729] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0235.729] GdipCreateRegion (region=0x20d400) returned 0x0
	[0235.729] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0235.729] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0235.730] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0235.730] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0235.730] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0235.730] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0235.731] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0235.731] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0235.731] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0235.731] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0235.731] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0235.732] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0235.732] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0235.732] OffsetViewportOrgEx (in: hdc=0x480119d3, x=0, y=0, lppt=0x2835c10 | out: lppt=0x2835c10) returned 1
	[0235.732] GdipReleaseDC (graphics=0x1b929550, hdc=0x480119d3) returned 0x0
	[0235.732] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9d10dbd) returned 0x0
	[0235.733] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0235.733] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0235.733] GdipReleaseDC (graphics=0x1b929550, hdc=0x480119d3) returned 0x0
	[0235.733] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0235.733] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0235.733] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0235.734] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0235.734] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0235.734] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0235.734] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0235.734] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0235.735] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0235.735] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0235.735] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0235.735] GdipReleaseDC (graphics=0x1b929550, hdc=0x480119d3) returned 0x0
	[0235.735] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0235.736] GdipCreateFromHDC (hdc=0x4d010b84, graphics=0x20d7e0) returned 0x0
	[0235.736] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0235.736] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0235.736] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0235.736] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0235.736] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0235.737] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0235.737] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0235.737] GdipCreateRegion (region=0x20d910) returned 0x0
	[0235.737] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0235.737] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0235.737] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0235.738] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9cf0dbd) returned 0x0
	[0235.738] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0235.738] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0235.739] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4d010b84) returned 0x0
	[0235.739] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0235.739] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0235.739] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0235.739] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0235.740] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0235.740] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0235.740] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0235.740] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0235.740] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0235.740] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0235.741] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0235.741] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0235.741] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0235.741] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0235.741] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0235.741] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0235.742] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0235.742] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0235.742] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0235.742] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0235.742] GdipCreateRegion (region=0x20d120) returned 0x0
	[0235.743] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0235.743] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0235.748] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0235.749] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0235.749] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0235.749] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0235.749] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0235.749] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0235.750] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0235.750] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0235.750] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0235.750] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0235.751] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd90407f9
	[0235.751] OffsetViewportOrgEx (in: hdc=0x4d010b84, x=0, y=0, lppt=0x2836d18 | out: lppt=0x2836d18) returned 1
	[0235.752] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4d010b84) returned 0x0
	[0235.752] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0235.752] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0235.752] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0235.752] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0235.752] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0235.753] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0235.753] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0235.753] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0235.753] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0235.753] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0235.754] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0235.754] GdipCreateRegion (region=0x20d070) returned 0x0
	[0235.754] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0235.754] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0235.754] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0235.755] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0235.755] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0235.755] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0235.755] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0235.755] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0235.755] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0235.756] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0235.756] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0235.756] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0235.756] OffsetViewportOrgEx (in: hdc=0x4d010b84, x=0, y=0, lppt=0x28372b8 | out: lppt=0x28372b8) returned 1
	[0235.756] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.756] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.757] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.757] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.757] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.757] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.757] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.757] GetROP2 (hdc=0x4d010b84) returned 13
	[0235.758] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4d010b84) returned 0x0
	[0235.758] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0235.758] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4d010b84) returned 0x0
	[0235.758] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0235.759] GetDIBits (in: hdc=0x70107fc, hbm=0x4b0519c7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0235.759] GetDIBits (in: hdc=0x70107fc, hbm=0x4b0519c7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0235.759] GdipCreateFromHDC (hdc=0x180119d6, graphics=0x20d800) returned 0x0
	[0235.760] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0235.760] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0235.760] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0235.760] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0235.760] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0235.760] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0235.761] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0235.761] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0235.761] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0235.761] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0235.761] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0235.761] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0235.762] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0235.762] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0235.762] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0235.762] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0235.762] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0235.762] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0235.763] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0235.763] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0235.763] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0235.763] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0235.763] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0235.763] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0235.764] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0235.764] OffsetViewportOrgEx (in: hdc=0x180119d6, x=0, y=0, lppt=0x2838b80 | out: lppt=0x2838b80) returned 1
	[0235.764] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180119d6) returned 0x0
	[0235.764] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9cc0dbd) returned 0x0
	[0235.765] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0235.765] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0235.772] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0235.772] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x180119d6) returned 0x0
	[0235.772] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0236.262] _TrackMouseEvent (in: lpEventTrack=0x2664f08 | out: lpEventTrack=0x2664f08) returned 1
	[0236.262] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0236.262] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0236.262] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0236.262] GdipCreateFromHDC (hdc=0xffffffffa7011929, graphics=0x20d7e0) returned 0x0
	[0236.263] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0236.263] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0236.263] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0236.263] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.263] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0236.263] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.264] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.264] GdipCreateRegion (region=0x20d910) returned 0x0
	[0236.264] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.264] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0236.264] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0236.264] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9ca0dbd) returned 0x0
	[0236.265] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.265] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0236.265] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa7011929) returned 0x0
	[0236.265] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0236.265] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.266] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.266] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.266] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0236.266] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0236.266] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0236.267] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0236.267] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0236.267] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.267] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0236.267] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0236.267] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0236.268] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0236.268] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.268] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.268] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.268] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0236.269] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.269] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0236.269] GdipCreateRegion (region=0x20d120) returned 0x0
	[0236.269] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.269] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0236.269] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0236.270] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0236.270] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0236.270] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0236.270] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0236.270] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0236.270] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0236.271] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0236.271] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.271] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0236.271] OffsetViewportOrgEx (in: hdc=0xffffffffa7011929, x=0, y=0, lppt=0x2839f80 | out: lppt=0x2839f80) returned 1
	[0236.271] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa7011929) returned 0x0
	[0236.272] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0236.272] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.272] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.272] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.272] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0236.272] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0236.273] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0236.273] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.273] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0236.273] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0236.273] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0236.274] GdipCreateRegion (region=0x20d070) returned 0x0
	[0236.274] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.274] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0236.274] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.274] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0236.274] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.275] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.275] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.275] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0236.275] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0236.275] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0236.275] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.276] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0236.276] OffsetViewportOrgEx (in: hdc=0xffffffffa7011929, x=0, y=0, lppt=0x283a520 | out: lppt=0x283a520) returned 1
	[0236.276] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.276] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.276] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.277] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.277] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.277] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.277] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.277] GetROP2 (hdc=0xffffffffa7011929) returned 13
	[0236.278] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa7011929) returned 0x0
	[0236.278] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0236.278] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa7011929) returned 0x0
	[0236.278] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0236.278] GdipCreateFromHDC (hdc=0xffffffffa9011929, graphics=0x20d7e0) returned 0x0
	[0236.279] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0236.279] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0236.279] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0236.279] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0236.279] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0236.279] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0236.280] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0236.280] GdipCreateRegion (region=0x20d910) returned 0x0
	[0236.280] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.280] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0236.280] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0236.280] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9c70dbd) returned 0x0
	[0236.281] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.281] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0236.281] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa9011929) returned 0x0
	[0236.312] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0236.312] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.312] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.312] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.312] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0236.312] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0236.312] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0236.312] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0236.312] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0236.312] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.312] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.312] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.312] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0236.312] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.312] CoTaskMemFree (pv=0x1b067a00) 
	[0236.312] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0236.313] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0236.313] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0236.313] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0236.313] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.313] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.313] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.313] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0236.313] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.313] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.313] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.313] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0236.313] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.313] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0236.313] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.313] CoTaskMemFree (pv=0x1b067a00) 
	[0236.314] GdipCreateRegion (region=0x20d120) returned 0x0
	[0236.314] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.314] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0236.314] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.314] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0236.314] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0236.314] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.314] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.314] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.314] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0236.314] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0236.314] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0236.314] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.314] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.314] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0236.314] GetCurrentObject (hdc=0xffffffffa9011929, type=0x1) returned 0x1b00017
	[0236.314] GetCurrentObject (hdc=0xffffffffa9011929, type=0x2) returned 0x1900010
	[0236.314] GetCurrentObject (hdc=0xffffffffa9011929, type=0x7) returned 0x140507d2
	[0236.314] GetCurrentObject (hdc=0xffffffffa9011929, type=0x6) returned 0x18a002e
	[0236.315] SaveDC (hdc=0xffffffffa9011929) returned 1
	[0236.315] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x72040710
	[0236.315] GetClipRgn (hdc=0xffffffffa9011929, hrgn=0x72040710) returned 0
	[0236.315] SelectClipRgn (hdc=0xffffffffa9011929, hrgn=0xffffffffde0407f9) returned 2
	[0236.315] DeleteObject (ho=0x72040710) returned 1
	[0236.315] DeleteObject (ho=0xffffffffde0407f9) returned 1
	[0236.315] OffsetViewportOrgEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x26924d0 | out: lppt=0x26924d0) returned 1
	[0236.315] GetNearestColor (hdc=0xffffffffa9011929, color=0xf0f0f0) returned 0xf0f0f0
	[0236.315] CreateSolidBrush (color=0xf0f0f0) returned 0x6f1007c0
	[0236.315] FillRect (hDC=0xffffffffa9011929, lprc=0x20d1d0, hbr=0x6f1007c0) returned 1
	[0236.315] DeleteObject (ho=0x6f1007c0) returned 1
	[0236.315] RestoreDC (hdc=0xffffffffa9011929, nSavedDC=-1) returned 1
	[0236.315] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.315] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa9011929) returned 0x0
	[0236.315] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.316] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0236.316] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.316] CoTaskMemFree (pv=0x1b067a00) 
	[0236.316] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0236.316] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.316] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.316] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.316] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0236.316] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0236.316] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.316] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0236.316] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.316] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.316] GetFocus () returned 0x401b4
	[0236.316] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.316] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0236.317] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.317] CoTaskMemFree (pv=0x1b067a00) 
	[0236.317] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0236.317] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0236.317] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.317] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0236.317] GdipCreateRegion (region=0x20d070) returned 0x0
	[0236.317] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.317] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0236.317] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0236.317] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0236.317] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0236.317] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0236.318] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0236.318] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0236.318] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0236.318] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0236.318] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0236.318] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.318] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.318] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0236.318] GetCurrentObject (hdc=0xffffffffa9011929, type=0x1) returned 0x1b00017
	[0236.318] GetCurrentObject (hdc=0xffffffffa9011929, type=0x2) returned 0x1900010
	[0236.318] GetCurrentObject (hdc=0xffffffffa9011929, type=0x7) returned 0x140507d2
	[0236.318] GetCurrentObject (hdc=0xffffffffa9011929, type=0x6) returned 0x18a002e
	[0236.318] SaveDC (hdc=0xffffffffa9011929) returned 1
	[0236.318] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffdf0407f9
	[0236.318] GetClipRgn (hdc=0xffffffffa9011929, hrgn=0xffffffffdf0407f9) returned 0
	[0236.318] SelectClipRgn (hdc=0xffffffffa9011929, hrgn=0x73040710) returned 2
	[0236.318] DeleteObject (ho=0xffffffffdf0407f9) returned 1
	[0236.318] DeleteObject (ho=0x73040710) returned 1
	[0236.318] OffsetViewportOrgEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x2692a70 | out: lppt=0x2692a70) returned 1
	[0236.319] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.319] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.319] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.319] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x513019c7
	[0236.319] SelectObject (hdc=0xffffffffa9011929, h=0x513019c7) returned 0x1b00017
	[0236.319] MoveToEx (in: hdc=0xffffffffa9011929, x=126, y=1, lppt=0x2692ad8 | out: lppt=0x2692ad8) returned 1
	[0236.319] LineTo (hdc=0xffffffffa9011929, x=1, y=1) returned 1
	[0236.319] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.319] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.319] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.319] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.319] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.319] SelectObject (hdc=0xffffffffa9011929, h=0x513019c7) returned 0x513019c7
	[0236.319] MoveToEx (in: hdc=0xffffffffa9011929, x=1, y=1, lppt=0x2692af0 | out: lppt=0x2692af0) returned 1
	[0236.319] LineTo (hdc=0xffffffffa9011929, x=1, y=39) returned 1
	[0236.319] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.319] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.319] SelectObject (hdc=0xffffffffa9011929, h=0x1b00017) returned 0x513019c7
	[0236.319] DeleteObject (ho=0x513019c7) returned 1
	[0236.319] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.319] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.319] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.320] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xffffffff983019cc
	[0236.320] SelectObject (hdc=0xffffffffa9011929, h=0xffffffff983019cc) returned 0x1b00017
	[0236.320] MoveToEx (in: hdc=0xffffffffa9011929, x=1, y=39, lppt=0x2692b58 | out: lppt=0x2692b58) returned 1
	[0236.320] LineTo (hdc=0xffffffffa9011929, x=126, y=39) returned 1
	[0236.320] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.320] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.320] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.320] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.320] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.320] SelectObject (hdc=0xffffffffa9011929, h=0xffffffff983019cc) returned 0xffffffff983019cc
	[0236.320] MoveToEx (in: hdc=0xffffffffa9011929, x=126, y=39, lppt=0x2692b70 | out: lppt=0x2692b70) returned 1
	[0236.320] LineTo (hdc=0xffffffffa9011929, x=126, y=0) returned 1
	[0236.320] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.320] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.320] SelectObject (hdc=0xffffffffa9011929, h=0x1b00017) returned 0xffffffff983019cc
	[0236.320] DeleteObject (ho=0xffffffff983019cc) returned 1
	[0236.320] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.320] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.320] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.320] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x523019c7
	[0236.321] SelectObject (hdc=0xffffffffa9011929, h=0x523019c7) returned 0x1b00017
	[0236.321] MoveToEx (in: hdc=0xffffffffa9011929, x=125, y=2, lppt=0x2692bd8 | out: lppt=0x2692bd8) returned 1
	[0236.321] LineTo (hdc=0xffffffffa9011929, x=2, y=2) returned 1
	[0236.321] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.321] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.321] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.321] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.321] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.321] SelectObject (hdc=0xffffffffa9011929, h=0x523019c7) returned 0x523019c7
	[0236.321] MoveToEx (in: hdc=0xffffffffa9011929, x=2, y=2, lppt=0x2692bf0 | out: lppt=0x2692bf0) returned 1
	[0236.321] LineTo (hdc=0xffffffffa9011929, x=2, y=38) returned 1
	[0236.321] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.321] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.321] SelectObject (hdc=0xffffffffa9011929, h=0x1b00017) returned 0x523019c7
	[0236.321] DeleteObject (ho=0x523019c7) returned 1
	[0236.321] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.321] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.321] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.321] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xffffffff993019cc
	[0236.321] SelectObject (hdc=0xffffffffa9011929, h=0xffffffff993019cc) returned 0x1b00017
	[0236.321] MoveToEx (in: hdc=0xffffffffa9011929, x=2, y=38, lppt=0x2692c58 | out: lppt=0x2692c58) returned 1
	[0236.321] LineTo (hdc=0xffffffffa9011929, x=125, y=38) returned 1
	[0236.321] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.321] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.321] GetROP2 (hdc=0xffffffffa9011929) returned 13
	[0236.322] GetBkMode (hdc=0xffffffffa9011929) returned 2
	[0236.322] SetBkMode (hdc=0xffffffffa9011929, mode=1) returned 2
	[0236.322] SelectObject (hdc=0xffffffffa9011929, h=0xffffffff993019cc) returned 0xffffffff993019cc
	[0236.322] MoveToEx (in: hdc=0xffffffffa9011929, x=125, y=38, lppt=0x2692c70 | out: lppt=0x2692c70) returned 1
	[0236.322] LineTo (hdc=0xffffffffa9011929, x=125, y=1) returned 1
	[0236.322] SetBkMode (hdc=0xffffffffa9011929, mode=2) returned 1
	[0236.322] MoveToEx (in: hdc=0xffffffffa9011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.322] SelectObject (hdc=0xffffffffa9011929, h=0x1b00017) returned 0xffffffff993019cc
	[0236.322] DeleteObject (ho=0xffffffff993019cc) returned 1
	[0236.322] RestoreDC (hdc=0xffffffffa9011929, nSavedDC=-1) returned 1
	[0236.322] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.322] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa9011929) returned 0x0
	[0236.322] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0236.322] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0xffffffffa9011929, x1=0, y1=0, rop=0xcc0020) returned 1
	[0236.322] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.322] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa9011929) returned 0x0
	[0236.322] SelectObject (hdc=0xffffffffa9011929, h=0x185000f) returned 0x140507d2
	[0236.322] DeleteDC (hdc=0xffffffffa9011929) returned 1
	[0236.322] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.322] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0236.322] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0236.322] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0236.322] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.322] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.323] WaitMessage () returned 1
	[0236.368] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.368] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.368] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.368] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.368] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.368] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.368] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.368] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.368] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.368] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.368] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x160055) returned 0x0
	[0236.368] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.368] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.368] WaitMessage () returned 1
	[0236.493] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.493] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.493] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.493] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.493] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.493] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0236.493] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe20131) returned 0x0
	[0236.494] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0236.494] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0236.494] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x0, lParam=0x201a6) returned 0x1
	[0236.494] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0236.494] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0236.494] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0236.495] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x50120) returned 0x1
	[0236.495] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0236.495] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0236.495] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0236.496] GetFocus () returned 0x401b4
	[0236.496] SetFocus (hWnd=0x201d8) returned 0x401b4
	[0236.496] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x8, wParam=0x201d8, lParam=0x0) returned 0x0
	[0236.496] GetStockObject (i=5) returned 0x1900015
	[0236.496] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0236.496] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0236.496] GetCapture () returned 0x0
	[0236.496] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0236.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0236.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0236.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0236.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0236.497] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0236.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x401b4, lParam=0x0) returned 0x0
	[0236.497] GetStockObject (i=5) returned 0x1900015
	[0236.497] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0236.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0236.497] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0236.497] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.497] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.498] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.498] GetKeyState (nVirtKey=1) returned -128
	[0236.498] GetKeyState (nVirtKey=2) returned 0
	[0236.498] GetKeyState (nVirtKey=4) returned 0
	[0236.498] GetKeyState (nVirtKey=5) returned 0
	[0236.498] GetKeyState (nVirtKey=6) returned 0
	[0236.498] IsWindowVisible (hWnd=0x201d8) returned 1
	[0236.498] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0236.498] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0236.498] GetFocus () returned 0x201d8
	[0236.498] GetFocus () returned 0x201d8
	[0236.498] GetFocus () returned 0x201d8
	[0236.498] GetKeyState (nVirtKey=1) returned -128
	[0236.498] GetKeyState (nVirtKey=2) returned 0
	[0236.498] GetKeyState (nVirtKey=4) returned 0
	[0236.498] GetKeyState (nVirtKey=5) returned 0
	[0236.498] GetKeyState (nVirtKey=6) returned 0
	[0236.498] GetCapture () returned 0x0
	[0236.498] SetCapture (hWnd=0x201d8) returned 0x0
	[0236.498] GetKeyState (nVirtKey=1) returned -128
	[0236.498] GetKeyState (nVirtKey=2) returned 0
	[0236.498] GetKeyState (nVirtKey=4) returned 0
	[0236.498] GetKeyState (nVirtKey=5) returned 0
	[0236.498] GetKeyState (nVirtKey=6) returned 0
	[0236.498] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0236.498] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0236.498] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.498] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.498] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.498] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0236.498] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.498] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.498] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.498] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0236.498] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.498] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.498] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.498] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.498] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0236.498] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x2692e20, cPoints=0x1 | out: lpPoints=0x2692e20) returned 30606029
	[0236.498] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0236.499] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0236.499] UpdateWindow (hWnd=0x201d8) returned 1
	[0236.499] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0236.499] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0236.499] CreateCompatibleDC (hdc=0x70107fc) returned 0xffffffffb2011929
	[0236.499] SelectObject (hdc=0xffffffffb2011929, h=0x140507d2) returned 0x185000f
	[0236.499] GdipCreateFromHDC (hdc=0xffffffffb2011929, graphics=0x20cfa0) returned 0x0
	[0236.499] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0236.499] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0236.499] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0236.499] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.499] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0236.499] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0236.499] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.499] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0236.499] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.499] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.499] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0236.499] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.499] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0236.499] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0236.499] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9c40dbd) returned 0x0
	[0236.500] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.500] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.500] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0236.500] GetCurrentObject (hdc=0xffffffffb2011929, type=0x1) returned 0x1b00017
	[0236.500] GetCurrentObject (hdc=0xffffffffb2011929, type=0x2) returned 0x1900010
	[0236.500] GetCurrentObject (hdc=0xffffffffb2011929, type=0x7) returned 0x140507d2
	[0236.500] GetCurrentObject (hdc=0xffffffffb2011929, type=0x6) returned 0x18a002e
	[0236.500] SaveDC (hdc=0xffffffffb2011929) returned 1
	[0236.500] GetNearestColor (hdc=0xffffffffb2011929, color=0xf0f0f0) returned 0xf0f0f0
	[0236.500] GetNearestColor (hdc=0xffffffffb2011929, color=0xa0a0a0) returned 0xa0a0a0
	[0236.500] GetNearestColor (hdc=0xffffffffb2011929, color=0x696969) returned 0x696969
	[0236.501] GetNearestColor (hdc=0xffffffffb2011929, color=0xa0a0a0) returned 0xa0a0a0
	[0236.501] GetNearestColor (hdc=0xffffffffb2011929, color=0x0) returned 0x0
	[0236.501] GetNearestColor (hdc=0xffffffffb2011929, color=0xffffff) returned 0xffffff
	[0236.501] GetNearestColor (hdc=0xffffffffb2011929, color=0xe5e5e5) returned 0xe5e5e5
	[0236.501] GetNearestColor (hdc=0xffffffffb2011929, color=0xd8d8d8) returned 0xd8d8d8
	[0236.501] GetNearestColor (hdc=0xffffffffb2011929, color=0x0) returned 0x0
	[0236.501] RestoreDC (hdc=0xffffffffb2011929, nSavedDC=-1) returned 1
	[0236.501] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.501] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb2011929) returned 0x0
	[0236.501] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.501] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0236.502] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.502] CoTaskMemFree (pv=0x1b067980) 
	[0236.502] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0236.502] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.502] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.502] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.502] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0236.502] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0236.502] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0236.502] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0236.502] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0236.502] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.502] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.502] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.502] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0236.502] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.502] CoTaskMemFree (pv=0x1b067980) 
	[0236.502] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0236.502] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0236.502] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0236.503] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0236.503] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.503] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.503] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.503] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0236.503] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.503] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.503] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0236.503] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0236.503] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.503] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0236.503] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.503] CoTaskMemFree (pv=0x1b067980) 
	[0236.503] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0236.503] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.503] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0236.504] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0236.504] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0236.504] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0236.504] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0236.505] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0236.505] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0236.505] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0236.505] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0236.505] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0236.505] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0236.506] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.506] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0236.506] GetCurrentObject (hdc=0xffffffffb2011929, type=0x1) returned 0x1b00017
	[0236.506] GetCurrentObject (hdc=0xffffffffb2011929, type=0x2) returned 0x1900010
	[0236.506] GetCurrentObject (hdc=0xffffffffb2011929, type=0x7) returned 0x140507d2
	[0236.506] GetCurrentObject (hdc=0xffffffffb2011929, type=0x6) returned 0x18a002e
	[0236.507] SaveDC (hdc=0xffffffffb2011929) returned 1
	[0236.507] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x74040710
	[0236.507] GetClipRgn (hdc=0xffffffffb2011929, hrgn=0x74040710) returned 0
	[0236.507] SelectClipRgn (hdc=0xffffffffb2011929, hrgn=0xffffffffe40407f9) returned 2
	[0236.507] DeleteObject (ho=0x74040710) returned 1
	[0236.508] DeleteObject (ho=0xffffffffe40407f9) returned 1
	[0236.508] OffsetViewportOrgEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x2693aa0 | out: lppt=0x2693aa0) returned 1
	[0236.508] GetNearestColor (hdc=0xffffffffb2011929, color=0xf0f0f0) returned 0xf0f0f0
	[0236.508] CreateSolidBrush (color=0xf0f0f0) returned 0x701007c0
	[0236.508] FillRect (hDC=0xffffffffb2011929, lprc=0x20c990, hbr=0x701007c0) returned 1
	[0236.509] DeleteObject (ho=0x701007c0) returned 1
	[0236.509] RestoreDC (hdc=0xffffffffb2011929, nSavedDC=-1) returned 1
	[0236.509] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb2011929) returned 0x0
	[0236.509] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0236.509] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.509] CoTaskMemFree (pv=0x1b067980) 
	[0236.510] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0236.510] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.510] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.510] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.510] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0236.510] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0236.511] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0236.511] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.511] GetFocus () returned 0x201d8
	[0236.511] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.511] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0236.511] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.511] CoTaskMemFree (pv=0x1b067980) 
	[0236.511] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0236.511] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0236.512] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0236.512] GdipCreateRegion (region=0x20c830) returned 0x0
	[0236.512] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.512] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0236.512] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.513] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0236.513] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.513] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0236.513] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0236.513] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0236.513] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.514] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0236.514] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0236.514] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0236.514] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.514] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0236.514] GetCurrentObject (hdc=0xffffffffb2011929, type=0x1) returned 0x1b00017
	[0236.515] GetCurrentObject (hdc=0xffffffffb2011929, type=0x2) returned 0x1900010
	[0236.515] GetCurrentObject (hdc=0xffffffffb2011929, type=0x7) returned 0x140507d2
	[0236.515] GetCurrentObject (hdc=0xffffffffb2011929, type=0x6) returned 0x18a002e
	[0236.515] SaveDC (hdc=0xffffffffb2011929) returned 1
	[0236.515] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe50407f9
	[0236.515] GetClipRgn (hdc=0xffffffffb2011929, hrgn=0xffffffffe50407f9) returned 0
	[0236.516] SelectClipRgn (hdc=0xffffffffb2011929, hrgn=0x75040710) returned 2
	[0236.516] DeleteObject (ho=0xffffffffe50407f9) returned 1
	[0236.516] DeleteObject (ho=0x75040710) returned 1
	[0236.516] OffsetViewportOrgEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x2694040 | out: lppt=0x2694040) returned 1
	[0236.516] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.516] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.516] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.517] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xffffffff9a3019cc
	[0236.517] SelectObject (hdc=0xffffffffb2011929, h=0xffffffff9a3019cc) returned 0x1b00017
	[0236.517] MoveToEx (in: hdc=0xffffffffb2011929, x=164, y=1, lppt=0x26940a8 | out: lppt=0x26940a8) returned 1
	[0236.517] LineTo (hdc=0xffffffffb2011929, x=1, y=1) returned 1
	[0236.517] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.517] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.518] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.518] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.518] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.518] SelectObject (hdc=0xffffffffb2011929, h=0xffffffff9a3019cc) returned 0xffffffff9a3019cc
	[0236.518] MoveToEx (in: hdc=0xffffffffb2011929, x=1, y=1, lppt=0x26940c0 | out: lppt=0x26940c0) returned 1
	[0236.519] LineTo (hdc=0xffffffffb2011929, x=1, y=41) returned 1
	[0236.519] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.519] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.519] SelectObject (hdc=0xffffffffb2011929, h=0x1b00017) returned 0xffffffff9a3019cc
	[0236.519] DeleteObject (ho=0xffffffff9a3019cc) returned 1
	[0236.519] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.519] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.520] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.520] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x533019c7
	[0236.520] SelectObject (hdc=0xffffffffb2011929, h=0x533019c7) returned 0x1b00017
	[0236.520] MoveToEx (in: hdc=0xffffffffb2011929, x=1, y=41, lppt=0x2694128 | out: lppt=0x2694128) returned 1
	[0236.520] LineTo (hdc=0xffffffffb2011929, x=164, y=41) returned 1
	[0236.520] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.521] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.521] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.521] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.521] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.521] SelectObject (hdc=0xffffffffb2011929, h=0x533019c7) returned 0x533019c7
	[0236.521] MoveToEx (in: hdc=0xffffffffb2011929, x=164, y=41, lppt=0x2694140 | out: lppt=0x2694140) returned 1
	[0236.522] LineTo (hdc=0xffffffffb2011929, x=164, y=0) returned 1
	[0236.522] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.522] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.522] SelectObject (hdc=0xffffffffb2011929, h=0x1b00017) returned 0x533019c7
	[0236.522] DeleteObject (ho=0x533019c7) returned 1
	[0236.523] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.523] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.523] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.523] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xffffffff9b3019cc
	[0236.523] SelectObject (hdc=0xffffffffb2011929, h=0xffffffff9b3019cc) returned 0x1b00017
	[0236.524] MoveToEx (in: hdc=0xffffffffb2011929, x=163, y=2, lppt=0x26941a8 | out: lppt=0x26941a8) returned 1
	[0236.524] LineTo (hdc=0xffffffffb2011929, x=2, y=2) returned 1
	[0236.524] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.524] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.524] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.524] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.525] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.525] SelectObject (hdc=0xffffffffb2011929, h=0xffffffff9b3019cc) returned 0xffffffff9b3019cc
	[0236.525] MoveToEx (in: hdc=0xffffffffb2011929, x=2, y=2, lppt=0x26941c0 | out: lppt=0x26941c0) returned 1
	[0236.525] LineTo (hdc=0xffffffffb2011929, x=2, y=40) returned 1
	[0236.525] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.525] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.526] SelectObject (hdc=0xffffffffb2011929, h=0x1b00017) returned 0xffffffff9b3019cc
	[0236.526] DeleteObject (ho=0xffffffff9b3019cc) returned 1
	[0236.526] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.526] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.526] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.526] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x543019c7
	[0236.527] SelectObject (hdc=0xffffffffb2011929, h=0x543019c7) returned 0x1b00017
	[0236.527] MoveToEx (in: hdc=0xffffffffb2011929, x=2, y=40, lppt=0x2694228 | out: lppt=0x2694228) returned 1
	[0236.527] LineTo (hdc=0xffffffffb2011929, x=163, y=40) returned 1
	[0236.527] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.527] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.527] GetROP2 (hdc=0xffffffffb2011929) returned 13
	[0236.527] GetBkMode (hdc=0xffffffffb2011929) returned 2
	[0236.528] SetBkMode (hdc=0xffffffffb2011929, mode=1) returned 2
	[0236.528] SelectObject (hdc=0xffffffffb2011929, h=0x543019c7) returned 0x543019c7
	[0236.528] MoveToEx (in: hdc=0xffffffffb2011929, x=163, y=40, lppt=0x2694240 | out: lppt=0x2694240) returned 1
	[0236.528] LineTo (hdc=0xffffffffb2011929, x=163, y=1) returned 1
	[0236.528] SetBkMode (hdc=0xffffffffb2011929, mode=2) returned 1
	[0236.528] MoveToEx (in: hdc=0xffffffffb2011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.529] SelectObject (hdc=0xffffffffb2011929, h=0x1b00017) returned 0x543019c7
	[0236.529] DeleteObject (ho=0x543019c7) returned 1
	[0236.529] RestoreDC (hdc=0xffffffffb2011929, nSavedDC=-1) returned 1
	[0236.529] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb2011929) returned 0x0
	[0236.529] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0236.529] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0xffffffffb2011929, x1=0, y1=0, rop=0xcc0020) returned 1
	[0236.530] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffb2011929) returned 0x0
	[0236.530] SelectObject (hdc=0xffffffffb2011929, h=0x185000f) returned 0x140507d2
	[0236.530] DeleteDC (hdc=0xffffffffb2011929) returned 1
	[0236.530] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0236.530] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0236.531] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0236.531] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x2694298, cPoints=0x1 | out: lpPoints=0x2694298) returned 30606029
	[0236.531] WindowFromPoint (Point=0x1e900000322) returned 0x201d8
	[0236.531] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.531] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0236.531] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0236.531] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0236.531] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x2694388, Length=0x70 | out: Destination=0x1afe53a0) 
	[0236.531] ShellExecuteExW (in: pExecInfo=0x2694598*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2694598*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0236.569] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0236.570] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0236.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0236.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0236.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0236.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0236.571] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0236.571] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0236.571] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0236.571] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0236.571] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0236.571] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0236.571] GetStockObject (i=5) returned 0x1900015
	[0236.572] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0236.572] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0236.572] GetCapture () returned 0x0
	[0236.572] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0236.572] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0236.572] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0236.572] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x4010280
	[0236.573] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0236.573] CreateCompatibleDC (hdc=0x4010280) returned 0xffffffffba011929
	[0236.573] SelectObject (hdc=0xffffffffba011929, h=0x140507d2) returned 0x185000f
	[0236.573] GdipCreateFromHDC (hdc=0xffffffffba011929, graphics=0x20c9d0) returned 0x0
	[0236.573] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0236.573] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0236.574] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0236.574] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0236.574] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0236.574] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0236.574] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.574] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0236.575] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0236.575] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.575] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0236.575] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0236.575] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9c10dbd) returned 0x0
	[0236.575] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.576] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0236.576] GetCurrentObject (hdc=0xffffffffba011929, type=0x1) returned 0x1b00017
	[0236.576] GetCurrentObject (hdc=0xffffffffba011929, type=0x2) returned 0x1900010
	[0236.576] GetCurrentObject (hdc=0xffffffffba011929, type=0x7) returned 0x140507d2
	[0236.577] GetCurrentObject (hdc=0xffffffffba011929, type=0x6) returned 0x18a002e
	[0236.577] SaveDC (hdc=0xffffffffba011929) returned 1
	[0236.577] GetNearestColor (hdc=0xffffffffba011929, color=0xf0f0f0) returned 0xf0f0f0
	[0236.577] GetNearestColor (hdc=0xffffffffba011929, color=0xa0a0a0) returned 0xa0a0a0
	[0236.577] GetNearestColor (hdc=0xffffffffba011929, color=0x696969) returned 0x696969
	[0236.577] GetNearestColor (hdc=0xffffffffba011929, color=0xa0a0a0) returned 0xa0a0a0
	[0236.578] GetNearestColor (hdc=0xffffffffba011929, color=0x0) returned 0x0
	[0236.578] GetNearestColor (hdc=0xffffffffba011929, color=0xffffff) returned 0xffffff
	[0236.578] GetNearestColor (hdc=0xffffffffba011929, color=0xe5e5e5) returned 0xe5e5e5
	[0236.578] GetNearestColor (hdc=0xffffffffba011929, color=0xd8d8d8) returned 0xd8d8d8
	[0236.579] GetNearestColor (hdc=0xffffffffba011929, color=0x0) returned 0x0
	[0236.579] RestoreDC (hdc=0xffffffffba011929, nSavedDC=-1) returned 1
	[0236.579] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba011929) returned 0x0
	[0236.579] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.579] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.579] CoTaskMemFree (pv=0x1b077150) 
	[0236.580] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0236.580] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.580] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.580] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.580] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0236.580] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0236.581] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0236.581] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0236.581] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0236.581] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.581] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.581] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.582] CoTaskMemFree (pv=0x1b077150) 
	[0236.582] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0236.582] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0236.582] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0236.582] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0236.582] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.582] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.583] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.583] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0236.583] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.583] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0236.583] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.584] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.584] CoTaskMemFree (pv=0x1b077150) 
	[0236.584] GdipCreateRegion (region=0x20c310) returned 0x0
	[0236.584] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.584] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0236.584] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.584] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0236.585] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0236.585] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.585] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0236.585] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.585] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.586] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0236.586] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0236.586] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0236.587] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.587] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0236.587] GetCurrentObject (hdc=0xffffffffba011929, type=0x1) returned 0x1b00017
	[0236.587] GetCurrentObject (hdc=0xffffffffba011929, type=0x2) returned 0x1900010
	[0236.587] GetCurrentObject (hdc=0xffffffffba011929, type=0x7) returned 0x140507d2
	[0236.587] GetCurrentObject (hdc=0xffffffffba011929, type=0x6) returned 0x18a002e
	[0236.588] SaveDC (hdc=0xffffffffba011929) returned 1
	[0236.588] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x76040710
	[0236.588] GetClipRgn (hdc=0xffffffffba011929, hrgn=0x76040710) returned 0
	[0236.588] SelectClipRgn (hdc=0xffffffffba011929, hrgn=0xffffffffe80407f9) returned 2
	[0236.588] DeleteObject (ho=0x76040710) returned 1
	[0236.588] DeleteObject (ho=0xffffffffe80407f9) returned 1
	[0236.589] OffsetViewportOrgEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x2695278 | out: lppt=0x2695278) returned 1
	[0236.589] GetNearestColor (hdc=0xffffffffba011929, color=0xf0f0f0) returned 0xf0f0f0
	[0236.589] CreateSolidBrush (color=0xf0f0f0) returned 0x711007c0
	[0236.589] FillRect (hDC=0xffffffffba011929, lprc=0x20c3c0, hbr=0x711007c0) returned 1
	[0236.589] DeleteObject (ho=0x711007c0) returned 1
	[0236.590] RestoreDC (hdc=0xffffffffba011929, nSavedDC=-1) returned 1
	[0236.590] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba011929) returned 0x0
	[0236.590] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.590] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.590] CoTaskMemFree (pv=0x1b077150) 
	[0236.590] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0236.590] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.591] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.591] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.591] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0236.591] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0236.591] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0236.591] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.592] GetFocus () returned 0x0
	[0236.592] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.592] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.592] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.592] CoTaskMemFree (pv=0x1b077150) 
	[0236.592] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0236.592] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0236.592] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0236.593] GdipCreateRegion (region=0x20c260) returned 0x0
	[0236.593] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.593] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0236.593] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0236.593] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0236.593] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0236.594] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.594] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0236.594] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.594] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0236.594] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0236.594] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0236.594] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0236.595] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.595] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0236.595] GetCurrentObject (hdc=0xffffffffba011929, type=0x1) returned 0x1b00017
	[0236.595] GetCurrentObject (hdc=0xffffffffba011929, type=0x2) returned 0x1900010
	[0236.595] GetCurrentObject (hdc=0xffffffffba011929, type=0x7) returned 0x140507d2
	[0236.595] GetCurrentObject (hdc=0xffffffffba011929, type=0x6) returned 0x18a002e
	[0236.596] SaveDC (hdc=0xffffffffba011929) returned 1
	[0236.596] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe90407f9
	[0236.596] GetClipRgn (hdc=0xffffffffba011929, hrgn=0xffffffffe90407f9) returned 0
	[0236.596] SelectClipRgn (hdc=0xffffffffba011929, hrgn=0x77040710) returned 2
	[0236.596] DeleteObject (ho=0xffffffffe90407f9) returned 1
	[0236.596] DeleteObject (ho=0x77040710) returned 1
	[0236.597] OffsetViewportOrgEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x2695818 | out: lppt=0x2695818) returned 1
	[0236.597] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.597] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.597] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.597] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x553019c7
	[0236.597] SelectObject (hdc=0xffffffffba011929, h=0x553019c7) returned 0x1b00017
	[0236.598] MoveToEx (in: hdc=0xffffffffba011929, x=164, y=1, lppt=0x2695880 | out: lppt=0x2695880) returned 1
	[0236.598] LineTo (hdc=0xffffffffba011929, x=1, y=1) returned 1
	[0236.598] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.598] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.598] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.598] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.598] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.599] SelectObject (hdc=0xffffffffba011929, h=0x553019c7) returned 0x553019c7
	[0236.599] MoveToEx (in: hdc=0xffffffffba011929, x=1, y=1, lppt=0x2695898 | out: lppt=0x2695898) returned 1
	[0236.599] LineTo (hdc=0xffffffffba011929, x=1, y=41) returned 1
	[0236.599] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.599] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.599] SelectObject (hdc=0xffffffffba011929, h=0x1b00017) returned 0x553019c7
	[0236.600] DeleteObject (ho=0x553019c7) returned 1
	[0236.600] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.600] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.600] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.600] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xffffffff9c3019cc
	[0236.600] SelectObject (hdc=0xffffffffba011929, h=0xffffffff9c3019cc) returned 0x1b00017
	[0236.601] MoveToEx (in: hdc=0xffffffffba011929, x=1, y=41, lppt=0x2695900 | out: lppt=0x2695900) returned 1
	[0236.601] LineTo (hdc=0xffffffffba011929, x=164, y=41) returned 1
	[0236.601] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.666] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.666] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.666] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.666] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.666] SelectObject (hdc=0xffffffffba011929, h=0xffffffff9c3019cc) returned 0xffffffff9c3019cc
	[0236.667] MoveToEx (in: hdc=0xffffffffba011929, x=164, y=41, lppt=0x2695918 | out: lppt=0x2695918) returned 1
	[0236.667] LineTo (hdc=0xffffffffba011929, x=164, y=0) returned 1
	[0236.667] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.667] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.667] SelectObject (hdc=0xffffffffba011929, h=0x1b00017) returned 0xffffffff9c3019cc
	[0236.667] DeleteObject (ho=0xffffffff9c3019cc) returned 1
	[0236.668] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.668] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.668] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.668] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x7d301932
	[0236.668] SelectObject (hdc=0xffffffffba011929, h=0x7d301932) returned 0x1b00017
	[0236.668] MoveToEx (in: hdc=0xffffffffba011929, x=163, y=2, lppt=0x2695980 | out: lppt=0x2695980) returned 1
	[0236.668] LineTo (hdc=0xffffffffba011929, x=2, y=2) returned 1
	[0236.669] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.669] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.669] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.669] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.669] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.669] SelectObject (hdc=0xffffffffba011929, h=0x7d301932) returned 0x7d301932
	[0236.670] MoveToEx (in: hdc=0xffffffffba011929, x=2, y=2, lppt=0x2695998 | out: lppt=0x2695998) returned 1
	[0236.670] LineTo (hdc=0xffffffffba011929, x=2, y=40) returned 1
	[0236.670] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.670] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.670] SelectObject (hdc=0xffffffffba011929, h=0x1b00017) returned 0x7d301932
	[0236.670] DeleteObject (ho=0x7d301932) returned 1
	[0236.671] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.671] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.671] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.671] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xffffffff9d3019cc
	[0236.671] SelectObject (hdc=0xffffffffba011929, h=0xffffffff9d3019cc) returned 0x1b00017
	[0236.671] MoveToEx (in: hdc=0xffffffffba011929, x=2, y=40, lppt=0x2695a00 | out: lppt=0x2695a00) returned 1
	[0236.671] LineTo (hdc=0xffffffffba011929, x=163, y=40) returned 1
	[0236.672] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.672] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.672] GetROP2 (hdc=0xffffffffba011929) returned 13
	[0236.672] GetBkMode (hdc=0xffffffffba011929) returned 2
	[0236.672] SetBkMode (hdc=0xffffffffba011929, mode=1) returned 2
	[0236.672] SelectObject (hdc=0xffffffffba011929, h=0xffffffff9d3019cc) returned 0xffffffff9d3019cc
	[0236.673] MoveToEx (in: hdc=0xffffffffba011929, x=163, y=40, lppt=0x2695a18 | out: lppt=0x2695a18) returned 1
	[0236.673] LineTo (hdc=0xffffffffba011929, x=163, y=1) returned 1
	[0236.673] SetBkMode (hdc=0xffffffffba011929, mode=2) returned 1
	[0236.673] MoveToEx (in: hdc=0xffffffffba011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.673] SelectObject (hdc=0xffffffffba011929, h=0x1b00017) returned 0xffffffff9d3019cc
	[0236.673] DeleteObject (ho=0xffffffff9d3019cc) returned 1
	[0236.674] RestoreDC (hdc=0xffffffffba011929, nSavedDC=-1) returned 1
	[0236.674] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba011929) returned 0x0
	[0236.674] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0236.674] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0xffffffffba011929, x1=0, y1=0, rop=0xcc0020) returned 1
	[0236.674] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffba011929) returned 0x0
	[0236.674] SelectObject (hdc=0xffffffffba011929, h=0x185000f) returned 0x140507d2
	[0236.675] DeleteDC (hdc=0xffffffffba011929) returned 1
	[0236.675] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0236.675] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0236.675] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0236.675] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.675] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.675] GetKeyState (nVirtKey=1) returned 0
	[0236.675] GetKeyState (nVirtKey=2) returned 0
	[0236.675] GetKeyState (nVirtKey=4) returned 0
	[0236.675] GetKeyState (nVirtKey=5) returned 0
	[0236.675] GetKeyState (nVirtKey=6) returned 0
	[0236.676] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x4010280
	[0236.676] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0236.676] CreateCompatibleDC (hdc=0x4010280) returned 0xffffffffbc011929
	[0236.676] SelectObject (hdc=0xffffffffbc011929, h=0x140507d2) returned 0x185000f
	[0236.676] GdipCreateFromHDC (hdc=0xffffffffbc011929, graphics=0x20c9d0) returned 0x0
	[0236.676] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0236.676] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0236.677] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0236.677] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.677] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0236.677] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0236.677] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.677] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.678] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0236.678] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.678] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0236.678] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0236.678] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9be0dbd) returned 0x0
	[0236.678] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.679] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0236.679] GetCurrentObject (hdc=0xffffffffbc011929, type=0x1) returned 0x1b00017
	[0236.680] GetCurrentObject (hdc=0xffffffffbc011929, type=0x2) returned 0x1900010
	[0236.680] GetCurrentObject (hdc=0xffffffffbc011929, type=0x7) returned 0x140507d2
	[0236.680] GetCurrentObject (hdc=0xffffffffbc011929, type=0x6) returned 0x18a002e
	[0236.680] SaveDC (hdc=0xffffffffbc011929) returned 1
	[0236.680] GetNearestColor (hdc=0xffffffffbc011929, color=0xf0f0f0) returned 0xf0f0f0
	[0236.680] GetNearestColor (hdc=0xffffffffbc011929, color=0xa0a0a0) returned 0xa0a0a0
	[0236.681] GetNearestColor (hdc=0xffffffffbc011929, color=0x696969) returned 0x696969
	[0236.681] GetNearestColor (hdc=0xffffffffbc011929, color=0xa0a0a0) returned 0xa0a0a0
	[0236.681] GetNearestColor (hdc=0xffffffffbc011929, color=0x0) returned 0x0
	[0236.681] GetNearestColor (hdc=0xffffffffbc011929, color=0xffffff) returned 0xffffff
	[0236.682] GetNearestColor (hdc=0xffffffffbc011929, color=0xe5e5e5) returned 0xe5e5e5
	[0236.682] GetNearestColor (hdc=0xffffffffbc011929, color=0xd8d8d8) returned 0xd8d8d8
	[0236.682] GetNearestColor (hdc=0xffffffffbc011929, color=0x0) returned 0x0
	[0236.682] RestoreDC (hdc=0xffffffffbc011929, nSavedDC=-1) returned 1
	[0236.682] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffbc011929) returned 0x0
	[0236.683] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.683] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.683] CoTaskMemFree (pv=0x1b077150) 
	[0236.683] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0236.683] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.683] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.683] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.683] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0236.684] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0236.684] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0236.684] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0236.684] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0236.684] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.684] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.685] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.685] CoTaskMemFree (pv=0x1b077150) 
	[0236.685] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0236.685] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0236.685] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0236.685] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0236.685] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.685] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.686] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.686] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0236.686] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.686] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0236.686] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.686] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.686] CoTaskMemFree (pv=0x1b077150) 
	[0236.686] GdipCreateRegion (region=0x20c310) returned 0x0
	[0236.687] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.687] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0236.687] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0236.687] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0236.687] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0236.687] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.688] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0236.688] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.688] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0236.688] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0236.688] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0236.688] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0236.689] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.689] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0236.689] GetCurrentObject (hdc=0xffffffffbc011929, type=0x1) returned 0x1b00017
	[0236.689] GetCurrentObject (hdc=0xffffffffbc011929, type=0x2) returned 0x1900010
	[0236.689] GetCurrentObject (hdc=0xffffffffbc011929, type=0x7) returned 0x140507d2
	[0236.689] GetCurrentObject (hdc=0xffffffffbc011929, type=0x6) returned 0x18a002e
	[0236.689] SaveDC (hdc=0xffffffffbc011929) returned 1
	[0236.690] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x78040710
	[0236.690] GetClipRgn (hdc=0xffffffffbc011929, hrgn=0x78040710) returned 0
	[0236.690] SelectClipRgn (hdc=0xffffffffbc011929, hrgn=0xffffffffea0407f9) returned 2
	[0236.690] DeleteObject (ho=0x78040710) returned 1
	[0236.690] DeleteObject (ho=0xffffffffea0407f9) returned 1
	[0236.690] OffsetViewportOrgEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x26966a0 | out: lppt=0x26966a0) returned 1
	[0236.691] GetNearestColor (hdc=0xffffffffbc011929, color=0xf0f0f0) returned 0xf0f0f0
	[0236.691] CreateSolidBrush (color=0xf0f0f0) returned 0x721007c0
	[0236.691] FillRect (hDC=0xffffffffbc011929, lprc=0x20c3c0, hbr=0x721007c0) returned 1
	[0236.691] DeleteObject (ho=0x721007c0) returned 1
	[0236.691] RestoreDC (hdc=0xffffffffbc011929, nSavedDC=-1) returned 1
	[0236.691] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffbc011929) returned 0x0
	[0236.692] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.692] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.692] CoTaskMemFree (pv=0x1b077150) 
	[0236.692] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0236.692] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.692] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0236.692] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0236.693] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0236.693] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0236.693] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0236.693] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0236.693] GetFocus () returned 0x0
	[0236.693] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0236.693] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0236.694] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0236.694] CoTaskMemFree (pv=0x1b077150) 
	[0236.694] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0236.694] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0236.694] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0236.694] GdipCreateRegion (region=0x20c260) returned 0x0
	[0236.694] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0236.695] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0236.695] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0236.696] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0236.696] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0236.696] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.696] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0236.696] LocalFree (hMem=0x1b07c740) returned 0x0
	[0236.696] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0236.697] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0236.697] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0236.697] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0236.697] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0236.697] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0236.697] GetCurrentObject (hdc=0xffffffffbc011929, type=0x1) returned 0x1b00017
	[0236.698] GetCurrentObject (hdc=0xffffffffbc011929, type=0x2) returned 0x1900010
	[0236.698] GetCurrentObject (hdc=0xffffffffbc011929, type=0x7) returned 0x140507d2
	[0236.698] GetCurrentObject (hdc=0xffffffffbc011929, type=0x6) returned 0x18a002e
	[0236.698] SaveDC (hdc=0xffffffffbc011929) returned 1
	[0236.698] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffeb0407f9
	[0236.698] GetClipRgn (hdc=0xffffffffbc011929, hrgn=0xffffffffeb0407f9) returned 0
	[0236.699] SelectClipRgn (hdc=0xffffffffbc011929, hrgn=0x79040710) returned 2
	[0236.699] DeleteObject (ho=0xffffffffeb0407f9) returned 1
	[0236.699] DeleteObject (ho=0x79040710) returned 1
	[0236.699] OffsetViewportOrgEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x2696c40 | out: lppt=0x2696c40) returned 1
	[0236.699] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.699] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.700] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.700] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xffffffff9e3019cc
	[0236.700] SelectObject (hdc=0xffffffffbc011929, h=0xffffffff9e3019cc) returned 0x1b00017
	[0236.700] MoveToEx (in: hdc=0xffffffffbc011929, x=126, y=1, lppt=0x2696ca8 | out: lppt=0x2696ca8) returned 1
	[0236.700] LineTo (hdc=0xffffffffbc011929, x=1, y=1) returned 1
	[0236.700] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.701] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.701] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.701] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.701] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.701] SelectObject (hdc=0xffffffffbc011929, h=0xffffffff9e3019cc) returned 0xffffffff9e3019cc
	[0236.701] MoveToEx (in: hdc=0xffffffffbc011929, x=1, y=1, lppt=0x2696cc0 | out: lppt=0x2696cc0) returned 1
	[0236.702] LineTo (hdc=0xffffffffbc011929, x=1, y=39) returned 1
	[0236.702] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.702] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.702] SelectObject (hdc=0xffffffffbc011929, h=0x1b00017) returned 0xffffffff9e3019cc
	[0236.702] DeleteObject (ho=0xffffffff9e3019cc) returned 1
	[0236.702] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.703] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.703] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.703] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x7e301932
	[0236.703] SelectObject (hdc=0xffffffffbc011929, h=0x7e301932) returned 0x1b00017
	[0236.703] MoveToEx (in: hdc=0xffffffffbc011929, x=1, y=39, lppt=0x2696d28 | out: lppt=0x2696d28) returned 1
	[0236.703] LineTo (hdc=0xffffffffbc011929, x=126, y=39) returned 1
	[0236.703] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.704] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.704] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.704] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.704] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.704] SelectObject (hdc=0xffffffffbc011929, h=0x7e301932) returned 0x7e301932
	[0236.704] MoveToEx (in: hdc=0xffffffffbc011929, x=126, y=39, lppt=0x2696d40 | out: lppt=0x2696d40) returned 1
	[0236.705] LineTo (hdc=0xffffffffbc011929, x=126, y=0) returned 1
	[0236.705] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.705] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.705] SelectObject (hdc=0xffffffffbc011929, h=0x1b00017) returned 0x7e301932
	[0236.705] DeleteObject (ho=0x7e301932) returned 1
	[0236.705] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.706] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.706] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.706] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xffffffff9f3019cc
	[0236.706] SelectObject (hdc=0xffffffffbc011929, h=0xffffffff9f3019cc) returned 0x1b00017
	[0236.706] MoveToEx (in: hdc=0xffffffffbc011929, x=125, y=2, lppt=0x2696da8 | out: lppt=0x2696da8) returned 1
	[0236.706] LineTo (hdc=0xffffffffbc011929, x=2, y=2) returned 1
	[0236.706] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.707] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.707] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.707] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.707] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.707] SelectObject (hdc=0xffffffffbc011929, h=0xffffffff9f3019cc) returned 0xffffffff9f3019cc
	[0236.707] MoveToEx (in: hdc=0xffffffffbc011929, x=2, y=2, lppt=0x2696dc0 | out: lppt=0x2696dc0) returned 1
	[0236.708] LineTo (hdc=0xffffffffbc011929, x=2, y=38) returned 1
	[0236.708] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.708] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.708] SelectObject (hdc=0xffffffffbc011929, h=0x1b00017) returned 0xffffffff9f3019cc
	[0236.708] DeleteObject (ho=0xffffffff9f3019cc) returned 1
	[0236.708] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.709] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.709] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.709] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x7f301932
	[0236.709] SelectObject (hdc=0xffffffffbc011929, h=0x7f301932) returned 0x1b00017
	[0236.709] MoveToEx (in: hdc=0xffffffffbc011929, x=2, y=38, lppt=0x2696e28 | out: lppt=0x2696e28) returned 1
	[0236.709] LineTo (hdc=0xffffffffbc011929, x=125, y=38) returned 1
	[0236.710] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.710] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.710] GetROP2 (hdc=0xffffffffbc011929) returned 13
	[0236.710] GetBkMode (hdc=0xffffffffbc011929) returned 2
	[0236.751] SetBkMode (hdc=0xffffffffbc011929, mode=1) returned 2
	[0236.752] SelectObject (hdc=0xffffffffbc011929, h=0x7f301932) returned 0x7f301932
	[0236.752] MoveToEx (in: hdc=0xffffffffbc011929, x=125, y=38, lppt=0x2696e40 | out: lppt=0x2696e40) returned 1
	[0236.752] LineTo (hdc=0xffffffffbc011929, x=125, y=1) returned 1
	[0236.752] SetBkMode (hdc=0xffffffffbc011929, mode=2) returned 1
	[0236.752] MoveToEx (in: hdc=0xffffffffbc011929, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0236.753] SelectObject (hdc=0xffffffffbc011929, h=0x1b00017) returned 0x7f301932
	[0236.753] DeleteObject (ho=0x7f301932) returned 1
	[0236.753] RestoreDC (hdc=0xffffffffbc011929, nSavedDC=-1) returned 1
	[0236.753] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffbc011929) returned 0x0
	[0236.753] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0236.753] BitBlt (hdc=0x4010280, x=0, y=0, cx=128, cy=41, hdcSrc=0xffffffffbc011929, x1=0, y1=0, rop=0xcc0020) returned 1
	[0236.754] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffbc011929) returned 0x0
	[0236.754] SelectObject (hdc=0xffffffffbc011929, h=0x185000f) returned 0x140507d2
	[0236.754] DeleteDC (hdc=0xffffffffbc011929) returned 1
	[0236.754] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0236.754] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0236.755] EndPaint (hWnd=0x401b4, lpPaint=0x20cbd8) returned 1
	[0236.755] GetCapture () returned 0x0
	[0236.755] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.755] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0236.755] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.755] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.755] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.755] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.755] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.755] WaitMessage () returned 1
	[0236.882] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.882] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0236.882] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.882] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.882] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.882] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.882] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.882] WaitMessage () returned 1
	[0236.972] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.972] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.972] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.972] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.972] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.972] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.972] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.972] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.972] GetKeyState (nVirtKey=1) returned 0
	[0236.972] GetKeyState (nVirtKey=2) returned 0
	[0236.972] GetKeyState (nVirtKey=4) returned 0
	[0236.972] GetKeyState (nVirtKey=5) returned 0
	[0236.972] GetKeyState (nVirtKey=6) returned 0
	[0236.972] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.972] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.972] WaitMessage () returned 1
	[0236.973] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.973] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.973] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.973] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.973] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.973] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.973] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.973] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.973] GetKeyState (nVirtKey=1) returned 0
	[0236.973] GetKeyState (nVirtKey=2) returned 0
	[0236.973] GetKeyState (nVirtKey=4) returned 0
	[0236.973] GetKeyState (nVirtKey=5) returned 0
	[0236.973] GetKeyState (nVirtKey=6) returned 0
	[0236.973] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.973] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.973] WaitMessage () returned 1
	[0236.976] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.976] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.976] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.976] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.976] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.976] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.976] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.976] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.976] GetKeyState (nVirtKey=1) returned 0
	[0236.976] GetKeyState (nVirtKey=2) returned 0
	[0236.976] GetKeyState (nVirtKey=4) returned 0
	[0236.977] GetKeyState (nVirtKey=5) returned 0
	[0236.977] GetKeyState (nVirtKey=6) returned 0
	[0236.977] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.977] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.977] WaitMessage () returned 1
	[0236.984] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.984] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.985] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.985] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.985] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.985] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.985] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.985] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.985] GetKeyState (nVirtKey=1) returned 0
	[0236.985] GetKeyState (nVirtKey=2) returned 0
	[0236.985] GetKeyState (nVirtKey=4) returned 0
	[0236.985] GetKeyState (nVirtKey=5) returned 0
	[0236.985] GetKeyState (nVirtKey=6) returned 0
	[0236.985] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.985] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.985] WaitMessage () returned 1
	[0236.985] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.985] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.986] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.986] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.986] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.986] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.986] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.986] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.986] GetKeyState (nVirtKey=1) returned 0
	[0236.986] GetKeyState (nVirtKey=2) returned 0
	[0236.986] GetKeyState (nVirtKey=4) returned 0
	[0236.986] GetKeyState (nVirtKey=5) returned 0
	[0236.986] GetKeyState (nVirtKey=6) returned 0
	[0236.986] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.986] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.986] WaitMessage () returned 1
	[0236.988] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.988] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.988] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0236.988] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0236.988] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0236.988] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0236.989] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0236.989] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0236.989] GetKeyState (nVirtKey=1) returned 0
	[0236.989] GetKeyState (nVirtKey=2) returned 0
	[0236.989] GetKeyState (nVirtKey=4) returned 0
	[0236.989] GetKeyState (nVirtKey=5) returned 0
	[0236.989] GetKeyState (nVirtKey=6) returned 0
	[0236.989] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.989] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0236.989] WaitMessage () returned 1
	[0237.091] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.091] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.091] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.091] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.091] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.092] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.092] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.092] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.092] GetKeyState (nVirtKey=1) returned 0
	[0237.092] GetKeyState (nVirtKey=2) returned 0
	[0237.092] GetKeyState (nVirtKey=4) returned 0
	[0237.092] GetKeyState (nVirtKey=5) returned 0
	[0237.092] GetKeyState (nVirtKey=6) returned 0
	[0237.092] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.092] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.092] WaitMessage () returned 1
	[0237.094] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.094] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.094] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.094] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.094] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.094] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.094] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.094] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.094] GetKeyState (nVirtKey=1) returned 0
	[0237.094] GetKeyState (nVirtKey=2) returned 0
	[0237.094] GetKeyState (nVirtKey=4) returned 0
	[0237.094] GetKeyState (nVirtKey=5) returned 0
	[0237.094] GetKeyState (nVirtKey=6) returned 0
	[0237.094] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.094] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.095] WaitMessage () returned 1
	[0237.095] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.095] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.095] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.095] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.095] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.095] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.095] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.095] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.095] GetKeyState (nVirtKey=1) returned 0
	[0237.095] GetKeyState (nVirtKey=2) returned 0
	[0237.095] GetKeyState (nVirtKey=4) returned 0
	[0237.095] GetKeyState (nVirtKey=5) returned 0
	[0237.095] GetKeyState (nVirtKey=6) returned 0
	[0237.095] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.095] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.095] WaitMessage () returned 1
	[0237.096] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.096] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.097] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.097] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.097] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.097] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.097] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.097] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.097] GetKeyState (nVirtKey=1) returned 0
	[0237.097] GetKeyState (nVirtKey=2) returned 0
	[0237.097] GetKeyState (nVirtKey=4) returned 0
	[0237.097] GetKeyState (nVirtKey=5) returned 0
	[0237.097] GetKeyState (nVirtKey=6) returned 0
	[0237.097] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.097] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.097] WaitMessage () returned 1
	[0237.098] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.098] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.098] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.098] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.098] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.098] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.098] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.098] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.099] GetKeyState (nVirtKey=1) returned 0
	[0237.099] GetKeyState (nVirtKey=2) returned 0
	[0237.099] GetKeyState (nVirtKey=4) returned 0
	[0237.099] GetKeyState (nVirtKey=5) returned 0
	[0237.099] GetKeyState (nVirtKey=6) returned 0
	[0237.099] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.099] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.099] WaitMessage () returned 1
	[0237.117] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.117] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.117] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.117] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.117] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.117] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.118] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.118] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.118] GetKeyState (nVirtKey=1) returned 0
	[0237.118] GetKeyState (nVirtKey=2) returned 0
	[0237.118] GetKeyState (nVirtKey=4) returned 0
	[0237.118] GetKeyState (nVirtKey=5) returned 0
	[0237.118] GetKeyState (nVirtKey=6) returned 0
	[0237.118] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.118] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.118] WaitMessage () returned 1
	[0237.121] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.121] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.121] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.121] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.121] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.121] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.121] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.121] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.121] GetKeyState (nVirtKey=1) returned 0
	[0237.122] GetKeyState (nVirtKey=2) returned 0
	[0237.122] GetKeyState (nVirtKey=4) returned 0
	[0237.122] GetKeyState (nVirtKey=5) returned 0
	[0237.122] GetKeyState (nVirtKey=6) returned 0
	[0237.122] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.122] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.122] WaitMessage () returned 1
	[0237.123] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.123] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.124] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.124] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.124] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.124] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.124] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.124] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.124] GetKeyState (nVirtKey=1) returned 0
	[0237.124] GetKeyState (nVirtKey=2) returned 0
	[0237.124] GetKeyState (nVirtKey=4) returned 0
	[0237.124] GetKeyState (nVirtKey=5) returned 0
	[0237.124] GetKeyState (nVirtKey=6) returned 0
	[0237.124] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.124] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.124] WaitMessage () returned 1
	[0237.125] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.125] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.125] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.125] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.125] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.125] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.125] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.125] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.125] GetKeyState (nVirtKey=1) returned 0
	[0237.125] GetKeyState (nVirtKey=2) returned 0
	[0237.125] GetKeyState (nVirtKey=4) returned 0
	[0237.125] GetKeyState (nVirtKey=5) returned 0
	[0237.125] GetKeyState (nVirtKey=6) returned 0
	[0237.125] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.125] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.125] WaitMessage () returned 1
	[0237.186] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.187] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.187] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.187] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.187] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.187] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.187] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.187] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.187] GetKeyState (nVirtKey=1) returned 0
	[0237.187] GetKeyState (nVirtKey=2) returned 0
	[0237.187] GetKeyState (nVirtKey=4) returned 0
	[0237.187] GetKeyState (nVirtKey=5) returned 0
	[0237.187] GetKeyState (nVirtKey=6) returned 0
	[0237.187] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.187] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.187] WaitMessage () returned 1
	[0237.188] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.188] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.188] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.188] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.188] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.188] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.188] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.188] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.188] GetKeyState (nVirtKey=1) returned 0
	[0237.188] GetKeyState (nVirtKey=2) returned 0
	[0237.188] GetKeyState (nVirtKey=4) returned 0
	[0237.188] GetKeyState (nVirtKey=5) returned 0
	[0237.188] GetKeyState (nVirtKey=6) returned 0
	[0237.188] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.188] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.188] WaitMessage () returned 1
	[0237.188] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.189] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.189] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.189] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.189] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.189] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.189] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.189] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.189] GetKeyState (nVirtKey=1) returned 0
	[0237.189] GetKeyState (nVirtKey=2) returned 0
	[0237.189] GetKeyState (nVirtKey=4) returned 0
	[0237.189] GetKeyState (nVirtKey=5) returned 0
	[0237.189] GetKeyState (nVirtKey=6) returned 0
	[0237.189] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.189] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.189] WaitMessage () returned 1
	[0237.192] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.192] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.193] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.193] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.193] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.193] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.193] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.193] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.193] GetKeyState (nVirtKey=1) returned 0
	[0237.193] GetKeyState (nVirtKey=2) returned 0
	[0237.193] GetKeyState (nVirtKey=4) returned 0
	[0237.193] GetKeyState (nVirtKey=5) returned 0
	[0237.193] GetKeyState (nVirtKey=6) returned 0
	[0237.193] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.193] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.193] WaitMessage () returned 1
	[0237.207] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.207] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.207] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.207] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.207] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.207] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.207] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.207] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.207] GetKeyState (nVirtKey=1) returned 0
	[0237.207] GetKeyState (nVirtKey=2) returned 0
	[0237.207] GetKeyState (nVirtKey=4) returned 0
	[0237.207] GetKeyState (nVirtKey=5) returned 0
	[0237.207] GetKeyState (nVirtKey=6) returned 0
	[0237.207] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.207] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.207] WaitMessage () returned 1
	[0237.211] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.211] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.211] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.211] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.211] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.211] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.212] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.212] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.212] GetKeyState (nVirtKey=1) returned 0
	[0237.212] GetKeyState (nVirtKey=2) returned 0
	[0237.212] GetKeyState (nVirtKey=4) returned 0
	[0237.212] GetKeyState (nVirtKey=5) returned 0
	[0237.212] GetKeyState (nVirtKey=6) returned 0
	[0237.212] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.212] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.212] WaitMessage () returned 1
	[0237.226] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.226] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.227] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.227] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.227] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.227] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.227] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.227] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.227] GetKeyState (nVirtKey=1) returned 0
	[0237.227] GetKeyState (nVirtKey=2) returned 0
	[0237.227] GetKeyState (nVirtKey=4) returned 0
	[0237.227] GetKeyState (nVirtKey=5) returned 0
	[0237.227] GetKeyState (nVirtKey=6) returned 0
	[0237.227] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.227] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.227] WaitMessage () returned 1
	[0237.258] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.258] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.258] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.258] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.258] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.258] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.259] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.259] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.259] GetKeyState (nVirtKey=1) returned 0
	[0237.259] GetKeyState (nVirtKey=2) returned 0
	[0237.259] GetKeyState (nVirtKey=4) returned 0
	[0237.259] GetKeyState (nVirtKey=5) returned 0
	[0237.259] GetKeyState (nVirtKey=6) returned 0
	[0237.259] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.259] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.259] WaitMessage () returned 1
	[0237.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.277] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.277] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.277] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.277] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.277] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.277] GetKeyState (nVirtKey=1) returned 0
	[0237.277] GetKeyState (nVirtKey=2) returned 0
	[0237.277] GetKeyState (nVirtKey=4) returned 0
	[0237.277] GetKeyState (nVirtKey=5) returned 0
	[0237.277] GetKeyState (nVirtKey=6) returned 0
	[0237.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.277] WaitMessage () returned 1
	[0237.311] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.311] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.311] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.311] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.311] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.311] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.311] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.311] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.311] GetKeyState (nVirtKey=1) returned 0
	[0237.311] GetKeyState (nVirtKey=2) returned 0
	[0237.311] GetKeyState (nVirtKey=4) returned 0
	[0237.311] GetKeyState (nVirtKey=5) returned 0
	[0237.311] GetKeyState (nVirtKey=6) returned 0
	[0237.311] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.311] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.311] WaitMessage () returned 1
	[0237.464] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.464] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.464] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.464] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.464] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.464] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.464] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.464] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.465] GetKeyState (nVirtKey=1) returned 0
	[0237.465] GetKeyState (nVirtKey=2) returned 0
	[0237.465] GetKeyState (nVirtKey=4) returned 0
	[0237.465] GetKeyState (nVirtKey=5) returned 0
	[0237.465] GetKeyState (nVirtKey=6) returned 0
	[0237.465] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.465] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.465] WaitMessage () returned 1
	[0237.480] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.481] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.481] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.481] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.481] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.481] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.481] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.481] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.481] GetKeyState (nVirtKey=1) returned 0
	[0237.481] GetKeyState (nVirtKey=2) returned 0
	[0237.481] GetKeyState (nVirtKey=4) returned 0
	[0237.481] GetKeyState (nVirtKey=5) returned 0
	[0237.481] GetKeyState (nVirtKey=6) returned 0
	[0237.481] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.481] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.481] WaitMessage () returned 1
	[0237.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.729] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.729] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.729] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.729] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90322) returned 0x1
	[0237.729] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0237.729] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.729] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.729] GetKeyState (nVirtKey=1) returned 0
	[0237.729] GetKeyState (nVirtKey=2) returned 0
	[0237.729] GetKeyState (nVirtKey=4) returned 0
	[0237.729] GetKeyState (nVirtKey=5) returned 0
	[0237.729] GetKeyState (nVirtKey=6) returned 0
	[0237.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.729] WaitMessage () returned 1
	[0237.788] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.788] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.788] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.788] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.788] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.788] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.788] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.788] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0237.788] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0237.789] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.789] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0237.789] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0237.789] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0237.789] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0237.789] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0237.789] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0237.789] CreateCompatibleDC (hdc=0x70107fc) returned 0x12011a0e
	[0237.789] SelectObject (hdc=0x12011a0e, h=0x140507d2) returned 0x185000f
	[0237.790] GdipCreateFromHDC (hdc=0x12011a0e, graphics=0x20d7e0) returned 0x0
	[0237.790] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0237.790] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0237.790] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0237.790] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0237.790] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0237.791] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0237.791] LocalFree (hMem=0x1b07c780) returned 0x0
	[0237.791] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0237.791] GdipCreateRegion (region=0x20d910) returned 0x0
	[0237.791] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0237.791] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0237.792] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0237.792] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9bb0dbd) returned 0x0
	[0237.792] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0237.792] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0237.793] GetCurrentObject (hdc=0x12011a0e, type=0x1) returned 0x1b00017
	[0237.793] GetCurrentObject (hdc=0x12011a0e, type=0x2) returned 0x1900010
	[0237.793] GetCurrentObject (hdc=0x12011a0e, type=0x7) returned 0x140507d2
	[0237.793] GetCurrentObject (hdc=0x12011a0e, type=0x6) returned 0x18a002e
	[0237.793] SaveDC (hdc=0x12011a0e) returned 1
	[0237.793] GetNearestColor (hdc=0x12011a0e, color=0xf0f0f0) returned 0xf0f0f0
	[0237.794] GetNearestColor (hdc=0x12011a0e, color=0xa0a0a0) returned 0xa0a0a0
	[0237.794] GetNearestColor (hdc=0x12011a0e, color=0x696969) returned 0x696969
	[0237.794] GetNearestColor (hdc=0x12011a0e, color=0xa0a0a0) returned 0xa0a0a0
	[0237.794] GetNearestColor (hdc=0x12011a0e, color=0x0) returned 0x0
	[0237.794] GetNearestColor (hdc=0x12011a0e, color=0xffffff) returned 0xffffff
	[0237.795] GetNearestColor (hdc=0x12011a0e, color=0xe5e5e5) returned 0xe5e5e5
	[0237.795] GetNearestColor (hdc=0x12011a0e, color=0xd8d8d8) returned 0xd8d8d8
	[0237.795] GetNearestColor (hdc=0x12011a0e, color=0x0) returned 0x0
	[0237.795] RestoreDC (hdc=0x12011a0e, nSavedDC=-1) returned 1
	[0237.795] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011a0e) returned 0x0
	[0237.796] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0237.796] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0237.796] CoTaskMemFree (pv=0x1b067580) 
	[0237.796] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0237.796] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0237.796] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0237.796] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0237.797] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0237.797] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0237.797] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0237.797] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0237.797] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0237.797] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0237.798] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0237.798] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0237.798] CoTaskMemFree (pv=0x1b067580) 
	[0237.798] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0237.798] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0237.798] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0237.798] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0237.798] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0237.799] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0237.799] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0237.799] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0237.799] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0237.799] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0237.799] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0237.800] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0237.800] CoTaskMemFree (pv=0x1b067580) 
	[0237.800] GdipCreateRegion (region=0x20d120) returned 0x0
	[0237.800] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0237.800] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0237.800] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0237.800] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0237.801] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0237.801] LocalFree (hMem=0x1b07c780) returned 0x0
	[0237.801] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0237.801] LocalFree (hMem=0x1b07c780) returned 0x0
	[0237.801] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0237.801] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0237.802] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0237.802] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0237.802] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0237.802] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0237.803] GetCurrentObject (hdc=0x12011a0e, type=0x1) returned 0x1b00017
	[0237.803] GetCurrentObject (hdc=0x12011a0e, type=0x2) returned 0x1900010
	[0237.803] GetCurrentObject (hdc=0x12011a0e, type=0x7) returned 0x140507d2
	[0237.803] GetCurrentObject (hdc=0x12011a0e, type=0x6) returned 0x18a002e
	[0237.803] SaveDC (hdc=0x12011a0e) returned 1
	[0237.803] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7a040710
	[0237.804] GetClipRgn (hdc=0x12011a0e, hrgn=0x7a040710) returned 0
	[0237.804] SelectClipRgn (hdc=0x12011a0e, hrgn=0xffffffffec0407f9) returned 2
	[0237.804] DeleteObject (ho=0x7a040710) returned 1
	[0237.804] DeleteObject (ho=0xffffffffec0407f9) returned 1
	[0237.804] OffsetViewportOrgEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x2698600 | out: lppt=0x2698600) returned 1
	[0237.804] GetNearestColor (hdc=0x12011a0e, color=0xf0f0f0) returned 0xf0f0f0
	[0237.805] CreateSolidBrush (color=0xf0f0f0) returned 0x731007c0
	[0237.805] FillRect (hDC=0x12011a0e, lprc=0x20d1d0, hbr=0x731007c0) returned 1
	[0237.805] DeleteObject (ho=0x731007c0) returned 1
	[0237.805] RestoreDC (hdc=0x12011a0e, nSavedDC=-1) returned 1
	[0237.805] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011a0e) returned 0x0
	[0237.806] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0237.806] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0237.806] CoTaskMemFree (pv=0x1b067580) 
	[0237.806] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0237.806] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0237.806] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0237.806] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0237.807] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0237.807] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0237.807] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0237.807] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0237.807] GetFocus () returned 0x0
	[0237.808] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0237.808] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0237.808] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0237.808] CoTaskMemFree (pv=0x1b067580) 
	[0237.808] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0237.808] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0237.808] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0237.808] GdipCreateRegion (region=0x20d070) returned 0x0
	[0237.809] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0237.809] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0237.809] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0237.809] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0237.809] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0237.809] LocalFree (hMem=0x1b07c780) returned 0x0
	[0237.810] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0237.810] LocalFree (hMem=0x1b07c780) returned 0x0
	[0237.810] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0237.810] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0237.810] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0237.810] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0237.811] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0237.811] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0237.811] GetCurrentObject (hdc=0x12011a0e, type=0x1) returned 0x1b00017
	[0237.811] GetCurrentObject (hdc=0x12011a0e, type=0x2) returned 0x1900010
	[0237.811] GetCurrentObject (hdc=0x12011a0e, type=0x7) returned 0x140507d2
	[0237.811] GetCurrentObject (hdc=0x12011a0e, type=0x6) returned 0x18a002e
	[0237.811] SaveDC (hdc=0x12011a0e) returned 1
	[0237.812] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffed0407f9
	[0237.812] GetClipRgn (hdc=0x12011a0e, hrgn=0xffffffffed0407f9) returned 0
	[0237.812] SelectClipRgn (hdc=0x12011a0e, hrgn=0x7b040710) returned 2
	[0237.812] DeleteObject (ho=0xffffffffed0407f9) returned 1
	[0237.812] DeleteObject (ho=0x7b040710) returned 1
	[0237.812] OffsetViewportOrgEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x2698ba0 | out: lppt=0x2698ba0) returned 1
	[0237.813] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.813] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.813] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.813] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xc301a0d
	[0237.813] SelectObject (hdc=0x12011a0e, h=0xc301a0d) returned 0x1b00017
	[0237.813] MoveToEx (in: hdc=0x12011a0e, x=164, y=1, lppt=0x2698c08 | out: lppt=0x2698c08) returned 1
	[0237.814] LineTo (hdc=0x12011a0e, x=1, y=1) returned 1
	[0237.814] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.814] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.814] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.814] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.814] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.815] SelectObject (hdc=0x12011a0e, h=0xc301a0d) returned 0xc301a0d
	[0237.815] MoveToEx (in: hdc=0x12011a0e, x=1, y=1, lppt=0x2698c20 | out: lppt=0x2698c20) returned 1
	[0237.815] LineTo (hdc=0x12011a0e, x=1, y=41) returned 1
	[0237.815] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.815] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.815] SelectObject (hdc=0x12011a0e, h=0x1b00017) returned 0xc301a0d
	[0237.815] DeleteObject (ho=0xc301a0d) returned 1
	[0237.816] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.816] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.816] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.816] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x3301a0f
	[0237.816] SelectObject (hdc=0x12011a0e, h=0x3301a0f) returned 0x1b00017
	[0237.816] MoveToEx (in: hdc=0x12011a0e, x=1, y=41, lppt=0x2698c88 | out: lppt=0x2698c88) returned 1
	[0237.817] LineTo (hdc=0x12011a0e, x=164, y=41) returned 1
	[0237.817] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.817] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.817] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.817] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.817] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.817] SelectObject (hdc=0x12011a0e, h=0x3301a0f) returned 0x3301a0f
	[0237.818] MoveToEx (in: hdc=0x12011a0e, x=164, y=41, lppt=0x2698ca0 | out: lppt=0x2698ca0) returned 1
	[0237.819] LineTo (hdc=0x12011a0e, x=164, y=0) returned 1
	[0237.819] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.819] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.819] SelectObject (hdc=0x12011a0e, h=0x1b00017) returned 0x3301a0f
	[0237.820] DeleteObject (ho=0x3301a0f) returned 1
	[0237.820] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.820] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.820] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.820] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xf301a0d
	[0237.820] SelectObject (hdc=0x12011a0e, h=0xf301a0d) returned 0x1b00017
	[0237.820] MoveToEx (in: hdc=0x12011a0e, x=163, y=2, lppt=0x2698d08 | out: lppt=0x2698d08) returned 1
	[0237.821] LineTo (hdc=0x12011a0e, x=2, y=2) returned 1
	[0237.821] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.821] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.821] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.821] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.821] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.822] SelectObject (hdc=0x12011a0e, h=0xf301a0d) returned 0xf301a0d
	[0237.822] MoveToEx (in: hdc=0x12011a0e, x=2, y=2, lppt=0x2698d20 | out: lppt=0x2698d20) returned 1
	[0237.822] LineTo (hdc=0x12011a0e, x=2, y=40) returned 1
	[0237.822] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.822] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.822] SelectObject (hdc=0x12011a0e, h=0x1b00017) returned 0xf301a0d
	[0237.823] DeleteObject (ho=0xf301a0d) returned 1
	[0237.823] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.823] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.823] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.823] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x4301a0f
	[0237.823] SelectObject (hdc=0x12011a0e, h=0x4301a0f) returned 0x1b00017
	[0237.824] MoveToEx (in: hdc=0x12011a0e, x=2, y=40, lppt=0x2698d88 | out: lppt=0x2698d88) returned 1
	[0237.824] LineTo (hdc=0x12011a0e, x=163, y=40) returned 1
	[0237.824] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.824] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.824] GetROP2 (hdc=0x12011a0e) returned 13
	[0237.824] GetBkMode (hdc=0x12011a0e) returned 2
	[0237.824] SetBkMode (hdc=0x12011a0e, mode=1) returned 2
	[0237.825] SelectObject (hdc=0x12011a0e, h=0x4301a0f) returned 0x4301a0f
	[0237.825] MoveToEx (in: hdc=0x12011a0e, x=163, y=40, lppt=0x2698da0 | out: lppt=0x2698da0) returned 1
	[0237.825] LineTo (hdc=0x12011a0e, x=163, y=1) returned 1
	[0237.825] SetBkMode (hdc=0x12011a0e, mode=2) returned 1
	[0237.825] MoveToEx (in: hdc=0x12011a0e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0237.825] SelectObject (hdc=0x12011a0e, h=0x1b00017) returned 0x4301a0f
	[0237.826] DeleteObject (ho=0x4301a0f) returned 1
	[0237.826] RestoreDC (hdc=0x12011a0e, nSavedDC=-1) returned 1
	[0237.826] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011a0e) returned 0x0
	[0237.826] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0237.826] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x12011a0e, x1=0, y1=0, rop=0xcc0020) returned 1
	[0237.826] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011a0e) returned 0x0
	[0237.827] SelectObject (hdc=0x12011a0e, h=0x185000f) returned 0x140507d2
	[0237.827] DeleteDC (hdc=0x12011a0e) returned 1
	[0237.827] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0237.827] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0237.827] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0237.827] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.827] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0237.827] WaitMessage () returned 1
	[0239.476] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.476] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.476] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0239.476] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.476] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.477] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0239.477] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.477] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0239.477] _TrackMouseEvent (in: lpEventTrack=0x26470f0 | out: lpEventTrack=0x26470f0) returned 1
	[0239.477] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0239.477] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0239.477] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0239.477] GetKeyState (nVirtKey=1) returned 0
	[0239.477] GetKeyState (nVirtKey=2) returned 0
	[0239.477] GetKeyState (nVirtKey=4) returned 0
	[0239.477] GetKeyState (nVirtKey=5) returned 0
	[0239.477] GetKeyState (nVirtKey=6) returned 0
	[0239.477] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.477] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0239.477] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.477] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.477] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0239.477] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0239.477] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0239.478] CreateCompatibleDC (hdc=0x48010f97) returned 0xf011a07
	[0239.478] SelectObject (hdc=0xf011a07, h=0x140507d2) returned 0x185000f
	[0239.478] GdipCreateFromHDC (hdc=0xf011a07, graphics=0x20d7e0) returned 0x0
	[0239.478] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0239.479] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0239.479] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0239.479] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0239.479] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0239.479] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0239.479] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.480] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0239.480] GdipCreateRegion (region=0x20d910) returned 0x0
	[0239.480] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.480] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0239.480] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0239.480] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9b80dbd) returned 0x0
	[0239.481] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.481] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0239.481] GetCurrentObject (hdc=0xf011a07, type=0x1) returned 0x1b00017
	[0239.481] GetCurrentObject (hdc=0xf011a07, type=0x2) returned 0x1900010
	[0239.482] GetCurrentObject (hdc=0xf011a07, type=0x7) returned 0x140507d2
	[0239.482] GetCurrentObject (hdc=0xf011a07, type=0x6) returned 0x18a002e
	[0239.482] SaveDC (hdc=0xf011a07) returned 1
	[0239.482] GetNearestColor (hdc=0xf011a07, color=0xf0f0f0) returned 0xf0f0f0
	[0239.482] GetNearestColor (hdc=0xf011a07, color=0xa0a0a0) returned 0xa0a0a0
	[0239.482] GetNearestColor (hdc=0xf011a07, color=0x696969) returned 0x696969
	[0239.483] GetNearestColor (hdc=0xf011a07, color=0xa0a0a0) returned 0xa0a0a0
	[0239.483] GetNearestColor (hdc=0xf011a07, color=0x0) returned 0x0
	[0239.483] GetNearestColor (hdc=0xf011a07, color=0xffffff) returned 0xffffff
	[0239.483] GetNearestColor (hdc=0xf011a07, color=0xe5e5e5) returned 0xe5e5e5
	[0239.484] GetNearestColor (hdc=0xf011a07, color=0xd8d8d8) returned 0xd8d8d8
	[0239.484] GetNearestColor (hdc=0xf011a07, color=0x0) returned 0x0
	[0239.484] RestoreDC (hdc=0xf011a07, nSavedDC=-1) returned 1
	[0239.484] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf011a07) returned 0x0
	[0239.484] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0239.485] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.485] CoTaskMemFree (pv=0x1b067580) 
	[0239.485] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0239.485] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.485] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.485] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.485] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0239.485] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0239.486] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0239.486] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0239.486] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0239.486] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.486] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0239.487] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.487] CoTaskMemFree (pv=0x1b067580) 
	[0239.487] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0239.487] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0239.487] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0239.487] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0239.488] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.488] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.488] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.488] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0239.488] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.489] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0239.489] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0239.489] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.489] CoTaskMemFree (pv=0x1b067580) 
	[0239.489] GdipCreateRegion (region=0x20d120) returned 0x0
	[0239.489] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.490] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0239.490] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0239.490] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0239.490] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0239.490] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.490] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0239.491] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.491] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0239.491] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0239.491] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0239.491] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0239.491] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.492] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0239.492] GetCurrentObject (hdc=0xf011a07, type=0x1) returned 0x1b00017
	[0239.492] GetCurrentObject (hdc=0xf011a07, type=0x2) returned 0x1900010
	[0239.492] GetCurrentObject (hdc=0xf011a07, type=0x7) returned 0x140507d2
	[0239.492] GetCurrentObject (hdc=0xf011a07, type=0x6) returned 0x18a002e
	[0239.492] SaveDC (hdc=0xf011a07) returned 1
	[0239.493] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7c040710
	[0239.493] GetClipRgn (hdc=0xf011a07, hrgn=0x7c040710) returned 0
	[0239.493] SelectClipRgn (hdc=0xf011a07, hrgn=0xffffffffee0407f9) returned 2
	[0239.493] DeleteObject (ho=0x7c040710) returned 1
	[0239.493] DeleteObject (ho=0xffffffffee0407f9) returned 1
	[0239.494] OffsetViewportOrgEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x2699a98 | out: lppt=0x2699a98) returned 1
	[0239.494] GetNearestColor (hdc=0xf011a07, color=0xf0f0f0) returned 0xf0f0f0
	[0239.494] CreateSolidBrush (color=0xf0f0f0) returned 0x741007c0
	[0239.494] FillRect (hDC=0xf011a07, lprc=0x20d1d0, hbr=0x741007c0) returned 1
	[0239.494] DeleteObject (ho=0x741007c0) returned 1
	[0239.495] RestoreDC (hdc=0xf011a07, nSavedDC=-1) returned 1
	[0239.495] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf011a07) returned 0x0
	[0239.495] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0239.495] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.495] CoTaskMemFree (pv=0x1b067580) 
	[0239.495] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0239.496] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.496] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.496] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.496] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0239.496] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0239.496] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0239.497] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.497] GetFocus () returned 0x0
	[0239.497] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0239.497] CoTaskMemAlloc (cb=0x13) returned 0x1b067580
	[0239.497] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.497] CoTaskMemFree (pv=0x1b067580) 
	[0239.497] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0239.498] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0239.498] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0239.498] GdipCreateRegion (region=0x20d070) returned 0x0
	[0239.498] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.498] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0239.499] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0239.499] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0239.499] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0239.499] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.499] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0239.499] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.500] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0239.500] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0239.500] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0239.500] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0239.500] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.500] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0239.501] GetCurrentObject (hdc=0xf011a07, type=0x1) returned 0x1b00017
	[0239.501] GetCurrentObject (hdc=0xf011a07, type=0x2) returned 0x1900010
	[0239.501] GetCurrentObject (hdc=0xf011a07, type=0x7) returned 0x140507d2
	[0239.501] GetCurrentObject (hdc=0xf011a07, type=0x6) returned 0x18a002e
	[0239.501] SaveDC (hdc=0xf011a07) returned 1
	[0239.502] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffef0407f9
	[0239.502] GetClipRgn (hdc=0xf011a07, hrgn=0xffffffffef0407f9) returned 0
	[0239.502] SelectClipRgn (hdc=0xf011a07, hrgn=0x7d040710) returned 2
	[0239.502] DeleteObject (ho=0xffffffffef0407f9) returned 1
	[0239.502] DeleteObject (ho=0x7d040710) returned 1
	[0239.503] OffsetViewportOrgEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x269a038 | out: lppt=0x269a038) returned 1
	[0239.504] GetROP2 (hdc=0xf011a07) returned 13
	[0239.504] GetBkMode (hdc=0xf011a07) returned 2
	[0239.504] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.504] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1f300caa
	[0239.504] SelectObject (hdc=0xf011a07, h=0x1f300caa) returned 0x1b00017
	[0239.505] MoveToEx (in: hdc=0xf011a07, x=164, y=1, lppt=0x269a0a0 | out: lppt=0x269a0a0) returned 1
	[0239.505] LineTo (hdc=0xf011a07, x=1, y=1) returned 1
	[0239.505] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.505] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.505] GetROP2 (hdc=0xf011a07) returned 13
	[0239.506] GetBkMode (hdc=0xf011a07) returned 2
	[0239.506] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.506] SelectObject (hdc=0xf011a07, h=0x1f300caa) returned 0x1f300caa
	[0239.506] MoveToEx (in: hdc=0xf011a07, x=1, y=1, lppt=0x269a0b8 | out: lppt=0x269a0b8) returned 1
	[0239.506] LineTo (hdc=0xf011a07, x=1, y=41) returned 1
	[0239.507] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.507] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.507] SelectObject (hdc=0xf011a07, h=0x1b00017) returned 0x1f300caa
	[0239.507] DeleteObject (ho=0x1f300caa) returned 1
	[0239.507] GetROP2 (hdc=0xf011a07) returned 13
	[0239.508] GetBkMode (hdc=0xf011a07) returned 2
	[0239.508] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.508] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x25300cab
	[0239.508] SelectObject (hdc=0xf011a07, h=0x25300cab) returned 0x1b00017
	[0239.508] MoveToEx (in: hdc=0xf011a07, x=1, y=41, lppt=0x269a120 | out: lppt=0x269a120) returned 1
	[0239.509] LineTo (hdc=0xf011a07, x=164, y=41) returned 1
	[0239.509] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.509] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.509] GetROP2 (hdc=0xf011a07) returned 13
	[0239.509] GetBkMode (hdc=0xf011a07) returned 2
	[0239.510] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.510] SelectObject (hdc=0xf011a07, h=0x25300cab) returned 0x25300cab
	[0239.510] MoveToEx (in: hdc=0xf011a07, x=164, y=41, lppt=0x269a138 | out: lppt=0x269a138) returned 1
	[0239.510] LineTo (hdc=0xf011a07, x=164, y=0) returned 1
	[0239.510] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.510] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.511] SelectObject (hdc=0xf011a07, h=0x1b00017) returned 0x25300cab
	[0239.511] DeleteObject (ho=0x25300cab) returned 1
	[0239.511] GetROP2 (hdc=0xf011a07) returned 13
	[0239.511] GetBkMode (hdc=0xf011a07) returned 2
	[0239.511] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.512] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x20300caa
	[0239.512] SelectObject (hdc=0xf011a07, h=0x20300caa) returned 0x1b00017
	[0239.512] MoveToEx (in: hdc=0xf011a07, x=163, y=2, lppt=0x269a1a0 | out: lppt=0x269a1a0) returned 1
	[0239.512] LineTo (hdc=0xf011a07, x=2, y=2) returned 1
	[0239.512] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.512] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.513] GetROP2 (hdc=0xf011a07) returned 13
	[0239.513] GetBkMode (hdc=0xf011a07) returned 2
	[0239.513] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.513] SelectObject (hdc=0xf011a07, h=0x20300caa) returned 0x20300caa
	[0239.513] MoveToEx (in: hdc=0xf011a07, x=2, y=2, lppt=0x269a1b8 | out: lppt=0x269a1b8) returned 1
	[0239.513] LineTo (hdc=0xf011a07, x=2, y=40) returned 1
	[0239.514] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.514] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.514] SelectObject (hdc=0xf011a07, h=0x1b00017) returned 0x20300caa
	[0239.514] DeleteObject (ho=0x20300caa) returned 1
	[0239.514] GetROP2 (hdc=0xf011a07) returned 13
	[0239.514] GetBkMode (hdc=0xf011a07) returned 2
	[0239.515] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.515] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x26300cab
	[0239.515] SelectObject (hdc=0xf011a07, h=0x26300cab) returned 0x1b00017
	[0239.515] MoveToEx (in: hdc=0xf011a07, x=2, y=40, lppt=0x269a220 | out: lppt=0x269a220) returned 1
	[0239.515] LineTo (hdc=0xf011a07, x=163, y=40) returned 1
	[0239.515] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.516] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.516] GetROP2 (hdc=0xf011a07) returned 13
	[0239.516] GetBkMode (hdc=0xf011a07) returned 2
	[0239.516] SetBkMode (hdc=0xf011a07, mode=1) returned 2
	[0239.516] SelectObject (hdc=0xf011a07, h=0x26300cab) returned 0x26300cab
	[0239.516] MoveToEx (in: hdc=0xf011a07, x=163, y=40, lppt=0x269a238 | out: lppt=0x269a238) returned 1
	[0239.516] LineTo (hdc=0xf011a07, x=163, y=1) returned 1
	[0239.517] SetBkMode (hdc=0xf011a07, mode=2) returned 1
	[0239.517] MoveToEx (in: hdc=0xf011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.517] SelectObject (hdc=0xf011a07, h=0x1b00017) returned 0x26300cab
	[0239.517] DeleteObject (ho=0x26300cab) returned 1
	[0239.517] RestoreDC (hdc=0xf011a07, nSavedDC=-1) returned 1
	[0239.517] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf011a07) returned 0x0
	[0239.518] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0239.518] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0xf011a07, x1=0, y1=0, rop=0xcc0020) returned 1
	[0239.518] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xf011a07) returned 0x0
	[0239.519] SelectObject (hdc=0xf011a07, h=0x185000f) returned 0x140507d2
	[0239.519] DeleteDC (hdc=0xf011a07) returned 1
	[0239.519] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0239.520] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0239.520] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0239.520] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0239.520] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0239.520] WaitMessage () returned 1
	[0239.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.581] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0239.581] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.581] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.581] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0239.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.581] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0239.581] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.581] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.581] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0239.581] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x14002c) returned 0x0
	[0239.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0239.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0239.582] WaitMessage () returned 1
	[0239.694] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.695] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0239.695] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.695] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe00108) returned 0x0
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0239.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0239.696] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0239.696] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0239.696] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0239.696] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0239.696] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0239.696] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0239.697] GetFocus () returned 0x0
	[0239.697] SetFocus (hWnd=0x201d8) returned 0x0
	[0239.697] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0239.697] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0239.697] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0239.697] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0239.697] GetStockObject (i=5) returned 0x1900015
	[0239.698] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0239.698] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0239.698] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0239.698] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0239.698] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.698] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0239.698] GetKeyState (nVirtKey=1) returned -127
	[0239.698] GetKeyState (nVirtKey=2) returned 0
	[0239.698] GetKeyState (nVirtKey=4) returned 0
	[0239.698] GetKeyState (nVirtKey=5) returned 0
	[0239.698] GetKeyState (nVirtKey=6) returned 0
	[0239.698] IsWindowVisible (hWnd=0x201d8) returned 1
	[0239.698] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0239.698] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0239.698] GetFocus () returned 0x201d8
	[0239.698] GetFocus () returned 0x201d8
	[0239.698] GetFocus () returned 0x201d8
	[0239.698] GetKeyState (nVirtKey=1) returned -127
	[0239.698] GetKeyState (nVirtKey=2) returned 0
	[0239.698] GetKeyState (nVirtKey=4) returned 0
	[0239.698] GetKeyState (nVirtKey=5) returned 0
	[0239.698] GetKeyState (nVirtKey=6) returned 0
	[0239.698] GetCapture () returned 0x0
	[0239.698] SetCapture (hWnd=0x201d8) returned 0x0
	[0239.698] GetKeyState (nVirtKey=1) returned -127
	[0239.698] GetKeyState (nVirtKey=2) returned 0
	[0239.698] GetKeyState (nVirtKey=4) returned 0
	[0239.698] GetKeyState (nVirtKey=5) returned 0
	[0239.698] GetKeyState (nVirtKey=6) returned 0
	[0239.698] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0239.698] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0239.699] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.699] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.699] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.699] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0239.699] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.699] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.699] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.699] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0239.699] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.699] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0239.699] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0239.699] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0239.699] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0239.699] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x269a3b0, cPoints=0x1 | out: lpPoints=0x269a3b0) returned 30606029
	[0239.699] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0239.699] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0239.699] UpdateWindow (hWnd=0x201d8) returned 1
	[0239.699] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0239.699] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0239.699] CreateCompatibleDC (hdc=0x48010f97) returned 0x13011a07
	[0239.699] SelectObject (hdc=0x13011a07, h=0x140507d2) returned 0x185000f
	[0239.700] GdipCreateFromHDC (hdc=0x13011a07, graphics=0x20cfa0) returned 0x0
	[0239.700] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0239.700] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0239.700] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0239.700] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0239.700] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d130) returned 0x0
	[0239.701] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0239.701] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.701] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0239.701] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0239.701] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.701] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0239.702] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0239.702] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9b50dbd) returned 0x0
	[0239.702] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.702] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0239.703] GetCurrentObject (hdc=0x13011a07, type=0x1) returned 0x1b00017
	[0239.703] GetCurrentObject (hdc=0x13011a07, type=0x2) returned 0x1900010
	[0239.703] GetCurrentObject (hdc=0x13011a07, type=0x7) returned 0x140507d2
	[0239.703] GetCurrentObject (hdc=0x13011a07, type=0x6) returned 0x18a002e
	[0239.703] SaveDC (hdc=0x13011a07) returned 1
	[0239.703] GetNearestColor (hdc=0x13011a07, color=0xf0f0f0) returned 0xf0f0f0
	[0239.704] GetNearestColor (hdc=0x13011a07, color=0xa0a0a0) returned 0xa0a0a0
	[0239.704] GetNearestColor (hdc=0x13011a07, color=0x696969) returned 0x696969
	[0239.704] GetNearestColor (hdc=0x13011a07, color=0xa0a0a0) returned 0xa0a0a0
	[0239.704] GetNearestColor (hdc=0x13011a07, color=0x0) returned 0x0
	[0239.704] GetNearestColor (hdc=0x13011a07, color=0xffffff) returned 0xffffff
	[0239.705] GetNearestColor (hdc=0x13011a07, color=0xe5e5e5) returned 0xe5e5e5
	[0239.705] GetNearestColor (hdc=0x13011a07, color=0xd8d8d8) returned 0xd8d8d8
	[0239.705] GetNearestColor (hdc=0x13011a07, color=0x0) returned 0x0
	[0239.706] RestoreDC (hdc=0x13011a07, nSavedDC=-1) returned 1
	[0239.706] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x13011a07) returned 0x0
	[0239.706] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0239.706] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.706] CoTaskMemFree (pv=0x1b067a60) 
	[0239.706] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0239.707] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.707] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.707] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.707] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0239.707] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0239.707] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0239.708] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0239.708] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0239.708] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.708] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0239.708] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.708] CoTaskMemFree (pv=0x1b067a60) 
	[0239.708] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0239.709] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0239.709] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0239.709] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0239.709] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.709] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.709] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.710] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0239.710] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.710] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0239.710] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0239.710] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.710] CoTaskMemFree (pv=0x1b067a60) 
	[0239.711] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0239.711] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.711] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0239.711] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0239.711] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0239.711] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0239.712] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.712] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0239.712] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.712] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0239.712] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0239.713] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0239.713] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0239.713] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.713] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0239.713] GetCurrentObject (hdc=0x13011a07, type=0x1) returned 0x1b00017
	[0239.713] GetCurrentObject (hdc=0x13011a07, type=0x2) returned 0x1900010
	[0239.714] GetCurrentObject (hdc=0x13011a07, type=0x7) returned 0x140507d2
	[0239.714] GetCurrentObject (hdc=0x13011a07, type=0x6) returned 0x18a002e
	[0239.714] SaveDC (hdc=0x13011a07) returned 1
	[0239.714] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7e040710
	[0239.714] GetClipRgn (hdc=0x13011a07, hrgn=0x7e040710) returned 0
	[0239.715] SelectClipRgn (hdc=0x13011a07, hrgn=0xfffffffff20407f9) returned 2
	[0239.715] DeleteObject (ho=0x7e040710) returned 1
	[0239.715] DeleteObject (ho=0xfffffffff20407f9) returned 1
	[0239.715] OffsetViewportOrgEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x269b030 | out: lppt=0x269b030) returned 1
	[0239.715] GetNearestColor (hdc=0x13011a07, color=0xf0f0f0) returned 0xf0f0f0
	[0239.716] CreateSolidBrush (color=0xf0f0f0) returned 0x751007c0
	[0239.716] FillRect (hDC=0x13011a07, lprc=0x20c990, hbr=0x751007c0) returned 1
	[0239.716] DeleteObject (ho=0x751007c0) returned 1
	[0239.716] RestoreDC (hdc=0x13011a07, nSavedDC=-1) returned 1
	[0239.716] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x13011a07) returned 0x0
	[0239.716] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0239.717] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.717] CoTaskMemFree (pv=0x1b067a60) 
	[0239.717] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0239.717] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.717] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.717] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.717] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0239.718] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0239.718] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0239.718] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.718] GetFocus () returned 0x201d8
	[0239.719] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0239.719] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0239.719] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.719] CoTaskMemFree (pv=0x1b067a60) 
	[0239.719] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0239.719] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0239.719] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0239.720] GdipCreateRegion (region=0x20c830) returned 0x0
	[0239.720] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.720] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0239.720] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0239.720] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c890) returned 0x0
	[0239.720] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0239.721] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.721] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0239.721] LocalFree (hMem=0x1b07c780) returned 0x0
	[0239.721] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0239.721] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0239.721] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0239.722] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0239.722] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.722] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0239.722] GetCurrentObject (hdc=0x13011a07, type=0x1) returned 0x1b00017
	[0239.722] GetCurrentObject (hdc=0x13011a07, type=0x2) returned 0x1900010
	[0239.723] GetCurrentObject (hdc=0x13011a07, type=0x7) returned 0x140507d2
	[0239.723] GetCurrentObject (hdc=0x13011a07, type=0x6) returned 0x18a002e
	[0239.723] SaveDC (hdc=0x13011a07) returned 1
	[0239.723] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffff30407f9
	[0239.723] GetClipRgn (hdc=0x13011a07, hrgn=0xfffffffff30407f9) returned 0
	[0239.723] SelectClipRgn (hdc=0x13011a07, hrgn=0x7f040710) returned 2
	[0239.724] DeleteObject (ho=0xfffffffff30407f9) returned 1
	[0239.724] DeleteObject (ho=0x7f040710) returned 1
	[0239.724] OffsetViewportOrgEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x269b5d0 | out: lppt=0x269b5d0) returned 1
	[0239.724] GetROP2 (hdc=0x13011a07) returned 13
	[0239.724] GetBkMode (hdc=0x13011a07) returned 2
	[0239.724] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.725] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x27300cab
	[0239.725] SelectObject (hdc=0x13011a07, h=0x27300cab) returned 0x1b00017
	[0239.725] MoveToEx (in: hdc=0x13011a07, x=164, y=1, lppt=0x269b638 | out: lppt=0x269b638) returned 1
	[0239.725] LineTo (hdc=0x13011a07, x=1, y=1) returned 1
	[0239.725] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.725] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.726] GetROP2 (hdc=0x13011a07) returned 13
	[0239.726] GetBkMode (hdc=0x13011a07) returned 2
	[0239.726] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.726] SelectObject (hdc=0x13011a07, h=0x27300cab) returned 0x27300cab
	[0239.726] MoveToEx (in: hdc=0x13011a07, x=1, y=1, lppt=0x269b650 | out: lppt=0x269b650) returned 1
	[0239.726] LineTo (hdc=0x13011a07, x=1, y=41) returned 1
	[0239.727] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.727] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.727] SelectObject (hdc=0x13011a07, h=0x1b00017) returned 0x27300cab
	[0239.727] DeleteObject (ho=0x27300cab) returned 1
	[0239.727] GetROP2 (hdc=0x13011a07) returned 13
	[0239.727] GetBkMode (hdc=0x13011a07) returned 2
	[0239.728] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.728] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x21300caa
	[0239.728] SelectObject (hdc=0x13011a07, h=0x21300caa) returned 0x1b00017
	[0239.728] MoveToEx (in: hdc=0x13011a07, x=1, y=41, lppt=0x269b6b8 | out: lppt=0x269b6b8) returned 1
	[0239.728] LineTo (hdc=0x13011a07, x=164, y=41) returned 1
	[0239.728] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.729] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.729] GetROP2 (hdc=0x13011a07) returned 13
	[0239.729] GetBkMode (hdc=0x13011a07) returned 2
	[0239.729] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.729] SelectObject (hdc=0x13011a07, h=0x21300caa) returned 0x21300caa
	[0239.729] MoveToEx (in: hdc=0x13011a07, x=164, y=41, lppt=0x269b6d0 | out: lppt=0x269b6d0) returned 1
	[0239.730] LineTo (hdc=0x13011a07, x=164, y=0) returned 1
	[0239.730] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.730] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.730] SelectObject (hdc=0x13011a07, h=0x1b00017) returned 0x21300caa
	[0239.730] DeleteObject (ho=0x21300caa) returned 1
	[0239.731] GetROP2 (hdc=0x13011a07) returned 13
	[0239.731] GetBkMode (hdc=0x13011a07) returned 2
	[0239.731] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.731] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x28300cab
	[0239.731] SelectObject (hdc=0x13011a07, h=0x28300cab) returned 0x1b00017
	[0239.731] MoveToEx (in: hdc=0x13011a07, x=163, y=2, lppt=0x269b738 | out: lppt=0x269b738) returned 1
	[0239.732] LineTo (hdc=0x13011a07, x=2, y=2) returned 1
	[0239.732] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.732] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.732] GetROP2 (hdc=0x13011a07) returned 13
	[0239.732] GetBkMode (hdc=0x13011a07) returned 2
	[0239.733] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.733] SelectObject (hdc=0x13011a07, h=0x28300cab) returned 0x28300cab
	[0239.733] MoveToEx (in: hdc=0x13011a07, x=2, y=2, lppt=0x269b750 | out: lppt=0x269b750) returned 1
	[0239.733] LineTo (hdc=0x13011a07, x=2, y=40) returned 1
	[0239.733] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.733] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.734] SelectObject (hdc=0x13011a07, h=0x1b00017) returned 0x28300cab
	[0239.734] DeleteObject (ho=0x28300cab) returned 1
	[0239.734] GetROP2 (hdc=0x13011a07) returned 13
	[0239.734] GetBkMode (hdc=0x13011a07) returned 2
	[0239.734] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.734] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x22300caa
	[0239.735] SelectObject (hdc=0x13011a07, h=0x22300caa) returned 0x1b00017
	[0239.735] MoveToEx (in: hdc=0x13011a07, x=2, y=40, lppt=0x269b7b8 | out: lppt=0x269b7b8) returned 1
	[0239.735] LineTo (hdc=0x13011a07, x=163, y=40) returned 1
	[0239.735] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.735] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.735] GetROP2 (hdc=0x13011a07) returned 13
	[0239.736] GetBkMode (hdc=0x13011a07) returned 2
	[0239.736] SetBkMode (hdc=0x13011a07, mode=1) returned 2
	[0239.736] SelectObject (hdc=0x13011a07, h=0x22300caa) returned 0x22300caa
	[0239.736] MoveToEx (in: hdc=0x13011a07, x=163, y=40, lppt=0x269b7d0 | out: lppt=0x269b7d0) returned 1
	[0239.736] LineTo (hdc=0x13011a07, x=163, y=1) returned 1
	[0239.736] SetBkMode (hdc=0x13011a07, mode=2) returned 1
	[0239.741] MoveToEx (in: hdc=0x13011a07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.741] SelectObject (hdc=0x13011a07, h=0x1b00017) returned 0x22300caa
	[0239.741] DeleteObject (ho=0x22300caa) returned 1
	[0239.741] RestoreDC (hdc=0x13011a07, nSavedDC=-1) returned 1
	[0239.742] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x13011a07) returned 0x0
	[0239.742] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0239.742] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0x13011a07, x1=0, y1=0, rop=0xcc0020) returned 1
	[0239.742] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x13011a07) returned 0x0
	[0239.743] SelectObject (hdc=0x13011a07, h=0x185000f) returned 0x140507d2
	[0239.743] DeleteDC (hdc=0x13011a07) returned 1
	[0239.743] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0239.743] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0239.743] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0239.743] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x269b828, cPoints=0x1 | out: lpPoints=0x269b828) returned 30606029
	[0239.743] WindowFromPoint (Point=0x1e7000002f9) returned 0x201d8
	[0239.743] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.744] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0239.744] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0239.744] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0239.744] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x269b918, Length=0x70 | out: Destination=0x1afe53a0) 
	[0239.744] ShellExecuteExW (in: pExecInfo=0x269bb28*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x269bb28*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0239.777] GetKeyState (nVirtKey=1) returned 1
	[0239.777] GetKeyState (nVirtKey=2) returned 0
	[0239.777] GetKeyState (nVirtKey=4) returned 0
	[0239.777] GetKeyState (nVirtKey=5) returned 0
	[0239.778] GetKeyState (nVirtKey=6) returned 0
	[0239.812] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0239.812] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0239.812] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0239.812] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0239.812] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0239.812] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0239.813] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0239.813] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0239.813] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0239.813] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0239.813] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0239.813] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0239.814] GetStockObject (i=5) returned 0x1900015
	[0239.815] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0239.815] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0239.815] GetCapture () returned 0x0
	[0239.815] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0239.815] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0239.815] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0239.815] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x70107fc
	[0239.815] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0239.815] CreateCompatibleDC (hdc=0x70107fc) returned 0xffffffffa401198f
	[0239.816] SelectObject (hdc=0xffffffffa401198f, h=0x140507d2) returned 0x185000f
	[0239.816] GdipCreateFromHDC (hdc=0xffffffffa401198f, graphics=0x20c9d0) returned 0x0
	[0239.816] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0239.816] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0239.816] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0239.817] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0239.817] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0239.817] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0239.817] LocalFree (hMem=0x1b07c740) returned 0x0
	[0239.817] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0239.817] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0239.818] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.818] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0239.818] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0239.818] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9b20dbd) returned 0x0
	[0239.818] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.819] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0239.819] GetCurrentObject (hdc=0xffffffffa401198f, type=0x1) returned 0x1b00017
	[0239.819] GetCurrentObject (hdc=0xffffffffa401198f, type=0x2) returned 0x1900010
	[0239.819] GetCurrentObject (hdc=0xffffffffa401198f, type=0x7) returned 0x140507d2
	[0239.819] GetCurrentObject (hdc=0xffffffffa401198f, type=0x6) returned 0x18a002e
	[0239.820] SaveDC (hdc=0xffffffffa401198f) returned 1
	[0239.820] GetNearestColor (hdc=0xffffffffa401198f, color=0xf0f0f0) returned 0xf0f0f0
	[0239.820] GetNearestColor (hdc=0xffffffffa401198f, color=0xa0a0a0) returned 0xa0a0a0
	[0239.820] GetNearestColor (hdc=0xffffffffa401198f, color=0x696969) returned 0x696969
	[0239.820] GetNearestColor (hdc=0xffffffffa401198f, color=0xa0a0a0) returned 0xa0a0a0
	[0239.821] GetNearestColor (hdc=0xffffffffa401198f, color=0x0) returned 0x0
	[0239.821] GetNearestColor (hdc=0xffffffffa401198f, color=0xffffff) returned 0xffffff
	[0239.821] GetNearestColor (hdc=0xffffffffa401198f, color=0xe5e5e5) returned 0xe5e5e5
	[0239.821] GetNearestColor (hdc=0xffffffffa401198f, color=0xd8d8d8) returned 0xd8d8d8
	[0239.821] GetNearestColor (hdc=0xffffffffa401198f, color=0x0) returned 0x0
	[0239.822] RestoreDC (hdc=0xffffffffa401198f, nSavedDC=-1) returned 1
	[0239.822] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa401198f) returned 0x0
	[0239.822] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0239.822] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.822] CoTaskMemFree (pv=0x1b077150) 
	[0239.822] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0239.823] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.823] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.823] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.823] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0239.823] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0239.823] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0239.823] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0239.824] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0239.824] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.824] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0239.824] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.824] CoTaskMemFree (pv=0x1b077150) 
	[0239.824] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0239.825] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0239.825] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0239.825] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0239.825] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.825] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.825] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.826] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0239.826] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.826] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0239.826] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0239.826] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.826] CoTaskMemFree (pv=0x1b077150) 
	[0239.826] GdipCreateRegion (region=0x20c310) returned 0x0
	[0239.827] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.827] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0239.827] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0239.827] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c370) returned 0x0
	[0239.827] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0239.827] LocalFree (hMem=0x1b07c740) returned 0x0
	[0239.828] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0239.828] LocalFree (hMem=0x1b07c740) returned 0x0
	[0239.828] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0239.828] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0239.828] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0239.828] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0239.829] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.829] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0239.829] GetCurrentObject (hdc=0xffffffffa401198f, type=0x1) returned 0x1b00017
	[0239.829] GetCurrentObject (hdc=0xffffffffa401198f, type=0x2) returned 0x1900010
	[0239.829] GetCurrentObject (hdc=0xffffffffa401198f, type=0x7) returned 0x140507d2
	[0239.829] GetCurrentObject (hdc=0xffffffffa401198f, type=0x6) returned 0x18a002e
	[0239.831] SaveDC (hdc=0xffffffffa401198f) returned 1
	[0239.831] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff80040710
	[0239.831] GetClipRgn (hdc=0xffffffffa401198f, hrgn=0xffffffff80040710) returned 0
	[0239.831] SelectClipRgn (hdc=0xffffffffa401198f, hrgn=0xfffffffff60407f9) returned 2
	[0239.832] DeleteObject (ho=0xffffffff80040710) returned 1
	[0239.832] DeleteObject (ho=0xfffffffff60407f9) returned 1
	[0239.832] OffsetViewportOrgEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x269c830 | out: lppt=0x269c830) returned 1
	[0239.832] GetNearestColor (hdc=0xffffffffa401198f, color=0xf0f0f0) returned 0xf0f0f0
	[0239.832] CreateSolidBrush (color=0xf0f0f0) returned 0x761007c0
	[0239.833] FillRect (hDC=0xffffffffa401198f, lprc=0x20c3c0, hbr=0x761007c0) returned 1
	[0239.833] DeleteObject (ho=0x761007c0) returned 1
	[0239.833] RestoreDC (hdc=0xffffffffa401198f, nSavedDC=-1) returned 1
	[0239.833] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa401198f) returned 0x0
	[0239.833] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0239.833] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.834] CoTaskMemFree (pv=0x1b077150) 
	[0239.834] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0239.834] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.834] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0239.834] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0239.834] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0239.834] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0239.835] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0239.835] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0239.835] GetFocus () returned 0x0
	[0239.835] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0239.835] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0239.835] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0239.835] CoTaskMemFree (pv=0x1b077150) 
	[0239.835] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0239.836] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0239.836] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0239.836] GdipCreateRegion (region=0x20c260) returned 0x0
	[0239.836] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0239.836] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0239.837] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0239.837] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0239.837] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0239.837] LocalFree (hMem=0x1b07c740) returned 0x0
	[0239.837] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0239.837] LocalFree (hMem=0x1b07c740) returned 0x0
	[0239.838] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0239.838] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0239.838] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0239.838] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0239.838] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0239.838] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0239.839] GetCurrentObject (hdc=0xffffffffa401198f, type=0x1) returned 0x1b00017
	[0239.839] GetCurrentObject (hdc=0xffffffffa401198f, type=0x2) returned 0x1900010
	[0239.839] GetCurrentObject (hdc=0xffffffffa401198f, type=0x7) returned 0x140507d2
	[0239.839] GetCurrentObject (hdc=0xffffffffa401198f, type=0x6) returned 0x18a002e
	[0239.839] SaveDC (hdc=0xffffffffa401198f) returned 1
	[0239.839] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffff70407f9
	[0239.840] GetClipRgn (hdc=0xffffffffa401198f, hrgn=0xfffffffff70407f9) returned 0
	[0239.840] SelectClipRgn (hdc=0xffffffffa401198f, hrgn=0xffffffff81040710) returned 2
	[0239.840] DeleteObject (ho=0xfffffffff70407f9) returned 1
	[0239.840] DeleteObject (ho=0xffffffff81040710) returned 1
	[0239.840] OffsetViewportOrgEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x269cdd0 | out: lppt=0x269cdd0) returned 1
	[0239.840] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.841] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.841] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.841] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x23300caa
	[0239.841] SelectObject (hdc=0xffffffffa401198f, h=0x23300caa) returned 0x1b00017
	[0239.841] MoveToEx (in: hdc=0xffffffffa401198f, x=164, y=1, lppt=0x269ce38 | out: lppt=0x269ce38) returned 1
	[0239.842] LineTo (hdc=0xffffffffa401198f, x=1, y=1) returned 1
	[0239.842] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.842] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.842] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.842] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.842] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.843] SelectObject (hdc=0xffffffffa401198f, h=0x23300caa) returned 0x23300caa
	[0239.843] MoveToEx (in: hdc=0xffffffffa401198f, x=1, y=1, lppt=0x269ce50 | out: lppt=0x269ce50) returned 1
	[0239.843] LineTo (hdc=0xffffffffa401198f, x=1, y=41) returned 1
	[0239.843] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.843] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.843] SelectObject (hdc=0xffffffffa401198f, h=0x1b00017) returned 0x23300caa
	[0239.844] DeleteObject (ho=0x23300caa) returned 1
	[0239.844] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.844] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.844] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.844] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x29300cab
	[0239.845] SelectObject (hdc=0xffffffffa401198f, h=0x29300cab) returned 0x1b00017
	[0239.845] MoveToEx (in: hdc=0xffffffffa401198f, x=1, y=41, lppt=0x269ceb8 | out: lppt=0x269ceb8) returned 1
	[0239.845] LineTo (hdc=0xffffffffa401198f, x=164, y=41) returned 1
	[0239.845] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.845] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.845] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.846] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.846] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.846] SelectObject (hdc=0xffffffffa401198f, h=0x29300cab) returned 0x29300cab
	[0239.846] MoveToEx (in: hdc=0xffffffffa401198f, x=164, y=41, lppt=0x269ced0 | out: lppt=0x269ced0) returned 1
	[0239.847] LineTo (hdc=0xffffffffa401198f, x=164, y=0) returned 1
	[0239.847] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.847] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.847] SelectObject (hdc=0xffffffffa401198f, h=0x1b00017) returned 0x29300cab
	[0239.847] DeleteObject (ho=0x29300cab) returned 1
	[0239.847] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.848] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.848] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.848] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x24300caa
	[0239.848] SelectObject (hdc=0xffffffffa401198f, h=0x24300caa) returned 0x1b00017
	[0239.848] MoveToEx (in: hdc=0xffffffffa401198f, x=163, y=2, lppt=0x269cf38 | out: lppt=0x269cf38) returned 1
	[0239.848] LineTo (hdc=0xffffffffa401198f, x=2, y=2) returned 1
	[0239.849] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.849] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.849] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.849] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.849] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.849] SelectObject (hdc=0xffffffffa401198f, h=0x24300caa) returned 0x24300caa
	[0239.850] MoveToEx (in: hdc=0xffffffffa401198f, x=2, y=2, lppt=0x269cf50 | out: lppt=0x269cf50) returned 1
	[0239.850] LineTo (hdc=0xffffffffa401198f, x=2, y=40) returned 1
	[0239.850] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.850] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.850] SelectObject (hdc=0xffffffffa401198f, h=0x1b00017) returned 0x24300caa
	[0239.851] DeleteObject (ho=0x24300caa) returned 1
	[0239.851] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.851] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.851] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.851] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2a300cab
	[0239.851] SelectObject (hdc=0xffffffffa401198f, h=0x2a300cab) returned 0x1b00017
	[0239.851] MoveToEx (in: hdc=0xffffffffa401198f, x=2, y=40, lppt=0x269cfb8 | out: lppt=0x269cfb8) returned 1
	[0239.852] LineTo (hdc=0xffffffffa401198f, x=163, y=40) returned 1
	[0239.852] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.852] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.852] GetROP2 (hdc=0xffffffffa401198f) returned 13
	[0239.852] GetBkMode (hdc=0xffffffffa401198f) returned 2
	[0239.852] SetBkMode (hdc=0xffffffffa401198f, mode=1) returned 2
	[0239.853] SelectObject (hdc=0xffffffffa401198f, h=0x2a300cab) returned 0x2a300cab
	[0239.853] MoveToEx (in: hdc=0xffffffffa401198f, x=163, y=40, lppt=0x269cfd0 | out: lppt=0x269cfd0) returned 1
	[0239.853] LineTo (hdc=0xffffffffa401198f, x=163, y=1) returned 1
	[0239.853] SetBkMode (hdc=0xffffffffa401198f, mode=2) returned 1
	[0239.853] MoveToEx (in: hdc=0xffffffffa401198f, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0239.853] SelectObject (hdc=0xffffffffa401198f, h=0x1b00017) returned 0x2a300cab
	[0239.854] DeleteObject (ho=0x2a300cab) returned 1
	[0239.854] RestoreDC (hdc=0xffffffffa401198f, nSavedDC=-1) returned 1
	[0239.854] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa401198f) returned 0x0
	[0239.854] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0239.854] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0xffffffffa401198f, x1=0, y1=0, rop=0xcc0020) returned 1
	[0239.854] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xffffffffa401198f) returned 0x0
	[0239.855] SelectObject (hdc=0xffffffffa401198f, h=0x185000f) returned 0x140507d2
	[0239.855] DeleteDC (hdc=0xffffffffa401198f) returned 1
	[0239.855] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0239.855] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0239.855] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0239.855] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.856] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0239.856] GetKeyState (nVirtKey=1) returned 1
	[0239.856] GetKeyState (nVirtKey=2) returned 0
	[0239.856] GetKeyState (nVirtKey=4) returned 0
	[0239.856] GetKeyState (nVirtKey=5) returned 0
	[0239.856] GetKeyState (nVirtKey=6) returned 0
	[0239.872] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.872] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0239.872] GetKeyState (nVirtKey=1) returned 1
	[0239.872] GetKeyState (nVirtKey=2) returned 0
	[0239.872] GetKeyState (nVirtKey=4) returned 0
	[0239.872] GetKeyState (nVirtKey=5) returned 0
	[0239.872] GetKeyState (nVirtKey=6) returned 0
	[0239.909] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0239.909] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0239.909] GetKeyState (nVirtKey=1) returned 1
	[0239.909] GetKeyState (nVirtKey=2) returned 0
	[0239.909] GetKeyState (nVirtKey=4) returned 0
	[0239.909] GetKeyState (nVirtKey=5) returned 0
	[0239.909] GetKeyState (nVirtKey=6) returned 0
	[0239.927] GetCapture () returned 0x0
	[0239.928] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0239.928] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0239.928] WaitMessage () returned 1
	[0240.127] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.127] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0240.127] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.127] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.127] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.127] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.127] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.127] WaitMessage () returned 1
	[0240.436] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.436] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.436] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.436] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.436] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.436] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.437] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.437] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.437] GetKeyState (nVirtKey=1) returned 1
	[0240.437] GetKeyState (nVirtKey=2) returned 0
	[0240.437] GetKeyState (nVirtKey=4) returned 0
	[0240.437] GetKeyState (nVirtKey=5) returned 0
	[0240.437] GetKeyState (nVirtKey=6) returned 0
	[0240.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.437] WaitMessage () returned 1
	[0240.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.437] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.438] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.438] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.438] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.438] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.438] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.438] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.438] GetKeyState (nVirtKey=1) returned 1
	[0240.438] GetKeyState (nVirtKey=2) returned 0
	[0240.438] GetKeyState (nVirtKey=4) returned 0
	[0240.438] GetKeyState (nVirtKey=5) returned 0
	[0240.438] GetKeyState (nVirtKey=6) returned 0
	[0240.438] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.438] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.438] WaitMessage () returned 1
	[0240.440] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.441] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.441] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.441] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.441] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.441] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.441] GetKeyState (nVirtKey=1) returned 1
	[0240.441] GetKeyState (nVirtKey=2) returned 0
	[0240.441] GetKeyState (nVirtKey=4) returned 0
	[0240.441] GetKeyState (nVirtKey=5) returned 0
	[0240.441] GetKeyState (nVirtKey=6) returned 0
	[0240.441] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.441] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.441] WaitMessage () returned 1
	[0240.449] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.449] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.449] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.449] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.449] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.449] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.449] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.449] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.449] GetKeyState (nVirtKey=1) returned 1
	[0240.449] GetKeyState (nVirtKey=2) returned 0
	[0240.450] GetKeyState (nVirtKey=4) returned 0
	[0240.450] GetKeyState (nVirtKey=5) returned 0
	[0240.450] GetKeyState (nVirtKey=6) returned 0
	[0240.450] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.450] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.450] WaitMessage () returned 1
	[0240.450] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.450] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.450] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.450] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.450] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.451] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.451] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.451] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.451] GetKeyState (nVirtKey=1) returned 1
	[0240.451] GetKeyState (nVirtKey=2) returned 0
	[0240.451] GetKeyState (nVirtKey=4) returned 0
	[0240.451] GetKeyState (nVirtKey=5) returned 0
	[0240.451] GetKeyState (nVirtKey=6) returned 0
	[0240.451] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.451] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.451] WaitMessage () returned 1
	[0240.453] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.453] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.453] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.453] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.453] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.454] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.454] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.454] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.454] GetKeyState (nVirtKey=1) returned 1
	[0240.454] GetKeyState (nVirtKey=2) returned 0
	[0240.454] GetKeyState (nVirtKey=4) returned 0
	[0240.454] GetKeyState (nVirtKey=5) returned 0
	[0240.454] GetKeyState (nVirtKey=6) returned 0
	[0240.454] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.454] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.454] WaitMessage () returned 1
	[0240.486] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.486] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.486] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.486] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.486] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.486] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.486] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.486] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.486] GetKeyState (nVirtKey=1) returned 1
	[0240.486] GetKeyState (nVirtKey=2) returned 0
	[0240.486] GetKeyState (nVirtKey=4) returned 0
	[0240.486] GetKeyState (nVirtKey=5) returned 0
	[0240.486] GetKeyState (nVirtKey=6) returned 0
	[0240.486] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.486] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.486] WaitMessage () returned 1
	[0240.488] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.488] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.488] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.489] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.489] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.489] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.489] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.489] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.489] GetKeyState (nVirtKey=1) returned 1
	[0240.489] GetKeyState (nVirtKey=2) returned 0
	[0240.489] GetKeyState (nVirtKey=4) returned 0
	[0240.489] GetKeyState (nVirtKey=5) returned 0
	[0240.489] GetKeyState (nVirtKey=6) returned 0
	[0240.489] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.489] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.489] WaitMessage () returned 1
	[0240.498] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.498] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.498] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.498] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.498] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.498] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.499] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.499] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.499] GetKeyState (nVirtKey=1) returned 1
	[0240.499] GetKeyState (nVirtKey=2) returned 0
	[0240.499] GetKeyState (nVirtKey=4) returned 0
	[0240.499] GetKeyState (nVirtKey=5) returned 0
	[0240.499] GetKeyState (nVirtKey=6) returned 0
	[0240.499] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.499] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.499] WaitMessage () returned 1
	[0240.499] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.499] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.499] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.499] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.499] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.499] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.499] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.499] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.499] GetKeyState (nVirtKey=1) returned 1
	[0240.500] GetKeyState (nVirtKey=2) returned 0
	[0240.500] GetKeyState (nVirtKey=4) returned 0
	[0240.500] GetKeyState (nVirtKey=5) returned 0
	[0240.500] GetKeyState (nVirtKey=6) returned 0
	[0240.500] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.500] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.500] WaitMessage () returned 1
	[0240.501] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.501] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.501] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.501] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.501] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.501] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.501] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.501] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.501] GetKeyState (nVirtKey=1) returned 1
	[0240.501] GetKeyState (nVirtKey=2) returned 0
	[0240.501] GetKeyState (nVirtKey=4) returned 0
	[0240.501] GetKeyState (nVirtKey=5) returned 0
	[0240.501] GetKeyState (nVirtKey=6) returned 0
	[0240.501] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.501] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.501] WaitMessage () returned 1
	[0240.502] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.502] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.502] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.502] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.502] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.502] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.502] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.502] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.502] GetKeyState (nVirtKey=1) returned 1
	[0240.502] GetKeyState (nVirtKey=2) returned 0
	[0240.502] GetKeyState (nVirtKey=4) returned 0
	[0240.502] GetKeyState (nVirtKey=5) returned 0
	[0240.502] GetKeyState (nVirtKey=6) returned 0
	[0240.502] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.503] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.503] WaitMessage () returned 1
	[0240.524] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.524] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.524] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.524] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.524] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.524] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.524] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.524] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.524] GetKeyState (nVirtKey=1) returned 1
	[0240.524] GetKeyState (nVirtKey=2) returned 0
	[0240.524] GetKeyState (nVirtKey=4) returned 0
	[0240.524] GetKeyState (nVirtKey=5) returned 0
	[0240.524] GetKeyState (nVirtKey=6) returned 0
	[0240.524] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.524] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.524] WaitMessage () returned 1
	[0240.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.528] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.528] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.528] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.528] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.528] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.528] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.528] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.528] GetKeyState (nVirtKey=1) returned 1
	[0240.528] GetKeyState (nVirtKey=2) returned 0
	[0240.528] GetKeyState (nVirtKey=4) returned 0
	[0240.528] GetKeyState (nVirtKey=5) returned 0
	[0240.528] GetKeyState (nVirtKey=6) returned 0
	[0240.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.528] WaitMessage () returned 1
	[0240.530] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.530] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.530] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.530] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.530] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.530] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.530] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.530] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.530] GetKeyState (nVirtKey=1) returned 1
	[0240.530] GetKeyState (nVirtKey=2) returned 0
	[0240.530] GetKeyState (nVirtKey=4) returned 0
	[0240.530] GetKeyState (nVirtKey=5) returned 0
	[0240.530] GetKeyState (nVirtKey=6) returned 0
	[0240.530] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.530] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.530] WaitMessage () returned 1
	[0240.531] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.531] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.531] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.531] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.531] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.531] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.531] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.531] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.531] GetKeyState (nVirtKey=1) returned 1
	[0240.531] GetKeyState (nVirtKey=2) returned 0
	[0240.531] GetKeyState (nVirtKey=4) returned 0
	[0240.531] GetKeyState (nVirtKey=5) returned 0
	[0240.531] GetKeyState (nVirtKey=6) returned 0
	[0240.531] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.531] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.531] WaitMessage () returned 1
	[0240.603] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.603] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.603] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.603] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.603] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.603] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.603] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.603] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.603] GetKeyState (nVirtKey=1) returned 1
	[0240.603] GetKeyState (nVirtKey=2) returned 0
	[0240.603] GetKeyState (nVirtKey=4) returned 0
	[0240.603] GetKeyState (nVirtKey=5) returned 0
	[0240.603] GetKeyState (nVirtKey=6) returned 0
	[0240.603] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.603] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.603] WaitMessage () returned 1
	[0240.605] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.605] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.605] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.605] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.605] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.605] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.605] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.605] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.605] GetKeyState (nVirtKey=1) returned 1
	[0240.605] GetKeyState (nVirtKey=2) returned 0
	[0240.605] GetKeyState (nVirtKey=4) returned 0
	[0240.605] GetKeyState (nVirtKey=5) returned 0
	[0240.605] GetKeyState (nVirtKey=6) returned 0
	[0240.605] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.605] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.605] WaitMessage () returned 1
	[0240.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.606] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.606] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.606] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.606] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.606] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.606] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.606] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.606] GetKeyState (nVirtKey=1) returned 1
	[0240.606] GetKeyState (nVirtKey=2) returned 0
	[0240.606] GetKeyState (nVirtKey=4) returned 0
	[0240.606] GetKeyState (nVirtKey=5) returned 0
	[0240.606] GetKeyState (nVirtKey=6) returned 0
	[0240.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.607] WaitMessage () returned 1
	[0240.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.607] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.607] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.607] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.607] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.608] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.608] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.608] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.608] GetKeyState (nVirtKey=1) returned 1
	[0240.608] GetKeyState (nVirtKey=2) returned 0
	[0240.608] GetKeyState (nVirtKey=4) returned 0
	[0240.608] GetKeyState (nVirtKey=5) returned 0
	[0240.608] GetKeyState (nVirtKey=6) returned 0
	[0240.608] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.608] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.608] WaitMessage () returned 1
	[0240.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.609] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.609] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.609] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.609] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.609] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.609] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.609] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.609] GetKeyState (nVirtKey=1) returned 1
	[0240.609] GetKeyState (nVirtKey=2) returned 0
	[0240.609] GetKeyState (nVirtKey=4) returned 0
	[0240.609] GetKeyState (nVirtKey=5) returned 0
	[0240.609] GetKeyState (nVirtKey=6) returned 0
	[0240.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.609] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.609] WaitMessage () returned 1
	[0240.610] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.610] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.610] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.610] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.610] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.611] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.611] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.611] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.611] GetKeyState (nVirtKey=1) returned 1
	[0240.611] GetKeyState (nVirtKey=2) returned 0
	[0240.611] GetKeyState (nVirtKey=4) returned 0
	[0240.611] GetKeyState (nVirtKey=5) returned 0
	[0240.611] GetKeyState (nVirtKey=6) returned 0
	[0240.611] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.611] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.611] WaitMessage () returned 1
	[0240.612] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.612] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.612] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.612] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.612] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.612] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.612] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.612] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.612] GetKeyState (nVirtKey=1) returned 1
	[0240.612] GetKeyState (nVirtKey=2) returned 0
	[0240.612] GetKeyState (nVirtKey=4) returned 0
	[0240.612] GetKeyState (nVirtKey=5) returned 0
	[0240.612] GetKeyState (nVirtKey=6) returned 0
	[0240.612] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.612] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.612] WaitMessage () returned 1
	[0240.613] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.613] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.613] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.613] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.613] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.613] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.613] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.613] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.613] GetKeyState (nVirtKey=1) returned 1
	[0240.613] GetKeyState (nVirtKey=2) returned 0
	[0240.613] GetKeyState (nVirtKey=4) returned 0
	[0240.613] GetKeyState (nVirtKey=5) returned 0
	[0240.613] GetKeyState (nVirtKey=6) returned 0
	[0240.613] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.613] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.613] WaitMessage () returned 1
	[0240.615] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.615] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.615] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.615] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.615] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.615] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.615] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.615] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.615] GetKeyState (nVirtKey=1) returned 1
	[0240.615] GetKeyState (nVirtKey=2) returned 0
	[0240.615] GetKeyState (nVirtKey=4) returned 0
	[0240.615] GetKeyState (nVirtKey=5) returned 0
	[0240.615] GetKeyState (nVirtKey=6) returned 0
	[0240.615] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.615] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.615] WaitMessage () returned 1
	[0240.616] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.616] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.616] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.616] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.616] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.617] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.617] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.617] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.617] GetKeyState (nVirtKey=1) returned 1
	[0240.617] GetKeyState (nVirtKey=2) returned 0
	[0240.617] GetKeyState (nVirtKey=4) returned 0
	[0240.617] GetKeyState (nVirtKey=5) returned 0
	[0240.617] GetKeyState (nVirtKey=6) returned 0
	[0240.617] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.617] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.617] WaitMessage () returned 1
	[0240.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.621] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.621] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.621] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.621] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.621] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.621] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.621] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.621] GetKeyState (nVirtKey=1) returned 1
	[0240.621] GetKeyState (nVirtKey=2) returned 0
	[0240.621] GetKeyState (nVirtKey=4) returned 0
	[0240.621] GetKeyState (nVirtKey=5) returned 0
	[0240.621] GetKeyState (nVirtKey=6) returned 0
	[0240.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.621] WaitMessage () returned 1
	[0240.625] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.625] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.625] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.625] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.625] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.625] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.625] GetKeyState (nVirtKey=1) returned 1
	[0240.625] GetKeyState (nVirtKey=2) returned 0
	[0240.625] GetKeyState (nVirtKey=4) returned 0
	[0240.625] GetKeyState (nVirtKey=5) returned 0
	[0240.625] GetKeyState (nVirtKey=6) returned 0
	[0240.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.626] WaitMessage () returned 1
	[0240.627] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.627] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.627] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.627] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.627] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.627] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.627] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.627] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.627] GetKeyState (nVirtKey=1) returned 1
	[0240.627] GetKeyState (nVirtKey=2) returned 0
	[0240.627] GetKeyState (nVirtKey=4) returned 0
	[0240.627] GetKeyState (nVirtKey=5) returned 0
	[0240.627] GetKeyState (nVirtKey=6) returned 0
	[0240.627] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.627] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.627] WaitMessage () returned 1
	[0240.652] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.652] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.652] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.652] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.652] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.652] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.652] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.653] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.653] GetKeyState (nVirtKey=1) returned 1
	[0240.653] GetKeyState (nVirtKey=2) returned 0
	[0240.653] GetKeyState (nVirtKey=4) returned 0
	[0240.653] GetKeyState (nVirtKey=5) returned 0
	[0240.653] GetKeyState (nVirtKey=6) returned 0
	[0240.653] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.653] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.653] WaitMessage () returned 1
	[0240.675] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.676] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.676] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.676] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.676] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.676] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.676] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.676] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.676] GetKeyState (nVirtKey=1) returned 1
	[0240.676] GetKeyState (nVirtKey=2) returned 0
	[0240.676] GetKeyState (nVirtKey=4) returned 0
	[0240.676] GetKeyState (nVirtKey=5) returned 0
	[0240.676] GetKeyState (nVirtKey=6) returned 0
	[0240.676] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.676] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.676] WaitMessage () returned 1
	[0240.709] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.709] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.709] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.709] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.709] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.709] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.709] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.709] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.709] GetKeyState (nVirtKey=1) returned 1
	[0240.709] GetKeyState (nVirtKey=2) returned 0
	[0240.709] GetKeyState (nVirtKey=4) returned 0
	[0240.709] GetKeyState (nVirtKey=5) returned 0
	[0240.709] GetKeyState (nVirtKey=6) returned 0
	[0240.709] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.709] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.709] WaitMessage () returned 1
	[0240.710] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.710] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.710] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.710] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.710] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.710] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.710] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.710] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.710] GetKeyState (nVirtKey=1) returned 1
	[0240.710] GetKeyState (nVirtKey=2) returned 0
	[0240.710] GetKeyState (nVirtKey=4) returned 0
	[0240.710] GetKeyState (nVirtKey=5) returned 0
	[0240.710] GetKeyState (nVirtKey=6) returned 0
	[0240.710] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.710] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.710] WaitMessage () returned 1
	[0240.711] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.711] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.711] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.711] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.711] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.711] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.711] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.711] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.711] GetKeyState (nVirtKey=1) returned 1
	[0240.711] GetKeyState (nVirtKey=2) returned 0
	[0240.711] GetKeyState (nVirtKey=4) returned 0
	[0240.711] GetKeyState (nVirtKey=5) returned 0
	[0240.711] GetKeyState (nVirtKey=6) returned 0
	[0240.711] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.711] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.711] WaitMessage () returned 1
	[0240.711] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.711] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.711] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.711] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.711] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.711] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.712] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.712] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.712] GetKeyState (nVirtKey=1) returned 1
	[0240.712] GetKeyState (nVirtKey=2) returned 0
	[0240.712] GetKeyState (nVirtKey=4) returned 0
	[0240.712] GetKeyState (nVirtKey=5) returned 0
	[0240.712] GetKeyState (nVirtKey=6) returned 0
	[0240.712] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.712] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.712] WaitMessage () returned 1
	[0240.884] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.884] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0240.884] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x46, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0240.885] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0240.885] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0240.886] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0240.886] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0240.886] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df50 | out: lpwndpl=0x20df50) returned 1
	[0240.886] GetClientRect (in: hWnd=0x50120, lpRect=0x20de00 | out: lpRect=0x20de00) returned 1
	[0240.886] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0240.886] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0240.887] GetSystemMetrics (nIndex=42) returned 0
	[0240.887] CoTaskMemAlloc (cb=0x26) returned 0x1b065c20
	[0240.887] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b065c20, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0240.887] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b065c20) returned 0x10
	[0240.887] CoTaskMemFree (pv=0x1b065c20) 
	[0240.887] GetClientRect (in: hWnd=0x50120, lpRect=0x20dba0 | out: lpRect=0x20dba0) returned 1
	[0240.887] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0240.887] GdipCreateFromHDC (hdc=0x70107fc, graphics=0x20d770) returned 0x0
	[0240.888] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0240.888] GdipCreateMatrix (matrix=0x20d660) returned 0x0
	[0240.888] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0240.888] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d6c0) returned 0x0
	[0240.888] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0240.888] GdipCreateRegion (region=0x20d660) returned 0x0
	[0240.889] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0240.889] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d690) returned 0x0
	[0240.889] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0240.889] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d760) returned 0x0
	[0240.889] GdipCreateRegion (region=0x20d630) returned 0x0
	[0240.890] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0240.890] GdipCreateMatrix (matrix=0x20d630) returned 0x0
	[0240.890] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0240.890] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d690) returned 0x0
	[0240.890] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0240.890] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.891] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0240.891] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6e0) returned 0x0
	[0240.891] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0240.891] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d710) returned 0x0
	[0240.891] GetCurrentObject (hdc=0x70107fc, type=0x1) returned 0x1b00017
	[0240.892] GetCurrentObject (hdc=0x70107fc, type=0x2) returned 0x1900010
	[0240.892] GetCurrentObject (hdc=0x70107fc, type=0x7) returned 0x1050032
	[0240.892] GetCurrentObject (hdc=0x70107fc, type=0x6) returned 0x18a002e
	[0240.892] SaveDC (hdc=0x70107fc) returned 1
	[0240.892] OffsetViewportOrgEx (in: hdc=0x70107fc, x=0, y=0, lppt=0x269e2d0 | out: lppt=0x269e2d0) returned 1
	[0240.892] GetNearestColor (hdc=0x70107fc, color=0xf0f0f0) returned 0xf0f0f0
	[0240.893] CreateSolidBrush (color=0xf0f0f0) returned 0x771007c0
	[0240.893] FillRect (hDC=0x70107fc, lprc=0x20d6e0, hbr=0x771007c0) returned 1
	[0240.893] DeleteObject (ho=0x771007c0) returned 1
	[0240.893] RestoreDC (hdc=0x70107fc, nSavedDC=-1) returned 1
	[0240.893] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x70107fc) returned 0x0
	[0240.894] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0240.894] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0240.894] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x2041a3a, lParam=0x0) returned 0x0
	[0240.895] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x3041a3a, lParam=0x0) returned 0x0
	[0240.895] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x70107fc, lParam=0x0) returned 0x1
	[0240.895] GetStockObject (i=5) returned 0x1900015
	[0240.896] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0x4041a3a, lParam=0x0) returned 0x0
	[0240.896] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df30 | out: lpwndpl=0x20df30) returned 1
	[0240.896] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0240.896] GetClientRect (in: hWnd=0x50120, lpRect=0x20dcd0 | out: lpRect=0x20dcd0) returned 1
	[0240.896] GetWindowRect (in: hWnd=0x50120, lpRect=0x20dcd0 | out: lpRect=0x20dcd0) returned 1
	[0240.896] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0240.896] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0240.896] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x47, wParam=0x0, lParam=0x20e4d0) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b1352d0) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0xd38) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0xd38) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0xd38) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0xd38) returned 0x0
	[0240.897] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0xd38) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0240.897] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0240.898] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0240.898] GetFocus () returned 0x0
	[0240.898] SetFocus (hWnd=0x401b4) returned 0x0
	[0240.898] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0240.899] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0240.899] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0240.899] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0240.899] GetStockObject (i=5) returned 0x1900015
	[0240.900] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1a0) returned 0x0
	[0240.900] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1a0) returned 0x0
	[0240.900] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0240.900] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0240.900] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.900] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.900] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.900] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.900] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.900] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0240.900] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.900] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0240.900] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0240.900] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.900] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.900] GetKeyState (nVirtKey=1) returned 1
	[0240.900] GetKeyState (nVirtKey=2) returned 0
	[0240.900] GetKeyState (nVirtKey=4) returned 0
	[0240.900] GetKeyState (nVirtKey=5) returned 0
	[0240.900] GetKeyState (nVirtKey=6) returned 0
	[0240.900] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.900] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0240.900] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.901] GetKeyState (nVirtKey=16) returned 0
	[0240.901] GetKeyState (nVirtKey=17) returned 0
	[0240.901] GetKeyState (nVirtKey=18) returned -128
	[0240.901] TranslateMessage (lpMsg=0x20e6b0) returned 1
	[0240.901] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.901] GetKeyState (nVirtKey=16) returned 0
	[0240.901] GetKeyState (nVirtKey=17) returned 0
	[0240.901] GetKeyState (nVirtKey=18) returned -128
	[0240.901] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x105, wParam=0x1b, lParam=0xe0010001) returned 0x0
	[0240.901] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.901] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0240.901] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.901] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.901] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.901] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0240.901] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0240.902] CreateCompatibleDC (hdc=0x10107f8) returned 0x18011a39
	[0240.902] GetObjectType (h=0x10107f8) returned 0x3
	[0240.902] CreateCompatibleBitmap (hdc=0x10107f8, cx=1, cy=1) returned 0x12051a3b
	[0240.903] GetDIBits (in: hdc=0x10107f8, hbm=0x12051a3b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0240.903] GetDIBits (in: hdc=0x10107f8, hbm=0x12051a3b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0240.903] DeleteObject (ho=0x12051a3b) returned 1
	[0240.904] CreateDIBSection (in: hdc=0x10107f8, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x2051a3c
	[0240.904] SelectObject (hdc=0x18011a39, h=0x2051a3c) returned 0x185000f
	[0240.904] GdipCreateFromHDC (hdc=0x18011a39, graphics=0x20d750) returned 0x0
	[0240.904] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0240.904] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0240.905] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0240.905] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0240.905] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0240.905] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0240.905] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.905] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0240.906] GdipCreateRegion (region=0x20d910) returned 0x0
	[0240.906] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0240.906] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0240.906] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0240.906] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0240.906] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0240.906] GetSystemMetrics (nIndex=42) returned 0
	[0240.906] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0240.906] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0240.906] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0240.907] CoTaskMemFree (pv=0x1b07f5c0) 
	[0240.907] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0240.907] GdipCreateRegion (region=0x20d400) returned 0x0
	[0240.907] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0240.907] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0240.907] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0240.907] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0240.908] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0240.908] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.908] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0240.908] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0240.908] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.908] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0240.909] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0240.909] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0240.909] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0240.909] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0240.909] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0240.909] GetCurrentObject (hdc=0x18011a39, type=0x1) returned 0x1b00017
	[0240.909] GetCurrentObject (hdc=0x18011a39, type=0x2) returned 0x1900010
	[0240.910] GetCurrentObject (hdc=0x18011a39, type=0x7) returned 0x2051a3c
	[0240.910] GetCurrentObject (hdc=0x18011a39, type=0x6) returned 0x18a002e
	[0240.910] SaveDC (hdc=0x18011a39) returned 1
	[0240.910] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff82040710
	[0240.910] GetClipRgn (hdc=0x18011a39, hrgn=0xffffffff82040710) returned 0
	[0240.911] SelectClipRgn (hdc=0x18011a39, hrgn=0xfffffffffd0407f9) returned 2
	[0240.911] DeleteObject (ho=0xffffffff82040710) returned 1
	[0240.911] DeleteObject (ho=0xfffffffffd0407f9) returned 1
	[0240.911] OffsetViewportOrgEx (in: hdc=0x18011a39, x=0, y=0, lppt=0x269fb18 | out: lppt=0x269fb18) returned 1
	[0240.911] GetNearestColor (hdc=0x18011a39, color=0x0) returned 0x0
	[0240.912] CreateSolidBrush (color=0x0) returned 0x781007c0
	[0240.912] FillRect (hDC=0x18011a39, lprc=0x20d4b0, hbr=0x781007c0) returned 1
	[0240.912] DeleteObject (ho=0x781007c0) returned 1
	[0240.912] RestoreDC (hdc=0x18011a39, nSavedDC=-1) returned 1
	[0240.912] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x18011a39) returned 0x0
	[0240.912] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9ad0dbd) returned 0x0
	[0240.913] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0240.913] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0240.913] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0240.913] GetSystemMetrics (nIndex=42) returned 0
	[0240.913] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0240.913] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0240.913] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0240.913] CoTaskMemFree (pv=0x1b07f5c0) 
	[0240.913] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0240.913] GetCurrentObject (hdc=0x18011a39, type=0x1) returned 0x1b00017
	[0240.913] GetCurrentObject (hdc=0x18011a39, type=0x2) returned 0x1900010
	[0240.914] GetCurrentObject (hdc=0x18011a39, type=0x7) returned 0x2051a3c
	[0240.914] GetCurrentObject (hdc=0x18011a39, type=0x6) returned 0x18a002e
	[0240.914] SaveDC (hdc=0x18011a39) returned 1
	[0240.914] GetNearestColor (hdc=0x18011a39, color=0x80) returned 0x80
	[0240.914] RestoreDC (hdc=0x18011a39, nSavedDC=-1) returned 1
	[0240.914] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x18011a39) returned 0x0
	[0240.915] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0240.915] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0240.915] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0240.915] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0240.915] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0240.915] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0240.916] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0240.916] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0240.916] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0240.916] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0240.917] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0240.917] BitBlt (hdc=0x10107f8, x=0, y=0, cx=310, cy=83, hdcSrc=0x18011a39, x1=0, y1=0, rop=0xcc0020) returned 1
	[0240.917] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x18011a39) returned 0x0
	[0240.917] SelectObject (hdc=0x18011a39, h=0x185000f) returned 0x2051a3c
	[0240.917] DeleteDC (hdc=0x18011a39) returned 1
	[0240.917] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0240.918] DeleteObject (ho=0x2051a3c) returned 1
	[0240.918] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0240.918] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0240.918] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.918] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0240.918] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.918] GetKeyState (nVirtKey=16) returned 0
	[0240.918] GetKeyState (nVirtKey=17) returned 0
	[0240.918] GetKeyState (nVirtKey=18) returned 0
	[0240.918] TranslateMessage (lpMsg=0x20e6b0) returned 1
	[0240.918] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.918] GetKeyState (nVirtKey=16) returned 0
	[0240.918] GetKeyState (nVirtKey=17) returned 0
	[0240.918] GetKeyState (nVirtKey=18) returned 0
	[0240.918] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x101, wParam=0x12, lParam=0xc0380001) returned 0x0
	[0240.918] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.919] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0240.919] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.919] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.919] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.919] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0240.919] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0240.919] CreateCompatibleDC (hdc=0x48010f97) returned 0x36011a33
	[0240.919] SelectObject (hdc=0x36011a33, h=0x140507d2) returned 0x185000f
	[0240.919] GdipCreateFromHDC (hdc=0x36011a33, graphics=0x20d7e0) returned 0x0
	[0240.920] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0240.920] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0240.920] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0240.920] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0240.920] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0240.920] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0240.921] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.921] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0240.921] GdipCreateRegion (region=0x20d910) returned 0x0
	[0240.921] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0240.921] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0240.921] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0240.922] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9ab0dbd) returned 0x0
	[0240.922] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0240.923] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0240.923] GetCurrentObject (hdc=0x36011a33, type=0x1) returned 0x1b00017
	[0240.923] GetCurrentObject (hdc=0x36011a33, type=0x2) returned 0x1900010
	[0240.924] GetCurrentObject (hdc=0x36011a33, type=0x7) returned 0x140507d2
	[0240.924] GetCurrentObject (hdc=0x36011a33, type=0x6) returned 0x18a002e
	[0240.924] SaveDC (hdc=0x36011a33) returned 1
	[0240.924] GetNearestColor (hdc=0x36011a33, color=0xf0f0f0) returned 0xf0f0f0
	[0240.924] GetNearestColor (hdc=0x36011a33, color=0xa0a0a0) returned 0xa0a0a0
	[0240.925] GetNearestColor (hdc=0x36011a33, color=0x696969) returned 0x696969
	[0240.925] GetNearestColor (hdc=0x36011a33, color=0xa0a0a0) returned 0xa0a0a0
	[0240.925] GetNearestColor (hdc=0x36011a33, color=0x0) returned 0x0
	[0240.925] GetNearestColor (hdc=0x36011a33, color=0xffffff) returned 0xffffff
	[0240.925] GetNearestColor (hdc=0x36011a33, color=0xe5e5e5) returned 0xe5e5e5
	[0240.926] GetNearestColor (hdc=0x36011a33, color=0xd8d8d8) returned 0xd8d8d8
	[0240.926] GetNearestColor (hdc=0x36011a33, color=0x0) returned 0x0
	[0240.926] RestoreDC (hdc=0x36011a33, nSavedDC=-1) returned 1
	[0240.926] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011a33) returned 0x0
	[0240.926] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0240.927] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0240.927] CoTaskMemFree (pv=0x1b067980) 
	[0240.927] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0240.927] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0240.927] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0240.927] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0240.927] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0240.928] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0240.928] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0240.928] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0240.928] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0240.928] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0240.928] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0240.929] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0240.929] CoTaskMemFree (pv=0x1b067980) 
	[0240.929] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0240.929] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0240.929] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0240.929] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0240.930] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0240.930] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0240.930] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0240.930] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0240.930] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0240.930] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0240.931] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0240.931] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0240.931] CoTaskMemFree (pv=0x1b067980) 
	[0240.931] GdipCreateRegion (region=0x20d120) returned 0x0
	[0240.931] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0240.931] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0240.932] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0240.932] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0240.932] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0240.932] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.932] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0240.932] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.933] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0240.933] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0240.933] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0240.933] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0240.933] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0240.933] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0240.934] GetCurrentObject (hdc=0x36011a33, type=0x1) returned 0x1b00017
	[0240.934] GetCurrentObject (hdc=0x36011a33, type=0x2) returned 0x1900010
	[0240.934] GetCurrentObject (hdc=0x36011a33, type=0x7) returned 0x140507d2
	[0240.934] GetCurrentObject (hdc=0x36011a33, type=0x6) returned 0x18a002e
	[0240.934] SaveDC (hdc=0x36011a33) returned 1
	[0240.934] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffffe0407f9
	[0240.935] GetClipRgn (hdc=0x36011a33, hrgn=0xfffffffffe0407f9) returned 0
	[0240.935] SelectClipRgn (hdc=0x36011a33, hrgn=0xffffffff83040710) returned 2
	[0240.935] DeleteObject (ho=0xfffffffffe0407f9) returned 1
	[0240.935] DeleteObject (ho=0xffffffff83040710) returned 1
	[0240.935] OffsetViewportOrgEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x26a0c20 | out: lppt=0x26a0c20) returned 1
	[0240.935] GetNearestColor (hdc=0x36011a33, color=0xf0f0f0) returned 0xf0f0f0
	[0240.936] CreateSolidBrush (color=0xf0f0f0) returned 0x791007c0
	[0240.936] FillRect (hDC=0x36011a33, lprc=0x20d1d0, hbr=0x791007c0) returned 1
	[0240.936] DeleteObject (ho=0x791007c0) returned 1
	[0240.936] RestoreDC (hdc=0x36011a33, nSavedDC=-1) returned 1
	[0240.936] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011a33) returned 0x0
	[0240.937] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0240.937] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0240.937] CoTaskMemFree (pv=0x1b067980) 
	[0240.937] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0240.937] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0240.937] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0240.938] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0240.938] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0240.938] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0240.938] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0240.939] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0240.939] GetFocus () returned 0x401b4
	[0240.939] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0240.939] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0240.939] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0240.939] CoTaskMemFree (pv=0x1b067980) 
	[0240.939] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0240.939] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0240.940] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0240.940] GdipCreateRegion (region=0x20d070) returned 0x0
	[0240.940] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0240.940] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0240.940] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0240.941] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0240.941] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0240.941] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.941] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0240.941] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.941] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0240.942] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0240.942] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0240.942] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0240.942] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0240.942] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0240.942] GetCurrentObject (hdc=0x36011a33, type=0x1) returned 0x1b00017
	[0240.943] GetCurrentObject (hdc=0x36011a33, type=0x2) returned 0x1900010
	[0240.943] GetCurrentObject (hdc=0x36011a33, type=0x7) returned 0x140507d2
	[0240.943] GetCurrentObject (hdc=0x36011a33, type=0x6) returned 0x18a002e
	[0240.943] SaveDC (hdc=0x36011a33) returned 1
	[0240.943] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff84040710
	[0240.943] GetClipRgn (hdc=0x36011a33, hrgn=0xffffffff84040710) returned 0
	[0240.944] SelectClipRgn (hdc=0x36011a33, hrgn=0xffffffffff0407f9) returned 2
	[0240.944] DeleteObject (ho=0xffffffff84040710) returned 1
	[0240.944] DeleteObject (ho=0xffffffffff0407f9) returned 1
	[0240.944] OffsetViewportOrgEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x26a11c0 | out: lppt=0x26a11c0) returned 1
	[0240.944] GetROP2 (hdc=0x36011a33) returned 13
	[0240.944] GetBkMode (hdc=0x36011a33) returned 2
	[0240.945] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.945] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x9301a38
	[0240.945] SelectObject (hdc=0x36011a33, h=0x9301a38) returned 0x1b00017
	[0240.945] MoveToEx (in: hdc=0x36011a33, x=126, y=1, lppt=0x26a1228 | out: lppt=0x26a1228) returned 1
	[0240.945] LineTo (hdc=0x36011a33, x=1, y=1) returned 1
	[0240.945] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.946] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.946] GetROP2 (hdc=0x36011a33) returned 13
	[0240.946] GetBkMode (hdc=0x36011a33) returned 2
	[0240.946] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.946] SelectObject (hdc=0x36011a33, h=0x9301a38) returned 0x9301a38
	[0240.946] MoveToEx (in: hdc=0x36011a33, x=1, y=1, lppt=0x26a1240 | out: lppt=0x26a1240) returned 1
	[0240.947] LineTo (hdc=0x36011a33, x=1, y=39) returned 1
	[0240.947] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.947] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.947] SelectObject (hdc=0x36011a33, h=0x1b00017) returned 0x9301a38
	[0240.947] DeleteObject (ho=0x9301a38) returned 1
	[0240.948] GetROP2 (hdc=0x36011a33) returned 13
	[0240.948] GetBkMode (hdc=0x36011a33) returned 2
	[0240.948] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.948] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x14301a3b
	[0240.948] SelectObject (hdc=0x36011a33, h=0x14301a3b) returned 0x1b00017
	[0240.948] MoveToEx (in: hdc=0x36011a33, x=1, y=39, lppt=0x26a12a8 | out: lppt=0x26a12a8) returned 1
	[0240.949] LineTo (hdc=0x36011a33, x=126, y=39) returned 1
	[0240.949] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.949] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.949] GetROP2 (hdc=0x36011a33) returned 13
	[0240.949] GetBkMode (hdc=0x36011a33) returned 2
	[0240.949] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.950] SelectObject (hdc=0x36011a33, h=0x14301a3b) returned 0x14301a3b
	[0240.950] MoveToEx (in: hdc=0x36011a33, x=126, y=39, lppt=0x26a12c0 | out: lppt=0x26a12c0) returned 1
	[0240.950] LineTo (hdc=0x36011a33, x=126, y=0) returned 1
	[0240.950] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.950] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.950] SelectObject (hdc=0x36011a33, h=0x1b00017) returned 0x14301a3b
	[0240.951] DeleteObject (ho=0x14301a3b) returned 1
	[0240.951] GetROP2 (hdc=0x36011a33) returned 13
	[0240.951] GetBkMode (hdc=0x36011a33) returned 2
	[0240.951] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.951] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xa301a38
	[0240.951] SelectObject (hdc=0x36011a33, h=0xa301a38) returned 0x1b00017
	[0240.952] MoveToEx (in: hdc=0x36011a33, x=125, y=2, lppt=0x26a1328 | out: lppt=0x26a1328) returned 1
	[0240.952] LineTo (hdc=0x36011a33, x=2, y=2) returned 1
	[0240.952] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.952] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.952] GetROP2 (hdc=0x36011a33) returned 13
	[0240.952] GetBkMode (hdc=0x36011a33) returned 2
	[0240.953] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.953] SelectObject (hdc=0x36011a33, h=0xa301a38) returned 0xa301a38
	[0240.953] MoveToEx (in: hdc=0x36011a33, x=2, y=2, lppt=0x26a1340 | out: lppt=0x26a1340) returned 1
	[0240.953] LineTo (hdc=0x36011a33, x=2, y=38) returned 1
	[0240.953] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.954] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.954] SelectObject (hdc=0x36011a33, h=0x1b00017) returned 0xa301a38
	[0240.954] DeleteObject (ho=0xa301a38) returned 1
	[0240.954] GetROP2 (hdc=0x36011a33) returned 13
	[0240.954] GetBkMode (hdc=0x36011a33) returned 2
	[0240.955] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.955] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x15301a3b
	[0240.955] SelectObject (hdc=0x36011a33, h=0x15301a3b) returned 0x1b00017
	[0240.955] MoveToEx (in: hdc=0x36011a33, x=2, y=38, lppt=0x26a13a8 | out: lppt=0x26a13a8) returned 1
	[0240.955] LineTo (hdc=0x36011a33, x=125, y=38) returned 1
	[0240.955] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.956] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.956] GetROP2 (hdc=0x36011a33) returned 13
	[0240.956] GetBkMode (hdc=0x36011a33) returned 2
	[0240.956] SetBkMode (hdc=0x36011a33, mode=1) returned 2
	[0240.956] SelectObject (hdc=0x36011a33, h=0x15301a3b) returned 0x15301a3b
	[0240.956] MoveToEx (in: hdc=0x36011a33, x=125, y=38, lppt=0x26a13c0 | out: lppt=0x26a13c0) returned 1
	[0240.957] LineTo (hdc=0x36011a33, x=125, y=1) returned 1
	[0240.957] SetBkMode (hdc=0x36011a33, mode=2) returned 1
	[0240.957] MoveToEx (in: hdc=0x36011a33, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0240.957] SelectObject (hdc=0x36011a33, h=0x1b00017) returned 0x15301a3b
	[0240.957] DeleteObject (ho=0x15301a3b) returned 1
	[0240.957] RestoreDC (hdc=0x36011a33, nSavedDC=-1) returned 1
	[0240.958] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011a33) returned 0x0
	[0240.958] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0240.958] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0x36011a33, x1=0, y1=0, rop=0xcc0020) returned 1
	[0240.958] GdipReleaseDC (graphics=0x1b929550, hdc=0x36011a33) returned 0x0
	[0240.959] SelectObject (hdc=0x36011a33, h=0x185000f) returned 0x140507d2
	[0240.959] DeleteDC (hdc=0x36011a33) returned 1
	[0240.959] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0240.959] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0240.959] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0240.959] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.959] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0240.959] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0240.959] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0240.960] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0240.960] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x4010280
	[0240.960] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0240.960] CreateCompatibleDC (hdc=0x4010280) returned 0x16011a3b
	[0240.960] GetObjectType (h=0x4010280) returned 0x3
	[0240.960] CreateCompatibleBitmap (hdc=0x4010280, cx=1, cy=1) returned 0xb051a38
	[0240.960] GetDIBits (in: hdc=0x4010280, hbm=0xb051a38, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0240.960] GetDIBits (in: hdc=0x4010280, hbm=0xb051a38, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0240.960] DeleteObject (ho=0xb051a38) returned 1
	[0240.961] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0x3051a3c
	[0240.961] SelectObject (hdc=0x16011a3b, h=0x3051a3c) returned 0x185000f
	[0240.961] GdipCreateFromHDC (hdc=0x16011a3b, graphics=0x20d800) returned 0x0
	[0240.961] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0240.961] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0240.962] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0240.962] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0240.962] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20da20) returned 0x0
	[0240.962] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0240.962] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.962] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0240.963] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0240.963] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0240.963] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0240.963] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0240.963] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0240.963] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0240.963] GetSystemMetrics (nIndex=42) returned 0
	[0240.963] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0240.963] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1 | out: lpString="") returned 0
	[0240.963] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0240.963] CoTaskMemFree (pv=0x1b078860) 
	[0240.963] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0240.964] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0240.964] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0240.964] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0240.964] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0240.964] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0240.964] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0240.965] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.965] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0240.965] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0240.965] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0240.965] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0240.965] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0240.966] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0240.966] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0240.966] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0240.966] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0240.966] GetCurrentObject (hdc=0x16011a3b, type=0x1) returned 0x1b00017
	[0240.966] GetCurrentObject (hdc=0x16011a3b, type=0x2) returned 0x1900010
	[0240.967] GetCurrentObject (hdc=0x16011a3b, type=0x7) returned 0x3051a3c
	[0240.967] GetCurrentObject (hdc=0x16011a3b, type=0x6) returned 0x18a002e
	[0240.967] SaveDC (hdc=0x16011a3b) returned 1
	[0240.967] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x407f9
	[0240.967] GetClipRgn (hdc=0x16011a3b, hrgn=0x407f9) returned 0
	[0240.967] SelectClipRgn (hdc=0x16011a3b, hrgn=0xffffffff85040710) returned 2
	[0240.968] DeleteObject (ho=0x407f9) returned 1
	[0240.968] DeleteObject (ho=0xffffffff85040710) returned 1
	[0240.968] OffsetViewportOrgEx (in: hdc=0x16011a3b, x=0, y=0, lppt=0x26a2a70 | out: lppt=0x26a2a70) returned 1
	[0240.969] GetNearestColor (hdc=0x16011a3b, color=0xf0f0f0) returned 0xf0f0f0
	[0240.969] CreateSolidBrush (color=0xf0f0f0) returned 0x7a1007c0
	[0240.970] FillRect (hDC=0x16011a3b, lprc=0x20d560, hbr=0x7a1007c0) returned 1
	[0240.970] DeleteObject (ho=0x7a1007c0) returned 1
	[0240.971] RestoreDC (hdc=0x16011a3b, nSavedDC=-1) returned 1
	[0240.971] GdipReleaseDC (graphics=0x1b929550, hdc=0x16011a3b) returned 0x0
	[0240.971] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9a80dbd) returned 0x0
	[0240.972] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0240.972] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0240.972] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0240.972] GetSystemMetrics (nIndex=42) returned 0
	[0240.972] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0240.972] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1 | out: lpString="") returned 0
	[0240.972] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0240.972] CoTaskMemFree (pv=0x1b078860) 
	[0240.972] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0240.979] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0240.979] BitBlt (hdc=0x4010280, x=0, y=0, cx=658, cy=456, hdcSrc=0x16011a3b, x1=0, y1=0, rop=0xcc0020) returned 1
	[0240.980] GdipReleaseDC (graphics=0x1b929550, hdc=0x16011a3b) returned 0x0
	[0240.980] SelectObject (hdc=0x16011a3b, h=0x185000f) returned 0x3051a3c
	[0240.980] DeleteDC (hdc=0x16011a3b) returned 1
	[0240.980] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0240.980] DeleteObject (ho=0x3051a3c) returned 1
	[0240.981] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0240.981] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0240.981] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.981] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0240.981] WaitMessage () returned 1
	[0241.074] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.074] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0241.074] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.074] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.074] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.074] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.074] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.074] WaitMessage () returned 1
	[0241.118] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.118] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.118] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.118] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.118] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.118] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.118] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.118] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.118] GetKeyState (nVirtKey=1) returned 1
	[0241.118] GetKeyState (nVirtKey=2) returned 0
	[0241.118] GetKeyState (nVirtKey=4) returned 0
	[0241.118] GetKeyState (nVirtKey=5) returned 0
	[0241.118] GetKeyState (nVirtKey=6) returned 0
	[0241.118] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.118] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.118] WaitMessage () returned 1
	[0241.150] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.151] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.151] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.151] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.151] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.151] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.151] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.151] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.151] GetKeyState (nVirtKey=1) returned 1
	[0241.151] GetKeyState (nVirtKey=2) returned 0
	[0241.151] GetKeyState (nVirtKey=4) returned 0
	[0241.151] GetKeyState (nVirtKey=5) returned 0
	[0241.151] GetKeyState (nVirtKey=6) returned 0
	[0241.151] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.151] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.151] WaitMessage () returned 1
	[0241.152] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.152] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.152] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.152] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.152] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.152] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.153] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.153] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.153] GetKeyState (nVirtKey=1) returned 1
	[0241.153] GetKeyState (nVirtKey=2) returned 0
	[0241.153] GetKeyState (nVirtKey=4) returned 0
	[0241.153] GetKeyState (nVirtKey=5) returned 0
	[0241.153] GetKeyState (nVirtKey=6) returned 0
	[0241.153] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.153] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.153] WaitMessage () returned 1
	[0241.153] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.154] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.154] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.154] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.154] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.154] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.154] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.154] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.154] GetKeyState (nVirtKey=1) returned 1
	[0241.154] GetKeyState (nVirtKey=2) returned 0
	[0241.154] GetKeyState (nVirtKey=4) returned 0
	[0241.154] GetKeyState (nVirtKey=5) returned 0
	[0241.154] GetKeyState (nVirtKey=6) returned 0
	[0241.154] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.154] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.154] WaitMessage () returned 1
	[0241.155] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.155] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.155] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.155] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.155] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.155] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.155] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.155] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.155] GetKeyState (nVirtKey=1) returned 1
	[0241.155] GetKeyState (nVirtKey=2) returned 0
	[0241.155] GetKeyState (nVirtKey=4) returned 0
	[0241.155] GetKeyState (nVirtKey=5) returned 0
	[0241.155] GetKeyState (nVirtKey=6) returned 0
	[0241.155] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.155] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.155] WaitMessage () returned 1
	[0241.157] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.157] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.157] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.158] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.158] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.158] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.158] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.158] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.158] GetKeyState (nVirtKey=1) returned 1
	[0241.158] GetKeyState (nVirtKey=2) returned 0
	[0241.158] GetKeyState (nVirtKey=4) returned 0
	[0241.158] GetKeyState (nVirtKey=5) returned 0
	[0241.158] GetKeyState (nVirtKey=6) returned 0
	[0241.158] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.158] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.158] WaitMessage () returned 1
	[0241.159] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.159] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.159] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.159] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.159] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.159] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.159] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.159] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.159] GetKeyState (nVirtKey=1) returned 1
	[0241.159] GetKeyState (nVirtKey=2) returned 0
	[0241.159] GetKeyState (nVirtKey=4) returned 0
	[0241.159] GetKeyState (nVirtKey=5) returned 0
	[0241.159] GetKeyState (nVirtKey=6) returned 0
	[0241.159] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.159] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.159] WaitMessage () returned 1
	[0241.160] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.160] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.160] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.160] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.160] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.161] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.161] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.161] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.161] GetKeyState (nVirtKey=1) returned 1
	[0241.161] GetKeyState (nVirtKey=2) returned 0
	[0241.161] GetKeyState (nVirtKey=4) returned 0
	[0241.161] GetKeyState (nVirtKey=5) returned 0
	[0241.161] GetKeyState (nVirtKey=6) returned 0
	[0241.161] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.161] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.161] WaitMessage () returned 1
	[0241.162] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.162] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.162] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.162] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.162] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.162] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.162] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.162] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.162] GetKeyState (nVirtKey=1) returned 1
	[0241.162] GetKeyState (nVirtKey=2) returned 0
	[0241.162] GetKeyState (nVirtKey=4) returned 0
	[0241.162] GetKeyState (nVirtKey=5) returned 0
	[0241.162] GetKeyState (nVirtKey=6) returned 0
	[0241.162] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.162] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.162] WaitMessage () returned 1
	[0241.163] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.163] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.163] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.163] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.163] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.163] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.164] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.164] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.164] GetKeyState (nVirtKey=1) returned 1
	[0241.164] GetKeyState (nVirtKey=2) returned 0
	[0241.164] GetKeyState (nVirtKey=4) returned 0
	[0241.164] GetKeyState (nVirtKey=5) returned 0
	[0241.164] GetKeyState (nVirtKey=6) returned 0
	[0241.164] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.164] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.164] WaitMessage () returned 1
	[0241.165] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.165] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.165] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.165] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.165] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.165] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.165] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.165] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.165] GetKeyState (nVirtKey=1) returned 1
	[0241.165] GetKeyState (nVirtKey=2) returned 0
	[0241.165] GetKeyState (nVirtKey=4) returned 0
	[0241.165] GetKeyState (nVirtKey=5) returned 0
	[0241.165] GetKeyState (nVirtKey=6) returned 0
	[0241.165] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.165] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.165] WaitMessage () returned 1
	[0241.166] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.166] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.166] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.166] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.166] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.166] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.166] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.167] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.167] GetKeyState (nVirtKey=1) returned 1
	[0241.167] GetKeyState (nVirtKey=2) returned 0
	[0241.167] GetKeyState (nVirtKey=4) returned 0
	[0241.167] GetKeyState (nVirtKey=5) returned 0
	[0241.167] GetKeyState (nVirtKey=6) returned 0
	[0241.167] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.167] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.167] WaitMessage () returned 1
	[0241.168] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.168] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.168] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.168] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.168] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.168] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.168] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.168] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.168] GetKeyState (nVirtKey=1) returned 1
	[0241.168] GetKeyState (nVirtKey=2) returned 0
	[0241.168] GetKeyState (nVirtKey=4) returned 0
	[0241.168] GetKeyState (nVirtKey=5) returned 0
	[0241.168] GetKeyState (nVirtKey=6) returned 0
	[0241.168] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.168] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.168] WaitMessage () returned 1
	[0241.169] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.169] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.169] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.169] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.169] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.169] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.169] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.169] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.169] GetKeyState (nVirtKey=1) returned 1
	[0241.169] GetKeyState (nVirtKey=2) returned 0
	[0241.169] GetKeyState (nVirtKey=4) returned 0
	[0241.169] GetKeyState (nVirtKey=5) returned 0
	[0241.169] GetKeyState (nVirtKey=6) returned 0
	[0241.169] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.169] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.169] WaitMessage () returned 1
	[0241.204] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.204] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0241.204] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.204] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.204] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.204] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.204] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.204] WaitMessage () returned 1
	[0241.214] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.214] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.214] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.214] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.214] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.214] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.214] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.214] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.214] GetKeyState (nVirtKey=1) returned 1
	[0241.214] GetKeyState (nVirtKey=2) returned 0
	[0241.214] GetKeyState (nVirtKey=4) returned 0
	[0241.214] GetKeyState (nVirtKey=5) returned 0
	[0241.214] GetKeyState (nVirtKey=6) returned 0
	[0241.214] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.214] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.214] WaitMessage () returned 1
	[0241.215] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.215] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.215] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.215] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.215] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.215] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.215] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.215] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.215] GetKeyState (nVirtKey=1) returned 1
	[0241.215] GetKeyState (nVirtKey=2) returned 0
	[0241.215] GetKeyState (nVirtKey=4) returned 0
	[0241.215] GetKeyState (nVirtKey=5) returned 0
	[0241.215] GetKeyState (nVirtKey=6) returned 0
	[0241.215] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.215] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.215] WaitMessage () returned 1
	[0241.228] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.228] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.228] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.228] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.228] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.228] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.228] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.228] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.228] GetKeyState (nVirtKey=1) returned 1
	[0241.228] GetKeyState (nVirtKey=2) returned 0
	[0241.228] GetKeyState (nVirtKey=4) returned 0
	[0241.228] GetKeyState (nVirtKey=5) returned 0
	[0241.228] GetKeyState (nVirtKey=6) returned 0
	[0241.228] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.228] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.228] WaitMessage () returned 1
	[0241.229] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.229] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.229] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.229] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.229] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.229] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.229] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.229] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.229] GetKeyState (nVirtKey=1) returned 1
	[0241.229] GetKeyState (nVirtKey=2) returned 0
	[0241.230] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.230] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.230] WaitMessage () returned 1
	[0241.501] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.501] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.501] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0241.501] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0241.501] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e702f9) returned 0x1
	[0241.501] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0241.501] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0241.501] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0241.502] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.502] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0241.502] WaitMessage () returned 1
	[0242.397] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.397] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.397] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0242.397] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.397] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.398] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0242.398] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.398] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.398] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.398] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.398] WaitMessage () returned 1
	[0242.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.437] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.437] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0242.437] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.437] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.437] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0242.437] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.437] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.437] WaitMessage () returned 1
	[0242.438] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.438] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.438] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0242.438] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.438] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.438] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0242.438] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.438] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.439] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.439] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.439] WaitMessage () returned 1
	[0242.465] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.465] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.465] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0242.465] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.465] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.465] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0242.465] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe40149) returned 0x0
	[0242.465] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0242.465] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0242.465] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x0, lParam=0x201a6) returned 0x1
	[0242.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0242.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0242.466] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0242.467] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x50120) returned 0x1
	[0242.468] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0242.468] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0242.468] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0242.468] GetFocus () returned 0x401b4
	[0242.468] SetFocus (hWnd=0x201d8) returned 0x401b4
	[0242.468] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x8, wParam=0x201d8, lParam=0x0) returned 0x0
	[0242.468] GetStockObject (i=5) returned 0x1900015
	[0242.469] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0242.469] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0242.469] GetCapture () returned 0x0
	[0242.469] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0242.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0242.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0242.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0242.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0242.470] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0242.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x401b4, lParam=0x0) returned 0x0
	[0242.470] GetStockObject (i=5) returned 0x1900015
	[0242.471] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0242.471] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0242.471] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0242.471] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0242.471] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.471] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.471] IsWindowVisible (hWnd=0x201d8) returned 1
	[0242.471] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0242.471] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0242.471] GetFocus () returned 0x201d8
	[0242.471] GetFocus () returned 0x201d8
	[0242.471] GetFocus () returned 0x201d8
	[0242.471] GetCapture () returned 0x0
	[0242.472] SetCapture (hWnd=0x201d8) returned 0x0
	[0242.472] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0242.472] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0242.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.472] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.472] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.472] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0242.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.472] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.472] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.472] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0242.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.472] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0242.472] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.472] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.472] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.472] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26a3558, cPoints=0x1 | out: lpPoints=0x26a3558) returned 30606029
	[0242.472] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0242.472] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0242.472] UpdateWindow (hWnd=0x201d8) returned 1
	[0242.472] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0242.472] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0242.473] CreateCompatibleDC (hdc=0x4010280) returned 0x26011a47
	[0242.473] SelectObject (hdc=0x26011a47, h=0x140507d2) returned 0x185000f
	[0242.473] GdipCreateFromHDC (hdc=0x26011a47, graphics=0x20cfa0) returned 0x0
	[0242.473] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0242.473] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0242.473] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0242.474] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.474] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0242.474] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0242.474] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0242.474] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.474] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0242.475] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.475] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0242.475] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0242.475] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9a60dbd) returned 0x0
	[0242.475] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.476] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0242.476] GetCurrentObject (hdc=0x26011a47, type=0x1) returned 0x1b00017
	[0242.476] GetCurrentObject (hdc=0x26011a47, type=0x2) returned 0x1900010
	[0242.476] GetCurrentObject (hdc=0x26011a47, type=0x7) returned 0x140507d2
	[0242.476] GetCurrentObject (hdc=0x26011a47, type=0x6) returned 0x18a002e
	[0242.477] SaveDC (hdc=0x26011a47) returned 1
	[0242.477] GetNearestColor (hdc=0x26011a47, color=0xf0f0f0) returned 0xf0f0f0
	[0242.477] GetNearestColor (hdc=0x26011a47, color=0xa0a0a0) returned 0xa0a0a0
	[0242.477] GetNearestColor (hdc=0x26011a47, color=0x696969) returned 0x696969
	[0242.477] GetNearestColor (hdc=0x26011a47, color=0xa0a0a0) returned 0xa0a0a0
	[0242.478] GetNearestColor (hdc=0x26011a47, color=0x0) returned 0x0
	[0242.478] GetNearestColor (hdc=0x26011a47, color=0xffffff) returned 0xffffff
	[0242.478] GetNearestColor (hdc=0x26011a47, color=0xe5e5e5) returned 0xe5e5e5
	[0242.478] GetNearestColor (hdc=0x26011a47, color=0xd8d8d8) returned 0xd8d8d8
	[0242.478] GetNearestColor (hdc=0x26011a47, color=0x0) returned 0x0
	[0242.479] RestoreDC (hdc=0x26011a47, nSavedDC=-1) returned 1
	[0242.479] GdipReleaseDC (graphics=0x1b929550, hdc=0x26011a47) returned 0x0
	[0242.479] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0242.479] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.479] CoTaskMemFree (pv=0x1b067a00) 
	[0242.479] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0242.479] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.480] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.480] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.480] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0242.480] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0242.480] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0242.480] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0242.481] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0242.481] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.481] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0242.481] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.481] CoTaskMemFree (pv=0x1b067a00) 
	[0242.481] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0242.482] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0242.482] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0242.482] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0242.482] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.490] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.490] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.490] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0242.490] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.491] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0242.491] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0242.491] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.491] CoTaskMemFree (pv=0x1b067a00) 
	[0242.491] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0242.491] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.492] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0242.492] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0242.492] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0242.492] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0242.492] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0242.492] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0242.493] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0242.493] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0242.493] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0242.493] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0242.493] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0242.493] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.494] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0242.494] GetCurrentObject (hdc=0x26011a47, type=0x1) returned 0x1b00017
	[0242.494] GetCurrentObject (hdc=0x26011a47, type=0x2) returned 0x1900010
	[0242.494] GetCurrentObject (hdc=0x26011a47, type=0x7) returned 0x140507d2
	[0242.494] GetCurrentObject (hdc=0x26011a47, type=0x6) returned 0x18a002e
	[0242.494] SaveDC (hdc=0x26011a47) returned 1
	[0242.495] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff86040710
	[0242.495] GetClipRgn (hdc=0x26011a47, hrgn=0xffffffff86040710) returned 0
	[0242.495] SelectClipRgn (hdc=0x26011a47, hrgn=0x50407f9) returned 2
	[0242.495] DeleteObject (ho=0xffffffff86040710) returned 1
	[0242.495] DeleteObject (ho=0x50407f9) returned 1
	[0242.496] OffsetViewportOrgEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x26a41d8 | out: lppt=0x26a41d8) returned 1
	[0242.496] GetNearestColor (hdc=0x26011a47, color=0xf0f0f0) returned 0xf0f0f0
	[0242.496] CreateSolidBrush (color=0xf0f0f0) returned 0x7b1007c0
	[0242.496] FillRect (hDC=0x26011a47, lprc=0x20c990, hbr=0x7b1007c0) returned 1
	[0242.496] DeleteObject (ho=0x7b1007c0) returned 1
	[0242.497] RestoreDC (hdc=0x26011a47, nSavedDC=-1) returned 1
	[0242.497] GdipReleaseDC (graphics=0x1b929550, hdc=0x26011a47) returned 0x0
	[0242.497] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0242.497] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.498] CoTaskMemFree (pv=0x1b067a00) 
	[0242.498] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0242.499] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.499] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.499] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.499] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0242.499] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0242.500] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0242.500] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.500] GetFocus () returned 0x201d8
	[0242.500] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0242.500] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0242.501] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.501] CoTaskMemFree (pv=0x1b067a00) 
	[0242.501] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0242.501] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0242.501] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0242.502] GdipCreateRegion (region=0x20c830) returned 0x0
	[0242.502] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.502] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0242.502] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.502] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0242.503] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0242.503] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0242.503] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0242.503] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0242.503] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.503] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0242.504] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0242.504] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0242.504] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.504] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0242.504] GetCurrentObject (hdc=0x26011a47, type=0x1) returned 0x1b00017
	[0242.504] GetCurrentObject (hdc=0x26011a47, type=0x2) returned 0x1900010
	[0242.505] GetCurrentObject (hdc=0x26011a47, type=0x7) returned 0x140507d2
	[0242.505] GetCurrentObject (hdc=0x26011a47, type=0x6) returned 0x18a002e
	[0242.505] SaveDC (hdc=0x26011a47) returned 1
	[0242.505] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x60407f9
	[0242.505] GetClipRgn (hdc=0x26011a47, hrgn=0x60407f9) returned 0
	[0242.505] SelectClipRgn (hdc=0x26011a47, hrgn=0xffffffff87040710) returned 2
	[0242.506] DeleteObject (ho=0x60407f9) returned 1
	[0242.506] DeleteObject (ho=0xffffffff87040710) returned 1
	[0242.506] OffsetViewportOrgEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x26a4778 | out: lppt=0x26a4778) returned 1
	[0242.506] GetROP2 (hdc=0x26011a47) returned 13
	[0242.506] GetBkMode (hdc=0x26011a47) returned 2
	[0242.506] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.507] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x60301a41
	[0242.507] SelectObject (hdc=0x26011a47, h=0x60301a41) returned 0x1b00017
	[0242.507] MoveToEx (in: hdc=0x26011a47, x=164, y=1, lppt=0x26a47e0 | out: lppt=0x26a47e0) returned 1
	[0242.507] LineTo (hdc=0x26011a47, x=1, y=1) returned 1
	[0242.507] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.507] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.508] GetROP2 (hdc=0x26011a47) returned 13
	[0242.508] GetBkMode (hdc=0x26011a47) returned 2
	[0242.508] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.508] SelectObject (hdc=0x26011a47, h=0x60301a41) returned 0x60301a41
	[0242.508] MoveToEx (in: hdc=0x26011a47, x=1, y=1, lppt=0x26a47f8 | out: lppt=0x26a47f8) returned 1
	[0242.508] LineTo (hdc=0x26011a47, x=1, y=41) returned 1
	[0242.509] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.509] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.509] SelectObject (hdc=0x26011a47, h=0x1b00017) returned 0x60301a41
	[0242.509] DeleteObject (ho=0x60301a41) returned 1
	[0242.509] GetROP2 (hdc=0x26011a47) returned 13
	[0242.509] GetBkMode (hdc=0x26011a47) returned 2
	[0242.510] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.510] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x46301a3b
	[0242.510] SelectObject (hdc=0x26011a47, h=0x46301a3b) returned 0x1b00017
	[0242.510] MoveToEx (in: hdc=0x26011a47, x=1, y=41, lppt=0x26a4860 | out: lppt=0x26a4860) returned 1
	[0242.510] LineTo (hdc=0x26011a47, x=164, y=41) returned 1
	[0242.510] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.511] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.511] GetROP2 (hdc=0x26011a47) returned 13
	[0242.511] GetBkMode (hdc=0x26011a47) returned 2
	[0242.511] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.511] SelectObject (hdc=0x26011a47, h=0x46301a3b) returned 0x46301a3b
	[0242.512] MoveToEx (in: hdc=0x26011a47, x=164, y=41, lppt=0x26a4878 | out: lppt=0x26a4878) returned 1
	[0242.512] LineTo (hdc=0x26011a47, x=164, y=0) returned 1
	[0242.512] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.512] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.512] SelectObject (hdc=0x26011a47, h=0x1b00017) returned 0x46301a3b
	[0242.512] DeleteObject (ho=0x46301a3b) returned 1
	[0242.513] GetROP2 (hdc=0x26011a47) returned 13
	[0242.513] GetBkMode (hdc=0x26011a47) returned 2
	[0242.513] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.513] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x61301a41
	[0242.513] SelectObject (hdc=0x26011a47, h=0x61301a41) returned 0x1b00017
	[0242.513] MoveToEx (in: hdc=0x26011a47, x=163, y=2, lppt=0x26a48e0 | out: lppt=0x26a48e0) returned 1
	[0242.514] LineTo (hdc=0x26011a47, x=2, y=2) returned 1
	[0242.514] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.514] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.514] GetROP2 (hdc=0x26011a47) returned 13
	[0242.514] GetBkMode (hdc=0x26011a47) returned 2
	[0242.514] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.514] SelectObject (hdc=0x26011a47, h=0x61301a41) returned 0x61301a41
	[0242.515] MoveToEx (in: hdc=0x26011a47, x=2, y=2, lppt=0x26a48f8 | out: lppt=0x26a48f8) returned 1
	[0242.515] LineTo (hdc=0x26011a47, x=2, y=40) returned 1
	[0242.515] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.515] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.515] SelectObject (hdc=0x26011a47, h=0x1b00017) returned 0x61301a41
	[0242.515] DeleteObject (ho=0x61301a41) returned 1
	[0242.516] GetROP2 (hdc=0x26011a47) returned 13
	[0242.516] GetBkMode (hdc=0x26011a47) returned 2
	[0242.516] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.516] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x47301a3b
	[0242.516] SelectObject (hdc=0x26011a47, h=0x47301a3b) returned 0x1b00017
	[0242.516] MoveToEx (in: hdc=0x26011a47, x=2, y=40, lppt=0x26a4960 | out: lppt=0x26a4960) returned 1
	[0242.517] LineTo (hdc=0x26011a47, x=163, y=40) returned 1
	[0242.517] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.517] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.517] GetROP2 (hdc=0x26011a47) returned 13
	[0242.517] GetBkMode (hdc=0x26011a47) returned 2
	[0242.517] SetBkMode (hdc=0x26011a47, mode=1) returned 2
	[0242.518] SelectObject (hdc=0x26011a47, h=0x47301a3b) returned 0x47301a3b
	[0242.518] MoveToEx (in: hdc=0x26011a47, x=163, y=40, lppt=0x26a4978 | out: lppt=0x26a4978) returned 1
	[0242.518] LineTo (hdc=0x26011a47, x=163, y=1) returned 1
	[0242.518] SetBkMode (hdc=0x26011a47, mode=2) returned 1
	[0242.518] MoveToEx (in: hdc=0x26011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.518] SelectObject (hdc=0x26011a47, h=0x1b00017) returned 0x47301a3b
	[0242.519] DeleteObject (ho=0x47301a3b) returned 1
	[0242.519] RestoreDC (hdc=0x26011a47, nSavedDC=-1) returned 1
	[0242.519] GdipReleaseDC (graphics=0x1b929550, hdc=0x26011a47) returned 0x0
	[0242.519] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0242.519] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x26011a47, x1=0, y1=0, rop=0xcc0020) returned 1
	[0242.520] GdipReleaseDC (graphics=0x1b929550, hdc=0x26011a47) returned 0x0
	[0242.520] SelectObject (hdc=0x26011a47, h=0x185000f) returned 0x140507d2
	[0242.520] DeleteDC (hdc=0x26011a47) returned 1
	[0242.520] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0242.520] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0242.520] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0242.521] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26a49d0, cPoints=0x1 | out: lpPoints=0x26a49d0) returned 30606029
	[0242.521] WindowFromPoint (Point=0x1eb0000033a) returned 0x201d8
	[0242.521] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.521] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0242.521] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0242.521] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0242.521] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26a4ac0, Length=0x70 | out: Destination=0x1afe53a0) 
	[0242.521] ShellExecuteExW (in: pExecInfo=0x26a4cd0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26a4cd0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0242.564] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0242.565] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0242.565] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0242.565] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0242.565] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0242.565] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0242.566] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0242.566] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0242.566] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0242.566] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0242.566] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0242.566] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0242.566] GetStockObject (i=5) returned 0x1900015
	[0242.567] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0242.567] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0242.567] GetCapture () returned 0x0
	[0242.567] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0242.567] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0242.567] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0242.567] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x48010f97
	[0242.567] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0242.568] CreateCompatibleDC (hdc=0x48010f97) returned 0x2d011a47
	[0242.568] SelectObject (hdc=0x2d011a47, h=0x140507d2) returned 0x185000f
	[0242.568] GdipCreateFromHDC (hdc=0x2d011a47, graphics=0x20c9d0) returned 0x0
	[0242.568] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0242.568] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0242.569] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0242.569] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0242.569] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0242.569] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0242.569] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.569] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0242.570] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0242.570] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.570] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0242.570] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0242.570] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9a30dbd) returned 0x0
	[0242.570] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.571] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0242.571] GetCurrentObject (hdc=0x2d011a47, type=0x1) returned 0x1b00017
	[0242.571] GetCurrentObject (hdc=0x2d011a47, type=0x2) returned 0x1900010
	[0242.571] GetCurrentObject (hdc=0x2d011a47, type=0x7) returned 0x140507d2
	[0242.571] GetCurrentObject (hdc=0x2d011a47, type=0x6) returned 0x18a002e
	[0242.572] SaveDC (hdc=0x2d011a47) returned 1
	[0242.572] GetNearestColor (hdc=0x2d011a47, color=0xf0f0f0) returned 0xf0f0f0
	[0242.572] GetNearestColor (hdc=0x2d011a47, color=0xa0a0a0) returned 0xa0a0a0
	[0242.572] GetNearestColor (hdc=0x2d011a47, color=0x696969) returned 0x696969
	[0242.572] GetNearestColor (hdc=0x2d011a47, color=0xa0a0a0) returned 0xa0a0a0
	[0242.573] GetNearestColor (hdc=0x2d011a47, color=0x0) returned 0x0
	[0242.573] GetNearestColor (hdc=0x2d011a47, color=0xffffff) returned 0xffffff
	[0242.573] GetNearestColor (hdc=0x2d011a47, color=0xe5e5e5) returned 0xe5e5e5
	[0242.573] GetNearestColor (hdc=0x2d011a47, color=0xd8d8d8) returned 0xd8d8d8
	[0242.574] GetNearestColor (hdc=0x2d011a47, color=0x0) returned 0x0
	[0242.574] RestoreDC (hdc=0x2d011a47, nSavedDC=-1) returned 1
	[0242.574] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d011a47) returned 0x0
	[0242.574] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.575] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.575] CoTaskMemFree (pv=0x1b077150) 
	[0242.575] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0242.575] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.575] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.575] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.575] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0242.575] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0242.576] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0242.576] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0242.576] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0242.576] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.577] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.577] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.577] CoTaskMemFree (pv=0x1b077150) 
	[0242.577] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0242.577] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0242.577] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0242.578] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0242.578] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.578] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.578] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.578] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0242.579] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.579] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0242.579] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.579] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.579] CoTaskMemFree (pv=0x1b077150) 
	[0242.579] GdipCreateRegion (region=0x20c310) returned 0x0
	[0242.579] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.580] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0242.580] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.580] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0242.580] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0242.580] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.581] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0242.581] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.581] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.581] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0242.581] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0242.581] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0242.582] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.582] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0242.582] GetCurrentObject (hdc=0x2d011a47, type=0x1) returned 0x1b00017
	[0242.582] GetCurrentObject (hdc=0x2d011a47, type=0x2) returned 0x1900010
	[0242.582] GetCurrentObject (hdc=0x2d011a47, type=0x7) returned 0x140507d2
	[0242.583] GetCurrentObject (hdc=0x2d011a47, type=0x6) returned 0x18a002e
	[0242.583] SaveDC (hdc=0x2d011a47) returned 1
	[0242.583] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff88040710
	[0242.583] GetClipRgn (hdc=0x2d011a47, hrgn=0xffffffff88040710) returned 0
	[0242.583] SelectClipRgn (hdc=0x2d011a47, hrgn=0x90407f9) returned 2
	[0242.584] DeleteObject (ho=0xffffffff88040710) returned 1
	[0242.584] DeleteObject (ho=0x90407f9) returned 1
	[0242.584] OffsetViewportOrgEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x26a59b0 | out: lppt=0x26a59b0) returned 1
	[0242.584] GetNearestColor (hdc=0x2d011a47, color=0xf0f0f0) returned 0xf0f0f0
	[0242.584] CreateSolidBrush (color=0xf0f0f0) returned 0x7c1007c0
	[0242.585] FillRect (hDC=0x2d011a47, lprc=0x20c3c0, hbr=0x7c1007c0) returned 1
	[0242.585] DeleteObject (ho=0x7c1007c0) returned 1
	[0242.585] RestoreDC (hdc=0x2d011a47, nSavedDC=-1) returned 1
	[0242.585] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d011a47) returned 0x0
	[0242.585] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.585] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.585] CoTaskMemFree (pv=0x1b077150) 
	[0242.585] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0242.586] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.586] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.586] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.586] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0242.586] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0242.586] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0242.587] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.587] GetFocus () returned 0x0
	[0242.587] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0242.587] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.587] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.587] CoTaskMemFree (pv=0x1b077150) 
	[0242.587] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0242.587] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0242.588] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0242.588] GdipCreateRegion (region=0x20c260) returned 0x0
	[0242.588] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.588] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0242.588] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0242.588] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0242.589] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0242.589] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.589] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0242.589] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.589] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0242.589] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0242.590] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0242.590] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0242.590] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.590] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0242.590] GetCurrentObject (hdc=0x2d011a47, type=0x1) returned 0x1b00017
	[0242.590] GetCurrentObject (hdc=0x2d011a47, type=0x2) returned 0x1900010
	[0242.591] GetCurrentObject (hdc=0x2d011a47, type=0x7) returned 0x140507d2
	[0242.591] GetCurrentObject (hdc=0x2d011a47, type=0x6) returned 0x18a002e
	[0242.591] SaveDC (hdc=0x2d011a47) returned 1
	[0242.591] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa0407f9
	[0242.593] GetClipRgn (hdc=0x2d011a47, hrgn=0xa0407f9) returned 0
	[0242.595] SelectClipRgn (hdc=0x2d011a47, hrgn=0xffffffff89040710) returned 2
	[0242.595] DeleteObject (ho=0xa0407f9) returned 1
	[0242.596] DeleteObject (ho=0xffffffff89040710) returned 1
	[0242.596] OffsetViewportOrgEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x26a5f50 | out: lppt=0x26a5f50) returned 1
	[0242.596] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.596] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.596] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.596] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x48301a3b
	[0242.597] SelectObject (hdc=0x2d011a47, h=0x48301a3b) returned 0x1b00017
	[0242.597] MoveToEx (in: hdc=0x2d011a47, x=164, y=1, lppt=0x26a5fb8 | out: lppt=0x26a5fb8) returned 1
	[0242.597] LineTo (hdc=0x2d011a47, x=1, y=1) returned 1
	[0242.597] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.597] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.597] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.598] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.598] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.598] SelectObject (hdc=0x2d011a47, h=0x48301a3b) returned 0x48301a3b
	[0242.598] MoveToEx (in: hdc=0x2d011a47, x=1, y=1, lppt=0x26a5fd0 | out: lppt=0x26a5fd0) returned 1
	[0242.598] LineTo (hdc=0x2d011a47, x=1, y=41) returned 1
	[0242.599] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.599] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.599] SelectObject (hdc=0x2d011a47, h=0x1b00017) returned 0x48301a3b
	[0242.599] DeleteObject (ho=0x48301a3b) returned 1
	[0242.599] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.599] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.600] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.600] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x62301a41
	[0242.600] SelectObject (hdc=0x2d011a47, h=0x62301a41) returned 0x1b00017
	[0242.600] MoveToEx (in: hdc=0x2d011a47, x=1, y=41, lppt=0x26a6038 | out: lppt=0x26a6038) returned 1
	[0242.600] LineTo (hdc=0x2d011a47, x=164, y=41) returned 1
	[0242.601] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.601] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.601] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.601] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.601] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.601] SelectObject (hdc=0x2d011a47, h=0x62301a41) returned 0x62301a41
	[0242.601] MoveToEx (in: hdc=0x2d011a47, x=164, y=41, lppt=0x26a6050 | out: lppt=0x26a6050) returned 1
	[0242.602] LineTo (hdc=0x2d011a47, x=164, y=0) returned 1
	[0242.602] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.602] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.602] SelectObject (hdc=0x2d011a47, h=0x1b00017) returned 0x62301a41
	[0242.602] DeleteObject (ho=0x62301a41) returned 1
	[0242.602] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.603] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.603] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.603] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x49301a3b
	[0242.603] SelectObject (hdc=0x2d011a47, h=0x49301a3b) returned 0x1b00017
	[0242.603] MoveToEx (in: hdc=0x2d011a47, x=163, y=2, lppt=0x26a60b8 | out: lppt=0x26a60b8) returned 1
	[0242.603] LineTo (hdc=0x2d011a47, x=2, y=2) returned 1
	[0242.604] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.604] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.604] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.604] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.604] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.604] SelectObject (hdc=0x2d011a47, h=0x49301a3b) returned 0x49301a3b
	[0242.604] MoveToEx (in: hdc=0x2d011a47, x=2, y=2, lppt=0x26a60d0 | out: lppt=0x26a60d0) returned 1
	[0242.605] LineTo (hdc=0x2d011a47, x=2, y=40) returned 1
	[0242.605] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.605] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.605] SelectObject (hdc=0x2d011a47, h=0x1b00017) returned 0x49301a3b
	[0242.605] DeleteObject (ho=0x49301a3b) returned 1
	[0242.605] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.606] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.606] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.606] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x63301a41
	[0242.606] SelectObject (hdc=0x2d011a47, h=0x63301a41) returned 0x1b00017
	[0242.606] MoveToEx (in: hdc=0x2d011a47, x=2, y=40, lppt=0x26a6138 | out: lppt=0x26a6138) returned 1
	[0242.607] LineTo (hdc=0x2d011a47, x=163, y=40) returned 1
	[0242.607] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.607] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.607] GetROP2 (hdc=0x2d011a47) returned 13
	[0242.607] GetBkMode (hdc=0x2d011a47) returned 2
	[0242.607] SetBkMode (hdc=0x2d011a47, mode=1) returned 2
	[0242.608] SelectObject (hdc=0x2d011a47, h=0x63301a41) returned 0x63301a41
	[0242.608] MoveToEx (in: hdc=0x2d011a47, x=163, y=40, lppt=0x26a6150 | out: lppt=0x26a6150) returned 1
	[0242.608] LineTo (hdc=0x2d011a47, x=163, y=1) returned 1
	[0242.608] SetBkMode (hdc=0x2d011a47, mode=2) returned 1
	[0242.608] MoveToEx (in: hdc=0x2d011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.608] SelectObject (hdc=0x2d011a47, h=0x1b00017) returned 0x63301a41
	[0242.609] DeleteObject (ho=0x63301a41) returned 1
	[0242.609] RestoreDC (hdc=0x2d011a47, nSavedDC=-1) returned 1
	[0242.609] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d011a47) returned 0x0
	[0242.609] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0242.609] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0x2d011a47, x1=0, y1=0, rop=0xcc0020) returned 1
	[0242.610] GdipReleaseDC (graphics=0x1b929550, hdc=0x2d011a47) returned 0x0
	[0242.610] SelectObject (hdc=0x2d011a47, h=0x185000f) returned 0x140507d2
	[0242.610] DeleteDC (hdc=0x2d011a47) returned 1
	[0242.610] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0242.610] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0242.610] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0242.611] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.611] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0242.611] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x10107f8
	[0242.611] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0242.611] CreateCompatibleDC (hdc=0x10107f8) returned 0x2f011a47
	[0242.611] SelectObject (hdc=0x2f011a47, h=0x140507d2) returned 0x185000f
	[0242.612] GdipCreateFromHDC (hdc=0x2f011a47, graphics=0x20c9d0) returned 0x0
	[0242.612] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0242.612] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0242.612] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0242.612] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.612] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0242.612] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0242.613] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.613] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.613] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0242.613] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.613] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0242.614] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0242.614] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9a00dbd) returned 0x0
	[0242.614] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.614] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0242.615] GetCurrentObject (hdc=0x2f011a47, type=0x1) returned 0x1b00017
	[0242.615] GetCurrentObject (hdc=0x2f011a47, type=0x2) returned 0x1900010
	[0242.615] GetCurrentObject (hdc=0x2f011a47, type=0x7) returned 0x140507d2
	[0242.615] GetCurrentObject (hdc=0x2f011a47, type=0x6) returned 0x18a002e
	[0242.615] SaveDC (hdc=0x2f011a47) returned 1
	[0242.615] GetNearestColor (hdc=0x2f011a47, color=0xf0f0f0) returned 0xf0f0f0
	[0242.616] GetNearestColor (hdc=0x2f011a47, color=0xa0a0a0) returned 0xa0a0a0
	[0242.616] GetNearestColor (hdc=0x2f011a47, color=0x696969) returned 0x696969
	[0242.616] GetNearestColor (hdc=0x2f011a47, color=0xa0a0a0) returned 0xa0a0a0
	[0242.616] GetNearestColor (hdc=0x2f011a47, color=0x0) returned 0x0
	[0242.616] GetNearestColor (hdc=0x2f011a47, color=0xffffff) returned 0xffffff
	[0242.617] GetNearestColor (hdc=0x2f011a47, color=0xe5e5e5) returned 0xe5e5e5
	[0242.617] GetNearestColor (hdc=0x2f011a47, color=0xd8d8d8) returned 0xd8d8d8
	[0242.617] GetNearestColor (hdc=0x2f011a47, color=0x0) returned 0x0
	[0242.617] RestoreDC (hdc=0x2f011a47, nSavedDC=-1) returned 1
	[0242.618] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011a47) returned 0x0
	[0242.618] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.618] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.618] CoTaskMemFree (pv=0x1b077150) 
	[0242.618] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0242.618] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.618] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.619] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.619] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0242.619] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0242.619] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0242.619] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0242.619] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0242.619] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.620] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.620] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.620] CoTaskMemFree (pv=0x1b077150) 
	[0242.620] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0242.620] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0242.620] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0242.621] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0242.621] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.621] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.621] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.621] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0242.621] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.622] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0242.622] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.622] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.622] CoTaskMemFree (pv=0x1b077150) 
	[0242.622] GdipCreateRegion (region=0x20c310) returned 0x0
	[0242.622] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.623] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0242.623] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0242.623] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0242.623] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0242.624] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.624] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0242.624] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.624] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0242.624] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0242.624] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0242.625] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0242.625] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.625] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0242.625] GetCurrentObject (hdc=0x2f011a47, type=0x1) returned 0x1b00017
	[0242.625] GetCurrentObject (hdc=0x2f011a47, type=0x2) returned 0x1900010
	[0242.625] GetCurrentObject (hdc=0x2f011a47, type=0x7) returned 0x140507d2
	[0242.626] GetCurrentObject (hdc=0x2f011a47, type=0x6) returned 0x18a002e
	[0242.626] SaveDC (hdc=0x2f011a47) returned 1
	[0242.626] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8a040710
	[0242.626] GetClipRgn (hdc=0x2f011a47, hrgn=0xffffffff8a040710) returned 0
	[0242.626] SelectClipRgn (hdc=0x2f011a47, hrgn=0xb0407f9) returned 2
	[0242.626] DeleteObject (ho=0xffffffff8a040710) returned 1
	[0242.627] DeleteObject (ho=0xb0407f9) returned 1
	[0242.627] OffsetViewportOrgEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x26a6dd8 | out: lppt=0x26a6dd8) returned 1
	[0242.627] GetNearestColor (hdc=0x2f011a47, color=0xf0f0f0) returned 0xf0f0f0
	[0242.627] CreateSolidBrush (color=0xf0f0f0) returned 0x7d1007c0
	[0242.628] FillRect (hDC=0x2f011a47, lprc=0x20c3c0, hbr=0x7d1007c0) returned 1
	[0242.628] DeleteObject (ho=0x7d1007c0) returned 1
	[0242.628] RestoreDC (hdc=0x2f011a47, nSavedDC=-1) returned 1
	[0242.628] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011a47) returned 0x0
	[0242.628] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.629] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.629] CoTaskMemFree (pv=0x1b077150) 
	[0242.629] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0242.629] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.629] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.629] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.629] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0242.629] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0242.630] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0242.630] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.630] GetFocus () returned 0x0
	[0242.630] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0242.630] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0242.631] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.631] CoTaskMemFree (pv=0x1b077150) 
	[0242.631] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0242.631] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0242.631] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0242.631] GdipCreateRegion (region=0x20c260) returned 0x0
	[0242.631] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.632] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0242.632] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.632] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0242.632] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0242.632] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.632] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0242.633] LocalFree (hMem=0x1b07c740) returned 0x0
	[0242.633] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.633] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0242.633] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0242.633] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0242.633] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.634] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0242.634] GetCurrentObject (hdc=0x2f011a47, type=0x1) returned 0x1b00017
	[0242.634] GetCurrentObject (hdc=0x2f011a47, type=0x2) returned 0x1900010
	[0242.634] GetCurrentObject (hdc=0x2f011a47, type=0x7) returned 0x140507d2
	[0242.634] GetCurrentObject (hdc=0x2f011a47, type=0x6) returned 0x18a002e
	[0242.634] SaveDC (hdc=0x2f011a47) returned 1
	[0242.635] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0407f9
	[0242.635] GetClipRgn (hdc=0x2f011a47, hrgn=0xc0407f9) returned 0
	[0242.635] SelectClipRgn (hdc=0x2f011a47, hrgn=0xffffffff8b040710) returned 2
	[0242.635] DeleteObject (ho=0xc0407f9) returned 1
	[0242.635] DeleteObject (ho=0xffffffff8b040710) returned 1
	[0242.635] OffsetViewportOrgEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x26a7378 | out: lppt=0x26a7378) returned 1
	[0242.636] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.636] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.636] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.636] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x64301a41
	[0242.636] SelectObject (hdc=0x2f011a47, h=0x64301a41) returned 0x1b00017
	[0242.636] MoveToEx (in: hdc=0x2f011a47, x=126, y=1, lppt=0x26a73e0 | out: lppt=0x26a73e0) returned 1
	[0242.637] LineTo (hdc=0x2f011a47, x=1, y=1) returned 1
	[0242.637] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.637] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.637] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.637] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.637] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.638] SelectObject (hdc=0x2f011a47, h=0x64301a41) returned 0x64301a41
	[0242.638] MoveToEx (in: hdc=0x2f011a47, x=1, y=1, lppt=0x26a73f8 | out: lppt=0x26a73f8) returned 1
	[0242.638] LineTo (hdc=0x2f011a47, x=1, y=39) returned 1
	[0242.779] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.779] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.779] SelectObject (hdc=0x2f011a47, h=0x1b00017) returned 0x64301a41
	[0242.780] DeleteObject (ho=0x64301a41) returned 1
	[0242.780] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.780] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.780] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.780] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xd301a4e
	[0242.780] SelectObject (hdc=0x2f011a47, h=0xd301a4e) returned 0x1b00017
	[0242.781] MoveToEx (in: hdc=0x2f011a47, x=1, y=39, lppt=0x26a7460 | out: lppt=0x26a7460) returned 1
	[0242.781] LineTo (hdc=0x2f011a47, x=126, y=39) returned 1
	[0242.781] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.781] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.781] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.781] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.782] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.782] SelectObject (hdc=0x2f011a47, h=0xd301a4e) returned 0xd301a4e
	[0242.782] MoveToEx (in: hdc=0x2f011a47, x=126, y=39, lppt=0x26a7478 | out: lppt=0x26a7478) returned 1
	[0242.782] LineTo (hdc=0x2f011a47, x=126, y=0) returned 1
	[0242.782] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.782] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.783] SelectObject (hdc=0x2f011a47, h=0x1b00017) returned 0xd301a4e
	[0242.783] DeleteObject (ho=0xd301a4e) returned 1
	[0242.783] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.783] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.783] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.783] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x65301a41
	[0242.784] SelectObject (hdc=0x2f011a47, h=0x65301a41) returned 0x1b00017
	[0242.784] MoveToEx (in: hdc=0x2f011a47, x=125, y=2, lppt=0x26a74e0 | out: lppt=0x26a74e0) returned 1
	[0242.784] LineTo (hdc=0x2f011a47, x=2, y=2) returned 1
	[0242.784] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.784] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.784] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.785] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.785] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.785] SelectObject (hdc=0x2f011a47, h=0x65301a41) returned 0x65301a41
	[0242.785] MoveToEx (in: hdc=0x2f011a47, x=2, y=2, lppt=0x26a74f8 | out: lppt=0x26a74f8) returned 1
	[0242.785] LineTo (hdc=0x2f011a47, x=2, y=38) returned 1
	[0242.785] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.786] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.786] SelectObject (hdc=0x2f011a47, h=0x1b00017) returned 0x65301a41
	[0242.786] DeleteObject (ho=0x65301a41) returned 1
	[0242.786] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.786] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.786] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.787] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xe301a4e
	[0242.787] SelectObject (hdc=0x2f011a47, h=0xe301a4e) returned 0x1b00017
	[0242.787] MoveToEx (in: hdc=0x2f011a47, x=2, y=38, lppt=0x26a7560 | out: lppt=0x26a7560) returned 1
	[0242.787] LineTo (hdc=0x2f011a47, x=125, y=38) returned 1
	[0242.787] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.787] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.788] GetROP2 (hdc=0x2f011a47) returned 13
	[0242.788] GetBkMode (hdc=0x2f011a47) returned 2
	[0242.788] SetBkMode (hdc=0x2f011a47, mode=1) returned 2
	[0242.788] SelectObject (hdc=0x2f011a47, h=0xe301a4e) returned 0xe301a4e
	[0242.788] MoveToEx (in: hdc=0x2f011a47, x=125, y=38, lppt=0x26a7578 | out: lppt=0x26a7578) returned 1
	[0242.788] LineTo (hdc=0x2f011a47, x=125, y=1) returned 1
	[0242.788] SetBkMode (hdc=0x2f011a47, mode=2) returned 1
	[0242.789] MoveToEx (in: hdc=0x2f011a47, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.789] SelectObject (hdc=0x2f011a47, h=0x1b00017) returned 0xe301a4e
	[0242.789] DeleteObject (ho=0xe301a4e) returned 1
	[0242.789] RestoreDC (hdc=0x2f011a47, nSavedDC=-1) returned 1
	[0242.789] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011a47) returned 0x0
	[0242.789] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0242.790] BitBlt (hdc=0x10107f8, x=0, y=0, cx=128, cy=41, hdcSrc=0x2f011a47, x1=0, y1=0, rop=0xcc0020) returned 1
	[0242.790] GdipReleaseDC (graphics=0x1b929550, hdc=0x2f011a47) returned 0x0
	[0242.790] SelectObject (hdc=0x2f011a47, h=0x185000f) returned 0x140507d2
	[0242.790] DeleteDC (hdc=0x2f011a47) returned 1
	[0242.790] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0242.791] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0242.791] EndPaint (hWnd=0x401b4, lpPaint=0x20cbd8) returned 1
	[0242.791] GetCapture () returned 0x0
	[0242.791] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.791] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.791] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0242.791] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.791] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1eb033a) returned 0x1
	[0242.791] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0242.791] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.791] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.792] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.792] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0242.792] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.792] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.792] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.792] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.792] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.792] WaitMessage () returned 1
	[0242.872] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.872] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0242.872] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.872] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.872] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.872] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.872] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.872] WaitMessage () returned 1
	[0242.912] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.912] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0242.912] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0242.912] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.913] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.913] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.913] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0242.913] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0242.913] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.913] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0242.913] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0242.913] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.913] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0242.913] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0242.913] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.913] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.913] _TrackMouseEvent (in: lpEventTrack=0x263be70 | out: lpEventTrack=0x263be70) returned 1
	[0242.913] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0242.913] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0242.913] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0242.914] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.914] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0242.914] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.914] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.914] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0242.914] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0242.914] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0242.914] CreateCompatibleDC (hdc=0x70107fc) returned 0x6011a57
	[0242.914] SelectObject (hdc=0x6011a57, h=0x140507d2) returned 0x185000f
	[0242.915] GdipCreateFromHDC (hdc=0x6011a57, graphics=0x20d7e0) returned 0x0
	[0242.915] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0242.915] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0242.915] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0242.915] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0242.915] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0242.916] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0242.916] LocalFree (hMem=0x1b07c780) returned 0x0
	[0242.916] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0242.916] GdipCreateRegion (region=0x20d910) returned 0x0
	[0242.916] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.916] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0242.917] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0242.917] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff99d0dbd) returned 0x0
	[0242.917] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.917] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0242.918] GetCurrentObject (hdc=0x6011a57, type=0x1) returned 0x1b00017
	[0242.918] GetCurrentObject (hdc=0x6011a57, type=0x2) returned 0x1900010
	[0242.918] GetCurrentObject (hdc=0x6011a57, type=0x7) returned 0x140507d2
	[0242.918] GetCurrentObject (hdc=0x6011a57, type=0x6) returned 0x18a002e
	[0242.918] SaveDC (hdc=0x6011a57) returned 1
	[0242.918] GetNearestColor (hdc=0x6011a57, color=0xf0f0f0) returned 0xf0f0f0
	[0242.919] GetNearestColor (hdc=0x6011a57, color=0xa0a0a0) returned 0xa0a0a0
	[0242.919] GetNearestColor (hdc=0x6011a57, color=0x696969) returned 0x696969
	[0242.919] GetNearestColor (hdc=0x6011a57, color=0xa0a0a0) returned 0xa0a0a0
	[0242.919] GetNearestColor (hdc=0x6011a57, color=0x0) returned 0x0
	[0242.919] GetNearestColor (hdc=0x6011a57, color=0xffffff) returned 0xffffff
	[0242.920] GetNearestColor (hdc=0x6011a57, color=0xe5e5e5) returned 0xe5e5e5
	[0242.920] GetNearestColor (hdc=0x6011a57, color=0xd8d8d8) returned 0xd8d8d8
	[0242.920] GetNearestColor (hdc=0x6011a57, color=0x0) returned 0x0
	[0242.920] RestoreDC (hdc=0x6011a57, nSavedDC=-1) returned 1
	[0242.920] GdipReleaseDC (graphics=0x1b929550, hdc=0x6011a57) returned 0x0
	[0242.921] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.921] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.921] CoTaskMemFree (pv=0x1b067a60) 
	[0242.921] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0242.921] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.921] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.921] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.922] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0242.922] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0242.922] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0242.922] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0242.922] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0242.922] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.923] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.923] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.923] CoTaskMemFree (pv=0x1b067a60) 
	[0242.923] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0242.923] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0242.923] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0242.924] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0242.924] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.924] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.924] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.924] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0242.925] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.925] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0242.925] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.925] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.925] CoTaskMemFree (pv=0x1b067a60) 
	[0242.925] GdipCreateRegion (region=0x20d120) returned 0x0
	[0242.925] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.926] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0242.926] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.926] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0242.926] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0242.926] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0242.927] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.927] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0242.927] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0242.927] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0242.927] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.927] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0242.928] GetCurrentObject (hdc=0x6011a57, type=0x1) returned 0x1b00017
	[0242.928] GetCurrentObject (hdc=0x6011a57, type=0x2) returned 0x1900010
	[0242.928] GetCurrentObject (hdc=0x6011a57, type=0x7) returned 0x140507d2
	[0242.928] GetCurrentObject (hdc=0x6011a57, type=0x6) returned 0x18a002e
	[0242.928] SaveDC (hdc=0x6011a57) returned 1
	[0242.928] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8c040710
	[0242.929] GetClipRgn (hdc=0x6011a57, hrgn=0xffffffff8c040710) returned 0
	[0242.929] SelectClipRgn (hdc=0x6011a57, hrgn=0xd0407f9) returned 2
	[0242.929] DeleteObject (ho=0xffffffff8c040710) returned 1
	[0242.929] DeleteObject (ho=0xd0407f9) returned 1
	[0242.929] OffsetViewportOrgEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x26a8308 | out: lppt=0x26a8308) returned 1
	[0242.929] GetNearestColor (hdc=0x6011a57, color=0xf0f0f0) returned 0xf0f0f0
	[0242.930] CreateSolidBrush (color=0xf0f0f0) returned 0x7e1007c0
	[0242.930] FillRect (hDC=0x6011a57, lprc=0x20d1d0, hbr=0x7e1007c0) returned 1
	[0242.930] DeleteObject (ho=0x7e1007c0) returned 1
	[0242.930] RestoreDC (hdc=0x6011a57, nSavedDC=-1) returned 1
	[0242.930] GdipReleaseDC (graphics=0x1b929550, hdc=0x6011a57) returned 0x0
	[0242.931] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.931] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.931] CoTaskMemFree (pv=0x1b067a60) 
	[0242.931] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0242.931] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.931] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.931] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.932] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0242.932] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0242.932] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0242.932] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.932] GetFocus () returned 0x0
	[0242.932] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0242.932] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.933] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.933] CoTaskMemFree (pv=0x1b067a60) 
	[0242.933] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0242.933] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0242.933] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0242.933] GdipCreateRegion (region=0x20d070) returned 0x0
	[0242.933] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.934] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0242.934] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0242.934] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0242.934] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0242.934] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0242.934] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0242.935] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0242.935] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0242.935] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0242.935] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.935] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0242.935] GetCurrentObject (hdc=0x6011a57, type=0x1) returned 0x1b00017
	[0242.936] GetCurrentObject (hdc=0x6011a57, type=0x2) returned 0x1900010
	[0242.936] GetCurrentObject (hdc=0x6011a57, type=0x7) returned 0x140507d2
	[0242.936] GetCurrentObject (hdc=0x6011a57, type=0x6) returned 0x18a002e
	[0242.936] SaveDC (hdc=0x6011a57) returned 1
	[0242.936] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe0407f9
	[0242.936] GetClipRgn (hdc=0x6011a57, hrgn=0xe0407f9) returned 0
	[0242.937] SelectClipRgn (hdc=0x6011a57, hrgn=0xffffffff8d040710) returned 2
	[0242.937] DeleteObject (ho=0xe0407f9) returned 1
	[0242.937] DeleteObject (ho=0xffffffff8d040710) returned 1
	[0242.937] OffsetViewportOrgEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x26a88a8 | out: lppt=0x26a88a8) returned 1
	[0242.937] GetROP2 (hdc=0x6011a57) returned 13
	[0242.938] GetBkMode (hdc=0x6011a57) returned 2
	[0242.938] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.938] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x6301a54
	[0242.938] SelectObject (hdc=0x6011a57, h=0x6301a54) returned 0x1b00017
	[0242.938] MoveToEx (in: hdc=0x6011a57, x=164, y=1, lppt=0x26a8910 | out: lppt=0x26a8910) returned 1
	[0242.938] LineTo (hdc=0x6011a57, x=1, y=1) returned 1
	[0242.938] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.939] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.939] GetROP2 (hdc=0x6011a57) returned 13
	[0242.939] GetBkMode (hdc=0x6011a57) returned 2
	[0242.939] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.939] SelectObject (hdc=0x6011a57, h=0x6301a54) returned 0x6301a54
	[0242.939] MoveToEx (in: hdc=0x6011a57, x=1, y=1, lppt=0x26a8928 | out: lppt=0x26a8928) returned 1
	[0242.940] LineTo (hdc=0x6011a57, x=1, y=41) returned 1
	[0242.940] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.940] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.940] SelectObject (hdc=0x6011a57, h=0x1b00017) returned 0x6301a54
	[0242.940] DeleteObject (ho=0x6301a54) returned 1
	[0242.940] GetROP2 (hdc=0x6011a57) returned 13
	[0242.941] GetBkMode (hdc=0x6011a57) returned 2
	[0242.941] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.941] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1301a59
	[0242.941] SelectObject (hdc=0x6011a57, h=0x1301a59) returned 0x1b00017
	[0242.941] MoveToEx (in: hdc=0x6011a57, x=1, y=41, lppt=0x26a8990 | out: lppt=0x26a8990) returned 1
	[0242.941] LineTo (hdc=0x6011a57, x=164, y=41) returned 1
	[0242.941] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.942] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.942] GetROP2 (hdc=0x6011a57) returned 13
	[0242.942] GetBkMode (hdc=0x6011a57) returned 2
	[0242.942] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.942] SelectObject (hdc=0x6011a57, h=0x1301a59) returned 0x1301a59
	[0242.942] MoveToEx (in: hdc=0x6011a57, x=164, y=41, lppt=0x26a89a8 | out: lppt=0x26a89a8) returned 1
	[0242.943] LineTo (hdc=0x6011a57, x=164, y=0) returned 1
	[0242.943] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.943] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.943] SelectObject (hdc=0x6011a57, h=0x1b00017) returned 0x1301a59
	[0242.943] DeleteObject (ho=0x1301a59) returned 1
	[0242.943] GetROP2 (hdc=0x6011a57) returned 13
	[0242.944] GetBkMode (hdc=0x6011a57) returned 2
	[0242.944] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.944] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x7301a54
	[0242.944] SelectObject (hdc=0x6011a57, h=0x7301a54) returned 0x1b00017
	[0242.944] MoveToEx (in: hdc=0x6011a57, x=163, y=2, lppt=0x26a8a10 | out: lppt=0x26a8a10) returned 1
	[0242.944] LineTo (hdc=0x6011a57, x=2, y=2) returned 1
	[0242.945] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.945] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.945] GetROP2 (hdc=0x6011a57) returned 13
	[0242.945] GetBkMode (hdc=0x6011a57) returned 2
	[0242.945] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.945] SelectObject (hdc=0x6011a57, h=0x7301a54) returned 0x7301a54
	[0242.945] MoveToEx (in: hdc=0x6011a57, x=2, y=2, lppt=0x26a8a28 | out: lppt=0x26a8a28) returned 1
	[0242.946] LineTo (hdc=0x6011a57, x=2, y=40) returned 1
	[0242.946] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.946] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.946] SelectObject (hdc=0x6011a57, h=0x1b00017) returned 0x7301a54
	[0242.946] DeleteObject (ho=0x7301a54) returned 1
	[0242.946] GetROP2 (hdc=0x6011a57) returned 13
	[0242.947] GetBkMode (hdc=0x6011a57) returned 2
	[0242.947] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.947] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2301a59
	[0242.947] SelectObject (hdc=0x6011a57, h=0x2301a59) returned 0x1b00017
	[0242.947] MoveToEx (in: hdc=0x6011a57, x=2, y=40, lppt=0x26a8a90 | out: lppt=0x26a8a90) returned 1
	[0242.947] LineTo (hdc=0x6011a57, x=163, y=40) returned 1
	[0242.948] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.948] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.948] GetROP2 (hdc=0x6011a57) returned 13
	[0242.948] GetBkMode (hdc=0x6011a57) returned 2
	[0242.948] SetBkMode (hdc=0x6011a57, mode=1) returned 2
	[0242.948] SelectObject (hdc=0x6011a57, h=0x2301a59) returned 0x2301a59
	[0242.949] MoveToEx (in: hdc=0x6011a57, x=163, y=40, lppt=0x26a8aa8 | out: lppt=0x26a8aa8) returned 1
	[0242.949] LineTo (hdc=0x6011a57, x=163, y=1) returned 1
	[0242.949] SetBkMode (hdc=0x6011a57, mode=2) returned 1
	[0242.949] MoveToEx (in: hdc=0x6011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.949] SelectObject (hdc=0x6011a57, h=0x1b00017) returned 0x2301a59
	[0242.950] DeleteObject (ho=0x2301a59) returned 1
	[0242.950] RestoreDC (hdc=0x6011a57, nSavedDC=-1) returned 1
	[0242.950] GdipReleaseDC (graphics=0x1b929550, hdc=0x6011a57) returned 0x0
	[0242.951] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0242.951] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x6011a57, x1=0, y1=0, rop=0xcc0020) returned 1
	[0242.951] GdipReleaseDC (graphics=0x1b929550, hdc=0x6011a57) returned 0x0
	[0242.952] SelectObject (hdc=0x6011a57, h=0x185000f) returned 0x140507d2
	[0242.952] DeleteDC (hdc=0x6011a57) returned 1
	[0242.952] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0242.952] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0242.952] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0242.952] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.953] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0242.953] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0242.953] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0242.953] DispatchMessageW (lpMsg=0x20e6b0) returned 0x18a002e
	[0242.953] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0242.953] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0242.953] CreateCompatibleDC (hdc=0x4010280) returned 0x8011a57
	[0242.953] SelectObject (hdc=0x8011a57, h=0x140507d2) returned 0x185000f
	[0242.954] GdipCreateFromHDC (hdc=0x8011a57, graphics=0x20d7e0) returned 0x0
	[0242.954] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0242.954] GdipSetClipRectI (graphics=0x1b929550, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0242.954] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0242.954] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.954] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0242.955] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0242.955] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.955] GdipCreateRegion (region=0x20d910) returned 0x0
	[0242.955] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.955] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0242.955] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0242.956] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff99a0dbd) returned 0x0
	[0242.956] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.956] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0242.956] GetCurrentObject (hdc=0x8011a57, type=0x1) returned 0x1b00017
	[0242.956] GetCurrentObject (hdc=0x8011a57, type=0x2) returned 0x1900010
	[0242.956] GetCurrentObject (hdc=0x8011a57, type=0x7) returned 0x140507d2
	[0242.957] GetCurrentObject (hdc=0x8011a57, type=0x6) returned 0x18a002e
	[0242.957] SaveDC (hdc=0x8011a57) returned 1
	[0242.957] GetNearestColor (hdc=0x8011a57, color=0xf0f0f0) returned 0xf0f0f0
	[0242.957] GetNearestColor (hdc=0x8011a57, color=0xa0a0a0) returned 0xa0a0a0
	[0242.957] GetNearestColor (hdc=0x8011a57, color=0x696969) returned 0x696969
	[0242.957] GetNearestColor (hdc=0x8011a57, color=0xa0a0a0) returned 0xa0a0a0
	[0242.958] GetNearestColor (hdc=0x8011a57, color=0x0) returned 0x0
	[0242.958] GetNearestColor (hdc=0x8011a57, color=0xffffff) returned 0xffffff
	[0242.958] GetNearestColor (hdc=0x8011a57, color=0xe5e5e5) returned 0xe5e5e5
	[0242.958] GetNearestColor (hdc=0x8011a57, color=0xd8d8d8) returned 0xd8d8d8
	[0242.958] GetNearestColor (hdc=0x8011a57, color=0x0) returned 0x0
	[0242.959] RestoreDC (hdc=0x8011a57, nSavedDC=-1) returned 1
	[0242.959] GdipReleaseDC (graphics=0x1b929550, hdc=0x8011a57) returned 0x0
	[0242.959] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.959] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.959] CoTaskMemFree (pv=0x1b067a60) 
	[0242.959] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0242.959] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.960] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.960] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.960] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0242.960] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0242.960] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0242.960] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0242.961] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0242.961] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.961] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.961] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.961] CoTaskMemFree (pv=0x1b067a60) 
	[0242.961] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0242.961] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0242.961] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0242.962] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0242.962] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.962] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.962] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.962] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0242.962] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.963] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0242.963] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.963] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.963] CoTaskMemFree (pv=0x1b067a60) 
	[0242.963] GdipCreateRegion (region=0x20d120) returned 0x0
	[0242.963] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.963] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0242.964] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0242.964] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0242.964] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0242.964] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0242.964] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0242.964] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0242.965] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0242.965] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0242.965] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.965] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0242.965] GetCurrentObject (hdc=0x8011a57, type=0x1) returned 0x1b00017
	[0242.965] GetCurrentObject (hdc=0x8011a57, type=0x2) returned 0x1900010
	[0242.965] GetCurrentObject (hdc=0x8011a57, type=0x7) returned 0x140507d2
	[0242.966] GetCurrentObject (hdc=0x8011a57, type=0x6) returned 0x18a002e
	[0242.966] SaveDC (hdc=0x8011a57) returned 1
	[0242.966] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8e040710
	[0242.966] GetClipRgn (hdc=0x8011a57, hrgn=0xffffffff8e040710) returned 0
	[0242.967] SelectClipRgn (hdc=0x8011a57, hrgn=0xf0407f9) returned 2
	[0242.967] DeleteObject (ho=0xffffffff8e040710) returned 1
	[0242.967] DeleteObject (ho=0xf0407f9) returned 1
	[0242.967] OffsetViewportOrgEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x26a9708 | out: lppt=0x26a9708) returned 1
	[0242.967] GetNearestColor (hdc=0x8011a57, color=0xf0f0f0) returned 0xf0f0f0
	[0242.967] CreateSolidBrush (color=0xf0f0f0) returned 0x7f1007c0
	[0242.968] FillRect (hDC=0x8011a57, lprc=0x20d1d0, hbr=0x7f1007c0) returned 1
	[0242.968] DeleteObject (ho=0x7f1007c0) returned 1
	[0242.968] RestoreDC (hdc=0x8011a57, nSavedDC=-1) returned 1
	[0242.968] GdipReleaseDC (graphics=0x1b929550, hdc=0x8011a57) returned 0x0
	[0242.968] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.968] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.968] CoTaskMemFree (pv=0x1b067a60) 
	[0242.968] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0242.969] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.969] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0242.969] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0242.969] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0242.969] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0242.969] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0242.970] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0242.970] GetFocus () returned 0x0
	[0242.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0242.970] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0242.970] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0242.970] CoTaskMemFree (pv=0x1b067a60) 
	[0242.970] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0242.970] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0242.971] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0242.971] GdipCreateRegion (region=0x20d070) returned 0x0
	[0242.971] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0242.971] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0242.971] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0242.971] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0242.972] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0242.972] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0242.972] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0242.972] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0242.972] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0242.972] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0242.972] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0242.973] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0242.973] GetCurrentObject (hdc=0x8011a57, type=0x1) returned 0x1b00017
	[0242.973] GetCurrentObject (hdc=0x8011a57, type=0x2) returned 0x1900010
	[0242.973] GetCurrentObject (hdc=0x8011a57, type=0x7) returned 0x140507d2
	[0242.973] GetCurrentObject (hdc=0x8011a57, type=0x6) returned 0x18a002e
	[0242.973] SaveDC (hdc=0x8011a57) returned 1
	[0242.974] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x100407f9
	[0242.974] GetClipRgn (hdc=0x8011a57, hrgn=0x100407f9) returned 0
	[0242.974] SelectClipRgn (hdc=0x8011a57, hrgn=0xffffffff8f040710) returned 2
	[0242.974] DeleteObject (ho=0x100407f9) returned 1
	[0242.974] DeleteObject (ho=0xffffffff8f040710) returned 1
	[0242.975] OffsetViewportOrgEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x26a9ca8 | out: lppt=0x26a9ca8) returned 1
	[0242.975] GetROP2 (hdc=0x8011a57) returned 13
	[0242.975] GetBkMode (hdc=0x8011a57) returned 2
	[0242.975] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.975] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3301a59
	[0242.975] SelectObject (hdc=0x8011a57, h=0x3301a59) returned 0x1b00017
	[0242.975] MoveToEx (in: hdc=0x8011a57, x=126, y=1, lppt=0x26a9d10 | out: lppt=0x26a9d10) returned 1
	[0242.976] LineTo (hdc=0x8011a57, x=1, y=1) returned 1
	[0242.976] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.976] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.976] GetROP2 (hdc=0x8011a57) returned 13
	[0242.976] GetBkMode (hdc=0x8011a57) returned 2
	[0242.976] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.977] SelectObject (hdc=0x8011a57, h=0x3301a59) returned 0x3301a59
	[0242.977] MoveToEx (in: hdc=0x8011a57, x=1, y=1, lppt=0x26a9d28 | out: lppt=0x26a9d28) returned 1
	[0242.977] LineTo (hdc=0x8011a57, x=1, y=39) returned 1
	[0242.977] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.977] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.977] SelectObject (hdc=0x8011a57, h=0x1b00017) returned 0x3301a59
	[0242.978] DeleteObject (ho=0x3301a59) returned 1
	[0242.978] GetROP2 (hdc=0x8011a57) returned 13
	[0242.978] GetBkMode (hdc=0x8011a57) returned 2
	[0242.978] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.978] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x8301a54
	[0242.978] SelectObject (hdc=0x8011a57, h=0x8301a54) returned 0x1b00017
	[0242.978] MoveToEx (in: hdc=0x8011a57, x=1, y=39, lppt=0x26a9d90 | out: lppt=0x26a9d90) returned 1
	[0242.979] LineTo (hdc=0x8011a57, x=126, y=39) returned 1
	[0242.979] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.979] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.979] GetROP2 (hdc=0x8011a57) returned 13
	[0242.979] GetBkMode (hdc=0x8011a57) returned 2
	[0242.979] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.980] SelectObject (hdc=0x8011a57, h=0x8301a54) returned 0x8301a54
	[0242.980] MoveToEx (in: hdc=0x8011a57, x=126, y=39, lppt=0x26a9da8 | out: lppt=0x26a9da8) returned 1
	[0242.980] LineTo (hdc=0x8011a57, x=126, y=0) returned 1
	[0242.980] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.980] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.980] SelectObject (hdc=0x8011a57, h=0x1b00017) returned 0x8301a54
	[0242.981] DeleteObject (ho=0x8301a54) returned 1
	[0242.981] GetROP2 (hdc=0x8011a57) returned 13
	[0242.981] GetBkMode (hdc=0x8011a57) returned 2
	[0242.981] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.981] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4301a59
	[0242.982] SelectObject (hdc=0x8011a57, h=0x4301a59) returned 0x1b00017
	[0242.982] MoveToEx (in: hdc=0x8011a57, x=125, y=2, lppt=0x26a9e10 | out: lppt=0x26a9e10) returned 1
	[0242.982] LineTo (hdc=0x8011a57, x=2, y=2) returned 1
	[0242.982] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.983] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.983] GetROP2 (hdc=0x8011a57) returned 13
	[0242.983] GetBkMode (hdc=0x8011a57) returned 2
	[0242.983] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.983] SelectObject (hdc=0x8011a57, h=0x4301a59) returned 0x4301a59
	[0242.983] MoveToEx (in: hdc=0x8011a57, x=2, y=2, lppt=0x26a9e28 | out: lppt=0x26a9e28) returned 1
	[0242.984] LineTo (hdc=0x8011a57, x=2, y=38) returned 1
	[0242.984] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.984] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.984] SelectObject (hdc=0x8011a57, h=0x1b00017) returned 0x4301a59
	[0242.984] DeleteObject (ho=0x4301a59) returned 1
	[0242.984] GetROP2 (hdc=0x8011a57) returned 13
	[0242.985] GetBkMode (hdc=0x8011a57) returned 2
	[0242.985] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.985] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x9301a54
	[0242.985] SelectObject (hdc=0x8011a57, h=0x9301a54) returned 0x1b00017
	[0242.985] MoveToEx (in: hdc=0x8011a57, x=2, y=38, lppt=0x26a9e90 | out: lppt=0x26a9e90) returned 1
	[0242.985] LineTo (hdc=0x8011a57, x=125, y=38) returned 1
	[0242.985] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.986] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.986] GetROP2 (hdc=0x8011a57) returned 13
	[0242.986] GetBkMode (hdc=0x8011a57) returned 2
	[0242.986] SetBkMode (hdc=0x8011a57, mode=1) returned 2
	[0242.986] SelectObject (hdc=0x8011a57, h=0x9301a54) returned 0x9301a54
	[0242.986] MoveToEx (in: hdc=0x8011a57, x=125, y=38, lppt=0x26a9ea8 | out: lppt=0x26a9ea8) returned 1
	[0242.987] LineTo (hdc=0x8011a57, x=125, y=1) returned 1
	[0242.987] SetBkMode (hdc=0x8011a57, mode=2) returned 1
	[0242.987] MoveToEx (in: hdc=0x8011a57, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0242.987] SelectObject (hdc=0x8011a57, h=0x1b00017) returned 0x9301a54
	[0242.987] DeleteObject (ho=0x9301a54) returned 1
	[0242.987] RestoreDC (hdc=0x8011a57, nSavedDC=-1) returned 1
	[0242.988] GdipReleaseDC (graphics=0x1b929550, hdc=0x8011a57) returned 0x0
	[0242.988] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0242.988] BitBlt (hdc=0x4010280, x=0, y=0, cx=128, cy=41, hdcSrc=0x8011a57, x1=0, y1=0, rop=0xcc0020) returned 1
	[0242.988] GdipReleaseDC (graphics=0x1b929550, hdc=0x8011a57) returned 0x0
	[0242.988] SelectObject (hdc=0x8011a57, h=0x185000f) returned 0x140507d2
	[0242.988] DeleteDC (hdc=0x8011a57) returned 1
	[0242.989] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0242.989] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0242.989] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0242.989] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.989] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0242.989] WaitMessage () returned 1
	[0243.069] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.069] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.069] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.069] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.069] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.069] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.069] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.069] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.069] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.069] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.069] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a1, wParam=0x0, lParam=0x1c0047) returned 0x0
	[0243.069] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.069] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.069] WaitMessage () returned 1
	[0243.195] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.195] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.207] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.207] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.207] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.207] GetDlgItem (hDlg=0x50120, nIDDlgItem=0) returned 0x0
	[0243.207] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x210, wParam=0x201, lParam=0x1af0053) returned 0x0
	[0243.207] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0243.207] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0243.208] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e510) returned 0x0
	[0243.208] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x46, wParam=0x0, lParam=0x20e510) returned 0x0
	[0243.208] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0243.208] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0243.208] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0243.208] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0243.209] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df90 | out: lpwndpl=0x20df90) returned 1
	[0243.209] GetClientRect (in: hWnd=0x50120, lpRect=0x20de40 | out: lpRect=0x20de40) returned 1
	[0243.210] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0243.210] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0243.210] GetSystemMetrics (nIndex=42) returned 0
	[0243.210] CoTaskMemAlloc (cb=0x26) returned 0x1b065c20
	[0243.210] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b065c20, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0243.210] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b065c20) returned 0x10
	[0243.210] CoTaskMemFree (pv=0x1b065c20) 
	[0243.210] GetClientRect (in: hWnd=0x50120, lpRect=0x20dbe0 | out: lpRect=0x20dbe0) returned 1
	[0243.210] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0243.211] GdipCreateFromHDC (hdc=0x10107f8, graphics=0x20d7b0) returned 0x0
	[0243.211] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0243.211] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0243.211] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0243.211] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d700) returned 0x0
	[0243.212] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0243.212] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0243.212] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0243.212] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6d0) returned 0x0
	[0243.212] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0243.212] GdipSaveGraphics (graphics=0x1b929550, state=0x20d7a0) returned 0x0
	[0243.213] GdipCreateRegion (region=0x20d670) returned 0x0
	[0243.213] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0243.213] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0243.213] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0243.213] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d6d0) returned 0x0
	[0243.213] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0243.214] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0243.214] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d720) returned 0x0
	[0243.214] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0243.214] GdipGetDC (graphics=0x1b929550, hdc=0x20d750) returned 0x0
	[0243.214] GetCurrentObject (hdc=0x10107f8, type=0x1) returned 0x1b00017
	[0243.214] GetCurrentObject (hdc=0x10107f8, type=0x2) returned 0x1900010
	[0243.215] GetCurrentObject (hdc=0x10107f8, type=0x7) returned 0x1050032
	[0243.215] GetCurrentObject (hdc=0x10107f8, type=0x6) returned 0x18a002e
	[0243.215] SaveDC (hdc=0x10107f8) returned 1
	[0243.215] OffsetViewportOrgEx (in: hdc=0x10107f8, x=0, y=0, lppt=0x26aa410 | out: lppt=0x26aa410) returned 1
	[0243.216] GetNearestColor (hdc=0x10107f8, color=0xf0f0f0) returned 0xf0f0f0
	[0243.216] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff801007c0
	[0243.216] FillRect (hDC=0x10107f8, lprc=0x20d720, hbr=0xffffffff801007c0) returned 1
	[0243.216] DeleteObject (ho=0xffffffff801007c0) returned 1
	[0243.216] RestoreDC (hdc=0x10107f8, nSavedDC=-1) returned 1
	[0243.216] GdipReleaseDC (graphics=0x1b929550, hdc=0x10107f8) returned 0x0
	[0243.217] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0243.217] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0243.217] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x2041a5a, lParam=0x0) returned 0x0
	[0243.217] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x3041a5a, lParam=0x0) returned 0x0
	[0243.218] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x10107f8, lParam=0x0) returned 0x1
	[0243.218] GetStockObject (i=5) returned 0x1900015
	[0243.218] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0x4041a5a, lParam=0x0) returned 0x0
	[0243.218] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df70 | out: lpwndpl=0x20df70) returned 1
	[0243.218] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e510) returned 0x0
	[0243.219] GetClientRect (in: hWnd=0x50120, lpRect=0x20dd10 | out: lpRect=0x20dd10) returned 1
	[0243.219] GetWindowRect (in: hWnd=0x50120, lpRect=0x20dd10 | out: lpRect=0x20dd10) returned 1
	[0243.219] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0243.219] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0243.219] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0243.219] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x47, wParam=0x0, lParam=0x20e510) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b1352d0) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0243.220] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0243.220] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0243.221] GetFocus () returned 0x0
	[0243.221] SetFocus (hWnd=0x401b4) returned 0x0
	[0243.221] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0243.221] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0243.221] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0243.221] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0243.221] GetStockObject (i=5) returned 0x1900015
	[0243.222] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1e0) returned 0x0
	[0243.222] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1e0) returned 0x0
	[0243.222] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0243.222] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.222] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.222] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.223] IsWindowVisible (hWnd=0x401b4) returned 1
	[0243.223] IsWindowEnabled (hWnd=0x401b4) returned 1
	[0243.223] SetFocus (hWnd=0x401b4) returned 0x401b4
	[0243.223] GetFocus () returned 0x401b4
	[0243.223] GetFocus () returned 0x401b4
	[0243.223] GetFocus () returned 0x401b4
	[0243.223] GetCapture () returned 0x0
	[0243.223] SetCapture (hWnd=0x401b4) returned 0x0
	[0243.223] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0243.223] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0243.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.223] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.223] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.223] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0243.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.223] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.223] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.223] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0243.223] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.223] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.223] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.223] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.223] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.223] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x26aa558, cPoints=0x1 | out: lpPoints=0x26aa558) returned 40370579
	[0243.223] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0243.223] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0243.223] UpdateWindow (hWnd=0x401b4) returned 1
	[0243.224] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0243.224] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0243.224] CreateCompatibleDC (hdc=0x48010f97) returned 0xe011a58
	[0243.224] SelectObject (hdc=0xe011a58, h=0x140507d2) returned 0x185000f
	[0243.224] GdipCreateFromHDC (hdc=0xe011a58, graphics=0x20cfa0) returned 0x0
	[0243.224] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0243.225] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0243.225] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0243.225] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0243.225] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0243.225] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0243.225] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0243.225] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0243.226] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0243.226] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0243.226] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0243.226] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9950dbd) returned 0x0
	[0243.226] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0243.227] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0243.227] GetCurrentObject (hdc=0xe011a58, type=0x1) returned 0x1b00017
	[0243.227] GetCurrentObject (hdc=0xe011a58, type=0x2) returned 0x1900010
	[0243.227] GetCurrentObject (hdc=0xe011a58, type=0x7) returned 0x140507d2
	[0243.227] GetCurrentObject (hdc=0xe011a58, type=0x6) returned 0x18a002e
	[0243.227] SaveDC (hdc=0xe011a58) returned 1
	[0243.228] GetNearestColor (hdc=0xe011a58, color=0xf0f0f0) returned 0xf0f0f0
	[0243.228] GetNearestColor (hdc=0xe011a58, color=0xa0a0a0) returned 0xa0a0a0
	[0243.228] GetNearestColor (hdc=0xe011a58, color=0x696969) returned 0x696969
	[0243.228] GetNearestColor (hdc=0xe011a58, color=0xa0a0a0) returned 0xa0a0a0
	[0243.228] GetNearestColor (hdc=0xe011a58, color=0x0) returned 0x0
	[0243.228] GetNearestColor (hdc=0xe011a58, color=0xffffff) returned 0xffffff
	[0243.229] GetNearestColor (hdc=0xe011a58, color=0xe5e5e5) returned 0xe5e5e5
	[0243.229] GetNearestColor (hdc=0xe011a58, color=0xd8d8d8) returned 0xd8d8d8
	[0243.229] GetNearestColor (hdc=0xe011a58, color=0x0) returned 0x0
	[0243.229] RestoreDC (hdc=0xe011a58, nSavedDC=-1) returned 1
	[0243.229] GdipReleaseDC (graphics=0x1b929550, hdc=0xe011a58) returned 0x0
	[0243.230] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0243.230] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0243.230] CoTaskMemFree (pv=0x1b067a40) 
	[0243.230] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0243.230] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0243.230] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0243.230] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0243.231] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0243.231] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0243.231] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0243.231] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0243.232] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0243.232] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0243.232] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0243.232] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0243.232] CoTaskMemFree (pv=0x1b067a40) 
	[0243.232] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0243.232] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0243.233] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0243.233] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0243.233] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0243.233] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0243.233] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0243.233] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0243.234] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0243.234] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0243.234] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0243.234] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0243.234] CoTaskMemFree (pv=0x1b067a40) 
	[0243.234] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0243.235] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0243.235] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0243.235] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0243.235] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0243.235] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0243.236] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0243.236] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0243.236] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0243.236] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0243.236] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0243.236] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0243.236] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0243.237] GetCurrentObject (hdc=0xe011a58, type=0x1) returned 0x1b00017
	[0243.237] GetCurrentObject (hdc=0xe011a58, type=0x2) returned 0x1900010
	[0243.237] GetCurrentObject (hdc=0xe011a58, type=0x7) returned 0x140507d2
	[0243.237] GetCurrentObject (hdc=0xe011a58, type=0x6) returned 0x18a002e
	[0243.237] SaveDC (hdc=0xe011a58) returned 1
	[0243.238] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff90040710
	[0243.238] GetClipRgn (hdc=0xe011a58, hrgn=0xffffffff90040710) returned 0
	[0243.238] SelectClipRgn (hdc=0xe011a58, hrgn=0x160407f9) returned 2
	[0243.238] DeleteObject (ho=0xffffffff90040710) returned 1
	[0243.238] DeleteObject (ho=0x160407f9) returned 1
	[0243.238] OffsetViewportOrgEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x26ab1d8 | out: lppt=0x26ab1d8) returned 1
	[0243.239] GetNearestColor (hdc=0xe011a58, color=0xf0f0f0) returned 0xf0f0f0
	[0243.239] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff811007c0
	[0243.239] FillRect (hDC=0xe011a58, lprc=0x20c990, hbr=0xffffffff811007c0) returned 1
	[0243.239] DeleteObject (ho=0xffffffff811007c0) returned 1
	[0243.239] RestoreDC (hdc=0xe011a58, nSavedDC=-1) returned 1
	[0243.239] GdipReleaseDC (graphics=0x1b929550, hdc=0xe011a58) returned 0x0
	[0243.240] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0243.240] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0243.240] CoTaskMemFree (pv=0x1b067a40) 
	[0243.240] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0243.240] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0243.240] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0243.240] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0243.241] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0243.241] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0243.241] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0243.241] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0243.241] GetFocus () returned 0x401b4
	[0243.241] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0243.241] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0243.242] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0243.242] CoTaskMemFree (pv=0x1b067a40) 
	[0243.242] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0243.242] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0243.242] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0243.242] GdipCreateRegion (region=0x20c830) returned 0x0
	[0243.242] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0243.243] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0243.243] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0243.243] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0243.243] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0243.243] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0243.243] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0243.244] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0243.244] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0243.244] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0243.244] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0243.244] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0243.244] GetCurrentObject (hdc=0xe011a58, type=0x1) returned 0x1b00017
	[0243.244] GetCurrentObject (hdc=0xe011a58, type=0x2) returned 0x1900010
	[0243.245] GetCurrentObject (hdc=0xe011a58, type=0x7) returned 0x140507d2
	[0243.245] GetCurrentObject (hdc=0xe011a58, type=0x6) returned 0x18a002e
	[0243.245] SaveDC (hdc=0xe011a58) returned 1
	[0243.245] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x170407f9
	[0243.245] GetClipRgn (hdc=0xe011a58, hrgn=0x170407f9) returned 0
	[0243.246] SelectClipRgn (hdc=0xe011a58, hrgn=0xffffffff91040710) returned 2
	[0243.246] DeleteObject (ho=0x170407f9) returned 1
	[0243.246] DeleteObject (ho=0xffffffff91040710) returned 1
	[0243.246] OffsetViewportOrgEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x26ab778 | out: lppt=0x26ab778) returned 1
	[0243.246] GetROP2 (hdc=0xe011a58) returned 13
	[0243.246] GetBkMode (hdc=0xe011a58) returned 2
	[0243.252] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.252] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1b301a59
	[0243.252] SelectObject (hdc=0xe011a58, h=0x1b301a59) returned 0x1b00017
	[0243.252] MoveToEx (in: hdc=0xe011a58, x=126, y=1, lppt=0x26ab7e0 | out: lppt=0x26ab7e0) returned 1
	[0243.253] LineTo (hdc=0xe011a58, x=1, y=1) returned 1
	[0243.253] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.253] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.253] GetROP2 (hdc=0xe011a58) returned 13
	[0243.253] GetBkMode (hdc=0xe011a58) returned 2
	[0243.253] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.254] SelectObject (hdc=0xe011a58, h=0x1b301a59) returned 0x1b301a59
	[0243.254] MoveToEx (in: hdc=0xe011a58, x=1, y=1, lppt=0x26ab7f8 | out: lppt=0x26ab7f8) returned 1
	[0243.254] LineTo (hdc=0xe011a58, x=1, y=39) returned 1
	[0243.254] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.254] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.254] SelectObject (hdc=0xe011a58, h=0x1b00017) returned 0x1b301a59
	[0243.255] DeleteObject (ho=0x1b301a59) returned 1
	[0243.255] GetROP2 (hdc=0xe011a58) returned 13
	[0243.255] GetBkMode (hdc=0xe011a58) returned 2
	[0243.255] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.255] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x12301a5b
	[0243.255] SelectObject (hdc=0xe011a58, h=0x12301a5b) returned 0x1b00017
	[0243.256] MoveToEx (in: hdc=0xe011a58, x=1, y=39, lppt=0x26ab860 | out: lppt=0x26ab860) returned 1
	[0243.256] LineTo (hdc=0xe011a58, x=126, y=39) returned 1
	[0243.256] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.256] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.256] GetROP2 (hdc=0xe011a58) returned 13
	[0243.256] GetBkMode (hdc=0xe011a58) returned 2
	[0243.256] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.257] SelectObject (hdc=0xe011a58, h=0x12301a5b) returned 0x12301a5b
	[0243.257] MoveToEx (in: hdc=0xe011a58, x=126, y=39, lppt=0x26ab878 | out: lppt=0x26ab878) returned 1
	[0243.257] LineTo (hdc=0xe011a58, x=126, y=0) returned 1
	[0243.257] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.257] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.257] SelectObject (hdc=0xe011a58, h=0x1b00017) returned 0x12301a5b
	[0243.258] DeleteObject (ho=0x12301a5b) returned 1
	[0243.258] GetROP2 (hdc=0xe011a58) returned 13
	[0243.258] GetBkMode (hdc=0xe011a58) returned 2
	[0243.258] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.258] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x1c301a59
	[0243.258] SelectObject (hdc=0xe011a58, h=0x1c301a59) returned 0x1b00017
	[0243.259] MoveToEx (in: hdc=0xe011a58, x=125, y=2, lppt=0x26ab8e0 | out: lppt=0x26ab8e0) returned 1
	[0243.259] LineTo (hdc=0xe011a58, x=2, y=2) returned 1
	[0243.259] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.259] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.259] GetROP2 (hdc=0xe011a58) returned 13
	[0243.259] GetBkMode (hdc=0xe011a58) returned 2
	[0243.260] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.260] SelectObject (hdc=0xe011a58, h=0x1c301a59) returned 0x1c301a59
	[0243.260] MoveToEx (in: hdc=0xe011a58, x=2, y=2, lppt=0x26ab8f8 | out: lppt=0x26ab8f8) returned 1
	[0243.260] LineTo (hdc=0xe011a58, x=2, y=38) returned 1
	[0243.260] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.260] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.261] SelectObject (hdc=0xe011a58, h=0x1b00017) returned 0x1c301a59
	[0243.261] DeleteObject (ho=0x1c301a59) returned 1
	[0243.261] GetROP2 (hdc=0xe011a58) returned 13
	[0243.261] GetBkMode (hdc=0xe011a58) returned 2
	[0243.261] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.261] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x13301a5b
	[0243.262] SelectObject (hdc=0xe011a58, h=0x13301a5b) returned 0x1b00017
	[0243.262] MoveToEx (in: hdc=0xe011a58, x=2, y=38, lppt=0x26ab960 | out: lppt=0x26ab960) returned 1
	[0243.262] LineTo (hdc=0xe011a58, x=125, y=38) returned 1
	[0243.262] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.262] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.263] GetROP2 (hdc=0xe011a58) returned 13
	[0243.263] GetBkMode (hdc=0xe011a58) returned 2
	[0243.263] SetBkMode (hdc=0xe011a58, mode=1) returned 2
	[0243.263] SelectObject (hdc=0xe011a58, h=0x13301a5b) returned 0x13301a5b
	[0243.263] MoveToEx (in: hdc=0xe011a58, x=125, y=38, lppt=0x26ab978 | out: lppt=0x26ab978) returned 1
	[0243.263] LineTo (hdc=0xe011a58, x=125, y=1) returned 1
	[0243.263] SetBkMode (hdc=0xe011a58, mode=2) returned 1
	[0243.264] MoveToEx (in: hdc=0xe011a58, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0243.264] SelectObject (hdc=0xe011a58, h=0x1b00017) returned 0x13301a5b
	[0243.264] DeleteObject (ho=0x13301a5b) returned 1
	[0243.264] RestoreDC (hdc=0xe011a58, nSavedDC=-1) returned 1
	[0243.264] GdipReleaseDC (graphics=0x1b929550, hdc=0xe011a58) returned 0x0
	[0243.264] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0243.265] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0xe011a58, x1=0, y1=0, rop=0xcc0020) returned 1
	[0243.265] GdipReleaseDC (graphics=0x1b929550, hdc=0xe011a58) returned 0x0
	[0243.265] SelectObject (hdc=0xe011a58, h=0x185000f) returned 0x140507d2
	[0243.265] DeleteDC (hdc=0xe011a58) returned 1
	[0243.265] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0243.266] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0243.266] EndPaint (hWnd=0x401b4, lpPaint=0x20d1a8) returned 1
	[0243.266] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x26ab9d0, cPoints=0x1 | out: lpPoints=0x26ab9d0) returned 40370579
	[0243.266] WindowFromPoint (Point=0x284000001da) returned 0x401b4
	[0243.266] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.266] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0243.266] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0243.266] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0243.266] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0243.266] GetCapture () returned 0x401b4
	[0243.266] ReleaseCapture () returned 1
	[0243.266] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0243.266] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.266] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.267] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.267] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.267] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.267] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.267] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.267] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.267] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.267] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0243.267] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.267] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.267] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.267] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0243.267] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0243.267] CreateCompatibleDC (hdc=0x4010280) returned 0x14011a5b
	[0243.267] GetObjectType (h=0x4010280) returned 0x3
	[0243.268] CreateCompatibleBitmap (hdc=0x4010280, cx=1, cy=1) returned 0x1d051a59
	[0243.268] GetDIBits (in: hdc=0x4010280, hbm=0x1d051a59, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0243.268] GetDIBits (in: hdc=0x4010280, hbm=0x1d051a59, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0243.268] DeleteObject (ho=0x1d051a59) returned 1
	[0243.268] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x2051a5c
	[0243.268] SelectObject (hdc=0x14011a5b, h=0x2051a5c) returned 0x185000f
	[0243.269] GdipCreateFromHDC (hdc=0x14011a5b, graphics=0x20d750) returned 0x0
	[0243.269] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0243.269] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0243.269] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0243.269] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0243.269] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0243.270] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0243.270] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0243.270] GdipCreateRegion (region=0x20d910) returned 0x0
	[0243.270] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0243.270] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0243.270] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0243.271] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0243.271] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0243.271] GetSystemMetrics (nIndex=42) returned 0
	[0243.271] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0243.271] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0243.271] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0243.271] CoTaskMemFree (pv=0x1b07f5c0) 
	[0243.271] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0243.271] GdipCreateRegion (region=0x20d400) returned 0x0
	[0243.271] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0243.271] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0243.272] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0243.272] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d460) returned 0x0
	[0243.272] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0243.272] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0243.272] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0243.272] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0243.273] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0243.273] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0243.273] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0243.273] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0243.273] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0243.273] GetCurrentObject (hdc=0x14011a5b, type=0x1) returned 0x1b00017
	[0243.274] GetCurrentObject (hdc=0x14011a5b, type=0x2) returned 0x1900010
	[0243.274] GetCurrentObject (hdc=0x14011a5b, type=0x7) returned 0x2051a5c
	[0243.274] GetCurrentObject (hdc=0x14011a5b, type=0x6) returned 0x18a002e
	[0243.274] SaveDC (hdc=0x14011a5b) returned 1
	[0243.274] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff92040710
	[0243.274] GetClipRgn (hdc=0x14011a5b, hrgn=0xffffffff92040710) returned 0
	[0243.275] SelectClipRgn (hdc=0x14011a5b, hrgn=0x180407f9) returned 2
	[0243.275] DeleteObject (ho=0xffffffff92040710) returned 1
	[0243.275] DeleteObject (ho=0x180407f9) returned 1
	[0243.275] OffsetViewportOrgEx (in: hdc=0x14011a5b, x=0, y=0, lppt=0x26ad130 | out: lppt=0x26ad130) returned 1
	[0243.275] GetNearestColor (hdc=0x14011a5b, color=0x0) returned 0x0
	[0243.275] CreateSolidBrush (color=0x0) returned 0xffffffff821007c0
	[0243.276] FillRect (hDC=0x14011a5b, lprc=0x20d4b0, hbr=0xffffffff821007c0) returned 1
	[0243.276] DeleteObject (ho=0xffffffff821007c0) returned 1
	[0243.276] RestoreDC (hdc=0x14011a5b, nSavedDC=-1) returned 1
	[0243.276] GdipReleaseDC (graphics=0x1b929550, hdc=0x14011a5b) returned 0x0
	[0243.276] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9920dbd) returned 0x0
	[0243.276] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0243.277] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0243.277] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0243.277] GetSystemMetrics (nIndex=42) returned 0
	[0243.277] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0243.277] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0243.277] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0243.277] CoTaskMemFree (pv=0x1b07f5c0) 
	[0243.277] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0243.277] GetCurrentObject (hdc=0x14011a5b, type=0x1) returned 0x1b00017
	[0243.277] GetCurrentObject (hdc=0x14011a5b, type=0x2) returned 0x1900010
	[0243.277] GetCurrentObject (hdc=0x14011a5b, type=0x7) returned 0x2051a5c
	[0243.277] GetCurrentObject (hdc=0x14011a5b, type=0x6) returned 0x18a002e
	[0243.278] SaveDC (hdc=0x14011a5b) returned 1
	[0243.278] GetNearestColor (hdc=0x14011a5b, color=0x80) returned 0x80
	[0243.278] RestoreDC (hdc=0x14011a5b, nSavedDC=-1) returned 1
	[0243.278] GdipReleaseDC (graphics=0x1b929550, hdc=0x14011a5b) returned 0x0
	[0243.278] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0243.279] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0243.279] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0243.279] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0243.279] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0243.279] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0243.279] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0243.280] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0243.280] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0243.280] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0243.280] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0243.280] BitBlt (hdc=0x4010280, x=0, y=0, cx=310, cy=83, hdcSrc=0x14011a5b, x1=0, y1=0, rop=0xcc0020) returned 1
	[0243.281] GdipReleaseDC (graphics=0x1b929550, hdc=0x14011a5b) returned 0x0
	[0243.281] SelectObject (hdc=0x14011a5b, h=0x185000f) returned 0x2051a5c
	[0243.281] DeleteDC (hdc=0x14011a5b) returned 1
	[0243.281] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0243.281] DeleteObject (ho=0x2051a5c) returned 1
	[0243.281] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0243.282] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0243.282] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.282] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0243.282] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.282] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.282] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.282] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x70107fc
	[0243.282] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0243.282] CreateCompatibleDC (hdc=0x70107fc) returned 0xd011a57
	[0243.282] GetObjectType (h=0x70107fc) returned 0x3
	[0243.283] CreateCompatibleBitmap (hdc=0x70107fc, cx=1, cy=1) returned 0x1f051a59
	[0243.283] GetDIBits (in: hdc=0x70107fc, hbm=0x1f051a59, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0243.283] GetDIBits (in: hdc=0x70107fc, hbm=0x1f051a59, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0243.283] DeleteObject (ho=0x1f051a59) returned 1
	[0243.283] CreateDIBSection (in: hdc=0x70107fc, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0x3051a5c
	[0243.284] SelectObject (hdc=0xd011a57, h=0x3051a5c) returned 0x185000f
	[0243.284] GdipCreateFromHDC (hdc=0xd011a57, graphics=0x20d800) returned 0x0
	[0243.284] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0243.284] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0243.284] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0243.284] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0243.285] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0243.285] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0243.285] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0243.285] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0243.285] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0243.285] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0243.286] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0243.286] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0243.286] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0243.286] GetSystemMetrics (nIndex=42) returned 0
	[0243.286] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0243.286] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0243.286] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0243.286] CoTaskMemFree (pv=0x1b078870) 
	[0243.286] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0243.286] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0243.286] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0243.287] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0243.287] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0243.287] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d510) returned 0x0
	[0243.287] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0243.287] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0243.287] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0243.287] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0243.288] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0243.288] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0243.288] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0243.288] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0243.288] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0243.288] GetCurrentObject (hdc=0xd011a57, type=0x1) returned 0x1b00017
	[0243.289] GetCurrentObject (hdc=0xd011a57, type=0x2) returned 0x1900010
	[0243.289] GetCurrentObject (hdc=0xd011a57, type=0x7) returned 0x3051a5c
	[0243.289] GetCurrentObject (hdc=0xd011a57, type=0x6) returned 0x18a002e
	[0243.289] SaveDC (hdc=0xd011a57) returned 1
	[0243.289] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x190407f9
	[0243.289] GetClipRgn (hdc=0xd011a57, hrgn=0x190407f9) returned 0
	[0243.290] SelectClipRgn (hdc=0xd011a57, hrgn=0xffffffff93040710) returned 2
	[0243.290] DeleteObject (ho=0x190407f9) returned 1
	[0243.290] DeleteObject (ho=0xffffffff93040710) returned 1
	[0243.290] OffsetViewportOrgEx (in: hdc=0xd011a57, x=0, y=0, lppt=0x26aec70 | out: lppt=0x26aec70) returned 1
	[0243.290] GetNearestColor (hdc=0xd011a57, color=0xf0f0f0) returned 0xf0f0f0
	[0243.290] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff831007c0
	[0243.291] FillRect (hDC=0xd011a57, lprc=0x20d560, hbr=0xffffffff831007c0) returned 1
	[0243.291] DeleteObject (ho=0xffffffff831007c0) returned 1
	[0243.291] RestoreDC (hdc=0xd011a57, nSavedDC=-1) returned 1
	[0243.291] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd011a57) returned 0x0
	[0243.292] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9900dbd) returned 0x0
	[0243.292] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0243.292] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0243.292] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0243.292] GetSystemMetrics (nIndex=42) returned 0
	[0243.292] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0243.292] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0243.292] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0243.292] CoTaskMemFree (pv=0x1b078870) 
	[0243.292] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0243.300] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0243.300] BitBlt (hdc=0x70107fc, x=0, y=0, cx=658, cy=456, hdcSrc=0xd011a57, x1=0, y1=0, rop=0xcc0020) returned 1
	[0243.301] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xd011a57) returned 0x0
	[0243.301] SelectObject (hdc=0xd011a57, h=0x185000f) returned 0x3051a5c
	[0243.301] DeleteDC (hdc=0xd011a57) returned 1
	[0243.301] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0243.302] DeleteObject (ho=0x3051a5c) returned 1
	[0243.302] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0243.302] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0243.302] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.302] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.302] WaitMessage () returned 1
	[0243.307] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.307] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.307] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.307] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.307] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.307] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.307] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.307] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.308] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.308] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.308] WaitMessage () returned 1
	[0243.310] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.310] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.310] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.310] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.310] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.310] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.310] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.310] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.310] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.310] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.310] WaitMessage () returned 1
	[0243.311] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.311] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.311] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.311] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.311] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.311] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.311] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.311] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.312] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.312] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.312] WaitMessage () returned 1
	[0243.312] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.312] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.312] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.312] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.312] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.313] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.313] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.313] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.313] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.313] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.313] WaitMessage () returned 1
	[0243.314] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.314] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.314] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.314] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.315] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.315] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.315] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.315] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.315] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.315] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.315] WaitMessage () returned 1
	[0243.316] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.316] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.316] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.316] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.316] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.316] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.316] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.316] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.317] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.317] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.317] WaitMessage () returned 1
	[0243.318] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.318] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.318] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.318] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.318] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.318] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.318] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.318] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.318] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.318] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.318] WaitMessage () returned 1
	[0243.319] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.319] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.319] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.319] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.319] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.319] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.319] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.319] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.320] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.320] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.320] WaitMessage () returned 1
	[0243.321] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.321] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.321] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.321] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.321] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.321] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.321] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.321] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.321] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.321] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.321] WaitMessage () returned 1
	[0243.322] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.322] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.322] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.322] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.322] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.322] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.322] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.322] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.322] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.322] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.322] WaitMessage () returned 1
	[0243.323] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.323] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.324] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.324] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.324] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.324] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.324] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.324] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.324] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.324] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.324] WaitMessage () returned 1
	[0243.325] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.325] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0243.325] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.325] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.325] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.325] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.325] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.325] WaitMessage () returned 1
	[0243.325] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.325] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.325] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.325] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.325] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.325] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.325] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.325] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.326] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.326] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.326] WaitMessage () returned 1
	[0243.326] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.327] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.327] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0243.327] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.327] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0243.327] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0243.327] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.327] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.327] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.327] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.327] WaitMessage () returned 1
	[0243.527] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.527] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0243.528] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0243.528] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0243.528] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0243.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.528] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0243.528] WaitMessage () returned 1
	[0244.110] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.110] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.110] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.110] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.110] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.110] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.110] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.111] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.111] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.111] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.111] WaitMessage () returned 1
	[0244.112] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.112] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.113] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.113] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.113] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.113] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.113] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.113] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.113] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.113] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.113] WaitMessage () returned 1
	[0244.116] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.116] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.116] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.116] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.116] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.116] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.116] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.116] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.116] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.116] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.116] WaitMessage () returned 1
	[0244.179] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.179] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.179] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.179] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.179] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.179] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.180] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.180] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.180] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.180] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.180] WaitMessage () returned 1
	[0244.181] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.181] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.181] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.181] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.181] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.181] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.181] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.181] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.181] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.181] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.181] WaitMessage () returned 1
	[0244.184] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.184] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.185] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.185] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.185] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.186] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.186] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.186] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.186] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.186] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.186] WaitMessage () returned 1
	[0244.244] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.244] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.244] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.244] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.244] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.244] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.244] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.245] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.245] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.245] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.245] WaitMessage () returned 1
	[0244.248] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.248] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.248] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.248] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.248] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.248] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.248] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.249] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.249] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.249] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.249] WaitMessage () returned 1
	[0244.270] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.270] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.270] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.270] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.270] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.270] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.270] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.270] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.271] WaitMessage () returned 1
	[0244.271] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.271] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.271] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.271] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.271] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.271] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.271] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.272] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.272] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.272] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.272] WaitMessage () returned 1
	[0244.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.273] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.273] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.273] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.273] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.273] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.273] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.273] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.274] WaitMessage () returned 1
	[0244.275] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.275] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.275] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.275] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.275] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.275] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.275] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.275] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.276] WaitMessage () returned 1
	[0244.451] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.451] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.451] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.451] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.451] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.451] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.451] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.451] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.451] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.451] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.451] WaitMessage () returned 1
	[0244.452] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.452] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.453] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.453] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.453] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.453] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.453] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.453] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.453] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.453] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.453] WaitMessage () returned 1
	[0244.456] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.456] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.456] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.457] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.457] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.457] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.457] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.457] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.457] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.457] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.457] WaitMessage () returned 1
	[0244.457] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.457] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.457] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.457] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.457] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.458] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.458] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.458] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.458] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.458] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.458] WaitMessage () returned 1
	[0244.619] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.619] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.619] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.619] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.619] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.619] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.619] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.619] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.620] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.620] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.620] WaitMessage () returned 1
	[0244.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.622] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.622] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.622] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.622] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.622] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.622] WaitMessage () returned 1
	[0244.623] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.623] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.623] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.623] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.623] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.623] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.623] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.623] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.624] WaitMessage () returned 1
	[0244.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.624] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.624] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.624] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.624] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.624] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.624] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.624] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.625] WaitMessage () returned 1
	[0244.625] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.625] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.625] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.625] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.625] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.625] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.625] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.625] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.625] WaitMessage () returned 1
	[0244.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.626] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.626] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.626] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.626] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.626] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.626] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.626] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.626] WaitMessage () returned 1
	[0244.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.626] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.626] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.626] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.626] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.627] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.627] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.627] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.627] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.627] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.627] WaitMessage () returned 1
	[0244.627] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.627] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.627] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.627] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.627] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.627] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.627] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.627] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.628] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.628] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.628] WaitMessage () returned 1
	[0244.629] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.629] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.629] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.629] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.629] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.630] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.630] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.630] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.630] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.630] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.630] WaitMessage () returned 1
	[0244.631] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.631] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.631] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.631] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.631] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.631] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.631] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.631] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.631] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.631] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.631] WaitMessage () returned 1
	[0244.634] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.634] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.634] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.634] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.634] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.634] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.634] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.634] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.635] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.635] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.635] WaitMessage () returned 1
	[0244.637] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.637] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.638] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.638] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.638] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.638] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.638] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.638] WaitMessage () returned 1
	[0244.639] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.639] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.639] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.639] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.639] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.640] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.640] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.640] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.640] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.640] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.640] WaitMessage () returned 1
	[0244.646] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.646] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.646] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.646] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.646] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.646] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.646] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.646] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.646] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.646] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.646] WaitMessage () returned 1
	[0244.651] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.651] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.651] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.651] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.651] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.651] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.651] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.651] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.652] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.652] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.652] WaitMessage () returned 1
	[0244.856] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.856] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.856] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.856] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.856] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.856] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.856] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.856] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.856] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.856] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.856] WaitMessage () returned 1
	[0244.878] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.878] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.878] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.878] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.878] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.878] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.878] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.878] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.879] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.879] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.879] WaitMessage () returned 1
	[0244.916] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.916] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.917] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.917] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.917] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.917] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.917] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.917] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.917] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.917] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.917] WaitMessage () returned 1
	[0244.917] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.917] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.917] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.918] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.918] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.918] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.918] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.918] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.918] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.918] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.918] WaitMessage () returned 1
	[0244.919] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.919] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.919] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.919] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.919] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.919] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.919] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.919] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.919] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.919] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.920] WaitMessage () returned 1
	[0244.920] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.920] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.920] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0244.920] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0244.920] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28401da) returned 0x1
	[0244.920] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0244.920] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0244.920] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0244.920] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.920] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0244.920] WaitMessage () returned 1
	[0245.401] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.401] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.401] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0245.401] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.401] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.401] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0245.401] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0245.402] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0245.402] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.402] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.402] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0245.402] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.402] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.402] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0245.402] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.402] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0245.402] _TrackMouseEvent (in: lpEventTrack=0x26470f0 | out: lpEventTrack=0x26470f0) returned 1
	[0245.402] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0245.402] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0245.402] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0245.402] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.402] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0245.403] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.403] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.403] DispatchMessageW (lpMsg=0x20e6b0) returned 0xd
	[0245.403] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0245.403] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0245.403] CreateCompatibleDC (hdc=0x10107f8) returned 0x12011afd
	[0245.403] SelectObject (hdc=0x12011afd, h=0x140507d2) returned 0x185000f
	[0245.403] GdipCreateFromHDC (hdc=0x12011afd, graphics=0x20d7e0) returned 0x0
	[0245.403] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0245.403] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0245.403] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0245.403] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.403] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0245.403] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0245.403] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.403] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.404] GdipCreateRegion (region=0x20d910) returned 0x0
	[0245.404] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.404] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0245.404] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0245.404] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff98e0dbd) returned 0x0
	[0245.404] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.404] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.404] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0245.404] GetCurrentObject (hdc=0x12011afd, type=0x1) returned 0x1b00017
	[0245.404] GetCurrentObject (hdc=0x12011afd, type=0x2) returned 0x1900010
	[0245.404] GetCurrentObject (hdc=0x12011afd, type=0x7) returned 0x140507d2
	[0245.404] GetCurrentObject (hdc=0x12011afd, type=0x6) returned 0x18a002e
	[0245.404] SaveDC (hdc=0x12011afd) returned 1
	[0245.404] GetNearestColor (hdc=0x12011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.404] GetNearestColor (hdc=0x12011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.405] GetNearestColor (hdc=0x12011afd, color=0x696969) returned 0x696969
	[0245.405] GetNearestColor (hdc=0x12011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.405] GetNearestColor (hdc=0x12011afd, color=0x0) returned 0x0
	[0245.405] GetNearestColor (hdc=0x12011afd, color=0xffffff) returned 0xffffff
	[0245.405] GetNearestColor (hdc=0x12011afd, color=0xe5e5e5) returned 0xe5e5e5
	[0245.405] GetNearestColor (hdc=0x12011afd, color=0xd8d8d8) returned 0xd8d8d8
	[0245.405] GetNearestColor (hdc=0x12011afd, color=0x0) returned 0x0
	[0245.405] RestoreDC (hdc=0x12011afd, nSavedDC=-1) returned 1
	[0245.406] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.406] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011afd) returned 0x0
	[0245.406] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.406] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.406] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.406] CoTaskMemFree (pv=0x1b067a40) 
	[0245.406] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0245.406] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.406] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.406] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.406] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0245.406] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0245.406] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0245.406] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0245.406] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0245.406] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.406] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.407] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.407] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.407] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.407] CoTaskMemFree (pv=0x1b067a40) 
	[0245.407] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0245.407] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0245.407] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0245.407] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0245.407] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.407] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.407] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.407] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0245.407] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.407] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.407] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.407] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0245.408] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.408] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.408] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.408] CoTaskMemFree (pv=0x1b067a40) 
	[0245.408] GdipCreateRegion (region=0x20d120) returned 0x0
	[0245.408] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.408] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0245.408] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0245.408] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0245.408] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0245.408] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0245.408] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0245.408] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0245.408] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0245.408] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0245.408] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0245.409] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.409] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.409] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0245.409] GetCurrentObject (hdc=0x12011afd, type=0x1) returned 0x1b00017
	[0245.409] GetCurrentObject (hdc=0x12011afd, type=0x2) returned 0x1900010
	[0245.409] GetCurrentObject (hdc=0x12011afd, type=0x7) returned 0x140507d2
	[0245.409] GetCurrentObject (hdc=0x12011afd, type=0x6) returned 0x18a002e
	[0245.409] SaveDC (hdc=0x12011afd) returned 1
	[0245.409] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff94040710
	[0245.409] GetClipRgn (hdc=0x12011afd, hrgn=0xffffffff94040710) returned 0
	[0245.409] SelectClipRgn (hdc=0x12011afd, hrgn=0x1a0407f9) returned 2
	[0245.409] DeleteObject (ho=0xffffffff94040710) returned 1
	[0245.409] DeleteObject (ho=0x1a0407f9) returned 1
	[0245.409] OffsetViewportOrgEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x26b0d90 | out: lppt=0x26b0d90) returned 1
	[0245.409] GetNearestColor (hdc=0x12011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.409] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff841007c0
	[0245.409] FillRect (hDC=0x12011afd, lprc=0x20d1d0, hbr=0xffffffff841007c0) returned 1
	[0245.409] DeleteObject (ho=0xffffffff841007c0) returned 1
	[0245.409] RestoreDC (hdc=0x12011afd, nSavedDC=-1) returned 1
	[0245.410] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.410] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011afd) returned 0x0
	[0245.410] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.410] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.410] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.410] CoTaskMemFree (pv=0x1b067a40) 
	[0245.410] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0245.410] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.410] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.410] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.410] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0245.410] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0245.410] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.410] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0245.410] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.410] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.410] GetFocus () returned 0x401b4
	[0245.411] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.411] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.411] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.411] CoTaskMemFree (pv=0x1b067a40) 
	[0245.411] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0245.411] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0245.411] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.411] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0245.411] GdipCreateRegion (region=0x20d070) returned 0x0
	[0245.411] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.411] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0245.411] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.411] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0245.411] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0245.411] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.411] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.412] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.412] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0245.412] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0245.412] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0245.412] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.412] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.412] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0245.412] GetCurrentObject (hdc=0x12011afd, type=0x1) returned 0x1b00017
	[0245.412] GetCurrentObject (hdc=0x12011afd, type=0x2) returned 0x1900010
	[0245.412] GetCurrentObject (hdc=0x12011afd, type=0x7) returned 0x140507d2
	[0245.412] GetCurrentObject (hdc=0x12011afd, type=0x6) returned 0x18a002e
	[0245.412] SaveDC (hdc=0x12011afd) returned 1
	[0245.412] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1b0407f9
	[0245.412] GetClipRgn (hdc=0x12011afd, hrgn=0x1b0407f9) returned 0
	[0245.412] SelectClipRgn (hdc=0x12011afd, hrgn=0xffffffff95040710) returned 2
	[0245.412] DeleteObject (ho=0x1b0407f9) returned 1
	[0245.412] DeleteObject (ho=0xffffffff95040710) returned 1
	[0245.412] OffsetViewportOrgEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x26b1330 | out: lppt=0x26b1330) returned 1
	[0245.412] GetROP2 (hdc=0x12011afd) returned 13
	[0245.413] GetBkMode (hdc=0x12011afd) returned 2
	[0245.413] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.413] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xc301afc
	[0245.413] SelectObject (hdc=0x12011afd, h=0xc301afc) returned 0x1b00017
	[0245.413] MoveToEx (in: hdc=0x12011afd, x=164, y=1, lppt=0x26b1398 | out: lppt=0x26b1398) returned 1
	[0245.413] LineTo (hdc=0x12011afd, x=1, y=1) returned 1
	[0245.413] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.413] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.413] GetROP2 (hdc=0x12011afd) returned 13
	[0245.413] GetBkMode (hdc=0x12011afd) returned 2
	[0245.413] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.413] SelectObject (hdc=0x12011afd, h=0xc301afc) returned 0xc301afc
	[0245.413] MoveToEx (in: hdc=0x12011afd, x=1, y=1, lppt=0x26b13b0 | out: lppt=0x26b13b0) returned 1
	[0245.413] LineTo (hdc=0x12011afd, x=1, y=41) returned 1
	[0245.413] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.413] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.413] SelectObject (hdc=0x12011afd, h=0x1b00017) returned 0xc301afc
	[0245.413] DeleteObject (ho=0xc301afc) returned 1
	[0245.413] GetROP2 (hdc=0x12011afd) returned 13
	[0245.413] GetBkMode (hdc=0x12011afd) returned 2
	[0245.413] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.413] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x2301b00
	[0245.413] SelectObject (hdc=0x12011afd, h=0x2301b00) returned 0x1b00017
	[0245.413] MoveToEx (in: hdc=0x12011afd, x=1, y=41, lppt=0x26b1418 | out: lppt=0x26b1418) returned 1
	[0245.413] LineTo (hdc=0x12011afd, x=164, y=41) returned 1
	[0245.414] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.414] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.414] GetROP2 (hdc=0x12011afd) returned 13
	[0245.414] GetBkMode (hdc=0x12011afd) returned 2
	[0245.414] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.414] SelectObject (hdc=0x12011afd, h=0x2301b00) returned 0x2301b00
	[0245.414] MoveToEx (in: hdc=0x12011afd, x=164, y=41, lppt=0x26b1430 | out: lppt=0x26b1430) returned 1
	[0245.414] LineTo (hdc=0x12011afd, x=164, y=0) returned 1
	[0245.414] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.414] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.414] SelectObject (hdc=0x12011afd, h=0x1b00017) returned 0x2301b00
	[0245.414] DeleteObject (ho=0x2301b00) returned 1
	[0245.414] GetROP2 (hdc=0x12011afd) returned 13
	[0245.414] GetBkMode (hdc=0x12011afd) returned 2
	[0245.414] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.414] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xd301afc
	[0245.414] SelectObject (hdc=0x12011afd, h=0xd301afc) returned 0x1b00017
	[0245.414] MoveToEx (in: hdc=0x12011afd, x=163, y=2, lppt=0x26b1498 | out: lppt=0x26b1498) returned 1
	[0245.414] LineTo (hdc=0x12011afd, x=2, y=2) returned 1
	[0245.414] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.414] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.414] GetROP2 (hdc=0x12011afd) returned 13
	[0245.414] GetBkMode (hdc=0x12011afd) returned 2
	[0245.414] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.414] SelectObject (hdc=0x12011afd, h=0xd301afc) returned 0xd301afc
	[0245.415] MoveToEx (in: hdc=0x12011afd, x=2, y=2, lppt=0x26b14b0 | out: lppt=0x26b14b0) returned 1
	[0245.415] LineTo (hdc=0x12011afd, x=2, y=40) returned 1
	[0245.415] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.415] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.415] SelectObject (hdc=0x12011afd, h=0x1b00017) returned 0xd301afc
	[0245.415] DeleteObject (ho=0xd301afc) returned 1
	[0245.415] GetROP2 (hdc=0x12011afd) returned 13
	[0245.415] GetBkMode (hdc=0x12011afd) returned 2
	[0245.415] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.415] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x3301b00
	[0245.415] SelectObject (hdc=0x12011afd, h=0x3301b00) returned 0x1b00017
	[0245.415] MoveToEx (in: hdc=0x12011afd, x=2, y=40, lppt=0x26b1518 | out: lppt=0x26b1518) returned 1
	[0245.415] LineTo (hdc=0x12011afd, x=163, y=40) returned 1
	[0245.415] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.415] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.415] GetROP2 (hdc=0x12011afd) returned 13
	[0245.415] GetBkMode (hdc=0x12011afd) returned 2
	[0245.415] SetBkMode (hdc=0x12011afd, mode=1) returned 2
	[0245.415] SelectObject (hdc=0x12011afd, h=0x3301b00) returned 0x3301b00
	[0245.415] MoveToEx (in: hdc=0x12011afd, x=163, y=40, lppt=0x26b1530 | out: lppt=0x26b1530) returned 1
	[0245.415] LineTo (hdc=0x12011afd, x=163, y=1) returned 1
	[0245.416] SetBkMode (hdc=0x12011afd, mode=2) returned 1
	[0245.416] MoveToEx (in: hdc=0x12011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.416] SelectObject (hdc=0x12011afd, h=0x1b00017) returned 0x3301b00
	[0245.416] DeleteObject (ho=0x3301b00) returned 1
	[0245.416] RestoreDC (hdc=0x12011afd, nSavedDC=-1) returned 1
	[0245.416] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.416] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011afd) returned 0x0
	[0245.416] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0245.416] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x12011afd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0245.416] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.416] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x12011afd) returned 0x0
	[0245.416] SelectObject (hdc=0x12011afd, h=0x185000f) returned 0x140507d2
	[0245.416] DeleteDC (hdc=0x12011afd) returned 1
	[0245.416] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.416] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0245.416] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0245.416] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0245.416] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.416] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0245.416] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.416] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.416] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0245.416] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0245.417] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0245.417] CreateCompatibleDC (hdc=0x48010f97) returned 0x14011afd
	[0245.417] SelectObject (hdc=0x14011afd, h=0x140507d2) returned 0x185000f
	[0245.417] GdipCreateFromHDC (hdc=0x14011afd, graphics=0x20d7e0) returned 0x0
	[0245.417] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0245.417] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0245.417] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0245.417] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0245.417] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0245.417] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0245.417] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0245.417] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0245.417] GdipCreateRegion (region=0x20d910) returned 0x0
	[0245.417] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.417] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0245.417] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0245.417] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff98b0dbd) returned 0x0
	[0245.417] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0245.417] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.418] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0245.418] GetCurrentObject (hdc=0x14011afd, type=0x1) returned 0x1b00017
	[0245.418] GetCurrentObject (hdc=0x14011afd, type=0x2) returned 0x1900010
	[0245.418] GetCurrentObject (hdc=0x14011afd, type=0x7) returned 0x140507d2
	[0245.418] GetCurrentObject (hdc=0x14011afd, type=0x6) returned 0x18a002e
	[0245.418] SaveDC (hdc=0x14011afd) returned 1
	[0245.418] GetNearestColor (hdc=0x14011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.418] GetNearestColor (hdc=0x14011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.418] GetNearestColor (hdc=0x14011afd, color=0x696969) returned 0x696969
	[0245.418] GetNearestColor (hdc=0x14011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.419] GetNearestColor (hdc=0x14011afd, color=0x0) returned 0x0
	[0245.419] GetNearestColor (hdc=0x14011afd, color=0xffffff) returned 0xffffff
	[0245.419] GetNearestColor (hdc=0x14011afd, color=0xe5e5e5) returned 0xe5e5e5
	[0245.419] GetNearestColor (hdc=0x14011afd, color=0xd8d8d8) returned 0xd8d8d8
	[0245.419] GetNearestColor (hdc=0x14011afd, color=0x0) returned 0x0
	[0245.419] RestoreDC (hdc=0x14011afd, nSavedDC=-1) returned 1
	[0245.419] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011afd) returned 0x0
	[0245.420] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.420] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.420] CoTaskMemFree (pv=0x1b067a40) 
	[0245.420] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0245.420] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.420] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.420] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.421] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0245.421] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0245.421] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0245.421] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0245.421] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0245.421] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.421] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.422] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.422] CoTaskMemFree (pv=0x1b067a40) 
	[0245.422] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0245.422] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0245.422] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0245.422] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0245.422] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.423] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.423] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.423] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0245.423] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.423] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0245.423] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.424] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.424] CoTaskMemFree (pv=0x1b067a40) 
	[0245.424] GdipCreateRegion (region=0x20d120) returned 0x0
	[0245.424] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.424] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0245.424] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.424] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0245.424] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.425] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.425] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.425] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0245.425] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0245.425] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0245.425] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.426] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0245.426] GetCurrentObject (hdc=0x14011afd, type=0x1) returned 0x1b00017
	[0245.426] GetCurrentObject (hdc=0x14011afd, type=0x2) returned 0x1900010
	[0245.426] GetCurrentObject (hdc=0x14011afd, type=0x7) returned 0x140507d2
	[0245.426] GetCurrentObject (hdc=0x14011afd, type=0x6) returned 0x18a002e
	[0245.426] SaveDC (hdc=0x14011afd) returned 1
	[0245.427] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff96040710
	[0245.427] GetClipRgn (hdc=0x14011afd, hrgn=0xffffffff96040710) returned 0
	[0245.427] SelectClipRgn (hdc=0x14011afd, hrgn=0x1c0407f9) returned 2
	[0245.427] DeleteObject (ho=0xffffffff96040710) returned 1
	[0245.427] DeleteObject (ho=0x1c0407f9) returned 1
	[0245.427] OffsetViewportOrgEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x26b2190 | out: lppt=0x26b2190) returned 1
	[0245.427] GetNearestColor (hdc=0x14011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.428] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff851007c0
	[0245.428] FillRect (hDC=0x14011afd, lprc=0x20d1d0, hbr=0xffffffff851007c0) returned 1
	[0245.428] DeleteObject (ho=0xffffffff851007c0) returned 1
	[0245.428] RestoreDC (hdc=0x14011afd, nSavedDC=-1) returned 1
	[0245.428] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011afd) returned 0x0
	[0245.429] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.429] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.429] CoTaskMemFree (pv=0x1b067a40) 
	[0245.429] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0245.429] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.429] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.429] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.429] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0245.430] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0245.430] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0245.430] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.430] GetFocus () returned 0x401b4
	[0245.430] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.430] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0245.430] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.432] CoTaskMemFree (pv=0x1b067a40) 
	[0245.432] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0245.432] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0245.432] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0245.432] GdipCreateRegion (region=0x20d070) returned 0x0
	[0245.432] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.432] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0245.433] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0245.433] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0245.433] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0245.433] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0245.433] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0245.433] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0245.434] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0245.434] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0245.434] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.434] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0245.434] GetCurrentObject (hdc=0x14011afd, type=0x1) returned 0x1b00017
	[0245.434] GetCurrentObject (hdc=0x14011afd, type=0x2) returned 0x1900010
	[0245.434] GetCurrentObject (hdc=0x14011afd, type=0x7) returned 0x140507d2
	[0245.435] GetCurrentObject (hdc=0x14011afd, type=0x6) returned 0x18a002e
	[0245.435] SaveDC (hdc=0x14011afd) returned 1
	[0245.435] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1d0407f9
	[0245.435] GetClipRgn (hdc=0x14011afd, hrgn=0x1d0407f9) returned 0
	[0245.435] SelectClipRgn (hdc=0x14011afd, hrgn=0xffffffff97040710) returned 2
	[0245.435] DeleteObject (ho=0x1d0407f9) returned 1
	[0245.436] DeleteObject (ho=0xffffffff97040710) returned 1
	[0245.436] OffsetViewportOrgEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x26b2730 | out: lppt=0x26b2730) returned 1
	[0245.436] GetROP2 (hdc=0x14011afd) returned 13
	[0245.436] GetBkMode (hdc=0x14011afd) returned 2
	[0245.436] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.436] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x5301b00
	[0245.437] SelectObject (hdc=0x14011afd, h=0x5301b00) returned 0x1b00017
	[0245.437] MoveToEx (in: hdc=0x14011afd, x=126, y=1, lppt=0x26b2798 | out: lppt=0x26b2798) returned 1
	[0245.437] LineTo (hdc=0x14011afd, x=1, y=1) returned 1
	[0245.437] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.437] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.437] GetROP2 (hdc=0x14011afd) returned 13
	[0245.438] GetBkMode (hdc=0x14011afd) returned 2
	[0245.438] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.438] SelectObject (hdc=0x14011afd, h=0x5301b00) returned 0x5301b00
	[0245.438] MoveToEx (in: hdc=0x14011afd, x=1, y=1, lppt=0x26b27b0 | out: lppt=0x26b27b0) returned 1
	[0245.438] LineTo (hdc=0x14011afd, x=1, y=39) returned 1
	[0245.438] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.438] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.439] SelectObject (hdc=0x14011afd, h=0x1b00017) returned 0x5301b00
	[0245.439] DeleteObject (ho=0x5301b00) returned 1
	[0245.439] GetROP2 (hdc=0x14011afd) returned 13
	[0245.439] GetBkMode (hdc=0x14011afd) returned 2
	[0245.439] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.439] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xe301afc
	[0245.440] SelectObject (hdc=0x14011afd, h=0xe301afc) returned 0x1b00017
	[0245.440] MoveToEx (in: hdc=0x14011afd, x=1, y=39, lppt=0x26b2818 | out: lppt=0x26b2818) returned 1
	[0245.440] LineTo (hdc=0x14011afd, x=126, y=39) returned 1
	[0245.440] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.440] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.440] GetROP2 (hdc=0x14011afd) returned 13
	[0245.441] GetBkMode (hdc=0x14011afd) returned 2
	[0245.441] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.441] SelectObject (hdc=0x14011afd, h=0xe301afc) returned 0xe301afc
	[0245.441] MoveToEx (in: hdc=0x14011afd, x=126, y=39, lppt=0x26b2830 | out: lppt=0x26b2830) returned 1
	[0245.441] LineTo (hdc=0x14011afd, x=126, y=0) returned 1
	[0245.441] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.441] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.442] SelectObject (hdc=0x14011afd, h=0x1b00017) returned 0xe301afc
	[0245.442] DeleteObject (ho=0xe301afc) returned 1
	[0245.442] GetROP2 (hdc=0x14011afd) returned 13
	[0245.442] GetBkMode (hdc=0x14011afd) returned 2
	[0245.442] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.442] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x6301b00
	[0245.443] SelectObject (hdc=0x14011afd, h=0x6301b00) returned 0x1b00017
	[0245.443] MoveToEx (in: hdc=0x14011afd, x=125, y=2, lppt=0x26b2898 | out: lppt=0x26b2898) returned 1
	[0245.443] LineTo (hdc=0x14011afd, x=2, y=2) returned 1
	[0245.443] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.443] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.443] GetROP2 (hdc=0x14011afd) returned 13
	[0245.444] GetBkMode (hdc=0x14011afd) returned 2
	[0245.444] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.444] SelectObject (hdc=0x14011afd, h=0x6301b00) returned 0x6301b00
	[0245.444] MoveToEx (in: hdc=0x14011afd, x=2, y=2, lppt=0x26b28b0 | out: lppt=0x26b28b0) returned 1
	[0245.444] LineTo (hdc=0x14011afd, x=2, y=38) returned 1
	[0245.444] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.444] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.445] SelectObject (hdc=0x14011afd, h=0x1b00017) returned 0x6301b00
	[0245.445] DeleteObject (ho=0x6301b00) returned 1
	[0245.445] GetROP2 (hdc=0x14011afd) returned 13
	[0245.445] GetBkMode (hdc=0x14011afd) returned 2
	[0245.445] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.445] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xf301afc
	[0245.446] SelectObject (hdc=0x14011afd, h=0xf301afc) returned 0x1b00017
	[0245.446] MoveToEx (in: hdc=0x14011afd, x=2, y=38, lppt=0x26b2918 | out: lppt=0x26b2918) returned 1
	[0245.446] LineTo (hdc=0x14011afd, x=125, y=38) returned 1
	[0245.446] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.446] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.446] GetROP2 (hdc=0x14011afd) returned 13
	[0245.447] GetBkMode (hdc=0x14011afd) returned 2
	[0245.447] SetBkMode (hdc=0x14011afd, mode=1) returned 2
	[0245.447] SelectObject (hdc=0x14011afd, h=0xf301afc) returned 0xf301afc
	[0245.447] MoveToEx (in: hdc=0x14011afd, x=125, y=38, lppt=0x26b2930 | out: lppt=0x26b2930) returned 1
	[0245.447] LineTo (hdc=0x14011afd, x=125, y=1) returned 1
	[0245.447] SetBkMode (hdc=0x14011afd, mode=2) returned 1
	[0245.447] MoveToEx (in: hdc=0x14011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.448] SelectObject (hdc=0x14011afd, h=0x1b00017) returned 0xf301afc
	[0245.448] DeleteObject (ho=0xf301afc) returned 1
	[0245.448] RestoreDC (hdc=0x14011afd, nSavedDC=-1) returned 1
	[0245.448] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011afd) returned 0x0
	[0245.448] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0245.448] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0x14011afd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0245.449] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x14011afd) returned 0x0
	[0245.449] SelectObject (hdc=0x14011afd, h=0x185000f) returned 0x140507d2
	[0245.449] DeleteDC (hdc=0x14011afd) returned 1
	[0245.449] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0245.449] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0245.450] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0245.450] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0245.450] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0245.450] WaitMessage () returned 1
	[0245.509] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.509] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0245.509] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.509] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.509] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0245.509] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.509] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0245.509] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.509] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.509] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0245.509] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x16003a) returned 0x0
	[0245.509] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0245.509] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0245.509] WaitMessage () returned 1
	[0245.619] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.619] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0245.619] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.619] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe20116) returned 0x0
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x0, lParam=0x201a6) returned 0x1
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0245.619] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0245.620] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x50120) returned 0x1
	[0245.620] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0245.620] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0245.620] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0245.621] GetFocus () returned 0x401b4
	[0245.621] SetFocus (hWnd=0x201d8) returned 0x401b4
	[0245.621] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x8, wParam=0x201d8, lParam=0x0) returned 0x0
	[0245.621] GetStockObject (i=5) returned 0x1900015
	[0245.622] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0245.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0245.622] GetCapture () returned 0x0
	[0245.622] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0245.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0245.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0245.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0245.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0245.623] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0245.623] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x401b4, lParam=0x0) returned 0x0
	[0245.623] GetStockObject (i=5) returned 0x1900015
	[0245.623] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0245.623] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0245.623] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0245.623] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0245.623] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.623] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0245.623] IsWindowVisible (hWnd=0x201d8) returned 1
	[0245.623] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0245.623] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0245.623] GetFocus () returned 0x201d8
	[0245.623] GetFocus () returned 0x201d8
	[0245.623] GetFocus () returned 0x201d8
	[0245.624] GetCapture () returned 0x0
	[0245.624] SetCapture (hWnd=0x201d8) returned 0x0
	[0245.624] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0245.624] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0245.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.624] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.624] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.624] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0245.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.624] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.624] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.624] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0245.624] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.624] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0245.624] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0245.624] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0245.624] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0245.624] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26b2ae0, cPoints=0x1 | out: lpPoints=0x26b2ae0) returned 30606029
	[0245.624] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0245.624] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0245.624] UpdateWindow (hWnd=0x201d8) returned 1
	[0245.624] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0245.624] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0245.624] CreateCompatibleDC (hdc=0x48010f97) returned 0x22011afd
	[0245.625] SelectObject (hdc=0x22011afd, h=0x140507d2) returned 0x185000f
	[0245.625] GdipCreateFromHDC (hdc=0x22011afd, graphics=0x20cfa0) returned 0x0
	[0245.625] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0245.625] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0245.625] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0245.626] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.626] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0245.626] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.626] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.626] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0245.627] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.627] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0245.627] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0245.628] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9880dbd) returned 0x0
	[0245.628] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.628] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0245.628] GetCurrentObject (hdc=0x22011afd, type=0x1) returned 0x1b00017
	[0245.628] GetCurrentObject (hdc=0x22011afd, type=0x2) returned 0x1900010
	[0245.628] GetCurrentObject (hdc=0x22011afd, type=0x7) returned 0x140507d2
	[0245.629] GetCurrentObject (hdc=0x22011afd, type=0x6) returned 0x18a002e
	[0245.629] SaveDC (hdc=0x22011afd) returned 1
	[0245.629] GetNearestColor (hdc=0x22011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.629] GetNearestColor (hdc=0x22011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.629] GetNearestColor (hdc=0x22011afd, color=0x696969) returned 0x696969
	[0245.629] GetNearestColor (hdc=0x22011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.630] GetNearestColor (hdc=0x22011afd, color=0x0) returned 0x0
	[0245.630] GetNearestColor (hdc=0x22011afd, color=0xffffff) returned 0xffffff
	[0245.630] GetNearestColor (hdc=0x22011afd, color=0xe5e5e5) returned 0xe5e5e5
	[0245.630] GetNearestColor (hdc=0x22011afd, color=0xd8d8d8) returned 0xd8d8d8
	[0245.630] GetNearestColor (hdc=0x22011afd, color=0x0) returned 0x0
	[0245.631] RestoreDC (hdc=0x22011afd, nSavedDC=-1) returned 1
	[0245.631] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x22011afd) returned 0x0
	[0245.631] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0245.631] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.631] CoTaskMemFree (pv=0x1b067a60) 
	[0245.631] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0245.631] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.632] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.632] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.632] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0245.632] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0245.632] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0245.632] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0245.633] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0245.633] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.633] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0245.633] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.633] CoTaskMemFree (pv=0x1b067a60) 
	[0245.633] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0245.633] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0245.634] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0245.634] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0245.634] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.634] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.634] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.634] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0245.635] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.635] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0245.635] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0245.635] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.635] CoTaskMemFree (pv=0x1b067a60) 
	[0245.635] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0245.635] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.636] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0245.636] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0245.636] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0245.636] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0245.636] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0245.636] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0245.637] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0245.637] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0245.637] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0245.637] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.637] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0245.637] GetCurrentObject (hdc=0x22011afd, type=0x1) returned 0x1b00017
	[0245.638] GetCurrentObject (hdc=0x22011afd, type=0x2) returned 0x1900010
	[0245.638] GetCurrentObject (hdc=0x22011afd, type=0x7) returned 0x140507d2
	[0245.638] GetCurrentObject (hdc=0x22011afd, type=0x6) returned 0x18a002e
	[0245.638] SaveDC (hdc=0x22011afd) returned 1
	[0245.638] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff98040710
	[0245.638] GetClipRgn (hdc=0x22011afd, hrgn=0xffffffff98040710) returned 0
	[0245.639] SelectClipRgn (hdc=0x22011afd, hrgn=0x220407f9) returned 2
	[0245.639] DeleteObject (ho=0xffffffff98040710) returned 1
	[0245.639] DeleteObject (ho=0x220407f9) returned 1
	[0245.639] OffsetViewportOrgEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x26b3760 | out: lppt=0x26b3760) returned 1
	[0245.639] GetNearestColor (hdc=0x22011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.639] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff861007c0
	[0245.640] FillRect (hDC=0x22011afd, lprc=0x20c990, hbr=0xffffffff861007c0) returned 1
	[0245.640] DeleteObject (ho=0xffffffff861007c0) returned 1
	[0245.640] RestoreDC (hdc=0x22011afd, nSavedDC=-1) returned 1
	[0245.640] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x22011afd) returned 0x0
	[0245.640] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0245.641] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.641] CoTaskMemFree (pv=0x1b067a60) 
	[0245.641] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0245.641] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.641] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.641] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.641] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0245.642] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0245.642] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0245.642] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.642] GetFocus () returned 0x201d8
	[0245.642] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.642] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0245.643] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.643] CoTaskMemFree (pv=0x1b067a60) 
	[0245.643] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0245.643] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0245.643] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0245.643] GdipCreateRegion (region=0x20c830) returned 0x0
	[0245.643] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.644] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0245.644] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.644] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0245.644] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.644] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0245.644] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.645] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0245.645] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0245.645] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0245.645] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.645] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0245.645] GetCurrentObject (hdc=0x22011afd, type=0x1) returned 0x1b00017
	[0245.646] GetCurrentObject (hdc=0x22011afd, type=0x2) returned 0x1900010
	[0245.646] GetCurrentObject (hdc=0x22011afd, type=0x7) returned 0x140507d2
	[0245.646] GetCurrentObject (hdc=0x22011afd, type=0x6) returned 0x18a002e
	[0245.646] SaveDC (hdc=0x22011afd) returned 1
	[0245.646] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x230407f9
	[0245.646] GetClipRgn (hdc=0x22011afd, hrgn=0x230407f9) returned 0
	[0245.647] SelectClipRgn (hdc=0x22011afd, hrgn=0xffffffff99040710) returned 2
	[0245.647] DeleteObject (ho=0x230407f9) returned 1
	[0245.647] DeleteObject (ho=0xffffffff99040710) returned 1
	[0245.647] OffsetViewportOrgEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x26b3d00 | out: lppt=0x26b3d00) returned 1
	[0245.647] GetROP2 (hdc=0x22011afd) returned 13
	[0245.647] GetBkMode (hdc=0x22011afd) returned 2
	[0245.648] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.648] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1301b01
	[0245.648] SelectObject (hdc=0x22011afd, h=0x1301b01) returned 0x1b00017
	[0245.648] MoveToEx (in: hdc=0x22011afd, x=164, y=1, lppt=0x26b3d68 | out: lppt=0x26b3d68) returned 1
	[0245.648] LineTo (hdc=0x22011afd, x=1, y=1) returned 1
	[0245.648] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.648] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.649] GetROP2 (hdc=0x22011afd) returned 13
	[0245.649] GetBkMode (hdc=0x22011afd) returned 2
	[0245.649] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.649] SelectObject (hdc=0x22011afd, h=0x1301b01) returned 0x1301b01
	[0245.649] MoveToEx (in: hdc=0x22011afd, x=1, y=1, lppt=0x26b3d80 | out: lppt=0x26b3d80) returned 1
	[0245.650] LineTo (hdc=0x22011afd, x=1, y=41) returned 1
	[0245.650] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.650] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.650] SelectObject (hdc=0x22011afd, h=0x1b00017) returned 0x1301b01
	[0245.650] DeleteObject (ho=0x1301b01) returned 1
	[0245.650] GetROP2 (hdc=0x22011afd) returned 13
	[0245.651] GetBkMode (hdc=0x22011afd) returned 2
	[0245.651] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.651] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1301b02
	[0245.651] SelectObject (hdc=0x22011afd, h=0x1301b02) returned 0x1b00017
	[0245.651] MoveToEx (in: hdc=0x22011afd, x=1, y=41, lppt=0x26b3de8 | out: lppt=0x26b3de8) returned 1
	[0245.651] LineTo (hdc=0x22011afd, x=164, y=41) returned 1
	[0245.652] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.652] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.652] GetROP2 (hdc=0x22011afd) returned 13
	[0245.652] GetBkMode (hdc=0x22011afd) returned 2
	[0245.652] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.652] SelectObject (hdc=0x22011afd, h=0x1301b02) returned 0x1301b02
	[0245.653] MoveToEx (in: hdc=0x22011afd, x=164, y=41, lppt=0x26b3e00 | out: lppt=0x26b3e00) returned 1
	[0245.653] LineTo (hdc=0x22011afd, x=164, y=0) returned 1
	[0245.653] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.653] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.653] SelectObject (hdc=0x22011afd, h=0x1b00017) returned 0x1301b02
	[0245.653] DeleteObject (ho=0x1301b02) returned 1
	[0245.654] GetROP2 (hdc=0x22011afd) returned 13
	[0245.654] GetBkMode (hdc=0x22011afd) returned 2
	[0245.654] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.654] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2301b01
	[0245.654] SelectObject (hdc=0x22011afd, h=0x2301b01) returned 0x1b00017
	[0245.655] MoveToEx (in: hdc=0x22011afd, x=163, y=2, lppt=0x26b3e68 | out: lppt=0x26b3e68) returned 1
	[0245.655] LineTo (hdc=0x22011afd, x=2, y=2) returned 1
	[0245.655] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.655] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.655] GetROP2 (hdc=0x22011afd) returned 13
	[0245.655] GetBkMode (hdc=0x22011afd) returned 2
	[0245.656] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.656] SelectObject (hdc=0x22011afd, h=0x2301b01) returned 0x2301b01
	[0245.656] MoveToEx (in: hdc=0x22011afd, x=2, y=2, lppt=0x26b3e80 | out: lppt=0x26b3e80) returned 1
	[0245.656] LineTo (hdc=0x22011afd, x=2, y=40) returned 1
	[0245.656] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.657] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.657] SelectObject (hdc=0x22011afd, h=0x1b00017) returned 0x2301b01
	[0245.657] DeleteObject (ho=0x2301b01) returned 1
	[0245.657] GetROP2 (hdc=0x22011afd) returned 13
	[0245.657] GetBkMode (hdc=0x22011afd) returned 2
	[0245.657] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.658] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2301b02
	[0245.658] SelectObject (hdc=0x22011afd, h=0x2301b02) returned 0x1b00017
	[0245.658] MoveToEx (in: hdc=0x22011afd, x=2, y=40, lppt=0x26b3ee8 | out: lppt=0x26b3ee8) returned 1
	[0245.658] LineTo (hdc=0x22011afd, x=163, y=40) returned 1
	[0245.658] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.659] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.659] GetROP2 (hdc=0x22011afd) returned 13
	[0245.659] GetBkMode (hdc=0x22011afd) returned 2
	[0245.659] SetBkMode (hdc=0x22011afd, mode=1) returned 2
	[0245.659] SelectObject (hdc=0x22011afd, h=0x2301b02) returned 0x2301b02
	[0245.659] MoveToEx (in: hdc=0x22011afd, x=163, y=40, lppt=0x26b3f00 | out: lppt=0x26b3f00) returned 1
	[0245.660] LineTo (hdc=0x22011afd, x=163, y=1) returned 1
	[0245.660] SetBkMode (hdc=0x22011afd, mode=2) returned 1
	[0245.660] MoveToEx (in: hdc=0x22011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.660] SelectObject (hdc=0x22011afd, h=0x1b00017) returned 0x2301b02
	[0245.660] DeleteObject (ho=0x2301b02) returned 1
	[0245.660] RestoreDC (hdc=0x22011afd, nSavedDC=-1) returned 1
	[0245.661] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x22011afd) returned 0x0
	[0245.661] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0245.661] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0x22011afd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0245.661] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x22011afd) returned 0x0
	[0245.661] SelectObject (hdc=0x22011afd, h=0x185000f) returned 0x140507d2
	[0245.662] DeleteDC (hdc=0x22011afd) returned 1
	[0245.662] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0245.662] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0245.662] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0245.662] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26b3f58, cPoints=0x1 | out: lpPoints=0x26b3f58) returned 30606029
	[0245.662] WindowFromPoint (Point=0x1e900000307) returned 0x201d8
	[0245.662] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.663] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0245.663] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0245.663] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0245.663] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26b4048, Length=0x70 | out: Destination=0x1afe53a0) 
	[0245.664] ShellExecuteExW (in: pExecInfo=0x26b4258*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26b4258*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0245.699] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0245.699] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0245.699] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0245.700] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0245.700] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0245.700] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0245.701] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0245.701] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0245.701] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0245.701] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0245.701] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0245.701] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0245.701] GetStockObject (i=5) returned 0x1900015
	[0245.701] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0245.701] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0245.702] GetCapture () returned 0x0
	[0245.702] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0245.702] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0245.702] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0245.702] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x4010280
	[0245.702] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0245.702] CreateCompatibleDC (hdc=0x4010280) returned 0x2c011afd
	[0245.702] SelectObject (hdc=0x2c011afd, h=0x140507d2) returned 0x185000f
	[0245.702] GdipCreateFromHDC (hdc=0x2c011afd, graphics=0x20c9d0) returned 0x0
	[0245.703] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0245.703] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0245.703] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0245.703] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0245.703] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0245.703] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0245.704] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0245.704] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0245.704] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.704] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0245.704] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0245.704] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9850dbd) returned 0x0
	[0245.705] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.705] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0245.705] GetCurrentObject (hdc=0x2c011afd, type=0x1) returned 0x1b00017
	[0245.705] GetCurrentObject (hdc=0x2c011afd, type=0x2) returned 0x1900010
	[0245.705] GetCurrentObject (hdc=0x2c011afd, type=0x7) returned 0x140507d2
	[0245.705] GetCurrentObject (hdc=0x2c011afd, type=0x6) returned 0x18a002e
	[0245.706] SaveDC (hdc=0x2c011afd) returned 1
	[0245.706] GetNearestColor (hdc=0x2c011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.706] GetNearestColor (hdc=0x2c011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.706] GetNearestColor (hdc=0x2c011afd, color=0x696969) returned 0x696969
	[0245.706] GetNearestColor (hdc=0x2c011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.707] GetNearestColor (hdc=0x2c011afd, color=0x0) returned 0x0
	[0245.707] GetNearestColor (hdc=0x2c011afd, color=0xffffff) returned 0xffffff
	[0245.707] GetNearestColor (hdc=0x2c011afd, color=0xe5e5e5) returned 0xe5e5e5
	[0245.707] GetNearestColor (hdc=0x2c011afd, color=0xd8d8d8) returned 0xd8d8d8
	[0245.707] GetNearestColor (hdc=0x2c011afd, color=0x0) returned 0x0
	[0245.707] RestoreDC (hdc=0x2c011afd, nSavedDC=-1) returned 1
	[0245.708] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c011afd) returned 0x0
	[0245.708] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.708] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.708] CoTaskMemFree (pv=0x1b077150) 
	[0245.708] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0245.708] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.708] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.709] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.709] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0245.709] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0245.709] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0245.709] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0245.709] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0245.710] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.710] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.710] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.710] CoTaskMemFree (pv=0x1b077150) 
	[0245.710] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0245.710] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0245.710] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0245.711] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0245.711] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.711] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.711] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.712] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0245.712] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.712] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0245.713] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.713] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.713] CoTaskMemFree (pv=0x1b077150) 
	[0245.713] GdipCreateRegion (region=0x20c310) returned 0x0
	[0245.714] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.714] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0245.714] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.715] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0245.715] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0245.715] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0245.716] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.716] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0245.716] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0245.716] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0245.716] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.717] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0245.717] GetCurrentObject (hdc=0x2c011afd, type=0x1) returned 0x1b00017
	[0245.717] GetCurrentObject (hdc=0x2c011afd, type=0x2) returned 0x1900010
	[0245.717] GetCurrentObject (hdc=0x2c011afd, type=0x7) returned 0x140507d2
	[0245.717] GetCurrentObject (hdc=0x2c011afd, type=0x6) returned 0x18a002e
	[0245.717] SaveDC (hdc=0x2c011afd) returned 1
	[0245.718] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9a040710
	[0245.718] GetClipRgn (hdc=0x2c011afd, hrgn=0xffffffff9a040710) returned 0
	[0245.718] SelectClipRgn (hdc=0x2c011afd, hrgn=0x260407f9) returned 2
	[0245.718] DeleteObject (ho=0xffffffff9a040710) returned 1
	[0245.718] DeleteObject (ho=0x260407f9) returned 1
	[0245.719] OffsetViewportOrgEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x26b4f38 | out: lppt=0x26b4f38) returned 1
	[0245.719] GetNearestColor (hdc=0x2c011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.719] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff871007c0
	[0245.719] FillRect (hDC=0x2c011afd, lprc=0x20c3c0, hbr=0xffffffff871007c0) returned 1
	[0245.719] DeleteObject (ho=0xffffffff871007c0) returned 1
	[0245.719] RestoreDC (hdc=0x2c011afd, nSavedDC=-1) returned 1
	[0245.720] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c011afd) returned 0x0
	[0245.720] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.720] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.720] CoTaskMemFree (pv=0x1b077150) 
	[0245.720] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0245.720] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.721] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.721] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.721] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0245.721] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0245.721] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0245.721] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.722] GetFocus () returned 0x0
	[0245.722] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.722] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.722] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.722] CoTaskMemFree (pv=0x1b077150) 
	[0245.722] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0245.722] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0245.723] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0245.723] GdipCreateRegion (region=0x20c260) returned 0x0
	[0245.723] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.723] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0245.723] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0245.723] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0245.723] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0245.724] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0245.724] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0245.724] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0245.724] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0245.724] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0245.724] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.725] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0245.725] GetCurrentObject (hdc=0x2c011afd, type=0x1) returned 0x1b00017
	[0245.725] GetCurrentObject (hdc=0x2c011afd, type=0x2) returned 0x1900010
	[0245.725] GetCurrentObject (hdc=0x2c011afd, type=0x7) returned 0x140507d2
	[0245.725] GetCurrentObject (hdc=0x2c011afd, type=0x6) returned 0x18a002e
	[0245.725] SaveDC (hdc=0x2c011afd) returned 1
	[0245.726] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x270407f9
	[0245.726] GetClipRgn (hdc=0x2c011afd, hrgn=0x270407f9) returned 0
	[0245.726] SelectClipRgn (hdc=0x2c011afd, hrgn=0xffffffff9b040710) returned 2
	[0245.726] DeleteObject (ho=0x270407f9) returned 1
	[0245.726] DeleteObject (ho=0xffffffff9b040710) returned 1
	[0245.726] OffsetViewportOrgEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x26b54d8 | out: lppt=0x26b54d8) returned 1
	[0245.727] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.727] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.727] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.727] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x4301b02
	[0245.727] SelectObject (hdc=0x2c011afd, h=0x4301b02) returned 0x1b00017
	[0245.728] MoveToEx (in: hdc=0x2c011afd, x=164, y=1, lppt=0x26b5540 | out: lppt=0x26b5540) returned 1
	[0245.728] LineTo (hdc=0x2c011afd, x=1, y=1) returned 1
	[0245.728] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.728] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.728] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.728] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.729] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.729] SelectObject (hdc=0x2c011afd, h=0x4301b02) returned 0x4301b02
	[0245.729] MoveToEx (in: hdc=0x2c011afd, x=1, y=1, lppt=0x26b5558 | out: lppt=0x26b5558) returned 1
	[0245.729] LineTo (hdc=0x2c011afd, x=1, y=41) returned 1
	[0245.729] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.729] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.730] SelectObject (hdc=0x2c011afd, h=0x1b00017) returned 0x4301b02
	[0245.730] DeleteObject (ho=0x4301b02) returned 1
	[0245.730] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.730] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.730] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.730] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x3301b01
	[0245.731] SelectObject (hdc=0x2c011afd, h=0x3301b01) returned 0x1b00017
	[0245.731] MoveToEx (in: hdc=0x2c011afd, x=1, y=41, lppt=0x26b55c0 | out: lppt=0x26b55c0) returned 1
	[0245.731] LineTo (hdc=0x2c011afd, x=164, y=41) returned 1
	[0245.731] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.731] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.731] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.732] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.732] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.732] SelectObject (hdc=0x2c011afd, h=0x3301b01) returned 0x3301b01
	[0245.732] MoveToEx (in: hdc=0x2c011afd, x=164, y=41, lppt=0x26b55d8 | out: lppt=0x26b55d8) returned 1
	[0245.732] LineTo (hdc=0x2c011afd, x=164, y=0) returned 1
	[0245.733] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.733] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.733] SelectObject (hdc=0x2c011afd, h=0x1b00017) returned 0x3301b01
	[0245.733] DeleteObject (ho=0x3301b01) returned 1
	[0245.733] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.733] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.734] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.734] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x5301b02
	[0245.734] SelectObject (hdc=0x2c011afd, h=0x5301b02) returned 0x1b00017
	[0245.734] MoveToEx (in: hdc=0x2c011afd, x=163, y=2, lppt=0x26b5640 | out: lppt=0x26b5640) returned 1
	[0245.734] LineTo (hdc=0x2c011afd, x=2, y=2) returned 1
	[0245.734] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.735] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.735] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.735] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.735] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.735] SelectObject (hdc=0x2c011afd, h=0x5301b02) returned 0x5301b02
	[0245.735] MoveToEx (in: hdc=0x2c011afd, x=2, y=2, lppt=0x26b5658 | out: lppt=0x26b5658) returned 1
	[0245.735] LineTo (hdc=0x2c011afd, x=2, y=40) returned 1
	[0245.736] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.736] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.736] SelectObject (hdc=0x2c011afd, h=0x1b00017) returned 0x5301b02
	[0245.736] DeleteObject (ho=0x5301b02) returned 1
	[0245.736] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.736] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.737] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.737] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x4301b01
	[0245.737] SelectObject (hdc=0x2c011afd, h=0x4301b01) returned 0x1b00017
	[0245.737] MoveToEx (in: hdc=0x2c011afd, x=2, y=40, lppt=0x26b56c0 | out: lppt=0x26b56c0) returned 1
	[0245.737] LineTo (hdc=0x2c011afd, x=163, y=40) returned 1
	[0245.737] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.738] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.738] GetROP2 (hdc=0x2c011afd) returned 13
	[0245.738] GetBkMode (hdc=0x2c011afd) returned 2
	[0245.738] SetBkMode (hdc=0x2c011afd, mode=1) returned 2
	[0245.738] SelectObject (hdc=0x2c011afd, h=0x4301b01) returned 0x4301b01
	[0245.738] MoveToEx (in: hdc=0x2c011afd, x=163, y=40, lppt=0x26b56d8 | out: lppt=0x26b56d8) returned 1
	[0245.738] LineTo (hdc=0x2c011afd, x=163, y=1) returned 1
	[0245.739] SetBkMode (hdc=0x2c011afd, mode=2) returned 1
	[0245.739] MoveToEx (in: hdc=0x2c011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.739] SelectObject (hdc=0x2c011afd, h=0x1b00017) returned 0x4301b01
	[0245.739] DeleteObject (ho=0x4301b01) returned 1
	[0245.739] RestoreDC (hdc=0x2c011afd, nSavedDC=-1) returned 1
	[0245.739] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c011afd) returned 0x0
	[0245.740] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0245.740] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x2c011afd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0245.740] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2c011afd) returned 0x0
	[0245.740] SelectObject (hdc=0x2c011afd, h=0x185000f) returned 0x140507d2
	[0245.740] DeleteDC (hdc=0x2c011afd) returned 1
	[0245.741] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0245.741] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0245.741] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0245.741] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.741] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0245.741] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x48010f97
	[0245.741] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0245.742] CreateCompatibleDC (hdc=0x48010f97) returned 0x2e011afd
	[0245.742] SelectObject (hdc=0x2e011afd, h=0x140507d2) returned 0x185000f
	[0245.742] GdipCreateFromHDC (hdc=0x2e011afd, graphics=0x20c9d0) returned 0x0
	[0245.742] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0245.742] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0245.742] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0245.743] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.743] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0245.743] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0245.743] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.743] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0245.744] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.744] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0245.744] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0245.744] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9820dbd) returned 0x0
	[0245.744] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.744] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0245.745] GetCurrentObject (hdc=0x2e011afd, type=0x1) returned 0x1b00017
	[0245.745] GetCurrentObject (hdc=0x2e011afd, type=0x2) returned 0x1900010
	[0245.745] GetCurrentObject (hdc=0x2e011afd, type=0x7) returned 0x140507d2
	[0245.745] GetCurrentObject (hdc=0x2e011afd, type=0x6) returned 0x18a002e
	[0245.745] SaveDC (hdc=0x2e011afd) returned 1
	[0245.745] GetNearestColor (hdc=0x2e011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.746] GetNearestColor (hdc=0x2e011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.746] GetNearestColor (hdc=0x2e011afd, color=0x696969) returned 0x696969
	[0245.746] GetNearestColor (hdc=0x2e011afd, color=0xa0a0a0) returned 0xa0a0a0
	[0245.746] GetNearestColor (hdc=0x2e011afd, color=0x0) returned 0x0
	[0245.746] GetNearestColor (hdc=0x2e011afd, color=0xffffff) returned 0xffffff
	[0245.746] GetNearestColor (hdc=0x2e011afd, color=0xe5e5e5) returned 0xe5e5e5
	[0245.747] GetNearestColor (hdc=0x2e011afd, color=0xd8d8d8) returned 0xd8d8d8
	[0245.747] GetNearestColor (hdc=0x2e011afd, color=0x0) returned 0x0
	[0245.747] RestoreDC (hdc=0x2e011afd, nSavedDC=-1) returned 1
	[0245.747] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2e011afd) returned 0x0
	[0245.747] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.748] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.748] CoTaskMemFree (pv=0x1b077150) 
	[0245.748] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0245.748] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.748] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.748] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.748] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0245.748] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0245.749] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0245.749] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0245.749] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0245.749] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.749] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.749] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.749] CoTaskMemFree (pv=0x1b077150) 
	[0245.749] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0245.750] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0245.750] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0245.750] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0245.750] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.750] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.750] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.751] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0245.751] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.751] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0245.751] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.751] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.751] CoTaskMemFree (pv=0x1b077150) 
	[0245.751] GdipCreateRegion (region=0x20c310) returned 0x0
	[0245.752] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.752] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0245.752] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0245.752] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0245.752] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0245.752] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0245.753] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0245.753] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0245.753] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0245.753] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0245.753] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.753] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0245.753] GetCurrentObject (hdc=0x2e011afd, type=0x1) returned 0x1b00017
	[0245.754] GetCurrentObject (hdc=0x2e011afd, type=0x2) returned 0x1900010
	[0245.754] GetCurrentObject (hdc=0x2e011afd, type=0x7) returned 0x140507d2
	[0245.754] GetCurrentObject (hdc=0x2e011afd, type=0x6) returned 0x18a002e
	[0245.754] SaveDC (hdc=0x2e011afd) returned 1
	[0245.754] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9c040710
	[0245.754] GetClipRgn (hdc=0x2e011afd, hrgn=0xffffffff9c040710) returned 0
	[0245.755] SelectClipRgn (hdc=0x2e011afd, hrgn=0x280407f9) returned 2
	[0245.755] DeleteObject (ho=0xffffffff9c040710) returned 1
	[0245.755] DeleteObject (ho=0x280407f9) returned 1
	[0245.755] OffsetViewportOrgEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x26b6360 | out: lppt=0x26b6360) returned 1
	[0245.755] GetNearestColor (hdc=0x2e011afd, color=0xf0f0f0) returned 0xf0f0f0
	[0245.755] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff881007c0
	[0245.756] FillRect (hDC=0x2e011afd, lprc=0x20c3c0, hbr=0xffffffff881007c0) returned 1
	[0245.756] DeleteObject (ho=0xffffffff881007c0) returned 1
	[0245.756] RestoreDC (hdc=0x2e011afd, nSavedDC=-1) returned 1
	[0245.756] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2e011afd) returned 0x0
	[0245.756] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.756] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.757] CoTaskMemFree (pv=0x1b077150) 
	[0245.757] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0245.757] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.757] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0245.757] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0245.757] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0245.757] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0245.758] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0245.758] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0245.758] GetFocus () returned 0x0
	[0245.758] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0245.842] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0245.842] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0245.843] CoTaskMemFree (pv=0x1b077150) 
	[0245.843] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0245.843] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0245.844] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0245.844] GdipCreateRegion (region=0x20c260) returned 0x0
	[0245.844] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0245.844] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0245.844] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0245.844] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0245.845] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0245.845] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0245.845] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0245.845] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0245.845] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0245.845] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0245.846] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0245.846] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0245.846] GetCurrentObject (hdc=0x2e011afd, type=0x1) returned 0x1b00017
	[0245.846] GetCurrentObject (hdc=0x2e011afd, type=0x2) returned 0x1900010
	[0245.846] GetCurrentObject (hdc=0x2e011afd, type=0x7) returned 0x140507d2
	[0245.847] GetCurrentObject (hdc=0x2e011afd, type=0x6) returned 0x18a002e
	[0245.847] SaveDC (hdc=0x2e011afd) returned 1
	[0245.847] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x290407f9
	[0245.847] GetClipRgn (hdc=0x2e011afd, hrgn=0x290407f9) returned 0
	[0245.847] SelectClipRgn (hdc=0x2e011afd, hrgn=0xffffffff9d040710) returned 2
	[0245.848] DeleteObject (ho=0x290407f9) returned 1
	[0245.848] DeleteObject (ho=0xffffffff9d040710) returned 1
	[0245.848] OffsetViewportOrgEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x26b6900 | out: lppt=0x26b6900) returned 1
	[0245.848] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.848] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.849] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.849] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x9301b0e
	[0245.849] SelectObject (hdc=0x2e011afd, h=0x9301b0e) returned 0x1b00017
	[0245.849] MoveToEx (in: hdc=0x2e011afd, x=126, y=1, lppt=0x26b6968 | out: lppt=0x26b6968) returned 1
	[0245.849] LineTo (hdc=0x2e011afd, x=1, y=1) returned 1
	[0245.849] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.850] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.850] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.850] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.850] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.850] SelectObject (hdc=0x2e011afd, h=0x9301b0e) returned 0x9301b0e
	[0245.850] MoveToEx (in: hdc=0x2e011afd, x=1, y=1, lppt=0x26b6980 | out: lppt=0x26b6980) returned 1
	[0245.851] LineTo (hdc=0x2e011afd, x=1, y=39) returned 1
	[0245.851] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.851] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.851] SelectObject (hdc=0x2e011afd, h=0x1b00017) returned 0x9301b0e
	[0245.851] DeleteObject (ho=0x9301b0e) returned 1
	[0245.852] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.852] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.854] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.855] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1130198f
	[0245.855] SelectObject (hdc=0x2e011afd, h=0x1130198f) returned 0x1b00017
	[0245.855] MoveToEx (in: hdc=0x2e011afd, x=1, y=39, lppt=0x26b69e8 | out: lppt=0x26b69e8) returned 1
	[0245.855] LineTo (hdc=0x2e011afd, x=126, y=39) returned 1
	[0245.855] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.856] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.856] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.856] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.856] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.856] SelectObject (hdc=0x2e011afd, h=0x1130198f) returned 0x1130198f
	[0245.856] MoveToEx (in: hdc=0x2e011afd, x=126, y=39, lppt=0x26b6a00 | out: lppt=0x26b6a00) returned 1
	[0245.857] LineTo (hdc=0x2e011afd, x=126, y=0) returned 1
	[0245.857] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.857] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.857] SelectObject (hdc=0x2e011afd, h=0x1b00017) returned 0x1130198f
	[0245.857] DeleteObject (ho=0x1130198f) returned 1
	[0245.858] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.858] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.858] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.858] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xa301b0e
	[0245.858] SelectObject (hdc=0x2e011afd, h=0xa301b0e) returned 0x1b00017
	[0245.859] MoveToEx (in: hdc=0x2e011afd, x=125, y=2, lppt=0x26b6a68 | out: lppt=0x26b6a68) returned 1
	[0245.859] LineTo (hdc=0x2e011afd, x=2, y=2) returned 1
	[0245.859] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.859] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.859] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.860] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.860] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.860] SelectObject (hdc=0x2e011afd, h=0xa301b0e) returned 0xa301b0e
	[0245.860] MoveToEx (in: hdc=0x2e011afd, x=2, y=2, lppt=0x26b6a80 | out: lppt=0x26b6a80) returned 1
	[0245.860] LineTo (hdc=0x2e011afd, x=2, y=38) returned 1
	[0245.860] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.861] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.861] SelectObject (hdc=0x2e011afd, h=0x1b00017) returned 0xa301b0e
	[0245.861] DeleteObject (ho=0xa301b0e) returned 1
	[0245.861] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.861] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.862] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.862] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1230198f
	[0245.862] SelectObject (hdc=0x2e011afd, h=0x1230198f) returned 0x1b00017
	[0245.862] MoveToEx (in: hdc=0x2e011afd, x=2, y=38, lppt=0x26b6ae8 | out: lppt=0x26b6ae8) returned 1
	[0245.862] LineTo (hdc=0x2e011afd, x=125, y=38) returned 1
	[0245.863] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.863] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.863] GetROP2 (hdc=0x2e011afd) returned 13
	[0245.863] GetBkMode (hdc=0x2e011afd) returned 2
	[0245.863] SetBkMode (hdc=0x2e011afd, mode=1) returned 2
	[0245.863] SelectObject (hdc=0x2e011afd, h=0x1230198f) returned 0x1230198f
	[0245.864] MoveToEx (in: hdc=0x2e011afd, x=125, y=38, lppt=0x26b6b00 | out: lppt=0x26b6b00) returned 1
	[0245.864] LineTo (hdc=0x2e011afd, x=125, y=1) returned 1
	[0245.864] SetBkMode (hdc=0x2e011afd, mode=2) returned 1
	[0245.864] MoveToEx (in: hdc=0x2e011afd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0245.864] SelectObject (hdc=0x2e011afd, h=0x1b00017) returned 0x1230198f
	[0245.864] DeleteObject (ho=0x1230198f) returned 1
	[0245.865] RestoreDC (hdc=0x2e011afd, nSavedDC=-1) returned 1
	[0245.865] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2e011afd) returned 0x0
	[0245.865] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0245.865] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0x2e011afd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0245.865] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2e011afd) returned 0x0
	[0245.866] SelectObject (hdc=0x2e011afd, h=0x185000f) returned 0x140507d2
	[0245.866] DeleteDC (hdc=0x2e011afd) returned 1
	[0245.866] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0245.866] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0245.866] EndPaint (hWnd=0x401b4, lpPaint=0x20cbd8) returned 1
	[0245.867] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e90307) returned 0x1
	[0245.867] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0245.874] GetCapture () returned 0x0
	[0245.874] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0245.874] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0245.874] WaitMessage () returned 1
	[0246.066] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0246.066] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0246.066] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0246.066] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0246.066] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0246.066] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0246.066] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0246.066] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0246.066] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0246.066] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0246.066] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0246.066] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0246.066] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0246.066] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0246.066] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0246.066] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0246.066] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0246.066] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0246.066] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0246.067] CreateCompatibleDC (hdc=0x48010f97) returned 0xa011734
	[0246.067] SelectObject (hdc=0xa011734, h=0x140507d2) returned 0x185000f
	[0246.067] GdipCreateFromHDC (hdc=0xa011734, graphics=0x20d7e0) returned 0x0
	[0246.068] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0246.068] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0246.068] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0246.068] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0246.068] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0246.068] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0246.069] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0246.069] GdipCreateRegion (region=0x20d910) returned 0x0
	[0246.069] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0246.069] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0246.069] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0246.069] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff97f0dbd) returned 0x0
	[0246.069] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0246.070] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0246.070] GetCurrentObject (hdc=0xa011734, type=0x1) returned 0x1b00017
	[0246.070] GetCurrentObject (hdc=0xa011734, type=0x2) returned 0x1900010
	[0246.070] GetCurrentObject (hdc=0xa011734, type=0x7) returned 0x140507d2
	[0246.070] GetCurrentObject (hdc=0xa011734, type=0x6) returned 0x18a002e
	[0246.070] SaveDC (hdc=0xa011734) returned 1
	[0246.071] GetNearestColor (hdc=0xa011734, color=0xf0f0f0) returned 0xf0f0f0
	[0246.071] GetNearestColor (hdc=0xa011734, color=0xa0a0a0) returned 0xa0a0a0
	[0246.071] GetNearestColor (hdc=0xa011734, color=0x696969) returned 0x696969
	[0246.071] GetNearestColor (hdc=0xa011734, color=0xa0a0a0) returned 0xa0a0a0
	[0246.071] GetNearestColor (hdc=0xa011734, color=0x0) returned 0x0
	[0246.072] GetNearestColor (hdc=0xa011734, color=0xffffff) returned 0xffffff
	[0246.072] GetNearestColor (hdc=0xa011734, color=0xe5e5e5) returned 0xe5e5e5
	[0246.072] GetNearestColor (hdc=0xa011734, color=0xd8d8d8) returned 0xd8d8d8
	[0246.072] GetNearestColor (hdc=0xa011734, color=0x0) returned 0x0
	[0246.072] RestoreDC (hdc=0xa011734, nSavedDC=-1) returned 1
	[0246.072] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011734) returned 0x0
	[0246.073] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0246.073] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0246.073] CoTaskMemFree (pv=0x1b067a00) 
	[0246.073] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0246.073] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0246.073] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0246.073] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0246.073] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0246.074] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0246.074] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0246.074] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0246.074] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0246.074] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0246.075] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0246.075] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0246.075] CoTaskMemFree (pv=0x1b067a00) 
	[0246.075] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0246.075] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0246.075] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0246.075] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0246.075] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0246.076] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0246.076] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0246.076] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0246.076] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0246.076] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0246.076] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0246.077] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0246.077] CoTaskMemFree (pv=0x1b067a00) 
	[0246.077] GdipCreateRegion (region=0x20d120) returned 0x0
	[0246.077] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0246.077] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0246.077] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0246.077] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0246.077] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0246.078] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0246.078] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0246.078] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0246.078] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0246.078] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0246.078] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0246.079] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0246.079] GetCurrentObject (hdc=0xa011734, type=0x1) returned 0x1b00017
	[0246.079] GetCurrentObject (hdc=0xa011734, type=0x2) returned 0x1900010
	[0246.079] GetCurrentObject (hdc=0xa011734, type=0x7) returned 0x140507d2
	[0246.079] GetCurrentObject (hdc=0xa011734, type=0x6) returned 0x18a002e
	[0246.079] SaveDC (hdc=0xa011734) returned 1
	[0246.080] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9e040710
	[0246.080] GetClipRgn (hdc=0xa011734, hrgn=0xffffffff9e040710) returned 0
	[0246.080] SelectClipRgn (hdc=0xa011734, hrgn=0x2a0407f9) returned 2
	[0246.080] DeleteObject (ho=0xffffffff9e040710) returned 1
	[0246.080] DeleteObject (ho=0x2a0407f9) returned 1
	[0246.080] OffsetViewportOrgEx (in: hdc=0xa011734, x=0, y=0, lppt=0x26b77f8 | out: lppt=0x26b77f8) returned 1
	[0246.081] GetNearestColor (hdc=0xa011734, color=0xf0f0f0) returned 0xf0f0f0
	[0246.081] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff891007c0
	[0246.081] FillRect (hDC=0xa011734, lprc=0x20d1d0, hbr=0xffffffff891007c0) returned 1
	[0246.081] DeleteObject (ho=0xffffffff891007c0) returned 1
	[0246.081] RestoreDC (hdc=0xa011734, nSavedDC=-1) returned 1
	[0246.081] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011734) returned 0x0
	[0246.082] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0246.082] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0246.082] CoTaskMemFree (pv=0x1b067a00) 
	[0246.082] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0246.082] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0246.082] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0246.082] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0246.083] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0246.083] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0246.083] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0246.083] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0246.083] GetFocus () returned 0x0
	[0246.083] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0246.083] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0246.084] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0246.084] CoTaskMemFree (pv=0x1b067a00) 
	[0246.084] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0246.084] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0246.084] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0246.084] GdipCreateRegion (region=0x20d070) returned 0x0
	[0246.084] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0246.084] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0246.085] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0246.085] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0246.085] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0246.085] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0246.085] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0246.085] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0246.086] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0246.086] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0246.086] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0246.086] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0246.086] GetCurrentObject (hdc=0xa011734, type=0x1) returned 0x1b00017
	[0246.087] GetCurrentObject (hdc=0xa011734, type=0x2) returned 0x1900010
	[0246.087] GetCurrentObject (hdc=0xa011734, type=0x7) returned 0x140507d2
	[0246.087] GetCurrentObject (hdc=0xa011734, type=0x6) returned 0x18a002e
	[0246.087] SaveDC (hdc=0xa011734) returned 1
	[0246.087] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2b0407f9
	[0246.087] GetClipRgn (hdc=0xa011734, hrgn=0x2b0407f9) returned 0
	[0246.088] SelectClipRgn (hdc=0xa011734, hrgn=0xffffffff9f040710) returned 2
	[0246.088] DeleteObject (ho=0x2b0407f9) returned 1
	[0246.088] DeleteObject (ho=0xffffffff9f040710) returned 1
	[0246.088] OffsetViewportOrgEx (in: hdc=0xa011734, x=0, y=0, lppt=0x26b7d98 | out: lppt=0x26b7d98) returned 1
	[0246.088] GetROP2 (hdc=0xa011734) returned 13
	[0246.088] GetBkMode (hdc=0xa011734) returned 2
	[0246.088] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.089] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x30301afd
	[0246.089] SelectObject (hdc=0xa011734, h=0x30301afd) returned 0x1b00017
	[0246.089] MoveToEx (in: hdc=0xa011734, x=164, y=1, lppt=0x26b7e00 | out: lppt=0x26b7e00) returned 1
	[0246.089] LineTo (hdc=0xa011734, x=1, y=1) returned 1
	[0246.089] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.089] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.090] GetROP2 (hdc=0xa011734) returned 13
	[0246.090] GetBkMode (hdc=0xa011734) returned 2
	[0246.090] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.090] SelectObject (hdc=0xa011734, h=0x30301afd) returned 0x30301afd
	[0246.090] MoveToEx (in: hdc=0xa011734, x=1, y=1, lppt=0x26b7e18 | out: lppt=0x26b7e18) returned 1
	[0246.090] LineTo (hdc=0xa011734, x=1, y=41) returned 1
	[0246.091] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.091] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.091] SelectObject (hdc=0xa011734, h=0x1b00017) returned 0x30301afd
	[0246.091] DeleteObject (ho=0x30301afd) returned 1
	[0246.091] GetROP2 (hdc=0xa011734) returned 13
	[0246.091] GetBkMode (hdc=0xa011734) returned 2
	[0246.092] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.092] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xa301b10
	[0246.092] SelectObject (hdc=0xa011734, h=0xa301b10) returned 0x1b00017
	[0246.092] MoveToEx (in: hdc=0xa011734, x=1, y=41, lppt=0x26b7e80 | out: lppt=0x26b7e80) returned 1
	[0246.092] LineTo (hdc=0xa011734, x=164, y=41) returned 1
	[0246.092] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.093] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.093] GetROP2 (hdc=0xa011734) returned 13
	[0246.093] GetBkMode (hdc=0xa011734) returned 2
	[0246.093] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.093] SelectObject (hdc=0xa011734, h=0xa301b10) returned 0xa301b10
	[0246.093] MoveToEx (in: hdc=0xa011734, x=164, y=41, lppt=0x26b7e98 | out: lppt=0x26b7e98) returned 1
	[0246.094] LineTo (hdc=0xa011734, x=164, y=0) returned 1
	[0246.094] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.094] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.094] SelectObject (hdc=0xa011734, h=0x1b00017) returned 0xa301b10
	[0246.094] DeleteObject (ho=0xa301b10) returned 1
	[0246.094] GetROP2 (hdc=0xa011734) returned 13
	[0246.094] GetBkMode (hdc=0xa011734) returned 2
	[0246.095] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.095] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x31301afd
	[0246.095] SelectObject (hdc=0xa011734, h=0x31301afd) returned 0x1b00017
	[0246.095] MoveToEx (in: hdc=0xa011734, x=163, y=2, lppt=0x26b7f00 | out: lppt=0x26b7f00) returned 1
	[0246.095] LineTo (hdc=0xa011734, x=2, y=2) returned 1
	[0246.095] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.096] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.096] GetROP2 (hdc=0xa011734) returned 13
	[0246.096] GetBkMode (hdc=0xa011734) returned 2
	[0246.096] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.096] SelectObject (hdc=0xa011734, h=0x31301afd) returned 0x31301afd
	[0246.096] MoveToEx (in: hdc=0xa011734, x=2, y=2, lppt=0x26b7f18 | out: lppt=0x26b7f18) returned 1
	[0246.097] LineTo (hdc=0xa011734, x=2, y=40) returned 1
	[0246.097] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.097] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.097] SelectObject (hdc=0xa011734, h=0x1b00017) returned 0x31301afd
	[0246.097] DeleteObject (ho=0x31301afd) returned 1
	[0246.097] GetROP2 (hdc=0xa011734) returned 13
	[0246.097] GetBkMode (hdc=0xa011734) returned 2
	[0246.098] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.098] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xb301b10
	[0246.098] SelectObject (hdc=0xa011734, h=0xb301b10) returned 0x1b00017
	[0246.098] MoveToEx (in: hdc=0xa011734, x=2, y=40, lppt=0x26b7f80 | out: lppt=0x26b7f80) returned 1
	[0246.098] LineTo (hdc=0xa011734, x=163, y=40) returned 1
	[0246.099] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.099] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.099] GetROP2 (hdc=0xa011734) returned 13
	[0246.099] GetBkMode (hdc=0xa011734) returned 2
	[0246.099] SetBkMode (hdc=0xa011734, mode=1) returned 2
	[0246.099] SelectObject (hdc=0xa011734, h=0xb301b10) returned 0xb301b10
	[0246.099] MoveToEx (in: hdc=0xa011734, x=163, y=40, lppt=0x26b7f98 | out: lppt=0x26b7f98) returned 1
	[0246.100] LineTo (hdc=0xa011734, x=163, y=1) returned 1
	[0246.100] SetBkMode (hdc=0xa011734, mode=2) returned 1
	[0246.100] MoveToEx (in: hdc=0xa011734, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0246.100] SelectObject (hdc=0xa011734, h=0x1b00017) returned 0xb301b10
	[0246.100] DeleteObject (ho=0xb301b10) returned 1
	[0246.100] RestoreDC (hdc=0xa011734, nSavedDC=-1) returned 1
	[0246.101] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011734) returned 0x0
	[0246.101] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0246.101] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0xa011734, x1=0, y1=0, rop=0xcc0020) returned 1
	[0246.101] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xa011734) returned 0x0
	[0246.103] SelectObject (hdc=0xa011734, h=0x185000f) returned 0x140507d2
	[0246.103] DeleteDC (hdc=0xa011734) returned 1
	[0246.103] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0246.104] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0246.104] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0246.104] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0246.104] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0246.104] WaitMessage () returned 1
	[0248.498] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.498] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.499] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.499] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.499] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.499] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0248.499] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.499] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0248.499] _TrackMouseEvent (in: lpEventTrack=0x26470f0 | out: lpEventTrack=0x26470f0) returned 1
	[0248.499] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0248.499] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0248.499] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0248.499] GetKeyState (nVirtKey=1) returned 0
	[0248.499] GetKeyState (nVirtKey=2) returned 0
	[0248.499] GetKeyState (nVirtKey=4) returned 0
	[0248.499] GetKeyState (nVirtKey=5) returned 0
	[0248.499] GetKeyState (nVirtKey=6) returned 0
	[0248.499] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.499] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.499] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.499] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.499] DispatchMessageW (lpMsg=0x20e6b0) returned 0xd301b68
	[0248.499] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0248.499] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0248.500] CreateCompatibleDC (hdc=0x70107fc) returned 0x35011b07
	[0248.500] SelectObject (hdc=0x35011b07, h=0x140507d2) returned 0x185000f
	[0248.500] GdipCreateFromHDC (hdc=0x35011b07, graphics=0x20d7e0) returned 0x0
	[0248.501] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0248.501] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0248.501] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0248.501] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0248.501] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0248.502] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.502] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0248.502] GdipCreateRegion (region=0x20d910) returned 0x0
	[0248.502] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.502] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0248.502] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0248.503] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff97c0dbd) returned 0x0
	[0248.503] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.503] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0248.503] GetCurrentObject (hdc=0x35011b07, type=0x1) returned 0x1b00017
	[0248.503] GetCurrentObject (hdc=0x35011b07, type=0x2) returned 0x1900010
	[0248.503] GetCurrentObject (hdc=0x35011b07, type=0x7) returned 0x140507d2
	[0248.504] GetCurrentObject (hdc=0x35011b07, type=0x6) returned 0x18a002e
	[0248.504] SaveDC (hdc=0x35011b07) returned 1
	[0248.504] GetNearestColor (hdc=0x35011b07, color=0xf0f0f0) returned 0xf0f0f0
	[0248.504] GetNearestColor (hdc=0x35011b07, color=0xa0a0a0) returned 0xa0a0a0
	[0248.504] GetNearestColor (hdc=0x35011b07, color=0x696969) returned 0x696969
	[0248.505] GetNearestColor (hdc=0x35011b07, color=0xa0a0a0) returned 0xa0a0a0
	[0248.505] GetNearestColor (hdc=0x35011b07, color=0x0) returned 0x0
	[0248.506] GetNearestColor (hdc=0x35011b07, color=0xffffff) returned 0xffffff
	[0248.506] GetNearestColor (hdc=0x35011b07, color=0xe5e5e5) returned 0xe5e5e5
	[0248.506] GetNearestColor (hdc=0x35011b07, color=0xd8d8d8) returned 0xd8d8d8
	[0248.506] GetNearestColor (hdc=0x35011b07, color=0x0) returned 0x0
	[0248.506] RestoreDC (hdc=0x35011b07, nSavedDC=-1) returned 1
	[0248.506] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35011b07) returned 0x0
	[0248.507] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0248.507] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.507] CoTaskMemFree (pv=0x1b067a00) 
	[0248.507] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0248.507] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.507] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.508] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.508] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0248.508] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0248.508] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0248.508] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0248.509] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0248.509] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.509] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0248.510] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.510] CoTaskMemFree (pv=0x1b067a00) 
	[0248.510] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0248.510] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0248.510] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0248.510] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0248.511] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.511] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.511] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.511] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0248.511] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.512] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0248.512] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0248.512] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.512] CoTaskMemFree (pv=0x1b067a00) 
	[0248.512] GdipCreateRegion (region=0x20d120) returned 0x0
	[0248.513] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.513] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0248.513] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0248.513] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0248.513] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.513] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.514] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0248.514] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0248.514] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0248.514] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0248.514] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.514] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0248.515] GetCurrentObject (hdc=0x35011b07, type=0x1) returned 0x1b00017
	[0248.515] GetCurrentObject (hdc=0x35011b07, type=0x2) returned 0x1900010
	[0248.515] GetCurrentObject (hdc=0x35011b07, type=0x7) returned 0x140507d2
	[0248.516] GetCurrentObject (hdc=0x35011b07, type=0x6) returned 0x18a002e
	[0248.516] SaveDC (hdc=0x35011b07) returned 1
	[0248.516] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa0040710
	[0248.516] GetClipRgn (hdc=0x35011b07, hrgn=0xffffffffa0040710) returned 0
	[0248.516] SelectClipRgn (hdc=0x35011b07, hrgn=0x2c0407f9) returned 2
	[0248.517] DeleteObject (ho=0xffffffffa0040710) returned 1
	[0248.517] DeleteObject (ho=0x2c0407f9) returned 1
	[0248.517] OffsetViewportOrgEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x26b8c90 | out: lppt=0x26b8c90) returned 1
	[0248.517] GetNearestColor (hdc=0x35011b07, color=0xf0f0f0) returned 0xf0f0f0
	[0248.517] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff8a1007c0
	[0248.518] FillRect (hDC=0x35011b07, lprc=0x20d1d0, hbr=0xffffffff8a1007c0) returned 1
	[0248.518] DeleteObject (ho=0xffffffff8a1007c0) returned 1
	[0248.518] RestoreDC (hdc=0x35011b07, nSavedDC=-1) returned 1
	[0248.518] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35011b07) returned 0x0
	[0248.518] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0248.518] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.519] CoTaskMemFree (pv=0x1b067a00) 
	[0248.519] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0248.519] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.519] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.519] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.519] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0248.520] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0248.520] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0248.520] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.520] GetFocus () returned 0x0
	[0248.520] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0248.520] CoTaskMemAlloc (cb=0x13) returned 0x1b067a00
	[0248.520] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.521] CoTaskMemFree (pv=0x1b067a00) 
	[0248.521] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0248.521] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0248.521] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0248.521] GdipCreateRegion (region=0x20d070) returned 0x0
	[0248.521] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.521] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0248.522] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0248.522] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0248.522] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.522] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.522] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0248.522] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0248.523] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0248.523] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0248.523] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.523] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0248.523] GetCurrentObject (hdc=0x35011b07, type=0x1) returned 0x1b00017
	[0248.523] GetCurrentObject (hdc=0x35011b07, type=0x2) returned 0x1900010
	[0248.524] GetCurrentObject (hdc=0x35011b07, type=0x7) returned 0x140507d2
	[0248.524] GetCurrentObject (hdc=0x35011b07, type=0x6) returned 0x18a002e
	[0248.524] SaveDC (hdc=0x35011b07) returned 1
	[0248.524] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2d0407f9
	[0248.524] GetClipRgn (hdc=0x35011b07, hrgn=0x2d0407f9) returned 0
	[0248.525] SelectClipRgn (hdc=0x35011b07, hrgn=0xffffffffa1040710) returned 2
	[0248.525] DeleteObject (ho=0x2d0407f9) returned 1
	[0248.525] DeleteObject (ho=0xffffffffa1040710) returned 1
	[0248.525] OffsetViewportOrgEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x26b9230 | out: lppt=0x26b9230) returned 1
	[0248.525] GetROP2 (hdc=0x35011b07) returned 13
	[0248.526] GetBkMode (hdc=0x35011b07) returned 2
	[0248.526] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.526] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x10301b64
	[0248.526] SelectObject (hdc=0x35011b07, h=0x10301b64) returned 0x1b00017
	[0248.527] MoveToEx (in: hdc=0x35011b07, x=164, y=1, lppt=0x26b9298 | out: lppt=0x26b9298) returned 1
	[0248.527] LineTo (hdc=0x35011b07, x=1, y=1) returned 1
	[0248.527] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.527] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.527] GetROP2 (hdc=0x35011b07) returned 13
	[0248.528] GetBkMode (hdc=0x35011b07) returned 2
	[0248.528] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.528] SelectObject (hdc=0x35011b07, h=0x10301b64) returned 0x10301b64
	[0248.528] MoveToEx (in: hdc=0x35011b07, x=1, y=1, lppt=0x26b92b0 | out: lppt=0x26b92b0) returned 1
	[0248.528] LineTo (hdc=0x35011b07, x=1, y=41) returned 1
	[0248.529] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.529] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.529] SelectObject (hdc=0x35011b07, h=0x1b00017) returned 0x10301b64
	[0248.529] DeleteObject (ho=0x10301b64) returned 1
	[0248.529] GetROP2 (hdc=0x35011b07) returned 13
	[0248.530] GetBkMode (hdc=0x35011b07) returned 2
	[0248.530] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.530] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xa301b62
	[0248.530] SelectObject (hdc=0x35011b07, h=0xa301b62) returned 0x1b00017
	[0248.530] MoveToEx (in: hdc=0x35011b07, x=1, y=41, lppt=0x26b9318 | out: lppt=0x26b9318) returned 1
	[0248.531] LineTo (hdc=0x35011b07, x=164, y=41) returned 1
	[0248.531] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.531] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.531] GetROP2 (hdc=0x35011b07) returned 13
	[0248.531] GetBkMode (hdc=0x35011b07) returned 2
	[0248.531] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.532] SelectObject (hdc=0x35011b07, h=0xa301b62) returned 0xa301b62
	[0248.532] MoveToEx (in: hdc=0x35011b07, x=164, y=41, lppt=0x26b9330 | out: lppt=0x26b9330) returned 1
	[0248.532] LineTo (hdc=0x35011b07, x=164, y=0) returned 1
	[0248.532] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.532] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.533] SelectObject (hdc=0x35011b07, h=0x1b00017) returned 0xa301b62
	[0248.594] DeleteObject (ho=0xa301b62) returned 1
	[0248.594] GetROP2 (hdc=0x35011b07) returned 13
	[0248.594] GetBkMode (hdc=0x35011b07) returned 2
	[0248.594] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.595] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xd301b68
	[0248.595] SelectObject (hdc=0x35011b07, h=0xd301b68) returned 0x1b00017
	[0248.595] MoveToEx (in: hdc=0x35011b07, x=163, y=2, lppt=0x26b9398 | out: lppt=0x26b9398) returned 1
	[0248.595] LineTo (hdc=0x35011b07, x=2, y=2) returned 1
	[0248.596] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.596] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.596] GetROP2 (hdc=0x35011b07) returned 13
	[0248.596] GetBkMode (hdc=0x35011b07) returned 2
	[0248.596] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.597] SelectObject (hdc=0x35011b07, h=0xd301b68) returned 0xd301b68
	[0248.597] MoveToEx (in: hdc=0x35011b07, x=2, y=2, lppt=0x26b93b0 | out: lppt=0x26b93b0) returned 1
	[0248.597] LineTo (hdc=0x35011b07, x=2, y=40) returned 1
	[0248.597] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.597] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.598] SelectObject (hdc=0x35011b07, h=0x1b00017) returned 0xd301b68
	[0248.598] DeleteObject (ho=0xd301b68) returned 1
	[0248.598] GetROP2 (hdc=0x35011b07) returned 13
	[0248.598] GetBkMode (hdc=0x35011b07) returned 2
	[0248.598] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.598] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xb301b62
	[0248.599] SelectObject (hdc=0x35011b07, h=0xb301b62) returned 0x1b00017
	[0248.599] MoveToEx (in: hdc=0x35011b07, x=2, y=40, lppt=0x26b9418 | out: lppt=0x26b9418) returned 1
	[0248.599] LineTo (hdc=0x35011b07, x=163, y=40) returned 1
	[0248.599] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.599] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.600] GetROP2 (hdc=0x35011b07) returned 13
	[0248.600] GetBkMode (hdc=0x35011b07) returned 2
	[0248.600] SetBkMode (hdc=0x35011b07, mode=1) returned 2
	[0248.600] SelectObject (hdc=0x35011b07, h=0xb301b62) returned 0xb301b62
	[0248.600] MoveToEx (in: hdc=0x35011b07, x=163, y=40, lppt=0x26b9430 | out: lppt=0x26b9430) returned 1
	[0248.600] LineTo (hdc=0x35011b07, x=163, y=1) returned 1
	[0248.601] SetBkMode (hdc=0x35011b07, mode=2) returned 1
	[0248.601] MoveToEx (in: hdc=0x35011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.601] SelectObject (hdc=0x35011b07, h=0x1b00017) returned 0xb301b62
	[0248.601] DeleteObject (ho=0xb301b62) returned 1
	[0248.601] RestoreDC (hdc=0x35011b07, nSavedDC=-1) returned 1
	[0248.602] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35011b07) returned 0x0
	[0248.602] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0248.603] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x35011b07, x1=0, y1=0, rop=0xcc0020) returned 1
	[0248.603] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x35011b07) returned 0x0
	[0248.603] SelectObject (hdc=0x35011b07, h=0x185000f) returned 0x140507d2
	[0248.603] DeleteDC (hdc=0x35011b07) returned 1
	[0248.603] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0248.606] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0248.606] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0248.606] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.606] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.606] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.606] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.606] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.606] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0248.607] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.607] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0248.607] GetKeyState (nVirtKey=1) returned 0
	[0248.607] GetKeyState (nVirtKey=2) returned 0
	[0248.607] GetKeyState (nVirtKey=4) returned 0
	[0248.607] GetKeyState (nVirtKey=5) returned 0
	[0248.607] GetKeyState (nVirtKey=6) returned 0
	[0248.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.607] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.607] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.607] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.607] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0248.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.607] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.607] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.607] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.607] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0248.607] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x100039) returned 0x0
	[0248.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0248.607] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0248.607] WaitMessage () returned 1
	[0248.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.621] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.621] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.621] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.622] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0248.622] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.622] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0248.622] GetKeyState (nVirtKey=1) returned 0
	[0248.622] GetKeyState (nVirtKey=2) returned 0
	[0248.622] GetKeyState (nVirtKey=4) returned 0
	[0248.622] GetKeyState (nVirtKey=5) returned 0
	[0248.622] GetKeyState (nVirtKey=6) returned 0
	[0248.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0248.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0248.622] WaitMessage () returned 1
	[0248.719] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.722] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.723] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.724] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.725] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xdc0115) returned 0x0
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0248.725] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0248.725] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0248.726] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0248.726] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0248.726] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0248.726] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0248.727] GetFocus () returned 0x0
	[0248.727] SetFocus (hWnd=0x201d8) returned 0x0
	[0248.727] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0248.727] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0248.727] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0248.727] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0248.727] GetStockObject (i=5) returned 0x1900015
	[0248.728] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0248.728] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0248.728] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0248.728] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0248.728] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.728] DispatchMessageW (lpMsg=0x20e6b0) returned 0xff81
	[0248.728] GetKeyState (nVirtKey=1) returned -127
	[0248.728] GetKeyState (nVirtKey=2) returned 0
	[0248.728] GetKeyState (nVirtKey=4) returned 0
	[0248.728] GetKeyState (nVirtKey=5) returned 0
	[0248.728] GetKeyState (nVirtKey=6) returned 0
	[0248.728] IsWindowVisible (hWnd=0x201d8) returned 1
	[0248.728] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0248.728] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0248.729] GetFocus () returned 0x201d8
	[0248.729] GetFocus () returned 0x201d8
	[0248.729] GetFocus () returned 0x201d8
	[0248.729] GetKeyState (nVirtKey=1) returned -127
	[0248.729] GetKeyState (nVirtKey=2) returned 0
	[0248.729] GetKeyState (nVirtKey=4) returned 0
	[0248.729] GetKeyState (nVirtKey=5) returned 0
	[0248.729] GetKeyState (nVirtKey=6) returned 0
	[0248.729] GetCapture () returned 0x0
	[0248.729] SetCapture (hWnd=0x201d8) returned 0x0
	[0248.729] GetKeyState (nVirtKey=1) returned -127
	[0248.729] GetKeyState (nVirtKey=2) returned 0
	[0248.729] GetKeyState (nVirtKey=4) returned 0
	[0248.729] GetKeyState (nVirtKey=5) returned 0
	[0248.729] GetKeyState (nVirtKey=6) returned 0
	[0248.729] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0248.729] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0248.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.729] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.729] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.729] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0248.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.729] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.729] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.729] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0248.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.729] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0248.729] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0248.729] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0248.729] DispatchMessageW (lpMsg=0x20e6b0) returned 0x696969
	[0248.729] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26b95f8, cPoints=0x1 | out: lpPoints=0x26b95f8) returned 30606029
	[0248.729] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0248.729] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0248.729] UpdateWindow (hWnd=0x201d8) returned 1
	[0248.730] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0248.730] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0248.730] CreateCompatibleDC (hdc=0x48010f97) returned 0x4e011b07
	[0248.730] SelectObject (hdc=0x4e011b07, h=0x140507d2) returned 0x185000f
	[0248.731] GdipCreateFromHDC (hdc=0x4e011b07, graphics=0x20cfa0) returned 0x0
	[0248.731] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0248.731] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0248.731] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0248.731] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0248.732] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0248.732] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.732] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0248.732] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0248.732] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0248.732] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.733] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0248.733] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0248.733] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9790dbd) returned 0x0
	[0248.733] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.734] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0248.734] GetCurrentObject (hdc=0x4e011b07, type=0x1) returned 0x1b00017
	[0248.734] GetCurrentObject (hdc=0x4e011b07, type=0x2) returned 0x1900010
	[0248.734] GetCurrentObject (hdc=0x4e011b07, type=0x7) returned 0x140507d2
	[0248.734] GetCurrentObject (hdc=0x4e011b07, type=0x6) returned 0x18a002e
	[0248.735] SaveDC (hdc=0x4e011b07) returned 1
	[0248.735] GetNearestColor (hdc=0x4e011b07, color=0xf0f0f0) returned 0xf0f0f0
	[0248.735] GetNearestColor (hdc=0x4e011b07, color=0xa0a0a0) returned 0xa0a0a0
	[0248.736] GetNearestColor (hdc=0x4e011b07, color=0x696969) returned 0x696969
	[0248.736] GetNearestColor (hdc=0x4e011b07, color=0xa0a0a0) returned 0xa0a0a0
	[0248.736] GetNearestColor (hdc=0x4e011b07, color=0x0) returned 0x0
	[0248.736] GetNearestColor (hdc=0x4e011b07, color=0xffffff) returned 0xffffff
	[0248.736] GetNearestColor (hdc=0x4e011b07, color=0xe5e5e5) returned 0xe5e5e5
	[0248.737] GetNearestColor (hdc=0x4e011b07, color=0xd8d8d8) returned 0xd8d8d8
	[0248.737] GetNearestColor (hdc=0x4e011b07, color=0x0) returned 0x0
	[0248.737] RestoreDC (hdc=0x4e011b07, nSavedDC=-1) returned 1
	[0248.737] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4e011b07) returned 0x0
	[0248.738] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0248.738] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.742] CoTaskMemFree (pv=0x1b0679c0) 
	[0248.742] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0248.742] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.742] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.742] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.742] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0248.743] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0248.743] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0248.743] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0248.743] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0248.743] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.744] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0248.744] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.744] CoTaskMemFree (pv=0x1b0679c0) 
	[0248.744] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0248.744] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0248.744] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0248.745] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0248.745] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.745] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.745] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.746] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0248.746] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.746] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0248.746] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0248.746] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.746] CoTaskMemFree (pv=0x1b0679c0) 
	[0248.747] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0248.747] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.747] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0248.747] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0248.747] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0248.748] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.748] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0248.748] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.748] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0248.748] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0248.748] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0248.749] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0248.749] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0248.749] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.749] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0248.749] GetCurrentObject (hdc=0x4e011b07, type=0x1) returned 0x1b00017
	[0248.750] GetCurrentObject (hdc=0x4e011b07, type=0x2) returned 0x1900010
	[0248.750] GetCurrentObject (hdc=0x4e011b07, type=0x7) returned 0x140507d2
	[0248.750] GetCurrentObject (hdc=0x4e011b07, type=0x6) returned 0x18a002e
	[0248.750] SaveDC (hdc=0x4e011b07) returned 1
	[0248.750] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa2040710
	[0248.750] GetClipRgn (hdc=0x4e011b07, hrgn=0xffffffffa2040710) returned 0
	[0248.751] SelectClipRgn (hdc=0x4e011b07, hrgn=0x300407f9) returned 2
	[0248.751] DeleteObject (ho=0xffffffffa2040710) returned 1
	[0248.751] DeleteObject (ho=0x300407f9) returned 1
	[0248.751] OffsetViewportOrgEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x26ba278 | out: lppt=0x26ba278) returned 1
	[0248.751] GetNearestColor (hdc=0x4e011b07, color=0xf0f0f0) returned 0xf0f0f0
	[0248.752] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff8b1007c0
	[0248.752] FillRect (hDC=0x4e011b07, lprc=0x20c990, hbr=0xffffffff8b1007c0) returned 1
	[0248.752] DeleteObject (ho=0xffffffff8b1007c0) returned 1
	[0248.752] RestoreDC (hdc=0x4e011b07, nSavedDC=-1) returned 1
	[0248.753] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4e011b07) returned 0x0
	[0248.753] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0248.753] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.753] CoTaskMemFree (pv=0x1b0679c0) 
	[0248.753] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0248.753] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.753] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.753] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.754] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0248.754] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0248.754] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0248.754] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.754] GetFocus () returned 0x201d8
	[0248.755] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0248.755] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0248.755] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.755] CoTaskMemFree (pv=0x1b0679c0) 
	[0248.755] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0248.755] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0248.755] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0248.756] GdipCreateRegion (region=0x20c830) returned 0x0
	[0248.756] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.756] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0248.756] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0248.756] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0248.757] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.757] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0248.757] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0248.757] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0248.757] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0248.758] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0248.758] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0248.758] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0248.758] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.758] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0248.758] GetCurrentObject (hdc=0x4e011b07, type=0x1) returned 0x1b00017
	[0248.759] GetCurrentObject (hdc=0x4e011b07, type=0x2) returned 0x1900010
	[0248.759] GetCurrentObject (hdc=0x4e011b07, type=0x7) returned 0x140507d2
	[0248.759] GetCurrentObject (hdc=0x4e011b07, type=0x6) returned 0x18a002e
	[0248.759] SaveDC (hdc=0x4e011b07) returned 1
	[0248.759] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x310407f9
	[0248.760] GetClipRgn (hdc=0x4e011b07, hrgn=0x310407f9) returned 0
	[0248.760] SelectClipRgn (hdc=0x4e011b07, hrgn=0xffffffffa3040710) returned 2
	[0248.760] DeleteObject (ho=0x310407f9) returned 1
	[0248.760] DeleteObject (ho=0xffffffffa3040710) returned 1
	[0248.760] OffsetViewportOrgEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x26ba818 | out: lppt=0x26ba818) returned 1
	[0248.760] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.761] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.761] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.761] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x17301b68
	[0248.761] SelectObject (hdc=0x4e011b07, h=0x17301b68) returned 0x1b00017
	[0248.761] MoveToEx (in: hdc=0x4e011b07, x=164, y=1, lppt=0x26ba880 | out: lppt=0x26ba880) returned 1
	[0248.762] LineTo (hdc=0x4e011b07, x=1, y=1) returned 1
	[0248.762] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.762] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.762] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.762] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.762] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.763] SelectObject (hdc=0x4e011b07, h=0x17301b68) returned 0x17301b68
	[0248.763] MoveToEx (in: hdc=0x4e011b07, x=1, y=1, lppt=0x26ba898 | out: lppt=0x26ba898) returned 1
	[0248.763] LineTo (hdc=0x4e011b07, x=1, y=41) returned 1
	[0248.763] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.763] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.763] SelectObject (hdc=0x4e011b07, h=0x1b00017) returned 0x17301b68
	[0248.764] DeleteObject (ho=0x17301b68) returned 1
	[0248.764] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.764] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.764] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.764] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xb301b69
	[0248.765] SelectObject (hdc=0x4e011b07, h=0xb301b69) returned 0x1b00017
	[0248.765] MoveToEx (in: hdc=0x4e011b07, x=1, y=41, lppt=0x26ba900 | out: lppt=0x26ba900) returned 1
	[0248.765] LineTo (hdc=0x4e011b07, x=164, y=41) returned 1
	[0248.765] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.766] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.766] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.766] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.766] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.766] SelectObject (hdc=0x4e011b07, h=0xb301b69) returned 0xb301b69
	[0248.767] MoveToEx (in: hdc=0x4e011b07, x=164, y=41, lppt=0x26ba918 | out: lppt=0x26ba918) returned 1
	[0248.767] LineTo (hdc=0x4e011b07, x=164, y=0) returned 1
	[0248.767] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.767] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.767] SelectObject (hdc=0x4e011b07, h=0x1b00017) returned 0xb301b69
	[0248.767] DeleteObject (ho=0xb301b69) returned 1
	[0248.768] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.768] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.768] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.768] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x18301b68
	[0248.768] SelectObject (hdc=0x4e011b07, h=0x18301b68) returned 0x1b00017
	[0248.768] MoveToEx (in: hdc=0x4e011b07, x=163, y=2, lppt=0x26ba980 | out: lppt=0x26ba980) returned 1
	[0248.769] LineTo (hdc=0x4e011b07, x=2, y=2) returned 1
	[0248.769] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.769] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.769] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.769] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.769] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.770] SelectObject (hdc=0x4e011b07, h=0x18301b68) returned 0x18301b68
	[0248.770] MoveToEx (in: hdc=0x4e011b07, x=2, y=2, lppt=0x26ba998 | out: lppt=0x26ba998) returned 1
	[0248.770] LineTo (hdc=0x4e011b07, x=2, y=40) returned 1
	[0248.770] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.770] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.770] SelectObject (hdc=0x4e011b07, h=0x1b00017) returned 0x18301b68
	[0248.771] DeleteObject (ho=0x18301b68) returned 1
	[0248.771] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.771] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.771] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.771] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xc301b69
	[0248.771] SelectObject (hdc=0x4e011b07, h=0xc301b69) returned 0x1b00017
	[0248.772] MoveToEx (in: hdc=0x4e011b07, x=2, y=40, lppt=0x26baa00 | out: lppt=0x26baa00) returned 1
	[0248.772] LineTo (hdc=0x4e011b07, x=163, y=40) returned 1
	[0248.772] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.772] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.772] GetROP2 (hdc=0x4e011b07) returned 13
	[0248.772] GetBkMode (hdc=0x4e011b07) returned 2
	[0248.773] SetBkMode (hdc=0x4e011b07, mode=1) returned 2
	[0248.773] SelectObject (hdc=0x4e011b07, h=0xc301b69) returned 0xc301b69
	[0248.773] MoveToEx (in: hdc=0x4e011b07, x=163, y=40, lppt=0x26baa18 | out: lppt=0x26baa18) returned 1
	[0248.773] LineTo (hdc=0x4e011b07, x=163, y=1) returned 1
	[0248.773] SetBkMode (hdc=0x4e011b07, mode=2) returned 1
	[0248.773] MoveToEx (in: hdc=0x4e011b07, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.774] SelectObject (hdc=0x4e011b07, h=0x1b00017) returned 0xc301b69
	[0248.774] DeleteObject (ho=0xc301b69) returned 1
	[0248.774] RestoreDC (hdc=0x4e011b07, nSavedDC=-1) returned 1
	[0248.774] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4e011b07) returned 0x0
	[0248.774] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0248.774] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0x4e011b07, x1=0, y1=0, rop=0xcc0020) returned 1
	[0248.775] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x4e011b07) returned 0x0
	[0248.775] SelectObject (hdc=0x4e011b07, h=0x185000f) returned 0x140507d2
	[0248.775] DeleteDC (hdc=0x4e011b07) returned 1
	[0248.776] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0248.776] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0248.776] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0248.777] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26baa70, cPoints=0x1 | out: lpPoints=0x26baa70) returned 30606029
	[0248.777] WindowFromPoint (Point=0x1e300000306) returned 0x201d8
	[0248.777] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.777] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0248.777] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0248.777] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0248.777] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26bab60, Length=0x70 | out: Destination=0x1afe53a0) 
	[0248.777] ShellExecuteExW (in: pExecInfo=0x26bad70*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26bad70*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0248.816] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0248.816] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0248.816] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0248.817] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0248.817] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0248.817] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0248.818] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0248.818] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0248.818] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0248.818] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0248.818] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0248.818] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0248.818] GetStockObject (i=5) returned 0x1900015
	[0248.819] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0248.819] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0248.819] GetCapture () returned 0x0
	[0248.819] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0248.819] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0248.819] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0248.819] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x70107fc
	[0248.819] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0248.820] CreateCompatibleDC (hdc=0x70107fc) returned 0x1b011b69
	[0248.820] SelectObject (hdc=0x1b011b69, h=0x140507d2) returned 0x185000f
	[0248.820] GdipCreateFromHDC (hdc=0x1b011b69, graphics=0x20c9d0) returned 0x0
	[0248.820] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0248.820] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0248.821] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0248.821] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0248.821] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0248.821] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0248.821] LocalFree (hMem=0x1b07c740) returned 0x0
	[0248.822] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0248.822] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0248.822] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.822] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0248.822] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0248.822] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9760dbd) returned 0x0
	[0248.823] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.823] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0248.823] GetCurrentObject (hdc=0x1b011b69, type=0x1) returned 0x1b00017
	[0248.824] GetCurrentObject (hdc=0x1b011b69, type=0x2) returned 0x1900010
	[0248.824] GetCurrentObject (hdc=0x1b011b69, type=0x7) returned 0x140507d2
	[0248.824] GetCurrentObject (hdc=0x1b011b69, type=0x6) returned 0x18a002e
	[0248.824] SaveDC (hdc=0x1b011b69) returned 1
	[0248.824] GetNearestColor (hdc=0x1b011b69, color=0xf0f0f0) returned 0xf0f0f0
	[0248.824] GetNearestColor (hdc=0x1b011b69, color=0xa0a0a0) returned 0xa0a0a0
	[0248.825] GetNearestColor (hdc=0x1b011b69, color=0x696969) returned 0x696969
	[0248.825] GetNearestColor (hdc=0x1b011b69, color=0xa0a0a0) returned 0xa0a0a0
	[0248.825] GetNearestColor (hdc=0x1b011b69, color=0x0) returned 0x0
	[0248.826] GetNearestColor (hdc=0x1b011b69, color=0xffffff) returned 0xffffff
	[0248.826] GetNearestColor (hdc=0x1b011b69, color=0xe5e5e5) returned 0xe5e5e5
	[0248.826] GetNearestColor (hdc=0x1b011b69, color=0xd8d8d8) returned 0xd8d8d8
	[0248.826] GetNearestColor (hdc=0x1b011b69, color=0x0) returned 0x0
	[0248.827] RestoreDC (hdc=0x1b011b69, nSavedDC=-1) returned 1
	[0248.827] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b011b69) returned 0x0
	[0248.827] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0248.827] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.827] CoTaskMemFree (pv=0x1b077150) 
	[0248.827] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0248.828] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.828] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.828] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.828] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0248.828] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0248.828] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0248.829] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0248.829] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0248.829] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.829] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0248.829] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.829] CoTaskMemFree (pv=0x1b077150) 
	[0248.830] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0248.830] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0248.830] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0248.830] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0248.830] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.830] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.831] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.831] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0248.831] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.831] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0248.831] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0248.832] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.832] CoTaskMemFree (pv=0x1b077150) 
	[0248.832] GdipCreateRegion (region=0x20c310) returned 0x0
	[0248.832] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.832] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0248.832] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0248.832] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0248.833] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0248.833] LocalFree (hMem=0x1b07c740) returned 0x0
	[0248.833] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0248.833] LocalFree (hMem=0x1b07c740) returned 0x0
	[0248.833] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0248.834] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0248.834] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0248.834] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0248.834] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.834] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0248.835] GetCurrentObject (hdc=0x1b011b69, type=0x1) returned 0x1b00017
	[0248.835] GetCurrentObject (hdc=0x1b011b69, type=0x2) returned 0x1900010
	[0248.835] GetCurrentObject (hdc=0x1b011b69, type=0x7) returned 0x140507d2
	[0248.835] GetCurrentObject (hdc=0x1b011b69, type=0x6) returned 0x18a002e
	[0248.835] SaveDC (hdc=0x1b011b69) returned 1
	[0248.836] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa4040710
	[0248.836] GetClipRgn (hdc=0x1b011b69, hrgn=0xffffffffa4040710) returned 0
	[0248.837] SelectClipRgn (hdc=0x1b011b69, hrgn=0x340407f9) returned 2
	[0248.837] DeleteObject (ho=0xffffffffa4040710) returned 1
	[0248.837] DeleteObject (ho=0x340407f9) returned 1
	[0248.837] OffsetViewportOrgEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x26bba50 | out: lppt=0x26bba50) returned 1
	[0248.837] GetNearestColor (hdc=0x1b011b69, color=0xf0f0f0) returned 0xf0f0f0
	[0248.838] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff8c1007c0
	[0248.838] FillRect (hDC=0x1b011b69, lprc=0x20c3c0, hbr=0xffffffff8c1007c0) returned 1
	[0248.838] DeleteObject (ho=0xffffffff8c1007c0) returned 1
	[0248.838] RestoreDC (hdc=0x1b011b69, nSavedDC=-1) returned 1
	[0248.839] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b011b69) returned 0x0
	[0248.839] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0248.839] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.839] CoTaskMemFree (pv=0x1b077150) 
	[0248.839] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0248.839] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.839] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0248.840] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0248.840] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0248.840] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0248.840] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0248.840] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0248.841] GetFocus () returned 0x0
	[0248.841] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0248.841] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0248.841] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0248.841] CoTaskMemFree (pv=0x1b077150) 
	[0248.841] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0248.841] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0248.842] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0248.842] GdipCreateRegion (region=0x20c260) returned 0x0
	[0248.842] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0248.842] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0248.842] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0248.843] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0248.843] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0248.843] LocalFree (hMem=0x1b07c740) returned 0x0
	[0248.843] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0248.843] LocalFree (hMem=0x1b07c740) returned 0x0
	[0248.844] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0248.844] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0248.844] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0248.844] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0248.844] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0248.844] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0248.845] GetCurrentObject (hdc=0x1b011b69, type=0x1) returned 0x1b00017
	[0248.845] GetCurrentObject (hdc=0x1b011b69, type=0x2) returned 0x1900010
	[0248.845] GetCurrentObject (hdc=0x1b011b69, type=0x7) returned 0x140507d2
	[0248.845] GetCurrentObject (hdc=0x1b011b69, type=0x6) returned 0x18a002e
	[0248.845] SaveDC (hdc=0x1b011b69) returned 1
	[0248.846] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x350407f9
	[0248.846] GetClipRgn (hdc=0x1b011b69, hrgn=0x350407f9) returned 0
	[0248.846] SelectClipRgn (hdc=0x1b011b69, hrgn=0xffffffffa5040710) returned 2
	[0248.846] DeleteObject (ho=0x350407f9) returned 1
	[0248.847] DeleteObject (ho=0xffffffffa5040710) returned 1
	[0248.847] OffsetViewportOrgEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x26bbff0 | out: lppt=0x26bbff0) returned 1
	[0248.847] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.847] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.847] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.848] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3b301b65
	[0248.848] SelectObject (hdc=0x1b011b69, h=0x3b301b65) returned 0x1b00017
	[0248.848] MoveToEx (in: hdc=0x1b011b69, x=164, y=1, lppt=0x26bc058 | out: lppt=0x26bc058) returned 1
	[0248.848] LineTo (hdc=0x1b011b69, x=1, y=1) returned 1
	[0248.848] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.848] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.849] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.849] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.849] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.849] SelectObject (hdc=0x1b011b69, h=0x3b301b65) returned 0x3b301b65
	[0248.849] MoveToEx (in: hdc=0x1b011b69, x=1, y=1, lppt=0x26bc070 | out: lppt=0x26bc070) returned 1
	[0248.849] LineTo (hdc=0x1b011b69, x=1, y=41) returned 1
	[0248.850] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.850] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.850] SelectObject (hdc=0x1b011b69, h=0x1b00017) returned 0x3b301b65
	[0248.850] DeleteObject (ho=0x3b301b65) returned 1
	[0248.850] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.850] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.851] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.851] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x19301b68
	[0248.851] SelectObject (hdc=0x1b011b69, h=0x19301b68) returned 0x1b00017
	[0248.851] MoveToEx (in: hdc=0x1b011b69, x=1, y=41, lppt=0x26bc0d8 | out: lppt=0x26bc0d8) returned 1
	[0248.851] LineTo (hdc=0x1b011b69, x=164, y=41) returned 1
	[0248.852] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.852] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.852] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.852] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.852] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.852] SelectObject (hdc=0x1b011b69, h=0x19301b68) returned 0x19301b68
	[0248.853] MoveToEx (in: hdc=0x1b011b69, x=164, y=41, lppt=0x26bc0f0 | out: lppt=0x26bc0f0) returned 1
	[0248.853] LineTo (hdc=0x1b011b69, x=164, y=0) returned 1
	[0248.853] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.853] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.853] SelectObject (hdc=0x1b011b69, h=0x1b00017) returned 0x19301b68
	[0248.854] DeleteObject (ho=0x19301b68) returned 1
	[0248.854] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.854] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.854] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.854] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x3c301b65
	[0248.854] SelectObject (hdc=0x1b011b69, h=0x3c301b65) returned 0x1b00017
	[0248.855] MoveToEx (in: hdc=0x1b011b69, x=163, y=2, lppt=0x26bc158 | out: lppt=0x26bc158) returned 1
	[0248.855] LineTo (hdc=0x1b011b69, x=2, y=2) returned 1
	[0248.855] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.855] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.855] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.855] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.857] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.857] SelectObject (hdc=0x1b011b69, h=0x3c301b65) returned 0x3c301b65
	[0248.857] MoveToEx (in: hdc=0x1b011b69, x=2, y=2, lppt=0x26bc170 | out: lppt=0x26bc170) returned 1
	[0248.857] LineTo (hdc=0x1b011b69, x=2, y=40) returned 1
	[0248.858] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.858] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.858] SelectObject (hdc=0x1b011b69, h=0x1b00017) returned 0x3c301b65
	[0248.858] DeleteObject (ho=0x3c301b65) returned 1
	[0248.858] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.858] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.859] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.861] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1a301b68
	[0248.861] SelectObject (hdc=0x1b011b69, h=0x1a301b68) returned 0x1b00017
	[0248.861] MoveToEx (in: hdc=0x1b011b69, x=2, y=40, lppt=0x26bc1d8 | out: lppt=0x26bc1d8) returned 1
	[0248.861] LineTo (hdc=0x1b011b69, x=163, y=40) returned 1
	[0248.862] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.862] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.862] GetROP2 (hdc=0x1b011b69) returned 13
	[0248.862] GetBkMode (hdc=0x1b011b69) returned 2
	[0248.862] SetBkMode (hdc=0x1b011b69, mode=1) returned 2
	[0248.862] SelectObject (hdc=0x1b011b69, h=0x1a301b68) returned 0x1a301b68
	[0248.863] MoveToEx (in: hdc=0x1b011b69, x=163, y=40, lppt=0x26bc1f0 | out: lppt=0x26bc1f0) returned 1
	[0248.863] LineTo (hdc=0x1b011b69, x=163, y=1) returned 1
	[0248.863] SetBkMode (hdc=0x1b011b69, mode=2) returned 1
	[0248.863] MoveToEx (in: hdc=0x1b011b69, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0248.863] SelectObject (hdc=0x1b011b69, h=0x1b00017) returned 0x1a301b68
	[0248.864] DeleteObject (ho=0x1a301b68) returned 1
	[0248.864] RestoreDC (hdc=0x1b011b69, nSavedDC=-1) returned 1
	[0248.864] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b011b69) returned 0x0
	[0248.864] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0248.864] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x1b011b69, x1=0, y1=0, rop=0xcc0020) returned 1
	[0248.864] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1b011b69) returned 0x0
	[0248.865] SelectObject (hdc=0x1b011b69, h=0x185000f) returned 0x140507d2
	[0248.865] DeleteDC (hdc=0x1b011b69) returned 1
	[0248.865] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0248.865] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0248.865] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0248.866] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.866] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0248.866] GetKeyState (nVirtKey=1) returned 1
	[0248.866] GetKeyState (nVirtKey=2) returned 0
	[0248.866] GetKeyState (nVirtKey=4) returned 0
	[0248.866] GetKeyState (nVirtKey=5) returned 0
	[0248.866] GetKeyState (nVirtKey=6) returned 0
	[0248.876] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.876] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0248.876] GetKeyState (nVirtKey=1) returned 1
	[0248.876] GetKeyState (nVirtKey=2) returned 0
	[0248.876] GetKeyState (nVirtKey=4) returned 0
	[0248.876] GetKeyState (nVirtKey=5) returned 0
	[0248.876] GetKeyState (nVirtKey=6) returned 0
	[0248.878] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0248.878] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0248.878] GetKeyState (nVirtKey=1) returned 1
	[0248.878] GetKeyState (nVirtKey=2) returned 0
	[0248.878] GetKeyState (nVirtKey=4) returned 0
	[0248.878] GetKeyState (nVirtKey=5) returned 0
	[0248.878] GetKeyState (nVirtKey=6) returned 0
	[0249.107] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.107] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.107] GetKeyState (nVirtKey=1) returned 1
	[0249.108] GetKeyState (nVirtKey=2) returned 0
	[0249.108] GetKeyState (nVirtKey=4) returned 0
	[0249.108] GetKeyState (nVirtKey=5) returned 0
	[0249.108] GetKeyState (nVirtKey=6) returned 0
	[0249.255] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.255] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.255] GetKeyState (nVirtKey=1) returned 1
	[0249.255] GetKeyState (nVirtKey=2) returned 0
	[0249.255] GetKeyState (nVirtKey=4) returned 0
	[0249.255] GetKeyState (nVirtKey=5) returned 0
	[0249.255] GetKeyState (nVirtKey=6) returned 0
	[0249.296] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.297] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.297] GetKeyState (nVirtKey=1) returned 1
	[0249.297] GetKeyState (nVirtKey=2) returned 0
	[0249.297] GetKeyState (nVirtKey=4) returned 0
	[0249.297] GetKeyState (nVirtKey=5) returned 0
	[0249.297] GetKeyState (nVirtKey=6) returned 0
	[0249.299] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.299] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.299] GetKeyState (nVirtKey=1) returned 1
	[0249.299] GetKeyState (nVirtKey=2) returned 0
	[0249.299] GetKeyState (nVirtKey=4) returned 0
	[0249.299] GetKeyState (nVirtKey=5) returned 0
	[0249.299] GetKeyState (nVirtKey=6) returned 0
	[0249.304] GetCapture () returned 0x0
	[0249.304] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.304] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.304] WaitMessage () returned 1
	[0249.312] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.312] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.313] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.313] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.313] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.313] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.313] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.313] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.313] GetKeyState (nVirtKey=1) returned 1
	[0249.313] GetKeyState (nVirtKey=2) returned 0
	[0249.313] GetKeyState (nVirtKey=4) returned 0
	[0249.313] GetKeyState (nVirtKey=5) returned 0
	[0249.313] GetKeyState (nVirtKey=6) returned 0
	[0249.313] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.313] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.313] WaitMessage () returned 1
	[0249.316] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.316] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.316] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.316] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.316] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.316] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.316] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.316] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.316] GetKeyState (nVirtKey=1) returned 1
	[0249.316] GetKeyState (nVirtKey=2) returned 0
	[0249.316] GetKeyState (nVirtKey=4) returned 0
	[0249.316] GetKeyState (nVirtKey=5) returned 0
	[0249.316] GetKeyState (nVirtKey=6) returned 0
	[0249.316] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.316] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.317] WaitMessage () returned 1
	[0249.318] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.318] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.318] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.318] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.318] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.318] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.318] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.318] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.318] GetKeyState (nVirtKey=1) returned 1
	[0249.318] GetKeyState (nVirtKey=2) returned 0
	[0249.318] GetKeyState (nVirtKey=4) returned 0
	[0249.318] GetKeyState (nVirtKey=5) returned 0
	[0249.318] GetKeyState (nVirtKey=6) returned 0
	[0249.318] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.318] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.318] WaitMessage () returned 1
	[0249.319] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.319] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.319] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.319] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.319] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.319] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.319] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.319] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.319] GetKeyState (nVirtKey=1) returned 1
	[0249.319] GetKeyState (nVirtKey=2) returned 0
	[0249.319] GetKeyState (nVirtKey=4) returned 0
	[0249.320] GetKeyState (nVirtKey=5) returned 0
	[0249.320] GetKeyState (nVirtKey=6) returned 0
	[0249.320] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.320] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.320] WaitMessage () returned 1
	[0249.320] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.320] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.320] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.320] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.320] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.321] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.321] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.321] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.321] GetKeyState (nVirtKey=1) returned 1
	[0249.321] GetKeyState (nVirtKey=2) returned 0
	[0249.321] GetKeyState (nVirtKey=4) returned 0
	[0249.321] GetKeyState (nVirtKey=5) returned 0
	[0249.321] GetKeyState (nVirtKey=6) returned 0
	[0249.321] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.321] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.321] WaitMessage () returned 1
	[0249.322] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.322] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.322] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.322] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.322] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.323] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.323] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.323] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0249.323] GetKeyState (nVirtKey=1) returned 1
	[0249.323] GetKeyState (nVirtKey=2) returned 0
	[0249.323] GetKeyState (nVirtKey=4) returned 0
	[0249.323] GetKeyState (nVirtKey=5) returned 0
	[0249.323] GetKeyState (nVirtKey=6) returned 0
	[0249.323] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.323] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.323] WaitMessage () returned 1
	[0249.324] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.324] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.324] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.324] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.324] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.324] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.324] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.324] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.324] GetKeyState (nVirtKey=1) returned 1
	[0249.324] GetKeyState (nVirtKey=2) returned 0
	[0249.324] GetKeyState (nVirtKey=4) returned 0
	[0249.324] GetKeyState (nVirtKey=5) returned 0
	[0249.324] GetKeyState (nVirtKey=6) returned 0
	[0249.324] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.324] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.324] WaitMessage () returned 1
	[0249.325] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.325] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.325] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.325] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.325] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.325] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.325] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.325] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.325] GetKeyState (nVirtKey=1) returned 1
	[0249.325] GetKeyState (nVirtKey=2) returned 0
	[0249.325] GetKeyState (nVirtKey=4) returned 0
	[0249.325] GetKeyState (nVirtKey=5) returned 0
	[0249.326] GetKeyState (nVirtKey=6) returned 0
	[0249.326] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.326] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.326] WaitMessage () returned 1
	[0249.327] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.327] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.327] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.327] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.327] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.327] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.327] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.327] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.327] GetKeyState (nVirtKey=1) returned 1
	[0249.327] GetKeyState (nVirtKey=2) returned 0
	[0249.327] GetKeyState (nVirtKey=4) returned 0
	[0249.327] GetKeyState (nVirtKey=5) returned 0
	[0249.327] GetKeyState (nVirtKey=6) returned 0
	[0249.327] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.327] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.327] WaitMessage () returned 1
	[0249.328] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.328] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.328] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.328] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.328] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.329] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.329] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.329] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.329] GetKeyState (nVirtKey=1) returned 1
	[0249.329] GetKeyState (nVirtKey=2) returned 0
	[0249.329] GetKeyState (nVirtKey=4) returned 0
	[0249.329] GetKeyState (nVirtKey=5) returned 0
	[0249.329] GetKeyState (nVirtKey=6) returned 0
	[0249.329] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.329] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.329] WaitMessage () returned 1
	[0249.330] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.330] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.330] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.330] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.330] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.330] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.330] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.330] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.330] GetKeyState (nVirtKey=1) returned 1
	[0249.330] GetKeyState (nVirtKey=2) returned 0
	[0249.330] GetKeyState (nVirtKey=4) returned 0
	[0249.330] GetKeyState (nVirtKey=5) returned 0
	[0249.330] GetKeyState (nVirtKey=6) returned 0
	[0249.330] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.330] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.330] WaitMessage () returned 1
	[0249.331] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.331] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.331] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.332] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.332] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.332] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.332] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.332] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.332] GetKeyState (nVirtKey=1) returned 1
	[0249.332] GetKeyState (nVirtKey=2) returned 0
	[0249.332] GetKeyState (nVirtKey=4) returned 0
	[0249.332] GetKeyState (nVirtKey=5) returned 0
	[0249.332] GetKeyState (nVirtKey=6) returned 0
	[0249.332] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.332] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.332] WaitMessage () returned 1
	[0249.333] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.333] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.333] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.333] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.333] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.333] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.333] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.333] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.333] GetKeyState (nVirtKey=1) returned 1
	[0249.333] GetKeyState (nVirtKey=2) returned 0
	[0249.333] GetKeyState (nVirtKey=4) returned 0
	[0249.333] GetKeyState (nVirtKey=5) returned 0
	[0249.333] GetKeyState (nVirtKey=6) returned 0
	[0249.333] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.333] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.334] WaitMessage () returned 1
	[0249.334] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.334] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.334] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.334] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.334] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.335] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.335] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.335] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.335] GetKeyState (nVirtKey=1) returned 1
	[0249.335] GetKeyState (nVirtKey=2) returned 0
	[0249.335] GetKeyState (nVirtKey=4) returned 0
	[0249.335] GetKeyState (nVirtKey=5) returned 0
	[0249.335] GetKeyState (nVirtKey=6) returned 0
	[0249.335] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.335] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.335] WaitMessage () returned 1
	[0249.397] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.397] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.397] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.397] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.397] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.397] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.397] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.397] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.397] GetKeyState (nVirtKey=1) returned 1
	[0249.397] GetKeyState (nVirtKey=2) returned 0
	[0249.397] GetKeyState (nVirtKey=4) returned 0
	[0249.397] GetKeyState (nVirtKey=5) returned 0
	[0249.397] GetKeyState (nVirtKey=6) returned 0
	[0249.398] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.398] IsWindowUnicode (hWnd=0x50120) returned 1
	[0249.398] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.398] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.398] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.398] BeginPaint (in: hWnd=0x50120, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x70107fc
	[0249.398] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1041b7c, lParam=0x0) returned 0x0
	[0249.399] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0249.399] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0249.399] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0249.399] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0249.400] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0249.400] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0249.400] GetSystemMetrics (nIndex=42) returned 0
	[0249.400] CoTaskMemAlloc (cb=0x26) returned 0x1b065c20
	[0249.400] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b065c20, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0249.400] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b065c20) returned 0x10
	[0249.400] CoTaskMemFree (pv=0x1b065c20) 
	[0249.400] EndPaint (hWnd=0x50120, lpPaint=0x20da98) returned 1
	[0249.400] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x0
	[0249.401] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.401] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0249.401] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.401] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.401] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.401] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0249.401] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x4041b7c, lParam=0x0) returned 0x0
	[0249.401] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0249.402] CreateCompatibleDC (hdc=0x48010f97) returned 0x5011b7b
	[0249.402] GetObjectType (h=0x48010f97) returned 0x3
	[0249.402] CreateCompatibleBitmap (hdc=0x48010f97, cx=1, cy=1) returned 0x4051b7e
	[0249.402] GetDIBits (in: hdc=0x48010f97, hbm=0x4051b7e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0249.402] GetDIBits (in: hdc=0x48010f97, hbm=0x4051b7e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0249.402] DeleteObject (ho=0x4051b7e) returned 1
	[0249.402] CreateDIBSection (in: hdc=0x48010f97, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x2051b7f
	[0249.403] SelectObject (hdc=0x5011b7b, h=0x2051b7f) returned 0x185000f
	[0249.403] GdipCreateFromHDC (hdc=0x5011b7b, graphics=0x20d750) returned 0x0
	[0249.403] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0249.403] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0249.403] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0249.403] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f2d0) returned 0x0
	[0249.403] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0249.403] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.403] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0249.403] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.403] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.403] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0249.403] GdipCreateRegion (region=0x20d910) returned 0x0
	[0249.403] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0249.403] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0249.403] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0249.404] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0249.404] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0249.404] GetSystemMetrics (nIndex=42) returned 0
	[0249.404] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0249.404] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0249.404] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0249.404] CoTaskMemFree (pv=0x1b07f5c0) 
	[0249.404] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0249.404] GdipCreateRegion (region=0x20d400) returned 0x0
	[0249.404] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0249.404] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0249.404] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0249.404] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0249.404] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.404] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0249.404] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.404] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0249.404] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.404] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0249.404] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.404] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.404] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0249.405] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0249.405] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0249.405] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0249.405] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.405] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0249.405] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0249.405] GetCurrentObject (hdc=0x5011b7b, type=0x1) returned 0x1b00017
	[0249.405] GetCurrentObject (hdc=0x5011b7b, type=0x2) returned 0x1900010
	[0249.405] GetCurrentObject (hdc=0x5011b7b, type=0x7) returned 0x2051b7f
	[0249.405] GetCurrentObject (hdc=0x5011b7b, type=0x6) returned 0x18a002e
	[0249.405] SaveDC (hdc=0x5011b7b) returned 1
	[0249.405] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa6040710
	[0249.405] GetClipRgn (hdc=0x5011b7b, hrgn=0xffffffffa6040710) returned 0
	[0249.405] SelectClipRgn (hdc=0x5011b7b, hrgn=0x380407f9) returned 2
	[0249.405] DeleteObject (ho=0xffffffffa6040710) returned 1
	[0249.405] DeleteObject (ho=0x380407f9) returned 1
	[0249.405] OffsetViewportOrgEx (in: hdc=0x5011b7b, x=0, y=0, lppt=0x26be0e0 | out: lppt=0x26be0e0) returned 1
	[0249.405] GetNearestColor (hdc=0x5011b7b, color=0x0) returned 0x0
	[0249.406] CreateSolidBrush (color=0x0) returned 0xffffffff8d1007c0
	[0249.406] FillRect (hDC=0x5011b7b, lprc=0x20d4b0, hbr=0xffffffff8d1007c0) returned 1
	[0249.406] DeleteObject (ho=0xffffffff8d1007c0) returned 1
	[0249.406] RestoreDC (hdc=0x5011b7b, nSavedDC=-1) returned 1
	[0249.406] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.406] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5011b7b) returned 0x0
	[0249.406] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9730dbd) returned 0x0
	[0249.406] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.406] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0249.406] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0249.406] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0249.406] GetSystemMetrics (nIndex=42) returned 0
	[0249.406] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0249.406] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0249.406] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0249.406] CoTaskMemFree (pv=0x1b07f5c0) 
	[0249.406] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0249.406] GetCurrentObject (hdc=0x5011b7b, type=0x1) returned 0x1b00017
	[0249.406] GetCurrentObject (hdc=0x5011b7b, type=0x2) returned 0x1900010
	[0249.406] GetCurrentObject (hdc=0x5011b7b, type=0x7) returned 0x2051b7f
	[0249.406] GetCurrentObject (hdc=0x5011b7b, type=0x6) returned 0x18a002e
	[0249.407] SaveDC (hdc=0x5011b7b) returned 1
	[0249.407] GetNearestColor (hdc=0x5011b7b, color=0x80) returned 0x80
	[0249.407] RestoreDC (hdc=0x5011b7b, nSavedDC=-1) returned 1
	[0249.407] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.407] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5011b7b) returned 0x0
	[0249.407] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0249.407] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0249.407] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0249.407] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0249.407] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0249.407] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0249.407] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0249.407] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0249.407] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.408] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0249.408] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.408] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0249.408] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0249.408] BitBlt (hdc=0x48010f97, x=0, y=0, cx=310, cy=83, hdcSrc=0x5011b7b, x1=0, y1=0, rop=0xcc0020) returned 1
	[0249.408] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.408] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x5011b7b) returned 0x0
	[0249.409] SelectObject (hdc=0x5011b7b, h=0x185000f) returned 0x2051b7f
	[0249.409] DeleteDC (hdc=0x5011b7b) returned 1
	[0249.409] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.409] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0249.409] DeleteObject (ho=0x2051b7f) returned 1
	[0249.409] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0249.409] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0249.409] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.409] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0249.409] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.409] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.409] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.410] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0249.410] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x7041b7c, lParam=0x0) returned 0x0
	[0249.410] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x70107fc, lParam=0x0) returned 0x1
	[0249.410] GetStockObject (i=5) returned 0x1900015
	[0249.410] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0249.410] CreateCompatibleDC (hdc=0x70107fc) returned 0xb011b7a
	[0249.410] SelectObject (hdc=0xb011b7a, h=0x140507d2) returned 0x185000f
	[0249.410] GdipCreateFromHDC (hdc=0xb011b7a, graphics=0x20d7e0) returned 0x0
	[0249.410] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0249.410] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=23, combineMode=0x0) returned 0x0
	[0249.411] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0249.411] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0249.411] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0249.411] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.411] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0249.411] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.411] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.411] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0249.411] GdipCreateRegion (region=0x20d910) returned 0x0
	[0249.411] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0249.411] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0249.411] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0249.411] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9710dbd) returned 0x0
	[0249.411] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.411] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0249.412] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0249.412] GetCurrentObject (hdc=0xb011b7a, type=0x1) returned 0x1b00017
	[0249.412] GetCurrentObject (hdc=0xb011b7a, type=0x2) returned 0x1900010
	[0249.412] GetCurrentObject (hdc=0xb011b7a, type=0x7) returned 0x140507d2
	[0249.412] GetCurrentObject (hdc=0xb011b7a, type=0x6) returned 0x18a002e
	[0249.412] SaveDC (hdc=0xb011b7a) returned 1
	[0249.412] GetNearestColor (hdc=0xb011b7a, color=0xf0f0f0) returned 0xf0f0f0
	[0249.412] GetNearestColor (hdc=0xb011b7a, color=0xa0a0a0) returned 0xa0a0a0
	[0249.412] GetNearestColor (hdc=0xb011b7a, color=0x696969) returned 0x696969
	[0249.412] GetNearestColor (hdc=0xb011b7a, color=0xa0a0a0) returned 0xa0a0a0
	[0249.413] GetNearestColor (hdc=0xb011b7a, color=0x0) returned 0x0
	[0249.413] GetNearestColor (hdc=0xb011b7a, color=0xffffff) returned 0xffffff
	[0249.413] GetNearestColor (hdc=0xb011b7a, color=0xe5e5e5) returned 0xe5e5e5
	[0249.413] GetNearestColor (hdc=0xb011b7a, color=0xd8d8d8) returned 0xd8d8d8
	[0249.413] GetNearestColor (hdc=0xb011b7a, color=0x0) returned 0x0
	[0249.413] RestoreDC (hdc=0xb011b7a, nSavedDC=-1) returned 1
	[0249.413] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.413] GdipReleaseDC (graphics=0x1b929550, hdc=0xb011b7a) returned 0x0
	[0249.414] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0249.414] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0249.414] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0249.414] CoTaskMemFree (pv=0x1b067a40) 
	[0249.414] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0249.414] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0249.414] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0249.414] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0249.414] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0249.414] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0249.414] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0249.414] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0249.414] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0249.414] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.414] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0249.415] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0249.415] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0249.415] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0249.418] CoTaskMemFree (pv=0x1b067a40) 
	[0249.418] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0249.418] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0249.418] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0249.418] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0249.418] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0249.418] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0249.418] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0249.418] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0249.419] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.419] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0249.419] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.419] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0249.419] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0249.419] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0249.419] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0249.419] CoTaskMemFree (pv=0x1b067a40) 
	[0249.419] GdipCreateRegion (region=0x20d120) returned 0x0
	[0249.420] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0249.420] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0249.420] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0249.420] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0249.420] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.420] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0249.420] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.420] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.420] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0249.420] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.420] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.420] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0249.420] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0249.420] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0249.420] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0249.420] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.420] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0249.420] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0249.420] GetCurrentObject (hdc=0xb011b7a, type=0x1) returned 0x1b00017
	[0249.420] GetCurrentObject (hdc=0xb011b7a, type=0x2) returned 0x1900010
	[0249.420] GetCurrentObject (hdc=0xb011b7a, type=0x7) returned 0x140507d2
	[0249.421] GetCurrentObject (hdc=0xb011b7a, type=0x6) returned 0x18a002e
	[0249.421] SaveDC (hdc=0xb011b7a) returned 1
	[0249.421] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x390407f9
	[0249.421] GetClipRgn (hdc=0xb011b7a, hrgn=0x390407f9) returned 0
	[0249.421] SelectClipRgn (hdc=0xb011b7a, hrgn=0xffffffffa7040710) returned 2
	[0249.421] DeleteObject (ho=0x390407f9) returned 1
	[0249.421] DeleteObject (ho=0xffffffffa7040710) returned 1
	[0249.421] OffsetViewportOrgEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x26bf1d0 | out: lppt=0x26bf1d0) returned 1
	[0249.421] GetNearestColor (hdc=0xb011b7a, color=0xf0f0f0) returned 0xf0f0f0
	[0249.421] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff8e1007c0
	[0249.421] FillRect (hDC=0xb011b7a, lprc=0x20d1d0, hbr=0xffffffff8e1007c0) returned 1
	[0249.421] DeleteObject (ho=0xffffffff8e1007c0) returned 1
	[0249.421] RestoreDC (hdc=0xb011b7a, nSavedDC=-1) returned 1
	[0249.421] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.421] GdipReleaseDC (graphics=0x1b929550, hdc=0xb011b7a) returned 0x0
	[0249.422] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0249.422] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0249.422] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0249.422] CoTaskMemFree (pv=0x1b067a40) 
	[0249.422] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0249.422] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0249.422] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0249.422] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0249.422] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0249.422] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0249.422] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.422] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0249.423] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.423] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0249.423] GetFocus () returned 0x0
	[0249.423] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0249.423] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0249.423] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0249.423] CoTaskMemFree (pv=0x1b067a40) 
	[0249.423] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0249.423] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0249.423] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.423] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0249.424] GdipCreateRegion (region=0x20d070) returned 0x0
	[0249.424] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0249.424] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0249.424] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0249.424] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0249.424] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.424] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0249.424] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.424] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0249.424] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0249.424] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.424] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.424] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0249.424] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0249.424] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0249.424] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0249.424] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0249.424] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0249.424] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0249.424] GetCurrentObject (hdc=0xb011b7a, type=0x1) returned 0x1b00017
	[0249.425] GetCurrentObject (hdc=0xb011b7a, type=0x2) returned 0x1900010
	[0249.425] GetCurrentObject (hdc=0xb011b7a, type=0x7) returned 0x140507d2
	[0249.425] GetCurrentObject (hdc=0xb011b7a, type=0x6) returned 0x18a002e
	[0249.425] SaveDC (hdc=0xb011b7a) returned 1
	[0249.425] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa8040710
	[0249.425] GetClipRgn (hdc=0xb011b7a, hrgn=0xffffffffa8040710) returned 0
	[0249.425] SelectClipRgn (hdc=0xb011b7a, hrgn=0x3a0407f9) returned 2
	[0249.425] DeleteObject (ho=0xffffffffa8040710) returned 1
	[0249.425] DeleteObject (ho=0x3a0407f9) returned 1
	[0249.425] OffsetViewportOrgEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x26bf770 | out: lppt=0x26bf770) returned 1
	[0249.425] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.425] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.425] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.425] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3301b7f
	[0249.425] SelectObject (hdc=0xb011b7a, h=0x3301b7f) returned 0x1b00017
	[0249.425] MoveToEx (in: hdc=0xb011b7a, x=126, y=1, lppt=0x26bf7d8 | out: lppt=0x26bf7d8) returned 1
	[0249.425] LineTo (hdc=0xb011b7a, x=1, y=1) returned 1
	[0249.425] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.425] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.425] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.426] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.426] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.426] SelectObject (hdc=0xb011b7a, h=0x3301b7f) returned 0x3301b7f
	[0249.426] MoveToEx (in: hdc=0xb011b7a, x=1, y=1, lppt=0x26bf7f0 | out: lppt=0x26bf7f0) returned 1
	[0249.426] LineTo (hdc=0xb011b7a, x=1, y=39) returned 1
	[0249.426] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.426] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.426] SelectObject (hdc=0xb011b7a, h=0x1b00017) returned 0x3301b7f
	[0249.426] DeleteObject (ho=0x3301b7f) returned 1
	[0249.426] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.426] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.426] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.426] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x6301b7b
	[0249.427] SelectObject (hdc=0xb011b7a, h=0x6301b7b) returned 0x1b00017
	[0249.427] MoveToEx (in: hdc=0xb011b7a, x=1, y=39, lppt=0x26bf858 | out: lppt=0x26bf858) returned 1
	[0249.427] LineTo (hdc=0xb011b7a, x=126, y=39) returned 1
	[0249.427] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.427] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.428] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.429] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.429] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.429] SelectObject (hdc=0xb011b7a, h=0x6301b7b) returned 0x6301b7b
	[0249.429] MoveToEx (in: hdc=0xb011b7a, x=126, y=39, lppt=0x26bf870 | out: lppt=0x26bf870) returned 1
	[0249.429] LineTo (hdc=0xb011b7a, x=126, y=0) returned 1
	[0249.429] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.430] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.430] SelectObject (hdc=0xb011b7a, h=0x1b00017) returned 0x6301b7b
	[0249.430] DeleteObject (ho=0x6301b7b) returned 1
	[0249.430] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.431] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.431] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.431] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4301b7f
	[0249.431] SelectObject (hdc=0xb011b7a, h=0x4301b7f) returned 0x1b00017
	[0249.431] MoveToEx (in: hdc=0xb011b7a, x=125, y=2, lppt=0x26bf8d8 | out: lppt=0x26bf8d8) returned 1
	[0249.432] LineTo (hdc=0xb011b7a, x=2, y=2) returned 1
	[0249.432] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.432] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.432] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.432] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.432] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.433] SelectObject (hdc=0xb011b7a, h=0x4301b7f) returned 0x4301b7f
	[0249.433] MoveToEx (in: hdc=0xb011b7a, x=2, y=2, lppt=0x26bf8f0 | out: lppt=0x26bf8f0) returned 1
	[0249.433] LineTo (hdc=0xb011b7a, x=2, y=38) returned 1
	[0249.433] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.433] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.434] SelectObject (hdc=0xb011b7a, h=0x1b00017) returned 0x4301b7f
	[0249.434] DeleteObject (ho=0x4301b7f) returned 1
	[0249.434] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.434] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.434] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.434] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x7301b7b
	[0249.435] SelectObject (hdc=0xb011b7a, h=0x7301b7b) returned 0x1b00017
	[0249.435] MoveToEx (in: hdc=0xb011b7a, x=2, y=38, lppt=0x26bf958 | out: lppt=0x26bf958) returned 1
	[0249.435] LineTo (hdc=0xb011b7a, x=125, y=38) returned 1
	[0249.435] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.435] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.435] GetROP2 (hdc=0xb011b7a) returned 13
	[0249.436] GetBkMode (hdc=0xb011b7a) returned 2
	[0249.436] SetBkMode (hdc=0xb011b7a, mode=1) returned 2
	[0249.436] SelectObject (hdc=0xb011b7a, h=0x7301b7b) returned 0x7301b7b
	[0249.436] MoveToEx (in: hdc=0xb011b7a, x=125, y=38, lppt=0x26bf970 | out: lppt=0x26bf970) returned 1
	[0249.436] LineTo (hdc=0xb011b7a, x=125, y=1) returned 1
	[0249.437] SetBkMode (hdc=0xb011b7a, mode=2) returned 1
	[0249.437] MoveToEx (in: hdc=0xb011b7a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0249.437] SelectObject (hdc=0xb011b7a, h=0x1b00017) returned 0x7301b7b
	[0249.437] DeleteObject (ho=0x7301b7b) returned 1
	[0249.437] RestoreDC (hdc=0xb011b7a, nSavedDC=-1) returned 1
	[0249.438] GdipReleaseDC (graphics=0x1b929550, hdc=0xb011b7a) returned 0x0
	[0249.438] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0249.438] BitBlt (hdc=0x70107fc, x=0, y=0, cx=128, cy=41, hdcSrc=0xb011b7a, x1=0, y1=0, rop=0xcc0020) returned 1
	[0249.439] GdipReleaseDC (graphics=0x1b929550, hdc=0xb011b7a) returned 0x0
	[0249.439] SelectObject (hdc=0xb011b7a, h=0x185000f) returned 0x140507d2
	[0249.439] DeleteDC (hdc=0xb011b7a) returned 1
	[0249.439] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0249.439] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0249.440] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0249.440] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.440] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0249.440] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.440] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.440] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.440] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x48010f97
	[0249.441] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0xa041b7c, lParam=0x0) returned 0x0
	[0249.441] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0249.441] CreateCompatibleDC (hdc=0x48010f97) returned 0x16011b71
	[0249.441] GetObjectType (h=0x48010f97) returned 0x3
	[0249.442] CreateCompatibleBitmap (hdc=0x48010f97, cx=1, cy=1) returned 0xc051b7a
	[0249.442] GetDIBits (in: hdc=0x48010f97, hbm=0xc051b7a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0249.442] GetDIBits (in: hdc=0x48010f97, hbm=0xc051b7a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0249.442] DeleteObject (ho=0xc051b7a) returned 1
	[0249.442] CreateDIBSection (in: hdc=0x48010f97, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0xa051b7e
	[0249.442] SelectObject (hdc=0x16011b71, h=0xa051b7e) returned 0x185000f
	[0249.443] GdipCreateFromHDC (hdc=0x16011b71, graphics=0x20d800) returned 0x0
	[0249.443] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0249.443] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0249.443] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0249.443] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0249.444] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0249.444] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0249.444] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.444] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0249.444] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0249.444] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0249.445] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0249.445] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0249.445] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0249.445] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0249.445] GetSystemMetrics (nIndex=42) returned 0
	[0249.445] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0249.445] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0249.445] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0249.445] CoTaskMemFree (pv=0x1b078870) 
	[0249.445] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0249.445] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0249.446] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0249.446] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0249.446] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0249.446] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d510) returned 0x0
	[0249.446] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0249.446] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.447] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0249.447] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0249.447] LocalFree (hMem=0x1b07c780) returned 0x0
	[0249.447] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0249.447] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0249.447] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0249.448] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0249.448] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0249.448] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0249.448] GetCurrentObject (hdc=0x16011b71, type=0x1) returned 0x1b00017
	[0249.449] GetCurrentObject (hdc=0x16011b71, type=0x2) returned 0x1900010
	[0249.449] GetCurrentObject (hdc=0x16011b71, type=0x7) returned 0xa051b7e
	[0249.449] GetCurrentObject (hdc=0x16011b71, type=0x6) returned 0x18a002e
	[0249.449] SaveDC (hdc=0x16011b71) returned 1
	[0249.449] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b0407f9
	[0249.449] GetClipRgn (hdc=0x16011b71, hrgn=0x3b0407f9) returned 0
	[0249.450] SelectClipRgn (hdc=0x16011b71, hrgn=0xffffffffa9040710) returned 2
	[0249.450] DeleteObject (ho=0x3b0407f9) returned 1
	[0249.450] DeleteObject (ho=0xffffffffa9040710) returned 1
	[0249.450] OffsetViewportOrgEx (in: hdc=0x16011b71, x=0, y=0, lppt=0x26c1020 | out: lppt=0x26c1020) returned 1
	[0249.450] GetNearestColor (hdc=0x16011b71, color=0xf0f0f0) returned 0xf0f0f0
	[0249.451] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff8f1007c0
	[0249.451] FillRect (hDC=0x16011b71, lprc=0x20d560, hbr=0xffffffff8f1007c0) returned 1
	[0249.451] DeleteObject (ho=0xffffffff8f1007c0) returned 1
	[0249.452] RestoreDC (hdc=0x16011b71, nSavedDC=-1) returned 1
	[0249.452] GdipReleaseDC (graphics=0x1b929550, hdc=0x16011b71) returned 0x0
	[0249.452] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff96e0dbd) returned 0x0
	[0249.452] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0249.452] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0249.452] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0249.452] GetSystemMetrics (nIndex=42) returned 0
	[0249.452] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0249.452] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0249.452] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0249.453] CoTaskMemFree (pv=0x1b078870) 
	[0249.492] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0249.500] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0249.500] BitBlt (hdc=0x48010f97, x=0, y=0, cx=658, cy=456, hdcSrc=0x16011b71, x1=0, y1=0, rop=0xcc0020) returned 1
	[0249.501] GdipReleaseDC (graphics=0x1b929550, hdc=0x16011b71) returned 0x0
	[0249.501] SelectObject (hdc=0x16011b71, h=0x185000f) returned 0xa051b7e
	[0249.501] DeleteDC (hdc=0x16011b71) returned 1
	[0249.501] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0249.502] DeleteObject (ho=0xa051b7e) returned 1
	[0249.502] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0249.503] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0249.503] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.503] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.503] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.503] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.503] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.503] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.503] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.503] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.503] GetKeyState (nVirtKey=1) returned 1
	[0249.503] GetKeyState (nVirtKey=2) returned 0
	[0249.503] GetKeyState (nVirtKey=4) returned 0
	[0249.503] GetKeyState (nVirtKey=5) returned 0
	[0249.503] GetKeyState (nVirtKey=6) returned 0
	[0249.503] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.503] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.503] WaitMessage () returned 1
	[0249.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.581] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.581] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.581] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.581] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.581] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.581] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.581] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.581] GetKeyState (nVirtKey=1) returned 1
	[0249.581] GetKeyState (nVirtKey=2) returned 0
	[0249.581] GetKeyState (nVirtKey=4) returned 0
	[0249.581] GetKeyState (nVirtKey=5) returned 0
	[0249.581] GetKeyState (nVirtKey=6) returned 0
	[0249.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.581] WaitMessage () returned 1
	[0249.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.582] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.582] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.582] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.582] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.582] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.582] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.582] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.582] GetKeyState (nVirtKey=1) returned 1
	[0249.582] GetKeyState (nVirtKey=2) returned 0
	[0249.582] GetKeyState (nVirtKey=4) returned 0
	[0249.582] GetKeyState (nVirtKey=5) returned 0
	[0249.582] GetKeyState (nVirtKey=6) returned 0
	[0249.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.582] WaitMessage () returned 1
	[0249.585] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.585] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.585] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.585] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.585] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.585] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.585] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.585] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.585] GetKeyState (nVirtKey=1) returned 1
	[0249.585] GetKeyState (nVirtKey=2) returned 0
	[0249.585] GetKeyState (nVirtKey=4) returned 0
	[0249.585] GetKeyState (nVirtKey=5) returned 0
	[0249.585] GetKeyState (nVirtKey=6) returned 0
	[0249.585] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.585] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.585] WaitMessage () returned 1
	[0249.593] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.593] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.593] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.593] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.593] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.593] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.594] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.594] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.594] GetKeyState (nVirtKey=1) returned 1
	[0249.594] GetKeyState (nVirtKey=2) returned 0
	[0249.594] GetKeyState (nVirtKey=4) returned 0
	[0249.594] GetKeyState (nVirtKey=5) returned 0
	[0249.594] GetKeyState (nVirtKey=6) returned 0
	[0249.594] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.594] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.594] WaitMessage () returned 1
	[0249.595] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.595] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.595] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.595] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.595] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.595] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.595] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.595] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.595] GetKeyState (nVirtKey=1) returned 1
	[0249.595] GetKeyState (nVirtKey=2) returned 0
	[0249.595] GetKeyState (nVirtKey=4) returned 0
	[0249.595] GetKeyState (nVirtKey=5) returned 0
	[0249.595] GetKeyState (nVirtKey=6) returned 0
	[0249.595] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.595] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.595] WaitMessage () returned 1
	[0249.598] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.598] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.598] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.598] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.598] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.598] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.598] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.598] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.598] GetKeyState (nVirtKey=1) returned 1
	[0249.598] GetKeyState (nVirtKey=2) returned 0
	[0249.598] GetKeyState (nVirtKey=4) returned 0
	[0249.598] GetKeyState (nVirtKey=5) returned 0
	[0249.599] GetKeyState (nVirtKey=6) returned 0
	[0249.599] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.599] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.599] WaitMessage () returned 1
	[0249.635] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.635] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.635] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.635] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.635] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.635] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.635] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.635] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.635] GetKeyState (nVirtKey=1) returned 1
	[0249.635] GetKeyState (nVirtKey=2) returned 0
	[0249.635] GetKeyState (nVirtKey=4) returned 0
	[0249.635] GetKeyState (nVirtKey=5) returned 0
	[0249.635] GetKeyState (nVirtKey=6) returned 0
	[0249.635] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.635] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.635] WaitMessage () returned 1
	[0249.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.638] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.638] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.638] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.638] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.638] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.638] GetKeyState (nVirtKey=1) returned 1
	[0249.638] GetKeyState (nVirtKey=2) returned 0
	[0249.638] GetKeyState (nVirtKey=4) returned 0
	[0249.638] GetKeyState (nVirtKey=5) returned 0
	[0249.638] GetKeyState (nVirtKey=6) returned 0
	[0249.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.638] WaitMessage () returned 1
	[0249.639] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.639] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.639] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.639] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.639] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.639] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.639] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.639] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.639] GetKeyState (nVirtKey=1) returned 1
	[0249.639] GetKeyState (nVirtKey=2) returned 0
	[0249.639] GetKeyState (nVirtKey=4) returned 0
	[0249.639] GetKeyState (nVirtKey=5) returned 0
	[0249.639] GetKeyState (nVirtKey=6) returned 0
	[0249.639] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.639] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.639] WaitMessage () returned 1
	[0249.640] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.640] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.640] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.640] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.640] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.640] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.640] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.640] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.640] GetKeyState (nVirtKey=1) returned 1
	[0249.641] GetKeyState (nVirtKey=2) returned 0
	[0249.641] GetKeyState (nVirtKey=4) returned 0
	[0249.641] GetKeyState (nVirtKey=5) returned 0
	[0249.641] GetKeyState (nVirtKey=6) returned 0
	[0249.641] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.641] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.641] WaitMessage () returned 1
	[0249.643] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.643] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.643] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.643] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.643] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.643] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.643] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.643] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.643] GetKeyState (nVirtKey=1) returned 1
	[0249.643] GetKeyState (nVirtKey=2) returned 0
	[0249.643] GetKeyState (nVirtKey=4) returned 0
	[0249.643] GetKeyState (nVirtKey=5) returned 0
	[0249.643] GetKeyState (nVirtKey=6) returned 0
	[0249.643] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.643] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.643] WaitMessage () returned 1
	[0249.662] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.662] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.662] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.662] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.662] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.662] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.662] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.662] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.662] GetKeyState (nVirtKey=1) returned 1
	[0249.662] GetKeyState (nVirtKey=2) returned 0
	[0249.662] GetKeyState (nVirtKey=4) returned 0
	[0249.662] GetKeyState (nVirtKey=5) returned 0
	[0249.662] GetKeyState (nVirtKey=6) returned 0
	[0249.662] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.662] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.662] WaitMessage () returned 1
	[0249.666] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.666] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.666] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.666] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.666] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.666] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.666] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.666] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.666] GetKeyState (nVirtKey=1) returned 1
	[0249.666] GetKeyState (nVirtKey=2) returned 0
	[0249.666] GetKeyState (nVirtKey=4) returned 0
	[0249.666] GetKeyState (nVirtKey=5) returned 0
	[0249.666] GetKeyState (nVirtKey=6) returned 0
	[0249.666] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.666] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.666] WaitMessage () returned 1
	[0249.668] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.668] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.668] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.668] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.668] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.668] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.668] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.668] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.668] GetKeyState (nVirtKey=1) returned 1
	[0249.668] GetKeyState (nVirtKey=2) returned 0
	[0249.668] GetKeyState (nVirtKey=4) returned 0
	[0249.668] GetKeyState (nVirtKey=5) returned 0
	[0249.668] GetKeyState (nVirtKey=6) returned 0
	[0249.668] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.668] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.669] WaitMessage () returned 1
	[0249.669] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.669] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.669] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.669] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.669] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.669] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.669] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.669] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.670] GetKeyState (nVirtKey=1) returned 1
	[0249.670] GetKeyState (nVirtKey=2) returned 0
	[0249.670] GetKeyState (nVirtKey=4) returned 0
	[0249.670] GetKeyState (nVirtKey=5) returned 0
	[0249.670] GetKeyState (nVirtKey=6) returned 0
	[0249.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.670] WaitMessage () returned 1
	[0249.717] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.717] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.718] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.718] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.718] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.718] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.718] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.718] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.718] GetKeyState (nVirtKey=1) returned 1
	[0249.718] GetKeyState (nVirtKey=2) returned 0
	[0249.718] GetKeyState (nVirtKey=4) returned 0
	[0249.718] GetKeyState (nVirtKey=5) returned 0
	[0249.718] GetKeyState (nVirtKey=6) returned 0
	[0249.718] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.718] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.718] WaitMessage () returned 1
	[0249.719] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.719] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.719] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.719] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.719] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.719] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.719] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.719] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.719] GetKeyState (nVirtKey=1) returned 1
	[0249.719] GetKeyState (nVirtKey=2) returned 0
	[0249.719] GetKeyState (nVirtKey=4) returned 0
	[0249.719] GetKeyState (nVirtKey=5) returned 0
	[0249.719] GetKeyState (nVirtKey=6) returned 0
	[0249.719] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.719] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.720] WaitMessage () returned 1
	[0249.720] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.720] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.720] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.720] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.720] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.720] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.720] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.720] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.720] GetKeyState (nVirtKey=1) returned 1
	[0249.720] GetKeyState (nVirtKey=2) returned 0
	[0249.720] GetKeyState (nVirtKey=4) returned 0
	[0249.720] GetKeyState (nVirtKey=5) returned 0
	[0249.720] GetKeyState (nVirtKey=6) returned 0
	[0249.720] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.720] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.720] WaitMessage () returned 1
	[0249.724] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.724] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.724] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.724] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.724] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.724] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.724] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.724] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.724] GetKeyState (nVirtKey=1) returned 1
	[0249.724] GetKeyState (nVirtKey=2) returned 0
	[0249.724] GetKeyState (nVirtKey=4) returned 0
	[0249.724] GetKeyState (nVirtKey=5) returned 0
	[0249.724] GetKeyState (nVirtKey=6) returned 0
	[0249.724] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.724] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.724] WaitMessage () returned 1
	[0249.726] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.726] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.726] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.726] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.726] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.726] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.726] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.726] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.726] GetKeyState (nVirtKey=1) returned 1
	[0249.726] GetKeyState (nVirtKey=2) returned 0
	[0249.726] GetKeyState (nVirtKey=4) returned 0
	[0249.726] GetKeyState (nVirtKey=5) returned 0
	[0249.726] GetKeyState (nVirtKey=6) returned 0
	[0249.727] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.727] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.727] WaitMessage () returned 1
	[0249.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.729] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.729] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.729] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.729] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.729] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.729] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.729] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.729] GetKeyState (nVirtKey=1) returned 1
	[0249.729] GetKeyState (nVirtKey=2) returned 0
	[0249.729] GetKeyState (nVirtKey=4) returned 0
	[0249.729] GetKeyState (nVirtKey=5) returned 0
	[0249.729] GetKeyState (nVirtKey=6) returned 0
	[0249.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.729] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.729] WaitMessage () returned 1
	[0249.747] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.747] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.747] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.747] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.747] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.747] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.747] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.747] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.747] GetKeyState (nVirtKey=1) returned 1
	[0249.747] GetKeyState (nVirtKey=2) returned 0
	[0249.747] GetKeyState (nVirtKey=4) returned 0
	[0249.748] GetKeyState (nVirtKey=5) returned 0
	[0249.748] GetKeyState (nVirtKey=6) returned 0
	[0249.748] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.748] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.748] WaitMessage () returned 1
	[0249.755] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.755] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.755] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.755] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.755] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.755] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.756] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.756] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.756] GetKeyState (nVirtKey=1) returned 1
	[0249.756] GetKeyState (nVirtKey=2) returned 0
	[0249.756] GetKeyState (nVirtKey=4) returned 0
	[0249.756] GetKeyState (nVirtKey=5) returned 0
	[0249.756] GetKeyState (nVirtKey=6) returned 0
	[0249.756] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.756] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.756] WaitMessage () returned 1
	[0249.776] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.776] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.776] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.776] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.777] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.777] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.777] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.777] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.777] GetKeyState (nVirtKey=1) returned 1
	[0249.777] GetKeyState (nVirtKey=2) returned 0
	[0249.777] GetKeyState (nVirtKey=4) returned 0
	[0249.777] GetKeyState (nVirtKey=5) returned 0
	[0249.777] GetKeyState (nVirtKey=6) returned 0
	[0249.777] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.777] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.777] WaitMessage () returned 1
	[0249.820] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.820] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.820] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.820] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.820] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.820] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.820] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.820] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.820] GetKeyState (nVirtKey=1) returned 1
	[0249.820] GetKeyState (nVirtKey=2) returned 0
	[0249.820] GetKeyState (nVirtKey=4) returned 0
	[0249.820] GetKeyState (nVirtKey=5) returned 0
	[0249.820] GetKeyState (nVirtKey=6) returned 0
	[0249.820] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.820] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.820] WaitMessage () returned 1
	[0249.984] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.984] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.984] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0249.984] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0249.984] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0249.984] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0249.984] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0249.984] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0249.984] GetKeyState (nVirtKey=1) returned 1
	[0249.984] GetKeyState (nVirtKey=2) returned 0
	[0249.984] GetKeyState (nVirtKey=4) returned 0
	[0249.984] GetKeyState (nVirtKey=5) returned 0
	[0249.984] GetKeyState (nVirtKey=6) returned 0
	[0249.985] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.985] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0249.985] WaitMessage () returned 1
	[0250.071] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0250.071] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0250.071] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0250.071] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0250.071] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0250.071] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0250.072] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0250.072] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0250.072] GetKeyState (nVirtKey=1) returned 1
	[0250.072] GetKeyState (nVirtKey=2) returned 0
	[0250.072] GetKeyState (nVirtKey=4) returned 0
	[0250.072] GetKeyState (nVirtKey=5) returned 0
	[0250.072] GetKeyState (nVirtKey=6) returned 0
	[0250.072] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0250.072] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0250.072] WaitMessage () returned 1
	[0250.104] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0250.104] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0250.104] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0250.104] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0250.104] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0250.104] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0250.104] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0250.104] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0250.104] GetKeyState (nVirtKey=1) returned 1
	[0250.104] GetKeyState (nVirtKey=2) returned 0
	[0250.104] GetKeyState (nVirtKey=4) returned 0
	[0250.104] GetKeyState (nVirtKey=5) returned 0
	[0250.104] GetKeyState (nVirtKey=6) returned 0
	[0250.104] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0250.104] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0250.104] WaitMessage () returned 1
	[0250.276] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0250.276] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0250.276] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0250.277] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0250.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0250.277] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0250.277] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0250.277] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0250.277] GetKeyState (nVirtKey=1) returned 1
	[0250.277] GetKeyState (nVirtKey=2) returned 0
	[0250.277] GetKeyState (nVirtKey=4) returned 0
	[0250.277] GetKeyState (nVirtKey=5) returned 0
	[0250.277] GetKeyState (nVirtKey=6) returned 0
	[0250.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0250.277] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0250.277] WaitMessage () returned 1
	[0251.074] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.074] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0251.074] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0251.074] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.074] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e30306) returned 0x1
	[0251.074] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0251.074] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0251.074] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0251.074] GetKeyState (nVirtKey=1) returned 1
	[0251.074] GetKeyState (nVirtKey=2) returned 0
	[0251.074] GetKeyState (nVirtKey=4) returned 0
	[0251.074] GetKeyState (nVirtKey=5) returned 0
	[0251.074] GetKeyState (nVirtKey=6) returned 0
	[0251.074] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0251.074] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0251.075] WaitMessage () returned 1
	[0251.203] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.227] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0251.235] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0251.235] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.235] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0251.235] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0251.235] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0251.235] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0251.235] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.235] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0251.235] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0251.235] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.235] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0251.235] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0251.236] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0251.236] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0251.236] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0251.236] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.236] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0251.236] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0251.236] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0251.236] DispatchMessageW (lpMsg=0x20e6b0) returned 0x2
	[0251.236] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0251.236] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0251.236] CreateCompatibleDC (hdc=0x48010f97) returned 0x3b011bac
	[0251.236] SelectObject (hdc=0x3b011bac, h=0x140507d2) returned 0x185000f
	[0251.237] GdipCreateFromHDC (hdc=0x3b011bac, graphics=0x20d7e0) returned 0x0
	[0251.237] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0251.237] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0251.237] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0251.237] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0251.237] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0251.238] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0251.238] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0251.238] GdipCreateRegion (region=0x20d910) returned 0x0
	[0251.238] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0251.238] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0251.238] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0251.239] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff96c0dbd) returned 0x0
	[0251.239] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0251.239] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0251.239] GetCurrentObject (hdc=0x3b011bac, type=0x1) returned 0x1b00017
	[0251.239] GetCurrentObject (hdc=0x3b011bac, type=0x2) returned 0x1900010
	[0251.239] GetCurrentObject (hdc=0x3b011bac, type=0x7) returned 0x140507d2
	[0251.240] GetCurrentObject (hdc=0x3b011bac, type=0x6) returned 0x18a002e
	[0251.240] SaveDC (hdc=0x3b011bac) returned 1
	[0251.240] GetNearestColor (hdc=0x3b011bac, color=0xf0f0f0) returned 0xf0f0f0
	[0251.240] GetNearestColor (hdc=0x3b011bac, color=0xa0a0a0) returned 0xa0a0a0
	[0251.240] GetNearestColor (hdc=0x3b011bac, color=0x696969) returned 0x696969
	[0251.241] GetNearestColor (hdc=0x3b011bac, color=0xa0a0a0) returned 0xa0a0a0
	[0251.241] GetNearestColor (hdc=0x3b011bac, color=0x0) returned 0x0
	[0251.241] GetNearestColor (hdc=0x3b011bac, color=0xffffff) returned 0xffffff
	[0251.241] GetNearestColor (hdc=0x3b011bac, color=0xe5e5e5) returned 0xe5e5e5
	[0251.241] GetNearestColor (hdc=0x3b011bac, color=0xd8d8d8) returned 0xd8d8d8
	[0251.241] GetNearestColor (hdc=0x3b011bac, color=0x0) returned 0x0
	[0251.242] RestoreDC (hdc=0x3b011bac, nSavedDC=-1) returned 1
	[0251.242] GdipReleaseDC (graphics=0x1b929550, hdc=0x3b011bac) returned 0x0
	[0251.242] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0251.242] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0251.242] CoTaskMemFree (pv=0x1b067a40) 
	[0251.242] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0251.242] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0251.243] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0251.243] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0251.243] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0251.243] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0251.243] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0251.243] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0251.244] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0251.244] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0251.244] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0251.244] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0251.244] CoTaskMemFree (pv=0x1b067a40) 
	[0251.244] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0251.244] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0251.245] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0251.245] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0251.245] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0251.245] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0251.245] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0251.245] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0251.245] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0251.246] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0251.246] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0251.246] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0251.246] CoTaskMemFree (pv=0x1b067a40) 
	[0251.246] GdipCreateRegion (region=0x20d120) returned 0x0
	[0251.246] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0251.246] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0251.247] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0251.247] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0251.247] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0251.247] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0251.247] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0251.247] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0251.248] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0251.248] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0251.249] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0251.249] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0251.249] GetCurrentObject (hdc=0x3b011bac, type=0x1) returned 0x1b00017
	[0251.249] GetCurrentObject (hdc=0x3b011bac, type=0x2) returned 0x1900010
	[0251.249] GetCurrentObject (hdc=0x3b011bac, type=0x7) returned 0x140507d2
	[0251.249] GetCurrentObject (hdc=0x3b011bac, type=0x6) returned 0x18a002e
	[0251.250] SaveDC (hdc=0x3b011bac) returned 1
	[0251.250] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffaa040710
	[0251.250] GetClipRgn (hdc=0x3b011bac, hrgn=0xffffffffaa040710) returned 0
	[0251.250] SelectClipRgn (hdc=0x3b011bac, hrgn=0x3c0407f9) returned 2
	[0251.250] DeleteObject (ho=0xffffffffaa040710) returned 1
	[0251.250] DeleteObject (ho=0x3c0407f9) returned 1
	[0251.251] OffsetViewportOrgEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x26c2918 | out: lppt=0x26c2918) returned 1
	[0251.251] GetNearestColor (hdc=0x3b011bac, color=0xf0f0f0) returned 0xf0f0f0
	[0251.251] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff901007c0
	[0251.251] FillRect (hDC=0x3b011bac, lprc=0x20d1d0, hbr=0xffffffff901007c0) returned 1
	[0251.251] DeleteObject (ho=0xffffffff901007c0) returned 1
	[0251.251] RestoreDC (hdc=0x3b011bac, nSavedDC=-1) returned 1
	[0251.252] GdipReleaseDC (graphics=0x1b929550, hdc=0x3b011bac) returned 0x0
	[0251.252] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0251.252] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0251.252] CoTaskMemFree (pv=0x1b067a40) 
	[0251.252] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0251.252] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0251.252] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0251.253] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0251.253] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0251.253] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0251.253] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0251.253] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0251.253] GetFocus () returned 0x0
	[0251.254] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0251.254] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0251.254] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0251.254] CoTaskMemFree (pv=0x1b067a40) 
	[0251.254] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0251.254] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0251.254] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0251.254] GdipCreateRegion (region=0x20d070) returned 0x0
	[0251.255] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0251.255] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0251.255] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0251.255] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0251.255] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0251.255] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0251.255] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0251.256] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0251.256] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0251.256] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0251.256] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0251.256] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0251.256] GetCurrentObject (hdc=0x3b011bac, type=0x1) returned 0x1b00017
	[0251.257] GetCurrentObject (hdc=0x3b011bac, type=0x2) returned 0x1900010
	[0251.257] GetCurrentObject (hdc=0x3b011bac, type=0x7) returned 0x140507d2
	[0251.257] GetCurrentObject (hdc=0x3b011bac, type=0x6) returned 0x18a002e
	[0251.257] SaveDC (hdc=0x3b011bac) returned 1
	[0251.257] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d0407f9
	[0251.257] GetClipRgn (hdc=0x3b011bac, hrgn=0x3d0407f9) returned 0
	[0251.258] SelectClipRgn (hdc=0x3b011bac, hrgn=0xffffffffab040710) returned 2
	[0251.258] DeleteObject (ho=0x3d0407f9) returned 1
	[0251.258] DeleteObject (ho=0xffffffffab040710) returned 1
	[0251.258] OffsetViewportOrgEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x26c2eb8 | out: lppt=0x26c2eb8) returned 1
	[0251.258] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.259] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.259] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.259] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x2b301bae
	[0251.259] SelectObject (hdc=0x3b011bac, h=0x2b301bae) returned 0x1b00017
	[0251.259] MoveToEx (in: hdc=0x3b011bac, x=164, y=1, lppt=0x26c2f20 | out: lppt=0x26c2f20) returned 1
	[0251.259] LineTo (hdc=0x3b011bac, x=1, y=1) returned 1
	[0251.260] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.260] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.260] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.260] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.260] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.260] SelectObject (hdc=0x3b011bac, h=0x2b301bae) returned 0x2b301bae
	[0251.261] MoveToEx (in: hdc=0x3b011bac, x=1, y=1, lppt=0x26c2f38 | out: lppt=0x26c2f38) returned 1
	[0251.261] LineTo (hdc=0x3b011bac, x=1, y=41) returned 1
	[0251.261] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.261] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.261] SelectObject (hdc=0x3b011bac, h=0x1b00017) returned 0x2b301bae
	[0251.261] DeleteObject (ho=0x2b301bae) returned 1
	[0251.261] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.262] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.262] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.262] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x3301bb6
	[0251.262] SelectObject (hdc=0x3b011bac, h=0x3301bb6) returned 0x1b00017
	[0251.262] MoveToEx (in: hdc=0x3b011bac, x=1, y=41, lppt=0x26c2fa0 | out: lppt=0x26c2fa0) returned 1
	[0251.262] LineTo (hdc=0x3b011bac, x=164, y=41) returned 1
	[0251.263] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.263] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.263] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.263] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.263] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.263] SelectObject (hdc=0x3b011bac, h=0x3301bb6) returned 0x3301bb6
	[0251.264] MoveToEx (in: hdc=0x3b011bac, x=164, y=41, lppt=0x26c2fb8 | out: lppt=0x26c2fb8) returned 1
	[0251.264] LineTo (hdc=0x3b011bac, x=164, y=0) returned 1
	[0251.264] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.264] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.264] SelectObject (hdc=0x3b011bac, h=0x1b00017) returned 0x3301bb6
	[0251.264] DeleteObject (ho=0x3301bb6) returned 1
	[0251.265] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.265] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.265] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.265] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2c301bae
	[0251.265] SelectObject (hdc=0x3b011bac, h=0x2c301bae) returned 0x1b00017
	[0251.266] MoveToEx (in: hdc=0x3b011bac, x=163, y=2, lppt=0x26c3020 | out: lppt=0x26c3020) returned 1
	[0251.266] LineTo (hdc=0x3b011bac, x=2, y=2) returned 1
	[0251.266] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.266] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.266] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.267] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.267] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.267] SelectObject (hdc=0x3b011bac, h=0x2c301bae) returned 0x2c301bae
	[0251.267] MoveToEx (in: hdc=0x3b011bac, x=2, y=2, lppt=0x26c3038 | out: lppt=0x26c3038) returned 1
	[0251.267] LineTo (hdc=0x3b011bac, x=2, y=40) returned 1
	[0251.267] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.268] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.268] SelectObject (hdc=0x3b011bac, h=0x1b00017) returned 0x2c301bae
	[0251.268] DeleteObject (ho=0x2c301bae) returned 1
	[0251.268] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.268] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.268] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.269] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x4301bb6
	[0251.269] SelectObject (hdc=0x3b011bac, h=0x4301bb6) returned 0x1b00017
	[0251.269] MoveToEx (in: hdc=0x3b011bac, x=2, y=40, lppt=0x26c30a0 | out: lppt=0x26c30a0) returned 1
	[0251.269] LineTo (hdc=0x3b011bac, x=163, y=40) returned 1
	[0251.269] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.270] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.270] GetROP2 (hdc=0x3b011bac) returned 13
	[0251.270] GetBkMode (hdc=0x3b011bac) returned 2
	[0251.270] SetBkMode (hdc=0x3b011bac, mode=1) returned 2
	[0251.270] SelectObject (hdc=0x3b011bac, h=0x4301bb6) returned 0x4301bb6
	[0251.270] MoveToEx (in: hdc=0x3b011bac, x=163, y=40, lppt=0x26c30b8 | out: lppt=0x26c30b8) returned 1
	[0251.270] LineTo (hdc=0x3b011bac, x=163, y=1) returned 1
	[0251.271] SetBkMode (hdc=0x3b011bac, mode=2) returned 1
	[0251.271] MoveToEx (in: hdc=0x3b011bac, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0251.271] SelectObject (hdc=0x3b011bac, h=0x1b00017) returned 0x4301bb6
	[0251.271] DeleteObject (ho=0x4301bb6) returned 1
	[0251.271] RestoreDC (hdc=0x3b011bac, nSavedDC=-1) returned 1
	[0251.271] GdipReleaseDC (graphics=0x1b929550, hdc=0x3b011bac) returned 0x0
	[0251.272] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0251.272] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0x3b011bac, x1=0, y1=0, rop=0xcc0020) returned 1
	[0251.272] GdipReleaseDC (graphics=0x1b929550, hdc=0x3b011bac) returned 0x0
	[0251.272] SelectObject (hdc=0x3b011bac, h=0x185000f) returned 0x140507d2
	[0251.272] DeleteDC (hdc=0x3b011bac) returned 1
	[0251.272] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0251.273] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0251.273] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0251.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0251.273] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0251.273] WaitMessage () returned 1
	[0252.094] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.094] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.094] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.094] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.094] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.094] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.094] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x2a2, wParam=0x0, lParam=0x0) returned 0x0
	[0252.094] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.094] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.094] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.094] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.094] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.094] SetCursor (hCursor=0xe00df) returned 0x10003
	[0252.095] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.095] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.095] _TrackMouseEvent (in: lpEventTrack=0x26470f0 | out: lpEventTrack=0x26470f0) returned 1
	[0252.095] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0252.095] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0252.095] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0252.095] GetKeyState (nVirtKey=1) returned 1
	[0252.095] GetKeyState (nVirtKey=2) returned 0
	[0252.095] GetKeyState (nVirtKey=4) returned 0
	[0252.095] GetKeyState (nVirtKey=5) returned 0
	[0252.095] GetKeyState (nVirtKey=6) returned 0
	[0252.095] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.095] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.095] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.095] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.095] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.095] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0252.095] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0252.096] CreateCompatibleDC (hdc=0x48010f97) returned 0x21011bb5
	[0252.096] SelectObject (hdc=0x21011bb5, h=0x140507d2) returned 0x185000f
	[0252.096] GdipCreateFromHDC (hdc=0x21011bb5, graphics=0x20d7e0) returned 0x0
	[0252.096] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0252.096] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0252.097] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0252.097] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0252.097] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0252.097] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0252.097] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0252.097] GdipCreateRegion (region=0x20d910) returned 0x0
	[0252.098] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.098] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0252.098] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0252.098] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9690dbd) returned 0x0
	[0252.098] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.098] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0252.099] GetCurrentObject (hdc=0x21011bb5, type=0x1) returned 0x1b00017
	[0252.099] GetCurrentObject (hdc=0x21011bb5, type=0x2) returned 0x1900010
	[0252.099] GetCurrentObject (hdc=0x21011bb5, type=0x7) returned 0x140507d2
	[0252.099] GetCurrentObject (hdc=0x21011bb5, type=0x6) returned 0x18a002e
	[0252.099] SaveDC (hdc=0x21011bb5) returned 1
	[0252.100] GetNearestColor (hdc=0x21011bb5, color=0xf0f0f0) returned 0xf0f0f0
	[0252.100] GetNearestColor (hdc=0x21011bb5, color=0xa0a0a0) returned 0xa0a0a0
	[0252.100] GetNearestColor (hdc=0x21011bb5, color=0x696969) returned 0x696969
	[0252.100] GetNearestColor (hdc=0x21011bb5, color=0xa0a0a0) returned 0xa0a0a0
	[0252.100] GetNearestColor (hdc=0x21011bb5, color=0x0) returned 0x0
	[0252.100] GetNearestColor (hdc=0x21011bb5, color=0xffffff) returned 0xffffff
	[0252.101] GetNearestColor (hdc=0x21011bb5, color=0xe5e5e5) returned 0xe5e5e5
	[0252.101] GetNearestColor (hdc=0x21011bb5, color=0xd8d8d8) returned 0xd8d8d8
	[0252.101] GetNearestColor (hdc=0x21011bb5, color=0x0) returned 0x0
	[0252.101] RestoreDC (hdc=0x21011bb5, nSavedDC=-1) returned 1
	[0252.101] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011bb5) returned 0x0
	[0252.102] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0252.102] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.102] CoTaskMemFree (pv=0x1b067a40) 
	[0252.102] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0252.102] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.102] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.103] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.103] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0252.103] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0252.103] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0252.103] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0252.103] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0252.104] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.104] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0252.104] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.104] CoTaskMemFree (pv=0x1b067a40) 
	[0252.104] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0252.104] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0252.104] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0252.105] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0252.105] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.105] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.105] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.105] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0252.105] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.106] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0252.106] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0252.106] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.106] CoTaskMemFree (pv=0x1b067a40) 
	[0252.106] GdipCreateRegion (region=0x20d120) returned 0x0
	[0252.107] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.107] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0252.107] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0252.107] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0252.107] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0252.107] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0252.108] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0252.108] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0252.108] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0252.108] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0252.108] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.108] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0252.109] GetCurrentObject (hdc=0x21011bb5, type=0x1) returned 0x1b00017
	[0252.109] GetCurrentObject (hdc=0x21011bb5, type=0x2) returned 0x1900010
	[0252.109] GetCurrentObject (hdc=0x21011bb5, type=0x7) returned 0x140507d2
	[0252.109] GetCurrentObject (hdc=0x21011bb5, type=0x6) returned 0x18a002e
	[0252.109] SaveDC (hdc=0x21011bb5) returned 1
	[0252.109] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffac040710
	[0252.110] GetClipRgn (hdc=0x21011bb5, hrgn=0xffffffffac040710) returned 0
	[0252.110] SelectClipRgn (hdc=0x21011bb5, hrgn=0x3e0407f9) returned 2
	[0252.110] DeleteObject (ho=0xffffffffac040710) returned 1
	[0252.110] DeleteObject (ho=0x3e0407f9) returned 1
	[0252.110] OffsetViewportOrgEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x26c3db0 | out: lppt=0x26c3db0) returned 1
	[0252.110] GetNearestColor (hdc=0x21011bb5, color=0xf0f0f0) returned 0xf0f0f0
	[0252.111] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff911007c0
	[0252.111] FillRect (hDC=0x21011bb5, lprc=0x20d1d0, hbr=0xffffffff911007c0) returned 1
	[0252.111] DeleteObject (ho=0xffffffff911007c0) returned 1
	[0252.111] RestoreDC (hdc=0x21011bb5, nSavedDC=-1) returned 1
	[0252.111] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011bb5) returned 0x0
	[0252.112] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0252.112] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.112] CoTaskMemFree (pv=0x1b067a40) 
	[0252.112] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0252.112] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.112] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.112] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.113] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0252.113] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0252.113] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0252.113] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.113] GetFocus () returned 0x0
	[0252.114] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.114] CoTaskMemAlloc (cb=0x13) returned 0x1b067a40
	[0252.114] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.114] CoTaskMemFree (pv=0x1b067a40) 
	[0252.114] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0252.114] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0252.114] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0252.115] GdipCreateRegion (region=0x20d070) returned 0x0
	[0252.115] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.115] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0252.115] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0252.115] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d0d0) returned 0x0
	[0252.116] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0252.116] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0252.116] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0252.116] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0252.116] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0252.116] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0252.117] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.117] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0252.117] GetCurrentObject (hdc=0x21011bb5, type=0x1) returned 0x1b00017
	[0252.117] GetCurrentObject (hdc=0x21011bb5, type=0x2) returned 0x1900010
	[0252.117] GetCurrentObject (hdc=0x21011bb5, type=0x7) returned 0x140507d2
	[0252.117] GetCurrentObject (hdc=0x21011bb5, type=0x6) returned 0x18a002e
	[0252.118] SaveDC (hdc=0x21011bb5) returned 1
	[0252.118] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f0407f9
	[0252.118] GetClipRgn (hdc=0x21011bb5, hrgn=0x3f0407f9) returned 0
	[0252.118] SelectClipRgn (hdc=0x21011bb5, hrgn=0xffffffffad040710) returned 2
	[0252.118] DeleteObject (ho=0x3f0407f9) returned 1
	[0252.119] DeleteObject (ho=0xffffffffad040710) returned 1
	[0252.119] OffsetViewportOrgEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x26c4350 | out: lppt=0x26c4350) returned 1
	[0252.119] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.119] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.119] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.119] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x30301bab
	[0252.120] SelectObject (hdc=0x21011bb5, h=0x30301bab) returned 0x1b00017
	[0252.120] MoveToEx (in: hdc=0x21011bb5, x=164, y=1, lppt=0x26c43b8 | out: lppt=0x26c43b8) returned 1
	[0252.120] LineTo (hdc=0x21011bb5, x=1, y=1) returned 1
	[0252.120] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.120] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.121] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.121] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.121] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.122] SelectObject (hdc=0x21011bb5, h=0x30301bab) returned 0x30301bab
	[0252.122] MoveToEx (in: hdc=0x21011bb5, x=1, y=1, lppt=0x26c43d0 | out: lppt=0x26c43d0) returned 1
	[0252.123] LineTo (hdc=0x21011bb5, x=1, y=41) returned 1
	[0252.123] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.123] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.123] SelectObject (hdc=0x21011bb5, h=0x1b00017) returned 0x30301bab
	[0252.123] DeleteObject (ho=0x30301bab) returned 1
	[0252.124] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.124] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.124] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.124] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x5301bb6
	[0252.124] SelectObject (hdc=0x21011bb5, h=0x5301bb6) returned 0x1b00017
	[0252.125] MoveToEx (in: hdc=0x21011bb5, x=1, y=41, lppt=0x26c4438 | out: lppt=0x26c4438) returned 1
	[0252.125] LineTo (hdc=0x21011bb5, x=164, y=41) returned 1
	[0252.125] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.125] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.125] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.125] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.126] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.126] SelectObject (hdc=0x21011bb5, h=0x5301bb6) returned 0x5301bb6
	[0252.126] MoveToEx (in: hdc=0x21011bb5, x=164, y=41, lppt=0x26c4450 | out: lppt=0x26c4450) returned 1
	[0252.126] LineTo (hdc=0x21011bb5, x=164, y=0) returned 1
	[0252.126] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.127] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.127] SelectObject (hdc=0x21011bb5, h=0x1b00017) returned 0x5301bb6
	[0252.127] DeleteObject (ho=0x5301bb6) returned 1
	[0252.127] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.127] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.127] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.128] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x31301bab
	[0252.128] SelectObject (hdc=0x21011bb5, h=0x31301bab) returned 0x1b00017
	[0252.128] MoveToEx (in: hdc=0x21011bb5, x=163, y=2, lppt=0x26c44b8 | out: lppt=0x26c44b8) returned 1
	[0252.128] LineTo (hdc=0x21011bb5, x=2, y=2) returned 1
	[0252.128] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.128] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.129] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.129] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.129] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.129] SelectObject (hdc=0x21011bb5, h=0x31301bab) returned 0x31301bab
	[0252.129] MoveToEx (in: hdc=0x21011bb5, x=2, y=2, lppt=0x26c44d0 | out: lppt=0x26c44d0) returned 1
	[0252.129] LineTo (hdc=0x21011bb5, x=2, y=40) returned 1
	[0252.130] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.130] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.130] SelectObject (hdc=0x21011bb5, h=0x1b00017) returned 0x31301bab
	[0252.130] DeleteObject (ho=0x31301bab) returned 1
	[0252.130] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.130] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.131] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.131] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x6301bb6
	[0252.131] SelectObject (hdc=0x21011bb5, h=0x6301bb6) returned 0x1b00017
	[0252.131] MoveToEx (in: hdc=0x21011bb5, x=2, y=40, lppt=0x26c4538 | out: lppt=0x26c4538) returned 1
	[0252.131] LineTo (hdc=0x21011bb5, x=163, y=40) returned 1
	[0252.131] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.132] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.132] GetROP2 (hdc=0x21011bb5) returned 13
	[0252.132] GetBkMode (hdc=0x21011bb5) returned 2
	[0252.132] SetBkMode (hdc=0x21011bb5, mode=1) returned 2
	[0252.132] SelectObject (hdc=0x21011bb5, h=0x6301bb6) returned 0x6301bb6
	[0252.132] MoveToEx (in: hdc=0x21011bb5, x=163, y=40, lppt=0x26c4550 | out: lppt=0x26c4550) returned 1
	[0252.133] LineTo (hdc=0x21011bb5, x=163, y=1) returned 1
	[0252.133] SetBkMode (hdc=0x21011bb5, mode=2) returned 1
	[0252.133] MoveToEx (in: hdc=0x21011bb5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.133] SelectObject (hdc=0x21011bb5, h=0x1b00017) returned 0x6301bb6
	[0252.133] DeleteObject (ho=0x6301bb6) returned 1
	[0252.133] RestoreDC (hdc=0x21011bb5, nSavedDC=-1) returned 1
	[0252.134] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011bb5) returned 0x0
	[0252.134] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0252.134] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0x21011bb5, x1=0, y1=0, rop=0xcc0020) returned 1
	[0252.134] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011bb5) returned 0x0
	[0252.134] SelectObject (hdc=0x21011bb5, h=0x185000f) returned 0x140507d2
	[0252.135] DeleteDC (hdc=0x21011bb5) returned 1
	[0252.135] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0252.135] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0252.135] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0252.135] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.135] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.135] WaitMessage () returned 1
	[0252.200] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.200] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.200] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.200] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.200] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.200] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.200] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.200] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.200] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.200] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.201] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0xa0042) returned 0x0
	[0252.201] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.201] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.201] WaitMessage () returned 1
	[0252.327] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.327] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.327] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.327] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.327] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.327] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0252.327] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xd6011e) returned 0x0
	[0252.327] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0252.327] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0252.328] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0252.328] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0252.329] GetFocus () returned 0x0
	[0252.329] SetFocus (hWnd=0x201d8) returned 0x0
	[0252.329] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0252.329] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0252.330] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0252.330] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0252.330] GetStockObject (i=5) returned 0x1900015
	[0252.330] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0252.331] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0252.331] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0252.331] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.331] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.331] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.331] GetKeyState (nVirtKey=1) returned -128
	[0252.331] GetKeyState (nVirtKey=2) returned 0
	[0252.331] GetKeyState (nVirtKey=4) returned 0
	[0252.331] GetKeyState (nVirtKey=5) returned 0
	[0252.331] GetKeyState (nVirtKey=6) returned 0
	[0252.331] IsWindowVisible (hWnd=0x201d8) returned 1
	[0252.331] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0252.331] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0252.331] GetFocus () returned 0x201d8
	[0252.331] GetFocus () returned 0x201d8
	[0252.331] GetFocus () returned 0x201d8
	[0252.331] GetKeyState (nVirtKey=1) returned -128
	[0252.331] GetKeyState (nVirtKey=2) returned 0
	[0252.331] GetKeyState (nVirtKey=4) returned 0
	[0252.331] GetKeyState (nVirtKey=5) returned 0
	[0252.331] GetKeyState (nVirtKey=6) returned 0
	[0252.332] GetCapture () returned 0x0
	[0252.332] SetCapture (hWnd=0x201d8) returned 0x0
	[0252.332] GetKeyState (nVirtKey=1) returned -128
	[0252.332] GetKeyState (nVirtKey=2) returned 0
	[0252.332] GetKeyState (nVirtKey=4) returned 0
	[0252.332] GetKeyState (nVirtKey=5) returned 0
	[0252.332] GetKeyState (nVirtKey=6) returned 0
	[0252.332] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0252.332] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0252.332] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.332] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.332] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.332] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0252.332] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.332] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.332] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.332] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0252.332] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.332] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.332] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.332] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.332] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0252.332] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26c46c8, cPoints=0x1 | out: lpPoints=0x26c46c8) returned 30606029
	[0252.332] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0252.332] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0252.332] UpdateWindow (hWnd=0x201d8) returned 0
	[0252.332] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x4010280
	[0252.332] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0252.333] CreateCompatibleDC (hdc=0x4010280) returned 0xf0119d0
	[0252.333] SelectObject (hdc=0xf0119d0, h=0x140507d2) returned 0x185000f
	[0252.333] GdipCreateFromHDC (hdc=0xf0119d0, graphics=0x20cfa0) returned 0x0
	[0252.333] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0252.334] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0252.334] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0252.334] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0252.334] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d130) returned 0x0
	[0252.334] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0252.335] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0252.335] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0252.335] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.335] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0252.335] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0252.336] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9660dbd) returned 0x0
	[0252.336] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.336] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0252.336] GetCurrentObject (hdc=0xf0119d0, type=0x1) returned 0x1b00017
	[0252.336] GetCurrentObject (hdc=0xf0119d0, type=0x2) returned 0x1900010
	[0252.336] GetCurrentObject (hdc=0xf0119d0, type=0x7) returned 0x140507d2
	[0252.337] GetCurrentObject (hdc=0xf0119d0, type=0x6) returned 0x18a002e
	[0252.337] SaveDC (hdc=0xf0119d0) returned 1
	[0252.337] GetNearestColor (hdc=0xf0119d0, color=0xf0f0f0) returned 0xf0f0f0
	[0252.337] GetNearestColor (hdc=0xf0119d0, color=0xa0a0a0) returned 0xa0a0a0
	[0252.337] GetNearestColor (hdc=0xf0119d0, color=0x696969) returned 0x696969
	[0252.338] GetNearestColor (hdc=0xf0119d0, color=0xa0a0a0) returned 0xa0a0a0
	[0252.338] GetNearestColor (hdc=0xf0119d0, color=0x0) returned 0x0
	[0252.338] GetNearestColor (hdc=0xf0119d0, color=0xffffff) returned 0xffffff
	[0252.338] GetNearestColor (hdc=0xf0119d0, color=0xe5e5e5) returned 0xe5e5e5
	[0252.338] GetNearestColor (hdc=0xf0119d0, color=0xd8d8d8) returned 0xd8d8d8
	[0252.339] GetNearestColor (hdc=0xf0119d0, color=0x0) returned 0x0
	[0252.339] RestoreDC (hdc=0xf0119d0, nSavedDC=-1) returned 1
	[0252.339] GdipReleaseDC (graphics=0x1b929550, hdc=0xf0119d0) returned 0x0
	[0252.339] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0252.339] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.340] CoTaskMemFree (pv=0x1b067a60) 
	[0252.340] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0252.340] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.340] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.340] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.340] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0252.340] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0252.341] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0252.341] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0252.341] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0252.341] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.341] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0252.342] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.342] CoTaskMemFree (pv=0x1b067a60) 
	[0252.342] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0252.342] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0252.342] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0252.342] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0252.343] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.343] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.343] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.343] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0252.343] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.343] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0252.344] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0252.344] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.344] CoTaskMemFree (pv=0x1b067a60) 
	[0252.344] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0252.344] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.344] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0252.345] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0252.345] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c940) returned 0x0
	[0252.345] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0252.345] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c780) returned 0x0
	[0252.345] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0252.345] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0252.346] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0252.346] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0252.346] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.346] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0252.346] GetCurrentObject (hdc=0xf0119d0, type=0x1) returned 0x1b00017
	[0252.347] GetCurrentObject (hdc=0xf0119d0, type=0x2) returned 0x1900010
	[0252.347] GetCurrentObject (hdc=0xf0119d0, type=0x7) returned 0x140507d2
	[0252.347] GetCurrentObject (hdc=0xf0119d0, type=0x6) returned 0x18a002e
	[0252.347] SaveDC (hdc=0xf0119d0) returned 1
	[0252.347] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffae040710
	[0252.348] GetClipRgn (hdc=0xf0119d0, hrgn=0xffffffffae040710) returned 0
	[0252.348] SelectClipRgn (hdc=0xf0119d0, hrgn=0x420407f9) returned 2
	[0252.348] DeleteObject (ho=0xffffffffae040710) returned 1
	[0252.348] DeleteObject (ho=0x420407f9) returned 1
	[0252.348] OffsetViewportOrgEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x26c5348 | out: lppt=0x26c5348) returned 1
	[0252.348] GetNearestColor (hdc=0xf0119d0, color=0xf0f0f0) returned 0xf0f0f0
	[0252.349] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff921007c0
	[0252.349] FillRect (hDC=0xf0119d0, lprc=0x20c990, hbr=0xffffffff921007c0) returned 1
	[0252.349] DeleteObject (ho=0xffffffff921007c0) returned 1
	[0252.349] RestoreDC (hdc=0xf0119d0, nSavedDC=-1) returned 1
	[0252.349] GdipReleaseDC (graphics=0x1b929550, hdc=0xf0119d0) returned 0x0
	[0252.350] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0252.350] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.350] CoTaskMemFree (pv=0x1b067a60) 
	[0252.350] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0252.350] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.350] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.351] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.351] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0252.351] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0252.351] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0252.351] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.352] GetFocus () returned 0x201d8
	[0252.352] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.352] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0252.352] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.352] CoTaskMemFree (pv=0x1b067a60) 
	[0252.352] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0252.352] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0252.353] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0252.353] GdipCreateRegion (region=0x20c830) returned 0x0
	[0252.353] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.353] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0252.353] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0252.354] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c890) returned 0x0
	[0252.354] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0252.354] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0252.354] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0252.354] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0252.354] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0252.355] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0252.355] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.355] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0252.356] GetCurrentObject (hdc=0xf0119d0, type=0x1) returned 0x1b00017
	[0252.356] GetCurrentObject (hdc=0xf0119d0, type=0x2) returned 0x1900010
	[0252.356] GetCurrentObject (hdc=0xf0119d0, type=0x7) returned 0x140507d2
	[0252.356] GetCurrentObject (hdc=0xf0119d0, type=0x6) returned 0x18a002e
	[0252.356] SaveDC (hdc=0xf0119d0) returned 1
	[0252.357] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x430407f9
	[0252.357] GetClipRgn (hdc=0xf0119d0, hrgn=0x430407f9) returned 0
	[0252.357] SelectClipRgn (hdc=0xf0119d0, hrgn=0xffffffffaf040710) returned 2
	[0252.357] DeleteObject (ho=0x430407f9) returned 1
	[0252.357] DeleteObject (ho=0xffffffffaf040710) returned 1
	[0252.357] OffsetViewportOrgEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x26c58e8 | out: lppt=0x26c58e8) returned 1
	[0252.358] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.358] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.358] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.358] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x22301bb5
	[0252.358] SelectObject (hdc=0xf0119d0, h=0x22301bb5) returned 0x1b00017
	[0252.359] MoveToEx (in: hdc=0xf0119d0, x=164, y=1, lppt=0x26c5950 | out: lppt=0x26c5950) returned 1
	[0252.359] LineTo (hdc=0xf0119d0, x=1, y=1) returned 1
	[0252.359] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.359] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.359] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.360] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.360] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.360] SelectObject (hdc=0xf0119d0, h=0x22301bb5) returned 0x22301bb5
	[0252.360] MoveToEx (in: hdc=0xf0119d0, x=1, y=1, lppt=0x26c5968 | out: lppt=0x26c5968) returned 1
	[0252.360] LineTo (hdc=0xf0119d0, x=1, y=41) returned 1
	[0252.360] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.361] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.361] SelectObject (hdc=0xf0119d0, h=0x1b00017) returned 0x22301bb5
	[0252.361] DeleteObject (ho=0x22301bb5) returned 1
	[0252.361] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.361] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.362] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.362] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x40301bac
	[0252.362] SelectObject (hdc=0xf0119d0, h=0x40301bac) returned 0x1b00017
	[0252.362] MoveToEx (in: hdc=0xf0119d0, x=1, y=41, lppt=0x26c59d0 | out: lppt=0x26c59d0) returned 1
	[0252.362] LineTo (hdc=0xf0119d0, x=164, y=41) returned 1
	[0252.362] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.363] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.363] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.363] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.363] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.363] SelectObject (hdc=0xf0119d0, h=0x40301bac) returned 0x40301bac
	[0252.364] MoveToEx (in: hdc=0xf0119d0, x=164, y=41, lppt=0x26c59e8 | out: lppt=0x26c59e8) returned 1
	[0252.364] LineTo (hdc=0xf0119d0, x=164, y=0) returned 1
	[0252.364] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.364] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.364] SelectObject (hdc=0xf0119d0, h=0x1b00017) returned 0x40301bac
	[0252.364] DeleteObject (ho=0x40301bac) returned 1
	[0252.365] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.365] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.365] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.365] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x23301bb5
	[0252.365] SelectObject (hdc=0xf0119d0, h=0x23301bb5) returned 0x1b00017
	[0252.365] MoveToEx (in: hdc=0xf0119d0, x=163, y=2, lppt=0x26c5a50 | out: lppt=0x26c5a50) returned 1
	[0252.366] LineTo (hdc=0xf0119d0, x=2, y=2) returned 1
	[0252.366] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.366] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.366] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.366] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.367] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.367] SelectObject (hdc=0xf0119d0, h=0x23301bb5) returned 0x23301bb5
	[0252.367] MoveToEx (in: hdc=0xf0119d0, x=2, y=2, lppt=0x26c5a68 | out: lppt=0x26c5a68) returned 1
	[0252.367] LineTo (hdc=0xf0119d0, x=2, y=40) returned 1
	[0252.367] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.367] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.368] SelectObject (hdc=0xf0119d0, h=0x1b00017) returned 0x23301bb5
	[0252.368] DeleteObject (ho=0x23301bb5) returned 1
	[0252.368] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.368] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.368] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.369] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x41301bac
	[0252.369] SelectObject (hdc=0xf0119d0, h=0x41301bac) returned 0x1b00017
	[0252.369] MoveToEx (in: hdc=0xf0119d0, x=2, y=40, lppt=0x26c5ad0 | out: lppt=0x26c5ad0) returned 1
	[0252.369] LineTo (hdc=0xf0119d0, x=163, y=40) returned 1
	[0252.369] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.369] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.370] GetROP2 (hdc=0xf0119d0) returned 13
	[0252.370] GetBkMode (hdc=0xf0119d0) returned 2
	[0252.370] SetBkMode (hdc=0xf0119d0, mode=1) returned 2
	[0252.370] SelectObject (hdc=0xf0119d0, h=0x41301bac) returned 0x41301bac
	[0252.370] MoveToEx (in: hdc=0xf0119d0, x=163, y=40, lppt=0x26c5ae8 | out: lppt=0x26c5ae8) returned 1
	[0252.371] LineTo (hdc=0xf0119d0, x=163, y=1) returned 1
	[0252.371] SetBkMode (hdc=0xf0119d0, mode=2) returned 1
	[0252.371] MoveToEx (in: hdc=0xf0119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.371] SelectObject (hdc=0xf0119d0, h=0x1b00017) returned 0x41301bac
	[0252.371] DeleteObject (ho=0x41301bac) returned 1
	[0252.371] RestoreDC (hdc=0xf0119d0, nSavedDC=-1) returned 1
	[0252.372] GdipReleaseDC (graphics=0x1b929550, hdc=0xf0119d0) returned 0x0
	[0252.372] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0252.372] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0xf0119d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0252.372] GdipReleaseDC (graphics=0x1b929550, hdc=0xf0119d0) returned 0x0
	[0252.373] SelectObject (hdc=0xf0119d0, h=0x185000f) returned 0x140507d2
	[0252.373] DeleteDC (hdc=0xf0119d0) returned 1
	[0252.373] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0252.373] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0252.373] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0252.373] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26c5b40, cPoints=0x1 | out: lpPoints=0x26c5b40) returned 30606029
	[0252.373] WindowFromPoint (Point=0x1dd0000030f) returned 0x201d8
	[0252.373] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.374] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0252.374] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0252.375] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0252.375] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26c5c30, Length=0x70 | out: Destination=0x1afe53a0) 
	[0252.375] ShellExecuteExW (in: pExecInfo=0x26c5e40*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26c5e40*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0252.415] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0252.415] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0252.415] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0252.415] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0252.415] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0252.415] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0252.416] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0252.416] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0252.416] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0252.416] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0252.416] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0252.416] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0252.416] GetStockObject (i=5) returned 0x1900015
	[0252.416] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0252.417] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0252.417] GetCapture () returned 0x0
	[0252.417] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0252.417] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0252.417] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0252.417] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x70107fc
	[0252.417] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0252.417] CreateCompatibleDC (hdc=0x70107fc) returned 0x170119d0
	[0252.417] SelectObject (hdc=0x170119d0, h=0x140507d2) returned 0x185000f
	[0252.417] GdipCreateFromHDC (hdc=0x170119d0, graphics=0x20c9d0) returned 0x0
	[0252.417] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0252.417] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0252.417] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0252.417] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0252.418] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20cb60) returned 0x0
	[0252.418] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c740
	[0252.418] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0252.418] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0252.418] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0252.418] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.418] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0252.418] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0252.418] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9630dbd) returned 0x0
	[0252.418] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.418] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.419] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0252.419] GetCurrentObject (hdc=0x170119d0, type=0x1) returned 0x1b00017
	[0252.419] GetCurrentObject (hdc=0x170119d0, type=0x2) returned 0x1900010
	[0252.419] GetCurrentObject (hdc=0x170119d0, type=0x7) returned 0x140507d2
	[0252.419] GetCurrentObject (hdc=0x170119d0, type=0x6) returned 0x18a002e
	[0252.419] SaveDC (hdc=0x170119d0) returned 1
	[0252.419] GetNearestColor (hdc=0x170119d0, color=0xf0f0f0) returned 0xf0f0f0
	[0252.419] GetNearestColor (hdc=0x170119d0, color=0xa0a0a0) returned 0xa0a0a0
	[0252.419] GetNearestColor (hdc=0x170119d0, color=0x696969) returned 0x696969
	[0252.420] GetNearestColor (hdc=0x170119d0, color=0xa0a0a0) returned 0xa0a0a0
	[0252.420] GetNearestColor (hdc=0x170119d0, color=0x0) returned 0x0
	[0252.420] GetNearestColor (hdc=0x170119d0, color=0xffffff) returned 0xffffff
	[0252.420] GetNearestColor (hdc=0x170119d0, color=0xe5e5e5) returned 0xe5e5e5
	[0252.420] GetNearestColor (hdc=0x170119d0, color=0xd8d8d8) returned 0xd8d8d8
	[0252.420] GetNearestColor (hdc=0x170119d0, color=0x0) returned 0x0
	[0252.420] RestoreDC (hdc=0x170119d0, nSavedDC=-1) returned 1
	[0252.421] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.421] GdipReleaseDC (graphics=0x1b929550, hdc=0x170119d0) returned 0x0
	[0252.421] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.421] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0252.421] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.421] CoTaskMemFree (pv=0x1b077150) 
	[0252.421] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0252.421] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.421] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.421] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.421] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0252.421] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0252.421] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0252.421] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0252.421] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0252.422] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.422] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.422] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.422] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0252.422] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.422] CoTaskMemFree (pv=0x1b077150) 
	[0252.422] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0252.422] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0252.422] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0252.422] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0252.422] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.422] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.422] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.422] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0252.422] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.423] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.423] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.423] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0252.423] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.423] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0252.423] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.423] CoTaskMemFree (pv=0x1b077150) 
	[0252.423] GdipCreateRegion (region=0x20c310) returned 0x0
	[0252.423] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.423] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0252.423] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0252.423] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c370) returned 0x0
	[0252.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c740
	[0252.423] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0252.424] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0252.424] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0252.424] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0252.424] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0252.424] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0252.424] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.424] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.424] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0252.424] GetCurrentObject (hdc=0x170119d0, type=0x1) returned 0x1b00017
	[0252.424] GetCurrentObject (hdc=0x170119d0, type=0x2) returned 0x1900010
	[0252.424] GetCurrentObject (hdc=0x170119d0, type=0x7) returned 0x140507d2
	[0252.424] GetCurrentObject (hdc=0x170119d0, type=0x6) returned 0x18a002e
	[0252.424] SaveDC (hdc=0x170119d0) returned 1
	[0252.424] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb0040710
	[0252.424] GetClipRgn (hdc=0x170119d0, hrgn=0xffffffffb0040710) returned 0
	[0252.424] SelectClipRgn (hdc=0x170119d0, hrgn=0x460407f9) returned 2
	[0252.424] DeleteObject (ho=0xffffffffb0040710) returned 1
	[0252.425] DeleteObject (ho=0x460407f9) returned 1
	[0252.425] OffsetViewportOrgEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x26c6b20 | out: lppt=0x26c6b20) returned 1
	[0252.425] GetNearestColor (hdc=0x170119d0, color=0xf0f0f0) returned 0xf0f0f0
	[0252.425] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff931007c0
	[0252.425] FillRect (hDC=0x170119d0, lprc=0x20c3c0, hbr=0xffffffff931007c0) returned 1
	[0252.425] DeleteObject (ho=0xffffffff931007c0) returned 1
	[0252.425] RestoreDC (hdc=0x170119d0, nSavedDC=-1) returned 1
	[0252.425] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.425] GdipReleaseDC (graphics=0x1b929550, hdc=0x170119d0) returned 0x0
	[0252.425] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.425] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0252.425] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.425] CoTaskMemFree (pv=0x1b077150) 
	[0252.425] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0252.425] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.426] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.426] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.426] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0252.426] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0252.426] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.426] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0252.426] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.426] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.426] GetFocus () returned 0x0
	[0252.426] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.426] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0252.426] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.426] CoTaskMemFree (pv=0x1b077150) 
	[0252.426] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0252.426] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0252.426] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.426] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0252.427] GdipCreateRegion (region=0x20c260) returned 0x0
	[0252.427] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.427] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0252.427] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0252.427] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20c2c0) returned 0x0
	[0252.427] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c740
	[0252.427] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0252.427] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c740) returned 0x0
	[0252.427] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0252.427] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0252.427] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0252.427] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0252.427] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.427] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.427] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0252.428] GetCurrentObject (hdc=0x170119d0, type=0x1) returned 0x1b00017
	[0252.428] GetCurrentObject (hdc=0x170119d0, type=0x2) returned 0x1900010
	[0252.428] GetCurrentObject (hdc=0x170119d0, type=0x7) returned 0x140507d2
	[0252.428] GetCurrentObject (hdc=0x170119d0, type=0x6) returned 0x18a002e
	[0252.428] SaveDC (hdc=0x170119d0) returned 1
	[0252.428] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x470407f9
	[0252.428] GetClipRgn (hdc=0x170119d0, hrgn=0x470407f9) returned 0
	[0252.428] SelectClipRgn (hdc=0x170119d0, hrgn=0xffffffffb1040710) returned 2
	[0252.428] DeleteObject (ho=0x470407f9) returned 1
	[0252.428] DeleteObject (ho=0xffffffffb1040710) returned 1
	[0252.428] OffsetViewportOrgEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x26c70c0 | out: lppt=0x26c70c0) returned 1
	[0252.428] GetROP2 (hdc=0x170119d0) returned 13
	[0252.428] GetBkMode (hdc=0x170119d0) returned 2
	[0252.428] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.428] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x42301bac
	[0252.428] SelectObject (hdc=0x170119d0, h=0x42301bac) returned 0x1b00017
	[0252.428] MoveToEx (in: hdc=0x170119d0, x=164, y=1, lppt=0x26c7128 | out: lppt=0x26c7128) returned 1
	[0252.428] LineTo (hdc=0x170119d0, x=1, y=1) returned 1
	[0252.428] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.428] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.429] GetROP2 (hdc=0x170119d0) returned 13
	[0252.429] GetBkMode (hdc=0x170119d0) returned 2
	[0252.429] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.429] SelectObject (hdc=0x170119d0, h=0x42301bac) returned 0x42301bac
	[0252.429] MoveToEx (in: hdc=0x170119d0, x=1, y=1, lppt=0x26c7140 | out: lppt=0x26c7140) returned 1
	[0252.429] LineTo (hdc=0x170119d0, x=1, y=41) returned 1
	[0252.429] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.429] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.429] SelectObject (hdc=0x170119d0, h=0x1b00017) returned 0x42301bac
	[0252.429] DeleteObject (ho=0x42301bac) returned 1
	[0252.429] GetROP2 (hdc=0x170119d0) returned 13
	[0252.429] GetBkMode (hdc=0x170119d0) returned 2
	[0252.429] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.429] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x24301bb5
	[0252.429] SelectObject (hdc=0x170119d0, h=0x24301bb5) returned 0x1b00017
	[0252.429] MoveToEx (in: hdc=0x170119d0, x=1, y=41, lppt=0x26c71a8 | out: lppt=0x26c71a8) returned 1
	[0252.429] LineTo (hdc=0x170119d0, x=164, y=41) returned 1
	[0252.429] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.429] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.429] GetROP2 (hdc=0x170119d0) returned 13
	[0252.429] GetBkMode (hdc=0x170119d0) returned 2
	[0252.429] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.429] SelectObject (hdc=0x170119d0, h=0x24301bb5) returned 0x24301bb5
	[0252.429] MoveToEx (in: hdc=0x170119d0, x=164, y=41, lppt=0x26c71c0 | out: lppt=0x26c71c0) returned 1
	[0252.430] LineTo (hdc=0x170119d0, x=164, y=0) returned 1
	[0252.430] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.430] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.430] SelectObject (hdc=0x170119d0, h=0x1b00017) returned 0x24301bb5
	[0252.430] DeleteObject (ho=0x24301bb5) returned 1
	[0252.430] GetROP2 (hdc=0x170119d0) returned 13
	[0252.430] GetBkMode (hdc=0x170119d0) returned 2
	[0252.430] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.430] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x43301bac
	[0252.430] SelectObject (hdc=0x170119d0, h=0x43301bac) returned 0x1b00017
	[0252.430] MoveToEx (in: hdc=0x170119d0, x=163, y=2, lppt=0x26c7228 | out: lppt=0x26c7228) returned 1
	[0252.430] LineTo (hdc=0x170119d0, x=2, y=2) returned 1
	[0252.430] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.430] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.430] GetROP2 (hdc=0x170119d0) returned 13
	[0252.430] GetBkMode (hdc=0x170119d0) returned 2
	[0252.430] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.430] SelectObject (hdc=0x170119d0, h=0x43301bac) returned 0x43301bac
	[0252.430] MoveToEx (in: hdc=0x170119d0, x=2, y=2, lppt=0x26c7240 | out: lppt=0x26c7240) returned 1
	[0252.430] LineTo (hdc=0x170119d0, x=2, y=40) returned 1
	[0252.430] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.431] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.431] SelectObject (hdc=0x170119d0, h=0x1b00017) returned 0x43301bac
	[0252.431] DeleteObject (ho=0x43301bac) returned 1
	[0252.431] GetROP2 (hdc=0x170119d0) returned 13
	[0252.431] GetBkMode (hdc=0x170119d0) returned 2
	[0252.431] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.431] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x25301bb5
	[0252.431] SelectObject (hdc=0x170119d0, h=0x25301bb5) returned 0x1b00017
	[0252.431] MoveToEx (in: hdc=0x170119d0, x=2, y=40, lppt=0x26c72a8 | out: lppt=0x26c72a8) returned 1
	[0252.431] LineTo (hdc=0x170119d0, x=163, y=40) returned 1
	[0252.431] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.431] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.431] GetROP2 (hdc=0x170119d0) returned 13
	[0252.431] GetBkMode (hdc=0x170119d0) returned 2
	[0252.431] SetBkMode (hdc=0x170119d0, mode=1) returned 2
	[0252.431] SelectObject (hdc=0x170119d0, h=0x25301bb5) returned 0x25301bb5
	[0252.431] MoveToEx (in: hdc=0x170119d0, x=163, y=40, lppt=0x26c72c0 | out: lppt=0x26c72c0) returned 1
	[0252.431] LineTo (hdc=0x170119d0, x=163, y=1) returned 1
	[0252.431] SetBkMode (hdc=0x170119d0, mode=2) returned 1
	[0252.431] MoveToEx (in: hdc=0x170119d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.431] SelectObject (hdc=0x170119d0, h=0x1b00017) returned 0x25301bb5
	[0252.431] DeleteObject (ho=0x25301bb5) returned 1
	[0252.431] RestoreDC (hdc=0x170119d0, nSavedDC=-1) returned 1
	[0252.431] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.432] GdipReleaseDC (graphics=0x1b929550, hdc=0x170119d0) returned 0x0
	[0252.432] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0252.432] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x170119d0, x1=0, y1=0, rop=0xcc0020) returned 1
	[0252.432] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.432] GdipReleaseDC (graphics=0x1b929550, hdc=0x170119d0) returned 0x0
	[0252.432] SelectObject (hdc=0x170119d0, h=0x185000f) returned 0x140507d2
	[0252.432] DeleteDC (hdc=0x170119d0) returned 1
	[0252.432] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.432] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0252.432] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0252.432] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0252.432] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.432] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.432] GetKeyState (nVirtKey=1) returned 0
	[0252.432] GetKeyState (nVirtKey=2) returned 0
	[0252.432] GetKeyState (nVirtKey=4) returned 0
	[0252.432] GetKeyState (nVirtKey=5) returned 0
	[0252.432] GetKeyState (nVirtKey=6) returned 0
	[0252.436] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.436] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.436] GetKeyState (nVirtKey=1) returned 0
	[0252.436] GetKeyState (nVirtKey=2) returned 0
	[0252.436] GetKeyState (nVirtKey=4) returned 0
	[0252.436] GetKeyState (nVirtKey=5) returned 0
	[0252.436] GetKeyState (nVirtKey=6) returned 0
	[0252.437] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.437] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.437] GetKeyState (nVirtKey=1) returned 0
	[0252.437] GetKeyState (nVirtKey=2) returned 0
	[0252.437] GetKeyState (nVirtKey=4) returned 0
	[0252.437] GetKeyState (nVirtKey=5) returned 0
	[0252.437] GetKeyState (nVirtKey=6) returned 0
	[0252.438] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.438] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.438] GetKeyState (nVirtKey=1) returned 0
	[0252.438] GetKeyState (nVirtKey=2) returned 0
	[0252.438] GetKeyState (nVirtKey=4) returned 0
	[0252.438] GetKeyState (nVirtKey=5) returned 0
	[0252.438] GetKeyState (nVirtKey=6) returned 0
	[0252.439] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.439] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.439] GetKeyState (nVirtKey=1) returned 0
	[0252.439] GetKeyState (nVirtKey=2) returned 0
	[0252.439] GetKeyState (nVirtKey=4) returned 0
	[0252.439] GetKeyState (nVirtKey=5) returned 0
	[0252.439] GetKeyState (nVirtKey=6) returned 0
	[0252.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.441] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.441] GetKeyState (nVirtKey=1) returned 0
	[0252.441] GetKeyState (nVirtKey=2) returned 0
	[0252.441] GetKeyState (nVirtKey=4) returned 0
	[0252.441] GetKeyState (nVirtKey=5) returned 0
	[0252.441] GetKeyState (nVirtKey=6) returned 0
	[0252.442] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.442] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.442] GetKeyState (nVirtKey=1) returned 0
	[0252.442] GetKeyState (nVirtKey=2) returned 0
	[0252.442] GetKeyState (nVirtKey=4) returned 0
	[0252.442] GetKeyState (nVirtKey=5) returned 0
	[0252.442] GetKeyState (nVirtKey=6) returned 0
	[0252.443] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.443] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.443] GetKeyState (nVirtKey=1) returned 0
	[0252.443] GetKeyState (nVirtKey=2) returned 0
	[0252.443] GetKeyState (nVirtKey=4) returned 0
	[0252.443] GetKeyState (nVirtKey=5) returned 0
	[0252.443] GetKeyState (nVirtKey=6) returned 0
	[0252.444] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.444] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.444] GetKeyState (nVirtKey=1) returned 0
	[0252.444] GetKeyState (nVirtKey=2) returned 0
	[0252.444] GetKeyState (nVirtKey=4) returned 0
	[0252.444] GetKeyState (nVirtKey=5) returned 0
	[0252.444] GetKeyState (nVirtKey=6) returned 0
	[0252.445] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.445] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.445] GetKeyState (nVirtKey=1) returned 0
	[0252.445] GetKeyState (nVirtKey=2) returned 0
	[0252.445] GetKeyState (nVirtKey=4) returned 0
	[0252.445] GetKeyState (nVirtKey=5) returned 0
	[0252.445] GetKeyState (nVirtKey=6) returned 0
	[0252.446] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.446] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.446] GetKeyState (nVirtKey=1) returned 0
	[0252.446] GetKeyState (nVirtKey=2) returned 0
	[0252.446] GetKeyState (nVirtKey=4) returned 0
	[0252.446] GetKeyState (nVirtKey=5) returned 0
	[0252.446] GetKeyState (nVirtKey=6) returned 0
	[0252.448] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.448] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.448] GetKeyState (nVirtKey=1) returned 0
	[0252.448] GetKeyState (nVirtKey=2) returned 0
	[0252.448] GetKeyState (nVirtKey=4) returned 0
	[0252.448] GetKeyState (nVirtKey=5) returned 0
	[0252.448] GetKeyState (nVirtKey=6) returned 0
	[0252.450] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.450] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.450] GetKeyState (nVirtKey=1) returned 0
	[0252.450] GetKeyState (nVirtKey=2) returned 0
	[0252.450] GetKeyState (nVirtKey=4) returned 0
	[0252.450] GetKeyState (nVirtKey=5) returned 0
	[0252.450] GetKeyState (nVirtKey=6) returned 0
	[0252.451] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.451] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.451] GetKeyState (nVirtKey=1) returned 0
	[0252.451] GetKeyState (nVirtKey=2) returned 0
	[0252.451] GetKeyState (nVirtKey=4) returned 0
	[0252.451] GetKeyState (nVirtKey=5) returned 0
	[0252.451] GetKeyState (nVirtKey=6) returned 0
	[0252.483] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.483] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.483] GetKeyState (nVirtKey=1) returned 0
	[0252.483] GetKeyState (nVirtKey=2) returned 0
	[0252.483] GetKeyState (nVirtKey=4) returned 0
	[0252.483] GetKeyState (nVirtKey=5) returned 0
	[0252.483] GetKeyState (nVirtKey=6) returned 0
	[0252.517] LocalFree (hMem=0x1afe53a0) returned 0x0
	[0252.517] GetCapture () returned 0x0
	[0252.517] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.517] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.517] WaitMessage () returned 1
	[0252.539] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.539] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.539] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.539] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.539] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.540] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.540] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.540] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.540] GetKeyState (nVirtKey=1) returned 0
	[0252.540] GetKeyState (nVirtKey=2) returned 0
	[0252.540] GetKeyState (nVirtKey=4) returned 0
	[0252.540] GetKeyState (nVirtKey=5) returned 0
	[0252.540] GetKeyState (nVirtKey=6) returned 0
	[0252.540] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.540] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.540] WaitMessage () returned 1
	[0252.541] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.541] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.541] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.541] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.541] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.541] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.541] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.541] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.541] GetKeyState (nVirtKey=1) returned 0
	[0252.541] GetKeyState (nVirtKey=2) returned 0
	[0252.541] GetKeyState (nVirtKey=4) returned 0
	[0252.541] GetKeyState (nVirtKey=5) returned 0
	[0252.541] GetKeyState (nVirtKey=6) returned 0
	[0252.541] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.541] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.541] WaitMessage () returned 1
	[0252.544] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.544] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.544] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.544] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.544] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.544] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.544] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.544] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.544] GetKeyState (nVirtKey=1) returned 0
	[0252.544] GetKeyState (nVirtKey=2) returned 0
	[0252.544] GetKeyState (nVirtKey=4) returned 0
	[0252.544] GetKeyState (nVirtKey=5) returned 0
	[0252.544] GetKeyState (nVirtKey=6) returned 0
	[0252.544] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.544] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.544] WaitMessage () returned 1
	[0252.552] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.552] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.552] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.553] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.553] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.553] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.553] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.553] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.553] GetKeyState (nVirtKey=1) returned 0
	[0252.553] GetKeyState (nVirtKey=2) returned 0
	[0252.553] GetKeyState (nVirtKey=4) returned 0
	[0252.553] GetKeyState (nVirtKey=5) returned 0
	[0252.553] GetKeyState (nVirtKey=6) returned 0
	[0252.553] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.553] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.553] WaitMessage () returned 1
	[0252.554] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.554] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.554] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.554] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.554] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.554] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.554] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.554] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.554] GetKeyState (nVirtKey=1) returned 0
	[0252.554] GetKeyState (nVirtKey=2) returned 0
	[0252.554] GetKeyState (nVirtKey=4) returned 0
	[0252.554] GetKeyState (nVirtKey=5) returned 0
	[0252.554] GetKeyState (nVirtKey=6) returned 0
	[0252.554] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.554] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.554] WaitMessage () returned 1
	[0252.556] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.556] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.556] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.556] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.556] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.556] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.556] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.556] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.556] GetKeyState (nVirtKey=1) returned 0
	[0252.556] GetKeyState (nVirtKey=2) returned 0
	[0252.556] GetKeyState (nVirtKey=4) returned 0
	[0252.557] GetKeyState (nVirtKey=5) returned 0
	[0252.557] GetKeyState (nVirtKey=6) returned 0
	[0252.557] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.557] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.557] WaitMessage () returned 1
	[0252.586] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.586] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.586] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.586] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.586] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.586] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.586] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.586] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.586] GetKeyState (nVirtKey=1) returned 0
	[0252.586] GetKeyState (nVirtKey=2) returned 0
	[0252.586] GetKeyState (nVirtKey=4) returned 0
	[0252.586] GetKeyState (nVirtKey=5) returned 0
	[0252.586] GetKeyState (nVirtKey=6) returned 0
	[0252.586] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.586] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.586] WaitMessage () returned 1
	[0252.588] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.588] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.588] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.588] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.588] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.588] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.589] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.589] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.589] GetKeyState (nVirtKey=1) returned 0
	[0252.589] GetKeyState (nVirtKey=2) returned 0
	[0252.589] GetKeyState (nVirtKey=4) returned 0
	[0252.589] GetKeyState (nVirtKey=5) returned 0
	[0252.589] GetKeyState (nVirtKey=6) returned 0
	[0252.589] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.589] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.589] WaitMessage () returned 1
	[0252.597] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.597] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.597] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.597] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.597] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.597] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.597] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.597] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.597] GetKeyState (nVirtKey=1) returned 0
	[0252.597] GetKeyState (nVirtKey=2) returned 0
	[0252.597] GetKeyState (nVirtKey=4) returned 0
	[0252.597] GetKeyState (nVirtKey=5) returned 0
	[0252.597] GetKeyState (nVirtKey=6) returned 0
	[0252.598] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.598] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.598] WaitMessage () returned 1
	[0252.598] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.598] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.598] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.598] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.598] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.598] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.598] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.598] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.598] GetKeyState (nVirtKey=1) returned 0
	[0252.598] GetKeyState (nVirtKey=2) returned 0
	[0252.598] GetKeyState (nVirtKey=4) returned 0
	[0252.599] GetKeyState (nVirtKey=5) returned 0
	[0252.599] GetKeyState (nVirtKey=6) returned 0
	[0252.599] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.599] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.599] WaitMessage () returned 1
	[0252.600] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.600] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.600] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.600] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.600] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.600] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.600] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.600] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.600] GetKeyState (nVirtKey=1) returned 0
	[0252.600] GetKeyState (nVirtKey=2) returned 0
	[0252.600] GetKeyState (nVirtKey=4) returned 0
	[0252.600] GetKeyState (nVirtKey=5) returned 0
	[0252.600] GetKeyState (nVirtKey=6) returned 0
	[0252.600] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.600] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.600] WaitMessage () returned 1
	[0252.601] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.601] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.601] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.601] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.601] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1dd030f) returned 0x1
	[0252.602] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0252.602] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.602] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.602] GetKeyState (nVirtKey=1) returned 0
	[0252.602] GetKeyState (nVirtKey=2) returned 0
	[0252.602] GetKeyState (nVirtKey=4) returned 0
	[0252.602] GetKeyState (nVirtKey=5) returned 0
	[0252.602] GetKeyState (nVirtKey=6) returned 0
	[0252.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.602] WaitMessage () returned 1
	[0252.620] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.620] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.620] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.621] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.621] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.621] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.621] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0252.621] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0252.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.621] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.621] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.621] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.621] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.621] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0252.621] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.621] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.621] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0252.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.621] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0252.621] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.621] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.621] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.621] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0252.621] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0252.621] CreateCompatibleDC (hdc=0x70107fc) returned 0x2011bc5
	[0252.621] SelectObject (hdc=0x2011bc5, h=0x140507d2) returned 0x185000f
	[0252.621] GdipCreateFromHDC (hdc=0x2011bc5, graphics=0x20d7e0) returned 0x0
	[0252.622] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0252.622] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0252.622] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0252.622] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0252.622] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0252.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c7c0
	[0252.622] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0252.622] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0252.622] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.622] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0252.622] GdipCreateRegion (region=0x20d910) returned 0x0
	[0252.622] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.622] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0252.622] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0252.622] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9600dbd) returned 0x0
	[0252.622] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0252.622] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.623] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0252.623] GetCurrentObject (hdc=0x2011bc5, type=0x1) returned 0x1b00017
	[0252.623] GetCurrentObject (hdc=0x2011bc5, type=0x2) returned 0x1900010
	[0252.623] GetCurrentObject (hdc=0x2011bc5, type=0x7) returned 0x140507d2
	[0252.623] GetCurrentObject (hdc=0x2011bc5, type=0x6) returned 0x18a002e
	[0252.623] SaveDC (hdc=0x2011bc5) returned 1
	[0252.623] GetNearestColor (hdc=0x2011bc5, color=0xf0f0f0) returned 0xf0f0f0
	[0252.623] GetNearestColor (hdc=0x2011bc5, color=0xa0a0a0) returned 0xa0a0a0
	[0252.623] GetNearestColor (hdc=0x2011bc5, color=0x696969) returned 0x696969
	[0252.624] GetNearestColor (hdc=0x2011bc5, color=0xa0a0a0) returned 0xa0a0a0
	[0252.624] GetNearestColor (hdc=0x2011bc5, color=0x0) returned 0x0
	[0252.624] GetNearestColor (hdc=0x2011bc5, color=0xffffff) returned 0xffffff
	[0252.625] GetNearestColor (hdc=0x2011bc5, color=0xe5e5e5) returned 0xe5e5e5
	[0252.625] GetNearestColor (hdc=0x2011bc5, color=0xd8d8d8) returned 0xd8d8d8
	[0252.625] GetNearestColor (hdc=0x2011bc5, color=0x0) returned 0x0
	[0252.625] RestoreDC (hdc=0x2011bc5, nSavedDC=-1) returned 1
	[0252.625] GdipReleaseDC (graphics=0x1b929550, hdc=0x2011bc5) returned 0x0
	[0252.626] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0252.626] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.626] CoTaskMemFree (pv=0x1b067a80) 
	[0252.626] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0252.626] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.626] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.626] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.627] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0252.627] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0252.627] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0252.627] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0252.627] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0252.627] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.628] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0252.628] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.628] CoTaskMemFree (pv=0x1b067a80) 
	[0252.628] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0252.628] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0252.628] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0252.628] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0252.628] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.629] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.629] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.629] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0252.629] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.629] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0252.629] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0252.630] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.630] CoTaskMemFree (pv=0x1b067a80) 
	[0252.630] GdipCreateRegion (region=0x20d120) returned 0x0
	[0252.630] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.630] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0252.630] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0252.630] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d180) returned 0x0
	[0252.631] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0252.631] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0252.631] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0252.631] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0252.631] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0252.631] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0252.632] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0252.632] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0252.632] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.632] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0252.632] GetCurrentObject (hdc=0x2011bc5, type=0x1) returned 0x1b00017
	[0252.632] GetCurrentObject (hdc=0x2011bc5, type=0x2) returned 0x1900010
	[0252.633] GetCurrentObject (hdc=0x2011bc5, type=0x7) returned 0x140507d2
	[0252.633] GetCurrentObject (hdc=0x2011bc5, type=0x6) returned 0x18a002e
	[0252.633] SaveDC (hdc=0x2011bc5) returned 1
	[0252.633] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb2040710
	[0252.633] GetClipRgn (hdc=0x2011bc5, hrgn=0xffffffffb2040710) returned 0
	[0252.633] SelectClipRgn (hdc=0x2011bc5, hrgn=0x480407f9) returned 2
	[0252.634] DeleteObject (ho=0xffffffffb2040710) returned 1
	[0252.634] DeleteObject (ho=0x480407f9) returned 1
	[0252.634] OffsetViewportOrgEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x26c8668 | out: lppt=0x26c8668) returned 1
	[0252.634] GetNearestColor (hdc=0x2011bc5, color=0xf0f0f0) returned 0xf0f0f0
	[0252.634] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff941007c0
	[0252.635] FillRect (hDC=0x2011bc5, lprc=0x20d1d0, hbr=0xffffffff941007c0) returned 1
	[0252.635] DeleteObject (ho=0xffffffff941007c0) returned 1
	[0252.635] RestoreDC (hdc=0x2011bc5, nSavedDC=-1) returned 1
	[0252.635] GdipReleaseDC (graphics=0x1b929550, hdc=0x2011bc5) returned 0x0
	[0252.635] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0252.636] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.636] CoTaskMemFree (pv=0x1b067a80) 
	[0252.636] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0252.636] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.649] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0252.649] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0252.649] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0252.649] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0252.650] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0252.650] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0252.650] GetFocus () returned 0x0
	[0252.650] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0252.650] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0252.651] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0252.651] CoTaskMemFree (pv=0x1b067a80) 
	[0252.651] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0252.651] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0252.651] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0252.651] GdipCreateRegion (region=0x20d070) returned 0x0
	[0252.651] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0252.652] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0252.652] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0252.652] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0252.652] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0252.652] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0252.653] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0252.653] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0252.653] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0252.653] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0252.653] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0252.653] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0252.654] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0252.654] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0252.654] GetCurrentObject (hdc=0x2011bc5, type=0x1) returned 0x1b00017
	[0252.654] GetCurrentObject (hdc=0x2011bc5, type=0x2) returned 0x1900010
	[0252.654] GetCurrentObject (hdc=0x2011bc5, type=0x7) returned 0x140507d2
	[0252.654] GetCurrentObject (hdc=0x2011bc5, type=0x6) returned 0x18a002e
	[0252.655] SaveDC (hdc=0x2011bc5) returned 1
	[0252.655] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x490407f9
	[0252.655] GetClipRgn (hdc=0x2011bc5, hrgn=0x490407f9) returned 0
	[0252.655] SelectClipRgn (hdc=0x2011bc5, hrgn=0xffffffffb3040710) returned 2
	[0252.655] DeleteObject (ho=0x490407f9) returned 1
	[0252.655] DeleteObject (ho=0xffffffffb3040710) returned 1
	[0252.656] OffsetViewportOrgEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x26c8c08 | out: lppt=0x26c8c08) returned 1
	[0252.656] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.656] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.656] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.656] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x9301bd9
	[0252.656] SelectObject (hdc=0x2011bc5, h=0x9301bd9) returned 0x1b00017
	[0252.657] MoveToEx (in: hdc=0x2011bc5, x=164, y=1, lppt=0x26c8c70 | out: lppt=0x26c8c70) returned 1
	[0252.657] LineTo (hdc=0x2011bc5, x=1, y=1) returned 1
	[0252.657] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.657] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.657] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.657] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.658] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.658] SelectObject (hdc=0x2011bc5, h=0x9301bd9) returned 0x9301bd9
	[0252.658] MoveToEx (in: hdc=0x2011bc5, x=1, y=1, lppt=0x26c8c88 | out: lppt=0x26c8c88) returned 1
	[0252.658] LineTo (hdc=0x2011bc5, x=1, y=41) returned 1
	[0252.658] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.658] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.659] SelectObject (hdc=0x2011bc5, h=0x1b00017) returned 0x9301bd9
	[0252.659] DeleteObject (ho=0x9301bd9) returned 1
	[0252.659] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.659] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.659] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.660] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x8301bda
	[0252.660] SelectObject (hdc=0x2011bc5, h=0x8301bda) returned 0x1b00017
	[0252.660] MoveToEx (in: hdc=0x2011bc5, x=1, y=41, lppt=0x26c8cf0 | out: lppt=0x26c8cf0) returned 1
	[0252.660] LineTo (hdc=0x2011bc5, x=164, y=41) returned 1
	[0252.660] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.660] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.661] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.661] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.661] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.661] SelectObject (hdc=0x2011bc5, h=0x8301bda) returned 0x8301bda
	[0252.661] MoveToEx (in: hdc=0x2011bc5, x=164, y=41, lppt=0x26c8d08 | out: lppt=0x26c8d08) returned 1
	[0252.661] LineTo (hdc=0x2011bc5, x=164, y=0) returned 1
	[0252.662] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.662] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.662] SelectObject (hdc=0x2011bc5, h=0x1b00017) returned 0x8301bda
	[0252.662] DeleteObject (ho=0x8301bda) returned 1
	[0252.662] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.662] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.663] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.663] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xa301bd9
	[0252.663] SelectObject (hdc=0x2011bc5, h=0xa301bd9) returned 0x1b00017
	[0252.663] MoveToEx (in: hdc=0x2011bc5, x=163, y=2, lppt=0x26c8d70 | out: lppt=0x26c8d70) returned 1
	[0252.663] LineTo (hdc=0x2011bc5, x=2, y=2) returned 1
	[0252.663] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.664] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.664] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.664] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.664] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.664] SelectObject (hdc=0x2011bc5, h=0xa301bd9) returned 0xa301bd9
	[0252.664] MoveToEx (in: hdc=0x2011bc5, x=2, y=2, lppt=0x26c8d88 | out: lppt=0x26c8d88) returned 1
	[0252.665] LineTo (hdc=0x2011bc5, x=2, y=40) returned 1
	[0252.665] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.665] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.665] SelectObject (hdc=0x2011bc5, h=0x1b00017) returned 0xa301bd9
	[0252.665] DeleteObject (ho=0xa301bd9) returned 1
	[0252.665] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.666] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.666] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.666] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x9301bda
	[0252.666] SelectObject (hdc=0x2011bc5, h=0x9301bda) returned 0x1b00017
	[0252.666] MoveToEx (in: hdc=0x2011bc5, x=2, y=40, lppt=0x26c8df0 | out: lppt=0x26c8df0) returned 1
	[0252.666] LineTo (hdc=0x2011bc5, x=163, y=40) returned 1
	[0252.667] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.667] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.667] GetROP2 (hdc=0x2011bc5) returned 13
	[0252.667] GetBkMode (hdc=0x2011bc5) returned 2
	[0252.667] SetBkMode (hdc=0x2011bc5, mode=1) returned 2
	[0252.667] SelectObject (hdc=0x2011bc5, h=0x9301bda) returned 0x9301bda
	[0252.668] MoveToEx (in: hdc=0x2011bc5, x=163, y=40, lppt=0x26c8e08 | out: lppt=0x26c8e08) returned 1
	[0252.668] LineTo (hdc=0x2011bc5, x=163, y=1) returned 1
	[0252.668] SetBkMode (hdc=0x2011bc5, mode=2) returned 1
	[0252.668] MoveToEx (in: hdc=0x2011bc5, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0252.668] SelectObject (hdc=0x2011bc5, h=0x1b00017) returned 0x9301bda
	[0252.668] DeleteObject (ho=0x9301bda) returned 1
	[0252.669] RestoreDC (hdc=0x2011bc5, nSavedDC=-1) returned 1
	[0252.669] GdipReleaseDC (graphics=0x1b929550, hdc=0x2011bc5) returned 0x0
	[0252.669] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0252.669] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x2011bc5, x1=0, y1=0, rop=0xcc0020) returned 1
	[0252.669] GdipReleaseDC (graphics=0x1b929550, hdc=0x2011bc5) returned 0x0
	[0252.669] SelectObject (hdc=0x2011bc5, h=0x185000f) returned 0x140507d2
	[0252.670] DeleteDC (hdc=0x2011bc5) returned 1
	[0252.670] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0252.670] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0252.670] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0252.670] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.670] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.670] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.670] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.670] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.670] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0252.670] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.671] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.671] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0252.671] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.671] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.671] WaitMessage () returned 1
	[0252.721] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.721] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0252.721] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.721] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.721] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.721] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.721] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.721] WaitMessage () returned 1
	[0252.738] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.738] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.738] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.738] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.738] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.738] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0252.739] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.739] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.739] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0252.739] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.739] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.739] WaitMessage () returned 1
	[0252.771] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.771] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.772] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.772] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.772] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.772] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0252.772] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.772] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.772] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0252.772] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.772] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.772] WaitMessage () returned 1
	[0252.783] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.783] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.783] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.783] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.783] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.783] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0252.783] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.783] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.784] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0252.784] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.784] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.784] WaitMessage () returned 1
	[0252.805] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.805] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.805] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.805] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.805] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.805] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0252.805] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.805] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.805] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0252.805] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.805] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.805] WaitMessage () returned 1
	[0252.849] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.849] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.849] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0252.849] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0252.849] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0252.849] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0252.849] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0252.849] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0252.849] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0252.849] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.849] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0252.849] WaitMessage () returned 1
	[0253.128] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0253.128] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0253.128] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0253.128] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0253.128] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0253.128] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0253.128] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0253.128] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0253.128] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0253.128] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0253.128] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0253.128] WaitMessage () returned 1
	[0253.253] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0253.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0253.253] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0253.253] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0253.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0253.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0253.253] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0253.253] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0253.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0253.253] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0253.253] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0253.253] WaitMessage () returned 1
	[0253.422] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0253.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0253.422] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0253.422] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0253.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0253.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0253.422] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0253.422] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0253.422] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0253.422] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0253.422] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0253.422] WaitMessage () returned 1
	[0254.214] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.214] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.214] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0254.214] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.214] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.214] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0254.214] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.214] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.214] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0254.214] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.214] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.214] WaitMessage () returned 1
	[0254.253] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.253] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0254.253] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0254.253] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.253] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0254.253] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.253] IsWindowUnicode (hWnd=0x50120) returned 1
	[0254.253] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.253] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.253] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.253] BeginPaint (in: hWnd=0x50120, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x10107f8
	[0254.253] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x3041bf4, lParam=0x0) returned 0x0
	[0254.254] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0254.254] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0254.254] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0254.254] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0254.255] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0254.255] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0254.255] GetSystemMetrics (nIndex=42) returned 0
	[0254.255] CoTaskMemAlloc (cb=0x26) returned 0x1b065c20
	[0254.255] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b065c20, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0254.255] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b065c20) returned 0x10
	[0254.255] CoTaskMemFree (pv=0x1b065c20) 
	[0254.255] EndPaint (hWnd=0x50120, lpPaint=0x20da98) returned 1
	[0254.255] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x0
	[0254.256] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.256] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0254.256] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.256] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.256] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.256] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0254.256] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x6041bf4, lParam=0x0) returned 0x0
	[0254.256] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0254.256] CreateCompatibleDC (hdc=0x48010f97) returned 0xb011bf3
	[0254.256] GetObjectType (h=0x48010f97) returned 0x3
	[0254.257] CreateCompatibleBitmap (hdc=0x48010f97, cx=1, cy=1) returned 0x4051bf6
	[0254.257] GetDIBits (in: hdc=0x48010f97, hbm=0x4051bf6, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0254.257] GetDIBits (in: hdc=0x48010f97, hbm=0x4051bf6, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0254.257] DeleteObject (ho=0x4051bf6) returned 1
	[0254.257] CreateDIBSection (in: hdc=0x48010f97, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x2051bf7
	[0254.257] SelectObject (hdc=0xb011bf3, h=0x2051bf7) returned 0x185000f
	[0254.258] GdipCreateFromHDC (hdc=0xb011bf3, graphics=0x20d750) returned 0x0
	[0254.258] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0254.258] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0254.258] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0254.259] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f290) returned 0x0
	[0254.259] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20d970) returned 0x0
	[0254.260] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0254.260] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.260] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0254.260] GdipCreateRegion (region=0x20d910) returned 0x0
	[0254.260] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0254.260] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0254.261] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0254.261] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0254.261] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0254.261] GetSystemMetrics (nIndex=42) returned 0
	[0254.261] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0254.261] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0254.261] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0254.261] CoTaskMemFree (pv=0x1b07f5c0) 
	[0254.261] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0254.261] GdipCreateRegion (region=0x20d400) returned 0x0
	[0254.261] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0254.262] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0254.262] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f0d0) returned 0x0
	[0254.262] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d460) returned 0x0
	[0254.262] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.262] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.262] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0254.263] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.263] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.263] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0254.263] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0254.263] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0254.263] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0254.264] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.264] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0254.264] GetCurrentObject (hdc=0xb011bf3, type=0x1) returned 0x1b00017
	[0254.264] GetCurrentObject (hdc=0xb011bf3, type=0x2) returned 0x1900010
	[0254.264] GetCurrentObject (hdc=0xb011bf3, type=0x7) returned 0x2051bf7
	[0254.264] GetCurrentObject (hdc=0xb011bf3, type=0x6) returned 0x18a002e
	[0254.264] SaveDC (hdc=0xb011bf3) returned 1
	[0254.265] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb4040710
	[0254.265] GetClipRgn (hdc=0xb011bf3, hrgn=0xffffffffb4040710) returned 0
	[0254.265] SelectClipRgn (hdc=0xb011bf3, hrgn=0x4c0407f9) returned 2
	[0254.265] DeleteObject (ho=0xffffffffb4040710) returned 1
	[0254.265] DeleteObject (ho=0x4c0407f9) returned 1
	[0254.265] OffsetViewportOrgEx (in: hdc=0xb011bf3, x=0, y=0, lppt=0x26ca8a8 | out: lppt=0x26ca8a8) returned 1
	[0254.266] GetNearestColor (hdc=0xb011bf3, color=0x0) returned 0x0
	[0254.266] CreateSolidBrush (color=0x0) returned 0xffffffff951007c0
	[0254.266] FillRect (hDC=0xb011bf3, lprc=0x20d4b0, hbr=0xffffffff951007c0) returned 1
	[0254.266] DeleteObject (ho=0xffffffff951007c0) returned 1
	[0254.266] RestoreDC (hdc=0xb011bf3, nSavedDC=-1) returned 1
	[0254.267] GdipReleaseDC (graphics=0x1b929550, hdc=0xb011bf3) returned 0x0
	[0254.267] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff95d0dbd) returned 0x0
	[0254.267] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0254.267] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0254.267] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0254.267] GetSystemMetrics (nIndex=42) returned 0
	[0254.267] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0254.267] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0254.267] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0254.267] CoTaskMemFree (pv=0x1b07f5c0) 
	[0254.267] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0254.268] GetCurrentObject (hdc=0xb011bf3, type=0x1) returned 0x1b00017
	[0254.268] GetCurrentObject (hdc=0xb011bf3, type=0x2) returned 0x1900010
	[0254.268] GetCurrentObject (hdc=0xb011bf3, type=0x7) returned 0x2051bf7
	[0254.268] GetCurrentObject (hdc=0xb011bf3, type=0x6) returned 0x18a002e
	[0254.268] SaveDC (hdc=0xb011bf3) returned 1
	[0254.268] GetNearestColor (hdc=0xb011bf3, color=0x80) returned 0x80
	[0254.269] RestoreDC (hdc=0xb011bf3, nSavedDC=-1) returned 1
	[0254.269] GdipReleaseDC (graphics=0x1b929550, hdc=0xb011bf3) returned 0x0
	[0254.269] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0254.269] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0254.269] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0254.269] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0254.270] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0254.270] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0254.270] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0254.270] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0254.270] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0254.271] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0254.271] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0254.271] BitBlt (hdc=0x48010f97, x=0, y=0, cx=310, cy=83, hdcSrc=0xb011bf3, x1=0, y1=0, rop=0xcc0020) returned 1
	[0254.271] GdipReleaseDC (graphics=0x1b929550, hdc=0xb011bf3) returned 0x0
	[0254.271] SelectObject (hdc=0xb011bf3, h=0x185000f) returned 0x2051bf7
	[0254.271] DeleteDC (hdc=0xb011bf3) returned 1
	[0254.272] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0254.272] DeleteObject (ho=0x2051bf7) returned 1
	[0254.272] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0254.272] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0254.272] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.272] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0254.272] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.272] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.272] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.272] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0254.272] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x9041bf4, lParam=0x0) returned 0x0
	[0254.273] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x48010f97, lParam=0x0) returned 0x1
	[0254.273] GetStockObject (i=5) returned 0x1900015
	[0254.273] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0254.273] CreateCompatibleDC (hdc=0x48010f97) returned 0x66011be9
	[0254.273] SelectObject (hdc=0x66011be9, h=0x140507d2) returned 0x185000f
	[0254.273] GdipCreateFromHDC (hdc=0x66011be9, graphics=0x20d7e0) returned 0x0
	[0254.274] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0254.274] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=23, combineMode=0x0) returned 0x0
	[0254.275] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0254.275] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0254.276] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0254.276] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0254.276] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.276] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0254.276] GdipCreateRegion (region=0x20d910) returned 0x0
	[0254.276] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0254.277] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0254.277] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0254.277] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff95b0dbd) returned 0x0
	[0254.277] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.278] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0254.278] GetCurrentObject (hdc=0x66011be9, type=0x1) returned 0x1b00017
	[0254.278] GetCurrentObject (hdc=0x66011be9, type=0x2) returned 0x1900010
	[0254.278] GetCurrentObject (hdc=0x66011be9, type=0x7) returned 0x140507d2
	[0254.278] GetCurrentObject (hdc=0x66011be9, type=0x6) returned 0x18a002e
	[0254.278] SaveDC (hdc=0x66011be9) returned 1
	[0254.279] GetNearestColor (hdc=0x66011be9, color=0xf0f0f0) returned 0xf0f0f0
	[0254.279] GetNearestColor (hdc=0x66011be9, color=0xa0a0a0) returned 0xa0a0a0
	[0254.279] GetNearestColor (hdc=0x66011be9, color=0x696969) returned 0x696969
	[0254.279] GetNearestColor (hdc=0x66011be9, color=0xa0a0a0) returned 0xa0a0a0
	[0254.279] GetNearestColor (hdc=0x66011be9, color=0x0) returned 0x0
	[0254.280] GetNearestColor (hdc=0x66011be9, color=0xffffff) returned 0xffffff
	[0254.280] GetNearestColor (hdc=0x66011be9, color=0xe5e5e5) returned 0xe5e5e5
	[0254.280] GetNearestColor (hdc=0x66011be9, color=0xd8d8d8) returned 0xd8d8d8
	[0254.280] GetNearestColor (hdc=0x66011be9, color=0x0) returned 0x0
	[0254.280] RestoreDC (hdc=0x66011be9, nSavedDC=-1) returned 1
	[0254.281] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x66011be9) returned 0x0
	[0254.281] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.281] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.281] CoTaskMemFree (pv=0x1b067a80) 
	[0254.281] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0254.281] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.282] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.282] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0254.282] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0254.282] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0254.282] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0254.282] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0254.283] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0254.283] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0254.283] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.283] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.283] CoTaskMemFree (pv=0x1b067a80) 
	[0254.283] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0254.283] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0254.284] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0254.284] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0254.284] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0254.284] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.284] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.284] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0254.285] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0254.285] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0254.285] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.285] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.285] CoTaskMemFree (pv=0x1b067a80) 
	[0254.285] GdipCreateRegion (region=0x20d120) returned 0x0
	[0254.286] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0254.286] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0254.286] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0254.286] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0254.286] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.286] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.287] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.287] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.287] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0254.287] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0254.287] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0254.287] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0254.288] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.288] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0254.288] GetCurrentObject (hdc=0x66011be9, type=0x1) returned 0x1b00017
	[0254.288] GetCurrentObject (hdc=0x66011be9, type=0x2) returned 0x1900010
	[0254.288] GetCurrentObject (hdc=0x66011be9, type=0x7) returned 0x140507d2
	[0254.288] GetCurrentObject (hdc=0x66011be9, type=0x6) returned 0x18a002e
	[0254.289] SaveDC (hdc=0x66011be9) returned 1
	[0254.289] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4d0407f9
	[0254.289] GetClipRgn (hdc=0x66011be9, hrgn=0x4d0407f9) returned 0
	[0254.289] SelectClipRgn (hdc=0x66011be9, hrgn=0xffffffffb5040710) returned 2
	[0254.289] DeleteObject (ho=0x4d0407f9) returned 1
	[0254.341] DeleteObject (ho=0xffffffffb5040710) returned 1
	[0254.341] OffsetViewportOrgEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x26cb998 | out: lppt=0x26cb998) returned 1
	[0254.341] GetNearestColor (hdc=0x66011be9, color=0xf0f0f0) returned 0xf0f0f0
	[0254.342] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff961007c0
	[0254.342] FillRect (hDC=0x66011be9, lprc=0x20d1d0, hbr=0xffffffff961007c0) returned 1
	[0254.342] DeleteObject (ho=0xffffffff961007c0) returned 1
	[0254.342] RestoreDC (hdc=0x66011be9, nSavedDC=-1) returned 1
	[0254.342] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x66011be9) returned 0x0
	[0254.343] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.343] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.343] CoTaskMemFree (pv=0x1b067a80) 
	[0254.343] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0254.343] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.343] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.343] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0254.344] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0254.344] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0254.344] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0254.344] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0254.344] GetFocus () returned 0x0
	[0254.345] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0254.345] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.345] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.345] CoTaskMemFree (pv=0x1b067a80) 
	[0254.345] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0254.345] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0254.346] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0254.346] GdipCreateRegion (region=0x20d070) returned 0x0
	[0254.346] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0254.346] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0254.347] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0254.347] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0254.347] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0254.347] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.347] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0254.348] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.348] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0254.348] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0254.348] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0254.348] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0254.348] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.349] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0254.349] GetCurrentObject (hdc=0x66011be9, type=0x1) returned 0x1b00017
	[0254.349] GetCurrentObject (hdc=0x66011be9, type=0x2) returned 0x1900010
	[0254.349] GetCurrentObject (hdc=0x66011be9, type=0x7) returned 0x140507d2
	[0254.349] GetCurrentObject (hdc=0x66011be9, type=0x6) returned 0x18a002e
	[0254.350] SaveDC (hdc=0x66011be9) returned 1
	[0254.350] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb6040710
	[0254.350] GetClipRgn (hdc=0x66011be9, hrgn=0xffffffffb6040710) returned 0
	[0254.350] SelectClipRgn (hdc=0x66011be9, hrgn=0x4e0407f9) returned 2
	[0254.350] DeleteObject (ho=0xffffffffb6040710) returned 1
	[0254.350] DeleteObject (ho=0x4e0407f9) returned 1
	[0254.351] OffsetViewportOrgEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x26cbf38 | out: lppt=0x26cbf38) returned 1
	[0254.351] GetROP2 (hdc=0x66011be9) returned 13
	[0254.351] GetBkMode (hdc=0x66011be9) returned 2
	[0254.351] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.351] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x48301a58
	[0254.352] SelectObject (hdc=0x66011be9, h=0x48301a58) returned 0x1b00017
	[0254.352] MoveToEx (in: hdc=0x66011be9, x=126, y=1, lppt=0x26cbfa0 | out: lppt=0x26cbfa0) returned 1
	[0254.353] LineTo (hdc=0x66011be9, x=1, y=1) returned 1
	[0254.353] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.353] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.353] GetROP2 (hdc=0x66011be9) returned 13
	[0254.353] GetBkMode (hdc=0x66011be9) returned 2
	[0254.353] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.354] SelectObject (hdc=0x66011be9, h=0x48301a58) returned 0x48301a58
	[0254.354] MoveToEx (in: hdc=0x66011be9, x=1, y=1, lppt=0x26cbfb8 | out: lppt=0x26cbfb8) returned 1
	[0254.354] LineTo (hdc=0x66011be9, x=1, y=39) returned 1
	[0254.354] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.354] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.354] SelectObject (hdc=0x66011be9, h=0x1b00017) returned 0x48301a58
	[0254.355] DeleteObject (ho=0x48301a58) returned 1
	[0254.355] GetROP2 (hdc=0x66011be9) returned 13
	[0254.355] GetBkMode (hdc=0x66011be9) returned 2
	[0254.355] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.355] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x193013e7
	[0254.355] SelectObject (hdc=0x66011be9, h=0x193013e7) returned 0x1b00017
	[0254.356] MoveToEx (in: hdc=0x66011be9, x=1, y=39, lppt=0x26cc020 | out: lppt=0x26cc020) returned 1
	[0254.356] LineTo (hdc=0x66011be9, x=126, y=39) returned 1
	[0254.356] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.356] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.356] GetROP2 (hdc=0x66011be9) returned 13
	[0254.356] GetBkMode (hdc=0x66011be9) returned 2
	[0254.357] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.357] SelectObject (hdc=0x66011be9, h=0x193013e7) returned 0x193013e7
	[0254.357] MoveToEx (in: hdc=0x66011be9, x=126, y=39, lppt=0x26cc038 | out: lppt=0x26cc038) returned 1
	[0254.357] LineTo (hdc=0x66011be9, x=126, y=0) returned 1
	[0254.357] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.357] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.358] SelectObject (hdc=0x66011be9, h=0x1b00017) returned 0x193013e7
	[0254.358] DeleteObject (ho=0x193013e7) returned 1
	[0254.358] GetROP2 (hdc=0x66011be9) returned 13
	[0254.358] GetBkMode (hdc=0x66011be9) returned 2
	[0254.358] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.358] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x49301a58
	[0254.359] SelectObject (hdc=0x66011be9, h=0x49301a58) returned 0x1b00017
	[0254.359] MoveToEx (in: hdc=0x66011be9, x=125, y=2, lppt=0x26cc0a0 | out: lppt=0x26cc0a0) returned 1
	[0254.359] LineTo (hdc=0x66011be9, x=2, y=2) returned 1
	[0254.359] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.359] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.359] GetROP2 (hdc=0x66011be9) returned 13
	[0254.360] GetBkMode (hdc=0x66011be9) returned 2
	[0254.360] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.360] SelectObject (hdc=0x66011be9, h=0x49301a58) returned 0x49301a58
	[0254.360] MoveToEx (in: hdc=0x66011be9, x=2, y=2, lppt=0x26cc0b8 | out: lppt=0x26cc0b8) returned 1
	[0254.360] LineTo (hdc=0x66011be9, x=2, y=38) returned 1
	[0254.360] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.361] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.361] SelectObject (hdc=0x66011be9, h=0x1b00017) returned 0x49301a58
	[0254.361] DeleteObject (ho=0x49301a58) returned 1
	[0254.361] GetROP2 (hdc=0x66011be9) returned 13
	[0254.361] GetBkMode (hdc=0x66011be9) returned 2
	[0254.361] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.362] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1a3013e7
	[0254.362] SelectObject (hdc=0x66011be9, h=0x1a3013e7) returned 0x1b00017
	[0254.362] MoveToEx (in: hdc=0x66011be9, x=2, y=38, lppt=0x26cc120 | out: lppt=0x26cc120) returned 1
	[0254.362] LineTo (hdc=0x66011be9, x=125, y=38) returned 1
	[0254.362] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.362] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.363] GetROP2 (hdc=0x66011be9) returned 13
	[0254.363] GetBkMode (hdc=0x66011be9) returned 2
	[0254.363] SetBkMode (hdc=0x66011be9, mode=1) returned 2
	[0254.363] SelectObject (hdc=0x66011be9, h=0x1a3013e7) returned 0x1a3013e7
	[0254.363] MoveToEx (in: hdc=0x66011be9, x=125, y=38, lppt=0x26cc138 | out: lppt=0x26cc138) returned 1
	[0254.363] LineTo (hdc=0x66011be9, x=125, y=1) returned 1
	[0254.364] SetBkMode (hdc=0x66011be9, mode=2) returned 1
	[0254.364] MoveToEx (in: hdc=0x66011be9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.364] SelectObject (hdc=0x66011be9, h=0x1b00017) returned 0x1a3013e7
	[0254.364] DeleteObject (ho=0x1a3013e7) returned 1
	[0254.364] RestoreDC (hdc=0x66011be9, nSavedDC=-1) returned 1
	[0254.364] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x66011be9) returned 0x0
	[0254.365] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0254.365] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0x66011be9, x1=0, y1=0, rop=0xcc0020) returned 1
	[0254.365] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x66011be9) returned 0x0
	[0254.365] SelectObject (hdc=0x66011be9, h=0x185000f) returned 0x140507d2
	[0254.365] DeleteDC (hdc=0x66011be9) returned 1
	[0254.366] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0254.366] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0254.366] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0254.366] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.366] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.366] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0254.366] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.366] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.366] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0254.366] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.366] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.366] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0254.367] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.367] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0254.367] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.367] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.367] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.367] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x48010f97
	[0254.367] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0xc041bf4, lParam=0x0) returned 0x0
	[0254.367] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0254.367] CreateCompatibleDC (hdc=0x48010f97) returned 0x55011be7
	[0254.368] GetObjectType (h=0x48010f97) returned 0x3
	[0254.368] CreateCompatibleBitmap (hdc=0x48010f97, cx=1, cy=1) returned 0x67051be9
	[0254.368] GetDIBits (in: hdc=0x48010f97, hbm=0x67051be9, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0254.368] GetDIBits (in: hdc=0x48010f97, hbm=0x67051be9, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0254.369] DeleteObject (ho=0x67051be9) returned 1
	[0254.369] CreateDIBSection (in: hdc=0x48010f97, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0xa051bf6
	[0254.369] SelectObject (hdc=0x55011be7, h=0xa051bf6) returned 0x185000f
	[0254.369] GdipCreateFromHDC (hdc=0x55011be7, graphics=0x20d800) returned 0x0
	[0254.369] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0254.370] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0254.370] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0254.370] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0254.370] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20da20) returned 0x0
	[0254.370] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.370] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.371] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0254.371] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0254.371] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0254.371] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0254.371] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0254.371] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0254.371] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0254.372] GetSystemMetrics (nIndex=42) returned 0
	[0254.372] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0254.372] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1 | out: lpString="") returned 0
	[0254.372] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0254.372] CoTaskMemFree (pv=0x1b078860) 
	[0254.372] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0254.372] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0254.372] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0254.372] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0254.372] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0254.373] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0254.373] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0254.373] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.373] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0254.373] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0254.373] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.374] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0254.374] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0254.374] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0254.374] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0254.374] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0254.374] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0254.374] GetCurrentObject (hdc=0x55011be7, type=0x1) returned 0x1b00017
	[0254.375] GetCurrentObject (hdc=0x55011be7, type=0x2) returned 0x1900010
	[0254.375] GetCurrentObject (hdc=0x55011be7, type=0x7) returned 0xa051bf6
	[0254.375] GetCurrentObject (hdc=0x55011be7, type=0x6) returned 0x18a002e
	[0254.375] SaveDC (hdc=0x55011be7) returned 1
	[0254.375] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4f0407f9
	[0254.375] GetClipRgn (hdc=0x55011be7, hrgn=0x4f0407f9) returned 0
	[0254.376] SelectClipRgn (hdc=0x55011be7, hrgn=0xffffffffb7040710) returned 2
	[0254.376] DeleteObject (ho=0x4f0407f9) returned 1
	[0254.376] DeleteObject (ho=0xffffffffb7040710) returned 1
	[0254.376] OffsetViewportOrgEx (in: hdc=0x55011be7, x=0, y=0, lppt=0x26cd7e8 | out: lppt=0x26cd7e8) returned 1
	[0254.376] GetNearestColor (hdc=0x55011be7, color=0xf0f0f0) returned 0xf0f0f0
	[0254.377] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff971007c0
	[0254.377] FillRect (hDC=0x55011be7, lprc=0x20d560, hbr=0xffffffff971007c0) returned 1
	[0254.377] DeleteObject (ho=0xffffffff971007c0) returned 1
	[0254.377] RestoreDC (hdc=0x55011be7, nSavedDC=-1) returned 1
	[0254.378] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x55011be7) returned 0x0
	[0254.378] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9580dbd) returned 0x0
	[0254.378] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.378] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0254.378] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0254.378] GetSystemMetrics (nIndex=42) returned 0
	[0254.378] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0254.378] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1 | out: lpString="") returned 0
	[0254.378] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0254.378] CoTaskMemFree (pv=0x1b078860) 
	[0254.379] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0254.451] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0254.451] BitBlt (hdc=0x48010f97, x=0, y=0, cx=658, cy=456, hdcSrc=0x55011be7, x1=0, y1=0, rop=0xcc0020) returned 1
	[0254.452] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x55011be7) returned 0x0
	[0254.452] SelectObject (hdc=0x55011be7, h=0x185000f) returned 0xa051bf6
	[0254.452] DeleteDC (hdc=0x55011be7) returned 1
	[0254.452] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0254.452] DeleteObject (ho=0xa051bf6) returned 1
	[0254.453] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0254.453] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0254.453] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.453] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.453] IsWindowUnicode (hWnd=0x201a6) returned 1
	[0254.453] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.453] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x84, wParam=0x0, lParam=0x27101ef) returned 0x10
	[0254.453] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x20, wParam=0x201a6, lParam=0x2000012) returned 0x0
	[0254.454] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.454] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.454] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0xa0, wParam=0x12, lParam=0x27101ef) returned 0x0
	[0254.454] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.454] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.454] WaitMessage () returned 1
	[0254.743] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.743] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0254.743] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0254.743] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.743] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.743] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.743] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x2a2, wParam=0x0, lParam=0x0) returned 0x0
	[0254.743] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.743] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0254.743] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0254.744] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.744] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0254.744] SetCursor (hCursor=0xe00df) returned 0x10003
	[0254.744] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.744] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.744] _TrackMouseEvent (in: lpEventTrack=0x26470f0 | out: lpEventTrack=0x26470f0) returned 1
	[0254.744] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0254.744] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0254.744] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0254.744] GetKeyState (nVirtKey=1) returned 0
	[0254.744] GetKeyState (nVirtKey=2) returned 0
	[0254.744] GetKeyState (nVirtKey=4) returned 0
	[0254.744] GetKeyState (nVirtKey=5) returned 0
	[0254.744] GetKeyState (nVirtKey=6) returned 0
	[0254.744] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.744] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0254.744] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.744] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.744] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.744] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0254.744] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0254.745] CreateCompatibleDC (hdc=0x70107fc) returned 0xc011bc4
	[0254.745] SelectObject (hdc=0xc011bc4, h=0x140507d2) returned 0x185000f
	[0254.745] GdipCreateFromHDC (hdc=0xc011bc4, graphics=0x20d7e0) returned 0x0
	[0254.745] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0254.745] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0254.746] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0254.746] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0254.746] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0254.746] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.746] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.747] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0254.747] GdipCreateRegion (region=0x20d910) returned 0x0
	[0254.747] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0254.747] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0254.747] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0254.748] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9560dbd) returned 0x0
	[0254.748] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.748] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0254.748] GetCurrentObject (hdc=0xc011bc4, type=0x1) returned 0x1b00017
	[0254.749] GetCurrentObject (hdc=0xc011bc4, type=0x2) returned 0x1900010
	[0254.749] GetCurrentObject (hdc=0xc011bc4, type=0x7) returned 0x140507d2
	[0254.749] GetCurrentObject (hdc=0xc011bc4, type=0x6) returned 0x18a002e
	[0254.749] SaveDC (hdc=0xc011bc4) returned 1
	[0254.749] GetNearestColor (hdc=0xc011bc4, color=0xf0f0f0) returned 0xf0f0f0
	[0254.750] GetNearestColor (hdc=0xc011bc4, color=0xa0a0a0) returned 0xa0a0a0
	[0254.750] GetNearestColor (hdc=0xc011bc4, color=0x696969) returned 0x696969
	[0254.750] GetNearestColor (hdc=0xc011bc4, color=0xa0a0a0) returned 0xa0a0a0
	[0254.750] GetNearestColor (hdc=0xc011bc4, color=0x0) returned 0x0
	[0254.750] GetNearestColor (hdc=0xc011bc4, color=0xffffff) returned 0xffffff
	[0254.751] GetNearestColor (hdc=0xc011bc4, color=0xe5e5e5) returned 0xe5e5e5
	[0254.751] GetNearestColor (hdc=0xc011bc4, color=0xd8d8d8) returned 0xd8d8d8
	[0254.751] GetNearestColor (hdc=0xc011bc4, color=0x0) returned 0x0
	[0254.751] RestoreDC (hdc=0xc011bc4, nSavedDC=-1) returned 1
	[0254.751] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc011bc4) returned 0x0
	[0254.752] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.752] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.752] CoTaskMemFree (pv=0x1b067a80) 
	[0254.752] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0254.752] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.752] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.752] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0254.753] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0254.753] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0254.753] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0254.753] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0254.753] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0254.753] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0254.754] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.754] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.754] CoTaskMemFree (pv=0x1b067a80) 
	[0254.754] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0254.754] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0254.754] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0254.754] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0254.755] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0254.755] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.755] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.755] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0254.755] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0254.755] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0254.756] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.756] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.756] CoTaskMemFree (pv=0x1b067a80) 
	[0254.756] GdipCreateRegion (region=0x20d120) returned 0x0
	[0254.756] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0254.756] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0254.757] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0254.757] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0254.757] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0254.757] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.757] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0254.758] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.758] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0254.758] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0254.758] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0254.758] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0254.759] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.759] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0254.759] GetCurrentObject (hdc=0xc011bc4, type=0x1) returned 0x1b00017
	[0254.759] GetCurrentObject (hdc=0xc011bc4, type=0x2) returned 0x1900010
	[0254.759] GetCurrentObject (hdc=0xc011bc4, type=0x7) returned 0x140507d2
	[0254.759] GetCurrentObject (hdc=0xc011bc4, type=0x6) returned 0x18a002e
	[0254.760] SaveDC (hdc=0xc011bc4) returned 1
	[0254.760] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb8040710
	[0254.760] GetClipRgn (hdc=0xc011bc4, hrgn=0xffffffffb8040710) returned 0
	[0254.760] SelectClipRgn (hdc=0xc011bc4, hrgn=0x500407f9) returned 2
	[0254.760] DeleteObject (ho=0xffffffffb8040710) returned 1
	[0254.760] DeleteObject (ho=0x500407f9) returned 1
	[0254.761] OffsetViewportOrgEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x26ce5a0 | out: lppt=0x26ce5a0) returned 1
	[0254.761] GetNearestColor (hdc=0xc011bc4, color=0xf0f0f0) returned 0xf0f0f0
	[0254.761] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff981007c0
	[0254.761] FillRect (hDC=0xc011bc4, lprc=0x20d1d0, hbr=0xffffffff981007c0) returned 1
	[0254.761] DeleteObject (ho=0xffffffff981007c0) returned 1
	[0254.761] RestoreDC (hdc=0xc011bc4, nSavedDC=-1) returned 1
	[0254.762] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc011bc4) returned 0x0
	[0254.762] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.762] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.762] CoTaskMemFree (pv=0x1b067a80) 
	[0254.762] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0254.762] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.763] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0254.763] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0254.763] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0254.763] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0254.763] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0254.764] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0254.764] GetFocus () returned 0x0
	[0254.764] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0254.764] CoTaskMemAlloc (cb=0x13) returned 0x1b067a80
	[0254.764] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0254.764] CoTaskMemFree (pv=0x1b067a80) 
	[0254.764] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0254.765] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0254.765] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0254.765] GdipCreateRegion (region=0x20d070) returned 0x0
	[0254.765] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0254.765] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0254.765] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0254.766] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0254.766] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.766] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.766] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0254.766] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0254.767] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0254.767] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0254.767] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0254.767] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0254.767] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0254.767] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0254.768] GetCurrentObject (hdc=0xc011bc4, type=0x1) returned 0x1b00017
	[0254.768] GetCurrentObject (hdc=0xc011bc4, type=0x2) returned 0x1900010
	[0254.768] GetCurrentObject (hdc=0xc011bc4, type=0x7) returned 0x140507d2
	[0254.768] GetCurrentObject (hdc=0xc011bc4, type=0x6) returned 0x18a002e
	[0254.768] SaveDC (hdc=0xc011bc4) returned 1
	[0254.768] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x510407f9
	[0254.769] GetClipRgn (hdc=0xc011bc4, hrgn=0x510407f9) returned 0
	[0254.769] SelectClipRgn (hdc=0xc011bc4, hrgn=0xffffffffb9040710) returned 2
	[0254.769] DeleteObject (ho=0x510407f9) returned 1
	[0254.769] DeleteObject (ho=0xffffffffb9040710) returned 1
	[0254.769] OffsetViewportOrgEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x26ceb40 | out: lppt=0x26ceb40) returned 1
	[0254.770] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.770] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.770] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.770] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x14301bf5
	[0254.770] SelectObject (hdc=0xc011bc4, h=0x14301bf5) returned 0x1b00017
	[0254.771] MoveToEx (in: hdc=0xc011bc4, x=164, y=1, lppt=0x26ceba8 | out: lppt=0x26ceba8) returned 1
	[0254.771] LineTo (hdc=0xc011bc4, x=1, y=1) returned 1
	[0254.771] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.771] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.771] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.771] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.772] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.772] SelectObject (hdc=0xc011bc4, h=0x14301bf5) returned 0x14301bf5
	[0254.772] MoveToEx (in: hdc=0xc011bc4, x=1, y=1, lppt=0x26cebc0 | out: lppt=0x26cebc0) returned 1
	[0254.772] LineTo (hdc=0xc011bc4, x=1, y=41) returned 1
	[0254.772] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.772] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.773] SelectObject (hdc=0xc011bc4, h=0x1b00017) returned 0x14301bf5
	[0254.773] DeleteObject (ho=0x14301bf5) returned 1
	[0254.773] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.773] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.774] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.774] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x65301beb
	[0254.774] SelectObject (hdc=0xc011bc4, h=0x65301beb) returned 0x1b00017
	[0254.775] MoveToEx (in: hdc=0xc011bc4, x=1, y=41, lppt=0x26cec28 | out: lppt=0x26cec28) returned 1
	[0254.775] LineTo (hdc=0xc011bc4, x=164, y=41) returned 1
	[0254.775] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.775] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.775] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.775] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.776] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.776] SelectObject (hdc=0xc011bc4, h=0x65301beb) returned 0x65301beb
	[0254.776] MoveToEx (in: hdc=0xc011bc4, x=164, y=41, lppt=0x26cec40 | out: lppt=0x26cec40) returned 1
	[0254.776] LineTo (hdc=0xc011bc4, x=164, y=0) returned 1
	[0254.776] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.776] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.777] SelectObject (hdc=0xc011bc4, h=0x1b00017) returned 0x65301beb
	[0254.777] DeleteObject (ho=0x65301beb) returned 1
	[0254.777] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.777] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.777] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.777] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x15301bf5
	[0254.778] SelectObject (hdc=0xc011bc4, h=0x15301bf5) returned 0x1b00017
	[0254.778] MoveToEx (in: hdc=0xc011bc4, x=163, y=2, lppt=0x26ceca8 | out: lppt=0x26ceca8) returned 1
	[0254.778] LineTo (hdc=0xc011bc4, x=2, y=2) returned 1
	[0254.778] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.778] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.778] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.779] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.779] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.779] SelectObject (hdc=0xc011bc4, h=0x15301bf5) returned 0x15301bf5
	[0254.779] MoveToEx (in: hdc=0xc011bc4, x=2, y=2, lppt=0x26cecc0 | out: lppt=0x26cecc0) returned 1
	[0254.779] LineTo (hdc=0xc011bc4, x=2, y=40) returned 1
	[0254.779] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.780] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.780] SelectObject (hdc=0xc011bc4, h=0x1b00017) returned 0x15301bf5
	[0254.780] DeleteObject (ho=0x15301bf5) returned 1
	[0254.780] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.780] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.780] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.781] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x66301beb
	[0254.781] SelectObject (hdc=0xc011bc4, h=0x66301beb) returned 0x1b00017
	[0254.781] MoveToEx (in: hdc=0xc011bc4, x=2, y=40, lppt=0x26ced28 | out: lppt=0x26ced28) returned 1
	[0254.781] LineTo (hdc=0xc011bc4, x=163, y=40) returned 1
	[0254.781] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.781] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.782] GetROP2 (hdc=0xc011bc4) returned 13
	[0254.782] GetBkMode (hdc=0xc011bc4) returned 2
	[0254.782] SetBkMode (hdc=0xc011bc4, mode=1) returned 2
	[0254.782] SelectObject (hdc=0xc011bc4, h=0x66301beb) returned 0x66301beb
	[0254.782] MoveToEx (in: hdc=0xc011bc4, x=163, y=40, lppt=0x26ced40 | out: lppt=0x26ced40) returned 1
	[0254.782] LineTo (hdc=0xc011bc4, x=163, y=1) returned 1
	[0254.783] SetBkMode (hdc=0xc011bc4, mode=2) returned 1
	[0254.783] MoveToEx (in: hdc=0xc011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0254.783] SelectObject (hdc=0xc011bc4, h=0x1b00017) returned 0x66301beb
	[0254.783] DeleteObject (ho=0x66301beb) returned 1
	[0254.783] RestoreDC (hdc=0xc011bc4, nSavedDC=-1) returned 1
	[0254.783] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc011bc4) returned 0x0
	[0254.784] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0254.784] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0xc011bc4, x1=0, y1=0, rop=0xcc0020) returned 1
	[0254.784] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0xc011bc4) returned 0x0
	[0254.784] SelectObject (hdc=0xc011bc4, h=0x185000f) returned 0x140507d2
	[0254.784] DeleteDC (hdc=0xc011bc4) returned 1
	[0254.785] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0254.785] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0254.785] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0254.785] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.785] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.785] WaitMessage () returned 1
	[0254.852] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.852] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0254.852] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.852] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.852] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.852] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.852] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0254.852] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0254.852] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0254.852] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0254.852] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x130042) returned 0x0
	[0254.852] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.852] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0254.852] WaitMessage () returned 1
	[0255.148] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.148] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.148] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.148] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xdf011e) returned 0x0
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0255.148] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0255.148] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0255.149] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0255.149] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0255.149] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0255.149] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0255.149] GetFocus () returned 0x0
	[0255.149] SetFocus (hWnd=0x201d8) returned 0x0
	[0255.150] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0255.150] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0255.150] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0255.150] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0255.150] GetStockObject (i=5) returned 0x1900015
	[0255.151] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0255.151] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0255.151] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0255.151] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.151] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.151] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.151] GetKeyState (nVirtKey=1) returned -127
	[0255.151] GetKeyState (nVirtKey=2) returned 0
	[0255.151] GetKeyState (nVirtKey=4) returned 0
	[0255.151] GetKeyState (nVirtKey=5) returned 0
	[0255.151] GetKeyState (nVirtKey=6) returned 0
	[0255.151] IsWindowVisible (hWnd=0x201d8) returned 1
	[0255.151] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0255.151] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0255.151] GetFocus () returned 0x201d8
	[0255.151] GetFocus () returned 0x201d8
	[0255.151] GetFocus () returned 0x201d8
	[0255.151] GetKeyState (nVirtKey=1) returned -127
	[0255.151] GetKeyState (nVirtKey=2) returned 0
	[0255.151] GetKeyState (nVirtKey=4) returned 0
	[0255.151] GetKeyState (nVirtKey=5) returned 0
	[0255.151] GetKeyState (nVirtKey=6) returned 0
	[0255.151] GetCapture () returned 0x0
	[0255.151] SetCapture (hWnd=0x201d8) returned 0x0
	[0255.151] GetKeyState (nVirtKey=1) returned -127
	[0255.151] GetKeyState (nVirtKey=2) returned 0
	[0255.151] GetKeyState (nVirtKey=4) returned 0
	[0255.151] GetKeyState (nVirtKey=5) returned 0
	[0255.151] GetKeyState (nVirtKey=6) returned 0
	[0255.151] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0255.151] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0255.152] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.152] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.152] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.152] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0255.152] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.152] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.152] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.152] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0255.152] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.152] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.152] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.152] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.152] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.152] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26ceeb8, cPoints=0x1 | out: lpPoints=0x26ceeb8) returned 30606029
	[0255.152] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0255.152] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0255.152] UpdateWindow (hWnd=0x201d8) returned 1
	[0255.152] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0255.152] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0255.152] CreateCompatibleDC (hdc=0x10107f8) returned 0x15011bc4
	[0255.153] SelectObject (hdc=0x15011bc4, h=0x140507d2) returned 0x185000f
	[0255.153] GdipCreateFromHDC (hdc=0x15011bc4, graphics=0x20cfa0) returned 0x0
	[0255.153] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0255.153] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0255.153] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0255.153] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0255.154] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0255.154] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0255.154] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0255.154] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0255.154] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0255.154] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0255.155] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0255.155] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0255.155] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9530dbd) returned 0x0
	[0255.155] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0255.156] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0255.156] GetCurrentObject (hdc=0x15011bc4, type=0x1) returned 0x1b00017
	[0255.156] GetCurrentObject (hdc=0x15011bc4, type=0x2) returned 0x1900010
	[0255.156] GetCurrentObject (hdc=0x15011bc4, type=0x7) returned 0x140507d2
	[0255.156] GetCurrentObject (hdc=0x15011bc4, type=0x6) returned 0x18a002e
	[0255.156] SaveDC (hdc=0x15011bc4) returned 1
	[0255.157] GetNearestColor (hdc=0x15011bc4, color=0xf0f0f0) returned 0xf0f0f0
	[0255.157] GetNearestColor (hdc=0x15011bc4, color=0xa0a0a0) returned 0xa0a0a0
	[0255.157] GetNearestColor (hdc=0x15011bc4, color=0x696969) returned 0x696969
	[0255.157] GetNearestColor (hdc=0x15011bc4, color=0xa0a0a0) returned 0xa0a0a0
	[0255.158] GetNearestColor (hdc=0x15011bc4, color=0x0) returned 0x0
	[0255.158] GetNearestColor (hdc=0x15011bc4, color=0xffffff) returned 0xffffff
	[0255.158] GetNearestColor (hdc=0x15011bc4, color=0xe5e5e5) returned 0xe5e5e5
	[0255.158] GetNearestColor (hdc=0x15011bc4, color=0xd8d8d8) returned 0xd8d8d8
	[0255.158] GetNearestColor (hdc=0x15011bc4, color=0x0) returned 0x0
	[0255.159] RestoreDC (hdc=0x15011bc4, nSavedDC=-1) returned 1
	[0255.159] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011bc4) returned 0x0
	[0255.159] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0255.159] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.159] CoTaskMemFree (pv=0x1b0679c0) 
	[0255.159] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0255.159] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.160] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.160] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0255.160] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0255.160] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0255.160] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0255.160] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0255.161] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0255.161] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0255.161] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0255.161] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.161] CoTaskMemFree (pv=0x1b0679c0) 
	[0255.161] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0255.161] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0255.162] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0255.162] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0255.162] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0255.162] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.162] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.162] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0255.163] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0255.163] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0255.163] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0255.163] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.163] CoTaskMemFree (pv=0x1b0679c0) 
	[0255.164] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0255.164] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0255.164] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0255.164] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0255.164] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0255.164] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0255.165] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0255.165] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c7c0) returned 0x0
	[0255.165] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0255.165] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0255.165] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0255.165] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0255.166] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0255.166] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0255.166] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0255.166] GetCurrentObject (hdc=0x15011bc4, type=0x1) returned 0x1b00017
	[0255.166] GetCurrentObject (hdc=0x15011bc4, type=0x2) returned 0x1900010
	[0255.166] GetCurrentObject (hdc=0x15011bc4, type=0x7) returned 0x140507d2
	[0255.167] GetCurrentObject (hdc=0x15011bc4, type=0x6) returned 0x18a002e
	[0255.167] SaveDC (hdc=0x15011bc4) returned 1
	[0255.167] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffba040710
	[0255.167] GetClipRgn (hdc=0x15011bc4, hrgn=0xffffffffba040710) returned 0
	[0255.167] SelectClipRgn (hdc=0x15011bc4, hrgn=0x540407f9) returned 2
	[0255.167] DeleteObject (ho=0xffffffffba040710) returned 1
	[0255.168] DeleteObject (ho=0x540407f9) returned 1
	[0255.168] OffsetViewportOrgEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x26cfb38 | out: lppt=0x26cfb38) returned 1
	[0255.168] GetNearestColor (hdc=0x15011bc4, color=0xf0f0f0) returned 0xf0f0f0
	[0255.168] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff991007c0
	[0255.168] FillRect (hDC=0x15011bc4, lprc=0x20c990, hbr=0xffffffff991007c0) returned 1
	[0255.168] DeleteObject (ho=0xffffffff991007c0) returned 1
	[0255.169] RestoreDC (hdc=0x15011bc4, nSavedDC=-1) returned 1
	[0255.169] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011bc4) returned 0x0
	[0255.169] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0255.169] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.169] CoTaskMemFree (pv=0x1b0679c0) 
	[0255.169] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0255.169] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.170] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.170] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0255.170] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0255.170] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0255.170] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0255.171] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0255.171] GetFocus () returned 0x201d8
	[0255.171] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0255.171] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0255.171] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.171] CoTaskMemFree (pv=0x1b0679c0) 
	[0255.171] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0255.171] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0255.172] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0255.172] GdipCreateRegion (region=0x20c830) returned 0x0
	[0255.172] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0255.172] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0255.172] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0255.172] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0255.173] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0255.173] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0255.173] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0255.173] LocalFree (hMem=0x1b07c7c0) returned 0x0
	[0255.173] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0255.174] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0255.174] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0255.174] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0255.174] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0255.174] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0255.174] GetCurrentObject (hdc=0x15011bc4, type=0x1) returned 0x1b00017
	[0255.174] GetCurrentObject (hdc=0x15011bc4, type=0x2) returned 0x1900010
	[0255.175] GetCurrentObject (hdc=0x15011bc4, type=0x7) returned 0x140507d2
	[0255.175] GetCurrentObject (hdc=0x15011bc4, type=0x6) returned 0x18a002e
	[0255.175] SaveDC (hdc=0x15011bc4) returned 1
	[0255.175] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x550407f9
	[0255.175] GetClipRgn (hdc=0x15011bc4, hrgn=0x550407f9) returned 0
	[0255.176] SelectClipRgn (hdc=0x15011bc4, hrgn=0xffffffffbb040710) returned 2
	[0255.176] DeleteObject (ho=0x550407f9) returned 1
	[0255.176] DeleteObject (ho=0xffffffffbb040710) returned 1
	[0255.176] OffsetViewportOrgEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x26d00d8 | out: lppt=0x26d00d8) returned 1
	[0255.176] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.176] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.177] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.177] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x67301beb
	[0255.177] SelectObject (hdc=0x15011bc4, h=0x67301beb) returned 0x1b00017
	[0255.177] MoveToEx (in: hdc=0x15011bc4, x=164, y=1, lppt=0x26d0140 | out: lppt=0x26d0140) returned 1
	[0255.177] LineTo (hdc=0x15011bc4, x=1, y=1) returned 1
	[0255.177] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.178] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.178] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.178] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.178] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.178] SelectObject (hdc=0x15011bc4, h=0x67301beb) returned 0x67301beb
	[0255.178] MoveToEx (in: hdc=0x15011bc4, x=1, y=1, lppt=0x26d0158 | out: lppt=0x26d0158) returned 1
	[0255.179] LineTo (hdc=0x15011bc4, x=1, y=41) returned 1
	[0255.179] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.179] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.179] SelectObject (hdc=0x15011bc4, h=0x1b00017) returned 0x67301beb
	[0255.179] DeleteObject (ho=0x67301beb) returned 1
	[0255.179] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.180] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.180] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.180] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x16301bf5
	[0255.180] SelectObject (hdc=0x15011bc4, h=0x16301bf5) returned 0x1b00017
	[0255.180] MoveToEx (in: hdc=0x15011bc4, x=1, y=41, lppt=0x26d01c0 | out: lppt=0x26d01c0) returned 1
	[0255.180] LineTo (hdc=0x15011bc4, x=164, y=41) returned 1
	[0255.181] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.181] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.181] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.181] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.181] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.181] SelectObject (hdc=0x15011bc4, h=0x16301bf5) returned 0x16301bf5
	[0255.182] MoveToEx (in: hdc=0x15011bc4, x=164, y=41, lppt=0x26d01d8 | out: lppt=0x26d01d8) returned 1
	[0255.182] LineTo (hdc=0x15011bc4, x=164, y=0) returned 1
	[0255.182] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.182] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.182] SelectObject (hdc=0x15011bc4, h=0x1b00017) returned 0x16301bf5
	[0255.182] DeleteObject (ho=0x16301bf5) returned 1
	[0255.183] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.183] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.183] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.183] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x68301beb
	[0255.183] SelectObject (hdc=0x15011bc4, h=0x68301beb) returned 0x1b00017
	[0255.183] MoveToEx (in: hdc=0x15011bc4, x=163, y=2, lppt=0x26d0240 | out: lppt=0x26d0240) returned 1
	[0255.184] LineTo (hdc=0x15011bc4, x=2, y=2) returned 1
	[0255.184] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.184] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.184] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.184] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.184] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.185] SelectObject (hdc=0x15011bc4, h=0x68301beb) returned 0x68301beb
	[0255.185] MoveToEx (in: hdc=0x15011bc4, x=2, y=2, lppt=0x26d0258 | out: lppt=0x26d0258) returned 1
	[0255.185] LineTo (hdc=0x15011bc4, x=2, y=40) returned 1
	[0255.185] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.185] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.185] SelectObject (hdc=0x15011bc4, h=0x1b00017) returned 0x68301beb
	[0255.186] DeleteObject (ho=0x68301beb) returned 1
	[0255.186] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.186] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.186] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.186] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x17301bf5
	[0255.186] SelectObject (hdc=0x15011bc4, h=0x17301bf5) returned 0x1b00017
	[0255.187] MoveToEx (in: hdc=0x15011bc4, x=2, y=40, lppt=0x26d02c0 | out: lppt=0x26d02c0) returned 1
	[0255.187] LineTo (hdc=0x15011bc4, x=163, y=40) returned 1
	[0255.187] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.187] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.187] GetROP2 (hdc=0x15011bc4) returned 13
	[0255.187] GetBkMode (hdc=0x15011bc4) returned 2
	[0255.188] SetBkMode (hdc=0x15011bc4, mode=1) returned 2
	[0255.188] SelectObject (hdc=0x15011bc4, h=0x17301bf5) returned 0x17301bf5
	[0255.188] MoveToEx (in: hdc=0x15011bc4, x=163, y=40, lppt=0x26d02d8 | out: lppt=0x26d02d8) returned 1
	[0255.188] LineTo (hdc=0x15011bc4, x=163, y=1) returned 1
	[0255.188] SetBkMode (hdc=0x15011bc4, mode=2) returned 1
	[0255.188] MoveToEx (in: hdc=0x15011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.188] SelectObject (hdc=0x15011bc4, h=0x1b00017) returned 0x17301bf5
	[0255.189] DeleteObject (ho=0x17301bf5) returned 1
	[0255.189] RestoreDC (hdc=0x15011bc4, nSavedDC=-1) returned 1
	[0255.189] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011bc4) returned 0x0
	[0255.189] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0255.189] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x15011bc4, x1=0, y1=0, rop=0xcc0020) returned 1
	[0255.190] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011bc4) returned 0x0
	[0255.190] SelectObject (hdc=0x15011bc4, h=0x185000f) returned 0x140507d2
	[0255.190] DeleteDC (hdc=0x15011bc4) returned 1
	[0255.190] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0255.190] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0255.190] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0255.191] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26d0330, cPoints=0x1 | out: lpPoints=0x26d0330) returned 30606029
	[0255.191] WindowFromPoint (Point=0x1e60000030f) returned 0x201d8
	[0255.191] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.191] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0255.191] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0255.192] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0255.192] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26d0420, Length=0x70 | out: Destination=0x1afe53a0) 
	[0255.192] ShellExecuteExW (in: pExecInfo=0x26d0630*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26d0630*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0255.232] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0255.233] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0255.233] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0255.233] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0255.234] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0255.234] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0255.235] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0255.235] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0255.235] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0255.235] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0255.235] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0255.235] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0255.235] GetStockObject (i=5) returned 0x1900015
	[0255.236] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0255.236] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0255.236] GetCapture () returned 0x0
	[0255.236] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0255.236] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0255.236] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0255.236] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x48010f97
	[0255.236] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0255.236] CreateCompatibleDC (hdc=0x48010f97) returned 0x1d011bc4
	[0255.237] SelectObject (hdc=0x1d011bc4, h=0x140507d2) returned 0x185000f
	[0255.237] GdipCreateFromHDC (hdc=0x1d011bc4, graphics=0x20c9d0) returned 0x0
	[0255.237] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0255.237] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0255.237] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0255.237] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0255.238] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20cb60) returned 0x0
	[0255.238] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0255.238] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0255.238] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0255.238] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0255.239] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20cb30) returned 0x0
	[0255.239] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20cc00) returned 0x0
	[0255.239] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9500dbd) returned 0x0
	[0255.239] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0255.239] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20bfe0) returned 0x0
	[0255.239] GetCurrentObject (hdc=0x1d011bc4, type=0x1) returned 0x1b00017
	[0255.240] GetCurrentObject (hdc=0x1d011bc4, type=0x2) returned 0x1900010
	[0255.240] GetCurrentObject (hdc=0x1d011bc4, type=0x7) returned 0x140507d2
	[0255.240] GetCurrentObject (hdc=0x1d011bc4, type=0x6) returned 0x18a002e
	[0255.240] SaveDC (hdc=0x1d011bc4) returned 1
	[0255.240] GetNearestColor (hdc=0x1d011bc4, color=0xf0f0f0) returned 0xf0f0f0
	[0255.241] GetNearestColor (hdc=0x1d011bc4, color=0xa0a0a0) returned 0xa0a0a0
	[0255.241] GetNearestColor (hdc=0x1d011bc4, color=0x696969) returned 0x696969
	[0255.241] GetNearestColor (hdc=0x1d011bc4, color=0xa0a0a0) returned 0xa0a0a0
	[0255.241] GetNearestColor (hdc=0x1d011bc4, color=0x0) returned 0x0
	[0255.241] GetNearestColor (hdc=0x1d011bc4, color=0xffffff) returned 0xffffff
	[0255.242] GetNearestColor (hdc=0x1d011bc4, color=0xe5e5e5) returned 0xe5e5e5
	[0255.242] GetNearestColor (hdc=0x1d011bc4, color=0xd8d8d8) returned 0xd8d8d8
	[0255.242] GetNearestColor (hdc=0x1d011bc4, color=0x0) returned 0x0
	[0255.242] RestoreDC (hdc=0x1d011bc4, nSavedDC=-1) returned 1
	[0255.242] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d011bc4) returned 0x0
	[0255.242] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0255.243] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.243] CoTaskMemFree (pv=0x1b077150) 
	[0255.243] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0255.243] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.243] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.243] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0255.244] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0255.244] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0255.244] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0255.244] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0255.244] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0255.244] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0255.245] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0255.245] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.245] CoTaskMemFree (pv=0x1b077150) 
	[0255.245] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0255.245] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0255.245] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0255.246] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0255.246] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0255.246] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.246] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.246] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0255.246] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0255.247] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0255.247] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0255.247] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.247] CoTaskMemFree (pv=0x1b077150) 
	[0255.247] GdipCreateRegion (region=0x20c310) returned 0x0
	[0255.248] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0255.248] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0255.248] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0255.248] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0255.248] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0255.248] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0255.249] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0255.249] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c3c0) returned 0x0
	[0255.249] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c380) returned 0x0
	[0255.249] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c380) returned 0x0
	[0255.249] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0255.249] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c3f0) returned 0x0
	[0255.250] GetCurrentObject (hdc=0x1d011bc4, type=0x1) returned 0x1b00017
	[0255.250] GetCurrentObject (hdc=0x1d011bc4, type=0x2) returned 0x1900010
	[0255.250] GetCurrentObject (hdc=0x1d011bc4, type=0x7) returned 0x140507d2
	[0255.250] GetCurrentObject (hdc=0x1d011bc4, type=0x6) returned 0x18a002e
	[0255.250] SaveDC (hdc=0x1d011bc4) returned 1
	[0255.251] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbc040710
	[0255.251] GetClipRgn (hdc=0x1d011bc4, hrgn=0xffffffffbc040710) returned 0
	[0255.251] SelectClipRgn (hdc=0x1d011bc4, hrgn=0x580407f9) returned 2
	[0255.251] DeleteObject (ho=0xffffffffbc040710) returned 1
	[0255.251] DeleteObject (ho=0x580407f9) returned 1
	[0255.251] OffsetViewportOrgEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x26d1310 | out: lppt=0x26d1310) returned 1
	[0255.252] GetNearestColor (hdc=0x1d011bc4, color=0xf0f0f0) returned 0xf0f0f0
	[0255.252] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff9a1007c0
	[0255.252] FillRect (hDC=0x1d011bc4, lprc=0x20c3c0, hbr=0xffffffff9a1007c0) returned 1
	[0255.252] DeleteObject (ho=0xffffffff9a1007c0) returned 1
	[0255.252] RestoreDC (hdc=0x1d011bc4, nSavedDC=-1) returned 1
	[0255.253] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d011bc4) returned 0x0
	[0255.253] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0255.253] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.253] CoTaskMemFree (pv=0x1b077150) 
	[0255.253] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0255.253] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.253] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0255.254] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0255.254] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0255.254] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0255.254] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0255.254] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0255.255] GetFocus () returned 0x0
	[0255.255] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0255.255] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0255.255] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0255.255] CoTaskMemFree (pv=0x1b077150) 
	[0255.255] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0255.255] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0255.256] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0255.256] GdipCreateRegion (region=0x20c260) returned 0x0
	[0255.256] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0255.256] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0255.256] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0255.257] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c2c0) returned 0x0
	[0255.258] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0255.258] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c740) returned 0x0
	[0255.258] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0255.258] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c310) returned 0x0
	[0255.258] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c2d0) returned 0x0
	[0255.258] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c2d0) returned 0x0
	[0255.259] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0255.259] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c340) returned 0x0
	[0255.259] GetCurrentObject (hdc=0x1d011bc4, type=0x1) returned 0x1b00017
	[0255.259] GetCurrentObject (hdc=0x1d011bc4, type=0x2) returned 0x1900010
	[0255.259] GetCurrentObject (hdc=0x1d011bc4, type=0x7) returned 0x140507d2
	[0255.260] GetCurrentObject (hdc=0x1d011bc4, type=0x6) returned 0x18a002e
	[0255.260] SaveDC (hdc=0x1d011bc4) returned 1
	[0255.260] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x590407f9
	[0255.260] GetClipRgn (hdc=0x1d011bc4, hrgn=0x590407f9) returned 0
	[0255.260] SelectClipRgn (hdc=0x1d011bc4, hrgn=0xffffffffbd040710) returned 2
	[0255.260] DeleteObject (ho=0x590407f9) returned 1
	[0255.261] DeleteObject (ho=0xffffffffbd040710) returned 1
	[0255.261] OffsetViewportOrgEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x26d18b0 | out: lppt=0x26d18b0) returned 1
	[0255.261] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.261] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.261] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.261] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x18301bf5
	[0255.262] SelectObject (hdc=0x1d011bc4, h=0x18301bf5) returned 0x1b00017
	[0255.262] MoveToEx (in: hdc=0x1d011bc4, x=164, y=1, lppt=0x26d1918 | out: lppt=0x26d1918) returned 1
	[0255.262] LineTo (hdc=0x1d011bc4, x=1, y=1) returned 1
	[0255.262] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.262] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.263] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.263] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.263] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.263] SelectObject (hdc=0x1d011bc4, h=0x18301bf5) returned 0x18301bf5
	[0255.263] MoveToEx (in: hdc=0x1d011bc4, x=1, y=1, lppt=0x26d1930 | out: lppt=0x26d1930) returned 1
	[0255.263] LineTo (hdc=0x1d011bc4, x=1, y=41) returned 1
	[0255.264] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.264] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.264] SelectObject (hdc=0x1d011bc4, h=0x1b00017) returned 0x18301bf5
	[0255.264] DeleteObject (ho=0x18301bf5) returned 1
	[0255.264] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.264] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.265] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.265] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x69301beb
	[0255.265] SelectObject (hdc=0x1d011bc4, h=0x69301beb) returned 0x1b00017
	[0255.265] MoveToEx (in: hdc=0x1d011bc4, x=1, y=41, lppt=0x26d1998 | out: lppt=0x26d1998) returned 1
	[0255.265] LineTo (hdc=0x1d011bc4, x=164, y=41) returned 1
	[0255.266] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.266] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.266] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.266] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.266] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.266] SelectObject (hdc=0x1d011bc4, h=0x69301beb) returned 0x69301beb
	[0255.267] MoveToEx (in: hdc=0x1d011bc4, x=164, y=41, lppt=0x26d19b0 | out: lppt=0x26d19b0) returned 1
	[0255.267] LineTo (hdc=0x1d011bc4, x=164, y=0) returned 1
	[0255.267] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.267] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.267] SelectObject (hdc=0x1d011bc4, h=0x1b00017) returned 0x69301beb
	[0255.267] DeleteObject (ho=0x69301beb) returned 1
	[0255.268] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.268] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.268] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.268] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x19301bf5
	[0255.268] SelectObject (hdc=0x1d011bc4, h=0x19301bf5) returned 0x1b00017
	[0255.269] MoveToEx (in: hdc=0x1d011bc4, x=163, y=2, lppt=0x26d1a18 | out: lppt=0x26d1a18) returned 1
	[0255.269] LineTo (hdc=0x1d011bc4, x=2, y=2) returned 1
	[0255.269] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.269] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.269] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.269] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.270] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.270] SelectObject (hdc=0x1d011bc4, h=0x19301bf5) returned 0x19301bf5
	[0255.270] MoveToEx (in: hdc=0x1d011bc4, x=2, y=2, lppt=0x26d1a30 | out: lppt=0x26d1a30) returned 1
	[0255.270] LineTo (hdc=0x1d011bc4, x=2, y=40) returned 1
	[0255.270] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.270] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.271] SelectObject (hdc=0x1d011bc4, h=0x1b00017) returned 0x19301bf5
	[0255.271] DeleteObject (ho=0x19301bf5) returned 1
	[0255.271] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.271] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.271] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.272] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x6a301beb
	[0255.272] SelectObject (hdc=0x1d011bc4, h=0x6a301beb) returned 0x1b00017
	[0255.272] MoveToEx (in: hdc=0x1d011bc4, x=2, y=40, lppt=0x26d1a98 | out: lppt=0x26d1a98) returned 1
	[0255.272] LineTo (hdc=0x1d011bc4, x=163, y=40) returned 1
	[0255.272] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.272] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.273] GetROP2 (hdc=0x1d011bc4) returned 13
	[0255.273] GetBkMode (hdc=0x1d011bc4) returned 2
	[0255.273] SetBkMode (hdc=0x1d011bc4, mode=1) returned 2
	[0255.273] SelectObject (hdc=0x1d011bc4, h=0x6a301beb) returned 0x6a301beb
	[0255.273] MoveToEx (in: hdc=0x1d011bc4, x=163, y=40, lppt=0x26d1ab0 | out: lppt=0x26d1ab0) returned 1
	[0255.274] LineTo (hdc=0x1d011bc4, x=163, y=1) returned 1
	[0255.274] SetBkMode (hdc=0x1d011bc4, mode=2) returned 1
	[0255.274] MoveToEx (in: hdc=0x1d011bc4, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0255.274] SelectObject (hdc=0x1d011bc4, h=0x1b00017) returned 0x6a301beb
	[0255.274] DeleteObject (ho=0x6a301beb) returned 1
	[0255.275] RestoreDC (hdc=0x1d011bc4, nSavedDC=-1) returned 1
	[0255.275] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d011bc4) returned 0x0
	[0255.275] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cad0) returned 0x0
	[0255.275] BitBlt (hdc=0x48010f97, x=0, y=0, cx=166, cy=43, hdcSrc=0x1d011bc4, x1=0, y1=0, rop=0xcc0020) returned 1
	[0255.276] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1d011bc4) returned 0x0
	[0255.276] SelectObject (hdc=0x1d011bc4, h=0x185000f) returned 0x140507d2
	[0255.276] DeleteDC (hdc=0x1d011bc4) returned 1
	[0255.276] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0255.276] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0255.277] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0255.277] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.277] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.277] GetKeyState (nVirtKey=1) returned 1
	[0255.277] GetKeyState (nVirtKey=2) returned 0
	[0255.277] GetKeyState (nVirtKey=4) returned 0
	[0255.277] GetKeyState (nVirtKey=5) returned 0
	[0255.277] GetKeyState (nVirtKey=6) returned 0
	[0255.299] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.300] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.300] GetKeyState (nVirtKey=1) returned 1
	[0255.300] GetKeyState (nVirtKey=2) returned 0
	[0255.300] GetKeyState (nVirtKey=4) returned 0
	[0255.300] GetKeyState (nVirtKey=5) returned 0
	[0255.300] GetKeyState (nVirtKey=6) returned 0
	[0255.352] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.353] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.354] GetKeyState (nVirtKey=1) returned 1
	[0255.354] GetKeyState (nVirtKey=2) returned 0
	[0255.354] GetKeyState (nVirtKey=4) returned 0
	[0255.354] GetKeyState (nVirtKey=5) returned 0
	[0255.354] GetKeyState (nVirtKey=6) returned 0
	[0255.381] GetCapture () returned 0x0
	[0255.381] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.381] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.381] WaitMessage () returned 1
	[0255.408] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.408] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.408] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.408] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.408] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.408] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.408] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.408] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.409] GetKeyState (nVirtKey=1) returned 1
	[0255.409] GetKeyState (nVirtKey=2) returned 0
	[0255.409] GetKeyState (nVirtKey=4) returned 0
	[0255.409] GetKeyState (nVirtKey=5) returned 0
	[0255.409] GetKeyState (nVirtKey=6) returned 0
	[0255.409] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.409] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.409] WaitMessage () returned 1
	[0255.409] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.409] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.409] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.409] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.410] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.410] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.410] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.410] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.410] GetKeyState (nVirtKey=1) returned 1
	[0255.410] GetKeyState (nVirtKey=2) returned 0
	[0255.410] GetKeyState (nVirtKey=4) returned 0
	[0255.410] GetKeyState (nVirtKey=5) returned 0
	[0255.410] GetKeyState (nVirtKey=6) returned 0
	[0255.410] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.410] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.410] WaitMessage () returned 1
	[0255.412] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.412] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.412] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.412] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.412] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.413] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.413] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.413] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0255.413] GetKeyState (nVirtKey=1) returned 1
	[0255.413] GetKeyState (nVirtKey=2) returned 0
	[0255.413] GetKeyState (nVirtKey=4) returned 0
	[0255.413] GetKeyState (nVirtKey=5) returned 0
	[0255.413] GetKeyState (nVirtKey=6) returned 0
	[0255.413] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.413] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.413] WaitMessage () returned 1
	[0255.421] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.422] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.422] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.422] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.422] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.422] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.422] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.422] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.422] GetKeyState (nVirtKey=1) returned 1
	[0255.422] GetKeyState (nVirtKey=2) returned 0
	[0255.422] GetKeyState (nVirtKey=4) returned 0
	[0255.422] GetKeyState (nVirtKey=5) returned 0
	[0255.422] GetKeyState (nVirtKey=6) returned 0
	[0255.422] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.422] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.422] WaitMessage () returned 1
	[0255.423] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.423] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.423] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.423] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.423] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.423] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.424] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.424] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.424] GetKeyState (nVirtKey=1) returned 1
	[0255.424] GetKeyState (nVirtKey=2) returned 0
	[0255.424] GetKeyState (nVirtKey=4) returned 0
	[0255.424] GetKeyState (nVirtKey=5) returned 0
	[0255.424] GetKeyState (nVirtKey=6) returned 0
	[0255.424] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.424] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.424] WaitMessage () returned 1
	[0255.427] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.427] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.427] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.427] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.427] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.427] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.427] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.427] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.428] GetKeyState (nVirtKey=1) returned 1
	[0255.428] GetKeyState (nVirtKey=2) returned 0
	[0255.428] GetKeyState (nVirtKey=4) returned 0
	[0255.428] GetKeyState (nVirtKey=5) returned 0
	[0255.428] GetKeyState (nVirtKey=6) returned 0
	[0255.428] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.428] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.428] WaitMessage () returned 1
	[0255.459] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.459] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.460] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.460] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.460] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.460] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.460] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.460] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.460] GetKeyState (nVirtKey=1) returned 1
	[0255.460] GetKeyState (nVirtKey=2) returned 0
	[0255.460] GetKeyState (nVirtKey=4) returned 0
	[0255.460] GetKeyState (nVirtKey=5) returned 0
	[0255.460] GetKeyState (nVirtKey=6) returned 0
	[0255.460] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.460] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.460] WaitMessage () returned 1
	[0255.462] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.462] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.462] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.462] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.462] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.462] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.462] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.462] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.462] GetKeyState (nVirtKey=1) returned 1
	[0255.462] GetKeyState (nVirtKey=2) returned 0
	[0255.462] GetKeyState (nVirtKey=4) returned 0
	[0255.462] GetKeyState (nVirtKey=5) returned 0
	[0255.462] GetKeyState (nVirtKey=6) returned 0
	[0255.462] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.462] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.462] WaitMessage () returned 1
	[0255.470] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.470] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.470] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.470] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.470] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.470] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.471] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.471] GetKeyState (nVirtKey=1) returned 1
	[0255.471] GetKeyState (nVirtKey=2) returned 0
	[0255.471] GetKeyState (nVirtKey=4) returned 0
	[0255.471] GetKeyState (nVirtKey=5) returned 0
	[0255.471] GetKeyState (nVirtKey=6) returned 0
	[0255.471] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.471] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.471] WaitMessage () returned 1
	[0255.471] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.471] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.471] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.471] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.471] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.471] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.472] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.472] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.472] GetKeyState (nVirtKey=1) returned 1
	[0255.472] GetKeyState (nVirtKey=2) returned 0
	[0255.472] GetKeyState (nVirtKey=4) returned 0
	[0255.472] GetKeyState (nVirtKey=5) returned 0
	[0255.472] GetKeyState (nVirtKey=6) returned 0
	[0255.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.472] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.472] WaitMessage () returned 1
	[0255.473] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.473] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.473] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.473] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.473] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.473] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.473] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.473] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.473] GetKeyState (nVirtKey=1) returned 1
	[0255.473] GetKeyState (nVirtKey=2) returned 0
	[0255.473] GetKeyState (nVirtKey=4) returned 0
	[0255.473] GetKeyState (nVirtKey=5) returned 0
	[0255.473] GetKeyState (nVirtKey=6) returned 0
	[0255.473] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.473] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.473] WaitMessage () returned 1
	[0255.474] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.474] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.474] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.474] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.474] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.475] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.475] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.475] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.475] GetKeyState (nVirtKey=1) returned 1
	[0255.475] GetKeyState (nVirtKey=2) returned 0
	[0255.475] GetKeyState (nVirtKey=4) returned 0
	[0255.475] GetKeyState (nVirtKey=5) returned 0
	[0255.475] GetKeyState (nVirtKey=6) returned 0
	[0255.475] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.475] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.475] WaitMessage () returned 1
	[0255.497] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.497] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.497] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.497] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.497] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.497] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.497] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.497] GetKeyState (nVirtKey=1) returned 1
	[0255.497] GetKeyState (nVirtKey=2) returned 0
	[0255.497] GetKeyState (nVirtKey=4) returned 0
	[0255.497] GetKeyState (nVirtKey=5) returned 0
	[0255.497] GetKeyState (nVirtKey=6) returned 0
	[0255.497] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.497] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.497] WaitMessage () returned 1
	[0255.501] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.501] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.501] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.501] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.501] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.501] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.501] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.501] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.501] GetKeyState (nVirtKey=1) returned 1
	[0255.501] GetKeyState (nVirtKey=2) returned 0
	[0255.501] GetKeyState (nVirtKey=4) returned 0
	[0255.501] GetKeyState (nVirtKey=5) returned 0
	[0255.501] GetKeyState (nVirtKey=6) returned 0
	[0255.501] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.501] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.501] WaitMessage () returned 1
	[0255.503] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.503] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.503] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.503] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.503] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.503] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.503] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.503] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.503] GetKeyState (nVirtKey=1) returned 1
	[0255.503] GetKeyState (nVirtKey=2) returned 0
	[0255.503] GetKeyState (nVirtKey=4) returned 0
	[0255.503] GetKeyState (nVirtKey=5) returned 0
	[0255.504] GetKeyState (nVirtKey=6) returned 0
	[0255.504] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.504] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.504] WaitMessage () returned 1
	[0255.504] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.504] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.504] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.504] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.504] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.505] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.505] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.505] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.505] GetKeyState (nVirtKey=1) returned 1
	[0255.505] GetKeyState (nVirtKey=2) returned 0
	[0255.505] GetKeyState (nVirtKey=4) returned 0
	[0255.505] GetKeyState (nVirtKey=5) returned 0
	[0255.505] GetKeyState (nVirtKey=6) returned 0
	[0255.505] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.505] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.505] WaitMessage () returned 1
	[0255.538] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.538] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0255.538] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.538] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.538] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.538] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.538] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.538] WaitMessage () returned 1
	[0255.569] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.570] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.570] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.570] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.570] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.570] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.570] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.570] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.570] GetKeyState (nVirtKey=1) returned 1
	[0255.570] GetKeyState (nVirtKey=2) returned 0
	[0255.570] GetKeyState (nVirtKey=4) returned 0
	[0255.570] GetKeyState (nVirtKey=5) returned 0
	[0255.570] GetKeyState (nVirtKey=6) returned 0
	[0255.570] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.570] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.570] WaitMessage () returned 1
	[0255.572] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.572] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.572] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.572] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.572] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.572] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.572] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.572] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.572] GetKeyState (nVirtKey=1) returned 1
	[0255.572] GetKeyState (nVirtKey=2) returned 0
	[0255.572] GetKeyState (nVirtKey=4) returned 0
	[0255.572] GetKeyState (nVirtKey=5) returned 0
	[0255.572] GetKeyState (nVirtKey=6) returned 0
	[0255.572] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.572] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.572] WaitMessage () returned 1
	[0255.573] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.573] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.573] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.573] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.573] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.573] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.573] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.573] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.573] GetKeyState (nVirtKey=1) returned 1
	[0255.573] GetKeyState (nVirtKey=2) returned 0
	[0255.573] GetKeyState (nVirtKey=4) returned 0
	[0255.573] GetKeyState (nVirtKey=5) returned 0
	[0255.573] GetKeyState (nVirtKey=6) returned 0
	[0255.573] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.573] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.573] WaitMessage () returned 1
	[0255.574] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.574] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.574] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.574] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.574] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.574] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.574] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.575] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.575] GetKeyState (nVirtKey=1) returned 1
	[0255.575] GetKeyState (nVirtKey=2) returned 0
	[0255.575] GetKeyState (nVirtKey=4) returned 0
	[0255.575] GetKeyState (nVirtKey=5) returned 0
	[0255.575] GetKeyState (nVirtKey=6) returned 0
	[0255.575] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.575] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.575] WaitMessage () returned 1
	[0255.576] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.576] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.576] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.576] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.576] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.576] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.576] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.576] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.576] GetKeyState (nVirtKey=1) returned 1
	[0255.576] GetKeyState (nVirtKey=2) returned 0
	[0255.576] GetKeyState (nVirtKey=4) returned 0
	[0255.576] GetKeyState (nVirtKey=5) returned 0
	[0255.576] GetKeyState (nVirtKey=6) returned 0
	[0255.577] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.577] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.577] WaitMessage () returned 1
	[0255.577] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.577] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.577] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.577] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.577] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.578] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.578] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.578] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.578] GetKeyState (nVirtKey=1) returned 1
	[0255.578] GetKeyState (nVirtKey=2) returned 0
	[0255.578] GetKeyState (nVirtKey=4) returned 0
	[0255.578] GetKeyState (nVirtKey=5) returned 0
	[0255.578] GetKeyState (nVirtKey=6) returned 0
	[0255.578] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.578] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.578] WaitMessage () returned 1
	[0255.578] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.578] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.579] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.579] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.579] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.579] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.579] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.579] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.579] GetKeyState (nVirtKey=1) returned 1
	[0255.579] GetKeyState (nVirtKey=2) returned 0
	[0255.579] GetKeyState (nVirtKey=4) returned 0
	[0255.579] GetKeyState (nVirtKey=5) returned 0
	[0255.579] GetKeyState (nVirtKey=6) returned 0
	[0255.579] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.579] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.579] WaitMessage () returned 1
	[0255.580] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.580] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.580] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.580] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.580] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.580] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.580] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.580] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.580] GetKeyState (nVirtKey=1) returned 1
	[0255.580] GetKeyState (nVirtKey=2) returned 0
	[0255.580] GetKeyState (nVirtKey=4) returned 0
	[0255.580] GetKeyState (nVirtKey=5) returned 0
	[0255.580] GetKeyState (nVirtKey=6) returned 0
	[0255.580] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.580] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.580] WaitMessage () returned 1
	[0255.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.582] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.582] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.582] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.582] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.582] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.582] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.582] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.582] GetKeyState (nVirtKey=1) returned 1
	[0255.582] GetKeyState (nVirtKey=2) returned 0
	[0255.582] GetKeyState (nVirtKey=4) returned 0
	[0255.582] GetKeyState (nVirtKey=5) returned 0
	[0255.582] GetKeyState (nVirtKey=6) returned 0
	[0255.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.582] WaitMessage () returned 1
	[0255.583] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.583] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.583] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.583] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.583] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.584] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.584] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.584] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.584] GetKeyState (nVirtKey=1) returned 1
	[0255.584] GetKeyState (nVirtKey=2) returned 0
	[0255.584] GetKeyState (nVirtKey=4) returned 0
	[0255.584] GetKeyState (nVirtKey=5) returned 0
	[0255.584] GetKeyState (nVirtKey=6) returned 0
	[0255.584] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.584] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.584] WaitMessage () returned 1
	[0255.589] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.589] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.589] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.589] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.589] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.589] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.589] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.589] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.589] GetKeyState (nVirtKey=1) returned 1
	[0255.589] GetKeyState (nVirtKey=2) returned 0
	[0255.589] GetKeyState (nVirtKey=4) returned 0
	[0255.589] GetKeyState (nVirtKey=5) returned 0
	[0255.589] GetKeyState (nVirtKey=6) returned 0
	[0255.589] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.589] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.589] WaitMessage () returned 1
	[0255.593] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.593] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.593] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.593] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.593] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.593] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.593] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.593] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.593] GetKeyState (nVirtKey=1) returned 1
	[0255.593] GetKeyState (nVirtKey=2) returned 0
	[0255.593] GetKeyState (nVirtKey=4) returned 0
	[0255.593] GetKeyState (nVirtKey=5) returned 0
	[0255.593] GetKeyState (nVirtKey=6) returned 0
	[0255.593] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.593] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.593] WaitMessage () returned 1
	[0255.595] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.595] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.595] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.595] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.595] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.595] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.595] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.595] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.595] GetKeyState (nVirtKey=1) returned 1
	[0255.595] GetKeyState (nVirtKey=2) returned 0
	[0255.595] GetKeyState (nVirtKey=4) returned 0
	[0255.595] GetKeyState (nVirtKey=5) returned 0
	[0255.595] GetKeyState (nVirtKey=6) returned 0
	[0255.595] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.595] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.595] WaitMessage () returned 1
	[0255.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.622] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.622] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.622] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.622] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.622] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.622] GetKeyState (nVirtKey=1) returned 1
	[0255.622] GetKeyState (nVirtKey=2) returned 0
	[0255.622] GetKeyState (nVirtKey=4) returned 0
	[0255.622] GetKeyState (nVirtKey=5) returned 0
	[0255.622] GetKeyState (nVirtKey=6) returned 0
	[0255.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.622] WaitMessage () returned 1
	[0255.653] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.653] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.653] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.653] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.653] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.653] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.653] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.653] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.653] GetKeyState (nVirtKey=1) returned 1
	[0255.653] GetKeyState (nVirtKey=2) returned 0
	[0255.653] GetKeyState (nVirtKey=4) returned 0
	[0255.653] GetKeyState (nVirtKey=5) returned 0
	[0255.653] GetKeyState (nVirtKey=6) returned 0
	[0255.653] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.653] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.653] WaitMessage () returned 1
	[0255.691] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.691] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.691] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.691] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.691] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.691] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.691] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.691] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.691] GetKeyState (nVirtKey=1) returned 1
	[0255.691] GetKeyState (nVirtKey=2) returned 0
	[0255.691] GetKeyState (nVirtKey=4) returned 0
	[0255.691] GetKeyState (nVirtKey=5) returned 0
	[0255.691] GetKeyState (nVirtKey=6) returned 0
	[0255.691] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.691] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.691] WaitMessage () returned 1
	[0255.692] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.692] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.692] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.692] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.692] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.692] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.692] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.692] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.692] GetKeyState (nVirtKey=1) returned 1
	[0255.692] GetKeyState (nVirtKey=2) returned 0
	[0255.692] GetKeyState (nVirtKey=4) returned 0
	[0255.692] GetKeyState (nVirtKey=5) returned 0
	[0255.692] GetKeyState (nVirtKey=6) returned 0
	[0255.692] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.692] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.692] WaitMessage () returned 1
	[0255.693] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.693] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.693] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.693] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.693] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.693] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.693] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.693] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.693] GetKeyState (nVirtKey=1) returned 1
	[0255.693] GetKeyState (nVirtKey=2) returned 0
	[0255.693] GetKeyState (nVirtKey=4) returned 0
	[0255.693] GetKeyState (nVirtKey=5) returned 0
	[0255.693] GetKeyState (nVirtKey=6) returned 0
	[0255.693] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.693] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.693] WaitMessage () returned 1
	[0255.693] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.693] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.694] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.694] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.694] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.694] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.694] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.694] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.694] GetKeyState (nVirtKey=1) returned 1
	[0255.694] GetKeyState (nVirtKey=2) returned 0
	[0255.694] GetKeyState (nVirtKey=4) returned 0
	[0255.694] GetKeyState (nVirtKey=5) returned 0
	[0255.694] GetKeyState (nVirtKey=6) returned 0
	[0255.694] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.694] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.694] WaitMessage () returned 1
	[0255.830] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.830] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.831] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.831] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.831] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.831] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.831] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.831] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.831] GetKeyState (nVirtKey=1) returned 1
	[0255.831] GetKeyState (nVirtKey=2) returned 0
	[0255.831] GetKeyState (nVirtKey=4) returned 0
	[0255.831] GetKeyState (nVirtKey=5) returned 0
	[0255.831] GetKeyState (nVirtKey=6) returned 0
	[0255.831] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.831] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.831] WaitMessage () returned 1
	[0255.832] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.832] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.833] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.833] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.833] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.833] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.833] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.833] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.833] GetKeyState (nVirtKey=1) returned 1
	[0255.833] GetKeyState (nVirtKey=2) returned 0
	[0255.833] GetKeyState (nVirtKey=4) returned 0
	[0255.833] GetKeyState (nVirtKey=5) returned 0
	[0255.833] GetKeyState (nVirtKey=6) returned 0
	[0255.834] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.834] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.834] WaitMessage () returned 1
	[0255.842] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.842] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.842] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.842] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.842] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.842] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.842] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.842] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.842] GetKeyState (nVirtKey=1) returned 1
	[0255.842] GetKeyState (nVirtKey=2) returned 0
	[0255.842] GetKeyState (nVirtKey=4) returned 0
	[0255.842] GetKeyState (nVirtKey=5) returned 0
	[0255.842] GetKeyState (nVirtKey=6) returned 0
	[0255.842] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.842] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.842] WaitMessage () returned 1
	[0255.843] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.843] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.844] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0255.844] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0255.844] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0255.844] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0255.844] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0255.844] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0255.844] GetKeyState (nVirtKey=1) returned 1
	[0255.844] GetKeyState (nVirtKey=2) returned 0
	[0255.844] GetKeyState (nVirtKey=4) returned 0
	[0255.844] GetKeyState (nVirtKey=5) returned 0
	[0255.844] GetKeyState (nVirtKey=6) returned 0
	[0255.844] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.844] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0255.844] WaitMessage () returned 1
	[0256.159] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.159] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0256.160] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0256.160] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.160] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1e6030f) returned 0x1
	[0256.160] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.160] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.160] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.160] GetKeyState (nVirtKey=1) returned 1
	[0256.160] GetKeyState (nVirtKey=2) returned 0
	[0256.160] GetKeyState (nVirtKey=4) returned 0
	[0256.160] GetKeyState (nVirtKey=5) returned 0
	[0256.160] GetKeyState (nVirtKey=6) returned 0
	[0256.160] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.160] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.160] WaitMessage () returned 1
	[0256.300] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.300] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.300] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.300] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.300] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.300] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.300] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0256.300] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0256.300] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.300] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.300] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.300] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.300] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.300] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.300] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.300] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.300] _TrackMouseEvent (in: lpEventTrack=0x263be70 | out: lpEventTrack=0x263be70) returned 1
	[0256.301] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0256.301] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0256.301] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0256.301] GetKeyState (nVirtKey=1) returned 1
	[0256.301] GetKeyState (nVirtKey=2) returned 0
	[0256.301] GetKeyState (nVirtKey=4) returned 0
	[0256.301] GetKeyState (nVirtKey=5) returned 0
	[0256.301] GetKeyState (nVirtKey=6) returned 0
	[0256.301] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.301] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0256.301] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.301] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.301] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.301] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0256.301] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0256.301] CreateCompatibleDC (hdc=0x4010280) returned 0x15011c2a
	[0256.302] SelectObject (hdc=0x15011c2a, h=0x140507d2) returned 0x185000f
	[0256.302] GdipCreateFromHDC (hdc=0x15011c2a, graphics=0x20d7e0) returned 0x0
	[0256.302] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0256.302] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0256.303] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0256.303] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0256.303] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0256.303] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.303] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.303] GdipCreateRegion (region=0x20d910) returned 0x0
	[0256.304] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.304] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0256.304] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0256.304] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff94d0dbd) returned 0x0
	[0256.304] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.304] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0256.305] GetCurrentObject (hdc=0x15011c2a, type=0x1) returned 0x1b00017
	[0256.305] GetCurrentObject (hdc=0x15011c2a, type=0x2) returned 0x1900010
	[0256.305] GetCurrentObject (hdc=0x15011c2a, type=0x7) returned 0x140507d2
	[0256.305] GetCurrentObject (hdc=0x15011c2a, type=0x6) returned 0x18a002e
	[0256.305] SaveDC (hdc=0x15011c2a) returned 1
	[0256.305] GetNearestColor (hdc=0x15011c2a, color=0xf0f0f0) returned 0xf0f0f0
	[0256.306] GetNearestColor (hdc=0x15011c2a, color=0xa0a0a0) returned 0xa0a0a0
	[0256.306] GetNearestColor (hdc=0x15011c2a, color=0x696969) returned 0x696969
	[0256.306] GetNearestColor (hdc=0x15011c2a, color=0xa0a0a0) returned 0xa0a0a0
	[0256.306] GetNearestColor (hdc=0x15011c2a, color=0x0) returned 0x0
	[0256.306] GetNearestColor (hdc=0x15011c2a, color=0xffffff) returned 0xffffff
	[0256.306] GetNearestColor (hdc=0x15011c2a, color=0xe5e5e5) returned 0xe5e5e5
	[0256.307] GetNearestColor (hdc=0x15011c2a, color=0xd8d8d8) returned 0xd8d8d8
	[0256.307] GetNearestColor (hdc=0x15011c2a, color=0x0) returned 0x0
	[0256.307] RestoreDC (hdc=0x15011c2a, nSavedDC=-1) returned 1
	[0256.307] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011c2a) returned 0x0
	[0256.307] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.308] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.308] CoTaskMemFree (pv=0x1b067980) 
	[0256.308] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0256.308] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.308] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.308] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.308] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0256.309] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0256.309] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0256.309] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0256.309] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0256.309] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.309] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.309] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.310] CoTaskMemFree (pv=0x1b067980) 
	[0256.310] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0256.310] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0256.310] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0256.310] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0256.310] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.310] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.311] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.311] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0256.311] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.311] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0256.311] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.311] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.311] CoTaskMemFree (pv=0x1b067980) 
	[0256.311] GdipCreateRegion (region=0x20d120) returned 0x0
	[0256.312] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.312] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0256.312] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0256.312] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d180) returned 0x0
	[0256.312] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.312] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.313] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0256.313] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0256.313] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0256.313] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0256.313] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.313] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0256.314] GetCurrentObject (hdc=0x15011c2a, type=0x1) returned 0x1b00017
	[0256.314] GetCurrentObject (hdc=0x15011c2a, type=0x2) returned 0x1900010
	[0256.314] GetCurrentObject (hdc=0x15011c2a, type=0x7) returned 0x140507d2
	[0256.314] GetCurrentObject (hdc=0x15011c2a, type=0x6) returned 0x18a002e
	[0256.314] SaveDC (hdc=0x15011c2a) returned 1
	[0256.314] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbe040710
	[0256.315] GetClipRgn (hdc=0x15011c2a, hrgn=0xffffffffbe040710) returned 0
	[0256.315] SelectClipRgn (hdc=0x15011c2a, hrgn=0x5a0407f9) returned 2
	[0256.315] DeleteObject (ho=0xffffffffbe040710) returned 1
	[0256.315] DeleteObject (ho=0x5a0407f9) returned 1
	[0256.315] OffsetViewportOrgEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x26d3790 | out: lppt=0x26d3790) returned 1
	[0256.315] GetNearestColor (hdc=0x15011c2a, color=0xf0f0f0) returned 0xf0f0f0
	[0256.316] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff9b1007c0
	[0256.316] FillRect (hDC=0x15011c2a, lprc=0x20d1d0, hbr=0xffffffff9b1007c0) returned 1
	[0256.316] DeleteObject (ho=0xffffffff9b1007c0) returned 1
	[0256.316] RestoreDC (hdc=0x15011c2a, nSavedDC=-1) returned 1
	[0256.316] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011c2a) returned 0x0
	[0256.316] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.317] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.317] CoTaskMemFree (pv=0x1b067980) 
	[0256.317] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0256.317] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.317] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.317] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.317] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0256.317] GdipDrawString (graphics=0x1b94e0b0, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0256.320] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0256.320] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.320] GetFocus () returned 0x0
	[0256.320] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0256.320] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.320] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.320] CoTaskMemFree (pv=0x1b067980) 
	[0256.320] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0256.320] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0256.321] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0256.321] GdipCreateRegion (region=0x20d070) returned 0x0
	[0256.321] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.321] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0256.321] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0256.322] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0256.322] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.322] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.322] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.322] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0256.322] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0256.323] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0256.323] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.323] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0256.323] GetCurrentObject (hdc=0x15011c2a, type=0x1) returned 0x1b00017
	[0256.323] GetCurrentObject (hdc=0x15011c2a, type=0x2) returned 0x1900010
	[0256.324] GetCurrentObject (hdc=0x15011c2a, type=0x7) returned 0x140507d2
	[0256.324] GetCurrentObject (hdc=0x15011c2a, type=0x6) returned 0x18a002e
	[0256.324] SaveDC (hdc=0x15011c2a) returned 1
	[0256.324] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b0407f9
	[0256.324] GetClipRgn (hdc=0x15011c2a, hrgn=0x5b0407f9) returned 0
	[0256.324] SelectClipRgn (hdc=0x15011c2a, hrgn=0xffffffffbf040710) returned 2
	[0256.325] DeleteObject (ho=0x5b0407f9) returned 1
	[0256.325] DeleteObject (ho=0xffffffffbf040710) returned 1
	[0256.325] OffsetViewportOrgEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x26d3d30 | out: lppt=0x26d3d30) returned 1
	[0256.325] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.325] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.325] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.326] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x22301c1f
	[0256.326] SelectObject (hdc=0x15011c2a, h=0x22301c1f) returned 0x1b00017
	[0256.326] MoveToEx (in: hdc=0x15011c2a, x=164, y=1, lppt=0x26d3d98 | out: lppt=0x26d3d98) returned 1
	[0256.326] LineTo (hdc=0x15011c2a, x=1, y=1) returned 1
	[0256.326] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.326] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.327] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.327] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.327] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.327] SelectObject (hdc=0x15011c2a, h=0x22301c1f) returned 0x22301c1f
	[0256.327] MoveToEx (in: hdc=0x15011c2a, x=1, y=1, lppt=0x26d3db0 | out: lppt=0x26d3db0) returned 1
	[0256.327] LineTo (hdc=0x15011c2a, x=1, y=41) returned 1
	[0256.328] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.328] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.328] SelectObject (hdc=0x15011c2a, h=0x1b00017) returned 0x22301c1f
	[0256.328] DeleteObject (ho=0x22301c1f) returned 1
	[0256.328] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.328] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.328] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.329] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1b301c24
	[0256.329] SelectObject (hdc=0x15011c2a, h=0x1b301c24) returned 0x1b00017
	[0256.329] MoveToEx (in: hdc=0x15011c2a, x=1, y=41, lppt=0x26d3e18 | out: lppt=0x26d3e18) returned 1
	[0256.329] LineTo (hdc=0x15011c2a, x=164, y=41) returned 1
	[0256.329] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.329] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.330] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.330] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.330] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.330] SelectObject (hdc=0x15011c2a, h=0x1b301c24) returned 0x1b301c24
	[0256.330] MoveToEx (in: hdc=0x15011c2a, x=164, y=41, lppt=0x26d3e30 | out: lppt=0x26d3e30) returned 1
	[0256.330] LineTo (hdc=0x15011c2a, x=164, y=0) returned 1
	[0256.331] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.331] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.331] SelectObject (hdc=0x15011c2a, h=0x1b00017) returned 0x1b301c24
	[0256.331] DeleteObject (ho=0x1b301c24) returned 1
	[0256.331] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.331] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.331] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.332] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x23301c1f
	[0256.332] SelectObject (hdc=0x15011c2a, h=0x23301c1f) returned 0x1b00017
	[0256.332] MoveToEx (in: hdc=0x15011c2a, x=163, y=2, lppt=0x26d3e98 | out: lppt=0x26d3e98) returned 1
	[0256.332] LineTo (hdc=0x15011c2a, x=2, y=2) returned 1
	[0256.332] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.332] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.333] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.333] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.333] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.333] SelectObject (hdc=0x15011c2a, h=0x23301c1f) returned 0x23301c1f
	[0256.334] MoveToEx (in: hdc=0x15011c2a, x=2, y=2, lppt=0x26d3eb0 | out: lppt=0x26d3eb0) returned 1
	[0256.334] LineTo (hdc=0x15011c2a, x=2, y=40) returned 1
	[0256.334] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.334] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.334] SelectObject (hdc=0x15011c2a, h=0x1b00017) returned 0x23301c1f
	[0256.334] DeleteObject (ho=0x23301c1f) returned 1
	[0256.335] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.335] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.335] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.335] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1e301c24
	[0256.335] SelectObject (hdc=0x15011c2a, h=0x1e301c24) returned 0x1b00017
	[0256.335] MoveToEx (in: hdc=0x15011c2a, x=2, y=40, lppt=0x26d3f18 | out: lppt=0x26d3f18) returned 1
	[0256.336] LineTo (hdc=0x15011c2a, x=163, y=40) returned 1
	[0256.336] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.336] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.336] GetROP2 (hdc=0x15011c2a) returned 13
	[0256.336] GetBkMode (hdc=0x15011c2a) returned 2
	[0256.336] SetBkMode (hdc=0x15011c2a, mode=1) returned 2
	[0256.337] SelectObject (hdc=0x15011c2a, h=0x1e301c24) returned 0x1e301c24
	[0256.337] MoveToEx (in: hdc=0x15011c2a, x=163, y=40, lppt=0x26d3f30 | out: lppt=0x26d3f30) returned 1
	[0256.337] LineTo (hdc=0x15011c2a, x=163, y=1) returned 1
	[0256.337] SetBkMode (hdc=0x15011c2a, mode=2) returned 1
	[0256.337] MoveToEx (in: hdc=0x15011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.337] SelectObject (hdc=0x15011c2a, h=0x1b00017) returned 0x1e301c24
	[0256.337] DeleteObject (ho=0x1e301c24) returned 1
	[0256.338] RestoreDC (hdc=0x15011c2a, nSavedDC=-1) returned 1
	[0256.338] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011c2a) returned 0x0
	[0256.338] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0256.338] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x15011c2a, x1=0, y1=0, rop=0xcc0020) returned 1
	[0256.338] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x15011c2a) returned 0x0
	[0256.339] SelectObject (hdc=0x15011c2a, h=0x185000f) returned 0x140507d2
	[0256.339] DeleteDC (hdc=0x15011c2a) returned 1
	[0256.339] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0256.339] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0256.339] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0256.339] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.339] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.339] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.340] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.340] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.340] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0256.340] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0256.340] CreateCompatibleDC (hdc=0x4010280) returned 0x17011c2a
	[0256.340] SelectObject (hdc=0x17011c2a, h=0x140507d2) returned 0x185000f
	[0256.340] GdipCreateFromHDC (hdc=0x17011c2a, graphics=0x20d7e0) returned 0x0
	[0256.340] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0256.341] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0256.341] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0256.341] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0256.341] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0256.341] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.341] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0256.342] GdipCreateRegion (region=0x20d910) returned 0x0
	[0256.342] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.342] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0256.342] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0256.342] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff94a0dbd) returned 0x0
	[0256.342] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.343] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20cdf0) returned 0x0
	[0256.343] GetCurrentObject (hdc=0x17011c2a, type=0x1) returned 0x1b00017
	[0256.343] GetCurrentObject (hdc=0x17011c2a, type=0x2) returned 0x1900010
	[0256.343] GetCurrentObject (hdc=0x17011c2a, type=0x7) returned 0x140507d2
	[0256.343] GetCurrentObject (hdc=0x17011c2a, type=0x6) returned 0x18a002e
	[0256.343] SaveDC (hdc=0x17011c2a) returned 1
	[0256.344] GetNearestColor (hdc=0x17011c2a, color=0xf0f0f0) returned 0xf0f0f0
	[0256.344] GetNearestColor (hdc=0x17011c2a, color=0xa0a0a0) returned 0xa0a0a0
	[0256.344] GetNearestColor (hdc=0x17011c2a, color=0x696969) returned 0x696969
	[0256.344] GetNearestColor (hdc=0x17011c2a, color=0xa0a0a0) returned 0xa0a0a0
	[0256.344] GetNearestColor (hdc=0x17011c2a, color=0x0) returned 0x0
	[0256.344] GetNearestColor (hdc=0x17011c2a, color=0xffffff) returned 0xffffff
	[0256.345] GetNearestColor (hdc=0x17011c2a, color=0xe5e5e5) returned 0xe5e5e5
	[0256.345] GetNearestColor (hdc=0x17011c2a, color=0xd8d8d8) returned 0xd8d8d8
	[0256.345] GetNearestColor (hdc=0x17011c2a, color=0x0) returned 0x0
	[0256.345] RestoreDC (hdc=0x17011c2a, nSavedDC=-1) returned 1
	[0256.345] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17011c2a) returned 0x0
	[0256.346] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.346] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.346] CoTaskMemFree (pv=0x1b067980) 
	[0256.346] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0256.346] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.346] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.347] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.347] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0256.347] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0256.347] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0256.347] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0256.347] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0256.348] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.348] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.348] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.348] CoTaskMemFree (pv=0x1b067980) 
	[0256.348] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0256.348] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0256.349] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0256.349] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0256.349] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.350] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.350] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.350] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0256.350] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.350] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0256.351] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.351] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.351] CoTaskMemFree (pv=0x1b067980) 
	[0256.351] GdipCreateRegion (region=0x20d120) returned 0x0
	[0256.351] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.351] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0256.351] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0256.351] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0256.352] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.352] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.352] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.352] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d1d0) returned 0x0
	[0256.352] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d190) returned 0x0
	[0256.352] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d190) returned 0x0
	[0256.353] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.353] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d200) returned 0x0
	[0256.353] GetCurrentObject (hdc=0x17011c2a, type=0x1) returned 0x1b00017
	[0256.353] GetCurrentObject (hdc=0x17011c2a, type=0x2) returned 0x1900010
	[0256.353] GetCurrentObject (hdc=0x17011c2a, type=0x7) returned 0x140507d2
	[0256.353] GetCurrentObject (hdc=0x17011c2a, type=0x6) returned 0x18a002e
	[0256.354] SaveDC (hdc=0x17011c2a) returned 1
	[0256.354] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc0040710
	[0256.354] GetClipRgn (hdc=0x17011c2a, hrgn=0xffffffffc0040710) returned 0
	[0256.354] SelectClipRgn (hdc=0x17011c2a, hrgn=0x5c0407f9) returned 2
	[0256.354] DeleteObject (ho=0xffffffffc0040710) returned 1
	[0256.354] DeleteObject (ho=0x5c0407f9) returned 1
	[0256.355] OffsetViewportOrgEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x26d4b90 | out: lppt=0x26d4b90) returned 1
	[0256.355] GetNearestColor (hdc=0x17011c2a, color=0xf0f0f0) returned 0xf0f0f0
	[0256.355] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff9c1007c0
	[0256.355] FillRect (hDC=0x17011c2a, lprc=0x20d1d0, hbr=0xffffffff9c1007c0) returned 1
	[0256.355] DeleteObject (ho=0xffffffff9c1007c0) returned 1
	[0256.355] RestoreDC (hdc=0x17011c2a, nSavedDC=-1) returned 1
	[0256.356] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17011c2a) returned 0x0
	[0256.356] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.356] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.356] CoTaskMemFree (pv=0x1b067980) 
	[0256.356] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0256.356] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.356] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.357] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.357] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0256.357] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0256.357] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0256.357] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.357] GetFocus () returned 0x0
	[0256.357] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0256.358] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0256.358] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.358] CoTaskMemFree (pv=0x1b067980) 
	[0256.358] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0256.358] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0256.358] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0256.358] GdipCreateRegion (region=0x20d070) returned 0x0
	[0256.358] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.359] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0256.359] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0256.359] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d0d0) returned 0x0
	[0256.359] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.359] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.359] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0256.360] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d120) returned 0x0
	[0256.360] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d0e0) returned 0x0
	[0256.360] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20d0e0) returned 0x0
	[0256.360] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.360] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d150) returned 0x0
	[0256.360] GetCurrentObject (hdc=0x17011c2a, type=0x1) returned 0x1b00017
	[0256.360] GetCurrentObject (hdc=0x17011c2a, type=0x2) returned 0x1900010
	[0256.361] GetCurrentObject (hdc=0x17011c2a, type=0x7) returned 0x140507d2
	[0256.361] GetCurrentObject (hdc=0x17011c2a, type=0x6) returned 0x18a002e
	[0256.361] SaveDC (hdc=0x17011c2a) returned 1
	[0256.361] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0407f9
	[0256.361] GetClipRgn (hdc=0x17011c2a, hrgn=0x5d0407f9) returned 0
	[0256.361] SelectClipRgn (hdc=0x17011c2a, hrgn=0xffffffffc1040710) returned 2
	[0256.362] DeleteObject (ho=0x5d0407f9) returned 1
	[0256.362] DeleteObject (ho=0xffffffffc1040710) returned 1
	[0256.362] OffsetViewportOrgEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x26d5130 | out: lppt=0x26d5130) returned 1
	[0256.362] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.362] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.362] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.363] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1f301c24
	[0256.363] SelectObject (hdc=0x17011c2a, h=0x1f301c24) returned 0x1b00017
	[0256.363] MoveToEx (in: hdc=0x17011c2a, x=126, y=1, lppt=0x26d5198 | out: lppt=0x26d5198) returned 1
	[0256.363] LineTo (hdc=0x17011c2a, x=1, y=1) returned 1
	[0256.363] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.363] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.364] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.364] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.364] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.364] SelectObject (hdc=0x17011c2a, h=0x1f301c24) returned 0x1f301c24
	[0256.364] MoveToEx (in: hdc=0x17011c2a, x=1, y=1, lppt=0x26d51b0 | out: lppt=0x26d51b0) returned 1
	[0256.364] LineTo (hdc=0x17011c2a, x=1, y=39) returned 1
	[0256.376] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.376] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.376] SelectObject (hdc=0x17011c2a, h=0x1b00017) returned 0x1f301c24
	[0256.376] DeleteObject (ho=0x1f301c24) returned 1
	[0256.376] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.376] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.377] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.377] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x24301c1f
	[0256.377] SelectObject (hdc=0x17011c2a, h=0x24301c1f) returned 0x1b00017
	[0256.377] MoveToEx (in: hdc=0x17011c2a, x=1, y=39, lppt=0x26d5218 | out: lppt=0x26d5218) returned 1
	[0256.377] LineTo (hdc=0x17011c2a, x=126, y=39) returned 1
	[0256.377] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.377] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.378] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.378] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.378] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.378] SelectObject (hdc=0x17011c2a, h=0x24301c1f) returned 0x24301c1f
	[0256.378] MoveToEx (in: hdc=0x17011c2a, x=126, y=39, lppt=0x26d5230 | out: lppt=0x26d5230) returned 1
	[0256.378] LineTo (hdc=0x17011c2a, x=126, y=0) returned 1
	[0256.379] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.379] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.379] SelectObject (hdc=0x17011c2a, h=0x1b00017) returned 0x24301c1f
	[0256.379] DeleteObject (ho=0x24301c1f) returned 1
	[0256.379] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.379] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.380] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.380] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x20301c24
	[0256.380] SelectObject (hdc=0x17011c2a, h=0x20301c24) returned 0x1b00017
	[0256.380] MoveToEx (in: hdc=0x17011c2a, x=125, y=2, lppt=0x26d5298 | out: lppt=0x26d5298) returned 1
	[0256.380] LineTo (hdc=0x17011c2a, x=2, y=2) returned 1
	[0256.385] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.386] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.386] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.386] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.386] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.386] SelectObject (hdc=0x17011c2a, h=0x20301c24) returned 0x20301c24
	[0256.387] MoveToEx (in: hdc=0x17011c2a, x=2, y=2, lppt=0x26d52b0 | out: lppt=0x26d52b0) returned 1
	[0256.387] LineTo (hdc=0x17011c2a, x=2, y=38) returned 1
	[0256.387] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.387] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.387] SelectObject (hdc=0x17011c2a, h=0x1b00017) returned 0x20301c24
	[0256.387] DeleteObject (ho=0x20301c24) returned 1
	[0256.388] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.388] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.388] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.388] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x25301c1f
	[0256.388] SelectObject (hdc=0x17011c2a, h=0x25301c1f) returned 0x1b00017
	[0256.389] MoveToEx (in: hdc=0x17011c2a, x=2, y=38, lppt=0x26d5318 | out: lppt=0x26d5318) returned 1
	[0256.389] LineTo (hdc=0x17011c2a, x=125, y=38) returned 1
	[0256.389] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.389] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.389] GetROP2 (hdc=0x17011c2a) returned 13
	[0256.390] GetBkMode (hdc=0x17011c2a) returned 2
	[0256.390] SetBkMode (hdc=0x17011c2a, mode=1) returned 2
	[0256.390] SelectObject (hdc=0x17011c2a, h=0x25301c1f) returned 0x25301c1f
	[0256.390] MoveToEx (in: hdc=0x17011c2a, x=125, y=38, lppt=0x26d5330 | out: lppt=0x26d5330) returned 1
	[0256.390] LineTo (hdc=0x17011c2a, x=125, y=1) returned 1
	[0256.390] SetBkMode (hdc=0x17011c2a, mode=2) returned 1
	[0256.391] MoveToEx (in: hdc=0x17011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.391] SelectObject (hdc=0x17011c2a, h=0x1b00017) returned 0x25301c1f
	[0256.391] DeleteObject (ho=0x25301c1f) returned 1
	[0256.391] RestoreDC (hdc=0x17011c2a, nSavedDC=-1) returned 1
	[0256.391] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17011c2a) returned 0x0
	[0256.391] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0256.392] BitBlt (hdc=0x4010280, x=0, y=0, cx=128, cy=41, hdcSrc=0x17011c2a, x1=0, y1=0, rop=0xcc0020) returned 1
	[0256.392] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x17011c2a) returned 0x0
	[0256.392] SelectObject (hdc=0x17011c2a, h=0x185000f) returned 0x140507d2
	[0256.392] DeleteDC (hdc=0x17011c2a) returned 1
	[0256.392] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0256.392] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0256.393] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0256.393] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.393] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.393] WaitMessage () returned 1
	[0256.396] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.396] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.396] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.396] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.396] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.396] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.396] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.396] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.397] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.397] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.397] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a1, wParam=0x0, lParam=0x19001f) returned 0x0
	[0256.397] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.397] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.397] WaitMessage () returned 1
	[0256.538] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.538] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.538] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.538] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.538] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.538] GetDlgItem (hDlg=0x50120, nIDDlgItem=0) returned 0x0
	[0256.538] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x210, wParam=0x201, lParam=0x1ac002b) returned 0x0
	[0256.538] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0256.538] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0256.539] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e510) returned 0x0
	[0256.539] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x46, wParam=0x0, lParam=0x20e510) returned 0x0
	[0256.539] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0256.540] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0256.540] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0256.540] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0256.540] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df90 | out: lpwndpl=0x20df90) returned 1
	[0256.540] GetClientRect (in: hWnd=0x50120, lpRect=0x20de40 | out: lpRect=0x20de40) returned 1
	[0256.541] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0256.541] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0256.541] GetSystemMetrics (nIndex=42) returned 0
	[0256.541] CoTaskMemAlloc (cb=0x26) returned 0x1b065c20
	[0256.541] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b065c20, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0256.541] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b065c20) returned 0x10
	[0256.541] CoTaskMemFree (pv=0x1b065c20) 
	[0256.541] GetClientRect (in: hWnd=0x50120, lpRect=0x20dbe0 | out: lpRect=0x20dbe0) returned 1
	[0256.541] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0256.541] GdipCreateFromHDC (hdc=0x48010f97, graphics=0x20d7b0) returned 0x0
	[0256.542] GdipSetPageUnit (graphics=0x1b94e0b0, unit=0x2) returned 0x0
	[0256.542] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0256.542] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0256.542] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d700) returned 0x0
	[0256.542] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.543] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0256.543] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.543] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d6d0) returned 0x0
	[0256.543] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.543] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d7a0) returned 0x0
	[0256.543] GdipCreateRegion (region=0x20d670) returned 0x0
	[0256.543] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.544] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0256.544] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0256.544] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d6d0) returned 0x0
	[0256.544] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.544] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0256.544] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d720) returned 0x0
	[0256.545] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.545] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d750) returned 0x0
	[0256.545] GetCurrentObject (hdc=0x48010f97, type=0x1) returned 0x1b00017
	[0256.545] GetCurrentObject (hdc=0x48010f97, type=0x2) returned 0x1900010
	[0256.545] GetCurrentObject (hdc=0x48010f97, type=0x7) returned 0x1050032
	[0256.545] GetCurrentObject (hdc=0x48010f97, type=0x6) returned 0x18a002e
	[0256.546] SaveDC (hdc=0x48010f97) returned 1
	[0256.546] OffsetViewportOrgEx (in: hdc=0x48010f97, x=0, y=0, lppt=0x26d5898 | out: lppt=0x26d5898) returned 1
	[0256.546] GetNearestColor (hdc=0x48010f97, color=0xf0f0f0) returned 0xf0f0f0
	[0256.546] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff9d1007c0
	[0256.546] FillRect (hDC=0x48010f97, lprc=0x20d720, hbr=0xffffffff9d1007c0) returned 1
	[0256.546] DeleteObject (ho=0xffffffff9d1007c0) returned 1
	[0256.547] RestoreDC (hdc=0x48010f97, nSavedDC=-1) returned 1
	[0256.547] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x48010f97) returned 0x0
	[0256.547] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0256.547] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0256.547] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x1c041c29, lParam=0x0) returned 0x0
	[0256.548] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0x1d041c29, lParam=0x0) returned 0x0
	[0256.548] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x48010f97, lParam=0x0) returned 0x1
	[0256.548] GetStockObject (i=5) returned 0x1900015
	[0256.548] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0x1e041c29, lParam=0x0) returned 0x0
	[0256.548] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df70 | out: lpwndpl=0x20df70) returned 1
	[0256.548] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e510) returned 0x0
	[0256.549] GetClientRect (in: hWnd=0x50120, lpRect=0x20dd10 | out: lpRect=0x20dd10) returned 1
	[0256.549] GetWindowRect (in: hWnd=0x50120, lpRect=0x20dd10 | out: lpRect=0x20dd10) returned 1
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x47, wParam=0x0, lParam=0x20e510) returned 0x0
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b1352d0) returned 0x0
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0256.549] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0256.550] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0256.550] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0256.550] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0256.550] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0256.550] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0256.550] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0256.550] GetFocus () returned 0x0
	[0256.551] SetFocus (hWnd=0x401b4) returned 0x0
	[0256.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0256.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0256.551] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0256.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0256.551] GetStockObject (i=5) returned 0x1900015
	[0256.551] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1e0) returned 0x0
	[0256.551] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1e0) returned 0x0
	[0256.551] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0256.552] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.552] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.552] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.552] GetKeyState (nVirtKey=1) returned -128
	[0256.552] GetKeyState (nVirtKey=2) returned 0
	[0256.552] GetKeyState (nVirtKey=4) returned 0
	[0256.552] GetKeyState (nVirtKey=5) returned 0
	[0256.552] GetKeyState (nVirtKey=6) returned 0
	[0256.552] IsWindowVisible (hWnd=0x401b4) returned 1
	[0256.552] IsWindowEnabled (hWnd=0x401b4) returned 1
	[0256.552] SetFocus (hWnd=0x401b4) returned 0x401b4
	[0256.552] GetFocus () returned 0x401b4
	[0256.552] GetFocus () returned 0x401b4
	[0256.552] GetFocus () returned 0x401b4
	[0256.552] GetKeyState (nVirtKey=1) returned -128
	[0256.552] GetKeyState (nVirtKey=2) returned 0
	[0256.552] GetKeyState (nVirtKey=4) returned 0
	[0256.552] GetKeyState (nVirtKey=5) returned 0
	[0256.552] GetKeyState (nVirtKey=6) returned 0
	[0256.552] GetCapture () returned 0x0
	[0256.552] SetCapture (hWnd=0x401b4) returned 0x0
	[0256.552] GetKeyState (nVirtKey=1) returned -128
	[0256.552] GetKeyState (nVirtKey=2) returned 0
	[0256.552] GetKeyState (nVirtKey=4) returned 0
	[0256.552] GetKeyState (nVirtKey=5) returned 0
	[0256.552] GetKeyState (nVirtKey=6) returned 0
	[0256.552] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0256.552] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0256.552] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.552] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.552] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.552] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0256.552] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.552] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.552] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.552] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0256.552] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.552] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.552] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.552] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.552] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.552] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x26d59e0, cPoints=0x1 | out: lpPoints=0x26d59e0) returned 40370579
	[0256.552] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0256.552] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0256.553] UpdateWindow (hWnd=0x401b4) returned 1
	[0256.553] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x70107fc
	[0256.553] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0256.553] CreateCompatibleDC (hdc=0x70107fc) returned 0x20011c2a
	[0256.553] SelectObject (hdc=0x20011c2a, h=0x140507d2) returned 0x185000f
	[0256.553] GdipCreateFromHDC (hdc=0x20011c2a, graphics=0x20cfa0) returned 0x0
	[0256.553] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0256.554] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0256.554] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0256.554] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0256.554] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0256.554] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.554] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.555] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0256.555] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.555] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d100) returned 0x0
	[0256.555] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20d1d0) returned 0x0
	[0256.555] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9450dbd) returned 0x0
	[0256.555] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.555] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c5b0) returned 0x0
	[0256.556] GetCurrentObject (hdc=0x20011c2a, type=0x1) returned 0x1b00017
	[0256.556] GetCurrentObject (hdc=0x20011c2a, type=0x2) returned 0x1900010
	[0256.556] GetCurrentObject (hdc=0x20011c2a, type=0x7) returned 0x140507d2
	[0256.556] GetCurrentObject (hdc=0x20011c2a, type=0x6) returned 0x18a002e
	[0256.556] SaveDC (hdc=0x20011c2a) returned 1
	[0256.556] GetNearestColor (hdc=0x20011c2a, color=0xf0f0f0) returned 0xf0f0f0
	[0256.557] GetNearestColor (hdc=0x20011c2a, color=0xa0a0a0) returned 0xa0a0a0
	[0256.557] GetNearestColor (hdc=0x20011c2a, color=0x696969) returned 0x696969
	[0256.557] GetNearestColor (hdc=0x20011c2a, color=0xa0a0a0) returned 0xa0a0a0
	[0256.557] GetNearestColor (hdc=0x20011c2a, color=0x0) returned 0x0
	[0256.557] GetNearestColor (hdc=0x20011c2a, color=0xffffff) returned 0xffffff
	[0256.557] GetNearestColor (hdc=0x20011c2a, color=0xe5e5e5) returned 0xe5e5e5
	[0256.558] GetNearestColor (hdc=0x20011c2a, color=0xd8d8d8) returned 0xd8d8d8
	[0256.558] GetNearestColor (hdc=0x20011c2a, color=0x0) returned 0x0
	[0256.558] RestoreDC (hdc=0x20011c2a, nSavedDC=-1) returned 1
	[0256.558] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20011c2a) returned 0x0
	[0256.558] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0256.559] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.559] CoTaskMemFree (pv=0x1b067a60) 
	[0256.559] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0256.559] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.559] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.559] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.559] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0256.559] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0256.560] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0256.560] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0256.560] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0256.560] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.560] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0256.560] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.561] CoTaskMemFree (pv=0x1b067a60) 
	[0256.561] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0256.561] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0256.561] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0256.561] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0256.561] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.561] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.562] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.562] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0256.562] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.562] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0256.562] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0256.562] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.562] CoTaskMemFree (pv=0x1b067a60) 
	[0256.563] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0256.563] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.563] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0256.563] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0256.563] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20c940) returned 0x0
	[0256.563] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.563] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.564] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0256.564] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c990) returned 0x0
	[0256.564] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c950) returned 0x0
	[0256.564] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c950) returned 0x0
	[0256.564] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.564] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c9c0) returned 0x0
	[0256.565] GetCurrentObject (hdc=0x20011c2a, type=0x1) returned 0x1b00017
	[0256.565] GetCurrentObject (hdc=0x20011c2a, type=0x2) returned 0x1900010
	[0256.565] GetCurrentObject (hdc=0x20011c2a, type=0x7) returned 0x140507d2
	[0256.565] GetCurrentObject (hdc=0x20011c2a, type=0x6) returned 0x18a002e
	[0256.565] SaveDC (hdc=0x20011c2a) returned 1
	[0256.565] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc2040710
	[0256.566] GetClipRgn (hdc=0x20011c2a, hrgn=0xffffffffc2040710) returned 0
	[0256.566] SelectClipRgn (hdc=0x20011c2a, hrgn=0x630407f9) returned 2
	[0256.566] DeleteObject (ho=0xffffffffc2040710) returned 1
	[0256.566] DeleteObject (ho=0x630407f9) returned 1
	[0256.566] OffsetViewportOrgEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x26d6660 | out: lppt=0x26d6660) returned 1
	[0256.566] GetNearestColor (hdc=0x20011c2a, color=0xf0f0f0) returned 0xf0f0f0
	[0256.567] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff9e1007c0
	[0256.567] FillRect (hDC=0x20011c2a, lprc=0x20c990, hbr=0xffffffff9e1007c0) returned 1
	[0256.567] DeleteObject (ho=0xffffffff9e1007c0) returned 1
	[0256.572] RestoreDC (hdc=0x20011c2a, nSavedDC=-1) returned 1
	[0256.572] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20011c2a) returned 0x0
	[0256.572] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0256.572] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.573] CoTaskMemFree (pv=0x1b067a60) 
	[0256.573] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0256.573] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.573] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0256.573] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.573] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0256.573] GdipDrawString (graphics=0x1b94e0b0, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0256.574] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0256.574] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.574] GetFocus () returned 0x401b4
	[0256.574] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0256.574] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0256.574] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0256.575] CoTaskMemFree (pv=0x1b067a60) 
	[0256.575] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0256.575] GdipDrawRectangleI (graphics=0x1b94e0b0, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0256.575] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0256.575] GdipCreateRegion (region=0x20c830) returned 0x0
	[0256.575] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.575] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0256.576] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0256.576] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0256.576] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.576] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.576] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.576] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8e0) returned 0x0
	[0256.577] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20c8a0) returned 0x0
	[0256.577] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b94e0b0, hRgn=0x20c8a0) returned 0x0
	[0256.577] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.577] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20c910) returned 0x0
	[0256.577] GetCurrentObject (hdc=0x20011c2a, type=0x1) returned 0x1b00017
	[0256.578] GetCurrentObject (hdc=0x20011c2a, type=0x2) returned 0x1900010
	[0256.578] GetCurrentObject (hdc=0x20011c2a, type=0x7) returned 0x140507d2
	[0256.578] GetCurrentObject (hdc=0x20011c2a, type=0x6) returned 0x18a002e
	[0256.578] SaveDC (hdc=0x20011c2a) returned 1
	[0256.578] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x640407f9
	[0256.578] GetClipRgn (hdc=0x20011c2a, hrgn=0x640407f9) returned 0
	[0256.579] SelectClipRgn (hdc=0x20011c2a, hrgn=0xffffffffc3040710) returned 2
	[0256.579] DeleteObject (ho=0x640407f9) returned 1
	[0256.579] DeleteObject (ho=0xffffffffc3040710) returned 1
	[0256.579] OffsetViewportOrgEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x26d6c00 | out: lppt=0x26d6c00) returned 1
	[0256.579] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.579] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.580] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.580] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x39301c24
	[0256.580] SelectObject (hdc=0x20011c2a, h=0x39301c24) returned 0x1b00017
	[0256.580] MoveToEx (in: hdc=0x20011c2a, x=126, y=1, lppt=0x26d6c68 | out: lppt=0x26d6c68) returned 1
	[0256.580] LineTo (hdc=0x20011c2a, x=1, y=1) returned 1
	[0256.580] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.580] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.581] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.581] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.581] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.581] SelectObject (hdc=0x20011c2a, h=0x39301c24) returned 0x39301c24
	[0256.581] MoveToEx (in: hdc=0x20011c2a, x=1, y=1, lppt=0x26d6c80 | out: lppt=0x26d6c80) returned 1
	[0256.581] LineTo (hdc=0x20011c2a, x=1, y=39) returned 1
	[0256.582] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.582] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.582] SelectObject (hdc=0x20011c2a, h=0x1b00017) returned 0x39301c24
	[0256.582] DeleteObject (ho=0x39301c24) returned 1
	[0256.582] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.582] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.583] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.583] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1c301c2b
	[0256.583] SelectObject (hdc=0x20011c2a, h=0x1c301c2b) returned 0x1b00017
	[0256.583] MoveToEx (in: hdc=0x20011c2a, x=1, y=39, lppt=0x26d6ce8 | out: lppt=0x26d6ce8) returned 1
	[0256.583] LineTo (hdc=0x20011c2a, x=126, y=39) returned 1
	[0256.584] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.584] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.584] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.584] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.584] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.584] SelectObject (hdc=0x20011c2a, h=0x1c301c2b) returned 0x1c301c2b
	[0256.585] MoveToEx (in: hdc=0x20011c2a, x=126, y=39, lppt=0x26d6d00 | out: lppt=0x26d6d00) returned 1
	[0256.585] LineTo (hdc=0x20011c2a, x=126, y=0) returned 1
	[0256.585] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.585] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.585] SelectObject (hdc=0x20011c2a, h=0x1b00017) returned 0x1c301c2b
	[0256.585] DeleteObject (ho=0x1c301c2b) returned 1
	[0256.585] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.586] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.586] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.586] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x3a301c24
	[0256.586] SelectObject (hdc=0x20011c2a, h=0x3a301c24) returned 0x1b00017
	[0256.586] MoveToEx (in: hdc=0x20011c2a, x=125, y=2, lppt=0x26d6d68 | out: lppt=0x26d6d68) returned 1
	[0256.587] LineTo (hdc=0x20011c2a, x=2, y=2) returned 1
	[0256.587] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.587] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.587] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.587] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.587] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.587] SelectObject (hdc=0x20011c2a, h=0x3a301c24) returned 0x3a301c24
	[0256.588] MoveToEx (in: hdc=0x20011c2a, x=2, y=2, lppt=0x26d6d80 | out: lppt=0x26d6d80) returned 1
	[0256.588] LineTo (hdc=0x20011c2a, x=2, y=38) returned 1
	[0256.588] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.588] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.588] SelectObject (hdc=0x20011c2a, h=0x1b00017) returned 0x3a301c24
	[0256.588] DeleteObject (ho=0x3a301c24) returned 1
	[0256.589] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.589] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.589] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.589] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1d301c2b
	[0256.589] SelectObject (hdc=0x20011c2a, h=0x1d301c2b) returned 0x1b00017
	[0256.589] MoveToEx (in: hdc=0x20011c2a, x=2, y=38, lppt=0x26d6de8 | out: lppt=0x26d6de8) returned 1
	[0256.590] LineTo (hdc=0x20011c2a, x=125, y=38) returned 1
	[0256.590] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.590] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.590] GetROP2 (hdc=0x20011c2a) returned 13
	[0256.590] GetBkMode (hdc=0x20011c2a) returned 2
	[0256.590] SetBkMode (hdc=0x20011c2a, mode=1) returned 2
	[0256.591] SelectObject (hdc=0x20011c2a, h=0x1d301c2b) returned 0x1d301c2b
	[0256.591] MoveToEx (in: hdc=0x20011c2a, x=125, y=38, lppt=0x26d6e00 | out: lppt=0x26d6e00) returned 1
	[0256.591] LineTo (hdc=0x20011c2a, x=125, y=1) returned 1
	[0256.591] SetBkMode (hdc=0x20011c2a, mode=2) returned 1
	[0256.591] MoveToEx (in: hdc=0x20011c2a, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0256.591] SelectObject (hdc=0x20011c2a, h=0x1b00017) returned 0x1d301c2b
	[0256.591] DeleteObject (ho=0x1d301c2b) returned 1
	[0256.592] RestoreDC (hdc=0x20011c2a, nSavedDC=-1) returned 1
	[0256.592] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20011c2a) returned 0x0
	[0256.592] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d0a0) returned 0x0
	[0256.592] BitBlt (hdc=0x70107fc, x=0, y=0, cx=128, cy=41, hdcSrc=0x20011c2a, x1=0, y1=0, rop=0xcc0020) returned 1
	[0256.592] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x20011c2a) returned 0x0
	[0256.593] SelectObject (hdc=0x20011c2a, h=0x185000f) returned 0x140507d2
	[0256.593] DeleteDC (hdc=0x20011c2a) returned 1
	[0256.593] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0256.593] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0256.593] EndPaint (hWnd=0x401b4, lpPaint=0x20d1a8) returned 1
	[0256.593] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x26d6e58, cPoints=0x1 | out: lpPoints=0x26d6e58) returned 40370579
	[0256.593] WindowFromPoint (Point=0x281000001b2) returned 0x401b4
	[0256.593] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.593] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0256.593] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0256.593] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0256.594] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0256.594] GetCapture () returned 0x401b4
	[0256.594] ReleaseCapture () returned 1
	[0256.594] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0256.594] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.594] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.594] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.594] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.594] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.594] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.594] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.594] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.594] GetKeyState (nVirtKey=1) returned 0
	[0256.594] GetKeyState (nVirtKey=2) returned 0
	[0256.594] GetKeyState (nVirtKey=4) returned 0
	[0256.594] GetKeyState (nVirtKey=5) returned 0
	[0256.594] GetKeyState (nVirtKey=6) returned 0
	[0256.594] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.594] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0256.594] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.594] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.594] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.595] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0256.595] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0256.595] CreateCompatibleDC (hdc=0x4010280) returned 0x1e011c2b
	[0256.595] GetObjectType (h=0x4010280) returned 0x3
	[0256.595] CreateCompatibleBitmap (hdc=0x4010280, cx=1, cy=1) returned 0x3b051c24
	[0256.595] GetDIBits (in: hdc=0x4010280, hbm=0x3b051c24, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0256.595] GetDIBits (in: hdc=0x4010280, hbm=0x3b051c24, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0256.595] DeleteObject (ho=0x3b051c24) returned 1
	[0256.595] CreateDIBSection (in: hdc=0x4010280, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x1b051c26
	[0256.595] SelectObject (hdc=0x1e011c2b, h=0x1b051c26) returned 0x185000f
	[0256.595] GdipCreateFromHDC (hdc=0x1e011c2b, graphics=0x20d750) returned 0x0
	[0256.596] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0256.596] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0256.596] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0256.596] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f0d0) returned 0x0
	[0256.596] GdipIsMatrixIdentity (matrix=0x1b49f0d0, result=0x20d970) returned 0x0
	[0256.596] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0256.596] GdipGetMatrixElements (matrix=0x1b49f0d0, matrixOut=0x1b07c780) returned 0x0
	[0256.596] GdipDeleteMatrix (matrix=0x1b49f0d0) returned 0x0
	[0256.596] GdipCreateRegion (region=0x20d910) returned 0x0
	[0256.596] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0256.596] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d940) returned 0x0
	[0256.596] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20da10) returned 0x0
	[0256.596] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0256.596] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0256.596] GetSystemMetrics (nIndex=42) returned 0
	[0256.596] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0256.596] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0256.596] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0256.596] CoTaskMemFree (pv=0x1b07f5c0) 
	[0256.596] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0256.597] GdipCreateRegion (region=0x20d400) returned 0x0
	[0256.597] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0256.597] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0256.597] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0256.597] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0256.597] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0256.597] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.597] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0256.597] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0256.597] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.597] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.597] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d4b0) returned 0x0
	[0256.597] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d470) returned 0x0
	[0256.597] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d470) returned 0x0
	[0256.597] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.597] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0256.597] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d4e0) returned 0x0
	[0256.597] GetCurrentObject (hdc=0x1e011c2b, type=0x1) returned 0x1b00017
	[0256.597] GetCurrentObject (hdc=0x1e011c2b, type=0x2) returned 0x1900010
	[0256.597] GetCurrentObject (hdc=0x1e011c2b, type=0x7) returned 0x1b051c26
	[0256.597] GetCurrentObject (hdc=0x1e011c2b, type=0x6) returned 0x18a002e
	[0256.598] SaveDC (hdc=0x1e011c2b) returned 1
	[0256.598] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc4040710
	[0256.598] GetClipRgn (hdc=0x1e011c2b, hrgn=0xffffffffc4040710) returned 0
	[0256.598] SelectClipRgn (hdc=0x1e011c2b, hrgn=0x650407f9) returned 2
	[0256.598] DeleteObject (ho=0xffffffffc4040710) returned 1
	[0256.598] DeleteObject (ho=0x650407f9) returned 1
	[0256.598] OffsetViewportOrgEx (in: hdc=0x1e011c2b, x=0, y=0, lppt=0x26d85b8 | out: lppt=0x26d85b8) returned 1
	[0256.598] GetNearestColor (hdc=0x1e011c2b, color=0x0) returned 0x0
	[0256.598] CreateSolidBrush (color=0x0) returned 0xffffffff9f1007c0
	[0256.598] FillRect (hDC=0x1e011c2b, lprc=0x20d4b0, hbr=0xffffffff9f1007c0) returned 1
	[0256.598] DeleteObject (ho=0xffffffff9f1007c0) returned 1
	[0256.598] RestoreDC (hdc=0x1e011c2b, nSavedDC=-1) returned 1
	[0256.599] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.599] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e011c2b) returned 0x0
	[0256.599] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9420dbd) returned 0x0
	[0256.599] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.599] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.599] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0256.599] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0256.599] GetSystemMetrics (nIndex=42) returned 0
	[0256.599] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0256.599] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0256.599] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0256.600] CoTaskMemFree (pv=0x1b07f5c0) 
	[0256.600] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d530) returned 0x0
	[0256.600] GetCurrentObject (hdc=0x1e011c2b, type=0x1) returned 0x1b00017
	[0256.600] GetCurrentObject (hdc=0x1e011c2b, type=0x2) returned 0x1900010
	[0256.600] GetCurrentObject (hdc=0x1e011c2b, type=0x7) returned 0x1b051c26
	[0256.600] GetCurrentObject (hdc=0x1e011c2b, type=0x6) returned 0x18a002e
	[0256.600] SaveDC (hdc=0x1e011c2b) returned 1
	[0256.600] GetNearestColor (hdc=0x1e011c2b, color=0x80) returned 0x80
	[0256.600] RestoreDC (hdc=0x1e011c2b, nSavedDC=-1) returned 1
	[0256.600] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.600] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e011c2b) returned 0x0
	[0256.600] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0256.600] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0256.601] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0256.601] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0256.601] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0256.601] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0256.601] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0256.601] GdipDrawString (graphics=0x1b94e0b0, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0256.601] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.601] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0256.601] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.601] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0256.601] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d8e0) returned 0x0
	[0256.601] BitBlt (hdc=0x4010280, x=0, y=0, cx=310, cy=83, hdcSrc=0x1e011c2b, x1=0, y1=0, rop=0xcc0020) returned 1
	[0256.601] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.601] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x1e011c2b) returned 0x0
	[0256.601] SelectObject (hdc=0x1e011c2b, h=0x185000f) returned 0x1b051c26
	[0256.601] DeleteDC (hdc=0x1e011c2b) returned 1
	[0256.601] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.601] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0256.601] DeleteObject (ho=0x1b051c26) returned 1
	[0256.602] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0256.602] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0256.602] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.602] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0256.602] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.602] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.602] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.602] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x10107f8
	[0256.602] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0256.602] CreateCompatibleDC (hdc=0x10107f8) returned 0x2c011c1f
	[0256.602] GetObjectType (h=0x10107f8) returned 0x3
	[0256.602] CreateCompatibleBitmap (hdc=0x10107f8, cx=1, cy=1) returned 0x3d051c24
	[0256.602] GetDIBits (in: hdc=0x10107f8, hbm=0x3d051c24, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0256.602] GetDIBits (in: hdc=0x10107f8, hbm=0x3d051c24, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0256.602] DeleteObject (ho=0x3d051c24) returned 1
	[0256.603] CreateDIBSection (in: hdc=0x10107f8, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0x1c051c26
	[0256.603] SelectObject (hdc=0x2c011c1f, h=0x1c051c26) returned 0x185000f
	[0256.603] GdipCreateFromHDC (hdc=0x2c011c1f, graphics=0x20d800) returned 0x0
	[0256.603] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0256.603] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0256.603] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0256.603] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0256.603] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20da20) returned 0x0
	[0256.603] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0256.603] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0256.603] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0256.603] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0256.603] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0256.603] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d9f0) returned 0x0
	[0256.603] GdipSaveGraphics (graphics=0x1b929550, state=0x20dac0) returned 0x0
	[0256.603] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0256.603] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0256.604] GetSystemMetrics (nIndex=42) returned 0
	[0256.604] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0256.604] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0256.604] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0256.604] CoTaskMemFree (pv=0x1b078870) 
	[0256.604] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0256.604] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0256.604] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0256.604] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0256.604] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0256.604] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0256.604] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0256.604] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.604] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0256.604] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0256.604] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0256.604] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0256.604] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d560) returned 0x0
	[0256.604] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d520) returned 0x0
	[0256.604] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d520) returned 0x0
	[0256.605] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.605] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0256.605] GdipGetDC (graphics=0x1b929550, hdc=0x20d590) returned 0x0
	[0256.605] GetCurrentObject (hdc=0x2c011c1f, type=0x1) returned 0x1b00017
	[0256.605] GetCurrentObject (hdc=0x2c011c1f, type=0x2) returned 0x1900010
	[0256.605] GetCurrentObject (hdc=0x2c011c1f, type=0x7) returned 0x1c051c26
	[0256.605] GetCurrentObject (hdc=0x2c011c1f, type=0x6) returned 0x18a002e
	[0256.605] SaveDC (hdc=0x2c011c1f) returned 1
	[0256.605] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x660407f9
	[0256.605] GetClipRgn (hdc=0x2c011c1f, hrgn=0x660407f9) returned 0
	[0256.605] SelectClipRgn (hdc=0x2c011c1f, hrgn=0xffffffffc5040710) returned 2
	[0256.605] DeleteObject (ho=0x660407f9) returned 1
	[0256.605] DeleteObject (ho=0xffffffffc5040710) returned 1
	[0256.605] OffsetViewportOrgEx (in: hdc=0x2c011c1f, x=0, y=0, lppt=0x26da0f8 | out: lppt=0x26da0f8) returned 1
	[0256.605] GetNearestColor (hdc=0x2c011c1f, color=0xf0f0f0) returned 0xf0f0f0
	[0256.605] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa01007c0
	[0256.605] FillRect (hDC=0x2c011c1f, lprc=0x20d560, hbr=0xffffffffa01007c0) returned 1
	[0256.606] DeleteObject (ho=0xffffffffa01007c0) returned 1
	[0256.606] RestoreDC (hdc=0x2c011c1f, nSavedDC=-1) returned 1
	[0256.606] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.606] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c011c1f) returned 0x0
	[0256.606] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9400dbd) returned 0x0
	[0256.606] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.606] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0256.606] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0256.606] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0256.606] GetSystemMetrics (nIndex=42) returned 0
	[0256.606] CoTaskMemAlloc (cb=0x6) returned 0x1b078870
	[0256.606] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078870, nMaxCount=1 | out: lpString="") returned 0
	[0256.606] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078870) returned 0x0
	[0256.606] CoTaskMemFree (pv=0x1b078870) 
	[0256.606] GdipDrawImageRectI (graphics=0x1b929550, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0256.612] GdipGetDC (graphics=0x1b929550, hdc=0x20d990) returned 0x0
	[0256.612] BitBlt (hdc=0x10107f8, x=0, y=0, cx=658, cy=456, hdcSrc=0x2c011c1f, x1=0, y1=0, rop=0xcc0020) returned 1
	[0256.613] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.613] GdipReleaseDC (graphics=0x1b929550, hdc=0x2c011c1f) returned 0x0
	[0256.613] SelectObject (hdc=0x2c011c1f, h=0x185000f) returned 0x1c051c26
	[0256.613] DeleteDC (hdc=0x2c011c1f) returned 1
	[0256.613] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0256.613] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0256.613] DeleteObject (ho=0x1c051c26) returned 1
	[0256.613] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0256.613] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0256.613] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.613] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.613] WaitMessage () returned 1
	[0256.619] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.619] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.619] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.619] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.619] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.619] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.619] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.619] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.619] GetKeyState (nVirtKey=1) returned 0
	[0256.619] GetKeyState (nVirtKey=2) returned 0
	[0256.619] GetKeyState (nVirtKey=4) returned 0
	[0256.619] GetKeyState (nVirtKey=5) returned 0
	[0256.619] GetKeyState (nVirtKey=6) returned 0
	[0256.619] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.619] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.619] WaitMessage () returned 1
	[0256.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.621] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.621] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.621] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.621] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.621] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.621] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.621] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.621] GetKeyState (nVirtKey=1) returned 0
	[0256.621] GetKeyState (nVirtKey=2) returned 0
	[0256.621] GetKeyState (nVirtKey=4) returned 0
	[0256.621] GetKeyState (nVirtKey=5) returned 0
	[0256.621] GetKeyState (nVirtKey=6) returned 0
	[0256.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.621] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.621] WaitMessage () returned 1
	[0256.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.622] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.622] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.622] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.622] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.622] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.622] GetKeyState (nVirtKey=1) returned 0
	[0256.622] GetKeyState (nVirtKey=2) returned 0
	[0256.622] GetKeyState (nVirtKey=4) returned 0
	[0256.622] GetKeyState (nVirtKey=5) returned 0
	[0256.622] GetKeyState (nVirtKey=6) returned 0
	[0256.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.622] WaitMessage () returned 1
	[0256.623] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.623] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.623] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.623] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.623] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.623] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.623] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.623] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.623] GetKeyState (nVirtKey=1) returned 0
	[0256.623] GetKeyState (nVirtKey=2) returned 0
	[0256.623] GetKeyState (nVirtKey=4) returned 0
	[0256.623] GetKeyState (nVirtKey=5) returned 0
	[0256.623] GetKeyState (nVirtKey=6) returned 0
	[0256.623] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.623] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.623] WaitMessage () returned 1
	[0256.625] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.625] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.625] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.625] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.625] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.625] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.625] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.625] GetKeyState (nVirtKey=1) returned 0
	[0256.625] GetKeyState (nVirtKey=2) returned 0
	[0256.625] GetKeyState (nVirtKey=4) returned 0
	[0256.625] GetKeyState (nVirtKey=5) returned 0
	[0256.625] GetKeyState (nVirtKey=6) returned 0
	[0256.625] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.625] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.625] WaitMessage () returned 1
	[0256.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.626] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.626] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.626] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.626] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.626] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.626] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.626] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.626] GetKeyState (nVirtKey=1) returned 0
	[0256.626] GetKeyState (nVirtKey=2) returned 0
	[0256.626] GetKeyState (nVirtKey=4) returned 0
	[0256.626] GetKeyState (nVirtKey=5) returned 0
	[0256.626] GetKeyState (nVirtKey=6) returned 0
	[0256.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.626] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.626] WaitMessage () returned 1
	[0256.627] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.627] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.627] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.627] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.627] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.627] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.628] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.628] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.628] GetKeyState (nVirtKey=1) returned 0
	[0256.628] GetKeyState (nVirtKey=2) returned 0
	[0256.628] GetKeyState (nVirtKey=4) returned 0
	[0256.628] GetKeyState (nVirtKey=5) returned 0
	[0256.628] GetKeyState (nVirtKey=6) returned 0
	[0256.628] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.628] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.628] WaitMessage () returned 1
	[0256.629] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.629] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.629] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.629] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.629] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.629] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.629] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.629] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.629] GetKeyState (nVirtKey=1) returned 0
	[0256.629] GetKeyState (nVirtKey=2) returned 0
	[0256.629] GetKeyState (nVirtKey=4) returned 0
	[0256.629] GetKeyState (nVirtKey=5) returned 0
	[0256.629] GetKeyState (nVirtKey=6) returned 0
	[0256.629] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.629] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.629] WaitMessage () returned 1
	[0256.631] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.631] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.631] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.631] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.631] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.631] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.631] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.631] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.631] GetKeyState (nVirtKey=1) returned 0
	[0256.631] GetKeyState (nVirtKey=2) returned 0
	[0256.632] GetKeyState (nVirtKey=4) returned 0
	[0256.632] GetKeyState (nVirtKey=5) returned 0
	[0256.632] GetKeyState (nVirtKey=6) returned 0
	[0256.632] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.632] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.632] WaitMessage () returned 1
	[0256.632] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.632] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.633] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.633] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.633] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.633] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.633] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.633] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.633] GetKeyState (nVirtKey=1) returned 0
	[0256.633] GetKeyState (nVirtKey=2) returned 0
	[0256.633] GetKeyState (nVirtKey=4) returned 0
	[0256.633] GetKeyState (nVirtKey=5) returned 0
	[0256.633] GetKeyState (nVirtKey=6) returned 0
	[0256.633] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.633] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.633] WaitMessage () returned 1
	[0256.634] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.634] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.634] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.634] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.634] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.635] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.635] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.635] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.635] GetKeyState (nVirtKey=1) returned 0
	[0256.635] GetKeyState (nVirtKey=2) returned 0
	[0256.635] GetKeyState (nVirtKey=4) returned 0
	[0256.635] GetKeyState (nVirtKey=5) returned 0
	[0256.635] GetKeyState (nVirtKey=6) returned 0
	[0256.635] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.635] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.635] WaitMessage () returned 1
	[0256.636] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.636] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.636] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.636] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.636] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.637] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.637] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.637] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.637] GetKeyState (nVirtKey=1) returned 0
	[0256.637] GetKeyState (nVirtKey=2) returned 0
	[0256.637] GetKeyState (nVirtKey=4) returned 0
	[0256.637] GetKeyState (nVirtKey=5) returned 0
	[0256.637] GetKeyState (nVirtKey=6) returned 0
	[0256.637] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.637] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.637] WaitMessage () returned 1
	[0256.638] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.638] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0256.638] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0256.638] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0256.639] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.639] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.639] GetKeyState (nVirtKey=1) returned 0
	[0256.639] GetKeyState (nVirtKey=2) returned 0
	[0256.639] GetKeyState (nVirtKey=4) returned 0
	[0256.639] GetKeyState (nVirtKey=5) returned 0
	[0256.639] GetKeyState (nVirtKey=6) returned 0
	[0256.639] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.639] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.639] WaitMessage () returned 1
	[0256.645] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.645] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0256.645] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.645] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.645] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.645] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.645] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.646] WaitMessage () returned 1
	[0256.848] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.848] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0256.848] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0256.848] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0256.848] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0256.848] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.848] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0256.848] WaitMessage () returned 1
	[0257.209] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.209] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0257.209] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0257.209] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.209] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101b2) returned 0x1
	[0257.209] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0257.209] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.209] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.209] GetKeyState (nVirtKey=1) returned 0
	[0257.209] GetKeyState (nVirtKey=2) returned 0
	[0257.209] GetKeyState (nVirtKey=4) returned 0
	[0257.210] GetKeyState (nVirtKey=5) returned 0
	[0257.210] GetKeyState (nVirtKey=6) returned 0
	[0257.210] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0257.210] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0257.210] WaitMessage () returned 1
	[0257.755] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.755] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0257.755] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0257.756] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.756] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.756] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.756] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0257.756] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0257.756] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.756] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0257.756] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0257.756] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.756] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0257.756] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0257.756] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.756] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.756] _TrackMouseEvent (in: lpEventTrack=0x26470f0 | out: lpEventTrack=0x26470f0) returned 1
	[0257.756] SendMessageW (hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0257.756] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0257.756] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0257.756] GetKeyState (nVirtKey=1) returned 0
	[0257.756] GetKeyState (nVirtKey=2) returned 0
	[0257.756] GetKeyState (nVirtKey=4) returned 0
	[0257.756] GetKeyState (nVirtKey=5) returned 0
	[0257.756] GetKeyState (nVirtKey=6) returned 0
	[0257.756] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.756] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0257.756] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.757] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.757] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.757] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x4010280
	[0257.757] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0257.757] CreateCompatibleDC (hdc=0x4010280) returned 0x1f011c2d
	[0257.757] SelectObject (hdc=0x1f011c2d, h=0x140507d2) returned 0x185000f
	[0257.757] GdipCreateFromHDC (hdc=0x1f011c2d, graphics=0x20d7e0) returned 0x0
	[0257.757] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0257.757] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0257.757] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0257.757] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0257.757] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0257.757] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0257.757] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0257.757] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.757] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.757] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0257.758] GdipCreateRegion (region=0x20d910) returned 0x0
	[0257.758] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0257.758] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0257.758] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0257.758] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff93e0dbd) returned 0x0
	[0257.758] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.758] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0257.758] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0257.758] GetCurrentObject (hdc=0x1f011c2d, type=0x1) returned 0x1b00017
	[0257.758] GetCurrentObject (hdc=0x1f011c2d, type=0x2) returned 0x1900010
	[0257.758] GetCurrentObject (hdc=0x1f011c2d, type=0x7) returned 0x140507d2
	[0257.759] GetCurrentObject (hdc=0x1f011c2d, type=0x6) returned 0x18a002e
	[0257.759] SaveDC (hdc=0x1f011c2d) returned 1
	[0257.759] GetNearestColor (hdc=0x1f011c2d, color=0xf0f0f0) returned 0xf0f0f0
	[0257.759] GetNearestColor (hdc=0x1f011c2d, color=0xa0a0a0) returned 0xa0a0a0
	[0257.759] GetNearestColor (hdc=0x1f011c2d, color=0x696969) returned 0x696969
	[0257.759] GetNearestColor (hdc=0x1f011c2d, color=0xa0a0a0) returned 0xa0a0a0
	[0257.759] GetNearestColor (hdc=0x1f011c2d, color=0x0) returned 0x0
	[0257.759] GetNearestColor (hdc=0x1f011c2d, color=0xffffff) returned 0xffffff
	[0257.760] GetNearestColor (hdc=0x1f011c2d, color=0xe5e5e5) returned 0xe5e5e5
	[0257.760] GetNearestColor (hdc=0x1f011c2d, color=0xd8d8d8) returned 0xd8d8d8
	[0257.760] GetNearestColor (hdc=0x1f011c2d, color=0x0) returned 0x0
	[0257.760] RestoreDC (hdc=0x1f011c2d, nSavedDC=-1) returned 1
	[0257.760] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.760] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011c2d) returned 0x0
	[0257.760] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0257.760] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.761] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.761] CoTaskMemFree (pv=0x1b067a60) 
	[0257.761] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0257.761] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.761] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.761] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0257.761] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0257.761] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0257.761] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0257.761] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0257.761] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0257.761] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.761] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0257.761] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0257.761] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.762] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.762] CoTaskMemFree (pv=0x1b067a60) 
	[0257.762] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0257.762] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0257.762] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0257.762] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0257.762] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0257.762] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.762] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.762] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0257.762] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.762] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0257.762] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.762] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0257.763] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0257.763] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.763] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.763] CoTaskMemFree (pv=0x1b067a60) 
	[0257.763] GdipCreateRegion (region=0x20d120) returned 0x0
	[0257.763] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0257.763] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0257.763] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0257.763] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0257.763] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0257.763] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0257.763] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.763] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0257.763] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0257.764] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.764] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.764] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0257.764] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0257.764] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0257.764] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0257.764] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.764] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0257.764] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0257.764] GetCurrentObject (hdc=0x1f011c2d, type=0x1) returned 0x1b00017
	[0257.764] GetCurrentObject (hdc=0x1f011c2d, type=0x2) returned 0x1900010
	[0257.764] GetCurrentObject (hdc=0x1f011c2d, type=0x7) returned 0x140507d2
	[0257.764] GetCurrentObject (hdc=0x1f011c2d, type=0x6) returned 0x18a002e
	[0257.764] SaveDC (hdc=0x1f011c2d) returned 1
	[0257.764] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc6040710
	[0257.764] GetClipRgn (hdc=0x1f011c2d, hrgn=0xffffffffc6040710) returned 0
	[0257.764] SelectClipRgn (hdc=0x1f011c2d, hrgn=0x670407f9) returned 2
	[0257.765] DeleteObject (ho=0xffffffffc6040710) returned 1
	[0257.765] DeleteObject (ho=0x670407f9) returned 1
	[0257.765] OffsetViewportOrgEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x26db498 | out: lppt=0x26db498) returned 1
	[0257.765] GetNearestColor (hdc=0x1f011c2d, color=0xf0f0f0) returned 0xf0f0f0
	[0257.765] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa11007c0
	[0257.765] FillRect (hDC=0x1f011c2d, lprc=0x20d1d0, hbr=0xffffffffa11007c0) returned 1
	[0257.765] DeleteObject (ho=0xffffffffa11007c0) returned 1
	[0257.765] RestoreDC (hdc=0x1f011c2d, nSavedDC=-1) returned 1
	[0257.765] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.765] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011c2d) returned 0x0
	[0257.765] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0257.765] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.766] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.766] CoTaskMemFree (pv=0x1b067a60) 
	[0257.766] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0257.766] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.766] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.766] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0257.766] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0257.766] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0257.766] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.766] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0257.766] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.766] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0257.766] GetFocus () returned 0x401b4
	[0257.766] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0257.767] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.767] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.767] CoTaskMemFree (pv=0x1b067a60) 
	[0257.767] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0257.767] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0257.767] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.767] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0257.767] GdipCreateRegion (region=0x20d070) returned 0x0
	[0257.767] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0257.767] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0257.767] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0257.767] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0257.767] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0257.767] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0257.767] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.767] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0257.767] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0257.767] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.767] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.768] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0257.768] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0257.768] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0257.768] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0257.768] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.768] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0257.768] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0257.768] GetCurrentObject (hdc=0x1f011c2d, type=0x1) returned 0x1b00017
	[0257.768] GetCurrentObject (hdc=0x1f011c2d, type=0x2) returned 0x1900010
	[0257.768] GetCurrentObject (hdc=0x1f011c2d, type=0x7) returned 0x140507d2
	[0257.768] GetCurrentObject (hdc=0x1f011c2d, type=0x6) returned 0x18a002e
	[0257.768] SaveDC (hdc=0x1f011c2d) returned 1
	[0257.768] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x680407f9
	[0257.768] GetClipRgn (hdc=0x1f011c2d, hrgn=0x680407f9) returned 0
	[0257.768] SelectClipRgn (hdc=0x1f011c2d, hrgn=0xffffffffc7040710) returned 2
	[0257.768] DeleteObject (ho=0x680407f9) returned 1
	[0257.768] DeleteObject (ho=0xffffffffc7040710) returned 1
	[0257.768] OffsetViewportOrgEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x26dba38 | out: lppt=0x26dba38) returned 1
	[0257.769] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.769] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.769] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.769] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x5d301c24
	[0257.769] SelectObject (hdc=0x1f011c2d, h=0x5d301c24) returned 0x1b00017
	[0257.769] MoveToEx (in: hdc=0x1f011c2d, x=164, y=1, lppt=0x26dbaa0 | out: lppt=0x26dbaa0) returned 1
	[0257.769] LineTo (hdc=0x1f011c2d, x=1, y=1) returned 1
	[0257.769] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.769] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.769] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.769] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.769] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.769] SelectObject (hdc=0x1f011c2d, h=0x5d301c24) returned 0x5d301c24
	[0257.769] MoveToEx (in: hdc=0x1f011c2d, x=1, y=1, lppt=0x26dbab8 | out: lppt=0x26dbab8) returned 1
	[0257.769] LineTo (hdc=0x1f011c2d, x=1, y=41) returned 1
	[0257.769] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.769] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.769] SelectObject (hdc=0x1f011c2d, h=0x1b00017) returned 0x5d301c24
	[0257.769] DeleteObject (ho=0x5d301c24) returned 1
	[0257.769] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.769] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.769] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.769] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x31301c26
	[0257.769] SelectObject (hdc=0x1f011c2d, h=0x31301c26) returned 0x1b00017
	[0257.769] MoveToEx (in: hdc=0x1f011c2d, x=1, y=41, lppt=0x26dbb20 | out: lppt=0x26dbb20) returned 1
	[0257.770] LineTo (hdc=0x1f011c2d, x=164, y=41) returned 1
	[0257.770] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.770] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.770] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.770] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.770] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.770] SelectObject (hdc=0x1f011c2d, h=0x31301c26) returned 0x31301c26
	[0257.770] MoveToEx (in: hdc=0x1f011c2d, x=164, y=41, lppt=0x26dbb38 | out: lppt=0x26dbb38) returned 1
	[0257.770] LineTo (hdc=0x1f011c2d, x=164, y=0) returned 1
	[0257.770] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.770] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.770] SelectObject (hdc=0x1f011c2d, h=0x1b00017) returned 0x31301c26
	[0257.770] DeleteObject (ho=0x31301c26) returned 1
	[0257.770] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.770] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.770] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.770] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x5e301c24
	[0257.770] SelectObject (hdc=0x1f011c2d, h=0x5e301c24) returned 0x1b00017
	[0257.770] MoveToEx (in: hdc=0x1f011c2d, x=163, y=2, lppt=0x26dbba0 | out: lppt=0x26dbba0) returned 1
	[0257.770] LineTo (hdc=0x1f011c2d, x=2, y=2) returned 1
	[0257.770] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.770] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.770] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.770] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.770] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.770] SelectObject (hdc=0x1f011c2d, h=0x5e301c24) returned 0x5e301c24
	[0257.771] MoveToEx (in: hdc=0x1f011c2d, x=2, y=2, lppt=0x26dbbb8 | out: lppt=0x26dbbb8) returned 1
	[0257.771] LineTo (hdc=0x1f011c2d, x=2, y=40) returned 1
	[0257.771] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.771] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.771] SelectObject (hdc=0x1f011c2d, h=0x1b00017) returned 0x5e301c24
	[0257.771] DeleteObject (ho=0x5e301c24) returned 1
	[0257.771] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.771] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.771] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.771] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x32301c26
	[0257.771] SelectObject (hdc=0x1f011c2d, h=0x32301c26) returned 0x1b00017
	[0257.771] MoveToEx (in: hdc=0x1f011c2d, x=2, y=40, lppt=0x26dbc20 | out: lppt=0x26dbc20) returned 1
	[0257.771] LineTo (hdc=0x1f011c2d, x=163, y=40) returned 1
	[0257.771] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.771] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.771] GetROP2 (hdc=0x1f011c2d) returned 13
	[0257.771] GetBkMode (hdc=0x1f011c2d) returned 2
	[0257.771] SetBkMode (hdc=0x1f011c2d, mode=1) returned 2
	[0257.771] SelectObject (hdc=0x1f011c2d, h=0x32301c26) returned 0x32301c26
	[0257.771] MoveToEx (in: hdc=0x1f011c2d, x=163, y=40, lppt=0x26dbc38 | out: lppt=0x26dbc38) returned 1
	[0257.771] LineTo (hdc=0x1f011c2d, x=163, y=1) returned 1
	[0257.771] SetBkMode (hdc=0x1f011c2d, mode=2) returned 1
	[0257.771] MoveToEx (in: hdc=0x1f011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.771] SelectObject (hdc=0x1f011c2d, h=0x1b00017) returned 0x32301c26
	[0257.771] DeleteObject (ho=0x32301c26) returned 1
	[0257.771] RestoreDC (hdc=0x1f011c2d, nSavedDC=-1) returned 1
	[0257.772] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.772] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011c2d) returned 0x0
	[0257.772] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0257.772] BitBlt (hdc=0x4010280, x=0, y=0, cx=166, cy=43, hdcSrc=0x1f011c2d, x1=0, y1=0, rop=0xcc0020) returned 1
	[0257.772] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.772] GdipReleaseDC (graphics=0x1b929550, hdc=0x1f011c2d) returned 0x0
	[0257.772] SelectObject (hdc=0x1f011c2d, h=0x185000f) returned 0x140507d2
	[0257.772] DeleteDC (hdc=0x1f011c2d) returned 1
	[0257.772] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.772] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0257.772] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0257.772] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0257.772] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.772] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0257.772] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.772] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.772] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.772] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x48010f97
	[0257.772] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0257.772] CreateCompatibleDC (hdc=0x48010f97) returned 0x21011c2d
	[0257.772] SelectObject (hdc=0x21011c2d, h=0x140507d2) returned 0x185000f
	[0257.772] GdipCreateFromHDC (hdc=0x21011c2d, graphics=0x20d7e0) returned 0x0
	[0257.773] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0257.773] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0257.773] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0257.773] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0257.773] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0257.773] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b07c780
	[0257.773] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0257.773] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.773] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.773] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0257.773] GdipCreateRegion (region=0x20d910) returned 0x0
	[0257.773] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0257.773] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0257.773] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0257.773] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff93b0dbd) returned 0x0
	[0257.773] FindAtomW (lpString="GDI+Atom_1140_1") returned 0xc000
	[0257.773] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0257.774] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0257.774] GetCurrentObject (hdc=0x21011c2d, type=0x1) returned 0x1b00017
	[0257.774] GetCurrentObject (hdc=0x21011c2d, type=0x2) returned 0x1900010
	[0257.774] GetCurrentObject (hdc=0x21011c2d, type=0x7) returned 0x140507d2
	[0257.774] GetCurrentObject (hdc=0x21011c2d, type=0x6) returned 0x18a002e
	[0257.774] SaveDC (hdc=0x21011c2d) returned 1
	[0257.775] GetNearestColor (hdc=0x21011c2d, color=0xf0f0f0) returned 0xf0f0f0
	[0257.775] GetNearestColor (hdc=0x21011c2d, color=0xa0a0a0) returned 0xa0a0a0
	[0257.775] GetNearestColor (hdc=0x21011c2d, color=0x696969) returned 0x696969
	[0257.775] GetNearestColor (hdc=0x21011c2d, color=0xa0a0a0) returned 0xa0a0a0
	[0257.775] GetNearestColor (hdc=0x21011c2d, color=0x0) returned 0x0
	[0257.776] GetNearestColor (hdc=0x21011c2d, color=0xffffff) returned 0xffffff
	[0257.776] GetNearestColor (hdc=0x21011c2d, color=0xe5e5e5) returned 0xe5e5e5
	[0257.776] GetNearestColor (hdc=0x21011c2d, color=0xd8d8d8) returned 0xd8d8d8
	[0257.776] GetNearestColor (hdc=0x21011c2d, color=0x0) returned 0x0
	[0257.777] RestoreDC (hdc=0x21011c2d, nSavedDC=-1) returned 1
	[0257.777] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011c2d) returned 0x0
	[0257.777] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.777] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.777] CoTaskMemFree (pv=0x1b067a60) 
	[0257.777] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0257.777] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.778] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.778] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0257.778] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0257.778] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0257.778] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0257.778] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0257.778] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0257.779] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0257.779] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.779] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.779] CoTaskMemFree (pv=0x1b067a60) 
	[0257.779] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0257.779] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0257.779] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0257.780] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0257.780] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0257.780] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.780] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.780] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0257.780] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0257.781] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0257.781] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.781] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.781] CoTaskMemFree (pv=0x1b067a60) 
	[0257.781] GdipCreateRegion (region=0x20d120) returned 0x0
	[0257.781] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0257.781] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0257.782] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0257.782] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0257.782] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0257.782] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.782] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0257.782] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.783] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0257.783] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0257.783] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0257.783] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0257.783] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0257.783] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0257.784] GetCurrentObject (hdc=0x21011c2d, type=0x1) returned 0x1b00017
	[0257.784] GetCurrentObject (hdc=0x21011c2d, type=0x2) returned 0x1900010
	[0257.785] GetCurrentObject (hdc=0x21011c2d, type=0x7) returned 0x140507d2
	[0257.785] GetCurrentObject (hdc=0x21011c2d, type=0x6) returned 0x18a002e
	[0257.785] SaveDC (hdc=0x21011c2d) returned 1
	[0257.786] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc8040710
	[0257.786] GetClipRgn (hdc=0x21011c2d, hrgn=0xffffffffc8040710) returned 0
	[0257.786] SelectClipRgn (hdc=0x21011c2d, hrgn=0x690407f9) returned 2
	[0257.786] DeleteObject (ho=0xffffffffc8040710) returned 1
	[0257.786] DeleteObject (ho=0x690407f9) returned 1
	[0257.786] OffsetViewportOrgEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x26dc898 | out: lppt=0x26dc898) returned 1
	[0257.787] GetNearestColor (hdc=0x21011c2d, color=0xf0f0f0) returned 0xf0f0f0
	[0257.787] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa21007c0
	[0257.787] FillRect (hDC=0x21011c2d, lprc=0x20d1d0, hbr=0xffffffffa21007c0) returned 1
	[0257.787] DeleteObject (ho=0xffffffffa21007c0) returned 1
	[0257.787] RestoreDC (hdc=0x21011c2d, nSavedDC=-1) returned 1
	[0257.788] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011c2d) returned 0x0
	[0257.788] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.788] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.788] CoTaskMemFree (pv=0x1b067a60) 
	[0257.788] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0257.788] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.788] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0257.789] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0257.789] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0257.789] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0257.789] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0257.789] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0257.789] GetFocus () returned 0x401b4
	[0257.790] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0257.790] CoTaskMemAlloc (cb=0x13) returned 0x1b067a60
	[0257.790] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0257.790] CoTaskMemFree (pv=0x1b067a60) 
	[0257.790] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0257.790] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0257.790] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0257.791] GdipCreateRegion (region=0x20d070) returned 0x0
	[0257.791] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0257.791] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0257.791] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0257.791] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0257.791] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0257.792] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.792] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0257.792] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.792] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0257.792] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0257.792] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0257.793] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0257.793] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0257.793] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0257.793] GetCurrentObject (hdc=0x21011c2d, type=0x1) returned 0x1b00017
	[0257.793] GetCurrentObject (hdc=0x21011c2d, type=0x2) returned 0x1900010
	[0257.793] GetCurrentObject (hdc=0x21011c2d, type=0x7) returned 0x140507d2
	[0257.794] GetCurrentObject (hdc=0x21011c2d, type=0x6) returned 0x18a002e
	[0257.794] SaveDC (hdc=0x21011c2d) returned 1
	[0257.794] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6a0407f9
	[0257.794] GetClipRgn (hdc=0x21011c2d, hrgn=0x6a0407f9) returned 0
	[0257.794] SelectClipRgn (hdc=0x21011c2d, hrgn=0xffffffffc9040710) returned 2
	[0257.794] DeleteObject (ho=0x6a0407f9) returned 1
	[0257.795] DeleteObject (ho=0xffffffffc9040710) returned 1
	[0257.795] OffsetViewportOrgEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x26dce38 | out: lppt=0x26dce38) returned 1
	[0257.795] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.795] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.795] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.795] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x33301c26
	[0257.796] SelectObject (hdc=0x21011c2d, h=0x33301c26) returned 0x1b00017
	[0257.796] MoveToEx (in: hdc=0x21011c2d, x=126, y=1, lppt=0x26dcea0 | out: lppt=0x26dcea0) returned 1
	[0257.796] LineTo (hdc=0x21011c2d, x=1, y=1) returned 1
	[0257.796] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.796] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.796] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.797] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.797] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.797] SelectObject (hdc=0x21011c2d, h=0x33301c26) returned 0x33301c26
	[0257.797] MoveToEx (in: hdc=0x21011c2d, x=1, y=1, lppt=0x26dceb8 | out: lppt=0x26dceb8) returned 1
	[0257.797] LineTo (hdc=0x21011c2d, x=1, y=39) returned 1
	[0257.797] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.798] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.798] SelectObject (hdc=0x21011c2d, h=0x1b00017) returned 0x33301c26
	[0257.798] DeleteObject (ho=0x33301c26) returned 1
	[0257.798] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.798] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.798] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.799] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x5f301c24
	[0257.799] SelectObject (hdc=0x21011c2d, h=0x5f301c24) returned 0x1b00017
	[0257.799] MoveToEx (in: hdc=0x21011c2d, x=1, y=39, lppt=0x26dcf20 | out: lppt=0x26dcf20) returned 1
	[0257.799] LineTo (hdc=0x21011c2d, x=126, y=39) returned 1
	[0257.799] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.799] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.799] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.800] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.800] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.801] SelectObject (hdc=0x21011c2d, h=0x5f301c24) returned 0x5f301c24
	[0257.801] MoveToEx (in: hdc=0x21011c2d, x=126, y=39, lppt=0x26dcf38 | out: lppt=0x26dcf38) returned 1
	[0257.801] LineTo (hdc=0x21011c2d, x=126, y=0) returned 1
	[0257.801] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.801] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.801] SelectObject (hdc=0x21011c2d, h=0x1b00017) returned 0x5f301c24
	[0257.802] DeleteObject (ho=0x5f301c24) returned 1
	[0257.802] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.802] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.802] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.802] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x34301c26
	[0257.802] SelectObject (hdc=0x21011c2d, h=0x34301c26) returned 0x1b00017
	[0257.803] MoveToEx (in: hdc=0x21011c2d, x=125, y=2, lppt=0x26dcfa0 | out: lppt=0x26dcfa0) returned 1
	[0257.803] LineTo (hdc=0x21011c2d, x=2, y=2) returned 1
	[0257.803] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.803] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.803] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.804] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.804] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.804] SelectObject (hdc=0x21011c2d, h=0x34301c26) returned 0x34301c26
	[0257.804] MoveToEx (in: hdc=0x21011c2d, x=2, y=2, lppt=0x26dcfb8 | out: lppt=0x26dcfb8) returned 1
	[0257.804] LineTo (hdc=0x21011c2d, x=2, y=38) returned 1
	[0257.805] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.805] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.805] SelectObject (hdc=0x21011c2d, h=0x1b00017) returned 0x34301c26
	[0257.805] DeleteObject (ho=0x34301c26) returned 1
	[0257.805] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.805] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.806] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.806] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x60301c24
	[0257.806] SelectObject (hdc=0x21011c2d, h=0x60301c24) returned 0x1b00017
	[0257.806] MoveToEx (in: hdc=0x21011c2d, x=2, y=38, lppt=0x26dd020 | out: lppt=0x26dd020) returned 1
	[0257.806] LineTo (hdc=0x21011c2d, x=125, y=38) returned 1
	[0257.806] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.807] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.807] GetROP2 (hdc=0x21011c2d) returned 13
	[0257.807] GetBkMode (hdc=0x21011c2d) returned 2
	[0257.807] SetBkMode (hdc=0x21011c2d, mode=1) returned 2
	[0257.807] SelectObject (hdc=0x21011c2d, h=0x60301c24) returned 0x60301c24
	[0257.807] MoveToEx (in: hdc=0x21011c2d, x=125, y=38, lppt=0x26dd038 | out: lppt=0x26dd038) returned 1
	[0257.807] LineTo (hdc=0x21011c2d, x=125, y=1) returned 1
	[0257.808] SetBkMode (hdc=0x21011c2d, mode=2) returned 1
	[0257.808] MoveToEx (in: hdc=0x21011c2d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0257.808] SelectObject (hdc=0x21011c2d, h=0x1b00017) returned 0x60301c24
	[0257.808] DeleteObject (ho=0x60301c24) returned 1
	[0257.808] RestoreDC (hdc=0x21011c2d, nSavedDC=-1) returned 1
	[0257.809] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011c2d) returned 0x0
	[0257.809] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0257.809] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0x21011c2d, x1=0, y1=0, rop=0xcc0020) returned 1
	[0257.809] GdipReleaseDC (graphics=0x1b929550, hdc=0x21011c2d) returned 0x0
	[0257.809] SelectObject (hdc=0x21011c2d, h=0x185000f) returned 0x140507d2
	[0257.809] DeleteDC (hdc=0x21011c2d) returned 1
	[0257.810] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0257.810] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0257.810] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0257.810] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0257.810] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0257.810] WaitMessage () returned 1
	[0257.862] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.862] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0257.862] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.862] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.862] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.862] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.862] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0257.862] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.862] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.862] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.862] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a1, wParam=0x0, lParam=0x1d0048) returned 0x0
	[0257.862] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0257.862] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0257.862] WaitMessage () returned 1
	[0257.989] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0257.989] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0257.989] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0257.989] GetDlgItem (hDlg=0x201a6, nIDDlgItem=0) returned 0x0
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x210, wParam=0x201, lParam=0xe90124) returned 0x0
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x21, wParam=0x201a6, lParam=0x2010001) returned 0x1
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x0, lParam=0x201a6) returned 0x1
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0257.989] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0257.990] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0257.990] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x1, lParam=0x50120) returned 0x1
	[0257.990] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0257.990] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0257.991] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0257.991] GetFocus () returned 0x401b4
	[0257.991] SetFocus (hWnd=0x201d8) returned 0x401b4
	[0257.991] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x8, wParam=0x201d8, lParam=0x0) returned 0x0
	[0257.991] GetStockObject (i=5) returned 0x1900015
	[0257.992] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0257.992] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d210) returned 0x0
	[0257.992] GetCapture () returned 0x0
	[0257.992] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0257.992] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0257.992] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0257.992] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0257.992] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0257.993] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0257.993] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x7, wParam=0x401b4, lParam=0x0) returned 0x0
	[0257.993] GetStockObject (i=5) returned 0x1900015
	[0257.993] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0257.993] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20d1e0) returned 0x0
	[0257.993] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0257.993] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0257.993] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.993] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0257.993] GetKeyState (nVirtKey=1) returned -127
	[0257.993] GetKeyState (nVirtKey=2) returned 0
	[0257.993] GetKeyState (nVirtKey=4) returned 0
	[0257.993] GetKeyState (nVirtKey=5) returned 0
	[0257.993] GetKeyState (nVirtKey=6) returned 0
	[0257.993] IsWindowVisible (hWnd=0x201d8) returned 1
	[0257.993] IsWindowEnabled (hWnd=0x201d8) returned 1
	[0257.993] SetFocus (hWnd=0x201d8) returned 0x201d8
	[0257.993] GetFocus () returned 0x201d8
	[0257.993] GetFocus () returned 0x201d8
	[0257.994] GetFocus () returned 0x201d8
	[0257.994] GetKeyState (nVirtKey=1) returned -127
	[0257.994] GetKeyState (nVirtKey=2) returned 0
	[0257.994] GetKeyState (nVirtKey=4) returned 0
	[0257.994] GetKeyState (nVirtKey=5) returned 0
	[0257.994] GetKeyState (nVirtKey=6) returned 0
	[0257.994] GetCapture () returned 0x0
	[0257.994] SetCapture (hWnd=0x201d8) returned 0x0
	[0257.994] GetKeyState (nVirtKey=1) returned -127
	[0257.994] GetKeyState (nVirtKey=2) returned 0
	[0257.994] GetKeyState (nVirtKey=4) returned 0
	[0257.994] GetKeyState (nVirtKey=5) returned 0
	[0257.994] GetKeyState (nVirtKey=6) returned 0
	[0257.994] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0257.994] InvalidateRect (hWnd=0x201d8, lpRect=0x20dd30, bErase=0) returned 1
	[0257.994] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.994] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.994] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.994] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0257.994] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.994] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.994] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.994] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0257.994] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.994] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0257.994] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0257.994] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0257.994] DispatchMessageW (lpMsg=0x20e6b0) returned 0x1
	[0257.994] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26dd1e8, cPoints=0x1 | out: lpPoints=0x26dd1e8) returned 30606029
	[0257.994] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0257.994] InvalidateRect (hWnd=0x201d8, lpRect=0x20dc80, bErase=0) returned 1
	[0257.994] UpdateWindow (hWnd=0x201d8) returned 1
	[0257.995] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x10107f8
	[0257.995] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0257.995] CreateCompatibleDC (hdc=0x10107f8) returned 0x190107cd
	[0257.995] SelectObject (hdc=0x190107cd, h=0x140507d2) returned 0x185000f
	[0257.995] GdipCreateFromHDC (hdc=0x190107cd, graphics=0x20cfa0) returned 0x0
	[0257.996] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0257.996] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0257.996] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0257.996] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0257.996] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d130) returned 0x0
	[0257.997] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0257.997] LocalFree (hMem=0x1b07c780) returned 0x0
	[0257.997] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0257.997] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0257.997] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0257.998] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0257.998] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0257.998] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9380dbd) returned 0x0
	[0257.998] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0257.999] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0257.999] GetCurrentObject (hdc=0x190107cd, type=0x1) returned 0x1b00017
	[0257.999] GetCurrentObject (hdc=0x190107cd, type=0x2) returned 0x1900010
	[0258.000] GetCurrentObject (hdc=0x190107cd, type=0x7) returned 0x140507d2
	[0258.000] GetCurrentObject (hdc=0x190107cd, type=0x6) returned 0x18a002e
	[0258.000] SaveDC (hdc=0x190107cd) returned 1
	[0258.000] GetNearestColor (hdc=0x190107cd, color=0xf0f0f0) returned 0xf0f0f0
	[0258.000] GetNearestColor (hdc=0x190107cd, color=0xa0a0a0) returned 0xa0a0a0
	[0258.001] GetNearestColor (hdc=0x190107cd, color=0x696969) returned 0x696969
	[0258.001] GetNearestColor (hdc=0x190107cd, color=0xa0a0a0) returned 0xa0a0a0
	[0258.001] GetNearestColor (hdc=0x190107cd, color=0x0) returned 0x0
	[0258.001] GetNearestColor (hdc=0x190107cd, color=0xffffff) returned 0xffffff
	[0258.002] GetNearestColor (hdc=0x190107cd, color=0xe5e5e5) returned 0xe5e5e5
	[0258.002] GetNearestColor (hdc=0x190107cd, color=0xd8d8d8) returned 0xd8d8d8
	[0258.002] GetNearestColor (hdc=0x190107cd, color=0x0) returned 0x0
	[0258.088] RestoreDC (hdc=0x190107cd, nSavedDC=-1) returned 1
	[0258.088] GdipReleaseDC (graphics=0x1b929550, hdc=0x190107cd) returned 0x0
	[0258.088] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0258.088] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.088] CoTaskMemFree (pv=0x1b067980) 
	[0258.088] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0258.089] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.089] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.089] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.089] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0258.089] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0258.089] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0258.090] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0258.090] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0258.090] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.090] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0258.090] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.090] CoTaskMemFree (pv=0x1b067980) 
	[0258.090] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0258.090] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0258.091] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0258.091] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0258.091] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.091] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.091] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.091] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0258.092] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.092] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0258.092] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0258.092] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.092] CoTaskMemFree (pv=0x1b067980) 
	[0258.092] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0258.092] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.093] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0258.093] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0258.093] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c940) returned 0x0
	[0258.093] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0258.093] LocalFree (hMem=0x1b07c780) returned 0x0
	[0258.093] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c780) returned 0x0
	[0258.094] LocalFree (hMem=0x1b07c780) returned 0x0
	[0258.094] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0258.094] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0258.094] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0258.094] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0258.094] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.094] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0258.095] GetCurrentObject (hdc=0x190107cd, type=0x1) returned 0x1b00017
	[0258.095] GetCurrentObject (hdc=0x190107cd, type=0x2) returned 0x1900010
	[0258.095] GetCurrentObject (hdc=0x190107cd, type=0x7) returned 0x140507d2
	[0258.095] GetCurrentObject (hdc=0x190107cd, type=0x6) returned 0x18a002e
	[0258.095] SaveDC (hdc=0x190107cd) returned 1
	[0258.095] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffca040710
	[0258.096] GetClipRgn (hdc=0x190107cd, hrgn=0xffffffffca040710) returned 0
	[0258.096] SelectClipRgn (hdc=0x190107cd, hrgn=0x6f0407f9) returned 2
	[0258.096] DeleteObject (ho=0xffffffffca040710) returned 1
	[0258.096] DeleteObject (ho=0x6f0407f9) returned 1
	[0258.096] OffsetViewportOrgEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x26dde68 | out: lppt=0x26dde68) returned 1
	[0258.097] GetNearestColor (hdc=0x190107cd, color=0xf0f0f0) returned 0xf0f0f0
	[0258.097] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa31007c0
	[0258.097] FillRect (hDC=0x190107cd, lprc=0x20c990, hbr=0xffffffffa31007c0) returned 1
	[0258.097] DeleteObject (ho=0xffffffffa31007c0) returned 1
	[0258.097] RestoreDC (hdc=0x190107cd, nSavedDC=-1) returned 1
	[0258.098] GdipReleaseDC (graphics=0x1b929550, hdc=0x190107cd) returned 0x0
	[0258.098] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0258.098] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.098] CoTaskMemFree (pv=0x1b067980) 
	[0258.098] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0258.098] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.098] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.098] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.099] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0258.099] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0258.099] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0258.099] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.099] GetFocus () returned 0x201d8
	[0258.100] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0258.100] CoTaskMemAlloc (cb=0x13) returned 0x1b067980
	[0258.100] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.100] CoTaskMemFree (pv=0x1b067980) 
	[0258.100] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0258.100] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0258.100] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0258.101] GdipCreateRegion (region=0x20c830) returned 0x0
	[0258.101] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.101] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0258.101] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0258.101] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c890) returned 0x0
	[0258.101] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0258.102] LocalFree (hMem=0x1b07c780) returned 0x0
	[0258.102] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c780) returned 0x0
	[0258.102] LocalFree (hMem=0x1b07c780) returned 0x0
	[0258.102] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0258.102] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0258.102] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0258.103] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0258.103] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.103] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0258.103] GetCurrentObject (hdc=0x190107cd, type=0x1) returned 0x1b00017
	[0258.103] GetCurrentObject (hdc=0x190107cd, type=0x2) returned 0x1900010
	[0258.104] GetCurrentObject (hdc=0x190107cd, type=0x7) returned 0x140507d2
	[0258.104] GetCurrentObject (hdc=0x190107cd, type=0x6) returned 0x18a002e
	[0258.104] SaveDC (hdc=0x190107cd) returned 1
	[0258.104] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x700407f9
	[0258.104] GetClipRgn (hdc=0x190107cd, hrgn=0x700407f9) returned 0
	[0258.104] SelectClipRgn (hdc=0x190107cd, hrgn=0xffffffffcb040710) returned 2
	[0258.105] DeleteObject (ho=0x700407f9) returned 1
	[0258.105] DeleteObject (ho=0xffffffffcb040710) returned 1
	[0258.105] OffsetViewportOrgEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x26de408 | out: lppt=0x26de408) returned 1
	[0258.105] GetROP2 (hdc=0x190107cd) returned 13
	[0258.105] GetBkMode (hdc=0x190107cd) returned 2
	[0258.106] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.106] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1d3007c3
	[0258.106] SelectObject (hdc=0x190107cd, h=0x1d3007c3) returned 0x1b00017
	[0258.106] MoveToEx (in: hdc=0x190107cd, x=164, y=1, lppt=0x26de470 | out: lppt=0x26de470) returned 1
	[0258.106] LineTo (hdc=0x190107cd, x=1, y=1) returned 1
	[0258.106] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.107] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.107] GetROP2 (hdc=0x190107cd) returned 13
	[0258.107] GetBkMode (hdc=0x190107cd) returned 2
	[0258.107] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.107] SelectObject (hdc=0x190107cd, h=0x1d3007c3) returned 0x1d3007c3
	[0258.108] MoveToEx (in: hdc=0x190107cd, x=1, y=1, lppt=0x26de488 | out: lppt=0x26de488) returned 1
	[0258.108] LineTo (hdc=0x190107cd, x=1, y=41) returned 1
	[0258.108] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.108] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.108] SelectObject (hdc=0x190107cd, h=0x1b00017) returned 0x1d3007c3
	[0258.108] DeleteObject (ho=0x1d3007c3) returned 1
	[0258.109] GetROP2 (hdc=0x190107cd) returned 13
	[0258.109] GetBkMode (hdc=0x190107cd) returned 2
	[0258.109] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.109] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xa3007c5
	[0258.109] SelectObject (hdc=0x190107cd, h=0xa3007c5) returned 0x1b00017
	[0258.109] MoveToEx (in: hdc=0x190107cd, x=1, y=41, lppt=0x26de4f0 | out: lppt=0x26de4f0) returned 1
	[0258.110] LineTo (hdc=0x190107cd, x=164, y=41) returned 1
	[0258.110] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.110] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.110] GetROP2 (hdc=0x190107cd) returned 13
	[0258.110] GetBkMode (hdc=0x190107cd) returned 2
	[0258.110] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.110] SelectObject (hdc=0x190107cd, h=0xa3007c5) returned 0xa3007c5
	[0258.111] MoveToEx (in: hdc=0x190107cd, x=164, y=41, lppt=0x26de508 | out: lppt=0x26de508) returned 1
	[0258.111] LineTo (hdc=0x190107cd, x=164, y=0) returned 1
	[0258.111] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.111] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.111] SelectObject (hdc=0x190107cd, h=0x1b00017) returned 0xa3007c5
	[0258.111] DeleteObject (ho=0xa3007c5) returned 1
	[0258.112] GetROP2 (hdc=0x190107cd) returned 13
	[0258.112] GetBkMode (hdc=0x190107cd) returned 2
	[0258.112] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.112] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x1e3007c3
	[0258.112] SelectObject (hdc=0x190107cd, h=0x1e3007c3) returned 0x1b00017
	[0258.113] MoveToEx (in: hdc=0x190107cd, x=163, y=2, lppt=0x26de570 | out: lppt=0x26de570) returned 1
	[0258.113] LineTo (hdc=0x190107cd, x=2, y=2) returned 1
	[0258.113] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.113] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.113] GetROP2 (hdc=0x190107cd) returned 13
	[0258.113] GetBkMode (hdc=0x190107cd) returned 2
	[0258.113] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.114] SelectObject (hdc=0x190107cd, h=0x1e3007c3) returned 0x1e3007c3
	[0258.114] MoveToEx (in: hdc=0x190107cd, x=2, y=2, lppt=0x26de588 | out: lppt=0x26de588) returned 1
	[0258.114] LineTo (hdc=0x190107cd, x=2, y=40) returned 1
	[0258.114] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.114] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.115] SelectObject (hdc=0x190107cd, h=0x1b00017) returned 0x1e3007c3
	[0258.115] DeleteObject (ho=0x1e3007c3) returned 1
	[0258.115] GetROP2 (hdc=0x190107cd) returned 13
	[0258.115] GetBkMode (hdc=0x190107cd) returned 2
	[0258.115] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.115] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xb3007c5
	[0258.116] SelectObject (hdc=0x190107cd, h=0xb3007c5) returned 0x1b00017
	[0258.116] MoveToEx (in: hdc=0x190107cd, x=2, y=40, lppt=0x26de5f0 | out: lppt=0x26de5f0) returned 1
	[0258.116] LineTo (hdc=0x190107cd, x=163, y=40) returned 1
	[0258.116] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.116] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.116] GetROP2 (hdc=0x190107cd) returned 13
	[0258.117] GetBkMode (hdc=0x190107cd) returned 2
	[0258.117] SetBkMode (hdc=0x190107cd, mode=1) returned 2
	[0258.117] SelectObject (hdc=0x190107cd, h=0xb3007c5) returned 0xb3007c5
	[0258.117] MoveToEx (in: hdc=0x190107cd, x=163, y=40, lppt=0x26de608 | out: lppt=0x26de608) returned 1
	[0258.117] LineTo (hdc=0x190107cd, x=163, y=1) returned 1
	[0258.118] SetBkMode (hdc=0x190107cd, mode=2) returned 1
	[0258.118] MoveToEx (in: hdc=0x190107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.118] SelectObject (hdc=0x190107cd, h=0x1b00017) returned 0xb3007c5
	[0258.118] DeleteObject (ho=0xb3007c5) returned 1
	[0258.118] RestoreDC (hdc=0x190107cd, nSavedDC=-1) returned 1
	[0258.118] GdipReleaseDC (graphics=0x1b929550, hdc=0x190107cd) returned 0x0
	[0258.119] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0258.119] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x190107cd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0258.119] GdipReleaseDC (graphics=0x1b929550, hdc=0x190107cd) returned 0x0
	[0258.119] SelectObject (hdc=0x190107cd, h=0x185000f) returned 0x140507d2
	[0258.119] DeleteDC (hdc=0x190107cd) returned 1
	[0258.119] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0258.120] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0258.120] EndPaint (hWnd=0x201d8, lpPaint=0x20d1a8) returned 1
	[0258.120] MapWindowPoints (in: hWndFrom=0x201d8, hWndTo=0x0, lpPoints=0x26de660, cPoints=0x1 | out: lpPoints=0x26de660) returned 30606029
	[0258.120] WindowFromPoint (Point=0x1f000000315) returned 0x201d8
	[0258.120] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.120] NotifyWinEvent (event=0x800a, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0258.120] NotifyWinEvent (event=0x800c, hwnd=0x201d8, idObject=-4, idChild=0) 
	[0258.121] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x1afe53a0
	[0258.121] RtlMoveMemory (in: Destination=0x1afe53a0, Source=0x26de750, Length=0x70 | out: Destination=0x1afe53a0) 
	[0258.121] ShellExecuteExW (in: pExecInfo=0x26de960*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26de960*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0258.151] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
	[0258.152] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0258.152] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
	[0258.152] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0258.152] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0258.152] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0258.153] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0258.153] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0258.153] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0258.153] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0258.153] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x674) returned 0x0
	[0258.153] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
	[0258.153] GetStockObject (i=5) returned 0x1900015
	[0258.154] SendMessageW (hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0258.154] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x202b, wParam=0x201d8, lParam=0x20caa0) returned 0x0
	[0258.154] GetCapture () returned 0x0
	[0258.154] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0258.154] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
	[0258.154] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
	[0258.154] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x70107fc
	[0258.154] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0258.155] CreateCompatibleDC (hdc=0x70107fc) returned 0x210107cd
	[0258.155] SelectObject (hdc=0x210107cd, h=0x140507d2) returned 0x185000f
	[0258.155] GdipCreateFromHDC (hdc=0x210107cd, graphics=0x20c9d0) returned 0x0
	[0258.155] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0258.155] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0258.156] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0258.156] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0258.156] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20cb60) returned 0x0
	[0258.156] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0258.156] LocalFree (hMem=0x1b07c740) returned 0x0
	[0258.157] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0258.157] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0258.157] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.157] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0258.157] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0258.158] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9350dbd) returned 0x0
	[0258.158] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.158] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0258.159] GetCurrentObject (hdc=0x210107cd, type=0x1) returned 0x1b00017
	[0258.159] GetCurrentObject (hdc=0x210107cd, type=0x2) returned 0x1900010
	[0258.159] GetCurrentObject (hdc=0x210107cd, type=0x7) returned 0x140507d2
	[0258.159] GetCurrentObject (hdc=0x210107cd, type=0x6) returned 0x18a002e
	[0258.159] SaveDC (hdc=0x210107cd) returned 1
	[0258.159] GetNearestColor (hdc=0x210107cd, color=0xf0f0f0) returned 0xf0f0f0
	[0258.160] GetNearestColor (hdc=0x210107cd, color=0xa0a0a0) returned 0xa0a0a0
	[0258.160] GetNearestColor (hdc=0x210107cd, color=0x696969) returned 0x696969
	[0258.160] GetNearestColor (hdc=0x210107cd, color=0xa0a0a0) returned 0xa0a0a0
	[0258.160] GetNearestColor (hdc=0x210107cd, color=0x0) returned 0x0
	[0258.160] GetNearestColor (hdc=0x210107cd, color=0xffffff) returned 0xffffff
	[0258.161] GetNearestColor (hdc=0x210107cd, color=0xe5e5e5) returned 0xe5e5e5
	[0258.161] GetNearestColor (hdc=0x210107cd, color=0xd8d8d8) returned 0xd8d8d8
	[0258.161] GetNearestColor (hdc=0x210107cd, color=0x0) returned 0x0
	[0258.161] RestoreDC (hdc=0x210107cd, nSavedDC=-1) returned 1
	[0258.161] GdipReleaseDC (graphics=0x1b929550, hdc=0x210107cd) returned 0x0
	[0258.162] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.162] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.162] CoTaskMemFree (pv=0x1b077150) 
	[0258.162] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0258.162] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.162] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.163] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.163] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0258.163] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0258.163] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0258.163] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0258.163] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0258.164] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.164] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.164] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.164] CoTaskMemFree (pv=0x1b077150) 
	[0258.164] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0258.164] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0258.164] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0258.165] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0258.165] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.165] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.165] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.165] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0258.165] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.166] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0258.166] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.166] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.166] CoTaskMemFree (pv=0x1b077150) 
	[0258.166] GdipCreateRegion (region=0x20c310) returned 0x0
	[0258.166] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.166] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0258.166] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0258.167] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c370) returned 0x0
	[0258.167] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0258.167] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0258.167] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0258.167] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0258.167] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0258.168] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0258.168] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.168] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0258.168] GetCurrentObject (hdc=0x210107cd, type=0x1) returned 0x1b00017
	[0258.168] GetCurrentObject (hdc=0x210107cd, type=0x2) returned 0x1900010
	[0258.168] GetCurrentObject (hdc=0x210107cd, type=0x7) returned 0x140507d2
	[0258.169] GetCurrentObject (hdc=0x210107cd, type=0x6) returned 0x18a002e
	[0258.169] SaveDC (hdc=0x210107cd) returned 1
	[0258.169] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffcc040710
	[0258.169] GetClipRgn (hdc=0x210107cd, hrgn=0xffffffffcc040710) returned 0
	[0258.169] SelectClipRgn (hdc=0x210107cd, hrgn=0x730407f9) returned 2
	[0258.169] DeleteObject (ho=0xffffffffcc040710) returned 1
	[0258.170] DeleteObject (ho=0x730407f9) returned 1
	[0258.170] OffsetViewportOrgEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x26df640 | out: lppt=0x26df640) returned 1
	[0258.170] GetNearestColor (hdc=0x210107cd, color=0xf0f0f0) returned 0xf0f0f0
	[0258.170] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa41007c0
	[0258.170] FillRect (hDC=0x210107cd, lprc=0x20c3c0, hbr=0xffffffffa41007c0) returned 1
	[0258.170] DeleteObject (ho=0xffffffffa41007c0) returned 1
	[0258.171] RestoreDC (hdc=0x210107cd, nSavedDC=-1) returned 1
	[0258.171] GdipReleaseDC (graphics=0x1b929550, hdc=0x210107cd) returned 0x0
	[0258.171] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.171] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.171] CoTaskMemFree (pv=0x1b077150) 
	[0258.171] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0258.171] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.171] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.172] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.172] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0258.172] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0258.172] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0258.172] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.173] GetFocus () returned 0x0
	[0258.173] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0258.173] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.173] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.173] CoTaskMemFree (pv=0x1b077150) 
	[0258.173] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0258.173] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0258.173] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0258.173] GdipCreateRegion (region=0x20c260) returned 0x0
	[0258.174] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.174] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0258.174] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0258.174] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c2c0) returned 0x0
	[0258.174] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0258.175] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0258.175] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0258.175] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0258.175] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0258.175] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0258.175] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.175] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0258.176] GetCurrentObject (hdc=0x210107cd, type=0x1) returned 0x1b00017
	[0258.176] GetCurrentObject (hdc=0x210107cd, type=0x2) returned 0x1900010
	[0258.176] GetCurrentObject (hdc=0x210107cd, type=0x7) returned 0x140507d2
	[0258.176] GetCurrentObject (hdc=0x210107cd, type=0x6) returned 0x18a002e
	[0258.176] SaveDC (hdc=0x210107cd) returned 1
	[0258.176] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x740407f9
	[0258.177] GetClipRgn (hdc=0x210107cd, hrgn=0x740407f9) returned 0
	[0258.177] SelectClipRgn (hdc=0x210107cd, hrgn=0xffffffffcd040710) returned 2
	[0258.177] DeleteObject (ho=0x740407f9) returned 1
	[0258.177] DeleteObject (ho=0xffffffffcd040710) returned 1
	[0258.177] OffsetViewportOrgEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x26dfbe0 | out: lppt=0x26dfbe0) returned 1
	[0258.177] GetROP2 (hdc=0x210107cd) returned 13
	[0258.178] GetBkMode (hdc=0x210107cd) returned 2
	[0258.178] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.178] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xc3007c5
	[0258.178] SelectObject (hdc=0x210107cd, h=0xc3007c5) returned 0x1b00017
	[0258.178] MoveToEx (in: hdc=0x210107cd, x=164, y=1, lppt=0x26dfc48 | out: lppt=0x26dfc48) returned 1
	[0258.178] LineTo (hdc=0x210107cd, x=1, y=1) returned 1
	[0258.179] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.179] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.179] GetROP2 (hdc=0x210107cd) returned 13
	[0258.179] GetBkMode (hdc=0x210107cd) returned 2
	[0258.179] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.179] SelectObject (hdc=0x210107cd, h=0xc3007c5) returned 0xc3007c5
	[0258.179] MoveToEx (in: hdc=0x210107cd, x=1, y=1, lppt=0x26dfc60 | out: lppt=0x26dfc60) returned 1
	[0258.180] LineTo (hdc=0x210107cd, x=1, y=41) returned 1
	[0258.180] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.180] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.180] SelectObject (hdc=0x210107cd, h=0x1b00017) returned 0xc3007c5
	[0258.180] DeleteObject (ho=0xc3007c5) returned 1
	[0258.181] GetROP2 (hdc=0x210107cd) returned 13
	[0258.181] GetBkMode (hdc=0x210107cd) returned 2
	[0258.181] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.181] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1f3007c3
	[0258.181] SelectObject (hdc=0x210107cd, h=0x1f3007c3) returned 0x1b00017
	[0258.181] MoveToEx (in: hdc=0x210107cd, x=1, y=41, lppt=0x26dfcc8 | out: lppt=0x26dfcc8) returned 1
	[0258.181] LineTo (hdc=0x210107cd, x=164, y=41) returned 1
	[0258.182] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.182] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.182] GetROP2 (hdc=0x210107cd) returned 13
	[0258.182] GetBkMode (hdc=0x210107cd) returned 2
	[0258.182] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.182] SelectObject (hdc=0x210107cd, h=0x1f3007c3) returned 0x1f3007c3
	[0258.183] MoveToEx (in: hdc=0x210107cd, x=164, y=41, lppt=0x26dfce0 | out: lppt=0x26dfce0) returned 1
	[0258.183] LineTo (hdc=0x210107cd, x=164, y=0) returned 1
	[0258.183] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.183] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.183] SelectObject (hdc=0x210107cd, h=0x1b00017) returned 0x1f3007c3
	[0258.183] DeleteObject (ho=0x1f3007c3) returned 1
	[0258.183] GetROP2 (hdc=0x210107cd) returned 13
	[0258.184] GetBkMode (hdc=0x210107cd) returned 2
	[0258.184] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.184] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xd3007c5
	[0258.184] SelectObject (hdc=0x210107cd, h=0xd3007c5) returned 0x1b00017
	[0258.184] MoveToEx (in: hdc=0x210107cd, x=163, y=2, lppt=0x26dfd48 | out: lppt=0x26dfd48) returned 1
	[0258.184] LineTo (hdc=0x210107cd, x=2, y=2) returned 1
	[0258.185] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.185] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.185] GetROP2 (hdc=0x210107cd) returned 13
	[0258.185] GetBkMode (hdc=0x210107cd) returned 2
	[0258.185] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.185] SelectObject (hdc=0x210107cd, h=0xd3007c5) returned 0xd3007c5
	[0258.186] MoveToEx (in: hdc=0x210107cd, x=2, y=2, lppt=0x26dfd60 | out: lppt=0x26dfd60) returned 1
	[0258.186] LineTo (hdc=0x210107cd, x=2, y=40) returned 1
	[0258.186] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.186] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.186] SelectObject (hdc=0x210107cd, h=0x1b00017) returned 0xd3007c5
	[0258.186] DeleteObject (ho=0xd3007c5) returned 1
	[0258.186] GetROP2 (hdc=0x210107cd) returned 13
	[0258.187] GetBkMode (hdc=0x210107cd) returned 2
	[0258.187] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.187] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x203007c3
	[0258.187] SelectObject (hdc=0x210107cd, h=0x203007c3) returned 0x1b00017
	[0258.187] MoveToEx (in: hdc=0x210107cd, x=2, y=40, lppt=0x26dfdc8 | out: lppt=0x26dfdc8) returned 1
	[0258.187] LineTo (hdc=0x210107cd, x=163, y=40) returned 1
	[0258.188] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.188] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.188] GetROP2 (hdc=0x210107cd) returned 13
	[0258.188] GetBkMode (hdc=0x210107cd) returned 2
	[0258.188] SetBkMode (hdc=0x210107cd, mode=1) returned 2
	[0258.188] SelectObject (hdc=0x210107cd, h=0x203007c3) returned 0x203007c3
	[0258.189] MoveToEx (in: hdc=0x210107cd, x=163, y=40, lppt=0x26dfde0 | out: lppt=0x26dfde0) returned 1
	[0258.189] LineTo (hdc=0x210107cd, x=163, y=1) returned 1
	[0258.189] SetBkMode (hdc=0x210107cd, mode=2) returned 1
	[0258.189] MoveToEx (in: hdc=0x210107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.189] SelectObject (hdc=0x210107cd, h=0x1b00017) returned 0x203007c3
	[0258.189] DeleteObject (ho=0x203007c3) returned 1
	[0258.190] RestoreDC (hdc=0x210107cd, nSavedDC=-1) returned 1
	[0258.191] GdipReleaseDC (graphics=0x1b929550, hdc=0x210107cd) returned 0x0
	[0258.191] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0258.191] BitBlt (hdc=0x70107fc, x=0, y=0, cx=166, cy=43, hdcSrc=0x210107cd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0258.191] GdipReleaseDC (graphics=0x1b929550, hdc=0x210107cd) returned 0x0
	[0258.191] SelectObject (hdc=0x210107cd, h=0x185000f) returned 0x140507d2
	[0258.192] DeleteDC (hdc=0x210107cd) returned 1
	[0258.192] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0258.192] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0258.192] EndPaint (hWnd=0x201d8, lpPaint=0x20cbd8) returned 1
	[0258.192] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.192] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.192] GetKeyState (nVirtKey=1) returned 1
	[0258.192] GetKeyState (nVirtKey=2) returned 0
	[0258.192] GetKeyState (nVirtKey=4) returned 0
	[0258.192] GetKeyState (nVirtKey=5) returned 0
	[0258.192] GetKeyState (nVirtKey=6) returned 0
	[0258.192] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20cbc8 | out: lpPaint=0x20cbc8) returned 0x48010f97
	[0258.193] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0258.193] CreateCompatibleDC (hdc=0x48010f97) returned 0x230107cd
	[0258.193] SelectObject (hdc=0x230107cd, h=0x140507d2) returned 0x185000f
	[0258.193] GdipCreateFromHDC (hdc=0x230107cd, graphics=0x20c9d0) returned 0x0
	[0258.193] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0258.193] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0258.194] GdipCreateMatrix (matrix=0x20cb00) returned 0x0
	[0258.194] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0258.194] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20cb60) returned 0x0
	[0258.194] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0258.194] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0258.194] GdipCreateRegion (region=0x20cb00) returned 0x0
	[0258.195] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.195] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20cb30) returned 0x0
	[0258.195] GdipSaveGraphics (graphics=0x1b929550, state=0x20cc00) returned 0x0
	[0258.195] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9320dbd) returned 0x0
	[0258.195] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.195] GdipGetDC (graphics=0x1b929550, hdc=0x20bfe0) returned 0x0
	[0258.196] GetCurrentObject (hdc=0x230107cd, type=0x1) returned 0x1b00017
	[0258.196] GetCurrentObject (hdc=0x230107cd, type=0x2) returned 0x1900010
	[0258.196] GetCurrentObject (hdc=0x230107cd, type=0x7) returned 0x140507d2
	[0258.196] GetCurrentObject (hdc=0x230107cd, type=0x6) returned 0x18a002e
	[0258.196] SaveDC (hdc=0x230107cd) returned 1
	[0258.196] GetNearestColor (hdc=0x230107cd, color=0xf0f0f0) returned 0xf0f0f0
	[0258.197] GetNearestColor (hdc=0x230107cd, color=0xa0a0a0) returned 0xa0a0a0
	[0258.197] GetNearestColor (hdc=0x230107cd, color=0x696969) returned 0x696969
	[0258.197] GetNearestColor (hdc=0x230107cd, color=0xa0a0a0) returned 0xa0a0a0
	[0258.197] GetNearestColor (hdc=0x230107cd, color=0x0) returned 0x0
	[0258.197] GetNearestColor (hdc=0x230107cd, color=0xffffff) returned 0xffffff
	[0258.197] GetNearestColor (hdc=0x230107cd, color=0xe5e5e5) returned 0xe5e5e5
	[0258.198] GetNearestColor (hdc=0x230107cd, color=0xd8d8d8) returned 0xd8d8d8
	[0258.198] GetNearestColor (hdc=0x230107cd, color=0x0) returned 0x0
	[0258.198] RestoreDC (hdc=0x230107cd, nSavedDC=-1) returned 1
	[0258.198] GdipReleaseDC (graphics=0x1b929550, hdc=0x230107cd) returned 0x0
	[0258.198] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.198] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.198] CoTaskMemFree (pv=0x1b077150) 
	[0258.199] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c6d0) returned 0x0
	[0258.199] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.199] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.199] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.199] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20c700) returned 0x0
	[0258.199] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20c700) returned 0x0
	[0258.199] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20c700) returned 0x0
	[0258.200] GdipGetFontSize (font=0x1b912930, size=0x20c700) returned 0x0
	[0258.200] GdipGetFontStyle (font=0x1b912930, style=0x20c700) returned 0x0
	[0258.200] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.200] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.200] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.200] CoTaskMemFree (pv=0x1b077150) 
	[0258.200] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c390) returned 0x0
	[0258.201] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c3a0) returned 0x0
	[0258.201] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0258.201] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0258.201] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.201] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.201] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.201] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c2b8, stringFormat=0x1b912930, boundingBox=0x20c2a8, codepointsFitted=0x20c2a4, linesFilled=0x20c2a0) returned 0x0
	[0258.202] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.202] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0258.202] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.202] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.202] CoTaskMemFree (pv=0x1b077150) 
	[0258.202] GdipCreateRegion (region=0x20c310) returned 0x0
	[0258.202] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.203] GdipCreateMatrix (matrix=0x20c310) returned 0x0
	[0258.203] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0258.203] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c370) returned 0x0
	[0258.203] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0258.203] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c740) returned 0x0
	[0258.203] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0258.203] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c3c0) returned 0x0
	[0258.204] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c380) returned 0x0
	[0258.204] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c380) returned 0x0
	[0258.204] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.204] GdipGetDC (graphics=0x1b929550, hdc=0x20c3f0) returned 0x0
	[0258.204] GetCurrentObject (hdc=0x230107cd, type=0x1) returned 0x1b00017
	[0258.204] GetCurrentObject (hdc=0x230107cd, type=0x2) returned 0x1900010
	[0258.205] GetCurrentObject (hdc=0x230107cd, type=0x7) returned 0x140507d2
	[0258.205] GetCurrentObject (hdc=0x230107cd, type=0x6) returned 0x18a002e
	[0258.205] SaveDC (hdc=0x230107cd) returned 1
	[0258.205] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffce040710
	[0258.269] GetClipRgn (hdc=0x230107cd, hrgn=0xffffffffce040710) returned 0
	[0258.270] SelectClipRgn (hdc=0x230107cd, hrgn=0x750407f9) returned 2
	[0258.270] DeleteObject (ho=0xffffffffce040710) returned 1
	[0258.270] DeleteObject (ho=0x750407f9) returned 1
	[0258.270] OffsetViewportOrgEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x26e0a68 | out: lppt=0x26e0a68) returned 1
	[0258.270] GetNearestColor (hdc=0x230107cd, color=0xf0f0f0) returned 0xf0f0f0
	[0258.270] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa51007c0
	[0258.271] FillRect (hDC=0x230107cd, lprc=0x20c3c0, hbr=0xffffffffa51007c0) returned 1
	[0258.271] DeleteObject (ho=0xffffffffa51007c0) returned 1
	[0258.271] RestoreDC (hdc=0x230107cd, nSavedDC=-1) returned 1
	[0258.271] GdipReleaseDC (graphics=0x1b929550, hdc=0x230107cd) returned 0x0
	[0258.271] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.272] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.272] CoTaskMemFree (pv=0x1b077150) 
	[0258.272] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c430) returned 0x0
	[0258.272] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.272] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0258.272] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0258.272] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20c4a0) returned 0x0
	[0258.272] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c3b0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0258.273] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0258.273] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0258.273] GetFocus () returned 0x0
	[0258.273] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0258.273] CoTaskMemAlloc (cb=0x13) returned 0x1b077150
	[0258.273] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0258.273] CoTaskMemFree (pv=0x1b077150) 
	[0258.273] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20c790) returned 0x0
	[0258.274] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0258.274] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0258.274] GdipCreateRegion (region=0x20c260) returned 0x0
	[0258.274] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0258.274] GdipCreateMatrix (matrix=0x20c260) returned 0x0
	[0258.275] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0258.275] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c2c0) returned 0x0
	[0258.275] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0258.275] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c740) returned 0x0
	[0258.275] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0258.275] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c310) returned 0x0
	[0258.276] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c2d0) returned 0x0
	[0258.276] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c2d0) returned 0x0
	[0258.276] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0258.276] GdipGetDC (graphics=0x1b929550, hdc=0x20c340) returned 0x0
	[0258.276] GetCurrentObject (hdc=0x230107cd, type=0x1) returned 0x1b00017
	[0258.276] GetCurrentObject (hdc=0x230107cd, type=0x2) returned 0x1900010
	[0258.277] GetCurrentObject (hdc=0x230107cd, type=0x7) returned 0x140507d2
	[0258.277] GetCurrentObject (hdc=0x230107cd, type=0x6) returned 0x18a002e
	[0258.277] SaveDC (hdc=0x230107cd) returned 1
	[0258.277] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x760407f9
	[0258.277] GetClipRgn (hdc=0x230107cd, hrgn=0x760407f9) returned 0
	[0258.277] SelectClipRgn (hdc=0x230107cd, hrgn=0xffffffffcf040710) returned 2
	[0258.278] DeleteObject (ho=0x760407f9) returned 1
	[0258.278] DeleteObject (ho=0xffffffffcf040710) returned 1
	[0258.278] OffsetViewportOrgEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x26e1008 | out: lppt=0x26e1008) returned 1
	[0258.278] GetROP2 (hdc=0x230107cd) returned 13
	[0258.278] GetBkMode (hdc=0x230107cd) returned 2
	[0258.278] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.279] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x5f3019d0
	[0258.279] SelectObject (hdc=0x230107cd, h=0x5f3019d0) returned 0x1b00017
	[0258.279] MoveToEx (in: hdc=0x230107cd, x=126, y=1, lppt=0x26e1070 | out: lppt=0x26e1070) returned 1
	[0258.279] LineTo (hdc=0x230107cd, x=1, y=1) returned 1
	[0258.279] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.279] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.280] GetROP2 (hdc=0x230107cd) returned 13
	[0258.280] GetBkMode (hdc=0x230107cd) returned 2
	[0258.280] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.280] SelectObject (hdc=0x230107cd, h=0x5f3019d0) returned 0x5f3019d0
	[0258.280] MoveToEx (in: hdc=0x230107cd, x=1, y=1, lppt=0x26e1088 | out: lppt=0x26e1088) returned 1
	[0258.280] LineTo (hdc=0x230107cd, x=1, y=39) returned 1
	[0258.280] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.281] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.281] SelectObject (hdc=0x230107cd, h=0x1b00017) returned 0x5f3019d0
	[0258.281] DeleteObject (ho=0x5f3019d0) returned 1
	[0258.281] GetROP2 (hdc=0x230107cd) returned 13
	[0258.281] GetBkMode (hdc=0x230107cd) returned 2
	[0258.281] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.282] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xffffffffab301c29
	[0258.282] SelectObject (hdc=0x230107cd, h=0xffffffffab301c29) returned 0x1b00017
	[0258.282] MoveToEx (in: hdc=0x230107cd, x=1, y=39, lppt=0x26e10f0 | out: lppt=0x26e10f0) returned 1
	[0258.282] LineTo (hdc=0x230107cd, x=126, y=39) returned 1
	[0258.282] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.282] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.283] GetROP2 (hdc=0x230107cd) returned 13
	[0258.283] GetBkMode (hdc=0x230107cd) returned 2
	[0258.283] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.283] SelectObject (hdc=0x230107cd, h=0xffffffffab301c29) returned 0xffffffffab301c29
	[0258.283] MoveToEx (in: hdc=0x230107cd, x=126, y=39, lppt=0x26e1108 | out: lppt=0x26e1108) returned 1
	[0258.283] LineTo (hdc=0x230107cd, x=126, y=0) returned 1
	[0258.284] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.284] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.284] SelectObject (hdc=0x230107cd, h=0x1b00017) returned 0xffffffffab301c29
	[0258.284] DeleteObject (ho=0xffffffffab301c29) returned 1
	[0258.284] GetROP2 (hdc=0x230107cd) returned 13
	[0258.284] GetBkMode (hdc=0x230107cd) returned 2
	[0258.285] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.285] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x603019d0
	[0258.285] SelectObject (hdc=0x230107cd, h=0x603019d0) returned 0x1b00017
	[0258.285] MoveToEx (in: hdc=0x230107cd, x=125, y=2, lppt=0x26e1170 | out: lppt=0x26e1170) returned 1
	[0258.285] LineTo (hdc=0x230107cd, x=2, y=2) returned 1
	[0258.285] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.286] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.286] GetROP2 (hdc=0x230107cd) returned 13
	[0258.286] GetBkMode (hdc=0x230107cd) returned 2
	[0258.286] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.286] SelectObject (hdc=0x230107cd, h=0x603019d0) returned 0x603019d0
	[0258.286] MoveToEx (in: hdc=0x230107cd, x=2, y=2, lppt=0x26e1188 | out: lppt=0x26e1188) returned 1
	[0258.286] LineTo (hdc=0x230107cd, x=2, y=38) returned 1
	[0258.287] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.287] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.287] SelectObject (hdc=0x230107cd, h=0x1b00017) returned 0x603019d0
	[0258.287] DeleteObject (ho=0x603019d0) returned 1
	[0258.287] GetROP2 (hdc=0x230107cd) returned 13
	[0258.287] GetBkMode (hdc=0x230107cd) returned 2
	[0258.288] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.288] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xffffffffac301c29
	[0258.288] SelectObject (hdc=0x230107cd, h=0xffffffffac301c29) returned 0x1b00017
	[0258.288] MoveToEx (in: hdc=0x230107cd, x=2, y=38, lppt=0x26e11f0 | out: lppt=0x26e11f0) returned 1
	[0258.288] LineTo (hdc=0x230107cd, x=125, y=38) returned 1
	[0258.288] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.289] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.289] GetROP2 (hdc=0x230107cd) returned 13
	[0258.289] GetBkMode (hdc=0x230107cd) returned 2
	[0258.289] SetBkMode (hdc=0x230107cd, mode=1) returned 2
	[0258.289] SelectObject (hdc=0x230107cd, h=0xffffffffac301c29) returned 0xffffffffac301c29
	[0258.289] MoveToEx (in: hdc=0x230107cd, x=125, y=38, lppt=0x26e1208 | out: lppt=0x26e1208) returned 1
	[0258.290] LineTo (hdc=0x230107cd, x=125, y=1) returned 1
	[0258.290] SetBkMode (hdc=0x230107cd, mode=2) returned 1
	[0258.290] MoveToEx (in: hdc=0x230107cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0258.290] SelectObject (hdc=0x230107cd, h=0x1b00017) returned 0xffffffffac301c29
	[0258.290] DeleteObject (ho=0xffffffffac301c29) returned 1
	[0258.291] RestoreDC (hdc=0x230107cd, nSavedDC=-1) returned 1
	[0258.291] GdipReleaseDC (graphics=0x1b929550, hdc=0x230107cd) returned 0x0
	[0258.291] GdipGetDC (graphics=0x1b929550, hdc=0x20cad0) returned 0x0
	[0258.291] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0x230107cd, x1=0, y1=0, rop=0xcc0020) returned 1
	[0258.291] GdipReleaseDC (graphics=0x1b929550, hdc=0x230107cd) returned 0x0
	[0258.291] SelectObject (hdc=0x230107cd, h=0x185000f) returned 0x140507d2
	[0258.292] DeleteDC (hdc=0x230107cd) returned 1
	[0258.292] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0258.292] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0258.292] EndPaint (hWnd=0x401b4, lpPaint=0x20cbd8) returned 1
	[0258.292] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.292] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.292] GetKeyState (nVirtKey=1) returned 1
	[0258.292] GetKeyState (nVirtKey=2) returned 0
	[0258.292] GetKeyState (nVirtKey=4) returned 0
	[0258.293] GetKeyState (nVirtKey=5) returned 0
	[0258.293] GetKeyState (nVirtKey=6) returned 0
	[0258.315] GetCapture () returned 0x0
	[0258.316] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.316] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.316] WaitMessage () returned 1
	[0258.338] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.339] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.339] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.339] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.339] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.339] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.339] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.339] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.339] GetKeyState (nVirtKey=1) returned 1
	[0258.339] GetKeyState (nVirtKey=2) returned 0
	[0258.339] GetKeyState (nVirtKey=4) returned 0
	[0258.339] GetKeyState (nVirtKey=5) returned 0
	[0258.339] GetKeyState (nVirtKey=6) returned 0
	[0258.339] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.339] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.339] WaitMessage () returned 1
	[0258.340] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.340] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.340] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.340] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.340] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.340] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.340] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.340] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.340] GetKeyState (nVirtKey=1) returned 1
	[0258.340] GetKeyState (nVirtKey=2) returned 0
	[0258.340] GetKeyState (nVirtKey=4) returned 0
	[0258.340] GetKeyState (nVirtKey=5) returned 0
	[0258.340] GetKeyState (nVirtKey=6) returned 0
	[0258.340] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.340] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.340] WaitMessage () returned 1
	[0258.342] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.342] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.342] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.342] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.343] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.343] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.343] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.343] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.343] GetKeyState (nVirtKey=1) returned 1
	[0258.343] GetKeyState (nVirtKey=2) returned 0
	[0258.343] GetKeyState (nVirtKey=4) returned 0
	[0258.343] GetKeyState (nVirtKey=5) returned 0
	[0258.343] GetKeyState (nVirtKey=6) returned 0
	[0258.343] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.343] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.343] WaitMessage () returned 1
	[0258.351] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.351] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.351] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.351] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.351] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.352] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.352] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.352] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.352] GetKeyState (nVirtKey=1) returned 1
	[0258.352] GetKeyState (nVirtKey=2) returned 0
	[0258.352] GetKeyState (nVirtKey=4) returned 0
	[0258.352] GetKeyState (nVirtKey=5) returned 0
	[0258.352] GetKeyState (nVirtKey=6) returned 0
	[0258.352] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.352] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.352] WaitMessage () returned 1
	[0258.352] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.353] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.353] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.353] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.353] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.353] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.353] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.353] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.353] GetKeyState (nVirtKey=1) returned 1
	[0258.353] GetKeyState (nVirtKey=2) returned 0
	[0258.353] GetKeyState (nVirtKey=4) returned 0
	[0258.353] GetKeyState (nVirtKey=5) returned 0
	[0258.353] GetKeyState (nVirtKey=6) returned 0
	[0258.353] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.353] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.353] WaitMessage () returned 1
	[0258.356] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.356] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.356] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.356] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.356] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.356] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.356] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.356] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.356] GetKeyState (nVirtKey=1) returned 1
	[0258.356] GetKeyState (nVirtKey=2) returned 0
	[0258.356] GetKeyState (nVirtKey=4) returned 0
	[0258.356] GetKeyState (nVirtKey=5) returned 0
	[0258.356] GetKeyState (nVirtKey=6) returned 0
	[0258.356] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.356] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.356] WaitMessage () returned 1
	[0258.398] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.398] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.398] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.398] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.398] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.398] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.399] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.399] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.399] GetKeyState (nVirtKey=1) returned 1
	[0258.399] GetKeyState (nVirtKey=2) returned 0
	[0258.399] GetKeyState (nVirtKey=4) returned 0
	[0258.399] GetKeyState (nVirtKey=5) returned 0
	[0258.399] GetKeyState (nVirtKey=6) returned 0
	[0258.399] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.399] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.399] WaitMessage () returned 1
	[0258.401] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.401] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.401] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.401] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.401] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.401] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.401] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.401] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.401] GetKeyState (nVirtKey=1) returned 1
	[0258.401] GetKeyState (nVirtKey=2) returned 0
	[0258.401] GetKeyState (nVirtKey=4) returned 0
	[0258.401] GetKeyState (nVirtKey=5) returned 0
	[0258.401] GetKeyState (nVirtKey=6) returned 0
	[0258.401] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.401] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.401] WaitMessage () returned 1
	[0258.410] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.410] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.410] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.410] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.410] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.410] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.410] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.410] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.410] GetKeyState (nVirtKey=1) returned 1
	[0258.410] GetKeyState (nVirtKey=2) returned 0
	[0258.410] GetKeyState (nVirtKey=4) returned 0
	[0258.410] GetKeyState (nVirtKey=5) returned 0
	[0258.410] GetKeyState (nVirtKey=6) returned 0
	[0258.410] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.410] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.410] WaitMessage () returned 1
	[0258.411] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.411] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.411] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.411] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.411] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.411] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.411] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.411] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.411] GetKeyState (nVirtKey=1) returned 1
	[0258.411] GetKeyState (nVirtKey=2) returned 0
	[0258.411] GetKeyState (nVirtKey=4) returned 0
	[0258.411] GetKeyState (nVirtKey=5) returned 0
	[0258.411] GetKeyState (nVirtKey=6) returned 0
	[0258.411] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.411] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.411] WaitMessage () returned 1
	[0258.412] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.412] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.412] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.412] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.412] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.413] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.413] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.413] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.413] GetKeyState (nVirtKey=1) returned 1
	[0258.413] GetKeyState (nVirtKey=2) returned 0
	[0258.413] GetKeyState (nVirtKey=4) returned 0
	[0258.413] GetKeyState (nVirtKey=5) returned 0
	[0258.413] GetKeyState (nVirtKey=6) returned 0
	[0258.413] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.413] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.413] WaitMessage () returned 1
	[0258.414] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.414] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.414] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.414] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.414] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.414] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.414] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.414] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.414] GetKeyState (nVirtKey=1) returned 1
	[0258.414] GetKeyState (nVirtKey=2) returned 0
	[0258.414] GetKeyState (nVirtKey=4) returned 0
	[0258.414] GetKeyState (nVirtKey=5) returned 0
	[0258.414] GetKeyState (nVirtKey=6) returned 0
	[0258.414] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.414] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.414] WaitMessage () returned 1
	[0258.433] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.433] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.433] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.433] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.433] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.433] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.433] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.433] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.433] GetKeyState (nVirtKey=1) returned 1
	[0258.433] GetKeyState (nVirtKey=2) returned 0
	[0258.433] GetKeyState (nVirtKey=4) returned 0
	[0258.433] GetKeyState (nVirtKey=5) returned 0
	[0258.433] GetKeyState (nVirtKey=6) returned 0
	[0258.434] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.434] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.434] WaitMessage () returned 1
	[0258.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.437] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.437] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.437] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.437] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.437] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.437] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.437] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.437] GetKeyState (nVirtKey=1) returned 1
	[0258.437] GetKeyState (nVirtKey=2) returned 0
	[0258.437] GetKeyState (nVirtKey=4) returned 0
	[0258.437] GetKeyState (nVirtKey=5) returned 0
	[0258.437] GetKeyState (nVirtKey=6) returned 0
	[0258.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.437] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.437] WaitMessage () returned 1
	[0258.439] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.439] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.439] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.439] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.439] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.440] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.440] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.440] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.440] GetKeyState (nVirtKey=1) returned 1
	[0258.440] GetKeyState (nVirtKey=2) returned 0
	[0258.440] GetKeyState (nVirtKey=4) returned 0
	[0258.440] GetKeyState (nVirtKey=5) returned 0
	[0258.440] GetKeyState (nVirtKey=6) returned 0
	[0258.440] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.440] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.440] WaitMessage () returned 1
	[0258.440] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.440] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.440] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.440] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.441] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.441] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.441] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.441] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.441] GetKeyState (nVirtKey=1) returned 1
	[0258.441] GetKeyState (nVirtKey=2) returned 0
	[0258.441] GetKeyState (nVirtKey=4) returned 0
	[0258.441] GetKeyState (nVirtKey=5) returned 0
	[0258.441] GetKeyState (nVirtKey=6) returned 0
	[0258.441] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.441] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.441] WaitMessage () returned 1
	[0258.455] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.455] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0258.455] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.455] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.455] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.455] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.456] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.456] WaitMessage () returned 1
	[0258.504] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.504] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.504] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.504] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.504] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.504] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.505] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.505] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.505] GetKeyState (nVirtKey=1) returned 1
	[0258.505] GetKeyState (nVirtKey=2) returned 0
	[0258.505] GetKeyState (nVirtKey=4) returned 0
	[0258.505] GetKeyState (nVirtKey=5) returned 0
	[0258.505] GetKeyState (nVirtKey=6) returned 0
	[0258.505] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.505] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.505] WaitMessage () returned 1
	[0258.505] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.505] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.506] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.506] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.506] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.506] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.506] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.506] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.506] GetKeyState (nVirtKey=1) returned 1
	[0258.506] GetKeyState (nVirtKey=2) returned 0
	[0258.506] GetKeyState (nVirtKey=4) returned 0
	[0258.506] GetKeyState (nVirtKey=5) returned 0
	[0258.506] GetKeyState (nVirtKey=6) returned 0
	[0258.506] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.506] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.506] WaitMessage () returned 1
	[0258.507] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.507] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.507] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.507] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.507] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.507] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.507] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.507] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.507] GetKeyState (nVirtKey=1) returned 1
	[0258.507] GetKeyState (nVirtKey=2) returned 0
	[0258.507] GetKeyState (nVirtKey=4) returned 0
	[0258.507] GetKeyState (nVirtKey=5) returned 0
	[0258.507] GetKeyState (nVirtKey=6) returned 0
	[0258.507] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.507] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.508] WaitMessage () returned 1
	[0258.511] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.511] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.511] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.511] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.511] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.511] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.511] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.511] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.511] GetKeyState (nVirtKey=1) returned 1
	[0258.511] GetKeyState (nVirtKey=2) returned 0
	[0258.511] GetKeyState (nVirtKey=4) returned 0
	[0258.511] GetKeyState (nVirtKey=5) returned 0
	[0258.512] GetKeyState (nVirtKey=6) returned 0
	[0258.512] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.512] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.512] WaitMessage () returned 1
	[0258.514] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.514] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.514] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.514] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.514] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.514] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.514] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.514] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.514] GetKeyState (nVirtKey=1) returned 1
	[0258.514] GetKeyState (nVirtKey=2) returned 0
	[0258.514] GetKeyState (nVirtKey=4) returned 0
	[0258.514] GetKeyState (nVirtKey=5) returned 0
	[0258.514] GetKeyState (nVirtKey=6) returned 0
	[0258.514] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.514] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.515] WaitMessage () returned 1
	[0258.518] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.518] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.518] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.518] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.518] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.518] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.518] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.518] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.518] GetKeyState (nVirtKey=1) returned 1
	[0258.518] GetKeyState (nVirtKey=2) returned 0
	[0258.518] GetKeyState (nVirtKey=4) returned 0
	[0258.518] GetKeyState (nVirtKey=5) returned 0
	[0258.518] GetKeyState (nVirtKey=6) returned 0
	[0258.519] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.519] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.519] WaitMessage () returned 1
	[0258.540] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.540] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.540] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.540] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.540] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.540] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.540] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.540] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.540] GetKeyState (nVirtKey=1) returned 1
	[0258.540] GetKeyState (nVirtKey=2) returned 0
	[0258.541] GetKeyState (nVirtKey=4) returned 0
	[0258.541] GetKeyState (nVirtKey=5) returned 0
	[0258.541] GetKeyState (nVirtKey=6) returned 0
	[0258.541] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.541] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.541] WaitMessage () returned 1
	[0258.559] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.559] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.559] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.559] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.559] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.559] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.559] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.559] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.559] GetKeyState (nVirtKey=1) returned 1
	[0258.559] GetKeyState (nVirtKey=2) returned 0
	[0258.559] GetKeyState (nVirtKey=4) returned 0
	[0258.559] GetKeyState (nVirtKey=5) returned 0
	[0258.559] GetKeyState (nVirtKey=6) returned 0
	[0258.559] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.559] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.559] WaitMessage () returned 1
	[0258.581] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.581] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.582] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.582] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.582] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.582] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.582] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.582] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.582] GetKeyState (nVirtKey=1) returned 1
	[0258.582] GetKeyState (nVirtKey=2) returned 0
	[0258.582] GetKeyState (nVirtKey=4) returned 0
	[0258.582] GetKeyState (nVirtKey=5) returned 0
	[0258.582] GetKeyState (nVirtKey=6) returned 0
	[0258.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.582] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.582] WaitMessage () returned 1
	[0258.622] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.622] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.622] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.622] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.622] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.622] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.623] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.623] GetKeyState (nVirtKey=1) returned 1
	[0258.623] GetKeyState (nVirtKey=2) returned 0
	[0258.623] GetKeyState (nVirtKey=4) returned 0
	[0258.623] GetKeyState (nVirtKey=5) returned 0
	[0258.623] GetKeyState (nVirtKey=6) returned 0
	[0258.623] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.623] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.623] WaitMessage () returned 1
	[0258.824] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.824] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.824] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.824] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.824] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.824] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.824] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.824] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.824] GetKeyState (nVirtKey=1) returned 1
	[0258.824] GetKeyState (nVirtKey=2) returned 0
	[0258.824] GetKeyState (nVirtKey=4) returned 0
	[0258.824] GetKeyState (nVirtKey=5) returned 0
	[0258.824] GetKeyState (nVirtKey=6) returned 0
	[0258.824] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.824] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.824] WaitMessage () returned 1
	[0258.839] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.839] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.839] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0258.839] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0258.839] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0258.839] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0258.840] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0258.840] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0258.840] GetKeyState (nVirtKey=1) returned 1
	[0258.840] GetKeyState (nVirtKey=2) returned 0
	[0258.840] GetKeyState (nVirtKey=4) returned 0
	[0258.840] GetKeyState (nVirtKey=5) returned 0
	[0258.840] GetKeyState (nVirtKey=6) returned 0
	[0258.840] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.840] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0258.840] WaitMessage () returned 1
	[0259.177] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.177] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0259.178] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0259.178] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.178] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x84, wParam=0x0, lParam=0x1f00315) returned 0x1
	[0259.178] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.178] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.178] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.178] GetKeyState (nVirtKey=1) returned 1
	[0259.178] GetKeyState (nVirtKey=2) returned 0
	[0259.178] GetKeyState (nVirtKey=4) returned 0
	[0259.178] GetKeyState (nVirtKey=5) returned 0
	[0259.178] GetKeyState (nVirtKey=6) returned 0
	[0259.178] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.178] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.178] WaitMessage () returned 1
	[0259.409] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.409] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.409] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.409] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.409] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.409] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.409] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x201d8, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0
	[0259.409] InvalidateRect (hWnd=0x201d8, lpRect=0x0, bErase=0) returned 1
	[0259.409] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.409] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.409] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.409] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.409] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.409] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.409] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.410] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.410] _TrackMouseEvent (in: lpEventTrack=0x263be70 | out: lpEventTrack=0x263be70) returned 1
	[0259.410] SendMessageW (hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0259.410] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0xc059, wParam=0x0, lParam=0x0) returned 0x0
	[0259.410] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0259.410] GetKeyState (nVirtKey=1) returned 1
	[0259.410] GetKeyState (nVirtKey=2) returned 0
	[0259.410] GetKeyState (nVirtKey=4) returned 0
	[0259.410] GetKeyState (nVirtKey=5) returned 0
	[0259.410] GetKeyState (nVirtKey=6) returned 0
	[0259.410] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.410] IsWindowUnicode (hWnd=0x201d8) returned 1
	[0259.410] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.410] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.410] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.410] BeginPaint (in: hWnd=0x201d8, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0259.410] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0259.411] CreateCompatibleDC (hdc=0x10107f8) returned 0x1c011c5d
	[0259.411] SelectObject (hdc=0x1c011c5d, h=0x140507d2) returned 0x185000f
	[0259.411] GdipCreateFromHDC (hdc=0x1c011c5d, graphics=0x20d7e0) returned 0x0
	[0259.412] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0259.412] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=166, height=43, combineMode=0x0) returned 0x0
	[0259.412] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0259.412] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0259.412] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d970) returned 0x0
	[0259.412] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.413] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.413] GdipCreateRegion (region=0x20d910) returned 0x0
	[0259.413] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.413] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0259.413] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0259.413] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff92f0dbd) returned 0x0
	[0259.414] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.414] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0259.414] GetCurrentObject (hdc=0x1c011c5d, type=0x1) returned 0x1b00017
	[0259.414] GetCurrentObject (hdc=0x1c011c5d, type=0x2) returned 0x1900010
	[0259.414] GetCurrentObject (hdc=0x1c011c5d, type=0x7) returned 0x140507d2
	[0259.414] GetCurrentObject (hdc=0x1c011c5d, type=0x6) returned 0x18a002e
	[0259.415] SaveDC (hdc=0x1c011c5d) returned 1
	[0259.415] GetNearestColor (hdc=0x1c011c5d, color=0xf0f0f0) returned 0xf0f0f0
	[0259.415] GetNearestColor (hdc=0x1c011c5d, color=0xa0a0a0) returned 0xa0a0a0
	[0259.415] GetNearestColor (hdc=0x1c011c5d, color=0x696969) returned 0x696969
	[0259.415] GetNearestColor (hdc=0x1c011c5d, color=0xa0a0a0) returned 0xa0a0a0
	[0259.416] GetNearestColor (hdc=0x1c011c5d, color=0x0) returned 0x0
	[0259.416] GetNearestColor (hdc=0x1c011c5d, color=0xffffff) returned 0xffffff
	[0259.416] GetNearestColor (hdc=0x1c011c5d, color=0xe5e5e5) returned 0xe5e5e5
	[0259.416] GetNearestColor (hdc=0x1c011c5d, color=0xd8d8d8) returned 0xd8d8d8
	[0259.416] GetNearestColor (hdc=0x1c011c5d, color=0x0) returned 0x0
	[0259.416] RestoreDC (hdc=0x1c011c5d, nSavedDC=-1) returned 1
	[0259.417] GdipReleaseDC (graphics=0x1b929550, hdc=0x1c011c5d) returned 0x0
	[0259.417] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.417] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.417] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.417] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0259.417] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.417] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.418] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.418] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0259.418] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0259.418] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0259.418] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0259.418] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0259.419] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.419] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.419] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.419] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.419] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0259.419] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0259.420] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0259.420] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0259.420] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.420] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.420] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.420] GdipMeasureString (graphics=0x1b927100, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0259.420] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.421] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0259.421] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.421] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.421] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.421] GdipCreateRegion (region=0x20d120) returned 0x0
	[0259.421] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.422] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0259.422] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0259.422] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d180) returned 0x0
	[0259.423] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.423] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.423] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0259.423] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0259.423] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0259.423] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0259.423] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.424] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0259.424] GetCurrentObject (hdc=0x1c011c5d, type=0x1) returned 0x1b00017
	[0259.424] GetCurrentObject (hdc=0x1c011c5d, type=0x2) returned 0x1900010
	[0259.424] GetCurrentObject (hdc=0x1c011c5d, type=0x7) returned 0x140507d2
	[0259.424] GetCurrentObject (hdc=0x1c011c5d, type=0x6) returned 0x18a002e
	[0259.424] SaveDC (hdc=0x1c011c5d) returned 1
	[0259.425] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd0040710
	[0259.425] GetClipRgn (hdc=0x1c011c5d, hrgn=0xffffffffd0040710) returned 0
	[0259.425] SelectClipRgn (hdc=0x1c011c5d, hrgn=0x770407f9) returned 2
	[0259.425] DeleteObject (ho=0xffffffffd0040710) returned 1
	[0259.425] DeleteObject (ho=0x770407f9) returned 1
	[0259.426] OffsetViewportOrgEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x26e2a78 | out: lppt=0x26e2a78) returned 1
	[0259.426] GetNearestColor (hdc=0x1c011c5d, color=0xf0f0f0) returned 0xf0f0f0
	[0259.426] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa61007c0
	[0259.426] FillRect (hDC=0x1c011c5d, lprc=0x20d1d0, hbr=0xffffffffa61007c0) returned 1
	[0259.426] DeleteObject (ho=0xffffffffa61007c0) returned 1
	[0259.426] RestoreDC (hdc=0x1c011c5d, nSavedDC=-1) returned 1
	[0259.427] GdipReleaseDC (graphics=0x1b929550, hdc=0x1c011c5d) returned 0x0
	[0259.427] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.427] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.427] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.427] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0259.427] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.427] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.428] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.428] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0259.428] GdipDrawString (graphics=0x1b929550, string="Open in the browser", length=19, font=0x1b49f210, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0259.428] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0259.428] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.429] GetFocus () returned 0x0
	[0259.429] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0259.429] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.429] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.429] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.429] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0259.429] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=165, height=42) returned 0x0
	[0259.430] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0259.430] GdipCreateRegion (region=0x20d070) returned 0x0
	[0259.430] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.430] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0259.430] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0259.431] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d0d0) returned 0x0
	[0259.431] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.431] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.431] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.431] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0259.431] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0259.432] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0259.432] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.432] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0259.432] GetCurrentObject (hdc=0x1c011c5d, type=0x1) returned 0x1b00017
	[0259.432] GetCurrentObject (hdc=0x1c011c5d, type=0x2) returned 0x1900010
	[0259.432] GetCurrentObject (hdc=0x1c011c5d, type=0x7) returned 0x140507d2
	[0259.433] GetCurrentObject (hdc=0x1c011c5d, type=0x6) returned 0x18a002e
	[0259.433] SaveDC (hdc=0x1c011c5d) returned 1
	[0259.433] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x780407f9
	[0259.433] GetClipRgn (hdc=0x1c011c5d, hrgn=0x780407f9) returned 0
	[0259.433] SelectClipRgn (hdc=0x1c011c5d, hrgn=0xffffffffd1040710) returned 2
	[0259.433] DeleteObject (ho=0x780407f9) returned 1
	[0259.434] DeleteObject (ho=0xffffffffd1040710) returned 1
	[0259.434] OffsetViewportOrgEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x26e3018 | out: lppt=0x26e3018) returned 1
	[0259.434] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.434] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.434] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.434] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1c301c57
	[0259.435] SelectObject (hdc=0x1c011c5d, h=0x1c301c57) returned 0x1b00017
	[0259.435] MoveToEx (in: hdc=0x1c011c5d, x=164, y=1, lppt=0x26e3080 | out: lppt=0x26e3080) returned 1
	[0259.435] LineTo (hdc=0x1c011c5d, x=1, y=1) returned 1
	[0259.435] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.435] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.435] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.436] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.436] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.436] SelectObject (hdc=0x1c011c5d, h=0x1c301c57) returned 0x1c301c57
	[0259.436] MoveToEx (in: hdc=0x1c011c5d, x=1, y=1, lppt=0x26e3098 | out: lppt=0x26e3098) returned 1
	[0259.436] LineTo (hdc=0x1c011c5d, x=1, y=41) returned 1
	[0259.436] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.437] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.437] SelectObject (hdc=0x1c011c5d, h=0x1b00017) returned 0x1c301c57
	[0259.437] DeleteObject (ho=0x1c301c57) returned 1
	[0259.437] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.437] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.437] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.438] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x11301c56
	[0259.439] SelectObject (hdc=0x1c011c5d, h=0x11301c56) returned 0x1b00017
	[0259.439] MoveToEx (in: hdc=0x1c011c5d, x=1, y=41, lppt=0x26e3100 | out: lppt=0x26e3100) returned 1
	[0259.439] LineTo (hdc=0x1c011c5d, x=164, y=41) returned 1
	[0259.439] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.439] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.439] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.440] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.440] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.440] SelectObject (hdc=0x1c011c5d, h=0x11301c56) returned 0x11301c56
	[0259.440] MoveToEx (in: hdc=0x1c011c5d, x=164, y=41, lppt=0x26e3118 | out: lppt=0x26e3118) returned 1
	[0259.440] LineTo (hdc=0x1c011c5d, x=164, y=0) returned 1
	[0259.440] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.441] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.441] SelectObject (hdc=0x1c011c5d, h=0x1b00017) returned 0x11301c56
	[0259.441] DeleteObject (ho=0x11301c56) returned 1
	[0259.441] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.441] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.441] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.442] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x1d301c57
	[0259.442] SelectObject (hdc=0x1c011c5d, h=0x1d301c57) returned 0x1b00017
	[0259.442] MoveToEx (in: hdc=0x1c011c5d, x=163, y=2, lppt=0x26e3180 | out: lppt=0x26e3180) returned 1
	[0259.442] LineTo (hdc=0x1c011c5d, x=2, y=2) returned 1
	[0259.442] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.442] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.443] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.443] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.443] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.443] SelectObject (hdc=0x1c011c5d, h=0x1d301c57) returned 0x1d301c57
	[0259.443] MoveToEx (in: hdc=0x1c011c5d, x=2, y=2, lppt=0x26e3198 | out: lppt=0x26e3198) returned 1
	[0259.443] LineTo (hdc=0x1c011c5d, x=2, y=40) returned 1
	[0259.444] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.444] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.444] SelectObject (hdc=0x1c011c5d, h=0x1b00017) returned 0x1d301c57
	[0259.444] DeleteObject (ho=0x1d301c57) returned 1
	[0259.444] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.444] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.444] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.445] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x12301c56
	[0259.445] SelectObject (hdc=0x1c011c5d, h=0x12301c56) returned 0x1b00017
	[0259.445] MoveToEx (in: hdc=0x1c011c5d, x=2, y=40, lppt=0x26e3200 | out: lppt=0x26e3200) returned 1
	[0259.445] LineTo (hdc=0x1c011c5d, x=163, y=40) returned 1
	[0259.445] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.445] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.446] GetROP2 (hdc=0x1c011c5d) returned 13
	[0259.446] GetBkMode (hdc=0x1c011c5d) returned 2
	[0259.446] SetBkMode (hdc=0x1c011c5d, mode=1) returned 2
	[0259.446] SelectObject (hdc=0x1c011c5d, h=0x12301c56) returned 0x12301c56
	[0259.446] MoveToEx (in: hdc=0x1c011c5d, x=163, y=40, lppt=0x26e3218 | out: lppt=0x26e3218) returned 1
	[0259.446] LineTo (hdc=0x1c011c5d, x=163, y=1) returned 1
	[0259.447] SetBkMode (hdc=0x1c011c5d, mode=2) returned 1
	[0259.447] MoveToEx (in: hdc=0x1c011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.447] SelectObject (hdc=0x1c011c5d, h=0x1b00017) returned 0x12301c56
	[0259.447] DeleteObject (ho=0x12301c56) returned 1
	[0259.447] RestoreDC (hdc=0x1c011c5d, nSavedDC=-1) returned 1
	[0259.448] GdipReleaseDC (graphics=0x1b929550, hdc=0x1c011c5d) returned 0x0
	[0259.448] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0259.448] BitBlt (hdc=0x10107f8, x=0, y=0, cx=166, cy=43, hdcSrc=0x1c011c5d, x1=0, y1=0, rop=0xcc0020) returned 1
	[0259.448] GdipReleaseDC (graphics=0x1b929550, hdc=0x1c011c5d) returned 0x0
	[0259.448] SelectObject (hdc=0x1c011c5d, h=0x185000f) returned 0x140507d2
	[0259.449] DeleteDC (hdc=0x1c011c5d) returned 1
	[0259.449] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0259.449] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0259.449] EndPaint (hWnd=0x201d8, lpPaint=0x20d9e8) returned 1
	[0259.449] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.449] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.449] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.449] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.449] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.449] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x70107fc
	[0259.450] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0259.450] CreateCompatibleDC (hdc=0x70107fc) returned 0x1e011c5d
	[0259.450] SelectObject (hdc=0x1e011c5d, h=0x140507d2) returned 0x185000f
	[0259.450] GdipCreateFromHDC (hdc=0x1e011c5d, graphics=0x20d7e0) returned 0x0
	[0259.450] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0259.450] GdipSetClipRectI (graphics=0x1b929550, x=0, y=23, width=128, height=18, combineMode=0x0) returned 0x0
	[0259.451] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0259.451] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0259.451] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0259.451] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.451] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0259.451] GdipCreateRegion (region=0x20d910) returned 0x0
	[0259.452] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.452] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0259.452] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0259.452] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff92c0dbd) returned 0x0
	[0259.452] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.452] GdipGetDC (graphics=0x1b929550, hdc=0x20cdf0) returned 0x0
	[0259.453] GetCurrentObject (hdc=0x1e011c5d, type=0x1) returned 0x1b00017
	[0259.453] GetCurrentObject (hdc=0x1e011c5d, type=0x2) returned 0x1900010
	[0259.453] GetCurrentObject (hdc=0x1e011c5d, type=0x7) returned 0x140507d2
	[0259.459] GetCurrentObject (hdc=0x1e011c5d, type=0x6) returned 0x18a002e
	[0259.459] SaveDC (hdc=0x1e011c5d) returned 1
	[0259.459] GetNearestColor (hdc=0x1e011c5d, color=0xf0f0f0) returned 0xf0f0f0
	[0259.459] GetNearestColor (hdc=0x1e011c5d, color=0xa0a0a0) returned 0xa0a0a0
	[0259.460] GetNearestColor (hdc=0x1e011c5d, color=0x696969) returned 0x696969
	[0259.460] GetNearestColor (hdc=0x1e011c5d, color=0xa0a0a0) returned 0xa0a0a0
	[0259.460] GetNearestColor (hdc=0x1e011c5d, color=0x0) returned 0x0
	[0259.460] GetNearestColor (hdc=0x1e011c5d, color=0xffffff) returned 0xffffff
	[0259.460] GetNearestColor (hdc=0x1e011c5d, color=0xe5e5e5) returned 0xe5e5e5
	[0259.461] GetNearestColor (hdc=0x1e011c5d, color=0xd8d8d8) returned 0xd8d8d8
	[0259.461] GetNearestColor (hdc=0x1e011c5d, color=0x0) returned 0x0
	[0259.461] RestoreDC (hdc=0x1e011c5d, nSavedDC=-1) returned 1
	[0259.461] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011c5d) returned 0x0
	[0259.461] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.462] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.462] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.462] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4e0) returned 0x0
	[0259.462] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.462] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.462] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.462] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d510) returned 0x0
	[0259.463] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20d510) returned 0x0
	[0259.463] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20d510) returned 0x0
	[0259.463] GdipGetFontSize (font=0x1b912930, size=0x20d510) returned 0x0
	[0259.463] GdipGetFontStyle (font=0x1b912930, style=0x20d510) returned 0x0
	[0259.463] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.464] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.464] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.464] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.464] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20d1a0) returned 0x0
	[0259.464] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d1b0) returned 0x0
	[0259.464] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0259.464] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0259.465] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.465] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.465] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.465] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d0c8, stringFormat=0x1b912930, boundingBox=0x20d0b8, codepointsFitted=0x20d0b4, linesFilled=0x20d0b0) returned 0x0
	[0259.465] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.465] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0259.466] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.466] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.466] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.466] GdipCreateRegion (region=0x20d120) returned 0x0
	[0259.466] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.466] GdipCreateMatrix (matrix=0x20d120) returned 0x0
	[0259.467] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0259.467] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d180) returned 0x0
	[0259.467] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.467] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.467] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.468] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d1d0) returned 0x0
	[0259.468] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d190) returned 0x0
	[0259.468] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d190) returned 0x0
	[0259.468] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.468] GdipGetDC (graphics=0x1b929550, hdc=0x20d200) returned 0x0
	[0259.469] GetCurrentObject (hdc=0x1e011c5d, type=0x1) returned 0x1b00017
	[0259.469] GetCurrentObject (hdc=0x1e011c5d, type=0x2) returned 0x1900010
	[0259.469] GetCurrentObject (hdc=0x1e011c5d, type=0x7) returned 0x140507d2
	[0259.469] GetCurrentObject (hdc=0x1e011c5d, type=0x6) returned 0x18a002e
	[0259.470] SaveDC (hdc=0x1e011c5d) returned 1
	[0259.470] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd2040710
	[0259.470] GetClipRgn (hdc=0x1e011c5d, hrgn=0xffffffffd2040710) returned 0
	[0259.470] SelectClipRgn (hdc=0x1e011c5d, hrgn=0x790407f9) returned 2
	[0259.470] DeleteObject (ho=0xffffffffd2040710) returned 1
	[0259.471] DeleteObject (ho=0x790407f9) returned 1
	[0259.471] OffsetViewportOrgEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x26e3e78 | out: lppt=0x26e3e78) returned 1
	[0259.471] GetNearestColor (hdc=0x1e011c5d, color=0xf0f0f0) returned 0xf0f0f0
	[0259.471] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa71007c0
	[0259.471] FillRect (hDC=0x1e011c5d, lprc=0x20d1d0, hbr=0xffffffffa71007c0) returned 1
	[0259.472] DeleteObject (ho=0xffffffffa71007c0) returned 1
	[0259.472] RestoreDC (hdc=0x1e011c5d, nSavedDC=-1) returned 1
	[0259.472] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011c5d) returned 0x0
	[0259.472] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.472] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.472] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.472] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d240) returned 0x0
	[0259.473] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.473] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.473] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.473] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20d2b0) returned 0x0
	[0259.473] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20d1c0, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0259.474] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0259.474] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.474] GetFocus () returned 0x0
	[0259.474] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0259.474] CoTaskMemAlloc (cb=0x13) returned 0x1b0679c0
	[0259.475] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.475] CoTaskMemFree (pv=0x1b0679c0) 
	[0259.475] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20d5a0) returned 0x0
	[0259.475] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0259.475] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0259.475] GdipCreateRegion (region=0x20d070) returned 0x0
	[0259.475] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.476] GdipCreateMatrix (matrix=0x20d070) returned 0x0
	[0259.476] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0259.476] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d0d0) returned 0x0
	[0259.476] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.476] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.477] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0259.477] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d120) returned 0x0
	[0259.477] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d0e0) returned 0x0
	[0259.477] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20d0e0) returned 0x0
	[0259.477] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.477] GdipGetDC (graphics=0x1b929550, hdc=0x20d150) returned 0x0
	[0259.478] GetCurrentObject (hdc=0x1e011c5d, type=0x1) returned 0x1b00017
	[0259.478] GetCurrentObject (hdc=0x1e011c5d, type=0x2) returned 0x1900010
	[0259.478] GetCurrentObject (hdc=0x1e011c5d, type=0x7) returned 0x140507d2
	[0259.478] GetCurrentObject (hdc=0x1e011c5d, type=0x6) returned 0x18a002e
	[0259.478] SaveDC (hdc=0x1e011c5d) returned 1
	[0259.479] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7a0407f9
	[0259.479] GetClipRgn (hdc=0x1e011c5d, hrgn=0x7a0407f9) returned 0
	[0259.479] SelectClipRgn (hdc=0x1e011c5d, hrgn=0xffffffffd3040710) returned 2
	[0259.479] DeleteObject (ho=0x7a0407f9) returned 1
	[0259.479] DeleteObject (ho=0xffffffffd3040710) returned 1
	[0259.479] OffsetViewportOrgEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x26e4418 | out: lppt=0x26e4418) returned 1
	[0259.480] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.480] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.480] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.480] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1f301c57
	[0259.480] SelectObject (hdc=0x1e011c5d, h=0x1f301c57) returned 0x1b00017
	[0259.480] MoveToEx (in: hdc=0x1e011c5d, x=126, y=1, lppt=0x26e4480 | out: lppt=0x26e4480) returned 1
	[0259.481] LineTo (hdc=0x1e011c5d, x=1, y=1) returned 1
	[0259.481] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.481] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.481] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.481] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.481] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.481] SelectObject (hdc=0x1e011c5d, h=0x1f301c57) returned 0x1f301c57
	[0259.482] MoveToEx (in: hdc=0x1e011c5d, x=1, y=1, lppt=0x26e4498 | out: lppt=0x26e4498) returned 1
	[0259.482] LineTo (hdc=0x1e011c5d, x=1, y=39) returned 1
	[0259.482] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.482] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.482] SelectObject (hdc=0x1e011c5d, h=0x1b00017) returned 0x1f301c57
	[0259.482] DeleteObject (ho=0x1f301c57) returned 1
	[0259.483] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.483] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.483] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.483] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x2c301c52
	[0259.483] SelectObject (hdc=0x1e011c5d, h=0x2c301c52) returned 0x1b00017
	[0259.483] MoveToEx (in: hdc=0x1e011c5d, x=1, y=39, lppt=0x26e4500 | out: lppt=0x26e4500) returned 1
	[0259.484] LineTo (hdc=0x1e011c5d, x=126, y=39) returned 1
	[0259.484] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.484] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.484] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.485] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.485] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.485] SelectObject (hdc=0x1e011c5d, h=0x2c301c52) returned 0x2c301c52
	[0259.486] MoveToEx (in: hdc=0x1e011c5d, x=126, y=39, lppt=0x26e4518 | out: lppt=0x26e4518) returned 1
	[0259.486] LineTo (hdc=0x1e011c5d, x=126, y=0) returned 1
	[0259.486] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.486] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.486] SelectObject (hdc=0x1e011c5d, h=0x1b00017) returned 0x2c301c52
	[0259.486] DeleteObject (ho=0x2c301c52) returned 1
	[0259.487] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.487] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.487] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.487] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x123017ff
	[0259.487] SelectObject (hdc=0x1e011c5d, h=0x123017ff) returned 0x1b00017
	[0259.487] MoveToEx (in: hdc=0x1e011c5d, x=125, y=2, lppt=0x26e4580 | out: lppt=0x26e4580) returned 1
	[0259.488] LineTo (hdc=0x1e011c5d, x=2, y=2) returned 1
	[0259.488] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.488] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.488] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.488] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.488] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.488] SelectObject (hdc=0x1e011c5d, h=0x123017ff) returned 0x123017ff
	[0259.489] MoveToEx (in: hdc=0x1e011c5d, x=2, y=2, lppt=0x26e4598 | out: lppt=0x26e4598) returned 1
	[0259.489] LineTo (hdc=0x1e011c5d, x=2, y=38) returned 1
	[0259.489] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.489] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.489] SelectObject (hdc=0x1e011c5d, h=0x1b00017) returned 0x123017ff
	[0259.489] DeleteObject (ho=0x123017ff) returned 1
	[0259.490] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.490] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.490] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.490] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2d301c52
	[0259.490] SelectObject (hdc=0x1e011c5d, h=0x2d301c52) returned 0x1b00017
	[0259.490] MoveToEx (in: hdc=0x1e011c5d, x=2, y=38, lppt=0x26e4600 | out: lppt=0x26e4600) returned 1
	[0259.491] LineTo (hdc=0x1e011c5d, x=125, y=38) returned 1
	[0259.491] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.491] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.491] GetROP2 (hdc=0x1e011c5d) returned 13
	[0259.491] GetBkMode (hdc=0x1e011c5d) returned 2
	[0259.491] SetBkMode (hdc=0x1e011c5d, mode=1) returned 2
	[0259.492] SelectObject (hdc=0x1e011c5d, h=0x2d301c52) returned 0x2d301c52
	[0259.492] MoveToEx (in: hdc=0x1e011c5d, x=125, y=38, lppt=0x26e4618 | out: lppt=0x26e4618) returned 1
	[0259.492] LineTo (hdc=0x1e011c5d, x=125, y=1) returned 1
	[0259.492] SetBkMode (hdc=0x1e011c5d, mode=2) returned 1
	[0259.492] MoveToEx (in: hdc=0x1e011c5d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.492] SelectObject (hdc=0x1e011c5d, h=0x1b00017) returned 0x2d301c52
	[0259.493] DeleteObject (ho=0x2d301c52) returned 1
	[0259.493] RestoreDC (hdc=0x1e011c5d, nSavedDC=-1) returned 1
	[0259.493] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011c5d) returned 0x0
	[0259.493] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0259.493] BitBlt (hdc=0x70107fc, x=0, y=0, cx=128, cy=41, hdcSrc=0x1e011c5d, x1=0, y1=0, rop=0xcc0020) returned 1
	[0259.494] GdipReleaseDC (graphics=0x1b929550, hdc=0x1e011c5d) returned 0x0
	[0259.494] SelectObject (hdc=0x1e011c5d, h=0x185000f) returned 0x140507d2
	[0259.494] DeleteDC (hdc=0x1e011c5d) returned 1
	[0259.494] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0259.494] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0259.494] EndPaint (hWnd=0x401b4, lpPaint=0x20d9e8) returned 1
	[0259.494] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.494] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.495] WaitMessage () returned 1
	[0259.516] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.516] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.516] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.516] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.516] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.516] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.516] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.516] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.516] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.516] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.516] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x2a1, wParam=0x0, lParam=0x190042) returned 0x0
	[0259.516] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.516] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.516] WaitMessage () returned 1
	[0259.637] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.637] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.637] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.637] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.637] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.638] GetDlgItem (hDlg=0x50120, nIDDlgItem=0) returned 0x0
	[0259.638] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x210, wParam=0x201, lParam=0x1ac004e) returned 0x0
	[0259.638] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0259.638] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x21, wParam=0x50120, lParam=0x2010001) returned 0x1
	[0259.638] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x46, wParam=0x0, lParam=0x20e510) returned 0x0
	[0259.638] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x46, wParam=0x0, lParam=0x20e510) returned 0x0
	[0259.638] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
	[0259.638] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0259.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0259.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0259.639] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df90 | out: lpwndpl=0x20df90) returned 1
	[0259.639] GetClientRect (in: hWnd=0x50120, lpRect=0x20de40 | out: lpRect=0x20de40) returned 1
	[0259.639] GetWindowTextLengthW (hWnd=0x50120) returned 16
	[0259.639] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x10
	[0259.639] GetSystemMetrics (nIndex=42) returned 0
	[0259.639] CoTaskMemAlloc (cb=0x26) returned 0x1b065c20
	[0259.639] GetWindowTextW (in: hWnd=0x50120, lpString=0x1b065c20, nMaxCount=17 | out: lpString="Boom Ransomeware") returned 16
	[0259.640] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0xd, wParam=0x11, lParam=0x1b065c20) returned 0x10
	[0259.640] CoTaskMemFree (pv=0x1b065c20) 
	[0259.640] GetClientRect (in: hWnd=0x50120, lpRect=0x20dbe0 | out: lpRect=0x20dbe0) returned 1
	[0259.640] SelectPalette (hdc=0x4010280, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0259.640] GdipCreateFromHDC (hdc=0x4010280, graphics=0x20d7b0) returned 0x0
	[0259.641] GdipSetPageUnit (graphics=0x1b929550, unit=0x2) returned 0x0
	[0259.641] GdipCreateMatrix (matrix=0x20d6a0) returned 0x0
	[0259.641] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0259.641] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d700) returned 0x0
	[0259.641] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.641] GdipCreateRegion (region=0x20d6a0) returned 0x0
	[0259.642] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.642] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d6d0) returned 0x0
	[0259.642] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.642] GdipSaveGraphics (graphics=0x1b929550, state=0x20d7a0) returned 0x0
	[0259.642] GdipCreateRegion (region=0x20d670) returned 0x0
	[0259.642] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.643] GdipCreateMatrix (matrix=0x20d670) returned 0x0
	[0259.643] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0259.643] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d6d0) returned 0x0
	[0259.643] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.643] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0259.643] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d720) returned 0x0
	[0259.644] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.644] GdipGetDC (graphics=0x1b929550, hdc=0x20d750) returned 0x0
	[0259.644] GetCurrentObject (hdc=0x4010280, type=0x1) returned 0x1b00017
	[0259.644] GetCurrentObject (hdc=0x4010280, type=0x2) returned 0x1900010
	[0259.644] GetCurrentObject (hdc=0x4010280, type=0x7) returned 0x1050032
	[0259.644] GetCurrentObject (hdc=0x4010280, type=0x6) returned 0x18a002e
	[0259.645] SaveDC (hdc=0x4010280) returned 1
	[0259.645] OffsetViewportOrgEx (in: hdc=0x4010280, x=0, y=0, lppt=0x26e4b80 | out: lppt=0x26e4b80) returned 1
	[0259.645] GetNearestColor (hdc=0x4010280, color=0xf0f0f0) returned 0xf0f0f0
	[0259.645] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa81007c0
	[0259.645] FillRect (hDC=0x4010280, lprc=0x20d720, hbr=0xffffffffa81007c0) returned 1
	[0259.646] DeleteObject (ho=0xffffffffa81007c0) returned 1
	[0259.646] RestoreDC (hdc=0x4010280, nSavedDC=-1) returned 1
	[0259.646] GdipReleaseDC (graphics=0x1b929550, hdc=0x4010280) returned 0x0
	[0259.646] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0259.646] SelectPalette (hdc=0x4010280, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0259.647] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0x85, wParam=0x9041c5e, lParam=0x0) returned 0x0
	[0259.647] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x85, wParam=0xa041c5e, lParam=0x0) returned 0x0
	[0259.647] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x14, wParam=0x4010280, lParam=0x0) returned 0x1
	[0259.647] GetStockObject (i=5) returned 0x1900015
	[0259.647] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0x85, wParam=0xb041c5e, lParam=0x0) returned 0x0
	[0259.648] GetWindowPlacement (in: hWnd=0x50120, lpwndpl=0x20df70 | out: lpwndpl=0x20df70) returned 1
	[0259.648] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x47, wParam=0x0, lParam=0x20e510) returned 0x0
	[0259.648] GetClientRect (in: hWnd=0x50120, lpRect=0x20dd10 | out: lpRect=0x20dd10) returned 1
	[0259.648] GetWindowRect (in: hWnd=0x50120, lpRect=0x20dd10 | out: lpRect=0x20dd10) returned 1
	[0259.648] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0259.648] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0259.648] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x47, wParam=0x0, lParam=0x20e510) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0xd, wParam=0x104, lParam=0x1b1352d0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0259.649] NtdllDefWindowProc_W (hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
	[0259.649] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x50120, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
	[0259.650] GetFocus () returned 0x0
	[0259.650] SetFocus (hWnd=0x401b4) returned 0x0
	[0259.650] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
	[0259.650] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
	[0259.650] GetKeyboardLayout (idThread=0x0) returned 0x4090409
	[0259.650] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
	[0259.650] GetStockObject (i=5) returned 0x1900015
	[0259.651] SendMessageW (hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1e0) returned 0x0
	[0259.651] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x202b, wParam=0x401b4, lParam=0x20d1e0) returned 0x0
	[0259.651] InvalidateRect (hWnd=0x401b4, lpRect=0x0, bErase=0) returned 1
	[0259.651] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.651] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.651] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.651] GetKeyState (nVirtKey=1) returned -128
	[0259.651] GetKeyState (nVirtKey=2) returned 0
	[0259.651] GetKeyState (nVirtKey=4) returned 0
	[0259.651] GetKeyState (nVirtKey=5) returned 0
	[0259.651] GetKeyState (nVirtKey=6) returned 0
	[0259.651] IsWindowVisible (hWnd=0x401b4) returned 1
	[0259.651] IsWindowEnabled (hWnd=0x401b4) returned 1
	[0259.651] SetFocus (hWnd=0x401b4) returned 0x401b4
	[0259.651] GetFocus () returned 0x401b4
	[0259.651] GetFocus () returned 0x401b4
	[0259.651] GetFocus () returned 0x401b4
	[0259.651] GetKeyState (nVirtKey=1) returned -128
	[0259.651] GetKeyState (nVirtKey=2) returned 0
	[0259.651] GetKeyState (nVirtKey=4) returned 0
	[0259.651] GetKeyState (nVirtKey=5) returned 0
	[0259.651] GetKeyState (nVirtKey=6) returned 0
	[0259.651] GetCapture () returned 0x0
	[0259.651] SetCapture (hWnd=0x401b4) returned 0x0
	[0259.651] GetKeyState (nVirtKey=1) returned -128
	[0259.651] GetKeyState (nVirtKey=2) returned 0
	[0259.651] GetKeyState (nVirtKey=4) returned 0
	[0259.652] GetKeyState (nVirtKey=5) returned 0
	[0259.652] GetKeyState (nVirtKey=6) returned 0
	[0259.652] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0259.652] InvalidateRect (hWnd=0x401b4, lpRect=0x20dd30, bErase=0) returned 1
	[0259.652] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.652] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.652] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.652] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0259.652] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.652] GetMessageA (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.652] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.652] DispatchMessageA (lpMsg=0x20e6b0) returned 0x0
	[0259.652] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.652] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.652] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.652] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.652] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.652] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x26e4cc8, cPoints=0x1 | out: lpPoints=0x26e4cc8) returned 40370579
	[0259.652] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0259.652] InvalidateRect (hWnd=0x401b4, lpRect=0x20dc80, bErase=0) returned 1
	[0259.652] UpdateWindow (hWnd=0x401b4) returned 1
	[0259.652] BeginPaint (in: hWnd=0x401b4, lpPaint=0x20d198 | out: lpPaint=0x20d198) returned 0x48010f97
	[0259.652] SelectPalette (hdc=0x48010f97, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0259.652] CreateCompatibleDC (hdc=0x48010f97) returned 0x20011c5c
	[0259.652] SelectObject (hdc=0x20011c5c, h=0x140507d2) returned 0x185000f
	[0259.653] GdipCreateFromHDC (hdc=0x20011c5c, graphics=0x20cfa0) returned 0x0
	[0259.653] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0259.653] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=128, height=41, combineMode=0x0) returned 0x0
	[0259.653] GdipCreateMatrix (matrix=0x20d0d0) returned 0x0
	[0259.653] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0259.653] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d130) returned 0x0
	[0259.654] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.654] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.654] GdipCreateRegion (region=0x20d0d0) returned 0x0
	[0259.654] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.654] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d100) returned 0x0
	[0259.654] GdipSaveGraphics (graphics=0x1b929550, state=0x20d1d0) returned 0x0
	[0259.655] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9270dbd) returned 0x0
	[0259.655] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.655] GdipGetDC (graphics=0x1b929550, hdc=0x20c5b0) returned 0x0
	[0259.655] GetCurrentObject (hdc=0x20011c5c, type=0x1) returned 0x1b00017
	[0259.655] GetCurrentObject (hdc=0x20011c5c, type=0x2) returned 0x1900010
	[0259.655] GetCurrentObject (hdc=0x20011c5c, type=0x7) returned 0x140507d2
	[0259.656] GetCurrentObject (hdc=0x20011c5c, type=0x6) returned 0x18a002e
	[0259.656] SaveDC (hdc=0x20011c5c) returned 1
	[0259.656] GetNearestColor (hdc=0x20011c5c, color=0xf0f0f0) returned 0xf0f0f0
	[0259.656] GetNearestColor (hdc=0x20011c5c, color=0xa0a0a0) returned 0xa0a0a0
	[0259.657] GetNearestColor (hdc=0x20011c5c, color=0x696969) returned 0x696969
	[0259.657] GetNearestColor (hdc=0x20011c5c, color=0xa0a0a0) returned 0xa0a0a0
	[0259.657] GetNearestColor (hdc=0x20011c5c, color=0x0) returned 0x0
	[0259.657] GetNearestColor (hdc=0x20011c5c, color=0xffffff) returned 0xffffff
	[0259.657] GetNearestColor (hdc=0x20011c5c, color=0xe5e5e5) returned 0xe5e5e5
	[0259.657] GetNearestColor (hdc=0x20011c5c, color=0xd8d8d8) returned 0xd8d8d8
	[0259.658] GetNearestColor (hdc=0x20011c5c, color=0x0) returned 0x0
	[0259.658] RestoreDC (hdc=0x20011c5c, nSavedDC=-1) returned 1
	[0259.658] GdipReleaseDC (graphics=0x1b929550, hdc=0x20011c5c) returned 0x0
	[0259.658] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0259.658] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.658] CoTaskMemFree (pv=0x1b067960) 
	[0259.658] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20cca0) returned 0x0
	[0259.659] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.659] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.659] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.659] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20ccd0) returned 0x0
	[0259.659] GdipGetStringFormatTrimming (format=0x1b912930, trimming=0x20ccd0) returned 0x0
	[0259.659] GdipGetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=0x20ccd0) returned 0x0
	[0259.660] GdipGetFontSize (font=0x1b912930, size=0x20ccd0) returned 0x0
	[0259.660] GdipGetFontStyle (font=0x1b912930, style=0x20ccd0) returned 0x0
	[0259.660] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.660] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0259.660] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.660] CoTaskMemFree (pv=0x1b067960) 
	[0259.660] GdipCreateFromHDC (hdc=0x601081a, graphics=0x20c960) returned 0x0
	[0259.661] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20c970) returned 0x0
	[0259.661] GdipSetStringFormatFlags (format=0x1b912930, flags=0) returned 0x0
	[0259.661] GdipSetStringFormatTrimming (format=0x1b912930, trimming=0x1) returned 0x0
	[0259.661] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.661] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.661] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.662] GdipMeasureString (graphics=0x1b927100, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c888, stringFormat=0x1b912930, boundingBox=0x20c878, codepointsFitted=0x20c874, linesFilled=0x20c870) returned 0x0
	[0259.662] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.662] GdipDeleteGraphics (graphics=0x1b927100) returned 0x0
	[0259.662] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0259.662] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.662] CoTaskMemFree (pv=0x1b067960) 
	[0259.662] GdipCreateRegion (region=0x20c8e0) returned 0x0
	[0259.662] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.663] GdipCreateMatrix (matrix=0x20c8e0) returned 0x0
	[0259.663] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0259.663] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20c940) returned 0x0
	[0259.663] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.663] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.663] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0259.664] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c990) returned 0x0
	[0259.664] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c950) returned 0x0
	[0259.664] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c950) returned 0x0
	[0259.664] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.664] GdipGetDC (graphics=0x1b929550, hdc=0x20c9c0) returned 0x0
	[0259.665] GetCurrentObject (hdc=0x20011c5c, type=0x1) returned 0x1b00017
	[0259.665] GetCurrentObject (hdc=0x20011c5c, type=0x2) returned 0x1900010
	[0259.665] GetCurrentObject (hdc=0x20011c5c, type=0x7) returned 0x140507d2
	[0259.665] GetCurrentObject (hdc=0x20011c5c, type=0x6) returned 0x18a002e
	[0259.665] SaveDC (hdc=0x20011c5c) returned 1
	[0259.666] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd4040710
	[0259.666] GetClipRgn (hdc=0x20011c5c, hrgn=0xffffffffd4040710) returned 0
	[0259.666] SelectClipRgn (hdc=0x20011c5c, hrgn=0xffffffff800407f9) returned 2
	[0259.666] DeleteObject (ho=0xffffffffd4040710) returned 1
	[0259.666] DeleteObject (ho=0xffffffff800407f9) returned 1
	[0259.666] OffsetViewportOrgEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x26e5948 | out: lppt=0x26e5948) returned 1
	[0259.667] GetNearestColor (hdc=0x20011c5c, color=0xf0f0f0) returned 0xf0f0f0
	[0259.667] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffa91007c0
	[0259.667] FillRect (hDC=0x20011c5c, lprc=0x20c990, hbr=0xffffffffa91007c0) returned 1
	[0259.667] DeleteObject (ho=0xffffffffa91007c0) returned 1
	[0259.667] RestoreDC (hdc=0x20011c5c, nSavedDC=-1) returned 1
	[0259.668] GdipReleaseDC (graphics=0x1b929550, hdc=0x20011c5c) returned 0x0
	[0259.668] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0259.668] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.668] CoTaskMemFree (pv=0x1b067960) 
	[0259.668] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20ca00) returned 0x0
	[0259.668] GdipSetStringFormatAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.668] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x1) returned 0x0
	[0259.669] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.669] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x20ca70) returned 0x0
	[0259.669] GdipDrawString (graphics=0x1b929550, string="Get PIN", length=7, font=0x1b40c350, layoutRect=0x20c980, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0259.669] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0259.669] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.670] GetFocus () returned 0x401b4
	[0259.670] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef48a0000
	[0259.670] CoTaskMemAlloc (cb=0x13) returned 0x1b067960
	[0259.670] GetProcAddress (hModule=0x7fef48a0000, lpProcName="ImageList_WriteEx") returned 0x0
	[0259.670] CoTaskMemFree (pv=0x1b067960) 
	[0259.670] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x20cd60) returned 0x0
	[0259.670] GdipDrawRectangleI (graphics=0x1b929550, pen=0x1b9151c0, x=0, y=0, width=127, height=40) returned 0x0
	[0259.670] GdipDeletePen (pen=0x1b9151c0) returned 0x0
	[0259.671] GdipCreateRegion (region=0x20c830) returned 0x0
	[0259.671] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.671] GdipCreateMatrix (matrix=0x20c830) returned 0x0
	[0259.671] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0259.671] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20c890) returned 0x0
	[0259.671] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.672] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.672] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.672] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8e0) returned 0x0
	[0259.672] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20c8a0) returned 0x0
	[0259.672] GdipGetRegionHRgn (region=0x1b929d90, graphics=0x1b929550, hRgn=0x20c8a0) returned 0x0
	[0259.673] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.673] GdipGetDC (graphics=0x1b929550, hdc=0x20c910) returned 0x0
	[0259.673] GetCurrentObject (hdc=0x20011c5c, type=0x1) returned 0x1b00017
	[0259.673] GetCurrentObject (hdc=0x20011c5c, type=0x2) returned 0x1900010
	[0259.673] GetCurrentObject (hdc=0x20011c5c, type=0x7) returned 0x140507d2
	[0259.674] GetCurrentObject (hdc=0x20011c5c, type=0x6) returned 0x18a002e
	[0259.674] SaveDC (hdc=0x20011c5c) returned 1
	[0259.674] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff810407f9
	[0259.674] GetClipRgn (hdc=0x20011c5c, hrgn=0xffffffff810407f9) returned 0
	[0259.674] SelectClipRgn (hdc=0x20011c5c, hrgn=0xffffffffd5040710) returned 2
	[0259.675] DeleteObject (ho=0xffffffff810407f9) returned 1
	[0259.675] DeleteObject (ho=0xffffffffd5040710) returned 1
	[0259.675] OffsetViewportOrgEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x26e5ee8 | out: lppt=0x26e5ee8) returned 1
	[0259.675] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.675] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.675] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.676] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x343017f9
	[0259.676] SelectObject (hdc=0x20011c5c, h=0x343017f9) returned 0x1b00017
	[0259.676] MoveToEx (in: hdc=0x20011c5c, x=126, y=1, lppt=0x26e5f50 | out: lppt=0x26e5f50) returned 1
	[0259.676] LineTo (hdc=0x20011c5c, x=1, y=1) returned 1
	[0259.676] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.677] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.677] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.677] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.677] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.677] SelectObject (hdc=0x20011c5c, h=0x343017f9) returned 0x343017f9
	[0259.677] MoveToEx (in: hdc=0x20011c5c, x=1, y=1, lppt=0x26e5f68 | out: lppt=0x26e5f68) returned 1
	[0259.678] LineTo (hdc=0x20011c5c, x=1, y=39) returned 1
	[0259.678] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.678] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.678] SelectObject (hdc=0x20011c5c, h=0x1b00017) returned 0x343017f9
	[0259.678] DeleteObject (ho=0x343017f9) returned 1
	[0259.678] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.679] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.679] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.679] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x14301c5f
	[0259.679] SelectObject (hdc=0x20011c5c, h=0x14301c5f) returned 0x1b00017
	[0259.679] MoveToEx (in: hdc=0x20011c5c, x=1, y=39, lppt=0x26e5fd0 | out: lppt=0x26e5fd0) returned 1
	[0259.679] LineTo (hdc=0x20011c5c, x=126, y=39) returned 1
	[0259.680] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.680] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.680] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.680] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.680] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.680] SelectObject (hdc=0x20011c5c, h=0x14301c5f) returned 0x14301c5f
	[0259.681] MoveToEx (in: hdc=0x20011c5c, x=126, y=39, lppt=0x26e5fe8 | out: lppt=0x26e5fe8) returned 1
	[0259.681] LineTo (hdc=0x20011c5c, x=126, y=0) returned 1
	[0259.681] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.681] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.681] SelectObject (hdc=0x20011c5c, h=0x1b00017) returned 0x14301c5f
	[0259.681] DeleteObject (ho=0x14301c5f) returned 1
	[0259.682] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.682] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.682] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.682] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x353017f9
	[0259.682] SelectObject (hdc=0x20011c5c, h=0x353017f9) returned 0x1b00017
	[0259.683] MoveToEx (in: hdc=0x20011c5c, x=125, y=2, lppt=0x26e6050 | out: lppt=0x26e6050) returned 1
	[0259.683] LineTo (hdc=0x20011c5c, x=2, y=2) returned 1
	[0259.683] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.683] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.683] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.683] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.684] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.684] SelectObject (hdc=0x20011c5c, h=0x353017f9) returned 0x353017f9
	[0259.684] MoveToEx (in: hdc=0x20011c5c, x=2, y=2, lppt=0x26e6068 | out: lppt=0x26e6068) returned 1
	[0259.684] LineTo (hdc=0x20011c5c, x=2, y=38) returned 1
	[0259.684] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.684] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.685] SelectObject (hdc=0x20011c5c, h=0x1b00017) returned 0x353017f9
	[0259.685] DeleteObject (ho=0x353017f9) returned 1
	[0259.685] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.685] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.685] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.685] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x15301c5f
	[0259.686] SelectObject (hdc=0x20011c5c, h=0x15301c5f) returned 0x1b00017
	[0259.686] MoveToEx (in: hdc=0x20011c5c, x=2, y=38, lppt=0x26e60d0 | out: lppt=0x26e60d0) returned 1
	[0259.686] LineTo (hdc=0x20011c5c, x=125, y=38) returned 1
	[0259.686] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.686] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.687] GetROP2 (hdc=0x20011c5c) returned 13
	[0259.687] GetBkMode (hdc=0x20011c5c) returned 2
	[0259.687] SetBkMode (hdc=0x20011c5c, mode=1) returned 2
	[0259.687] SelectObject (hdc=0x20011c5c, h=0x15301c5f) returned 0x15301c5f
	[0259.692] MoveToEx (in: hdc=0x20011c5c, x=125, y=38, lppt=0x26e60e8 | out: lppt=0x26e60e8) returned 1
	[0259.692] LineTo (hdc=0x20011c5c, x=125, y=1) returned 1
	[0259.693] SetBkMode (hdc=0x20011c5c, mode=2) returned 1
	[0259.693] MoveToEx (in: hdc=0x20011c5c, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0259.693] SelectObject (hdc=0x20011c5c, h=0x1b00017) returned 0x15301c5f
	[0259.693] DeleteObject (ho=0x15301c5f) returned 1
	[0259.693] RestoreDC (hdc=0x20011c5c, nSavedDC=-1) returned 1
	[0259.693] GdipReleaseDC (graphics=0x1b929550, hdc=0x20011c5c) returned 0x0
	[0259.694] GdipGetDC (graphics=0x1b929550, hdc=0x20d0a0) returned 0x0
	[0259.694] BitBlt (hdc=0x48010f97, x=0, y=0, cx=128, cy=41, hdcSrc=0x20011c5c, x1=0, y1=0, rop=0xcc0020) returned 1
	[0259.694] GdipReleaseDC (graphics=0x1b929550, hdc=0x20011c5c) returned 0x0
	[0259.694] SelectObject (hdc=0x20011c5c, h=0x185000f) returned 0x140507d2
	[0259.694] DeleteDC (hdc=0x20011c5c) returned 1
	[0259.695] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0259.695] SelectPalette (hdc=0x48010f97, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0259.695] EndPaint (hWnd=0x401b4, lpPaint=0x20d1a8) returned 1
	[0259.695] MapWindowPoints (in: hWndFrom=0x401b4, hWndTo=0x0, lpPoints=0x26e6140, cPoints=0x1 | out: lpPoints=0x26e6140) returned 40370579
	[0259.695] WindowFromPoint (Point=0x281000001d5) returned 0x401b4
	[0259.695] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.695] NotifyWinEvent (event=0x800a, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0259.695] NotifyWinEvent (event=0x800c, hwnd=0x401b4, idObject=-4, idChild=0) 
	[0259.695] SetWindowPos (hWnd=0x201a6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
	[0259.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a6, Msg=0x46, wParam=0x0, lParam=0x20da90) returned 0x0
	[0259.696] GetCapture () returned 0x401b4
	[0259.696] ReleaseCapture () returned 1
	[0259.696] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
	[0259.696] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.696] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.696] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.696] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.696] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.696] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.696] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.696] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.696] GetKeyState (nVirtKey=1) returned 0
	[0259.696] GetKeyState (nVirtKey=2) returned 0
	[0259.696] GetKeyState (nVirtKey=4) returned 0
	[0259.696] GetKeyState (nVirtKey=5) returned 0
	[0259.696] GetKeyState (nVirtKey=6) returned 0
	[0259.696] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.696] IsWindowUnicode (hWnd=0x401a4) returned 1
	[0259.696] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.696] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.696] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.696] BeginPaint (in: hWnd=0x401a4, lpPaint=0x20d9d8 | out: lpPaint=0x20d9d8) returned 0x10107f8
	[0259.696] SelectPalette (hdc=0x10107f8, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0259.697] CreateCompatibleDC (hdc=0x10107f8) returned 0x16011c5f
	[0259.697] GetObjectType (h=0x10107f8) returned 0x3
	[0259.697] CreateCompatibleBitmap (hdc=0x10107f8, cx=1, cy=1) returned 0x360517f9
	[0259.697] GetDIBits (in: hdc=0x10107f8, hbm=0x360517f9, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0259.697] GetDIBits (in: hdc=0x10107f8, hbm=0x360517f9, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d068) returned 1
	[0259.697] DeleteObject (ho=0x360517f9) returned 1
	[0259.698] CreateDIBSection (in: hdc=0x10107f8, lpbmi=0x20d240, usage=0x0, ppvBits=0x20d238, hSection=0x0, offset=0x0 | out: ppvBits=0x20d238) returned 0x2051c60
	[0259.698] SelectObject (hdc=0x16011c5f, h=0x2051c60) returned 0x185000f
	[0259.698] GdipCreateFromHDC (hdc=0x16011c5f, graphics=0x20d750) returned 0x0
	[0259.698] GdipTranslateWorldTransform (graphics=0x1b929550, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0259.698] GdipSetClipRectI (graphics=0x1b929550, x=0, y=0, width=86, height=83, combineMode=0x0) returned 0x0
	[0259.698] GdipCreateMatrix (matrix=0x20d910) returned 0x0
	[0259.699] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f2d0) returned 0x0
	[0259.699] GdipIsMatrixIdentity (matrix=0x1b49f2d0, result=0x20d970) returned 0x0
	[0259.699] GdipGetMatrixElements (matrix=0x1b49f2d0, matrixOut=0x1b07c7c0) returned 0x0
	[0259.699] GdipDeleteMatrix (matrix=0x1b49f2d0) returned 0x0
	[0259.699] GdipCreateRegion (region=0x20d910) returned 0x0
	[0259.699] GdipGetClip (graphics=0x1b929550, region=0x1b929d90) returned 0x0
	[0259.700] GdipIsInfiniteRegion (region=0x1b929d90, graphics=0x1b929550, result=0x20d940) returned 0x0
	[0259.700] GdipSaveGraphics (graphics=0x1b929550, state=0x20da10) returned 0x0
	[0259.700] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0259.700] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0259.700] GetSystemMetrics (nIndex=42) returned 0
	[0259.700] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0259.700] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0259.700] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0259.700] CoTaskMemFree (pv=0x1b07f5c0) 
	[0259.700] GetClientRect (in: hWnd=0x401a4, lpRect=0x20d970 | out: lpRect=0x20d970) returned 1
	[0259.700] GdipCreateRegion (region=0x20d400) returned 0x0
	[0259.701] GdipGetClip (graphics=0x1b929550, region=0x1b913cf0) returned 0x0
	[0259.701] GdipCreateMatrix (matrix=0x20d400) returned 0x0
	[0259.701] GdipGetWorldTransform (graphics=0x1b929550, matrix=0x1b49f310) returned 0x0
	[0259.701] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d460) returned 0x0
	[0259.701] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.701] GdipCombineRegionRegion (region=0x1b913cf0, region2=0x1b929d90, combineMode=0x1) returned 0x0
	[0259.702] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.702] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.702] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d4b0) returned 0x0
	[0259.702] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b929550, result=0x20d470) returned 0x0
	[0259.702] GdipGetRegionHRgn (region=0x1b913cf0, graphics=0x1b929550, hRgn=0x20d470) returned 0x0
	[0259.702] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0259.702] GdipGetDC (graphics=0x1b929550, hdc=0x20d4e0) returned 0x0
	[0259.703] GetCurrentObject (hdc=0x16011c5f, type=0x1) returned 0x1b00017
	[0259.703] GetCurrentObject (hdc=0x16011c5f, type=0x2) returned 0x1900010
	[0259.703] GetCurrentObject (hdc=0x16011c5f, type=0x7) returned 0x2051c60
	[0259.703] GetCurrentObject (hdc=0x16011c5f, type=0x6) returned 0x18a002e
	[0259.703] SaveDC (hdc=0x16011c5f) returned 1
	[0259.704] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd6040710
	[0259.704] GetClipRgn (hdc=0x16011c5f, hrgn=0xffffffffd6040710) returned 0
	[0259.704] SelectClipRgn (hdc=0x16011c5f, hrgn=0xffffffff820407f9) returned 2
	[0259.704] DeleteObject (ho=0xffffffffd6040710) returned 1
	[0259.704] DeleteObject (ho=0xffffffff820407f9) returned 1
	[0259.704] OffsetViewportOrgEx (in: hdc=0x16011c5f, x=0, y=0, lppt=0x26e78a0 | out: lppt=0x26e78a0) returned 1
	[0259.705] GetNearestColor (hdc=0x16011c5f, color=0x0) returned 0x0
	[0259.705] CreateSolidBrush (color=0x0) returned 0xffffffffaa1007c0
	[0259.705] FillRect (hDC=0x16011c5f, lprc=0x20d4b0, hbr=0xffffffffaa1007c0) returned 1
	[0259.705] DeleteObject (ho=0xffffffffaa1007c0) returned 1
	[0259.705] RestoreDC (hdc=0x16011c5f, nSavedDC=-1) returned 1
	[0259.706] GdipReleaseDC (graphics=0x1b929550, hdc=0x16011c5f) returned 0x0
	[0259.706] GdipRestoreGraphics (graphics=0x1b929550, state=0xfffffffff9240dbd) returned 0x0
	[0259.706] GdipDeleteRegion (region=0x1b929d90) returned 0x0
	[0259.706] GetWindowTextLengthW (hWnd=0x401a4) returned 117
	[0259.706] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x75
	[0259.706] GetSystemMetrics (nIndex=42) returned 0
	[0259.706] CoTaskMemAlloc (cb=0xf0) returned 0x1b07f5c0
	[0259.706] GetWindowTextW (in: hWnd=0x401a4, lpString=0x1b07f5c0, nMaxCount=118 | out: lpString="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever") returned 117
	[0259.706] CallWindowProcW (lpPrevWndFunc=0x776f826c, hWnd=0x401a4, Msg=0xd, wParam=0x76, lParam=0x1b07f5c0) returned 0x75
	[0259.706] CoTaskMemFree (pv=0x1b07f5c0) 
	[0259.707] GdipGetDC (graphics=0x1b929550, hdc=0x20d530) returned 0x0
	[0259.707] GetCurrentObject (hdc=0x16011c5f, type=0x1) returned 0x1b00017
	[0259.707] GetCurrentObject (hdc=0x16011c5f, type=0x2) returned 0x1900010
	[0259.707] GetCurrentObject (hdc=0x16011c5f, type=0x7) returned 0x2051c60
	[0259.707] GetCurrentObject (hdc=0x16011c5f, type=0x6) returned 0x18a002e
	[0259.707] SaveDC (hdc=0x16011c5f) returned 1
	[0259.708] GetNearestColor (hdc=0x16011c5f, color=0x80) returned 0x80
	[0259.708] RestoreDC (hdc=0x16011c5f, nSavedDC=-1) returned 1
	[0259.708] GdipReleaseDC (graphics=0x1b929550, hdc=0x16011c5f) returned 0x0
	[0259.708] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x20d4c0) returned 0x0
	[0259.708] GdipSetStringFormatAlign (format=0x1b912930, align=0x0) returned 0x0
	[0259.708] GdipSetStringFormatLineAlign (format=0x1b912930, align=0x0) returned 0x0
	[0259.709] GdipSetStringFormatHotkeyPrefix (format=0x1b912930, hotkeyPrefix=2) returned 0x0
	[0259.709] GdipGetStringFormatFlags (format=0x1b912930, flags=0x20d4e0) returned 0x0
	[0259.709] GdipSetStringFormatFlags (format=0x1b912930, flags=2048) returned 0x0
	[0259.709] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x20d530) returned 0x0
	[0259.709] GdipDrawString (graphics=0x1b929550, string="               Warning\r\nDo not try to turn off the computer \r\nmore than 10 times\r\nBecause you will lose files forever", length=117, font=0x1b49ef90, layoutRect=0x20d440, stringFormat=0x1b912930, brush=0x1b913cf0) returned 0x0
	[0259.710] GdipDeleteBrush (brush=0x1b913cf0) returned 0x0
	[0259.710] GdipDeleteStringFormat (format=0x1b912930) returned 0x0
	[0259.710] GdipGetDC (graphics=0x1b929550, hdc=0x20d8e0) returned 0x0
	[0259.710] BitBlt (hdc=0x10107f8, x=0, y=0, cx=310, cy=83, hdcSrc=0x16011c5f, x1=0, y1=0, rop=0xcc0020) returned 1
	[0259.710] GdipReleaseDC (graphics=0x1b929550, hdc=0x16011c5f) returned 0x0
	[0259.710] SelectObject (hdc=0x16011c5f, h=0x185000f) returned 0x2051c60
	[0259.711] DeleteDC (hdc=0x16011c5f) returned 1
	[0259.711] GdipDeleteGraphics (graphics=0x1b929550) returned 0x0
	[0259.711] DeleteObject (ho=0x2051c60) returned 1
	[0259.711] SelectPalette (hdc=0x10107f8, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0259.711] EndPaint (hWnd=0x401a4, lpPaint=0x20d9e8) returned 1
	[0259.711] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.712] IsWindowUnicode (hWnd=0x301aa) returned 1
	[0259.712] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.712] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.712] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.712] BeginPaint (in: hWnd=0x301aa, lpPaint=0x20da88 | out: lpPaint=0x20da88) returned 0x70107fc
	[0259.712] SelectPalette (hdc=0x70107fc, hPal=0x1308070b, bForceBkgd=1) returned 0x188000b
	[0259.712] CreateCompatibleDC (hdc=0x70107fc) returned 0x2b0117ff
	[0259.712] GetObjectType (h=0x70107fc) returned 0x3
	[0259.712] CreateCompatibleBitmap (hdc=0x70107fc, cx=1, cy=1) returned 0x380517f9
	[0259.712] GetDIBits (in: hdc=0x70107fc, hbm=0x380517f9, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0259.713] GetDIBits (in: hdc=0x70107fc, hbm=0x380517f9, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x20d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x20d118) returned 1
	[0259.713] DeleteObject (ho=0x380517f9) returned 1
	[0259.713] CreateDIBSection (in: hdc=0x70107fc, lpbmi=0x20d2f0, usage=0x0, ppvBits=0x20d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x20d2e8) returned 0x3051c60
	[0259.713] SelectObject (hdc=0x2b0117ff, h=0x3051c60) returned 0x185000f
	[0259.713] GdipCreateFromHDC (hdc=0x2b0117ff, graphics=0x20d800) returned 0x0
	[0259.713] GdipTranslateWorldTransform (graphics=0x1b94e0b0, dx=0x0, dy=0x7fef1eaba58, order=0x0) returned 0x0
	[0259.714] GdipSetClipRectI (graphics=0x1b94e0b0, x=0, y=0, width=548, height=426, combineMode=0x0) returned 0x0
	[0259.714] GdipCreateMatrix (matrix=0x20d9c0) returned 0x0
	[0259.714] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f290) returned 0x0
	[0259.714] GdipIsMatrixIdentity (matrix=0x1b49f290, result=0x20da20) returned 0x0
	[0259.714] GdipGetMatrixElements (matrix=0x1b49f290, matrixOut=0x1b07c7c0) returned 0x0
	[0259.715] GdipDeleteMatrix (matrix=0x1b49f290) returned 0x0
	[0259.715] GdipCreateRegion (region=0x20d9c0) returned 0x0
	[0259.715] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913cf0) returned 0x0
	[0259.715] GdipIsInfiniteRegion (region=0x1b913cf0, graphics=0x1b94e0b0, result=0x20d9f0) returned 0x0
	[0259.715] GdipSaveGraphics (graphics=0x1b94e0b0, state=0x20dac0) returned 0x0
	[0259.715] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0259.715] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0259.716] GetSystemMetrics (nIndex=42) returned 0
	[0259.716] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0259.716] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1 | out: lpString="") returned 0
	[0259.716] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0259.716] CoTaskMemFree (pv=0x1b078860) 
	[0259.716] GetClientRect (in: hWnd=0x301aa, lpRect=0x20da20 | out: lpRect=0x20da20) returned 1
	[0259.716] GdipCreateRegion (region=0x20d4b0) returned 0x0
	[0259.716] GdipGetClip (graphics=0x1b94e0b0, region=0x1b913db0) returned 0x0
	[0259.716] GdipCreateMatrix (matrix=0x20d4b0) returned 0x0
	[0259.716] GdipGetWorldTransform (graphics=0x1b94e0b0, matrix=0x1b49f310) returned 0x0
	[0259.717] GdipIsMatrixIdentity (matrix=0x1b49f310, result=0x20d510) returned 0x0
	[0259.717] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.717] GdipCombineRegionRegion (region=0x1b913db0, region2=0x1b913cf0, combineMode=0x1) returned 0x0
	[0259.717] GdipGetMatrixElements (matrix=0x1b49f310, matrixOut=0x1b07c7c0) returned 0x0
	[0259.717] GdipDeleteMatrix (matrix=0x1b49f310) returned 0x0
	[0259.717] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d560) returned 0x0
	[0259.718] GdipIsInfiniteRegion (region=0x1b913db0, graphics=0x1b94e0b0, result=0x20d520) returned 0x0
	[0259.718] GdipGetRegionHRgn (region=0x1b913db0, graphics=0x1b94e0b0, hRgn=0x20d520) returned 0x0
	[0259.718] GdipDeleteRegion (region=0x1b913db0) returned 0x0
	[0259.718] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d590) returned 0x0
	[0259.719] GetCurrentObject (hdc=0x2b0117ff, type=0x1) returned 0x1b00017
	[0259.719] GetCurrentObject (hdc=0x2b0117ff, type=0x2) returned 0x1900010
	[0259.719] GetCurrentObject (hdc=0x2b0117ff, type=0x7) returned 0x3051c60
	[0259.720] GetCurrentObject (hdc=0x2b0117ff, type=0x6) returned 0x18a002e
	[0259.720] SaveDC (hdc=0x2b0117ff) returned 1
	[0259.720] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff830407f9
	[0259.720] GetClipRgn (hdc=0x2b0117ff, hrgn=0xffffffff830407f9) returned 0
	[0259.720] SelectClipRgn (hdc=0x2b0117ff, hrgn=0xffffffffd7040710) returned 2
	[0259.721] DeleteObject (ho=0xffffffff830407f9) returned 1
	[0259.721] DeleteObject (ho=0xffffffffd7040710) returned 1
	[0259.721] OffsetViewportOrgEx (in: hdc=0x2b0117ff, x=0, y=0, lppt=0x26e93e0 | out: lppt=0x26e93e0) returned 1
	[0259.721] GetNearestColor (hdc=0x2b0117ff, color=0xf0f0f0) returned 0xf0f0f0
	[0259.721] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffab1007c0
	[0259.721] FillRect (hDC=0x2b0117ff, lprc=0x20d560, hbr=0xffffffffab1007c0) returned 1
	[0259.722] DeleteObject (ho=0xffffffffab1007c0) returned 1
	[0259.722] RestoreDC (hdc=0x2b0117ff, nSavedDC=-1) returned 1
	[0259.722] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2b0117ff) returned 0x0
	[0259.723] GdipRestoreGraphics (graphics=0x1b94e0b0, state=0xfffffffff9220dbd) returned 0x0
	[0259.723] GdipDeleteRegion (region=0x1b913cf0) returned 0x0
	[0259.723] GetWindowTextLengthW (hWnd=0x301aa) returned 0
	[0259.723] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
	[0259.723] GetSystemMetrics (nIndex=42) returned 0
	[0259.723] CoTaskMemAlloc (cb=0x6) returned 0x1b078860
	[0259.723] GetWindowTextW (in: hWnd=0x301aa, lpString=0x1b078860, nMaxCount=1 | out: lpString="") returned 0
	[0259.723] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x301aa, Msg=0xd, wParam=0x1, lParam=0x1b078860) returned 0x0
	[0259.723] CoTaskMemFree (pv=0x1b078860) 
	[0259.723] GdipDrawImageRectI (graphics=0x1b94e0b0, image=0x1b494c00, x=0, y=0, width=658, height=456) returned 0x0
	[0259.731] GdipGetDC (graphics=0x1b94e0b0, hdc=0x20d990) returned 0x0
	[0259.732] BitBlt (hdc=0x70107fc, x=0, y=0, cx=658, cy=456, hdcSrc=0x2b0117ff, x1=0, y1=0, rop=0xcc0020) returned 1
	[0259.732] GdipReleaseDC (graphics=0x1b94e0b0, hdc=0x2b0117ff) returned 0x0
	[0259.732] SelectObject (hdc=0x2b0117ff, h=0x185000f) returned 0x3051c60
	[0259.732] DeleteDC (hdc=0x2b0117ff) returned 1
	[0259.732] GdipDeleteGraphics (graphics=0x1b94e0b0) returned 0x0
	[0259.733] DeleteObject (ho=0x3051c60) returned 1
	[0259.733] SelectPalette (hdc=0x70107fc, hPal=0x188000b, bForceBkgd=0) returned 0x1308070b
	[0259.733] EndPaint (hWnd=0x301aa, lpPaint=0x20da98) returned 1
	[0259.733] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.733] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.733] WaitMessage () returned 1
	[0259.739] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.739] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.739] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.739] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.739] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.739] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.739] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.739] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.739] GetKeyState (nVirtKey=1) returned 0
	[0259.739] GetKeyState (nVirtKey=2) returned 0
	[0259.739] GetKeyState (nVirtKey=4) returned 0
	[0259.739] GetKeyState (nVirtKey=5) returned 0
	[0259.739] GetKeyState (nVirtKey=6) returned 0
	[0259.739] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.739] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.739] WaitMessage () returned 1
	[0259.741] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.741] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.741] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.741] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.741] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.741] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.741] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.741] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.741] GetKeyState (nVirtKey=1) returned 0
	[0259.741] GetKeyState (nVirtKey=2) returned 0
	[0259.741] GetKeyState (nVirtKey=4) returned 0
	[0259.741] GetKeyState (nVirtKey=5) returned 0
	[0259.741] GetKeyState (nVirtKey=6) returned 0
	[0259.741] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.741] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.741] WaitMessage () returned 1
	[0259.742] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.742] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.742] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.742] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.742] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.742] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.742] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.742] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.742] GetKeyState (nVirtKey=1) returned 0
	[0259.742] GetKeyState (nVirtKey=2) returned 0
	[0259.742] GetKeyState (nVirtKey=4) returned 0
	[0259.742] GetKeyState (nVirtKey=5) returned 0
	[0259.742] GetKeyState (nVirtKey=6) returned 0
	[0259.742] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.742] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.742] WaitMessage () returned 1
	[0259.743] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.743] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.743] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.743] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.743] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.743] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.743] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.743] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.743] GetKeyState (nVirtKey=1) returned 0
	[0259.743] GetKeyState (nVirtKey=2) returned 0
	[0259.743] GetKeyState (nVirtKey=4) returned 0
	[0259.743] GetKeyState (nVirtKey=5) returned 0
	[0259.743] GetKeyState (nVirtKey=6) returned 0
	[0259.743] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.743] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.743] WaitMessage () returned 1
	[0259.745] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.745] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.745] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.745] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.745] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.745] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.745] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.745] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.745] GetKeyState (nVirtKey=1) returned 0
	[0259.745] GetKeyState (nVirtKey=2) returned 0
	[0259.745] GetKeyState (nVirtKey=4) returned 0
	[0259.745] GetKeyState (nVirtKey=5) returned 0
	[0259.745] GetKeyState (nVirtKey=6) returned 0
	[0259.745] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.745] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.745] WaitMessage () returned 1
	[0259.746] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.746] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.746] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.746] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.746] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.746] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.746] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.746] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.746] GetKeyState (nVirtKey=1) returned 0
	[0259.746] GetKeyState (nVirtKey=2) returned 0
	[0259.746] GetKeyState (nVirtKey=4) returned 0
	[0259.746] GetKeyState (nVirtKey=5) returned 0
	[0259.746] GetKeyState (nVirtKey=6) returned 0
	[0259.747] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.747] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.747] WaitMessage () returned 1
	[0259.747] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.747] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.747] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.747] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.748] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.748] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.748] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.748] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.748] GetKeyState (nVirtKey=1) returned 0
	[0259.748] GetKeyState (nVirtKey=2) returned 0
	[0259.748] GetKeyState (nVirtKey=4) returned 0
	[0259.748] GetKeyState (nVirtKey=5) returned 0
	[0259.748] GetKeyState (nVirtKey=6) returned 0
	[0259.748] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.748] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.748] WaitMessage () returned 1
	[0259.749] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.749] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.749] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.749] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.749] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.749] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.749] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.749] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.749] GetKeyState (nVirtKey=1) returned 0
	[0259.749] GetKeyState (nVirtKey=2) returned 0
	[0259.749] GetKeyState (nVirtKey=4) returned 0
	[0259.749] GetKeyState (nVirtKey=5) returned 0
	[0259.749] GetKeyState (nVirtKey=6) returned 0
	[0259.749] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.749] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.749] WaitMessage () returned 1
	[0259.750] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.750] IsWindowUnicode (hWnd=0x15019e) returned 1
	[0259.750] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.750] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.750] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.750] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.750] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.750] WaitMessage () returned 1
	[0259.751] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.751] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.751] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.751] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.751] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.751] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.751] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.751] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.751] GetKeyState (nVirtKey=1) returned 0
	[0259.751] GetKeyState (nVirtKey=2) returned 0
	[0259.751] GetKeyState (nVirtKey=4) returned 0
	[0259.751] GetKeyState (nVirtKey=5) returned 0
	[0259.751] GetKeyState (nVirtKey=6) returned 0
	[0259.751] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.751] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.752] WaitMessage () returned 1
	[0259.752] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.752] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.752] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.752] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.752] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.752] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.753] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.753] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.753] GetKeyState (nVirtKey=1) returned 0
	[0259.753] GetKeyState (nVirtKey=2) returned 0
	[0259.753] GetKeyState (nVirtKey=4) returned 0
	[0259.753] GetKeyState (nVirtKey=5) returned 0
	[0259.753] GetKeyState (nVirtKey=6) returned 0
	[0259.753] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.753] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.753] WaitMessage () returned 1
	[0259.754] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.754] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.754] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.754] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.754] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.754] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.754] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.754] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.754] GetKeyState (nVirtKey=1) returned 0
	[0259.754] GetKeyState (nVirtKey=2) returned 0
	[0259.754] GetKeyState (nVirtKey=4) returned 0
	[0259.754] GetKeyState (nVirtKey=5) returned 0
	[0259.754] GetKeyState (nVirtKey=6) returned 0
	[0259.754] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.754] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.754] WaitMessage () returned 1
	[0259.755] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.755] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.755] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.755] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.755] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.755] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.755] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.755] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.755] GetKeyState (nVirtKey=1) returned 0
	[0259.755] GetKeyState (nVirtKey=2) returned 0
	[0259.755] GetKeyState (nVirtKey=4) returned 0
	[0259.755] GetKeyState (nVirtKey=5) returned 0
	[0259.755] GetKeyState (nVirtKey=6) returned 0
	[0259.755] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.756] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.756] WaitMessage () returned 1
	[0259.756] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.756] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.756] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0259.756] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.757] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0259.757] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0259.757] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.757] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.757] GetKeyState (nVirtKey=1) returned 0
	[0259.757] GetKeyState (nVirtKey=2) returned 0
	[0259.757] GetKeyState (nVirtKey=4) returned 0
	[0259.757] GetKeyState (nVirtKey=5) returned 0
	[0259.757] GetKeyState (nVirtKey=6) returned 0
	[0259.757] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.757] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.757] WaitMessage () returned 1
	[0259.953] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.953] IsWindowUnicode (hWnd=0x201a0) returned 1
	[0259.953] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0259.953] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0259.953] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0259.953] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.953] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0259.953] WaitMessage () returned 1
	[0260.125] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0260.125] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0260.125] IsWindowUnicode (hWnd=0x401b4) returned 1
	[0260.125] GetMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x20e6a0) returned 1
	[0260.125] CallWindowProcW (lpPrevWndFunc=0x776f819c, hWnd=0x401b4, Msg=0x84, wParam=0x0, lParam=0x28101d5) returned 0x1
	[0260.125] SetCursor (hCursor=0xe00df) returned 0xe00df
	[0260.125] TranslateMessage (lpMsg=0x20e6b0) returned 0
	[0260.125] DispatchMessageW (lpMsg=0x20e6b0) returned 0x0
	[0260.125] GetKeyState (nVirtKey=1) returned 0
	[0260.126] GetKeyState (nVirtKey=2) returned 0
	[0260.126] GetKeyState (nVirtKey=4) returned 0
	[0260.126] GetKeyState (nVirtKey=5) returned 0
	[0260.126] GetKeyState (nVirtKey=6) returned 0
	[0260.126] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0260.126] PeekMessageW (in: lpMsg=0x20e6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x20e6a0) returned 0
	[0260.126] WaitMessage () 

Thread:
	id = 2
	os_tid = 0x2d0


Thread:
	id = 3
	os_tid = 0x1c4

	[0025.501] CoGetContextToken (in: pToken=0x1afdf090 | out: pToken=0x1afdf090) returned 0x800401f0
	[0025.501] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0054.978] CloseHandle (hObject=0x38c) returned 1

Thread:
	id = 4
	os_tid = 0x0


Thread:
	id = 5
	os_tid = 0x5e0


Thread:
	id = 6
	os_tid = 0x7c4


Thread:
	id = 7
	os_tid = 0x188


Thread:
	id = 8
	os_tid = 0x640


Thread:
	id = 9
	os_tid = 0x778


Thread:
	id = 10
	os_tid = 0x7e8


Thread:
	id = 13
	os_tid = 0x6bc


Thread:
	id = 14
	os_tid = 0x518


Thread:
	id = 38
	os_tid = 0x6f0


Thread:
	id = 54
	os_tid = 0x6f0


Thread:
	id = 90
	os_tid = 0xf0


Thread:
	id = 98
	os_tid = 0x820


Thread:
	id = 100
	os_tid = 0x828


Thread:
	id = 103
	os_tid = 0x840


Thread:
	id = 104
	os_tid = 0x844


Thread:
	id = 110
	os_tid = 0x85c


Thread:
	id = 131
	os_tid = 0x8b8


Thread:
	id = 155
	os_tid = 0x928


Thread:
	id = 159
	os_tid = 0x940


Thread:
	id = 160
	os_tid = 0x950


Thread:
	id = 183
	os_tid = 0x9b0


Thread:
	id = 186
	os_tid = 0x9bc


Thread:
	id = 191
	os_tid = 0xa08


Thread:
	id = 203
	os_tid = 0xa3c


Thread:
	id = 215
	os_tid = 0xa94


Thread:
	id = 220
	os_tid = 0xaac


Thread:
	id = 243
	os_tid = 0xb14


Thread:
	id = 247
	os_tid = 0xb24


Thread:
	id = 250
	os_tid = 0xb30


Thread:
	id = 275
	os_tid = 0xb9c


Thread:
	id = 277
	os_tid = 0xba4


Thread:
	id = 279
	os_tid = 0xbac


Thread:
	id = 289
	os_tid = 0xbe0


Thread:
	id = 291
	os_tid = 0xbe8


Thread:
	id = 306
	os_tid = 0x660


Thread:
	id = 309
	os_tid = 0x844


Thread:
	id = 331
	os_tid = 0xaa8


Thread:
	id = 337
	os_tid = 0x9f0


Thread:
	id = 339
	os_tid = 0x9d4


Thread:
	id = 341
	os_tid = 0xb0c


Thread:
	id = 343
	os_tid = 0x654


Thread:
	id = 353
	os_tid = 0x660


Thread:
	id = 355
	os_tid = 0xaa8


Thread:
	id = 363
	os_tid = 0x814


Thread:
	id = 372
	os_tid = 0x830


Thread:
	id = 376
	os_tid = 0xc0c


Thread:
	id = 388
	os_tid = 0xc40


Thread:
	id = 389
	os_tid = 0xc44


Thread:
	id = 406
	os_tid = 0xc88


Thread:
	id = 410
	os_tid = 0xc9c


Thread:
	id = 412
	os_tid = 0xca4


Thread:
	id = 431
	os_tid = 0xcf8


Thread:
	id = 438
	os_tid = 0xd18


Thread:
	id = 440
	os_tid = 0xd20


Thread:
	id = 443
	os_tid = 0xd34


Thread:
	id = 445
	os_tid = 0xd40


Thread:
	id = 464
	os_tid = 0xd94


Thread:
	id = 470
	os_tid = 0xe18


Thread:
	id = 472
	os_tid = 0xe3c


Thread:
	id = 475
	os_tid = 0xe4c


Thread:
	id = 478
	os_tid = 0xe60


Process:
	id = "2"
	image_name = "tempsvchost.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\tempsvchost.exe"
	page_root = "0x4e0b5000"
	os_pid = "0x7dc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x474"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 378
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 379
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 380
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 381
	        start_va = 0x50000
	          end_va = 0x8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 382
	        start_va = 0x90000
	          end_va = 0x18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000090000"
	        filename = ""

Region:
	              id = 383
	        start_va = 0x190000
	          end_va = 0x193fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 384
	        start_va = 0x400000
	          end_va = 0x6f5fff
	     entry_point = 0x400000
	     region_type = mapped_file
	            name = "tempsvchost.exe"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\tempsvchost.exe")

Region:
	              id = 385
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 386
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 387
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 388
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 389
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 390
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 391
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 392
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 393
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 394
	        start_va = 0x340000
	          end_va = 0x3bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000340000"
	        filename = ""

Region:
	              id = 395
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 396
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 397
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 398
	        start_va = 0x8a0000
	          end_va = 0x99ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008a0000"
	        filename = ""

Region:
	              id = 399
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 400
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 401
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 402
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 403
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 404
	        start_va = 0x1a0000
	          end_va = 0x206fff
	     entry_point = 0x1a0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 405
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 406
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 407
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 408
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 409
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 410
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 411
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 412
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 413
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 414
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 415
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 416
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 417
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 418
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 419
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 420
	        start_va = 0x300000
	          end_va = 0x30ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000300000"
	        filename = ""

Region:
	              id = 421
	        start_va = 0x700000
	          end_va = 0x887fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000700000"
	        filename = ""

Region:
	              id = 422
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 423
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 424
	        start_va = 0x20000
	          end_va = 0x20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 425
	        start_va = 0x30000
	          end_va = 0x30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 426
	        start_va = 0x9a0000
	          end_va = 0xb20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000009a0000"
	        filename = ""

Region:
	              id = 427
	        start_va = 0xb30000
	          end_va = 0x1f2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b30000"
	        filename = ""

Region:
	              id = 428
	        start_va = 0x2090000
	          end_va = 0x209ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002090000"
	        filename = ""

Region:
	              id = 429
	        start_va = 0x20a0000
	          end_va = 0x2215fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020a0000"
	        filename = ""

Region:
	              id = 430
	        start_va = 0x2220000
	          end_va = 0x24eefff
	     entry_point = 0x2220000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 431
	        start_va = 0x210000
	          end_va = 0x24ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 432
	        start_va = 0x1f30000
	          end_va = 0x202ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f30000"
	        filename = ""

Region:
	              id = 433
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 5712
	        start_va = 0x210000
	          end_va = 0x210fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000210000"
	        filename = ""

Region:
	              id = 5713
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5714
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 5715
	        start_va = 0x220000
	          end_va = 0x226fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 5716
	        start_va = 0x230000
	          end_va = 0x231fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 5717
	        start_va = 0x24f0000
	          end_va = 0x28e2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000024f0000"
	        filename = ""

Region:
	              id = 5718
	        start_va = 0x28f0000
	          end_va = 0x2acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028f0000"
	        filename = ""

Region:
	              id = 5719
	        start_va = 0x2ad0000
	          end_va = 0x33fffff
	     entry_point = 0x2ad0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 5720
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 5721
	        start_va = 0x3400000
	          end_va = 0x361ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003400000"
	        filename = ""

Region:
	              id = 5722
	        start_va = 0x1f30000
	          end_va = 0x200efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001f30000"
	        filename = ""

Region:
	              id = 5723
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 5724
	        start_va = 0x240000
	          end_va = 0x241fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000240000"
	        filename = ""

Region:
	              id = 5725
	        start_va = 0x240000
	          end_va = 0x240fff
	     entry_point = 0x240000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 5726
	        start_va = 0x250000
	          end_va = 0x251fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000250000"
	        filename = ""

Region:
	              id = 5727
	        start_va = 0x250000
	          end_va = 0x2cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 5730
	        start_va = 0x2d0000
	          end_va = 0x2d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002d0000"
	        filename = ""

Region:
	              id = 5731
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5732
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5733
	        start_va = 0x2e0000
	          end_va = 0x2e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002e0000"
	        filename = ""


Thread:
	id = 11
	os_tid = 0x7cc

	[0036.580] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x75a20000
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="lstrlenA") returned 0x75a35a4b
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="CloseHandle") returned 0x75a31410
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileA") returned 0x75a558e5
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="CreateFileA") returned 0x75a353c6
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="ExitProcess") returned 0x75a37a10
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="FindClose") returned 0x75a34442
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="FindFirstFileA") returned 0x75a3e2ce
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="FindNextFileA") returned 0x75a5d53e
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="FindResourceA") returned 0x75a4e9bb
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="FreeResource") returned 0x75a4d3db
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="GetCommandLineA") returned 0x75a351a1
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="GetEnvironmentVariableA") returned 0x75a333a0
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="GetFileAttributesA") returned 0x75a35414
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="GetFileSize") returned 0x75a3196e
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="GetFileTime") returned 0x75a34407
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="GetLogicalDrives") returned 0x75a35371
	[0036.581] GetProcAddress (hModule=0x75a20000, lpProcName="GetModuleFileNameA") returned 0x75a314b1
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="GetModuleHandleA") returned 0x75a31245
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="GetProcessHeap") returned 0x75a314e9
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="GetTempPathA") returned 0x75a5276c
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="GetWindowsDirectoryA") returned 0x75a52b0a
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="GlobalFree") returned 0x75a35558
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="HeapAlloc") returned 0x7787e026
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="LoadResource") returned 0x75a3594c
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="LockResource") returned 0x75a35959
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="MoveFileA") returned 0x75aad911
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="ReadFile") returned 0x75a33ed3
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="RtlMoveMemory") returned 0x778b3c40
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="SetErrorMode") returned 0x75a31b00
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="SetFilePointer") returned 0x75a317d1
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="SetFileTime") returned 0x75a4ecbb
	[0036.582] GetProcAddress (hModule=0x75a20000, lpProcName="SizeofResource") returned 0x75a35ac9
	[0036.583] GetProcAddress (hModule=0x75a20000, lpProcName="WriteFile") returned 0x75a31282
	[0036.583] GetProcAddress (hModule=0x75a20000, lpProcName="lstrcatA") returned 0x75a52b7a
	[0036.583] GetProcAddress (hModule=0x75a20000, lpProcName="lstrcmpA") returned 0x75a4eceb
	[0036.583] GetProcAddress (hModule=0x75a20000, lpProcName="lstrcmpiA") returned 0x75a33e8e
	[0036.583] GetProcAddress (hModule=0x75a20000, lpProcName="lstrcpyA") returned 0x75a52a9d
	[0036.583] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75b30000
	[0036.583] GetProcAddress (hModule=0x75b30000, lpProcName="RegCreateKeyExA") returned 0x75b41469
	[0036.583] GetProcAddress (hModule=0x75b30000, lpProcName="CryptCreateHash") returned 0x75b3df4e
	[0036.583] GetProcAddress (hModule=0x75b30000, lpProcName="CryptDestroyHash") returned 0x75b3df66
	[0036.583] GetProcAddress (hModule=0x75b30000, lpProcName="CryptGetHashParam") returned 0x75b3df7e
	[0036.583] GetProcAddress (hModule=0x75b30000, lpProcName="RegSetValueExA") returned 0x75b414b3
	[0036.584] GetProcAddress (hModule=0x75b30000, lpProcName="RegDeleteKeyA") returned 0x75b5a8b7
	[0036.584] GetProcAddress (hModule=0x75b30000, lpProcName="CryptAcquireContextA") returned 0x75b391dd
	[0036.584] GetProcAddress (hModule=0x75b30000, lpProcName="RegCloseKey") returned 0x75b4469d
	[0036.584] GetProcAddress (hModule=0x75b30000, lpProcName="CryptReleaseContext") returned 0x75b3e124
	[0036.584] GetProcAddress (hModule=0x75b30000, lpProcName="CryptHashData") returned 0x75b3df36
	[0036.584] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x75140000
	[0036.584] GetProcAddress (hModule=0x75140000, lpProcName="InitCommonControls") returned 0x75141739
	[0036.584] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x773c0000
	[0036.584] GetProcAddress (hModule=0x773c0000, lpProcName="CreateFontIndirectA") returned 0x773dcffd
	[0036.584] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76670000
	[0036.584] GetProcAddress (hModule=0x76670000, lpProcName="ShellExecuteA") returned 0x768b7078
	[0036.584] GetProcAddress (hModule=0x76670000, lpProcName="SHGetSpecialFolderPathA") returned 0x768bfb26
	[0036.584] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x75ce0000
	[0036.584] GetProcAddress (hModule=0x75ce0000, lpProcName="PathFindFileNameA") returned 0x75cf00aa
	[0036.585] GetProcAddress (hModule=0x75ce0000, lpProcName="PathFindExtensionA") returned 0x75d0eced
	[0036.585] GetProcAddress (hModule=0x75ce0000, lpProcName="PathAddBackslashA") returned 0x75cecf33
	[0036.585] GetProcAddress (hModule=0x75ce0000, lpProcName="PathMatchSpecA") returned 0x75d1af13
	[0036.585] LoadLibraryA (lpLibFileName="user32.dll") returned 0x756f0000
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="RegisterClassExA") returned 0x7570db98
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="PeekMessageA") returned 0x75715f74
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="SendMessageA") returned 0x7571612e
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="LoadCursorA") returned 0x7570dad5
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="GetSystemMetrics") returned 0x75707d2f
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="GetMessageA") returned 0x75707bd3
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="GetDlgItemTextA") returned 0x75766b36
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="EndPaint") returned 0x75711341
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="SystemParametersInfoA") returned 0x75716c30
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="TranslateMessage") returned 0x75707809
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="UpdateWindow") returned 0x75713559
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="MessageBoxA") returned 0x7575fd1e
	[0036.585] GetProcAddress (hModule=0x756f0000, lpProcName="DispatchMessageA") returned 0x75707bbb
	[0036.586] GetProcAddress (hModule=0x756f0000, lpProcName="DefWindowProcA") returned 0x778924e0
	[0036.586] GetProcAddress (hModule=0x756f0000, lpProcName="CreateWindowExA") returned 0x7570d22e
	[0036.586] GetProcAddress (hModule=0x756f0000, lpProcName="BeginPaint") returned 0x75711361
	[0036.586] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1
	[0036.586] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1
	[0036.586] FindResourceA (hModule=0x0, lpName=0xe, lpType=0x2) returned 0x6f50c0
	[0036.586] SizeofResource (hModule=0x0, hResInfo=0x6f50c0) returned 0x2ff
	[0036.586] LoadResource (hModule=0x0, hResInfo=0x6f50c0) returned 0x6f2ad4
	[0036.586] LockResource (hResData=0x6f2ad4) returned 0x6f2ad4
	[0036.586] RtlMoveMemory (in: Destination=0x406db9, Source=0x6f2ad4, Length=0x10 | out: Destination=0x406db9) 
	[0036.586] RtlMoveMemory (in: Destination=0x8b4988, Source=0x6f2ae8, Length=0x172 | out: Destination=0x8b4988) 
	[0036.586] RtlMoveMemory (in: Destination=0x8b4b08, Source=0x6f2c5e, Length=0x127 | out: Destination=0x8b4b08) 
	[0036.586] RtlMoveMemory (in: Destination=0x8b1158, Source=0x6f2d89, Length=0x5 | out: Destination=0x8b1158) 
	[0036.586] RtlMoveMemory (in: Destination=0x406dc9, Source=0x6f2d8e, Length=0x10 | out: Destination=0x406dc9) 
	[0036.586] RtlMoveMemory (in: Destination=0x407529, Source=0x6f2d9e, Length=0x5 | out: Destination=0x407529) 
	[0036.586] RtlMoveMemory (in: Destination=0x406dd9, Source=0x6f2da3, Length=0x10 | out: Destination=0x406dd9) 
	[0036.586] RtlMoveMemory (in: Destination=0x406de9, Source=0x6f2db3, Length=0x10 | out: Destination=0x406de9) 
	[0036.586] RtlMoveMemory (in: Destination=0x407525, Source=0x6f2dc3, Length=0x4 | out: Destination=0x407525) 
	[0036.586] RtlMoveMemory (in: Destination=0x4065a5, Source=0x6f2dc7, Length=0x4 | out: Destination=0x4065a5) 
	[0036.586] RtlMoveMemory (in: Destination=0x4065a9, Source=0x6f2dcb, Length=0x4 | out: Destination=0x4065a9) 
	[0036.586] RtlMoveMemory (in: Destination=0x4065ad, Source=0x6f2dcf, Length=0x4 | out: Destination=0x4065ad) 
	[0036.586] FreeResource (hResData=0x6f2ad4) returned 0
	[0036.586] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x404e50 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
	[0036.587] lstrcpyA (in: lpString1=0x405950, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\"
	[0036.587] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x405450, nSize=0x500 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\tempsvchost.exe")) returned 0x3b
	[0036.587] GetWindowsDirectoryA (in: lpBuffer=0x40755e, uSize=0x200 | out: lpBuffer="C:\\Windows") returned 0xa
	[0036.587] PathAddBackslashA (in: pszPath="C:\\Windows" | out: pszPath="C:\\Windows\\") returned=""
	[0036.587] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="explorer.exe" | out: lpString1="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe"
	[0036.587] CreateFileA (lpFileName="C:\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74
	[0036.587] GetFileTime (in: hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556 | out: lpCreationTime=0x407546*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastAccessTime=0x40754e*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastWriteTime=0x407556*(dwLowDateTime=0x90d6c893, dwHighDateTime=0x1cb892b)) returned 1
	[0036.587] CloseHandle (hObject=0x74) returned 1
	[0036.587] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="Bdx48saERp3j6l1" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1"
	[0036.587] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1", lpString2=".exe" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe"
	[0036.588] CopyFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Tempsvchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\tempsvchost.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bdx48saerp3j6l1.exe"), bFailIfExists=1) returned 1
	[0036.592] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bdx48saerp3j6l1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78
	[0036.592] SetFileTime (hFile=0x78, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.592] CloseHandle (hObject=0x78) returned 1
	[0036.592] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff6c, lpdwDisposition=0x18ff70 | out: phkResult=0x18ff6c*=0x78, lpdwDisposition=0x18ff70*=0x2) returned 0x0
	[0036.592] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe") returned 56
	[0036.592] RegSetValueExA (in: hKey=0x78, lpValueName="Alcmeter", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe") returned 0x0
	[0036.593] RegCloseKey (hKey=0x78) returned 0x0
	[0036.593] lstrcpyA (in: lpString1=0x4065b9, lpString2="." | out: lpString1=".") returned="."
	[0036.593] lstrcatA (in: lpString1=".", lpString2="Boom" | out: lpString1=".Boom") returned=".Boom"
	[0036.593] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey=".Boom", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x7e, lpdwDisposition=0x18ff6c*=0x1) returned 0x0
	[0036.595] lstrlenA (lpString="SSTWIPNUVDUSGRM") returned 15
	[0036.595] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="SSTWIPNUVDUSGRM", cbData=0xf | out: lpData="SSTWIPNUVDUSGRM") returned 0x0
	[0036.595] RegCloseKey (hKey=0x7e) returned 0x0
	[0036.595] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="SSTWIPNUVDUSGRM", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x76, lpdwDisposition=0x18ff6c*=0x1) returned 0x0
	[0036.596] lstrlenA (lpString="CRYPTED!") returned 8
	[0036.596] RegSetValueExA (in: hKey=0x76, lpValueName="", Reserved=0x0, dwType=0x1, lpData="CRYPTED!", cbData=0x8 | out: lpData="CRYPTED!") returned 0x0
	[0036.596] RegCloseKey (hKey=0x76) returned 0x0
	[0036.596] lstrcpyA (in: lpString1=0x4065b9, lpString2="SSTWIPNUVDUSGRM" | out: lpString1="SSTWIPNUVDUSGRM") returned="SSTWIPNUVDUSGRM"
	[0036.596] lstrcatA (in: lpString1="SSTWIPNUVDUSGRM", lpString2="\\DefaultIcon" | out: lpString1="SSTWIPNUVDUSGRM\\DefaultIcon") returned="SSTWIPNUVDUSGRM\\DefaultIcon"
	[0036.596] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe", lpString2=",0" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe,0") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe,0"
	[0036.596] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="SSTWIPNUVDUSGRM\\DefaultIcon", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x7e, lpdwDisposition=0x18ff6c*=0x1) returned 0x0
	[0036.597] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe,0") returned 58
	[0036.597] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe,0", cbData=0x3a | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe,0") returned 0x0
	[0036.597] RegCloseKey (hKey=0x7e) returned 0x0
	[0036.597] lstrcpyA (in: lpString1=0x4065b9, lpString2="SSTWIPNUVDUSGRM" | out: lpString1="SSTWIPNUVDUSGRM") returned="SSTWIPNUVDUSGRM"
	[0036.597] lstrcatA (in: lpString1="SSTWIPNUVDUSGRM", lpString2="\\shell\\open\\command" | out: lpString1="SSTWIPNUVDUSGRM\\shell\\open\\command") returned="SSTWIPNUVDUSGRM\\shell\\open\\command"
	[0036.597] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe,0") returned 58
	[0036.598] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="SSTWIPNUVDUSGRM\\shell\\open\\command", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x82, lpdwDisposition=0x18ff6c*=0x1) returned 0x0
	[0036.599] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe") returned 56
	[0036.599] RegSetValueExA (in: hKey=0x82, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe") returned 0x0
	[0036.599] RegCloseKey (hKey=0x82) returned 0x0
	[0036.599] SetErrorMode (uMode=0x1) returned 0x0
	[0036.599] GetLogicalDrives () returned 0x4
	[0036.599] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 0x8b0d68
	[0036.599] lstrcmpA (lpString1=".", lpString2="$Recycle.Bin") returned 1
	[0036.602] lstrcmpA (lpString1="..", lpString2="$Recycle.Bin") returned 1
	[0036.602] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0036.603] lstrcatA (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin"
	[0036.603] lstrlenA (lpString="C:\\$Recycle.Bin") returned 15
	[0036.603] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b4de8
	[0036.603] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.603] FindNextFileA (in: hFindFile=0x8b4de8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.603] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.603] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.603] FindNextFileA (in: hFindFile=0x8b4de8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.603] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0036.603] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0036.603] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*"
	[0036.603] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000"
	[0036.603] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0036.603] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b5ec0
	[0036.603] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.603] FindNextFileA (in: hFindFile=0x8b5ec0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.603] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.603] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.603] FindNextFileA (in: hFindFile=0x8b5ec0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.603] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.604] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1
	[0036.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1
	[0036.604] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0036.604] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned="*.*"
	[0036.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\"
	[0036.604] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned=""
	[0036.604] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt"
	[0036.604] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0xffffffff
	[0036.604] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.605] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.605] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.606] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.606] CloseHandle (hObject=0x84) returned 1
	[0036.607] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"
	[0036.607] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.zip") returned 0
	[0036.623] lstrlenA (lpString="*.zip") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.rar") returned 0
	[0036.623] lstrlenA (lpString="*.rar") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.7z") returned 0
	[0036.623] lstrlenA (lpString="*.7z") returned 4
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.tar") returned 0
	[0036.623] lstrlenA (lpString="*.tar") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gzip") returned 0
	[0036.623] lstrlenA (lpString="*.gzip") returned 6
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpg") returned 0
	[0036.623] lstrlenA (lpString="*.jpg") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpeg") returned 0
	[0036.623] lstrlenA (lpString="*.jpeg") returned 6
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.psd") returned 0
	[0036.623] lstrlenA (lpString="*.psd") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.cdr") returned 0
	[0036.623] lstrlenA (lpString="*.cdr") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dwg") returned 0
	[0036.623] lstrlenA (lpString="*.dwg") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.max") returned 0
	[0036.623] lstrlenA (lpString="*.max") returned 5
	[0036.623] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.bmp") returned 0
	[0036.623] lstrlenA (lpString="*.bmp") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gif") returned 0
	[0036.624] lstrlenA (lpString="*.gif") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.png") returned 0
	[0036.624] lstrlenA (lpString="*.png") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.doc") returned 0
	[0036.624] lstrlenA (lpString="*.doc") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.docx") returned 0
	[0036.624] lstrlenA (lpString="*.docx") returned 6
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xls") returned 0
	[0036.624] lstrlenA (lpString="*.xls") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xlsx") returned 0
	[0036.624] lstrlenA (lpString="*.xlsx") returned 6
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ppt") returned 0
	[0036.624] lstrlenA (lpString="*.ppt") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pptx") returned 0
	[0036.624] lstrlenA (lpString="*.pptx") returned 6
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.txt") returned 0
	[0036.624] lstrlenA (lpString="*.txt") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pdf") returned 0
	[0036.624] lstrlenA (lpString="*.pdf") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.djvu") returned 0
	[0036.624] lstrlenA (lpString="*.djvu") returned 6
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.htm") returned 0
	[0036.624] lstrlenA (lpString="*.htm") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.html") returned 0
	[0036.624] lstrlenA (lpString="*.html") returned 6
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mdb") returned 0
	[0036.624] lstrlenA (lpString="*.mdb") returned 5
	[0036.624] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.cer") returned 0
	[0036.624] lstrlenA (lpString="*.cer") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.p12") returned 0
	[0036.625] lstrlenA (lpString="*.p12") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pfx") returned 0
	[0036.625] lstrlenA (lpString="*.pfx") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.kwm") returned 0
	[0036.625] lstrlenA (lpString="*.kwm") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pwm") returned 0
	[0036.625] lstrlenA (lpString="*.pwm") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.1cd") returned 0
	[0036.625] lstrlenA (lpString="*.1cd") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.md") returned 0
	[0036.625] lstrlenA (lpString="*.md") returned 4
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mdf") returned 0
	[0036.625] lstrlenA (lpString="*.mdf") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dbf") returned 0
	[0036.625] lstrlenA (lpString="*.dbf") returned 5
	[0036.625] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.odt") returned 0
	[0036.625] lstrlenA (lpString="*.odt") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.vob") returned 0
	[0036.626] lstrlenA (lpString="*.vob") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ifo") returned 0
	[0036.626] lstrlenA (lpString="*.ifo") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.lnk") returned 0
	[0036.626] lstrlenA (lpString="*.lnk") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.torrent") returned 0
	[0036.626] lstrlenA (lpString="*.torrent") returned 9
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mov") returned 0
	[0036.626] lstrlenA (lpString="*.mov") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.m2v") returned 0
	[0036.626] lstrlenA (lpString="*.m2v") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.3gp") returned 0
	[0036.626] lstrlenA (lpString="*.3gp") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mpeg") returned 0
	[0036.626] lstrlenA (lpString="*.mpeg") returned 6
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mpg") returned 0
	[0036.626] lstrlenA (lpString="*.mpg") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.flv") returned 0
	[0036.626] lstrlenA (lpString="*.flv") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.avi") returned 0
	[0036.626] lstrlenA (lpString="*.avi") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp4") returned 0
	[0036.626] lstrlenA (lpString="*.mp4") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wmv") returned 0
	[0036.626] lstrlenA (lpString="*.wmv") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.divx") returned 0
	[0036.626] lstrlenA (lpString="*.divx") returned 6
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mkv") returned 0
	[0036.626] lstrlenA (lpString="*.mkv") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp3") returned 0
	[0036.626] lstrlenA (lpString="*.mp3") returned 5
	[0036.626] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wav") returned 0
	[0036.627] lstrlenA (lpString="*.wav") returned 5
	[0036.627] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.flac") returned 0
	[0036.627] lstrlenA (lpString="*.flac") returned 6
	[0036.627] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ape") returned 0
	[0036.627] lstrlenA (lpString="*.ape") returned 5
	[0036.627] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wma") returned 0
	[0036.627] lstrlenA (lpString="*.wma") returned 5
	[0036.627] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ac3") returned 0
	[0036.627] lstrlenA (lpString="*.ac3") returned 5
	[0036.627] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.exe") returned 0
	[0036.627] lstrlenA (lpString="*.exe") returned 5
	[0036.627] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.apk") returned 0
	[0036.627] lstrlenA (lpString="*.apk") returned 5
	[0036.627] FindNextFileA (in: hFindFile=0x8b5ec0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.627] FindClose (in: hFindFile=0x8b5ec0 | out: hFindFile=0x8b5ec0) returned 1
	[0036.627] FindNextFileA (in: hFindFile=0x8b4de8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0
	[0036.627] FindClose (in: hFindFile=0x8b4de8 | out: hFindFile=0x8b4de8) returned 1
	[0036.627] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0036.627] lstrcmpA (lpString1=".", lpString2="Boot") returned -1
	[0036.627] lstrcmpA (lpString1="..", lpString2="Boot") returned -1
	[0036.627] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0036.627] lstrcatA (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot"
	[0036.627] lstrlenA (lpString="C:\\Boot") returned 7
	[0036.627] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b5de0
	[0036.628] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.628] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.628] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.628] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.628] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.628] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0
	[0036.628] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD") returned 1
	[0036.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1
	[0036.628] lstrcmpiA (lpString1="", lpString2="BCD") returned -1
	[0036.628] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0036.628] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0036.628] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt"
	[0036.628] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0xffffffff
	[0036.628] CreateFileA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74
	[0036.629] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.629] WriteFile (in: hFile=0x74, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.629] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.630] CloseHandle (hObject=0x74) returned 1
	[0036.630] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD"
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.zip") returned 0
	[0036.630] lstrlenA (lpString="*.zip") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rar") returned 0
	[0036.630] lstrlenA (lpString="*.rar") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.7z") returned 0
	[0036.630] lstrlenA (lpString="*.7z") returned 4
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tar") returned 0
	[0036.630] lstrlenA (lpString="*.tar") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gzip") returned 0
	[0036.630] lstrlenA (lpString="*.gzip") returned 6
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpg") returned 0
	[0036.630] lstrlenA (lpString="*.jpg") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpeg") returned 0
	[0036.630] lstrlenA (lpString="*.jpeg") returned 6
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.psd") returned 0
	[0036.630] lstrlenA (lpString="*.psd") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cdr") returned 0
	[0036.630] lstrlenA (lpString="*.cdr") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dwg") returned 0
	[0036.630] lstrlenA (lpString="*.dwg") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.max") returned 0
	[0036.630] lstrlenA (lpString="*.max") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bmp") returned 0
	[0036.630] lstrlenA (lpString="*.bmp") returned 5
	[0036.630] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gif") returned 0
	[0036.631] lstrlenA (lpString="*.gif") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.png") returned 0
	[0036.631] lstrlenA (lpString="*.png") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0
	[0036.631] lstrlenA (lpString="*.doc") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docx") returned 0
	[0036.631] lstrlenA (lpString="*.docx") returned 6
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xls") returned 0
	[0036.631] lstrlenA (lpString="*.xls") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsx") returned 0
	[0036.631] lstrlenA (lpString="*.xlsx") returned 6
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ppt") returned 0
	[0036.631] lstrlenA (lpString="*.ppt") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pptx") returned 0
	[0036.631] lstrlenA (lpString="*.pptx") returned 6
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.txt") returned 0
	[0036.631] lstrlenA (lpString="*.txt") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pdf") returned 0
	[0036.631] lstrlenA (lpString="*.pdf") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.djvu") returned 0
	[0036.631] lstrlenA (lpString="*.djvu") returned 6
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.htm") returned 0
	[0036.631] lstrlenA (lpString="*.htm") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.html") returned 0
	[0036.631] lstrlenA (lpString="*.html") returned 6
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdb") returned 0
	[0036.631] lstrlenA (lpString="*.mdb") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cer") returned 0
	[0036.631] lstrlenA (lpString="*.cer") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.p12") returned 0
	[0036.631] lstrlenA (lpString="*.p12") returned 5
	[0036.631] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pfx") returned 0
	[0036.631] lstrlenA (lpString="*.pfx") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.kwm") returned 0
	[0036.632] lstrlenA (lpString="*.kwm") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pwm") returned 0
	[0036.632] lstrlenA (lpString="*.pwm") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.1cd") returned 0
	[0036.632] lstrlenA (lpString="*.1cd") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.md") returned 0
	[0036.632] lstrlenA (lpString="*.md") returned 4
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdf") returned 0
	[0036.632] lstrlenA (lpString="*.mdf") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dbf") returned 0
	[0036.632] lstrlenA (lpString="*.dbf") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.odt") returned 0
	[0036.632] lstrlenA (lpString="*.odt") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vob") returned 0
	[0036.632] lstrlenA (lpString="*.vob") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ifo") returned 0
	[0036.632] lstrlenA (lpString="*.ifo") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.lnk") returned 0
	[0036.632] lstrlenA (lpString="*.lnk") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.torrent") returned 0
	[0036.632] lstrlenA (lpString="*.torrent") returned 9
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mov") returned 0
	[0036.632] lstrlenA (lpString="*.mov") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.m2v") returned 0
	[0036.632] lstrlenA (lpString="*.m2v") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.3gp") returned 0
	[0036.632] lstrlenA (lpString="*.3gp") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpeg") returned 0
	[0036.632] lstrlenA (lpString="*.mpeg") returned 6
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpg") returned 0
	[0036.632] lstrlenA (lpString="*.mpg") returned 5
	[0036.632] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flv") returned 0
	[0036.633] lstrlenA (lpString="*.flv") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.avi") returned 0
	[0036.633] lstrlenA (lpString="*.avi") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp4") returned 0
	[0036.633] lstrlenA (lpString="*.mp4") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wmv") returned 0
	[0036.633] lstrlenA (lpString="*.wmv") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.divx") returned 0
	[0036.633] lstrlenA (lpString="*.divx") returned 6
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mkv") returned 0
	[0036.633] lstrlenA (lpString="*.mkv") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp3") returned 0
	[0036.633] lstrlenA (lpString="*.mp3") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wav") returned 0
	[0036.633] lstrlenA (lpString="*.wav") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flac") returned 0
	[0036.633] lstrlenA (lpString="*.flac") returned 6
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ape") returned 0
	[0036.633] lstrlenA (lpString="*.ape") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wma") returned 0
	[0036.633] lstrlenA (lpString="*.wma") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ac3") returned 0
	[0036.633] lstrlenA (lpString="*.ac3") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.exe") returned 0
	[0036.633] lstrlenA (lpString="*.exe") returned 5
	[0036.633] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.apk") returned 0
	[0036.633] lstrlenA (lpString="*.apk") returned 5
	[0036.633] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.633] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0
	[0036.633] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD.LOG") returned 1
	[0036.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG") returned 1
	[0036.633] lstrcmpiA (lpString1="", lpString2="BCD.LOG") returned -1
	[0036.633] PathFindFileNameA (pszPath="C:\\Boot\\BCD") returned="BCD"
	[0036.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0036.634] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0036.634] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt"
	[0036.634] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20
	[0036.634] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG"
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.zip") returned 0
	[0036.634] lstrlenA (lpString="*.zip") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rar") returned 0
	[0036.634] lstrlenA (lpString="*.rar") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.7z") returned 0
	[0036.634] lstrlenA (lpString="*.7z") returned 4
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tar") returned 0
	[0036.634] lstrlenA (lpString="*.tar") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gzip") returned 0
	[0036.634] lstrlenA (lpString="*.gzip") returned 6
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpg") returned 0
	[0036.634] lstrlenA (lpString="*.jpg") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpeg") returned 0
	[0036.634] lstrlenA (lpString="*.jpeg") returned 6
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.psd") returned 0
	[0036.634] lstrlenA (lpString="*.psd") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cdr") returned 0
	[0036.634] lstrlenA (lpString="*.cdr") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dwg") returned 0
	[0036.634] lstrlenA (lpString="*.dwg") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.max") returned 0
	[0036.634] lstrlenA (lpString="*.max") returned 5
	[0036.634] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bmp") returned 0
	[0036.634] lstrlenA (lpString="*.bmp") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gif") returned 0
	[0036.635] lstrlenA (lpString="*.gif") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.png") returned 0
	[0036.635] lstrlenA (lpString="*.png") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0
	[0036.635] lstrlenA (lpString="*.doc") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docx") returned 0
	[0036.635] lstrlenA (lpString="*.docx") returned 6
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xls") returned 0
	[0036.635] lstrlenA (lpString="*.xls") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsx") returned 0
	[0036.635] lstrlenA (lpString="*.xlsx") returned 6
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ppt") returned 0
	[0036.635] lstrlenA (lpString="*.ppt") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pptx") returned 0
	[0036.635] lstrlenA (lpString="*.pptx") returned 6
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.txt") returned 0
	[0036.635] lstrlenA (lpString="*.txt") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pdf") returned 0
	[0036.635] lstrlenA (lpString="*.pdf") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.djvu") returned 0
	[0036.635] lstrlenA (lpString="*.djvu") returned 6
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.htm") returned 0
	[0036.635] lstrlenA (lpString="*.htm") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.html") returned 0
	[0036.635] lstrlenA (lpString="*.html") returned 6
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdb") returned 0
	[0036.635] lstrlenA (lpString="*.mdb") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cer") returned 0
	[0036.635] lstrlenA (lpString="*.cer") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.p12") returned 0
	[0036.635] lstrlenA (lpString="*.p12") returned 5
	[0036.635] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pfx") returned 0
	[0036.635] lstrlenA (lpString="*.pfx") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.kwm") returned 0
	[0036.636] lstrlenA (lpString="*.kwm") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pwm") returned 0
	[0036.636] lstrlenA (lpString="*.pwm") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.1cd") returned 0
	[0036.636] lstrlenA (lpString="*.1cd") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.md") returned 0
	[0036.636] lstrlenA (lpString="*.md") returned 4
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdf") returned 0
	[0036.636] lstrlenA (lpString="*.mdf") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dbf") returned 0
	[0036.636] lstrlenA (lpString="*.dbf") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.odt") returned 0
	[0036.636] lstrlenA (lpString="*.odt") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vob") returned 0
	[0036.636] lstrlenA (lpString="*.vob") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ifo") returned 0
	[0036.636] lstrlenA (lpString="*.ifo") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.lnk") returned 0
	[0036.636] lstrlenA (lpString="*.lnk") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.torrent") returned 0
	[0036.636] lstrlenA (lpString="*.torrent") returned 9
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mov") returned 0
	[0036.636] lstrlenA (lpString="*.mov") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.m2v") returned 0
	[0036.636] lstrlenA (lpString="*.m2v") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.3gp") returned 0
	[0036.636] lstrlenA (lpString="*.3gp") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpeg") returned 0
	[0036.636] lstrlenA (lpString="*.mpeg") returned 6
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpg") returned 0
	[0036.636] lstrlenA (lpString="*.mpg") returned 5
	[0036.636] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flv") returned 0
	[0036.637] lstrlenA (lpString="*.flv") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.avi") returned 0
	[0036.637] lstrlenA (lpString="*.avi") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp4") returned 0
	[0036.637] lstrlenA (lpString="*.mp4") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wmv") returned 0
	[0036.637] lstrlenA (lpString="*.wmv") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.divx") returned 0
	[0036.637] lstrlenA (lpString="*.divx") returned 6
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mkv") returned 0
	[0036.637] lstrlenA (lpString="*.mkv") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp3") returned 0
	[0036.637] lstrlenA (lpString="*.mp3") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wav") returned 0
	[0036.637] lstrlenA (lpString="*.wav") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flac") returned 0
	[0036.637] lstrlenA (lpString="*.flac") returned 6
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ape") returned 0
	[0036.637] lstrlenA (lpString="*.ape") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wma") returned 0
	[0036.637] lstrlenA (lpString="*.wma") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ac3") returned 0
	[0036.637] lstrlenA (lpString="*.ac3") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.exe") returned 0
	[0036.637] lstrlenA (lpString="*.exe") returned 5
	[0036.637] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.apk") returned 0
	[0036.637] lstrlenA (lpString="*.apk") returned 5
	[0036.637] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.637] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0
	[0036.637] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD.LOG1") returned 1
	[0036.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG1") returned 1
	[0036.637] lstrcmpiA (lpString1="", lpString2="BCD.LOG1") returned -1
	[0036.637] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG") returned="BCD.LOG"
	[0036.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0036.638] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0036.638] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt"
	[0036.638] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20
	[0036.638] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1"
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.zip") returned 0
	[0036.638] lstrlenA (lpString="*.zip") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rar") returned 0
	[0036.638] lstrlenA (lpString="*.rar") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.7z") returned 0
	[0036.638] lstrlenA (lpString="*.7z") returned 4
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tar") returned 0
	[0036.638] lstrlenA (lpString="*.tar") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gzip") returned 0
	[0036.638] lstrlenA (lpString="*.gzip") returned 6
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpg") returned 0
	[0036.638] lstrlenA (lpString="*.jpg") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpeg") returned 0
	[0036.638] lstrlenA (lpString="*.jpeg") returned 6
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.psd") returned 0
	[0036.638] lstrlenA (lpString="*.psd") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cdr") returned 0
	[0036.638] lstrlenA (lpString="*.cdr") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dwg") returned 0
	[0036.638] lstrlenA (lpString="*.dwg") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.max") returned 0
	[0036.638] lstrlenA (lpString="*.max") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bmp") returned 0
	[0036.638] lstrlenA (lpString="*.bmp") returned 5
	[0036.638] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gif") returned 0
	[0036.639] lstrlenA (lpString="*.gif") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.png") returned 0
	[0036.639] lstrlenA (lpString="*.png") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0
	[0036.639] lstrlenA (lpString="*.doc") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docx") returned 0
	[0036.639] lstrlenA (lpString="*.docx") returned 6
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xls") returned 0
	[0036.639] lstrlenA (lpString="*.xls") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsx") returned 0
	[0036.639] lstrlenA (lpString="*.xlsx") returned 6
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ppt") returned 0
	[0036.639] lstrlenA (lpString="*.ppt") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pptx") returned 0
	[0036.639] lstrlenA (lpString="*.pptx") returned 6
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.txt") returned 0
	[0036.639] lstrlenA (lpString="*.txt") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pdf") returned 0
	[0036.639] lstrlenA (lpString="*.pdf") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.djvu") returned 0
	[0036.639] lstrlenA (lpString="*.djvu") returned 6
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.htm") returned 0
	[0036.639] lstrlenA (lpString="*.htm") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.html") returned 0
	[0036.639] lstrlenA (lpString="*.html") returned 6
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdb") returned 0
	[0036.639] lstrlenA (lpString="*.mdb") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cer") returned 0
	[0036.639] lstrlenA (lpString="*.cer") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.p12") returned 0
	[0036.639] lstrlenA (lpString="*.p12") returned 5
	[0036.639] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pfx") returned 0
	[0036.639] lstrlenA (lpString="*.pfx") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.kwm") returned 0
	[0036.640] lstrlenA (lpString="*.kwm") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pwm") returned 0
	[0036.640] lstrlenA (lpString="*.pwm") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.1cd") returned 0
	[0036.640] lstrlenA (lpString="*.1cd") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.md") returned 0
	[0036.640] lstrlenA (lpString="*.md") returned 4
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdf") returned 0
	[0036.640] lstrlenA (lpString="*.mdf") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dbf") returned 0
	[0036.640] lstrlenA (lpString="*.dbf") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.odt") returned 0
	[0036.640] lstrlenA (lpString="*.odt") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vob") returned 0
	[0036.640] lstrlenA (lpString="*.vob") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ifo") returned 0
	[0036.640] lstrlenA (lpString="*.ifo") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.lnk") returned 0
	[0036.640] lstrlenA (lpString="*.lnk") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.torrent") returned 0
	[0036.640] lstrlenA (lpString="*.torrent") returned 9
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mov") returned 0
	[0036.640] lstrlenA (lpString="*.mov") returned 5
	[0036.640] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.m2v") returned 0
	[0036.641] lstrlenA (lpString="*.m2v") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.3gp") returned 0
	[0036.641] lstrlenA (lpString="*.3gp") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpeg") returned 0
	[0036.641] lstrlenA (lpString="*.mpeg") returned 6
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpg") returned 0
	[0036.641] lstrlenA (lpString="*.mpg") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flv") returned 0
	[0036.641] lstrlenA (lpString="*.flv") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.avi") returned 0
	[0036.641] lstrlenA (lpString="*.avi") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp4") returned 0
	[0036.641] lstrlenA (lpString="*.mp4") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wmv") returned 0
	[0036.641] lstrlenA (lpString="*.wmv") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.divx") returned 0
	[0036.641] lstrlenA (lpString="*.divx") returned 6
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mkv") returned 0
	[0036.641] lstrlenA (lpString="*.mkv") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp3") returned 0
	[0036.641] lstrlenA (lpString="*.mp3") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wav") returned 0
	[0036.641] lstrlenA (lpString="*.wav") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flac") returned 0
	[0036.641] lstrlenA (lpString="*.flac") returned 6
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ape") returned 0
	[0036.641] lstrlenA (lpString="*.ape") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wma") returned 0
	[0036.641] lstrlenA (lpString="*.wma") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ac3") returned 0
	[0036.641] lstrlenA (lpString="*.ac3") returned 5
	[0036.641] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.exe") returned 0
	[0036.641] lstrlenA (lpString="*.exe") returned 5
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.apk") returned 0
	[0036.642] lstrlenA (lpString="*.apk") returned 5
	[0036.642] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.642] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0
	[0036.642] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD.LOG2") returned 1
	[0036.642] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG2") returned 1
	[0036.642] lstrcmpiA (lpString1="", lpString2="BCD.LOG2") returned -1
	[0036.642] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG1") returned="BCD.LOG1"
	[0036.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0036.642] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0036.642] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt"
	[0036.642] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20
	[0036.642] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2"
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.zip") returned 0
	[0036.642] lstrlenA (lpString="*.zip") returned 5
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rar") returned 0
	[0036.642] lstrlenA (lpString="*.rar") returned 5
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.7z") returned 0
	[0036.642] lstrlenA (lpString="*.7z") returned 4
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tar") returned 0
	[0036.642] lstrlenA (lpString="*.tar") returned 5
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gzip") returned 0
	[0036.642] lstrlenA (lpString="*.gzip") returned 6
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpg") returned 0
	[0036.642] lstrlenA (lpString="*.jpg") returned 5
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpeg") returned 0
	[0036.642] lstrlenA (lpString="*.jpeg") returned 6
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.psd") returned 0
	[0036.642] lstrlenA (lpString="*.psd") returned 5
	[0036.642] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cdr") returned 0
	[0036.643] lstrlenA (lpString="*.cdr") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dwg") returned 0
	[0036.643] lstrlenA (lpString="*.dwg") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.max") returned 0
	[0036.643] lstrlenA (lpString="*.max") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bmp") returned 0
	[0036.643] lstrlenA (lpString="*.bmp") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gif") returned 0
	[0036.643] lstrlenA (lpString="*.gif") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.png") returned 0
	[0036.643] lstrlenA (lpString="*.png") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0
	[0036.643] lstrlenA (lpString="*.doc") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docx") returned 0
	[0036.643] lstrlenA (lpString="*.docx") returned 6
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xls") returned 0
	[0036.643] lstrlenA (lpString="*.xls") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsx") returned 0
	[0036.643] lstrlenA (lpString="*.xlsx") returned 6
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ppt") returned 0
	[0036.643] lstrlenA (lpString="*.ppt") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pptx") returned 0
	[0036.643] lstrlenA (lpString="*.pptx") returned 6
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.txt") returned 0
	[0036.643] lstrlenA (lpString="*.txt") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pdf") returned 0
	[0036.643] lstrlenA (lpString="*.pdf") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.djvu") returned 0
	[0036.643] lstrlenA (lpString="*.djvu") returned 6
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.htm") returned 0
	[0036.643] lstrlenA (lpString="*.htm") returned 5
	[0036.643] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.html") returned 0
	[0036.643] lstrlenA (lpString="*.html") returned 6
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdb") returned 0
	[0036.644] lstrlenA (lpString="*.mdb") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cer") returned 0
	[0036.644] lstrlenA (lpString="*.cer") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.p12") returned 0
	[0036.644] lstrlenA (lpString="*.p12") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pfx") returned 0
	[0036.644] lstrlenA (lpString="*.pfx") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.kwm") returned 0
	[0036.644] lstrlenA (lpString="*.kwm") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pwm") returned 0
	[0036.644] lstrlenA (lpString="*.pwm") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.1cd") returned 0
	[0036.644] lstrlenA (lpString="*.1cd") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.md") returned 0
	[0036.644] lstrlenA (lpString="*.md") returned 4
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdf") returned 0
	[0036.644] lstrlenA (lpString="*.mdf") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dbf") returned 0
	[0036.644] lstrlenA (lpString="*.dbf") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.odt") returned 0
	[0036.644] lstrlenA (lpString="*.odt") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vob") returned 0
	[0036.644] lstrlenA (lpString="*.vob") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ifo") returned 0
	[0036.644] lstrlenA (lpString="*.ifo") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.lnk") returned 0
	[0036.644] lstrlenA (lpString="*.lnk") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.torrent") returned 0
	[0036.644] lstrlenA (lpString="*.torrent") returned 9
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mov") returned 0
	[0036.644] lstrlenA (lpString="*.mov") returned 5
	[0036.644] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.m2v") returned 0
	[0036.645] lstrlenA (lpString="*.m2v") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.3gp") returned 0
	[0036.645] lstrlenA (lpString="*.3gp") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpeg") returned 0
	[0036.645] lstrlenA (lpString="*.mpeg") returned 6
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpg") returned 0
	[0036.645] lstrlenA (lpString="*.mpg") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flv") returned 0
	[0036.645] lstrlenA (lpString="*.flv") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.avi") returned 0
	[0036.645] lstrlenA (lpString="*.avi") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp4") returned 0
	[0036.645] lstrlenA (lpString="*.mp4") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wmv") returned 0
	[0036.645] lstrlenA (lpString="*.wmv") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.divx") returned 0
	[0036.645] lstrlenA (lpString="*.divx") returned 6
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mkv") returned 0
	[0036.645] lstrlenA (lpString="*.mkv") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp3") returned 0
	[0036.645] lstrlenA (lpString="*.mp3") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wav") returned 0
	[0036.645] lstrlenA (lpString="*.wav") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flac") returned 0
	[0036.645] lstrlenA (lpString="*.flac") returned 6
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ape") returned 0
	[0036.645] lstrlenA (lpString="*.ape") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wma") returned 0
	[0036.645] lstrlenA (lpString="*.wma") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ac3") returned 0
	[0036.645] lstrlenA (lpString="*.ac3") returned 5
	[0036.645] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.exe") returned 0
	[0036.645] lstrlenA (lpString="*.exe") returned 5
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.apk") returned 0
	[0036.646] lstrlenA (lpString="*.apk") returned 5
	[0036.646] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.646] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0
	[0036.646] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOOTSTAT.DAT") returned 1
	[0036.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSTAT.DAT") returned 1
	[0036.646] lstrcmpiA (lpString1="", lpString2="BOOTSTAT.DAT") returned -1
	[0036.646] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG2") returned="BCD.LOG2"
	[0036.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0036.646] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0036.646] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt"
	[0036.646] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20
	[0036.646] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT"
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.zip") returned 0
	[0036.646] lstrlenA (lpString="*.zip") returned 5
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.rar") returned 0
	[0036.646] lstrlenA (lpString="*.rar") returned 5
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.7z") returned 0
	[0036.646] lstrlenA (lpString="*.7z") returned 4
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.tar") returned 0
	[0036.646] lstrlenA (lpString="*.tar") returned 5
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gzip") returned 0
	[0036.646] lstrlenA (lpString="*.gzip") returned 6
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpg") returned 0
	[0036.646] lstrlenA (lpString="*.jpg") returned 5
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpeg") returned 0
	[0036.646] lstrlenA (lpString="*.jpeg") returned 6
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.psd") returned 0
	[0036.646] lstrlenA (lpString="*.psd") returned 5
	[0036.646] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cdr") returned 0
	[0036.647] lstrlenA (lpString="*.cdr") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dwg") returned 0
	[0036.647] lstrlenA (lpString="*.dwg") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.max") returned 0
	[0036.647] lstrlenA (lpString="*.max") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.bmp") returned 0
	[0036.647] lstrlenA (lpString="*.bmp") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gif") returned 0
	[0036.647] lstrlenA (lpString="*.gif") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.png") returned 0
	[0036.647] lstrlenA (lpString="*.png") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.doc") returned 0
	[0036.647] lstrlenA (lpString="*.doc") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.docx") returned 0
	[0036.647] lstrlenA (lpString="*.docx") returned 6
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xls") returned 0
	[0036.647] lstrlenA (lpString="*.xls") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xlsx") returned 0
	[0036.647] lstrlenA (lpString="*.xlsx") returned 6
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ppt") returned 0
	[0036.647] lstrlenA (lpString="*.ppt") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pptx") returned 0
	[0036.647] lstrlenA (lpString="*.pptx") returned 6
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.txt") returned 0
	[0036.647] lstrlenA (lpString="*.txt") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pdf") returned 0
	[0036.647] lstrlenA (lpString="*.pdf") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.djvu") returned 0
	[0036.647] lstrlenA (lpString="*.djvu") returned 6
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.htm") returned 0
	[0036.647] lstrlenA (lpString="*.htm") returned 5
	[0036.647] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.html") returned 0
	[0036.648] lstrlenA (lpString="*.html") returned 6
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdb") returned 0
	[0036.648] lstrlenA (lpString="*.mdb") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cer") returned 0
	[0036.648] lstrlenA (lpString="*.cer") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.p12") returned 0
	[0036.648] lstrlenA (lpString="*.p12") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pfx") returned 0
	[0036.648] lstrlenA (lpString="*.pfx") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.kwm") returned 0
	[0036.648] lstrlenA (lpString="*.kwm") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pwm") returned 0
	[0036.648] lstrlenA (lpString="*.pwm") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.1cd") returned 0
	[0036.648] lstrlenA (lpString="*.1cd") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.md") returned 0
	[0036.648] lstrlenA (lpString="*.md") returned 4
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdf") returned 0
	[0036.648] lstrlenA (lpString="*.mdf") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dbf") returned 0
	[0036.648] lstrlenA (lpString="*.dbf") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.odt") returned 0
	[0036.648] lstrlenA (lpString="*.odt") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.vob") returned 0
	[0036.648] lstrlenA (lpString="*.vob") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ifo") returned 0
	[0036.648] lstrlenA (lpString="*.ifo") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.lnk") returned 0
	[0036.648] lstrlenA (lpString="*.lnk") returned 5
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.torrent") returned 0
	[0036.648] lstrlenA (lpString="*.torrent") returned 9
	[0036.648] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mov") returned 0
	[0036.648] lstrlenA (lpString="*.mov") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.m2v") returned 0
	[0036.649] lstrlenA (lpString="*.m2v") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.3gp") returned 0
	[0036.649] lstrlenA (lpString="*.3gp") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpeg") returned 0
	[0036.649] lstrlenA (lpString="*.mpeg") returned 6
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpg") returned 0
	[0036.649] lstrlenA (lpString="*.mpg") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flv") returned 0
	[0036.649] lstrlenA (lpString="*.flv") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.avi") returned 0
	[0036.649] lstrlenA (lpString="*.avi") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp4") returned 0
	[0036.649] lstrlenA (lpString="*.mp4") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wmv") returned 0
	[0036.649] lstrlenA (lpString="*.wmv") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.divx") returned 0
	[0036.649] lstrlenA (lpString="*.divx") returned 6
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mkv") returned 0
	[0036.649] lstrlenA (lpString="*.mkv") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp3") returned 0
	[0036.649] lstrlenA (lpString="*.mp3") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wav") returned 0
	[0036.649] lstrlenA (lpString="*.wav") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flac") returned 0
	[0036.649] lstrlenA (lpString="*.flac") returned 6
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ape") returned 0
	[0036.649] lstrlenA (lpString="*.ape") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wma") returned 0
	[0036.649] lstrlenA (lpString="*.wma") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ac3") returned 0
	[0036.649] lstrlenA (lpString="*.ac3") returned 5
	[0036.649] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.exe") returned 0
	[0036.650] lstrlenA (lpString="*.exe") returned 5
	[0036.650] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.apk") returned 0
	[0036.650] lstrlenA (lpString="*.apk") returned 5
	[0036.650] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.650] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1
	[0036.650] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1
	[0036.650] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT"
	[0036.650] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ"
	[0036.650] lstrlenA (lpString="C:\\Boot\\cs-CZ") returned 13
	[0036.650] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.651] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.651] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.651] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.651] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.651] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.651] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.651] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.651] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.651] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\*.*") returned="*.*"
	[0036.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\"
	[0036.651] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned=""
	[0036.651] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt"
	[0036.651] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff
	[0036.651] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.652] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.652] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.653] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.653] CloseHandle (hObject=0x84) returned 1
	[0036.653] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui"
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.653] lstrlenA (lpString="*.zip") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.653] lstrlenA (lpString="*.rar") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.653] lstrlenA (lpString="*.7z") returned 4
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.653] lstrlenA (lpString="*.tar") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.653] lstrlenA (lpString="*.gzip") returned 6
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.653] lstrlenA (lpString="*.jpg") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.653] lstrlenA (lpString="*.jpeg") returned 6
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.653] lstrlenA (lpString="*.psd") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.653] lstrlenA (lpString="*.cdr") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.653] lstrlenA (lpString="*.dwg") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.653] lstrlenA (lpString="*.max") returned 5
	[0036.653] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.654] lstrlenA (lpString="*.bmp") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.654] lstrlenA (lpString="*.gif") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.654] lstrlenA (lpString="*.png") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.654] lstrlenA (lpString="*.doc") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.654] lstrlenA (lpString="*.docx") returned 6
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.654] lstrlenA (lpString="*.xls") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.654] lstrlenA (lpString="*.xlsx") returned 6
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.654] lstrlenA (lpString="*.ppt") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.654] lstrlenA (lpString="*.pptx") returned 6
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.654] lstrlenA (lpString="*.txt") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.654] lstrlenA (lpString="*.pdf") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.654] lstrlenA (lpString="*.djvu") returned 6
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.654] lstrlenA (lpString="*.htm") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.654] lstrlenA (lpString="*.html") returned 6
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.654] lstrlenA (lpString="*.mdb") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.654] lstrlenA (lpString="*.cer") returned 5
	[0036.654] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.654] lstrlenA (lpString="*.p12") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.655] lstrlenA (lpString="*.pfx") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.655] lstrlenA (lpString="*.kwm") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.655] lstrlenA (lpString="*.pwm") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.655] lstrlenA (lpString="*.1cd") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.655] lstrlenA (lpString="*.md") returned 4
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.655] lstrlenA (lpString="*.mdf") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.655] lstrlenA (lpString="*.dbf") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.655] lstrlenA (lpString="*.odt") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.655] lstrlenA (lpString="*.vob") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.655] lstrlenA (lpString="*.ifo") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.655] lstrlenA (lpString="*.lnk") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.655] lstrlenA (lpString="*.torrent") returned 9
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.655] lstrlenA (lpString="*.mov") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.655] lstrlenA (lpString="*.m2v") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.655] lstrlenA (lpString="*.3gp") returned 5
	[0036.655] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.655] lstrlenA (lpString="*.mpeg") returned 6
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.656] lstrlenA (lpString="*.mpg") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.656] lstrlenA (lpString="*.flv") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.656] lstrlenA (lpString="*.avi") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.656] lstrlenA (lpString="*.mp4") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.656] lstrlenA (lpString="*.wmv") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.656] lstrlenA (lpString="*.divx") returned 6
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.656] lstrlenA (lpString="*.mkv") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.656] lstrlenA (lpString="*.mp3") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.656] lstrlenA (lpString="*.wav") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.656] lstrlenA (lpString="*.flac") returned 6
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.656] lstrlenA (lpString="*.ape") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.656] lstrlenA (lpString="*.wma") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.656] lstrlenA (lpString="*.ac3") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.656] lstrlenA (lpString="*.exe") returned 5
	[0036.656] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.656] lstrlenA (lpString="*.apk") returned 5
	[0036.656] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.656] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.656] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.657] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1
	[0036.657] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1
	[0036.657] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.657] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK"
	[0036.657] lstrlenA (lpString="C:\\Boot\\da-DK") returned 13
	[0036.657] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.657] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.657] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.657] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.657] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.657] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.657] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.657] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.657] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.657] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\*.*") returned="*.*"
	[0036.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\"
	[0036.657] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned=""
	[0036.657] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt"
	[0036.657] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt")) returned 0xffffffff
	[0036.657] CreateFileA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.657] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.657] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.658] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.658] CloseHandle (hObject=0x84) returned 1
	[0036.658] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui"
	[0036.658] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.658] lstrlenA (lpString="*.zip") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.659] lstrlenA (lpString="*.rar") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.659] lstrlenA (lpString="*.7z") returned 4
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.659] lstrlenA (lpString="*.tar") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.659] lstrlenA (lpString="*.gzip") returned 6
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.659] lstrlenA (lpString="*.jpg") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.659] lstrlenA (lpString="*.jpeg") returned 6
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.659] lstrlenA (lpString="*.psd") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.659] lstrlenA (lpString="*.cdr") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.659] lstrlenA (lpString="*.dwg") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.659] lstrlenA (lpString="*.max") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.659] lstrlenA (lpString="*.bmp") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.659] lstrlenA (lpString="*.gif") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.659] lstrlenA (lpString="*.png") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.659] lstrlenA (lpString="*.doc") returned 5
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.659] lstrlenA (lpString="*.docx") returned 6
	[0036.659] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.659] lstrlenA (lpString="*.xls") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.660] lstrlenA (lpString="*.xlsx") returned 6
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.660] lstrlenA (lpString="*.ppt") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.660] lstrlenA (lpString="*.pptx") returned 6
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.660] lstrlenA (lpString="*.txt") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.660] lstrlenA (lpString="*.pdf") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.660] lstrlenA (lpString="*.djvu") returned 6
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.660] lstrlenA (lpString="*.htm") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.660] lstrlenA (lpString="*.html") returned 6
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.660] lstrlenA (lpString="*.mdb") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.660] lstrlenA (lpString="*.cer") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.660] lstrlenA (lpString="*.p12") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.660] lstrlenA (lpString="*.pfx") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.660] lstrlenA (lpString="*.kwm") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.660] lstrlenA (lpString="*.pwm") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.660] lstrlenA (lpString="*.1cd") returned 5
	[0036.660] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.660] lstrlenA (lpString="*.md") returned 4
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.661] lstrlenA (lpString="*.mdf") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.661] lstrlenA (lpString="*.dbf") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.661] lstrlenA (lpString="*.odt") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.661] lstrlenA (lpString="*.vob") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.661] lstrlenA (lpString="*.ifo") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.661] lstrlenA (lpString="*.lnk") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.661] lstrlenA (lpString="*.torrent") returned 9
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.661] lstrlenA (lpString="*.mov") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.661] lstrlenA (lpString="*.m2v") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.661] lstrlenA (lpString="*.3gp") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.661] lstrlenA (lpString="*.mpeg") returned 6
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.661] lstrlenA (lpString="*.mpg") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.661] lstrlenA (lpString="*.flv") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.661] lstrlenA (lpString="*.avi") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.661] lstrlenA (lpString="*.mp4") returned 5
	[0036.661] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.661] lstrlenA (lpString="*.wmv") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.662] lstrlenA (lpString="*.divx") returned 6
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.662] lstrlenA (lpString="*.mkv") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.662] lstrlenA (lpString="*.mp3") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.662] lstrlenA (lpString="*.wav") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.662] lstrlenA (lpString="*.flac") returned 6
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.662] lstrlenA (lpString="*.ape") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.662] lstrlenA (lpString="*.wma") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.662] lstrlenA (lpString="*.ac3") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.662] lstrlenA (lpString="*.exe") returned 5
	[0036.662] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.662] lstrlenA (lpString="*.apk") returned 5
	[0036.662] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.662] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.662] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.662] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1
	[0036.662] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1
	[0036.662] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.662] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE"
	[0036.662] lstrlenA (lpString="C:\\Boot\\de-DE") returned 13
	[0036.662] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.663] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.663] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.663] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.663] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.664] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.664] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.664] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.664] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.664] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\*.*") returned="*.*"
	[0036.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\"
	[0036.664] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned=""
	[0036.664] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt"
	[0036.664] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt")) returned 0xffffffff
	[0036.664] CreateFileA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.665] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.665] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.666] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.666] CloseHandle (hObject=0x84) returned 1
	[0036.666] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui"
	[0036.666] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.666] lstrlenA (lpString="*.zip") returned 5
	[0036.666] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.666] lstrlenA (lpString="*.rar") returned 5
	[0036.666] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.666] lstrlenA (lpString="*.7z") returned 4
	[0036.666] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.666] lstrlenA (lpString="*.tar") returned 5
	[0036.666] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.666] lstrlenA (lpString="*.gzip") returned 6
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.667] lstrlenA (lpString="*.jpg") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.667] lstrlenA (lpString="*.jpeg") returned 6
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.667] lstrlenA (lpString="*.psd") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.667] lstrlenA (lpString="*.cdr") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.667] lstrlenA (lpString="*.dwg") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.667] lstrlenA (lpString="*.max") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.667] lstrlenA (lpString="*.bmp") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.667] lstrlenA (lpString="*.gif") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.667] lstrlenA (lpString="*.png") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.667] lstrlenA (lpString="*.doc") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.667] lstrlenA (lpString="*.docx") returned 6
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.667] lstrlenA (lpString="*.xls") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.667] lstrlenA (lpString="*.xlsx") returned 6
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.667] lstrlenA (lpString="*.ppt") returned 5
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.667] lstrlenA (lpString="*.pptx") returned 6
	[0036.667] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.667] lstrlenA (lpString="*.txt") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.668] lstrlenA (lpString="*.pdf") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.668] lstrlenA (lpString="*.djvu") returned 6
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.668] lstrlenA (lpString="*.htm") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.668] lstrlenA (lpString="*.html") returned 6
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.668] lstrlenA (lpString="*.mdb") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.668] lstrlenA (lpString="*.cer") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.668] lstrlenA (lpString="*.p12") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.668] lstrlenA (lpString="*.pfx") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.668] lstrlenA (lpString="*.kwm") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.668] lstrlenA (lpString="*.pwm") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.668] lstrlenA (lpString="*.1cd") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.668] lstrlenA (lpString="*.md") returned 4
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.668] lstrlenA (lpString="*.mdf") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.668] lstrlenA (lpString="*.dbf") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.668] lstrlenA (lpString="*.odt") returned 5
	[0036.668] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.668] lstrlenA (lpString="*.vob") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.669] lstrlenA (lpString="*.ifo") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.669] lstrlenA (lpString="*.lnk") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.669] lstrlenA (lpString="*.torrent") returned 9
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.669] lstrlenA (lpString="*.mov") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.669] lstrlenA (lpString="*.m2v") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.669] lstrlenA (lpString="*.3gp") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.669] lstrlenA (lpString="*.mpeg") returned 6
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.669] lstrlenA (lpString="*.mpg") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.669] lstrlenA (lpString="*.flv") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.669] lstrlenA (lpString="*.avi") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.669] lstrlenA (lpString="*.mp4") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.669] lstrlenA (lpString="*.wmv") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.669] lstrlenA (lpString="*.divx") returned 6
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.669] lstrlenA (lpString="*.mkv") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.669] lstrlenA (lpString="*.mp3") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.669] lstrlenA (lpString="*.wav") returned 5
	[0036.669] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.670] lstrlenA (lpString="*.flac") returned 6
	[0036.670] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.670] lstrlenA (lpString="*.ape") returned 5
	[0036.670] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.670] lstrlenA (lpString="*.wma") returned 5
	[0036.670] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.670] lstrlenA (lpString="*.ac3") returned 5
	[0036.670] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.670] lstrlenA (lpString="*.exe") returned 5
	[0036.670] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.670] lstrlenA (lpString="*.apk") returned 5
	[0036.670] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.670] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.670] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.670] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1
	[0036.670] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1
	[0036.670] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.670] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR"
	[0036.670] lstrlenA (lpString="C:\\Boot\\el-GR") returned 13
	[0036.670] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.670] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.671] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.671] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.671] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.671] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.671] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.671] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.671] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.671] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\*.*") returned="*.*"
	[0036.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\"
	[0036.671] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned=""
	[0036.671] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt"
	[0036.671] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt")) returned 0xffffffff
	[0036.671] CreateFileA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.672] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.672] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.672] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.673] CloseHandle (hObject=0x84) returned 1
	[0036.673] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui"
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.673] lstrlenA (lpString="*.zip") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.673] lstrlenA (lpString="*.rar") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.673] lstrlenA (lpString="*.7z") returned 4
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.673] lstrlenA (lpString="*.tar") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.673] lstrlenA (lpString="*.gzip") returned 6
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.673] lstrlenA (lpString="*.jpg") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.673] lstrlenA (lpString="*.jpeg") returned 6
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.673] lstrlenA (lpString="*.psd") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.673] lstrlenA (lpString="*.cdr") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.673] lstrlenA (lpString="*.dwg") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.673] lstrlenA (lpString="*.max") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.673] lstrlenA (lpString="*.bmp") returned 5
	[0036.673] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.673] lstrlenA (lpString="*.gif") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.674] lstrlenA (lpString="*.png") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.674] lstrlenA (lpString="*.doc") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.674] lstrlenA (lpString="*.docx") returned 6
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.674] lstrlenA (lpString="*.xls") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.674] lstrlenA (lpString="*.xlsx") returned 6
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.674] lstrlenA (lpString="*.ppt") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.674] lstrlenA (lpString="*.pptx") returned 6
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.674] lstrlenA (lpString="*.txt") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.674] lstrlenA (lpString="*.pdf") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.674] lstrlenA (lpString="*.djvu") returned 6
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.674] lstrlenA (lpString="*.htm") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.674] lstrlenA (lpString="*.html") returned 6
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.674] lstrlenA (lpString="*.mdb") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.674] lstrlenA (lpString="*.cer") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.674] lstrlenA (lpString="*.p12") returned 5
	[0036.674] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.674] lstrlenA (lpString="*.pfx") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.675] lstrlenA (lpString="*.kwm") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.675] lstrlenA (lpString="*.pwm") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.675] lstrlenA (lpString="*.1cd") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.675] lstrlenA (lpString="*.md") returned 4
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.675] lstrlenA (lpString="*.mdf") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.675] lstrlenA (lpString="*.dbf") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.675] lstrlenA (lpString="*.odt") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.675] lstrlenA (lpString="*.vob") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.675] lstrlenA (lpString="*.ifo") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.675] lstrlenA (lpString="*.lnk") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.675] lstrlenA (lpString="*.torrent") returned 9
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.675] lstrlenA (lpString="*.mov") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.675] lstrlenA (lpString="*.m2v") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.675] lstrlenA (lpString="*.3gp") returned 5
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.675] lstrlenA (lpString="*.mpeg") returned 6
	[0036.675] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.675] lstrlenA (lpString="*.mpg") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.676] lstrlenA (lpString="*.flv") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.676] lstrlenA (lpString="*.avi") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.676] lstrlenA (lpString="*.mp4") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.676] lstrlenA (lpString="*.wmv") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.676] lstrlenA (lpString="*.divx") returned 6
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.676] lstrlenA (lpString="*.mkv") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.676] lstrlenA (lpString="*.mp3") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.676] lstrlenA (lpString="*.wav") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.676] lstrlenA (lpString="*.flac") returned 6
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.676] lstrlenA (lpString="*.ape") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.676] lstrlenA (lpString="*.wma") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.676] lstrlenA (lpString="*.ac3") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.676] lstrlenA (lpString="*.exe") returned 5
	[0036.676] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.676] lstrlenA (lpString="*.apk") returned 5
	[0036.676] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.676] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.677] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.677] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0036.677] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0036.677] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.677] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US"
	[0036.677] lstrlenA (lpString="C:\\Boot\\en-US") returned 13
	[0036.677] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.678] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.678] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.678] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.678] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.678] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.678] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.678] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.678] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.678] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\*.*") returned="*.*"
	[0036.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\"
	[0036.678] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned=""
	[0036.678] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt"
	[0036.678] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0036.678] CreateFileA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.680] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.680] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.681] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.681] CloseHandle (hObject=0x84) returned 1
	[0036.681] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui"
	[0036.681] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.681] lstrlenA (lpString="*.zip") returned 5
	[0036.681] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.681] lstrlenA (lpString="*.rar") returned 5
	[0036.681] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.681] lstrlenA (lpString="*.7z") returned 4
	[0036.681] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.681] lstrlenA (lpString="*.tar") returned 5
	[0036.681] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.681] lstrlenA (lpString="*.gzip") returned 6
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.682] lstrlenA (lpString="*.jpg") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.682] lstrlenA (lpString="*.jpeg") returned 6
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.682] lstrlenA (lpString="*.psd") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.682] lstrlenA (lpString="*.cdr") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.682] lstrlenA (lpString="*.dwg") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.682] lstrlenA (lpString="*.max") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.682] lstrlenA (lpString="*.bmp") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.682] lstrlenA (lpString="*.gif") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.682] lstrlenA (lpString="*.png") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.682] lstrlenA (lpString="*.doc") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.682] lstrlenA (lpString="*.docx") returned 6
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.682] lstrlenA (lpString="*.xls") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.682] lstrlenA (lpString="*.xlsx") returned 6
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.682] lstrlenA (lpString="*.ppt") returned 5
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.682] lstrlenA (lpString="*.pptx") returned 6
	[0036.682] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.682] lstrlenA (lpString="*.txt") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.683] lstrlenA (lpString="*.pdf") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.683] lstrlenA (lpString="*.djvu") returned 6
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.683] lstrlenA (lpString="*.htm") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.683] lstrlenA (lpString="*.html") returned 6
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.683] lstrlenA (lpString="*.mdb") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.683] lstrlenA (lpString="*.cer") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.683] lstrlenA (lpString="*.p12") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.683] lstrlenA (lpString="*.pfx") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.683] lstrlenA (lpString="*.kwm") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.683] lstrlenA (lpString="*.pwm") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.683] lstrlenA (lpString="*.1cd") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.683] lstrlenA (lpString="*.md") returned 4
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.683] lstrlenA (lpString="*.mdf") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.683] lstrlenA (lpString="*.dbf") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.683] lstrlenA (lpString="*.odt") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.683] lstrlenA (lpString="*.vob") returned 5
	[0036.683] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.684] lstrlenA (lpString="*.ifo") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.684] lstrlenA (lpString="*.lnk") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.684] lstrlenA (lpString="*.torrent") returned 9
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.684] lstrlenA (lpString="*.mov") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.684] lstrlenA (lpString="*.m2v") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.684] lstrlenA (lpString="*.3gp") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.684] lstrlenA (lpString="*.mpeg") returned 6
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.684] lstrlenA (lpString="*.mpg") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.684] lstrlenA (lpString="*.flv") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.684] lstrlenA (lpString="*.avi") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.684] lstrlenA (lpString="*.mp4") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.684] lstrlenA (lpString="*.wmv") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.684] lstrlenA (lpString="*.divx") returned 6
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.684] lstrlenA (lpString="*.mkv") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.684] lstrlenA (lpString="*.mp3") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.684] lstrlenA (lpString="*.wav") returned 5
	[0036.684] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.685] lstrlenA (lpString="*.flac") returned 6
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.685] lstrlenA (lpString="*.ape") returned 5
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.685] lstrlenA (lpString="*.wma") returned 5
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.685] lstrlenA (lpString="*.ac3") returned 5
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.685] lstrlenA (lpString="*.exe") returned 5
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.685] lstrlenA (lpString="*.apk") returned 5
	[0036.685] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.685] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.685] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="memtest.exe.mui") returned -1
	[0036.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1
	[0036.685] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1
	[0036.685] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui"
	[0036.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\"
	[0036.685] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned=""
	[0036.685] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt"
	[0036.685] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0x20
	[0036.685] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui"
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.zip") returned 0
	[0036.685] lstrlenA (lpString="*.zip") returned 5
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rar") returned 0
	[0036.685] lstrlenA (lpString="*.rar") returned 5
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.7z") returned 0
	[0036.685] lstrlenA (lpString="*.7z") returned 4
	[0036.685] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tar") returned 0
	[0036.686] lstrlenA (lpString="*.tar") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gzip") returned 0
	[0036.686] lstrlenA (lpString="*.gzip") returned 6
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpg") returned 0
	[0036.686] lstrlenA (lpString="*.jpg") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.686] lstrlenA (lpString="*.jpeg") returned 6
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.psd") returned 0
	[0036.686] lstrlenA (lpString="*.psd") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cdr") returned 0
	[0036.686] lstrlenA (lpString="*.cdr") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dwg") returned 0
	[0036.686] lstrlenA (lpString="*.dwg") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.max") returned 0
	[0036.686] lstrlenA (lpString="*.max") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bmp") returned 0
	[0036.686] lstrlenA (lpString="*.bmp") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gif") returned 0
	[0036.686] lstrlenA (lpString="*.gif") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.png") returned 0
	[0036.686] lstrlenA (lpString="*.png") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0
	[0036.686] lstrlenA (lpString="*.doc") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docx") returned 0
	[0036.686] lstrlenA (lpString="*.docx") returned 6
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xls") returned 0
	[0036.686] lstrlenA (lpString="*.xls") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.686] lstrlenA (lpString="*.xlsx") returned 6
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ppt") returned 0
	[0036.686] lstrlenA (lpString="*.ppt") returned 5
	[0036.686] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pptx") returned 0
	[0036.686] lstrlenA (lpString="*.pptx") returned 6
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.txt") returned 0
	[0036.687] lstrlenA (lpString="*.txt") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pdf") returned 0
	[0036.687] lstrlenA (lpString="*.pdf") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.djvu") returned 0
	[0036.687] lstrlenA (lpString="*.djvu") returned 6
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.htm") returned 0
	[0036.687] lstrlenA (lpString="*.htm") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.html") returned 0
	[0036.687] lstrlenA (lpString="*.html") returned 6
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdb") returned 0
	[0036.687] lstrlenA (lpString="*.mdb") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cer") returned 0
	[0036.687] lstrlenA (lpString="*.cer") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.p12") returned 0
	[0036.687] lstrlenA (lpString="*.p12") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pfx") returned 0
	[0036.687] lstrlenA (lpString="*.pfx") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.kwm") returned 0
	[0036.687] lstrlenA (lpString="*.kwm") returned 5
	[0036.687] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pwm") returned 0
	[0036.687] lstrlenA (lpString="*.pwm") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.1cd") returned 0
	[0036.688] lstrlenA (lpString="*.1cd") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.md") returned 0
	[0036.688] lstrlenA (lpString="*.md") returned 4
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdf") returned 0
	[0036.688] lstrlenA (lpString="*.mdf") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dbf") returned 0
	[0036.688] lstrlenA (lpString="*.dbf") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.odt") returned 0
	[0036.688] lstrlenA (lpString="*.odt") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vob") returned 0
	[0036.688] lstrlenA (lpString="*.vob") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ifo") returned 0
	[0036.688] lstrlenA (lpString="*.ifo") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.lnk") returned 0
	[0036.688] lstrlenA (lpString="*.lnk") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.torrent") returned 0
	[0036.688] lstrlenA (lpString="*.torrent") returned 9
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mov") returned 0
	[0036.688] lstrlenA (lpString="*.mov") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.m2v") returned 0
	[0036.688] lstrlenA (lpString="*.m2v") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.3gp") returned 0
	[0036.688] lstrlenA (lpString="*.3gp") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.688] lstrlenA (lpString="*.mpeg") returned 6
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpg") returned 0
	[0036.688] lstrlenA (lpString="*.mpg") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flv") returned 0
	[0036.688] lstrlenA (lpString="*.flv") returned 5
	[0036.688] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.avi") returned 0
	[0036.688] lstrlenA (lpString="*.avi") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp4") returned 0
	[0036.689] lstrlenA (lpString="*.mp4") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wmv") returned 0
	[0036.689] lstrlenA (lpString="*.wmv") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.divx") returned 0
	[0036.689] lstrlenA (lpString="*.divx") returned 6
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mkv") returned 0
	[0036.689] lstrlenA (lpString="*.mkv") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp3") returned 0
	[0036.689] lstrlenA (lpString="*.mp3") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wav") returned 0
	[0036.689] lstrlenA (lpString="*.wav") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flac") returned 0
	[0036.689] lstrlenA (lpString="*.flac") returned 6
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ape") returned 0
	[0036.689] lstrlenA (lpString="*.ape") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wma") returned 0
	[0036.689] lstrlenA (lpString="*.wma") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ac3") returned 0
	[0036.689] lstrlenA (lpString="*.ac3") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.exe") returned 0
	[0036.689] lstrlenA (lpString="*.exe") returned 5
	[0036.689] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.apk") returned 0
	[0036.689] lstrlenA (lpString="*.apk") returned 5
	[0036.689] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.689] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.689] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.689] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1
	[0036.689] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1
	[0036.689] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.690] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES"
	[0036.690] lstrlenA (lpString="C:\\Boot\\es-ES") returned 13
	[0036.690] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.691] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.691] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.691] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.691] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.691] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.691] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.691] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.691] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.691] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\*.*") returned="*.*"
	[0036.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\"
	[0036.691] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned=""
	[0036.691] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt"
	[0036.691] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt")) returned 0xffffffff
	[0036.691] CreateFileA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.691] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.691] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.692] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.692] CloseHandle (hObject=0x84) returned 1
	[0036.693] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui"
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.693] lstrlenA (lpString="*.zip") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.693] lstrlenA (lpString="*.rar") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.693] lstrlenA (lpString="*.7z") returned 4
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.693] lstrlenA (lpString="*.tar") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.693] lstrlenA (lpString="*.gzip") returned 6
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.693] lstrlenA (lpString="*.jpg") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.693] lstrlenA (lpString="*.jpeg") returned 6
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.693] lstrlenA (lpString="*.psd") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.693] lstrlenA (lpString="*.cdr") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.693] lstrlenA (lpString="*.dwg") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.693] lstrlenA (lpString="*.max") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.693] lstrlenA (lpString="*.bmp") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.693] lstrlenA (lpString="*.gif") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.693] lstrlenA (lpString="*.png") returned 5
	[0036.693] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.693] lstrlenA (lpString="*.doc") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.694] lstrlenA (lpString="*.docx") returned 6
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.694] lstrlenA (lpString="*.xls") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.694] lstrlenA (lpString="*.xlsx") returned 6
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.694] lstrlenA (lpString="*.ppt") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.694] lstrlenA (lpString="*.pptx") returned 6
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.694] lstrlenA (lpString="*.txt") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.694] lstrlenA (lpString="*.pdf") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.694] lstrlenA (lpString="*.djvu") returned 6
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.694] lstrlenA (lpString="*.htm") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.694] lstrlenA (lpString="*.html") returned 6
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.694] lstrlenA (lpString="*.mdb") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.694] lstrlenA (lpString="*.cer") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.694] lstrlenA (lpString="*.p12") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.694] lstrlenA (lpString="*.pfx") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.694] lstrlenA (lpString="*.kwm") returned 5
	[0036.694] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.694] lstrlenA (lpString="*.pwm") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.695] lstrlenA (lpString="*.1cd") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.695] lstrlenA (lpString="*.md") returned 4
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.695] lstrlenA (lpString="*.mdf") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.695] lstrlenA (lpString="*.dbf") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.695] lstrlenA (lpString="*.odt") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.695] lstrlenA (lpString="*.vob") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.695] lstrlenA (lpString="*.ifo") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.695] lstrlenA (lpString="*.lnk") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.695] lstrlenA (lpString="*.torrent") returned 9
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.695] lstrlenA (lpString="*.mov") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.695] lstrlenA (lpString="*.m2v") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.695] lstrlenA (lpString="*.3gp") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.695] lstrlenA (lpString="*.mpeg") returned 6
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.695] lstrlenA (lpString="*.mpg") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.695] lstrlenA (lpString="*.flv") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.695] lstrlenA (lpString="*.avi") returned 5
	[0036.695] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.696] lstrlenA (lpString="*.mp4") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.696] lstrlenA (lpString="*.wmv") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.696] lstrlenA (lpString="*.divx") returned 6
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.696] lstrlenA (lpString="*.mkv") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.696] lstrlenA (lpString="*.mp3") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.696] lstrlenA (lpString="*.wav") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.696] lstrlenA (lpString="*.flac") returned 6
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.696] lstrlenA (lpString="*.ape") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.696] lstrlenA (lpString="*.wma") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.696] lstrlenA (lpString="*.ac3") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.696] lstrlenA (lpString="*.exe") returned 5
	[0036.696] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.696] lstrlenA (lpString="*.apk") returned 5
	[0036.696] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.696] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.696] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.696] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1
	[0036.696] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1
	[0036.696] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.696] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI"
	[0036.697] lstrlenA (lpString="C:\\Boot\\fi-FI") returned 13
	[0036.697] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.697] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.697] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.697] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.697] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.697] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.697] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.697] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.697] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.697] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\*.*") returned="*.*"
	[0036.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\"
	[0036.697] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned=""
	[0036.697] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt"
	[0036.697] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff
	[0036.697] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.698] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.698] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.699] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.699] CloseHandle (hObject=0x84) returned 1
	[0036.699] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui"
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.699] lstrlenA (lpString="*.zip") returned 5
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.699] lstrlenA (lpString="*.rar") returned 5
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.699] lstrlenA (lpString="*.7z") returned 4
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.699] lstrlenA (lpString="*.tar") returned 5
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.699] lstrlenA (lpString="*.gzip") returned 6
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.699] lstrlenA (lpString="*.jpg") returned 5
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.699] lstrlenA (lpString="*.jpeg") returned 6
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.699] lstrlenA (lpString="*.psd") returned 5
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.699] lstrlenA (lpString="*.cdr") returned 5
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.699] lstrlenA (lpString="*.dwg") returned 5
	[0036.699] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.700] lstrlenA (lpString="*.max") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.700] lstrlenA (lpString="*.bmp") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.700] lstrlenA (lpString="*.gif") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.700] lstrlenA (lpString="*.png") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.700] lstrlenA (lpString="*.doc") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.700] lstrlenA (lpString="*.docx") returned 6
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.700] lstrlenA (lpString="*.xls") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.700] lstrlenA (lpString="*.xlsx") returned 6
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.700] lstrlenA (lpString="*.ppt") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.700] lstrlenA (lpString="*.pptx") returned 6
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.700] lstrlenA (lpString="*.txt") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.700] lstrlenA (lpString="*.pdf") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.700] lstrlenA (lpString="*.djvu") returned 6
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.700] lstrlenA (lpString="*.htm") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.700] lstrlenA (lpString="*.html") returned 6
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.700] lstrlenA (lpString="*.mdb") returned 5
	[0036.700] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.700] lstrlenA (lpString="*.cer") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.701] lstrlenA (lpString="*.p12") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.701] lstrlenA (lpString="*.pfx") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.701] lstrlenA (lpString="*.kwm") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.701] lstrlenA (lpString="*.pwm") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.701] lstrlenA (lpString="*.1cd") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.701] lstrlenA (lpString="*.md") returned 4
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.701] lstrlenA (lpString="*.mdf") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.701] lstrlenA (lpString="*.dbf") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.701] lstrlenA (lpString="*.odt") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.701] lstrlenA (lpString="*.vob") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.701] lstrlenA (lpString="*.ifo") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.701] lstrlenA (lpString="*.lnk") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.701] lstrlenA (lpString="*.torrent") returned 9
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.701] lstrlenA (lpString="*.mov") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.701] lstrlenA (lpString="*.m2v") returned 5
	[0036.701] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.701] lstrlenA (lpString="*.3gp") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.702] lstrlenA (lpString="*.mpeg") returned 6
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.702] lstrlenA (lpString="*.mpg") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.702] lstrlenA (lpString="*.flv") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.702] lstrlenA (lpString="*.avi") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.702] lstrlenA (lpString="*.mp4") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.702] lstrlenA (lpString="*.wmv") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.702] lstrlenA (lpString="*.divx") returned 6
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.702] lstrlenA (lpString="*.mkv") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.702] lstrlenA (lpString="*.mp3") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.702] lstrlenA (lpString="*.wav") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.702] lstrlenA (lpString="*.flac") returned 6
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.702] lstrlenA (lpString="*.ape") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.702] lstrlenA (lpString="*.wma") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.702] lstrlenA (lpString="*.ac3") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.702] lstrlenA (lpString="*.exe") returned 5
	[0036.702] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.702] lstrlenA (lpString="*.apk") returned 5
	[0036.703] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.703] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.703] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.703] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1
	[0036.703] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1
	[0036.703] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.703] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts"
	[0036.703] lstrlenA (lpString="C:\\Boot\\Fonts") returned 13
	[0036.703] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.705] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.705] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.705] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.705] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.705] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.705] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.705] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="chs_boot.ttf") returned 1
	[0036.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chs_boot.ttf") returned 1
	[0036.705] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1
	[0036.705] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\*.*") returned="*.*"
	[0036.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0036.705] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0036.705] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0036.705] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff
	[0036.705] CreateFileA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.707] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.707] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.708] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.708] CloseHandle (hObject=0x84) returned 1
	[0036.708] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf"
	[0036.708] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.zip") returned 0
	[0036.708] lstrlenA (lpString="*.zip") returned 5
	[0036.708] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rar") returned 0
	[0036.708] lstrlenA (lpString="*.rar") returned 5
	[0036.708] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.7z") returned 0
	[0036.708] lstrlenA (lpString="*.7z") returned 4
	[0036.708] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tar") returned 0
	[0036.708] lstrlenA (lpString="*.tar") returned 5
	[0036.708] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gzip") returned 0
	[0036.709] lstrlenA (lpString="*.gzip") returned 6
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpg") returned 0
	[0036.709] lstrlenA (lpString="*.jpg") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpeg") returned 0
	[0036.709] lstrlenA (lpString="*.jpeg") returned 6
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.psd") returned 0
	[0036.709] lstrlenA (lpString="*.psd") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cdr") returned 0
	[0036.709] lstrlenA (lpString="*.cdr") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dwg") returned 0
	[0036.709] lstrlenA (lpString="*.dwg") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.max") returned 0
	[0036.709] lstrlenA (lpString="*.max") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bmp") returned 0
	[0036.709] lstrlenA (lpString="*.bmp") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gif") returned 0
	[0036.709] lstrlenA (lpString="*.gif") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.png") returned 0
	[0036.709] lstrlenA (lpString="*.png") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0
	[0036.709] lstrlenA (lpString="*.doc") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docx") returned 0
	[0036.709] lstrlenA (lpString="*.docx") returned 6
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xls") returned 0
	[0036.709] lstrlenA (lpString="*.xls") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsx") returned 0
	[0036.709] lstrlenA (lpString="*.xlsx") returned 6
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ppt") returned 0
	[0036.709] lstrlenA (lpString="*.ppt") returned 5
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pptx") returned 0
	[0036.709] lstrlenA (lpString="*.pptx") returned 6
	[0036.709] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.txt") returned 0
	[0036.709] lstrlenA (lpString="*.txt") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pdf") returned 0
	[0036.710] lstrlenA (lpString="*.pdf") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.djvu") returned 0
	[0036.710] lstrlenA (lpString="*.djvu") returned 6
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.htm") returned 0
	[0036.710] lstrlenA (lpString="*.htm") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.html") returned 0
	[0036.710] lstrlenA (lpString="*.html") returned 6
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdb") returned 0
	[0036.710] lstrlenA (lpString="*.mdb") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cer") returned 0
	[0036.710] lstrlenA (lpString="*.cer") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.p12") returned 0
	[0036.710] lstrlenA (lpString="*.p12") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pfx") returned 0
	[0036.710] lstrlenA (lpString="*.pfx") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.kwm") returned 0
	[0036.710] lstrlenA (lpString="*.kwm") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pwm") returned 0
	[0036.710] lstrlenA (lpString="*.pwm") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.1cd") returned 0
	[0036.710] lstrlenA (lpString="*.1cd") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.md") returned 0
	[0036.710] lstrlenA (lpString="*.md") returned 4
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdf") returned 0
	[0036.710] lstrlenA (lpString="*.mdf") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dbf") returned 0
	[0036.710] lstrlenA (lpString="*.dbf") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.odt") returned 0
	[0036.710] lstrlenA (lpString="*.odt") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vob") returned 0
	[0036.710] lstrlenA (lpString="*.vob") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ifo") returned 0
	[0036.710] lstrlenA (lpString="*.ifo") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.lnk") returned 0
	[0036.710] lstrlenA (lpString="*.lnk") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.torrent") returned 0
	[0036.710] lstrlenA (lpString="*.torrent") returned 9
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mov") returned 0
	[0036.710] lstrlenA (lpString="*.mov") returned 5
	[0036.710] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.m2v") returned 0
	[0036.711] lstrlenA (lpString="*.m2v") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.3gp") returned 0
	[0036.711] lstrlenA (lpString="*.3gp") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpeg") returned 0
	[0036.711] lstrlenA (lpString="*.mpeg") returned 6
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpg") returned 0
	[0036.711] lstrlenA (lpString="*.mpg") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flv") returned 0
	[0036.711] lstrlenA (lpString="*.flv") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.avi") returned 0
	[0036.711] lstrlenA (lpString="*.avi") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp4") returned 0
	[0036.711] lstrlenA (lpString="*.mp4") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wmv") returned 0
	[0036.711] lstrlenA (lpString="*.wmv") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.divx") returned 0
	[0036.711] lstrlenA (lpString="*.divx") returned 6
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mkv") returned 0
	[0036.711] lstrlenA (lpString="*.mkv") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp3") returned 0
	[0036.711] lstrlenA (lpString="*.mp3") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wav") returned 0
	[0036.711] lstrlenA (lpString="*.wav") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flac") returned 0
	[0036.711] lstrlenA (lpString="*.flac") returned 6
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ape") returned 0
	[0036.711] lstrlenA (lpString="*.ape") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wma") returned 0
	[0036.711] lstrlenA (lpString="*.wma") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ac3") returned 0
	[0036.711] lstrlenA (lpString="*.ac3") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.exe") returned 0
	[0036.711] lstrlenA (lpString="*.exe") returned 5
	[0036.711] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.apk") returned 0
	[0036.711] lstrlenA (lpString="*.apk") returned 5
	[0036.711] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.711] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.711] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="cht_boot.ttf") returned 1
	[0036.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cht_boot.ttf") returned 1
	[0036.711] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1
	[0036.711] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf"
	[0036.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0036.711] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0036.712] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0036.712] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20
	[0036.712] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf"
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.zip") returned 0
	[0036.712] lstrlenA (lpString="*.zip") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rar") returned 0
	[0036.712] lstrlenA (lpString="*.rar") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.7z") returned 0
	[0036.712] lstrlenA (lpString="*.7z") returned 4
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tar") returned 0
	[0036.712] lstrlenA (lpString="*.tar") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gzip") returned 0
	[0036.712] lstrlenA (lpString="*.gzip") returned 6
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpg") returned 0
	[0036.712] lstrlenA (lpString="*.jpg") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpeg") returned 0
	[0036.712] lstrlenA (lpString="*.jpeg") returned 6
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.psd") returned 0
	[0036.712] lstrlenA (lpString="*.psd") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cdr") returned 0
	[0036.712] lstrlenA (lpString="*.cdr") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dwg") returned 0
	[0036.712] lstrlenA (lpString="*.dwg") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.max") returned 0
	[0036.712] lstrlenA (lpString="*.max") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bmp") returned 0
	[0036.712] lstrlenA (lpString="*.bmp") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gif") returned 0
	[0036.712] lstrlenA (lpString="*.gif") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.png") returned 0
	[0036.712] lstrlenA (lpString="*.png") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0
	[0036.712] lstrlenA (lpString="*.doc") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docx") returned 0
	[0036.712] lstrlenA (lpString="*.docx") returned 6
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xls") returned 0
	[0036.712] lstrlenA (lpString="*.xls") returned 5
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsx") returned 0
	[0036.712] lstrlenA (lpString="*.xlsx") returned 6
	[0036.712] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ppt") returned 0
	[0036.713] lstrlenA (lpString="*.ppt") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pptx") returned 0
	[0036.713] lstrlenA (lpString="*.pptx") returned 6
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.txt") returned 0
	[0036.713] lstrlenA (lpString="*.txt") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pdf") returned 0
	[0036.713] lstrlenA (lpString="*.pdf") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.djvu") returned 0
	[0036.713] lstrlenA (lpString="*.djvu") returned 6
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.htm") returned 0
	[0036.713] lstrlenA (lpString="*.htm") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.html") returned 0
	[0036.713] lstrlenA (lpString="*.html") returned 6
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdb") returned 0
	[0036.713] lstrlenA (lpString="*.mdb") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cer") returned 0
	[0036.713] lstrlenA (lpString="*.cer") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.p12") returned 0
	[0036.713] lstrlenA (lpString="*.p12") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pfx") returned 0
	[0036.713] lstrlenA (lpString="*.pfx") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.kwm") returned 0
	[0036.713] lstrlenA (lpString="*.kwm") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pwm") returned 0
	[0036.713] lstrlenA (lpString="*.pwm") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.1cd") returned 0
	[0036.713] lstrlenA (lpString="*.1cd") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.md") returned 0
	[0036.713] lstrlenA (lpString="*.md") returned 4
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdf") returned 0
	[0036.713] lstrlenA (lpString="*.mdf") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dbf") returned 0
	[0036.713] lstrlenA (lpString="*.dbf") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.odt") returned 0
	[0036.713] lstrlenA (lpString="*.odt") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vob") returned 0
	[0036.713] lstrlenA (lpString="*.vob") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ifo") returned 0
	[0036.713] lstrlenA (lpString="*.ifo") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.lnk") returned 0
	[0036.713] lstrlenA (lpString="*.lnk") returned 5
	[0036.713] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.torrent") returned 0
	[0036.713] lstrlenA (lpString="*.torrent") returned 9
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mov") returned 0
	[0036.714] lstrlenA (lpString="*.mov") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.m2v") returned 0
	[0036.714] lstrlenA (lpString="*.m2v") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.3gp") returned 0
	[0036.714] lstrlenA (lpString="*.3gp") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpeg") returned 0
	[0036.714] lstrlenA (lpString="*.mpeg") returned 6
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpg") returned 0
	[0036.714] lstrlenA (lpString="*.mpg") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flv") returned 0
	[0036.714] lstrlenA (lpString="*.flv") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.avi") returned 0
	[0036.714] lstrlenA (lpString="*.avi") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp4") returned 0
	[0036.714] lstrlenA (lpString="*.mp4") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wmv") returned 0
	[0036.714] lstrlenA (lpString="*.wmv") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.divx") returned 0
	[0036.714] lstrlenA (lpString="*.divx") returned 6
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mkv") returned 0
	[0036.714] lstrlenA (lpString="*.mkv") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp3") returned 0
	[0036.714] lstrlenA (lpString="*.mp3") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wav") returned 0
	[0036.714] lstrlenA (lpString="*.wav") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flac") returned 0
	[0036.714] lstrlenA (lpString="*.flac") returned 6
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ape") returned 0
	[0036.714] lstrlenA (lpString="*.ape") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wma") returned 0
	[0036.714] lstrlenA (lpString="*.wma") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ac3") returned 0
	[0036.714] lstrlenA (lpString="*.ac3") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.exe") returned 0
	[0036.714] lstrlenA (lpString="*.exe") returned 5
	[0036.714] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.apk") returned 0
	[0036.714] lstrlenA (lpString="*.apk") returned 5
	[0036.714] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.714] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.714] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jpn_boot.ttf") returned -1
	[0036.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jpn_boot.ttf") returned -1
	[0036.714] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1
	[0036.715] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf"
	[0036.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0036.715] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0036.715] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0036.715] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20
	[0036.715] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf"
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.zip") returned 0
	[0036.715] lstrlenA (lpString="*.zip") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rar") returned 0
	[0036.715] lstrlenA (lpString="*.rar") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.7z") returned 0
	[0036.715] lstrlenA (lpString="*.7z") returned 4
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tar") returned 0
	[0036.715] lstrlenA (lpString="*.tar") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gzip") returned 0
	[0036.715] lstrlenA (lpString="*.gzip") returned 6
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpg") returned 0
	[0036.715] lstrlenA (lpString="*.jpg") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpeg") returned 0
	[0036.715] lstrlenA (lpString="*.jpeg") returned 6
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.psd") returned 0
	[0036.715] lstrlenA (lpString="*.psd") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cdr") returned 0
	[0036.715] lstrlenA (lpString="*.cdr") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dwg") returned 0
	[0036.715] lstrlenA (lpString="*.dwg") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.max") returned 0
	[0036.715] lstrlenA (lpString="*.max") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bmp") returned 0
	[0036.715] lstrlenA (lpString="*.bmp") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gif") returned 0
	[0036.715] lstrlenA (lpString="*.gif") returned 5
	[0036.715] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.png") returned 0
	[0036.715] lstrlenA (lpString="*.png") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0
	[0036.716] lstrlenA (lpString="*.doc") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docx") returned 0
	[0036.716] lstrlenA (lpString="*.docx") returned 6
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xls") returned 0
	[0036.716] lstrlenA (lpString="*.xls") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsx") returned 0
	[0036.716] lstrlenA (lpString="*.xlsx") returned 6
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ppt") returned 0
	[0036.716] lstrlenA (lpString="*.ppt") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pptx") returned 0
	[0036.716] lstrlenA (lpString="*.pptx") returned 6
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.txt") returned 0
	[0036.716] lstrlenA (lpString="*.txt") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pdf") returned 0
	[0036.716] lstrlenA (lpString="*.pdf") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.djvu") returned 0
	[0036.716] lstrlenA (lpString="*.djvu") returned 6
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.htm") returned 0
	[0036.716] lstrlenA (lpString="*.htm") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.html") returned 0
	[0036.716] lstrlenA (lpString="*.html") returned 6
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdb") returned 0
	[0036.716] lstrlenA (lpString="*.mdb") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cer") returned 0
	[0036.716] lstrlenA (lpString="*.cer") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.p12") returned 0
	[0036.716] lstrlenA (lpString="*.p12") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pfx") returned 0
	[0036.716] lstrlenA (lpString="*.pfx") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.kwm") returned 0
	[0036.716] lstrlenA (lpString="*.kwm") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pwm") returned 0
	[0036.716] lstrlenA (lpString="*.pwm") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.1cd") returned 0
	[0036.716] lstrlenA (lpString="*.1cd") returned 5
	[0036.716] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.md") returned 0
	[0036.716] lstrlenA (lpString="*.md") returned 4
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdf") returned 0
	[0036.717] lstrlenA (lpString="*.mdf") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dbf") returned 0
	[0036.717] lstrlenA (lpString="*.dbf") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.odt") returned 0
	[0036.717] lstrlenA (lpString="*.odt") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vob") returned 0
	[0036.717] lstrlenA (lpString="*.vob") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ifo") returned 0
	[0036.717] lstrlenA (lpString="*.ifo") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.lnk") returned 0
	[0036.717] lstrlenA (lpString="*.lnk") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.torrent") returned 0
	[0036.717] lstrlenA (lpString="*.torrent") returned 9
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mov") returned 0
	[0036.717] lstrlenA (lpString="*.mov") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.m2v") returned 0
	[0036.717] lstrlenA (lpString="*.m2v") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.3gp") returned 0
	[0036.717] lstrlenA (lpString="*.3gp") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpeg") returned 0
	[0036.717] lstrlenA (lpString="*.mpeg") returned 6
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpg") returned 0
	[0036.717] lstrlenA (lpString="*.mpg") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flv") returned 0
	[0036.717] lstrlenA (lpString="*.flv") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.avi") returned 0
	[0036.717] lstrlenA (lpString="*.avi") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp4") returned 0
	[0036.717] lstrlenA (lpString="*.mp4") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wmv") returned 0
	[0036.717] lstrlenA (lpString="*.wmv") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.divx") returned 0
	[0036.717] lstrlenA (lpString="*.divx") returned 6
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mkv") returned 0
	[0036.717] lstrlenA (lpString="*.mkv") returned 5
	[0036.717] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp3") returned 0
	[0036.717] lstrlenA (lpString="*.mp3") returned 5
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wav") returned 0
	[0036.718] lstrlenA (lpString="*.wav") returned 5
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flac") returned 0
	[0036.718] lstrlenA (lpString="*.flac") returned 6
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ape") returned 0
	[0036.718] lstrlenA (lpString="*.ape") returned 5
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wma") returned 0
	[0036.718] lstrlenA (lpString="*.wma") returned 5
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ac3") returned 0
	[0036.718] lstrlenA (lpString="*.ac3") returned 5
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.exe") returned 0
	[0036.718] lstrlenA (lpString="*.exe") returned 5
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.apk") returned 0
	[0036.718] lstrlenA (lpString="*.apk") returned 5
	[0036.718] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.718] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.718] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="kor_boot.ttf") returned -1
	[0036.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor_boot.ttf") returned -1
	[0036.718] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1
	[0036.718] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf"
	[0036.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0036.718] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0036.718] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0036.718] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20
	[0036.718] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf"
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.zip") returned 0
	[0036.718] lstrlenA (lpString="*.zip") returned 5
	[0036.718] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rar") returned 0
	[0036.719] lstrlenA (lpString="*.rar") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.7z") returned 0
	[0036.719] lstrlenA (lpString="*.7z") returned 4
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tar") returned 0
	[0036.719] lstrlenA (lpString="*.tar") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gzip") returned 0
	[0036.719] lstrlenA (lpString="*.gzip") returned 6
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpg") returned 0
	[0036.719] lstrlenA (lpString="*.jpg") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpeg") returned 0
	[0036.719] lstrlenA (lpString="*.jpeg") returned 6
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.psd") returned 0
	[0036.719] lstrlenA (lpString="*.psd") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cdr") returned 0
	[0036.719] lstrlenA (lpString="*.cdr") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dwg") returned 0
	[0036.719] lstrlenA (lpString="*.dwg") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.max") returned 0
	[0036.719] lstrlenA (lpString="*.max") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bmp") returned 0
	[0036.719] lstrlenA (lpString="*.bmp") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gif") returned 0
	[0036.719] lstrlenA (lpString="*.gif") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.png") returned 0
	[0036.719] lstrlenA (lpString="*.png") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0
	[0036.719] lstrlenA (lpString="*.doc") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docx") returned 0
	[0036.719] lstrlenA (lpString="*.docx") returned 6
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xls") returned 0
	[0036.719] lstrlenA (lpString="*.xls") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsx") returned 0
	[0036.719] lstrlenA (lpString="*.xlsx") returned 6
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ppt") returned 0
	[0036.719] lstrlenA (lpString="*.ppt") returned 5
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pptx") returned 0
	[0036.719] lstrlenA (lpString="*.pptx") returned 6
	[0036.719] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.txt") returned 0
	[0036.720] lstrlenA (lpString="*.txt") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pdf") returned 0
	[0036.720] lstrlenA (lpString="*.pdf") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.djvu") returned 0
	[0036.720] lstrlenA (lpString="*.djvu") returned 6
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.htm") returned 0
	[0036.720] lstrlenA (lpString="*.htm") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.html") returned 0
	[0036.720] lstrlenA (lpString="*.html") returned 6
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdb") returned 0
	[0036.720] lstrlenA (lpString="*.mdb") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cer") returned 0
	[0036.720] lstrlenA (lpString="*.cer") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.p12") returned 0
	[0036.720] lstrlenA (lpString="*.p12") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pfx") returned 0
	[0036.720] lstrlenA (lpString="*.pfx") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.kwm") returned 0
	[0036.720] lstrlenA (lpString="*.kwm") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pwm") returned 0
	[0036.720] lstrlenA (lpString="*.pwm") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.1cd") returned 0
	[0036.720] lstrlenA (lpString="*.1cd") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.md") returned 0
	[0036.720] lstrlenA (lpString="*.md") returned 4
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdf") returned 0
	[0036.720] lstrlenA (lpString="*.mdf") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dbf") returned 0
	[0036.720] lstrlenA (lpString="*.dbf") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.odt") returned 0
	[0036.720] lstrlenA (lpString="*.odt") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vob") returned 0
	[0036.720] lstrlenA (lpString="*.vob") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ifo") returned 0
	[0036.720] lstrlenA (lpString="*.ifo") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.lnk") returned 0
	[0036.720] lstrlenA (lpString="*.lnk") returned 5
	[0036.720] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.torrent") returned 0
	[0036.721] lstrlenA (lpString="*.torrent") returned 9
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mov") returned 0
	[0036.721] lstrlenA (lpString="*.mov") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.m2v") returned 0
	[0036.721] lstrlenA (lpString="*.m2v") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.3gp") returned 0
	[0036.721] lstrlenA (lpString="*.3gp") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpeg") returned 0
	[0036.721] lstrlenA (lpString="*.mpeg") returned 6
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpg") returned 0
	[0036.721] lstrlenA (lpString="*.mpg") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flv") returned 0
	[0036.721] lstrlenA (lpString="*.flv") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.avi") returned 0
	[0036.721] lstrlenA (lpString="*.avi") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp4") returned 0
	[0036.721] lstrlenA (lpString="*.mp4") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wmv") returned 0
	[0036.721] lstrlenA (lpString="*.wmv") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.divx") returned 0
	[0036.721] lstrlenA (lpString="*.divx") returned 6
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mkv") returned 0
	[0036.721] lstrlenA (lpString="*.mkv") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp3") returned 0
	[0036.721] lstrlenA (lpString="*.mp3") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wav") returned 0
	[0036.721] lstrlenA (lpString="*.wav") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flac") returned 0
	[0036.721] lstrlenA (lpString="*.flac") returned 6
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ape") returned 0
	[0036.721] lstrlenA (lpString="*.ape") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wma") returned 0
	[0036.721] lstrlenA (lpString="*.wma") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ac3") returned 0
	[0036.721] lstrlenA (lpString="*.ac3") returned 5
	[0036.721] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.exe") returned 0
	[0036.721] lstrlenA (lpString="*.exe") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.apk") returned 0
	[0036.722] lstrlenA (lpString="*.apk") returned 5
	[0036.722] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.722] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.722] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wgl4_boot.ttf") returned -1
	[0036.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wgl4_boot.ttf") returned -1
	[0036.722] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1
	[0036.722] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf"
	[0036.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\"
	[0036.722] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned=""
	[0036.722] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0036.722] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20
	[0036.722] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf"
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.zip") returned 0
	[0036.722] lstrlenA (lpString="*.zip") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.rar") returned 0
	[0036.722] lstrlenA (lpString="*.rar") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.7z") returned 0
	[0036.722] lstrlenA (lpString="*.7z") returned 4
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tar") returned 0
	[0036.722] lstrlenA (lpString="*.tar") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gzip") returned 0
	[0036.722] lstrlenA (lpString="*.gzip") returned 6
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpg") returned 0
	[0036.722] lstrlenA (lpString="*.jpg") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpeg") returned 0
	[0036.722] lstrlenA (lpString="*.jpeg") returned 6
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.psd") returned 0
	[0036.722] lstrlenA (lpString="*.psd") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cdr") returned 0
	[0036.722] lstrlenA (lpString="*.cdr") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dwg") returned 0
	[0036.722] lstrlenA (lpString="*.dwg") returned 5
	[0036.722] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.max") returned 0
	[0036.722] lstrlenA (lpString="*.max") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.bmp") returned 0
	[0036.723] lstrlenA (lpString="*.bmp") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gif") returned 0
	[0036.723] lstrlenA (lpString="*.gif") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.png") returned 0
	[0036.723] lstrlenA (lpString="*.png") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.doc") returned 0
	[0036.723] lstrlenA (lpString="*.doc") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.docx") returned 0
	[0036.723] lstrlenA (lpString="*.docx") returned 6
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xls") returned 0
	[0036.723] lstrlenA (lpString="*.xls") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xlsx") returned 0
	[0036.723] lstrlenA (lpString="*.xlsx") returned 6
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ppt") returned 0
	[0036.723] lstrlenA (lpString="*.ppt") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pptx") returned 0
	[0036.723] lstrlenA (lpString="*.pptx") returned 6
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.txt") returned 0
	[0036.723] lstrlenA (lpString="*.txt") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pdf") returned 0
	[0036.723] lstrlenA (lpString="*.pdf") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.djvu") returned 0
	[0036.723] lstrlenA (lpString="*.djvu") returned 6
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.htm") returned 0
	[0036.723] lstrlenA (lpString="*.htm") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.html") returned 0
	[0036.723] lstrlenA (lpString="*.html") returned 6
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mdb") returned 0
	[0036.723] lstrlenA (lpString="*.mdb") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cer") returned 0
	[0036.723] lstrlenA (lpString="*.cer") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.p12") returned 0
	[0036.723] lstrlenA (lpString="*.p12") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pfx") returned 0
	[0036.723] lstrlenA (lpString="*.pfx") returned 5
	[0036.723] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.kwm") returned 0
	[0036.723] lstrlenA (lpString="*.kwm") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pwm") returned 0
	[0036.724] lstrlenA (lpString="*.pwm") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.1cd") returned 0
	[0036.724] lstrlenA (lpString="*.1cd") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.md") returned 0
	[0036.724] lstrlenA (lpString="*.md") returned 4
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mdf") returned 0
	[0036.724] lstrlenA (lpString="*.mdf") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dbf") returned 0
	[0036.724] lstrlenA (lpString="*.dbf") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.odt") returned 0
	[0036.724] lstrlenA (lpString="*.odt") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.vob") returned 0
	[0036.724] lstrlenA (lpString="*.vob") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ifo") returned 0
	[0036.724] lstrlenA (lpString="*.ifo") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.lnk") returned 0
	[0036.724] lstrlenA (lpString="*.lnk") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.torrent") returned 0
	[0036.724] lstrlenA (lpString="*.torrent") returned 9
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mov") returned 0
	[0036.724] lstrlenA (lpString="*.mov") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.m2v") returned 0
	[0036.724] lstrlenA (lpString="*.m2v") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.3gp") returned 0
	[0036.724] lstrlenA (lpString="*.3gp") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpeg") returned 0
	[0036.724] lstrlenA (lpString="*.mpeg") returned 6
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpg") returned 0
	[0036.724] lstrlenA (lpString="*.mpg") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flv") returned 0
	[0036.724] lstrlenA (lpString="*.flv") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.avi") returned 0
	[0036.724] lstrlenA (lpString="*.avi") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp4") returned 0
	[0036.724] lstrlenA (lpString="*.mp4") returned 5
	[0036.724] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wmv") returned 0
	[0036.724] lstrlenA (lpString="*.wmv") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.divx") returned 0
	[0036.725] lstrlenA (lpString="*.divx") returned 6
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mkv") returned 0
	[0036.725] lstrlenA (lpString="*.mkv") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp3") returned 0
	[0036.725] lstrlenA (lpString="*.mp3") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wav") returned 0
	[0036.725] lstrlenA (lpString="*.wav") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flac") returned 0
	[0036.725] lstrlenA (lpString="*.flac") returned 6
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ape") returned 0
	[0036.725] lstrlenA (lpString="*.ape") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wma") returned 0
	[0036.725] lstrlenA (lpString="*.wma") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ac3") returned 0
	[0036.725] lstrlenA (lpString="*.ac3") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.exe") returned 0
	[0036.725] lstrlenA (lpString="*.exe") returned 5
	[0036.725] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.apk") returned 0
	[0036.725] lstrlenA (lpString="*.apk") returned 5
	[0036.725] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.725] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.725] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.725] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1
	[0036.725] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1
	[0036.725] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.725] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR"
	[0036.725] lstrlenA (lpString="C:\\Boot\\fr-FR") returned 13
	[0036.725] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.726] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.726] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.727] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.727] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.727] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.727] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.727] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.727] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.727] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\*.*") returned="*.*"
	[0036.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\"
	[0036.727] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned=""
	[0036.727] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt"
	[0036.727] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff
	[0036.727] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.727] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.727] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.728] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.728] CloseHandle (hObject=0x84) returned 1
	[0036.730] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui"
	[0036.730] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.730] lstrlenA (lpString="*.zip") returned 5
	[0036.730] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.731] lstrlenA (lpString="*.rar") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.731] lstrlenA (lpString="*.7z") returned 4
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.731] lstrlenA (lpString="*.tar") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.731] lstrlenA (lpString="*.gzip") returned 6
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.731] lstrlenA (lpString="*.jpg") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.731] lstrlenA (lpString="*.jpeg") returned 6
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.731] lstrlenA (lpString="*.psd") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.731] lstrlenA (lpString="*.cdr") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.731] lstrlenA (lpString="*.dwg") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.731] lstrlenA (lpString="*.max") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.731] lstrlenA (lpString="*.bmp") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.731] lstrlenA (lpString="*.gif") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.731] lstrlenA (lpString="*.png") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.731] lstrlenA (lpString="*.doc") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.731] lstrlenA (lpString="*.docx") returned 6
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.731] lstrlenA (lpString="*.xls") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.731] lstrlenA (lpString="*.xlsx") returned 6
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.731] lstrlenA (lpString="*.ppt") returned 5
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.731] lstrlenA (lpString="*.pptx") returned 6
	[0036.731] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.732] lstrlenA (lpString="*.txt") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.732] lstrlenA (lpString="*.pdf") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.732] lstrlenA (lpString="*.djvu") returned 6
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.732] lstrlenA (lpString="*.htm") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.732] lstrlenA (lpString="*.html") returned 6
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.732] lstrlenA (lpString="*.mdb") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.732] lstrlenA (lpString="*.cer") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.732] lstrlenA (lpString="*.p12") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.732] lstrlenA (lpString="*.pfx") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.732] lstrlenA (lpString="*.kwm") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.732] lstrlenA (lpString="*.pwm") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.732] lstrlenA (lpString="*.1cd") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.732] lstrlenA (lpString="*.md") returned 4
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.732] lstrlenA (lpString="*.mdf") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.732] lstrlenA (lpString="*.dbf") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.732] lstrlenA (lpString="*.odt") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.732] lstrlenA (lpString="*.vob") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.732] lstrlenA (lpString="*.ifo") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.732] lstrlenA (lpString="*.lnk") returned 5
	[0036.732] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.733] lstrlenA (lpString="*.torrent") returned 9
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.733] lstrlenA (lpString="*.mov") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.733] lstrlenA (lpString="*.m2v") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.733] lstrlenA (lpString="*.3gp") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.733] lstrlenA (lpString="*.mpeg") returned 6
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.733] lstrlenA (lpString="*.mpg") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.733] lstrlenA (lpString="*.flv") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.733] lstrlenA (lpString="*.avi") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.733] lstrlenA (lpString="*.mp4") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.733] lstrlenA (lpString="*.wmv") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.733] lstrlenA (lpString="*.divx") returned 6
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.733] lstrlenA (lpString="*.mkv") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.733] lstrlenA (lpString="*.mp3") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.733] lstrlenA (lpString="*.wav") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.733] lstrlenA (lpString="*.flac") returned 6
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.733] lstrlenA (lpString="*.ape") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.733] lstrlenA (lpString="*.wma") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.733] lstrlenA (lpString="*.ac3") returned 5
	[0036.733] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.733] lstrlenA (lpString="*.exe") returned 5
	[0036.734] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.734] lstrlenA (lpString="*.apk") returned 5
	[0036.734] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.734] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.734] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.734] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1
	[0036.734] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1
	[0036.734] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.734] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU"
	[0036.734] lstrlenA (lpString="C:\\Boot\\hu-HU") returned 13
	[0036.734] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.734] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.734] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.734] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.734] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.734] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.734] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.734] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.735] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.735] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\*.*") returned="*.*"
	[0036.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\"
	[0036.735] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned=""
	[0036.735] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt"
	[0036.735] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff
	[0036.735] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.735] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.735] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.736] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.736] CloseHandle (hObject=0x84) returned 1
	[0036.736] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui"
	[0036.736] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.736] lstrlenA (lpString="*.zip") returned 5
	[0036.736] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.736] lstrlenA (lpString="*.rar") returned 5
	[0036.736] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.736] lstrlenA (lpString="*.7z") returned 4
	[0036.736] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.736] lstrlenA (lpString="*.tar") returned 5
	[0036.736] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.736] lstrlenA (lpString="*.gzip") returned 6
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.737] lstrlenA (lpString="*.jpg") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.737] lstrlenA (lpString="*.jpeg") returned 6
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.737] lstrlenA (lpString="*.psd") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.737] lstrlenA (lpString="*.cdr") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.737] lstrlenA (lpString="*.dwg") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.737] lstrlenA (lpString="*.max") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.737] lstrlenA (lpString="*.bmp") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.737] lstrlenA (lpString="*.gif") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.737] lstrlenA (lpString="*.png") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.737] lstrlenA (lpString="*.doc") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.737] lstrlenA (lpString="*.docx") returned 6
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.737] lstrlenA (lpString="*.xls") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.737] lstrlenA (lpString="*.xlsx") returned 6
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.737] lstrlenA (lpString="*.ppt") returned 5
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.737] lstrlenA (lpString="*.pptx") returned 6
	[0036.737] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.737] lstrlenA (lpString="*.txt") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.738] lstrlenA (lpString="*.pdf") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.738] lstrlenA (lpString="*.djvu") returned 6
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.738] lstrlenA (lpString="*.htm") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.738] lstrlenA (lpString="*.html") returned 6
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.738] lstrlenA (lpString="*.mdb") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.738] lstrlenA (lpString="*.cer") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.738] lstrlenA (lpString="*.p12") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.738] lstrlenA (lpString="*.pfx") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.738] lstrlenA (lpString="*.kwm") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.738] lstrlenA (lpString="*.pwm") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.738] lstrlenA (lpString="*.1cd") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.738] lstrlenA (lpString="*.md") returned 4
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.738] lstrlenA (lpString="*.mdf") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.738] lstrlenA (lpString="*.dbf") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.738] lstrlenA (lpString="*.odt") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.738] lstrlenA (lpString="*.vob") returned 5
	[0036.738] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.739] lstrlenA (lpString="*.ifo") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.739] lstrlenA (lpString="*.lnk") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.739] lstrlenA (lpString="*.torrent") returned 9
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.739] lstrlenA (lpString="*.mov") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.739] lstrlenA (lpString="*.m2v") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.739] lstrlenA (lpString="*.3gp") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.739] lstrlenA (lpString="*.mpeg") returned 6
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.739] lstrlenA (lpString="*.mpg") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.739] lstrlenA (lpString="*.flv") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.739] lstrlenA (lpString="*.avi") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.739] lstrlenA (lpString="*.mp4") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.739] lstrlenA (lpString="*.wmv") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.739] lstrlenA (lpString="*.divx") returned 6
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.739] lstrlenA (lpString="*.mkv") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.739] lstrlenA (lpString="*.mp3") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.739] lstrlenA (lpString="*.wav") returned 5
	[0036.739] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.740] lstrlenA (lpString="*.flac") returned 6
	[0036.740] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.740] lstrlenA (lpString="*.ape") returned 5
	[0036.740] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.740] lstrlenA (lpString="*.wma") returned 5
	[0036.740] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.740] lstrlenA (lpString="*.ac3") returned 5
	[0036.740] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.740] lstrlenA (lpString="*.exe") returned 5
	[0036.740] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.740] lstrlenA (lpString="*.apk") returned 5
	[0036.740] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.740] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.740] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.740] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1
	[0036.740] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1
	[0036.740] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.740] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT"
	[0036.740] lstrlenA (lpString="C:\\Boot\\it-IT") returned 13
	[0036.740] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.741] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.741] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.741] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.741] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.741] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.741] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.741] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.741] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.741] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\*.*") returned="*.*"
	[0036.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\"
	[0036.741] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned=""
	[0036.742] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt"
	[0036.742] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt")) returned 0xffffffff
	[0036.742] CreateFileA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.742] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.742] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.743] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.743] CloseHandle (hObject=0x84) returned 1
	[0036.743] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui"
	[0036.743] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.743] lstrlenA (lpString="*.zip") returned 5
	[0036.743] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.743] lstrlenA (lpString="*.rar") returned 5
	[0036.743] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.743] lstrlenA (lpString="*.7z") returned 4
	[0036.743] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.743] lstrlenA (lpString="*.tar") returned 5
	[0036.743] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.743] lstrlenA (lpString="*.gzip") returned 6
	[0036.743] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.743] lstrlenA (lpString="*.jpg") returned 5
	[0036.743] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.744] lstrlenA (lpString="*.jpeg") returned 6
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.744] lstrlenA (lpString="*.psd") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.744] lstrlenA (lpString="*.cdr") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.744] lstrlenA (lpString="*.dwg") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.744] lstrlenA (lpString="*.max") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.744] lstrlenA (lpString="*.bmp") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.744] lstrlenA (lpString="*.gif") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.744] lstrlenA (lpString="*.png") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.744] lstrlenA (lpString="*.doc") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.744] lstrlenA (lpString="*.docx") returned 6
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.744] lstrlenA (lpString="*.xls") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.744] lstrlenA (lpString="*.xlsx") returned 6
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.744] lstrlenA (lpString="*.ppt") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.744] lstrlenA (lpString="*.pptx") returned 6
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.744] lstrlenA (lpString="*.txt") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.744] lstrlenA (lpString="*.pdf") returned 5
	[0036.744] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.745] lstrlenA (lpString="*.djvu") returned 6
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.745] lstrlenA (lpString="*.htm") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.745] lstrlenA (lpString="*.html") returned 6
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.745] lstrlenA (lpString="*.mdb") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.745] lstrlenA (lpString="*.cer") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.745] lstrlenA (lpString="*.p12") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.745] lstrlenA (lpString="*.pfx") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.745] lstrlenA (lpString="*.kwm") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.745] lstrlenA (lpString="*.pwm") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.745] lstrlenA (lpString="*.1cd") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.745] lstrlenA (lpString="*.md") returned 4
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.745] lstrlenA (lpString="*.mdf") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.745] lstrlenA (lpString="*.dbf") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.745] lstrlenA (lpString="*.odt") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.745] lstrlenA (lpString="*.vob") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.745] lstrlenA (lpString="*.ifo") returned 5
	[0036.745] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.745] lstrlenA (lpString="*.lnk") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.746] lstrlenA (lpString="*.torrent") returned 9
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.746] lstrlenA (lpString="*.mov") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.746] lstrlenA (lpString="*.m2v") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.746] lstrlenA (lpString="*.3gp") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.746] lstrlenA (lpString="*.mpeg") returned 6
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.746] lstrlenA (lpString="*.mpg") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.746] lstrlenA (lpString="*.flv") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.746] lstrlenA (lpString="*.avi") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.746] lstrlenA (lpString="*.mp4") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.746] lstrlenA (lpString="*.wmv") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.746] lstrlenA (lpString="*.divx") returned 6
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.746] lstrlenA (lpString="*.mkv") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.746] lstrlenA (lpString="*.mp3") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.746] lstrlenA (lpString="*.wav") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.746] lstrlenA (lpString="*.flac") returned 6
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.746] lstrlenA (lpString="*.ape") returned 5
	[0036.746] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.747] lstrlenA (lpString="*.wma") returned 5
	[0036.747] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.747] lstrlenA (lpString="*.ac3") returned 5
	[0036.747] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.747] lstrlenA (lpString="*.exe") returned 5
	[0036.747] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.747] lstrlenA (lpString="*.apk") returned 5
	[0036.747] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.747] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.747] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.747] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1
	[0036.747] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1
	[0036.747] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.747] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP"
	[0036.747] lstrlenA (lpString="C:\\Boot\\ja-JP") returned 13
	[0036.747] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.747] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.747] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.747] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.747] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.747] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.748] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.748] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.748] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.748] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\*.*") returned="*.*"
	[0036.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\"
	[0036.748] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned=""
	[0036.748] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt"
	[0036.748] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff
	[0036.748] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.748] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.748] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.749] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.749] CloseHandle (hObject=0x84) returned 1
	[0036.750] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui"
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.750] lstrlenA (lpString="*.zip") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.750] lstrlenA (lpString="*.rar") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.750] lstrlenA (lpString="*.7z") returned 4
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.750] lstrlenA (lpString="*.tar") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.750] lstrlenA (lpString="*.gzip") returned 6
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.750] lstrlenA (lpString="*.jpg") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.750] lstrlenA (lpString="*.jpeg") returned 6
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.750] lstrlenA (lpString="*.psd") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.750] lstrlenA (lpString="*.cdr") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.750] lstrlenA (lpString="*.dwg") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.750] lstrlenA (lpString="*.max") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.750] lstrlenA (lpString="*.bmp") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.750] lstrlenA (lpString="*.gif") returned 5
	[0036.750] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.750] lstrlenA (lpString="*.png") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.751] lstrlenA (lpString="*.doc") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.751] lstrlenA (lpString="*.docx") returned 6
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.751] lstrlenA (lpString="*.xls") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.751] lstrlenA (lpString="*.xlsx") returned 6
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.751] lstrlenA (lpString="*.ppt") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.751] lstrlenA (lpString="*.pptx") returned 6
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.751] lstrlenA (lpString="*.txt") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.751] lstrlenA (lpString="*.pdf") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.751] lstrlenA (lpString="*.djvu") returned 6
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.751] lstrlenA (lpString="*.htm") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.751] lstrlenA (lpString="*.html") returned 6
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.751] lstrlenA (lpString="*.mdb") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.751] lstrlenA (lpString="*.cer") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.751] lstrlenA (lpString="*.p12") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.751] lstrlenA (lpString="*.pfx") returned 5
	[0036.751] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.751] lstrlenA (lpString="*.kwm") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.752] lstrlenA (lpString="*.pwm") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.752] lstrlenA (lpString="*.1cd") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.752] lstrlenA (lpString="*.md") returned 4
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.752] lstrlenA (lpString="*.mdf") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.752] lstrlenA (lpString="*.dbf") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.752] lstrlenA (lpString="*.odt") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.752] lstrlenA (lpString="*.vob") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.752] lstrlenA (lpString="*.ifo") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.752] lstrlenA (lpString="*.lnk") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.752] lstrlenA (lpString="*.torrent") returned 9
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.752] lstrlenA (lpString="*.mov") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.752] lstrlenA (lpString="*.m2v") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.752] lstrlenA (lpString="*.3gp") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.752] lstrlenA (lpString="*.mpeg") returned 6
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.752] lstrlenA (lpString="*.mpg") returned 5
	[0036.752] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.752] lstrlenA (lpString="*.flv") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.753] lstrlenA (lpString="*.avi") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.753] lstrlenA (lpString="*.mp4") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.753] lstrlenA (lpString="*.wmv") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.753] lstrlenA (lpString="*.divx") returned 6
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.753] lstrlenA (lpString="*.mkv") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.753] lstrlenA (lpString="*.mp3") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.753] lstrlenA (lpString="*.wav") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.753] lstrlenA (lpString="*.flac") returned 6
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.753] lstrlenA (lpString="*.ape") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.753] lstrlenA (lpString="*.wma") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.753] lstrlenA (lpString="*.ac3") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.753] lstrlenA (lpString="*.exe") returned 5
	[0036.753] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.753] lstrlenA (lpString="*.apk") returned 5
	[0036.753] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.753] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.753] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.753] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1
	[0036.753] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1
	[0036.754] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.754] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR"
	[0036.754] lstrlenA (lpString="C:\\Boot\\ko-KR") returned 13
	[0036.754] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.755] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.755] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.755] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.755] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.755] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.755] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.755] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.755] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.755] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\*.*") returned="*.*"
	[0036.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\"
	[0036.755] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned=""
	[0036.755] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt"
	[0036.755] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff
	[0036.755] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.755] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.755] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.756] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.756] CloseHandle (hObject=0x84) returned 1
	[0036.756] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui"
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.757] lstrlenA (lpString="*.zip") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.757] lstrlenA (lpString="*.rar") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.757] lstrlenA (lpString="*.7z") returned 4
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.757] lstrlenA (lpString="*.tar") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.757] lstrlenA (lpString="*.gzip") returned 6
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.757] lstrlenA (lpString="*.jpg") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.757] lstrlenA (lpString="*.jpeg") returned 6
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.757] lstrlenA (lpString="*.psd") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.757] lstrlenA (lpString="*.cdr") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.757] lstrlenA (lpString="*.dwg") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.757] lstrlenA (lpString="*.max") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.757] lstrlenA (lpString="*.bmp") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.757] lstrlenA (lpString="*.gif") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.757] lstrlenA (lpString="*.png") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.757] lstrlenA (lpString="*.doc") returned 5
	[0036.757] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.757] lstrlenA (lpString="*.docx") returned 6
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.758] lstrlenA (lpString="*.xls") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.758] lstrlenA (lpString="*.xlsx") returned 6
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.758] lstrlenA (lpString="*.ppt") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.758] lstrlenA (lpString="*.pptx") returned 6
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.758] lstrlenA (lpString="*.txt") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.758] lstrlenA (lpString="*.pdf") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.758] lstrlenA (lpString="*.djvu") returned 6
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.758] lstrlenA (lpString="*.htm") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.758] lstrlenA (lpString="*.html") returned 6
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.758] lstrlenA (lpString="*.mdb") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.758] lstrlenA (lpString="*.cer") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.758] lstrlenA (lpString="*.p12") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.758] lstrlenA (lpString="*.pfx") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.758] lstrlenA (lpString="*.kwm") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.758] lstrlenA (lpString="*.pwm") returned 5
	[0036.758] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.758] lstrlenA (lpString="*.1cd") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.759] lstrlenA (lpString="*.md") returned 4
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.759] lstrlenA (lpString="*.mdf") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.759] lstrlenA (lpString="*.dbf") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.759] lstrlenA (lpString="*.odt") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.759] lstrlenA (lpString="*.vob") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.759] lstrlenA (lpString="*.ifo") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.759] lstrlenA (lpString="*.lnk") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.759] lstrlenA (lpString="*.torrent") returned 9
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.759] lstrlenA (lpString="*.mov") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.759] lstrlenA (lpString="*.m2v") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.759] lstrlenA (lpString="*.3gp") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.759] lstrlenA (lpString="*.mpeg") returned 6
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.759] lstrlenA (lpString="*.mpg") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.759] lstrlenA (lpString="*.flv") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.759] lstrlenA (lpString="*.avi") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.759] lstrlenA (lpString="*.mp4") returned 5
	[0036.759] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.760] lstrlenA (lpString="*.wmv") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.760] lstrlenA (lpString="*.divx") returned 6
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.760] lstrlenA (lpString="*.mkv") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.760] lstrlenA (lpString="*.mp3") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.760] lstrlenA (lpString="*.wav") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.760] lstrlenA (lpString="*.flac") returned 6
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.760] lstrlenA (lpString="*.ape") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.760] lstrlenA (lpString="*.wma") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.760] lstrlenA (lpString="*.ac3") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.760] lstrlenA (lpString="*.exe") returned 5
	[0036.760] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.760] lstrlenA (lpString="*.apk") returned 5
	[0036.760] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.760] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.760] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.760] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0
	[0036.760] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="memtest.exe") returned -1
	[0036.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe") returned -1
	[0036.760] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1
	[0036.760] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\"
	[0036.761] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned=""
	[0036.761] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt"
	[0036.761] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20
	[0036.761] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe"
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.zip") returned 0
	[0036.761] lstrlenA (lpString="*.zip") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rar") returned 0
	[0036.761] lstrlenA (lpString="*.rar") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.7z") returned 0
	[0036.761] lstrlenA (lpString="*.7z") returned 4
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tar") returned 0
	[0036.761] lstrlenA (lpString="*.tar") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gzip") returned 0
	[0036.761] lstrlenA (lpString="*.gzip") returned 6
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpg") returned 0
	[0036.761] lstrlenA (lpString="*.jpg") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpeg") returned 0
	[0036.761] lstrlenA (lpString="*.jpeg") returned 6
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.psd") returned 0
	[0036.761] lstrlenA (lpString="*.psd") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cdr") returned 0
	[0036.761] lstrlenA (lpString="*.cdr") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dwg") returned 0
	[0036.761] lstrlenA (lpString="*.dwg") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.max") returned 0
	[0036.761] lstrlenA (lpString="*.max") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bmp") returned 0
	[0036.761] lstrlenA (lpString="*.bmp") returned 5
	[0036.761] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gif") returned 0
	[0036.761] lstrlenA (lpString="*.gif") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.png") returned 0
	[0036.762] lstrlenA (lpString="*.png") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0
	[0036.762] lstrlenA (lpString="*.doc") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docx") returned 0
	[0036.762] lstrlenA (lpString="*.docx") returned 6
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xls") returned 0
	[0036.762] lstrlenA (lpString="*.xls") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsx") returned 0
	[0036.762] lstrlenA (lpString="*.xlsx") returned 6
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ppt") returned 0
	[0036.762] lstrlenA (lpString="*.ppt") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pptx") returned 0
	[0036.762] lstrlenA (lpString="*.pptx") returned 6
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.txt") returned 0
	[0036.762] lstrlenA (lpString="*.txt") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pdf") returned 0
	[0036.762] lstrlenA (lpString="*.pdf") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.djvu") returned 0
	[0036.762] lstrlenA (lpString="*.djvu") returned 6
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.htm") returned 0
	[0036.762] lstrlenA (lpString="*.htm") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.html") returned 0
	[0036.762] lstrlenA (lpString="*.html") returned 6
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdb") returned 0
	[0036.762] lstrlenA (lpString="*.mdb") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cer") returned 0
	[0036.762] lstrlenA (lpString="*.cer") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.p12") returned 0
	[0036.762] lstrlenA (lpString="*.p12") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pfx") returned 0
	[0036.762] lstrlenA (lpString="*.pfx") returned 5
	[0036.762] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.kwm") returned 0
	[0036.763] lstrlenA (lpString="*.kwm") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pwm") returned 0
	[0036.763] lstrlenA (lpString="*.pwm") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.1cd") returned 0
	[0036.763] lstrlenA (lpString="*.1cd") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.md") returned 0
	[0036.763] lstrlenA (lpString="*.md") returned 4
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdf") returned 0
	[0036.763] lstrlenA (lpString="*.mdf") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dbf") returned 0
	[0036.763] lstrlenA (lpString="*.dbf") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.odt") returned 0
	[0036.763] lstrlenA (lpString="*.odt") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vob") returned 0
	[0036.763] lstrlenA (lpString="*.vob") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ifo") returned 0
	[0036.763] lstrlenA (lpString="*.ifo") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.lnk") returned 0
	[0036.763] lstrlenA (lpString="*.lnk") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.torrent") returned 0
	[0036.763] lstrlenA (lpString="*.torrent") returned 9
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mov") returned 0
	[0036.763] lstrlenA (lpString="*.mov") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.m2v") returned 0
	[0036.763] lstrlenA (lpString="*.m2v") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.3gp") returned 0
	[0036.763] lstrlenA (lpString="*.3gp") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpeg") returned 0
	[0036.763] lstrlenA (lpString="*.mpeg") returned 6
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpg") returned 0
	[0036.763] lstrlenA (lpString="*.mpg") returned 5
	[0036.763] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flv") returned 0
	[0036.764] lstrlenA (lpString="*.flv") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.avi") returned 0
	[0036.764] lstrlenA (lpString="*.avi") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp4") returned 0
	[0036.764] lstrlenA (lpString="*.mp4") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wmv") returned 0
	[0036.764] lstrlenA (lpString="*.wmv") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.divx") returned 0
	[0036.764] lstrlenA (lpString="*.divx") returned 6
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mkv") returned 0
	[0036.764] lstrlenA (lpString="*.mkv") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp3") returned 0
	[0036.764] lstrlenA (lpString="*.mp3") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wav") returned 0
	[0036.764] lstrlenA (lpString="*.wav") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flac") returned 0
	[0036.764] lstrlenA (lpString="*.flac") returned 6
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ape") returned 0
	[0036.764] lstrlenA (lpString="*.ape") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wma") returned 0
	[0036.764] lstrlenA (lpString="*.wma") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ac3") returned 0
	[0036.764] lstrlenA (lpString="*.ac3") returned 5
	[0036.764] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.exe") returned 1
	[0036.764] lstrlenA (lpString="*.exe") returned 5
	[0036.764] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Boot\\memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe"
	[0036.764] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Boot\\memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe"
	[0036.764] lstrcatA (in: lpString1="C:\\Boot\\memtest.exe", lpString2="." | out: lpString1="C:\\Boot\\memtest.exe.") returned="C:\\Boot\\memtest.exe."
	[0036.764] lstrcatA (in: lpString1="C:\\Boot\\memtest.exe.", lpString2="Boom" | out: lpString1="C:\\Boot\\memtest.exe.Boom") returned="C:\\Boot\\memtest.exe.Boom"
	[0036.764] CreateFileA (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0036.765] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.765] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1
	[0036.765] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1
	[0036.765] PathFindFileNameA (pszPath="C:\\Boot\\memtest.exe") returned="memtest.exe"
	[0036.765] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO"
	[0036.765] lstrlenA (lpString="C:\\Boot\\nb-NO") returned 13
	[0036.765] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.765] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.765] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.765] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.765] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.765] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.766] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.766] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.766] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\*.*") returned="*.*"
	[0036.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\"
	[0036.766] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned=""
	[0036.766] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt"
	[0036.766] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt")) returned 0xffffffff
	[0036.766] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.766] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.766] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.767] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.767] CloseHandle (hObject=0x84) returned 1
	[0036.767] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui"
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.767] lstrlenA (lpString="*.zip") returned 5
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.767] lstrlenA (lpString="*.rar") returned 5
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.767] lstrlenA (lpString="*.7z") returned 4
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.767] lstrlenA (lpString="*.tar") returned 5
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.767] lstrlenA (lpString="*.gzip") returned 6
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.767] lstrlenA (lpString="*.jpg") returned 5
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.767] lstrlenA (lpString="*.jpeg") returned 6
	[0036.767] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.767] lstrlenA (lpString="*.psd") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.768] lstrlenA (lpString="*.cdr") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.768] lstrlenA (lpString="*.dwg") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.768] lstrlenA (lpString="*.max") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.768] lstrlenA (lpString="*.bmp") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.768] lstrlenA (lpString="*.gif") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.768] lstrlenA (lpString="*.png") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.768] lstrlenA (lpString="*.doc") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.768] lstrlenA (lpString="*.docx") returned 6
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.768] lstrlenA (lpString="*.xls") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.768] lstrlenA (lpString="*.xlsx") returned 6
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.768] lstrlenA (lpString="*.ppt") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.768] lstrlenA (lpString="*.pptx") returned 6
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.768] lstrlenA (lpString="*.txt") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.768] lstrlenA (lpString="*.pdf") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.768] lstrlenA (lpString="*.djvu") returned 6
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.768] lstrlenA (lpString="*.htm") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.768] lstrlenA (lpString="*.html") returned 6
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.768] lstrlenA (lpString="*.mdb") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.768] lstrlenA (lpString="*.cer") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.768] lstrlenA (lpString="*.p12") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.768] lstrlenA (lpString="*.pfx") returned 5
	[0036.768] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.768] lstrlenA (lpString="*.kwm") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.769] lstrlenA (lpString="*.pwm") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.769] lstrlenA (lpString="*.1cd") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.769] lstrlenA (lpString="*.md") returned 4
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.769] lstrlenA (lpString="*.mdf") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.769] lstrlenA (lpString="*.dbf") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.769] lstrlenA (lpString="*.odt") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.769] lstrlenA (lpString="*.vob") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.769] lstrlenA (lpString="*.ifo") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.769] lstrlenA (lpString="*.lnk") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.769] lstrlenA (lpString="*.torrent") returned 9
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.769] lstrlenA (lpString="*.mov") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.769] lstrlenA (lpString="*.m2v") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.769] lstrlenA (lpString="*.3gp") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.769] lstrlenA (lpString="*.mpeg") returned 6
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.769] lstrlenA (lpString="*.mpg") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.769] lstrlenA (lpString="*.flv") returned 5
	[0036.769] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.769] lstrlenA (lpString="*.avi") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.770] lstrlenA (lpString="*.mp4") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.770] lstrlenA (lpString="*.wmv") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.770] lstrlenA (lpString="*.divx") returned 6
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.770] lstrlenA (lpString="*.mkv") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.770] lstrlenA (lpString="*.mp3") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.770] lstrlenA (lpString="*.wav") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.770] lstrlenA (lpString="*.flac") returned 6
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.770] lstrlenA (lpString="*.ape") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.770] lstrlenA (lpString="*.wma") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.770] lstrlenA (lpString="*.ac3") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.770] lstrlenA (lpString="*.exe") returned 5
	[0036.770] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.770] lstrlenA (lpString="*.apk") returned 5
	[0036.770] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.770] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.770] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.770] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1
	[0036.770] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1
	[0036.770] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.771] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL"
	[0036.771] lstrlenA (lpString="C:\\Boot\\nl-NL") returned 13
	[0036.771] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.771] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.772] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.772] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.772] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.772] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.772] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.772] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.772] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.772] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\*.*") returned="*.*"
	[0036.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\"
	[0036.772] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned=""
	[0036.772] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt"
	[0036.772] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff
	[0036.772] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.772] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.772] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.773] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.773] CloseHandle (hObject=0x84) returned 1
	[0036.773] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui"
	[0036.773] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.774] lstrlenA (lpString="*.zip") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.774] lstrlenA (lpString="*.rar") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.774] lstrlenA (lpString="*.7z") returned 4
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.774] lstrlenA (lpString="*.tar") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.774] lstrlenA (lpString="*.gzip") returned 6
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.774] lstrlenA (lpString="*.jpg") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.774] lstrlenA (lpString="*.jpeg") returned 6
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.774] lstrlenA (lpString="*.psd") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.774] lstrlenA (lpString="*.cdr") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.774] lstrlenA (lpString="*.dwg") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.774] lstrlenA (lpString="*.max") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.774] lstrlenA (lpString="*.bmp") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.774] lstrlenA (lpString="*.gif") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.774] lstrlenA (lpString="*.png") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.774] lstrlenA (lpString="*.doc") returned 5
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.774] lstrlenA (lpString="*.docx") returned 6
	[0036.774] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.775] lstrlenA (lpString="*.xls") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.775] lstrlenA (lpString="*.xlsx") returned 6
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.775] lstrlenA (lpString="*.ppt") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.775] lstrlenA (lpString="*.pptx") returned 6
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.775] lstrlenA (lpString="*.txt") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.775] lstrlenA (lpString="*.pdf") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.775] lstrlenA (lpString="*.djvu") returned 6
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.775] lstrlenA (lpString="*.htm") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.775] lstrlenA (lpString="*.html") returned 6
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.775] lstrlenA (lpString="*.mdb") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.775] lstrlenA (lpString="*.cer") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.775] lstrlenA (lpString="*.p12") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.775] lstrlenA (lpString="*.pfx") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.775] lstrlenA (lpString="*.kwm") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.775] lstrlenA (lpString="*.pwm") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.775] lstrlenA (lpString="*.1cd") returned 5
	[0036.775] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.775] lstrlenA (lpString="*.md") returned 4
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.776] lstrlenA (lpString="*.mdf") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.776] lstrlenA (lpString="*.dbf") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.776] lstrlenA (lpString="*.odt") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.776] lstrlenA (lpString="*.vob") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.776] lstrlenA (lpString="*.ifo") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.776] lstrlenA (lpString="*.lnk") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.776] lstrlenA (lpString="*.torrent") returned 9
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.776] lstrlenA (lpString="*.mov") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.776] lstrlenA (lpString="*.m2v") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.776] lstrlenA (lpString="*.3gp") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.776] lstrlenA (lpString="*.mpeg") returned 6
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.776] lstrlenA (lpString="*.mpg") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.776] lstrlenA (lpString="*.flv") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.776] lstrlenA (lpString="*.avi") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.776] lstrlenA (lpString="*.mp4") returned 5
	[0036.776] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.776] lstrlenA (lpString="*.wmv") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.777] lstrlenA (lpString="*.divx") returned 6
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.777] lstrlenA (lpString="*.mkv") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.777] lstrlenA (lpString="*.mp3") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.777] lstrlenA (lpString="*.wav") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.777] lstrlenA (lpString="*.flac") returned 6
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.777] lstrlenA (lpString="*.ape") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.777] lstrlenA (lpString="*.wma") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.777] lstrlenA (lpString="*.ac3") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.777] lstrlenA (lpString="*.exe") returned 5
	[0036.777] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.777] lstrlenA (lpString="*.apk") returned 5
	[0036.777] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.777] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.777] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.777] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1
	[0036.777] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1
	[0036.777] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.777] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL"
	[0036.777] lstrlenA (lpString="C:\\Boot\\pl-PL") returned 13
	[0036.777] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.778] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.778] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.778] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.778] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.778] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.778] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.778] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.778] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.778] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\*.*") returned="*.*"
	[0036.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\"
	[0036.778] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned=""
	[0036.778] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt"
	[0036.778] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff
	[0036.778] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.778] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.779] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.779] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.779] CloseHandle (hObject=0x84) returned 1
	[0036.780] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui"
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.780] lstrlenA (lpString="*.zip") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.780] lstrlenA (lpString="*.rar") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.780] lstrlenA (lpString="*.7z") returned 4
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.780] lstrlenA (lpString="*.tar") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.780] lstrlenA (lpString="*.gzip") returned 6
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.780] lstrlenA (lpString="*.jpg") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.780] lstrlenA (lpString="*.jpeg") returned 6
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.780] lstrlenA (lpString="*.psd") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.780] lstrlenA (lpString="*.cdr") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.780] lstrlenA (lpString="*.dwg") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.780] lstrlenA (lpString="*.max") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.780] lstrlenA (lpString="*.bmp") returned 5
	[0036.780] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.781] lstrlenA (lpString="*.gif") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.781] lstrlenA (lpString="*.png") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.781] lstrlenA (lpString="*.doc") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.781] lstrlenA (lpString="*.docx") returned 6
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.781] lstrlenA (lpString="*.xls") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.781] lstrlenA (lpString="*.xlsx") returned 6
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.781] lstrlenA (lpString="*.ppt") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.781] lstrlenA (lpString="*.pptx") returned 6
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.781] lstrlenA (lpString="*.txt") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.781] lstrlenA (lpString="*.pdf") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.781] lstrlenA (lpString="*.djvu") returned 6
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.781] lstrlenA (lpString="*.htm") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.781] lstrlenA (lpString="*.html") returned 6
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.781] lstrlenA (lpString="*.mdb") returned 5
	[0036.781] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.781] lstrlenA (lpString="*.cer") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.782] lstrlenA (lpString="*.p12") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.782] lstrlenA (lpString="*.pfx") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.782] lstrlenA (lpString="*.kwm") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.782] lstrlenA (lpString="*.pwm") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.782] lstrlenA (lpString="*.1cd") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.782] lstrlenA (lpString="*.md") returned 4
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.782] lstrlenA (lpString="*.mdf") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.782] lstrlenA (lpString="*.dbf") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.782] lstrlenA (lpString="*.odt") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.782] lstrlenA (lpString="*.vob") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.782] lstrlenA (lpString="*.ifo") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.782] lstrlenA (lpString="*.lnk") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.782] lstrlenA (lpString="*.torrent") returned 9
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.782] lstrlenA (lpString="*.mov") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.782] lstrlenA (lpString="*.m2v") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.782] lstrlenA (lpString="*.3gp") returned 5
	[0036.782] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.783] lstrlenA (lpString="*.mpeg") returned 6
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.783] lstrlenA (lpString="*.mpg") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.783] lstrlenA (lpString="*.flv") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.783] lstrlenA (lpString="*.avi") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.783] lstrlenA (lpString="*.mp4") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.783] lstrlenA (lpString="*.wmv") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.783] lstrlenA (lpString="*.divx") returned 6
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.783] lstrlenA (lpString="*.mkv") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.783] lstrlenA (lpString="*.mp3") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.783] lstrlenA (lpString="*.wav") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.783] lstrlenA (lpString="*.flac") returned 6
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.783] lstrlenA (lpString="*.ape") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.783] lstrlenA (lpString="*.wma") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.783] lstrlenA (lpString="*.ac3") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.783] lstrlenA (lpString="*.exe") returned 5
	[0036.783] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.783] lstrlenA (lpString="*.apk") returned 5
	[0036.783] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.784] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.784] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.784] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1
	[0036.784] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1
	[0036.784] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.784] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR"
	[0036.784] lstrlenA (lpString="C:\\Boot\\pt-BR") returned 13
	[0036.784] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.785] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.785] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.785] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.785] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.785] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.785] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.785] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.785] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.785] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\*.*") returned="*.*"
	[0036.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\"
	[0036.785] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned=""
	[0036.785] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt"
	[0036.785] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt")) returned 0xffffffff
	[0036.785] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.785] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.785] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.786] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.786] CloseHandle (hObject=0x84) returned 1
	[0036.787] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui"
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.787] lstrlenA (lpString="*.zip") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.787] lstrlenA (lpString="*.rar") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.787] lstrlenA (lpString="*.7z") returned 4
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.787] lstrlenA (lpString="*.tar") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.787] lstrlenA (lpString="*.gzip") returned 6
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.787] lstrlenA (lpString="*.jpg") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.787] lstrlenA (lpString="*.jpeg") returned 6
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.787] lstrlenA (lpString="*.psd") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.787] lstrlenA (lpString="*.cdr") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.787] lstrlenA (lpString="*.dwg") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.787] lstrlenA (lpString="*.max") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.787] lstrlenA (lpString="*.bmp") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.787] lstrlenA (lpString="*.gif") returned 5
	[0036.787] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.787] lstrlenA (lpString="*.png") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.788] lstrlenA (lpString="*.doc") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.788] lstrlenA (lpString="*.docx") returned 6
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.788] lstrlenA (lpString="*.xls") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.788] lstrlenA (lpString="*.xlsx") returned 6
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.788] lstrlenA (lpString="*.ppt") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.788] lstrlenA (lpString="*.pptx") returned 6
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.788] lstrlenA (lpString="*.txt") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.788] lstrlenA (lpString="*.pdf") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.788] lstrlenA (lpString="*.djvu") returned 6
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.788] lstrlenA (lpString="*.htm") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.788] lstrlenA (lpString="*.html") returned 6
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.788] lstrlenA (lpString="*.mdb") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.788] lstrlenA (lpString="*.cer") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.788] lstrlenA (lpString="*.p12") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.788] lstrlenA (lpString="*.pfx") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.788] lstrlenA (lpString="*.kwm") returned 5
	[0036.788] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.789] lstrlenA (lpString="*.pwm") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.789] lstrlenA (lpString="*.1cd") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.789] lstrlenA (lpString="*.md") returned 4
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.789] lstrlenA (lpString="*.mdf") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.789] lstrlenA (lpString="*.dbf") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.789] lstrlenA (lpString="*.odt") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.789] lstrlenA (lpString="*.vob") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.789] lstrlenA (lpString="*.ifo") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.789] lstrlenA (lpString="*.lnk") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.789] lstrlenA (lpString="*.torrent") returned 9
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.789] lstrlenA (lpString="*.mov") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.789] lstrlenA (lpString="*.m2v") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.789] lstrlenA (lpString="*.3gp") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.789] lstrlenA (lpString="*.mpeg") returned 6
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.789] lstrlenA (lpString="*.mpg") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.789] lstrlenA (lpString="*.flv") returned 5
	[0036.789] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.789] lstrlenA (lpString="*.avi") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.790] lstrlenA (lpString="*.mp4") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.790] lstrlenA (lpString="*.wmv") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.790] lstrlenA (lpString="*.divx") returned 6
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.790] lstrlenA (lpString="*.mkv") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.790] lstrlenA (lpString="*.mp3") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.790] lstrlenA (lpString="*.wav") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.790] lstrlenA (lpString="*.flac") returned 6
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.790] lstrlenA (lpString="*.ape") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.790] lstrlenA (lpString="*.wma") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.790] lstrlenA (lpString="*.ac3") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.790] lstrlenA (lpString="*.exe") returned 5
	[0036.790] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.790] lstrlenA (lpString="*.apk") returned 5
	[0036.790] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.791] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.791] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.791] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1
	[0036.791] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1
	[0036.791] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.791] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT"
	[0036.791] lstrlenA (lpString="C:\\Boot\\pt-PT") returned 13
	[0036.791] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.791] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.791] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.791] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.791] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.791] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.791] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.791] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.791] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.791] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\*.*") returned="*.*"
	[0036.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\"
	[0036.791] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned=""
	[0036.791] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt"
	[0036.792] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff
	[0036.792] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.792] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.792] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.793] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.793] CloseHandle (hObject=0x84) returned 1
	[0036.793] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui"
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.793] lstrlenA (lpString="*.zip") returned 5
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.793] lstrlenA (lpString="*.rar") returned 5
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.793] lstrlenA (lpString="*.7z") returned 4
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.793] lstrlenA (lpString="*.tar") returned 5
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.793] lstrlenA (lpString="*.gzip") returned 6
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.793] lstrlenA (lpString="*.jpg") returned 5
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.793] lstrlenA (lpString="*.jpeg") returned 6
	[0036.793] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.794] lstrlenA (lpString="*.psd") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.794] lstrlenA (lpString="*.cdr") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.794] lstrlenA (lpString="*.dwg") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.794] lstrlenA (lpString="*.max") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.794] lstrlenA (lpString="*.bmp") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.794] lstrlenA (lpString="*.gif") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.794] lstrlenA (lpString="*.png") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.794] lstrlenA (lpString="*.doc") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.794] lstrlenA (lpString="*.docx") returned 6
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.794] lstrlenA (lpString="*.xls") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.794] lstrlenA (lpString="*.xlsx") returned 6
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.794] lstrlenA (lpString="*.ppt") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.794] lstrlenA (lpString="*.pptx") returned 6
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.794] lstrlenA (lpString="*.txt") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.794] lstrlenA (lpString="*.pdf") returned 5
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.794] lstrlenA (lpString="*.djvu") returned 6
	[0036.794] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.795] lstrlenA (lpString="*.htm") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.795] lstrlenA (lpString="*.html") returned 6
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.795] lstrlenA (lpString="*.mdb") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.795] lstrlenA (lpString="*.cer") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.795] lstrlenA (lpString="*.p12") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.795] lstrlenA (lpString="*.pfx") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.795] lstrlenA (lpString="*.kwm") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.795] lstrlenA (lpString="*.pwm") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.795] lstrlenA (lpString="*.1cd") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.795] lstrlenA (lpString="*.md") returned 4
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.795] lstrlenA (lpString="*.mdf") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.795] lstrlenA (lpString="*.dbf") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.795] lstrlenA (lpString="*.odt") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.795] lstrlenA (lpString="*.vob") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.795] lstrlenA (lpString="*.ifo") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.795] lstrlenA (lpString="*.lnk") returned 5
	[0036.795] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.795] lstrlenA (lpString="*.torrent") returned 9
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.796] lstrlenA (lpString="*.mov") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.796] lstrlenA (lpString="*.m2v") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.796] lstrlenA (lpString="*.3gp") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.796] lstrlenA (lpString="*.mpeg") returned 6
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.796] lstrlenA (lpString="*.mpg") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.796] lstrlenA (lpString="*.flv") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.796] lstrlenA (lpString="*.avi") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.796] lstrlenA (lpString="*.mp4") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.796] lstrlenA (lpString="*.wmv") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.796] lstrlenA (lpString="*.divx") returned 6
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.796] lstrlenA (lpString="*.mkv") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.796] lstrlenA (lpString="*.mp3") returned 5
	[0036.796] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.797] lstrlenA (lpString="*.wav") returned 5
	[0036.797] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.797] lstrlenA (lpString="*.flac") returned 6
	[0036.797] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.797] lstrlenA (lpString="*.ape") returned 5
	[0036.797] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.797] lstrlenA (lpString="*.wma") returned 5
	[0036.797] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.797] lstrlenA (lpString="*.ac3") returned 5
	[0036.797] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.797] lstrlenA (lpString="*.exe") returned 5
	[0036.797] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.797] lstrlenA (lpString="*.apk") returned 5
	[0036.797] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.797] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.797] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.797] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1
	[0036.797] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1
	[0036.797] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.797] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU"
	[0036.797] lstrlenA (lpString="C:\\Boot\\ru-RU") returned 13
	[0036.797] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.798] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.798] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.798] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.798] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.798] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.798] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.798] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.798] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.798] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\*.*") returned="*.*"
	[0036.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\"
	[0036.799] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned=""
	[0036.799] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt"
	[0036.799] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff
	[0036.799] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.799] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.799] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.800] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.800] CloseHandle (hObject=0x84) returned 1
	[0036.800] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui"
	[0036.800] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.800] lstrlenA (lpString="*.zip") returned 5
	[0036.800] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.800] lstrlenA (lpString="*.rar") returned 5
	[0036.800] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.800] lstrlenA (lpString="*.7z") returned 4
	[0036.800] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.800] lstrlenA (lpString="*.tar") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.801] lstrlenA (lpString="*.gzip") returned 6
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.801] lstrlenA (lpString="*.jpg") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.801] lstrlenA (lpString="*.jpeg") returned 6
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.801] lstrlenA (lpString="*.psd") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.801] lstrlenA (lpString="*.cdr") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.801] lstrlenA (lpString="*.dwg") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.801] lstrlenA (lpString="*.max") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.801] lstrlenA (lpString="*.bmp") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.801] lstrlenA (lpString="*.gif") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.801] lstrlenA (lpString="*.png") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.801] lstrlenA (lpString="*.doc") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.801] lstrlenA (lpString="*.docx") returned 6
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.801] lstrlenA (lpString="*.xls") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.801] lstrlenA (lpString="*.xlsx") returned 6
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.801] lstrlenA (lpString="*.ppt") returned 5
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.801] lstrlenA (lpString="*.pptx") returned 6
	[0036.801] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.802] lstrlenA (lpString="*.txt") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.802] lstrlenA (lpString="*.pdf") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.802] lstrlenA (lpString="*.djvu") returned 6
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.802] lstrlenA (lpString="*.htm") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.802] lstrlenA (lpString="*.html") returned 6
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.802] lstrlenA (lpString="*.mdb") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.802] lstrlenA (lpString="*.cer") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.802] lstrlenA (lpString="*.p12") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.802] lstrlenA (lpString="*.pfx") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.802] lstrlenA (lpString="*.kwm") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.802] lstrlenA (lpString="*.pwm") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.802] lstrlenA (lpString="*.1cd") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.802] lstrlenA (lpString="*.md") returned 4
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.802] lstrlenA (lpString="*.mdf") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.802] lstrlenA (lpString="*.dbf") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.802] lstrlenA (lpString="*.odt") returned 5
	[0036.802] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.802] lstrlenA (lpString="*.vob") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.803] lstrlenA (lpString="*.ifo") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.803] lstrlenA (lpString="*.lnk") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.803] lstrlenA (lpString="*.torrent") returned 9
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.803] lstrlenA (lpString="*.mov") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.803] lstrlenA (lpString="*.m2v") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.803] lstrlenA (lpString="*.3gp") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.803] lstrlenA (lpString="*.mpeg") returned 6
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.803] lstrlenA (lpString="*.mpg") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.803] lstrlenA (lpString="*.flv") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.803] lstrlenA (lpString="*.avi") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.803] lstrlenA (lpString="*.mp4") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.803] lstrlenA (lpString="*.wmv") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.803] lstrlenA (lpString="*.divx") returned 6
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.803] lstrlenA (lpString="*.mkv") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.803] lstrlenA (lpString="*.mp3") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.803] lstrlenA (lpString="*.wav") returned 5
	[0036.803] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.804] lstrlenA (lpString="*.flac") returned 6
	[0036.804] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.804] lstrlenA (lpString="*.ape") returned 5
	[0036.804] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.804] lstrlenA (lpString="*.wma") returned 5
	[0036.804] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.804] lstrlenA (lpString="*.ac3") returned 5
	[0036.804] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.804] lstrlenA (lpString="*.exe") returned 5
	[0036.804] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.804] lstrlenA (lpString="*.apk") returned 5
	[0036.804] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.804] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.804] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.804] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1
	[0036.804] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1
	[0036.804] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.804] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE"
	[0036.804] lstrlenA (lpString="C:\\Boot\\sv-SE") returned 13
	[0036.804] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.804] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.804] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.805] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.805] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.805] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.805] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.805] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.805] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.805] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\*.*") returned="*.*"
	[0036.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\"
	[0036.805] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned=""
	[0036.805] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt"
	[0036.805] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt")) returned 0xffffffff
	[0036.805] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.805] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.805] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.806] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.807] CloseHandle (hObject=0x84) returned 1
	[0036.807] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui"
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.807] lstrlenA (lpString="*.zip") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.807] lstrlenA (lpString="*.rar") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.807] lstrlenA (lpString="*.7z") returned 4
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.807] lstrlenA (lpString="*.tar") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.807] lstrlenA (lpString="*.gzip") returned 6
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.807] lstrlenA (lpString="*.jpg") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.807] lstrlenA (lpString="*.jpeg") returned 6
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.807] lstrlenA (lpString="*.psd") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.807] lstrlenA (lpString="*.cdr") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.807] lstrlenA (lpString="*.dwg") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.807] lstrlenA (lpString="*.max") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.807] lstrlenA (lpString="*.bmp") returned 5
	[0036.807] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.807] lstrlenA (lpString="*.gif") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.808] lstrlenA (lpString="*.png") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.808] lstrlenA (lpString="*.doc") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.808] lstrlenA (lpString="*.docx") returned 6
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.808] lstrlenA (lpString="*.xls") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.808] lstrlenA (lpString="*.xlsx") returned 6
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.808] lstrlenA (lpString="*.ppt") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.808] lstrlenA (lpString="*.pptx") returned 6
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.808] lstrlenA (lpString="*.txt") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.808] lstrlenA (lpString="*.pdf") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.808] lstrlenA (lpString="*.djvu") returned 6
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.808] lstrlenA (lpString="*.htm") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.808] lstrlenA (lpString="*.html") returned 6
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.808] lstrlenA (lpString="*.mdb") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.808] lstrlenA (lpString="*.cer") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.808] lstrlenA (lpString="*.p12") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.808] lstrlenA (lpString="*.pfx") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.808] lstrlenA (lpString="*.kwm") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.808] lstrlenA (lpString="*.pwm") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.808] lstrlenA (lpString="*.1cd") returned 5
	[0036.808] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.809] lstrlenA (lpString="*.md") returned 4
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.809] lstrlenA (lpString="*.mdf") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.809] lstrlenA (lpString="*.dbf") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.809] lstrlenA (lpString="*.odt") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.809] lstrlenA (lpString="*.vob") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.809] lstrlenA (lpString="*.ifo") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.809] lstrlenA (lpString="*.lnk") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.809] lstrlenA (lpString="*.torrent") returned 9
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.809] lstrlenA (lpString="*.mov") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.809] lstrlenA (lpString="*.m2v") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.809] lstrlenA (lpString="*.3gp") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.809] lstrlenA (lpString="*.mpeg") returned 6
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.809] lstrlenA (lpString="*.mpg") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.809] lstrlenA (lpString="*.flv") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.809] lstrlenA (lpString="*.avi") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.809] lstrlenA (lpString="*.mp4") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.809] lstrlenA (lpString="*.wmv") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.809] lstrlenA (lpString="*.divx") returned 6
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.809] lstrlenA (lpString="*.mkv") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.809] lstrlenA (lpString="*.mp3") returned 5
	[0036.809] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.810] lstrlenA (lpString="*.wav") returned 5
	[0036.810] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.810] lstrlenA (lpString="*.flac") returned 6
	[0036.810] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.810] lstrlenA (lpString="*.ape") returned 5
	[0036.810] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.810] lstrlenA (lpString="*.wma") returned 5
	[0036.810] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.810] lstrlenA (lpString="*.ac3") returned 5
	[0036.810] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.810] lstrlenA (lpString="*.exe") returned 5
	[0036.810] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.810] lstrlenA (lpString="*.apk") returned 5
	[0036.810] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.810] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.810] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.810] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1
	[0036.810] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1
	[0036.810] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.810] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR"
	[0036.810] lstrlenA (lpString="C:\\Boot\\tr-TR") returned 13
	[0036.810] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.811] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.811] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.811] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.811] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.811] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.811] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.811] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.811] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.811] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\*.*") returned="*.*"
	[0036.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\"
	[0036.811] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned=""
	[0036.811] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt"
	[0036.811] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff
	[0036.811] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.812] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.812] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.813] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.813] CloseHandle (hObject=0x84) returned 1
	[0036.813] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui"
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.813] lstrlenA (lpString="*.zip") returned 5
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.813] lstrlenA (lpString="*.rar") returned 5
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.813] lstrlenA (lpString="*.7z") returned 4
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.813] lstrlenA (lpString="*.tar") returned 5
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.813] lstrlenA (lpString="*.gzip") returned 6
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.813] lstrlenA (lpString="*.jpg") returned 5
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.813] lstrlenA (lpString="*.jpeg") returned 6
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.813] lstrlenA (lpString="*.psd") returned 5
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.813] lstrlenA (lpString="*.cdr") returned 5
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.813] lstrlenA (lpString="*.dwg") returned 5
	[0036.813] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.813] lstrlenA (lpString="*.max") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.814] lstrlenA (lpString="*.bmp") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.814] lstrlenA (lpString="*.gif") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.814] lstrlenA (lpString="*.png") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.814] lstrlenA (lpString="*.doc") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.814] lstrlenA (lpString="*.docx") returned 6
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.814] lstrlenA (lpString="*.xls") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.814] lstrlenA (lpString="*.xlsx") returned 6
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.814] lstrlenA (lpString="*.ppt") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.814] lstrlenA (lpString="*.pptx") returned 6
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.814] lstrlenA (lpString="*.txt") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.814] lstrlenA (lpString="*.pdf") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.814] lstrlenA (lpString="*.djvu") returned 6
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.814] lstrlenA (lpString="*.htm") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.814] lstrlenA (lpString="*.html") returned 6
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.814] lstrlenA (lpString="*.mdb") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.814] lstrlenA (lpString="*.cer") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.814] lstrlenA (lpString="*.p12") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.814] lstrlenA (lpString="*.pfx") returned 5
	[0036.814] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.814] lstrlenA (lpString="*.kwm") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.815] lstrlenA (lpString="*.pwm") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.815] lstrlenA (lpString="*.1cd") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.815] lstrlenA (lpString="*.md") returned 4
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.815] lstrlenA (lpString="*.mdf") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.815] lstrlenA (lpString="*.dbf") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.815] lstrlenA (lpString="*.odt") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.815] lstrlenA (lpString="*.vob") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.815] lstrlenA (lpString="*.ifo") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.815] lstrlenA (lpString="*.lnk") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.815] lstrlenA (lpString="*.torrent") returned 9
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.815] lstrlenA (lpString="*.mov") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.815] lstrlenA (lpString="*.m2v") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.815] lstrlenA (lpString="*.3gp") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.815] lstrlenA (lpString="*.mpeg") returned 6
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.815] lstrlenA (lpString="*.mpg") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.815] lstrlenA (lpString="*.flv") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.815] lstrlenA (lpString="*.avi") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.815] lstrlenA (lpString="*.mp4") returned 5
	[0036.815] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.815] lstrlenA (lpString="*.wmv") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.816] lstrlenA (lpString="*.divx") returned 6
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.816] lstrlenA (lpString="*.mkv") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.816] lstrlenA (lpString="*.mp3") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.816] lstrlenA (lpString="*.wav") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.816] lstrlenA (lpString="*.flac") returned 6
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.816] lstrlenA (lpString="*.ape") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.816] lstrlenA (lpString="*.wma") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.816] lstrlenA (lpString="*.ac3") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.816] lstrlenA (lpString="*.exe") returned 5
	[0036.816] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.816] lstrlenA (lpString="*.apk") returned 5
	[0036.816] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.816] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.816] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.816] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1
	[0036.816] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1
	[0036.816] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.816] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN"
	[0036.816] lstrlenA (lpString="C:\\Boot\\zh-CN") returned 13
	[0036.816] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.817] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.817] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.817] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.817] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.817] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.817] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.817] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.817] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.817] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\*.*") returned="*.*"
	[0036.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\"
	[0036.817] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned=""
	[0036.817] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt"
	[0036.817] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff
	[0036.817] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.817] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.817] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.818] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.818] CloseHandle (hObject=0x84) returned 1
	[0036.818] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui"
	[0036.818] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.818] lstrlenA (lpString="*.zip") returned 5
	[0036.818] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.818] lstrlenA (lpString="*.rar") returned 5
	[0036.818] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.818] lstrlenA (lpString="*.7z") returned 4
	[0036.818] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.818] lstrlenA (lpString="*.tar") returned 5
	[0036.818] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.818] lstrlenA (lpString="*.gzip") returned 6
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.819] lstrlenA (lpString="*.jpg") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.819] lstrlenA (lpString="*.jpeg") returned 6
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.819] lstrlenA (lpString="*.psd") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.819] lstrlenA (lpString="*.cdr") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.819] lstrlenA (lpString="*.dwg") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.819] lstrlenA (lpString="*.max") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.819] lstrlenA (lpString="*.bmp") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.819] lstrlenA (lpString="*.gif") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.819] lstrlenA (lpString="*.png") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.819] lstrlenA (lpString="*.doc") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.819] lstrlenA (lpString="*.docx") returned 6
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.819] lstrlenA (lpString="*.xls") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.819] lstrlenA (lpString="*.xlsx") returned 6
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.819] lstrlenA (lpString="*.ppt") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.819] lstrlenA (lpString="*.pptx") returned 6
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.819] lstrlenA (lpString="*.txt") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.819] lstrlenA (lpString="*.pdf") returned 5
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.819] lstrlenA (lpString="*.djvu") returned 6
	[0036.819] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.820] lstrlenA (lpString="*.htm") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.820] lstrlenA (lpString="*.html") returned 6
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.820] lstrlenA (lpString="*.mdb") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.820] lstrlenA (lpString="*.cer") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.820] lstrlenA (lpString="*.p12") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.820] lstrlenA (lpString="*.pfx") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.820] lstrlenA (lpString="*.kwm") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.820] lstrlenA (lpString="*.pwm") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.820] lstrlenA (lpString="*.1cd") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.820] lstrlenA (lpString="*.md") returned 4
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.820] lstrlenA (lpString="*.mdf") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.820] lstrlenA (lpString="*.dbf") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.820] lstrlenA (lpString="*.odt") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.820] lstrlenA (lpString="*.vob") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.820] lstrlenA (lpString="*.ifo") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.820] lstrlenA (lpString="*.lnk") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.820] lstrlenA (lpString="*.torrent") returned 9
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.820] lstrlenA (lpString="*.mov") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.820] lstrlenA (lpString="*.m2v") returned 5
	[0036.820] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.821] lstrlenA (lpString="*.3gp") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.821] lstrlenA (lpString="*.mpeg") returned 6
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.821] lstrlenA (lpString="*.mpg") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.821] lstrlenA (lpString="*.flv") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.821] lstrlenA (lpString="*.avi") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.821] lstrlenA (lpString="*.mp4") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.821] lstrlenA (lpString="*.wmv") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.821] lstrlenA (lpString="*.divx") returned 6
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.821] lstrlenA (lpString="*.mkv") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.821] lstrlenA (lpString="*.mp3") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.821] lstrlenA (lpString="*.wav") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.821] lstrlenA (lpString="*.flac") returned 6
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.821] lstrlenA (lpString="*.ape") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.821] lstrlenA (lpString="*.wma") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.821] lstrlenA (lpString="*.ac3") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.821] lstrlenA (lpString="*.exe") returned 5
	[0036.821] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.821] lstrlenA (lpString="*.apk") returned 5
	[0036.821] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.821] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.821] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.822] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1
	[0036.822] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1
	[0036.822] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.822] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK"
	[0036.822] lstrlenA (lpString="C:\\Boot\\zh-HK") returned 13
	[0036.822] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.822] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.822] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.823] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.823] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.823] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.823] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.823] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.823] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.823] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\*.*") returned="*.*"
	[0036.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\"
	[0036.823] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned=""
	[0036.823] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt"
	[0036.823] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff
	[0036.823] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.823] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.823] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.824] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.824] CloseHandle (hObject=0x84) returned 1
	[0036.824] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui"
	[0036.824] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.824] lstrlenA (lpString="*.zip") returned 5
	[0036.824] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.824] lstrlenA (lpString="*.rar") returned 5
	[0036.824] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.824] lstrlenA (lpString="*.7z") returned 4
	[0036.824] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.824] lstrlenA (lpString="*.tar") returned 5
	[0036.824] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.824] lstrlenA (lpString="*.gzip") returned 6
	[0036.824] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.824] lstrlenA (lpString="*.jpg") returned 5
	[0036.824] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.824] lstrlenA (lpString="*.jpeg") returned 6
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.825] lstrlenA (lpString="*.psd") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.825] lstrlenA (lpString="*.cdr") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.825] lstrlenA (lpString="*.dwg") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.825] lstrlenA (lpString="*.max") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.825] lstrlenA (lpString="*.bmp") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.825] lstrlenA (lpString="*.gif") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.825] lstrlenA (lpString="*.png") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.825] lstrlenA (lpString="*.doc") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.825] lstrlenA (lpString="*.docx") returned 6
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.825] lstrlenA (lpString="*.xls") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.825] lstrlenA (lpString="*.xlsx") returned 6
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.825] lstrlenA (lpString="*.ppt") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.825] lstrlenA (lpString="*.pptx") returned 6
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.825] lstrlenA (lpString="*.txt") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.825] lstrlenA (lpString="*.pdf") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.825] lstrlenA (lpString="*.djvu") returned 6
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.825] lstrlenA (lpString="*.htm") returned 5
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.825] lstrlenA (lpString="*.html") returned 6
	[0036.825] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.825] lstrlenA (lpString="*.mdb") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.826] lstrlenA (lpString="*.cer") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.826] lstrlenA (lpString="*.p12") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.826] lstrlenA (lpString="*.pfx") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.826] lstrlenA (lpString="*.kwm") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.826] lstrlenA (lpString="*.pwm") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.826] lstrlenA (lpString="*.1cd") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.826] lstrlenA (lpString="*.md") returned 4
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.826] lstrlenA (lpString="*.mdf") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.826] lstrlenA (lpString="*.dbf") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.826] lstrlenA (lpString="*.odt") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.826] lstrlenA (lpString="*.vob") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.826] lstrlenA (lpString="*.ifo") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.826] lstrlenA (lpString="*.lnk") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.826] lstrlenA (lpString="*.torrent") returned 9
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.826] lstrlenA (lpString="*.mov") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.826] lstrlenA (lpString="*.m2v") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.826] lstrlenA (lpString="*.3gp") returned 5
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.826] lstrlenA (lpString="*.mpeg") returned 6
	[0036.826] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.826] lstrlenA (lpString="*.mpg") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.827] lstrlenA (lpString="*.flv") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.827] lstrlenA (lpString="*.avi") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.827] lstrlenA (lpString="*.mp4") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.827] lstrlenA (lpString="*.wmv") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.827] lstrlenA (lpString="*.divx") returned 6
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.827] lstrlenA (lpString="*.mkv") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.827] lstrlenA (lpString="*.mp3") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.827] lstrlenA (lpString="*.wav") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.827] lstrlenA (lpString="*.flac") returned 6
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.827] lstrlenA (lpString="*.ape") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.827] lstrlenA (lpString="*.wma") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.827] lstrlenA (lpString="*.ac3") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.827] lstrlenA (lpString="*.exe") returned 5
	[0036.827] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.827] lstrlenA (lpString="*.apk") returned 5
	[0036.828] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.828] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.828] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.828] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1
	[0036.828] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1
	[0036.828] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*"
	[0036.828] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW"
	[0036.828] lstrlenA (lpString="C:\\Boot\\zh-TW") returned 13
	[0036.828] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e58
	[0036.828] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.828] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.828] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.828] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.828] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.828] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0036.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1
	[0036.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1
	[0036.828] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1
	[0036.828] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\*.*") returned="*.*"
	[0036.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\"
	[0036.828] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned=""
	[0036.828] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt"
	[0036.829] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff
	[0036.829] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0036.829] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.829] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.830] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.830] CloseHandle (hObject=0x84) returned 1
	[0036.830] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui"
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.zip") returned 0
	[0036.830] lstrlenA (lpString="*.zip") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rar") returned 0
	[0036.830] lstrlenA (lpString="*.rar") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.7z") returned 0
	[0036.830] lstrlenA (lpString="*.7z") returned 4
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tar") returned 0
	[0036.830] lstrlenA (lpString="*.tar") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0
	[0036.830] lstrlenA (lpString="*.gzip") returned 6
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0
	[0036.830] lstrlenA (lpString="*.jpg") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0
	[0036.830] lstrlenA (lpString="*.jpeg") returned 6
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.psd") returned 0
	[0036.830] lstrlenA (lpString="*.psd") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0
	[0036.830] lstrlenA (lpString="*.cdr") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0
	[0036.830] lstrlenA (lpString="*.dwg") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.max") returned 0
	[0036.830] lstrlenA (lpString="*.max") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0
	[0036.830] lstrlenA (lpString="*.bmp") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gif") returned 0
	[0036.830] lstrlenA (lpString="*.gif") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.png") returned 0
	[0036.830] lstrlenA (lpString="*.png") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0
	[0036.830] lstrlenA (lpString="*.doc") returned 5
	[0036.830] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docx") returned 0
	[0036.831] lstrlenA (lpString="*.docx") returned 6
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xls") returned 0
	[0036.831] lstrlenA (lpString="*.xls") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0
	[0036.831] lstrlenA (lpString="*.xlsx") returned 6
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0
	[0036.831] lstrlenA (lpString="*.ppt") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0
	[0036.831] lstrlenA (lpString="*.pptx") returned 6
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.txt") returned 0
	[0036.831] lstrlenA (lpString="*.txt") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0
	[0036.831] lstrlenA (lpString="*.pdf") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0
	[0036.831] lstrlenA (lpString="*.djvu") returned 6
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.htm") returned 0
	[0036.831] lstrlenA (lpString="*.htm") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.html") returned 0
	[0036.831] lstrlenA (lpString="*.html") returned 6
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0
	[0036.831] lstrlenA (lpString="*.mdb") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cer") returned 0
	[0036.831] lstrlenA (lpString="*.cer") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.p12") returned 0
	[0036.831] lstrlenA (lpString="*.p12") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0
	[0036.831] lstrlenA (lpString="*.pfx") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0
	[0036.831] lstrlenA (lpString="*.kwm") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0
	[0036.831] lstrlenA (lpString="*.pwm") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0
	[0036.831] lstrlenA (lpString="*.1cd") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.md") returned 0
	[0036.831] lstrlenA (lpString="*.md") returned 4
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0
	[0036.831] lstrlenA (lpString="*.mdf") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0
	[0036.831] lstrlenA (lpString="*.dbf") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.odt") returned 0
	[0036.831] lstrlenA (lpString="*.odt") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vob") returned 0
	[0036.831] lstrlenA (lpString="*.vob") returned 5
	[0036.831] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0
	[0036.832] lstrlenA (lpString="*.ifo") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0
	[0036.832] lstrlenA (lpString="*.lnk") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0
	[0036.832] lstrlenA (lpString="*.torrent") returned 9
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mov") returned 0
	[0036.832] lstrlenA (lpString="*.mov") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0
	[0036.832] lstrlenA (lpString="*.m2v") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0
	[0036.832] lstrlenA (lpString="*.3gp") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0
	[0036.832] lstrlenA (lpString="*.mpeg") returned 6
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0
	[0036.832] lstrlenA (lpString="*.mpg") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flv") returned 0
	[0036.832] lstrlenA (lpString="*.flv") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.avi") returned 0
	[0036.832] lstrlenA (lpString="*.avi") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0
	[0036.832] lstrlenA (lpString="*.mp4") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0
	[0036.832] lstrlenA (lpString="*.wmv") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.divx") returned 0
	[0036.832] lstrlenA (lpString="*.divx") returned 6
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0
	[0036.832] lstrlenA (lpString="*.mkv") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0
	[0036.832] lstrlenA (lpString="*.mp3") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wav") returned 0
	[0036.832] lstrlenA (lpString="*.wav") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flac") returned 0
	[0036.832] lstrlenA (lpString="*.flac") returned 6
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ape") returned 0
	[0036.832] lstrlenA (lpString="*.ape") returned 5
	[0036.832] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wma") returned 0
	[0036.832] lstrlenA (lpString="*.wma") returned 5
	[0036.833] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0
	[0036.833] lstrlenA (lpString="*.ac3") returned 5
	[0036.833] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.exe") returned 0
	[0036.833] lstrlenA (lpString="*.exe") returned 5
	[0036.833] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.apk") returned 0
	[0036.833] lstrlenA (lpString="*.apk") returned 5
	[0036.833] FindNextFileA (in: hFindFile=0x8b6e58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0036.833] FindClose (in: hFindFile=0x8b6e58 | out: hFindFile=0x8b6e58) returned 1
	[0036.833] FindNextFileA (in: hFindFile=0x8b5de0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0
	[0036.833] FindClose (in: hFindFile=0x8b5de0 | out: hFindFile=0x8b5de0) returned 1
	[0036.833] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0036.833] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0
	[0036.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr") returned 1
	[0036.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr") returned 1
	[0036.833] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1
	[0036.833] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0036.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0036.833] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0036.833] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt"
	[0036.833] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0xffffffff
	[0036.833] CreateFileA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c
	[0036.834] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.834] WriteFile (in: hFile=0x7c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.835] SetFileTime (hFile=0x7c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.835] CloseHandle (hObject=0x7c) returned 1
	[0036.835] lstrcatA (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr"
	[0036.835] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.zip") returned 0
	[0036.835] lstrlenA (lpString="*.zip") returned 5
	[0036.835] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rar") returned 0
	[0036.835] lstrlenA (lpString="*.rar") returned 5
	[0036.835] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.7z") returned 0
	[0036.835] lstrlenA (lpString="*.7z") returned 4
	[0036.835] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tar") returned 0
	[0036.835] lstrlenA (lpString="*.tar") returned 5
	[0036.835] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gzip") returned 0
	[0036.835] lstrlenA (lpString="*.gzip") returned 6
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpg") returned 0
	[0036.836] lstrlenA (lpString="*.jpg") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpeg") returned 0
	[0036.836] lstrlenA (lpString="*.jpeg") returned 6
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.psd") returned 0
	[0036.836] lstrlenA (lpString="*.psd") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cdr") returned 0
	[0036.836] lstrlenA (lpString="*.cdr") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dwg") returned 0
	[0036.836] lstrlenA (lpString="*.dwg") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.max") returned 0
	[0036.836] lstrlenA (lpString="*.max") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bmp") returned 0
	[0036.836] lstrlenA (lpString="*.bmp") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gif") returned 0
	[0036.836] lstrlenA (lpString="*.gif") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.png") returned 0
	[0036.836] lstrlenA (lpString="*.png") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0
	[0036.836] lstrlenA (lpString="*.doc") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docx") returned 0
	[0036.836] lstrlenA (lpString="*.docx") returned 6
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xls") returned 0
	[0036.836] lstrlenA (lpString="*.xls") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsx") returned 0
	[0036.836] lstrlenA (lpString="*.xlsx") returned 6
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ppt") returned 0
	[0036.836] lstrlenA (lpString="*.ppt") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pptx") returned 0
	[0036.836] lstrlenA (lpString="*.pptx") returned 6
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.txt") returned 0
	[0036.836] lstrlenA (lpString="*.txt") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pdf") returned 0
	[0036.836] lstrlenA (lpString="*.pdf") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.djvu") returned 0
	[0036.836] lstrlenA (lpString="*.djvu") returned 6
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.htm") returned 0
	[0036.836] lstrlenA (lpString="*.htm") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.html") returned 0
	[0036.836] lstrlenA (lpString="*.html") returned 6
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdb") returned 0
	[0036.836] lstrlenA (lpString="*.mdb") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cer") returned 0
	[0036.836] lstrlenA (lpString="*.cer") returned 5
	[0036.836] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.p12") returned 0
	[0036.837] lstrlenA (lpString="*.p12") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pfx") returned 0
	[0036.837] lstrlenA (lpString="*.pfx") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.kwm") returned 0
	[0036.837] lstrlenA (lpString="*.kwm") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pwm") returned 0
	[0036.837] lstrlenA (lpString="*.pwm") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.1cd") returned 0
	[0036.837] lstrlenA (lpString="*.1cd") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.md") returned 0
	[0036.837] lstrlenA (lpString="*.md") returned 4
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdf") returned 0
	[0036.837] lstrlenA (lpString="*.mdf") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dbf") returned 0
	[0036.837] lstrlenA (lpString="*.dbf") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.odt") returned 0
	[0036.837] lstrlenA (lpString="*.odt") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vob") returned 0
	[0036.837] lstrlenA (lpString="*.vob") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ifo") returned 0
	[0036.837] lstrlenA (lpString="*.ifo") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.lnk") returned 0
	[0036.837] lstrlenA (lpString="*.lnk") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.torrent") returned 0
	[0036.837] lstrlenA (lpString="*.torrent") returned 9
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mov") returned 0
	[0036.837] lstrlenA (lpString="*.mov") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.m2v") returned 0
	[0036.837] lstrlenA (lpString="*.m2v") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.3gp") returned 0
	[0036.837] lstrlenA (lpString="*.3gp") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpeg") returned 0
	[0036.837] lstrlenA (lpString="*.mpeg") returned 6
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpg") returned 0
	[0036.837] lstrlenA (lpString="*.mpg") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flv") returned 0
	[0036.837] lstrlenA (lpString="*.flv") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.avi") returned 0
	[0036.837] lstrlenA (lpString="*.avi") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp4") returned 0
	[0036.837] lstrlenA (lpString="*.mp4") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wmv") returned 0
	[0036.837] lstrlenA (lpString="*.wmv") returned 5
	[0036.837] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.divx") returned 0
	[0036.838] lstrlenA (lpString="*.divx") returned 6
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mkv") returned 0
	[0036.838] lstrlenA (lpString="*.mkv") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp3") returned 0
	[0036.838] lstrlenA (lpString="*.mp3") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wav") returned 0
	[0036.838] lstrlenA (lpString="*.wav") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flac") returned 0
	[0036.838] lstrlenA (lpString="*.flac") returned 6
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ape") returned 0
	[0036.838] lstrlenA (lpString="*.ape") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wma") returned 0
	[0036.838] lstrlenA (lpString="*.wma") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ac3") returned 0
	[0036.838] lstrlenA (lpString="*.ac3") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.exe") returned 0
	[0036.838] lstrlenA (lpString="*.exe") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.apk") returned 0
	[0036.838] lstrlenA (lpString="*.apk") returned 5
	[0036.838] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0036.838] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0
	[0036.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOOTSECT.BAK") returned 1
	[0036.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSECT.BAK") returned 1
	[0036.838] lstrcmpiA (lpString1="", lpString2="BOOTSECT.BAK") returned -1
	[0036.838] PathFindFileNameA (pszPath="C:\\bootmgr") returned="bootmgr"
	[0036.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0036.838] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0036.838] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt"
	[0036.838] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20
	[0036.838] lstrcatA (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK"
	[0036.838] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.zip") returned 0
	[0036.838] lstrlenA (lpString="*.zip") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.rar") returned 0
	[0036.838] lstrlenA (lpString="*.rar") returned 5
	[0036.838] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.7z") returned 0
	[0036.838] lstrlenA (lpString="*.7z") returned 4
	[0036.838] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.tar") returned 0
	[0036.838] lstrlenA (lpString="*.tar") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gzip") returned 0
	[0036.839] lstrlenA (lpString="*.gzip") returned 6
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpg") returned 0
	[0036.839] lstrlenA (lpString="*.jpg") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpeg") returned 0
	[0036.839] lstrlenA (lpString="*.jpeg") returned 6
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.psd") returned 0
	[0036.839] lstrlenA (lpString="*.psd") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.cdr") returned 0
	[0036.839] lstrlenA (lpString="*.cdr") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dwg") returned 0
	[0036.839] lstrlenA (lpString="*.dwg") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.max") returned 0
	[0036.839] lstrlenA (lpString="*.max") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.bmp") returned 0
	[0036.839] lstrlenA (lpString="*.bmp") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gif") returned 0
	[0036.839] lstrlenA (lpString="*.gif") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.png") returned 0
	[0036.839] lstrlenA (lpString="*.png") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.doc") returned 0
	[0036.839] lstrlenA (lpString="*.doc") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.docx") returned 0
	[0036.839] lstrlenA (lpString="*.docx") returned 6
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xls") returned 0
	[0036.839] lstrlenA (lpString="*.xls") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xlsx") returned 0
	[0036.839] lstrlenA (lpString="*.xlsx") returned 6
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ppt") returned 0
	[0036.839] lstrlenA (lpString="*.ppt") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pptx") returned 0
	[0036.839] lstrlenA (lpString="*.pptx") returned 6
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.txt") returned 0
	[0036.839] lstrlenA (lpString="*.txt") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pdf") returned 0
	[0036.839] lstrlenA (lpString="*.pdf") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.djvu") returned 0
	[0036.839] lstrlenA (lpString="*.djvu") returned 6
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.htm") returned 0
	[0036.839] lstrlenA (lpString="*.htm") returned 5
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.html") returned 0
	[0036.839] lstrlenA (lpString="*.html") returned 6
	[0036.839] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mdb") returned 0
	[0036.839] lstrlenA (lpString="*.mdb") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.cer") returned 0
	[0036.840] lstrlenA (lpString="*.cer") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.p12") returned 0
	[0036.840] lstrlenA (lpString="*.p12") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pfx") returned 0
	[0036.840] lstrlenA (lpString="*.pfx") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.kwm") returned 0
	[0036.840] lstrlenA (lpString="*.kwm") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pwm") returned 0
	[0036.840] lstrlenA (lpString="*.pwm") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.1cd") returned 0
	[0036.840] lstrlenA (lpString="*.1cd") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.md") returned 0
	[0036.840] lstrlenA (lpString="*.md") returned 4
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mdf") returned 0
	[0036.840] lstrlenA (lpString="*.mdf") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dbf") returned 0
	[0036.840] lstrlenA (lpString="*.dbf") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.odt") returned 0
	[0036.840] lstrlenA (lpString="*.odt") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.vob") returned 0
	[0036.840] lstrlenA (lpString="*.vob") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ifo") returned 0
	[0036.840] lstrlenA (lpString="*.ifo") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.lnk") returned 0
	[0036.840] lstrlenA (lpString="*.lnk") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.torrent") returned 0
	[0036.840] lstrlenA (lpString="*.torrent") returned 9
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mov") returned 0
	[0036.840] lstrlenA (lpString="*.mov") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.m2v") returned 0
	[0036.840] lstrlenA (lpString="*.m2v") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.3gp") returned 0
	[0036.840] lstrlenA (lpString="*.3gp") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mpeg") returned 0
	[0036.840] lstrlenA (lpString="*.mpeg") returned 6
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mpg") returned 0
	[0036.840] lstrlenA (lpString="*.mpg") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.flv") returned 0
	[0036.840] lstrlenA (lpString="*.flv") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.avi") returned 0
	[0036.840] lstrlenA (lpString="*.avi") returned 5
	[0036.840] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mp4") returned 0
	[0036.841] lstrlenA (lpString="*.mp4") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wmv") returned 0
	[0036.841] lstrlenA (lpString="*.wmv") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.divx") returned 0
	[0036.841] lstrlenA (lpString="*.divx") returned 6
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mkv") returned 0
	[0036.841] lstrlenA (lpString="*.mkv") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mp3") returned 0
	[0036.841] lstrlenA (lpString="*.mp3") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wav") returned 0
	[0036.841] lstrlenA (lpString="*.wav") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.flac") returned 0
	[0036.841] lstrlenA (lpString="*.flac") returned 6
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ape") returned 0
	[0036.841] lstrlenA (lpString="*.ape") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wma") returned 0
	[0036.841] lstrlenA (lpString="*.wma") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ac3") returned 0
	[0036.841] lstrlenA (lpString="*.ac3") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.exe") returned 0
	[0036.841] lstrlenA (lpString="*.exe") returned 5
	[0036.841] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.apk") returned 0
	[0036.841] lstrlenA (lpString="*.apk") returned 5
	[0036.841] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0036.841] lstrcmpA (lpString1=".", lpString2="Config.Msi") returned -1
	[0036.841] lstrcmpA (lpString1="..", lpString2="Config.Msi") returned -1
	[0036.841] PathFindFileNameA (pszPath="C:\\BOOTSECT.BAK") returned="BOOTSECT.BAK"
	[0036.841] lstrcatA (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi"
	[0036.841] lstrlenA (lpString="C:\\Config.Msi") returned 13
	[0036.841] FindFirstFileA (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b5df0
	[0036.842] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.842] FindNextFileA (in: hFindFile=0x8b5df0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.842] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.842] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.842] FindNextFileA (in: hFindFile=0x8b5df0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0
	[0036.842] FindClose (in: hFindFile=0x8b5df0 | out: hFindFile=0x8b5df0) returned 1
	[0036.842] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0036.842] lstrcmpA (lpString1=".", lpString2="Documents and Settings") returned -1
	[0036.842] lstrcmpA (lpString1="..", lpString2="Documents and Settings") returned -1
	[0036.842] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0036.842] lstrcatA (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings"
	[0036.842] lstrlenA (lpString="C:\\Documents and Settings") returned 25
	[0036.842] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0xffffffff
	[0036.842] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0036.842] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0
	[0036.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hiberfil.sys") returned -1
	[0036.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hiberfil.sys") returned 1
	[0036.842] lstrcmpiA (lpString1="", lpString2="hiberfil.sys") returned -1
	[0036.842] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0036.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0036.842] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0036.842] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt"
	[0036.842] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20
	[0036.842] lstrcatA (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys"
	[0036.842] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.zip") returned 0
	[0036.843] lstrlenA (lpString="*.zip") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.rar") returned 0
	[0036.843] lstrlenA (lpString="*.rar") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.7z") returned 0
	[0036.843] lstrlenA (lpString="*.7z") returned 4
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.tar") returned 0
	[0036.843] lstrlenA (lpString="*.tar") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.gzip") returned 0
	[0036.843] lstrlenA (lpString="*.gzip") returned 6
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.jpg") returned 0
	[0036.843] lstrlenA (lpString="*.jpg") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.jpeg") returned 0
	[0036.843] lstrlenA (lpString="*.jpeg") returned 6
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.psd") returned 0
	[0036.843] lstrlenA (lpString="*.psd") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.cdr") returned 0
	[0036.843] lstrlenA (lpString="*.cdr") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.dwg") returned 0
	[0036.843] lstrlenA (lpString="*.dwg") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.max") returned 0
	[0036.843] lstrlenA (lpString="*.max") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.bmp") returned 0
	[0036.843] lstrlenA (lpString="*.bmp") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.gif") returned 0
	[0036.843] lstrlenA (lpString="*.gif") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.png") returned 0
	[0036.843] lstrlenA (lpString="*.png") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.doc") returned 0
	[0036.843] lstrlenA (lpString="*.doc") returned 5
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.docx") returned 0
	[0036.843] lstrlenA (lpString="*.docx") returned 6
	[0036.843] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.xls") returned 0
	[0036.844] lstrlenA (lpString="*.xls") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.xlsx") returned 0
	[0036.844] lstrlenA (lpString="*.xlsx") returned 6
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ppt") returned 0
	[0036.844] lstrlenA (lpString="*.ppt") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pptx") returned 0
	[0036.844] lstrlenA (lpString="*.pptx") returned 6
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.txt") returned 0
	[0036.844] lstrlenA (lpString="*.txt") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pdf") returned 0
	[0036.844] lstrlenA (lpString="*.pdf") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.djvu") returned 0
	[0036.844] lstrlenA (lpString="*.djvu") returned 6
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.htm") returned 0
	[0036.844] lstrlenA (lpString="*.htm") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.html") returned 0
	[0036.844] lstrlenA (lpString="*.html") returned 6
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mdb") returned 0
	[0036.844] lstrlenA (lpString="*.mdb") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.cer") returned 0
	[0036.844] lstrlenA (lpString="*.cer") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.p12") returned 0
	[0036.844] lstrlenA (lpString="*.p12") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pfx") returned 0
	[0036.844] lstrlenA (lpString="*.pfx") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.kwm") returned 0
	[0036.844] lstrlenA (lpString="*.kwm") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pwm") returned 0
	[0036.844] lstrlenA (lpString="*.pwm") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.1cd") returned 0
	[0036.844] lstrlenA (lpString="*.1cd") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.md") returned 0
	[0036.844] lstrlenA (lpString="*.md") returned 4
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mdf") returned 0
	[0036.844] lstrlenA (lpString="*.mdf") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.dbf") returned 0
	[0036.844] lstrlenA (lpString="*.dbf") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.odt") returned 0
	[0036.844] lstrlenA (lpString="*.odt") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.vob") returned 0
	[0036.844] lstrlenA (lpString="*.vob") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ifo") returned 0
	[0036.844] lstrlenA (lpString="*.ifo") returned 5
	[0036.844] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.lnk") returned 0
	[0036.845] lstrlenA (lpString="*.lnk") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.torrent") returned 0
	[0036.845] lstrlenA (lpString="*.torrent") returned 9
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mov") returned 0
	[0036.845] lstrlenA (lpString="*.mov") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.m2v") returned 0
	[0036.845] lstrlenA (lpString="*.m2v") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.3gp") returned 0
	[0036.845] lstrlenA (lpString="*.3gp") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mpeg") returned 0
	[0036.845] lstrlenA (lpString="*.mpeg") returned 6
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mpg") returned 0
	[0036.845] lstrlenA (lpString="*.mpg") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.flv") returned 0
	[0036.845] lstrlenA (lpString="*.flv") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.avi") returned 0
	[0036.845] lstrlenA (lpString="*.avi") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mp4") returned 0
	[0036.845] lstrlenA (lpString="*.mp4") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wmv") returned 0
	[0036.845] lstrlenA (lpString="*.wmv") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.divx") returned 0
	[0036.845] lstrlenA (lpString="*.divx") returned 6
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mkv") returned 0
	[0036.845] lstrlenA (lpString="*.mkv") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mp3") returned 0
	[0036.845] lstrlenA (lpString="*.mp3") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wav") returned 0
	[0036.845] lstrlenA (lpString="*.wav") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.flac") returned 0
	[0036.845] lstrlenA (lpString="*.flac") returned 6
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ape") returned 0
	[0036.845] lstrlenA (lpString="*.ape") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wma") returned 0
	[0036.845] lstrlenA (lpString="*.wma") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ac3") returned 0
	[0036.845] lstrlenA (lpString="*.ac3") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.exe") returned 0
	[0036.845] lstrlenA (lpString="*.exe") returned 5
	[0036.845] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.apk") returned 0
	[0036.845] lstrlenA (lpString="*.apk") returned 5
	[0036.845] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0036.845] lstrcmpA (lpString1=".", lpString2="MSOCache") returned -1
	[0036.845] lstrcmpA (lpString1="..", lpString2="MSOCache") returned -1
	[0036.846] PathFindFileNameA (pszPath="C:\\hiberfil.sys") returned="hiberfil.sys"
	[0036.846] lstrcatA (in: lpString1="C:\\", lpString2="MSOCache" | out: lpString1="C:\\MSOCache") returned="C:\\MSOCache"
	[0036.846] lstrlenA (lpString="C:\\MSOCache") returned 11
	[0036.846] FindFirstFileA (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b5dc0
	[0036.846] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.846] FindNextFileA (in: hFindFile=0x8b5dc0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.846] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.846] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.846] FindNextFileA (in: hFindFile=0x8b5dc0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0036.846] lstrcmpA (lpString1=".", lpString2="All Users") returned -1
	[0036.846] lstrcmpA (lpString1="..", lpString2="All Users") returned -1
	[0036.846] PathFindFileNameA (pszPath="C:\\MSOCache\\*.*") returned="*.*"
	[0036.846] lstrcatA (in: lpString1="C:\\MSOCache\\", lpString2="All Users" | out: lpString1="C:\\MSOCache\\All Users") returned="C:\\MSOCache\\All Users"
	[0036.846] lstrlenA (lpString="C:\\MSOCache\\All Users") returned 21
	[0036.846] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b6e48
	[0036.859] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.859] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.860] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.860] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.860] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.860] lstrcmpA (lpString1=".", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1
	[0036.860] lstrcmpA (lpString1="..", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1
	[0036.860] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.860] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C"
	[0036.860] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62
	[0036.860] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0036.861] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.861] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.861] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.861] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.861] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.861] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.861] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExcelLR.cab") returned -1
	[0036.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelLR.cab") returned 1
	[0036.861] lstrcmpiA (lpString1="", lpString2="ExcelLR.cab") returned -1
	[0036.861] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\"
	[0036.861] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.861] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.861] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0036.861] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0036.863] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0036.863] WriteFile (in: hFile=0x88, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0036.864] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.864] CloseHandle (hObject=0x88) returned 1
	[0036.864] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab"
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.zip") returned 0
	[0036.864] lstrlenA (lpString="*.zip") returned 5
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.rar") returned 0
	[0036.864] lstrlenA (lpString="*.rar") returned 5
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.7z") returned 0
	[0036.864] lstrlenA (lpString="*.7z") returned 4
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.tar") returned 0
	[0036.864] lstrlenA (lpString="*.tar") returned 5
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gzip") returned 0
	[0036.864] lstrlenA (lpString="*.gzip") returned 6
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpg") returned 0
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpeg") returned 0
	[0036.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.psd") returned 0
	[0036.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.cdr") returned 0
	[0036.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.dwg") returned 0
	[0036.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.max") returned 0
	[0036.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.bmp") returned 0
	[0036.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gif") returned 0
	[0036.865] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.865] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExcelMUI.msi") returned -1
	[0036.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.msi") returned 1
	[0036.865] lstrcmpiA (lpString1="", lpString2="ExcelMUI.msi") returned -1
	[0036.865] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="ExcelLR.cab"
	[0036.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\"
	[0036.865] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.865] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.865] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.865] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi"
	[0036.865] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.865] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExcelMUI.xml") returned -1
	[0036.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.xml") returned 1
	[0036.865] lstrcmpiA (lpString1="", lpString2="ExcelMUI.xml") returned -1
	[0036.865] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="ExcelMUI.msi"
	[0036.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\"
	[0036.865] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.865] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.866] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.866] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml"
	[0036.866] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.866] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.866] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0036.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0036.866] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0036.866] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="ExcelMUI.xml"
	[0036.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\"
	[0036.866] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.866] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.866] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.866] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0036.866] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0036.866] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0036.866] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.866] lstrcmpA (lpString1=".", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1
	[0036.866] lstrcmpA (lpString1="..", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1
	[0036.866] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.866] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C"
	[0036.866] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0036.887] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.887] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.887] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.887] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.887] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.887] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.887] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PowerPointMUI.msi") returned -1
	[0036.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.msi") returned -1
	[0036.887] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.msi") returned -1
	[0036.887] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\"
	[0036.887] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.887] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.888] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0036.888] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0036.890] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.890] CloseHandle (hObject=0x88) returned 1
	[0036.890] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi"
	[0036.890] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.890] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.890] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PowerPointMUI.xml") returned -1
	[0036.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.xml") returned -1
	[0036.890] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.xml") returned -1
	[0036.890] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="PowerPointMUI.msi"
	[0036.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\"
	[0036.890] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.890] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.890] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.891] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml"
	[0036.891] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.891] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.891] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PptLR.cab") returned -1
	[0036.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PptLR.cab") returned -1
	[0036.891] lstrcmpiA (lpString1="", lpString2="PptLR.cab") returned -1
	[0036.891] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="PowerPointMUI.xml"
	[0036.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\"
	[0036.891] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.891] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.891] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.891] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PptLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab"
	[0036.891] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.891] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.891] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0036.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0036.891] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0036.891] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="PptLR.cab"
	[0036.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\"
	[0036.891] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.891] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.891] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.891] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0036.891] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0036.891] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0036.891] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.891] lstrcmpA (lpString1=".", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1
	[0036.891] lstrcmpA (lpString1="..", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1
	[0036.891] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.892] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C"
	[0036.892] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0036.907] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.907] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.907] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.907] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.907] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.907] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.907] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublisherMUI.msi") returned -1
	[0036.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.msi") returned -1
	[0036.907] lstrcmpiA (lpString1="", lpString2="PublisherMUI.msi") returned -1
	[0036.907] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\"
	[0036.907] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.907] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.907] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0036.907] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0036.908] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.909] CloseHandle (hObject=0x88) returned 1
	[0036.909] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi"
	[0036.909] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.909] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.909] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublisherMUI.xml") returned -1
	[0036.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.xml") returned -1
	[0036.909] lstrcmpiA (lpString1="", lpString2="PublisherMUI.xml") returned -1
	[0036.909] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="PublisherMUI.msi"
	[0036.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\"
	[0036.909] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.909] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.909] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.909] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml"
	[0036.909] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.909] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.909] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PubLR.cab") returned -1
	[0036.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PubLR.cab") returned -1
	[0036.909] lstrcmpiA (lpString1="", lpString2="PubLR.cab") returned -1
	[0036.909] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="PublisherMUI.xml"
	[0036.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\"
	[0036.910] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.910] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PubLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab"
	[0036.910] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.910] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.910] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0036.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0036.910] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0036.910] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="PubLR.cab"
	[0036.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\"
	[0036.910] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.910] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0036.910] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0036.910] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0036.910] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.910] lstrcmpA (lpString1=".", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1
	[0036.910] lstrcmpA (lpString1="..", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1
	[0036.910] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C"
	[0036.910] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0036.928] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.928] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.929] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.929] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.929] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.929] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.929] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlkLR.cab") returned -1
	[0036.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlkLR.cab") returned -1
	[0036.929] lstrcmpiA (lpString1="", lpString2="OutlkLR.cab") returned -1
	[0036.929] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\"
	[0036.929] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.929] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.929] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0036.929] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0036.930] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.930] CloseHandle (hObject=0x88) returned 1
	[0036.930] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlkLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab"
	[0036.931] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.931] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlookMUI.msi") returned -1
	[0036.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.msi") returned -1
	[0036.931] lstrcmpiA (lpString1="", lpString2="OutlookMUI.msi") returned -1
	[0036.931] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="OutlkLR.cab"
	[0036.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\"
	[0036.931] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.931] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.931] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.931] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi"
	[0036.931] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.931] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlookMUI.xml") returned -1
	[0036.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.xml") returned -1
	[0036.931] lstrcmpiA (lpString1="", lpString2="OutlookMUI.xml") returned -1
	[0036.931] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="OutlookMUI.msi"
	[0036.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\"
	[0036.931] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.931] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.931] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.931] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml"
	[0036.931] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.931] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0036.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0036.931] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0036.932] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="OutlookMUI.xml"
	[0036.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\"
	[0036.932] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.932] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.932] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.932] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0036.932] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0036.932] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0036.932] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.932] lstrcmpA (lpString1=".", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1
	[0036.932] lstrcmpA (lpString1="..", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1
	[0036.932] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.932] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C"
	[0036.932] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0036.933] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.933] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.933] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.933] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.933] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.933] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.933] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0036.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0036.933] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0036.933] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\"
	[0036.933] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.933] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.933] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0036.933] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0036.936] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.936] CloseHandle (hObject=0x88) returned 1
	[0036.936] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0036.936] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.936] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.936] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WordLR.cab") returned -1
	[0036.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordLR.cab") returned -1
	[0036.936] lstrcmpiA (lpString1="", lpString2="WordLR.cab") returned -1
	[0036.936] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml"
	[0036.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\"
	[0036.936] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.936] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.936] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.936] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab"
	[0036.936] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.936] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.936] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WordMUI.msi") returned -1
	[0036.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.msi") returned -1
	[0036.936] lstrcmpiA (lpString1="", lpString2="WordMUI.msi") returned -1
	[0036.936] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="WordLR.cab"
	[0036.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\"
	[0036.936] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.936] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.936] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.937] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi"
	[0036.937] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.937] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.937] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WordMUI.xml") returned -1
	[0036.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.xml") returned -1
	[0036.937] lstrcmpiA (lpString1="", lpString2="WordMUI.xml") returned -1
	[0036.937] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="WordMUI.msi"
	[0036.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\"
	[0036.937] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.937] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.937] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.937] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml"
	[0036.937] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0036.937] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0036.937] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.937] lstrcmpA (lpString1=".", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1
	[0036.937] lstrcmpA (lpString1="..", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1
	[0036.937] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.937] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C"
	[0036.937] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0036.957] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.957] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.957] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.957] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.957] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.957] lstrcmpA (lpString1=".", lpString2="Proof.en") returned -1
	[0036.957] lstrcmpA (lpString1="..", lpString2="Proof.en") returned -1
	[0036.958] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.958] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.en" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en"
	[0036.958] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b8f38
	[0036.958] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.958] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.958] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.958] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.958] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.958] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.958] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.cab") returned -1
	[0036.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1
	[0036.958] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1
	[0036.958] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*") returned="*.*"
	[0036.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\"
	[0036.958] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned=""
	[0036.958] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt"
	[0036.958] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0xffffffff
	[0036.959] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0036.960] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.960] CloseHandle (hObject=0x8c) returned 1
	[0036.960] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab"
	[0036.960] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.960] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.msi") returned -1
	[0036.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1
	[0036.960] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1
	[0036.960] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="Proof.cab"
	[0036.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\"
	[0036.960] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned=""
	[0036.961] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt"
	[0036.961] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020
	[0036.961] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi"
	[0036.961] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.961] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.961] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.xml") returned -1
	[0036.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1
	[0036.961] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1
	[0036.961] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="Proof.msi"
	[0036.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\"
	[0036.961] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned=""
	[0036.961] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt"
	[0036.961] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020
	[0036.961] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml"
	[0036.961] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0036.961] FindClose (in: hFindFile=0x8b8f38 | out: hFindFile=0x8b8f38) returned 1
	[0036.961] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.961] lstrcmpA (lpString1=".", lpString2="Proof.es") returned -1
	[0036.961] lstrcmpA (lpString1="..", lpString2="Proof.es") returned -1
	[0036.961] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.962] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.es" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es"
	[0036.962] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b8f38
	[0036.965] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.965] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.965] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.965] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.965] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.965] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.965] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.cab") returned -1
	[0036.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1
	[0036.965] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1
	[0036.965] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*") returned="*.*"
	[0036.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\"
	[0036.965] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned=""
	[0036.965] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt"
	[0036.965] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0xffffffff
	[0036.965] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0036.966] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.966] CloseHandle (hObject=0x8c) returned 1
	[0036.966] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab"
	[0036.966] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.966] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.msi") returned -1
	[0036.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1
	[0036.967] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1
	[0036.967] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="Proof.cab"
	[0036.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\"
	[0036.967] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned=""
	[0036.967] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt"
	[0036.967] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020
	[0036.967] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi"
	[0036.967] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.967] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.xml") returned -1
	[0036.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1
	[0036.967] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1
	[0036.967] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="Proof.msi"
	[0036.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\"
	[0036.967] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned=""
	[0036.967] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt"
	[0036.967] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020
	[0036.967] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml"
	[0036.967] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0036.967] FindClose (in: hFindFile=0x8b8f38 | out: hFindFile=0x8b8f38) returned 1
	[0036.967] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.967] lstrcmpA (lpString1=".", lpString2="Proof.fr") returned -1
	[0036.967] lstrcmpA (lpString1="..", lpString2="Proof.fr") returned -1
	[0036.968] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.968] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.fr" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr"
	[0036.968] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b8f38
	[0036.968] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.968] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.968] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.968] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.968] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.968] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.968] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.cab") returned -1
	[0036.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1
	[0036.968] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1
	[0036.968] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*") returned="*.*"
	[0036.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\"
	[0036.968] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned=""
	[0036.968] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt"
	[0036.968] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0xffffffff
	[0036.969] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0036.969] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.970] CloseHandle (hObject=0x8c) returned 1
	[0036.970] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab"
	[0036.970] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.970] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.msi") returned -1
	[0036.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1
	[0036.970] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1
	[0036.970] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="Proof.cab"
	[0036.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\"
	[0036.970] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned=""
	[0036.970] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt"
	[0036.970] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020
	[0036.970] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi"
	[0036.970] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0036.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0036.970] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.xml") returned -1
	[0036.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1
	[0036.970] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1
	[0036.970] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="Proof.msi"
	[0036.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\"
	[0036.970] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned=""
	[0036.970] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt"
	[0036.970] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020
	[0036.971] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml"
	[0036.971] FindNextFileA (in: hFindFile=0x8b8f38, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0036.971] FindClose (in: hFindFile=0x8b8f38 | out: hFindFile=0x8b8f38) returned 1
	[0036.971] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.971] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.971] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proofing.msi") returned -1
	[0036.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.msi") returned -1
	[0036.971] lstrcmpiA (lpString1="", lpString2="Proofing.msi") returned -1
	[0036.971] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\"
	[0036.971] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.971] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.971] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0036.971] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0036.972] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.972] CloseHandle (hObject=0x88) returned 1
	[0036.972] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi"
	[0036.972] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.972] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.972] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proofing.xml") returned -1
	[0036.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.xml") returned -1
	[0036.973] lstrcmpiA (lpString1="", lpString2="Proofing.xml") returned -1
	[0036.973] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="Proofing.msi"
	[0036.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\"
	[0036.973] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.973] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.973] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.973] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml"
	[0036.973] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.973] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.973] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0036.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0036.973] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0036.973] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="Proofing.xml"
	[0036.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\"
	[0036.973] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.973] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.973] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.973] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0036.973] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0036.973] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0036.973] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.973] lstrcmpA (lpString1=".", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1
	[0036.973] lstrcmpA (lpString1="..", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1
	[0036.973] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.973] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C"
	[0036.974] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0036.984] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0036.984] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.984] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0036.984] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0036.984] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.984] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.984] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32MUI.msi") returned -1
	[0036.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.msi") returned -1
	[0036.984] lstrcmpiA (lpString1="", lpString2="Office32MUI.msi") returned -1
	[0036.984] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0036.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\"
	[0036.984] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.984] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.984] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0036.984] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0036.986] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0036.986] CloseHandle (hObject=0x88) returned 1
	[0036.986] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi"
	[0036.986] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.986] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.986] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32MUI.xml") returned -1
	[0036.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.xml") returned -1
	[0036.986] lstrcmpiA (lpString1="", lpString2="Office32MUI.xml") returned -1
	[0036.986] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="Office32MUI.msi"
	[0036.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\"
	[0036.986] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.987] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.987] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.987] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml"
	[0036.987] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.987] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OWOW32LR.cab") returned -1
	[0036.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32LR.cab") returned -1
	[0036.987] lstrcmpiA (lpString1="", lpString2="OWOW32LR.cab") returned -1
	[0036.987] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="Office32MUI.xml"
	[0036.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\"
	[0036.987] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.987] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.987] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.987] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="OWOW32LR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab"
	[0036.987] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0036.987] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0036.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0036.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0036.987] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0036.987] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="OWOW32LR.cab"
	[0036.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\"
	[0036.987] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned=""
	[0036.987] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0036.987] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0036.987] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0036.987] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0036.988] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0036.988] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0036.988] lstrcmpA (lpString1=".", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1
	[0036.988] lstrcmpA (lpString1="..", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1
	[0036.988] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0036.988] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C"
	[0036.988] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.017] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.017] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.017] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.017] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.017] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.017] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.017] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfLR.cab") returned -1
	[0037.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfLR.cab") returned -1
	[0037.018] lstrcmpiA (lpString1="", lpString2="InfLR.cab") returned -1
	[0037.018] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\"
	[0037.018] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.018] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.018] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.018] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.019] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.019] CloseHandle (hObject=0x88) returned 1
	[0037.019] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab"
	[0037.019] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.019] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.019] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfoPathMUI.msi") returned -1
	[0037.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.msi") returned -1
	[0037.019] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.msi") returned -1
	[0037.019] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="InfLR.cab"
	[0037.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\"
	[0037.019] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.019] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.019] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.019] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi"
	[0037.019] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.019] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.019] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfoPathMUI.xml") returned -1
	[0037.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.xml") returned -1
	[0037.020] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.xml") returned -1
	[0037.020] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="InfoPathMUI.msi"
	[0037.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\"
	[0037.020] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.020] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.020] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.020] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml"
	[0037.020] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.020] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.020] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.020] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.020] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="InfoPathMUI.xml"
	[0037.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\"
	[0037.020] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.020] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.020] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.020] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.020] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.020] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.020] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.020] lstrcmpA (lpString1=".", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1
	[0037.020] lstrcmpA (lpString1="..", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1
	[0037.020] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.020] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C"
	[0037.020] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.021] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.021] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.021] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.021] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.021] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.021] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.021] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.021] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.021] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\"
	[0037.021] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.021] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.021] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.021] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.023] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.024] CloseHandle (hObject=0x88) returned 1
	[0037.024] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.024] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.024] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisioLR.cab") returned -1
	[0037.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioLR.cab") returned -1
	[0037.024] lstrcmpiA (lpString1="", lpString2="VisioLR.cab") returned -1
	[0037.024] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml"
	[0037.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\"
	[0037.024] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.024] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.024] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.024] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab"
	[0037.024] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.024] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisioMUI.msi") returned -1
	[0037.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.msi") returned -1
	[0037.024] lstrcmpiA (lpString1="", lpString2="VisioMUI.msi") returned -1
	[0037.024] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="VisioLR.cab"
	[0037.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\"
	[0037.024] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.024] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.025] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.025] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi"
	[0037.025] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.025] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisioMUI.xml") returned -1
	[0037.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.xml") returned -1
	[0037.025] lstrcmpiA (lpString1="", lpString2="VisioMUI.xml") returned -1
	[0037.025] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="VisioMUI.msi"
	[0037.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\"
	[0037.025] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.025] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.025] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.025] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml"
	[0037.025] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.025] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.025] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.025] lstrcmpA (lpString1=".", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1
	[0037.025] lstrcmpA (lpString1="..", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1
	[0037.025] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.025] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C"
	[0037.025] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.045] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.045] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.045] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.045] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.045] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.045] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.045] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OneNoteMUI.msi") returned -1
	[0037.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.msi") returned -1
	[0037.045] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.msi") returned -1
	[0037.045] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\"
	[0037.045] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.045] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.046] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.046] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.047] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.047] CloseHandle (hObject=0x88) returned 1
	[0037.047] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi"
	[0037.047] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.047] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.047] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OneNoteMUI.xml") returned -1
	[0037.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.xml") returned -1
	[0037.047] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.xml") returned -1
	[0037.047] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="OneNoteMUI.msi"
	[0037.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\"
	[0037.047] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.047] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.047] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.047] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml"
	[0037.047] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.047] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.047] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OnoteLR.cab") returned -1
	[0037.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnoteLR.cab") returned -1
	[0037.047] lstrcmpiA (lpString1="", lpString2="OnoteLR.cab") returned -1
	[0037.047] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="OneNoteMUI.xml"
	[0037.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\"
	[0037.048] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.048] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.048] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.048] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OnoteLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab"
	[0037.048] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.048] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.048] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.048] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.048] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="OnoteLR.cab"
	[0037.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\"
	[0037.048] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.048] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.048] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.048] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.048] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.048] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.048] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.048] lstrcmpA (lpString1=".", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1
	[0037.048] lstrcmpA (lpString1="..", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1
	[0037.048] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.048] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C"
	[0037.048] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.061] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.061] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.061] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.061] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.062] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.062] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.062] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectMUI.msi") returned -1
	[0037.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.msi") returned -1
	[0037.062] lstrcmpiA (lpString1="", lpString2="ProjectMUI.msi") returned -1
	[0037.062] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\"
	[0037.062] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.062] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.062] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.062] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.064] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.064] CloseHandle (hObject=0x88) returned 1
	[0037.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi"
	[0037.064] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.064] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectMUI.xml") returned -1
	[0037.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.xml") returned -1
	[0037.064] lstrcmpiA (lpString1="", lpString2="ProjectMUI.xml") returned -1
	[0037.064] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="ProjectMUI.msi"
	[0037.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\"
	[0037.064] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.064] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml"
	[0037.064] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.064] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjLR.cab") returned -1
	[0037.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjLR.cab") returned -1
	[0037.064] lstrcmpiA (lpString1="", lpString2="ProjLR.cab") returned -1
	[0037.064] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="ProjectMUI.xml"
	[0037.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\"
	[0037.064] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.064] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.064] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab"
	[0037.064] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.064] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.065] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.065] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="ProjLR.cab"
	[0037.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\"
	[0037.065] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.065] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.065] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.065] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.065] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.065] lstrcmpA (lpString1=".", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1
	[0037.065] lstrcmpA (lpString1="..", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1
	[0037.065] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C"
	[0037.065] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.099] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.099] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.099] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.099] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.099] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.099] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.099] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveLR.cab") returned -1
	[0037.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveLR.cab") returned 1
	[0037.099] lstrcmpiA (lpString1="", lpString2="GrooveLR.cab") returned -1
	[0037.099] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\"
	[0037.099] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.099] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.099] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.099] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.100] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.100] CloseHandle (hObject=0x88) returned 1
	[0037.100] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab"
	[0037.100] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.100] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.100] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveMUI.msi") returned -1
	[0037.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.msi") returned 1
	[0037.100] lstrcmpiA (lpString1="", lpString2="GrooveMUI.msi") returned -1
	[0037.101] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="GrooveLR.cab"
	[0037.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\"
	[0037.101] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.101] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi"
	[0037.101] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.101] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.101] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveMUI.xml") returned -1
	[0037.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.xml") returned 1
	[0037.101] lstrcmpiA (lpString1="", lpString2="GrooveMUI.xml") returned -1
	[0037.101] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="GrooveMUI.msi"
	[0037.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\"
	[0037.101] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.101] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml"
	[0037.101] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.101] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.101] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.101] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.101] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="GrooveMUI.xml"
	[0037.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\"
	[0037.101] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.101] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.101] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.101] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.102] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.102] lstrcmpA (lpString1=".", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1
	[0037.102] lstrcmpA (lpString1="..", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1
	[0037.102] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.102] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C"
	[0037.102] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.119] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.119] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.119] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.119] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.119] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.119] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0037.119] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0037.119] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.119] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="1033" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033"
	[0037.119] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b9330
	[0037.120] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.120] FindNextFileA (in: hFindFile=0x8b9330, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.120] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.120] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.120] FindNextFileA (in: hFindFile=0x8b9330, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.120] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.120] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="dwintl20.dll") returned 1
	[0037.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwintl20.dll") returned 1
	[0037.120] lstrcmpiA (lpString1="", lpString2="dwintl20.dll") returned -1
	[0037.120] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*") returned="*.*"
	[0037.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\"
	[0037.120] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned=""
	[0037.120] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt"
	[0037.120] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0037.120] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0037.121] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.121] CloseHandle (hObject=0x8c) returned 1
	[0037.122] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="dwintl20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll"
	[0037.122] FindNextFileA (in: hFindFile=0x8b9330, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0037.122] FindClose (in: hFindFile=0x8b9330 | out: hFindFile=0x8b9330) returned 1
	[0037.122] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.122] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.122] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="branding.xml") returned 1
	[0037.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1
	[0037.122] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1
	[0037.122] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.122] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.122] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.122] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.122] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.129] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.129] CloseHandle (hObject=0x88) returned 1
	[0037.129] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml"
	[0037.129] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.129] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.129] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DW20.EXE") returned 1
	[0037.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DW20.EXE") returned 1
	[0037.130] lstrcmpiA (lpString1="", lpString2="DW20.EXE") returned -1
	[0037.130] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="branding.xml"
	[0037.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.130] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.130] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.130] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.130] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="DW20.EXE" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE"
	[0037.130] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE"
	[0037.130] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE"
	[0037.130] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE."
	[0037.130] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.Boom") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.Boom"
	[0037.130] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.131] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xccb88
	[0037.131] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa26c9d00, dwHighDateTime=0x1cac9ae), lpLastAccessTime=0x407536*(dwLowDateTime=0xa26c9d00, dwHighDateTime=0x1cac9ae), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe85142d0, dwHighDateTime=0x1d301be)) returned 1
	[0037.131] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.131] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xccb65, lpOverlapped=0x0) returned 1
	[0037.197] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="DW20.EXE"
	[0037.200] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.200] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xccb65, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xccb65, lpOverlapped=0x0) returned 1
	[0037.203] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.203] CloseHandle (hObject=0x88) returned 1
	[0037.210] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.Boom" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.boom")) returned 1
	[0037.211] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.211] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.211] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="dwdcw20.dll") returned 1
	[0037.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwdcw20.dll") returned 1
	[0037.211] lstrcmpiA (lpString1="", lpString2="dwdcw20.dll") returned -1
	[0037.211] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="DW20.EXE"
	[0037.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.211] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.211] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.211] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.211] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwdcw20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll"
	[0037.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.zip") returned 0
	[0037.211] lstrlenA (lpString="*.zip") returned 5
	[0037.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.rar") returned 0
	[0037.211] lstrlenA (lpString="*.rar") returned 5
	[0037.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.7z") returned 0
	[0037.211] lstrlenA (lpString="*.7z") returned 4
	[0037.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.tar") returned 0
	[0037.211] lstrlenA (lpString="*.tar") returned 5
	[0037.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.gzip") returned 0
	[0037.212] lstrlenA (lpString="*.gzip") returned 6
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.jpg") returned 0
	[0037.212] lstrlenA (lpString="*.jpg") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.jpeg") returned 0
	[0037.212] lstrlenA (lpString="*.jpeg") returned 6
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.psd") returned 0
	[0037.212] lstrlenA (lpString="*.psd") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.cdr") returned 0
	[0037.212] lstrlenA (lpString="*.cdr") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.dwg") returned 0
	[0037.212] lstrlenA (lpString="*.dwg") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.max") returned 0
	[0037.212] lstrlenA (lpString="*.max") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.bmp") returned 0
	[0037.212] lstrlenA (lpString="*.bmp") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.gif") returned 0
	[0037.212] lstrlenA (lpString="*.gif") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.png") returned 0
	[0037.212] lstrlenA (lpString="*.png") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.doc") returned 0
	[0037.212] lstrlenA (lpString="*.doc") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.docx") returned 0
	[0037.212] lstrlenA (lpString="*.docx") returned 6
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.xls") returned 0
	[0037.212] lstrlenA (lpString="*.xls") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.xlsx") returned 0
	[0037.212] lstrlenA (lpString="*.xlsx") returned 6
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ppt") returned 0
	[0037.212] lstrlenA (lpString="*.ppt") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pptx") returned 0
	[0037.212] lstrlenA (lpString="*.pptx") returned 6
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.txt") returned 0
	[0037.212] lstrlenA (lpString="*.txt") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pdf") returned 0
	[0037.212] lstrlenA (lpString="*.pdf") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.djvu") returned 0
	[0037.212] lstrlenA (lpString="*.djvu") returned 6
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.htm") returned 0
	[0037.212] lstrlenA (lpString="*.htm") returned 5
	[0037.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.html") returned 0
	[0037.213] lstrlenA (lpString="*.html") returned 6
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mdb") returned 0
	[0037.213] lstrlenA (lpString="*.mdb") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.cer") returned 0
	[0037.213] lstrlenA (lpString="*.cer") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.p12") returned 0
	[0037.213] lstrlenA (lpString="*.p12") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pfx") returned 0
	[0037.213] lstrlenA (lpString="*.pfx") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.kwm") returned 0
	[0037.213] lstrlenA (lpString="*.kwm") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pwm") returned 0
	[0037.213] lstrlenA (lpString="*.pwm") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.1cd") returned 0
	[0037.213] lstrlenA (lpString="*.1cd") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.md") returned 0
	[0037.213] lstrlenA (lpString="*.md") returned 4
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mdf") returned 0
	[0037.213] lstrlenA (lpString="*.mdf") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.dbf") returned 0
	[0037.213] lstrlenA (lpString="*.dbf") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.odt") returned 0
	[0037.213] lstrlenA (lpString="*.odt") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.vob") returned 0
	[0037.213] lstrlenA (lpString="*.vob") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ifo") returned 0
	[0037.213] lstrlenA (lpString="*.ifo") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.lnk") returned 0
	[0037.213] lstrlenA (lpString="*.lnk") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.torrent") returned 0
	[0037.213] lstrlenA (lpString="*.torrent") returned 9
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mov") returned 0
	[0037.213] lstrlenA (lpString="*.mov") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.m2v") returned 0
	[0037.213] lstrlenA (lpString="*.m2v") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.3gp") returned 0
	[0037.213] lstrlenA (lpString="*.3gp") returned 5
	[0037.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mpeg") returned 0
	[0037.213] lstrlenA (lpString="*.mpeg") returned 6
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mpg") returned 0
	[0037.214] lstrlenA (lpString="*.mpg") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.flv") returned 0
	[0037.214] lstrlenA (lpString="*.flv") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.avi") returned 0
	[0037.214] lstrlenA (lpString="*.avi") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mp4") returned 0
	[0037.214] lstrlenA (lpString="*.mp4") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.wmv") returned 0
	[0037.214] lstrlenA (lpString="*.wmv") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.divx") returned 0
	[0037.214] lstrlenA (lpString="*.divx") returned 6
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mkv") returned 0
	[0037.214] lstrlenA (lpString="*.mkv") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mp3") returned 0
	[0037.214] lstrlenA (lpString="*.mp3") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.wav") returned 0
	[0037.214] lstrlenA (lpString="*.wav") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.flac") returned 0
	[0037.214] lstrlenA (lpString="*.flac") returned 6
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ape") returned 0
	[0037.214] lstrlenA (lpString="*.ape") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.wma") returned 0
	[0037.214] lstrlenA (lpString="*.wma") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ac3") returned 0
	[0037.214] lstrlenA (lpString="*.ac3") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.exe") returned 0
	[0037.214] lstrlenA (lpString="*.exe") returned 5
	[0037.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.apk") returned 0
	[0037.214] lstrlenA (lpString="*.apk") returned 5
	[0037.214] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.214] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.214] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="dwtrig20.exe") returned 1
	[0037.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwtrig20.exe") returned 1
	[0037.214] lstrcmpiA (lpString1="", lpString2="dwtrig20.exe") returned -1
	[0037.214] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="dwdcw20.dll"
	[0037.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.215] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.215] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.215] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.215] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwtrig20.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe"
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.zip") returned 0
	[0037.215] lstrlenA (lpString="*.zip") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.rar") returned 0
	[0037.215] lstrlenA (lpString="*.rar") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.7z") returned 0
	[0037.215] lstrlenA (lpString="*.7z") returned 4
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.tar") returned 0
	[0037.215] lstrlenA (lpString="*.tar") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.gzip") returned 0
	[0037.215] lstrlenA (lpString="*.gzip") returned 6
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.jpg") returned 0
	[0037.215] lstrlenA (lpString="*.jpg") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.jpeg") returned 0
	[0037.215] lstrlenA (lpString="*.jpeg") returned 6
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.psd") returned 0
	[0037.215] lstrlenA (lpString="*.psd") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.cdr") returned 0
	[0037.215] lstrlenA (lpString="*.cdr") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.dwg") returned 0
	[0037.215] lstrlenA (lpString="*.dwg") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.max") returned 0
	[0037.215] lstrlenA (lpString="*.max") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.bmp") returned 0
	[0037.215] lstrlenA (lpString="*.bmp") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.gif") returned 0
	[0037.215] lstrlenA (lpString="*.gif") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.png") returned 0
	[0037.215] lstrlenA (lpString="*.png") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.doc") returned 0
	[0037.215] lstrlenA (lpString="*.doc") returned 5
	[0037.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.docx") returned 0
	[0037.215] lstrlenA (lpString="*.docx") returned 6
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.xls") returned 0
	[0037.216] lstrlenA (lpString="*.xls") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.xlsx") returned 0
	[0037.216] lstrlenA (lpString="*.xlsx") returned 6
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.ppt") returned 0
	[0037.216] lstrlenA (lpString="*.ppt") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.pptx") returned 0
	[0037.216] lstrlenA (lpString="*.pptx") returned 6
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.txt") returned 0
	[0037.216] lstrlenA (lpString="*.txt") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.pdf") returned 0
	[0037.216] lstrlenA (lpString="*.pdf") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.djvu") returned 0
	[0037.216] lstrlenA (lpString="*.djvu") returned 6
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.htm") returned 0
	[0037.216] lstrlenA (lpString="*.htm") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.html") returned 0
	[0037.216] lstrlenA (lpString="*.html") returned 6
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mdb") returned 0
	[0037.216] lstrlenA (lpString="*.mdb") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.cer") returned 0
	[0037.216] lstrlenA (lpString="*.cer") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.p12") returned 0
	[0037.216] lstrlenA (lpString="*.p12") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.pfx") returned 0
	[0037.216] lstrlenA (lpString="*.pfx") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.kwm") returned 0
	[0037.216] lstrlenA (lpString="*.kwm") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.pwm") returned 0
	[0037.216] lstrlenA (lpString="*.pwm") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.1cd") returned 0
	[0037.216] lstrlenA (lpString="*.1cd") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.md") returned 0
	[0037.216] lstrlenA (lpString="*.md") returned 4
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mdf") returned 0
	[0037.216] lstrlenA (lpString="*.mdf") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.dbf") returned 0
	[0037.216] lstrlenA (lpString="*.dbf") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.odt") returned 0
	[0037.216] lstrlenA (lpString="*.odt") returned 5
	[0037.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.vob") returned 0
	[0037.217] lstrlenA (lpString="*.vob") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.ifo") returned 0
	[0037.217] lstrlenA (lpString="*.ifo") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.lnk") returned 0
	[0037.217] lstrlenA (lpString="*.lnk") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.torrent") returned 0
	[0037.217] lstrlenA (lpString="*.torrent") returned 9
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mov") returned 0
	[0037.217] lstrlenA (lpString="*.mov") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.m2v") returned 0
	[0037.217] lstrlenA (lpString="*.m2v") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.3gp") returned 0
	[0037.217] lstrlenA (lpString="*.3gp") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mpeg") returned 0
	[0037.217] lstrlenA (lpString="*.mpeg") returned 6
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mpg") returned 0
	[0037.217] lstrlenA (lpString="*.mpg") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.flv") returned 0
	[0037.217] lstrlenA (lpString="*.flv") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.avi") returned 0
	[0037.217] lstrlenA (lpString="*.avi") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mp4") returned 0
	[0037.217] lstrlenA (lpString="*.mp4") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.wmv") returned 0
	[0037.217] lstrlenA (lpString="*.wmv") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.divx") returned 0
	[0037.217] lstrlenA (lpString="*.divx") returned 6
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mkv") returned 0
	[0037.217] lstrlenA (lpString="*.mkv") returned 5
	[0037.217] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mp3") returned 0
	[0037.217] lstrlenA (lpString="*.mp3") returned 5
	[0037.218] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.wav") returned 0
	[0037.218] lstrlenA (lpString="*.wav") returned 5
	[0037.218] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.flac") returned 0
	[0037.218] lstrlenA (lpString="*.flac") returned 6
	[0037.218] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.ape") returned 0
	[0037.218] lstrlenA (lpString="*.ape") returned 5
	[0037.218] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.wma") returned 0
	[0037.218] lstrlenA (lpString="*.wma") returned 5
	[0037.218] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.ac3") returned 0
	[0037.218] lstrlenA (lpString="*.ac3") returned 5
	[0037.218] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.exe") returned 1
	[0037.218] lstrlenA (lpString="*.exe") returned 5
	[0037.218] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe"
	[0037.218] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe"
	[0037.218] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe."
	[0037.218] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.Boom") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.Boom"
	[0037.218] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.218] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7eda0
	[0037.218] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xabf60500, dwHighDateTime=0x1cac9ae), lpLastAccessTime=0x407536*(dwLowDateTime=0xabf60500, dwHighDateTime=0x1cac9ae), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe85f73a0, dwHighDateTime=0x1d301be)) returned 1
	[0037.218] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.218] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7ed7d, lpOverlapped=0x0) returned 1
	[0037.252] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="dwtrig20.exe"
	[0037.254] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.254] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7ed7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7ed7d, lpOverlapped=0x0) returned 1
	[0037.256] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.256] CloseHandle (hObject=0x88) returned 1
	[0037.259] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.Boom" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.boom")) returned 1
	[0037.259] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.259] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.VC90.CRT.manifest") returned -1
	[0037.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VC90.CRT.manifest") returned -1
	[0037.260] lstrcmpiA (lpString1="", lpString2="Microsoft.VC90.CRT.manifest") returned -1
	[0037.260] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="dwtrig20.exe"
	[0037.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.260] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.260] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.260] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.260] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Microsoft.VC90.CRT.manifest" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest"
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.zip") returned 0
	[0037.260] lstrlenA (lpString="*.zip") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.rar") returned 0
	[0037.260] lstrlenA (lpString="*.rar") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.7z") returned 0
	[0037.260] lstrlenA (lpString="*.7z") returned 4
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.tar") returned 0
	[0037.260] lstrlenA (lpString="*.tar") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.gzip") returned 0
	[0037.260] lstrlenA (lpString="*.gzip") returned 6
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.jpg") returned 0
	[0037.260] lstrlenA (lpString="*.jpg") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.jpeg") returned 0
	[0037.260] lstrlenA (lpString="*.jpeg") returned 6
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.psd") returned 0
	[0037.260] lstrlenA (lpString="*.psd") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.cdr") returned 0
	[0037.260] lstrlenA (lpString="*.cdr") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.dwg") returned 0
	[0037.260] lstrlenA (lpString="*.dwg") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.max") returned 0
	[0037.260] lstrlenA (lpString="*.max") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.bmp") returned 0
	[0037.260] lstrlenA (lpString="*.bmp") returned 5
	[0037.260] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.gif") returned 0
	[0037.261] lstrlenA (lpString="*.gif") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.png") returned 0
	[0037.261] lstrlenA (lpString="*.png") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.doc") returned 0
	[0037.261] lstrlenA (lpString="*.doc") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.docx") returned 0
	[0037.261] lstrlenA (lpString="*.docx") returned 6
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.xls") returned 0
	[0037.261] lstrlenA (lpString="*.xls") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.xlsx") returned 0
	[0037.261] lstrlenA (lpString="*.xlsx") returned 6
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.ppt") returned 0
	[0037.261] lstrlenA (lpString="*.ppt") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.pptx") returned 0
	[0037.261] lstrlenA (lpString="*.pptx") returned 6
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.txt") returned 0
	[0037.261] lstrlenA (lpString="*.txt") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.pdf") returned 0
	[0037.261] lstrlenA (lpString="*.pdf") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.djvu") returned 0
	[0037.261] lstrlenA (lpString="*.djvu") returned 6
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.htm") returned 0
	[0037.261] lstrlenA (lpString="*.htm") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.html") returned 0
	[0037.261] lstrlenA (lpString="*.html") returned 6
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mdb") returned 0
	[0037.261] lstrlenA (lpString="*.mdb") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.cer") returned 0
	[0037.261] lstrlenA (lpString="*.cer") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.p12") returned 0
	[0037.261] lstrlenA (lpString="*.p12") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.pfx") returned 0
	[0037.261] lstrlenA (lpString="*.pfx") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.kwm") returned 0
	[0037.261] lstrlenA (lpString="*.kwm") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.pwm") returned 0
	[0037.261] lstrlenA (lpString="*.pwm") returned 5
	[0037.261] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.1cd") returned 0
	[0037.262] lstrlenA (lpString="*.1cd") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.md") returned 0
	[0037.262] lstrlenA (lpString="*.md") returned 4
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mdf") returned 0
	[0037.262] lstrlenA (lpString="*.mdf") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.dbf") returned 0
	[0037.262] lstrlenA (lpString="*.dbf") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.odt") returned 0
	[0037.262] lstrlenA (lpString="*.odt") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.vob") returned 0
	[0037.262] lstrlenA (lpString="*.vob") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.ifo") returned 0
	[0037.262] lstrlenA (lpString="*.ifo") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.lnk") returned 0
	[0037.262] lstrlenA (lpString="*.lnk") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.torrent") returned 0
	[0037.262] lstrlenA (lpString="*.torrent") returned 9
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mov") returned 0
	[0037.262] lstrlenA (lpString="*.mov") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.m2v") returned 0
	[0037.262] lstrlenA (lpString="*.m2v") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.3gp") returned 0
	[0037.262] lstrlenA (lpString="*.3gp") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mpeg") returned 0
	[0037.262] lstrlenA (lpString="*.mpeg") returned 6
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mpg") returned 0
	[0037.262] lstrlenA (lpString="*.mpg") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.flv") returned 0
	[0037.262] lstrlenA (lpString="*.flv") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.avi") returned 0
	[0037.262] lstrlenA (lpString="*.avi") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mp4") returned 0
	[0037.262] lstrlenA (lpString="*.mp4") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.wmv") returned 0
	[0037.262] lstrlenA (lpString="*.wmv") returned 5
	[0037.262] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.divx") returned 0
	[0037.262] lstrlenA (lpString="*.divx") returned 6
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mkv") returned 0
	[0037.263] lstrlenA (lpString="*.mkv") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mp3") returned 0
	[0037.263] lstrlenA (lpString="*.mp3") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.wav") returned 0
	[0037.263] lstrlenA (lpString="*.wav") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.flac") returned 0
	[0037.263] lstrlenA (lpString="*.flac") returned 6
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.ape") returned 0
	[0037.263] lstrlenA (lpString="*.ape") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.wma") returned 0
	[0037.263] lstrlenA (lpString="*.wma") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.ac3") returned 0
	[0037.263] lstrlenA (lpString="*.ac3") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.exe") returned 0
	[0037.263] lstrlenA (lpString="*.exe") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.apk") returned 0
	[0037.263] lstrlenA (lpString="*.apk") returned 5
	[0037.263] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.263] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msvcr90.dll") returned -1
	[0037.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msvcr90.dll") returned -1
	[0037.263] lstrcmpiA (lpString1="", lpString2="msvcr90.dll") returned -1
	[0037.263] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="Microsoft.VC90.CRT.manifest"
	[0037.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.263] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.263] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.263] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.263] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="msvcr90.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll"
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.zip") returned 0
	[0037.263] lstrlenA (lpString="*.zip") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.rar") returned 0
	[0037.263] lstrlenA (lpString="*.rar") returned 5
	[0037.263] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.7z") returned 0
	[0037.264] lstrlenA (lpString="*.7z") returned 4
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.tar") returned 0
	[0037.264] lstrlenA (lpString="*.tar") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.gzip") returned 0
	[0037.264] lstrlenA (lpString="*.gzip") returned 6
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.jpg") returned 0
	[0037.264] lstrlenA (lpString="*.jpg") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.jpeg") returned 0
	[0037.264] lstrlenA (lpString="*.jpeg") returned 6
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.psd") returned 0
	[0037.264] lstrlenA (lpString="*.psd") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.cdr") returned 0
	[0037.264] lstrlenA (lpString="*.cdr") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.dwg") returned 0
	[0037.264] lstrlenA (lpString="*.dwg") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.max") returned 0
	[0037.264] lstrlenA (lpString="*.max") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.bmp") returned 0
	[0037.264] lstrlenA (lpString="*.bmp") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.gif") returned 0
	[0037.264] lstrlenA (lpString="*.gif") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.png") returned 0
	[0037.264] lstrlenA (lpString="*.png") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.doc") returned 0
	[0037.264] lstrlenA (lpString="*.doc") returned 5
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.docx") returned 0
	[0037.264] lstrlenA (lpString="*.docx") returned 6
	[0037.264] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.xls") returned 0
	[0037.264] lstrlenA (lpString="*.xls") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.xlsx") returned 0
	[0037.265] lstrlenA (lpString="*.xlsx") returned 6
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.ppt") returned 0
	[0037.265] lstrlenA (lpString="*.ppt") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.pptx") returned 0
	[0037.265] lstrlenA (lpString="*.pptx") returned 6
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.txt") returned 0
	[0037.265] lstrlenA (lpString="*.txt") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.pdf") returned 0
	[0037.265] lstrlenA (lpString="*.pdf") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.djvu") returned 0
	[0037.265] lstrlenA (lpString="*.djvu") returned 6
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.htm") returned 0
	[0037.265] lstrlenA (lpString="*.htm") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.html") returned 0
	[0037.265] lstrlenA (lpString="*.html") returned 6
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mdb") returned 0
	[0037.265] lstrlenA (lpString="*.mdb") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.cer") returned 0
	[0037.265] lstrlenA (lpString="*.cer") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.p12") returned 0
	[0037.265] lstrlenA (lpString="*.p12") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.pfx") returned 0
	[0037.265] lstrlenA (lpString="*.pfx") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.kwm") returned 0
	[0037.265] lstrlenA (lpString="*.kwm") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.pwm") returned 0
	[0037.265] lstrlenA (lpString="*.pwm") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.1cd") returned 0
	[0037.265] lstrlenA (lpString="*.1cd") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.md") returned 0
	[0037.265] lstrlenA (lpString="*.md") returned 4
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mdf") returned 0
	[0037.265] lstrlenA (lpString="*.mdf") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.dbf") returned 0
	[0037.265] lstrlenA (lpString="*.dbf") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.odt") returned 0
	[0037.265] lstrlenA (lpString="*.odt") returned 5
	[0037.265] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.vob") returned 0
	[0037.266] lstrlenA (lpString="*.vob") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.ifo") returned 0
	[0037.266] lstrlenA (lpString="*.ifo") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.lnk") returned 0
	[0037.266] lstrlenA (lpString="*.lnk") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.torrent") returned 0
	[0037.266] lstrlenA (lpString="*.torrent") returned 9
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mov") returned 0
	[0037.266] lstrlenA (lpString="*.mov") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.m2v") returned 0
	[0037.266] lstrlenA (lpString="*.m2v") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.3gp") returned 0
	[0037.266] lstrlenA (lpString="*.3gp") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mpeg") returned 0
	[0037.266] lstrlenA (lpString="*.mpeg") returned 6
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mpg") returned 0
	[0037.266] lstrlenA (lpString="*.mpg") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.flv") returned 0
	[0037.266] lstrlenA (lpString="*.flv") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.avi") returned 0
	[0037.266] lstrlenA (lpString="*.avi") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mp4") returned 0
	[0037.266] lstrlenA (lpString="*.mp4") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.wmv") returned 0
	[0037.266] lstrlenA (lpString="*.wmv") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.divx") returned 0
	[0037.266] lstrlenA (lpString="*.divx") returned 6
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mkv") returned 0
	[0037.266] lstrlenA (lpString="*.mkv") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mp3") returned 0
	[0037.266] lstrlenA (lpString="*.mp3") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.wav") returned 0
	[0037.266] lstrlenA (lpString="*.wav") returned 5
	[0037.266] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.flac") returned 0
	[0037.267] lstrlenA (lpString="*.flac") returned 6
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.ape") returned 0
	[0037.267] lstrlenA (lpString="*.ape") returned 5
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.wma") returned 0
	[0037.267] lstrlenA (lpString="*.wma") returned 5
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.ac3") returned 0
	[0037.267] lstrlenA (lpString="*.ac3") returned 5
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.exe") returned 0
	[0037.267] lstrlenA (lpString="*.exe") returned 5
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.apk") returned 0
	[0037.267] lstrlenA (lpString="*.apk") returned 5
	[0037.267] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.267] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.267] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeLR.cab") returned -1
	[0037.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeLR.cab") returned -1
	[0037.267] lstrcmpiA (lpString1="", lpString2="OfficeLR.cab") returned -1
	[0037.267] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="msvcr90.dll"
	[0037.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.267] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.267] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.267] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.267] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab"
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.zip") returned 0
	[0037.267] lstrlenA (lpString="*.zip") returned 5
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.rar") returned 0
	[0037.267] lstrlenA (lpString="*.rar") returned 5
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.7z") returned 0
	[0037.267] lstrlenA (lpString="*.7z") returned 4
	[0037.267] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.tar") returned 0
	[0037.268] lstrlenA (lpString="*.tar") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.gzip") returned 0
	[0037.268] lstrlenA (lpString="*.gzip") returned 6
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.jpg") returned 0
	[0037.268] lstrlenA (lpString="*.jpg") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.jpeg") returned 0
	[0037.268] lstrlenA (lpString="*.jpeg") returned 6
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.psd") returned 0
	[0037.268] lstrlenA (lpString="*.psd") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.cdr") returned 0
	[0037.268] lstrlenA (lpString="*.cdr") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.dwg") returned 0
	[0037.268] lstrlenA (lpString="*.dwg") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.max") returned 0
	[0037.268] lstrlenA (lpString="*.max") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.bmp") returned 0
	[0037.268] lstrlenA (lpString="*.bmp") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.gif") returned 0
	[0037.268] lstrlenA (lpString="*.gif") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.png") returned 0
	[0037.268] lstrlenA (lpString="*.png") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.doc") returned 0
	[0037.268] lstrlenA (lpString="*.doc") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.docx") returned 0
	[0037.268] lstrlenA (lpString="*.docx") returned 6
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.xls") returned 0
	[0037.268] lstrlenA (lpString="*.xls") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.xlsx") returned 0
	[0037.268] lstrlenA (lpString="*.xlsx") returned 6
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.ppt") returned 0
	[0037.268] lstrlenA (lpString="*.ppt") returned 5
	[0037.268] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.pptx") returned 0
	[0037.268] lstrlenA (lpString="*.pptx") returned 6
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.txt") returned 0
	[0037.269] lstrlenA (lpString="*.txt") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.pdf") returned 0
	[0037.269] lstrlenA (lpString="*.pdf") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.djvu") returned 0
	[0037.269] lstrlenA (lpString="*.djvu") returned 6
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.htm") returned 0
	[0037.269] lstrlenA (lpString="*.htm") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.html") returned 0
	[0037.269] lstrlenA (lpString="*.html") returned 6
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mdb") returned 0
	[0037.269] lstrlenA (lpString="*.mdb") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.cer") returned 0
	[0037.269] lstrlenA (lpString="*.cer") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.p12") returned 0
	[0037.269] lstrlenA (lpString="*.p12") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.pfx") returned 0
	[0037.269] lstrlenA (lpString="*.pfx") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.kwm") returned 0
	[0037.269] lstrlenA (lpString="*.kwm") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.pwm") returned 0
	[0037.269] lstrlenA (lpString="*.pwm") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.1cd") returned 0
	[0037.269] lstrlenA (lpString="*.1cd") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.md") returned 0
	[0037.269] lstrlenA (lpString="*.md") returned 4
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mdf") returned 0
	[0037.269] lstrlenA (lpString="*.mdf") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.dbf") returned 0
	[0037.269] lstrlenA (lpString="*.dbf") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.odt") returned 0
	[0037.269] lstrlenA (lpString="*.odt") returned 5
	[0037.269] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.vob") returned 0
	[0037.269] lstrlenA (lpString="*.vob") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.ifo") returned 0
	[0037.270] lstrlenA (lpString="*.ifo") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.lnk") returned 0
	[0037.270] lstrlenA (lpString="*.lnk") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.torrent") returned 0
	[0037.270] lstrlenA (lpString="*.torrent") returned 9
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mov") returned 0
	[0037.270] lstrlenA (lpString="*.mov") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.m2v") returned 0
	[0037.270] lstrlenA (lpString="*.m2v") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.3gp") returned 0
	[0037.270] lstrlenA (lpString="*.3gp") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mpeg") returned 0
	[0037.270] lstrlenA (lpString="*.mpeg") returned 6
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mpg") returned 0
	[0037.270] lstrlenA (lpString="*.mpg") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.flv") returned 0
	[0037.270] lstrlenA (lpString="*.flv") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.avi") returned 0
	[0037.270] lstrlenA (lpString="*.avi") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mp4") returned 0
	[0037.270] lstrlenA (lpString="*.mp4") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.wmv") returned 0
	[0037.270] lstrlenA (lpString="*.wmv") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.divx") returned 0
	[0037.270] lstrlenA (lpString="*.divx") returned 6
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mkv") returned 0
	[0037.270] lstrlenA (lpString="*.mkv") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mp3") returned 0
	[0037.270] lstrlenA (lpString="*.mp3") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.wav") returned 0
	[0037.270] lstrlenA (lpString="*.wav") returned 5
	[0037.270] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.flac") returned 0
	[0037.271] lstrlenA (lpString="*.flac") returned 6
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.ape") returned 0
	[0037.271] lstrlenA (lpString="*.ape") returned 5
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.wma") returned 0
	[0037.271] lstrlenA (lpString="*.wma") returned 5
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.ac3") returned 0
	[0037.271] lstrlenA (lpString="*.ac3") returned 5
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.exe") returned 0
	[0037.271] lstrlenA (lpString="*.exe") returned 5
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.apk") returned 0
	[0037.271] lstrlenA (lpString="*.apk") returned 5
	[0037.271] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUI.msi") returned -1
	[0037.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.msi") returned -1
	[0037.271] lstrcmpiA (lpString1="", lpString2="OfficeMUI.msi") returned -1
	[0037.271] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="OfficeLR.cab"
	[0037.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.271] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.271] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.271] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.271] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi"
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.zip") returned 0
	[0037.271] lstrlenA (lpString="*.zip") returned 5
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.rar") returned 0
	[0037.271] lstrlenA (lpString="*.rar") returned 5
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.7z") returned 0
	[0037.271] lstrlenA (lpString="*.7z") returned 4
	[0037.271] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.tar") returned 0
	[0037.271] lstrlenA (lpString="*.tar") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.gzip") returned 0
	[0037.272] lstrlenA (lpString="*.gzip") returned 6
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.jpg") returned 0
	[0037.272] lstrlenA (lpString="*.jpg") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.jpeg") returned 0
	[0037.272] lstrlenA (lpString="*.jpeg") returned 6
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.psd") returned 0
	[0037.272] lstrlenA (lpString="*.psd") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.cdr") returned 0
	[0037.272] lstrlenA (lpString="*.cdr") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.dwg") returned 0
	[0037.272] lstrlenA (lpString="*.dwg") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.max") returned 0
	[0037.272] lstrlenA (lpString="*.max") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.bmp") returned 0
	[0037.272] lstrlenA (lpString="*.bmp") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.gif") returned 0
	[0037.272] lstrlenA (lpString="*.gif") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.png") returned 0
	[0037.272] lstrlenA (lpString="*.png") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.doc") returned 0
	[0037.272] lstrlenA (lpString="*.doc") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.docx") returned 0
	[0037.272] lstrlenA (lpString="*.docx") returned 6
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.xls") returned 0
	[0037.272] lstrlenA (lpString="*.xls") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.xlsx") returned 0
	[0037.272] lstrlenA (lpString="*.xlsx") returned 6
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.ppt") returned 0
	[0037.272] lstrlenA (lpString="*.ppt") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.pptx") returned 0
	[0037.272] lstrlenA (lpString="*.pptx") returned 6
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.txt") returned 0
	[0037.272] lstrlenA (lpString="*.txt") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.pdf") returned 0
	[0037.272] lstrlenA (lpString="*.pdf") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.djvu") returned 0
	[0037.272] lstrlenA (lpString="*.djvu") returned 6
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.htm") returned 0
	[0037.272] lstrlenA (lpString="*.htm") returned 5
	[0037.272] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.html") returned 0
	[0037.272] lstrlenA (lpString="*.html") returned 6
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mdb") returned 0
	[0037.273] lstrlenA (lpString="*.mdb") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.cer") returned 0
	[0037.273] lstrlenA (lpString="*.cer") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.p12") returned 0
	[0037.273] lstrlenA (lpString="*.p12") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.pfx") returned 0
	[0037.273] lstrlenA (lpString="*.pfx") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.kwm") returned 0
	[0037.273] lstrlenA (lpString="*.kwm") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.pwm") returned 0
	[0037.273] lstrlenA (lpString="*.pwm") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.1cd") returned 0
	[0037.273] lstrlenA (lpString="*.1cd") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.md") returned 0
	[0037.273] lstrlenA (lpString="*.md") returned 4
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mdf") returned 0
	[0037.273] lstrlenA (lpString="*.mdf") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.dbf") returned 0
	[0037.273] lstrlenA (lpString="*.dbf") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.odt") returned 0
	[0037.273] lstrlenA (lpString="*.odt") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.vob") returned 0
	[0037.273] lstrlenA (lpString="*.vob") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.ifo") returned 0
	[0037.273] lstrlenA (lpString="*.ifo") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.lnk") returned 0
	[0037.273] lstrlenA (lpString="*.lnk") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.torrent") returned 0
	[0037.273] lstrlenA (lpString="*.torrent") returned 9
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mov") returned 0
	[0037.273] lstrlenA (lpString="*.mov") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.m2v") returned 0
	[0037.273] lstrlenA (lpString="*.m2v") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.3gp") returned 0
	[0037.273] lstrlenA (lpString="*.3gp") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mpeg") returned 0
	[0037.273] lstrlenA (lpString="*.mpeg") returned 6
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mpg") returned 0
	[0037.273] lstrlenA (lpString="*.mpg") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.flv") returned 0
	[0037.273] lstrlenA (lpString="*.flv") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.avi") returned 0
	[0037.273] lstrlenA (lpString="*.avi") returned 5
	[0037.273] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mp4") returned 0
	[0037.274] lstrlenA (lpString="*.mp4") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.wmv") returned 0
	[0037.274] lstrlenA (lpString="*.wmv") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.divx") returned 0
	[0037.274] lstrlenA (lpString="*.divx") returned 6
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mkv") returned 0
	[0037.274] lstrlenA (lpString="*.mkv") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mp3") returned 0
	[0037.274] lstrlenA (lpString="*.mp3") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.wav") returned 0
	[0037.274] lstrlenA (lpString="*.wav") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.flac") returned 0
	[0037.274] lstrlenA (lpString="*.flac") returned 6
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.ape") returned 0
	[0037.274] lstrlenA (lpString="*.ape") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.wma") returned 0
	[0037.274] lstrlenA (lpString="*.wma") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.ac3") returned 0
	[0037.274] lstrlenA (lpString="*.ac3") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.exe") returned 0
	[0037.274] lstrlenA (lpString="*.exe") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.apk") returned 0
	[0037.274] lstrlenA (lpString="*.apk") returned 5
	[0037.274] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.274] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUI.xml") returned -1
	[0037.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.xml") returned -1
	[0037.274] lstrcmpiA (lpString1="", lpString2="OfficeMUI.xml") returned -1
	[0037.274] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="OfficeMUI.msi"
	[0037.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.274] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.274] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.274] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.274] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml"
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.zip") returned 0
	[0037.274] lstrlenA (lpString="*.zip") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.rar") returned 0
	[0037.274] lstrlenA (lpString="*.rar") returned 5
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.7z") returned 0
	[0037.274] lstrlenA (lpString="*.7z") returned 4
	[0037.274] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.tar") returned 0
	[0037.275] lstrlenA (lpString="*.tar") returned 5
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.gzip") returned 0
	[0037.275] lstrlenA (lpString="*.gzip") returned 6
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.jpg") returned 0
	[0037.275] lstrlenA (lpString="*.jpg") returned 5
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.jpeg") returned 0
	[0037.275] lstrlenA (lpString="*.jpeg") returned 6
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.psd") returned 0
	[0037.275] lstrlenA (lpString="*.psd") returned 5
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.cdr") returned 0
	[0037.275] lstrlenA (lpString="*.cdr") returned 5
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.dwg") returned 0
	[0037.275] lstrlenA (lpString="*.dwg") returned 5
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.max") returned 0
	[0037.275] lstrlenA (lpString="*.max") returned 5
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.bmp") returned 0
	[0037.275] lstrlenA (lpString="*.bmp") returned 5
	[0037.275] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.gif") returned 0
	[0037.275] lstrlenA (lpString="*.gif") returned 5
	[0037.275] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.275] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.275] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUISet.msi") returned -1
	[0037.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.msi") returned -1
	[0037.275] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.msi") returned -1
	[0037.275] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="OfficeMUI.xml"
	[0037.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.275] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.275] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.275] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.275] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi"
	[0037.275] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.276] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUISet.xml") returned -1
	[0037.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.xml") returned -1
	[0037.276] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.xml") returned -1
	[0037.276] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="OfficeMUISet.msi"
	[0037.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.276] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.276] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.276] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.276] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml"
	[0037.276] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.276] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osetupui.dll") returned -1
	[0037.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetupui.dll") returned -1
	[0037.276] lstrcmpiA (lpString1="", lpString2="osetupui.dll") returned -1
	[0037.276] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="OfficeMUISet.xml"
	[0037.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.276] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.276] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.276] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.276] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="osetupui.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll"
	[0037.276] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.276] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pss10r.chm") returned -1
	[0037.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pss10r.chm") returned -1
	[0037.276] lstrcmpiA (lpString1="", lpString2="pss10r.chm") returned -1
	[0037.276] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="osetupui.dll"
	[0037.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.276] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.276] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.276] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.276] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="pss10r.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm"
	[0037.276] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.277] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="setup.chm") returned -1
	[0037.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.chm") returned -1
	[0037.277] lstrcmpiA (lpString1="", lpString2="setup.chm") returned -1
	[0037.277] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="pss10r.chm"
	[0037.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.277] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.277] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.277] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.277] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="setup.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm"
	[0037.277] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.277] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.277] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.277] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="setup.chm"
	[0037.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.277] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.277] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.277] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.277] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.277] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.277] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ShellUI.MST") returned -1
	[0037.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShellUI.MST") returned -1
	[0037.277] lstrcmpiA (lpString1="", lpString2="ShellUI.MST") returned -1
	[0037.277] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml"
	[0037.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\"
	[0037.277] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.277] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.277] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.277] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="ShellUI.MST" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST"
	[0037.277] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.278] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.278] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.278] lstrcmpA (lpString1=".", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1
	[0037.278] lstrcmpA (lpString1="..", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1
	[0037.278] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.278] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C"
	[0037.278] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.290] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.290] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.290] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.290] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.290] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.290] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1
	[0037.290] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1
	[0037.290] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.290] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Access.en-us" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us"
	[0037.290] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b9340
	[0037.300] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.300] FindNextFileA (in: hFindFile=0x8b9340, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.301] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.301] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.301] FindNextFileA (in: hFindFile=0x8b9340, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.301] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.301] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUI.msi") returned 1
	[0037.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.msi") returned 1
	[0037.301] lstrcmpiA (lpString1="", lpString2="AccessMUI.msi") returned -1
	[0037.301] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*") returned="*.*"
	[0037.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\"
	[0037.301] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned=""
	[0037.301] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt"
	[0037.301] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0037.301] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0037.303] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.303] CloseHandle (hObject=0x8c) returned 1
	[0037.303] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi"
	[0037.303] FindNextFileA (in: hFindFile=0x8b9340, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.303] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.303] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUI.xml") returned 1
	[0037.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.xml") returned 1
	[0037.304] lstrcmpiA (lpString1="", lpString2="AccessMUI.xml") returned -1
	[0037.304] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="AccessMUI.msi"
	[0037.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\"
	[0037.304] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned=""
	[0037.304] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt"
	[0037.304] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020
	[0037.304] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml"
	[0037.304] FindNextFileA (in: hFindFile=0x8b9340, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.304] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.304] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccLR.cab") returned 1
	[0037.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccLR.cab") returned 1
	[0037.304] lstrcmpiA (lpString1="", lpString2="AccLR.cab") returned -1
	[0037.304] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="AccessMUI.xml"
	[0037.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\"
	[0037.304] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned=""
	[0037.304] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt"
	[0037.304] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020
	[0037.304] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab"
	[0037.304] FindNextFileA (in: hFindFile=0x8b9340, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.304] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.304] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="branding.xml") returned 1
	[0037.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1
	[0037.304] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1
	[0037.304] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="AccLR.cab"
	[0037.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\"
	[0037.304] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned=""
	[0037.304] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt"
	[0037.304] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020
	[0037.304] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml"
	[0037.305] FindNextFileA (in: hFindFile=0x8b9340, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0037.305] FindClose (in: hFindFile=0x8b9340 | out: hFindFile=0x8b9340) returned 1
	[0037.305] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.305] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.305] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUISet.msi") returned 1
	[0037.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.msi") returned 1
	[0037.305] lstrcmpiA (lpString1="", lpString2="AccessMUISet.msi") returned -1
	[0037.305] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\"
	[0037.305] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.305] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.305] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.305] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.306] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.306] CloseHandle (hObject=0x88) returned 1
	[0037.307] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi"
	[0037.307] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.307] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.307] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUISet.xml") returned 1
	[0037.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.xml") returned 1
	[0037.307] lstrcmpiA (lpString1="", lpString2="AccessMUISet.xml") returned -1
	[0037.307] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="AccessMUISet.msi"
	[0037.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\"
	[0037.307] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.307] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.307] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.307] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml"
	[0037.307] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.307] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.307] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.307] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.307] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="AccessMUISet.xml"
	[0037.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\"
	[0037.307] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned=""
	[0037.307] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.307] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.307] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.307] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.307] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.307] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.307] lstrcmpA (lpString1=".", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1
	[0037.307] lstrcmpA (lpString1="..", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1
	[0037.308] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.308] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C"
	[0037.308] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.328] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.328] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.328] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.328] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.328] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.328] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.328] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.msi") returned -1
	[0037.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.msi") returned -1
	[0037.328] lstrcmpiA (lpString1="", lpString2="Office32WW.msi") returned -1
	[0037.328] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.328] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.328] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.328] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.328] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.329] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.329] CloseHandle (hObject=0x88) returned 1
	[0037.330] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi"
	[0037.330] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.330] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.330] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.xml") returned -1
	[0037.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.xml") returned -1
	[0037.330] lstrcmpiA (lpString1="", lpString2="Office32WW.xml") returned -1
	[0037.330] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi"
	[0037.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.330] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.330] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.330] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.330] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml"
	[0037.330] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.330] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.330] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ose.exe") returned -1
	[0037.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1
	[0037.330] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1
	[0037.330] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml"
	[0037.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.330] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.330] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.330] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.330] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.330] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.330] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.331] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe."
	[0037.331] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.Boom") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.Boom"
	[0037.331] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.331] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a968
	[0037.331] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf885a000, dwHighDateTime=0x1cac4d7), lpLastAccessTime=0x407536*(dwLowDateTime=0xf885a000, dwHighDateTime=0x1cac4d7), lpLastWriteTime=0x40753e*(dwLowDateTime=0x17c42c30, dwHighDateTime=0x1d301bf)) returned 1
	[0037.331] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.331] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2a945, lpOverlapped=0x0) returned 1
	[0037.342] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe"
	[0037.342] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.342] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2a945, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2a945, lpOverlapped=0x0) returned 1
	[0037.343] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.343] CloseHandle (hObject=0x88) returned 1
	[0037.344] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.Boom" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.boom")) returned 1
	[0037.345] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.345] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osetup.dll") returned -1
	[0037.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1
	[0037.345] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1
	[0037.345] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe"
	[0037.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.345] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.345] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.345] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.345] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll"
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.zip") returned 0
	[0037.345] lstrlenA (lpString="*.zip") returned 5
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.rar") returned 0
	[0037.345] lstrlenA (lpString="*.rar") returned 5
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.7z") returned 0
	[0037.345] lstrlenA (lpString="*.7z") returned 4
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.tar") returned 0
	[0037.345] lstrlenA (lpString="*.tar") returned 5
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gzip") returned 0
	[0037.345] lstrlenA (lpString="*.gzip") returned 6
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpg") returned 0
	[0037.345] lstrlenA (lpString="*.jpg") returned 5
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpeg") returned 0
	[0037.345] lstrlenA (lpString="*.jpeg") returned 6
	[0037.345] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.psd") returned 0
	[0037.345] lstrlenA (lpString="*.psd") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.cdr") returned 0
	[0037.346] lstrlenA (lpString="*.cdr") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.dwg") returned 0
	[0037.346] lstrlenA (lpString="*.dwg") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.max") returned 0
	[0037.346] lstrlenA (lpString="*.max") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.bmp") returned 0
	[0037.346] lstrlenA (lpString="*.bmp") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gif") returned 0
	[0037.346] lstrlenA (lpString="*.gif") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.png") returned 0
	[0037.346] lstrlenA (lpString="*.png") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.doc") returned 0
	[0037.346] lstrlenA (lpString="*.doc") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.docx") returned 0
	[0037.346] lstrlenA (lpString="*.docx") returned 6
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xls") returned 0
	[0037.346] lstrlenA (lpString="*.xls") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xlsx") returned 0
	[0037.346] lstrlenA (lpString="*.xlsx") returned 6
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ppt") returned 0
	[0037.346] lstrlenA (lpString="*.ppt") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pptx") returned 0
	[0037.346] lstrlenA (lpString="*.pptx") returned 6
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.txt") returned 0
	[0037.346] lstrlenA (lpString="*.txt") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pdf") returned 0
	[0037.346] lstrlenA (lpString="*.pdf") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.djvu") returned 0
	[0037.346] lstrlenA (lpString="*.djvu") returned 6
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.htm") returned 0
	[0037.346] lstrlenA (lpString="*.htm") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.html") returned 0
	[0037.346] lstrlenA (lpString="*.html") returned 6
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mdb") returned 0
	[0037.346] lstrlenA (lpString="*.mdb") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.cer") returned 0
	[0037.346] lstrlenA (lpString="*.cer") returned 5
	[0037.346] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.p12") returned 0
	[0037.347] lstrlenA (lpString="*.p12") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pfx") returned 0
	[0037.347] lstrlenA (lpString="*.pfx") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.kwm") returned 0
	[0037.347] lstrlenA (lpString="*.kwm") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pwm") returned 0
	[0037.347] lstrlenA (lpString="*.pwm") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.1cd") returned 0
	[0037.347] lstrlenA (lpString="*.1cd") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.md") returned 0
	[0037.347] lstrlenA (lpString="*.md") returned 4
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mdf") returned 0
	[0037.347] lstrlenA (lpString="*.mdf") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.dbf") returned 0
	[0037.347] lstrlenA (lpString="*.dbf") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.odt") returned 0
	[0037.347] lstrlenA (lpString="*.odt") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.vob") returned 0
	[0037.347] lstrlenA (lpString="*.vob") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ifo") returned 0
	[0037.347] lstrlenA (lpString="*.ifo") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.lnk") returned 0
	[0037.347] lstrlenA (lpString="*.lnk") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.torrent") returned 0
	[0037.347] lstrlenA (lpString="*.torrent") returned 9
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mov") returned 0
	[0037.347] lstrlenA (lpString="*.mov") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.m2v") returned 0
	[0037.347] lstrlenA (lpString="*.m2v") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.3gp") returned 0
	[0037.347] lstrlenA (lpString="*.3gp") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpeg") returned 0
	[0037.347] lstrlenA (lpString="*.mpeg") returned 6
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpg") returned 0
	[0037.347] lstrlenA (lpString="*.mpg") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flv") returned 0
	[0037.347] lstrlenA (lpString="*.flv") returned 5
	[0037.347] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.avi") returned 0
	[0037.347] lstrlenA (lpString="*.avi") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp4") returned 0
	[0037.348] lstrlenA (lpString="*.mp4") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wmv") returned 0
	[0037.348] lstrlenA (lpString="*.wmv") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.divx") returned 0
	[0037.348] lstrlenA (lpString="*.divx") returned 6
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mkv") returned 0
	[0037.348] lstrlenA (lpString="*.mkv") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp3") returned 0
	[0037.348] lstrlenA (lpString="*.mp3") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wav") returned 0
	[0037.348] lstrlenA (lpString="*.wav") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flac") returned 0
	[0037.348] lstrlenA (lpString="*.flac") returned 6
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ape") returned 0
	[0037.348] lstrlenA (lpString="*.ape") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wma") returned 0
	[0037.348] lstrlenA (lpString="*.wma") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ac3") returned 0
	[0037.348] lstrlenA (lpString="*.ac3") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.exe") returned 0
	[0037.348] lstrlenA (lpString="*.exe") returned 5
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.apk") returned 0
	[0037.348] lstrlenA (lpString="*.apk") returned 5
	[0037.348] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.348] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.348] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OWOW32WW.cab") returned -1
	[0037.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32WW.cab") returned -1
	[0037.348] lstrcmpiA (lpString1="", lpString2="OWOW32WW.cab") returned -1
	[0037.348] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll"
	[0037.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.348] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.348] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.348] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.348] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab"
	[0037.348] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.zip") returned 0
	[0037.348] lstrlenA (lpString="*.zip") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.rar") returned 0
	[0037.349] lstrlenA (lpString="*.rar") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.7z") returned 0
	[0037.349] lstrlenA (lpString="*.7z") returned 4
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.tar") returned 0
	[0037.349] lstrlenA (lpString="*.tar") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gzip") returned 0
	[0037.349] lstrlenA (lpString="*.gzip") returned 6
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpg") returned 0
	[0037.349] lstrlenA (lpString="*.jpg") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpeg") returned 0
	[0037.349] lstrlenA (lpString="*.jpeg") returned 6
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.psd") returned 0
	[0037.349] lstrlenA (lpString="*.psd") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.cdr") returned 0
	[0037.349] lstrlenA (lpString="*.cdr") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.dwg") returned 0
	[0037.349] lstrlenA (lpString="*.dwg") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.max") returned 0
	[0037.349] lstrlenA (lpString="*.max") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.bmp") returned 0
	[0037.349] lstrlenA (lpString="*.bmp") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gif") returned 0
	[0037.349] lstrlenA (lpString="*.gif") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.png") returned 0
	[0037.349] lstrlenA (lpString="*.png") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.doc") returned 0
	[0037.349] lstrlenA (lpString="*.doc") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.docx") returned 0
	[0037.349] lstrlenA (lpString="*.docx") returned 6
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xls") returned 0
	[0037.349] lstrlenA (lpString="*.xls") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xlsx") returned 0
	[0037.349] lstrlenA (lpString="*.xlsx") returned 6
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ppt") returned 0
	[0037.349] lstrlenA (lpString="*.ppt") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pptx") returned 0
	[0037.349] lstrlenA (lpString="*.pptx") returned 6
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.txt") returned 0
	[0037.349] lstrlenA (lpString="*.txt") returned 5
	[0037.349] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pdf") returned 0
	[0037.349] lstrlenA (lpString="*.pdf") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.djvu") returned 0
	[0037.350] lstrlenA (lpString="*.djvu") returned 6
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.htm") returned 0
	[0037.350] lstrlenA (lpString="*.htm") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.html") returned 0
	[0037.350] lstrlenA (lpString="*.html") returned 6
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mdb") returned 0
	[0037.350] lstrlenA (lpString="*.mdb") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.cer") returned 0
	[0037.350] lstrlenA (lpString="*.cer") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.p12") returned 0
	[0037.350] lstrlenA (lpString="*.p12") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pfx") returned 0
	[0037.350] lstrlenA (lpString="*.pfx") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.kwm") returned 0
	[0037.350] lstrlenA (lpString="*.kwm") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pwm") returned 0
	[0037.350] lstrlenA (lpString="*.pwm") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.1cd") returned 0
	[0037.350] lstrlenA (lpString="*.1cd") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.md") returned 0
	[0037.350] lstrlenA (lpString="*.md") returned 4
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mdf") returned 0
	[0037.350] lstrlenA (lpString="*.mdf") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.dbf") returned 0
	[0037.350] lstrlenA (lpString="*.dbf") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.odt") returned 0
	[0037.350] lstrlenA (lpString="*.odt") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.vob") returned 0
	[0037.350] lstrlenA (lpString="*.vob") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ifo") returned 0
	[0037.350] lstrlenA (lpString="*.ifo") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.lnk") returned 0
	[0037.350] lstrlenA (lpString="*.lnk") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.torrent") returned 0
	[0037.350] lstrlenA (lpString="*.torrent") returned 9
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mov") returned 0
	[0037.350] lstrlenA (lpString="*.mov") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.m2v") returned 0
	[0037.350] lstrlenA (lpString="*.m2v") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.3gp") returned 0
	[0037.350] lstrlenA (lpString="*.3gp") returned 5
	[0037.350] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpeg") returned 0
	[0037.350] lstrlenA (lpString="*.mpeg") returned 6
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpg") returned 0
	[0037.351] lstrlenA (lpString="*.mpg") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flv") returned 0
	[0037.351] lstrlenA (lpString="*.flv") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.avi") returned 0
	[0037.351] lstrlenA (lpString="*.avi") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp4") returned 0
	[0037.351] lstrlenA (lpString="*.mp4") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wmv") returned 0
	[0037.351] lstrlenA (lpString="*.wmv") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.divx") returned 0
	[0037.351] lstrlenA (lpString="*.divx") returned 6
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mkv") returned 0
	[0037.351] lstrlenA (lpString="*.mkv") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp3") returned 0
	[0037.351] lstrlenA (lpString="*.mp3") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wav") returned 0
	[0037.351] lstrlenA (lpString="*.wav") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flac") returned 0
	[0037.351] lstrlenA (lpString="*.flac") returned 6
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ape") returned 0
	[0037.351] lstrlenA (lpString="*.ape") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wma") returned 0
	[0037.351] lstrlenA (lpString="*.wma") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ac3") returned 0
	[0037.351] lstrlenA (lpString="*.ac3") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.exe") returned 0
	[0037.351] lstrlenA (lpString="*.exe") returned 5
	[0037.351] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.apk") returned 0
	[0037.351] lstrlenA (lpString="*.apk") returned 5
	[0037.351] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.351] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.351] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PidGenX.dll") returned -1
	[0037.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1
	[0037.351] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1
	[0037.351] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab"
	[0037.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.351] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.351] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.351] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.351] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll"
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.zip") returned 0
	[0037.352] lstrlenA (lpString="*.zip") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.rar") returned 0
	[0037.352] lstrlenA (lpString="*.rar") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.7z") returned 0
	[0037.352] lstrlenA (lpString="*.7z") returned 4
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.tar") returned 0
	[0037.352] lstrlenA (lpString="*.tar") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gzip") returned 0
	[0037.352] lstrlenA (lpString="*.gzip") returned 6
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpg") returned 0
	[0037.352] lstrlenA (lpString="*.jpg") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpeg") returned 0
	[0037.352] lstrlenA (lpString="*.jpeg") returned 6
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.psd") returned 0
	[0037.352] lstrlenA (lpString="*.psd") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.cdr") returned 0
	[0037.352] lstrlenA (lpString="*.cdr") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.dwg") returned 0
	[0037.352] lstrlenA (lpString="*.dwg") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.max") returned 0
	[0037.352] lstrlenA (lpString="*.max") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.bmp") returned 0
	[0037.352] lstrlenA (lpString="*.bmp") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gif") returned 0
	[0037.352] lstrlenA (lpString="*.gif") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.png") returned 0
	[0037.352] lstrlenA (lpString="*.png") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.doc") returned 0
	[0037.352] lstrlenA (lpString="*.doc") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.docx") returned 0
	[0037.352] lstrlenA (lpString="*.docx") returned 6
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xls") returned 0
	[0037.352] lstrlenA (lpString="*.xls") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xlsx") returned 0
	[0037.352] lstrlenA (lpString="*.xlsx") returned 6
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ppt") returned 0
	[0037.352] lstrlenA (lpString="*.ppt") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pptx") returned 0
	[0037.352] lstrlenA (lpString="*.pptx") returned 6
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.txt") returned 0
	[0037.352] lstrlenA (lpString="*.txt") returned 5
	[0037.352] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pdf") returned 0
	[0037.352] lstrlenA (lpString="*.pdf") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.djvu") returned 0
	[0037.353] lstrlenA (lpString="*.djvu") returned 6
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.htm") returned 0
	[0037.353] lstrlenA (lpString="*.htm") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.html") returned 0
	[0037.353] lstrlenA (lpString="*.html") returned 6
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mdb") returned 0
	[0037.353] lstrlenA (lpString="*.mdb") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.cer") returned 0
	[0037.353] lstrlenA (lpString="*.cer") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.p12") returned 0
	[0037.353] lstrlenA (lpString="*.p12") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pfx") returned 0
	[0037.353] lstrlenA (lpString="*.pfx") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.kwm") returned 0
	[0037.353] lstrlenA (lpString="*.kwm") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pwm") returned 0
	[0037.353] lstrlenA (lpString="*.pwm") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.1cd") returned 0
	[0037.353] lstrlenA (lpString="*.1cd") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.md") returned 0
	[0037.353] lstrlenA (lpString="*.md") returned 4
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mdf") returned 0
	[0037.353] lstrlenA (lpString="*.mdf") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.dbf") returned 0
	[0037.353] lstrlenA (lpString="*.dbf") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.odt") returned 0
	[0037.353] lstrlenA (lpString="*.odt") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.vob") returned 0
	[0037.353] lstrlenA (lpString="*.vob") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ifo") returned 0
	[0037.353] lstrlenA (lpString="*.ifo") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.lnk") returned 0
	[0037.353] lstrlenA (lpString="*.lnk") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.torrent") returned 0
	[0037.353] lstrlenA (lpString="*.torrent") returned 9
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mov") returned 0
	[0037.353] lstrlenA (lpString="*.mov") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.m2v") returned 0
	[0037.353] lstrlenA (lpString="*.m2v") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.3gp") returned 0
	[0037.353] lstrlenA (lpString="*.3gp") returned 5
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpeg") returned 0
	[0037.353] lstrlenA (lpString="*.mpeg") returned 6
	[0037.353] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpg") returned 0
	[0037.354] lstrlenA (lpString="*.mpg") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flv") returned 0
	[0037.354] lstrlenA (lpString="*.flv") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.avi") returned 0
	[0037.354] lstrlenA (lpString="*.avi") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp4") returned 0
	[0037.354] lstrlenA (lpString="*.mp4") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wmv") returned 0
	[0037.354] lstrlenA (lpString="*.wmv") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.divx") returned 0
	[0037.354] lstrlenA (lpString="*.divx") returned 6
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mkv") returned 0
	[0037.354] lstrlenA (lpString="*.mkv") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp3") returned 0
	[0037.354] lstrlenA (lpString="*.mp3") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wav") returned 0
	[0037.354] lstrlenA (lpString="*.wav") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flac") returned 0
	[0037.354] lstrlenA (lpString="*.flac") returned 6
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ape") returned 0
	[0037.354] lstrlenA (lpString="*.ape") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wma") returned 0
	[0037.354] lstrlenA (lpString="*.wma") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ac3") returned 0
	[0037.354] lstrlenA (lpString="*.ac3") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.exe") returned 0
	[0037.354] lstrlenA (lpString="*.exe") returned 5
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.apk") returned 0
	[0037.354] lstrlenA (lpString="*.apk") returned 5
	[0037.354] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.354] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.354] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.354] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.354] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll"
	[0037.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.354] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.354] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.354] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.354] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms"
	[0037.354] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.zip") returned 0
	[0037.354] lstrlenA (lpString="*.zip") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.rar") returned 0
	[0037.355] lstrlenA (lpString="*.rar") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.7z") returned 0
	[0037.355] lstrlenA (lpString="*.7z") returned 4
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.tar") returned 0
	[0037.355] lstrlenA (lpString="*.tar") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gzip") returned 0
	[0037.355] lstrlenA (lpString="*.gzip") returned 6
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpg") returned 0
	[0037.355] lstrlenA (lpString="*.jpg") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpeg") returned 0
	[0037.355] lstrlenA (lpString="*.jpeg") returned 6
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.psd") returned 0
	[0037.355] lstrlenA (lpString="*.psd") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.cdr") returned 0
	[0037.355] lstrlenA (lpString="*.cdr") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.dwg") returned 0
	[0037.355] lstrlenA (lpString="*.dwg") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.max") returned 0
	[0037.355] lstrlenA (lpString="*.max") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.bmp") returned 0
	[0037.355] lstrlenA (lpString="*.bmp") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gif") returned 0
	[0037.355] lstrlenA (lpString="*.gif") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.png") returned 0
	[0037.355] lstrlenA (lpString="*.png") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.doc") returned 0
	[0037.355] lstrlenA (lpString="*.doc") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.docx") returned 0
	[0037.355] lstrlenA (lpString="*.docx") returned 6
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xls") returned 0
	[0037.355] lstrlenA (lpString="*.xls") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xlsx") returned 0
	[0037.355] lstrlenA (lpString="*.xlsx") returned 6
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ppt") returned 0
	[0037.355] lstrlenA (lpString="*.ppt") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pptx") returned 0
	[0037.355] lstrlenA (lpString="*.pptx") returned 6
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.txt") returned 0
	[0037.355] lstrlenA (lpString="*.txt") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pdf") returned 0
	[0037.355] lstrlenA (lpString="*.pdf") returned 5
	[0037.355] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.djvu") returned 0
	[0037.355] lstrlenA (lpString="*.djvu") returned 6
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.htm") returned 0
	[0037.356] lstrlenA (lpString="*.htm") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.html") returned 0
	[0037.356] lstrlenA (lpString="*.html") returned 6
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mdb") returned 0
	[0037.356] lstrlenA (lpString="*.mdb") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.cer") returned 0
	[0037.356] lstrlenA (lpString="*.cer") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.p12") returned 0
	[0037.356] lstrlenA (lpString="*.p12") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pfx") returned 0
	[0037.356] lstrlenA (lpString="*.pfx") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.kwm") returned 0
	[0037.356] lstrlenA (lpString="*.kwm") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pwm") returned 0
	[0037.356] lstrlenA (lpString="*.pwm") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.1cd") returned 0
	[0037.356] lstrlenA (lpString="*.1cd") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.md") returned 0
	[0037.356] lstrlenA (lpString="*.md") returned 4
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mdf") returned 0
	[0037.356] lstrlenA (lpString="*.mdf") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.dbf") returned 0
	[0037.356] lstrlenA (lpString="*.dbf") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.odt") returned 0
	[0037.356] lstrlenA (lpString="*.odt") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.vob") returned 0
	[0037.356] lstrlenA (lpString="*.vob") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ifo") returned 0
	[0037.356] lstrlenA (lpString="*.ifo") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.lnk") returned 0
	[0037.356] lstrlenA (lpString="*.lnk") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.torrent") returned 0
	[0037.356] lstrlenA (lpString="*.torrent") returned 9
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mov") returned 0
	[0037.356] lstrlenA (lpString="*.mov") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.m2v") returned 0
	[0037.356] lstrlenA (lpString="*.m2v") returned 5
	[0037.356] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.3gp") returned 0
	[0037.357] lstrlenA (lpString="*.3gp") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpeg") returned 0
	[0037.357] lstrlenA (lpString="*.mpeg") returned 6
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpg") returned 0
	[0037.357] lstrlenA (lpString="*.mpg") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flv") returned 0
	[0037.357] lstrlenA (lpString="*.flv") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.avi") returned 0
	[0037.357] lstrlenA (lpString="*.avi") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp4") returned 0
	[0037.357] lstrlenA (lpString="*.mp4") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wmv") returned 0
	[0037.357] lstrlenA (lpString="*.wmv") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.divx") returned 0
	[0037.357] lstrlenA (lpString="*.divx") returned 6
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mkv") returned 0
	[0037.357] lstrlenA (lpString="*.mkv") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp3") returned 0
	[0037.357] lstrlenA (lpString="*.mp3") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wav") returned 0
	[0037.357] lstrlenA (lpString="*.wav") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flac") returned 0
	[0037.357] lstrlenA (lpString="*.flac") returned 6
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ape") returned 0
	[0037.357] lstrlenA (lpString="*.ape") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wma") returned 0
	[0037.357] lstrlenA (lpString="*.wma") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ac3") returned 0
	[0037.357] lstrlenA (lpString="*.ac3") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.exe") returned 0
	[0037.357] lstrlenA (lpString="*.exe") returned 5
	[0037.357] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.apk") returned 0
	[0037.357] lstrlenA (lpString="*.apk") returned 5
	[0037.357] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.357] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.357] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProPlusrWW.msi") returned -1
	[0037.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPlusrWW.msi") returned -1
	[0037.357] lstrcmpiA (lpString1="", lpString2="ProPlusrWW.msi") returned -1
	[0037.357] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms"
	[0037.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.358] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.358] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.358] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.358] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi"
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.zip") returned 0
	[0037.358] lstrlenA (lpString="*.zip") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.rar") returned 0
	[0037.358] lstrlenA (lpString="*.rar") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.7z") returned 0
	[0037.358] lstrlenA (lpString="*.7z") returned 4
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.tar") returned 0
	[0037.358] lstrlenA (lpString="*.tar") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.gzip") returned 0
	[0037.358] lstrlenA (lpString="*.gzip") returned 6
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.jpg") returned 0
	[0037.358] lstrlenA (lpString="*.jpg") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.jpeg") returned 0
	[0037.358] lstrlenA (lpString="*.jpeg") returned 6
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.psd") returned 0
	[0037.358] lstrlenA (lpString="*.psd") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.cdr") returned 0
	[0037.358] lstrlenA (lpString="*.cdr") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.dwg") returned 0
	[0037.358] lstrlenA (lpString="*.dwg") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.max") returned 0
	[0037.358] lstrlenA (lpString="*.max") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.bmp") returned 0
	[0037.358] lstrlenA (lpString="*.bmp") returned 5
	[0037.358] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.gif") returned 0
	[0037.358] lstrlenA (lpString="*.gif") returned 5
	[0037.359] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.359] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.359] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProPlusrWW.xml") returned -1
	[0037.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPlusrWW.xml") returned -1
	[0037.359] lstrcmpiA (lpString1="", lpString2="ProPlusrWW.xml") returned -1
	[0037.359] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="ProPlusrWW.msi"
	[0037.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.359] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.359] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.359] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.359] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml"
	[0037.359] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.359] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.359] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProPrWW.cab") returned -1
	[0037.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPrWW.cab") returned -1
	[0037.359] lstrcmpiA (lpString1="", lpString2="ProPrWW.cab") returned -1
	[0037.359] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="ProPlusrWW.xml"
	[0037.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.359] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.359] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.359] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.359] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab"
	[0037.359] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.359] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.359] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProPrWW2.cab") returned -1
	[0037.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPrWW2.cab") returned -1
	[0037.359] lstrcmpiA (lpString1="", lpString2="ProPrWW2.cab") returned -1
	[0037.359] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="ProPrWW.cab"
	[0037.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.360] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.360] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.360] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.360] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW2.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab"
	[0037.360] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.360] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.360] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="setup.exe") returned -1
	[0037.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1
	[0037.360] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1
	[0037.360] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="ProPrWW2.cab"
	[0037.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.360] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.360] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.360] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.360] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.360] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.360] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.360] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe."
	[0037.360] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.Boom") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.Boom"
	[0037.360] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.361] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150578
	[0037.361] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbec13c00, dwHighDateTime=0x1cac15b), lpLastAccessTime=0x407536*(dwLowDateTime=0xbec13c00, dwHighDateTime=0x1cac15b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1682d290, dwHighDateTime=0x1d301bf)) returned 1
	[0037.361] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.361] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x150555, lpOverlapped=0x0) returned 1
	[0037.404] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe"
	[0037.408] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.408] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x150555, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x150555, lpOverlapped=0x0) returned 1
	[0037.413] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.413] CloseHandle (hObject=0x88) returned 1
	[0037.428] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.Boom" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.boom")) returned 1
	[0037.428] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.428] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe"
	[0037.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\"
	[0037.428] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.428] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0
	[0037.429] lstrlenA (lpString="*.zip") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0
	[0037.429] lstrlenA (lpString="*.rar") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0
	[0037.429] lstrlenA (lpString="*.7z") returned 4
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0
	[0037.429] lstrlenA (lpString="*.tar") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0
	[0037.429] lstrlenA (lpString="*.gzip") returned 6
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0
	[0037.429] lstrlenA (lpString="*.jpg") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0
	[0037.429] lstrlenA (lpString="*.jpeg") returned 6
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0
	[0037.429] lstrlenA (lpString="*.psd") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0
	[0037.429] lstrlenA (lpString="*.cdr") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0
	[0037.429] lstrlenA (lpString="*.dwg") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0
	[0037.429] lstrlenA (lpString="*.max") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0
	[0037.429] lstrlenA (lpString="*.bmp") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0
	[0037.429] lstrlenA (lpString="*.gif") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0
	[0037.429] lstrlenA (lpString="*.png") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0
	[0037.429] lstrlenA (lpString="*.doc") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0
	[0037.429] lstrlenA (lpString="*.docx") returned 6
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0
	[0037.429] lstrlenA (lpString="*.xls") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0
	[0037.429] lstrlenA (lpString="*.xlsx") returned 6
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0
	[0037.429] lstrlenA (lpString="*.ppt") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0
	[0037.429] lstrlenA (lpString="*.pptx") returned 6
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0
	[0037.429] lstrlenA (lpString="*.txt") returned 5
	[0037.429] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0
	[0037.430] lstrlenA (lpString="*.pdf") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0
	[0037.430] lstrlenA (lpString="*.djvu") returned 6
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0
	[0037.430] lstrlenA (lpString="*.htm") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0
	[0037.430] lstrlenA (lpString="*.html") returned 6
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0
	[0037.430] lstrlenA (lpString="*.mdb") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0
	[0037.430] lstrlenA (lpString="*.cer") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0
	[0037.430] lstrlenA (lpString="*.p12") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0
	[0037.430] lstrlenA (lpString="*.pfx") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0
	[0037.430] lstrlenA (lpString="*.kwm") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0
	[0037.430] lstrlenA (lpString="*.pwm") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0
	[0037.430] lstrlenA (lpString="*.1cd") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0
	[0037.430] lstrlenA (lpString="*.md") returned 4
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0
	[0037.430] lstrlenA (lpString="*.mdf") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0
	[0037.430] lstrlenA (lpString="*.dbf") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0
	[0037.430] lstrlenA (lpString="*.odt") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0
	[0037.430] lstrlenA (lpString="*.vob") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0
	[0037.430] lstrlenA (lpString="*.ifo") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0
	[0037.430] lstrlenA (lpString="*.lnk") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0
	[0037.430] lstrlenA (lpString="*.torrent") returned 9
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0
	[0037.430] lstrlenA (lpString="*.mov") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0
	[0037.430] lstrlenA (lpString="*.m2v") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0
	[0037.430] lstrlenA (lpString="*.3gp") returned 5
	[0037.430] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0
	[0037.431] lstrlenA (lpString="*.mpeg") returned 6
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0
	[0037.431] lstrlenA (lpString="*.mpg") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0
	[0037.431] lstrlenA (lpString="*.flv") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0
	[0037.431] lstrlenA (lpString="*.avi") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0
	[0037.431] lstrlenA (lpString="*.mp4") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0
	[0037.431] lstrlenA (lpString="*.wmv") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0
	[0037.431] lstrlenA (lpString="*.divx") returned 6
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0
	[0037.431] lstrlenA (lpString="*.mkv") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0
	[0037.431] lstrlenA (lpString="*.mp3") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0
	[0037.431] lstrlenA (lpString="*.wav") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0
	[0037.431] lstrlenA (lpString="*.flac") returned 6
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0
	[0037.431] lstrlenA (lpString="*.ape") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0
	[0037.431] lstrlenA (lpString="*.wma") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0
	[0037.431] lstrlenA (lpString="*.ac3") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.exe") returned 0
	[0037.431] lstrlenA (lpString="*.exe") returned 5
	[0037.431] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.apk") returned 0
	[0037.431] lstrlenA (lpString="*.apk") returned 5
	[0037.431] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.431] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.431] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.431] lstrcmpA (lpString1=".", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1
	[0037.431] lstrcmpA (lpString1="..", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1
	[0037.431] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.431] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C"
	[0037.431] lstrlenA (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned 62
	[0037.431] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.470] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.470] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.470] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.470] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.470] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.470] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.msi") returned -1
	[0037.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.msi") returned -1
	[0037.470] lstrcmpiA (lpString1="", lpString2="Office32WW.msi") returned -1
	[0037.470] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.470] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.470] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.470] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.470] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.471] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0037.471] WriteFile (in: hFile=0x88, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0037.472] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.472] CloseHandle (hObject=0x88) returned 1
	[0037.472] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi"
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.zip") returned 0
	[0037.472] lstrlenA (lpString="*.zip") returned 5
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.rar") returned 0
	[0037.472] lstrlenA (lpString="*.rar") returned 5
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.7z") returned 0
	[0037.472] lstrlenA (lpString="*.7z") returned 4
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.tar") returned 0
	[0037.472] lstrlenA (lpString="*.tar") returned 5
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.gzip") returned 0
	[0037.472] lstrlenA (lpString="*.gzip") returned 6
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.jpg") returned 0
	[0037.472] lstrlenA (lpString="*.jpg") returned 5
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.jpeg") returned 0
	[0037.472] lstrlenA (lpString="*.jpeg") returned 6
	[0037.472] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.psd") returned 0
	[0037.472] lstrlenA (lpString="*.psd") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.cdr") returned 0
	[0037.473] lstrlenA (lpString="*.cdr") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.dwg") returned 0
	[0037.473] lstrlenA (lpString="*.dwg") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.max") returned 0
	[0037.473] lstrlenA (lpString="*.max") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.bmp") returned 0
	[0037.473] lstrlenA (lpString="*.bmp") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.gif") returned 0
	[0037.473] lstrlenA (lpString="*.gif") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.png") returned 0
	[0037.473] lstrlenA (lpString="*.png") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.doc") returned 0
	[0037.473] lstrlenA (lpString="*.doc") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.docx") returned 0
	[0037.473] lstrlenA (lpString="*.docx") returned 6
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.xls") returned 0
	[0037.473] lstrlenA (lpString="*.xls") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.xlsx") returned 0
	[0037.473] lstrlenA (lpString="*.xlsx") returned 6
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ppt") returned 0
	[0037.473] lstrlenA (lpString="*.ppt") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pptx") returned 0
	[0037.473] lstrlenA (lpString="*.pptx") returned 6
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.txt") returned 0
	[0037.473] lstrlenA (lpString="*.txt") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pdf") returned 0
	[0037.473] lstrlenA (lpString="*.pdf") returned 5
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.djvu") returned 0
	[0037.473] lstrlenA (lpString="*.djvu") returned 6
	[0037.473] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.htm") returned 0
	[0037.473] lstrlenA (lpString="*.htm") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.html") returned 0
	[0037.474] lstrlenA (lpString="*.html") returned 6
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mdb") returned 0
	[0037.474] lstrlenA (lpString="*.mdb") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.cer") returned 0
	[0037.474] lstrlenA (lpString="*.cer") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.p12") returned 0
	[0037.474] lstrlenA (lpString="*.p12") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pfx") returned 0
	[0037.474] lstrlenA (lpString="*.pfx") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.kwm") returned 0
	[0037.474] lstrlenA (lpString="*.kwm") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pwm") returned 0
	[0037.474] lstrlenA (lpString="*.pwm") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.1cd") returned 0
	[0037.474] lstrlenA (lpString="*.1cd") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.md") returned 0
	[0037.474] lstrlenA (lpString="*.md") returned 4
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mdf") returned 0
	[0037.474] lstrlenA (lpString="*.mdf") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.dbf") returned 0
	[0037.474] lstrlenA (lpString="*.dbf") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.odt") returned 0
	[0037.474] lstrlenA (lpString="*.odt") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.vob") returned 0
	[0037.474] lstrlenA (lpString="*.vob") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ifo") returned 0
	[0037.474] lstrlenA (lpString="*.ifo") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.lnk") returned 0
	[0037.474] lstrlenA (lpString="*.lnk") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.torrent") returned 0
	[0037.474] lstrlenA (lpString="*.torrent") returned 9
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mov") returned 0
	[0037.474] lstrlenA (lpString="*.mov") returned 5
	[0037.474] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.m2v") returned 0
	[0037.474] lstrlenA (lpString="*.m2v") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.3gp") returned 0
	[0037.475] lstrlenA (lpString="*.3gp") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mpeg") returned 0
	[0037.475] lstrlenA (lpString="*.mpeg") returned 6
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mpg") returned 0
	[0037.475] lstrlenA (lpString="*.mpg") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.flv") returned 0
	[0037.475] lstrlenA (lpString="*.flv") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.avi") returned 0
	[0037.475] lstrlenA (lpString="*.avi") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mp4") returned 0
	[0037.475] lstrlenA (lpString="*.mp4") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wmv") returned 0
	[0037.475] lstrlenA (lpString="*.wmv") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.divx") returned 0
	[0037.475] lstrlenA (lpString="*.divx") returned 6
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mkv") returned 0
	[0037.475] lstrlenA (lpString="*.mkv") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mp3") returned 0
	[0037.475] lstrlenA (lpString="*.mp3") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wav") returned 0
	[0037.475] lstrlenA (lpString="*.wav") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.flac") returned 0
	[0037.475] lstrlenA (lpString="*.flac") returned 6
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ape") returned 0
	[0037.475] lstrlenA (lpString="*.ape") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wma") returned 0
	[0037.475] lstrlenA (lpString="*.wma") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ac3") returned 0
	[0037.475] lstrlenA (lpString="*.ac3") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.exe") returned 0
	[0037.475] lstrlenA (lpString="*.exe") returned 5
	[0037.475] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.apk") returned 0
	[0037.476] lstrlenA (lpString="*.apk") returned 5
	[0037.476] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.476] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.476] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.xml") returned -1
	[0037.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.xml") returned -1
	[0037.476] lstrcmpiA (lpString1="", lpString2="Office32WW.xml") returned -1
	[0037.476] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi"
	[0037.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.476] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.476] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.476] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.476] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml"
	[0037.476] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.zip") returned 0
	[0037.476] lstrlenA (lpString="*.zip") returned 5
	[0037.476] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.rar") returned 0
	[0037.476] lstrlenA (lpString="*.rar") returned 5
	[0037.476] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.7z") returned 0
	[0037.476] lstrlenA (lpString="*.7z") returned 4
	[0037.476] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.tar") returned 0
	[0037.476] lstrlenA (lpString="*.tar") returned 5
	[0037.476] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.gzip") returned 0
	[0037.476] lstrlenA (lpString="*.gzip") returned 6
	[0037.476] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.jpg") returned 0
	[0037.476] lstrlenA (lpString="*.jpg") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.jpeg") returned 0
	[0037.477] lstrlenA (lpString="*.jpeg") returned 6
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.psd") returned 0
	[0037.477] lstrlenA (lpString="*.psd") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.cdr") returned 0
	[0037.477] lstrlenA (lpString="*.cdr") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.dwg") returned 0
	[0037.477] lstrlenA (lpString="*.dwg") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.max") returned 0
	[0037.477] lstrlenA (lpString="*.max") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.bmp") returned 0
	[0037.477] lstrlenA (lpString="*.bmp") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.gif") returned 0
	[0037.477] lstrlenA (lpString="*.gif") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.png") returned 0
	[0037.477] lstrlenA (lpString="*.png") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.doc") returned 0
	[0037.477] lstrlenA (lpString="*.doc") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.docx") returned 0
	[0037.477] lstrlenA (lpString="*.docx") returned 6
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.xls") returned 0
	[0037.477] lstrlenA (lpString="*.xls") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.xlsx") returned 0
	[0037.477] lstrlenA (lpString="*.xlsx") returned 6
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ppt") returned 0
	[0037.477] lstrlenA (lpString="*.ppt") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pptx") returned 0
	[0037.477] lstrlenA (lpString="*.pptx") returned 6
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.txt") returned 0
	[0037.477] lstrlenA (lpString="*.txt") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pdf") returned 0
	[0037.477] lstrlenA (lpString="*.pdf") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.djvu") returned 0
	[0037.477] lstrlenA (lpString="*.djvu") returned 6
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.htm") returned 0
	[0037.477] lstrlenA (lpString="*.htm") returned 5
	[0037.477] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.html") returned 0
	[0037.478] lstrlenA (lpString="*.html") returned 6
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mdb") returned 0
	[0037.478] lstrlenA (lpString="*.mdb") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.cer") returned 0
	[0037.478] lstrlenA (lpString="*.cer") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.p12") returned 0
	[0037.478] lstrlenA (lpString="*.p12") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pfx") returned 0
	[0037.478] lstrlenA (lpString="*.pfx") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.kwm") returned 0
	[0037.478] lstrlenA (lpString="*.kwm") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pwm") returned 0
	[0037.478] lstrlenA (lpString="*.pwm") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.1cd") returned 0
	[0037.478] lstrlenA (lpString="*.1cd") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.md") returned 0
	[0037.478] lstrlenA (lpString="*.md") returned 4
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mdf") returned 0
	[0037.478] lstrlenA (lpString="*.mdf") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.dbf") returned 0
	[0037.478] lstrlenA (lpString="*.dbf") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.odt") returned 0
	[0037.478] lstrlenA (lpString="*.odt") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.vob") returned 0
	[0037.478] lstrlenA (lpString="*.vob") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ifo") returned 0
	[0037.478] lstrlenA (lpString="*.ifo") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.lnk") returned 0
	[0037.478] lstrlenA (lpString="*.lnk") returned 5
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.torrent") returned 0
	[0037.478] lstrlenA (lpString="*.torrent") returned 9
	[0037.478] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mov") returned 0
	[0037.479] lstrlenA (lpString="*.mov") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.m2v") returned 0
	[0037.479] lstrlenA (lpString="*.m2v") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.3gp") returned 0
	[0037.479] lstrlenA (lpString="*.3gp") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mpeg") returned 0
	[0037.479] lstrlenA (lpString="*.mpeg") returned 6
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mpg") returned 0
	[0037.479] lstrlenA (lpString="*.mpg") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.flv") returned 0
	[0037.479] lstrlenA (lpString="*.flv") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.avi") returned 0
	[0037.479] lstrlenA (lpString="*.avi") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mp4") returned 0
	[0037.479] lstrlenA (lpString="*.mp4") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wmv") returned 0
	[0037.479] lstrlenA (lpString="*.wmv") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.divx") returned 0
	[0037.479] lstrlenA (lpString="*.divx") returned 6
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mkv") returned 0
	[0037.479] lstrlenA (lpString="*.mkv") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mp3") returned 0
	[0037.479] lstrlenA (lpString="*.mp3") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wav") returned 0
	[0037.479] lstrlenA (lpString="*.wav") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.flac") returned 0
	[0037.479] lstrlenA (lpString="*.flac") returned 6
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ape") returned 0
	[0037.479] lstrlenA (lpString="*.ape") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wma") returned 0
	[0037.479] lstrlenA (lpString="*.wma") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ac3") returned 0
	[0037.479] lstrlenA (lpString="*.ac3") returned 5
	[0037.479] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.exe") returned 0
	[0037.480] lstrlenA (lpString="*.exe") returned 5
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.apk") returned 0
	[0037.480] lstrlenA (lpString="*.apk") returned 5
	[0037.480] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.480] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ose.exe") returned -1
	[0037.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1
	[0037.480] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1
	[0037.480] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml"
	[0037.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.480] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.480] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.480] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.480] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.zip") returned 0
	[0037.480] lstrlenA (lpString="*.zip") returned 5
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.rar") returned 0
	[0037.480] lstrlenA (lpString="*.rar") returned 5
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.7z") returned 0
	[0037.480] lstrlenA (lpString="*.7z") returned 4
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.tar") returned 0
	[0037.480] lstrlenA (lpString="*.tar") returned 5
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.gzip") returned 0
	[0037.480] lstrlenA (lpString="*.gzip") returned 6
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.jpg") returned 0
	[0037.480] lstrlenA (lpString="*.jpg") returned 5
	[0037.480] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.jpeg") returned 0
	[0037.481] lstrlenA (lpString="*.jpeg") returned 6
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.psd") returned 0
	[0037.481] lstrlenA (lpString="*.psd") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.cdr") returned 0
	[0037.481] lstrlenA (lpString="*.cdr") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.dwg") returned 0
	[0037.481] lstrlenA (lpString="*.dwg") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.max") returned 0
	[0037.481] lstrlenA (lpString="*.max") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.bmp") returned 0
	[0037.481] lstrlenA (lpString="*.bmp") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.gif") returned 0
	[0037.481] lstrlenA (lpString="*.gif") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.png") returned 0
	[0037.481] lstrlenA (lpString="*.png") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.doc") returned 0
	[0037.481] lstrlenA (lpString="*.doc") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.docx") returned 0
	[0037.481] lstrlenA (lpString="*.docx") returned 6
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.xls") returned 0
	[0037.481] lstrlenA (lpString="*.xls") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.xlsx") returned 0
	[0037.481] lstrlenA (lpString="*.xlsx") returned 6
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ppt") returned 0
	[0037.481] lstrlenA (lpString="*.ppt") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pptx") returned 0
	[0037.481] lstrlenA (lpString="*.pptx") returned 6
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.txt") returned 0
	[0037.481] lstrlenA (lpString="*.txt") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pdf") returned 0
	[0037.481] lstrlenA (lpString="*.pdf") returned 5
	[0037.481] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.djvu") returned 0
	[0037.482] lstrlenA (lpString="*.djvu") returned 6
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.htm") returned 0
	[0037.482] lstrlenA (lpString="*.htm") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.html") returned 0
	[0037.482] lstrlenA (lpString="*.html") returned 6
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mdb") returned 0
	[0037.482] lstrlenA (lpString="*.mdb") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.cer") returned 0
	[0037.482] lstrlenA (lpString="*.cer") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.p12") returned 0
	[0037.482] lstrlenA (lpString="*.p12") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pfx") returned 0
	[0037.482] lstrlenA (lpString="*.pfx") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.kwm") returned 0
	[0037.482] lstrlenA (lpString="*.kwm") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pwm") returned 0
	[0037.482] lstrlenA (lpString="*.pwm") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.1cd") returned 0
	[0037.482] lstrlenA (lpString="*.1cd") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.md") returned 0
	[0037.482] lstrlenA (lpString="*.md") returned 4
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mdf") returned 0
	[0037.482] lstrlenA (lpString="*.mdf") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.dbf") returned 0
	[0037.482] lstrlenA (lpString="*.dbf") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.odt") returned 0
	[0037.482] lstrlenA (lpString="*.odt") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.vob") returned 0
	[0037.482] lstrlenA (lpString="*.vob") returned 5
	[0037.482] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ifo") returned 0
	[0037.482] lstrlenA (lpString="*.ifo") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.lnk") returned 0
	[0037.483] lstrlenA (lpString="*.lnk") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.torrent") returned 0
	[0037.483] lstrlenA (lpString="*.torrent") returned 9
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mov") returned 0
	[0037.483] lstrlenA (lpString="*.mov") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.m2v") returned 0
	[0037.483] lstrlenA (lpString="*.m2v") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.3gp") returned 0
	[0037.483] lstrlenA (lpString="*.3gp") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mpeg") returned 0
	[0037.483] lstrlenA (lpString="*.mpeg") returned 6
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mpg") returned 0
	[0037.483] lstrlenA (lpString="*.mpg") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.flv") returned 0
	[0037.483] lstrlenA (lpString="*.flv") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.avi") returned 0
	[0037.483] lstrlenA (lpString="*.avi") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mp4") returned 0
	[0037.483] lstrlenA (lpString="*.mp4") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wmv") returned 0
	[0037.483] lstrlenA (lpString="*.wmv") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.divx") returned 0
	[0037.483] lstrlenA (lpString="*.divx") returned 6
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mkv") returned 0
	[0037.483] lstrlenA (lpString="*.mkv") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mp3") returned 0
	[0037.483] lstrlenA (lpString="*.mp3") returned 5
	[0037.483] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wav") returned 0
	[0037.483] lstrlenA (lpString="*.wav") returned 5
	[0037.484] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.flac") returned 0
	[0037.484] lstrlenA (lpString="*.flac") returned 6
	[0037.484] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ape") returned 0
	[0037.484] lstrlenA (lpString="*.ape") returned 5
	[0037.484] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wma") returned 0
	[0037.484] lstrlenA (lpString="*.wma") returned 5
	[0037.484] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ac3") returned 0
	[0037.484] lstrlenA (lpString="*.ac3") returned 5
	[0037.484] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.exe") returned 1
	[0037.484] lstrlenA (lpString="*.exe") returned 5
	[0037.484] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.484] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.484] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe."
	[0037.484] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.Boom") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.Boom"
	[0037.484] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.485] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a968
	[0037.485] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfe57f8e0, dwHighDateTime=0x1cbe1cb), lpLastAccessTime=0x407536*(dwLowDateTime=0xfe57f8e0, dwHighDateTime=0x1cbe1cb), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa8bafbc0, dwHighDateTime=0x1d305f1)) returned 1
	[0037.485] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.485] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2a945, lpOverlapped=0x0) returned 1
	[0037.497] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe"
	[0037.497] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.497] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2a945, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2a945, lpOverlapped=0x0) returned 1
	[0037.498] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.499] CloseHandle (hObject=0x88) returned 1
	[0037.500] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.Boom" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.boom")) returned 1
	[0037.509] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.509] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.509] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osetup.dll") returned -1
	[0037.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1
	[0037.510] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1
	[0037.510] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe"
	[0037.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.510] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.510] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.510] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.510] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll"
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.zip") returned 0
	[0037.510] lstrlenA (lpString="*.zip") returned 5
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.rar") returned 0
	[0037.510] lstrlenA (lpString="*.rar") returned 5
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.7z") returned 0
	[0037.510] lstrlenA (lpString="*.7z") returned 4
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.tar") returned 0
	[0037.510] lstrlenA (lpString="*.tar") returned 5
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gzip") returned 0
	[0037.510] lstrlenA (lpString="*.gzip") returned 6
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpg") returned 0
	[0037.510] lstrlenA (lpString="*.jpg") returned 5
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpeg") returned 0
	[0037.510] lstrlenA (lpString="*.jpeg") returned 6
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.psd") returned 0
	[0037.510] lstrlenA (lpString="*.psd") returned 5
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.cdr") returned 0
	[0037.510] lstrlenA (lpString="*.cdr") returned 5
	[0037.510] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.dwg") returned 0
	[0037.511] lstrlenA (lpString="*.dwg") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.max") returned 0
	[0037.511] lstrlenA (lpString="*.max") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.bmp") returned 0
	[0037.511] lstrlenA (lpString="*.bmp") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gif") returned 0
	[0037.511] lstrlenA (lpString="*.gif") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.png") returned 0
	[0037.511] lstrlenA (lpString="*.png") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.doc") returned 0
	[0037.511] lstrlenA (lpString="*.doc") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.docx") returned 0
	[0037.511] lstrlenA (lpString="*.docx") returned 6
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xls") returned 0
	[0037.511] lstrlenA (lpString="*.xls") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xlsx") returned 0
	[0037.511] lstrlenA (lpString="*.xlsx") returned 6
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ppt") returned 0
	[0037.511] lstrlenA (lpString="*.ppt") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pptx") returned 0
	[0037.511] lstrlenA (lpString="*.pptx") returned 6
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.txt") returned 0
	[0037.511] lstrlenA (lpString="*.txt") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pdf") returned 0
	[0037.511] lstrlenA (lpString="*.pdf") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.djvu") returned 0
	[0037.511] lstrlenA (lpString="*.djvu") returned 6
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.htm") returned 0
	[0037.511] lstrlenA (lpString="*.htm") returned 5
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.html") returned 0
	[0037.511] lstrlenA (lpString="*.html") returned 6
	[0037.511] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mdb") returned 0
	[0037.511] lstrlenA (lpString="*.mdb") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.cer") returned 0
	[0037.512] lstrlenA (lpString="*.cer") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.p12") returned 0
	[0037.512] lstrlenA (lpString="*.p12") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pfx") returned 0
	[0037.512] lstrlenA (lpString="*.pfx") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.kwm") returned 0
	[0037.512] lstrlenA (lpString="*.kwm") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pwm") returned 0
	[0037.512] lstrlenA (lpString="*.pwm") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.1cd") returned 0
	[0037.512] lstrlenA (lpString="*.1cd") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.md") returned 0
	[0037.512] lstrlenA (lpString="*.md") returned 4
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mdf") returned 0
	[0037.512] lstrlenA (lpString="*.mdf") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.dbf") returned 0
	[0037.512] lstrlenA (lpString="*.dbf") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.odt") returned 0
	[0037.512] lstrlenA (lpString="*.odt") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.vob") returned 0
	[0037.512] lstrlenA (lpString="*.vob") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ifo") returned 0
	[0037.512] lstrlenA (lpString="*.ifo") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.lnk") returned 0
	[0037.512] lstrlenA (lpString="*.lnk") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.torrent") returned 0
	[0037.512] lstrlenA (lpString="*.torrent") returned 9
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mov") returned 0
	[0037.512] lstrlenA (lpString="*.mov") returned 5
	[0037.512] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.m2v") returned 0
	[0037.513] lstrlenA (lpString="*.m2v") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.3gp") returned 0
	[0037.513] lstrlenA (lpString="*.3gp") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpeg") returned 0
	[0037.513] lstrlenA (lpString="*.mpeg") returned 6
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpg") returned 0
	[0037.513] lstrlenA (lpString="*.mpg") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flv") returned 0
	[0037.513] lstrlenA (lpString="*.flv") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.avi") returned 0
	[0037.513] lstrlenA (lpString="*.avi") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp4") returned 0
	[0037.513] lstrlenA (lpString="*.mp4") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wmv") returned 0
	[0037.513] lstrlenA (lpString="*.wmv") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.divx") returned 0
	[0037.513] lstrlenA (lpString="*.divx") returned 6
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mkv") returned 0
	[0037.513] lstrlenA (lpString="*.mkv") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp3") returned 0
	[0037.513] lstrlenA (lpString="*.mp3") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wav") returned 0
	[0037.513] lstrlenA (lpString="*.wav") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flac") returned 0
	[0037.513] lstrlenA (lpString="*.flac") returned 6
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ape") returned 0
	[0037.513] lstrlenA (lpString="*.ape") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wma") returned 0
	[0037.513] lstrlenA (lpString="*.wma") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ac3") returned 0
	[0037.513] lstrlenA (lpString="*.ac3") returned 5
	[0037.513] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.exe") returned 0
	[0037.513] lstrlenA (lpString="*.exe") returned 5
	[0037.514] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.apk") returned 0
	[0037.514] lstrlenA (lpString="*.apk") returned 5
	[0037.514] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.514] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.514] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OWOW32WW.cab") returned -1
	[0037.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32WW.cab") returned -1
	[0037.514] lstrcmpiA (lpString1="", lpString2="OWOW32WW.cab") returned -1
	[0037.514] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll"
	[0037.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.514] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.514] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.514] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.514] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab"
	[0037.514] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.zip") returned 0
	[0037.515] lstrlenA (lpString="*.zip") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.rar") returned 0
	[0037.515] lstrlenA (lpString="*.rar") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.7z") returned 0
	[0037.515] lstrlenA (lpString="*.7z") returned 4
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.tar") returned 0
	[0037.515] lstrlenA (lpString="*.tar") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gzip") returned 0
	[0037.515] lstrlenA (lpString="*.gzip") returned 6
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpg") returned 0
	[0037.515] lstrlenA (lpString="*.jpg") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpeg") returned 0
	[0037.515] lstrlenA (lpString="*.jpeg") returned 6
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.psd") returned 0
	[0037.515] lstrlenA (lpString="*.psd") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.cdr") returned 0
	[0037.515] lstrlenA (lpString="*.cdr") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.dwg") returned 0
	[0037.515] lstrlenA (lpString="*.dwg") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.max") returned 0
	[0037.515] lstrlenA (lpString="*.max") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.bmp") returned 0
	[0037.515] lstrlenA (lpString="*.bmp") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gif") returned 0
	[0037.515] lstrlenA (lpString="*.gif") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.png") returned 0
	[0037.515] lstrlenA (lpString="*.png") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.doc") returned 0
	[0037.515] lstrlenA (lpString="*.doc") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.docx") returned 0
	[0037.515] lstrlenA (lpString="*.docx") returned 6
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xls") returned 0
	[0037.515] lstrlenA (lpString="*.xls") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xlsx") returned 0
	[0037.515] lstrlenA (lpString="*.xlsx") returned 6
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ppt") returned 0
	[0037.515] lstrlenA (lpString="*.ppt") returned 5
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pptx") returned 0
	[0037.515] lstrlenA (lpString="*.pptx") returned 6
	[0037.515] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.txt") returned 0
	[0037.515] lstrlenA (lpString="*.txt") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pdf") returned 0
	[0037.516] lstrlenA (lpString="*.pdf") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.djvu") returned 0
	[0037.516] lstrlenA (lpString="*.djvu") returned 6
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.htm") returned 0
	[0037.516] lstrlenA (lpString="*.htm") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.html") returned 0
	[0037.516] lstrlenA (lpString="*.html") returned 6
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mdb") returned 0
	[0037.516] lstrlenA (lpString="*.mdb") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.cer") returned 0
	[0037.516] lstrlenA (lpString="*.cer") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.p12") returned 0
	[0037.516] lstrlenA (lpString="*.p12") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pfx") returned 0
	[0037.516] lstrlenA (lpString="*.pfx") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.kwm") returned 0
	[0037.516] lstrlenA (lpString="*.kwm") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pwm") returned 0
	[0037.516] lstrlenA (lpString="*.pwm") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.1cd") returned 0
	[0037.516] lstrlenA (lpString="*.1cd") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.md") returned 0
	[0037.516] lstrlenA (lpString="*.md") returned 4
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mdf") returned 0
	[0037.516] lstrlenA (lpString="*.mdf") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.dbf") returned 0
	[0037.516] lstrlenA (lpString="*.dbf") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.odt") returned 0
	[0037.516] lstrlenA (lpString="*.odt") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.vob") returned 0
	[0037.516] lstrlenA (lpString="*.vob") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ifo") returned 0
	[0037.516] lstrlenA (lpString="*.ifo") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.lnk") returned 0
	[0037.516] lstrlenA (lpString="*.lnk") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.torrent") returned 0
	[0037.516] lstrlenA (lpString="*.torrent") returned 9
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mov") returned 0
	[0037.516] lstrlenA (lpString="*.mov") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.m2v") returned 0
	[0037.516] lstrlenA (lpString="*.m2v") returned 5
	[0037.516] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.3gp") returned 0
	[0037.516] lstrlenA (lpString="*.3gp") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpeg") returned 0
	[0037.517] lstrlenA (lpString="*.mpeg") returned 6
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpg") returned 0
	[0037.517] lstrlenA (lpString="*.mpg") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flv") returned 0
	[0037.517] lstrlenA (lpString="*.flv") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.avi") returned 0
	[0037.517] lstrlenA (lpString="*.avi") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp4") returned 0
	[0037.517] lstrlenA (lpString="*.mp4") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wmv") returned 0
	[0037.517] lstrlenA (lpString="*.wmv") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.divx") returned 0
	[0037.517] lstrlenA (lpString="*.divx") returned 6
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mkv") returned 0
	[0037.517] lstrlenA (lpString="*.mkv") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp3") returned 0
	[0037.517] lstrlenA (lpString="*.mp3") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wav") returned 0
	[0037.517] lstrlenA (lpString="*.wav") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flac") returned 0
	[0037.517] lstrlenA (lpString="*.flac") returned 6
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ape") returned 0
	[0037.517] lstrlenA (lpString="*.ape") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wma") returned 0
	[0037.517] lstrlenA (lpString="*.wma") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ac3") returned 0
	[0037.517] lstrlenA (lpString="*.ac3") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.exe") returned 0
	[0037.517] lstrlenA (lpString="*.exe") returned 5
	[0037.517] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.apk") returned 0
	[0037.517] lstrlenA (lpString="*.apk") returned 5
	[0037.517] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.517] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.517] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PidGenX.dll") returned -1
	[0037.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1
	[0037.517] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1
	[0037.517] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab"
	[0037.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.517] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.517] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.517] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.518] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll"
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.zip") returned 0
	[0037.518] lstrlenA (lpString="*.zip") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.rar") returned 0
	[0037.518] lstrlenA (lpString="*.rar") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.7z") returned 0
	[0037.518] lstrlenA (lpString="*.7z") returned 4
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.tar") returned 0
	[0037.518] lstrlenA (lpString="*.tar") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gzip") returned 0
	[0037.518] lstrlenA (lpString="*.gzip") returned 6
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpg") returned 0
	[0037.518] lstrlenA (lpString="*.jpg") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpeg") returned 0
	[0037.518] lstrlenA (lpString="*.jpeg") returned 6
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.psd") returned 0
	[0037.518] lstrlenA (lpString="*.psd") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.cdr") returned 0
	[0037.518] lstrlenA (lpString="*.cdr") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.dwg") returned 0
	[0037.518] lstrlenA (lpString="*.dwg") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.max") returned 0
	[0037.518] lstrlenA (lpString="*.max") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.bmp") returned 0
	[0037.518] lstrlenA (lpString="*.bmp") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gif") returned 0
	[0037.518] lstrlenA (lpString="*.gif") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.png") returned 0
	[0037.518] lstrlenA (lpString="*.png") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.doc") returned 0
	[0037.518] lstrlenA (lpString="*.doc") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.docx") returned 0
	[0037.518] lstrlenA (lpString="*.docx") returned 6
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xls") returned 0
	[0037.518] lstrlenA (lpString="*.xls") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xlsx") returned 0
	[0037.518] lstrlenA (lpString="*.xlsx") returned 6
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ppt") returned 0
	[0037.518] lstrlenA (lpString="*.ppt") returned 5
	[0037.518] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pptx") returned 0
	[0037.519] lstrlenA (lpString="*.pptx") returned 6
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.txt") returned 0
	[0037.519] lstrlenA (lpString="*.txt") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pdf") returned 0
	[0037.519] lstrlenA (lpString="*.pdf") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.djvu") returned 0
	[0037.519] lstrlenA (lpString="*.djvu") returned 6
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.htm") returned 0
	[0037.519] lstrlenA (lpString="*.htm") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.html") returned 0
	[0037.519] lstrlenA (lpString="*.html") returned 6
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mdb") returned 0
	[0037.519] lstrlenA (lpString="*.mdb") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.cer") returned 0
	[0037.519] lstrlenA (lpString="*.cer") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.p12") returned 0
	[0037.519] lstrlenA (lpString="*.p12") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pfx") returned 0
	[0037.519] lstrlenA (lpString="*.pfx") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.kwm") returned 0
	[0037.519] lstrlenA (lpString="*.kwm") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pwm") returned 0
	[0037.519] lstrlenA (lpString="*.pwm") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.1cd") returned 0
	[0037.519] lstrlenA (lpString="*.1cd") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.md") returned 0
	[0037.519] lstrlenA (lpString="*.md") returned 4
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mdf") returned 0
	[0037.519] lstrlenA (lpString="*.mdf") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.dbf") returned 0
	[0037.519] lstrlenA (lpString="*.dbf") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.odt") returned 0
	[0037.519] lstrlenA (lpString="*.odt") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.vob") returned 0
	[0037.519] lstrlenA (lpString="*.vob") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ifo") returned 0
	[0037.519] lstrlenA (lpString="*.ifo") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.lnk") returned 0
	[0037.519] lstrlenA (lpString="*.lnk") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.torrent") returned 0
	[0037.519] lstrlenA (lpString="*.torrent") returned 9
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mov") returned 0
	[0037.519] lstrlenA (lpString="*.mov") returned 5
	[0037.519] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.m2v") returned 0
	[0037.520] lstrlenA (lpString="*.m2v") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.3gp") returned 0
	[0037.520] lstrlenA (lpString="*.3gp") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpeg") returned 0
	[0037.520] lstrlenA (lpString="*.mpeg") returned 6
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpg") returned 0
	[0037.520] lstrlenA (lpString="*.mpg") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flv") returned 0
	[0037.520] lstrlenA (lpString="*.flv") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.avi") returned 0
	[0037.520] lstrlenA (lpString="*.avi") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp4") returned 0
	[0037.520] lstrlenA (lpString="*.mp4") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wmv") returned 0
	[0037.520] lstrlenA (lpString="*.wmv") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.divx") returned 0
	[0037.520] lstrlenA (lpString="*.divx") returned 6
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mkv") returned 0
	[0037.520] lstrlenA (lpString="*.mkv") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp3") returned 0
	[0037.520] lstrlenA (lpString="*.mp3") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wav") returned 0
	[0037.520] lstrlenA (lpString="*.wav") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flac") returned 0
	[0037.520] lstrlenA (lpString="*.flac") returned 6
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ape") returned 0
	[0037.520] lstrlenA (lpString="*.ape") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wma") returned 0
	[0037.520] lstrlenA (lpString="*.wma") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ac3") returned 0
	[0037.520] lstrlenA (lpString="*.ac3") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.exe") returned 0
	[0037.520] lstrlenA (lpString="*.exe") returned 5
	[0037.520] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.apk") returned 0
	[0037.520] lstrlenA (lpString="*.apk") returned 5
	[0037.520] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.520] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.520] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.520] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll"
	[0037.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.521] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.521] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.521] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.521] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms"
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.zip") returned 0
	[0037.521] lstrlenA (lpString="*.zip") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.rar") returned 0
	[0037.521] lstrlenA (lpString="*.rar") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.7z") returned 0
	[0037.521] lstrlenA (lpString="*.7z") returned 4
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.tar") returned 0
	[0037.521] lstrlenA (lpString="*.tar") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gzip") returned 0
	[0037.521] lstrlenA (lpString="*.gzip") returned 6
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpg") returned 0
	[0037.521] lstrlenA (lpString="*.jpg") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpeg") returned 0
	[0037.521] lstrlenA (lpString="*.jpeg") returned 6
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.psd") returned 0
	[0037.521] lstrlenA (lpString="*.psd") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.cdr") returned 0
	[0037.521] lstrlenA (lpString="*.cdr") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.dwg") returned 0
	[0037.521] lstrlenA (lpString="*.dwg") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.max") returned 0
	[0037.521] lstrlenA (lpString="*.max") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.bmp") returned 0
	[0037.521] lstrlenA (lpString="*.bmp") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gif") returned 0
	[0037.521] lstrlenA (lpString="*.gif") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.png") returned 0
	[0037.521] lstrlenA (lpString="*.png") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.doc") returned 0
	[0037.521] lstrlenA (lpString="*.doc") returned 5
	[0037.521] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.docx") returned 0
	[0037.522] lstrlenA (lpString="*.docx") returned 6
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xls") returned 0
	[0037.522] lstrlenA (lpString="*.xls") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xlsx") returned 0
	[0037.522] lstrlenA (lpString="*.xlsx") returned 6
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ppt") returned 0
	[0037.522] lstrlenA (lpString="*.ppt") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pptx") returned 0
	[0037.522] lstrlenA (lpString="*.pptx") returned 6
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.txt") returned 0
	[0037.522] lstrlenA (lpString="*.txt") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pdf") returned 0
	[0037.522] lstrlenA (lpString="*.pdf") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.djvu") returned 0
	[0037.522] lstrlenA (lpString="*.djvu") returned 6
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.htm") returned 0
	[0037.522] lstrlenA (lpString="*.htm") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.html") returned 0
	[0037.522] lstrlenA (lpString="*.html") returned 6
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mdb") returned 0
	[0037.522] lstrlenA (lpString="*.mdb") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.cer") returned 0
	[0037.522] lstrlenA (lpString="*.cer") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.p12") returned 0
	[0037.522] lstrlenA (lpString="*.p12") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pfx") returned 0
	[0037.522] lstrlenA (lpString="*.pfx") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.kwm") returned 0
	[0037.522] lstrlenA (lpString="*.kwm") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pwm") returned 0
	[0037.522] lstrlenA (lpString="*.pwm") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.1cd") returned 0
	[0037.522] lstrlenA (lpString="*.1cd") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.md") returned 0
	[0037.522] lstrlenA (lpString="*.md") returned 4
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mdf") returned 0
	[0037.522] lstrlenA (lpString="*.mdf") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.dbf") returned 0
	[0037.522] lstrlenA (lpString="*.dbf") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.odt") returned 0
	[0037.522] lstrlenA (lpString="*.odt") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.vob") returned 0
	[0037.522] lstrlenA (lpString="*.vob") returned 5
	[0037.522] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ifo") returned 0
	[0037.523] lstrlenA (lpString="*.ifo") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.lnk") returned 0
	[0037.523] lstrlenA (lpString="*.lnk") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.torrent") returned 0
	[0037.523] lstrlenA (lpString="*.torrent") returned 9
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mov") returned 0
	[0037.523] lstrlenA (lpString="*.mov") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.m2v") returned 0
	[0037.523] lstrlenA (lpString="*.m2v") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.3gp") returned 0
	[0037.523] lstrlenA (lpString="*.3gp") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpeg") returned 0
	[0037.523] lstrlenA (lpString="*.mpeg") returned 6
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpg") returned 0
	[0037.523] lstrlenA (lpString="*.mpg") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flv") returned 0
	[0037.523] lstrlenA (lpString="*.flv") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.avi") returned 0
	[0037.523] lstrlenA (lpString="*.avi") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp4") returned 0
	[0037.523] lstrlenA (lpString="*.mp4") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wmv") returned 0
	[0037.523] lstrlenA (lpString="*.wmv") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.divx") returned 0
	[0037.523] lstrlenA (lpString="*.divx") returned 6
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mkv") returned 0
	[0037.523] lstrlenA (lpString="*.mkv") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp3") returned 0
	[0037.523] lstrlenA (lpString="*.mp3") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wav") returned 0
	[0037.523] lstrlenA (lpString="*.wav") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flac") returned 0
	[0037.523] lstrlenA (lpString="*.flac") returned 6
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ape") returned 0
	[0037.523] lstrlenA (lpString="*.ape") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wma") returned 0
	[0037.523] lstrlenA (lpString="*.wma") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ac3") returned 0
	[0037.523] lstrlenA (lpString="*.ac3") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.exe") returned 0
	[0037.523] lstrlenA (lpString="*.exe") returned 5
	[0037.523] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.apk") returned 0
	[0037.523] lstrlenA (lpString="*.apk") returned 5
	[0037.524] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.524] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.524] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PrjProrWW.msi") returned -1
	[0037.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrjProrWW.msi") returned -1
	[0037.524] lstrcmpiA (lpString1="", lpString2="PrjProrWW.msi") returned -1
	[0037.524] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms"
	[0037.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.524] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.524] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.524] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.524] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi"
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.zip") returned 0
	[0037.524] lstrlenA (lpString="*.zip") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.rar") returned 0
	[0037.524] lstrlenA (lpString="*.rar") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.7z") returned 0
	[0037.524] lstrlenA (lpString="*.7z") returned 4
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.tar") returned 0
	[0037.524] lstrlenA (lpString="*.tar") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.gzip") returned 0
	[0037.524] lstrlenA (lpString="*.gzip") returned 6
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.jpg") returned 0
	[0037.524] lstrlenA (lpString="*.jpg") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.jpeg") returned 0
	[0037.524] lstrlenA (lpString="*.jpeg") returned 6
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.psd") returned 0
	[0037.524] lstrlenA (lpString="*.psd") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.cdr") returned 0
	[0037.524] lstrlenA (lpString="*.cdr") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.dwg") returned 0
	[0037.524] lstrlenA (lpString="*.dwg") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.max") returned 0
	[0037.524] lstrlenA (lpString="*.max") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.bmp") returned 0
	[0037.524] lstrlenA (lpString="*.bmp") returned 5
	[0037.524] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", pszSpec="*.gif") returned 0
	[0037.524] lstrlenA (lpString="*.gif") returned 5
	[0037.525] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.525] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PrjProrWW.xml") returned -1
	[0037.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrjProrWW.xml") returned -1
	[0037.525] lstrcmpiA (lpString1="", lpString2="PrjProrWW.xml") returned -1
	[0037.525] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="PrjProrWW.msi"
	[0037.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.525] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.525] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.525] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.525] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml"
	[0037.525] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.525] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PrjPrrWW.cab") returned -1
	[0037.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrjPrrWW.cab") returned -1
	[0037.525] lstrcmpiA (lpString1="", lpString2="PrjPrrWW.cab") returned -1
	[0037.525] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="PrjProrWW.xml"
	[0037.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.525] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.525] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.525] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.525] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjPrrWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab"
	[0037.525] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.526] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.526] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="setup.exe") returned -1
	[0037.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1
	[0037.526] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1
	[0037.526] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="PrjPrrWW.cab"
	[0037.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.526] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.526] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.526] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.526] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.526] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe."
	[0037.526] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.Boom") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.Boom"
	[0037.526] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.527] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150578
	[0037.527] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x69dde270, dwHighDateTime=0x1cb04b2), lpLastAccessTime=0x407536*(dwLowDateTime=0x69dde270, dwHighDateTime=0x1cb04b2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa8191670, dwHighDateTime=0x1d305f1)) returned 1
	[0037.527] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.527] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x150555, lpOverlapped=0x0) returned 1
	[0037.583] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe"
	[0037.587] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.587] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x150555, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x150555, lpOverlapped=0x0) returned 1
	[0037.594] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.594] CloseHandle (hObject=0x88) returned 1
	[0037.612] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.Boom" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.boom")) returned 1
	[0037.618] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.618] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.618] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.618] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.618] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.618] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe"
	[0037.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\"
	[0037.618] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.618] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.618] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.618] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0
	[0037.618] lstrlenA (lpString="*.zip") returned 5
	[0037.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0
	[0037.618] lstrlenA (lpString="*.rar") returned 5
	[0037.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0
	[0037.619] lstrlenA (lpString="*.7z") returned 4
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0
	[0037.619] lstrlenA (lpString="*.tar") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0
	[0037.619] lstrlenA (lpString="*.gzip") returned 6
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0
	[0037.619] lstrlenA (lpString="*.jpg") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0
	[0037.619] lstrlenA (lpString="*.jpeg") returned 6
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0
	[0037.619] lstrlenA (lpString="*.psd") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0
	[0037.619] lstrlenA (lpString="*.cdr") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0
	[0037.619] lstrlenA (lpString="*.dwg") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0
	[0037.619] lstrlenA (lpString="*.max") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0
	[0037.619] lstrlenA (lpString="*.bmp") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0
	[0037.619] lstrlenA (lpString="*.gif") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0
	[0037.619] lstrlenA (lpString="*.png") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0
	[0037.619] lstrlenA (lpString="*.doc") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0
	[0037.619] lstrlenA (lpString="*.docx") returned 6
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0
	[0037.619] lstrlenA (lpString="*.xls") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0
	[0037.619] lstrlenA (lpString="*.xlsx") returned 6
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0
	[0037.619] lstrlenA (lpString="*.ppt") returned 5
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0
	[0037.619] lstrlenA (lpString="*.pptx") returned 6
	[0037.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0
	[0037.620] lstrlenA (lpString="*.txt") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0
	[0037.620] lstrlenA (lpString="*.pdf") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0
	[0037.620] lstrlenA (lpString="*.djvu") returned 6
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0
	[0037.620] lstrlenA (lpString="*.htm") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0
	[0037.620] lstrlenA (lpString="*.html") returned 6
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0
	[0037.620] lstrlenA (lpString="*.mdb") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0
	[0037.620] lstrlenA (lpString="*.cer") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0
	[0037.620] lstrlenA (lpString="*.p12") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0
	[0037.620] lstrlenA (lpString="*.pfx") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0
	[0037.620] lstrlenA (lpString="*.kwm") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0
	[0037.620] lstrlenA (lpString="*.pwm") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0
	[0037.620] lstrlenA (lpString="*.1cd") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0
	[0037.620] lstrlenA (lpString="*.md") returned 4
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0
	[0037.620] lstrlenA (lpString="*.mdf") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0
	[0037.620] lstrlenA (lpString="*.dbf") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0
	[0037.620] lstrlenA (lpString="*.odt") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0
	[0037.620] lstrlenA (lpString="*.vob") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0
	[0037.620] lstrlenA (lpString="*.ifo") returned 5
	[0037.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0
	[0037.621] lstrlenA (lpString="*.lnk") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0
	[0037.621] lstrlenA (lpString="*.torrent") returned 9
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0
	[0037.621] lstrlenA (lpString="*.mov") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0
	[0037.621] lstrlenA (lpString="*.m2v") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0
	[0037.621] lstrlenA (lpString="*.3gp") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0
	[0037.621] lstrlenA (lpString="*.mpeg") returned 6
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0
	[0037.621] lstrlenA (lpString="*.mpg") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0
	[0037.621] lstrlenA (lpString="*.flv") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0
	[0037.621] lstrlenA (lpString="*.avi") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0
	[0037.621] lstrlenA (lpString="*.mp4") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0
	[0037.621] lstrlenA (lpString="*.wmv") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0
	[0037.621] lstrlenA (lpString="*.divx") returned 6
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0
	[0037.621] lstrlenA (lpString="*.mkv") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0
	[0037.621] lstrlenA (lpString="*.mp3") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0
	[0037.621] lstrlenA (lpString="*.wav") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0
	[0037.621] lstrlenA (lpString="*.flac") returned 6
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0
	[0037.621] lstrlenA (lpString="*.ape") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0
	[0037.621] lstrlenA (lpString="*.wma") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0
	[0037.621] lstrlenA (lpString="*.ac3") returned 5
	[0037.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.exe") returned 0
	[0037.621] lstrlenA (lpString="*.exe") returned 5
	[0037.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.apk") returned 0
	[0037.622] lstrlenA (lpString="*.apk") returned 5
	[0037.622] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.622] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.622] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.622] lstrcmpA (lpString1=".", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1
	[0037.622] lstrcmpA (lpString1="..", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1
	[0037.622] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*"
	[0037.622] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C"
	[0037.622] lstrlenA (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned 62
	[0037.622] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b6e08
	[0037.627] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.627] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.627] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.627] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.627] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.627] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.627] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.msi") returned -1
	[0037.627] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.msi") returned -1
	[0037.627] lstrcmpiA (lpString1="", lpString2="Office32WW.msi") returned -1
	[0037.627] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*"
	[0037.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.627] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.627] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.627] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff
	[0037.627] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.628] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0037.628] WriteFile (in: hFile=0x88, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0037.629] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.629] CloseHandle (hObject=0x88) returned 1
	[0037.629] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi"
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.zip") returned 0
	[0037.629] lstrlenA (lpString="*.zip") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.rar") returned 0
	[0037.629] lstrlenA (lpString="*.rar") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.7z") returned 0
	[0037.629] lstrlenA (lpString="*.7z") returned 4
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.tar") returned 0
	[0037.629] lstrlenA (lpString="*.tar") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.gzip") returned 0
	[0037.629] lstrlenA (lpString="*.gzip") returned 6
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.jpg") returned 0
	[0037.629] lstrlenA (lpString="*.jpg") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.jpeg") returned 0
	[0037.629] lstrlenA (lpString="*.jpeg") returned 6
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.psd") returned 0
	[0037.629] lstrlenA (lpString="*.psd") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.cdr") returned 0
	[0037.629] lstrlenA (lpString="*.cdr") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.dwg") returned 0
	[0037.629] lstrlenA (lpString="*.dwg") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.max") returned 0
	[0037.629] lstrlenA (lpString="*.max") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.bmp") returned 0
	[0037.629] lstrlenA (lpString="*.bmp") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.gif") returned 0
	[0037.629] lstrlenA (lpString="*.gif") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.png") returned 0
	[0037.629] lstrlenA (lpString="*.png") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.doc") returned 0
	[0037.629] lstrlenA (lpString="*.doc") returned 5
	[0037.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.docx") returned 0
	[0037.630] lstrlenA (lpString="*.docx") returned 6
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.xls") returned 0
	[0037.630] lstrlenA (lpString="*.xls") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.xlsx") returned 0
	[0037.630] lstrlenA (lpString="*.xlsx") returned 6
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ppt") returned 0
	[0037.630] lstrlenA (lpString="*.ppt") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pptx") returned 0
	[0037.630] lstrlenA (lpString="*.pptx") returned 6
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.txt") returned 0
	[0037.630] lstrlenA (lpString="*.txt") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pdf") returned 0
	[0037.630] lstrlenA (lpString="*.pdf") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.djvu") returned 0
	[0037.630] lstrlenA (lpString="*.djvu") returned 6
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.htm") returned 0
	[0037.630] lstrlenA (lpString="*.htm") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.html") returned 0
	[0037.630] lstrlenA (lpString="*.html") returned 6
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mdb") returned 0
	[0037.630] lstrlenA (lpString="*.mdb") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.cer") returned 0
	[0037.630] lstrlenA (lpString="*.cer") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.p12") returned 0
	[0037.630] lstrlenA (lpString="*.p12") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pfx") returned 0
	[0037.630] lstrlenA (lpString="*.pfx") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.kwm") returned 0
	[0037.630] lstrlenA (lpString="*.kwm") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pwm") returned 0
	[0037.630] lstrlenA (lpString="*.pwm") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.1cd") returned 0
	[0037.630] lstrlenA (lpString="*.1cd") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.md") returned 0
	[0037.630] lstrlenA (lpString="*.md") returned 4
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mdf") returned 0
	[0037.630] lstrlenA (lpString="*.mdf") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.dbf") returned 0
	[0037.630] lstrlenA (lpString="*.dbf") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.odt") returned 0
	[0037.630] lstrlenA (lpString="*.odt") returned 5
	[0037.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.vob") returned 0
	[0037.631] lstrlenA (lpString="*.vob") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ifo") returned 0
	[0037.631] lstrlenA (lpString="*.ifo") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.lnk") returned 0
	[0037.631] lstrlenA (lpString="*.lnk") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.torrent") returned 0
	[0037.631] lstrlenA (lpString="*.torrent") returned 9
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mov") returned 0
	[0037.631] lstrlenA (lpString="*.mov") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.m2v") returned 0
	[0037.631] lstrlenA (lpString="*.m2v") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.3gp") returned 0
	[0037.631] lstrlenA (lpString="*.3gp") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mpeg") returned 0
	[0037.631] lstrlenA (lpString="*.mpeg") returned 6
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mpg") returned 0
	[0037.631] lstrlenA (lpString="*.mpg") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.flv") returned 0
	[0037.631] lstrlenA (lpString="*.flv") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.avi") returned 0
	[0037.631] lstrlenA (lpString="*.avi") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mp4") returned 0
	[0037.631] lstrlenA (lpString="*.mp4") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wmv") returned 0
	[0037.631] lstrlenA (lpString="*.wmv") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.divx") returned 0
	[0037.631] lstrlenA (lpString="*.divx") returned 6
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mkv") returned 0
	[0037.631] lstrlenA (lpString="*.mkv") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mp3") returned 0
	[0037.631] lstrlenA (lpString="*.mp3") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wav") returned 0
	[0037.631] lstrlenA (lpString="*.wav") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.flac") returned 0
	[0037.631] lstrlenA (lpString="*.flac") returned 6
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ape") returned 0
	[0037.631] lstrlenA (lpString="*.ape") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wma") returned 0
	[0037.631] lstrlenA (lpString="*.wma") returned 5
	[0037.631] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ac3") returned 0
	[0037.631] lstrlenA (lpString="*.ac3") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.exe") returned 0
	[0037.632] lstrlenA (lpString="*.exe") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.apk") returned 0
	[0037.632] lstrlenA (lpString="*.apk") returned 5
	[0037.632] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.632] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.632] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.xml") returned -1
	[0037.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.xml") returned -1
	[0037.632] lstrcmpiA (lpString1="", lpString2="Office32WW.xml") returned -1
	[0037.632] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi"
	[0037.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.632] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.632] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.632] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.632] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml"
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.zip") returned 0
	[0037.632] lstrlenA (lpString="*.zip") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.rar") returned 0
	[0037.632] lstrlenA (lpString="*.rar") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.7z") returned 0
	[0037.632] lstrlenA (lpString="*.7z") returned 4
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.tar") returned 0
	[0037.632] lstrlenA (lpString="*.tar") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.gzip") returned 0
	[0037.632] lstrlenA (lpString="*.gzip") returned 6
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.jpg") returned 0
	[0037.632] lstrlenA (lpString="*.jpg") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.jpeg") returned 0
	[0037.632] lstrlenA (lpString="*.jpeg") returned 6
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.psd") returned 0
	[0037.632] lstrlenA (lpString="*.psd") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.cdr") returned 0
	[0037.632] lstrlenA (lpString="*.cdr") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.dwg") returned 0
	[0037.632] lstrlenA (lpString="*.dwg") returned 5
	[0037.632] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.max") returned 0
	[0037.632] lstrlenA (lpString="*.max") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.bmp") returned 0
	[0037.633] lstrlenA (lpString="*.bmp") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.gif") returned 0
	[0037.633] lstrlenA (lpString="*.gif") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.png") returned 0
	[0037.633] lstrlenA (lpString="*.png") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.doc") returned 0
	[0037.633] lstrlenA (lpString="*.doc") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.docx") returned 0
	[0037.633] lstrlenA (lpString="*.docx") returned 6
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.xls") returned 0
	[0037.633] lstrlenA (lpString="*.xls") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.xlsx") returned 0
	[0037.633] lstrlenA (lpString="*.xlsx") returned 6
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ppt") returned 0
	[0037.633] lstrlenA (lpString="*.ppt") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pptx") returned 0
	[0037.633] lstrlenA (lpString="*.pptx") returned 6
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.txt") returned 0
	[0037.633] lstrlenA (lpString="*.txt") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pdf") returned 0
	[0037.633] lstrlenA (lpString="*.pdf") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.djvu") returned 0
	[0037.633] lstrlenA (lpString="*.djvu") returned 6
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.htm") returned 0
	[0037.633] lstrlenA (lpString="*.htm") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.html") returned 0
	[0037.633] lstrlenA (lpString="*.html") returned 6
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mdb") returned 0
	[0037.633] lstrlenA (lpString="*.mdb") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.cer") returned 0
	[0037.633] lstrlenA (lpString="*.cer") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.p12") returned 0
	[0037.633] lstrlenA (lpString="*.p12") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pfx") returned 0
	[0037.633] lstrlenA (lpString="*.pfx") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.kwm") returned 0
	[0037.633] lstrlenA (lpString="*.kwm") returned 5
	[0037.633] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pwm") returned 0
	[0037.634] lstrlenA (lpString="*.pwm") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.1cd") returned 0
	[0037.634] lstrlenA (lpString="*.1cd") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.md") returned 0
	[0037.634] lstrlenA (lpString="*.md") returned 4
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mdf") returned 0
	[0037.634] lstrlenA (lpString="*.mdf") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.dbf") returned 0
	[0037.634] lstrlenA (lpString="*.dbf") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.odt") returned 0
	[0037.634] lstrlenA (lpString="*.odt") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.vob") returned 0
	[0037.634] lstrlenA (lpString="*.vob") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ifo") returned 0
	[0037.634] lstrlenA (lpString="*.ifo") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.lnk") returned 0
	[0037.634] lstrlenA (lpString="*.lnk") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.torrent") returned 0
	[0037.634] lstrlenA (lpString="*.torrent") returned 9
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mov") returned 0
	[0037.634] lstrlenA (lpString="*.mov") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.m2v") returned 0
	[0037.634] lstrlenA (lpString="*.m2v") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.3gp") returned 0
	[0037.634] lstrlenA (lpString="*.3gp") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mpeg") returned 0
	[0037.634] lstrlenA (lpString="*.mpeg") returned 6
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mpg") returned 0
	[0037.634] lstrlenA (lpString="*.mpg") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.flv") returned 0
	[0037.634] lstrlenA (lpString="*.flv") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.avi") returned 0
	[0037.634] lstrlenA (lpString="*.avi") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mp4") returned 0
	[0037.634] lstrlenA (lpString="*.mp4") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wmv") returned 0
	[0037.634] lstrlenA (lpString="*.wmv") returned 5
	[0037.634] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.divx") returned 0
	[0037.635] lstrlenA (lpString="*.divx") returned 6
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mkv") returned 0
	[0037.635] lstrlenA (lpString="*.mkv") returned 5
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mp3") returned 0
	[0037.635] lstrlenA (lpString="*.mp3") returned 5
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wav") returned 0
	[0037.635] lstrlenA (lpString="*.wav") returned 5
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.flac") returned 0
	[0037.635] lstrlenA (lpString="*.flac") returned 6
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ape") returned 0
	[0037.635] lstrlenA (lpString="*.ape") returned 5
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wma") returned 0
	[0037.635] lstrlenA (lpString="*.wma") returned 5
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ac3") returned 0
	[0037.635] lstrlenA (lpString="*.ac3") returned 5
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.exe") returned 0
	[0037.635] lstrlenA (lpString="*.exe") returned 5
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.apk") returned 0
	[0037.635] lstrlenA (lpString="*.apk") returned 5
	[0037.635] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.635] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.635] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ose.exe") returned -1
	[0037.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1
	[0037.635] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1
	[0037.635] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml"
	[0037.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.635] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.635] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.635] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.635] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.635] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.zip") returned 0
	[0037.636] lstrlenA (lpString="*.zip") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.rar") returned 0
	[0037.636] lstrlenA (lpString="*.rar") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.7z") returned 0
	[0037.636] lstrlenA (lpString="*.7z") returned 4
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.tar") returned 0
	[0037.636] lstrlenA (lpString="*.tar") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.gzip") returned 0
	[0037.636] lstrlenA (lpString="*.gzip") returned 6
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.jpg") returned 0
	[0037.636] lstrlenA (lpString="*.jpg") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.jpeg") returned 0
	[0037.636] lstrlenA (lpString="*.jpeg") returned 6
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.psd") returned 0
	[0037.636] lstrlenA (lpString="*.psd") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.cdr") returned 0
	[0037.636] lstrlenA (lpString="*.cdr") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.dwg") returned 0
	[0037.636] lstrlenA (lpString="*.dwg") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.max") returned 0
	[0037.636] lstrlenA (lpString="*.max") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.bmp") returned 0
	[0037.636] lstrlenA (lpString="*.bmp") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.gif") returned 0
	[0037.636] lstrlenA (lpString="*.gif") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.png") returned 0
	[0037.636] lstrlenA (lpString="*.png") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.doc") returned 0
	[0037.636] lstrlenA (lpString="*.doc") returned 5
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.docx") returned 0
	[0037.636] lstrlenA (lpString="*.docx") returned 6
	[0037.636] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.xls") returned 0
	[0037.636] lstrlenA (lpString="*.xls") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.xlsx") returned 0
	[0037.637] lstrlenA (lpString="*.xlsx") returned 6
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ppt") returned 0
	[0037.637] lstrlenA (lpString="*.ppt") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pptx") returned 0
	[0037.637] lstrlenA (lpString="*.pptx") returned 6
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.txt") returned 0
	[0037.637] lstrlenA (lpString="*.txt") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pdf") returned 0
	[0037.637] lstrlenA (lpString="*.pdf") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.djvu") returned 0
	[0037.637] lstrlenA (lpString="*.djvu") returned 6
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.htm") returned 0
	[0037.637] lstrlenA (lpString="*.htm") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.html") returned 0
	[0037.637] lstrlenA (lpString="*.html") returned 6
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mdb") returned 0
	[0037.637] lstrlenA (lpString="*.mdb") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.cer") returned 0
	[0037.637] lstrlenA (lpString="*.cer") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.p12") returned 0
	[0037.637] lstrlenA (lpString="*.p12") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pfx") returned 0
	[0037.637] lstrlenA (lpString="*.pfx") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.kwm") returned 0
	[0037.637] lstrlenA (lpString="*.kwm") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pwm") returned 0
	[0037.637] lstrlenA (lpString="*.pwm") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.1cd") returned 0
	[0037.637] lstrlenA (lpString="*.1cd") returned 5
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.md") returned 0
	[0037.637] lstrlenA (lpString="*.md") returned 4
	[0037.637] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mdf") returned 0
	[0037.637] lstrlenA (lpString="*.mdf") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.dbf") returned 0
	[0037.638] lstrlenA (lpString="*.dbf") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.odt") returned 0
	[0037.638] lstrlenA (lpString="*.odt") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.vob") returned 0
	[0037.638] lstrlenA (lpString="*.vob") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ifo") returned 0
	[0037.638] lstrlenA (lpString="*.ifo") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.lnk") returned 0
	[0037.638] lstrlenA (lpString="*.lnk") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.torrent") returned 0
	[0037.638] lstrlenA (lpString="*.torrent") returned 9
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mov") returned 0
	[0037.638] lstrlenA (lpString="*.mov") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.m2v") returned 0
	[0037.638] lstrlenA (lpString="*.m2v") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.3gp") returned 0
	[0037.638] lstrlenA (lpString="*.3gp") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mpeg") returned 0
	[0037.638] lstrlenA (lpString="*.mpeg") returned 6
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mpg") returned 0
	[0037.638] lstrlenA (lpString="*.mpg") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.flv") returned 0
	[0037.638] lstrlenA (lpString="*.flv") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.avi") returned 0
	[0037.638] lstrlenA (lpString="*.avi") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mp4") returned 0
	[0037.638] lstrlenA (lpString="*.mp4") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wmv") returned 0
	[0037.638] lstrlenA (lpString="*.wmv") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.divx") returned 0
	[0037.638] lstrlenA (lpString="*.divx") returned 6
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mkv") returned 0
	[0037.638] lstrlenA (lpString="*.mkv") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mp3") returned 0
	[0037.638] lstrlenA (lpString="*.mp3") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wav") returned 0
	[0037.638] lstrlenA (lpString="*.wav") returned 5
	[0037.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.flac") returned 0
	[0037.638] lstrlenA (lpString="*.flac") returned 6
	[0037.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ape") returned 0
	[0037.639] lstrlenA (lpString="*.ape") returned 5
	[0037.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wma") returned 0
	[0037.639] lstrlenA (lpString="*.wma") returned 5
	[0037.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ac3") returned 0
	[0037.639] lstrlenA (lpString="*.ac3") returned 5
	[0037.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.exe") returned 1
	[0037.639] lstrlenA (lpString="*.exe") returned 5
	[0037.639] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.639] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe"
	[0037.639] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe."
	[0037.639] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.Boom") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.Boom"
	[0037.639] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.640] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a968
	[0037.640] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xec54b6b0, dwHighDateTime=0x1cb04a9), lpLastAccessTime=0x407536*(dwLowDateTime=0xec54b6b0, dwHighDateTime=0x1cb04a9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4a687710, dwHighDateTime=0x1d305eb)) returned 1
	[0037.640] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.640] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2a945, lpOverlapped=0x0) returned 1
	[0037.659] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe"
	[0037.660] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.660] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2a945, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2a945, lpOverlapped=0x0) returned 1
	[0037.661] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.661] CloseHandle (hObject=0x88) returned 1
	[0037.662] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.Boom" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.boom")) returned 1
	[0037.663] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.663] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.663] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osetup.dll") returned -1
	[0037.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1
	[0037.663] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1
	[0037.663] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe"
	[0037.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.663] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.663] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.663] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.663] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll"
	[0037.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.zip") returned 0
	[0037.663] lstrlenA (lpString="*.zip") returned 5
	[0037.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.rar") returned 0
	[0037.663] lstrlenA (lpString="*.rar") returned 5
	[0037.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.7z") returned 0
	[0037.663] lstrlenA (lpString="*.7z") returned 4
	[0037.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.tar") returned 0
	[0037.663] lstrlenA (lpString="*.tar") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gzip") returned 0
	[0037.664] lstrlenA (lpString="*.gzip") returned 6
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpg") returned 0
	[0037.664] lstrlenA (lpString="*.jpg") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpeg") returned 0
	[0037.664] lstrlenA (lpString="*.jpeg") returned 6
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.psd") returned 0
	[0037.664] lstrlenA (lpString="*.psd") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.cdr") returned 0
	[0037.664] lstrlenA (lpString="*.cdr") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.dwg") returned 0
	[0037.664] lstrlenA (lpString="*.dwg") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.max") returned 0
	[0037.664] lstrlenA (lpString="*.max") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.bmp") returned 0
	[0037.664] lstrlenA (lpString="*.bmp") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gif") returned 0
	[0037.664] lstrlenA (lpString="*.gif") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.png") returned 0
	[0037.664] lstrlenA (lpString="*.png") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.doc") returned 0
	[0037.664] lstrlenA (lpString="*.doc") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.docx") returned 0
	[0037.664] lstrlenA (lpString="*.docx") returned 6
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xls") returned 0
	[0037.664] lstrlenA (lpString="*.xls") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xlsx") returned 0
	[0037.664] lstrlenA (lpString="*.xlsx") returned 6
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ppt") returned 0
	[0037.664] lstrlenA (lpString="*.ppt") returned 5
	[0037.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pptx") returned 0
	[0037.664] lstrlenA (lpString="*.pptx") returned 6
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.txt") returned 0
	[0037.665] lstrlenA (lpString="*.txt") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pdf") returned 0
	[0037.665] lstrlenA (lpString="*.pdf") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.djvu") returned 0
	[0037.665] lstrlenA (lpString="*.djvu") returned 6
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.htm") returned 0
	[0037.665] lstrlenA (lpString="*.htm") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.html") returned 0
	[0037.665] lstrlenA (lpString="*.html") returned 6
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mdb") returned 0
	[0037.665] lstrlenA (lpString="*.mdb") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.cer") returned 0
	[0037.665] lstrlenA (lpString="*.cer") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.p12") returned 0
	[0037.665] lstrlenA (lpString="*.p12") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pfx") returned 0
	[0037.665] lstrlenA (lpString="*.pfx") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.kwm") returned 0
	[0037.665] lstrlenA (lpString="*.kwm") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pwm") returned 0
	[0037.665] lstrlenA (lpString="*.pwm") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.1cd") returned 0
	[0037.665] lstrlenA (lpString="*.1cd") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.md") returned 0
	[0037.665] lstrlenA (lpString="*.md") returned 4
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mdf") returned 0
	[0037.665] lstrlenA (lpString="*.mdf") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.dbf") returned 0
	[0037.665] lstrlenA (lpString="*.dbf") returned 5
	[0037.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.odt") returned 0
	[0037.665] lstrlenA (lpString="*.odt") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.vob") returned 0
	[0037.666] lstrlenA (lpString="*.vob") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ifo") returned 0
	[0037.666] lstrlenA (lpString="*.ifo") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.lnk") returned 0
	[0037.666] lstrlenA (lpString="*.lnk") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.torrent") returned 0
	[0037.666] lstrlenA (lpString="*.torrent") returned 9
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mov") returned 0
	[0037.666] lstrlenA (lpString="*.mov") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.m2v") returned 0
	[0037.666] lstrlenA (lpString="*.m2v") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.3gp") returned 0
	[0037.666] lstrlenA (lpString="*.3gp") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpeg") returned 0
	[0037.666] lstrlenA (lpString="*.mpeg") returned 6
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpg") returned 0
	[0037.666] lstrlenA (lpString="*.mpg") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flv") returned 0
	[0037.666] lstrlenA (lpString="*.flv") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.avi") returned 0
	[0037.666] lstrlenA (lpString="*.avi") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp4") returned 0
	[0037.666] lstrlenA (lpString="*.mp4") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wmv") returned 0
	[0037.666] lstrlenA (lpString="*.wmv") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.divx") returned 0
	[0037.666] lstrlenA (lpString="*.divx") returned 6
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mkv") returned 0
	[0037.666] lstrlenA (lpString="*.mkv") returned 5
	[0037.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp3") returned 0
	[0037.666] lstrlenA (lpString="*.mp3") returned 5
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wav") returned 0
	[0037.667] lstrlenA (lpString="*.wav") returned 5
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flac") returned 0
	[0037.667] lstrlenA (lpString="*.flac") returned 6
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ape") returned 0
	[0037.667] lstrlenA (lpString="*.ape") returned 5
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wma") returned 0
	[0037.667] lstrlenA (lpString="*.wma") returned 5
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ac3") returned 0
	[0037.667] lstrlenA (lpString="*.ac3") returned 5
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.exe") returned 0
	[0037.667] lstrlenA (lpString="*.exe") returned 5
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.apk") returned 0
	[0037.667] lstrlenA (lpString="*.apk") returned 5
	[0037.667] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.667] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.667] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OWOW32WW.cab") returned -1
	[0037.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32WW.cab") returned -1
	[0037.667] lstrcmpiA (lpString1="", lpString2="OWOW32WW.cab") returned -1
	[0037.667] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll"
	[0037.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.667] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.667] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.667] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.667] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab"
	[0037.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.zip") returned 0
	[0037.668] lstrlenA (lpString="*.zip") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.rar") returned 0
	[0037.668] lstrlenA (lpString="*.rar") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.7z") returned 0
	[0037.668] lstrlenA (lpString="*.7z") returned 4
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.tar") returned 0
	[0037.668] lstrlenA (lpString="*.tar") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gzip") returned 0
	[0037.668] lstrlenA (lpString="*.gzip") returned 6
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpg") returned 0
	[0037.668] lstrlenA (lpString="*.jpg") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpeg") returned 0
	[0037.668] lstrlenA (lpString="*.jpeg") returned 6
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.psd") returned 0
	[0037.668] lstrlenA (lpString="*.psd") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.cdr") returned 0
	[0037.668] lstrlenA (lpString="*.cdr") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.dwg") returned 0
	[0037.668] lstrlenA (lpString="*.dwg") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.max") returned 0
	[0037.668] lstrlenA (lpString="*.max") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.bmp") returned 0
	[0037.668] lstrlenA (lpString="*.bmp") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gif") returned 0
	[0037.668] lstrlenA (lpString="*.gif") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.png") returned 0
	[0037.668] lstrlenA (lpString="*.png") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.doc") returned 0
	[0037.668] lstrlenA (lpString="*.doc") returned 5
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.docx") returned 0
	[0037.668] lstrlenA (lpString="*.docx") returned 6
	[0037.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xls") returned 0
	[0037.669] lstrlenA (lpString="*.xls") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xlsx") returned 0
	[0037.669] lstrlenA (lpString="*.xlsx") returned 6
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ppt") returned 0
	[0037.669] lstrlenA (lpString="*.ppt") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pptx") returned 0
	[0037.669] lstrlenA (lpString="*.pptx") returned 6
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.txt") returned 0
	[0037.669] lstrlenA (lpString="*.txt") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pdf") returned 0
	[0037.669] lstrlenA (lpString="*.pdf") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.djvu") returned 0
	[0037.669] lstrlenA (lpString="*.djvu") returned 6
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.htm") returned 0
	[0037.669] lstrlenA (lpString="*.htm") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.html") returned 0
	[0037.669] lstrlenA (lpString="*.html") returned 6
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mdb") returned 0
	[0037.669] lstrlenA (lpString="*.mdb") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.cer") returned 0
	[0037.669] lstrlenA (lpString="*.cer") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.p12") returned 0
	[0037.669] lstrlenA (lpString="*.p12") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pfx") returned 0
	[0037.669] lstrlenA (lpString="*.pfx") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.kwm") returned 0
	[0037.669] lstrlenA (lpString="*.kwm") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pwm") returned 0
	[0037.669] lstrlenA (lpString="*.pwm") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.1cd") returned 0
	[0037.669] lstrlenA (lpString="*.1cd") returned 5
	[0037.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.md") returned 0
	[0037.670] lstrlenA (lpString="*.md") returned 4
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mdf") returned 0
	[0037.670] lstrlenA (lpString="*.mdf") returned 5
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.dbf") returned 0
	[0037.670] lstrlenA (lpString="*.dbf") returned 5
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.odt") returned 0
	[0037.670] lstrlenA (lpString="*.odt") returned 5
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.vob") returned 0
	[0037.670] lstrlenA (lpString="*.vob") returned 5
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ifo") returned 0
	[0037.670] lstrlenA (lpString="*.ifo") returned 5
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.lnk") returned 0
	[0037.670] lstrlenA (lpString="*.lnk") returned 5
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.torrent") returned 0
	[0037.670] lstrlenA (lpString="*.torrent") returned 9
	[0037.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mov") returned 0
	[0037.670] lstrlenA (lpString="*.mov") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.m2v") returned 0
	[0037.671] lstrlenA (lpString="*.m2v") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.3gp") returned 0
	[0037.671] lstrlenA (lpString="*.3gp") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpeg") returned 0
	[0037.671] lstrlenA (lpString="*.mpeg") returned 6
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpg") returned 0
	[0037.671] lstrlenA (lpString="*.mpg") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flv") returned 0
	[0037.671] lstrlenA (lpString="*.flv") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.avi") returned 0
	[0037.671] lstrlenA (lpString="*.avi") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp4") returned 0
	[0037.671] lstrlenA (lpString="*.mp4") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wmv") returned 0
	[0037.671] lstrlenA (lpString="*.wmv") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.divx") returned 0
	[0037.671] lstrlenA (lpString="*.divx") returned 6
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mkv") returned 0
	[0037.671] lstrlenA (lpString="*.mkv") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp3") returned 0
	[0037.671] lstrlenA (lpString="*.mp3") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wav") returned 0
	[0037.671] lstrlenA (lpString="*.wav") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flac") returned 0
	[0037.671] lstrlenA (lpString="*.flac") returned 6
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ape") returned 0
	[0037.671] lstrlenA (lpString="*.ape") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wma") returned 0
	[0037.671] lstrlenA (lpString="*.wma") returned 5
	[0037.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ac3") returned 0
	[0037.671] lstrlenA (lpString="*.ac3") returned 5
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.exe") returned 0
	[0037.672] lstrlenA (lpString="*.exe") returned 5
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.apk") returned 0
	[0037.672] lstrlenA (lpString="*.apk") returned 5
	[0037.672] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.672] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.672] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PidGenX.dll") returned -1
	[0037.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1
	[0037.672] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1
	[0037.672] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab"
	[0037.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.672] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.672] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.672] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.672] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll"
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.zip") returned 0
	[0037.672] lstrlenA (lpString="*.zip") returned 5
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.rar") returned 0
	[0037.672] lstrlenA (lpString="*.rar") returned 5
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.7z") returned 0
	[0037.672] lstrlenA (lpString="*.7z") returned 4
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.tar") returned 0
	[0037.672] lstrlenA (lpString="*.tar") returned 5
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gzip") returned 0
	[0037.672] lstrlenA (lpString="*.gzip") returned 6
	[0037.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpg") returned 0
	[0037.672] lstrlenA (lpString="*.jpg") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpeg") returned 0
	[0037.673] lstrlenA (lpString="*.jpeg") returned 6
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.psd") returned 0
	[0037.673] lstrlenA (lpString="*.psd") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.cdr") returned 0
	[0037.673] lstrlenA (lpString="*.cdr") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.dwg") returned 0
	[0037.673] lstrlenA (lpString="*.dwg") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.max") returned 0
	[0037.673] lstrlenA (lpString="*.max") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.bmp") returned 0
	[0037.673] lstrlenA (lpString="*.bmp") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gif") returned 0
	[0037.673] lstrlenA (lpString="*.gif") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.png") returned 0
	[0037.673] lstrlenA (lpString="*.png") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.doc") returned 0
	[0037.673] lstrlenA (lpString="*.doc") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.docx") returned 0
	[0037.673] lstrlenA (lpString="*.docx") returned 6
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xls") returned 0
	[0037.673] lstrlenA (lpString="*.xls") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xlsx") returned 0
	[0037.673] lstrlenA (lpString="*.xlsx") returned 6
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ppt") returned 0
	[0037.673] lstrlenA (lpString="*.ppt") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pptx") returned 0
	[0037.673] lstrlenA (lpString="*.pptx") returned 6
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.txt") returned 0
	[0037.673] lstrlenA (lpString="*.txt") returned 5
	[0037.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pdf") returned 0
	[0037.673] lstrlenA (lpString="*.pdf") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.djvu") returned 0
	[0037.674] lstrlenA (lpString="*.djvu") returned 6
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.htm") returned 0
	[0037.674] lstrlenA (lpString="*.htm") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.html") returned 0
	[0037.674] lstrlenA (lpString="*.html") returned 6
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mdb") returned 0
	[0037.674] lstrlenA (lpString="*.mdb") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.cer") returned 0
	[0037.674] lstrlenA (lpString="*.cer") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.p12") returned 0
	[0037.674] lstrlenA (lpString="*.p12") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pfx") returned 0
	[0037.674] lstrlenA (lpString="*.pfx") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.kwm") returned 0
	[0037.674] lstrlenA (lpString="*.kwm") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pwm") returned 0
	[0037.674] lstrlenA (lpString="*.pwm") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.1cd") returned 0
	[0037.674] lstrlenA (lpString="*.1cd") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.md") returned 0
	[0037.674] lstrlenA (lpString="*.md") returned 4
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mdf") returned 0
	[0037.674] lstrlenA (lpString="*.mdf") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.dbf") returned 0
	[0037.674] lstrlenA (lpString="*.dbf") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.odt") returned 0
	[0037.674] lstrlenA (lpString="*.odt") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.vob") returned 0
	[0037.674] lstrlenA (lpString="*.vob") returned 5
	[0037.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ifo") returned 0
	[0037.674] lstrlenA (lpString="*.ifo") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.lnk") returned 0
	[0037.675] lstrlenA (lpString="*.lnk") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.torrent") returned 0
	[0037.675] lstrlenA (lpString="*.torrent") returned 9
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mov") returned 0
	[0037.675] lstrlenA (lpString="*.mov") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.m2v") returned 0
	[0037.675] lstrlenA (lpString="*.m2v") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.3gp") returned 0
	[0037.675] lstrlenA (lpString="*.3gp") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpeg") returned 0
	[0037.675] lstrlenA (lpString="*.mpeg") returned 6
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpg") returned 0
	[0037.675] lstrlenA (lpString="*.mpg") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flv") returned 0
	[0037.675] lstrlenA (lpString="*.flv") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.avi") returned 0
	[0037.675] lstrlenA (lpString="*.avi") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp4") returned 0
	[0037.675] lstrlenA (lpString="*.mp4") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wmv") returned 0
	[0037.675] lstrlenA (lpString="*.wmv") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.divx") returned 0
	[0037.675] lstrlenA (lpString="*.divx") returned 6
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mkv") returned 0
	[0037.675] lstrlenA (lpString="*.mkv") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp3") returned 0
	[0037.675] lstrlenA (lpString="*.mp3") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wav") returned 0
	[0037.675] lstrlenA (lpString="*.wav") returned 5
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flac") returned 0
	[0037.675] lstrlenA (lpString="*.flac") returned 6
	[0037.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ape") returned 0
	[0037.676] lstrlenA (lpString="*.ape") returned 5
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wma") returned 0
	[0037.676] lstrlenA (lpString="*.wma") returned 5
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ac3") returned 0
	[0037.676] lstrlenA (lpString="*.ac3") returned 5
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.exe") returned 0
	[0037.676] lstrlenA (lpString="*.exe") returned 5
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.apk") returned 0
	[0037.676] lstrlenA (lpString="*.apk") returned 5
	[0037.676] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.676] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.676] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.676] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1
	[0037.676] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll"
	[0037.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.676] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.676] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.676] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.676] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms"
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.zip") returned 0
	[0037.676] lstrlenA (lpString="*.zip") returned 5
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.rar") returned 0
	[0037.676] lstrlenA (lpString="*.rar") returned 5
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.7z") returned 0
	[0037.676] lstrlenA (lpString="*.7z") returned 4
	[0037.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.tar") returned 0
	[0037.676] lstrlenA (lpString="*.tar") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gzip") returned 0
	[0037.677] lstrlenA (lpString="*.gzip") returned 6
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpg") returned 0
	[0037.677] lstrlenA (lpString="*.jpg") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpeg") returned 0
	[0037.677] lstrlenA (lpString="*.jpeg") returned 6
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.psd") returned 0
	[0037.677] lstrlenA (lpString="*.psd") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.cdr") returned 0
	[0037.677] lstrlenA (lpString="*.cdr") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.dwg") returned 0
	[0037.677] lstrlenA (lpString="*.dwg") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.max") returned 0
	[0037.677] lstrlenA (lpString="*.max") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.bmp") returned 0
	[0037.677] lstrlenA (lpString="*.bmp") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gif") returned 0
	[0037.677] lstrlenA (lpString="*.gif") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.png") returned 0
	[0037.677] lstrlenA (lpString="*.png") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.doc") returned 0
	[0037.677] lstrlenA (lpString="*.doc") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.docx") returned 0
	[0037.677] lstrlenA (lpString="*.docx") returned 6
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xls") returned 0
	[0037.677] lstrlenA (lpString="*.xls") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xlsx") returned 0
	[0037.677] lstrlenA (lpString="*.xlsx") returned 6
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ppt") returned 0
	[0037.677] lstrlenA (lpString="*.ppt") returned 5
	[0037.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pptx") returned 0
	[0037.677] lstrlenA (lpString="*.pptx") returned 6
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.txt") returned 0
	[0037.678] lstrlenA (lpString="*.txt") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pdf") returned 0
	[0037.678] lstrlenA (lpString="*.pdf") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.djvu") returned 0
	[0037.678] lstrlenA (lpString="*.djvu") returned 6
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.htm") returned 0
	[0037.678] lstrlenA (lpString="*.htm") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.html") returned 0
	[0037.678] lstrlenA (lpString="*.html") returned 6
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mdb") returned 0
	[0037.678] lstrlenA (lpString="*.mdb") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.cer") returned 0
	[0037.678] lstrlenA (lpString="*.cer") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.p12") returned 0
	[0037.678] lstrlenA (lpString="*.p12") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pfx") returned 0
	[0037.678] lstrlenA (lpString="*.pfx") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.kwm") returned 0
	[0037.678] lstrlenA (lpString="*.kwm") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pwm") returned 0
	[0037.678] lstrlenA (lpString="*.pwm") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.1cd") returned 0
	[0037.678] lstrlenA (lpString="*.1cd") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.md") returned 0
	[0037.678] lstrlenA (lpString="*.md") returned 4
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mdf") returned 0
	[0037.678] lstrlenA (lpString="*.mdf") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.dbf") returned 0
	[0037.678] lstrlenA (lpString="*.dbf") returned 5
	[0037.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.odt") returned 0
	[0037.679] lstrlenA (lpString="*.odt") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.vob") returned 0
	[0037.679] lstrlenA (lpString="*.vob") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ifo") returned 0
	[0037.679] lstrlenA (lpString="*.ifo") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.lnk") returned 0
	[0037.679] lstrlenA (lpString="*.lnk") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.torrent") returned 0
	[0037.679] lstrlenA (lpString="*.torrent") returned 9
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mov") returned 0
	[0037.679] lstrlenA (lpString="*.mov") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.m2v") returned 0
	[0037.679] lstrlenA (lpString="*.m2v") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.3gp") returned 0
	[0037.679] lstrlenA (lpString="*.3gp") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpeg") returned 0
	[0037.679] lstrlenA (lpString="*.mpeg") returned 6
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpg") returned 0
	[0037.679] lstrlenA (lpString="*.mpg") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flv") returned 0
	[0037.679] lstrlenA (lpString="*.flv") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.avi") returned 0
	[0037.679] lstrlenA (lpString="*.avi") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp4") returned 0
	[0037.679] lstrlenA (lpString="*.mp4") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wmv") returned 0
	[0037.679] lstrlenA (lpString="*.wmv") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.divx") returned 0
	[0037.679] lstrlenA (lpString="*.divx") returned 6
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mkv") returned 0
	[0037.679] lstrlenA (lpString="*.mkv") returned 5
	[0037.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp3") returned 0
	[0037.679] lstrlenA (lpString="*.mp3") returned 5
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wav") returned 0
	[0037.680] lstrlenA (lpString="*.wav") returned 5
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flac") returned 0
	[0037.680] lstrlenA (lpString="*.flac") returned 6
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ape") returned 0
	[0037.680] lstrlenA (lpString="*.ape") returned 5
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wma") returned 0
	[0037.680] lstrlenA (lpString="*.wma") returned 5
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ac3") returned 0
	[0037.680] lstrlenA (lpString="*.ac3") returned 5
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.exe") returned 0
	[0037.680] lstrlenA (lpString="*.exe") returned 5
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.apk") returned 0
	[0037.680] lstrlenA (lpString="*.apk") returned 5
	[0037.680] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.680] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.680] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="setup.exe") returned -1
	[0037.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1
	[0037.680] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1
	[0037.680] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms"
	[0037.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.680] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.680] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.680] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.680] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.zip") returned 0
	[0037.680] lstrlenA (lpString="*.zip") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.rar") returned 0
	[0037.681] lstrlenA (lpString="*.rar") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.7z") returned 0
	[0037.681] lstrlenA (lpString="*.7z") returned 4
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.tar") returned 0
	[0037.681] lstrlenA (lpString="*.tar") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.gzip") returned 0
	[0037.681] lstrlenA (lpString="*.gzip") returned 6
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.jpg") returned 0
	[0037.681] lstrlenA (lpString="*.jpg") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.jpeg") returned 0
	[0037.681] lstrlenA (lpString="*.jpeg") returned 6
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.psd") returned 0
	[0037.681] lstrlenA (lpString="*.psd") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.cdr") returned 0
	[0037.681] lstrlenA (lpString="*.cdr") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.dwg") returned 0
	[0037.681] lstrlenA (lpString="*.dwg") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.max") returned 0
	[0037.681] lstrlenA (lpString="*.max") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.bmp") returned 0
	[0037.681] lstrlenA (lpString="*.bmp") returned 5
	[0037.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", pszSpec="*.gif") returned 0
	[0037.681] lstrlenA (lpString="*.gif") returned 5
	[0037.682] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.682] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe"
	[0037.682] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpString2="." | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe."
	[0037.682] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.", lpString2="Boom" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.Boom") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.Boom"
	[0037.682] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.683] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150578
	[0037.683] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeb7e7af0, dwHighDateTime=0x1cb04a9), lpLastAccessTime=0x407536*(dwLowDateTime=0xeb7e7af0, dwHighDateTime=0x1cb04a9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x49c691c0, dwHighDateTime=0x1d305eb)) returned 1
	[0037.683] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.683] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x150555, lpOverlapped=0x0) returned 1
	[0037.721] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe"
	[0037.727] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.727] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x150555, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x150555, lpOverlapped=0x0) returned 1
	[0037.734] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.734] CloseHandle (hObject=0x88) returned 1
	[0037.890] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.Boom" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.boom")) returned 1
	[0037.891] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.891] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.891] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1
	[0037.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1
	[0037.891] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1
	[0037.891] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe"
	[0037.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.891] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.891] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.891] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.891] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml"
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0
	[0037.891] lstrlenA (lpString="*.zip") returned 5
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0
	[0037.891] lstrlenA (lpString="*.rar") returned 5
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0
	[0037.891] lstrlenA (lpString="*.7z") returned 4
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0
	[0037.891] lstrlenA (lpString="*.tar") returned 5
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0
	[0037.891] lstrlenA (lpString="*.gzip") returned 6
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0
	[0037.891] lstrlenA (lpString="*.jpg") returned 5
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0
	[0037.891] lstrlenA (lpString="*.jpeg") returned 6
	[0037.891] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0
	[0037.891] lstrlenA (lpString="*.psd") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0
	[0037.892] lstrlenA (lpString="*.cdr") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0
	[0037.892] lstrlenA (lpString="*.dwg") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0
	[0037.892] lstrlenA (lpString="*.max") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0
	[0037.892] lstrlenA (lpString="*.bmp") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0
	[0037.892] lstrlenA (lpString="*.gif") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0
	[0037.892] lstrlenA (lpString="*.png") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0
	[0037.892] lstrlenA (lpString="*.doc") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0
	[0037.892] lstrlenA (lpString="*.docx") returned 6
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0
	[0037.892] lstrlenA (lpString="*.xls") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0
	[0037.892] lstrlenA (lpString="*.xlsx") returned 6
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0
	[0037.892] lstrlenA (lpString="*.ppt") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0
	[0037.892] lstrlenA (lpString="*.pptx") returned 6
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0
	[0037.892] lstrlenA (lpString="*.txt") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0
	[0037.892] lstrlenA (lpString="*.pdf") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0
	[0037.892] lstrlenA (lpString="*.djvu") returned 6
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0
	[0037.892] lstrlenA (lpString="*.htm") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0
	[0037.892] lstrlenA (lpString="*.html") returned 6
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0
	[0037.892] lstrlenA (lpString="*.mdb") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0
	[0037.892] lstrlenA (lpString="*.cer") returned 5
	[0037.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0
	[0037.892] lstrlenA (lpString="*.p12") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0
	[0037.893] lstrlenA (lpString="*.pfx") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0
	[0037.893] lstrlenA (lpString="*.kwm") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0
	[0037.893] lstrlenA (lpString="*.pwm") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0
	[0037.893] lstrlenA (lpString="*.1cd") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0
	[0037.893] lstrlenA (lpString="*.md") returned 4
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0
	[0037.893] lstrlenA (lpString="*.mdf") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0
	[0037.893] lstrlenA (lpString="*.dbf") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0
	[0037.893] lstrlenA (lpString="*.odt") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0
	[0037.893] lstrlenA (lpString="*.vob") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0
	[0037.893] lstrlenA (lpString="*.ifo") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0
	[0037.893] lstrlenA (lpString="*.lnk") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0
	[0037.893] lstrlenA (lpString="*.torrent") returned 9
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0
	[0037.893] lstrlenA (lpString="*.mov") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0
	[0037.893] lstrlenA (lpString="*.m2v") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0
	[0037.893] lstrlenA (lpString="*.3gp") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0
	[0037.893] lstrlenA (lpString="*.mpeg") returned 6
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0
	[0037.893] lstrlenA (lpString="*.mpg") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0
	[0037.893] lstrlenA (lpString="*.flv") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0
	[0037.893] lstrlenA (lpString="*.avi") returned 5
	[0037.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0
	[0037.894] lstrlenA (lpString="*.mp4") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0
	[0037.894] lstrlenA (lpString="*.wmv") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0
	[0037.894] lstrlenA (lpString="*.divx") returned 6
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0
	[0037.894] lstrlenA (lpString="*.mkv") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0
	[0037.894] lstrlenA (lpString="*.mp3") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0
	[0037.894] lstrlenA (lpString="*.wav") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0
	[0037.894] lstrlenA (lpString="*.flac") returned 6
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0
	[0037.894] lstrlenA (lpString="*.ape") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0
	[0037.894] lstrlenA (lpString="*.wma") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0
	[0037.894] lstrlenA (lpString="*.ac3") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.exe") returned 0
	[0037.894] lstrlenA (lpString="*.exe") returned 5
	[0037.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.apk") returned 0
	[0037.894] lstrlenA (lpString="*.apk") returned 5
	[0037.894] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.894] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.894] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisiorWW.cab") returned -1
	[0037.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisiorWW.cab") returned -1
	[0037.894] lstrcmpiA (lpString1="", lpString2="VisiorWW.cab") returned -1
	[0037.894] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml"
	[0037.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.894] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.894] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.894] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.894] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab"
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.zip") returned 0
	[0037.895] lstrlenA (lpString="*.zip") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.rar") returned 0
	[0037.895] lstrlenA (lpString="*.rar") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.7z") returned 0
	[0037.895] lstrlenA (lpString="*.7z") returned 4
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.tar") returned 0
	[0037.895] lstrlenA (lpString="*.tar") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.gzip") returned 0
	[0037.895] lstrlenA (lpString="*.gzip") returned 6
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.jpg") returned 0
	[0037.895] lstrlenA (lpString="*.jpg") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.jpeg") returned 0
	[0037.895] lstrlenA (lpString="*.jpeg") returned 6
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.psd") returned 0
	[0037.895] lstrlenA (lpString="*.psd") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.cdr") returned 0
	[0037.895] lstrlenA (lpString="*.cdr") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.dwg") returned 0
	[0037.895] lstrlenA (lpString="*.dwg") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.max") returned 0
	[0037.895] lstrlenA (lpString="*.max") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.bmp") returned 0
	[0037.895] lstrlenA (lpString="*.bmp") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.gif") returned 0
	[0037.895] lstrlenA (lpString="*.gif") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.png") returned 0
	[0037.895] lstrlenA (lpString="*.png") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.doc") returned 0
	[0037.895] lstrlenA (lpString="*.doc") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.docx") returned 0
	[0037.895] lstrlenA (lpString="*.docx") returned 6
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.xls") returned 0
	[0037.895] lstrlenA (lpString="*.xls") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.xlsx") returned 0
	[0037.895] lstrlenA (lpString="*.xlsx") returned 6
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.ppt") returned 0
	[0037.895] lstrlenA (lpString="*.ppt") returned 5
	[0037.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.pptx") returned 0
	[0037.896] lstrlenA (lpString="*.pptx") returned 6
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.txt") returned 0
	[0037.896] lstrlenA (lpString="*.txt") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.pdf") returned 0
	[0037.896] lstrlenA (lpString="*.pdf") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.djvu") returned 0
	[0037.896] lstrlenA (lpString="*.djvu") returned 6
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.htm") returned 0
	[0037.896] lstrlenA (lpString="*.htm") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.html") returned 0
	[0037.896] lstrlenA (lpString="*.html") returned 6
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mdb") returned 0
	[0037.896] lstrlenA (lpString="*.mdb") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.cer") returned 0
	[0037.896] lstrlenA (lpString="*.cer") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.p12") returned 0
	[0037.896] lstrlenA (lpString="*.p12") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.pfx") returned 0
	[0037.896] lstrlenA (lpString="*.pfx") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.kwm") returned 0
	[0037.896] lstrlenA (lpString="*.kwm") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.pwm") returned 0
	[0037.896] lstrlenA (lpString="*.pwm") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.1cd") returned 0
	[0037.896] lstrlenA (lpString="*.1cd") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.md") returned 0
	[0037.896] lstrlenA (lpString="*.md") returned 4
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mdf") returned 0
	[0037.896] lstrlenA (lpString="*.mdf") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.dbf") returned 0
	[0037.896] lstrlenA (lpString="*.dbf") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.odt") returned 0
	[0037.896] lstrlenA (lpString="*.odt") returned 5
	[0037.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.vob") returned 0
	[0037.896] lstrlenA (lpString="*.vob") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.ifo") returned 0
	[0037.897] lstrlenA (lpString="*.ifo") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.lnk") returned 0
	[0037.897] lstrlenA (lpString="*.lnk") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.torrent") returned 0
	[0037.897] lstrlenA (lpString="*.torrent") returned 9
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mov") returned 0
	[0037.897] lstrlenA (lpString="*.mov") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.m2v") returned 0
	[0037.897] lstrlenA (lpString="*.m2v") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.3gp") returned 0
	[0037.897] lstrlenA (lpString="*.3gp") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mpeg") returned 0
	[0037.897] lstrlenA (lpString="*.mpeg") returned 6
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mpg") returned 0
	[0037.897] lstrlenA (lpString="*.mpg") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.flv") returned 0
	[0037.897] lstrlenA (lpString="*.flv") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.avi") returned 0
	[0037.897] lstrlenA (lpString="*.avi") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mp4") returned 0
	[0037.897] lstrlenA (lpString="*.mp4") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.wmv") returned 0
	[0037.897] lstrlenA (lpString="*.wmv") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.divx") returned 0
	[0037.897] lstrlenA (lpString="*.divx") returned 6
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mkv") returned 0
	[0037.897] lstrlenA (lpString="*.mkv") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.mp3") returned 0
	[0037.897] lstrlenA (lpString="*.mp3") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.wav") returned 0
	[0037.897] lstrlenA (lpString="*.wav") returned 5
	[0037.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.flac") returned 0
	[0037.897] lstrlenA (lpString="*.flac") returned 6
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.ape") returned 0
	[0037.898] lstrlenA (lpString="*.ape") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.wma") returned 0
	[0037.898] lstrlenA (lpString="*.wma") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.ac3") returned 0
	[0037.898] lstrlenA (lpString="*.ac3") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.exe") returned 0
	[0037.898] lstrlenA (lpString="*.exe") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", pszSpec="*.apk") returned 0
	[0037.898] lstrlenA (lpString="*.apk") returned 5
	[0037.898] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.898] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.898] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisiorWW.msi") returned -1
	[0037.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisiorWW.msi") returned -1
	[0037.898] lstrcmpiA (lpString1="", lpString2="VisiorWW.msi") returned -1
	[0037.898] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="VisiorWW.cab"
	[0037.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.898] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.898] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.898] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.898] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi"
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.zip") returned 0
	[0037.898] lstrlenA (lpString="*.zip") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.rar") returned 0
	[0037.898] lstrlenA (lpString="*.rar") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.7z") returned 0
	[0037.898] lstrlenA (lpString="*.7z") returned 4
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.tar") returned 0
	[0037.898] lstrlenA (lpString="*.tar") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.gzip") returned 0
	[0037.898] lstrlenA (lpString="*.gzip") returned 6
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.jpg") returned 0
	[0037.898] lstrlenA (lpString="*.jpg") returned 5
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.jpeg") returned 0
	[0037.898] lstrlenA (lpString="*.jpeg") returned 6
	[0037.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.psd") returned 0
	[0037.899] lstrlenA (lpString="*.psd") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.cdr") returned 0
	[0037.899] lstrlenA (lpString="*.cdr") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.dwg") returned 0
	[0037.899] lstrlenA (lpString="*.dwg") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.max") returned 0
	[0037.899] lstrlenA (lpString="*.max") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.bmp") returned 0
	[0037.899] lstrlenA (lpString="*.bmp") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.gif") returned 0
	[0037.899] lstrlenA (lpString="*.gif") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.png") returned 0
	[0037.899] lstrlenA (lpString="*.png") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.doc") returned 0
	[0037.899] lstrlenA (lpString="*.doc") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.docx") returned 0
	[0037.899] lstrlenA (lpString="*.docx") returned 6
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.xls") returned 0
	[0037.899] lstrlenA (lpString="*.xls") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.xlsx") returned 0
	[0037.899] lstrlenA (lpString="*.xlsx") returned 6
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.ppt") returned 0
	[0037.899] lstrlenA (lpString="*.ppt") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.pptx") returned 0
	[0037.899] lstrlenA (lpString="*.pptx") returned 6
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.txt") returned 0
	[0037.899] lstrlenA (lpString="*.txt") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.pdf") returned 0
	[0037.899] lstrlenA (lpString="*.pdf") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.djvu") returned 0
	[0037.899] lstrlenA (lpString="*.djvu") returned 6
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.htm") returned 0
	[0037.899] lstrlenA (lpString="*.htm") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.html") returned 0
	[0037.899] lstrlenA (lpString="*.html") returned 6
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mdb") returned 0
	[0037.899] lstrlenA (lpString="*.mdb") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.cer") returned 0
	[0037.899] lstrlenA (lpString="*.cer") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.p12") returned 0
	[0037.899] lstrlenA (lpString="*.p12") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.pfx") returned 0
	[0037.899] lstrlenA (lpString="*.pfx") returned 5
	[0037.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.kwm") returned 0
	[0037.899] lstrlenA (lpString="*.kwm") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.pwm") returned 0
	[0037.900] lstrlenA (lpString="*.pwm") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.1cd") returned 0
	[0037.900] lstrlenA (lpString="*.1cd") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.md") returned 0
	[0037.900] lstrlenA (lpString="*.md") returned 4
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mdf") returned 0
	[0037.900] lstrlenA (lpString="*.mdf") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.dbf") returned 0
	[0037.900] lstrlenA (lpString="*.dbf") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.odt") returned 0
	[0037.900] lstrlenA (lpString="*.odt") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.vob") returned 0
	[0037.900] lstrlenA (lpString="*.vob") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.ifo") returned 0
	[0037.900] lstrlenA (lpString="*.ifo") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.lnk") returned 0
	[0037.900] lstrlenA (lpString="*.lnk") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.torrent") returned 0
	[0037.900] lstrlenA (lpString="*.torrent") returned 9
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mov") returned 0
	[0037.900] lstrlenA (lpString="*.mov") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.m2v") returned 0
	[0037.900] lstrlenA (lpString="*.m2v") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.3gp") returned 0
	[0037.900] lstrlenA (lpString="*.3gp") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mpeg") returned 0
	[0037.900] lstrlenA (lpString="*.mpeg") returned 6
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mpg") returned 0
	[0037.900] lstrlenA (lpString="*.mpg") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.flv") returned 0
	[0037.900] lstrlenA (lpString="*.flv") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.avi") returned 0
	[0037.900] lstrlenA (lpString="*.avi") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mp4") returned 0
	[0037.900] lstrlenA (lpString="*.mp4") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.wmv") returned 0
	[0037.900] lstrlenA (lpString="*.wmv") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.divx") returned 0
	[0037.900] lstrlenA (lpString="*.divx") returned 6
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mkv") returned 0
	[0037.900] lstrlenA (lpString="*.mkv") returned 5
	[0037.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.mp3") returned 0
	[0037.900] lstrlenA (lpString="*.mp3") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.wav") returned 0
	[0037.901] lstrlenA (lpString="*.wav") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.flac") returned 0
	[0037.901] lstrlenA (lpString="*.flac") returned 6
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.ape") returned 0
	[0037.901] lstrlenA (lpString="*.ape") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.wma") returned 0
	[0037.901] lstrlenA (lpString="*.wma") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.ac3") returned 0
	[0037.901] lstrlenA (lpString="*.ac3") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.exe") returned 0
	[0037.901] lstrlenA (lpString="*.exe") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", pszSpec="*.apk") returned 0
	[0037.901] lstrlenA (lpString="*.apk") returned 5
	[0037.901] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.901] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.901] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisiorWW.xml") returned -1
	[0037.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisiorWW.xml") returned -1
	[0037.901] lstrcmpiA (lpString1="", lpString2="VisiorWW.xml") returned -1
	[0037.901] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned="VisiorWW.msi"
	[0037.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\"
	[0037.901] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned=""
	[0037.901] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt"
	[0037.901] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020
	[0037.901] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml"
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.zip") returned 0
	[0037.901] lstrlenA (lpString="*.zip") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.rar") returned 0
	[0037.901] lstrlenA (lpString="*.rar") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.7z") returned 0
	[0037.901] lstrlenA (lpString="*.7z") returned 4
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.tar") returned 0
	[0037.901] lstrlenA (lpString="*.tar") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.gzip") returned 0
	[0037.901] lstrlenA (lpString="*.gzip") returned 6
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.jpg") returned 0
	[0037.901] lstrlenA (lpString="*.jpg") returned 5
	[0037.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.jpeg") returned 0
	[0037.901] lstrlenA (lpString="*.jpeg") returned 6
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.psd") returned 0
	[0037.902] lstrlenA (lpString="*.psd") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.cdr") returned 0
	[0037.902] lstrlenA (lpString="*.cdr") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.dwg") returned 0
	[0037.902] lstrlenA (lpString="*.dwg") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.max") returned 0
	[0037.902] lstrlenA (lpString="*.max") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.bmp") returned 0
	[0037.902] lstrlenA (lpString="*.bmp") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.gif") returned 0
	[0037.902] lstrlenA (lpString="*.gif") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.png") returned 0
	[0037.902] lstrlenA (lpString="*.png") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.doc") returned 0
	[0037.902] lstrlenA (lpString="*.doc") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.docx") returned 0
	[0037.902] lstrlenA (lpString="*.docx") returned 6
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.xls") returned 0
	[0037.902] lstrlenA (lpString="*.xls") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.xlsx") returned 0
	[0037.902] lstrlenA (lpString="*.xlsx") returned 6
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.ppt") returned 0
	[0037.902] lstrlenA (lpString="*.ppt") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.pptx") returned 0
	[0037.902] lstrlenA (lpString="*.pptx") returned 6
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.txt") returned 0
	[0037.902] lstrlenA (lpString="*.txt") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.pdf") returned 0
	[0037.902] lstrlenA (lpString="*.pdf") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.djvu") returned 0
	[0037.902] lstrlenA (lpString="*.djvu") returned 6
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.htm") returned 0
	[0037.902] lstrlenA (lpString="*.htm") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.html") returned 0
	[0037.902] lstrlenA (lpString="*.html") returned 6
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mdb") returned 0
	[0037.902] lstrlenA (lpString="*.mdb") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.cer") returned 0
	[0037.902] lstrlenA (lpString="*.cer") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.p12") returned 0
	[0037.902] lstrlenA (lpString="*.p12") returned 5
	[0037.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.pfx") returned 0
	[0037.902] lstrlenA (lpString="*.pfx") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.kwm") returned 0
	[0037.903] lstrlenA (lpString="*.kwm") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.pwm") returned 0
	[0037.903] lstrlenA (lpString="*.pwm") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.1cd") returned 0
	[0037.903] lstrlenA (lpString="*.1cd") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.md") returned 0
	[0037.903] lstrlenA (lpString="*.md") returned 4
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mdf") returned 0
	[0037.903] lstrlenA (lpString="*.mdf") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.dbf") returned 0
	[0037.903] lstrlenA (lpString="*.dbf") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.odt") returned 0
	[0037.903] lstrlenA (lpString="*.odt") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.vob") returned 0
	[0037.903] lstrlenA (lpString="*.vob") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.ifo") returned 0
	[0037.903] lstrlenA (lpString="*.ifo") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.lnk") returned 0
	[0037.903] lstrlenA (lpString="*.lnk") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.torrent") returned 0
	[0037.903] lstrlenA (lpString="*.torrent") returned 9
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mov") returned 0
	[0037.903] lstrlenA (lpString="*.mov") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.m2v") returned 0
	[0037.903] lstrlenA (lpString="*.m2v") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.3gp") returned 0
	[0037.903] lstrlenA (lpString="*.3gp") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mpeg") returned 0
	[0037.903] lstrlenA (lpString="*.mpeg") returned 6
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mpg") returned 0
	[0037.903] lstrlenA (lpString="*.mpg") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.flv") returned 0
	[0037.903] lstrlenA (lpString="*.flv") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.avi") returned 0
	[0037.903] lstrlenA (lpString="*.avi") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mp4") returned 0
	[0037.903] lstrlenA (lpString="*.mp4") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.wmv") returned 0
	[0037.903] lstrlenA (lpString="*.wmv") returned 5
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.divx") returned 0
	[0037.903] lstrlenA (lpString="*.divx") returned 6
	[0037.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mkv") returned 0
	[0037.904] lstrlenA (lpString="*.mkv") returned 5
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.mp3") returned 0
	[0037.904] lstrlenA (lpString="*.mp3") returned 5
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.wav") returned 0
	[0037.904] lstrlenA (lpString="*.wav") returned 5
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.flac") returned 0
	[0037.904] lstrlenA (lpString="*.flac") returned 6
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.ape") returned 0
	[0037.904] lstrlenA (lpString="*.ape") returned 5
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.wma") returned 0
	[0037.904] lstrlenA (lpString="*.wma") returned 5
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.ac3") returned 0
	[0037.904] lstrlenA (lpString="*.ac3") returned 5
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.exe") returned 0
	[0037.904] lstrlenA (lpString="*.exe") returned 5
	[0037.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", pszSpec="*.apk") returned 0
	[0037.904] lstrlenA (lpString="*.apk") returned 5
	[0037.904] FindNextFileA (in: hFindFile=0x8b6e08, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.904] FindClose (in: hFindFile=0x8b6e08 | out: hFindFile=0x8b6e08) returned 1
	[0037.904] FindNextFileA (in: hFindFile=0x8b6e48, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0037.904] FindClose (in: hFindFile=0x8b6e48 | out: hFindFile=0x8b6e48) returned 1
	[0037.904] FindNextFileA (in: hFindFile=0x8b5dc0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0
	[0037.904] FindClose (in: hFindFile=0x8b5dc0 | out: hFindFile=0x8b5dc0) returned 1
	[0037.904] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0037.904] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0
	[0037.905] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pagefile.sys") returned -1
	[0037.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pagefile.sys") returned -1
	[0037.905] lstrcmpiA (lpString1="", lpString2="pagefile.sys") returned -1
	[0037.905] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0037.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0037.905] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned=""
	[0037.905] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt"
	[0037.905] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20
	[0037.905] lstrcatA (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys"
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.zip") returned 0
	[0037.905] lstrlenA (lpString="*.zip") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.rar") returned 0
	[0037.905] lstrlenA (lpString="*.rar") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.7z") returned 0
	[0037.905] lstrlenA (lpString="*.7z") returned 4
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.tar") returned 0
	[0037.905] lstrlenA (lpString="*.tar") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.gzip") returned 0
	[0037.905] lstrlenA (lpString="*.gzip") returned 6
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.jpg") returned 0
	[0037.905] lstrlenA (lpString="*.jpg") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.jpeg") returned 0
	[0037.905] lstrlenA (lpString="*.jpeg") returned 6
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.psd") returned 0
	[0037.905] lstrlenA (lpString="*.psd") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.cdr") returned 0
	[0037.905] lstrlenA (lpString="*.cdr") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.dwg") returned 0
	[0037.905] lstrlenA (lpString="*.dwg") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.max") returned 0
	[0037.905] lstrlenA (lpString="*.max") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.bmp") returned 0
	[0037.905] lstrlenA (lpString="*.bmp") returned 5
	[0037.905] PathMatchSpecA (pszFile="C:\\pagefile.sys", pszSpec="*.gif") returned 0
	[0037.905] lstrlenA (lpString="*.gif") returned 5
	[0037.906] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0037.906] lstrcmpA (lpString1=".", lpString2="PerfLogs") returned -1
	[0037.906] lstrcmpA (lpString1="..", lpString2="PerfLogs") returned -1
	[0037.906] PathFindFileNameA (pszPath="C:\\pagefile.sys") returned="pagefile.sys"
	[0037.906] lstrcatA (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs"
	[0037.906] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b9298
	[0037.906] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.906] FindNextFileA (in: hFindFile=0x8b9298, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0037.906] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.906] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.906] FindNextFileA (in: hFindFile=0x8b9298, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0037.906] lstrcmpA (lpString1=".", lpString2="Admin") returned -1
	[0037.906] lstrcmpA (lpString1="..", lpString2="Admin") returned -1
	[0037.906] PathFindFileNameA (pszPath="C:\\PerfLogs\\*.*") returned="*.*"
	[0037.906] lstrcatA (in: lpString1="C:\\PerfLogs\\", lpString2="Admin" | out: lpString1="C:\\PerfLogs\\Admin") returned="C:\\PerfLogs\\Admin"
	[0037.906] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8ba318
	[0037.906] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.907] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.907] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.907] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.907] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0037.907] FindClose (in: hFindFile=0x8ba318 | out: hFindFile=0x8ba318) returned 1
	[0037.907] FindNextFileA (in: hFindFile=0x8b9298, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0
	[0037.907] FindClose (in: hFindFile=0x8b9298 | out: hFindFile=0x8b9298) returned 1
	[0037.907] FindNextFileA (in: hFindFile=0x8b0d68, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38) returned 1
	[0037.907] lstrcmpA (lpString1=".", lpString2="Program Files") returned -1
	[0037.907] lstrcmpA (lpString1="..", lpString2="Program Files") returned -1
	[0037.907] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*"
	[0037.907] lstrcatA (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files"
	[0037.907] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b92d0
	[0037.907] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.907] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0037.907] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.907] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.907] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0037.907] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1
	[0037.907] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1
	[0037.907] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0037.907] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Common Files" | out: lpString1="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files"
	[0037.907] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8ba368
	[0037.907] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.907] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.907] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.907] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.908] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.908] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0037.908] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="correspondence_berlin_nfl.exe") returned 1
	[0037.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="correspondence_berlin_nfl.exe") returned 1
	[0037.908] lstrcmpiA (lpString1="", lpString2="correspondence_berlin_nfl.exe") returned -1
	[0037.908] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0037.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\"
	[0037.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned=""
	[0037.908] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt"
	[0037.908] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt")) returned 0xffffffff
	[0037.908] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0037.911] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.911] CloseHandle (hObject=0x84) returned 1
	[0037.911] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="correspondence_berlin_nfl.exe" | out: lpString1="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe") returned="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe"
	[0037.912] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe" | out: lpString1="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe") returned="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe"
	[0037.912] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe" | out: lpString1="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe") returned="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe"
	[0037.912] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe.") returned="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe."
	[0037.912] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe.Boom") returned="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe.Boom"
	[0037.912] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe" (normalized: "c:\\program files\\common files\\correspondence_berlin_nfl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.912] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.912] lstrcmpA (lpString1=".", lpString2="DESIGNER") returned -1
	[0037.912] lstrcmpA (lpString1="..", lpString2="DESIGNER") returned -1
	[0037.912] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\correspondence_berlin_nfl.exe") returned="correspondence_berlin_nfl.exe"
	[0037.912] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="DESIGNER" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER"
	[0037.912] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8ba318
	[0037.912] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.912] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.912] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.912] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.912] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.912] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0037.913] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSADDNDR.DLL") returned -1
	[0037.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSADDNDR.DLL") returned -1
	[0037.913] lstrcmpiA (lpString1="", lpString2="MSADDNDR.DLL") returned -1
	[0037.913] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned="*.*"
	[0037.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\"
	[0037.913] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\" | out: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\") returned=""
	[0037.913] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt"
	[0037.913] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\designer\\how to decrypt files.txt")) returned 0xffffffff
	[0037.913] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\designer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0037.914] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.914] CloseHandle (hObject=0x88) returned 1
	[0037.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="MSADDNDR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL"
	[0037.914] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0037.914] FindClose (in: hFindFile=0x8ba318 | out: hFindFile=0x8ba318) returned 1
	[0037.914] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.914] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0037.914] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="dubai.exe") returned 1
	[0037.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dubai.exe") returned 1
	[0037.914] lstrcmpiA (lpString1="", lpString2="dubai.exe") returned -1
	[0037.914] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0037.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\"
	[0037.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned=""
	[0037.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt"
	[0037.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt")) returned 0x20
	[0037.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="dubai.exe" | out: lpString1="C:\\Program Files\\Common Files\\dubai.exe") returned="C:\\Program Files\\Common Files\\dubai.exe"
	[0037.914] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\dubai.exe" | out: lpString1="C:\\Program Files\\Common Files\\dubai.exe") returned="C:\\Program Files\\Common Files\\dubai.exe"
	[0037.915] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\dubai.exe" | out: lpString1="C:\\Program Files\\Common Files\\dubai.exe") returned="C:\\Program Files\\Common Files\\dubai.exe"
	[0037.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\dubai.exe", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\dubai.exe.") returned="C:\\Program Files\\Common Files\\dubai.exe."
	[0037.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\dubai.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\dubai.exe.Boom") returned="C:\\Program Files\\Common Files\\dubai.exe.Boom"
	[0037.915] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\dubai.exe" (normalized: "c:\\program files\\common files\\dubai.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.915] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0037.915] lstrcmpA (lpString1=".", lpString2="Microsoft Shared") returned -1
	[0037.915] lstrcmpA (lpString1="..", lpString2="Microsoft Shared") returned -1
	[0037.915] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\dubai.exe") returned="dubai.exe"
	[0037.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="Microsoft Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared"
	[0037.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8ba318
	[0037.915] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.915] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.915] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.915] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.915] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0037.915] lstrcmpA (lpString1=".", lpString2="DW") returned -1
	[0037.915] lstrcmpA (lpString1="..", lpString2="DW") returned -1
	[0037.915] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0037.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="DW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW"
	[0037.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba420
	[0037.927] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0037.927] FindNextFileA (in: hFindFile=0x8ba420, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.927] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0037.927] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0037.927] FindNextFileA (in: hFindFile=0x8ba420, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.927] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.927] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DBGHELP.DLL") returned 1
	[0037.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBGHELP.DLL") returned 1
	[0037.927] lstrcmpiA (lpString1="", lpString2="DBGHELP.DLL") returned -1
	[0037.927] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*") returned="*.*"
	[0037.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\"
	[0037.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned=""
	[0037.927] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt"
	[0037.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt")) returned 0xffffffff
	[0037.927] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0037.928] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0037.928] CloseHandle (hObject=0x8c) returned 1
	[0037.929] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DBGHELP.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL"
	[0037.929] FindNextFileA (in: hFindFile=0x8ba420, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.929] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.929] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DW20.EXE") returned 1
	[0037.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DW20.EXE") returned 1
	[0037.929] lstrcmpiA (lpString1="", lpString2="DW20.EXE") returned -1
	[0037.929] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned="DBGHELP.DLL"
	[0037.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\"
	[0037.929] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned=""
	[0037.929] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt"
	[0037.929] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt")) returned 0x20
	[0037.929] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DW20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE"
	[0037.929] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE"
	[0037.929] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE"
	[0037.929] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE."
	[0037.929] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.Boom"
	[0037.929] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0037.931] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2b88
	[0037.931] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2f8f7000, dwHighDateTime=0x1cba06d), lpLastAccessTime=0x407536*(dwLowDateTime=0xdb9ec040, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2f8f7000, dwHighDateTime=0x1cba06d)) returned 1
	[0037.931] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.931] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf2b65, lpOverlapped=0x0) returned 1
	[0037.961] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="DW20.EXE"
	[0037.964] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.964] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf2b65, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf2b65, lpOverlapped=0x0) returned 1
	[0037.968] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0037.968] CloseHandle (hObject=0x8c) returned 1
	[0037.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.boom")) returned 1
	[0037.975] FindNextFileA (in: hFindFile=0x8ba420, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0037.976] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0037.976] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DWTRIG20.EXE") returned 1
	[0037.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DWTRIG20.EXE") returned 1
	[0037.976] lstrcmpiA (lpString1="", lpString2="DWTRIG20.EXE") returned -1
	[0037.976] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="DW20.EXE"
	[0037.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\"
	[0037.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned=""
	[0037.976] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt"
	[0037.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt")) returned 0x20
	[0037.976] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DWTRIG20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE"
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.zip") returned 0
	[0037.976] lstrlenA (lpString="*.zip") returned 5
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.rar") returned 0
	[0037.976] lstrlenA (lpString="*.rar") returned 5
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.7z") returned 0
	[0037.976] lstrlenA (lpString="*.7z") returned 4
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.tar") returned 0
	[0037.976] lstrlenA (lpString="*.tar") returned 5
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.gzip") returned 0
	[0037.976] lstrlenA (lpString="*.gzip") returned 6
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.jpg") returned 0
	[0037.976] lstrlenA (lpString="*.jpg") returned 5
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.jpeg") returned 0
	[0037.976] lstrlenA (lpString="*.jpeg") returned 6
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.psd") returned 0
	[0037.976] lstrlenA (lpString="*.psd") returned 5
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.cdr") returned 0
	[0037.976] lstrlenA (lpString="*.cdr") returned 5
	[0037.976] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.dwg") returned 0
	[0037.976] lstrlenA (lpString="*.dwg") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.max") returned 0
	[0037.977] lstrlenA (lpString="*.max") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.bmp") returned 0
	[0037.977] lstrlenA (lpString="*.bmp") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.gif") returned 0
	[0037.977] lstrlenA (lpString="*.gif") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.png") returned 0
	[0037.977] lstrlenA (lpString="*.png") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.doc") returned 0
	[0037.977] lstrlenA (lpString="*.doc") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.docx") returned 0
	[0037.977] lstrlenA (lpString="*.docx") returned 6
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.xls") returned 0
	[0037.977] lstrlenA (lpString="*.xls") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.xlsx") returned 0
	[0037.977] lstrlenA (lpString="*.xlsx") returned 6
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.ppt") returned 0
	[0037.977] lstrlenA (lpString="*.ppt") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.pptx") returned 0
	[0037.977] lstrlenA (lpString="*.pptx") returned 6
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.txt") returned 0
	[0037.977] lstrlenA (lpString="*.txt") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.pdf") returned 0
	[0037.977] lstrlenA (lpString="*.pdf") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.djvu") returned 0
	[0037.977] lstrlenA (lpString="*.djvu") returned 6
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.htm") returned 0
	[0037.977] lstrlenA (lpString="*.htm") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.html") returned 0
	[0037.977] lstrlenA (lpString="*.html") returned 6
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mdb") returned 0
	[0037.977] lstrlenA (lpString="*.mdb") returned 5
	[0037.977] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.cer") returned 0
	[0037.977] lstrlenA (lpString="*.cer") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.p12") returned 0
	[0037.978] lstrlenA (lpString="*.p12") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.pfx") returned 0
	[0037.978] lstrlenA (lpString="*.pfx") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.kwm") returned 0
	[0037.978] lstrlenA (lpString="*.kwm") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.pwm") returned 0
	[0037.978] lstrlenA (lpString="*.pwm") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.1cd") returned 0
	[0037.978] lstrlenA (lpString="*.1cd") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.md") returned 0
	[0037.978] lstrlenA (lpString="*.md") returned 4
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mdf") returned 0
	[0037.978] lstrlenA (lpString="*.mdf") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.dbf") returned 0
	[0037.978] lstrlenA (lpString="*.dbf") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.odt") returned 0
	[0037.978] lstrlenA (lpString="*.odt") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.vob") returned 0
	[0037.978] lstrlenA (lpString="*.vob") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.ifo") returned 0
	[0037.978] lstrlenA (lpString="*.ifo") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.lnk") returned 0
	[0037.978] lstrlenA (lpString="*.lnk") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.torrent") returned 0
	[0037.978] lstrlenA (lpString="*.torrent") returned 9
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mov") returned 0
	[0037.978] lstrlenA (lpString="*.mov") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.m2v") returned 0
	[0037.978] lstrlenA (lpString="*.m2v") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.3gp") returned 0
	[0037.978] lstrlenA (lpString="*.3gp") returned 5
	[0037.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mpeg") returned 0
	[0037.979] lstrlenA (lpString="*.mpeg") returned 6
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mpg") returned 0
	[0037.979] lstrlenA (lpString="*.mpg") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.flv") returned 0
	[0037.979] lstrlenA (lpString="*.flv") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.avi") returned 0
	[0037.979] lstrlenA (lpString="*.avi") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mp4") returned 0
	[0037.979] lstrlenA (lpString="*.mp4") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.wmv") returned 0
	[0037.979] lstrlenA (lpString="*.wmv") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.divx") returned 0
	[0037.979] lstrlenA (lpString="*.divx") returned 6
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mkv") returned 0
	[0037.979] lstrlenA (lpString="*.mkv") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.mp3") returned 0
	[0037.979] lstrlenA (lpString="*.mp3") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.wav") returned 0
	[0037.979] lstrlenA (lpString="*.wav") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.flac") returned 0
	[0037.979] lstrlenA (lpString="*.flac") returned 6
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.ape") returned 0
	[0037.979] lstrlenA (lpString="*.ape") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.wma") returned 0
	[0037.979] lstrlenA (lpString="*.wma") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.ac3") returned 0
	[0037.979] lstrlenA (lpString="*.ac3") returned 5
	[0037.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", pszSpec="*.exe") returned 1
	[0037.979] lstrlenA (lpString="*.exe") returned 5
	[0037.979] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE"
	[0037.979] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE"
	[0037.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE."
	[0037.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.Boom"
	[0037.980] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0037.981] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99ba0
	[0037.981] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2e5e4300, dwHighDateTime=0x1cba06d), lpLastAccessTime=0x407536*(dwLowDateTime=0xdbe62980, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2e5e4300, dwHighDateTime=0x1cba06d)) returned 1
	[0037.981] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0037.981] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x99b7d, lpOverlapped=0x0) returned 1
	[0038.012] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned="DWTRIG20.EXE"
	[0038.014] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.014] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x99b7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x99b7d, lpOverlapped=0x0) returned 1
	[0038.016] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.017] CloseHandle (hObject=0x8c) returned 1
	[0038.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.boom")) returned 1
	[0038.023] FindNextFileA (in: hFindFile=0x8ba420, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0038.023] FindClose (in: hFindFile=0x8ba420 | out: hFindFile=0x8ba420) returned 1
	[0038.023] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0038.023] lstrcmpA (lpString1=".", lpString2="EQUATION") returned -1
	[0038.023] lstrcmpA (lpString1="..", lpString2="EQUATION") returned -1
	[0038.023] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0038.023] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="EQUATION" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION"
	[0038.023] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned 55
	[0038.023] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba3a8
	[0038.024] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.024] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.024] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.024] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.024] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.024] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0038.024] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0038.024] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*"
	[0038.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033"
	[0038.024] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033") returned 60
	[0038.024] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba3e8
	[0038.026] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.026] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.026] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.026] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.026] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.026] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EEINTL.DLL") returned -1
	[0038.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EEINTL.DLL") returned 1
	[0038.026] lstrcmpiA (lpString1="", lpString2="EEINTL.DLL") returned -1
	[0038.026] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*") returned="*.*"
	[0038.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\"
	[0038.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned=""
	[0038.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt"
	[0038.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0038.026] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.027] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.027] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.028] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.028] CloseHandle (hObject=0x90) returned 1
	[0038.028] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpString2="EEINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL"
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.zip") returned 0
	[0038.028] lstrlenA (lpString="*.zip") returned 5
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.rar") returned 0
	[0038.028] lstrlenA (lpString="*.rar") returned 5
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.7z") returned 0
	[0038.028] lstrlenA (lpString="*.7z") returned 4
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.tar") returned 0
	[0038.028] lstrlenA (lpString="*.tar") returned 5
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.gzip") returned 0
	[0038.028] lstrlenA (lpString="*.gzip") returned 6
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.jpg") returned 0
	[0038.028] lstrlenA (lpString="*.jpg") returned 5
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.jpeg") returned 0
	[0038.028] lstrlenA (lpString="*.jpeg") returned 6
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.psd") returned 0
	[0038.028] lstrlenA (lpString="*.psd") returned 5
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.cdr") returned 0
	[0038.028] lstrlenA (lpString="*.cdr") returned 5
	[0038.028] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.dwg") returned 0
	[0038.028] lstrlenA (lpString="*.dwg") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.max") returned 0
	[0038.029] lstrlenA (lpString="*.max") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.bmp") returned 0
	[0038.029] lstrlenA (lpString="*.bmp") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.gif") returned 0
	[0038.029] lstrlenA (lpString="*.gif") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.png") returned 0
	[0038.029] lstrlenA (lpString="*.png") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.doc") returned 0
	[0038.029] lstrlenA (lpString="*.doc") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.docx") returned 0
	[0038.029] lstrlenA (lpString="*.docx") returned 6
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.xls") returned 0
	[0038.029] lstrlenA (lpString="*.xls") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.xlsx") returned 0
	[0038.029] lstrlenA (lpString="*.xlsx") returned 6
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.ppt") returned 0
	[0038.029] lstrlenA (lpString="*.ppt") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.pptx") returned 0
	[0038.029] lstrlenA (lpString="*.pptx") returned 6
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.txt") returned 0
	[0038.029] lstrlenA (lpString="*.txt") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.pdf") returned 0
	[0038.029] lstrlenA (lpString="*.pdf") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.djvu") returned 0
	[0038.029] lstrlenA (lpString="*.djvu") returned 6
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.htm") returned 0
	[0038.029] lstrlenA (lpString="*.htm") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.html") returned 0
	[0038.029] lstrlenA (lpString="*.html") returned 6
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mdb") returned 0
	[0038.029] lstrlenA (lpString="*.mdb") returned 5
	[0038.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.cer") returned 0
	[0038.029] lstrlenA (lpString="*.cer") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.p12") returned 0
	[0038.030] lstrlenA (lpString="*.p12") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.pfx") returned 0
	[0038.030] lstrlenA (lpString="*.pfx") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.kwm") returned 0
	[0038.030] lstrlenA (lpString="*.kwm") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.pwm") returned 0
	[0038.030] lstrlenA (lpString="*.pwm") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.1cd") returned 0
	[0038.030] lstrlenA (lpString="*.1cd") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.md") returned 0
	[0038.030] lstrlenA (lpString="*.md") returned 4
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mdf") returned 0
	[0038.030] lstrlenA (lpString="*.mdf") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.dbf") returned 0
	[0038.030] lstrlenA (lpString="*.dbf") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.odt") returned 0
	[0038.030] lstrlenA (lpString="*.odt") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.vob") returned 0
	[0038.030] lstrlenA (lpString="*.vob") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.ifo") returned 0
	[0038.030] lstrlenA (lpString="*.ifo") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.lnk") returned 0
	[0038.030] lstrlenA (lpString="*.lnk") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.torrent") returned 0
	[0038.030] lstrlenA (lpString="*.torrent") returned 9
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mov") returned 0
	[0038.030] lstrlenA (lpString="*.mov") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.m2v") returned 0
	[0038.030] lstrlenA (lpString="*.m2v") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.3gp") returned 0
	[0038.030] lstrlenA (lpString="*.3gp") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mpeg") returned 0
	[0038.030] lstrlenA (lpString="*.mpeg") returned 6
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mpg") returned 0
	[0038.030] lstrlenA (lpString="*.mpg") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.flv") returned 0
	[0038.030] lstrlenA (lpString="*.flv") returned 5
	[0038.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.avi") returned 0
	[0038.031] lstrlenA (lpString="*.avi") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mp4") returned 0
	[0038.031] lstrlenA (lpString="*.mp4") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.wmv") returned 0
	[0038.031] lstrlenA (lpString="*.wmv") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.divx") returned 0
	[0038.031] lstrlenA (lpString="*.divx") returned 6
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mkv") returned 0
	[0038.031] lstrlenA (lpString="*.mkv") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.mp3") returned 0
	[0038.031] lstrlenA (lpString="*.mp3") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.wav") returned 0
	[0038.031] lstrlenA (lpString="*.wav") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.flac") returned 0
	[0038.031] lstrlenA (lpString="*.flac") returned 6
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.ape") returned 0
	[0038.031] lstrlenA (lpString="*.ape") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.wma") returned 0
	[0038.031] lstrlenA (lpString="*.wma") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.ac3") returned 0
	[0038.031] lstrlenA (lpString="*.ac3") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.exe") returned 0
	[0038.031] lstrlenA (lpString="*.exe") returned 5
	[0038.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", pszSpec="*.apk") returned 0
	[0038.031] lstrlenA (lpString="*.apk") returned 5
	[0038.031] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.031] FindClose (in: hFindFile=0x8ba3e8 | out: hFindFile=0x8ba3e8) returned 1
	[0038.031] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.031] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.031] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EQNEDT32.CNT") returned -1
	[0038.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EQNEDT32.CNT") returned 1
	[0038.031] lstrcmpiA (lpString1="", lpString2="EQNEDT32.CNT") returned -1
	[0038.031] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*"
	[0038.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\"
	[0038.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned=""
	[0038.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt"
	[0038.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0xffffffff
	[0038.032] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.033] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.033] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.033] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.034] CloseHandle (hObject=0x8c) returned 1
	[0038.034] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.CNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT"
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.zip") returned 0
	[0038.034] lstrlenA (lpString="*.zip") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.rar") returned 0
	[0038.034] lstrlenA (lpString="*.rar") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.7z") returned 0
	[0038.034] lstrlenA (lpString="*.7z") returned 4
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.tar") returned 0
	[0038.034] lstrlenA (lpString="*.tar") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.gzip") returned 0
	[0038.034] lstrlenA (lpString="*.gzip") returned 6
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.jpg") returned 0
	[0038.034] lstrlenA (lpString="*.jpg") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.jpeg") returned 0
	[0038.034] lstrlenA (lpString="*.jpeg") returned 6
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.psd") returned 0
	[0038.034] lstrlenA (lpString="*.psd") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.cdr") returned 0
	[0038.034] lstrlenA (lpString="*.cdr") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.dwg") returned 0
	[0038.034] lstrlenA (lpString="*.dwg") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.max") returned 0
	[0038.034] lstrlenA (lpString="*.max") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.bmp") returned 0
	[0038.034] lstrlenA (lpString="*.bmp") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.gif") returned 0
	[0038.034] lstrlenA (lpString="*.gif") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.png") returned 0
	[0038.034] lstrlenA (lpString="*.png") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.doc") returned 0
	[0038.034] lstrlenA (lpString="*.doc") returned 5
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.docx") returned 0
	[0038.034] lstrlenA (lpString="*.docx") returned 6
	[0038.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.xls") returned 0
	[0038.035] lstrlenA (lpString="*.xls") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.xlsx") returned 0
	[0038.035] lstrlenA (lpString="*.xlsx") returned 6
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.ppt") returned 0
	[0038.035] lstrlenA (lpString="*.ppt") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.pptx") returned 0
	[0038.035] lstrlenA (lpString="*.pptx") returned 6
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.txt") returned 0
	[0038.035] lstrlenA (lpString="*.txt") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.pdf") returned 0
	[0038.035] lstrlenA (lpString="*.pdf") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.djvu") returned 0
	[0038.035] lstrlenA (lpString="*.djvu") returned 6
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.htm") returned 0
	[0038.035] lstrlenA (lpString="*.htm") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.html") returned 0
	[0038.035] lstrlenA (lpString="*.html") returned 6
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mdb") returned 0
	[0038.035] lstrlenA (lpString="*.mdb") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.cer") returned 0
	[0038.035] lstrlenA (lpString="*.cer") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.p12") returned 0
	[0038.035] lstrlenA (lpString="*.p12") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.pfx") returned 0
	[0038.035] lstrlenA (lpString="*.pfx") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.kwm") returned 0
	[0038.035] lstrlenA (lpString="*.kwm") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.pwm") returned 0
	[0038.035] lstrlenA (lpString="*.pwm") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.1cd") returned 0
	[0038.035] lstrlenA (lpString="*.1cd") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.md") returned 0
	[0038.035] lstrlenA (lpString="*.md") returned 4
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mdf") returned 0
	[0038.035] lstrlenA (lpString="*.mdf") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.dbf") returned 0
	[0038.035] lstrlenA (lpString="*.dbf") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.odt") returned 0
	[0038.035] lstrlenA (lpString="*.odt") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.vob") returned 0
	[0038.035] lstrlenA (lpString="*.vob") returned 5
	[0038.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.ifo") returned 0
	[0038.035] lstrlenA (lpString="*.ifo") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.lnk") returned 0
	[0038.036] lstrlenA (lpString="*.lnk") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.torrent") returned 0
	[0038.036] lstrlenA (lpString="*.torrent") returned 9
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mov") returned 0
	[0038.036] lstrlenA (lpString="*.mov") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.m2v") returned 0
	[0038.036] lstrlenA (lpString="*.m2v") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.3gp") returned 0
	[0038.036] lstrlenA (lpString="*.3gp") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mpeg") returned 0
	[0038.036] lstrlenA (lpString="*.mpeg") returned 6
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mpg") returned 0
	[0038.036] lstrlenA (lpString="*.mpg") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.flv") returned 0
	[0038.036] lstrlenA (lpString="*.flv") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.avi") returned 0
	[0038.036] lstrlenA (lpString="*.avi") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mp4") returned 0
	[0038.036] lstrlenA (lpString="*.mp4") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.wmv") returned 0
	[0038.036] lstrlenA (lpString="*.wmv") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.divx") returned 0
	[0038.036] lstrlenA (lpString="*.divx") returned 6
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mkv") returned 0
	[0038.036] lstrlenA (lpString="*.mkv") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.mp3") returned 0
	[0038.036] lstrlenA (lpString="*.mp3") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.wav") returned 0
	[0038.036] lstrlenA (lpString="*.wav") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.flac") returned 0
	[0038.036] lstrlenA (lpString="*.flac") returned 6
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.ape") returned 0
	[0038.036] lstrlenA (lpString="*.ape") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.wma") returned 0
	[0038.036] lstrlenA (lpString="*.wma") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.ac3") returned 0
	[0038.036] lstrlenA (lpString="*.ac3") returned 5
	[0038.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.exe") returned 0
	[0038.037] lstrlenA (lpString="*.exe") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", pszSpec="*.apk") returned 0
	[0038.037] lstrlenA (lpString="*.apk") returned 5
	[0038.037] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.037] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.037] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EQNEDT32.EXE") returned -1
	[0038.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EQNEDT32.EXE") returned 1
	[0038.037] lstrcmpiA (lpString1="", lpString2="EQNEDT32.EXE") returned -1
	[0038.037] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="EQNEDT32.CNT"
	[0038.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\"
	[0038.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned=""
	[0038.037] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt"
	[0038.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20
	[0038.037] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE"
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.zip") returned 0
	[0038.037] lstrlenA (lpString="*.zip") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.rar") returned 0
	[0038.037] lstrlenA (lpString="*.rar") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.7z") returned 0
	[0038.037] lstrlenA (lpString="*.7z") returned 4
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.tar") returned 0
	[0038.037] lstrlenA (lpString="*.tar") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.gzip") returned 0
	[0038.037] lstrlenA (lpString="*.gzip") returned 6
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.jpg") returned 0
	[0038.037] lstrlenA (lpString="*.jpg") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.jpeg") returned 0
	[0038.037] lstrlenA (lpString="*.jpeg") returned 6
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.psd") returned 0
	[0038.037] lstrlenA (lpString="*.psd") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.cdr") returned 0
	[0038.037] lstrlenA (lpString="*.cdr") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.dwg") returned 0
	[0038.037] lstrlenA (lpString="*.dwg") returned 5
	[0038.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.max") returned 0
	[0038.038] lstrlenA (lpString="*.max") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.bmp") returned 0
	[0038.038] lstrlenA (lpString="*.bmp") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.gif") returned 0
	[0038.038] lstrlenA (lpString="*.gif") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.png") returned 0
	[0038.038] lstrlenA (lpString="*.png") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.doc") returned 0
	[0038.038] lstrlenA (lpString="*.doc") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.docx") returned 0
	[0038.038] lstrlenA (lpString="*.docx") returned 6
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.xls") returned 0
	[0038.038] lstrlenA (lpString="*.xls") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.xlsx") returned 0
	[0038.038] lstrlenA (lpString="*.xlsx") returned 6
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.ppt") returned 0
	[0038.038] lstrlenA (lpString="*.ppt") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.pptx") returned 0
	[0038.038] lstrlenA (lpString="*.pptx") returned 6
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.txt") returned 0
	[0038.038] lstrlenA (lpString="*.txt") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.pdf") returned 0
	[0038.038] lstrlenA (lpString="*.pdf") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.djvu") returned 0
	[0038.038] lstrlenA (lpString="*.djvu") returned 6
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.htm") returned 0
	[0038.038] lstrlenA (lpString="*.htm") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.html") returned 0
	[0038.038] lstrlenA (lpString="*.html") returned 6
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mdb") returned 0
	[0038.038] lstrlenA (lpString="*.mdb") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.cer") returned 0
	[0038.038] lstrlenA (lpString="*.cer") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.p12") returned 0
	[0038.038] lstrlenA (lpString="*.p12") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.pfx") returned 0
	[0038.038] lstrlenA (lpString="*.pfx") returned 5
	[0038.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.kwm") returned 0
	[0038.038] lstrlenA (lpString="*.kwm") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.pwm") returned 0
	[0038.039] lstrlenA (lpString="*.pwm") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.1cd") returned 0
	[0038.039] lstrlenA (lpString="*.1cd") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.md") returned 0
	[0038.039] lstrlenA (lpString="*.md") returned 4
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mdf") returned 0
	[0038.039] lstrlenA (lpString="*.mdf") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.dbf") returned 0
	[0038.039] lstrlenA (lpString="*.dbf") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.odt") returned 0
	[0038.039] lstrlenA (lpString="*.odt") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.vob") returned 0
	[0038.039] lstrlenA (lpString="*.vob") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.ifo") returned 0
	[0038.039] lstrlenA (lpString="*.ifo") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.lnk") returned 0
	[0038.039] lstrlenA (lpString="*.lnk") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.torrent") returned 0
	[0038.039] lstrlenA (lpString="*.torrent") returned 9
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mov") returned 0
	[0038.039] lstrlenA (lpString="*.mov") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.m2v") returned 0
	[0038.039] lstrlenA (lpString="*.m2v") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.3gp") returned 0
	[0038.039] lstrlenA (lpString="*.3gp") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mpeg") returned 0
	[0038.039] lstrlenA (lpString="*.mpeg") returned 6
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mpg") returned 0
	[0038.039] lstrlenA (lpString="*.mpg") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.flv") returned 0
	[0038.039] lstrlenA (lpString="*.flv") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.avi") returned 0
	[0038.039] lstrlenA (lpString="*.avi") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mp4") returned 0
	[0038.039] lstrlenA (lpString="*.mp4") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.wmv") returned 0
	[0038.039] lstrlenA (lpString="*.wmv") returned 5
	[0038.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.divx") returned 0
	[0038.039] lstrlenA (lpString="*.divx") returned 6
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mkv") returned 0
	[0038.040] lstrlenA (lpString="*.mkv") returned 5
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.mp3") returned 0
	[0038.040] lstrlenA (lpString="*.mp3") returned 5
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.wav") returned 0
	[0038.040] lstrlenA (lpString="*.wav") returned 5
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.flac") returned 0
	[0038.040] lstrlenA (lpString="*.flac") returned 6
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.ape") returned 0
	[0038.040] lstrlenA (lpString="*.ape") returned 5
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.wma") returned 0
	[0038.040] lstrlenA (lpString="*.wma") returned 5
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.ac3") returned 0
	[0038.040] lstrlenA (lpString="*.ac3") returned 5
	[0038.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", pszSpec="*.exe") returned 1
	[0038.040] lstrlenA (lpString="*.exe") returned 5
	[0038.040] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE"
	[0038.040] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE"
	[0038.040] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE."
	[0038.040] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.Boom"
	[0038.040] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.041] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84a48
	[0038.041] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28305200, dwHighDateTime=0x1c2f1c2), lpLastAccessTime=0x407536*(dwLowDateTime=0xeed5e6b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x28305200, dwHighDateTime=0x1c2f1c2)) returned 1
	[0038.041] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.041] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x84a25, lpOverlapped=0x0) returned 1
	[0038.064] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="EQNEDT32.EXE"
	[0038.066] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.066] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x84a25, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x84a25, lpOverlapped=0x0) returned 1
	[0038.068] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.068] CloseHandle (hObject=0x8c) returned 1
	[0038.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.boom")) returned 1
	[0038.073] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.073] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.073] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="eqnedt32.exe.manifest") returned -1
	[0038.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eqnedt32.exe.manifest") returned 1
	[0038.073] lstrcmpiA (lpString1="", lpString2="eqnedt32.exe.manifest") returned -1
	[0038.073] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="EQNEDT32.EXE"
	[0038.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\"
	[0038.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned=""
	[0038.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt"
	[0038.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20
	[0038.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="eqnedt32.exe.manifest" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest"
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.zip") returned 0
	[0038.073] lstrlenA (lpString="*.zip") returned 5
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.rar") returned 0
	[0038.073] lstrlenA (lpString="*.rar") returned 5
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.7z") returned 0
	[0038.073] lstrlenA (lpString="*.7z") returned 4
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.tar") returned 0
	[0038.073] lstrlenA (lpString="*.tar") returned 5
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.gzip") returned 0
	[0038.073] lstrlenA (lpString="*.gzip") returned 6
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.jpg") returned 0
	[0038.073] lstrlenA (lpString="*.jpg") returned 5
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.jpeg") returned 0
	[0038.073] lstrlenA (lpString="*.jpeg") returned 6
	[0038.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.psd") returned 0
	[0038.074] lstrlenA (lpString="*.psd") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.cdr") returned 0
	[0038.074] lstrlenA (lpString="*.cdr") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.dwg") returned 0
	[0038.074] lstrlenA (lpString="*.dwg") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.max") returned 0
	[0038.074] lstrlenA (lpString="*.max") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.bmp") returned 0
	[0038.074] lstrlenA (lpString="*.bmp") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.gif") returned 0
	[0038.074] lstrlenA (lpString="*.gif") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.png") returned 0
	[0038.074] lstrlenA (lpString="*.png") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.doc") returned 0
	[0038.074] lstrlenA (lpString="*.doc") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.docx") returned 0
	[0038.074] lstrlenA (lpString="*.docx") returned 6
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.xls") returned 0
	[0038.074] lstrlenA (lpString="*.xls") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.xlsx") returned 0
	[0038.074] lstrlenA (lpString="*.xlsx") returned 6
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.ppt") returned 0
	[0038.074] lstrlenA (lpString="*.ppt") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.pptx") returned 0
	[0038.074] lstrlenA (lpString="*.pptx") returned 6
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.txt") returned 0
	[0038.074] lstrlenA (lpString="*.txt") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.pdf") returned 0
	[0038.074] lstrlenA (lpString="*.pdf") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.djvu") returned 0
	[0038.074] lstrlenA (lpString="*.djvu") returned 6
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.htm") returned 0
	[0038.074] lstrlenA (lpString="*.htm") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.html") returned 0
	[0038.074] lstrlenA (lpString="*.html") returned 6
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mdb") returned 0
	[0038.074] lstrlenA (lpString="*.mdb") returned 5
	[0038.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.cer") returned 0
	[0038.074] lstrlenA (lpString="*.cer") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.p12") returned 0
	[0038.075] lstrlenA (lpString="*.p12") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.pfx") returned 0
	[0038.075] lstrlenA (lpString="*.pfx") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.kwm") returned 0
	[0038.075] lstrlenA (lpString="*.kwm") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.pwm") returned 0
	[0038.075] lstrlenA (lpString="*.pwm") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.1cd") returned 0
	[0038.075] lstrlenA (lpString="*.1cd") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.md") returned 0
	[0038.075] lstrlenA (lpString="*.md") returned 4
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mdf") returned 0
	[0038.075] lstrlenA (lpString="*.mdf") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.dbf") returned 0
	[0038.075] lstrlenA (lpString="*.dbf") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.odt") returned 0
	[0038.075] lstrlenA (lpString="*.odt") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.vob") returned 0
	[0038.075] lstrlenA (lpString="*.vob") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.ifo") returned 0
	[0038.075] lstrlenA (lpString="*.ifo") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.lnk") returned 0
	[0038.075] lstrlenA (lpString="*.lnk") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.torrent") returned 0
	[0038.075] lstrlenA (lpString="*.torrent") returned 9
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mov") returned 0
	[0038.075] lstrlenA (lpString="*.mov") returned 5
	[0038.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.m2v") returned 0
	[0038.075] lstrlenA (lpString="*.m2v") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.3gp") returned 0
	[0038.076] lstrlenA (lpString="*.3gp") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mpeg") returned 0
	[0038.076] lstrlenA (lpString="*.mpeg") returned 6
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mpg") returned 0
	[0038.076] lstrlenA (lpString="*.mpg") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.flv") returned 0
	[0038.076] lstrlenA (lpString="*.flv") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.avi") returned 0
	[0038.076] lstrlenA (lpString="*.avi") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mp4") returned 0
	[0038.076] lstrlenA (lpString="*.mp4") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.wmv") returned 0
	[0038.076] lstrlenA (lpString="*.wmv") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.divx") returned 0
	[0038.076] lstrlenA (lpString="*.divx") returned 6
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mkv") returned 0
	[0038.076] lstrlenA (lpString="*.mkv") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.mp3") returned 0
	[0038.076] lstrlenA (lpString="*.mp3") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.wav") returned 0
	[0038.076] lstrlenA (lpString="*.wav") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.flac") returned 0
	[0038.076] lstrlenA (lpString="*.flac") returned 6
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.ape") returned 0
	[0038.076] lstrlenA (lpString="*.ape") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.wma") returned 0
	[0038.076] lstrlenA (lpString="*.wma") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.ac3") returned 0
	[0038.076] lstrlenA (lpString="*.ac3") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.exe") returned 0
	[0038.076] lstrlenA (lpString="*.exe") returned 5
	[0038.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", pszSpec="*.apk") returned 0
	[0038.076] lstrlenA (lpString="*.apk") returned 5
	[0038.076] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.076] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.076] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EQNEDT32.HLP") returned -1
	[0038.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EQNEDT32.HLP") returned 1
	[0038.076] lstrcmpiA (lpString1="", lpString2="EQNEDT32.HLP") returned -1
	[0038.076] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="eqnedt32.exe.manifest"
	[0038.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\"
	[0038.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned=""
	[0038.077] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt"
	[0038.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20
	[0038.077] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.HLP" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP"
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.zip") returned 0
	[0038.077] lstrlenA (lpString="*.zip") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.rar") returned 0
	[0038.077] lstrlenA (lpString="*.rar") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.7z") returned 0
	[0038.077] lstrlenA (lpString="*.7z") returned 4
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.tar") returned 0
	[0038.077] lstrlenA (lpString="*.tar") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.gzip") returned 0
	[0038.077] lstrlenA (lpString="*.gzip") returned 6
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.jpg") returned 0
	[0038.077] lstrlenA (lpString="*.jpg") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.jpeg") returned 0
	[0038.077] lstrlenA (lpString="*.jpeg") returned 6
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.psd") returned 0
	[0038.077] lstrlenA (lpString="*.psd") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.cdr") returned 0
	[0038.077] lstrlenA (lpString="*.cdr") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.dwg") returned 0
	[0038.077] lstrlenA (lpString="*.dwg") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.max") returned 0
	[0038.077] lstrlenA (lpString="*.max") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.bmp") returned 0
	[0038.077] lstrlenA (lpString="*.bmp") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.gif") returned 0
	[0038.077] lstrlenA (lpString="*.gif") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.png") returned 0
	[0038.077] lstrlenA (lpString="*.png") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.doc") returned 0
	[0038.077] lstrlenA (lpString="*.doc") returned 5
	[0038.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.docx") returned 0
	[0038.078] lstrlenA (lpString="*.docx") returned 6
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.xls") returned 0
	[0038.078] lstrlenA (lpString="*.xls") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.xlsx") returned 0
	[0038.078] lstrlenA (lpString="*.xlsx") returned 6
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.ppt") returned 0
	[0038.078] lstrlenA (lpString="*.ppt") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.pptx") returned 0
	[0038.078] lstrlenA (lpString="*.pptx") returned 6
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.txt") returned 0
	[0038.078] lstrlenA (lpString="*.txt") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.pdf") returned 0
	[0038.078] lstrlenA (lpString="*.pdf") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.djvu") returned 0
	[0038.078] lstrlenA (lpString="*.djvu") returned 6
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.htm") returned 0
	[0038.078] lstrlenA (lpString="*.htm") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.html") returned 0
	[0038.078] lstrlenA (lpString="*.html") returned 6
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mdb") returned 0
	[0038.078] lstrlenA (lpString="*.mdb") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.cer") returned 0
	[0038.078] lstrlenA (lpString="*.cer") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.p12") returned 0
	[0038.078] lstrlenA (lpString="*.p12") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.pfx") returned 0
	[0038.078] lstrlenA (lpString="*.pfx") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.kwm") returned 0
	[0038.078] lstrlenA (lpString="*.kwm") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.pwm") returned 0
	[0038.078] lstrlenA (lpString="*.pwm") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.1cd") returned 0
	[0038.078] lstrlenA (lpString="*.1cd") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.md") returned 0
	[0038.078] lstrlenA (lpString="*.md") returned 4
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mdf") returned 0
	[0038.078] lstrlenA (lpString="*.mdf") returned 5
	[0038.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.dbf") returned 0
	[0038.078] lstrlenA (lpString="*.dbf") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.odt") returned 0
	[0038.079] lstrlenA (lpString="*.odt") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.vob") returned 0
	[0038.079] lstrlenA (lpString="*.vob") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.ifo") returned 0
	[0038.079] lstrlenA (lpString="*.ifo") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.lnk") returned 0
	[0038.079] lstrlenA (lpString="*.lnk") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.torrent") returned 0
	[0038.079] lstrlenA (lpString="*.torrent") returned 9
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mov") returned 0
	[0038.079] lstrlenA (lpString="*.mov") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.m2v") returned 0
	[0038.079] lstrlenA (lpString="*.m2v") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.3gp") returned 0
	[0038.079] lstrlenA (lpString="*.3gp") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mpeg") returned 0
	[0038.079] lstrlenA (lpString="*.mpeg") returned 6
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mpg") returned 0
	[0038.079] lstrlenA (lpString="*.mpg") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.flv") returned 0
	[0038.079] lstrlenA (lpString="*.flv") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.avi") returned 0
	[0038.079] lstrlenA (lpString="*.avi") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mp4") returned 0
	[0038.079] lstrlenA (lpString="*.mp4") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.wmv") returned 0
	[0038.079] lstrlenA (lpString="*.wmv") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.divx") returned 0
	[0038.079] lstrlenA (lpString="*.divx") returned 6
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mkv") returned 0
	[0038.079] lstrlenA (lpString="*.mkv") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.mp3") returned 0
	[0038.079] lstrlenA (lpString="*.mp3") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.wav") returned 0
	[0038.079] lstrlenA (lpString="*.wav") returned 5
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.flac") returned 0
	[0038.079] lstrlenA (lpString="*.flac") returned 6
	[0038.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.ape") returned 0
	[0038.079] lstrlenA (lpString="*.ape") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.wma") returned 0
	[0038.080] lstrlenA (lpString="*.wma") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.ac3") returned 0
	[0038.080] lstrlenA (lpString="*.ac3") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.exe") returned 0
	[0038.080] lstrlenA (lpString="*.exe") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", pszSpec="*.apk") returned 0
	[0038.080] lstrlenA (lpString="*.apk") returned 5
	[0038.080] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.080] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.080] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MTEXTRA.TTF") returned -1
	[0038.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MTEXTRA.TTF") returned -1
	[0038.080] lstrcmpiA (lpString1="", lpString2="MTEXTRA.TTF") returned -1
	[0038.080] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="EQNEDT32.HLP"
	[0038.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\"
	[0038.080] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned=""
	[0038.080] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt"
	[0038.080] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20
	[0038.080] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="MTEXTRA.TTF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF"
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.zip") returned 0
	[0038.080] lstrlenA (lpString="*.zip") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.rar") returned 0
	[0038.080] lstrlenA (lpString="*.rar") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.7z") returned 0
	[0038.080] lstrlenA (lpString="*.7z") returned 4
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.tar") returned 0
	[0038.080] lstrlenA (lpString="*.tar") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.gzip") returned 0
	[0038.080] lstrlenA (lpString="*.gzip") returned 6
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.jpg") returned 0
	[0038.080] lstrlenA (lpString="*.jpg") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.jpeg") returned 0
	[0038.080] lstrlenA (lpString="*.jpeg") returned 6
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.psd") returned 0
	[0038.080] lstrlenA (lpString="*.psd") returned 5
	[0038.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.cdr") returned 0
	[0038.081] lstrlenA (lpString="*.cdr") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.dwg") returned 0
	[0038.081] lstrlenA (lpString="*.dwg") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.max") returned 0
	[0038.081] lstrlenA (lpString="*.max") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.bmp") returned 0
	[0038.081] lstrlenA (lpString="*.bmp") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.gif") returned 0
	[0038.081] lstrlenA (lpString="*.gif") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.png") returned 0
	[0038.081] lstrlenA (lpString="*.png") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.doc") returned 0
	[0038.081] lstrlenA (lpString="*.doc") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.docx") returned 0
	[0038.081] lstrlenA (lpString="*.docx") returned 6
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.xls") returned 0
	[0038.081] lstrlenA (lpString="*.xls") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.xlsx") returned 0
	[0038.081] lstrlenA (lpString="*.xlsx") returned 6
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.ppt") returned 0
	[0038.081] lstrlenA (lpString="*.ppt") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.pptx") returned 0
	[0038.081] lstrlenA (lpString="*.pptx") returned 6
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.txt") returned 0
	[0038.081] lstrlenA (lpString="*.txt") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.pdf") returned 0
	[0038.081] lstrlenA (lpString="*.pdf") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.djvu") returned 0
	[0038.081] lstrlenA (lpString="*.djvu") returned 6
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.htm") returned 0
	[0038.081] lstrlenA (lpString="*.htm") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.html") returned 0
	[0038.081] lstrlenA (lpString="*.html") returned 6
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mdb") returned 0
	[0038.081] lstrlenA (lpString="*.mdb") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.cer") returned 0
	[0038.081] lstrlenA (lpString="*.cer") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.p12") returned 0
	[0038.081] lstrlenA (lpString="*.p12") returned 5
	[0038.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.pfx") returned 0
	[0038.082] lstrlenA (lpString="*.pfx") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.kwm") returned 0
	[0038.082] lstrlenA (lpString="*.kwm") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.pwm") returned 0
	[0038.082] lstrlenA (lpString="*.pwm") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.1cd") returned 0
	[0038.082] lstrlenA (lpString="*.1cd") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.md") returned 0
	[0038.082] lstrlenA (lpString="*.md") returned 4
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mdf") returned 0
	[0038.082] lstrlenA (lpString="*.mdf") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.dbf") returned 0
	[0038.082] lstrlenA (lpString="*.dbf") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.odt") returned 0
	[0038.082] lstrlenA (lpString="*.odt") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.vob") returned 0
	[0038.082] lstrlenA (lpString="*.vob") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.ifo") returned 0
	[0038.082] lstrlenA (lpString="*.ifo") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.lnk") returned 0
	[0038.082] lstrlenA (lpString="*.lnk") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.torrent") returned 0
	[0038.082] lstrlenA (lpString="*.torrent") returned 9
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mov") returned 0
	[0038.082] lstrlenA (lpString="*.mov") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.m2v") returned 0
	[0038.082] lstrlenA (lpString="*.m2v") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.3gp") returned 0
	[0038.082] lstrlenA (lpString="*.3gp") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mpeg") returned 0
	[0038.082] lstrlenA (lpString="*.mpeg") returned 6
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mpg") returned 0
	[0038.082] lstrlenA (lpString="*.mpg") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.flv") returned 0
	[0038.082] lstrlenA (lpString="*.flv") returned 5
	[0038.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.avi") returned 0
	[0038.083] lstrlenA (lpString="*.avi") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mp4") returned 0
	[0038.083] lstrlenA (lpString="*.mp4") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.wmv") returned 0
	[0038.083] lstrlenA (lpString="*.wmv") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.divx") returned 0
	[0038.083] lstrlenA (lpString="*.divx") returned 6
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mkv") returned 0
	[0038.083] lstrlenA (lpString="*.mkv") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.mp3") returned 0
	[0038.083] lstrlenA (lpString="*.mp3") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.wav") returned 0
	[0038.083] lstrlenA (lpString="*.wav") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.flac") returned 0
	[0038.083] lstrlenA (lpString="*.flac") returned 6
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.ape") returned 0
	[0038.083] lstrlenA (lpString="*.ape") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.wma") returned 0
	[0038.083] lstrlenA (lpString="*.wma") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.ac3") returned 0
	[0038.083] lstrlenA (lpString="*.ac3") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.exe") returned 0
	[0038.083] lstrlenA (lpString="*.exe") returned 5
	[0038.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", pszSpec="*.apk") returned 0
	[0038.083] lstrlenA (lpString="*.apk") returned 5
	[0038.083] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0038.083] FindClose (in: hFindFile=0x8ba3a8 | out: hFindFile=0x8ba3a8) returned 1
	[0038.083] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0038.083] lstrcmpA (lpString1=".", lpString2="EURO") returned -1
	[0038.083] lstrcmpA (lpString1="..", lpString2="EURO") returned -1
	[0038.083] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0038.084] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="EURO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO"
	[0038.084] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned 51
	[0038.084] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e48
	[0038.099] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.099] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.099] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.099] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.099] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.099] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.099] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOEURO.DLL") returned -1
	[0038.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOEURO.DLL") returned -1
	[0038.099] lstrcmpiA (lpString1="", lpString2="MSOEURO.DLL") returned -1
	[0038.099] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*") returned="*.*"
	[0038.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\"
	[0038.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned=""
	[0038.099] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt"
	[0038.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how to decrypt files.txt")) returned 0xffffffff
	[0038.099] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.099] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.099] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.100] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.100] CloseHandle (hObject=0x8c) returned 1
	[0038.100] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpString2="MSOEURO.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL"
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.zip") returned 0
	[0038.101] lstrlenA (lpString="*.zip") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.rar") returned 0
	[0038.101] lstrlenA (lpString="*.rar") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.7z") returned 0
	[0038.101] lstrlenA (lpString="*.7z") returned 4
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.tar") returned 0
	[0038.101] lstrlenA (lpString="*.tar") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.gzip") returned 0
	[0038.101] lstrlenA (lpString="*.gzip") returned 6
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.jpg") returned 0
	[0038.101] lstrlenA (lpString="*.jpg") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.jpeg") returned 0
	[0038.101] lstrlenA (lpString="*.jpeg") returned 6
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.psd") returned 0
	[0038.101] lstrlenA (lpString="*.psd") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.cdr") returned 0
	[0038.101] lstrlenA (lpString="*.cdr") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.dwg") returned 0
	[0038.101] lstrlenA (lpString="*.dwg") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.max") returned 0
	[0038.101] lstrlenA (lpString="*.max") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.bmp") returned 0
	[0038.101] lstrlenA (lpString="*.bmp") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.gif") returned 0
	[0038.101] lstrlenA (lpString="*.gif") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.png") returned 0
	[0038.101] lstrlenA (lpString="*.png") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.doc") returned 0
	[0038.101] lstrlenA (lpString="*.doc") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.docx") returned 0
	[0038.101] lstrlenA (lpString="*.docx") returned 6
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.xls") returned 0
	[0038.101] lstrlenA (lpString="*.xls") returned 5
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.xlsx") returned 0
	[0038.101] lstrlenA (lpString="*.xlsx") returned 6
	[0038.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.ppt") returned 0
	[0038.101] lstrlenA (lpString="*.ppt") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.pptx") returned 0
	[0038.102] lstrlenA (lpString="*.pptx") returned 6
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.txt") returned 0
	[0038.102] lstrlenA (lpString="*.txt") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.pdf") returned 0
	[0038.102] lstrlenA (lpString="*.pdf") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.djvu") returned 0
	[0038.102] lstrlenA (lpString="*.djvu") returned 6
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.htm") returned 0
	[0038.102] lstrlenA (lpString="*.htm") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.html") returned 0
	[0038.102] lstrlenA (lpString="*.html") returned 6
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mdb") returned 0
	[0038.102] lstrlenA (lpString="*.mdb") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.cer") returned 0
	[0038.102] lstrlenA (lpString="*.cer") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.p12") returned 0
	[0038.102] lstrlenA (lpString="*.p12") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.pfx") returned 0
	[0038.102] lstrlenA (lpString="*.pfx") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.kwm") returned 0
	[0038.102] lstrlenA (lpString="*.kwm") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.pwm") returned 0
	[0038.102] lstrlenA (lpString="*.pwm") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.1cd") returned 0
	[0038.102] lstrlenA (lpString="*.1cd") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.md") returned 0
	[0038.102] lstrlenA (lpString="*.md") returned 4
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mdf") returned 0
	[0038.102] lstrlenA (lpString="*.mdf") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.dbf") returned 0
	[0038.102] lstrlenA (lpString="*.dbf") returned 5
	[0038.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.odt") returned 0
	[0038.103] lstrlenA (lpString="*.odt") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.vob") returned 0
	[0038.103] lstrlenA (lpString="*.vob") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.ifo") returned 0
	[0038.103] lstrlenA (lpString="*.ifo") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.lnk") returned 0
	[0038.103] lstrlenA (lpString="*.lnk") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.torrent") returned 0
	[0038.103] lstrlenA (lpString="*.torrent") returned 9
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mov") returned 0
	[0038.103] lstrlenA (lpString="*.mov") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.m2v") returned 0
	[0038.103] lstrlenA (lpString="*.m2v") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.3gp") returned 0
	[0038.103] lstrlenA (lpString="*.3gp") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mpeg") returned 0
	[0038.103] lstrlenA (lpString="*.mpeg") returned 6
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mpg") returned 0
	[0038.103] lstrlenA (lpString="*.mpg") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.flv") returned 0
	[0038.103] lstrlenA (lpString="*.flv") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.avi") returned 0
	[0038.103] lstrlenA (lpString="*.avi") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mp4") returned 0
	[0038.103] lstrlenA (lpString="*.mp4") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.wmv") returned 0
	[0038.103] lstrlenA (lpString="*.wmv") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.divx") returned 0
	[0038.103] lstrlenA (lpString="*.divx") returned 6
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mkv") returned 0
	[0038.103] lstrlenA (lpString="*.mkv") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.mp3") returned 0
	[0038.103] lstrlenA (lpString="*.mp3") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.wav") returned 0
	[0038.103] lstrlenA (lpString="*.wav") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.flac") returned 0
	[0038.103] lstrlenA (lpString="*.flac") returned 6
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.ape") returned 0
	[0038.103] lstrlenA (lpString="*.ape") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.wma") returned 0
	[0038.103] lstrlenA (lpString="*.wma") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.ac3") returned 0
	[0038.103] lstrlenA (lpString="*.ac3") returned 5
	[0038.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.exe") returned 0
	[0038.103] lstrlenA (lpString="*.exe") returned 5
	[0038.104] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", pszSpec="*.apk") returned 0
	[0038.104] lstrlenA (lpString="*.apk") returned 5
	[0038.104] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0038.104] FindClose (in: hFindFile=0x8b7e48 | out: hFindFile=0x8b7e48) returned 1
	[0038.104] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0038.104] lstrcmpA (lpString1=".", lpString2="Filters") returned -1
	[0038.104] lstrcmpA (lpString1="..", lpString2="Filters") returned -1
	[0038.104] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0038.104] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Filters" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters"
	[0038.104] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned 54
	[0038.104] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7dd0
	[0038.105] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.105] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.105] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.105] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.105] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.105] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.105] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msgfilt.dll") returned -1
	[0038.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msgfilt.dll") returned -1
	[0038.105] lstrcmpiA (lpString1="", lpString2="msgfilt.dll") returned -1
	[0038.105] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*") returned="*.*"
	[0038.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\"
	[0038.105] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned=""
	[0038.105] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt"
	[0038.105] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0xffffffff
	[0038.105] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.106] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.106] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.107] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.107] CloseHandle (hObject=0x8c) returned 1
	[0038.107] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="msgfilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll"
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.zip") returned 0
	[0038.107] lstrlenA (lpString="*.zip") returned 5
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.rar") returned 0
	[0038.107] lstrlenA (lpString="*.rar") returned 5
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.7z") returned 0
	[0038.107] lstrlenA (lpString="*.7z") returned 4
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.tar") returned 0
	[0038.107] lstrlenA (lpString="*.tar") returned 5
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.gzip") returned 0
	[0038.107] lstrlenA (lpString="*.gzip") returned 6
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.jpg") returned 0
	[0038.107] lstrlenA (lpString="*.jpg") returned 5
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.jpeg") returned 0
	[0038.107] lstrlenA (lpString="*.jpeg") returned 6
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.psd") returned 0
	[0038.107] lstrlenA (lpString="*.psd") returned 5
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.cdr") returned 0
	[0038.107] lstrlenA (lpString="*.cdr") returned 5
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.dwg") returned 0
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.max") returned 0
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.bmp") returned 0
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.gif") returned 0
	[0038.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.png") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.doc") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.docx") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.xls") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.xlsx") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.ppt") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.pptx") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.txt") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.pdf") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.djvu") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.htm") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.html") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mdb") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.cer") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.p12") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.pfx") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.kwm") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.pwm") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.1cd") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.md") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mdf") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.dbf") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.odt") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.vob") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.ifo") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.lnk") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.torrent") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mov") returned 0
	[0038.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.m2v") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.3gp") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mpeg") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mpg") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.flv") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.avi") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mp4") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.wmv") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.divx") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mkv") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.mp3") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.wav") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.flac") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.ape") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.wma") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.ac3") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.exe") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", pszSpec="*.apk") returned 0
	[0038.109] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.109] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.109] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="odffilt.dll") returned -1
	[0038.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="odffilt.dll") returned -1
	[0038.109] lstrcmpiA (lpString1="", lpString2="odffilt.dll") returned -1
	[0038.109] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned="msgfilt.dll"
	[0038.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\"
	[0038.109] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned=""
	[0038.109] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt"
	[0038.109] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20
	[0038.109] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="odffilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll"
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.zip") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.rar") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.7z") returned 0
	[0038.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.tar") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.gzip") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.jpg") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.jpeg") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.psd") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.cdr") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.dwg") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.max") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.bmp") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.gif") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.png") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.doc") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.docx") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.xls") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.xlsx") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.ppt") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.pptx") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.txt") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.pdf") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.djvu") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.htm") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.html") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mdb") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.cer") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.p12") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.pfx") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.kwm") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.pwm") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.1cd") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.md") returned 0
	[0038.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mdf") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.dbf") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.odt") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.vob") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.ifo") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.lnk") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.torrent") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mov") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.m2v") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.3gp") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mpeg") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mpg") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.flv") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.avi") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mp4") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.wmv") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.divx") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mkv") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.mp3") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.wav") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.flac") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.ape") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.wma") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.ac3") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.exe") returned 0
	[0038.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", pszSpec="*.apk") returned 0
	[0038.111] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.111] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.111] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="offfiltx.dll") returned -1
	[0038.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="offfiltx.dll") returned -1
	[0038.111] lstrcmpiA (lpString1="", lpString2="offfiltx.dll") returned -1
	[0038.112] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned="odffilt.dll"
	[0038.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\"
	[0038.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned=""
	[0038.112] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt"
	[0038.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20
	[0038.112] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="offfiltx.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll"
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.zip") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.rar") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.7z") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.tar") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.gzip") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.jpg") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.jpeg") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.psd") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.cdr") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.dwg") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.max") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.bmp") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.gif") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.png") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.doc") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.docx") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.xls") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.xlsx") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.ppt") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.pptx") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.txt") returned 0
	[0038.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.pdf") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.djvu") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.htm") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.html") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mdb") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.cer") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.p12") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.pfx") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.kwm") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.pwm") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.1cd") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.md") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mdf") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.dbf") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.odt") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.vob") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.ifo") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.lnk") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.torrent") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mov") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.m2v") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.3gp") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mpeg") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mpg") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.flv") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.avi") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mp4") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.wmv") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.divx") returned 0
	[0038.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mkv") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.mp3") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.wav") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.flac") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.ape") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.wma") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.ac3") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.exe") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", pszSpec="*.apk") returned 0
	[0038.114] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.114] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.114] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VISFILT.DLL") returned -1
	[0038.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISFILT.DLL") returned -1
	[0038.114] lstrcmpiA (lpString1="", lpString2="VISFILT.DLL") returned -1
	[0038.114] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned="offfiltx.dll"
	[0038.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\"
	[0038.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned=""
	[0038.114] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt"
	[0038.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20
	[0038.114] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="VISFILT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL"
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.zip") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.rar") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.7z") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.tar") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.gzip") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.jpg") returned 0
	[0038.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.jpeg") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.psd") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.cdr") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.dwg") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.max") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.bmp") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.gif") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.png") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.doc") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.docx") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.xls") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.xlsx") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.ppt") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.pptx") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.txt") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.pdf") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.djvu") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.htm") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.html") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mdb") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.cer") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.p12") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.pfx") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.kwm") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.pwm") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.1cd") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.md") returned 0
	[0038.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mdf") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.dbf") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.odt") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.vob") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.ifo") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.lnk") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.torrent") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mov") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.m2v") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.3gp") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mpeg") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mpg") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.flv") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.avi") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mp4") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.wmv") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.divx") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mkv") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.mp3") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.wav") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.flac") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.ape") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.wma") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.ac3") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.exe") returned 0
	[0038.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", pszSpec="*.apk") returned 0
	[0038.116] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0038.116] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.116] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0038.117] lstrcmpA (lpString1=".", lpString2="GRPHFLT") returned -1
	[0038.117] lstrcmpA (lpString1="..", lpString2="GRPHFLT") returned -1
	[0038.117] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0038.117] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="GRPHFLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT"
	[0038.117] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7dd0
	[0038.128] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.128] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.128] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.128] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.129] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.129] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.129] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CGMIMP32.CFG") returned 1
	[0038.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CGMIMP32.CFG") returned 1
	[0038.129] lstrcmpiA (lpString1="", lpString2="CGMIMP32.CFG") returned -1
	[0038.129] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*") returned="*.*"
	[0038.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.129] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.129] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.129] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0xffffffff
	[0038.129] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.129] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.130] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.130] CloseHandle (hObject=0x8c) returned 1
	[0038.131] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.CFG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG"
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.zip") returned 0
	[0038.131] lstrlenA (lpString="*.zip") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.rar") returned 0
	[0038.131] lstrlenA (lpString="*.rar") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.7z") returned 0
	[0038.131] lstrlenA (lpString="*.7z") returned 4
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.tar") returned 0
	[0038.131] lstrlenA (lpString="*.tar") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.gzip") returned 0
	[0038.131] lstrlenA (lpString="*.gzip") returned 6
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.jpg") returned 0
	[0038.131] lstrlenA (lpString="*.jpg") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.jpeg") returned 0
	[0038.131] lstrlenA (lpString="*.jpeg") returned 6
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.psd") returned 0
	[0038.131] lstrlenA (lpString="*.psd") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.cdr") returned 0
	[0038.131] lstrlenA (lpString="*.cdr") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.dwg") returned 0
	[0038.131] lstrlenA (lpString="*.dwg") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.max") returned 0
	[0038.131] lstrlenA (lpString="*.max") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.bmp") returned 0
	[0038.131] lstrlenA (lpString="*.bmp") returned 5
	[0038.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", pszSpec="*.gif") returned 0
	[0038.131] lstrlenA (lpString="*.gif") returned 5
	[0038.132] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.132] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CGMIMP32.FLT") returned 1
	[0038.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CGMIMP32.FLT") returned 1
	[0038.132] lstrcmpiA (lpString1="", lpString2="CGMIMP32.FLT") returned -1
	[0038.132] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="CGMIMP32.CFG"
	[0038.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.132] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.132] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT"
	[0038.132] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.132] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CGMIMP32.FNT") returned 1
	[0038.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CGMIMP32.FNT") returned 1
	[0038.132] lstrcmpiA (lpString1="", lpString2="CGMIMP32.FNT") returned -1
	[0038.132] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="CGMIMP32.FLT"
	[0038.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.132] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.FNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT"
	[0038.133] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EPSIMP32.FLT") returned -1
	[0038.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EPSIMP32.FLT") returned 1
	[0038.133] lstrcmpiA (lpString1="", lpString2="EPSIMP32.FLT") returned -1
	[0038.133] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="CGMIMP32.FNT"
	[0038.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="EPSIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT"
	[0038.133] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GIFIMP32.FLT") returned -1
	[0038.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GIFIMP32.FLT") returned 1
	[0038.133] lstrcmpiA (lpString1="", lpString2="GIFIMP32.FLT") returned -1
	[0038.133] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="EPSIMP32.FLT"
	[0038.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="GIFIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT"
	[0038.133] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JPEGIM32.FLT") returned -1
	[0038.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JPEGIM32.FLT") returned -1
	[0038.134] lstrcmpiA (lpString1="", lpString2="JPEGIM32.FLT") returned -1
	[0038.134] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="GIFIMP32.FLT"
	[0038.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="JPEGIM32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT"
	[0038.134] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.134] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.CGM") returned -1
	[0038.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.CGM") returned -1
	[0038.134] lstrcmpiA (lpString1="", lpString2="MS.CGM") returned -1
	[0038.134] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="JPEGIM32.FLT"
	[0038.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.CGM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM"
	[0038.134] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.134] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.EPS") returned -1
	[0038.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.EPS") returned -1
	[0038.134] lstrcmpiA (lpString1="", lpString2="MS.EPS") returned -1
	[0038.134] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="MS.CGM"
	[0038.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.EPS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS"
	[0038.135] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.GIF") returned -1
	[0038.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.GIF") returned -1
	[0038.135] lstrcmpiA (lpString1="", lpString2="MS.GIF") returned -1
	[0038.135] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="MS.EPS"
	[0038.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF"
	[0038.135] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF"
	[0038.135] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF"
	[0038.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF."
	[0038.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.Boom"
	[0038.135] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.138] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42d
	[0038.138] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1
	[0038.138] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.138] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x40a, lpOverlapped=0x0) returned 1
	[0038.157] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="MS.GIF"
	[0038.157] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.157] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x40a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x40a, lpOverlapped=0x0) returned 1
	[0038.157] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.157] CloseHandle (hObject=0x8c) returned 1
	[0038.158] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.boom")) returned 1
	[0038.159] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.159] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.159] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.JPG") returned -1
	[0038.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.JPG") returned -1
	[0038.159] lstrcmpiA (lpString1="", lpString2="MS.JPG") returned -1
	[0038.159] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="MS.GIF"
	[0038.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.159] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.159] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG"
	[0038.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.zip") returned 0
	[0038.159] lstrlenA (lpString="*.zip") returned 5
	[0038.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.rar") returned 0
	[0038.159] lstrlenA (lpString="*.rar") returned 5
	[0038.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.7z") returned 0
	[0038.159] lstrlenA (lpString="*.7z") returned 4
	[0038.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.tar") returned 0
	[0038.159] lstrlenA (lpString="*.tar") returned 5
	[0038.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.gzip") returned 0
	[0038.159] lstrlenA (lpString="*.gzip") returned 6
	[0038.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.jpg") returned 1
	[0038.159] lstrlenA (lpString="*.jpg") returned 5
	[0038.159] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG"
	[0038.159] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG"
	[0038.159] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG."
	[0038.160] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.Boom"
	[0038.160] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.160] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x425
	[0038.161] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1
	[0038.161] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.161] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x402, lpOverlapped=0x0) returned 1
	[0038.165] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="MS.JPG"
	[0038.165] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.165] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x402, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x402, lpOverlapped=0x0) returned 1
	[0038.165] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.165] CloseHandle (hObject=0x8c) returned 1
	[0038.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.boom")) returned 1
	[0038.167] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.PNG") returned -1
	[0038.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.PNG") returned -1
	[0038.167] lstrcmpiA (lpString1="", lpString2="MS.PNG") returned -1
	[0038.167] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="MS.JPG"
	[0038.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.167] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.167] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG"
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.zip") returned 0
	[0038.167] lstrlenA (lpString="*.zip") returned 5
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.rar") returned 0
	[0038.167] lstrlenA (lpString="*.rar") returned 5
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.7z") returned 0
	[0038.167] lstrlenA (lpString="*.7z") returned 4
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.tar") returned 0
	[0038.167] lstrlenA (lpString="*.tar") returned 5
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.gzip") returned 0
	[0038.167] lstrlenA (lpString="*.gzip") returned 6
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpg") returned 0
	[0038.167] lstrlenA (lpString="*.jpg") returned 5
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpeg") returned 0
	[0038.167] lstrlenA (lpString="*.jpeg") returned 6
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.psd") returned 0
	[0038.167] lstrlenA (lpString="*.psd") returned 5
	[0038.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.cdr") returned 0
	[0038.167] lstrlenA (lpString="*.cdr") returned 5
	[0038.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.dwg") returned 0
	[0038.168] lstrlenA (lpString="*.dwg") returned 5
	[0038.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.max") returned 0
	[0038.168] lstrlenA (lpString="*.max") returned 5
	[0038.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.bmp") returned 0
	[0038.168] lstrlenA (lpString="*.bmp") returned 5
	[0038.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.gif") returned 0
	[0038.168] lstrlenA (lpString="*.gif") returned 5
	[0038.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.png") returned 1
	[0038.168] lstrlenA (lpString="*.png") returned 5
	[0038.168] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG"
	[0038.168] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG"
	[0038.168] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG."
	[0038.168] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.Boom"
	[0038.168] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.168] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x692
	[0038.168] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1
	[0038.168] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.168] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x66f, lpOverlapped=0x0) returned 1
	[0038.179] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="MS.PNG"
	[0038.180] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0038.180] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x66f, lpOverlapped=0x0) returned 1
	[0038.180] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.180] CloseHandle (hObject=0x8c) returned 1
	[0038.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.boom")) returned 1
	[0038.181] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.WPG") returned -1
	[0038.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.WPG") returned -1
	[0038.181] lstrcmpiA (lpString1="", lpString2="MS.WPG") returned -1
	[0038.181] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="MS.PNG"
	[0038.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.181] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.182] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.WPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG"
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.zip") returned 0
	[0038.182] lstrlenA (lpString="*.zip") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.rar") returned 0
	[0038.182] lstrlenA (lpString="*.rar") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.7z") returned 0
	[0038.182] lstrlenA (lpString="*.7z") returned 4
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.tar") returned 0
	[0038.182] lstrlenA (lpString="*.tar") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gzip") returned 0
	[0038.182] lstrlenA (lpString="*.gzip") returned 6
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpg") returned 0
	[0038.182] lstrlenA (lpString="*.jpg") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpeg") returned 0
	[0038.182] lstrlenA (lpString="*.jpeg") returned 6
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.psd") returned 0
	[0038.182] lstrlenA (lpString="*.psd") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.cdr") returned 0
	[0038.182] lstrlenA (lpString="*.cdr") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dwg") returned 0
	[0038.182] lstrlenA (lpString="*.dwg") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.max") returned 0
	[0038.182] lstrlenA (lpString="*.max") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.bmp") returned 0
	[0038.182] lstrlenA (lpString="*.bmp") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gif") returned 0
	[0038.182] lstrlenA (lpString="*.gif") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.png") returned 0
	[0038.182] lstrlenA (lpString="*.png") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.doc") returned 0
	[0038.182] lstrlenA (lpString="*.doc") returned 5
	[0038.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.docx") returned 0
	[0038.182] lstrlenA (lpString="*.docx") returned 6
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xls") returned 0
	[0038.183] lstrlenA (lpString="*.xls") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xlsx") returned 0
	[0038.183] lstrlenA (lpString="*.xlsx") returned 6
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ppt") returned 0
	[0038.183] lstrlenA (lpString="*.ppt") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pptx") returned 0
	[0038.183] lstrlenA (lpString="*.pptx") returned 6
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.txt") returned 0
	[0038.183] lstrlenA (lpString="*.txt") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pdf") returned 0
	[0038.183] lstrlenA (lpString="*.pdf") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.djvu") returned 0
	[0038.183] lstrlenA (lpString="*.djvu") returned 6
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.htm") returned 0
	[0038.183] lstrlenA (lpString="*.htm") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.html") returned 0
	[0038.183] lstrlenA (lpString="*.html") returned 6
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mdb") returned 0
	[0038.183] lstrlenA (lpString="*.mdb") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.cer") returned 0
	[0038.183] lstrlenA (lpString="*.cer") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.p12") returned 0
	[0038.183] lstrlenA (lpString="*.p12") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pfx") returned 0
	[0038.183] lstrlenA (lpString="*.pfx") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.kwm") returned 0
	[0038.183] lstrlenA (lpString="*.kwm") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pwm") returned 0
	[0038.183] lstrlenA (lpString="*.pwm") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.1cd") returned 0
	[0038.183] lstrlenA (lpString="*.1cd") returned 5
	[0038.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.md") returned 0
	[0038.184] lstrlenA (lpString="*.md") returned 4
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mdf") returned 0
	[0038.184] lstrlenA (lpString="*.mdf") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dbf") returned 0
	[0038.184] lstrlenA (lpString="*.dbf") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.odt") returned 0
	[0038.184] lstrlenA (lpString="*.odt") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.vob") returned 0
	[0038.184] lstrlenA (lpString="*.vob") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ifo") returned 0
	[0038.184] lstrlenA (lpString="*.ifo") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.lnk") returned 0
	[0038.184] lstrlenA (lpString="*.lnk") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.torrent") returned 0
	[0038.184] lstrlenA (lpString="*.torrent") returned 9
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mov") returned 0
	[0038.184] lstrlenA (lpString="*.mov") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.m2v") returned 0
	[0038.184] lstrlenA (lpString="*.m2v") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.3gp") returned 0
	[0038.184] lstrlenA (lpString="*.3gp") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mpeg") returned 0
	[0038.184] lstrlenA (lpString="*.mpeg") returned 6
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mpg") returned 0
	[0038.184] lstrlenA (lpString="*.mpg") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.flv") returned 0
	[0038.184] lstrlenA (lpString="*.flv") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.avi") returned 0
	[0038.184] lstrlenA (lpString="*.avi") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp4") returned 0
	[0038.184] lstrlenA (lpString="*.mp4") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wmv") returned 0
	[0038.184] lstrlenA (lpString="*.wmv") returned 5
	[0038.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.divx") returned 0
	[0038.185] lstrlenA (lpString="*.divx") returned 6
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mkv") returned 0
	[0038.185] lstrlenA (lpString="*.mkv") returned 5
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp3") returned 0
	[0038.185] lstrlenA (lpString="*.mp3") returned 5
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wav") returned 0
	[0038.185] lstrlenA (lpString="*.wav") returned 5
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.flac") returned 0
	[0038.185] lstrlenA (lpString="*.flac") returned 6
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ape") returned 0
	[0038.185] lstrlenA (lpString="*.ape") returned 5
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wma") returned 0
	[0038.185] lstrlenA (lpString="*.wma") returned 5
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ac3") returned 0
	[0038.185] lstrlenA (lpString="*.ac3") returned 5
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.exe") returned 0
	[0038.185] lstrlenA (lpString="*.exe") returned 5
	[0038.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.apk") returned 0
	[0038.185] lstrlenA (lpString="*.apk") returned 5
	[0038.185] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.185] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.185] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PICTIM32.FLT") returned -1
	[0038.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PICTIM32.FLT") returned -1
	[0038.185] lstrcmpiA (lpString1="", lpString2="PICTIM32.FLT") returned -1
	[0038.185] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="MS.WPG"
	[0038.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.185] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.186] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PICTIM32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT"
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.zip") returned 0
	[0038.186] lstrlenA (lpString="*.zip") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.rar") returned 0
	[0038.186] lstrlenA (lpString="*.rar") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.7z") returned 0
	[0038.186] lstrlenA (lpString="*.7z") returned 4
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.tar") returned 0
	[0038.186] lstrlenA (lpString="*.tar") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gzip") returned 0
	[0038.186] lstrlenA (lpString="*.gzip") returned 6
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpg") returned 0
	[0038.186] lstrlenA (lpString="*.jpg") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpeg") returned 0
	[0038.186] lstrlenA (lpString="*.jpeg") returned 6
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.psd") returned 0
	[0038.186] lstrlenA (lpString="*.psd") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.cdr") returned 0
	[0038.186] lstrlenA (lpString="*.cdr") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dwg") returned 0
	[0038.186] lstrlenA (lpString="*.dwg") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.max") returned 0
	[0038.186] lstrlenA (lpString="*.max") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.bmp") returned 0
	[0038.186] lstrlenA (lpString="*.bmp") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gif") returned 0
	[0038.186] lstrlenA (lpString="*.gif") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.png") returned 0
	[0038.186] lstrlenA (lpString="*.png") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.doc") returned 0
	[0038.186] lstrlenA (lpString="*.doc") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.docx") returned 0
	[0038.186] lstrlenA (lpString="*.docx") returned 6
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xls") returned 0
	[0038.186] lstrlenA (lpString="*.xls") returned 5
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xlsx") returned 0
	[0038.186] lstrlenA (lpString="*.xlsx") returned 6
	[0038.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ppt") returned 0
	[0038.187] lstrlenA (lpString="*.ppt") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pptx") returned 0
	[0038.187] lstrlenA (lpString="*.pptx") returned 6
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.txt") returned 0
	[0038.187] lstrlenA (lpString="*.txt") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pdf") returned 0
	[0038.187] lstrlenA (lpString="*.pdf") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.djvu") returned 0
	[0038.187] lstrlenA (lpString="*.djvu") returned 6
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.htm") returned 0
	[0038.187] lstrlenA (lpString="*.htm") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.html") returned 0
	[0038.187] lstrlenA (lpString="*.html") returned 6
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mdb") returned 0
	[0038.187] lstrlenA (lpString="*.mdb") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.cer") returned 0
	[0038.187] lstrlenA (lpString="*.cer") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.p12") returned 0
	[0038.187] lstrlenA (lpString="*.p12") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pfx") returned 0
	[0038.187] lstrlenA (lpString="*.pfx") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.kwm") returned 0
	[0038.187] lstrlenA (lpString="*.kwm") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pwm") returned 0
	[0038.187] lstrlenA (lpString="*.pwm") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.1cd") returned 0
	[0038.187] lstrlenA (lpString="*.1cd") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.md") returned 0
	[0038.187] lstrlenA (lpString="*.md") returned 4
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mdf") returned 0
	[0038.187] lstrlenA (lpString="*.mdf") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dbf") returned 0
	[0038.187] lstrlenA (lpString="*.dbf") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.odt") returned 0
	[0038.187] lstrlenA (lpString="*.odt") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.vob") returned 0
	[0038.187] lstrlenA (lpString="*.vob") returned 5
	[0038.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ifo") returned 0
	[0038.188] lstrlenA (lpString="*.ifo") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.lnk") returned 0
	[0038.188] lstrlenA (lpString="*.lnk") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.torrent") returned 0
	[0038.188] lstrlenA (lpString="*.torrent") returned 9
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mov") returned 0
	[0038.188] lstrlenA (lpString="*.mov") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.m2v") returned 0
	[0038.188] lstrlenA (lpString="*.m2v") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.3gp") returned 0
	[0038.188] lstrlenA (lpString="*.3gp") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mpeg") returned 0
	[0038.188] lstrlenA (lpString="*.mpeg") returned 6
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mpg") returned 0
	[0038.188] lstrlenA (lpString="*.mpg") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.flv") returned 0
	[0038.188] lstrlenA (lpString="*.flv") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.avi") returned 0
	[0038.188] lstrlenA (lpString="*.avi") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp4") returned 0
	[0038.188] lstrlenA (lpString="*.mp4") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wmv") returned 0
	[0038.188] lstrlenA (lpString="*.wmv") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.divx") returned 0
	[0038.188] lstrlenA (lpString="*.divx") returned 6
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mkv") returned 0
	[0038.188] lstrlenA (lpString="*.mkv") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp3") returned 0
	[0038.188] lstrlenA (lpString="*.mp3") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wav") returned 0
	[0038.188] lstrlenA (lpString="*.wav") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.flac") returned 0
	[0038.188] lstrlenA (lpString="*.flac") returned 6
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ape") returned 0
	[0038.188] lstrlenA (lpString="*.ape") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wma") returned 0
	[0038.188] lstrlenA (lpString="*.wma") returned 5
	[0038.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ac3") returned 0
	[0038.189] lstrlenA (lpString="*.ac3") returned 5
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.exe") returned 0
	[0038.189] lstrlenA (lpString="*.exe") returned 5
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.apk") returned 0
	[0038.189] lstrlenA (lpString="*.apk") returned 5
	[0038.189] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.189] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.189] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PNG32.FLT") returned -1
	[0038.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PNG32.FLT") returned -1
	[0038.189] lstrcmpiA (lpString1="", lpString2="PNG32.FLT") returned -1
	[0038.189] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="PICTIM32.FLT"
	[0038.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.189] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.189] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PNG32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT"
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.zip") returned 0
	[0038.189] lstrlenA (lpString="*.zip") returned 5
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.rar") returned 0
	[0038.189] lstrlenA (lpString="*.rar") returned 5
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.7z") returned 0
	[0038.189] lstrlenA (lpString="*.7z") returned 4
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.tar") returned 0
	[0038.189] lstrlenA (lpString="*.tar") returned 5
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gzip") returned 0
	[0038.189] lstrlenA (lpString="*.gzip") returned 6
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpg") returned 0
	[0038.189] lstrlenA (lpString="*.jpg") returned 5
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpeg") returned 0
	[0038.189] lstrlenA (lpString="*.jpeg") returned 6
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.psd") returned 0
	[0038.189] lstrlenA (lpString="*.psd") returned 5
	[0038.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.cdr") returned 0
	[0038.190] lstrlenA (lpString="*.cdr") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dwg") returned 0
	[0038.190] lstrlenA (lpString="*.dwg") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.max") returned 0
	[0038.190] lstrlenA (lpString="*.max") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.bmp") returned 0
	[0038.190] lstrlenA (lpString="*.bmp") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gif") returned 0
	[0038.190] lstrlenA (lpString="*.gif") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.png") returned 0
	[0038.190] lstrlenA (lpString="*.png") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.doc") returned 0
	[0038.190] lstrlenA (lpString="*.doc") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.docx") returned 0
	[0038.190] lstrlenA (lpString="*.docx") returned 6
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xls") returned 0
	[0038.190] lstrlenA (lpString="*.xls") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xlsx") returned 0
	[0038.190] lstrlenA (lpString="*.xlsx") returned 6
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ppt") returned 0
	[0038.190] lstrlenA (lpString="*.ppt") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pptx") returned 0
	[0038.190] lstrlenA (lpString="*.pptx") returned 6
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.txt") returned 0
	[0038.190] lstrlenA (lpString="*.txt") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pdf") returned 0
	[0038.190] lstrlenA (lpString="*.pdf") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.djvu") returned 0
	[0038.190] lstrlenA (lpString="*.djvu") returned 6
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.htm") returned 0
	[0038.190] lstrlenA (lpString="*.htm") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.html") returned 0
	[0038.190] lstrlenA (lpString="*.html") returned 6
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mdb") returned 0
	[0038.190] lstrlenA (lpString="*.mdb") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.cer") returned 0
	[0038.190] lstrlenA (lpString="*.cer") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.p12") returned 0
	[0038.190] lstrlenA (lpString="*.p12") returned 5
	[0038.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pfx") returned 0
	[0038.191] lstrlenA (lpString="*.pfx") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.kwm") returned 0
	[0038.191] lstrlenA (lpString="*.kwm") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pwm") returned 0
	[0038.191] lstrlenA (lpString="*.pwm") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.1cd") returned 0
	[0038.191] lstrlenA (lpString="*.1cd") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.md") returned 0
	[0038.191] lstrlenA (lpString="*.md") returned 4
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mdf") returned 0
	[0038.191] lstrlenA (lpString="*.mdf") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dbf") returned 0
	[0038.191] lstrlenA (lpString="*.dbf") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.odt") returned 0
	[0038.191] lstrlenA (lpString="*.odt") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.vob") returned 0
	[0038.191] lstrlenA (lpString="*.vob") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ifo") returned 0
	[0038.191] lstrlenA (lpString="*.ifo") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.lnk") returned 0
	[0038.191] lstrlenA (lpString="*.lnk") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.torrent") returned 0
	[0038.191] lstrlenA (lpString="*.torrent") returned 9
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mov") returned 0
	[0038.191] lstrlenA (lpString="*.mov") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.m2v") returned 0
	[0038.191] lstrlenA (lpString="*.m2v") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.3gp") returned 0
	[0038.191] lstrlenA (lpString="*.3gp") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mpeg") returned 0
	[0038.191] lstrlenA (lpString="*.mpeg") returned 6
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mpg") returned 0
	[0038.191] lstrlenA (lpString="*.mpg") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.flv") returned 0
	[0038.191] lstrlenA (lpString="*.flv") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.avi") returned 0
	[0038.191] lstrlenA (lpString="*.avi") returned 5
	[0038.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mp4") returned 0
	[0038.192] lstrlenA (lpString="*.mp4") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wmv") returned 0
	[0038.192] lstrlenA (lpString="*.wmv") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.divx") returned 0
	[0038.192] lstrlenA (lpString="*.divx") returned 6
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mkv") returned 0
	[0038.192] lstrlenA (lpString="*.mkv") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mp3") returned 0
	[0038.192] lstrlenA (lpString="*.mp3") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wav") returned 0
	[0038.192] lstrlenA (lpString="*.wav") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.flac") returned 0
	[0038.192] lstrlenA (lpString="*.flac") returned 6
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ape") returned 0
	[0038.192] lstrlenA (lpString="*.ape") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wma") returned 0
	[0038.192] lstrlenA (lpString="*.wma") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ac3") returned 0
	[0038.192] lstrlenA (lpString="*.ac3") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.exe") returned 0
	[0038.192] lstrlenA (lpString="*.exe") returned 5
	[0038.192] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.apk") returned 0
	[0038.192] lstrlenA (lpString="*.apk") returned 5
	[0038.192] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.192] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.192] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WPGIMP32.FLT") returned -1
	[0038.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPGIMP32.FLT") returned -1
	[0038.192] lstrcmpiA (lpString1="", lpString2="WPGIMP32.FLT") returned -1
	[0038.192] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="PNG32.FLT"
	[0038.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\"
	[0038.192] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned=""
	[0038.192] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt"
	[0038.192] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20
	[0038.192] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="WPGIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT"
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.zip") returned 0
	[0038.193] lstrlenA (lpString="*.zip") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.rar") returned 0
	[0038.193] lstrlenA (lpString="*.rar") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.7z") returned 0
	[0038.193] lstrlenA (lpString="*.7z") returned 4
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.tar") returned 0
	[0038.193] lstrlenA (lpString="*.tar") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.gzip") returned 0
	[0038.193] lstrlenA (lpString="*.gzip") returned 6
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.jpg") returned 0
	[0038.193] lstrlenA (lpString="*.jpg") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.jpeg") returned 0
	[0038.193] lstrlenA (lpString="*.jpeg") returned 6
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.psd") returned 0
	[0038.193] lstrlenA (lpString="*.psd") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.cdr") returned 0
	[0038.193] lstrlenA (lpString="*.cdr") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.dwg") returned 0
	[0038.193] lstrlenA (lpString="*.dwg") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.max") returned 0
	[0038.193] lstrlenA (lpString="*.max") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.bmp") returned 0
	[0038.193] lstrlenA (lpString="*.bmp") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.gif") returned 0
	[0038.193] lstrlenA (lpString="*.gif") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.png") returned 0
	[0038.193] lstrlenA (lpString="*.png") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.doc") returned 0
	[0038.193] lstrlenA (lpString="*.doc") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.docx") returned 0
	[0038.193] lstrlenA (lpString="*.docx") returned 6
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.xls") returned 0
	[0038.193] lstrlenA (lpString="*.xls") returned 5
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.xlsx") returned 0
	[0038.193] lstrlenA (lpString="*.xlsx") returned 6
	[0038.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ppt") returned 0
	[0038.193] lstrlenA (lpString="*.ppt") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pptx") returned 0
	[0038.194] lstrlenA (lpString="*.pptx") returned 6
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.txt") returned 0
	[0038.194] lstrlenA (lpString="*.txt") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pdf") returned 0
	[0038.194] lstrlenA (lpString="*.pdf") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.djvu") returned 0
	[0038.194] lstrlenA (lpString="*.djvu") returned 6
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.htm") returned 0
	[0038.194] lstrlenA (lpString="*.htm") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.html") returned 0
	[0038.194] lstrlenA (lpString="*.html") returned 6
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mdb") returned 0
	[0038.194] lstrlenA (lpString="*.mdb") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.cer") returned 0
	[0038.194] lstrlenA (lpString="*.cer") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.p12") returned 0
	[0038.194] lstrlenA (lpString="*.p12") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pfx") returned 0
	[0038.194] lstrlenA (lpString="*.pfx") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.kwm") returned 0
	[0038.194] lstrlenA (lpString="*.kwm") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pwm") returned 0
	[0038.194] lstrlenA (lpString="*.pwm") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.1cd") returned 0
	[0038.194] lstrlenA (lpString="*.1cd") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.md") returned 0
	[0038.194] lstrlenA (lpString="*.md") returned 4
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mdf") returned 0
	[0038.194] lstrlenA (lpString="*.mdf") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.dbf") returned 0
	[0038.194] lstrlenA (lpString="*.dbf") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.odt") returned 0
	[0038.194] lstrlenA (lpString="*.odt") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.vob") returned 0
	[0038.194] lstrlenA (lpString="*.vob") returned 5
	[0038.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ifo") returned 0
	[0038.194] lstrlenA (lpString="*.ifo") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.lnk") returned 0
	[0038.195] lstrlenA (lpString="*.lnk") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.torrent") returned 0
	[0038.195] lstrlenA (lpString="*.torrent") returned 9
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mov") returned 0
	[0038.195] lstrlenA (lpString="*.mov") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.m2v") returned 0
	[0038.195] lstrlenA (lpString="*.m2v") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.3gp") returned 0
	[0038.195] lstrlenA (lpString="*.3gp") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mpeg") returned 0
	[0038.195] lstrlenA (lpString="*.mpeg") returned 6
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mpg") returned 0
	[0038.195] lstrlenA (lpString="*.mpg") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.flv") returned 0
	[0038.195] lstrlenA (lpString="*.flv") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.avi") returned 0
	[0038.195] lstrlenA (lpString="*.avi") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mp4") returned 0
	[0038.195] lstrlenA (lpString="*.mp4") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wmv") returned 0
	[0038.195] lstrlenA (lpString="*.wmv") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.divx") returned 0
	[0038.195] lstrlenA (lpString="*.divx") returned 6
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mkv") returned 0
	[0038.195] lstrlenA (lpString="*.mkv") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mp3") returned 0
	[0038.195] lstrlenA (lpString="*.mp3") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wav") returned 0
	[0038.195] lstrlenA (lpString="*.wav") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.flac") returned 0
	[0038.195] lstrlenA (lpString="*.flac") returned 6
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ape") returned 0
	[0038.195] lstrlenA (lpString="*.ape") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wma") returned 0
	[0038.195] lstrlenA (lpString="*.wma") returned 5
	[0038.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ac3") returned 0
	[0038.195] lstrlenA (lpString="*.ac3") returned 5
	[0038.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.exe") returned 0
	[0038.196] lstrlenA (lpString="*.exe") returned 5
	[0038.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.apk") returned 0
	[0038.196] lstrlenA (lpString="*.apk") returned 5
	[0038.196] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0038.196] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.196] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0038.196] lstrcmpA (lpString1=".", lpString2="Help") returned -1
	[0038.196] lstrcmpA (lpString1="..", lpString2="Help") returned -1
	[0038.196] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0038.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Help" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help"
	[0038.196] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned 51
	[0038.196] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e48
	[0038.197] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.197] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.197] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.197] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.197] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.197] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hxds.dll") returned -1
	[0038.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxds.dll") returned -1
	[0038.197] lstrcmpiA (lpString1="", lpString2="hxds.dll") returned -1
	[0038.197] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*") returned="*.*"
	[0038.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\"
	[0038.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned=""
	[0038.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt"
	[0038.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0xffffffff
	[0038.197] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.198] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.198] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.199] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.199] CloseHandle (hObject=0x8c) returned 1
	[0038.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="hxds.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll"
	[0038.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.zip") returned 0
	[0038.199] lstrlenA (lpString="*.zip") returned 5
	[0038.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.rar") returned 0
	[0038.199] lstrlenA (lpString="*.rar") returned 5
	[0038.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.7z") returned 0
	[0038.199] lstrlenA (lpString="*.7z") returned 4
	[0038.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.tar") returned 0
	[0038.199] lstrlenA (lpString="*.tar") returned 5
	[0038.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.gzip") returned 0
	[0038.199] lstrlenA (lpString="*.gzip") returned 6
	[0038.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.jpg") returned 0
	[0038.199] lstrlenA (lpString="*.jpg") returned 5
	[0038.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.jpeg") returned 0
	[0038.199] lstrlenA (lpString="*.jpeg") returned 6
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.psd") returned 0
	[0038.200] lstrlenA (lpString="*.psd") returned 5
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.cdr") returned 0
	[0038.200] lstrlenA (lpString="*.cdr") returned 5
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.dwg") returned 0
	[0038.200] lstrlenA (lpString="*.dwg") returned 5
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.max") returned 0
	[0038.200] lstrlenA (lpString="*.max") returned 5
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.bmp") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.gif") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.png") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.doc") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.docx") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.xls") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.xlsx") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.ppt") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.pptx") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.txt") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.pdf") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.djvu") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.htm") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.html") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mdb") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.cer") returned 0
	[0038.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.p12") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.pfx") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.kwm") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.pwm") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.1cd") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.md") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mdf") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.dbf") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.odt") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.vob") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.ifo") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.lnk") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.torrent") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mov") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.m2v") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.3gp") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mpeg") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mpg") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.flv") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.avi") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mp4") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.wmv") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.divx") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mkv") returned 0
	[0038.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mp3") returned 0
	[0038.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.wav") returned 0
	[0038.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.flac") returned 0
	[0038.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.ape") returned 0
	[0038.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.wma") returned 0
	[0038.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.ac3") returned 0
	[0038.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.exe") returned 0
	[0038.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.apk") returned 0
	[0038.202] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.202] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ITIRCL55.DLL") returned -1
	[0038.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ITIRCL55.DLL") returned -1
	[0038.202] lstrcmpiA (lpString1="", lpString2="ITIRCL55.DLL") returned -1
	[0038.202] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="hxds.dll"
	[0038.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\"
	[0038.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned=""
	[0038.202] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt"
	[0038.202] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20
	[0038.203] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="ITIRCL55.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL"
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.zip") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.rar") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.7z") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.tar") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.gzip") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.jpg") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.jpeg") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.psd") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.cdr") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.dwg") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.max") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.bmp") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.gif") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.png") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.doc") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.docx") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.xls") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.xlsx") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.ppt") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.pptx") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.txt") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.pdf") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.djvu") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.htm") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.html") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mdb") returned 0
	[0038.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.cer") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.p12") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.pfx") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.kwm") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.pwm") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.1cd") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.md") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mdf") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.dbf") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.odt") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.vob") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.ifo") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.lnk") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.torrent") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mov") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.m2v") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.3gp") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mpeg") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mpg") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.flv") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.avi") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mp4") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.wmv") returned 0
	[0038.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.divx") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mkv") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mp3") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.wav") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.flac") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.ape") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.wma") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.ac3") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.exe") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.apk") returned 0
	[0038.205] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.205] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.205] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msitss55.dll") returned -1
	[0038.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msitss55.dll") returned -1
	[0038.205] lstrcmpiA (lpString1="", lpString2="msitss55.dll") returned -1
	[0038.205] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="ITIRCL55.DLL"
	[0038.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\"
	[0038.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned=""
	[0038.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt"
	[0038.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20
	[0038.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="msitss55.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll"
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.zip") returned 0
	[0038.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.rar") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.7z") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.tar") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.gzip") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.jpg") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.jpeg") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.psd") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.cdr") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.dwg") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.max") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.bmp") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.gif") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.png") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.doc") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.docx") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.xls") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.xlsx") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.ppt") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.pptx") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.txt") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.pdf") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.djvu") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.htm") returned 0
	[0038.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.html") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mdb") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.cer") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.p12") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.pfx") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.kwm") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.pwm") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.1cd") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.md") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mdf") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.dbf") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.odt") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.vob") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.ifo") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.lnk") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.torrent") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mov") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.m2v") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.3gp") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mpeg") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mpg") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.flv") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.avi") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mp4") returned 0
	[0038.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.wmv") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.divx") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mkv") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mp3") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.wav") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.flac") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.ape") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.wma") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.ac3") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.exe") returned 0
	[0038.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.apk") returned 0
	[0038.208] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0038.208] FindClose (in: hFindFile=0x8b7e48 | out: hFindFile=0x8b7e48) returned 1
	[0038.208] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0038.208] lstrcmpA (lpString1=".", lpString2="ink") returned -1
	[0038.208] lstrcmpA (lpString1="..", lpString2="ink") returned -1
	[0038.208] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0038.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="ink" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink"
	[0038.208] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e48
	[0038.209] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.209] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.209] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.209] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.209] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.209] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.209] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Alphabet.xml") returned 1
	[0038.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Alphabet.xml") returned 1
	[0038.209] lstrcmpiA (lpString1="", lpString2="Alphabet.xml") returned -1
	[0038.209] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt"
	[0038.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0xffffffff
	[0038.209] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0038.210] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.211] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.211] CloseHandle (hObject=0x8c) returned 1
	[0038.211] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Alphabet.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml"
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.zip") returned 0
	[0038.211] lstrlenA (lpString="*.zip") returned 5
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.rar") returned 0
	[0038.211] lstrlenA (lpString="*.rar") returned 5
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.7z") returned 0
	[0038.211] lstrlenA (lpString="*.7z") returned 4
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.tar") returned 0
	[0038.211] lstrlenA (lpString="*.tar") returned 5
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.gzip") returned 0
	[0038.211] lstrlenA (lpString="*.gzip") returned 6
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.jpg") returned 0
	[0038.211] lstrlenA (lpString="*.jpg") returned 5
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.jpeg") returned 0
	[0038.211] lstrlenA (lpString="*.jpeg") returned 6
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.psd") returned 0
	[0038.211] lstrlenA (lpString="*.psd") returned 5
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.cdr") returned 0
	[0038.211] lstrlenA (lpString="*.cdr") returned 5
	[0038.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.dwg") returned 0
	[0038.211] lstrlenA (lpString="*.dwg") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.max") returned 0
	[0038.212] lstrlenA (lpString="*.max") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.bmp") returned 0
	[0038.212] lstrlenA (lpString="*.bmp") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.gif") returned 0
	[0038.212] lstrlenA (lpString="*.gif") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.png") returned 0
	[0038.212] lstrlenA (lpString="*.png") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.doc") returned 0
	[0038.212] lstrlenA (lpString="*.doc") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.docx") returned 0
	[0038.212] lstrlenA (lpString="*.docx") returned 6
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.xls") returned 0
	[0038.212] lstrlenA (lpString="*.xls") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.xlsx") returned 0
	[0038.212] lstrlenA (lpString="*.xlsx") returned 6
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.ppt") returned 0
	[0038.212] lstrlenA (lpString="*.ppt") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.pptx") returned 0
	[0038.212] lstrlenA (lpString="*.pptx") returned 6
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.txt") returned 0
	[0038.212] lstrlenA (lpString="*.txt") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.pdf") returned 0
	[0038.212] lstrlenA (lpString="*.pdf") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.djvu") returned 0
	[0038.212] lstrlenA (lpString="*.djvu") returned 6
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.htm") returned 0
	[0038.212] lstrlenA (lpString="*.htm") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.html") returned 0
	[0038.212] lstrlenA (lpString="*.html") returned 6
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mdb") returned 0
	[0038.212] lstrlenA (lpString="*.mdb") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.cer") returned 0
	[0038.212] lstrlenA (lpString="*.cer") returned 5
	[0038.212] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.p12") returned 0
	[0038.212] lstrlenA (lpString="*.p12") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.pfx") returned 0
	[0038.213] lstrlenA (lpString="*.pfx") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.kwm") returned 0
	[0038.213] lstrlenA (lpString="*.kwm") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.pwm") returned 0
	[0038.213] lstrlenA (lpString="*.pwm") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.1cd") returned 0
	[0038.213] lstrlenA (lpString="*.1cd") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.md") returned 0
	[0038.213] lstrlenA (lpString="*.md") returned 4
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mdf") returned 0
	[0038.213] lstrlenA (lpString="*.mdf") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.dbf") returned 0
	[0038.213] lstrlenA (lpString="*.dbf") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.odt") returned 0
	[0038.213] lstrlenA (lpString="*.odt") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.vob") returned 0
	[0038.213] lstrlenA (lpString="*.vob") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.ifo") returned 0
	[0038.213] lstrlenA (lpString="*.ifo") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.lnk") returned 0
	[0038.213] lstrlenA (lpString="*.lnk") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.torrent") returned 0
	[0038.213] lstrlenA (lpString="*.torrent") returned 9
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mov") returned 0
	[0038.213] lstrlenA (lpString="*.mov") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.m2v") returned 0
	[0038.213] lstrlenA (lpString="*.m2v") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.3gp") returned 0
	[0038.213] lstrlenA (lpString="*.3gp") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mpeg") returned 0
	[0038.213] lstrlenA (lpString="*.mpeg") returned 6
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mpg") returned 0
	[0038.213] lstrlenA (lpString="*.mpg") returned 5
	[0038.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.flv") returned 0
	[0038.213] lstrlenA (lpString="*.flv") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.avi") returned 0
	[0038.214] lstrlenA (lpString="*.avi") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mp4") returned 0
	[0038.214] lstrlenA (lpString="*.mp4") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.wmv") returned 0
	[0038.214] lstrlenA (lpString="*.wmv") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.divx") returned 0
	[0038.214] lstrlenA (lpString="*.divx") returned 6
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mkv") returned 0
	[0038.214] lstrlenA (lpString="*.mkv") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mp3") returned 0
	[0038.214] lstrlenA (lpString="*.mp3") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.wav") returned 0
	[0038.214] lstrlenA (lpString="*.wav") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.flac") returned 0
	[0038.214] lstrlenA (lpString="*.flac") returned 6
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.ape") returned 0
	[0038.214] lstrlenA (lpString="*.ape") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.wma") returned 0
	[0038.214] lstrlenA (lpString="*.wma") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.ac3") returned 0
	[0038.214] lstrlenA (lpString="*.ac3") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.exe") returned 0
	[0038.214] lstrlenA (lpString="*.exe") returned 5
	[0038.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.apk") returned 0
	[0038.214] lstrlenA (lpString="*.apk") returned 5
	[0038.214] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.214] lstrcmpA (lpString1=".", lpString2="ar-SA") returned -1
	[0038.214] lstrcmpA (lpString1="..", lpString2="ar-SA") returned -1
	[0038.214] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="Alphabet.xml"
	[0038.214] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ar-SA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA"
	[0038.214] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned 56
	[0038.214] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.216] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.216] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.216] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.216] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.216] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.216] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.216] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.216] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*") returned="*.*"
	[0038.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\"
	[0038.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned=""
	[0038.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt"
	[0038.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt")) returned 0xffffffff
	[0038.216] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.217] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.217] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.218] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.218] CloseHandle (hObject=0x90) returned 1
	[0038.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui"
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.zip") returned 0
	[0038.218] lstrlenA (lpString="*.zip") returned 5
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.rar") returned 0
	[0038.218] lstrlenA (lpString="*.rar") returned 5
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.7z") returned 0
	[0038.218] lstrlenA (lpString="*.7z") returned 4
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.tar") returned 0
	[0038.218] lstrlenA (lpString="*.tar") returned 5
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gzip") returned 0
	[0038.218] lstrlenA (lpString="*.gzip") returned 6
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpg") returned 0
	[0038.218] lstrlenA (lpString="*.jpg") returned 5
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0
	[0038.218] lstrlenA (lpString="*.jpeg") returned 6
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.psd") returned 0
	[0038.218] lstrlenA (lpString="*.psd") returned 5
	[0038.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.cdr") returned 0
	[0038.218] lstrlenA (lpString="*.cdr") returned 5
	[0038.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.dwg") returned 0
	[0038.219] lstrlenA (lpString="*.dwg") returned 5
	[0038.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.max") returned 0
	[0038.219] lstrlenA (lpString="*.max") returned 5
	[0038.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.bmp") returned 0
	[0038.219] lstrlenA (lpString="*.bmp") returned 5
	[0038.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gif") returned 0
	[0038.219] lstrlenA (lpString="*.gif") returned 5
	[0038.219] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.219] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.219] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.219] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1
	[0038.219] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1
	[0038.219] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="bg-BG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG"
	[0038.219] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned 56
	[0038.219] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.220] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.220] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.220] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.220] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.220] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.220] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.220] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.220] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.220] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*") returned="*.*"
	[0038.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\"
	[0038.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned=""
	[0038.220] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt"
	[0038.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt")) returned 0xffffffff
	[0038.220] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.222] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.222] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.223] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.223] CloseHandle (hObject=0x90) returned 1
	[0038.223] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui"
	[0038.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.zip") returned 0
	[0038.223] lstrlenA (lpString="*.zip") returned 5
	[0038.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.rar") returned 0
	[0038.223] lstrlenA (lpString="*.rar") returned 5
	[0038.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.7z") returned 0
	[0038.223] lstrlenA (lpString="*.7z") returned 4
	[0038.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.tar") returned 0
	[0038.223] lstrlenA (lpString="*.tar") returned 5
	[0038.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gzip") returned 0
	[0038.223] lstrlenA (lpString="*.gzip") returned 6
	[0038.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpg") returned 0
	[0038.224] lstrlenA (lpString="*.jpg") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0
	[0038.224] lstrlenA (lpString="*.jpeg") returned 6
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.psd") returned 0
	[0038.224] lstrlenA (lpString="*.psd") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.cdr") returned 0
	[0038.224] lstrlenA (lpString="*.cdr") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.dwg") returned 0
	[0038.224] lstrlenA (lpString="*.dwg") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.max") returned 0
	[0038.224] lstrlenA (lpString="*.max") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.bmp") returned 0
	[0038.224] lstrlenA (lpString="*.bmp") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gif") returned 0
	[0038.224] lstrlenA (lpString="*.gif") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.png") returned 0
	[0038.224] lstrlenA (lpString="*.png") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.doc") returned 0
	[0038.224] lstrlenA (lpString="*.doc") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.docx") returned 0
	[0038.224] lstrlenA (lpString="*.docx") returned 6
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xls") returned 0
	[0038.224] lstrlenA (lpString="*.xls") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0
	[0038.224] lstrlenA (lpString="*.xlsx") returned 6
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ppt") returned 0
	[0038.224] lstrlenA (lpString="*.ppt") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pptx") returned 0
	[0038.224] lstrlenA (lpString="*.pptx") returned 6
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.txt") returned 0
	[0038.224] lstrlenA (lpString="*.txt") returned 5
	[0038.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pdf") returned 0
	[0038.225] lstrlenA (lpString="*.pdf") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.djvu") returned 0
	[0038.225] lstrlenA (lpString="*.djvu") returned 6
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.htm") returned 0
	[0038.225] lstrlenA (lpString="*.htm") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.html") returned 0
	[0038.225] lstrlenA (lpString="*.html") returned 6
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mdb") returned 0
	[0038.225] lstrlenA (lpString="*.mdb") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.cer") returned 0
	[0038.225] lstrlenA (lpString="*.cer") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.p12") returned 0
	[0038.225] lstrlenA (lpString="*.p12") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pfx") returned 0
	[0038.225] lstrlenA (lpString="*.pfx") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.kwm") returned 0
	[0038.225] lstrlenA (lpString="*.kwm") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pwm") returned 0
	[0038.225] lstrlenA (lpString="*.pwm") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.1cd") returned 0
	[0038.225] lstrlenA (lpString="*.1cd") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.md") returned 0
	[0038.225] lstrlenA (lpString="*.md") returned 4
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mdf") returned 0
	[0038.225] lstrlenA (lpString="*.mdf") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.dbf") returned 0
	[0038.225] lstrlenA (lpString="*.dbf") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.odt") returned 0
	[0038.225] lstrlenA (lpString="*.odt") returned 5
	[0038.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.vob") returned 0
	[0038.225] lstrlenA (lpString="*.vob") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ifo") returned 0
	[0038.226] lstrlenA (lpString="*.ifo") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.lnk") returned 0
	[0038.226] lstrlenA (lpString="*.lnk") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.torrent") returned 0
	[0038.226] lstrlenA (lpString="*.torrent") returned 9
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mov") returned 0
	[0038.226] lstrlenA (lpString="*.mov") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.m2v") returned 0
	[0038.226] lstrlenA (lpString="*.m2v") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.3gp") returned 0
	[0038.226] lstrlenA (lpString="*.3gp") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0
	[0038.226] lstrlenA (lpString="*.mpeg") returned 6
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpg") returned 0
	[0038.226] lstrlenA (lpString="*.mpg") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flv") returned 0
	[0038.226] lstrlenA (lpString="*.flv") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.avi") returned 0
	[0038.226] lstrlenA (lpString="*.avi") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp4") returned 0
	[0038.226] lstrlenA (lpString="*.mp4") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wmv") returned 0
	[0038.226] lstrlenA (lpString="*.wmv") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.divx") returned 0
	[0038.226] lstrlenA (lpString="*.divx") returned 6
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mkv") returned 0
	[0038.226] lstrlenA (lpString="*.mkv") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp3") returned 0
	[0038.226] lstrlenA (lpString="*.mp3") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wav") returned 0
	[0038.226] lstrlenA (lpString="*.wav") returned 5
	[0038.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flac") returned 0
	[0038.227] lstrlenA (lpString="*.flac") returned 6
	[0038.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ape") returned 0
	[0038.227] lstrlenA (lpString="*.ape") returned 5
	[0038.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wma") returned 0
	[0038.227] lstrlenA (lpString="*.wma") returned 5
	[0038.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ac3") returned 0
	[0038.227] lstrlenA (lpString="*.ac3") returned 5
	[0038.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.exe") returned 0
	[0038.227] lstrlenA (lpString="*.exe") returned 5
	[0038.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.apk") returned 0
	[0038.227] lstrlenA (lpString="*.apk") returned 5
	[0038.227] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.227] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.227] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.227] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Content.xml") returned 1
	[0038.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Content.xml") returned 1
	[0038.227] lstrcmpiA (lpString1="", lpString2="Content.xml") returned -1
	[0038.227] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.227] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt"
	[0038.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20
	[0038.227] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Content.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml"
	[0038.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.zip") returned 0
	[0038.228] lstrlenA (lpString="*.zip") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.rar") returned 0
	[0038.228] lstrlenA (lpString="*.rar") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.7z") returned 0
	[0038.228] lstrlenA (lpString="*.7z") returned 4
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.tar") returned 0
	[0038.228] lstrlenA (lpString="*.tar") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.gzip") returned 0
	[0038.228] lstrlenA (lpString="*.gzip") returned 6
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.jpg") returned 0
	[0038.228] lstrlenA (lpString="*.jpg") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.jpeg") returned 0
	[0038.228] lstrlenA (lpString="*.jpeg") returned 6
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.psd") returned 0
	[0038.228] lstrlenA (lpString="*.psd") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.cdr") returned 0
	[0038.228] lstrlenA (lpString="*.cdr") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.dwg") returned 0
	[0038.228] lstrlenA (lpString="*.dwg") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.max") returned 0
	[0038.228] lstrlenA (lpString="*.max") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.bmp") returned 0
	[0038.228] lstrlenA (lpString="*.bmp") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.gif") returned 0
	[0038.228] lstrlenA (lpString="*.gif") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.png") returned 0
	[0038.228] lstrlenA (lpString="*.png") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.doc") returned 0
	[0038.228] lstrlenA (lpString="*.doc") returned 5
	[0038.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.docx") returned 0
	[0038.228] lstrlenA (lpString="*.docx") returned 6
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.xls") returned 0
	[0038.229] lstrlenA (lpString="*.xls") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.xlsx") returned 0
	[0038.229] lstrlenA (lpString="*.xlsx") returned 6
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.ppt") returned 0
	[0038.229] lstrlenA (lpString="*.ppt") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.pptx") returned 0
	[0038.229] lstrlenA (lpString="*.pptx") returned 6
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.txt") returned 0
	[0038.229] lstrlenA (lpString="*.txt") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.pdf") returned 0
	[0038.229] lstrlenA (lpString="*.pdf") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.djvu") returned 0
	[0038.229] lstrlenA (lpString="*.djvu") returned 6
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.htm") returned 0
	[0038.229] lstrlenA (lpString="*.htm") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.html") returned 0
	[0038.229] lstrlenA (lpString="*.html") returned 6
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mdb") returned 0
	[0038.229] lstrlenA (lpString="*.mdb") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.cer") returned 0
	[0038.229] lstrlenA (lpString="*.cer") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.p12") returned 0
	[0038.229] lstrlenA (lpString="*.p12") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.pfx") returned 0
	[0038.229] lstrlenA (lpString="*.pfx") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.kwm") returned 0
	[0038.229] lstrlenA (lpString="*.kwm") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.pwm") returned 0
	[0038.229] lstrlenA (lpString="*.pwm") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.1cd") returned 0
	[0038.229] lstrlenA (lpString="*.1cd") returned 5
	[0038.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.md") returned 0
	[0038.230] lstrlenA (lpString="*.md") returned 4
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mdf") returned 0
	[0038.230] lstrlenA (lpString="*.mdf") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.dbf") returned 0
	[0038.230] lstrlenA (lpString="*.dbf") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.odt") returned 0
	[0038.230] lstrlenA (lpString="*.odt") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.vob") returned 0
	[0038.230] lstrlenA (lpString="*.vob") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.ifo") returned 0
	[0038.230] lstrlenA (lpString="*.ifo") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.lnk") returned 0
	[0038.230] lstrlenA (lpString="*.lnk") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.torrent") returned 0
	[0038.230] lstrlenA (lpString="*.torrent") returned 9
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mov") returned 0
	[0038.230] lstrlenA (lpString="*.mov") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.m2v") returned 0
	[0038.230] lstrlenA (lpString="*.m2v") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.3gp") returned 0
	[0038.230] lstrlenA (lpString="*.3gp") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mpeg") returned 0
	[0038.230] lstrlenA (lpString="*.mpeg") returned 6
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mpg") returned 0
	[0038.230] lstrlenA (lpString="*.mpg") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.flv") returned 0
	[0038.230] lstrlenA (lpString="*.flv") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.avi") returned 0
	[0038.230] lstrlenA (lpString="*.avi") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mp4") returned 0
	[0038.230] lstrlenA (lpString="*.mp4") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.wmv") returned 0
	[0038.230] lstrlenA (lpString="*.wmv") returned 5
	[0038.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.divx") returned 0
	[0038.230] lstrlenA (lpString="*.divx") returned 6
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mkv") returned 0
	[0038.231] lstrlenA (lpString="*.mkv") returned 5
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mp3") returned 0
	[0038.231] lstrlenA (lpString="*.mp3") returned 5
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.wav") returned 0
	[0038.231] lstrlenA (lpString="*.wav") returned 5
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.flac") returned 0
	[0038.231] lstrlenA (lpString="*.flac") returned 6
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.ape") returned 0
	[0038.231] lstrlenA (lpString="*.ape") returned 5
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.wma") returned 0
	[0038.231] lstrlenA (lpString="*.wma") returned 5
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.ac3") returned 0
	[0038.231] lstrlenA (lpString="*.ac3") returned 5
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.exe") returned 0
	[0038.231] lstrlenA (lpString="*.exe") returned 5
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.apk") returned 0
	[0038.231] lstrlenA (lpString="*.apk") returned 5
	[0038.231] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.231] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.231] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ConvertInkStore.exe") returned 1
	[0038.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ConvertInkStore.exe") returned 1
	[0038.231] lstrcmpiA (lpString1="", lpString2="ConvertInkStore.exe") returned -1
	[0038.231] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="Content.xml"
	[0038.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.231] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt"
	[0038.231] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20
	[0038.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ConvertInkStore.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe"
	[0038.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.zip") returned 0
	[0038.231] lstrlenA (lpString="*.zip") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.rar") returned 0
	[0038.232] lstrlenA (lpString="*.rar") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.7z") returned 0
	[0038.232] lstrlenA (lpString="*.7z") returned 4
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.tar") returned 0
	[0038.232] lstrlenA (lpString="*.tar") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.gzip") returned 0
	[0038.232] lstrlenA (lpString="*.gzip") returned 6
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.jpg") returned 0
	[0038.232] lstrlenA (lpString="*.jpg") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.jpeg") returned 0
	[0038.232] lstrlenA (lpString="*.jpeg") returned 6
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.psd") returned 0
	[0038.232] lstrlenA (lpString="*.psd") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.cdr") returned 0
	[0038.232] lstrlenA (lpString="*.cdr") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.dwg") returned 0
	[0038.232] lstrlenA (lpString="*.dwg") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.max") returned 0
	[0038.232] lstrlenA (lpString="*.max") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.bmp") returned 0
	[0038.232] lstrlenA (lpString="*.bmp") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.gif") returned 0
	[0038.232] lstrlenA (lpString="*.gif") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.png") returned 0
	[0038.232] lstrlenA (lpString="*.png") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.doc") returned 0
	[0038.232] lstrlenA (lpString="*.doc") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.docx") returned 0
	[0038.232] lstrlenA (lpString="*.docx") returned 6
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.xls") returned 0
	[0038.232] lstrlenA (lpString="*.xls") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.xlsx") returned 0
	[0038.232] lstrlenA (lpString="*.xlsx") returned 6
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.ppt") returned 0
	[0038.232] lstrlenA (lpString="*.ppt") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.pptx") returned 0
	[0038.232] lstrlenA (lpString="*.pptx") returned 6
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.txt") returned 0
	[0038.232] lstrlenA (lpString="*.txt") returned 5
	[0038.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.pdf") returned 0
	[0038.233] lstrlenA (lpString="*.pdf") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.djvu") returned 0
	[0038.233] lstrlenA (lpString="*.djvu") returned 6
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.htm") returned 0
	[0038.233] lstrlenA (lpString="*.htm") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.html") returned 0
	[0038.233] lstrlenA (lpString="*.html") returned 6
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mdb") returned 0
	[0038.233] lstrlenA (lpString="*.mdb") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.cer") returned 0
	[0038.233] lstrlenA (lpString="*.cer") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.p12") returned 0
	[0038.233] lstrlenA (lpString="*.p12") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.pfx") returned 0
	[0038.233] lstrlenA (lpString="*.pfx") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.kwm") returned 0
	[0038.233] lstrlenA (lpString="*.kwm") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.pwm") returned 0
	[0038.233] lstrlenA (lpString="*.pwm") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.1cd") returned 0
	[0038.233] lstrlenA (lpString="*.1cd") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.md") returned 0
	[0038.233] lstrlenA (lpString="*.md") returned 4
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mdf") returned 0
	[0038.233] lstrlenA (lpString="*.mdf") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.dbf") returned 0
	[0038.233] lstrlenA (lpString="*.dbf") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.odt") returned 0
	[0038.233] lstrlenA (lpString="*.odt") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.vob") returned 0
	[0038.233] lstrlenA (lpString="*.vob") returned 5
	[0038.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.ifo") returned 0
	[0038.233] lstrlenA (lpString="*.ifo") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.lnk") returned 0
	[0038.234] lstrlenA (lpString="*.lnk") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.torrent") returned 0
	[0038.234] lstrlenA (lpString="*.torrent") returned 9
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mov") returned 0
	[0038.234] lstrlenA (lpString="*.mov") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.m2v") returned 0
	[0038.234] lstrlenA (lpString="*.m2v") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.3gp") returned 0
	[0038.234] lstrlenA (lpString="*.3gp") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mpeg") returned 0
	[0038.234] lstrlenA (lpString="*.mpeg") returned 6
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mpg") returned 0
	[0038.234] lstrlenA (lpString="*.mpg") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.flv") returned 0
	[0038.234] lstrlenA (lpString="*.flv") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.avi") returned 0
	[0038.234] lstrlenA (lpString="*.avi") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mp4") returned 0
	[0038.234] lstrlenA (lpString="*.mp4") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.wmv") returned 0
	[0038.234] lstrlenA (lpString="*.wmv") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.divx") returned 0
	[0038.234] lstrlenA (lpString="*.divx") returned 6
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mkv") returned 0
	[0038.234] lstrlenA (lpString="*.mkv") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mp3") returned 0
	[0038.234] lstrlenA (lpString="*.mp3") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.wav") returned 0
	[0038.234] lstrlenA (lpString="*.wav") returned 5
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.flac") returned 0
	[0038.234] lstrlenA (lpString="*.flac") returned 6
	[0038.234] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.ape") returned 0
	[0038.235] lstrlenA (lpString="*.ape") returned 5
	[0038.235] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.wma") returned 0
	[0038.235] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.ac3") returned 0
	[0038.235] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.exe") returned 1
	[0038.235] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe"
	[0038.235] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe"
	[0038.235] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe."
	[0038.235] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.Boom"
	[0038.235] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.235] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.235] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1
	[0038.235] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1
	[0038.235] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="ConvertInkStore.exe"
	[0038.235] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="cs-CZ" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ"
	[0038.235] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.236] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.236] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.236] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.236] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.236] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.236] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.236] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.236] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*") returned="*.*"
	[0038.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\"
	[0038.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned=""
	[0038.236] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt"
	[0038.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff
	[0038.237] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.237] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.238] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.238] CloseHandle (hObject=0x90) returned 1
	[0038.238] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui"
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.zip") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.rar") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.7z") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.tar") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gzip") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpg") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.psd") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.cdr") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.dwg") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.max") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.bmp") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gif") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.png") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.doc") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.docx") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xls") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ppt") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pptx") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.txt") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pdf") returned 0
	[0038.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.djvu") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.htm") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.html") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mdb") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.cer") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.p12") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pfx") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.kwm") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pwm") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.1cd") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.md") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mdf") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.dbf") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.odt") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.vob") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ifo") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.lnk") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.torrent") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mov") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.m2v") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.3gp") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpg") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flv") returned 0
	[0038.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.avi") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp4") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wmv") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.divx") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mkv") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp3") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wav") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flac") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ape") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wma") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ac3") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.exe") returned 0
	[0038.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.apk") returned 0
	[0038.241] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.241] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.241] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.241] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1
	[0038.241] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1
	[0038.241] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.241] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="da-DK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK"
	[0038.241] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned 56
	[0038.241] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.242] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.242] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.242] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.242] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.242] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.242] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.242] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.242] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*") returned="*.*"
	[0038.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\"
	[0038.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned=""
	[0038.242] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt"
	[0038.242] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt")) returned 0xffffffff
	[0038.242] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.243] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.243] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.244] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.244] CloseHandle (hObject=0x90) returned 1
	[0038.244] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui"
	[0038.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.zip") returned 0
	[0038.244] lstrlenA (lpString="*.zip") returned 5
	[0038.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.rar") returned 0
	[0038.244] lstrlenA (lpString="*.rar") returned 5
	[0038.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.7z") returned 0
	[0038.244] lstrlenA (lpString="*.7z") returned 4
	[0038.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.tar") returned 0
	[0038.244] lstrlenA (lpString="*.tar") returned 5
	[0038.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gzip") returned 0
	[0038.245] lstrlenA (lpString="*.gzip") returned 6
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpg") returned 0
	[0038.245] lstrlenA (lpString="*.jpg") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0
	[0038.245] lstrlenA (lpString="*.jpeg") returned 6
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.psd") returned 0
	[0038.245] lstrlenA (lpString="*.psd") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.cdr") returned 0
	[0038.245] lstrlenA (lpString="*.cdr") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.dwg") returned 0
	[0038.245] lstrlenA (lpString="*.dwg") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.max") returned 0
	[0038.245] lstrlenA (lpString="*.max") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.bmp") returned 0
	[0038.245] lstrlenA (lpString="*.bmp") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gif") returned 0
	[0038.245] lstrlenA (lpString="*.gif") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.png") returned 0
	[0038.245] lstrlenA (lpString="*.png") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.doc") returned 0
	[0038.245] lstrlenA (lpString="*.doc") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.docx") returned 0
	[0038.245] lstrlenA (lpString="*.docx") returned 6
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xls") returned 0
	[0038.245] lstrlenA (lpString="*.xls") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0
	[0038.245] lstrlenA (lpString="*.xlsx") returned 6
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ppt") returned 0
	[0038.245] lstrlenA (lpString="*.ppt") returned 5
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pptx") returned 0
	[0038.245] lstrlenA (lpString="*.pptx") returned 6
	[0038.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.txt") returned 0
	[0038.245] lstrlenA (lpString="*.txt") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pdf") returned 0
	[0038.246] lstrlenA (lpString="*.pdf") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.djvu") returned 0
	[0038.246] lstrlenA (lpString="*.djvu") returned 6
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.htm") returned 0
	[0038.246] lstrlenA (lpString="*.htm") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.html") returned 0
	[0038.246] lstrlenA (lpString="*.html") returned 6
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mdb") returned 0
	[0038.246] lstrlenA (lpString="*.mdb") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.cer") returned 0
	[0038.246] lstrlenA (lpString="*.cer") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.p12") returned 0
	[0038.246] lstrlenA (lpString="*.p12") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pfx") returned 0
	[0038.246] lstrlenA (lpString="*.pfx") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.kwm") returned 0
	[0038.246] lstrlenA (lpString="*.kwm") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pwm") returned 0
	[0038.246] lstrlenA (lpString="*.pwm") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.1cd") returned 0
	[0038.246] lstrlenA (lpString="*.1cd") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.md") returned 0
	[0038.246] lstrlenA (lpString="*.md") returned 4
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mdf") returned 0
	[0038.246] lstrlenA (lpString="*.mdf") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.dbf") returned 0
	[0038.246] lstrlenA (lpString="*.dbf") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.odt") returned 0
	[0038.246] lstrlenA (lpString="*.odt") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.vob") returned 0
	[0038.246] lstrlenA (lpString="*.vob") returned 5
	[0038.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ifo") returned 0
	[0038.247] lstrlenA (lpString="*.ifo") returned 5
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.lnk") returned 0
	[0038.247] lstrlenA (lpString="*.lnk") returned 5
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.torrent") returned 0
	[0038.247] lstrlenA (lpString="*.torrent") returned 9
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mov") returned 0
	[0038.247] lstrlenA (lpString="*.mov") returned 5
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.m2v") returned 0
	[0038.247] lstrlenA (lpString="*.m2v") returned 5
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.3gp") returned 0
	[0038.247] lstrlenA (lpString="*.3gp") returned 5
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0
	[0038.247] lstrlenA (lpString="*.mpeg") returned 6
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpg") returned 0
	[0038.247] lstrlenA (lpString="*.mpg") returned 5
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flv") returned 0
	[0038.247] lstrlenA (lpString="*.flv") returned 5
	[0038.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.avi") returned 0
	[0038.247] lstrlenA (lpString="*.avi") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp4") returned 0
	[0038.248] lstrlenA (lpString="*.mp4") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wmv") returned 0
	[0038.248] lstrlenA (lpString="*.wmv") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.divx") returned 0
	[0038.248] lstrlenA (lpString="*.divx") returned 6
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mkv") returned 0
	[0038.248] lstrlenA (lpString="*.mkv") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp3") returned 0
	[0038.248] lstrlenA (lpString="*.mp3") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wav") returned 0
	[0038.248] lstrlenA (lpString="*.wav") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flac") returned 0
	[0038.248] lstrlenA (lpString="*.flac") returned 6
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ape") returned 0
	[0038.248] lstrlenA (lpString="*.ape") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wma") returned 0
	[0038.248] lstrlenA (lpString="*.wma") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ac3") returned 0
	[0038.248] lstrlenA (lpString="*.ac3") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.exe") returned 0
	[0038.248] lstrlenA (lpString="*.exe") returned 5
	[0038.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.apk") returned 0
	[0038.248] lstrlenA (lpString="*.apk") returned 5
	[0038.248] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.248] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.248] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.248] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1
	[0038.248] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1
	[0038.249] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.249] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="de-DE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE"
	[0038.249] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned 56
	[0038.249] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.250] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.250] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.250] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.250] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.250] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.250] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.250] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.250] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*") returned="*.*"
	[0038.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\"
	[0038.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned=""
	[0038.250] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt"
	[0038.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt")) returned 0xffffffff
	[0038.250] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.251] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.251] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.252] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.252] CloseHandle (hObject=0x90) returned 1
	[0038.252] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui"
	[0038.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.zip") returned 0
	[0038.252] lstrlenA (lpString="*.zip") returned 5
	[0038.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.rar") returned 0
	[0038.252] lstrlenA (lpString="*.rar") returned 5
	[0038.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.7z") returned 0
	[0038.252] lstrlenA (lpString="*.7z") returned 4
	[0038.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.tar") returned 0
	[0038.252] lstrlenA (lpString="*.tar") returned 5
	[0038.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gzip") returned 0
	[0038.252] lstrlenA (lpString="*.gzip") returned 6
	[0038.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpg") returned 0
	[0038.252] lstrlenA (lpString="*.jpg") returned 5
	[0038.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0
	[0038.252] lstrlenA (lpString="*.jpeg") returned 6
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.psd") returned 0
	[0038.253] lstrlenA (lpString="*.psd") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.cdr") returned 0
	[0038.253] lstrlenA (lpString="*.cdr") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.dwg") returned 0
	[0038.253] lstrlenA (lpString="*.dwg") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.max") returned 0
	[0038.253] lstrlenA (lpString="*.max") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.bmp") returned 0
	[0038.253] lstrlenA (lpString="*.bmp") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gif") returned 0
	[0038.253] lstrlenA (lpString="*.gif") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.png") returned 0
	[0038.253] lstrlenA (lpString="*.png") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.doc") returned 0
	[0038.253] lstrlenA (lpString="*.doc") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.docx") returned 0
	[0038.253] lstrlenA (lpString="*.docx") returned 6
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xls") returned 0
	[0038.253] lstrlenA (lpString="*.xls") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0
	[0038.253] lstrlenA (lpString="*.xlsx") returned 6
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ppt") returned 0
	[0038.253] lstrlenA (lpString="*.ppt") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pptx") returned 0
	[0038.253] lstrlenA (lpString="*.pptx") returned 6
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.txt") returned 0
	[0038.253] lstrlenA (lpString="*.txt") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pdf") returned 0
	[0038.253] lstrlenA (lpString="*.pdf") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.djvu") returned 0
	[0038.253] lstrlenA (lpString="*.djvu") returned 6
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.htm") returned 0
	[0038.253] lstrlenA (lpString="*.htm") returned 5
	[0038.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.html") returned 0
	[0038.254] lstrlenA (lpString="*.html") returned 6
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mdb") returned 0
	[0038.254] lstrlenA (lpString="*.mdb") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.cer") returned 0
	[0038.254] lstrlenA (lpString="*.cer") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.p12") returned 0
	[0038.254] lstrlenA (lpString="*.p12") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pfx") returned 0
	[0038.254] lstrlenA (lpString="*.pfx") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.kwm") returned 0
	[0038.254] lstrlenA (lpString="*.kwm") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pwm") returned 0
	[0038.254] lstrlenA (lpString="*.pwm") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.1cd") returned 0
	[0038.254] lstrlenA (lpString="*.1cd") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.md") returned 0
	[0038.254] lstrlenA (lpString="*.md") returned 4
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mdf") returned 0
	[0038.254] lstrlenA (lpString="*.mdf") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.dbf") returned 0
	[0038.254] lstrlenA (lpString="*.dbf") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.odt") returned 0
	[0038.254] lstrlenA (lpString="*.odt") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.vob") returned 0
	[0038.254] lstrlenA (lpString="*.vob") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ifo") returned 0
	[0038.254] lstrlenA (lpString="*.ifo") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.lnk") returned 0
	[0038.254] lstrlenA (lpString="*.lnk") returned 5
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.torrent") returned 0
	[0038.254] lstrlenA (lpString="*.torrent") returned 9
	[0038.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mov") returned 0
	[0038.254] lstrlenA (lpString="*.mov") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.m2v") returned 0
	[0038.255] lstrlenA (lpString="*.m2v") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.3gp") returned 0
	[0038.255] lstrlenA (lpString="*.3gp") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0
	[0038.255] lstrlenA (lpString="*.mpeg") returned 6
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpg") returned 0
	[0038.255] lstrlenA (lpString="*.mpg") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flv") returned 0
	[0038.255] lstrlenA (lpString="*.flv") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.avi") returned 0
	[0038.255] lstrlenA (lpString="*.avi") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp4") returned 0
	[0038.255] lstrlenA (lpString="*.mp4") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wmv") returned 0
	[0038.255] lstrlenA (lpString="*.wmv") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.divx") returned 0
	[0038.255] lstrlenA (lpString="*.divx") returned 6
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mkv") returned 0
	[0038.255] lstrlenA (lpString="*.mkv") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp3") returned 0
	[0038.255] lstrlenA (lpString="*.mp3") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wav") returned 0
	[0038.255] lstrlenA (lpString="*.wav") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flac") returned 0
	[0038.255] lstrlenA (lpString="*.flac") returned 6
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ape") returned 0
	[0038.255] lstrlenA (lpString="*.ape") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wma") returned 0
	[0038.255] lstrlenA (lpString="*.wma") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ac3") returned 0
	[0038.255] lstrlenA (lpString="*.ac3") returned 5
	[0038.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.exe") returned 0
	[0038.255] lstrlenA (lpString="*.exe") returned 5
	[0038.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.apk") returned 0
	[0038.256] lstrlenA (lpString="*.apk") returned 5
	[0038.256] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.256] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.256] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.256] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1
	[0038.256] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1
	[0038.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.256] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="el-GR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR"
	[0038.256] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned 56
	[0038.256] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.257] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.257] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.257] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.257] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.257] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.257] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.257] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*") returned="*.*"
	[0038.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\"
	[0038.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned=""
	[0038.257] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt"
	[0038.257] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt")) returned 0xffffffff
	[0038.257] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.258] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.258] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.259] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.259] CloseHandle (hObject=0x90) returned 1
	[0038.259] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui"
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.zip") returned 0
	[0038.260] lstrlenA (lpString="*.zip") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.rar") returned 0
	[0038.260] lstrlenA (lpString="*.rar") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.7z") returned 0
	[0038.260] lstrlenA (lpString="*.7z") returned 4
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.tar") returned 0
	[0038.260] lstrlenA (lpString="*.tar") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0
	[0038.260] lstrlenA (lpString="*.gzip") returned 6
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0
	[0038.260] lstrlenA (lpString="*.jpg") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0
	[0038.260] lstrlenA (lpString="*.jpeg") returned 6
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.psd") returned 0
	[0038.260] lstrlenA (lpString="*.psd") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.cdr") returned 0
	[0038.260] lstrlenA (lpString="*.cdr") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.dwg") returned 0
	[0038.260] lstrlenA (lpString="*.dwg") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.max") returned 0
	[0038.260] lstrlenA (lpString="*.max") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.bmp") returned 0
	[0038.260] lstrlenA (lpString="*.bmp") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gif") returned 0
	[0038.260] lstrlenA (lpString="*.gif") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.png") returned 0
	[0038.260] lstrlenA (lpString="*.png") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.doc") returned 0
	[0038.260] lstrlenA (lpString="*.doc") returned 5
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.docx") returned 0
	[0038.260] lstrlenA (lpString="*.docx") returned 6
	[0038.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xls") returned 0
	[0038.261] lstrlenA (lpString="*.xls") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0
	[0038.261] lstrlenA (lpString="*.xlsx") returned 6
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0
	[0038.261] lstrlenA (lpString="*.ppt") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0
	[0038.261] lstrlenA (lpString="*.pptx") returned 6
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.txt") returned 0
	[0038.261] lstrlenA (lpString="*.txt") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0
	[0038.261] lstrlenA (lpString="*.pdf") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.djvu") returned 0
	[0038.261] lstrlenA (lpString="*.djvu") returned 6
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.htm") returned 0
	[0038.261] lstrlenA (lpString="*.htm") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.html") returned 0
	[0038.261] lstrlenA (lpString="*.html") returned 6
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mdb") returned 0
	[0038.261] lstrlenA (lpString="*.mdb") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.cer") returned 0
	[0038.261] lstrlenA (lpString="*.cer") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.p12") returned 0
	[0038.261] lstrlenA (lpString="*.p12") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pfx") returned 0
	[0038.261] lstrlenA (lpString="*.pfx") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.kwm") returned 0
	[0038.261] lstrlenA (lpString="*.kwm") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pwm") returned 0
	[0038.261] lstrlenA (lpString="*.pwm") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.1cd") returned 0
	[0038.261] lstrlenA (lpString="*.1cd") returned 5
	[0038.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.md") returned 0
	[0038.261] lstrlenA (lpString="*.md") returned 4
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mdf") returned 0
	[0038.262] lstrlenA (lpString="*.mdf") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.dbf") returned 0
	[0038.262] lstrlenA (lpString="*.dbf") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.odt") returned 0
	[0038.262] lstrlenA (lpString="*.odt") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.vob") returned 0
	[0038.262] lstrlenA (lpString="*.vob") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ifo") returned 0
	[0038.262] lstrlenA (lpString="*.ifo") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.lnk") returned 0
	[0038.262] lstrlenA (lpString="*.lnk") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.torrent") returned 0
	[0038.262] lstrlenA (lpString="*.torrent") returned 9
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mov") returned 0
	[0038.262] lstrlenA (lpString="*.mov") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0
	[0038.262] lstrlenA (lpString="*.m2v") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0
	[0038.262] lstrlenA (lpString="*.3gp") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0
	[0038.262] lstrlenA (lpString="*.mpeg") returned 6
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0
	[0038.262] lstrlenA (lpString="*.mpg") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flv") returned 0
	[0038.262] lstrlenA (lpString="*.flv") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.avi") returned 0
	[0038.262] lstrlenA (lpString="*.avi") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0
	[0038.262] lstrlenA (lpString="*.mp4") returned 5
	[0038.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0
	[0038.263] lstrlenA (lpString="*.wmv") returned 5
	[0038.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.divx") returned 0
	[0038.263] lstrlenA (lpString="*.divx") returned 6
	[0038.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0
	[0038.263] lstrlenA (lpString="*.mkv") returned 5
	[0038.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0
	[0038.263] lstrlenA (lpString="*.mp3") returned 5
	[0038.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wav") returned 0
	[0038.264] lstrlenA (lpString="*.wav") returned 5
	[0038.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flac") returned 0
	[0038.264] lstrlenA (lpString="*.flac") returned 6
	[0038.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ape") returned 0
	[0038.264] lstrlenA (lpString="*.ape") returned 5
	[0038.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wma") returned 0
	[0038.264] lstrlenA (lpString="*.wma") returned 5
	[0038.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0
	[0038.264] lstrlenA (lpString="*.ac3") returned 5
	[0038.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.exe") returned 0
	[0038.264] lstrlenA (lpString="*.exe") returned 5
	[0038.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.apk") returned 0
	[0038.264] lstrlenA (lpString="*.apk") returned 5
	[0038.264] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.264] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.264] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.264] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0038.264] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0038.264] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.264] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US"
	[0038.264] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned 56
	[0038.264] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.269] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.269] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.269] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.269] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.269] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.269] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-correct.avi") returned 1
	[0038.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-correct.avi") returned 1
	[0038.269] lstrcmpiA (lpString1="", lpString2="boxed-correct.avi") returned -1
	[0038.269] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*") returned="*.*"
	[0038.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.269] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0038.269] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0038.270] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0038.270] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0038.271] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.271] CloseHandle (hObject=0x90) returned 1
	[0038.271] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi"
	[0038.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.zip") returned 0
	[0038.271] lstrlenA (lpString="*.zip") returned 5
	[0038.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.rar") returned 0
	[0038.271] lstrlenA (lpString="*.rar") returned 5
	[0038.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.7z") returned 0
	[0038.271] lstrlenA (lpString="*.7z") returned 4
	[0038.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.tar") returned 0
	[0038.271] lstrlenA (lpString="*.tar") returned 5
	[0038.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gzip") returned 0
	[0038.271] lstrlenA (lpString="*.gzip") returned 6
	[0038.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpg") returned 0
	[0038.271] lstrlenA (lpString="*.jpg") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpeg") returned 0
	[0038.272] lstrlenA (lpString="*.jpeg") returned 6
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.psd") returned 0
	[0038.272] lstrlenA (lpString="*.psd") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.cdr") returned 0
	[0038.272] lstrlenA (lpString="*.cdr") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.dwg") returned 0
	[0038.272] lstrlenA (lpString="*.dwg") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.max") returned 0
	[0038.272] lstrlenA (lpString="*.max") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.bmp") returned 0
	[0038.272] lstrlenA (lpString="*.bmp") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gif") returned 0
	[0038.272] lstrlenA (lpString="*.gif") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.png") returned 0
	[0038.272] lstrlenA (lpString="*.png") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.doc") returned 0
	[0038.272] lstrlenA (lpString="*.doc") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.docx") returned 0
	[0038.272] lstrlenA (lpString="*.docx") returned 6
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xls") returned 0
	[0038.272] lstrlenA (lpString="*.xls") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xlsx") returned 0
	[0038.272] lstrlenA (lpString="*.xlsx") returned 6
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.ppt") returned 0
	[0038.272] lstrlenA (lpString="*.ppt") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pptx") returned 0
	[0038.272] lstrlenA (lpString="*.pptx") returned 6
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.txt") returned 0
	[0038.272] lstrlenA (lpString="*.txt") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pdf") returned 0
	[0038.272] lstrlenA (lpString="*.pdf") returned 5
	[0038.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.djvu") returned 0
	[0038.273] lstrlenA (lpString="*.djvu") returned 6
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.htm") returned 0
	[0038.273] lstrlenA (lpString="*.htm") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.html") returned 0
	[0038.273] lstrlenA (lpString="*.html") returned 6
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mdb") returned 0
	[0038.273] lstrlenA (lpString="*.mdb") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.cer") returned 0
	[0038.273] lstrlenA (lpString="*.cer") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.p12") returned 0
	[0038.273] lstrlenA (lpString="*.p12") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pfx") returned 0
	[0038.273] lstrlenA (lpString="*.pfx") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.kwm") returned 0
	[0038.273] lstrlenA (lpString="*.kwm") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pwm") returned 0
	[0038.273] lstrlenA (lpString="*.pwm") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.1cd") returned 0
	[0038.273] lstrlenA (lpString="*.1cd") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.md") returned 0
	[0038.273] lstrlenA (lpString="*.md") returned 4
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mdf") returned 0
	[0038.273] lstrlenA (lpString="*.mdf") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.dbf") returned 0
	[0038.273] lstrlenA (lpString="*.dbf") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.odt") returned 0
	[0038.273] lstrlenA (lpString="*.odt") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.vob") returned 0
	[0038.273] lstrlenA (lpString="*.vob") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.ifo") returned 0
	[0038.273] lstrlenA (lpString="*.ifo") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.lnk") returned 0
	[0038.273] lstrlenA (lpString="*.lnk") returned 5
	[0038.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.torrent") returned 0
	[0038.274] lstrlenA (lpString="*.torrent") returned 9
	[0038.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mov") returned 0
	[0038.274] lstrlenA (lpString="*.mov") returned 5
	[0038.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.m2v") returned 0
	[0038.274] lstrlenA (lpString="*.m2v") returned 5
	[0038.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.3gp") returned 0
	[0038.274] lstrlenA (lpString="*.3gp") returned 5
	[0038.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpeg") returned 0
	[0038.274] lstrlenA (lpString="*.mpeg") returned 6
	[0038.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpg") returned 0
	[0038.274] lstrlenA (lpString="*.mpg") returned 5
	[0038.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.flv") returned 0
	[0038.274] lstrlenA (lpString="*.flv") returned 5
	[0038.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.avi") returned 1
	[0038.274] lstrlenA (lpString="*.avi") returned 5
	[0038.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi"
	[0038.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi"
	[0038.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi."
	[0038.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.Boom"
	[0038.274] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.284] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.284] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.284] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-delete.avi") returned 1
	[0038.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-delete.avi") returned 1
	[0038.284] lstrcmpiA (lpString1="", lpString2="boxed-delete.avi") returned -1
	[0038.284] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="boxed-correct.avi"
	[0038.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.284] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.284] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.284] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.284] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi"
	[0038.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.zip") returned 0
	[0038.284] lstrlenA (lpString="*.zip") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.rar") returned 0
	[0038.285] lstrlenA (lpString="*.rar") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.7z") returned 0
	[0038.285] lstrlenA (lpString="*.7z") returned 4
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.tar") returned 0
	[0038.285] lstrlenA (lpString="*.tar") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gzip") returned 0
	[0038.285] lstrlenA (lpString="*.gzip") returned 6
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpg") returned 0
	[0038.285] lstrlenA (lpString="*.jpg") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpeg") returned 0
	[0038.285] lstrlenA (lpString="*.jpeg") returned 6
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.psd") returned 0
	[0038.285] lstrlenA (lpString="*.psd") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.cdr") returned 0
	[0038.285] lstrlenA (lpString="*.cdr") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.dwg") returned 0
	[0038.285] lstrlenA (lpString="*.dwg") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.max") returned 0
	[0038.285] lstrlenA (lpString="*.max") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.bmp") returned 0
	[0038.285] lstrlenA (lpString="*.bmp") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gif") returned 0
	[0038.285] lstrlenA (lpString="*.gif") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.png") returned 0
	[0038.285] lstrlenA (lpString="*.png") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.doc") returned 0
	[0038.285] lstrlenA (lpString="*.doc") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.docx") returned 0
	[0038.285] lstrlenA (lpString="*.docx") returned 6
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xls") returned 0
	[0038.285] lstrlenA (lpString="*.xls") returned 5
	[0038.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xlsx") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.ppt") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pptx") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.txt") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pdf") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.djvu") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.htm") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.html") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mdb") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.cer") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.p12") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pfx") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.kwm") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pwm") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.1cd") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.md") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mdf") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.dbf") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.odt") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.vob") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.ifo") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.lnk") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.torrent") returned 0
	[0038.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mov") returned 0
	[0038.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.m2v") returned 0
	[0038.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.3gp") returned 0
	[0038.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpeg") returned 0
	[0038.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpg") returned 0
	[0038.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.flv") returned 0
	[0038.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.avi") returned 1
	[0038.287] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi"
	[0038.287] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi"
	[0038.287] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi."
	[0038.287] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.Boom"
	[0038.287] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.309] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.309] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.309] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-join.avi") returned 1
	[0038.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-join.avi") returned 1
	[0038.309] lstrcmpiA (lpString1="", lpString2="boxed-join.avi") returned -1
	[0038.309] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="boxed-delete.avi"
	[0038.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.309] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.309] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.309] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.309] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi"
	[0038.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.zip") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.rar") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.7z") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.tar") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gzip") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpg") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpeg") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.psd") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.cdr") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.dwg") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.max") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.bmp") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gif") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.png") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.doc") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.docx") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xls") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xlsx") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.ppt") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pptx") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.txt") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pdf") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.djvu") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.htm") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.html") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mdb") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.cer") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.p12") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pfx") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.kwm") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pwm") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.1cd") returned 0
	[0038.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.md") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mdf") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.dbf") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.odt") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.vob") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.ifo") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.lnk") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.torrent") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mov") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.m2v") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.3gp") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpeg") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpg") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.flv") returned 0
	[0038.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.avi") returned 1
	[0038.311] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi"
	[0038.311] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi"
	[0038.311] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi."
	[0038.311] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.Boom"
	[0038.311] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.311] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.311] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.311] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-split.avi") returned 1
	[0038.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-split.avi") returned 1
	[0038.311] lstrcmpiA (lpString1="", lpString2="boxed-split.avi") returned -1
	[0038.311] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="boxed-join.avi"
	[0038.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.312] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.312] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.312] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi"
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.zip") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.rar") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.7z") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.tar") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gzip") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpg") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpeg") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.psd") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.cdr") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.dwg") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.max") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.bmp") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gif") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.png") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.doc") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.docx") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xls") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xlsx") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.ppt") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pptx") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.txt") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pdf") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.djvu") returned 0
	[0038.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.htm") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.html") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mdb") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.cer") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.p12") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pfx") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.kwm") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pwm") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.1cd") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.md") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mdf") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.dbf") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.odt") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.vob") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.ifo") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.lnk") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.torrent") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mov") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.m2v") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.3gp") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpeg") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpg") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.flv") returned 0
	[0038.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.avi") returned 1
	[0038.313] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi"
	[0038.313] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi"
	[0038.313] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi."
	[0038.313] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.Boom"
	[0038.313] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.314] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.314] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.314] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="correct.avi") returned 1
	[0038.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="correct.avi") returned 1
	[0038.314] lstrcmpiA (lpString1="", lpString2="correct.avi") returned -1
	[0038.314] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="boxed-split.avi"
	[0038.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.314] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.314] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.314] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.314] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi"
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.zip") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.rar") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.7z") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.tar") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.gzip") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.jpg") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.jpeg") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.psd") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.cdr") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.dwg") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.max") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.bmp") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.gif") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.png") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.doc") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.docx") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.xls") returned 0
	[0038.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.xlsx") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.ppt") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.pptx") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.txt") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.pdf") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.djvu") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.htm") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.html") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mdb") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.cer") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.p12") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.pfx") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.kwm") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.pwm") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.1cd") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.md") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mdf") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.dbf") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.odt") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.vob") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.ifo") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.lnk") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.torrent") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mov") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.m2v") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.3gp") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mpeg") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mpg") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.flv") returned 0
	[0038.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.avi") returned 1
	[0038.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi"
	[0038.316] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi"
	[0038.316] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi."
	[0038.316] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.Boom"
	[0038.316] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.316] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.316] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="delete.avi") returned 1
	[0038.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="delete.avi") returned 1
	[0038.316] lstrcmpiA (lpString1="", lpString2="delete.avi") returned -1
	[0038.316] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="correct.avi"
	[0038.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.316] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.316] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.316] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.316] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi"
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.zip") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.rar") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.7z") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.tar") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.gzip") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.jpg") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.jpeg") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.psd") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.cdr") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.dwg") returned 0
	[0038.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.max") returned 0
	[0038.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.bmp") returned 0
	[0038.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.gif") returned 0
	[0038.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.png") returned 0
	[0038.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi"
	[0038.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi"
	[0038.317] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi."
	[0038.317] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.Boom"
	[0038.317] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.318] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FlickLearningWizard.exe.mui") returned -1
	[0038.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe.mui") returned 1
	[0038.318] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe.mui") returned -1
	[0038.318] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="delete.avi"
	[0038.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.318] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.318] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.318] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="FlickLearningWizard.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui"
	[0038.318] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkObj.dll.mui") returned -1
	[0038.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll.mui") returned -1
	[0038.318] lstrcmpiA (lpString1="", lpString2="InkObj.dll.mui") returned -1
	[0038.318] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="FlickLearningWizard.exe.mui"
	[0038.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.318] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.318] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.318] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkObj.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui"
	[0038.318] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkWatson.exe.mui") returned -1
	[0038.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkWatson.exe.mui") returned -1
	[0038.319] lstrcmpiA (lpString1="", lpString2="InkWatson.exe.mui") returned -1
	[0038.319] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui"
	[0038.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.319] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkWatson.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui"
	[0038.319] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.319] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.319] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InputPersonalization.exe.mui") returned -1
	[0038.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe.mui") returned -1
	[0038.319] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe.mui") returned -1
	[0038.319] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="InkWatson.exe.mui"
	[0038.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.319] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InputPersonalization.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui"
	[0038.319] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.319] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.319] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPSEventLogMsg.dll.mui") returned -1
	[0038.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1
	[0038.319] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll.mui") returned -1
	[0038.319] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="InputPersonalization.exe.mui"
	[0038.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.319] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IPSEventLogMsg.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui"
	[0038.320] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.320] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IpsMigrationPlugin.dll.mui") returned -1
	[0038.320] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1
	[0038.320] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll.mui") returned -1
	[0038.320] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="IPSEventLogMsg.dll.mui"
	[0038.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.320] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.320] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IpsMigrationPlugin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui"
	[0038.320] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.320] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="join.avi") returned -1
	[0038.320] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="join.avi") returned -1
	[0038.320] lstrcmpiA (lpString1="", lpString2="join.avi") returned -1
	[0038.320] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="IpsMigrationPlugin.dll.mui"
	[0038.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.320] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.320] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi"
	[0038.320] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi"
	[0038.320] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi"
	[0038.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi."
	[0038.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.Boom"
	[0038.321] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.321] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.321] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="micaut.dll.mui") returned -1
	[0038.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll.mui") returned -1
	[0038.321] lstrcmpiA (lpString1="", lpString2="micaut.dll.mui") returned -1
	[0038.321] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="join.avi"
	[0038.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.321] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.321] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.321] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.321] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="micaut.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui"
	[0038.321] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.321] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mip.exe.mui") returned -1
	[0038.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe.mui") returned -1
	[0038.321] lstrcmpiA (lpString1="", lpString2="mip.exe.mui") returned -1
	[0038.321] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui"
	[0038.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.321] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.321] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.321] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.321] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui"
	[0038.321] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.321] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mshwLatin.dll.mui") returned -1
	[0038.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll.mui") returned -1
	[0038.322] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll.mui") returned -1
	[0038.322] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui"
	[0038.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mshwLatin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui"
	[0038.322] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.322] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtscom.dll.mui") returned -1
	[0038.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll.mui") returned -1
	[0038.322] lstrcmpiA (lpString1="", lpString2="rtscom.dll.mui") returned -1
	[0038.322] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui"
	[0038.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="rtscom.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui"
	[0038.322] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.322] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ShapeCollector.exe.mui") returned -1
	[0038.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe.mui") returned -1
	[0038.322] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe.mui") returned -1
	[0038.322] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui"
	[0038.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="ShapeCollector.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui"
	[0038.323] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.323] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="split.avi") returned -1
	[0038.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="split.avi") returned -1
	[0038.323] lstrcmpiA (lpString1="", lpString2="split.avi") returned -1
	[0038.323] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="ShapeCollector.exe.mui"
	[0038.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.323] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.323] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi"
	[0038.323] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi"
	[0038.323] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi"
	[0038.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi."
	[0038.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.Boom"
	[0038.323] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.323] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.323] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tabskb.dll.mui") returned -1
	[0038.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll.mui") returned -1
	[0038.323] lstrcmpiA (lpString1="", lpString2="tabskb.dll.mui") returned -1
	[0038.323] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="split.avi"
	[0038.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.323] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.323] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="tabskb.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui"
	[0038.324] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.324] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.324] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipBand.dll.mui") returned -1
	[0038.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipBand.dll.mui") returned -1
	[0038.324] lstrcmpiA (lpString1="", lpString2="TipBand.dll.mui") returned -1
	[0038.324] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="tabskb.dll.mui"
	[0038.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.324] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.324] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.324] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.324] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipBand.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui"
	[0038.324] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.324] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.324] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipRes.dll.mui") returned -1
	[0038.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll.mui") returned -1
	[0038.324] lstrcmpiA (lpString1="", lpString2="TipRes.dll.mui") returned -1
	[0038.324] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="TipBand.dll.mui"
	[0038.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.324] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.324] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt"
	[0038.324] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20
	[0038.324] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipRes.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui"
	[0038.324] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.324] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.324] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.324] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.324] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui"
	[0038.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.324] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.326] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.326] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.326] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipTsf.dll.mui") returned -1
	[0038.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipTsf.dll.mui") returned -1
	[0038.326] lstrcmpiA (lpString1="", lpString2="TipTsf.dll.mui") returned -1
	[0038.326] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned="tipresx.dll.mui"
	[0038.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\"
	[0038.326] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned=""
	[0038.326] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.326] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.326] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.326] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1
	[0038.327] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1
	[0038.327] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.327] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.327] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.327] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.327] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.327] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.327] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.327] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.327] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.327] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.327] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*") returned="*.*"
	[0038.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\"
	[0038.327] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned=""
	[0038.329] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.330] CloseHandle (hObject=0x90) returned 1
	[0038.330] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.330] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.330] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.330] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1
	[0038.330] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1
	[0038.330] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.330] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.333] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.333] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.333] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.333] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.333] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.333] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.333] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.333] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*") returned="*.*"
	[0038.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\"
	[0038.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned=""
	[0038.334] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.334] CloseHandle (hObject=0x90) returned 1
	[0038.334] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.334] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.334] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.335] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1
	[0038.335] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1
	[0038.335] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.335] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.335] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.335] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.335] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.335] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.335] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.335] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.335] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.335] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*") returned="*.*"
	[0038.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\"
	[0038.335] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned=""
	[0038.337] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.337] CloseHandle (hObject=0x90) returned 1
	[0038.337] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.338] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.338] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.338] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FlickAnimation.avi") returned -1
	[0038.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickAnimation.avi") returned 1
	[0038.338] lstrcmpiA (lpString1="", lpString2="FlickAnimation.avi") returned -1
	[0038.338] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.338] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.338] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FlickLearningWizard.exe") returned -1
	[0038.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe") returned 1
	[0038.338] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe") returned -1
	[0038.338] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="FlickAnimation.avi"
	[0038.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.339] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.339] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1
	[0038.339] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1
	[0038.339] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned="FlickLearningWizard.exe"
	[0038.339] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.339] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.339] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.339] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.339] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.339] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.339] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.339] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.339] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*") returned="*.*"
	[0038.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\"
	[0038.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned=""
	[0038.340] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.340] CloseHandle (hObject=0x90) returned 1
	[0038.341] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.341] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.341] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.341] lstrcmpA (lpString1=".", lpString2="fsdefinitions") returned -1
	[0038.341] lstrcmpA (lpString1="..", lpString2="fsdefinitions") returned -1
	[0038.341] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.341] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.343] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.343] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.343] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.343] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.343] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.343] lstrcmpA (lpString1=".", lpString2="auxpad") returned -1
	[0038.343] lstrcmpA (lpString1="..", lpString2="auxpad") returned -1
	[0038.343] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.343] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bb450
	[0038.344] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.344] FindNextFileA (in: hFindFile=0x8bb450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.344] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.344] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.344] FindNextFileA (in: hFindFile=0x8bb450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.344] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="auxbase.xml") returned 1
	[0038.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxbase.xml") returned 1
	[0038.344] lstrcmpiA (lpString1="", lpString2="auxbase.xml") returned -1
	[0038.344] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*") returned="*.*"
	[0038.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\"
	[0038.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned=""
	[0038.345] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.345] CloseHandle (hObject=0x94) returned 1
	[0038.345] FindNextFileA (in: hFindFile=0x8bb450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.345] FindClose (in: hFindFile=0x8bb450 | out: hFindFile=0x8bb450) returned 1
	[0038.346] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.346] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="auxpad.xml") returned 1
	[0038.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxpad.xml") returned 1
	[0038.346] lstrcmpiA (lpString1="", lpString2="auxpad.xml") returned -1
	[0038.346] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.347] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.347] CloseHandle (hObject=0x90) returned 1
	[0038.348] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.348] lstrcmpA (lpString1=".", lpString2="keypad") returned -1
	[0038.348] lstrcmpA (lpString1="..", lpString2="keypad") returned -1
	[0038.348] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned="auxpad.xml"
	[0038.348] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd450
	[0038.348] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.348] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.348] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.348] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.348] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.348] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.348] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ea.xml") returned 1
	[0038.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea.xml") returned 1
	[0038.348] lstrcmpiA (lpString1="", lpString2="ea.xml") returned -1
	[0038.348] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*") returned="*.*"
	[0038.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\"
	[0038.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned=""
	[0038.349] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.349] CloseHandle (hObject=0x94) returned 1
	[0038.349] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.349] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.349] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="keypadbase.xml") returned -1
	[0038.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypadbase.xml") returned -1
	[0038.349] lstrcmpiA (lpString1="", lpString2="keypadbase.xml") returned -1
	[0038.349] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="ea.xml"
	[0038.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\"
	[0038.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned=""
	[0038.350] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.350] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.350] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="kor-kor.xml") returned -1
	[0038.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor-kor.xml") returned -1
	[0038.350] lstrcmpiA (lpString1="", lpString2="kor-kor.xml") returned -1
	[0038.350] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="keypadbase.xml"
	[0038.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\"
	[0038.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned=""
	[0038.350] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.350] FindClose (in: hFindFile=0x8bd450 | out: hFindFile=0x8bd450) returned 1
	[0038.350] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.350] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.350] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="keypad.xml") returned -1
	[0038.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypad.xml") returned -1
	[0038.350] lstrcmpiA (lpString1="", lpString2="keypad.xml") returned -1
	[0038.350] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.350] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.350] lstrcmpA (lpString1=".", lpString2="main") returned -1
	[0038.350] lstrcmpA (lpString1="..", lpString2="main") returned -1
	[0038.350] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned="keypad.xml"
	[0038.350] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd450
	[0038.365] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.365] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.365] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.365] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.365] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.365] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.365] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base.xml") returned 1
	[0038.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base.xml") returned 1
	[0038.365] lstrcmpiA (lpString1="", lpString2="base.xml") returned -1
	[0038.365] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*") returned="*.*"
	[0038.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.365] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.366] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.366] CloseHandle (hObject=0x94) returned 1
	[0038.366] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.366] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.367] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="baseAltGr_rtl.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="baseAltGr_rtl.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="", lpString2="baseAltGr_rtl.xml") returned -1
	[0038.367] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned="base.xml"
	[0038.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.367] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.367] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.367] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_altgr.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_altgr.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="", lpString2="base_altgr.xml") returned -1
	[0038.367] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="baseAltGr_rtl.xml"
	[0038.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.367] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.367] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.367] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_ca.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_ca.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="", lpString2="base_ca.xml") returned -1
	[0038.367] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="base_altgr.xml"
	[0038.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.367] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.367] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.367] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_heb.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_heb.xml") returned 1
	[0038.367] lstrcmpiA (lpString1="", lpString2="base_heb.xml") returned -1
	[0038.367] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="base_ca.xml"
	[0038.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.368] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.368] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.368] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_jpn.xml") returned 1
	[0038.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_jpn.xml") returned 1
	[0038.368] lstrcmpiA (lpString1="", lpString2="base_jpn.xml") returned -1
	[0038.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="base_heb.xml"
	[0038.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.368] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.368] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.368] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_kor.xml") returned 1
	[0038.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_kor.xml") returned 1
	[0038.368] lstrcmpiA (lpString1="", lpString2="base_kor.xml") returned -1
	[0038.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="base_jpn.xml"
	[0038.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.368] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.368] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.368] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_rtl.xml") returned 1
	[0038.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_rtl.xml") returned 1
	[0038.368] lstrcmpiA (lpString1="", lpString2="base_rtl.xml") returned -1
	[0038.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="base_kor.xml"
	[0038.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.368] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.368] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.368] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ja-jp.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="", lpString2="ja-jp.xml") returned -1
	[0038.369] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="base_rtl.xml"
	[0038.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.369] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.369] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.369] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ko-kr.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ko-kr.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="", lpString2="ko-kr.xml") returned -1
	[0038.369] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="ja-jp.xml"
	[0038.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.369] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.369] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.369] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="zh-changjei.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-changjei.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="", lpString2="zh-changjei.xml") returned -1
	[0038.369] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="ko-kr.xml"
	[0038.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.369] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.369] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.369] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="zh-dayi.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-dayi.xml") returned -1
	[0038.369] lstrcmpiA (lpString1="", lpString2="zh-dayi.xml") returned -1
	[0038.369] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="zh-changjei.xml"
	[0038.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.370] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.370] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.370] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="zh-phonetic.xml") returned -1
	[0038.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-phonetic.xml") returned -1
	[0038.370] lstrcmpiA (lpString1="", lpString2="zh-phonetic.xml") returned -1
	[0038.370] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="zh-dayi.xml"
	[0038.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\"
	[0038.370] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned=""
	[0038.370] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.370] FindClose (in: hFindFile=0x8bd450 | out: hFindFile=0x8bd450) returned 1
	[0038.370] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.370] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.370] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="main.xml") returned -1
	[0038.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="main.xml") returned -1
	[0038.370] lstrcmpiA (lpString1="", lpString2="main.xml") returned -1
	[0038.370] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.370] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.370] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.370] lstrcmpA (lpString1=".", lpString2="numbers") returned -1
	[0038.370] lstrcmpA (lpString1="..", lpString2="numbers") returned -1
	[0038.370] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned="main.xml"
	[0038.370] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd458
	[0038.371] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.371] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.371] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.371] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.371] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.371] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.371] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="numbase.xml") returned -1
	[0038.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbase.xml") returned -1
	[0038.371] lstrcmpiA (lpString1="", lpString2="numbase.xml") returned -1
	[0038.371] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*") returned="*.*"
	[0038.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\"
	[0038.371] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned=""
	[0038.382] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.382] CloseHandle (hObject=0x94) returned 1
	[0038.382] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.382] FindClose (in: hFindFile=0x8bd458 | out: hFindFile=0x8bd458) returned 1
	[0038.382] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.382] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.382] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="numbers.xml") returned -1
	[0038.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbers.xml") returned -1
	[0038.382] lstrcmpiA (lpString1="", lpString2="numbers.xml") returned -1
	[0038.382] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.382] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.382] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.382] lstrcmpA (lpString1=".", lpString2="oskmenu") returned -1
	[0038.382] lstrcmpA (lpString1="..", lpString2="oskmenu") returned -1
	[0038.382] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned="numbers.xml"
	[0038.383] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd458
	[0038.383] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.383] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.383] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.383] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.383] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.384] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.384] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskmenubase.xml") returned -1
	[0038.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenubase.xml") returned -1
	[0038.384] lstrcmpiA (lpString1="", lpString2="oskmenubase.xml") returned -1
	[0038.384] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*") returned="*.*"
	[0038.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\"
	[0038.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned=""
	[0038.385] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.385] CloseHandle (hObject=0x94) returned 1
	[0038.385] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.386] FindClose (in: hFindFile=0x8bd458 | out: hFindFile=0x8bd458) returned 1
	[0038.386] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.386] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskmenu.xml") returned -1
	[0038.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenu.xml") returned -1
	[0038.386] lstrcmpiA (lpString1="", lpString2="oskmenu.xml") returned -1
	[0038.386] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.386] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.386] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.386] lstrcmpA (lpString1=".", lpString2="osknumpad") returned -1
	[0038.386] lstrcmpA (lpString1="..", lpString2="osknumpad") returned -1
	[0038.386] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned="oskmenu.xml"
	[0038.386] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd458
	[0038.386] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.386] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.386] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.386] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.386] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.386] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osknumpadbase.xml") returned -1
	[0038.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpadbase.xml") returned -1
	[0038.386] lstrcmpiA (lpString1="", lpString2="osknumpadbase.xml") returned -1
	[0038.386] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*") returned="*.*"
	[0038.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\"
	[0038.387] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned=""
	[0038.388] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.388] CloseHandle (hObject=0x94) returned 1
	[0038.388] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.388] FindClose (in: hFindFile=0x8bd458 | out: hFindFile=0x8bd458) returned 1
	[0038.389] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.389] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osknumpad.xml") returned -1
	[0038.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpad.xml") returned -1
	[0038.389] lstrcmpiA (lpString1="", lpString2="osknumpad.xml") returned -1
	[0038.389] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.389] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.389] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.389] lstrcmpA (lpString1=".", lpString2="oskpred") returned -1
	[0038.389] lstrcmpA (lpString1="..", lpString2="oskpred") returned -1
	[0038.389] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned="osknumpad.xml"
	[0038.389] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd458
	[0038.389] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.389] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.390] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.390] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.390] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.390] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.390] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskpredbase.xml") returned -1
	[0038.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpredbase.xml") returned -1
	[0038.390] lstrcmpiA (lpString1="", lpString2="oskpredbase.xml") returned -1
	[0038.390] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*") returned="*.*"
	[0038.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\"
	[0038.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned=""
	[0038.391] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.391] CloseHandle (hObject=0x94) returned 1
	[0038.391] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.391] FindClose (in: hFindFile=0x8bd458 | out: hFindFile=0x8bd458) returned 1
	[0038.391] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.391] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskpred.xml") returned -1
	[0038.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpred.xml") returned -1
	[0038.391] lstrcmpiA (lpString1="", lpString2="oskpred.xml") returned -1
	[0038.391] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.391] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.391] lstrcmpA (lpString1=".", lpString2="symbols") returned -1
	[0038.391] lstrcmpA (lpString1="..", lpString2="symbols") returned -1
	[0038.391] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned="oskpred.xml"
	[0038.391] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd458
	[0038.392] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.392] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.392] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.392] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.392] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.392] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.392] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ea-sym.xml") returned -1
	[0038.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea-sym.xml") returned 1
	[0038.392] lstrcmpiA (lpString1="", lpString2="ea-sym.xml") returned -1
	[0038.392] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*") returned="*.*"
	[0038.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\"
	[0038.392] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned=""
	[0038.393] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.393] CloseHandle (hObject=0x94) returned 1
	[0038.393] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.393] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.393] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ja-jp-sym.xml") returned -1
	[0038.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp-sym.xml") returned -1
	[0038.393] lstrcmpiA (lpString1="", lpString2="ja-jp-sym.xml") returned -1
	[0038.393] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="ea-sym.xml"
	[0038.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\"
	[0038.393] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned=""
	[0038.393] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.393] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.393] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="symbase.xml") returned -1
	[0038.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbase.xml") returned -1
	[0038.393] lstrcmpiA (lpString1="", lpString2="symbase.xml") returned -1
	[0038.393] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="ja-jp-sym.xml"
	[0038.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\"
	[0038.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned=""
	[0038.394] FindNextFileA (in: hFindFile=0x8bd458, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.394] FindClose (in: hFindFile=0x8bd458 | out: hFindFile=0x8bd458) returned 1
	[0038.394] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.394] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="symbols.xml") returned -1
	[0038.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbols.xml") returned -1
	[0038.394] lstrcmpiA (lpString1="", lpString2="symbols.xml") returned -1
	[0038.394] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.394] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.394] lstrcmpA (lpString1=".", lpString2="web") returned -1
	[0038.394] lstrcmpA (lpString1="..", lpString2="web") returned -1
	[0038.394] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned="symbols.xml"
	[0038.394] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8bd450
	[0038.398] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.398] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.398] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.398] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.398] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0038.398] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.398] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="webbase.xml") returned -1
	[0038.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webbase.xml") returned -1
	[0038.398] lstrcmpiA (lpString1="", lpString2="webbase.xml") returned -1
	[0038.398] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*") returned="*.*"
	[0038.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\"
	[0038.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned=""
	[0038.400] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.400] CloseHandle (hObject=0x94) returned 1
	[0038.400] FindNextFileA (in: hFindFile=0x8bd450, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0038.401] FindClose (in: hFindFile=0x8bd450 | out: hFindFile=0x8bd450) returned 1
	[0038.401] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="web.xml") returned -1
	[0038.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.xml") returned -1
	[0038.401] lstrcmpiA (lpString1="", lpString2="web.xml") returned -1
	[0038.401] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*"
	[0038.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\"
	[0038.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned=""
	[0038.401] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.401] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.401] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.401] lstrcmpA (lpString1=".", lpString2="he-IL") returned -1
	[0038.401] lstrcmpA (lpString1="..", lpString2="he-IL") returned -1
	[0038.401] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.401] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.402] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.402] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.402] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.402] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.402] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.402] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.402] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*") returned="*.*"
	[0038.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\"
	[0038.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned=""
	[0038.403] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.404] CloseHandle (hObject=0x90) returned 1
	[0038.404] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.404] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.404] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.404] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1
	[0038.404] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1
	[0038.404] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.404] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.404] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.404] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.404] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.404] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.405] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.405] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.405] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*") returned="*.*"
	[0038.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\"
	[0038.405] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned=""
	[0038.406] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.406] CloseHandle (hObject=0x90) returned 1
	[0038.406] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.406] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.406] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.406] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1
	[0038.406] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1
	[0038.406] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.406] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.407] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.407] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.407] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.407] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.407] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.407] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.407] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1
	[0038.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1
	[0038.407] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1
	[0038.407] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*") returned="*.*"
	[0038.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\"
	[0038.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned=""
	[0038.411] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.411] CloseHandle (hObject=0x90) returned 1
	[0038.411] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.411] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.411] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.411] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.411] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwrcommonlm.dat") returned -1
	[0038.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrcommonlm.dat") returned -1
	[0038.411] lstrcmpiA (lpString1="", lpString2="hwrcommonlm.dat") returned -1
	[0038.411] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.411] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.411] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1
	[0038.411] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1
	[0038.411] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="hwrcommonlm.dat"
	[0038.411] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.413] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.413] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.413] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.413] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.413] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.413] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.413] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.413] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwrenalm.dat") returned -1
	[0038.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrenalm.dat") returned -1
	[0038.413] lstrcmpiA (lpString1="", lpString2="hwrenalm.dat") returned -1
	[0038.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.413] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.413] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwrenclm.dat") returned -1
	[0038.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrenclm.dat") returned -1
	[0038.413] lstrcmpiA (lpString1="", lpString2="hwrenclm.dat") returned -1
	[0038.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="hwrenalm.dat"
	[0038.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.414] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.414] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwrlatinlm.dat") returned -1
	[0038.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrlatinlm.dat") returned -1
	[0038.414] lstrcmpiA (lpString1="", lpString2="hwrlatinlm.dat") returned -1
	[0038.414] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="hwrenclm.dat"
	[0038.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.414] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.414] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwruklm.dat") returned -1
	[0038.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwruklm.dat") returned -1
	[0038.414] lstrcmpiA (lpString1="", lpString2="hwruklm.dat") returned -1
	[0038.414] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="hwrlatinlm.dat"
	[0038.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.414] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.414] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwruksh.dat") returned -1
	[0038.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwruksh.dat") returned -1
	[0038.414] lstrcmpiA (lpString1="", lpString2="hwruksh.dat") returned -1
	[0038.414] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="hwruklm.dat"
	[0038.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.415] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.415] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.415] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwrusalm.dat") returned -1
	[0038.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusalm.dat") returned -1
	[0038.415] lstrcmpiA (lpString1="", lpString2="hwrusalm.dat") returned -1
	[0038.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned="hwruksh.dat"
	[0038.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.415] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.415] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.415] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hwrusash.dat") returned -1
	[0038.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusash.dat") returned -1
	[0038.415] lstrcmpiA (lpString1="", lpString2="hwrusash.dat") returned -1
	[0038.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned="hwrusalm.dat"
	[0038.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.415] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.415] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.415] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkDiv.dll") returned -1
	[0038.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkDiv.dll") returned -1
	[0038.415] lstrcmpiA (lpString1="", lpString2="InkDiv.dll") returned -1
	[0038.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned="hwrusash.dat"
	[0038.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.416] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.416] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkObj.dll") returned -1
	[0038.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll") returned -1
	[0038.416] lstrcmpiA (lpString1="", lpString2="InkObj.dll") returned -1
	[0038.416] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned="InkDiv.dll"
	[0038.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.416] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.416] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkWatson.exe") returned -1
	[0038.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkWatson.exe") returned -1
	[0038.416] lstrcmpiA (lpString1="", lpString2="InkWatson.exe") returned -1
	[0038.416] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned="InkObj.dll"
	[0038.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.416] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.416] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InputPersonalization.exe") returned -1
	[0038.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe") returned -1
	[0038.416] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe") returned -1
	[0038.416] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned="InkWatson.exe"
	[0038.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.417] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.417] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.417] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ipscat.xml") returned -1
	[0038.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscat.xml") returned -1
	[0038.417] lstrcmpiA (lpString1="", lpString2="ipscat.xml") returned -1
	[0038.417] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned="InputPersonalization.exe"
	[0038.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.417] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.417] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.417] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ipschs.xml") returned -1
	[0038.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipschs.xml") returned -1
	[0038.417] lstrcmpiA (lpString1="", lpString2="ipschs.xml") returned -1
	[0038.417] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned="ipscat.xml"
	[0038.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.417] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.417] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.417] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ipscht.xml") returned -1
	[0038.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscht.xml") returned -1
	[0038.418] lstrcmpiA (lpString1="", lpString2="ipscht.xml") returned -1
	[0038.418] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned="ipschs.xml"
	[0038.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.418] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.418] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ipscsy.xml") returned -1
	[0038.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscsy.xml") returned -1
	[0038.418] lstrcmpiA (lpString1="", lpString2="ipscsy.xml") returned -1
	[0038.418] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned="ipscht.xml"
	[0038.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.418] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.418] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned="ipscsy.xml"
	[0038.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.418] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned="ipsdan.xml"
	[0038.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.419] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.419] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned="ipsdeu.xml"
	[0038.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.419] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.419] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned="ipsen.xml"
	[0038.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.419] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.419] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned="ipsesp.xml"
	[0038.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.419] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.419] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.420] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned="IPSEventLogMsg.dll"
	[0038.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.420] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.420] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned="ipsfin.xml"
	[0038.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.420] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.420] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned="ipsfra.xml"
	[0038.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.420] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.420] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned="ipshrv.xml"
	[0038.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.420] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.421] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned="ipsita.xml"
	[0038.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.421] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.421] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.421] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned="ipsjpn.xml"
	[0038.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.421] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.421] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.421] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned="ipskor.xml"
	[0038.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.421] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.421] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.421] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned="IpsMigrationPlugin.dll"
	[0038.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.421] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.422] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.422] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned="ipsnld.xml"
	[0038.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.422] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.422] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.422] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.424] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned="ipsnor.xml"
	[0038.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.424] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.424] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.424] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned="ipsplk.xml"
	[0038.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.424] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.424] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.424] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned="IpsPlugin.dll"
	[0038.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.424] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.424] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.425] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned="ipsptb.xml"
	[0038.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.425] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.425] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned="ipsptg.xml"
	[0038.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.425] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.425] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned="ipsrom.xml"
	[0038.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.425] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.425] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned="ipsrus.xml"
	[0038.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.425] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.426] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned="ipssrb.xml"
	[0038.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.426] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.426] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.426] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned="ipssrl.xml"
	[0038.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.426] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.426] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1
	[0038.426] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1
	[0038.426] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned="ipssve.xml"
	[0038.426] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.427] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.427] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.427] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.427] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.427] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.427] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.427] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*") returned="*.*"
	[0038.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\"
	[0038.427] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned=""
	[0038.428] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.428] CloseHandle (hObject=0x90) returned 1
	[0038.428] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.428] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.429] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.429] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1
	[0038.429] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1
	[0038.429] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.429] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.429] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.429] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.429] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.429] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.429] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.429] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*") returned="*.*"
	[0038.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\"
	[0038.429] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\") returned=""
	[0038.430] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.431] CloseHandle (hObject=0x90) returned 1
	[0038.431] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.431] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.431] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.431] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.431] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.431] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.431] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1
	[0038.431] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1
	[0038.431] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned="journal.dll"
	[0038.431] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.432] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.432] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.432] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.432] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.432] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.432] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.432] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*") returned="*.*"
	[0038.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\"
	[0038.432] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\") returned=""
	[0038.434] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.437] CloseHandle (hObject=0x90) returned 1
	[0038.437] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.437] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.437] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.438] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1
	[0038.438] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1
	[0038.438] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.438] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.439] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.439] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.439] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.439] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.439] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.439] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.439] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*") returned="*.*"
	[0038.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\"
	[0038.439] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\") returned=""
	[0038.441] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.441] CloseHandle (hObject=0x90) returned 1
	[0038.441] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.441] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.441] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.441] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1
	[0038.441] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1
	[0038.441] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.441] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.442] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.442] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.442] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.442] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.442] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.442] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.442] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*") returned="*.*"
	[0038.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\"
	[0038.442] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\") returned=""
	[0038.443] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.443] CloseHandle (hObject=0x90) returned 1
	[0038.444] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.444] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.444] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.444] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.444] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.444] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.444] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.444] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned="micaut.dll"
	[0038.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.444] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.444] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.444] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned="Microsoft.Ink.dll"
	[0038.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.445] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.445] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.445] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned="mip.exe"
	[0038.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.445] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.445] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.445] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned="mraut.dll"
	[0038.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.445] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.445] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.445] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned="mshwgst.dll"
	[0038.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.445] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.445] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1
	[0038.445] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1
	[0038.445] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned="mshwLatin.dll"
	[0038.446] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.446] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.446] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.446] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.446] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.446] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.446] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.446] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*") returned="*.*"
	[0038.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\"
	[0038.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned=""
	[0038.448] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.448] CloseHandle (hObject=0x90) returned 1
	[0038.448] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.448] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.449] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.449] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1
	[0038.449] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1
	[0038.449] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.449] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.449] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.449] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.449] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.449] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.449] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.449] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*") returned="*.*"
	[0038.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\"
	[0038.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\") returned=""
	[0038.451] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.451] CloseHandle (hObject=0x90) returned 1
	[0038.451] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.451] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.451] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.451] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1
	[0038.451] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1
	[0038.451] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.451] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.452] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.452] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.453] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.453] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.453] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.453] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.453] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*") returned="*.*"
	[0038.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\"
	[0038.453] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\") returned=""
	[0038.454] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.454] CloseHandle (hObject=0x90) returned 1
	[0038.454] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.454] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.454] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.454] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1
	[0038.454] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1
	[0038.455] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.455] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.455] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.455] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.455] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.455] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.455] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.455] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.455] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*") returned="*.*"
	[0038.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\"
	[0038.455] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\") returned=""
	[0038.457] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.457] CloseHandle (hObject=0x90) returned 1
	[0038.457] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0038.457] FindClose (in: hFindFile=0x8b7dd0 | out: hFindFile=0x8b7dd0) returned 1
	[0038.458] FindNextFileA (in: hFindFile=0x8b7e48, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0038.458] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1
	[0038.458] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1
	[0038.458] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.458] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.458] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.458] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.458] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.458] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.458] FindNextFileA (in: hFindFile=0x8b7dd0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0038.458] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.458] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*") returned="*.*"
	[0038.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\"
	[0038.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\") returned=""
	[0038.459] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.460] CloseHandle (hObject=0x90) returned 1
	[0038.460] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1
	[0038.460] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1
	[0038.460] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.460] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.462] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.462] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.462] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.462] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.462] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*") returned="*.*"
	[0038.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\"
	[0038.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\") returned=""
	[0038.463] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.463] CloseHandle (hObject=0x90) returned 1
	[0038.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.464] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.464] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.464] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1
	[0038.464] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1
	[0038.464] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned="rtscom.dll"
	[0038.464] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.465] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.465] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.465] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.466] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.466] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*") returned="*.*"
	[0038.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\"
	[0038.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\") returned=""
	[0038.468] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.468] CloseHandle (hObject=0x90) returned 1
	[0038.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.468] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.468] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.469] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1
	[0038.469] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1
	[0038.469] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned="ShapeCollector.exe"
	[0038.469] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.469] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.469] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.470] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.470] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.470] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*") returned="*.*"
	[0038.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\"
	[0038.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned=""
	[0038.471] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.471] CloseHandle (hObject=0x90) returned 1
	[0038.471] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1
	[0038.471] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1
	[0038.471] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.471] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.472] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.472] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.472] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.472] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.472] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*") returned="*.*"
	[0038.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\"
	[0038.472] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\") returned=""
	[0038.473] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.473] CloseHandle (hObject=0x90) returned 1
	[0038.473] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1
	[0038.473] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1
	[0038.473] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.473] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.474] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.474] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.474] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.474] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.474] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*") returned="*.*"
	[0038.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\"
	[0038.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\") returned=""
	[0038.476] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.476] CloseHandle (hObject=0x90) returned 1
	[0038.476] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1
	[0038.476] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1
	[0038.476] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.476] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.477] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.478] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.478] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.478] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.478] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*") returned="*.*"
	[0038.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\"
	[0038.478] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\") returned=""
	[0038.479] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.479] CloseHandle (hObject=0x90) returned 1
	[0038.479] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.479] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.479] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.479] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.480] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned="TabIpsps.dll"
	[0038.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.480] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.480] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned="tabskb.dll"
	[0038.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.481] lstrcmpA (lpString1=".", lpString2="th-TH") returned -1
	[0038.481] lstrcmpA (lpString1="..", lpString2="th-TH") returned -1
	[0038.481] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned="TabTip.exe"
	[0038.481] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.481] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.481] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.481] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.481] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.481] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*") returned="*.*"
	[0038.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\"
	[0038.481] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\") returned=""
	[0038.483] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.483] CloseHandle (hObject=0x90) returned 1
	[0038.483] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.483] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*"
	[0038.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.483] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.483] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned="TipBand.dll"
	[0038.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.483] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.484] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned="TipRes.dll"
	[0038.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\"
	[0038.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned=""
	[0038.484] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.484] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.484] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.484] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1
	[0038.484] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1
	[0038.484] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.485] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.485] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.485] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.485] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.487] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.487] CloseHandle (hObject=0x90) returned 1
	[0038.487] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1
	[0038.487] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1
	[0038.487] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.487] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.487] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.488] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.488] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.489] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.489] CloseHandle (hObject=0x90) returned 1
	[0038.489] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1
	[0038.489] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1
	[0038.489] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.490] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.490] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.490] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.490] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.492] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.492] CloseHandle (hObject=0x90) returned 1
	[0038.493] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1
	[0038.493] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1
	[0038.493] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7dd0
	[0038.493] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.493] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.493] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.493] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.494] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.495] CloseHandle (hObject=0x90) returned 1
	[0038.495] lstrcmpA (lpString1=".", lpString2="MSClientDataMgr") returned -1
	[0038.495] lstrcmpA (lpString1="..", lpString2="MSClientDataMgr") returned -1
	[0038.495] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba438
	[0038.496] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.496] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.496] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.496] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.498] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.498] CloseHandle (hObject=0x8c) returned 1
	[0038.498] lstrcmpA (lpString1=".", lpString2="MSInfo") returned -1
	[0038.498] lstrcmpA (lpString1="..", lpString2="MSInfo") returned -1
	[0038.498] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba3a8
	[0038.498] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.498] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.498] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.498] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0038.499] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0038.499] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba3e8
	[0038.499] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.499] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.499] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.499] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.501] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.501] CloseHandle (hObject=0x90) returned 1
	[0038.502] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.512] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.512] CloseHandle (hObject=0x8c) returned 1
	[0038.531] lstrcmpA (lpString1=".", lpString2="OFFICE14") returned -1
	[0038.531] lstrcmpA (lpString1="..", lpString2="OFFICE14") returned -1
	[0038.531] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba3a8
	[0038.531] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.531] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.531] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.532] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0038.532] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0038.532] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba3e8
	[0038.532] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.532] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.533] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.533] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.534] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.534] CloseHandle (hObject=0x90) returned 1
	[0038.534] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.534] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.544] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.544] CloseHandle (hObject=0x90) returned 1
	[0038.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.boom")) returned 1
	[0038.545] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.547] FindClose (in: hFindFile=0x8ba3e8 | out: hFindFile=0x8ba3e8) returned 1
	[0038.547] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.551] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.552] CloseHandle (hObject=0x8c) returned 1
	[0038.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.554] lstrcmpA (lpString1=".", lpString2="Cultures") returned -1
	[0038.554] lstrcmpA (lpString1="..", lpString2="Cultures") returned -1
	[0038.554] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8c03b8
	[0038.556] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.556] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.556] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.556] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.558] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.558] CloseHandle (hObject=0x90) returned 1
	[0038.558] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.558] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.559] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.559] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.586] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.586] CloseHandle (hObject=0x8c) returned 1
	[0038.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.boom")) returned 1
	[0038.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.600] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.600] CloseHandle (hObject=0x8c) returned 1
	[0038.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.boom")) returned 1
	[0038.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.628] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.628] CloseHandle (hObject=0x8c) returned 1
	[0038.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.boom")) returned 1
	[0038.629] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.629] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.630] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.630] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.645] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.645] CloseHandle (hObject=0x8c) returned 1
	[0038.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.boom")) returned 1
	[0038.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.684] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0038.684] CloseHandle (hObject=0x8c) returned 1
	[0038.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.boom")) returned 1
	[0038.686] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0038.686] lstrcmpA (lpString1=".", lpString2="Office Setup Controller") returned -1
	[0038.686] lstrcmpA (lpString1="..", lpString2="Office Setup Controller") returned -1
	[0038.686] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8c03b8
	[0038.702] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.704] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.704] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.704] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1
	[0038.704] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1
	[0038.704] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.728] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.728] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.728] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.728] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.729] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.730] CloseHandle (hObject=0x94) returned 1
	[0038.730] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.730] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.730] lstrcmpA (lpString1=".", lpString2="Excel.en-us") returned -1
	[0038.730] lstrcmpA (lpString1="..", lpString2="Excel.en-us") returned -1
	[0038.730] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.731] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.731] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.731] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0038.731] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.732] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0038.732] CloseHandle (hObject=0x94) returned 1
	[0038.732] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.733] lstrcmpA (lpString1=".", lpString2="Groove.en-us") returned -1
	[0038.733] lstrcmpA (lpString1="..", lpString2="Groove.en-us") returned -1
	[0038.733] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.733] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0038.734] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0038.734] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.736] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.736] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.737] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.741] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.boom")) returned 1
	[0038.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.783] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.784] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.786] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.786] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.786] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.786] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.788] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.829] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.829] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.833] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.835] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.836] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.856] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.856] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.859] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.864] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.864] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.865] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.865] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0038.865] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.866] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.888] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.889] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.889] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.893] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.893] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.894] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.905] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.905] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.906] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.909] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.910] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.912] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.912] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.913] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.914] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.915] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.919] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.920] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0038.921] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.boom")) returned 1
	[0038.988] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.992] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b8dd8
	[0038.996] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba458
	[0039.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.boom")) returned 1
	[0039.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.boom")) returned 1
	[0039.111] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba3a8
	[0039.128] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba430
	[0039.142] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba3a8
	[0039.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.boom")) returned 1
	[0039.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned=""
	[0039.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.zip") returned 0
	[0039.466] lstrlenA (lpString="*.zip") returned 5
	[0039.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.rar") returned 0
	[0039.466] lstrlenA (lpString="*.rar") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.7z") returned 0
	[0039.467] lstrlenA (lpString="*.7z") returned 4
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.tar") returned 0
	[0039.467] lstrlenA (lpString="*.tar") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.gzip") returned 0
	[0039.467] lstrlenA (lpString="*.gzip") returned 6
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.jpg") returned 0
	[0039.467] lstrlenA (lpString="*.jpg") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.jpeg") returned 0
	[0039.467] lstrlenA (lpString="*.jpeg") returned 6
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.psd") returned 0
	[0039.467] lstrlenA (lpString="*.psd") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.cdr") returned 0
	[0039.467] lstrlenA (lpString="*.cdr") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dwg") returned 0
	[0039.467] lstrlenA (lpString="*.dwg") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.max") returned 0
	[0039.467] lstrlenA (lpString="*.max") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.bmp") returned 0
	[0039.467] lstrlenA (lpString="*.bmp") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.gif") returned 0
	[0039.467] lstrlenA (lpString="*.gif") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.png") returned 0
	[0039.467] lstrlenA (lpString="*.png") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.doc") returned 0
	[0039.467] lstrlenA (lpString="*.doc") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.docx") returned 0
	[0039.467] lstrlenA (lpString="*.docx") returned 6
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xls") returned 0
	[0039.467] lstrlenA (lpString="*.xls") returned 5
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xlsx") returned 0
	[0039.467] lstrlenA (lpString="*.xlsx") returned 6
	[0039.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ppt") returned 0
	[0039.467] lstrlenA (lpString="*.ppt") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pptx") returned 0
	[0039.468] lstrlenA (lpString="*.pptx") returned 6
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.txt") returned 0
	[0039.468] lstrlenA (lpString="*.txt") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pdf") returned 0
	[0039.468] lstrlenA (lpString="*.pdf") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.djvu") returned 0
	[0039.468] lstrlenA (lpString="*.djvu") returned 6
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.htm") returned 0
	[0039.468] lstrlenA (lpString="*.htm") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.html") returned 0
	[0039.468] lstrlenA (lpString="*.html") returned 6
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mdb") returned 0
	[0039.468] lstrlenA (lpString="*.mdb") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.cer") returned 0
	[0039.468] lstrlenA (lpString="*.cer") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.p12") returned 0
	[0039.468] lstrlenA (lpString="*.p12") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pfx") returned 0
	[0039.468] lstrlenA (lpString="*.pfx") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.kwm") returned 0
	[0039.468] lstrlenA (lpString="*.kwm") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pwm") returned 0
	[0039.468] lstrlenA (lpString="*.pwm") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.1cd") returned 0
	[0039.468] lstrlenA (lpString="*.1cd") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.md") returned 0
	[0039.468] lstrlenA (lpString="*.md") returned 4
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mdf") returned 0
	[0039.468] lstrlenA (lpString="*.mdf") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dbf") returned 0
	[0039.468] lstrlenA (lpString="*.dbf") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.odt") returned 0
	[0039.468] lstrlenA (lpString="*.odt") returned 5
	[0039.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.vob") returned 0
	[0039.469] lstrlenA (lpString="*.vob") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ifo") returned 0
	[0039.469] lstrlenA (lpString="*.ifo") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.lnk") returned 0
	[0039.469] lstrlenA (lpString="*.lnk") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.torrent") returned 0
	[0039.469] lstrlenA (lpString="*.torrent") returned 9
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mov") returned 0
	[0039.469] lstrlenA (lpString="*.mov") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.m2v") returned 0
	[0039.469] lstrlenA (lpString="*.m2v") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.3gp") returned 0
	[0039.469] lstrlenA (lpString="*.3gp") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mpeg") returned 0
	[0039.469] lstrlenA (lpString="*.mpeg") returned 6
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mpg") returned 0
	[0039.469] lstrlenA (lpString="*.mpg") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.flv") returned 0
	[0039.469] lstrlenA (lpString="*.flv") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.avi") returned 0
	[0039.469] lstrlenA (lpString="*.avi") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mp4") returned 0
	[0039.469] lstrlenA (lpString="*.mp4") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wmv") returned 0
	[0039.469] lstrlenA (lpString="*.wmv") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.divx") returned 0
	[0039.469] lstrlenA (lpString="*.divx") returned 6
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mkv") returned 0
	[0039.469] lstrlenA (lpString="*.mkv") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mp3") returned 0
	[0039.469] lstrlenA (lpString="*.mp3") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wav") returned 0
	[0039.469] lstrlenA (lpString="*.wav") returned 5
	[0039.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.flac") returned 0
	[0039.470] lstrlenA (lpString="*.flac") returned 6
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ape") returned 0
	[0039.470] lstrlenA (lpString="*.ape") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wma") returned 0
	[0039.470] lstrlenA (lpString="*.wma") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ac3") returned 0
	[0039.470] lstrlenA (lpString="*.ac3") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.exe") returned 0
	[0039.470] lstrlenA (lpString="*.exe") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.apk") returned 0
	[0039.470] lstrlenA (lpString="*.apk") returned 5
	[0039.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned=""
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.zip") returned 0
	[0039.470] lstrlenA (lpString="*.zip") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.rar") returned 0
	[0039.470] lstrlenA (lpString="*.rar") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.7z") returned 0
	[0039.470] lstrlenA (lpString="*.7z") returned 4
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.tar") returned 0
	[0039.470] lstrlenA (lpString="*.tar") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.gzip") returned 0
	[0039.470] lstrlenA (lpString="*.gzip") returned 6
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.jpg") returned 0
	[0039.470] lstrlenA (lpString="*.jpg") returned 5
	[0039.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.jpeg") returned 0
	[0039.471] lstrlenA (lpString="*.jpeg") returned 6
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.psd") returned 0
	[0039.471] lstrlenA (lpString="*.psd") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.cdr") returned 0
	[0039.471] lstrlenA (lpString="*.cdr") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dwg") returned 0
	[0039.471] lstrlenA (lpString="*.dwg") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.max") returned 0
	[0039.471] lstrlenA (lpString="*.max") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.bmp") returned 0
	[0039.471] lstrlenA (lpString="*.bmp") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.gif") returned 0
	[0039.471] lstrlenA (lpString="*.gif") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.png") returned 0
	[0039.471] lstrlenA (lpString="*.png") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.doc") returned 0
	[0039.471] lstrlenA (lpString="*.doc") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.docx") returned 0
	[0039.471] lstrlenA (lpString="*.docx") returned 6
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xls") returned 0
	[0039.471] lstrlenA (lpString="*.xls") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xlsx") returned 0
	[0039.471] lstrlenA (lpString="*.xlsx") returned 6
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ppt") returned 0
	[0039.471] lstrlenA (lpString="*.ppt") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pptx") returned 0
	[0039.471] lstrlenA (lpString="*.pptx") returned 6
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.txt") returned 0
	[0039.471] lstrlenA (lpString="*.txt") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pdf") returned 0
	[0039.471] lstrlenA (lpString="*.pdf") returned 5
	[0039.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.djvu") returned 0
	[0039.471] lstrlenA (lpString="*.djvu") returned 6
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.htm") returned 0
	[0039.472] lstrlenA (lpString="*.htm") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.html") returned 0
	[0039.472] lstrlenA (lpString="*.html") returned 6
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mdb") returned 0
	[0039.472] lstrlenA (lpString="*.mdb") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.cer") returned 0
	[0039.472] lstrlenA (lpString="*.cer") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.p12") returned 0
	[0039.472] lstrlenA (lpString="*.p12") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pfx") returned 0
	[0039.472] lstrlenA (lpString="*.pfx") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.kwm") returned 0
	[0039.472] lstrlenA (lpString="*.kwm") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pwm") returned 0
	[0039.472] lstrlenA (lpString="*.pwm") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.1cd") returned 0
	[0039.472] lstrlenA (lpString="*.1cd") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.md") returned 0
	[0039.472] lstrlenA (lpString="*.md") returned 4
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mdf") returned 0
	[0039.472] lstrlenA (lpString="*.mdf") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dbf") returned 0
	[0039.472] lstrlenA (lpString="*.dbf") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.odt") returned 0
	[0039.472] lstrlenA (lpString="*.odt") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.vob") returned 0
	[0039.472] lstrlenA (lpString="*.vob") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ifo") returned 0
	[0039.472] lstrlenA (lpString="*.ifo") returned 5
	[0039.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.lnk") returned 0
	[0039.472] lstrlenA (lpString="*.lnk") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.torrent") returned 0
	[0039.473] lstrlenA (lpString="*.torrent") returned 9
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mov") returned 0
	[0039.473] lstrlenA (lpString="*.mov") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.m2v") returned 0
	[0039.473] lstrlenA (lpString="*.m2v") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.3gp") returned 0
	[0039.473] lstrlenA (lpString="*.3gp") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mpeg") returned 0
	[0039.473] lstrlenA (lpString="*.mpeg") returned 6
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mpg") returned 0
	[0039.473] lstrlenA (lpString="*.mpg") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.flv") returned 0
	[0039.473] lstrlenA (lpString="*.flv") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.avi") returned 0
	[0039.473] lstrlenA (lpString="*.avi") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mp4") returned 0
	[0039.473] lstrlenA (lpString="*.mp4") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wmv") returned 0
	[0039.473] lstrlenA (lpString="*.wmv") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.divx") returned 0
	[0039.473] lstrlenA (lpString="*.divx") returned 6
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mkv") returned 0
	[0039.473] lstrlenA (lpString="*.mkv") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mp3") returned 0
	[0039.473] lstrlenA (lpString="*.mp3") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wav") returned 0
	[0039.473] lstrlenA (lpString="*.wav") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.flac") returned 0
	[0039.473] lstrlenA (lpString="*.flac") returned 6
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ape") returned 0
	[0039.473] lstrlenA (lpString="*.ape") returned 5
	[0039.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wma") returned 0
	[0039.474] lstrlenA (lpString="*.wma") returned 5
	[0039.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ac3") returned 0
	[0039.474] lstrlenA (lpString="*.ac3") returned 5
	[0039.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.exe") returned 0
	[0039.474] lstrlenA (lpString="*.exe") returned 5
	[0039.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.apk") returned 0
	[0039.474] lstrlenA (lpString="*.apk") returned 5
	[0039.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.zip") returned 0
	[0039.475] lstrlenA (lpString="*.zip") returned 5
	[0039.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.rar") returned 0
	[0039.475] lstrlenA (lpString="*.rar") returned 5
	[0039.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.7z") returned 0
	[0039.475] lstrlenA (lpString="*.7z") returned 4
	[0039.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.tar") returned 0
	[0039.475] lstrlenA (lpString="*.tar") returned 5
	[0039.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.gzip") returned 0
	[0039.475] lstrlenA (lpString="*.gzip") returned 6
	[0039.475] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.jpg") returned 0
	[0039.475] lstrlenA (lpString="*.jpg") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.jpeg") returned 0
	[0039.476] lstrlenA (lpString="*.jpeg") returned 6
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.psd") returned 0
	[0039.476] lstrlenA (lpString="*.psd") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.cdr") returned 0
	[0039.476] lstrlenA (lpString="*.cdr") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dwg") returned 0
	[0039.476] lstrlenA (lpString="*.dwg") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.max") returned 0
	[0039.476] lstrlenA (lpString="*.max") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.bmp") returned 0
	[0039.476] lstrlenA (lpString="*.bmp") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.gif") returned 0
	[0039.476] lstrlenA (lpString="*.gif") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.png") returned 0
	[0039.476] lstrlenA (lpString="*.png") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.doc") returned 0
	[0039.476] lstrlenA (lpString="*.doc") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.docx") returned 0
	[0039.476] lstrlenA (lpString="*.docx") returned 6
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.xls") returned 0
	[0039.476] lstrlenA (lpString="*.xls") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.xlsx") returned 0
	[0039.476] lstrlenA (lpString="*.xlsx") returned 6
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ppt") returned 0
	[0039.476] lstrlenA (lpString="*.ppt") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pptx") returned 0
	[0039.476] lstrlenA (lpString="*.pptx") returned 6
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.txt") returned 0
	[0039.476] lstrlenA (lpString="*.txt") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pdf") returned 0
	[0039.476] lstrlenA (lpString="*.pdf") returned 5
	[0039.476] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.djvu") returned 0
	[0039.476] lstrlenA (lpString="*.djvu") returned 6
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.htm") returned 0
	[0039.477] lstrlenA (lpString="*.htm") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.html") returned 0
	[0039.477] lstrlenA (lpString="*.html") returned 6
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mdb") returned 0
	[0039.477] lstrlenA (lpString="*.mdb") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.cer") returned 0
	[0039.477] lstrlenA (lpString="*.cer") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.p12") returned 0
	[0039.477] lstrlenA (lpString="*.p12") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pfx") returned 0
	[0039.477] lstrlenA (lpString="*.pfx") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.kwm") returned 0
	[0039.477] lstrlenA (lpString="*.kwm") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pwm") returned 0
	[0039.477] lstrlenA (lpString="*.pwm") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.1cd") returned 0
	[0039.477] lstrlenA (lpString="*.1cd") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.md") returned 0
	[0039.477] lstrlenA (lpString="*.md") returned 4
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mdf") returned 0
	[0039.477] lstrlenA (lpString="*.mdf") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dbf") returned 0
	[0039.477] lstrlenA (lpString="*.dbf") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.odt") returned 0
	[0039.477] lstrlenA (lpString="*.odt") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.vob") returned 0
	[0039.477] lstrlenA (lpString="*.vob") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ifo") returned 0
	[0039.477] lstrlenA (lpString="*.ifo") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.lnk") returned 0
	[0039.477] lstrlenA (lpString="*.lnk") returned 5
	[0039.477] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.torrent") returned 0
	[0039.477] lstrlenA (lpString="*.torrent") returned 9
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mov") returned 0
	[0039.478] lstrlenA (lpString="*.mov") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.m2v") returned 0
	[0039.478] lstrlenA (lpString="*.m2v") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.3gp") returned 0
	[0039.478] lstrlenA (lpString="*.3gp") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mpeg") returned 0
	[0039.478] lstrlenA (lpString="*.mpeg") returned 6
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mpg") returned 0
	[0039.478] lstrlenA (lpString="*.mpg") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.flv") returned 0
	[0039.478] lstrlenA (lpString="*.flv") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.avi") returned 0
	[0039.478] lstrlenA (lpString="*.avi") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mp4") returned 0
	[0039.478] lstrlenA (lpString="*.mp4") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.wmv") returned 0
	[0039.478] lstrlenA (lpString="*.wmv") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.divx") returned 0
	[0039.478] lstrlenA (lpString="*.divx") returned 6
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mkv") returned 0
	[0039.478] lstrlenA (lpString="*.mkv") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mp3") returned 0
	[0039.478] lstrlenA (lpString="*.mp3") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.wav") returned 0
	[0039.478] lstrlenA (lpString="*.wav") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.flac") returned 0
	[0039.478] lstrlenA (lpString="*.flac") returned 6
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ape") returned 0
	[0039.478] lstrlenA (lpString="*.ape") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.wma") returned 0
	[0039.478] lstrlenA (lpString="*.wma") returned 5
	[0039.478] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ac3") returned 0
	[0039.478] lstrlenA (lpString="*.ac3") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.exe") returned 0
	[0039.479] lstrlenA (lpString="*.exe") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.apk") returned 0
	[0039.479] lstrlenA (lpString="*.apk") returned 5
	[0039.479] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.zip") returned 0
	[0039.479] lstrlenA (lpString="*.zip") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.rar") returned 0
	[0039.479] lstrlenA (lpString="*.rar") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.7z") returned 0
	[0039.479] lstrlenA (lpString="*.7z") returned 4
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.tar") returned 0
	[0039.479] lstrlenA (lpString="*.tar") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.gzip") returned 0
	[0039.479] lstrlenA (lpString="*.gzip") returned 6
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.jpg") returned 0
	[0039.479] lstrlenA (lpString="*.jpg") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.jpeg") returned 0
	[0039.479] lstrlenA (lpString="*.jpeg") returned 6
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.psd") returned 0
	[0039.479] lstrlenA (lpString="*.psd") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.cdr") returned 0
	[0039.479] lstrlenA (lpString="*.cdr") returned 5
	[0039.479] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.dwg") returned 0
	[0039.480] lstrlenA (lpString="*.dwg") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.max") returned 0
	[0039.480] lstrlenA (lpString="*.max") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.bmp") returned 0
	[0039.480] lstrlenA (lpString="*.bmp") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.gif") returned 0
	[0039.480] lstrlenA (lpString="*.gif") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.png") returned 0
	[0039.480] lstrlenA (lpString="*.png") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.doc") returned 0
	[0039.480] lstrlenA (lpString="*.doc") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.docx") returned 0
	[0039.480] lstrlenA (lpString="*.docx") returned 6
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.xls") returned 0
	[0039.480] lstrlenA (lpString="*.xls") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.xlsx") returned 0
	[0039.480] lstrlenA (lpString="*.xlsx") returned 6
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ppt") returned 0
	[0039.480] lstrlenA (lpString="*.ppt") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pptx") returned 0
	[0039.480] lstrlenA (lpString="*.pptx") returned 6
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.txt") returned 0
	[0039.480] lstrlenA (lpString="*.txt") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pdf") returned 0
	[0039.480] lstrlenA (lpString="*.pdf") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.djvu") returned 0
	[0039.480] lstrlenA (lpString="*.djvu") returned 6
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.htm") returned 0
	[0039.480] lstrlenA (lpString="*.htm") returned 5
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.html") returned 0
	[0039.480] lstrlenA (lpString="*.html") returned 6
	[0039.480] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mdb") returned 0
	[0039.480] lstrlenA (lpString="*.mdb") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.cer") returned 0
	[0039.481] lstrlenA (lpString="*.cer") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.p12") returned 0
	[0039.481] lstrlenA (lpString="*.p12") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pfx") returned 0
	[0039.481] lstrlenA (lpString="*.pfx") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.kwm") returned 0
	[0039.481] lstrlenA (lpString="*.kwm") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pwm") returned 0
	[0039.481] lstrlenA (lpString="*.pwm") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.1cd") returned 0
	[0039.481] lstrlenA (lpString="*.1cd") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.md") returned 0
	[0039.481] lstrlenA (lpString="*.md") returned 4
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mdf") returned 0
	[0039.481] lstrlenA (lpString="*.mdf") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.dbf") returned 0
	[0039.481] lstrlenA (lpString="*.dbf") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.odt") returned 0
	[0039.481] lstrlenA (lpString="*.odt") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.vob") returned 0
	[0039.481] lstrlenA (lpString="*.vob") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ifo") returned 0
	[0039.481] lstrlenA (lpString="*.ifo") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.lnk") returned 0
	[0039.481] lstrlenA (lpString="*.lnk") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.torrent") returned 0
	[0039.481] lstrlenA (lpString="*.torrent") returned 9
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mov") returned 0
	[0039.481] lstrlenA (lpString="*.mov") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.m2v") returned 0
	[0039.481] lstrlenA (lpString="*.m2v") returned 5
	[0039.481] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.3gp") returned 0
	[0039.482] lstrlenA (lpString="*.3gp") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mpeg") returned 0
	[0039.482] lstrlenA (lpString="*.mpeg") returned 6
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mpg") returned 0
	[0039.482] lstrlenA (lpString="*.mpg") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.flv") returned 0
	[0039.482] lstrlenA (lpString="*.flv") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.avi") returned 0
	[0039.482] lstrlenA (lpString="*.avi") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mp4") returned 0
	[0039.482] lstrlenA (lpString="*.mp4") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.wmv") returned 0
	[0039.482] lstrlenA (lpString="*.wmv") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.divx") returned 0
	[0039.482] lstrlenA (lpString="*.divx") returned 6
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mkv") returned 0
	[0039.482] lstrlenA (lpString="*.mkv") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mp3") returned 0
	[0039.482] lstrlenA (lpString="*.mp3") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.wav") returned 0
	[0039.482] lstrlenA (lpString="*.wav") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.flac") returned 0
	[0039.482] lstrlenA (lpString="*.flac") returned 6
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ape") returned 0
	[0039.482] lstrlenA (lpString="*.ape") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.wma") returned 0
	[0039.482] lstrlenA (lpString="*.wma") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ac3") returned 0
	[0039.482] lstrlenA (lpString="*.ac3") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.exe") returned 0
	[0039.482] lstrlenA (lpString="*.exe") returned 5
	[0039.482] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.apk") returned 0
	[0039.483] lstrlenA (lpString="*.apk") returned 5
	[0039.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.483] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.483] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FPERSON.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL"
	[0039.483] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.zip") returned 0
	[0039.483] lstrlenA (lpString="*.zip") returned 5
	[0039.483] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.rar") returned 0
	[0039.483] lstrlenA (lpString="*.rar") returned 5
	[0039.483] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.7z") returned 0
	[0039.483] lstrlenA (lpString="*.7z") returned 4
	[0039.483] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.tar") returned 0
	[0039.483] lstrlenA (lpString="*.tar") returned 5
	[0039.483] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.gzip") returned 0
	[0039.483] lstrlenA (lpString="*.gzip") returned 6
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.jpg") returned 0
	[0039.484] lstrlenA (lpString="*.jpg") returned 5
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.jpeg") returned 0
	[0039.484] lstrlenA (lpString="*.jpeg") returned 6
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.psd") returned 0
	[0039.484] lstrlenA (lpString="*.psd") returned 5
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.cdr") returned 0
	[0039.484] lstrlenA (lpString="*.cdr") returned 5
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.dwg") returned 0
	[0039.484] lstrlenA (lpString="*.dwg") returned 5
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.max") returned 0
	[0039.484] lstrlenA (lpString="*.max") returned 5
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.bmp") returned 0
	[0039.484] lstrlenA (lpString="*.bmp") returned 5
	[0039.484] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.gif") returned 0
	[0039.484] lstrlenA (lpString="*.gif") returned 5
	[0039.484] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.484] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FPLACE.DLL") returned -1
	[0039.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPLACE.DLL") returned 1
	[0039.484] lstrcmpiA (lpString1="", lpString2="FPLACE.DLL") returned -1
	[0039.484] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned="FPERSON.DLL"
	[0039.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FPLACE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL"
	[0039.485] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.485] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FSTOCK.DLL") returned -1
	[0039.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FSTOCK.DLL") returned 1
	[0039.485] lstrcmpiA (lpString1="", lpString2="FSTOCK.DLL") returned -1
	[0039.485] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned="FPLACE.DLL"
	[0039.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FSTOCK.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL"
	[0039.485] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.485] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IETAG.DLL") returned -1
	[0039.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IETAG.DLL") returned -1
	[0039.485] lstrcmpiA (lpString1="", lpString2="IETAG.DLL") returned -1
	[0039.485] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned="FSTOCK.DLL"
	[0039.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.486] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="IETAG.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL"
	[0039.486] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.486] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMCONTACT.DLL") returned -1
	[0039.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMCONTACT.DLL") returned -1
	[0039.486] lstrcmpiA (lpString1="", lpString2="IMCONTACT.DLL") returned -1
	[0039.486] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned="IETAG.DLL"
	[0039.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.486] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.486] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="IMCONTACT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL"
	[0039.486] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.486] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned="IMCONTACT.DLL"
	[0039.486] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="LISTS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS"
	[0039.486] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba3a8
	[0039.487] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.487] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.488] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*"
	[0039.488] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033"
	[0039.488] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8ba3e8
	[0039.488] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0039.488] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0039.488] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*") returned="*.*"
	[0039.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\"
	[0039.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned=""
	[0039.488] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt"
	[0039.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0039.488] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0039.514] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="DATES.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML"
	[0039.514] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0039.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="DATES.XML"
	[0039.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\"
	[0039.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned=""
	[0039.514] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt"
	[0039.514] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20
	[0039.514] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="PHONE.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML"
	[0039.514] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0039.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="PHONE.XML"
	[0039.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\"
	[0039.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned=""
	[0039.515] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt"
	[0039.515] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20
	[0039.515] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="STOCKS.DAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT"
	[0039.515] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0039.515] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="STOCKS.DAT"
	[0039.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\"
	[0039.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned=""
	[0039.515] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt"
	[0039.515] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20
	[0039.515] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="STOCKS.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML"
	[0039.515] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0039.515] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="STOCKS.XML"
	[0039.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\"
	[0039.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned=""
	[0039.515] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt"
	[0039.515] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20
	[0039.515] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="TIME.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML"
	[0039.515] FindNextFileA (in: hFindFile=0x8ba3e8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0039.515] FindClose (in: hFindFile=0x8ba3e8 | out: hFindFile=0x8ba3e8) returned 1
	[0039.515] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.516] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BASMLA.XSL") returned 1
	[0039.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BASMLA.XSL") returned 1
	[0039.516] lstrcmpiA (lpString1="", lpString2="BASMLA.XSL") returned -1
	[0039.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*"
	[0039.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\"
	[0039.517] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned=""
	[0039.517] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt"
	[0039.517] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\how to decrypt files.txt")) returned 0xffffffff
	[0039.517] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0039.518] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0039.518] CloseHandle (hObject=0x90) returned 1
	[0039.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="BASMLA.XSL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL"
	[0039.519] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0039.519] FindClose (in: hFindFile=0x8ba3a8 | out: hFindFile=0x8ba3a8) returned 1
	[0039.519] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.519] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="METCONV.DLL") returned -1
	[0039.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="METCONV.DLL") returned -1
	[0039.519] lstrcmpiA (lpString1="", lpString2="METCONV.DLL") returned -1
	[0039.519] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*"
	[0039.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.519] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="METCONV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL"
	[0039.520] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.520] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="METCONV.TXT") returned -1
	[0039.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="METCONV.TXT") returned -1
	[0039.520] lstrcmpiA (lpString1="", lpString2="METCONV.TXT") returned -1
	[0039.520] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned="METCONV.DLL"
	[0039.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.520] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.520] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.520] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT"
	[0039.520] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT"
	[0039.520] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT"
	[0039.520] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT."
	[0039.520] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.Boom"
	[0039.520] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0039.521] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120eb8
	[0039.521] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x85f12000, dwHighDateTime=0x1c9a11f), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a83910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x85f12000, dwHighDateTime=0x1c9a11f)) returned 1
	[0039.521] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.522] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x120e95, lpOverlapped=0x0) returned 1
	[0039.577] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="METCONV.TXT"
	[0039.581] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.581] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x120e95, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x120e95, lpOverlapped=0x0) returned 1
	[0039.588] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0039.588] CloseHandle (hObject=0x8c) returned 1
	[0039.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.boom")) returned 1
	[0039.607] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.608] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.608] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MOFL.DLL") returned -1
	[0039.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MOFL.DLL") returned -1
	[0039.608] lstrcmpiA (lpString1="", lpString2="MOFL.DLL") returned -1
	[0039.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="METCONV.TXT"
	[0039.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="MOFL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL"
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.zip") returned 0
	[0039.608] lstrlenA (lpString="*.zip") returned 5
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.rar") returned 0
	[0039.608] lstrlenA (lpString="*.rar") returned 5
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.7z") returned 0
	[0039.608] lstrlenA (lpString="*.7z") returned 4
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.tar") returned 0
	[0039.608] lstrlenA (lpString="*.tar") returned 5
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.gzip") returned 0
	[0039.608] lstrlenA (lpString="*.gzip") returned 6
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.jpg") returned 0
	[0039.608] lstrlenA (lpString="*.jpg") returned 5
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.jpeg") returned 0
	[0039.608] lstrlenA (lpString="*.jpeg") returned 6
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.psd") returned 0
	[0039.608] lstrlenA (lpString="*.psd") returned 5
	[0039.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.cdr") returned 0
	[0039.608] lstrlenA (lpString="*.cdr") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dwg") returned 0
	[0039.609] lstrlenA (lpString="*.dwg") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.max") returned 0
	[0039.609] lstrlenA (lpString="*.max") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.bmp") returned 0
	[0039.609] lstrlenA (lpString="*.bmp") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.gif") returned 0
	[0039.609] lstrlenA (lpString="*.gif") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.png") returned 0
	[0039.609] lstrlenA (lpString="*.png") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.doc") returned 0
	[0039.609] lstrlenA (lpString="*.doc") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.docx") returned 0
	[0039.609] lstrlenA (lpString="*.docx") returned 6
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xls") returned 0
	[0039.609] lstrlenA (lpString="*.xls") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xlsx") returned 0
	[0039.609] lstrlenA (lpString="*.xlsx") returned 6
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ppt") returned 0
	[0039.609] lstrlenA (lpString="*.ppt") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pptx") returned 0
	[0039.609] lstrlenA (lpString="*.pptx") returned 6
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.txt") returned 0
	[0039.609] lstrlenA (lpString="*.txt") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pdf") returned 0
	[0039.609] lstrlenA (lpString="*.pdf") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.djvu") returned 0
	[0039.609] lstrlenA (lpString="*.djvu") returned 6
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.htm") returned 0
	[0039.609] lstrlenA (lpString="*.htm") returned 5
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.html") returned 0
	[0039.609] lstrlenA (lpString="*.html") returned 6
	[0039.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mdb") returned 0
	[0039.610] lstrlenA (lpString="*.mdb") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.cer") returned 0
	[0039.610] lstrlenA (lpString="*.cer") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.p12") returned 0
	[0039.610] lstrlenA (lpString="*.p12") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pfx") returned 0
	[0039.610] lstrlenA (lpString="*.pfx") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.kwm") returned 0
	[0039.610] lstrlenA (lpString="*.kwm") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pwm") returned 0
	[0039.610] lstrlenA (lpString="*.pwm") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.1cd") returned 0
	[0039.610] lstrlenA (lpString="*.1cd") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.md") returned 0
	[0039.610] lstrlenA (lpString="*.md") returned 4
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mdf") returned 0
	[0039.610] lstrlenA (lpString="*.mdf") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dbf") returned 0
	[0039.610] lstrlenA (lpString="*.dbf") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.odt") returned 0
	[0039.610] lstrlenA (lpString="*.odt") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.vob") returned 0
	[0039.610] lstrlenA (lpString="*.vob") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ifo") returned 0
	[0039.610] lstrlenA (lpString="*.ifo") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.lnk") returned 0
	[0039.610] lstrlenA (lpString="*.lnk") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.torrent") returned 0
	[0039.610] lstrlenA (lpString="*.torrent") returned 9
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mov") returned 0
	[0039.610] lstrlenA (lpString="*.mov") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.m2v") returned 0
	[0039.610] lstrlenA (lpString="*.m2v") returned 5
	[0039.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.3gp") returned 0
	[0039.610] lstrlenA (lpString="*.3gp") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mpeg") returned 0
	[0039.611] lstrlenA (lpString="*.mpeg") returned 6
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mpg") returned 0
	[0039.611] lstrlenA (lpString="*.mpg") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.flv") returned 0
	[0039.611] lstrlenA (lpString="*.flv") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.avi") returned 0
	[0039.611] lstrlenA (lpString="*.avi") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mp4") returned 0
	[0039.611] lstrlenA (lpString="*.mp4") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wmv") returned 0
	[0039.611] lstrlenA (lpString="*.wmv") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.divx") returned 0
	[0039.611] lstrlenA (lpString="*.divx") returned 6
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mkv") returned 0
	[0039.611] lstrlenA (lpString="*.mkv") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mp3") returned 0
	[0039.611] lstrlenA (lpString="*.mp3") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wav") returned 0
	[0039.611] lstrlenA (lpString="*.wav") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.flac") returned 0
	[0039.611] lstrlenA (lpString="*.flac") returned 6
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ape") returned 0
	[0039.611] lstrlenA (lpString="*.ape") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wma") returned 0
	[0039.611] lstrlenA (lpString="*.wma") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ac3") returned 0
	[0039.611] lstrlenA (lpString="*.ac3") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.exe") returned 0
	[0039.611] lstrlenA (lpString="*.exe") returned 5
	[0039.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.apk") returned 0
	[0039.611] lstrlenA (lpString="*.apk") returned 5
	[0039.611] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.611] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.611] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTAG.TLB") returned -1
	[0039.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTAG.TLB") returned -1
	[0039.612] lstrcmpiA (lpString1="", lpString2="MSTAG.TLB") returned -1
	[0039.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned="MOFL.DLL"
	[0039.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="MSTAG.TLB" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB"
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.zip") returned 0
	[0039.612] lstrlenA (lpString="*.zip") returned 5
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.rar") returned 0
	[0039.612] lstrlenA (lpString="*.rar") returned 5
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.7z") returned 0
	[0039.612] lstrlenA (lpString="*.7z") returned 4
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.tar") returned 0
	[0039.612] lstrlenA (lpString="*.tar") returned 5
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.gzip") returned 0
	[0039.612] lstrlenA (lpString="*.gzip") returned 6
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.jpg") returned 0
	[0039.612] lstrlenA (lpString="*.jpg") returned 5
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.jpeg") returned 0
	[0039.612] lstrlenA (lpString="*.jpeg") returned 6
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.psd") returned 0
	[0039.612] lstrlenA (lpString="*.psd") returned 5
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.cdr") returned 0
	[0039.612] lstrlenA (lpString="*.cdr") returned 5
	[0039.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dwg") returned 0
	[0039.612] lstrlenA (lpString="*.dwg") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.max") returned 0
	[0039.613] lstrlenA (lpString="*.max") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.bmp") returned 0
	[0039.613] lstrlenA (lpString="*.bmp") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.gif") returned 0
	[0039.613] lstrlenA (lpString="*.gif") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.png") returned 0
	[0039.613] lstrlenA (lpString="*.png") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.doc") returned 0
	[0039.613] lstrlenA (lpString="*.doc") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.docx") returned 0
	[0039.613] lstrlenA (lpString="*.docx") returned 6
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xls") returned 0
	[0039.613] lstrlenA (lpString="*.xls") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xlsx") returned 0
	[0039.613] lstrlenA (lpString="*.xlsx") returned 6
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ppt") returned 0
	[0039.613] lstrlenA (lpString="*.ppt") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pptx") returned 0
	[0039.613] lstrlenA (lpString="*.pptx") returned 6
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.txt") returned 0
	[0039.613] lstrlenA (lpString="*.txt") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pdf") returned 0
	[0039.613] lstrlenA (lpString="*.pdf") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.djvu") returned 0
	[0039.613] lstrlenA (lpString="*.djvu") returned 6
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.htm") returned 0
	[0039.613] lstrlenA (lpString="*.htm") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.html") returned 0
	[0039.613] lstrlenA (lpString="*.html") returned 6
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mdb") returned 0
	[0039.613] lstrlenA (lpString="*.mdb") returned 5
	[0039.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.cer") returned 0
	[0039.614] lstrlenA (lpString="*.cer") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.p12") returned 0
	[0039.614] lstrlenA (lpString="*.p12") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pfx") returned 0
	[0039.614] lstrlenA (lpString="*.pfx") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.kwm") returned 0
	[0039.614] lstrlenA (lpString="*.kwm") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pwm") returned 0
	[0039.614] lstrlenA (lpString="*.pwm") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.1cd") returned 0
	[0039.614] lstrlenA (lpString="*.1cd") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.md") returned 0
	[0039.614] lstrlenA (lpString="*.md") returned 4
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mdf") returned 0
	[0039.614] lstrlenA (lpString="*.mdf") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dbf") returned 0
	[0039.614] lstrlenA (lpString="*.dbf") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.odt") returned 0
	[0039.614] lstrlenA (lpString="*.odt") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.vob") returned 0
	[0039.614] lstrlenA (lpString="*.vob") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ifo") returned 0
	[0039.614] lstrlenA (lpString="*.ifo") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.lnk") returned 0
	[0039.614] lstrlenA (lpString="*.lnk") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.torrent") returned 0
	[0039.614] lstrlenA (lpString="*.torrent") returned 9
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mov") returned 0
	[0039.614] lstrlenA (lpString="*.mov") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.m2v") returned 0
	[0039.614] lstrlenA (lpString="*.m2v") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.3gp") returned 0
	[0039.614] lstrlenA (lpString="*.3gp") returned 5
	[0039.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mpeg") returned 0
	[0039.615] lstrlenA (lpString="*.mpeg") returned 6
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mpg") returned 0
	[0039.615] lstrlenA (lpString="*.mpg") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.flv") returned 0
	[0039.615] lstrlenA (lpString="*.flv") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.avi") returned 0
	[0039.615] lstrlenA (lpString="*.avi") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mp4") returned 0
	[0039.615] lstrlenA (lpString="*.mp4") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wmv") returned 0
	[0039.615] lstrlenA (lpString="*.wmv") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.divx") returned 0
	[0039.615] lstrlenA (lpString="*.divx") returned 6
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mkv") returned 0
	[0039.615] lstrlenA (lpString="*.mkv") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mp3") returned 0
	[0039.615] lstrlenA (lpString="*.mp3") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wav") returned 0
	[0039.615] lstrlenA (lpString="*.wav") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.flac") returned 0
	[0039.615] lstrlenA (lpString="*.flac") returned 6
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ape") returned 0
	[0039.615] lstrlenA (lpString="*.ape") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wma") returned 0
	[0039.615] lstrlenA (lpString="*.wma") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ac3") returned 0
	[0039.615] lstrlenA (lpString="*.ac3") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.exe") returned 0
	[0039.615] lstrlenA (lpString="*.exe") returned 5
	[0039.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.apk") returned 0
	[0039.615] lstrlenA (lpString="*.apk") returned 5
	[0039.615] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.615] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.615] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SmartTagInstall.exe") returned -1
	[0039.616] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SmartTagInstall.exe") returned -1
	[0039.616] lstrcmpiA (lpString1="", lpString2="SmartTagInstall.exe") returned -1
	[0039.616] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="MSTAG.TLB"
	[0039.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\"
	[0039.616] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned=""
	[0039.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt"
	[0039.616] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20
	[0039.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="SmartTagInstall.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe"
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.zip") returned 0
	[0039.616] lstrlenA (lpString="*.zip") returned 5
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.rar") returned 0
	[0039.616] lstrlenA (lpString="*.rar") returned 5
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.7z") returned 0
	[0039.616] lstrlenA (lpString="*.7z") returned 4
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.tar") returned 0
	[0039.616] lstrlenA (lpString="*.tar") returned 5
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.gzip") returned 0
	[0039.616] lstrlenA (lpString="*.gzip") returned 6
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.jpg") returned 0
	[0039.616] lstrlenA (lpString="*.jpg") returned 5
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.jpeg") returned 0
	[0039.616] lstrlenA (lpString="*.jpeg") returned 6
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.psd") returned 0
	[0039.616] lstrlenA (lpString="*.psd") returned 5
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.cdr") returned 0
	[0039.616] lstrlenA (lpString="*.cdr") returned 5
	[0039.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dwg") returned 0
	[0039.616] lstrlenA (lpString="*.dwg") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.max") returned 0
	[0039.617] lstrlenA (lpString="*.max") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.bmp") returned 0
	[0039.617] lstrlenA (lpString="*.bmp") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.gif") returned 0
	[0039.617] lstrlenA (lpString="*.gif") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.png") returned 0
	[0039.617] lstrlenA (lpString="*.png") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.doc") returned 0
	[0039.617] lstrlenA (lpString="*.doc") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.docx") returned 0
	[0039.617] lstrlenA (lpString="*.docx") returned 6
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.xls") returned 0
	[0039.617] lstrlenA (lpString="*.xls") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.xlsx") returned 0
	[0039.617] lstrlenA (lpString="*.xlsx") returned 6
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ppt") returned 0
	[0039.617] lstrlenA (lpString="*.ppt") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pptx") returned 0
	[0039.617] lstrlenA (lpString="*.pptx") returned 6
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.txt") returned 0
	[0039.617] lstrlenA (lpString="*.txt") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pdf") returned 0
	[0039.617] lstrlenA (lpString="*.pdf") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.djvu") returned 0
	[0039.617] lstrlenA (lpString="*.djvu") returned 6
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.htm") returned 0
	[0039.617] lstrlenA (lpString="*.htm") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.html") returned 0
	[0039.617] lstrlenA (lpString="*.html") returned 6
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mdb") returned 0
	[0039.617] lstrlenA (lpString="*.mdb") returned 5
	[0039.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.cer") returned 0
	[0039.618] lstrlenA (lpString="*.cer") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.p12") returned 0
	[0039.618] lstrlenA (lpString="*.p12") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pfx") returned 0
	[0039.618] lstrlenA (lpString="*.pfx") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.kwm") returned 0
	[0039.618] lstrlenA (lpString="*.kwm") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pwm") returned 0
	[0039.618] lstrlenA (lpString="*.pwm") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.1cd") returned 0
	[0039.618] lstrlenA (lpString="*.1cd") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.md") returned 0
	[0039.618] lstrlenA (lpString="*.md") returned 4
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mdf") returned 0
	[0039.618] lstrlenA (lpString="*.mdf") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dbf") returned 0
	[0039.618] lstrlenA (lpString="*.dbf") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.odt") returned 0
	[0039.618] lstrlenA (lpString="*.odt") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.vob") returned 0
	[0039.618] lstrlenA (lpString="*.vob") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ifo") returned 0
	[0039.618] lstrlenA (lpString="*.ifo") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.lnk") returned 0
	[0039.618] lstrlenA (lpString="*.lnk") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.torrent") returned 0
	[0039.618] lstrlenA (lpString="*.torrent") returned 9
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mov") returned 0
	[0039.618] lstrlenA (lpString="*.mov") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.m2v") returned 0
	[0039.618] lstrlenA (lpString="*.m2v") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.3gp") returned 0
	[0039.618] lstrlenA (lpString="*.3gp") returned 5
	[0039.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mpeg") returned 0
	[0039.619] lstrlenA (lpString="*.mpeg") returned 6
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mpg") returned 0
	[0039.619] lstrlenA (lpString="*.mpg") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.flv") returned 0
	[0039.619] lstrlenA (lpString="*.flv") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.avi") returned 0
	[0039.619] lstrlenA (lpString="*.avi") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mp4") returned 0
	[0039.619] lstrlenA (lpString="*.mp4") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.wmv") returned 0
	[0039.619] lstrlenA (lpString="*.wmv") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.divx") returned 0
	[0039.619] lstrlenA (lpString="*.divx") returned 6
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mkv") returned 0
	[0039.619] lstrlenA (lpString="*.mkv") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mp3") returned 0
	[0039.619] lstrlenA (lpString="*.mp3") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.wav") returned 0
	[0039.619] lstrlenA (lpString="*.wav") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.flac") returned 0
	[0039.619] lstrlenA (lpString="*.flac") returned 6
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ape") returned 0
	[0039.619] lstrlenA (lpString="*.ape") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.wma") returned 0
	[0039.619] lstrlenA (lpString="*.wma") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ac3") returned 0
	[0039.619] lstrlenA (lpString="*.ac3") returned 5
	[0039.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.exe") returned 1
	[0039.619] lstrlenA (lpString="*.exe") returned 5
	[0039.619] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe"
	[0039.619] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe"
	[0039.619] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe."
	[0039.619] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.Boom"
	[0039.620] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0039.621] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d80
	[0039.621] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5de00200, dwHighDateTime=0x1cac9ac), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2e6230, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5de00200, dwHighDateTime=0x1cac9ac)) returned 1
	[0039.621] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.621] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3d5d, lpOverlapped=0x0) returned 1
	[0039.641] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned="SmartTagInstall.exe"
	[0039.641] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.641] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3d5d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3d5d, lpOverlapped=0x0) returned 1
	[0039.641] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0039.641] CloseHandle (hObject=0x8c) returned 1
	[0039.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.boom")) returned 1
	[0039.644] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0039.644] FindClose (in: hFindFile=0x8ba430 | out: hFindFile=0x8ba430) returned 1
	[0039.644] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0039.645] lstrcmpA (lpString1=".", lpString2="Source Engine") returned -1
	[0039.645] lstrcmpA (lpString1="..", lpString2="Source Engine") returned -1
	[0039.645] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0039.645] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Source Engine" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine"
	[0039.645] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned 60
	[0039.645] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba438
	[0039.646] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0039.646] FindNextFileA (in: hFindFile=0x8ba438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.646] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0039.646] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0039.646] FindNextFileA (in: hFindFile=0x8ba438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.646] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSE.EXE") returned -1
	[0039.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSE.EXE") returned -1
	[0039.646] lstrcmpiA (lpString1="", lpString2="OSE.EXE") returned -1
	[0039.646] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*") returned="*.*"
	[0039.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\"
	[0039.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned=""
	[0039.646] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt"
	[0039.646] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how to decrypt files.txt")) returned 0xffffffff
	[0039.646] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0039.648] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0039.648] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0039.649] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0039.649] CloseHandle (hObject=0x8c) returned 1
	[0039.649] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpString2="OSE.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE"
	[0039.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.zip") returned 0
	[0039.649] lstrlenA (lpString="*.zip") returned 5
	[0039.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.rar") returned 0
	[0039.649] lstrlenA (lpString="*.rar") returned 5
	[0039.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.7z") returned 0
	[0039.649] lstrlenA (lpString="*.7z") returned 4
	[0039.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.tar") returned 0
	[0039.649] lstrlenA (lpString="*.tar") returned 5
	[0039.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.gzip") returned 0
	[0039.649] lstrlenA (lpString="*.gzip") returned 6
	[0039.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.jpg") returned 0
	[0039.649] lstrlenA (lpString="*.jpg") returned 5
	[0039.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.jpeg") returned 0
	[0039.649] lstrlenA (lpString="*.jpeg") returned 6
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.psd") returned 0
	[0039.650] lstrlenA (lpString="*.psd") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.cdr") returned 0
	[0039.650] lstrlenA (lpString="*.cdr") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.dwg") returned 0
	[0039.650] lstrlenA (lpString="*.dwg") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.max") returned 0
	[0039.650] lstrlenA (lpString="*.max") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.bmp") returned 0
	[0039.650] lstrlenA (lpString="*.bmp") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.gif") returned 0
	[0039.650] lstrlenA (lpString="*.gif") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.png") returned 0
	[0039.650] lstrlenA (lpString="*.png") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.doc") returned 0
	[0039.650] lstrlenA (lpString="*.doc") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.docx") returned 0
	[0039.650] lstrlenA (lpString="*.docx") returned 6
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.xls") returned 0
	[0039.650] lstrlenA (lpString="*.xls") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.xlsx") returned 0
	[0039.650] lstrlenA (lpString="*.xlsx") returned 6
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ppt") returned 0
	[0039.650] lstrlenA (lpString="*.ppt") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pptx") returned 0
	[0039.650] lstrlenA (lpString="*.pptx") returned 6
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.txt") returned 0
	[0039.650] lstrlenA (lpString="*.txt") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pdf") returned 0
	[0039.650] lstrlenA (lpString="*.pdf") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.djvu") returned 0
	[0039.650] lstrlenA (lpString="*.djvu") returned 6
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.htm") returned 0
	[0039.650] lstrlenA (lpString="*.htm") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.html") returned 0
	[0039.650] lstrlenA (lpString="*.html") returned 6
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mdb") returned 0
	[0039.650] lstrlenA (lpString="*.mdb") returned 5
	[0039.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.cer") returned 0
	[0039.651] lstrlenA (lpString="*.cer") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.p12") returned 0
	[0039.651] lstrlenA (lpString="*.p12") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pfx") returned 0
	[0039.651] lstrlenA (lpString="*.pfx") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.kwm") returned 0
	[0039.651] lstrlenA (lpString="*.kwm") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pwm") returned 0
	[0039.651] lstrlenA (lpString="*.pwm") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.1cd") returned 0
	[0039.651] lstrlenA (lpString="*.1cd") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.md") returned 0
	[0039.651] lstrlenA (lpString="*.md") returned 4
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mdf") returned 0
	[0039.651] lstrlenA (lpString="*.mdf") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.dbf") returned 0
	[0039.651] lstrlenA (lpString="*.dbf") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.odt") returned 0
	[0039.651] lstrlenA (lpString="*.odt") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.vob") returned 0
	[0039.651] lstrlenA (lpString="*.vob") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ifo") returned 0
	[0039.651] lstrlenA (lpString="*.ifo") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.lnk") returned 0
	[0039.651] lstrlenA (lpString="*.lnk") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.torrent") returned 0
	[0039.651] lstrlenA (lpString="*.torrent") returned 9
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mov") returned 0
	[0039.651] lstrlenA (lpString="*.mov") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.m2v") returned 0
	[0039.651] lstrlenA (lpString="*.m2v") returned 5
	[0039.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.3gp") returned 0
	[0039.651] lstrlenA (lpString="*.3gp") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mpeg") returned 0
	[0039.652] lstrlenA (lpString="*.mpeg") returned 6
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mpg") returned 0
	[0039.652] lstrlenA (lpString="*.mpg") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.flv") returned 0
	[0039.652] lstrlenA (lpString="*.flv") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.avi") returned 0
	[0039.652] lstrlenA (lpString="*.avi") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mp4") returned 0
	[0039.652] lstrlenA (lpString="*.mp4") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.wmv") returned 0
	[0039.652] lstrlenA (lpString="*.wmv") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.divx") returned 0
	[0039.652] lstrlenA (lpString="*.divx") returned 6
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mkv") returned 0
	[0039.652] lstrlenA (lpString="*.mkv") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mp3") returned 0
	[0039.652] lstrlenA (lpString="*.mp3") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.wav") returned 0
	[0039.652] lstrlenA (lpString="*.wav") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.flac") returned 0
	[0039.652] lstrlenA (lpString="*.flac") returned 6
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ape") returned 0
	[0039.652] lstrlenA (lpString="*.ape") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.wma") returned 0
	[0039.652] lstrlenA (lpString="*.wma") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ac3") returned 0
	[0039.652] lstrlenA (lpString="*.ac3") returned 5
	[0039.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.exe") returned 1
	[0039.652] lstrlenA (lpString="*.exe") returned 5
	[0039.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE"
	[0039.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE"
	[0039.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE."
	[0039.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.Boom"
	[0039.652] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0039.653] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a968
	[0039.653] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcfcedc00, dwHighDateTime=0x1ca911d), lpLastAccessTime=0x407536*(dwLowDateTime=0xeef4d890, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcfcedc00, dwHighDateTime=0x1ca911d)) returned 1
	[0039.653] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.653] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2a945, lpOverlapped=0x0) returned 1
	[0039.674] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned="OSE.EXE"
	[0039.674] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.675] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2a945, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2a945, lpOverlapped=0x0) returned 1
	[0039.675] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0039.675] CloseHandle (hObject=0x8c) returned 1
	[0039.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.boom")) returned 1
	[0039.677] FindNextFileA (in: hFindFile=0x8ba438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0039.677] FindClose (in: hFindFile=0x8ba438 | out: hFindFile=0x8ba438) returned 1
	[0039.677] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0039.677] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1
	[0039.677] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1
	[0039.677] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0039.677] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Stationery" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery"
	[0039.677] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned 57
	[0039.677] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba430
	[0039.744] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0039.744] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.745] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0039.745] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0039.745] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.745] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.745] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Bears.htm") returned 1
	[0039.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.htm") returned 1
	[0039.745] lstrcmpiA (lpString1="", lpString2="Bears.htm") returned -1
	[0039.745] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*") returned="*.*"
	[0039.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.745] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0xffffffff
	[0039.746] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0039.746] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0039.746] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0039.747] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0039.747] CloseHandle (hObject=0x8c) returned 1
	[0039.747] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm"
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.zip") returned 0
	[0039.747] lstrlenA (lpString="*.zip") returned 5
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.rar") returned 0
	[0039.747] lstrlenA (lpString="*.rar") returned 5
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.7z") returned 0
	[0039.747] lstrlenA (lpString="*.7z") returned 4
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.tar") returned 0
	[0039.747] lstrlenA (lpString="*.tar") returned 5
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.gzip") returned 0
	[0039.747] lstrlenA (lpString="*.gzip") returned 6
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.jpg") returned 0
	[0039.747] lstrlenA (lpString="*.jpg") returned 5
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.jpeg") returned 0
	[0039.747] lstrlenA (lpString="*.jpeg") returned 6
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.psd") returned 0
	[0039.747] lstrlenA (lpString="*.psd") returned 5
	[0039.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.cdr") returned 0
	[0039.748] lstrlenA (lpString="*.cdr") returned 5
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.dwg") returned 0
	[0039.748] lstrlenA (lpString="*.dwg") returned 5
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.max") returned 0
	[0039.748] lstrlenA (lpString="*.max") returned 5
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.bmp") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.gif") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.png") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.doc") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.docx") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.xls") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.xlsx") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.ppt") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.pptx") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.txt") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.pdf") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.djvu") returned 0
	[0039.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.htm") returned 1
	[0039.748] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm"
	[0039.748] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm"
	[0039.748] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm."
	[0039.748] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.Boom"
	[0039.748] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.756] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.756] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.756] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Bears.jpg") returned 1
	[0039.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.jpg") returned 1
	[0039.756] lstrcmpiA (lpString1="", lpString2="Bears.jpg") returned -1
	[0039.756] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="Bears.htm"
	[0039.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.756] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.756] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg"
	[0039.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", pszSpec="*.zip") returned 0
	[0039.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", pszSpec="*.rar") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", pszSpec="*.7z") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", pszSpec="*.tar") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", pszSpec="*.gzip") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", pszSpec="*.jpg") returned 1
	[0039.757] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg"
	[0039.757] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg"
	[0039.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg."
	[0039.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.Boom"
	[0039.757] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.757] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.757] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.757] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Blue_Gradient.jpg") returned 1
	[0039.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue_Gradient.jpg") returned 1
	[0039.757] lstrcmpiA (lpString1="", lpString2="Blue_Gradient.jpg") returned -1
	[0039.757] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="Bears.jpg"
	[0039.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg"
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.zip") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.rar") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.7z") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.tar") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.gzip") returned 0
	[0039.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.jpg") returned 1
	[0039.757] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg"
	[0039.757] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg"
	[0039.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg."
	[0039.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.Boom"
	[0039.758] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.758] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.758] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.758] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Cave_Drawings.gif") returned 1
	[0039.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Cave_Drawings.gif") returned 1
	[0039.758] lstrcmpiA (lpString1="", lpString2="Cave_Drawings.gif") returned -1
	[0039.758] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="Blue_Gradient.jpg"
	[0039.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.758] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif"
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.zip") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.rar") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.7z") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.tar") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.gzip") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.jpg") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.jpeg") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.psd") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.cdr") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.dwg") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.max") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.bmp") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.gif") returned 1
	[0039.759] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif"
	[0039.759] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif"
	[0039.759] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif."
	[0039.759] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.Boom"
	[0039.759] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.759] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.759] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Connectivity.gif") returned 1
	[0039.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Connectivity.gif") returned 1
	[0039.759] lstrcmpiA (lpString1="", lpString2="Connectivity.gif") returned -1
	[0039.759] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="Cave_Drawings.gif"
	[0039.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.759] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.759] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.759] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.759] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif"
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.zip") returned 0
	[0039.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.rar") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.7z") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.tar") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.gzip") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.jpg") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.jpeg") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.psd") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.cdr") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.dwg") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.max") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.bmp") returned 0
	[0039.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.gif") returned 1
	[0039.760] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif"
	[0039.760] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif"
	[0039.760] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif."
	[0039.760] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.Boom"
	[0039.760] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.760] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.760] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Desktop.ini") returned 1
	[0039.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.ini") returned 1
	[0039.760] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1
	[0039.760] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="Connectivity.gif"
	[0039.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.761] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.761] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.761] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Desktop.ini" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini"
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.zip") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.rar") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.7z") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.tar") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.gzip") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.jpg") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.jpeg") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.psd") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.cdr") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.dwg") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.max") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.bmp") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.gif") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.png") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.doc") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.docx") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.xls") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.xlsx") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.ppt") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.pptx") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.txt") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.pdf") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.djvu") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.htm") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.html") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mdb") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.cer") returned 0
	[0039.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.p12") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.pfx") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.kwm") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.pwm") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.1cd") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.md") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mdf") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.dbf") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.odt") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.vob") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.ifo") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.lnk") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.torrent") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mov") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.m2v") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.3gp") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mpeg") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mpg") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.flv") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.avi") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mp4") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.wmv") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.divx") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mkv") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mp3") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.wav") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.flac") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.ape") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.wma") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.ac3") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.exe") returned 0
	[0039.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.apk") returned 0
	[0039.763] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.763] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Dotted_Lines.emf") returned 1
	[0039.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dotted_Lines.emf") returned 1
	[0039.763] lstrcmpiA (lpString1="", lpString2="Dotted_Lines.emf") returned -1
	[0039.763] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned="Desktop.ini"
	[0039.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.763] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.763] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.763] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Dotted_Lines.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf"
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.zip") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.rar") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.7z") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.tar") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.gzip") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.jpg") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.jpeg") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.psd") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.cdr") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.dwg") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.max") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.bmp") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.gif") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.png") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.doc") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.docx") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.xls") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.xlsx") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.ppt") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.pptx") returned 0
	[0039.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.txt") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.pdf") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.djvu") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.htm") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.html") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mdb") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.cer") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.p12") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.pfx") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.kwm") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.pwm") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.1cd") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.md") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mdf") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.dbf") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.odt") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.vob") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.ifo") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.lnk") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.torrent") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mov") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.m2v") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.3gp") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mpeg") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mpg") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.flv") returned 0
	[0039.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.avi") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mp4") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.wmv") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.divx") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mkv") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.mp3") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.wav") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.flac") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.ape") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.wma") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.ac3") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.exe") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", pszSpec="*.apk") returned 0
	[0039.765] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Garden.htm") returned -1
	[0039.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.htm") returned 1
	[0039.765] lstrcmpiA (lpString1="", lpString2="Garden.htm") returned -1
	[0039.765] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="Dotted_Lines.emf"
	[0039.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm"
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.zip") returned 0
	[0039.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.rar") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.7z") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.tar") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.gzip") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.jpg") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.jpeg") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.psd") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.cdr") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.dwg") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.max") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.bmp") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.gif") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.png") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.doc") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.docx") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.xls") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.xlsx") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.ppt") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.pptx") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.txt") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.pdf") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.djvu") returned 0
	[0039.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", pszSpec="*.htm") returned 1
	[0039.766] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm"
	[0039.766] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm"
	[0039.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm."
	[0039.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.Boom"
	[0039.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.767] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Garden.jpg") returned -1
	[0039.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.jpg") returned 1
	[0039.767] lstrcmpiA (lpString1="", lpString2="Garden.jpg") returned -1
	[0039.767] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="Garden.htm"
	[0039.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.767] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg"
	[0039.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", pszSpec="*.zip") returned 0
	[0039.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", pszSpec="*.rar") returned 0
	[0039.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", pszSpec="*.7z") returned 0
	[0039.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", pszSpec="*.tar") returned 0
	[0039.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", pszSpec="*.gzip") returned 0
	[0039.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", pszSpec="*.jpg") returned 1
	[0039.767] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg"
	[0039.767] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg"
	[0039.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg."
	[0039.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.Boom"
	[0039.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.768] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.768] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Genko_1.emf") returned -1
	[0039.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_1.emf") returned 1
	[0039.768] lstrcmpiA (lpString1="", lpString2="Genko_1.emf") returned -1
	[0039.768] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="Garden.jpg"
	[0039.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.768] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.768] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Genko_1.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf"
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.zip") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.rar") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.7z") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.tar") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.gzip") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.jpg") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.jpeg") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.psd") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.cdr") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.dwg") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.max") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.bmp") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.gif") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.png") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.doc") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.docx") returned 0
	[0039.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.xls") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.xlsx") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.ppt") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.pptx") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.txt") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.pdf") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.djvu") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.htm") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.html") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.mdb") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.cer") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.p12") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.pfx") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.kwm") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.pwm") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.1cd") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.md") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.mdf") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.dbf") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.odt") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.vob") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.ifo") returned 0
	[0039.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", pszSpec="*.lnk") returned 0
	[0039.769] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.770] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Genko_2.emf") returned -1
	[0039.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_2.emf") returned 1
	[0039.770] lstrcmpiA (lpString1="", lpString2="Genko_2.emf") returned -1
	[0039.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="Genko_1.emf"
	[0039.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Genko_2.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf"
	[0039.770] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.770] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Graph.emf") returned -1
	[0039.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Graph.emf") returned 1
	[0039.770] lstrcmpiA (lpString1="", lpString2="Graph.emf") returned -1
	[0039.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="Genko_2.emf"
	[0039.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Graph.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf"
	[0039.770] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.770] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Green Bubbles.htm") returned -1
	[0039.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Bubbles.htm") returned 1
	[0039.770] lstrcmpiA (lpString1="", lpString2="Green Bubbles.htm") returned -1
	[0039.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="Graph.emf"
	[0039.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm"
	[0039.771] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm"
	[0039.771] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm"
	[0039.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm."
	[0039.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.Boom"
	[0039.771] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.780] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GreenBubbles.jpg") returned -1
	[0039.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenBubbles.jpg") returned 1
	[0039.780] lstrcmpiA (lpString1="", lpString2="GreenBubbles.jpg") returned -1
	[0039.780] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm"
	[0039.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg"
	[0039.780] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg"
	[0039.780] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg"
	[0039.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg."
	[0039.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.Boom"
	[0039.781] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.781] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.781] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="grid_(cm).wmf") returned -1
	[0039.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(cm).wmf") returned 1
	[0039.781] lstrcmpiA (lpString1="", lpString2="grid_(cm).wmf") returned -1
	[0039.781] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg"
	[0039.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="grid_(cm).wmf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf"
	[0039.781] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.781] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="grid_(inch).wmf") returned -1
	[0039.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(inch).wmf") returned 1
	[0039.781] lstrcmpiA (lpString1="", lpString2="grid_(inch).wmf") returned -1
	[0039.781] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="grid_(cm).wmf"
	[0039.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="grid_(inch).wmf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf"
	[0039.782] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.782] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hand Prints.htm") returned -1
	[0039.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hand Prints.htm") returned 1
	[0039.782] lstrcmpiA (lpString1="", lpString2="Hand Prints.htm") returned -1
	[0039.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="grid_(inch).wmf"
	[0039.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm"
	[0039.782] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm"
	[0039.782] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm"
	[0039.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm."
	[0039.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.Boom"
	[0039.782] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.783] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.783] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HandPrints.jpg") returned -1
	[0039.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HandPrints.jpg") returned 1
	[0039.783] lstrcmpiA (lpString1="", lpString2="HandPrints.jpg") returned -1
	[0039.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm"
	[0039.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg"
	[0039.783] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg"
	[0039.783] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg"
	[0039.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg."
	[0039.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.Boom"
	[0039.784] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.784] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.784] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Memo.emf") returned -1
	[0039.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Memo.emf") returned -1
	[0039.784] lstrcmpiA (lpString1="", lpString2="Memo.emf") returned -1
	[0039.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg"
	[0039.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Memo.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf"
	[0039.784] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.784] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Monet.jpg") returned -1
	[0039.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Monet.jpg") returned -1
	[0039.784] lstrcmpiA (lpString1="", lpString2="Monet.jpg") returned -1
	[0039.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="Memo.emf"
	[0039.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.785] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg"
	[0039.785] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg"
	[0039.785] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg"
	[0039.785] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg."
	[0039.785] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.Boom"
	[0039.785] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.786] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.786] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Month_Calendar.emf") returned -1
	[0039.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Month_Calendar.emf") returned -1
	[0039.786] lstrcmpiA (lpString1="", lpString2="Month_Calendar.emf") returned -1
	[0039.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="Monet.jpg"
	[0039.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Month_Calendar.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf"
	[0039.786] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.786] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Music.emf") returned -1
	[0039.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Music.emf") returned -1
	[0039.786] lstrcmpiA (lpString1="", lpString2="Music.emf") returned -1
	[0039.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned="Month_Calendar.emf"
	[0039.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Music.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf"
	[0039.786] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.787] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Notebook.jpg") returned -1
	[0039.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Notebook.jpg") returned -1
	[0039.787] lstrcmpiA (lpString1="", lpString2="Notebook.jpg") returned -1
	[0039.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned="Music.emf"
	[0039.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg"
	[0039.787] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg"
	[0039.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg"
	[0039.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg."
	[0039.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.Boom"
	[0039.787] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.788] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.788] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Orange Circles.htm") returned -1
	[0039.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Circles.htm") returned -1
	[0039.788] lstrcmpiA (lpString1="", lpString2="Orange Circles.htm") returned -1
	[0039.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="Notebook.jpg"
	[0039.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm"
	[0039.788] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm"
	[0039.788] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm"
	[0039.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm."
	[0039.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.Boom"
	[0039.789] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.789] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.789] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrangeCircles.jpg") returned -1
	[0039.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrangeCircles.jpg") returned -1
	[0039.789] lstrcmpiA (lpString1="", lpString2="OrangeCircles.jpg") returned -1
	[0039.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm"
	[0039.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg"
	[0039.789] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg"
	[0039.789] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg"
	[0039.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg."
	[0039.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.Boom"
	[0039.789] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.789] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.789] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Peacock.htm") returned -1
	[0039.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.htm") returned -1
	[0039.789] lstrcmpiA (lpString1="", lpString2="Peacock.htm") returned -1
	[0039.790] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg"
	[0039.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm"
	[0039.790] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm"
	[0039.790] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm"
	[0039.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm."
	[0039.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.Boom"
	[0039.790] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.791] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.791] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.791] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Peacock.jpg") returned -1
	[0039.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.jpg") returned -1
	[0039.791] lstrcmpiA (lpString1="", lpString2="Peacock.jpg") returned -1
	[0039.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="Peacock.htm"
	[0039.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg"
	[0039.791] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg"
	[0039.791] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg"
	[0039.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg."
	[0039.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.Boom"
	[0039.792] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.792] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.792] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pine_Lumber.jpg") returned -1
	[0039.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pine_Lumber.jpg") returned -1
	[0039.793] lstrcmpiA (lpString1="", lpString2="Pine_Lumber.jpg") returned -1
	[0039.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="Peacock.jpg"
	[0039.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.793] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.793] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg"
	[0039.793] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg"
	[0039.793] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg"
	[0039.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg."
	[0039.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.Boom"
	[0039.793] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.793] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.793] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.793] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pretty_Peacock.jpg") returned -1
	[0039.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pretty_Peacock.jpg") returned -1
	[0039.793] lstrcmpiA (lpString1="", lpString2="Pretty_Peacock.jpg") returned -1
	[0039.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="Pine_Lumber.jpg"
	[0039.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.793] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.793] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg"
	[0039.793] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg"
	[0039.794] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg"
	[0039.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg."
	[0039.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.Boom"
	[0039.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.794] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.794] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.794] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Psychedelic.jpg") returned -1
	[0039.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Psychedelic.jpg") returned -1
	[0039.794] lstrcmpiA (lpString1="", lpString2="Psychedelic.jpg") returned -1
	[0039.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="Pretty_Peacock.jpg"
	[0039.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.794] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.794] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg"
	[0039.794] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg"
	[0039.794] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg"
	[0039.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg."
	[0039.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.Boom"
	[0039.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.795] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.795] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.795] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Roses.htm") returned -1
	[0039.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.htm") returned -1
	[0039.795] lstrcmpiA (lpString1="", lpString2="Roses.htm") returned -1
	[0039.795] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="Psychedelic.jpg"
	[0039.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.795] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm"
	[0039.795] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm"
	[0039.795] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm"
	[0039.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm."
	[0039.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.Boom"
	[0039.795] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.796] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.796] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.796] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Roses.jpg") returned -1
	[0039.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.jpg") returned -1
	[0039.796] lstrcmpiA (lpString1="", lpString2="Roses.jpg") returned -1
	[0039.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="Roses.htm"
	[0039.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg"
	[0039.796] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg"
	[0039.796] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg"
	[0039.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg."
	[0039.797] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.Boom"
	[0039.797] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.797] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.797] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.797] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sand_Paper.jpg") returned -1
	[0039.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sand_Paper.jpg") returned -1
	[0039.797] lstrcmpiA (lpString1="", lpString2="Sand_Paper.jpg") returned -1
	[0039.797] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="Roses.jpg"
	[0039.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.797] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg"
	[0039.798] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg"
	[0039.798] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg"
	[0039.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg."
	[0039.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.Boom"
	[0039.798] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.798] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.798] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.798] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Seyes.emf") returned -1
	[0039.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Seyes.emf") returned -1
	[0039.798] lstrcmpiA (lpString1="", lpString2="Seyes.emf") returned -1
	[0039.798] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="Sand_Paper.jpg"
	[0039.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Seyes.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf"
	[0039.798] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.798] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shades of Blue.htm") returned -1
	[0039.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shades of Blue.htm") returned -1
	[0039.799] lstrcmpiA (lpString1="", lpString2="Shades of Blue.htm") returned -1
	[0039.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned="Seyes.emf"
	[0039.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm"
	[0039.799] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm"
	[0039.799] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm"
	[0039.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm."
	[0039.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.Boom"
	[0039.799] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.799] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.799] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ShadesOfBlue.jpg") returned -1
	[0039.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShadesOfBlue.jpg") returned -1
	[0039.799] lstrcmpiA (lpString1="", lpString2="ShadesOfBlue.jpg") returned -1
	[0039.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm"
	[0039.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg"
	[0039.800] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg"
	[0039.800] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg"
	[0039.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg."
	[0039.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.Boom"
	[0039.800] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.801] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.801] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.801] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shorthand.emf") returned -1
	[0039.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shorthand.emf") returned -1
	[0039.801] lstrcmpiA (lpString1="", lpString2="Shorthand.emf") returned -1
	[0039.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg"
	[0039.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Shorthand.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf"
	[0039.801] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.801] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.801] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Small_News.jpg") returned -1
	[0039.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Small_News.jpg") returned -1
	[0039.801] lstrcmpiA (lpString1="", lpString2="Small_News.jpg") returned -1
	[0039.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned="Shorthand.emf"
	[0039.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg"
	[0039.802] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg"
	[0039.802] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg"
	[0039.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg."
	[0039.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.Boom"
	[0039.802] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.868] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.868] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Soft Blue.htm") returned -1
	[0039.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Soft Blue.htm") returned -1
	[0039.868] lstrcmpiA (lpString1="", lpString2="Soft Blue.htm") returned -1
	[0039.868] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="Small_News.jpg"
	[0039.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.868] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.868] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.868] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.868] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm"
	[0039.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm"
	[0039.869] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm"
	[0039.869] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm."
	[0039.869] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.Boom"
	[0039.869] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.870] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.870] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.870] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SoftBlue.jpg") returned -1
	[0039.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.jpg") returned -1
	[0039.870] lstrcmpiA (lpString1="", lpString2="SoftBlue.jpg") returned -1
	[0039.870] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm"
	[0039.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.870] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.870] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg"
	[0039.870] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg"
	[0039.870] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg"
	[0039.870] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg."
	[0039.870] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.Boom"
	[0039.870] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.871] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.871] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.871] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stars.htm") returned -1
	[0039.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.htm") returned -1
	[0039.871] lstrcmpiA (lpString1="", lpString2="Stars.htm") returned -1
	[0039.871] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg"
	[0039.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.871] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.871] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm"
	[0039.871] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm"
	[0039.871] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm"
	[0039.871] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm."
	[0039.871] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.Boom"
	[0039.872] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.872] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.872] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.872] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stars.jpg") returned -1
	[0039.872] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.jpg") returned -1
	[0039.872] lstrcmpiA (lpString1="", lpString2="Stars.jpg") returned -1
	[0039.872] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="Stars.htm"
	[0039.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.872] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.872] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.872] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.872] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg"
	[0039.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg"
	[0039.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg"
	[0039.872] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg."
	[0039.872] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.Boom"
	[0039.872] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.873] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.873] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.873] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stucco.gif") returned -1
	[0039.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stucco.gif") returned -1
	[0039.873] lstrcmpiA (lpString1="", lpString2="Stucco.gif") returned -1
	[0039.873] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="Stars.jpg"
	[0039.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.873] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.873] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.873] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Stucco.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif"
	[0039.873] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif"
	[0039.873] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif"
	[0039.873] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif."
	[0039.873] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.Boom"
	[0039.873] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.874] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.874] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.874] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tanspecks.jpg") returned -1
	[0039.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tanspecks.jpg") returned -1
	[0039.874] lstrcmpiA (lpString1="", lpString2="Tanspecks.jpg") returned -1
	[0039.874] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="Stucco.gif"
	[0039.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.874] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.874] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.874] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg"
	[0039.874] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg"
	[0039.874] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg"
	[0039.874] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg."
	[0039.874] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.Boom"
	[0039.874] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.875] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.875] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.875] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tiki.gif") returned -1
	[0039.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tiki.gif") returned -1
	[0039.875] lstrcmpiA (lpString1="", lpString2="Tiki.gif") returned -1
	[0039.875] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="Tanspecks.jpg"
	[0039.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.875] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.875] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Tiki.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif"
	[0039.876] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif"
	[0039.876] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif"
	[0039.876] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif."
	[0039.876] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.Boom"
	[0039.876] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.876] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.876] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.876] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="To_Do_List.emf") returned -1
	[0039.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="To_Do_List.emf") returned -1
	[0039.876] lstrcmpiA (lpString1="", lpString2="To_Do_List.emf") returned -1
	[0039.876] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="Tiki.gif"
	[0039.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.876] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.876] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="To_Do_List.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf"
	[0039.876] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.876] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.876] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="White_Chocolate.jpg") returned -1
	[0039.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="White_Chocolate.jpg") returned -1
	[0039.876] lstrcmpiA (lpString1="", lpString2="White_Chocolate.jpg") returned -1
	[0039.876] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned="To_Do_List.emf"
	[0039.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.877] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.877] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.877] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="White_Chocolate.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg"
	[0039.877] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg"
	[0039.877] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg"
	[0039.877] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg."
	[0039.877] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.Boom"
	[0039.877] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.878] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.878] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.878] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Wrinkled_Paper.gif") returned -1
	[0039.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wrinkled_Paper.gif") returned -1
	[0039.878] lstrcmpiA (lpString1="", lpString2="Wrinkled_Paper.gif") returned -1
	[0039.878] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned="White_Chocolate.jpg"
	[0039.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\"
	[0039.878] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned=""
	[0039.878] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0039.878] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20
	[0039.878] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Wrinkled_Paper.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif"
	[0039.878] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif"
	[0039.878] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif"
	[0039.878] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif."
	[0039.878] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.Boom"
	[0039.879] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0039.879] FindNextFileA (in: hFindFile=0x8ba430, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0039.879] FindClose (in: hFindFile=0x8ba430 | out: hFindFile=0x8ba430) returned 1
	[0039.879] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0039.879] lstrcmpA (lpString1=".", lpString2="TextConv") returned -1
	[0039.879] lstrcmpA (lpString1="..", lpString2="TextConv") returned -1
	[0039.879] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0039.879] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="TextConv" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv"
	[0039.879] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba3a8
	[0039.879] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0039.879] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.880] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0039.880] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0039.880] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.880] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0039.880] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0039.880] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned="*.*"
	[0039.880] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US"
	[0039.880] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0039.880] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0039.880] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.880] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0039.880] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0039.880] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0039.880] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0039.880] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.880] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.880] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSCONV97.DLL") returned -1
	[0039.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCONV97.DLL") returned -1
	[0039.880] lstrcmpiA (lpString1="", lpString2="MSCONV97.DLL") returned -1
	[0039.880] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned="*.*"
	[0039.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\"
	[0039.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned=""
	[0039.881] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt"
	[0039.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to decrypt files.txt")) returned 0xffffffff
	[0039.881] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0039.903] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0039.903] CloseHandle (hObject=0x8c) returned 1
	[0039.904] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="MSCONV97.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL"
	[0039.904] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.904] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RECOVR32.CNV") returned -1
	[0039.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RECOVR32.CNV") returned -1
	[0039.904] lstrcmpiA (lpString1="", lpString2="RECOVR32.CNV") returned -1
	[0039.904] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned="MSCONV97.DLL"
	[0039.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\"
	[0039.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned=""
	[0039.904] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt"
	[0039.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to decrypt files.txt")) returned 0x20
	[0039.904] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="RECOVR32.CNV" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV"
	[0039.904] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.904] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Wks9Pxy.cnv") returned -1
	[0039.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wks9Pxy.cnv") returned -1
	[0039.904] lstrcmpiA (lpString1="", lpString2="Wks9Pxy.cnv") returned -1
	[0039.904] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned="RECOVR32.CNV"
	[0039.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\"
	[0039.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned=""
	[0039.904] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt"
	[0039.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to decrypt files.txt")) returned 0x20
	[0039.905] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="Wks9Pxy.cnv" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv"
	[0039.905] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.905] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WPFT532.CNV") returned -1
	[0039.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPFT532.CNV") returned -1
	[0039.905] lstrcmpiA (lpString1="", lpString2="WPFT532.CNV") returned -1
	[0039.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned="Wks9Pxy.cnv"
	[0039.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\"
	[0039.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned=""
	[0039.905] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt"
	[0039.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to decrypt files.txt")) returned 0x20
	[0039.905] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="WPFT532.CNV" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV"
	[0039.905] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0039.905] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WPFT632.CNV") returned -1
	[0039.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPFT632.CNV") returned -1
	[0039.905] lstrcmpiA (lpString1="", lpString2="WPFT632.CNV") returned -1
	[0039.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned="WPFT532.CNV"
	[0039.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\"
	[0039.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned=""
	[0039.905] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt"
	[0039.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to decrypt files.txt")) returned 0x20
	[0039.905] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="WPFT632.CNV" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV"
	[0039.906] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0039.906] FindClose (in: hFindFile=0x8ba3a8 | out: hFindFile=0x8ba3a8) returned 1
	[0039.906] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0039.906] lstrcmpA (lpString1=".", lpString2="THEMES14") returned -1
	[0039.906] lstrcmpA (lpString1="..", lpString2="THEMES14") returned -1
	[0039.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0039.906] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="THEMES14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14"
	[0039.906] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8ba3a8
	[0039.928] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0039.928] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.930] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0039.930] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0039.930] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0039.930] lstrcmpA (lpString1=".", lpString2="AFTRNOON") returned -1
	[0039.930] lstrcmpA (lpString1="..", lpString2="AFTRNOON") returned -1
	[0039.930] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0039.930] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="AFTRNOON" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON"
	[0039.930] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0039.930] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0039.930] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.930] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0039.930] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0039.930] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0039.930] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AFTRNOON.ELM") returned 1
	[0039.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AFTRNOON.ELM") returned 1
	[0039.930] lstrcmpiA (lpString1="", lpString2="AFTRNOON.ELM") returned -1
	[0039.930] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*") returned="*.*"
	[0039.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\"
	[0039.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned=""
	[0039.930] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt"
	[0039.930] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to decrypt files.txt")) returned 0xffffffff
	[0039.931] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0039.962] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0039.962] CloseHandle (hObject=0x90) returned 1
	[0039.963] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="AFTRNOON.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM"
	[0039.963] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0039.963] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AFTRNOON.INF") returned 1
	[0039.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AFTRNOON.INF") returned 1
	[0039.963] lstrcmpiA (lpString1="", lpString2="AFTRNOON.INF") returned -1
	[0039.963] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned="AFTRNOON.ELM"
	[0039.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\"
	[0039.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned=""
	[0039.963] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt"
	[0039.963] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to decrypt files.txt")) returned 0x20
	[0039.963] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="AFTRNOON.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF"
	[0039.963] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0039.963] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0039.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0039.963] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0039.963] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned="AFTRNOON.INF"
	[0039.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\"
	[0039.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned=""
	[0039.964] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt"
	[0039.964] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to decrypt files.txt")) returned 0x20
	[0039.964] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF"
	[0039.964] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF"
	[0039.964] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF"
	[0039.964] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF."
	[0039.964] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.Boom"
	[0039.964] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0039.965] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x621
	[0039.965] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x85b50300, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x85b50300, dwHighDateTime=0x1c43125)) returned 1
	[0039.965] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.965] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5fe, lpOverlapped=0x0) returned 1
	[0039.978] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0039.978] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0039.978] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5fe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5fe, lpOverlapped=0x0) returned 1
	[0039.978] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0039.978] CloseHandle (hObject=0x90) returned 1
	[0039.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.boom")) returned 1
	[0039.980] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0039.980] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0039.980] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0039.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0039.980] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0039.980] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0039.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\"
	[0039.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned=""
	[0039.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt"
	[0039.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to decrypt files.txt")) returned 0x20
	[0039.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG"
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0039.980] lstrlenA (lpString="*.zip") returned 5
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0039.980] lstrlenA (lpString="*.rar") returned 5
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0039.980] lstrlenA (lpString="*.7z") returned 4
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0039.980] lstrlenA (lpString="*.tar") returned 5
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0039.980] lstrlenA (lpString="*.gzip") returned 6
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0039.980] lstrlenA (lpString="*.jpg") returned 5
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0039.980] lstrlenA (lpString="*.jpeg") returned 6
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0039.980] lstrlenA (lpString="*.psd") returned 5
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0039.980] lstrlenA (lpString="*.cdr") returned 5
	[0039.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0039.980] lstrlenA (lpString="*.dwg") returned 5
	[0039.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0039.981] lstrlenA (lpString="*.max") returned 5
	[0039.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0039.981] lstrlenA (lpString="*.bmp") returned 5
	[0039.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0039.981] lstrlenA (lpString="*.gif") returned 5
	[0039.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0039.981] lstrlenA (lpString="*.png") returned 5
	[0039.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG"
	[0039.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG"
	[0039.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG."
	[0039.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.Boom"
	[0039.981] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.028] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6292
	[0040.028] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x86e63000, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x86e63000, dwHighDateTime=0x1c43125)) returned 1
	[0040.029] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.029] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x626f, lpOverlapped=0x0) returned 1
	[0040.047] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.047] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.047] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x626f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x626f, lpOverlapped=0x0) returned 1
	[0040.048] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.048] CloseHandle (hObject=0x90) returned 1
	[0040.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.boom")) returned 1
	[0040.049] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.049] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.049] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.050] lstrcmpA (lpString1=".", lpString2="ARCTIC") returned -1
	[0040.050] lstrcmpA (lpString1="..", lpString2="ARCTIC") returned -1
	[0040.050] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.050] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ARCTIC" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC"
	[0040.050] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC") returned 62
	[0040.050] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.051] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.051] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.051] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.051] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.051] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.051] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.051] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ARCTIC.ELM") returned 1
	[0040.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARCTIC.ELM") returned 1
	[0040.051] lstrcmpiA (lpString1="", lpString2="ARCTIC.ELM") returned -1
	[0040.051] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*") returned="*.*"
	[0040.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\"
	[0040.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned=""
	[0040.051] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt"
	[0040.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0xffffffff
	[0040.051] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.053] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.053] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.054] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.054] CloseHandle (hObject=0x90) returned 1
	[0040.054] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="ARCTIC.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM"
	[0040.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.zip") returned 0
	[0040.054] lstrlenA (lpString="*.zip") returned 5
	[0040.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.rar") returned 0
	[0040.054] lstrlenA (lpString="*.rar") returned 5
	[0040.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.7z") returned 0
	[0040.054] lstrlenA (lpString="*.7z") returned 4
	[0040.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.tar") returned 0
	[0040.054] lstrlenA (lpString="*.tar") returned 5
	[0040.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.gzip") returned 0
	[0040.054] lstrlenA (lpString="*.gzip") returned 6
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.jpg") returned 0
	[0040.055] lstrlenA (lpString="*.jpg") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.jpeg") returned 0
	[0040.055] lstrlenA (lpString="*.jpeg") returned 6
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.psd") returned 0
	[0040.055] lstrlenA (lpString="*.psd") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.cdr") returned 0
	[0040.055] lstrlenA (lpString="*.cdr") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.dwg") returned 0
	[0040.055] lstrlenA (lpString="*.dwg") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.max") returned 0
	[0040.055] lstrlenA (lpString="*.max") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.bmp") returned 0
	[0040.055] lstrlenA (lpString="*.bmp") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.gif") returned 0
	[0040.055] lstrlenA (lpString="*.gif") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.png") returned 0
	[0040.055] lstrlenA (lpString="*.png") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.doc") returned 0
	[0040.055] lstrlenA (lpString="*.doc") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.docx") returned 0
	[0040.055] lstrlenA (lpString="*.docx") returned 6
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.xls") returned 0
	[0040.055] lstrlenA (lpString="*.xls") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.xlsx") returned 0
	[0040.055] lstrlenA (lpString="*.xlsx") returned 6
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ppt") returned 0
	[0040.055] lstrlenA (lpString="*.ppt") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.pptx") returned 0
	[0040.055] lstrlenA (lpString="*.pptx") returned 6
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.txt") returned 0
	[0040.055] lstrlenA (lpString="*.txt") returned 5
	[0040.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.pdf") returned 0
	[0040.055] lstrlenA (lpString="*.pdf") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.djvu") returned 0
	[0040.056] lstrlenA (lpString="*.djvu") returned 6
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.htm") returned 0
	[0040.056] lstrlenA (lpString="*.htm") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.html") returned 0
	[0040.056] lstrlenA (lpString="*.html") returned 6
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mdb") returned 0
	[0040.056] lstrlenA (lpString="*.mdb") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.cer") returned 0
	[0040.056] lstrlenA (lpString="*.cer") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.p12") returned 0
	[0040.056] lstrlenA (lpString="*.p12") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.pfx") returned 0
	[0040.056] lstrlenA (lpString="*.pfx") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.kwm") returned 0
	[0040.056] lstrlenA (lpString="*.kwm") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.pwm") returned 0
	[0040.056] lstrlenA (lpString="*.pwm") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.1cd") returned 0
	[0040.056] lstrlenA (lpString="*.1cd") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.md") returned 0
	[0040.056] lstrlenA (lpString="*.md") returned 4
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mdf") returned 0
	[0040.056] lstrlenA (lpString="*.mdf") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.dbf") returned 0
	[0040.056] lstrlenA (lpString="*.dbf") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.odt") returned 0
	[0040.056] lstrlenA (lpString="*.odt") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.vob") returned 0
	[0040.056] lstrlenA (lpString="*.vob") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ifo") returned 0
	[0040.056] lstrlenA (lpString="*.ifo") returned 5
	[0040.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.lnk") returned 0
	[0040.056] lstrlenA (lpString="*.lnk") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.torrent") returned 0
	[0040.057] lstrlenA (lpString="*.torrent") returned 9
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mov") returned 0
	[0040.057] lstrlenA (lpString="*.mov") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.m2v") returned 0
	[0040.057] lstrlenA (lpString="*.m2v") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.3gp") returned 0
	[0040.057] lstrlenA (lpString="*.3gp") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mpeg") returned 0
	[0040.057] lstrlenA (lpString="*.mpeg") returned 6
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mpg") returned 0
	[0040.057] lstrlenA (lpString="*.mpg") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.flv") returned 0
	[0040.057] lstrlenA (lpString="*.flv") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.avi") returned 0
	[0040.057] lstrlenA (lpString="*.avi") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mp4") returned 0
	[0040.057] lstrlenA (lpString="*.mp4") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.wmv") returned 0
	[0040.057] lstrlenA (lpString="*.wmv") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.divx") returned 0
	[0040.057] lstrlenA (lpString="*.divx") returned 6
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mkv") returned 0
	[0040.057] lstrlenA (lpString="*.mkv") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mp3") returned 0
	[0040.057] lstrlenA (lpString="*.mp3") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.wav") returned 0
	[0040.057] lstrlenA (lpString="*.wav") returned 5
	[0040.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.flac") returned 0
	[0040.058] lstrlenA (lpString="*.flac") returned 6
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ape") returned 0
	[0040.058] lstrlenA (lpString="*.ape") returned 5
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.wma") returned 0
	[0040.058] lstrlenA (lpString="*.wma") returned 5
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ac3") returned 0
	[0040.058] lstrlenA (lpString="*.ac3") returned 5
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.exe") returned 0
	[0040.058] lstrlenA (lpString="*.exe") returned 5
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.apk") returned 0
	[0040.058] lstrlenA (lpString="*.apk") returned 5
	[0040.058] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.058] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ARCTIC.INF") returned 1
	[0040.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARCTIC.INF") returned 1
	[0040.058] lstrcmpiA (lpString1="", lpString2="ARCTIC.INF") returned -1
	[0040.058] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="ARCTIC.ELM"
	[0040.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\"
	[0040.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned=""
	[0040.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt"
	[0040.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0x20
	[0040.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="ARCTIC.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF"
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.zip") returned 0
	[0040.058] lstrlenA (lpString="*.zip") returned 5
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.rar") returned 0
	[0040.058] lstrlenA (lpString="*.rar") returned 5
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.7z") returned 0
	[0040.058] lstrlenA (lpString="*.7z") returned 4
	[0040.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.tar") returned 0
	[0040.059] lstrlenA (lpString="*.tar") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.gzip") returned 0
	[0040.059] lstrlenA (lpString="*.gzip") returned 6
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.jpg") returned 0
	[0040.059] lstrlenA (lpString="*.jpg") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.jpeg") returned 0
	[0040.059] lstrlenA (lpString="*.jpeg") returned 6
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.psd") returned 0
	[0040.059] lstrlenA (lpString="*.psd") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.cdr") returned 0
	[0040.059] lstrlenA (lpString="*.cdr") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.dwg") returned 0
	[0040.059] lstrlenA (lpString="*.dwg") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.max") returned 0
	[0040.059] lstrlenA (lpString="*.max") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.bmp") returned 0
	[0040.059] lstrlenA (lpString="*.bmp") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.gif") returned 0
	[0040.059] lstrlenA (lpString="*.gif") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.png") returned 0
	[0040.059] lstrlenA (lpString="*.png") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.doc") returned 0
	[0040.059] lstrlenA (lpString="*.doc") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.docx") returned 0
	[0040.059] lstrlenA (lpString="*.docx") returned 6
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.xls") returned 0
	[0040.059] lstrlenA (lpString="*.xls") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.xlsx") returned 0
	[0040.059] lstrlenA (lpString="*.xlsx") returned 6
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.ppt") returned 0
	[0040.059] lstrlenA (lpString="*.ppt") returned 5
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.pptx") returned 0
	[0040.059] lstrlenA (lpString="*.pptx") returned 6
	[0040.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.txt") returned 0
	[0040.060] lstrlenA (lpString="*.txt") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.pdf") returned 0
	[0040.060] lstrlenA (lpString="*.pdf") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.djvu") returned 0
	[0040.060] lstrlenA (lpString="*.djvu") returned 6
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.htm") returned 0
	[0040.060] lstrlenA (lpString="*.htm") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.html") returned 0
	[0040.060] lstrlenA (lpString="*.html") returned 6
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mdb") returned 0
	[0040.060] lstrlenA (lpString="*.mdb") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.cer") returned 0
	[0040.060] lstrlenA (lpString="*.cer") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.p12") returned 0
	[0040.060] lstrlenA (lpString="*.p12") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.pfx") returned 0
	[0040.060] lstrlenA (lpString="*.pfx") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.kwm") returned 0
	[0040.060] lstrlenA (lpString="*.kwm") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.pwm") returned 0
	[0040.060] lstrlenA (lpString="*.pwm") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.1cd") returned 0
	[0040.060] lstrlenA (lpString="*.1cd") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.md") returned 0
	[0040.060] lstrlenA (lpString="*.md") returned 4
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mdf") returned 0
	[0040.060] lstrlenA (lpString="*.mdf") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.dbf") returned 0
	[0040.060] lstrlenA (lpString="*.dbf") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.odt") returned 0
	[0040.060] lstrlenA (lpString="*.odt") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.vob") returned 0
	[0040.060] lstrlenA (lpString="*.vob") returned 5
	[0040.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.ifo") returned 0
	[0040.060] lstrlenA (lpString="*.ifo") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.lnk") returned 0
	[0040.061] lstrlenA (lpString="*.lnk") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.torrent") returned 0
	[0040.061] lstrlenA (lpString="*.torrent") returned 9
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mov") returned 0
	[0040.061] lstrlenA (lpString="*.mov") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.m2v") returned 0
	[0040.061] lstrlenA (lpString="*.m2v") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.3gp") returned 0
	[0040.061] lstrlenA (lpString="*.3gp") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mpeg") returned 0
	[0040.061] lstrlenA (lpString="*.mpeg") returned 6
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mpg") returned 0
	[0040.061] lstrlenA (lpString="*.mpg") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.flv") returned 0
	[0040.061] lstrlenA (lpString="*.flv") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.avi") returned 0
	[0040.061] lstrlenA (lpString="*.avi") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mp4") returned 0
	[0040.061] lstrlenA (lpString="*.mp4") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.wmv") returned 0
	[0040.061] lstrlenA (lpString="*.wmv") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.divx") returned 0
	[0040.061] lstrlenA (lpString="*.divx") returned 6
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mkv") returned 0
	[0040.061] lstrlenA (lpString="*.mkv") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mp3") returned 0
	[0040.061] lstrlenA (lpString="*.mp3") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.wav") returned 0
	[0040.061] lstrlenA (lpString="*.wav") returned 5
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.flac") returned 0
	[0040.061] lstrlenA (lpString="*.flac") returned 6
	[0040.061] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.ape") returned 0
	[0040.061] lstrlenA (lpString="*.ape") returned 5
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.wma") returned 0
	[0040.062] lstrlenA (lpString="*.wma") returned 5
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.ac3") returned 0
	[0040.062] lstrlenA (lpString="*.ac3") returned 5
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.exe") returned 0
	[0040.062] lstrlenA (lpString="*.exe") returned 5
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.apk") returned 0
	[0040.062] lstrlenA (lpString="*.apk") returned 5
	[0040.062] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.062] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.062] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.062] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.062] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned="ARCTIC.INF"
	[0040.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\"
	[0040.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned=""
	[0040.062] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt"
	[0040.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0x20
	[0040.062] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF"
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.062] lstrlenA (lpString="*.zip") returned 5
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.062] lstrlenA (lpString="*.rar") returned 5
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.062] lstrlenA (lpString="*.7z") returned 4
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.062] lstrlenA (lpString="*.tar") returned 5
	[0040.062] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.062] lstrlenA (lpString="*.gzip") returned 6
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.063] lstrlenA (lpString="*.jpg") returned 5
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.063] lstrlenA (lpString="*.jpeg") returned 6
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.063] lstrlenA (lpString="*.psd") returned 5
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.063] lstrlenA (lpString="*.cdr") returned 5
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.063] lstrlenA (lpString="*.dwg") returned 5
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.063] lstrlenA (lpString="*.max") returned 5
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.063] lstrlenA (lpString="*.bmp") returned 5
	[0040.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.063] lstrlenA (lpString="*.gif") returned 5
	[0040.063] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF"
	[0040.063] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF"
	[0040.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF."
	[0040.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.Boom"
	[0040.063] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.064] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba9
	[0040.064] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a79b700, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a79b700, dwHighDateTime=0x1c43125)) returned 1
	[0040.064] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.064] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xb86, lpOverlapped=0x0) returned 1
	[0040.072] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.072] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.072] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xb86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xb86, lpOverlapped=0x0) returned 1
	[0040.072] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.072] CloseHandle (hObject=0x90) returned 1
	[0040.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.boom")) returned 1
	[0040.075] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.075] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.075] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.075] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.075] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\"
	[0040.075] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned=""
	[0040.075] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt"
	[0040.075] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0x20
	[0040.075] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG"
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.076] lstrlenA (lpString="*.zip") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.076] lstrlenA (lpString="*.rar") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.076] lstrlenA (lpString="*.7z") returned 4
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.076] lstrlenA (lpString="*.tar") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.076] lstrlenA (lpString="*.gzip") returned 6
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.076] lstrlenA (lpString="*.jpg") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.076] lstrlenA (lpString="*.jpeg") returned 6
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.076] lstrlenA (lpString="*.psd") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.076] lstrlenA (lpString="*.cdr") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.076] lstrlenA (lpString="*.dwg") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.076] lstrlenA (lpString="*.max") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.076] lstrlenA (lpString="*.bmp") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.076] lstrlenA (lpString="*.gif") returned 5
	[0040.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.076] lstrlenA (lpString="*.png") returned 5
	[0040.076] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG"
	[0040.076] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG"
	[0040.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG."
	[0040.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.Boom"
	[0040.076] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.078] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d44
	[0040.078] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a79b700, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a79b700, dwHighDateTime=0x1c43125)) returned 1
	[0040.078] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.078] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4d21, lpOverlapped=0x0) returned 1
	[0040.106] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.106] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.106] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4d21, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4d21, lpOverlapped=0x0) returned 1
	[0040.106] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.106] CloseHandle (hObject=0x90) returned 1
	[0040.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.boom")) returned 1
	[0040.108] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.108] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.108] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.108] lstrcmpA (lpString1=".", lpString2="AXIS") returned -1
	[0040.108] lstrcmpA (lpString1="..", lpString2="AXIS") returned -1
	[0040.108] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.108] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS") returned 60
	[0040.108] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.109] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.109] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.109] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.109] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.109] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.109] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.109] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AXIS.ELM") returned 1
	[0040.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.ELM") returned 1
	[0040.109] lstrcmpiA (lpString1="", lpString2="AXIS.ELM") returned -1
	[0040.109] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*") returned="*.*"
	[0040.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\"
	[0040.110] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned=""
	[0040.110] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0xffffffff
	[0040.110] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.110] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.110] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.111] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.111] CloseHandle (hObject=0x90) returned 1
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.zip") returned 0
	[0040.112] lstrlenA (lpString="*.zip") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.rar") returned 0
	[0040.112] lstrlenA (lpString="*.rar") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.7z") returned 0
	[0040.112] lstrlenA (lpString="*.7z") returned 4
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.tar") returned 0
	[0040.112] lstrlenA (lpString="*.tar") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.gzip") returned 0
	[0040.112] lstrlenA (lpString="*.gzip") returned 6
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.jpg") returned 0
	[0040.112] lstrlenA (lpString="*.jpg") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.jpeg") returned 0
	[0040.112] lstrlenA (lpString="*.jpeg") returned 6
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.psd") returned 0
	[0040.112] lstrlenA (lpString="*.psd") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.cdr") returned 0
	[0040.112] lstrlenA (lpString="*.cdr") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.dwg") returned 0
	[0040.112] lstrlenA (lpString="*.dwg") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.max") returned 0
	[0040.112] lstrlenA (lpString="*.max") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.bmp") returned 0
	[0040.112] lstrlenA (lpString="*.bmp") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.gif") returned 0
	[0040.112] lstrlenA (lpString="*.gif") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.png") returned 0
	[0040.112] lstrlenA (lpString="*.png") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.doc") returned 0
	[0040.112] lstrlenA (lpString="*.doc") returned 5
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.docx") returned 0
	[0040.112] lstrlenA (lpString="*.docx") returned 6
	[0040.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.xls") returned 0
	[0040.112] lstrlenA (lpString="*.xls") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.xlsx") returned 0
	[0040.113] lstrlenA (lpString="*.xlsx") returned 6
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ppt") returned 0
	[0040.113] lstrlenA (lpString="*.ppt") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.pptx") returned 0
	[0040.113] lstrlenA (lpString="*.pptx") returned 6
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.txt") returned 0
	[0040.113] lstrlenA (lpString="*.txt") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.pdf") returned 0
	[0040.113] lstrlenA (lpString="*.pdf") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.djvu") returned 0
	[0040.113] lstrlenA (lpString="*.djvu") returned 6
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.htm") returned 0
	[0040.113] lstrlenA (lpString="*.htm") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.html") returned 0
	[0040.113] lstrlenA (lpString="*.html") returned 6
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mdb") returned 0
	[0040.113] lstrlenA (lpString="*.mdb") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.cer") returned 0
	[0040.113] lstrlenA (lpString="*.cer") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.p12") returned 0
	[0040.113] lstrlenA (lpString="*.p12") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.pfx") returned 0
	[0040.113] lstrlenA (lpString="*.pfx") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.kwm") returned 0
	[0040.113] lstrlenA (lpString="*.kwm") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.pwm") returned 0
	[0040.113] lstrlenA (lpString="*.pwm") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.1cd") returned 0
	[0040.113] lstrlenA (lpString="*.1cd") returned 5
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.md") returned 0
	[0040.113] lstrlenA (lpString="*.md") returned 4
	[0040.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mdf") returned 0
	[0040.114] lstrlenA (lpString="*.mdf") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.dbf") returned 0
	[0040.114] lstrlenA (lpString="*.dbf") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.odt") returned 0
	[0040.114] lstrlenA (lpString="*.odt") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.vob") returned 0
	[0040.114] lstrlenA (lpString="*.vob") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ifo") returned 0
	[0040.114] lstrlenA (lpString="*.ifo") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.lnk") returned 0
	[0040.114] lstrlenA (lpString="*.lnk") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.torrent") returned 0
	[0040.114] lstrlenA (lpString="*.torrent") returned 9
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mov") returned 0
	[0040.114] lstrlenA (lpString="*.mov") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.m2v") returned 0
	[0040.114] lstrlenA (lpString="*.m2v") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.3gp") returned 0
	[0040.114] lstrlenA (lpString="*.3gp") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mpeg") returned 0
	[0040.114] lstrlenA (lpString="*.mpeg") returned 6
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mpg") returned 0
	[0040.114] lstrlenA (lpString="*.mpg") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.flv") returned 0
	[0040.114] lstrlenA (lpString="*.flv") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.avi") returned 0
	[0040.114] lstrlenA (lpString="*.avi") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mp4") returned 0
	[0040.114] lstrlenA (lpString="*.mp4") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.wmv") returned 0
	[0040.114] lstrlenA (lpString="*.wmv") returned 5
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.divx") returned 0
	[0040.114] lstrlenA (lpString="*.divx") returned 6
	[0040.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mkv") returned 0
	[0040.115] lstrlenA (lpString="*.mkv") returned 5
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mp3") returned 0
	[0040.115] lstrlenA (lpString="*.mp3") returned 5
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.wav") returned 0
	[0040.115] lstrlenA (lpString="*.wav") returned 5
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.flac") returned 0
	[0040.115] lstrlenA (lpString="*.flac") returned 6
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ape") returned 0
	[0040.115] lstrlenA (lpString="*.ape") returned 5
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.wma") returned 0
	[0040.115] lstrlenA (lpString="*.wma") returned 5
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ac3") returned 0
	[0040.115] lstrlenA (lpString="*.ac3") returned 5
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.exe") returned 0
	[0040.115] lstrlenA (lpString="*.exe") returned 5
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.apk") returned 0
	[0040.115] lstrlenA (lpString="*.apk") returned 5
	[0040.115] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.115] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.115] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AXIS.INF") returned 1
	[0040.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.INF") returned 1
	[0040.115] lstrcmpiA (lpString1="", lpString2="AXIS.INF") returned -1
	[0040.115] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned="AXIS.ELM"
	[0040.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\"
	[0040.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned=""
	[0040.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0x20
	[0040.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.zip") returned 0
	[0040.115] lstrlenA (lpString="*.zip") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.rar") returned 0
	[0040.116] lstrlenA (lpString="*.rar") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.7z") returned 0
	[0040.116] lstrlenA (lpString="*.7z") returned 4
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.tar") returned 0
	[0040.116] lstrlenA (lpString="*.tar") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.gzip") returned 0
	[0040.116] lstrlenA (lpString="*.gzip") returned 6
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.jpg") returned 0
	[0040.116] lstrlenA (lpString="*.jpg") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.jpeg") returned 0
	[0040.116] lstrlenA (lpString="*.jpeg") returned 6
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.psd") returned 0
	[0040.116] lstrlenA (lpString="*.psd") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.cdr") returned 0
	[0040.116] lstrlenA (lpString="*.cdr") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.dwg") returned 0
	[0040.116] lstrlenA (lpString="*.dwg") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.max") returned 0
	[0040.116] lstrlenA (lpString="*.max") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.bmp") returned 0
	[0040.116] lstrlenA (lpString="*.bmp") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.gif") returned 0
	[0040.116] lstrlenA (lpString="*.gif") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.png") returned 0
	[0040.116] lstrlenA (lpString="*.png") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.doc") returned 0
	[0040.116] lstrlenA (lpString="*.doc") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.docx") returned 0
	[0040.116] lstrlenA (lpString="*.docx") returned 6
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.xls") returned 0
	[0040.116] lstrlenA (lpString="*.xls") returned 5
	[0040.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.xlsx") returned 0
	[0040.116] lstrlenA (lpString="*.xlsx") returned 6
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.ppt") returned 0
	[0040.117] lstrlenA (lpString="*.ppt") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.pptx") returned 0
	[0040.117] lstrlenA (lpString="*.pptx") returned 6
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.txt") returned 0
	[0040.117] lstrlenA (lpString="*.txt") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.pdf") returned 0
	[0040.117] lstrlenA (lpString="*.pdf") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.djvu") returned 0
	[0040.117] lstrlenA (lpString="*.djvu") returned 6
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.htm") returned 0
	[0040.117] lstrlenA (lpString="*.htm") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.html") returned 0
	[0040.117] lstrlenA (lpString="*.html") returned 6
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mdb") returned 0
	[0040.117] lstrlenA (lpString="*.mdb") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.cer") returned 0
	[0040.117] lstrlenA (lpString="*.cer") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.p12") returned 0
	[0040.117] lstrlenA (lpString="*.p12") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.pfx") returned 0
	[0040.117] lstrlenA (lpString="*.pfx") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.kwm") returned 0
	[0040.117] lstrlenA (lpString="*.kwm") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.pwm") returned 0
	[0040.117] lstrlenA (lpString="*.pwm") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.1cd") returned 0
	[0040.117] lstrlenA (lpString="*.1cd") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.md") returned 0
	[0040.117] lstrlenA (lpString="*.md") returned 4
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mdf") returned 0
	[0040.117] lstrlenA (lpString="*.mdf") returned 5
	[0040.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.dbf") returned 0
	[0040.117] lstrlenA (lpString="*.dbf") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.odt") returned 0
	[0040.118] lstrlenA (lpString="*.odt") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.vob") returned 0
	[0040.118] lstrlenA (lpString="*.vob") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.ifo") returned 0
	[0040.118] lstrlenA (lpString="*.ifo") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.lnk") returned 0
	[0040.118] lstrlenA (lpString="*.lnk") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.torrent") returned 0
	[0040.118] lstrlenA (lpString="*.torrent") returned 9
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mov") returned 0
	[0040.118] lstrlenA (lpString="*.mov") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.m2v") returned 0
	[0040.118] lstrlenA (lpString="*.m2v") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.3gp") returned 0
	[0040.118] lstrlenA (lpString="*.3gp") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mpeg") returned 0
	[0040.118] lstrlenA (lpString="*.mpeg") returned 6
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mpg") returned 0
	[0040.118] lstrlenA (lpString="*.mpg") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.flv") returned 0
	[0040.118] lstrlenA (lpString="*.flv") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.avi") returned 0
	[0040.118] lstrlenA (lpString="*.avi") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mp4") returned 0
	[0040.118] lstrlenA (lpString="*.mp4") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.wmv") returned 0
	[0040.118] lstrlenA (lpString="*.wmv") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.divx") returned 0
	[0040.118] lstrlenA (lpString="*.divx") returned 6
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mkv") returned 0
	[0040.118] lstrlenA (lpString="*.mkv") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mp3") returned 0
	[0040.118] lstrlenA (lpString="*.mp3") returned 5
	[0040.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.wav") returned 0
	[0040.118] lstrlenA (lpString="*.wav") returned 5
	[0040.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.flac") returned 0
	[0040.119] lstrlenA (lpString="*.flac") returned 6
	[0040.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.ape") returned 0
	[0040.119] lstrlenA (lpString="*.ape") returned 5
	[0040.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.wma") returned 0
	[0040.119] lstrlenA (lpString="*.wma") returned 5
	[0040.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.ac3") returned 0
	[0040.119] lstrlenA (lpString="*.ac3") returned 5
	[0040.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.exe") returned 0
	[0040.119] lstrlenA (lpString="*.exe") returned 5
	[0040.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.apk") returned 0
	[0040.119] lstrlenA (lpString="*.apk") returned 5
	[0040.119] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.119] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.119] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.119] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.119] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned="AXIS.INF"
	[0040.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\"
	[0040.119] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned=""
	[0040.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt"
	[0040.119] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0x20
	[0040.120] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF"
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.120] lstrlenA (lpString="*.zip") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.120] lstrlenA (lpString="*.rar") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.120] lstrlenA (lpString="*.7z") returned 4
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.120] lstrlenA (lpString="*.tar") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.120] lstrlenA (lpString="*.gzip") returned 6
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.120] lstrlenA (lpString="*.jpg") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.120] lstrlenA (lpString="*.jpeg") returned 6
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.120] lstrlenA (lpString="*.psd") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.120] lstrlenA (lpString="*.cdr") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.120] lstrlenA (lpString="*.dwg") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.120] lstrlenA (lpString="*.max") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.120] lstrlenA (lpString="*.bmp") returned 5
	[0040.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.120] lstrlenA (lpString="*.gif") returned 5
	[0040.120] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF"
	[0040.120] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF"
	[0040.120] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF."
	[0040.120] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.Boom"
	[0040.120] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.121] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb20
	[0040.121] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8baae400, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8baae400, dwHighDateTime=0x1c43125)) returned 1
	[0040.121] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.121] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xafd, lpOverlapped=0x0) returned 1
	[0040.122] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.123] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.123] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xafd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xafd, lpOverlapped=0x0) returned 1
	[0040.123] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.123] CloseHandle (hObject=0x90) returned 1
	[0040.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.boom")) returned 1
	[0040.128] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.128] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.128] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.129] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\"
	[0040.129] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned=""
	[0040.129] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt"
	[0040.129] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0x20
	[0040.129] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG"
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.129] lstrlenA (lpString="*.zip") returned 5
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.129] lstrlenA (lpString="*.rar") returned 5
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.129] lstrlenA (lpString="*.7z") returned 4
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.129] lstrlenA (lpString="*.tar") returned 5
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.129] lstrlenA (lpString="*.gzip") returned 6
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.129] lstrlenA (lpString="*.jpg") returned 5
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.129] lstrlenA (lpString="*.jpeg") returned 6
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.129] lstrlenA (lpString="*.psd") returned 5
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.129] lstrlenA (lpString="*.cdr") returned 5
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.129] lstrlenA (lpString="*.dwg") returned 5
	[0040.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.130] lstrlenA (lpString="*.max") returned 5
	[0040.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.130] lstrlenA (lpString="*.bmp") returned 5
	[0040.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.130] lstrlenA (lpString="*.gif") returned 5
	[0040.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.130] lstrlenA (lpString="*.png") returned 5
	[0040.130] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG"
	[0040.130] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG"
	[0040.130] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG."
	[0040.130] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.Boom"
	[0040.130] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.131] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8864
	[0040.131] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8baae400, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8baae400, dwHighDateTime=0x1c43125)) returned 1
	[0040.131] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.131] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x8841, lpOverlapped=0x0) returned 1
	[0040.140] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.140] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.140] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x8841, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x8841, lpOverlapped=0x0) returned 1
	[0040.140] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.140] CloseHandle (hObject=0x90) returned 1
	[0040.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.boom")) returned 1
	[0040.142] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.142] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.142] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.142] lstrcmpA (lpString1=".", lpString2="BLENDS") returned -1
	[0040.143] lstrcmpA (lpString1="..", lpString2="BLENDS") returned -1
	[0040.143] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.143] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BLENDS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS"
	[0040.143] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS") returned 62
	[0040.143] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.151] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.151] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.151] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.151] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.151] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.151] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.151] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BLENDS.ELM") returned 1
	[0040.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLENDS.ELM") returned 1
	[0040.151] lstrcmpiA (lpString1="", lpString2="BLENDS.ELM") returned -1
	[0040.151] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*") returned="*.*"
	[0040.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\"
	[0040.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned=""
	[0040.151] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt"
	[0040.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0xffffffff
	[0040.151] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.152] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.152] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.153] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.153] CloseHandle (hObject=0x90) returned 1
	[0040.153] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="BLENDS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM"
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.zip") returned 0
	[0040.153] lstrlenA (lpString="*.zip") returned 5
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.rar") returned 0
	[0040.153] lstrlenA (lpString="*.rar") returned 5
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.7z") returned 0
	[0040.153] lstrlenA (lpString="*.7z") returned 4
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.tar") returned 0
	[0040.153] lstrlenA (lpString="*.tar") returned 5
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.gzip") returned 0
	[0040.153] lstrlenA (lpString="*.gzip") returned 6
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.jpg") returned 0
	[0040.153] lstrlenA (lpString="*.jpg") returned 5
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.jpeg") returned 0
	[0040.153] lstrlenA (lpString="*.jpeg") returned 6
	[0040.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.psd") returned 0
	[0040.154] lstrlenA (lpString="*.psd") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.cdr") returned 0
	[0040.154] lstrlenA (lpString="*.cdr") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.dwg") returned 0
	[0040.154] lstrlenA (lpString="*.dwg") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.max") returned 0
	[0040.154] lstrlenA (lpString="*.max") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.bmp") returned 0
	[0040.154] lstrlenA (lpString="*.bmp") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.gif") returned 0
	[0040.154] lstrlenA (lpString="*.gif") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.png") returned 0
	[0040.154] lstrlenA (lpString="*.png") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.doc") returned 0
	[0040.154] lstrlenA (lpString="*.doc") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.docx") returned 0
	[0040.154] lstrlenA (lpString="*.docx") returned 6
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.xls") returned 0
	[0040.154] lstrlenA (lpString="*.xls") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.xlsx") returned 0
	[0040.154] lstrlenA (lpString="*.xlsx") returned 6
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ppt") returned 0
	[0040.154] lstrlenA (lpString="*.ppt") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.pptx") returned 0
	[0040.154] lstrlenA (lpString="*.pptx") returned 6
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.txt") returned 0
	[0040.154] lstrlenA (lpString="*.txt") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.pdf") returned 0
	[0040.154] lstrlenA (lpString="*.pdf") returned 5
	[0040.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.djvu") returned 0
	[0040.154] lstrlenA (lpString="*.djvu") returned 6
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.htm") returned 0
	[0040.155] lstrlenA (lpString="*.htm") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.html") returned 0
	[0040.155] lstrlenA (lpString="*.html") returned 6
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mdb") returned 0
	[0040.155] lstrlenA (lpString="*.mdb") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.cer") returned 0
	[0040.155] lstrlenA (lpString="*.cer") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.p12") returned 0
	[0040.155] lstrlenA (lpString="*.p12") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.pfx") returned 0
	[0040.155] lstrlenA (lpString="*.pfx") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.kwm") returned 0
	[0040.155] lstrlenA (lpString="*.kwm") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.pwm") returned 0
	[0040.155] lstrlenA (lpString="*.pwm") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.1cd") returned 0
	[0040.155] lstrlenA (lpString="*.1cd") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.md") returned 0
	[0040.155] lstrlenA (lpString="*.md") returned 4
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mdf") returned 0
	[0040.155] lstrlenA (lpString="*.mdf") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.dbf") returned 0
	[0040.155] lstrlenA (lpString="*.dbf") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.odt") returned 0
	[0040.155] lstrlenA (lpString="*.odt") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.vob") returned 0
	[0040.155] lstrlenA (lpString="*.vob") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ifo") returned 0
	[0040.155] lstrlenA (lpString="*.ifo") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.lnk") returned 0
	[0040.155] lstrlenA (lpString="*.lnk") returned 5
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.torrent") returned 0
	[0040.155] lstrlenA (lpString="*.torrent") returned 9
	[0040.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mov") returned 0
	[0040.155] lstrlenA (lpString="*.mov") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.m2v") returned 0
	[0040.156] lstrlenA (lpString="*.m2v") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.3gp") returned 0
	[0040.156] lstrlenA (lpString="*.3gp") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mpeg") returned 0
	[0040.156] lstrlenA (lpString="*.mpeg") returned 6
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mpg") returned 0
	[0040.156] lstrlenA (lpString="*.mpg") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.flv") returned 0
	[0040.156] lstrlenA (lpString="*.flv") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.avi") returned 0
	[0040.156] lstrlenA (lpString="*.avi") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mp4") returned 0
	[0040.156] lstrlenA (lpString="*.mp4") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.wmv") returned 0
	[0040.156] lstrlenA (lpString="*.wmv") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.divx") returned 0
	[0040.156] lstrlenA (lpString="*.divx") returned 6
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mkv") returned 0
	[0040.156] lstrlenA (lpString="*.mkv") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mp3") returned 0
	[0040.156] lstrlenA (lpString="*.mp3") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.wav") returned 0
	[0040.156] lstrlenA (lpString="*.wav") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.flac") returned 0
	[0040.156] lstrlenA (lpString="*.flac") returned 6
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ape") returned 0
	[0040.156] lstrlenA (lpString="*.ape") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.wma") returned 0
	[0040.156] lstrlenA (lpString="*.wma") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ac3") returned 0
	[0040.156] lstrlenA (lpString="*.ac3") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.exe") returned 0
	[0040.156] lstrlenA (lpString="*.exe") returned 5
	[0040.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.apk") returned 0
	[0040.156] lstrlenA (lpString="*.apk") returned 5
	[0040.156] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.157] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.157] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BLENDS.INF") returned 1
	[0040.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLENDS.INF") returned 1
	[0040.157] lstrcmpiA (lpString1="", lpString2="BLENDS.INF") returned -1
	[0040.157] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned="BLENDS.ELM"
	[0040.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\"
	[0040.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned=""
	[0040.157] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt"
	[0040.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0x20
	[0040.157] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="BLENDS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF"
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.zip") returned 0
	[0040.157] lstrlenA (lpString="*.zip") returned 5
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.rar") returned 0
	[0040.157] lstrlenA (lpString="*.rar") returned 5
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.7z") returned 0
	[0040.157] lstrlenA (lpString="*.7z") returned 4
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.tar") returned 0
	[0040.157] lstrlenA (lpString="*.tar") returned 5
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.gzip") returned 0
	[0040.157] lstrlenA (lpString="*.gzip") returned 6
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.jpg") returned 0
	[0040.157] lstrlenA (lpString="*.jpg") returned 5
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.jpeg") returned 0
	[0040.157] lstrlenA (lpString="*.jpeg") returned 6
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.psd") returned 0
	[0040.157] lstrlenA (lpString="*.psd") returned 5
	[0040.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.cdr") returned 0
	[0040.157] lstrlenA (lpString="*.cdr") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.dwg") returned 0
	[0040.158] lstrlenA (lpString="*.dwg") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.max") returned 0
	[0040.158] lstrlenA (lpString="*.max") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.bmp") returned 0
	[0040.158] lstrlenA (lpString="*.bmp") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.gif") returned 0
	[0040.158] lstrlenA (lpString="*.gif") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.png") returned 0
	[0040.158] lstrlenA (lpString="*.png") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.doc") returned 0
	[0040.158] lstrlenA (lpString="*.doc") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.docx") returned 0
	[0040.158] lstrlenA (lpString="*.docx") returned 6
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.xls") returned 0
	[0040.158] lstrlenA (lpString="*.xls") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.xlsx") returned 0
	[0040.158] lstrlenA (lpString="*.xlsx") returned 6
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.ppt") returned 0
	[0040.158] lstrlenA (lpString="*.ppt") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.pptx") returned 0
	[0040.158] lstrlenA (lpString="*.pptx") returned 6
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.txt") returned 0
	[0040.158] lstrlenA (lpString="*.txt") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.pdf") returned 0
	[0040.158] lstrlenA (lpString="*.pdf") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.djvu") returned 0
	[0040.158] lstrlenA (lpString="*.djvu") returned 6
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.htm") returned 0
	[0040.158] lstrlenA (lpString="*.htm") returned 5
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.html") returned 0
	[0040.158] lstrlenA (lpString="*.html") returned 6
	[0040.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mdb") returned 0
	[0040.159] lstrlenA (lpString="*.mdb") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.cer") returned 0
	[0040.159] lstrlenA (lpString="*.cer") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.p12") returned 0
	[0040.159] lstrlenA (lpString="*.p12") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.pfx") returned 0
	[0040.159] lstrlenA (lpString="*.pfx") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.kwm") returned 0
	[0040.159] lstrlenA (lpString="*.kwm") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.pwm") returned 0
	[0040.159] lstrlenA (lpString="*.pwm") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.1cd") returned 0
	[0040.159] lstrlenA (lpString="*.1cd") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.md") returned 0
	[0040.159] lstrlenA (lpString="*.md") returned 4
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mdf") returned 0
	[0040.159] lstrlenA (lpString="*.mdf") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.dbf") returned 0
	[0040.159] lstrlenA (lpString="*.dbf") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.odt") returned 0
	[0040.159] lstrlenA (lpString="*.odt") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.vob") returned 0
	[0040.159] lstrlenA (lpString="*.vob") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.ifo") returned 0
	[0040.159] lstrlenA (lpString="*.ifo") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.lnk") returned 0
	[0040.159] lstrlenA (lpString="*.lnk") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.torrent") returned 0
	[0040.159] lstrlenA (lpString="*.torrent") returned 9
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mov") returned 0
	[0040.159] lstrlenA (lpString="*.mov") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.m2v") returned 0
	[0040.159] lstrlenA (lpString="*.m2v") returned 5
	[0040.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.3gp") returned 0
	[0040.160] lstrlenA (lpString="*.3gp") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mpeg") returned 0
	[0040.160] lstrlenA (lpString="*.mpeg") returned 6
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mpg") returned 0
	[0040.160] lstrlenA (lpString="*.mpg") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.flv") returned 0
	[0040.160] lstrlenA (lpString="*.flv") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.avi") returned 0
	[0040.160] lstrlenA (lpString="*.avi") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mp4") returned 0
	[0040.160] lstrlenA (lpString="*.mp4") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.wmv") returned 0
	[0040.160] lstrlenA (lpString="*.wmv") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.divx") returned 0
	[0040.160] lstrlenA (lpString="*.divx") returned 6
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mkv") returned 0
	[0040.160] lstrlenA (lpString="*.mkv") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mp3") returned 0
	[0040.160] lstrlenA (lpString="*.mp3") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.wav") returned 0
	[0040.160] lstrlenA (lpString="*.wav") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.flac") returned 0
	[0040.160] lstrlenA (lpString="*.flac") returned 6
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.ape") returned 0
	[0040.160] lstrlenA (lpString="*.ape") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.wma") returned 0
	[0040.160] lstrlenA (lpString="*.wma") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.ac3") returned 0
	[0040.160] lstrlenA (lpString="*.ac3") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.exe") returned 0
	[0040.160] lstrlenA (lpString="*.exe") returned 5
	[0040.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.apk") returned 0
	[0040.160] lstrlenA (lpString="*.apk") returned 5
	[0040.160] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.161] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.161] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.161] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.161] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned="BLENDS.INF"
	[0040.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\"
	[0040.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned=""
	[0040.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt"
	[0040.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0x20
	[0040.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF"
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.161] lstrlenA (lpString="*.zip") returned 5
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.161] lstrlenA (lpString="*.rar") returned 5
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.161] lstrlenA (lpString="*.7z") returned 4
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.161] lstrlenA (lpString="*.tar") returned 5
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.161] lstrlenA (lpString="*.gzip") returned 6
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.161] lstrlenA (lpString="*.jpg") returned 5
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.161] lstrlenA (lpString="*.jpeg") returned 6
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.161] lstrlenA (lpString="*.psd") returned 5
	[0040.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.161] lstrlenA (lpString="*.cdr") returned 5
	[0040.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.162] lstrlenA (lpString="*.dwg") returned 5
	[0040.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.162] lstrlenA (lpString="*.max") returned 5
	[0040.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.162] lstrlenA (lpString="*.bmp") returned 5
	[0040.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.162] lstrlenA (lpString="*.gif") returned 5
	[0040.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF"
	[0040.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF"
	[0040.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF."
	[0040.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.Boom"
	[0040.162] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.177] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x885
	[0040.177] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6d2cd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.177] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.177] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x862, lpOverlapped=0x0) returned 1
	[0040.191] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.191] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.191] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x862, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x862, lpOverlapped=0x0) returned 1
	[0040.191] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.191] CloseHandle (hObject=0x90) returned 1
	[0040.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.boom")) returned 1
	[0040.204] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.204] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.204] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.204] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.204] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\"
	[0040.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned=""
	[0040.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt"
	[0040.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0x20
	[0040.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG"
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.205] lstrlenA (lpString="*.zip") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.205] lstrlenA (lpString="*.rar") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.205] lstrlenA (lpString="*.7z") returned 4
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.205] lstrlenA (lpString="*.tar") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.205] lstrlenA (lpString="*.gzip") returned 6
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.205] lstrlenA (lpString="*.jpg") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.205] lstrlenA (lpString="*.jpeg") returned 6
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.205] lstrlenA (lpString="*.psd") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.205] lstrlenA (lpString="*.cdr") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.205] lstrlenA (lpString="*.dwg") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.205] lstrlenA (lpString="*.max") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.205] lstrlenA (lpString="*.bmp") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.205] lstrlenA (lpString="*.gif") returned 5
	[0040.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.205] lstrlenA (lpString="*.png") returned 5
	[0040.205] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG"
	[0040.205] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG"
	[0040.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG."
	[0040.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.Boom"
	[0040.206] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.206] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5093
	[0040.206] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.206] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.206] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5070, lpOverlapped=0x0) returned 1
	[0040.225] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.225] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.225] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5070, lpOverlapped=0x0) returned 1
	[0040.225] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.226] CloseHandle (hObject=0x90) returned 1
	[0040.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.boom")) returned 1
	[0040.231] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.231] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.231] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.231] lstrcmpA (lpString1=".", lpString2="BLUECALM") returned -1
	[0040.231] lstrcmpA (lpString1="..", lpString2="BLUECALM") returned -1
	[0040.231] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BLUECALM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM"
	[0040.231] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM") returned 64
	[0040.232] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.232] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.232] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.232] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.232] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.232] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BLUECALM.ELM") returned 1
	[0040.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUECALM.ELM") returned 1
	[0040.232] lstrcmpiA (lpString1="", lpString2="BLUECALM.ELM") returned -1
	[0040.232] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*") returned="*.*"
	[0040.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\"
	[0040.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned=""
	[0040.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt"
	[0040.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0xffffffff
	[0040.232] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.235] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.235] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.236] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.237] CloseHandle (hObject=0x90) returned 1
	[0040.237] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="BLUECALM.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM"
	[0040.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.zip") returned 0
	[0040.237] lstrlenA (lpString="*.zip") returned 5
	[0040.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.rar") returned 0
	[0040.237] lstrlenA (lpString="*.rar") returned 5
	[0040.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.7z") returned 0
	[0040.237] lstrlenA (lpString="*.7z") returned 4
	[0040.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.tar") returned 0
	[0040.237] lstrlenA (lpString="*.tar") returned 5
	[0040.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.gzip") returned 0
	[0040.237] lstrlenA (lpString="*.gzip") returned 6
	[0040.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.jpg") returned 0
	[0040.237] lstrlenA (lpString="*.jpg") returned 5
	[0040.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.jpeg") returned 0
	[0040.237] lstrlenA (lpString="*.jpeg") returned 6
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.psd") returned 0
	[0040.238] lstrlenA (lpString="*.psd") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.cdr") returned 0
	[0040.238] lstrlenA (lpString="*.cdr") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.dwg") returned 0
	[0040.238] lstrlenA (lpString="*.dwg") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.max") returned 0
	[0040.238] lstrlenA (lpString="*.max") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.bmp") returned 0
	[0040.238] lstrlenA (lpString="*.bmp") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.gif") returned 0
	[0040.238] lstrlenA (lpString="*.gif") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.png") returned 0
	[0040.238] lstrlenA (lpString="*.png") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.doc") returned 0
	[0040.238] lstrlenA (lpString="*.doc") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.docx") returned 0
	[0040.238] lstrlenA (lpString="*.docx") returned 6
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.xls") returned 0
	[0040.238] lstrlenA (lpString="*.xls") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.xlsx") returned 0
	[0040.238] lstrlenA (lpString="*.xlsx") returned 6
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ppt") returned 0
	[0040.238] lstrlenA (lpString="*.ppt") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.pptx") returned 0
	[0040.238] lstrlenA (lpString="*.pptx") returned 6
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.txt") returned 0
	[0040.238] lstrlenA (lpString="*.txt") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.pdf") returned 0
	[0040.238] lstrlenA (lpString="*.pdf") returned 5
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.djvu") returned 0
	[0040.238] lstrlenA (lpString="*.djvu") returned 6
	[0040.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.htm") returned 0
	[0040.239] lstrlenA (lpString="*.htm") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.html") returned 0
	[0040.239] lstrlenA (lpString="*.html") returned 6
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mdb") returned 0
	[0040.239] lstrlenA (lpString="*.mdb") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.cer") returned 0
	[0040.239] lstrlenA (lpString="*.cer") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.p12") returned 0
	[0040.239] lstrlenA (lpString="*.p12") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.pfx") returned 0
	[0040.239] lstrlenA (lpString="*.pfx") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.kwm") returned 0
	[0040.239] lstrlenA (lpString="*.kwm") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.pwm") returned 0
	[0040.239] lstrlenA (lpString="*.pwm") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.1cd") returned 0
	[0040.239] lstrlenA (lpString="*.1cd") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.md") returned 0
	[0040.239] lstrlenA (lpString="*.md") returned 4
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mdf") returned 0
	[0040.239] lstrlenA (lpString="*.mdf") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.dbf") returned 0
	[0040.239] lstrlenA (lpString="*.dbf") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.odt") returned 0
	[0040.239] lstrlenA (lpString="*.odt") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.vob") returned 0
	[0040.239] lstrlenA (lpString="*.vob") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ifo") returned 0
	[0040.239] lstrlenA (lpString="*.ifo") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.lnk") returned 0
	[0040.239] lstrlenA (lpString="*.lnk") returned 5
	[0040.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.torrent") returned 0
	[0040.239] lstrlenA (lpString="*.torrent") returned 9
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mov") returned 0
	[0040.240] lstrlenA (lpString="*.mov") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.m2v") returned 0
	[0040.240] lstrlenA (lpString="*.m2v") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.3gp") returned 0
	[0040.240] lstrlenA (lpString="*.3gp") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mpeg") returned 0
	[0040.240] lstrlenA (lpString="*.mpeg") returned 6
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mpg") returned 0
	[0040.240] lstrlenA (lpString="*.mpg") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.flv") returned 0
	[0040.240] lstrlenA (lpString="*.flv") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.avi") returned 0
	[0040.240] lstrlenA (lpString="*.avi") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mp4") returned 0
	[0040.240] lstrlenA (lpString="*.mp4") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.wmv") returned 0
	[0040.240] lstrlenA (lpString="*.wmv") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.divx") returned 0
	[0040.240] lstrlenA (lpString="*.divx") returned 6
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mkv") returned 0
	[0040.240] lstrlenA (lpString="*.mkv") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mp3") returned 0
	[0040.240] lstrlenA (lpString="*.mp3") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.wav") returned 0
	[0040.240] lstrlenA (lpString="*.wav") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.flac") returned 0
	[0040.240] lstrlenA (lpString="*.flac") returned 6
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ape") returned 0
	[0040.240] lstrlenA (lpString="*.ape") returned 5
	[0040.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.wma") returned 0
	[0040.240] lstrlenA (lpString="*.wma") returned 5
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ac3") returned 0
	[0040.241] lstrlenA (lpString="*.ac3") returned 5
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.exe") returned 0
	[0040.241] lstrlenA (lpString="*.exe") returned 5
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.apk") returned 0
	[0040.241] lstrlenA (lpString="*.apk") returned 5
	[0040.241] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BLUECALM.INF") returned 1
	[0040.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUECALM.INF") returned 1
	[0040.241] lstrcmpiA (lpString1="", lpString2="BLUECALM.INF") returned -1
	[0040.241] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned="BLUECALM.ELM"
	[0040.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\"
	[0040.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned=""
	[0040.241] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt"
	[0040.241] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0x20
	[0040.241] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="BLUECALM.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF"
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.zip") returned 0
	[0040.241] lstrlenA (lpString="*.zip") returned 5
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.rar") returned 0
	[0040.241] lstrlenA (lpString="*.rar") returned 5
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.7z") returned 0
	[0040.241] lstrlenA (lpString="*.7z") returned 4
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.tar") returned 0
	[0040.241] lstrlenA (lpString="*.tar") returned 5
	[0040.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.gzip") returned 0
	[0040.242] lstrlenA (lpString="*.gzip") returned 6
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.jpg") returned 0
	[0040.242] lstrlenA (lpString="*.jpg") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.jpeg") returned 0
	[0040.242] lstrlenA (lpString="*.jpeg") returned 6
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.psd") returned 0
	[0040.242] lstrlenA (lpString="*.psd") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.cdr") returned 0
	[0040.242] lstrlenA (lpString="*.cdr") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.dwg") returned 0
	[0040.242] lstrlenA (lpString="*.dwg") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.max") returned 0
	[0040.242] lstrlenA (lpString="*.max") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.bmp") returned 0
	[0040.242] lstrlenA (lpString="*.bmp") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.gif") returned 0
	[0040.242] lstrlenA (lpString="*.gif") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.png") returned 0
	[0040.242] lstrlenA (lpString="*.png") returned 5
	[0040.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.doc") returned 0
	[0040.242] lstrlenA (lpString="*.doc") returned 5
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.docx") returned 0
	[0040.243] lstrlenA (lpString="*.docx") returned 6
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.xls") returned 0
	[0040.243] lstrlenA (lpString="*.xls") returned 5
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.xlsx") returned 0
	[0040.243] lstrlenA (lpString="*.xlsx") returned 6
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.ppt") returned 0
	[0040.243] lstrlenA (lpString="*.ppt") returned 5
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.pptx") returned 0
	[0040.243] lstrlenA (lpString="*.pptx") returned 6
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.txt") returned 0
	[0040.243] lstrlenA (lpString="*.txt") returned 5
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.pdf") returned 0
	[0040.243] lstrlenA (lpString="*.pdf") returned 5
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.djvu") returned 0
	[0040.243] lstrlenA (lpString="*.djvu") returned 6
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.htm") returned 0
	[0040.243] lstrlenA (lpString="*.htm") returned 5
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.html") returned 0
	[0040.243] lstrlenA (lpString="*.html") returned 6
	[0040.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mdb") returned 0
	[0040.243] lstrlenA (lpString="*.mdb") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.cer") returned 0
	[0040.244] lstrlenA (lpString="*.cer") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.p12") returned 0
	[0040.244] lstrlenA (lpString="*.p12") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.pfx") returned 0
	[0040.244] lstrlenA (lpString="*.pfx") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.kwm") returned 0
	[0040.244] lstrlenA (lpString="*.kwm") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.pwm") returned 0
	[0040.244] lstrlenA (lpString="*.pwm") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.1cd") returned 0
	[0040.244] lstrlenA (lpString="*.1cd") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.md") returned 0
	[0040.244] lstrlenA (lpString="*.md") returned 4
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mdf") returned 0
	[0040.244] lstrlenA (lpString="*.mdf") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.dbf") returned 0
	[0040.244] lstrlenA (lpString="*.dbf") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.odt") returned 0
	[0040.244] lstrlenA (lpString="*.odt") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.vob") returned 0
	[0040.244] lstrlenA (lpString="*.vob") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.ifo") returned 0
	[0040.244] lstrlenA (lpString="*.ifo") returned 5
	[0040.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.lnk") returned 0
	[0040.245] lstrlenA (lpString="*.lnk") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.torrent") returned 0
	[0040.245] lstrlenA (lpString="*.torrent") returned 9
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mov") returned 0
	[0040.245] lstrlenA (lpString="*.mov") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.m2v") returned 0
	[0040.245] lstrlenA (lpString="*.m2v") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.3gp") returned 0
	[0040.245] lstrlenA (lpString="*.3gp") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mpeg") returned 0
	[0040.245] lstrlenA (lpString="*.mpeg") returned 6
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mpg") returned 0
	[0040.245] lstrlenA (lpString="*.mpg") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.flv") returned 0
	[0040.245] lstrlenA (lpString="*.flv") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.avi") returned 0
	[0040.245] lstrlenA (lpString="*.avi") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mp4") returned 0
	[0040.245] lstrlenA (lpString="*.mp4") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.wmv") returned 0
	[0040.245] lstrlenA (lpString="*.wmv") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.divx") returned 0
	[0040.245] lstrlenA (lpString="*.divx") returned 6
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mkv") returned 0
	[0040.245] lstrlenA (lpString="*.mkv") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mp3") returned 0
	[0040.245] lstrlenA (lpString="*.mp3") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.wav") returned 0
	[0040.245] lstrlenA (lpString="*.wav") returned 5
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.flac") returned 0
	[0040.245] lstrlenA (lpString="*.flac") returned 6
	[0040.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.ape") returned 0
	[0040.246] lstrlenA (lpString="*.ape") returned 5
	[0040.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.wma") returned 0
	[0040.246] lstrlenA (lpString="*.wma") returned 5
	[0040.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.ac3") returned 0
	[0040.246] lstrlenA (lpString="*.ac3") returned 5
	[0040.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.exe") returned 0
	[0040.246] lstrlenA (lpString="*.exe") returned 5
	[0040.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.apk") returned 0
	[0040.246] lstrlenA (lpString="*.apk") returned 5
	[0040.246] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.246] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.246] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.246] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.246] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned="BLUECALM.INF"
	[0040.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\"
	[0040.246] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned=""
	[0040.246] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt"
	[0040.246] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0x20
	[0040.246] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF"
	[0040.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.246] lstrlenA (lpString="*.zip") returned 5
	[0040.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.246] lstrlenA (lpString="*.rar") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.247] lstrlenA (lpString="*.7z") returned 4
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.247] lstrlenA (lpString="*.tar") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.247] lstrlenA (lpString="*.gzip") returned 6
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.247] lstrlenA (lpString="*.jpg") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.247] lstrlenA (lpString="*.jpeg") returned 6
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.247] lstrlenA (lpString="*.psd") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.247] lstrlenA (lpString="*.cdr") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.247] lstrlenA (lpString="*.dwg") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.247] lstrlenA (lpString="*.max") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.247] lstrlenA (lpString="*.bmp") returned 5
	[0040.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.247] lstrlenA (lpString="*.gif") returned 5
	[0040.247] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF"
	[0040.247] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF"
	[0040.247] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF."
	[0040.247] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.Boom"
	[0040.247] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.248] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x618
	[0040.248] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6d2cd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.248] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.248] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5f5, lpOverlapped=0x0) returned 1
	[0040.272] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.272] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.272] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5f5, lpOverlapped=0x0) returned 1
	[0040.272] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.272] CloseHandle (hObject=0x90) returned 1
	[0040.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.boom")) returned 1
	[0040.273] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.273] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.274] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.274] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\"
	[0040.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned=""
	[0040.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt"
	[0040.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0x20
	[0040.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG"
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.274] lstrlenA (lpString="*.zip") returned 5
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.274] lstrlenA (lpString="*.rar") returned 5
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.274] lstrlenA (lpString="*.7z") returned 4
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.274] lstrlenA (lpString="*.tar") returned 5
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.274] lstrlenA (lpString="*.gzip") returned 6
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.274] lstrlenA (lpString="*.jpg") returned 5
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.274] lstrlenA (lpString="*.jpeg") returned 6
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.274] lstrlenA (lpString="*.psd") returned 5
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.274] lstrlenA (lpString="*.cdr") returned 5
	[0040.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.274] lstrlenA (lpString="*.dwg") returned 5
	[0040.275] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.275] lstrlenA (lpString="*.max") returned 5
	[0040.275] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.275] lstrlenA (lpString="*.bmp") returned 5
	[0040.275] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.275] lstrlenA (lpString="*.gif") returned 5
	[0040.275] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.275] lstrlenA (lpString="*.png") returned 5
	[0040.275] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG"
	[0040.275] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG"
	[0040.275] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG."
	[0040.275] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.Boom"
	[0040.275] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.275] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f1
	[0040.275] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.275] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.275] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x80ce, lpOverlapped=0x0) returned 1
	[0040.284] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.284] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.284] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x80ce, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x80ce, lpOverlapped=0x0) returned 1
	[0040.285] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.285] CloseHandle (hObject=0x90) returned 1
	[0040.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.boom")) returned 1
	[0040.287] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.287] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.287] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.287] lstrcmpA (lpString1=".", lpString2="BLUEPRNT") returned -1
	[0040.287] lstrcmpA (lpString1="..", lpString2="BLUEPRNT") returned -1
	[0040.287] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.287] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BLUEPRNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT"
	[0040.287] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT") returned 64
	[0040.288] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.289] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.289] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.289] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.289] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.289] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.289] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.289] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BLUEPRNT.ELM") returned 1
	[0040.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUEPRNT.ELM") returned 1
	[0040.289] lstrcmpiA (lpString1="", lpString2="BLUEPRNT.ELM") returned -1
	[0040.289] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*") returned="*.*"
	[0040.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\"
	[0040.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned=""
	[0040.289] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt"
	[0040.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0xffffffff
	[0040.289] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.312] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.312] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.313] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.314] CloseHandle (hObject=0x90) returned 1
	[0040.314] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="BLUEPRNT.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM"
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.zip") returned 0
	[0040.314] lstrlenA (lpString="*.zip") returned 5
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.rar") returned 0
	[0040.314] lstrlenA (lpString="*.rar") returned 5
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.7z") returned 0
	[0040.314] lstrlenA (lpString="*.7z") returned 4
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.tar") returned 0
	[0040.314] lstrlenA (lpString="*.tar") returned 5
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.gzip") returned 0
	[0040.314] lstrlenA (lpString="*.gzip") returned 6
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.jpg") returned 0
	[0040.314] lstrlenA (lpString="*.jpg") returned 5
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.jpeg") returned 0
	[0040.314] lstrlenA (lpString="*.jpeg") returned 6
	[0040.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.psd") returned 0
	[0040.315] lstrlenA (lpString="*.psd") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.cdr") returned 0
	[0040.315] lstrlenA (lpString="*.cdr") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.dwg") returned 0
	[0040.315] lstrlenA (lpString="*.dwg") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.max") returned 0
	[0040.315] lstrlenA (lpString="*.max") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.bmp") returned 0
	[0040.315] lstrlenA (lpString="*.bmp") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.gif") returned 0
	[0040.315] lstrlenA (lpString="*.gif") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.png") returned 0
	[0040.315] lstrlenA (lpString="*.png") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.doc") returned 0
	[0040.315] lstrlenA (lpString="*.doc") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.docx") returned 0
	[0040.315] lstrlenA (lpString="*.docx") returned 6
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.xls") returned 0
	[0040.315] lstrlenA (lpString="*.xls") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.xlsx") returned 0
	[0040.315] lstrlenA (lpString="*.xlsx") returned 6
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ppt") returned 0
	[0040.315] lstrlenA (lpString="*.ppt") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.pptx") returned 0
	[0040.315] lstrlenA (lpString="*.pptx") returned 6
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.txt") returned 0
	[0040.315] lstrlenA (lpString="*.txt") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.pdf") returned 0
	[0040.315] lstrlenA (lpString="*.pdf") returned 5
	[0040.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.djvu") returned 0
	[0040.315] lstrlenA (lpString="*.djvu") returned 6
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.htm") returned 0
	[0040.316] lstrlenA (lpString="*.htm") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.html") returned 0
	[0040.316] lstrlenA (lpString="*.html") returned 6
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mdb") returned 0
	[0040.316] lstrlenA (lpString="*.mdb") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.cer") returned 0
	[0040.316] lstrlenA (lpString="*.cer") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.p12") returned 0
	[0040.316] lstrlenA (lpString="*.p12") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.pfx") returned 0
	[0040.316] lstrlenA (lpString="*.pfx") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.kwm") returned 0
	[0040.316] lstrlenA (lpString="*.kwm") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.pwm") returned 0
	[0040.316] lstrlenA (lpString="*.pwm") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.1cd") returned 0
	[0040.316] lstrlenA (lpString="*.1cd") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.md") returned 0
	[0040.316] lstrlenA (lpString="*.md") returned 4
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mdf") returned 0
	[0040.316] lstrlenA (lpString="*.mdf") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.dbf") returned 0
	[0040.316] lstrlenA (lpString="*.dbf") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.odt") returned 0
	[0040.316] lstrlenA (lpString="*.odt") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.vob") returned 0
	[0040.316] lstrlenA (lpString="*.vob") returned 5
	[0040.316] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ifo") returned 0
	[0040.316] lstrlenA (lpString="*.ifo") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.lnk") returned 0
	[0040.317] lstrlenA (lpString="*.lnk") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.torrent") returned 0
	[0040.317] lstrlenA (lpString="*.torrent") returned 9
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mov") returned 0
	[0040.317] lstrlenA (lpString="*.mov") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.m2v") returned 0
	[0040.317] lstrlenA (lpString="*.m2v") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.3gp") returned 0
	[0040.317] lstrlenA (lpString="*.3gp") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mpeg") returned 0
	[0040.317] lstrlenA (lpString="*.mpeg") returned 6
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mpg") returned 0
	[0040.317] lstrlenA (lpString="*.mpg") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.flv") returned 0
	[0040.317] lstrlenA (lpString="*.flv") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.avi") returned 0
	[0040.317] lstrlenA (lpString="*.avi") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mp4") returned 0
	[0040.317] lstrlenA (lpString="*.mp4") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.wmv") returned 0
	[0040.317] lstrlenA (lpString="*.wmv") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.divx") returned 0
	[0040.317] lstrlenA (lpString="*.divx") returned 6
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mkv") returned 0
	[0040.317] lstrlenA (lpString="*.mkv") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mp3") returned 0
	[0040.317] lstrlenA (lpString="*.mp3") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.wav") returned 0
	[0040.317] lstrlenA (lpString="*.wav") returned 5
	[0040.317] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.flac") returned 0
	[0040.317] lstrlenA (lpString="*.flac") returned 6
	[0040.318] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ape") returned 0
	[0040.318] lstrlenA (lpString="*.ape") returned 5
	[0040.318] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.wma") returned 0
	[0040.318] lstrlenA (lpString="*.wma") returned 5
	[0040.318] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ac3") returned 0
	[0040.318] lstrlenA (lpString="*.ac3") returned 5
	[0040.318] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.exe") returned 0
	[0040.318] lstrlenA (lpString="*.exe") returned 5
	[0040.318] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.apk") returned 0
	[0040.318] lstrlenA (lpString="*.apk") returned 5
	[0040.318] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BLUEPRNT.INF") returned 1
	[0040.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUEPRNT.INF") returned 1
	[0040.318] lstrcmpiA (lpString1="", lpString2="BLUEPRNT.INF") returned -1
	[0040.318] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned="BLUEPRNT.ELM"
	[0040.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\"
	[0040.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned=""
	[0040.318] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt"
	[0040.318] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0x20
	[0040.318] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="BLUEPRNT.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF"
	[0040.318] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.zip") returned 0
	[0040.318] lstrlenA (lpString="*.zip") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.rar") returned 0
	[0040.319] lstrlenA (lpString="*.rar") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.7z") returned 0
	[0040.319] lstrlenA (lpString="*.7z") returned 4
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.tar") returned 0
	[0040.319] lstrlenA (lpString="*.tar") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.gzip") returned 0
	[0040.319] lstrlenA (lpString="*.gzip") returned 6
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.jpg") returned 0
	[0040.319] lstrlenA (lpString="*.jpg") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.jpeg") returned 0
	[0040.319] lstrlenA (lpString="*.jpeg") returned 6
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.psd") returned 0
	[0040.319] lstrlenA (lpString="*.psd") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.cdr") returned 0
	[0040.319] lstrlenA (lpString="*.cdr") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.dwg") returned 0
	[0040.319] lstrlenA (lpString="*.dwg") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.max") returned 0
	[0040.319] lstrlenA (lpString="*.max") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.bmp") returned 0
	[0040.319] lstrlenA (lpString="*.bmp") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.gif") returned 0
	[0040.319] lstrlenA (lpString="*.gif") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.png") returned 0
	[0040.319] lstrlenA (lpString="*.png") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.doc") returned 0
	[0040.319] lstrlenA (lpString="*.doc") returned 5
	[0040.319] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.docx") returned 0
	[0040.319] lstrlenA (lpString="*.docx") returned 6
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.xls") returned 0
	[0040.320] lstrlenA (lpString="*.xls") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.xlsx") returned 0
	[0040.320] lstrlenA (lpString="*.xlsx") returned 6
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.ppt") returned 0
	[0040.320] lstrlenA (lpString="*.ppt") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.pptx") returned 0
	[0040.320] lstrlenA (lpString="*.pptx") returned 6
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.txt") returned 0
	[0040.320] lstrlenA (lpString="*.txt") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.pdf") returned 0
	[0040.320] lstrlenA (lpString="*.pdf") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.djvu") returned 0
	[0040.320] lstrlenA (lpString="*.djvu") returned 6
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.htm") returned 0
	[0040.320] lstrlenA (lpString="*.htm") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.html") returned 0
	[0040.320] lstrlenA (lpString="*.html") returned 6
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mdb") returned 0
	[0040.320] lstrlenA (lpString="*.mdb") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.cer") returned 0
	[0040.320] lstrlenA (lpString="*.cer") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.p12") returned 0
	[0040.320] lstrlenA (lpString="*.p12") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.pfx") returned 0
	[0040.320] lstrlenA (lpString="*.pfx") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.kwm") returned 0
	[0040.320] lstrlenA (lpString="*.kwm") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.pwm") returned 0
	[0040.320] lstrlenA (lpString="*.pwm") returned 5
	[0040.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.1cd") returned 0
	[0040.321] lstrlenA (lpString="*.1cd") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.md") returned 0
	[0040.321] lstrlenA (lpString="*.md") returned 4
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mdf") returned 0
	[0040.321] lstrlenA (lpString="*.mdf") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.dbf") returned 0
	[0040.321] lstrlenA (lpString="*.dbf") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.odt") returned 0
	[0040.321] lstrlenA (lpString="*.odt") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.vob") returned 0
	[0040.321] lstrlenA (lpString="*.vob") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.ifo") returned 0
	[0040.321] lstrlenA (lpString="*.ifo") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.lnk") returned 0
	[0040.321] lstrlenA (lpString="*.lnk") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.torrent") returned 0
	[0040.321] lstrlenA (lpString="*.torrent") returned 9
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mov") returned 0
	[0040.321] lstrlenA (lpString="*.mov") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.m2v") returned 0
	[0040.321] lstrlenA (lpString="*.m2v") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.3gp") returned 0
	[0040.321] lstrlenA (lpString="*.3gp") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mpeg") returned 0
	[0040.321] lstrlenA (lpString="*.mpeg") returned 6
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mpg") returned 0
	[0040.321] lstrlenA (lpString="*.mpg") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.flv") returned 0
	[0040.321] lstrlenA (lpString="*.flv") returned 5
	[0040.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.avi") returned 0
	[0040.321] lstrlenA (lpString="*.avi") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mp4") returned 0
	[0040.322] lstrlenA (lpString="*.mp4") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.wmv") returned 0
	[0040.322] lstrlenA (lpString="*.wmv") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.divx") returned 0
	[0040.322] lstrlenA (lpString="*.divx") returned 6
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mkv") returned 0
	[0040.322] lstrlenA (lpString="*.mkv") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mp3") returned 0
	[0040.322] lstrlenA (lpString="*.mp3") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.wav") returned 0
	[0040.322] lstrlenA (lpString="*.wav") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.flac") returned 0
	[0040.322] lstrlenA (lpString="*.flac") returned 6
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.ape") returned 0
	[0040.322] lstrlenA (lpString="*.ape") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.wma") returned 0
	[0040.322] lstrlenA (lpString="*.wma") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.ac3") returned 0
	[0040.322] lstrlenA (lpString="*.ac3") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.exe") returned 0
	[0040.322] lstrlenA (lpString="*.exe") returned 5
	[0040.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.apk") returned 0
	[0040.323] lstrlenA (lpString="*.apk") returned 5
	[0040.323] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.323] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.323] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.323] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned="BLUEPRNT.INF"
	[0040.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\"
	[0040.323] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned=""
	[0040.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt"
	[0040.323] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0x20
	[0040.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF"
	[0040.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.323] lstrlenA (lpString="*.zip") returned 5
	[0040.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.323] lstrlenA (lpString="*.rar") returned 5
	[0040.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.323] lstrlenA (lpString="*.7z") returned 4
	[0040.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.323] lstrlenA (lpString="*.tar") returned 5
	[0040.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.323] lstrlenA (lpString="*.gzip") returned 6
	[0040.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.323] lstrlenA (lpString="*.jpg") returned 5
	[0040.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.324] lstrlenA (lpString="*.jpeg") returned 6
	[0040.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.324] lstrlenA (lpString="*.psd") returned 5
	[0040.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.324] lstrlenA (lpString="*.cdr") returned 5
	[0040.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.324] lstrlenA (lpString="*.dwg") returned 5
	[0040.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.324] lstrlenA (lpString="*.max") returned 5
	[0040.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.324] lstrlenA (lpString="*.bmp") returned 5
	[0040.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.324] lstrlenA (lpString="*.gif") returned 5
	[0040.324] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF"
	[0040.324] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF"
	[0040.324] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF."
	[0040.324] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.Boom"
	[0040.324] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.325] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x785
	[0040.325] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.325] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.325] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x762, lpOverlapped=0x0) returned 1
	[0040.560] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.560] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.560] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x762, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x762, lpOverlapped=0x0) returned 1
	[0040.560] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.560] CloseHandle (hObject=0x90) returned 1
	[0040.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.boom")) returned 1
	[0040.561] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.561] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.561] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.561] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.561] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\"
	[0040.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned=""
	[0040.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt"
	[0040.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0x20
	[0040.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG"
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.562] lstrlenA (lpString="*.zip") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.562] lstrlenA (lpString="*.rar") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.562] lstrlenA (lpString="*.7z") returned 4
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.562] lstrlenA (lpString="*.tar") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.562] lstrlenA (lpString="*.gzip") returned 6
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.562] lstrlenA (lpString="*.jpg") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.562] lstrlenA (lpString="*.jpeg") returned 6
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.562] lstrlenA (lpString="*.psd") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.562] lstrlenA (lpString="*.cdr") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.562] lstrlenA (lpString="*.dwg") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.562] lstrlenA (lpString="*.max") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.562] lstrlenA (lpString="*.bmp") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.562] lstrlenA (lpString="*.gif") returned 5
	[0040.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.562] lstrlenA (lpString="*.png") returned 5
	[0040.562] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG"
	[0040.562] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG"
	[0040.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG."
	[0040.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.Boom"
	[0040.562] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.566] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b0f
	[0040.566] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.567] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.567] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6aec, lpOverlapped=0x0) returned 1
	[0040.569] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.569] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.569] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6aec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6aec, lpOverlapped=0x0) returned 1
	[0040.569] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.569] CloseHandle (hObject=0x90) returned 1
	[0040.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.boom")) returned 1
	[0040.571] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.571] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.571] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.571] lstrcmpA (lpString1=".", lpString2="BOLDSTRI") returned -1
	[0040.571] lstrcmpA (lpString1="..", lpString2="BOLDSTRI") returned -1
	[0040.571] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.571] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BOLDSTRI" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI"
	[0040.571] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI") returned 64
	[0040.571] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.572] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.572] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.572] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.572] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.572] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.572] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOLDSTRI.ELM") returned 1
	[0040.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOLDSTRI.ELM") returned 1
	[0040.572] lstrcmpiA (lpString1="", lpString2="BOLDSTRI.ELM") returned -1
	[0040.573] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*") returned="*.*"
	[0040.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\"
	[0040.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned=""
	[0040.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt"
	[0040.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0xffffffff
	[0040.573] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.586] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.587] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.587] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.587] CloseHandle (hObject=0x90) returned 1
	[0040.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="BOLDSTRI.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM"
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.zip") returned 0
	[0040.588] lstrlenA (lpString="*.zip") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.rar") returned 0
	[0040.588] lstrlenA (lpString="*.rar") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.7z") returned 0
	[0040.588] lstrlenA (lpString="*.7z") returned 4
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.tar") returned 0
	[0040.588] lstrlenA (lpString="*.tar") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.gzip") returned 0
	[0040.588] lstrlenA (lpString="*.gzip") returned 6
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.jpg") returned 0
	[0040.588] lstrlenA (lpString="*.jpg") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.jpeg") returned 0
	[0040.588] lstrlenA (lpString="*.jpeg") returned 6
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.psd") returned 0
	[0040.588] lstrlenA (lpString="*.psd") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.cdr") returned 0
	[0040.588] lstrlenA (lpString="*.cdr") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.dwg") returned 0
	[0040.588] lstrlenA (lpString="*.dwg") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.max") returned 0
	[0040.588] lstrlenA (lpString="*.max") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.bmp") returned 0
	[0040.588] lstrlenA (lpString="*.bmp") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.gif") returned 0
	[0040.588] lstrlenA (lpString="*.gif") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.png") returned 0
	[0040.588] lstrlenA (lpString="*.png") returned 5
	[0040.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.doc") returned 0
	[0040.589] lstrlenA (lpString="*.doc") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.docx") returned 0
	[0040.589] lstrlenA (lpString="*.docx") returned 6
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.xls") returned 0
	[0040.589] lstrlenA (lpString="*.xls") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.xlsx") returned 0
	[0040.589] lstrlenA (lpString="*.xlsx") returned 6
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ppt") returned 0
	[0040.589] lstrlenA (lpString="*.ppt") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.pptx") returned 0
	[0040.589] lstrlenA (lpString="*.pptx") returned 6
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.txt") returned 0
	[0040.589] lstrlenA (lpString="*.txt") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.pdf") returned 0
	[0040.589] lstrlenA (lpString="*.pdf") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.djvu") returned 0
	[0040.589] lstrlenA (lpString="*.djvu") returned 6
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.htm") returned 0
	[0040.589] lstrlenA (lpString="*.htm") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.html") returned 0
	[0040.589] lstrlenA (lpString="*.html") returned 6
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mdb") returned 0
	[0040.589] lstrlenA (lpString="*.mdb") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.cer") returned 0
	[0040.589] lstrlenA (lpString="*.cer") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.p12") returned 0
	[0040.589] lstrlenA (lpString="*.p12") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.pfx") returned 0
	[0040.589] lstrlenA (lpString="*.pfx") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.kwm") returned 0
	[0040.589] lstrlenA (lpString="*.kwm") returned 5
	[0040.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.pwm") returned 0
	[0040.589] lstrlenA (lpString="*.pwm") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.1cd") returned 0
	[0040.590] lstrlenA (lpString="*.1cd") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.md") returned 0
	[0040.590] lstrlenA (lpString="*.md") returned 4
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mdf") returned 0
	[0040.590] lstrlenA (lpString="*.mdf") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.dbf") returned 0
	[0040.590] lstrlenA (lpString="*.dbf") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.odt") returned 0
	[0040.590] lstrlenA (lpString="*.odt") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.vob") returned 0
	[0040.590] lstrlenA (lpString="*.vob") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ifo") returned 0
	[0040.590] lstrlenA (lpString="*.ifo") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.lnk") returned 0
	[0040.590] lstrlenA (lpString="*.lnk") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.torrent") returned 0
	[0040.590] lstrlenA (lpString="*.torrent") returned 9
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mov") returned 0
	[0040.590] lstrlenA (lpString="*.mov") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.m2v") returned 0
	[0040.590] lstrlenA (lpString="*.m2v") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.3gp") returned 0
	[0040.590] lstrlenA (lpString="*.3gp") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mpeg") returned 0
	[0040.590] lstrlenA (lpString="*.mpeg") returned 6
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mpg") returned 0
	[0040.590] lstrlenA (lpString="*.mpg") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.flv") returned 0
	[0040.590] lstrlenA (lpString="*.flv") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.avi") returned 0
	[0040.590] lstrlenA (lpString="*.avi") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mp4") returned 0
	[0040.590] lstrlenA (lpString="*.mp4") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.wmv") returned 0
	[0040.590] lstrlenA (lpString="*.wmv") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.divx") returned 0
	[0040.590] lstrlenA (lpString="*.divx") returned 6
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mkv") returned 0
	[0040.590] lstrlenA (lpString="*.mkv") returned 5
	[0040.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mp3") returned 0
	[0040.591] lstrlenA (lpString="*.mp3") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.wav") returned 0
	[0040.591] lstrlenA (lpString="*.wav") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.flac") returned 0
	[0040.591] lstrlenA (lpString="*.flac") returned 6
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ape") returned 0
	[0040.591] lstrlenA (lpString="*.ape") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.wma") returned 0
	[0040.591] lstrlenA (lpString="*.wma") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ac3") returned 0
	[0040.591] lstrlenA (lpString="*.ac3") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.exe") returned 0
	[0040.591] lstrlenA (lpString="*.exe") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.apk") returned 0
	[0040.591] lstrlenA (lpString="*.apk") returned 5
	[0040.591] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.591] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.591] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOLDSTRI.INF") returned 1
	[0040.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOLDSTRI.INF") returned 1
	[0040.591] lstrcmpiA (lpString1="", lpString2="BOLDSTRI.INF") returned -1
	[0040.591] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned="BOLDSTRI.ELM"
	[0040.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\"
	[0040.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned=""
	[0040.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt"
	[0040.591] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0x20
	[0040.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="BOLDSTRI.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF"
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.zip") returned 0
	[0040.591] lstrlenA (lpString="*.zip") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.rar") returned 0
	[0040.591] lstrlenA (lpString="*.rar") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.7z") returned 0
	[0040.591] lstrlenA (lpString="*.7z") returned 4
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.tar") returned 0
	[0040.591] lstrlenA (lpString="*.tar") returned 5
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.gzip") returned 0
	[0040.591] lstrlenA (lpString="*.gzip") returned 6
	[0040.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.jpg") returned 0
	[0040.591] lstrlenA (lpString="*.jpg") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.jpeg") returned 0
	[0040.592] lstrlenA (lpString="*.jpeg") returned 6
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.psd") returned 0
	[0040.592] lstrlenA (lpString="*.psd") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.cdr") returned 0
	[0040.592] lstrlenA (lpString="*.cdr") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.dwg") returned 0
	[0040.592] lstrlenA (lpString="*.dwg") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.max") returned 0
	[0040.592] lstrlenA (lpString="*.max") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.bmp") returned 0
	[0040.592] lstrlenA (lpString="*.bmp") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.gif") returned 0
	[0040.592] lstrlenA (lpString="*.gif") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.png") returned 0
	[0040.592] lstrlenA (lpString="*.png") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.doc") returned 0
	[0040.592] lstrlenA (lpString="*.doc") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.docx") returned 0
	[0040.592] lstrlenA (lpString="*.docx") returned 6
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.xls") returned 0
	[0040.592] lstrlenA (lpString="*.xls") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.xlsx") returned 0
	[0040.592] lstrlenA (lpString="*.xlsx") returned 6
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.ppt") returned 0
	[0040.592] lstrlenA (lpString="*.ppt") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.pptx") returned 0
	[0040.592] lstrlenA (lpString="*.pptx") returned 6
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.txt") returned 0
	[0040.592] lstrlenA (lpString="*.txt") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.pdf") returned 0
	[0040.592] lstrlenA (lpString="*.pdf") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.djvu") returned 0
	[0040.592] lstrlenA (lpString="*.djvu") returned 6
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.htm") returned 0
	[0040.592] lstrlenA (lpString="*.htm") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.html") returned 0
	[0040.592] lstrlenA (lpString="*.html") returned 6
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mdb") returned 0
	[0040.592] lstrlenA (lpString="*.mdb") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.cer") returned 0
	[0040.592] lstrlenA (lpString="*.cer") returned 5
	[0040.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.p12") returned 0
	[0040.593] lstrlenA (lpString="*.p12") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.pfx") returned 0
	[0040.593] lstrlenA (lpString="*.pfx") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.kwm") returned 0
	[0040.593] lstrlenA (lpString="*.kwm") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.pwm") returned 0
	[0040.593] lstrlenA (lpString="*.pwm") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.1cd") returned 0
	[0040.593] lstrlenA (lpString="*.1cd") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.md") returned 0
	[0040.593] lstrlenA (lpString="*.md") returned 4
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mdf") returned 0
	[0040.593] lstrlenA (lpString="*.mdf") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.dbf") returned 0
	[0040.593] lstrlenA (lpString="*.dbf") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.odt") returned 0
	[0040.593] lstrlenA (lpString="*.odt") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.vob") returned 0
	[0040.593] lstrlenA (lpString="*.vob") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.ifo") returned 0
	[0040.593] lstrlenA (lpString="*.ifo") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.lnk") returned 0
	[0040.593] lstrlenA (lpString="*.lnk") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.torrent") returned 0
	[0040.593] lstrlenA (lpString="*.torrent") returned 9
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mov") returned 0
	[0040.593] lstrlenA (lpString="*.mov") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.m2v") returned 0
	[0040.593] lstrlenA (lpString="*.m2v") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.3gp") returned 0
	[0040.593] lstrlenA (lpString="*.3gp") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mpeg") returned 0
	[0040.593] lstrlenA (lpString="*.mpeg") returned 6
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mpg") returned 0
	[0040.593] lstrlenA (lpString="*.mpg") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.flv") returned 0
	[0040.593] lstrlenA (lpString="*.flv") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.avi") returned 0
	[0040.593] lstrlenA (lpString="*.avi") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mp4") returned 0
	[0040.593] lstrlenA (lpString="*.mp4") returned 5
	[0040.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.wmv") returned 0
	[0040.593] lstrlenA (lpString="*.wmv") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.divx") returned 0
	[0040.594] lstrlenA (lpString="*.divx") returned 6
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mkv") returned 0
	[0040.594] lstrlenA (lpString="*.mkv") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mp3") returned 0
	[0040.594] lstrlenA (lpString="*.mp3") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.wav") returned 0
	[0040.594] lstrlenA (lpString="*.wav") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.flac") returned 0
	[0040.594] lstrlenA (lpString="*.flac") returned 6
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.ape") returned 0
	[0040.594] lstrlenA (lpString="*.ape") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.wma") returned 0
	[0040.594] lstrlenA (lpString="*.wma") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.ac3") returned 0
	[0040.594] lstrlenA (lpString="*.ac3") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.exe") returned 0
	[0040.594] lstrlenA (lpString="*.exe") returned 5
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.apk") returned 0
	[0040.594] lstrlenA (lpString="*.apk") returned 5
	[0040.594] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.594] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.594] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.594] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.594] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned="BOLDSTRI.INF"
	[0040.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\"
	[0040.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned=""
	[0040.594] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt"
	[0040.594] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0x20
	[0040.594] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF"
	[0040.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.594] lstrlenA (lpString="*.zip") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.595] lstrlenA (lpString="*.rar") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.595] lstrlenA (lpString="*.7z") returned 4
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.595] lstrlenA (lpString="*.tar") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.595] lstrlenA (lpString="*.gzip") returned 6
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.595] lstrlenA (lpString="*.jpg") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.595] lstrlenA (lpString="*.jpeg") returned 6
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.595] lstrlenA (lpString="*.psd") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.595] lstrlenA (lpString="*.cdr") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.595] lstrlenA (lpString="*.dwg") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.595] lstrlenA (lpString="*.max") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.595] lstrlenA (lpString="*.bmp") returned 5
	[0040.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.595] lstrlenA (lpString="*.gif") returned 5
	[0040.595] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF"
	[0040.595] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF"
	[0040.595] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF."
	[0040.595] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.Boom"
	[0040.595] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.596] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd97
	[0040.596] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.596] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.596] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd74, lpOverlapped=0x0) returned 1
	[0040.602] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.602] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.602] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd74, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd74, lpOverlapped=0x0) returned 1
	[0040.602] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.602] CloseHandle (hObject=0x90) returned 1
	[0040.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.boom")) returned 1
	[0040.603] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.603] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.603] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.603] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\"
	[0040.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned=""
	[0040.603] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt"
	[0040.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0x20
	[0040.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG"
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.604] lstrlenA (lpString="*.zip") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.604] lstrlenA (lpString="*.rar") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.604] lstrlenA (lpString="*.7z") returned 4
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.604] lstrlenA (lpString="*.tar") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.604] lstrlenA (lpString="*.gzip") returned 6
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.604] lstrlenA (lpString="*.jpg") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.604] lstrlenA (lpString="*.jpeg") returned 6
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.604] lstrlenA (lpString="*.psd") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.604] lstrlenA (lpString="*.cdr") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.604] lstrlenA (lpString="*.dwg") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.604] lstrlenA (lpString="*.max") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.604] lstrlenA (lpString="*.bmp") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.604] lstrlenA (lpString="*.gif") returned 5
	[0040.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.604] lstrlenA (lpString="*.png") returned 5
	[0040.604] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG"
	[0040.604] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG"
	[0040.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG."
	[0040.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.Boom"
	[0040.604] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.605] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c5d
	[0040.605] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.605] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.605] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7c3a, lpOverlapped=0x0) returned 1
	[0040.609] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.609] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.609] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7c3a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7c3a, lpOverlapped=0x0) returned 1
	[0040.609] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.610] CloseHandle (hObject=0x90) returned 1
	[0040.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.boom")) returned 1
	[0040.611] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.611] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.611] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.611] lstrcmpA (lpString1=".", lpString2="BREEZE") returned -1
	[0040.611] lstrcmpA (lpString1="..", lpString2="BREEZE") returned -1
	[0040.611] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BREEZE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE"
	[0040.611] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE") returned 62
	[0040.611] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.612] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.612] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.612] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.612] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.612] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.612] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.612] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BREEZE.ELM") returned 1
	[0040.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.ELM") returned 1
	[0040.612] lstrcmpiA (lpString1="", lpString2="BREEZE.ELM") returned -1
	[0040.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*") returned="*.*"
	[0040.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\"
	[0040.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned=""
	[0040.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt"
	[0040.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0xffffffff
	[0040.612] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.613] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.613] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.614] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.614] CloseHandle (hObject=0x90) returned 1
	[0040.614] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="BREEZE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM"
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.zip") returned 0
	[0040.614] lstrlenA (lpString="*.zip") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.rar") returned 0
	[0040.614] lstrlenA (lpString="*.rar") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.7z") returned 0
	[0040.614] lstrlenA (lpString="*.7z") returned 4
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.tar") returned 0
	[0040.614] lstrlenA (lpString="*.tar") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.gzip") returned 0
	[0040.614] lstrlenA (lpString="*.gzip") returned 6
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.jpg") returned 0
	[0040.614] lstrlenA (lpString="*.jpg") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.jpeg") returned 0
	[0040.614] lstrlenA (lpString="*.jpeg") returned 6
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.psd") returned 0
	[0040.614] lstrlenA (lpString="*.psd") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.cdr") returned 0
	[0040.614] lstrlenA (lpString="*.cdr") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.dwg") returned 0
	[0040.614] lstrlenA (lpString="*.dwg") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.max") returned 0
	[0040.614] lstrlenA (lpString="*.max") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.bmp") returned 0
	[0040.614] lstrlenA (lpString="*.bmp") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.gif") returned 0
	[0040.614] lstrlenA (lpString="*.gif") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.png") returned 0
	[0040.614] lstrlenA (lpString="*.png") returned 5
	[0040.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.doc") returned 0
	[0040.615] lstrlenA (lpString="*.doc") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.docx") returned 0
	[0040.615] lstrlenA (lpString="*.docx") returned 6
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.xls") returned 0
	[0040.615] lstrlenA (lpString="*.xls") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.xlsx") returned 0
	[0040.615] lstrlenA (lpString="*.xlsx") returned 6
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ppt") returned 0
	[0040.615] lstrlenA (lpString="*.ppt") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.pptx") returned 0
	[0040.615] lstrlenA (lpString="*.pptx") returned 6
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.txt") returned 0
	[0040.615] lstrlenA (lpString="*.txt") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.pdf") returned 0
	[0040.615] lstrlenA (lpString="*.pdf") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.djvu") returned 0
	[0040.615] lstrlenA (lpString="*.djvu") returned 6
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.htm") returned 0
	[0040.615] lstrlenA (lpString="*.htm") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.html") returned 0
	[0040.615] lstrlenA (lpString="*.html") returned 6
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mdb") returned 0
	[0040.615] lstrlenA (lpString="*.mdb") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.cer") returned 0
	[0040.615] lstrlenA (lpString="*.cer") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.p12") returned 0
	[0040.615] lstrlenA (lpString="*.p12") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.pfx") returned 0
	[0040.615] lstrlenA (lpString="*.pfx") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.kwm") returned 0
	[0040.615] lstrlenA (lpString="*.kwm") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.pwm") returned 0
	[0040.615] lstrlenA (lpString="*.pwm") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.1cd") returned 0
	[0040.615] lstrlenA (lpString="*.1cd") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.md") returned 0
	[0040.615] lstrlenA (lpString="*.md") returned 4
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mdf") returned 0
	[0040.615] lstrlenA (lpString="*.mdf") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.dbf") returned 0
	[0040.615] lstrlenA (lpString="*.dbf") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.odt") returned 0
	[0040.615] lstrlenA (lpString="*.odt") returned 5
	[0040.615] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.vob") returned 0
	[0040.616] lstrlenA (lpString="*.vob") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ifo") returned 0
	[0040.616] lstrlenA (lpString="*.ifo") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.lnk") returned 0
	[0040.616] lstrlenA (lpString="*.lnk") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.torrent") returned 0
	[0040.616] lstrlenA (lpString="*.torrent") returned 9
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mov") returned 0
	[0040.616] lstrlenA (lpString="*.mov") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.m2v") returned 0
	[0040.616] lstrlenA (lpString="*.m2v") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.3gp") returned 0
	[0040.616] lstrlenA (lpString="*.3gp") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mpeg") returned 0
	[0040.616] lstrlenA (lpString="*.mpeg") returned 6
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mpg") returned 0
	[0040.616] lstrlenA (lpString="*.mpg") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.flv") returned 0
	[0040.616] lstrlenA (lpString="*.flv") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.avi") returned 0
	[0040.616] lstrlenA (lpString="*.avi") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mp4") returned 0
	[0040.616] lstrlenA (lpString="*.mp4") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.wmv") returned 0
	[0040.616] lstrlenA (lpString="*.wmv") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.divx") returned 0
	[0040.616] lstrlenA (lpString="*.divx") returned 6
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mkv") returned 0
	[0040.616] lstrlenA (lpString="*.mkv") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mp3") returned 0
	[0040.616] lstrlenA (lpString="*.mp3") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.wav") returned 0
	[0040.616] lstrlenA (lpString="*.wav") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.flac") returned 0
	[0040.616] lstrlenA (lpString="*.flac") returned 6
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ape") returned 0
	[0040.616] lstrlenA (lpString="*.ape") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.wma") returned 0
	[0040.616] lstrlenA (lpString="*.wma") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ac3") returned 0
	[0040.616] lstrlenA (lpString="*.ac3") returned 5
	[0040.616] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.exe") returned 0
	[0040.616] lstrlenA (lpString="*.exe") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.apk") returned 0
	[0040.617] lstrlenA (lpString="*.apk") returned 5
	[0040.617] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.617] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.617] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BREEZE.INF") returned 1
	[0040.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.INF") returned 1
	[0040.617] lstrcmpiA (lpString1="", lpString2="BREEZE.INF") returned -1
	[0040.617] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned="BREEZE.ELM"
	[0040.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\"
	[0040.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned=""
	[0040.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt"
	[0040.617] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0x20
	[0040.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="BREEZE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF"
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.zip") returned 0
	[0040.617] lstrlenA (lpString="*.zip") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.rar") returned 0
	[0040.617] lstrlenA (lpString="*.rar") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.7z") returned 0
	[0040.617] lstrlenA (lpString="*.7z") returned 4
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.tar") returned 0
	[0040.617] lstrlenA (lpString="*.tar") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.gzip") returned 0
	[0040.617] lstrlenA (lpString="*.gzip") returned 6
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.jpg") returned 0
	[0040.617] lstrlenA (lpString="*.jpg") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.jpeg") returned 0
	[0040.617] lstrlenA (lpString="*.jpeg") returned 6
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.psd") returned 0
	[0040.617] lstrlenA (lpString="*.psd") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.cdr") returned 0
	[0040.617] lstrlenA (lpString="*.cdr") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.dwg") returned 0
	[0040.617] lstrlenA (lpString="*.dwg") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.max") returned 0
	[0040.617] lstrlenA (lpString="*.max") returned 5
	[0040.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.bmp") returned 0
	[0040.617] lstrlenA (lpString="*.bmp") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.gif") returned 0
	[0040.618] lstrlenA (lpString="*.gif") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.png") returned 0
	[0040.618] lstrlenA (lpString="*.png") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.doc") returned 0
	[0040.618] lstrlenA (lpString="*.doc") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.docx") returned 0
	[0040.618] lstrlenA (lpString="*.docx") returned 6
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.xls") returned 0
	[0040.618] lstrlenA (lpString="*.xls") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.xlsx") returned 0
	[0040.618] lstrlenA (lpString="*.xlsx") returned 6
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.ppt") returned 0
	[0040.618] lstrlenA (lpString="*.ppt") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.pptx") returned 0
	[0040.618] lstrlenA (lpString="*.pptx") returned 6
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.txt") returned 0
	[0040.618] lstrlenA (lpString="*.txt") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.pdf") returned 0
	[0040.618] lstrlenA (lpString="*.pdf") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.djvu") returned 0
	[0040.618] lstrlenA (lpString="*.djvu") returned 6
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.htm") returned 0
	[0040.618] lstrlenA (lpString="*.htm") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.html") returned 0
	[0040.618] lstrlenA (lpString="*.html") returned 6
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mdb") returned 0
	[0040.618] lstrlenA (lpString="*.mdb") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.cer") returned 0
	[0040.618] lstrlenA (lpString="*.cer") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.p12") returned 0
	[0040.618] lstrlenA (lpString="*.p12") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.pfx") returned 0
	[0040.618] lstrlenA (lpString="*.pfx") returned 5
	[0040.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.kwm") returned 0
	[0040.618] lstrlenA (lpString="*.kwm") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.pwm") returned 0
	[0040.619] lstrlenA (lpString="*.pwm") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.1cd") returned 0
	[0040.619] lstrlenA (lpString="*.1cd") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.md") returned 0
	[0040.619] lstrlenA (lpString="*.md") returned 4
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mdf") returned 0
	[0040.619] lstrlenA (lpString="*.mdf") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.dbf") returned 0
	[0040.619] lstrlenA (lpString="*.dbf") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.odt") returned 0
	[0040.619] lstrlenA (lpString="*.odt") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.vob") returned 0
	[0040.619] lstrlenA (lpString="*.vob") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.ifo") returned 0
	[0040.619] lstrlenA (lpString="*.ifo") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.lnk") returned 0
	[0040.619] lstrlenA (lpString="*.lnk") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.torrent") returned 0
	[0040.619] lstrlenA (lpString="*.torrent") returned 9
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mov") returned 0
	[0040.619] lstrlenA (lpString="*.mov") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.m2v") returned 0
	[0040.619] lstrlenA (lpString="*.m2v") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.3gp") returned 0
	[0040.619] lstrlenA (lpString="*.3gp") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mpeg") returned 0
	[0040.619] lstrlenA (lpString="*.mpeg") returned 6
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mpg") returned 0
	[0040.619] lstrlenA (lpString="*.mpg") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.flv") returned 0
	[0040.619] lstrlenA (lpString="*.flv") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.avi") returned 0
	[0040.619] lstrlenA (lpString="*.avi") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mp4") returned 0
	[0040.619] lstrlenA (lpString="*.mp4") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.wmv") returned 0
	[0040.619] lstrlenA (lpString="*.wmv") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.divx") returned 0
	[0040.619] lstrlenA (lpString="*.divx") returned 6
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mkv") returned 0
	[0040.619] lstrlenA (lpString="*.mkv") returned 5
	[0040.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mp3") returned 0
	[0040.620] lstrlenA (lpString="*.mp3") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.wav") returned 0
	[0040.620] lstrlenA (lpString="*.wav") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.flac") returned 0
	[0040.620] lstrlenA (lpString="*.flac") returned 6
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.ape") returned 0
	[0040.620] lstrlenA (lpString="*.ape") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.wma") returned 0
	[0040.620] lstrlenA (lpString="*.wma") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.ac3") returned 0
	[0040.620] lstrlenA (lpString="*.ac3") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.exe") returned 0
	[0040.620] lstrlenA (lpString="*.exe") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.apk") returned 0
	[0040.620] lstrlenA (lpString="*.apk") returned 5
	[0040.620] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.620] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.620] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.620] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.620] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned="BREEZE.INF"
	[0040.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\"
	[0040.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned=""
	[0040.620] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt"
	[0040.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0x20
	[0040.620] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF"
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.620] lstrlenA (lpString="*.zip") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.620] lstrlenA (lpString="*.rar") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.620] lstrlenA (lpString="*.7z") returned 4
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.620] lstrlenA (lpString="*.tar") returned 5
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.620] lstrlenA (lpString="*.gzip") returned 6
	[0040.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.620] lstrlenA (lpString="*.jpg") returned 5
	[0040.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.621] lstrlenA (lpString="*.jpeg") returned 6
	[0040.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.621] lstrlenA (lpString="*.psd") returned 5
	[0040.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.621] lstrlenA (lpString="*.cdr") returned 5
	[0040.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.621] lstrlenA (lpString="*.dwg") returned 5
	[0040.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.621] lstrlenA (lpString="*.max") returned 5
	[0040.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.621] lstrlenA (lpString="*.bmp") returned 5
	[0040.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.621] lstrlenA (lpString="*.gif") returned 5
	[0040.621] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF"
	[0040.621] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF"
	[0040.621] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF."
	[0040.621] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.Boom"
	[0040.621] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.622] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa2
	[0040.622] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.622] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.622] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa7f, lpOverlapped=0x0) returned 1
	[0040.630] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.630] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.631] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa7f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa7f, lpOverlapped=0x0) returned 1
	[0040.631] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.631] CloseHandle (hObject=0x90) returned 1
	[0040.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.boom")) returned 1
	[0040.643] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.643] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.643] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.643] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.643] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\"
	[0040.643] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned=""
	[0040.643] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt"
	[0040.643] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0x20
	[0040.643] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG"
	[0040.643] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.643] lstrlenA (lpString="*.zip") returned 5
	[0040.643] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.643] lstrlenA (lpString="*.rar") returned 5
	[0040.643] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.643] lstrlenA (lpString="*.7z") returned 4
	[0040.643] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.643] lstrlenA (lpString="*.tar") returned 5
	[0040.643] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.644] lstrlenA (lpString="*.gzip") returned 6
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.644] lstrlenA (lpString="*.jpg") returned 5
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.644] lstrlenA (lpString="*.jpeg") returned 6
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.644] lstrlenA (lpString="*.psd") returned 5
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.644] lstrlenA (lpString="*.cdr") returned 5
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.644] lstrlenA (lpString="*.dwg") returned 5
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.644] lstrlenA (lpString="*.max") returned 5
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.644] lstrlenA (lpString="*.bmp") returned 5
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.644] lstrlenA (lpString="*.gif") returned 5
	[0040.644] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.644] lstrlenA (lpString="*.png") returned 5
	[0040.644] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG"
	[0040.644] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG"
	[0040.644] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG."
	[0040.644] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.Boom"
	[0040.644] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.645] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa90c
	[0040.645] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.645] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.645] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa8e9, lpOverlapped=0x0) returned 1
	[0040.657] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.657] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.658] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa8e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa8e9, lpOverlapped=0x0) returned 1
	[0040.658] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.658] CloseHandle (hObject=0x90) returned 1
	[0040.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.boom")) returned 1
	[0040.661] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.661] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.661] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.661] lstrcmpA (lpString1=".", lpString2="CANYON") returned -1
	[0040.661] lstrcmpA (lpString1="..", lpString2="CANYON") returned -1
	[0040.661] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.661] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CANYON" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON"
	[0040.661] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON") returned 62
	[0040.661] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.663] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.663] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.663] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.663] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.663] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.663] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CANYON.ELM") returned 1
	[0040.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CANYON.ELM") returned 1
	[0040.663] lstrcmpiA (lpString1="", lpString2="CANYON.ELM") returned -1
	[0040.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*") returned="*.*"
	[0040.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\"
	[0040.663] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned=""
	[0040.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt"
	[0040.663] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0xffffffff
	[0040.664] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.664] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.664] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.671] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.672] CloseHandle (hObject=0x90) returned 1
	[0040.672] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="CANYON.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM"
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.zip") returned 0
	[0040.672] lstrlenA (lpString="*.zip") returned 5
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.rar") returned 0
	[0040.672] lstrlenA (lpString="*.rar") returned 5
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.7z") returned 0
	[0040.672] lstrlenA (lpString="*.7z") returned 4
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.tar") returned 0
	[0040.672] lstrlenA (lpString="*.tar") returned 5
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.gzip") returned 0
	[0040.672] lstrlenA (lpString="*.gzip") returned 6
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.jpg") returned 0
	[0040.672] lstrlenA (lpString="*.jpg") returned 5
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.jpeg") returned 0
	[0040.672] lstrlenA (lpString="*.jpeg") returned 6
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.psd") returned 0
	[0040.672] lstrlenA (lpString="*.psd") returned 5
	[0040.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.cdr") returned 0
	[0040.672] lstrlenA (lpString="*.cdr") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.dwg") returned 0
	[0040.673] lstrlenA (lpString="*.dwg") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.max") returned 0
	[0040.673] lstrlenA (lpString="*.max") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.bmp") returned 0
	[0040.673] lstrlenA (lpString="*.bmp") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.gif") returned 0
	[0040.673] lstrlenA (lpString="*.gif") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.png") returned 0
	[0040.673] lstrlenA (lpString="*.png") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.doc") returned 0
	[0040.673] lstrlenA (lpString="*.doc") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.docx") returned 0
	[0040.673] lstrlenA (lpString="*.docx") returned 6
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.xls") returned 0
	[0040.673] lstrlenA (lpString="*.xls") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.xlsx") returned 0
	[0040.673] lstrlenA (lpString="*.xlsx") returned 6
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ppt") returned 0
	[0040.673] lstrlenA (lpString="*.ppt") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.pptx") returned 0
	[0040.673] lstrlenA (lpString="*.pptx") returned 6
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.txt") returned 0
	[0040.673] lstrlenA (lpString="*.txt") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.pdf") returned 0
	[0040.673] lstrlenA (lpString="*.pdf") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.djvu") returned 0
	[0040.673] lstrlenA (lpString="*.djvu") returned 6
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.htm") returned 0
	[0040.673] lstrlenA (lpString="*.htm") returned 5
	[0040.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.html") returned 0
	[0040.673] lstrlenA (lpString="*.html") returned 6
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mdb") returned 0
	[0040.674] lstrlenA (lpString="*.mdb") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.cer") returned 0
	[0040.674] lstrlenA (lpString="*.cer") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.p12") returned 0
	[0040.674] lstrlenA (lpString="*.p12") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.pfx") returned 0
	[0040.674] lstrlenA (lpString="*.pfx") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.kwm") returned 0
	[0040.674] lstrlenA (lpString="*.kwm") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.pwm") returned 0
	[0040.674] lstrlenA (lpString="*.pwm") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.1cd") returned 0
	[0040.674] lstrlenA (lpString="*.1cd") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.md") returned 0
	[0040.674] lstrlenA (lpString="*.md") returned 4
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mdf") returned 0
	[0040.674] lstrlenA (lpString="*.mdf") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.dbf") returned 0
	[0040.674] lstrlenA (lpString="*.dbf") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.odt") returned 0
	[0040.674] lstrlenA (lpString="*.odt") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.vob") returned 0
	[0040.674] lstrlenA (lpString="*.vob") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ifo") returned 0
	[0040.674] lstrlenA (lpString="*.ifo") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.lnk") returned 0
	[0040.674] lstrlenA (lpString="*.lnk") returned 5
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.torrent") returned 0
	[0040.674] lstrlenA (lpString="*.torrent") returned 9
	[0040.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mov") returned 0
	[0040.674] lstrlenA (lpString="*.mov") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.m2v") returned 0
	[0040.675] lstrlenA (lpString="*.m2v") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.3gp") returned 0
	[0040.675] lstrlenA (lpString="*.3gp") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mpeg") returned 0
	[0040.675] lstrlenA (lpString="*.mpeg") returned 6
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mpg") returned 0
	[0040.675] lstrlenA (lpString="*.mpg") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.flv") returned 0
	[0040.675] lstrlenA (lpString="*.flv") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.avi") returned 0
	[0040.675] lstrlenA (lpString="*.avi") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mp4") returned 0
	[0040.675] lstrlenA (lpString="*.mp4") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.wmv") returned 0
	[0040.675] lstrlenA (lpString="*.wmv") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.divx") returned 0
	[0040.675] lstrlenA (lpString="*.divx") returned 6
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mkv") returned 0
	[0040.675] lstrlenA (lpString="*.mkv") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mp3") returned 0
	[0040.675] lstrlenA (lpString="*.mp3") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.wav") returned 0
	[0040.675] lstrlenA (lpString="*.wav") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.flac") returned 0
	[0040.675] lstrlenA (lpString="*.flac") returned 6
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ape") returned 0
	[0040.675] lstrlenA (lpString="*.ape") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.wma") returned 0
	[0040.675] lstrlenA (lpString="*.wma") returned 5
	[0040.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ac3") returned 0
	[0040.675] lstrlenA (lpString="*.ac3") returned 5
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.exe") returned 0
	[0040.676] lstrlenA (lpString="*.exe") returned 5
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.apk") returned 0
	[0040.676] lstrlenA (lpString="*.apk") returned 5
	[0040.676] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.676] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.676] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CANYON.INF") returned 1
	[0040.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CANYON.INF") returned 1
	[0040.676] lstrcmpiA (lpString1="", lpString2="CANYON.INF") returned -1
	[0040.676] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned="CANYON.ELM"
	[0040.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\"
	[0040.676] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned=""
	[0040.676] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt"
	[0040.676] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0x20
	[0040.676] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="CANYON.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF"
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.zip") returned 0
	[0040.676] lstrlenA (lpString="*.zip") returned 5
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.rar") returned 0
	[0040.676] lstrlenA (lpString="*.rar") returned 5
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.7z") returned 0
	[0040.676] lstrlenA (lpString="*.7z") returned 4
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.tar") returned 0
	[0040.676] lstrlenA (lpString="*.tar") returned 5
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.gzip") returned 0
	[0040.676] lstrlenA (lpString="*.gzip") returned 6
	[0040.676] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.jpg") returned 0
	[0040.676] lstrlenA (lpString="*.jpg") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.jpeg") returned 0
	[0040.677] lstrlenA (lpString="*.jpeg") returned 6
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.psd") returned 0
	[0040.677] lstrlenA (lpString="*.psd") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.cdr") returned 0
	[0040.677] lstrlenA (lpString="*.cdr") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.dwg") returned 0
	[0040.677] lstrlenA (lpString="*.dwg") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.max") returned 0
	[0040.677] lstrlenA (lpString="*.max") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.bmp") returned 0
	[0040.677] lstrlenA (lpString="*.bmp") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.gif") returned 0
	[0040.677] lstrlenA (lpString="*.gif") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.png") returned 0
	[0040.677] lstrlenA (lpString="*.png") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.doc") returned 0
	[0040.677] lstrlenA (lpString="*.doc") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.docx") returned 0
	[0040.677] lstrlenA (lpString="*.docx") returned 6
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.xls") returned 0
	[0040.677] lstrlenA (lpString="*.xls") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.xlsx") returned 0
	[0040.677] lstrlenA (lpString="*.xlsx") returned 6
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.ppt") returned 0
	[0040.677] lstrlenA (lpString="*.ppt") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.pptx") returned 0
	[0040.677] lstrlenA (lpString="*.pptx") returned 6
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.txt") returned 0
	[0040.677] lstrlenA (lpString="*.txt") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.pdf") returned 0
	[0040.677] lstrlenA (lpString="*.pdf") returned 5
	[0040.677] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.djvu") returned 0
	[0040.678] lstrlenA (lpString="*.djvu") returned 6
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.htm") returned 0
	[0040.678] lstrlenA (lpString="*.htm") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.html") returned 0
	[0040.678] lstrlenA (lpString="*.html") returned 6
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mdb") returned 0
	[0040.678] lstrlenA (lpString="*.mdb") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.cer") returned 0
	[0040.678] lstrlenA (lpString="*.cer") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.p12") returned 0
	[0040.678] lstrlenA (lpString="*.p12") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.pfx") returned 0
	[0040.678] lstrlenA (lpString="*.pfx") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.kwm") returned 0
	[0040.678] lstrlenA (lpString="*.kwm") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.pwm") returned 0
	[0040.678] lstrlenA (lpString="*.pwm") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.1cd") returned 0
	[0040.678] lstrlenA (lpString="*.1cd") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.md") returned 0
	[0040.678] lstrlenA (lpString="*.md") returned 4
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mdf") returned 0
	[0040.678] lstrlenA (lpString="*.mdf") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.dbf") returned 0
	[0040.678] lstrlenA (lpString="*.dbf") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.odt") returned 0
	[0040.678] lstrlenA (lpString="*.odt") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.vob") returned 0
	[0040.678] lstrlenA (lpString="*.vob") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.ifo") returned 0
	[0040.678] lstrlenA (lpString="*.ifo") returned 5
	[0040.678] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.lnk") returned 0
	[0040.679] lstrlenA (lpString="*.lnk") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.torrent") returned 0
	[0040.679] lstrlenA (lpString="*.torrent") returned 9
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mov") returned 0
	[0040.679] lstrlenA (lpString="*.mov") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.m2v") returned 0
	[0040.679] lstrlenA (lpString="*.m2v") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.3gp") returned 0
	[0040.679] lstrlenA (lpString="*.3gp") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mpeg") returned 0
	[0040.679] lstrlenA (lpString="*.mpeg") returned 6
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mpg") returned 0
	[0040.679] lstrlenA (lpString="*.mpg") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.flv") returned 0
	[0040.679] lstrlenA (lpString="*.flv") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.avi") returned 0
	[0040.679] lstrlenA (lpString="*.avi") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mp4") returned 0
	[0040.679] lstrlenA (lpString="*.mp4") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.wmv") returned 0
	[0040.679] lstrlenA (lpString="*.wmv") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.divx") returned 0
	[0040.679] lstrlenA (lpString="*.divx") returned 6
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mkv") returned 0
	[0040.679] lstrlenA (lpString="*.mkv") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mp3") returned 0
	[0040.679] lstrlenA (lpString="*.mp3") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.wav") returned 0
	[0040.679] lstrlenA (lpString="*.wav") returned 5
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.flac") returned 0
	[0040.679] lstrlenA (lpString="*.flac") returned 6
	[0040.679] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.ape") returned 0
	[0040.680] lstrlenA (lpString="*.ape") returned 5
	[0040.680] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.wma") returned 0
	[0040.680] lstrlenA (lpString="*.wma") returned 5
	[0040.680] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.ac3") returned 0
	[0040.680] lstrlenA (lpString="*.ac3") returned 5
	[0040.680] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.exe") returned 0
	[0040.680] lstrlenA (lpString="*.exe") returned 5
	[0040.680] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.apk") returned 0
	[0040.680] lstrlenA (lpString="*.apk") returned 5
	[0040.680] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.680] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.680] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.680] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.680] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned="CANYON.INF"
	[0040.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\"
	[0040.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned=""
	[0040.680] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt"
	[0040.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0x20
	[0040.680] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF"
	[0040.680] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.680] lstrlenA (lpString="*.zip") returned 5
	[0040.680] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.680] lstrlenA (lpString="*.rar") returned 5
	[0040.680] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.680] lstrlenA (lpString="*.7z") returned 4
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.681] lstrlenA (lpString="*.tar") returned 5
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.681] lstrlenA (lpString="*.gzip") returned 6
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.681] lstrlenA (lpString="*.jpg") returned 5
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.681] lstrlenA (lpString="*.jpeg") returned 6
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.681] lstrlenA (lpString="*.psd") returned 5
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.681] lstrlenA (lpString="*.cdr") returned 5
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.681] lstrlenA (lpString="*.dwg") returned 5
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.681] lstrlenA (lpString="*.max") returned 5
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.681] lstrlenA (lpString="*.bmp") returned 5
	[0040.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.681] lstrlenA (lpString="*.gif") returned 5
	[0040.681] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF"
	[0040.681] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF"
	[0040.681] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF."
	[0040.681] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.Boom"
	[0040.681] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.682] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b1
	[0040.682] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.682] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.682] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x38e, lpOverlapped=0x0) returned 1
	[0040.686] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.686] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.686] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x38e, lpOverlapped=0x0) returned 1
	[0040.686] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.687] CloseHandle (hObject=0x90) returned 1
	[0040.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.boom")) returned 1
	[0040.689] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.690] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.690] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.690] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.690] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\"
	[0040.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned=""
	[0040.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt"
	[0040.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0x20
	[0040.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG"
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.690] lstrlenA (lpString="*.zip") returned 5
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.690] lstrlenA (lpString="*.rar") returned 5
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.690] lstrlenA (lpString="*.7z") returned 4
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.690] lstrlenA (lpString="*.tar") returned 5
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.690] lstrlenA (lpString="*.gzip") returned 6
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.690] lstrlenA (lpString="*.jpg") returned 5
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.690] lstrlenA (lpString="*.jpeg") returned 6
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.690] lstrlenA (lpString="*.psd") returned 5
	[0040.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.690] lstrlenA (lpString="*.cdr") returned 5
	[0040.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.691] lstrlenA (lpString="*.dwg") returned 5
	[0040.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.691] lstrlenA (lpString="*.max") returned 5
	[0040.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.691] lstrlenA (lpString="*.bmp") returned 5
	[0040.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.691] lstrlenA (lpString="*.gif") returned 5
	[0040.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.691] lstrlenA (lpString="*.png") returned 5
	[0040.691] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG"
	[0040.691] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG"
	[0040.691] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG."
	[0040.691] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.Boom"
	[0040.691] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.691] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f5f
	[0040.691] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.691] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.691] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7f3c, lpOverlapped=0x0) returned 1
	[0040.699] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.699] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.699] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7f3c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7f3c, lpOverlapped=0x0) returned 1
	[0040.699] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.700] CloseHandle (hObject=0x90) returned 1
	[0040.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.boom")) returned 1
	[0040.701] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.701] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.701] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.701] lstrcmpA (lpString1=".", lpString2="CAPSULES") returned -1
	[0040.701] lstrcmpA (lpString1="..", lpString2="CAPSULES") returned -1
	[0040.701] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.701] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CAPSULES" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES"
	[0040.701] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES") returned 64
	[0040.701] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.702] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.702] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.702] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.702] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.702] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.702] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.702] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CAPSULES.ELM") returned 1
	[0040.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAPSULES.ELM") returned 1
	[0040.702] lstrcmpiA (lpString1="", lpString2="CAPSULES.ELM") returned -1
	[0040.702] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*") returned="*.*"
	[0040.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\"
	[0040.702] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned=""
	[0040.702] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt"
	[0040.702] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0xffffffff
	[0040.702] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.707] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.707] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.708] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.708] CloseHandle (hObject=0x90) returned 1
	[0040.708] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="CAPSULES.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM"
	[0040.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.zip") returned 0
	[0040.708] lstrlenA (lpString="*.zip") returned 5
	[0040.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.rar") returned 0
	[0040.708] lstrlenA (lpString="*.rar") returned 5
	[0040.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.7z") returned 0
	[0040.708] lstrlenA (lpString="*.7z") returned 4
	[0040.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.tar") returned 0
	[0040.708] lstrlenA (lpString="*.tar") returned 5
	[0040.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.gzip") returned 0
	[0040.708] lstrlenA (lpString="*.gzip") returned 6
	[0040.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.jpg") returned 0
	[0040.708] lstrlenA (lpString="*.jpg") returned 5
	[0040.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.jpeg") returned 0
	[0040.709] lstrlenA (lpString="*.jpeg") returned 6
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.psd") returned 0
	[0040.709] lstrlenA (lpString="*.psd") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.cdr") returned 0
	[0040.709] lstrlenA (lpString="*.cdr") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.dwg") returned 0
	[0040.709] lstrlenA (lpString="*.dwg") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.max") returned 0
	[0040.709] lstrlenA (lpString="*.max") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.bmp") returned 0
	[0040.709] lstrlenA (lpString="*.bmp") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.gif") returned 0
	[0040.709] lstrlenA (lpString="*.gif") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.png") returned 0
	[0040.709] lstrlenA (lpString="*.png") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.doc") returned 0
	[0040.709] lstrlenA (lpString="*.doc") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.docx") returned 0
	[0040.709] lstrlenA (lpString="*.docx") returned 6
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.xls") returned 0
	[0040.709] lstrlenA (lpString="*.xls") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.xlsx") returned 0
	[0040.709] lstrlenA (lpString="*.xlsx") returned 6
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ppt") returned 0
	[0040.709] lstrlenA (lpString="*.ppt") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.pptx") returned 0
	[0040.709] lstrlenA (lpString="*.pptx") returned 6
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.txt") returned 0
	[0040.709] lstrlenA (lpString="*.txt") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.pdf") returned 0
	[0040.709] lstrlenA (lpString="*.pdf") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.djvu") returned 0
	[0040.709] lstrlenA (lpString="*.djvu") returned 6
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.htm") returned 0
	[0040.709] lstrlenA (lpString="*.htm") returned 5
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.html") returned 0
	[0040.709] lstrlenA (lpString="*.html") returned 6
	[0040.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mdb") returned 0
	[0040.709] lstrlenA (lpString="*.mdb") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.cer") returned 0
	[0040.710] lstrlenA (lpString="*.cer") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.p12") returned 0
	[0040.710] lstrlenA (lpString="*.p12") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.pfx") returned 0
	[0040.710] lstrlenA (lpString="*.pfx") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.kwm") returned 0
	[0040.710] lstrlenA (lpString="*.kwm") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.pwm") returned 0
	[0040.710] lstrlenA (lpString="*.pwm") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.1cd") returned 0
	[0040.710] lstrlenA (lpString="*.1cd") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.md") returned 0
	[0040.710] lstrlenA (lpString="*.md") returned 4
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mdf") returned 0
	[0040.710] lstrlenA (lpString="*.mdf") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.dbf") returned 0
	[0040.710] lstrlenA (lpString="*.dbf") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.odt") returned 0
	[0040.710] lstrlenA (lpString="*.odt") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.vob") returned 0
	[0040.710] lstrlenA (lpString="*.vob") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ifo") returned 0
	[0040.710] lstrlenA (lpString="*.ifo") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.lnk") returned 0
	[0040.710] lstrlenA (lpString="*.lnk") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.torrent") returned 0
	[0040.710] lstrlenA (lpString="*.torrent") returned 9
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mov") returned 0
	[0040.710] lstrlenA (lpString="*.mov") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.m2v") returned 0
	[0040.710] lstrlenA (lpString="*.m2v") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.3gp") returned 0
	[0040.710] lstrlenA (lpString="*.3gp") returned 5
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mpeg") returned 0
	[0040.710] lstrlenA (lpString="*.mpeg") returned 6
	[0040.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mpg") returned 0
	[0040.710] lstrlenA (lpString="*.mpg") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.flv") returned 0
	[0040.711] lstrlenA (lpString="*.flv") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.avi") returned 0
	[0040.711] lstrlenA (lpString="*.avi") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mp4") returned 0
	[0040.711] lstrlenA (lpString="*.mp4") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.wmv") returned 0
	[0040.711] lstrlenA (lpString="*.wmv") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.divx") returned 0
	[0040.711] lstrlenA (lpString="*.divx") returned 6
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mkv") returned 0
	[0040.711] lstrlenA (lpString="*.mkv") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mp3") returned 0
	[0040.711] lstrlenA (lpString="*.mp3") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.wav") returned 0
	[0040.711] lstrlenA (lpString="*.wav") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.flac") returned 0
	[0040.711] lstrlenA (lpString="*.flac") returned 6
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ape") returned 0
	[0040.711] lstrlenA (lpString="*.ape") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.wma") returned 0
	[0040.711] lstrlenA (lpString="*.wma") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ac3") returned 0
	[0040.711] lstrlenA (lpString="*.ac3") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.exe") returned 0
	[0040.711] lstrlenA (lpString="*.exe") returned 5
	[0040.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.apk") returned 0
	[0040.711] lstrlenA (lpString="*.apk") returned 5
	[0040.711] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.711] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.711] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CAPSULES.INF") returned 1
	[0040.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAPSULES.INF") returned 1
	[0040.711] lstrcmpiA (lpString1="", lpString2="CAPSULES.INF") returned -1
	[0040.711] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned="CAPSULES.ELM"
	[0040.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\"
	[0040.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned=""
	[0040.711] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt"
	[0040.711] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0x20
	[0040.712] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="CAPSULES.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF"
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.zip") returned 0
	[0040.712] lstrlenA (lpString="*.zip") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.rar") returned 0
	[0040.712] lstrlenA (lpString="*.rar") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.7z") returned 0
	[0040.712] lstrlenA (lpString="*.7z") returned 4
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.tar") returned 0
	[0040.712] lstrlenA (lpString="*.tar") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.gzip") returned 0
	[0040.712] lstrlenA (lpString="*.gzip") returned 6
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.jpg") returned 0
	[0040.712] lstrlenA (lpString="*.jpg") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.jpeg") returned 0
	[0040.712] lstrlenA (lpString="*.jpeg") returned 6
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.psd") returned 0
	[0040.712] lstrlenA (lpString="*.psd") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.cdr") returned 0
	[0040.712] lstrlenA (lpString="*.cdr") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.dwg") returned 0
	[0040.712] lstrlenA (lpString="*.dwg") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.max") returned 0
	[0040.712] lstrlenA (lpString="*.max") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.bmp") returned 0
	[0040.712] lstrlenA (lpString="*.bmp") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.gif") returned 0
	[0040.712] lstrlenA (lpString="*.gif") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.png") returned 0
	[0040.712] lstrlenA (lpString="*.png") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.doc") returned 0
	[0040.712] lstrlenA (lpString="*.doc") returned 5
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.docx") returned 0
	[0040.712] lstrlenA (lpString="*.docx") returned 6
	[0040.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.xls") returned 0
	[0040.712] lstrlenA (lpString="*.xls") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.xlsx") returned 0
	[0040.713] lstrlenA (lpString="*.xlsx") returned 6
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.ppt") returned 0
	[0040.713] lstrlenA (lpString="*.ppt") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.pptx") returned 0
	[0040.713] lstrlenA (lpString="*.pptx") returned 6
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.txt") returned 0
	[0040.713] lstrlenA (lpString="*.txt") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.pdf") returned 0
	[0040.713] lstrlenA (lpString="*.pdf") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.djvu") returned 0
	[0040.713] lstrlenA (lpString="*.djvu") returned 6
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.htm") returned 0
	[0040.713] lstrlenA (lpString="*.htm") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.html") returned 0
	[0040.713] lstrlenA (lpString="*.html") returned 6
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mdb") returned 0
	[0040.713] lstrlenA (lpString="*.mdb") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.cer") returned 0
	[0040.713] lstrlenA (lpString="*.cer") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.p12") returned 0
	[0040.713] lstrlenA (lpString="*.p12") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.pfx") returned 0
	[0040.713] lstrlenA (lpString="*.pfx") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.kwm") returned 0
	[0040.713] lstrlenA (lpString="*.kwm") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.pwm") returned 0
	[0040.713] lstrlenA (lpString="*.pwm") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.1cd") returned 0
	[0040.713] lstrlenA (lpString="*.1cd") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.md") returned 0
	[0040.713] lstrlenA (lpString="*.md") returned 4
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mdf") returned 0
	[0040.713] lstrlenA (lpString="*.mdf") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.dbf") returned 0
	[0040.713] lstrlenA (lpString="*.dbf") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.odt") returned 0
	[0040.713] lstrlenA (lpString="*.odt") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.vob") returned 0
	[0040.713] lstrlenA (lpString="*.vob") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.ifo") returned 0
	[0040.713] lstrlenA (lpString="*.ifo") returned 5
	[0040.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.lnk") returned 0
	[0040.713] lstrlenA (lpString="*.lnk") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.torrent") returned 0
	[0040.714] lstrlenA (lpString="*.torrent") returned 9
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mov") returned 0
	[0040.714] lstrlenA (lpString="*.mov") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.m2v") returned 0
	[0040.714] lstrlenA (lpString="*.m2v") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.3gp") returned 0
	[0040.714] lstrlenA (lpString="*.3gp") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mpeg") returned 0
	[0040.714] lstrlenA (lpString="*.mpeg") returned 6
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mpg") returned 0
	[0040.714] lstrlenA (lpString="*.mpg") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.flv") returned 0
	[0040.714] lstrlenA (lpString="*.flv") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.avi") returned 0
	[0040.714] lstrlenA (lpString="*.avi") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mp4") returned 0
	[0040.714] lstrlenA (lpString="*.mp4") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.wmv") returned 0
	[0040.714] lstrlenA (lpString="*.wmv") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.divx") returned 0
	[0040.714] lstrlenA (lpString="*.divx") returned 6
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mkv") returned 0
	[0040.714] lstrlenA (lpString="*.mkv") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mp3") returned 0
	[0040.714] lstrlenA (lpString="*.mp3") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.wav") returned 0
	[0040.714] lstrlenA (lpString="*.wav") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.flac") returned 0
	[0040.714] lstrlenA (lpString="*.flac") returned 6
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.ape") returned 0
	[0040.714] lstrlenA (lpString="*.ape") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.wma") returned 0
	[0040.714] lstrlenA (lpString="*.wma") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.ac3") returned 0
	[0040.714] lstrlenA (lpString="*.ac3") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.exe") returned 0
	[0040.714] lstrlenA (lpString="*.exe") returned 5
	[0040.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.apk") returned 0
	[0040.714] lstrlenA (lpString="*.apk") returned 5
	[0040.714] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.714] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.714] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.715] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.715] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned="CAPSULES.INF"
	[0040.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\"
	[0040.715] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned=""
	[0040.715] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt"
	[0040.715] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0x20
	[0040.715] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF"
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.715] lstrlenA (lpString="*.zip") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.715] lstrlenA (lpString="*.rar") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.715] lstrlenA (lpString="*.7z") returned 4
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.715] lstrlenA (lpString="*.tar") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.715] lstrlenA (lpString="*.gzip") returned 6
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.715] lstrlenA (lpString="*.jpg") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.715] lstrlenA (lpString="*.jpeg") returned 6
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.715] lstrlenA (lpString="*.psd") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.715] lstrlenA (lpString="*.cdr") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.715] lstrlenA (lpString="*.dwg") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.715] lstrlenA (lpString="*.max") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.715] lstrlenA (lpString="*.bmp") returned 5
	[0040.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.715] lstrlenA (lpString="*.gif") returned 5
	[0040.715] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF"
	[0040.715] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF"
	[0040.715] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF."
	[0040.715] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.Boom"
	[0040.716] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.716] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fc
	[0040.716] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.716] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.716] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7d9, lpOverlapped=0x0) returned 1
	[0040.724] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.724] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.724] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7d9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7d9, lpOverlapped=0x0) returned 1
	[0040.724] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.724] CloseHandle (hObject=0x90) returned 1
	[0040.725] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.boom")) returned 1
	[0040.725] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.725] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.725] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.726] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.726] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\"
	[0040.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned=""
	[0040.726] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt"
	[0040.726] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0x20
	[0040.726] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG"
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.726] lstrlenA (lpString="*.zip") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.726] lstrlenA (lpString="*.rar") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.726] lstrlenA (lpString="*.7z") returned 4
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.726] lstrlenA (lpString="*.tar") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.726] lstrlenA (lpString="*.gzip") returned 6
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.726] lstrlenA (lpString="*.jpg") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.726] lstrlenA (lpString="*.jpeg") returned 6
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.726] lstrlenA (lpString="*.psd") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.726] lstrlenA (lpString="*.cdr") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.726] lstrlenA (lpString="*.dwg") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.726] lstrlenA (lpString="*.max") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.726] lstrlenA (lpString="*.bmp") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.726] lstrlenA (lpString="*.gif") returned 5
	[0040.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.727] lstrlenA (lpString="*.png") returned 5
	[0040.727] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG"
	[0040.727] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG"
	[0040.727] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG."
	[0040.727] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.Boom"
	[0040.727] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.727] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74e5
	[0040.727] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.727] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.727] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x74c2, lpOverlapped=0x0) returned 1
	[0040.729] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.729] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.729] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x74c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x74c2, lpOverlapped=0x0) returned 1
	[0040.729] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.729] CloseHandle (hObject=0x90) returned 1
	[0040.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.boom")) returned 1
	[0040.731] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.731] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.731] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.731] lstrcmpA (lpString1=".", lpString2="CASCADE") returned -1
	[0040.731] lstrcmpA (lpString1="..", lpString2="CASCADE") returned -1
	[0040.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.731] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CASCADE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE"
	[0040.731] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE") returned 63
	[0040.731] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.732] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.732] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.732] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.732] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.733] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.733] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CASCADE.ELM") returned 1
	[0040.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASCADE.ELM") returned 1
	[0040.733] lstrcmpiA (lpString1="", lpString2="CASCADE.ELM") returned -1
	[0040.733] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*") returned="*.*"
	[0040.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\"
	[0040.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned=""
	[0040.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt"
	[0040.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0xffffffff
	[0040.733] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.733] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.733] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.734] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.734] CloseHandle (hObject=0x90) returned 1
	[0040.735] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="CASCADE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM"
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.zip") returned 0
	[0040.735] lstrlenA (lpString="*.zip") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.rar") returned 0
	[0040.735] lstrlenA (lpString="*.rar") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.7z") returned 0
	[0040.735] lstrlenA (lpString="*.7z") returned 4
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.tar") returned 0
	[0040.735] lstrlenA (lpString="*.tar") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.gzip") returned 0
	[0040.735] lstrlenA (lpString="*.gzip") returned 6
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.jpg") returned 0
	[0040.735] lstrlenA (lpString="*.jpg") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.jpeg") returned 0
	[0040.735] lstrlenA (lpString="*.jpeg") returned 6
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.psd") returned 0
	[0040.735] lstrlenA (lpString="*.psd") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.cdr") returned 0
	[0040.735] lstrlenA (lpString="*.cdr") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.dwg") returned 0
	[0040.735] lstrlenA (lpString="*.dwg") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.max") returned 0
	[0040.735] lstrlenA (lpString="*.max") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.bmp") returned 0
	[0040.735] lstrlenA (lpString="*.bmp") returned 5
	[0040.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.gif") returned 0
	[0040.736] lstrlenA (lpString="*.gif") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.png") returned 0
	[0040.736] lstrlenA (lpString="*.png") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.doc") returned 0
	[0040.736] lstrlenA (lpString="*.doc") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.docx") returned 0
	[0040.736] lstrlenA (lpString="*.docx") returned 6
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.xls") returned 0
	[0040.736] lstrlenA (lpString="*.xls") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.xlsx") returned 0
	[0040.736] lstrlenA (lpString="*.xlsx") returned 6
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ppt") returned 0
	[0040.736] lstrlenA (lpString="*.ppt") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.pptx") returned 0
	[0040.736] lstrlenA (lpString="*.pptx") returned 6
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.txt") returned 0
	[0040.736] lstrlenA (lpString="*.txt") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.pdf") returned 0
	[0040.736] lstrlenA (lpString="*.pdf") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.djvu") returned 0
	[0040.736] lstrlenA (lpString="*.djvu") returned 6
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.htm") returned 0
	[0040.736] lstrlenA (lpString="*.htm") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.html") returned 0
	[0040.736] lstrlenA (lpString="*.html") returned 6
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mdb") returned 0
	[0040.736] lstrlenA (lpString="*.mdb") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.cer") returned 0
	[0040.736] lstrlenA (lpString="*.cer") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.p12") returned 0
	[0040.736] lstrlenA (lpString="*.p12") returned 5
	[0040.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.pfx") returned 0
	[0040.737] lstrlenA (lpString="*.pfx") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.kwm") returned 0
	[0040.737] lstrlenA (lpString="*.kwm") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.pwm") returned 0
	[0040.737] lstrlenA (lpString="*.pwm") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.1cd") returned 0
	[0040.737] lstrlenA (lpString="*.1cd") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.md") returned 0
	[0040.737] lstrlenA (lpString="*.md") returned 4
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mdf") returned 0
	[0040.737] lstrlenA (lpString="*.mdf") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.dbf") returned 0
	[0040.737] lstrlenA (lpString="*.dbf") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.odt") returned 0
	[0040.737] lstrlenA (lpString="*.odt") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.vob") returned 0
	[0040.737] lstrlenA (lpString="*.vob") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ifo") returned 0
	[0040.737] lstrlenA (lpString="*.ifo") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.lnk") returned 0
	[0040.737] lstrlenA (lpString="*.lnk") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.torrent") returned 0
	[0040.737] lstrlenA (lpString="*.torrent") returned 9
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mov") returned 0
	[0040.737] lstrlenA (lpString="*.mov") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.m2v") returned 0
	[0040.737] lstrlenA (lpString="*.m2v") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.3gp") returned 0
	[0040.737] lstrlenA (lpString="*.3gp") returned 5
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mpeg") returned 0
	[0040.737] lstrlenA (lpString="*.mpeg") returned 6
	[0040.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mpg") returned 0
	[0040.738] lstrlenA (lpString="*.mpg") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.flv") returned 0
	[0040.738] lstrlenA (lpString="*.flv") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.avi") returned 0
	[0040.738] lstrlenA (lpString="*.avi") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mp4") returned 0
	[0040.738] lstrlenA (lpString="*.mp4") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.wmv") returned 0
	[0040.738] lstrlenA (lpString="*.wmv") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.divx") returned 0
	[0040.738] lstrlenA (lpString="*.divx") returned 6
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mkv") returned 0
	[0040.738] lstrlenA (lpString="*.mkv") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mp3") returned 0
	[0040.738] lstrlenA (lpString="*.mp3") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.wav") returned 0
	[0040.738] lstrlenA (lpString="*.wav") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.flac") returned 0
	[0040.738] lstrlenA (lpString="*.flac") returned 6
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ape") returned 0
	[0040.738] lstrlenA (lpString="*.ape") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.wma") returned 0
	[0040.738] lstrlenA (lpString="*.wma") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ac3") returned 0
	[0040.738] lstrlenA (lpString="*.ac3") returned 5
	[0040.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.exe") returned 0
	[0040.738] lstrlenA (lpString="*.exe") returned 5
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.apk") returned 0
	[0040.739] lstrlenA (lpString="*.apk") returned 5
	[0040.739] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.739] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CASCADE.INF") returned 1
	[0040.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASCADE.INF") returned 1
	[0040.739] lstrcmpiA (lpString1="", lpString2="CASCADE.INF") returned -1
	[0040.739] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned="CASCADE.ELM"
	[0040.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\"
	[0040.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned=""
	[0040.739] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt"
	[0040.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0x20
	[0040.739] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="CASCADE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF"
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.zip") returned 0
	[0040.739] lstrlenA (lpString="*.zip") returned 5
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.rar") returned 0
	[0040.739] lstrlenA (lpString="*.rar") returned 5
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.7z") returned 0
	[0040.739] lstrlenA (lpString="*.7z") returned 4
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.tar") returned 0
	[0040.739] lstrlenA (lpString="*.tar") returned 5
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.gzip") returned 0
	[0040.739] lstrlenA (lpString="*.gzip") returned 6
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.jpg") returned 0
	[0040.739] lstrlenA (lpString="*.jpg") returned 5
	[0040.739] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.jpeg") returned 0
	[0040.739] lstrlenA (lpString="*.jpeg") returned 6
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.psd") returned 0
	[0040.740] lstrlenA (lpString="*.psd") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.cdr") returned 0
	[0040.740] lstrlenA (lpString="*.cdr") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.dwg") returned 0
	[0040.740] lstrlenA (lpString="*.dwg") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.max") returned 0
	[0040.740] lstrlenA (lpString="*.max") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.bmp") returned 0
	[0040.740] lstrlenA (lpString="*.bmp") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.gif") returned 0
	[0040.740] lstrlenA (lpString="*.gif") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.png") returned 0
	[0040.740] lstrlenA (lpString="*.png") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.doc") returned 0
	[0040.740] lstrlenA (lpString="*.doc") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.docx") returned 0
	[0040.740] lstrlenA (lpString="*.docx") returned 6
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.xls") returned 0
	[0040.740] lstrlenA (lpString="*.xls") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.xlsx") returned 0
	[0040.740] lstrlenA (lpString="*.xlsx") returned 6
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.ppt") returned 0
	[0040.740] lstrlenA (lpString="*.ppt") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.pptx") returned 0
	[0040.740] lstrlenA (lpString="*.pptx") returned 6
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.txt") returned 0
	[0040.740] lstrlenA (lpString="*.txt") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.pdf") returned 0
	[0040.740] lstrlenA (lpString="*.pdf") returned 5
	[0040.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.djvu") returned 0
	[0040.740] lstrlenA (lpString="*.djvu") returned 6
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.htm") returned 0
	[0040.741] lstrlenA (lpString="*.htm") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.html") returned 0
	[0040.741] lstrlenA (lpString="*.html") returned 6
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mdb") returned 0
	[0040.741] lstrlenA (lpString="*.mdb") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.cer") returned 0
	[0040.741] lstrlenA (lpString="*.cer") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.p12") returned 0
	[0040.741] lstrlenA (lpString="*.p12") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.pfx") returned 0
	[0040.741] lstrlenA (lpString="*.pfx") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.kwm") returned 0
	[0040.741] lstrlenA (lpString="*.kwm") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.pwm") returned 0
	[0040.741] lstrlenA (lpString="*.pwm") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.1cd") returned 0
	[0040.741] lstrlenA (lpString="*.1cd") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.md") returned 0
	[0040.741] lstrlenA (lpString="*.md") returned 4
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mdf") returned 0
	[0040.741] lstrlenA (lpString="*.mdf") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.dbf") returned 0
	[0040.741] lstrlenA (lpString="*.dbf") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.odt") returned 0
	[0040.741] lstrlenA (lpString="*.odt") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.vob") returned 0
	[0040.741] lstrlenA (lpString="*.vob") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.ifo") returned 0
	[0040.741] lstrlenA (lpString="*.ifo") returned 5
	[0040.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.lnk") returned 0
	[0040.741] lstrlenA (lpString="*.lnk") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.torrent") returned 0
	[0040.742] lstrlenA (lpString="*.torrent") returned 9
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mov") returned 0
	[0040.742] lstrlenA (lpString="*.mov") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.m2v") returned 0
	[0040.742] lstrlenA (lpString="*.m2v") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.3gp") returned 0
	[0040.742] lstrlenA (lpString="*.3gp") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mpeg") returned 0
	[0040.742] lstrlenA (lpString="*.mpeg") returned 6
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mpg") returned 0
	[0040.742] lstrlenA (lpString="*.mpg") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.flv") returned 0
	[0040.742] lstrlenA (lpString="*.flv") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.avi") returned 0
	[0040.742] lstrlenA (lpString="*.avi") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mp4") returned 0
	[0040.742] lstrlenA (lpString="*.mp4") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.wmv") returned 0
	[0040.742] lstrlenA (lpString="*.wmv") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.divx") returned 0
	[0040.742] lstrlenA (lpString="*.divx") returned 6
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mkv") returned 0
	[0040.742] lstrlenA (lpString="*.mkv") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mp3") returned 0
	[0040.742] lstrlenA (lpString="*.mp3") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.wav") returned 0
	[0040.742] lstrlenA (lpString="*.wav") returned 5
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.flac") returned 0
	[0040.742] lstrlenA (lpString="*.flac") returned 6
	[0040.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.ape") returned 0
	[0040.742] lstrlenA (lpString="*.ape") returned 5
	[0040.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.wma") returned 0
	[0040.743] lstrlenA (lpString="*.wma") returned 5
	[0040.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.ac3") returned 0
	[0040.743] lstrlenA (lpString="*.ac3") returned 5
	[0040.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.exe") returned 0
	[0040.743] lstrlenA (lpString="*.exe") returned 5
	[0040.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.apk") returned 0
	[0040.743] lstrlenA (lpString="*.apk") returned 5
	[0040.743] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.743] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.743] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.743] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned="CASCADE.INF"
	[0040.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\"
	[0040.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned=""
	[0040.743] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt"
	[0040.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0x20
	[0040.743] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF"
	[0040.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.743] lstrlenA (lpString="*.zip") returned 5
	[0040.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.744] lstrlenA (lpString="*.rar") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.744] lstrlenA (lpString="*.7z") returned 4
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.744] lstrlenA (lpString="*.tar") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.744] lstrlenA (lpString="*.gzip") returned 6
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.744] lstrlenA (lpString="*.jpg") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.744] lstrlenA (lpString="*.jpeg") returned 6
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.744] lstrlenA (lpString="*.psd") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.744] lstrlenA (lpString="*.cdr") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.744] lstrlenA (lpString="*.dwg") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.744] lstrlenA (lpString="*.max") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.744] lstrlenA (lpString="*.bmp") returned 5
	[0040.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.744] lstrlenA (lpString="*.gif") returned 5
	[0040.744] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF"
	[0040.744] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF"
	[0040.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF."
	[0040.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.Boom"
	[0040.744] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.745] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x553
	[0040.745] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.745] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.745] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x530, lpOverlapped=0x0) returned 1
	[0040.753] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.753] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.753] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x530, lpOverlapped=0x0) returned 1
	[0040.753] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.753] CloseHandle (hObject=0x90) returned 1
	[0040.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.boom")) returned 1
	[0040.756] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.756] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.756] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.756] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.756] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\"
	[0040.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned=""
	[0040.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt"
	[0040.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0x20
	[0040.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG"
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.757] lstrlenA (lpString="*.zip") returned 5
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.757] lstrlenA (lpString="*.rar") returned 5
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.757] lstrlenA (lpString="*.7z") returned 4
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.757] lstrlenA (lpString="*.tar") returned 5
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.757] lstrlenA (lpString="*.gzip") returned 6
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.757] lstrlenA (lpString="*.jpg") returned 5
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.757] lstrlenA (lpString="*.jpeg") returned 6
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.757] lstrlenA (lpString="*.psd") returned 5
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.757] lstrlenA (lpString="*.cdr") returned 5
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.757] lstrlenA (lpString="*.dwg") returned 5
	[0040.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.757] lstrlenA (lpString="*.max") returned 5
	[0040.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.758] lstrlenA (lpString="*.bmp") returned 5
	[0040.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.758] lstrlenA (lpString="*.gif") returned 5
	[0040.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.758] lstrlenA (lpString="*.png") returned 5
	[0040.758] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG"
	[0040.758] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG"
	[0040.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG."
	[0040.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.Boom"
	[0040.758] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.758] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f93
	[0040.758] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.758] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.758] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4f70, lpOverlapped=0x0) returned 1
	[0040.760] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.760] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.760] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4f70, lpOverlapped=0x0) returned 1
	[0040.761] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.761] CloseHandle (hObject=0x90) returned 1
	[0040.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.boom")) returned 1
	[0040.763] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.763] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.763] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.763] lstrcmpA (lpString1=".", lpString2="COMPASS") returned -1
	[0040.763] lstrcmpA (lpString1="..", lpString2="COMPASS") returned -1
	[0040.763] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.763] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="COMPASS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS"
	[0040.763] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS") returned 63
	[0040.763] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.764] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.764] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.764] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.764] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.764] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.764] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.764] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COMPASS.ELM") returned 1
	[0040.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPASS.ELM") returned 1
	[0040.764] lstrcmpiA (lpString1="", lpString2="COMPASS.ELM") returned -1
	[0040.764] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*") returned="*.*"
	[0040.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\"
	[0040.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned=""
	[0040.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt"
	[0040.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0xffffffff
	[0040.765] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.765] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.765] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.766] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.766] CloseHandle (hObject=0x90) returned 1
	[0040.766] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="COMPASS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM"
	[0040.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.zip") returned 0
	[0040.767] lstrlenA (lpString="*.zip") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.rar") returned 0
	[0040.767] lstrlenA (lpString="*.rar") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.7z") returned 0
	[0040.767] lstrlenA (lpString="*.7z") returned 4
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.tar") returned 0
	[0040.767] lstrlenA (lpString="*.tar") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.gzip") returned 0
	[0040.767] lstrlenA (lpString="*.gzip") returned 6
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.jpg") returned 0
	[0040.767] lstrlenA (lpString="*.jpg") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.jpeg") returned 0
	[0040.767] lstrlenA (lpString="*.jpeg") returned 6
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.psd") returned 0
	[0040.767] lstrlenA (lpString="*.psd") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.cdr") returned 0
	[0040.767] lstrlenA (lpString="*.cdr") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.dwg") returned 0
	[0040.767] lstrlenA (lpString="*.dwg") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.max") returned 0
	[0040.767] lstrlenA (lpString="*.max") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.bmp") returned 0
	[0040.767] lstrlenA (lpString="*.bmp") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.gif") returned 0
	[0040.767] lstrlenA (lpString="*.gif") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.png") returned 0
	[0040.767] lstrlenA (lpString="*.png") returned 5
	[0040.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.doc") returned 0
	[0040.767] lstrlenA (lpString="*.doc") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.docx") returned 0
	[0040.768] lstrlenA (lpString="*.docx") returned 6
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.xls") returned 0
	[0040.768] lstrlenA (lpString="*.xls") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.xlsx") returned 0
	[0040.768] lstrlenA (lpString="*.xlsx") returned 6
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ppt") returned 0
	[0040.768] lstrlenA (lpString="*.ppt") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.pptx") returned 0
	[0040.768] lstrlenA (lpString="*.pptx") returned 6
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.txt") returned 0
	[0040.768] lstrlenA (lpString="*.txt") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.pdf") returned 0
	[0040.768] lstrlenA (lpString="*.pdf") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.djvu") returned 0
	[0040.768] lstrlenA (lpString="*.djvu") returned 6
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.htm") returned 0
	[0040.768] lstrlenA (lpString="*.htm") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.html") returned 0
	[0040.768] lstrlenA (lpString="*.html") returned 6
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mdb") returned 0
	[0040.768] lstrlenA (lpString="*.mdb") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.cer") returned 0
	[0040.768] lstrlenA (lpString="*.cer") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.p12") returned 0
	[0040.768] lstrlenA (lpString="*.p12") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.pfx") returned 0
	[0040.768] lstrlenA (lpString="*.pfx") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.kwm") returned 0
	[0040.768] lstrlenA (lpString="*.kwm") returned 5
	[0040.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.pwm") returned 0
	[0040.769] lstrlenA (lpString="*.pwm") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.1cd") returned 0
	[0040.769] lstrlenA (lpString="*.1cd") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.md") returned 0
	[0040.769] lstrlenA (lpString="*.md") returned 4
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mdf") returned 0
	[0040.769] lstrlenA (lpString="*.mdf") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.dbf") returned 0
	[0040.769] lstrlenA (lpString="*.dbf") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.odt") returned 0
	[0040.769] lstrlenA (lpString="*.odt") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.vob") returned 0
	[0040.769] lstrlenA (lpString="*.vob") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ifo") returned 0
	[0040.769] lstrlenA (lpString="*.ifo") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.lnk") returned 0
	[0040.769] lstrlenA (lpString="*.lnk") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.torrent") returned 0
	[0040.769] lstrlenA (lpString="*.torrent") returned 9
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mov") returned 0
	[0040.769] lstrlenA (lpString="*.mov") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.m2v") returned 0
	[0040.769] lstrlenA (lpString="*.m2v") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.3gp") returned 0
	[0040.769] lstrlenA (lpString="*.3gp") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mpeg") returned 0
	[0040.769] lstrlenA (lpString="*.mpeg") returned 6
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mpg") returned 0
	[0040.769] lstrlenA (lpString="*.mpg") returned 5
	[0040.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.flv") returned 0
	[0040.769] lstrlenA (lpString="*.flv") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.avi") returned 0
	[0040.770] lstrlenA (lpString="*.avi") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mp4") returned 0
	[0040.770] lstrlenA (lpString="*.mp4") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.wmv") returned 0
	[0040.770] lstrlenA (lpString="*.wmv") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.divx") returned 0
	[0040.770] lstrlenA (lpString="*.divx") returned 6
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mkv") returned 0
	[0040.770] lstrlenA (lpString="*.mkv") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mp3") returned 0
	[0040.770] lstrlenA (lpString="*.mp3") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.wav") returned 0
	[0040.770] lstrlenA (lpString="*.wav") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.flac") returned 0
	[0040.770] lstrlenA (lpString="*.flac") returned 6
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ape") returned 0
	[0040.770] lstrlenA (lpString="*.ape") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.wma") returned 0
	[0040.770] lstrlenA (lpString="*.wma") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ac3") returned 0
	[0040.770] lstrlenA (lpString="*.ac3") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.exe") returned 0
	[0040.770] lstrlenA (lpString="*.exe") returned 5
	[0040.770] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.apk") returned 0
	[0040.770] lstrlenA (lpString="*.apk") returned 5
	[0040.770] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.770] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COMPASS.INF") returned 1
	[0040.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPASS.INF") returned 1
	[0040.770] lstrcmpiA (lpString1="", lpString2="COMPASS.INF") returned -1
	[0040.771] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned="COMPASS.ELM"
	[0040.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\"
	[0040.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned=""
	[0040.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt"
	[0040.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0x20
	[0040.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="COMPASS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF"
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.zip") returned 0
	[0040.771] lstrlenA (lpString="*.zip") returned 5
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.rar") returned 0
	[0040.771] lstrlenA (lpString="*.rar") returned 5
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.7z") returned 0
	[0040.771] lstrlenA (lpString="*.7z") returned 4
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.tar") returned 0
	[0040.771] lstrlenA (lpString="*.tar") returned 5
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.gzip") returned 0
	[0040.771] lstrlenA (lpString="*.gzip") returned 6
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.jpg") returned 0
	[0040.771] lstrlenA (lpString="*.jpg") returned 5
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.jpeg") returned 0
	[0040.771] lstrlenA (lpString="*.jpeg") returned 6
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.psd") returned 0
	[0040.771] lstrlenA (lpString="*.psd") returned 5
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.cdr") returned 0
	[0040.771] lstrlenA (lpString="*.cdr") returned 5
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.dwg") returned 0
	[0040.771] lstrlenA (lpString="*.dwg") returned 5
	[0040.771] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.max") returned 0
	[0040.771] lstrlenA (lpString="*.max") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.bmp") returned 0
	[0040.772] lstrlenA (lpString="*.bmp") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.gif") returned 0
	[0040.772] lstrlenA (lpString="*.gif") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.png") returned 0
	[0040.772] lstrlenA (lpString="*.png") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.doc") returned 0
	[0040.772] lstrlenA (lpString="*.doc") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.docx") returned 0
	[0040.772] lstrlenA (lpString="*.docx") returned 6
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.xls") returned 0
	[0040.772] lstrlenA (lpString="*.xls") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.xlsx") returned 0
	[0040.772] lstrlenA (lpString="*.xlsx") returned 6
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.ppt") returned 0
	[0040.772] lstrlenA (lpString="*.ppt") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.pptx") returned 0
	[0040.772] lstrlenA (lpString="*.pptx") returned 6
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.txt") returned 0
	[0040.772] lstrlenA (lpString="*.txt") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.pdf") returned 0
	[0040.772] lstrlenA (lpString="*.pdf") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.djvu") returned 0
	[0040.772] lstrlenA (lpString="*.djvu") returned 6
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.htm") returned 0
	[0040.772] lstrlenA (lpString="*.htm") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.html") returned 0
	[0040.772] lstrlenA (lpString="*.html") returned 6
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mdb") returned 0
	[0040.772] lstrlenA (lpString="*.mdb") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.cer") returned 0
	[0040.772] lstrlenA (lpString="*.cer") returned 5
	[0040.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.p12") returned 0
	[0040.773] lstrlenA (lpString="*.p12") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.pfx") returned 0
	[0040.773] lstrlenA (lpString="*.pfx") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.kwm") returned 0
	[0040.773] lstrlenA (lpString="*.kwm") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.pwm") returned 0
	[0040.773] lstrlenA (lpString="*.pwm") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.1cd") returned 0
	[0040.773] lstrlenA (lpString="*.1cd") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.md") returned 0
	[0040.773] lstrlenA (lpString="*.md") returned 4
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mdf") returned 0
	[0040.773] lstrlenA (lpString="*.mdf") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.dbf") returned 0
	[0040.773] lstrlenA (lpString="*.dbf") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.odt") returned 0
	[0040.773] lstrlenA (lpString="*.odt") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.vob") returned 0
	[0040.773] lstrlenA (lpString="*.vob") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.ifo") returned 0
	[0040.773] lstrlenA (lpString="*.ifo") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.lnk") returned 0
	[0040.773] lstrlenA (lpString="*.lnk") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.torrent") returned 0
	[0040.773] lstrlenA (lpString="*.torrent") returned 9
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mov") returned 0
	[0040.773] lstrlenA (lpString="*.mov") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.m2v") returned 0
	[0040.773] lstrlenA (lpString="*.m2v") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.3gp") returned 0
	[0040.773] lstrlenA (lpString="*.3gp") returned 5
	[0040.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mpeg") returned 0
	[0040.774] lstrlenA (lpString="*.mpeg") returned 6
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mpg") returned 0
	[0040.774] lstrlenA (lpString="*.mpg") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.flv") returned 0
	[0040.774] lstrlenA (lpString="*.flv") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.avi") returned 0
	[0040.774] lstrlenA (lpString="*.avi") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mp4") returned 0
	[0040.774] lstrlenA (lpString="*.mp4") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.wmv") returned 0
	[0040.774] lstrlenA (lpString="*.wmv") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.divx") returned 0
	[0040.774] lstrlenA (lpString="*.divx") returned 6
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mkv") returned 0
	[0040.774] lstrlenA (lpString="*.mkv") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mp3") returned 0
	[0040.774] lstrlenA (lpString="*.mp3") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.wav") returned 0
	[0040.774] lstrlenA (lpString="*.wav") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.flac") returned 0
	[0040.774] lstrlenA (lpString="*.flac") returned 6
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.ape") returned 0
	[0040.774] lstrlenA (lpString="*.ape") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.wma") returned 0
	[0040.774] lstrlenA (lpString="*.wma") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.ac3") returned 0
	[0040.774] lstrlenA (lpString="*.ac3") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.exe") returned 0
	[0040.774] lstrlenA (lpString="*.exe") returned 5
	[0040.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.apk") returned 0
	[0040.774] lstrlenA (lpString="*.apk") returned 5
	[0040.775] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.775] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.775] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.775] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned="COMPASS.INF"
	[0040.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\"
	[0040.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned=""
	[0040.775] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt"
	[0040.775] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0x20
	[0040.775] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF"
	[0040.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.775] lstrlenA (lpString="*.zip") returned 5
	[0040.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.775] lstrlenA (lpString="*.rar") returned 5
	[0040.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.775] lstrlenA (lpString="*.7z") returned 4
	[0040.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.775] lstrlenA (lpString="*.tar") returned 5
	[0040.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.775] lstrlenA (lpString="*.gzip") returned 6
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.776] lstrlenA (lpString="*.jpg") returned 5
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.776] lstrlenA (lpString="*.jpeg") returned 6
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.776] lstrlenA (lpString="*.psd") returned 5
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.776] lstrlenA (lpString="*.cdr") returned 5
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.776] lstrlenA (lpString="*.dwg") returned 5
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.776] lstrlenA (lpString="*.max") returned 5
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.776] lstrlenA (lpString="*.bmp") returned 5
	[0040.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.776] lstrlenA (lpString="*.gif") returned 5
	[0040.776] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF"
	[0040.776] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF"
	[0040.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF."
	[0040.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.Boom"
	[0040.776] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.777] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50d
	[0040.777] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.777] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.777] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4ea, lpOverlapped=0x0) returned 1
	[0040.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.787] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.787] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4ea, lpOverlapped=0x0) returned 1
	[0040.787] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.787] CloseHandle (hObject=0x90) returned 1
	[0040.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.boom")) returned 1
	[0040.790] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.790] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.790] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.790] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\"
	[0040.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned=""
	[0040.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt"
	[0040.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0x20
	[0040.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG"
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.791] lstrlenA (lpString="*.zip") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.791] lstrlenA (lpString="*.rar") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.791] lstrlenA (lpString="*.7z") returned 4
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.791] lstrlenA (lpString="*.tar") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.791] lstrlenA (lpString="*.gzip") returned 6
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.791] lstrlenA (lpString="*.jpg") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.791] lstrlenA (lpString="*.jpeg") returned 6
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.791] lstrlenA (lpString="*.psd") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.791] lstrlenA (lpString="*.cdr") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.791] lstrlenA (lpString="*.dwg") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.791] lstrlenA (lpString="*.max") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.791] lstrlenA (lpString="*.bmp") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.791] lstrlenA (lpString="*.gif") returned 5
	[0040.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.792] lstrlenA (lpString="*.png") returned 5
	[0040.792] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG"
	[0040.792] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG"
	[0040.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG."
	[0040.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.Boom"
	[0040.792] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.792] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x505f
	[0040.792] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.792] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.792] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x503c, lpOverlapped=0x0) returned 1
	[0040.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.794] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.794] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x503c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x503c, lpOverlapped=0x0) returned 1
	[0040.794] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.794] CloseHandle (hObject=0x90) returned 1
	[0040.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.boom")) returned 1
	[0040.796] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.796] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.796] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.796] lstrcmpA (lpString1=".", lpString2="CONCRETE") returned -1
	[0040.796] lstrcmpA (lpString1="..", lpString2="CONCRETE") returned -1
	[0040.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CONCRETE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE"
	[0040.796] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE") returned 64
	[0040.796] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.796] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.796] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.796] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.797] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.797] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.797] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONCRETE.ELM") returned 1
	[0040.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONCRETE.ELM") returned 1
	[0040.797] lstrcmpiA (lpString1="", lpString2="CONCRETE.ELM") returned -1
	[0040.797] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*") returned="*.*"
	[0040.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\"
	[0040.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned=""
	[0040.797] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt"
	[0040.797] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0xffffffff
	[0040.797] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.799] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.799] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.800] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.800] CloseHandle (hObject=0x90) returned 1
	[0040.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="CONCRETE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM"
	[0040.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.zip") returned 0
	[0040.800] lstrlenA (lpString="*.zip") returned 5
	[0040.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.rar") returned 0
	[0040.800] lstrlenA (lpString="*.rar") returned 5
	[0040.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.7z") returned 0
	[0040.800] lstrlenA (lpString="*.7z") returned 4
	[0040.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.tar") returned 0
	[0040.800] lstrlenA (lpString="*.tar") returned 5
	[0040.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.gzip") returned 0
	[0040.800] lstrlenA (lpString="*.gzip") returned 6
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.jpg") returned 0
	[0040.801] lstrlenA (lpString="*.jpg") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.jpeg") returned 0
	[0040.801] lstrlenA (lpString="*.jpeg") returned 6
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.psd") returned 0
	[0040.801] lstrlenA (lpString="*.psd") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.cdr") returned 0
	[0040.801] lstrlenA (lpString="*.cdr") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.dwg") returned 0
	[0040.801] lstrlenA (lpString="*.dwg") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.max") returned 0
	[0040.801] lstrlenA (lpString="*.max") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.bmp") returned 0
	[0040.801] lstrlenA (lpString="*.bmp") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.gif") returned 0
	[0040.801] lstrlenA (lpString="*.gif") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.png") returned 0
	[0040.801] lstrlenA (lpString="*.png") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.doc") returned 0
	[0040.801] lstrlenA (lpString="*.doc") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.docx") returned 0
	[0040.801] lstrlenA (lpString="*.docx") returned 6
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.xls") returned 0
	[0040.801] lstrlenA (lpString="*.xls") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.xlsx") returned 0
	[0040.801] lstrlenA (lpString="*.xlsx") returned 6
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ppt") returned 0
	[0040.801] lstrlenA (lpString="*.ppt") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.pptx") returned 0
	[0040.801] lstrlenA (lpString="*.pptx") returned 6
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.txt") returned 0
	[0040.801] lstrlenA (lpString="*.txt") returned 5
	[0040.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.pdf") returned 0
	[0040.802] lstrlenA (lpString="*.pdf") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.djvu") returned 0
	[0040.802] lstrlenA (lpString="*.djvu") returned 6
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.htm") returned 0
	[0040.802] lstrlenA (lpString="*.htm") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.html") returned 0
	[0040.802] lstrlenA (lpString="*.html") returned 6
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mdb") returned 0
	[0040.802] lstrlenA (lpString="*.mdb") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.cer") returned 0
	[0040.802] lstrlenA (lpString="*.cer") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.p12") returned 0
	[0040.802] lstrlenA (lpString="*.p12") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.pfx") returned 0
	[0040.802] lstrlenA (lpString="*.pfx") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.kwm") returned 0
	[0040.802] lstrlenA (lpString="*.kwm") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.pwm") returned 0
	[0040.802] lstrlenA (lpString="*.pwm") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.1cd") returned 0
	[0040.802] lstrlenA (lpString="*.1cd") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.md") returned 0
	[0040.802] lstrlenA (lpString="*.md") returned 4
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mdf") returned 0
	[0040.802] lstrlenA (lpString="*.mdf") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.dbf") returned 0
	[0040.802] lstrlenA (lpString="*.dbf") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.odt") returned 0
	[0040.802] lstrlenA (lpString="*.odt") returned 5
	[0040.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.vob") returned 0
	[0040.802] lstrlenA (lpString="*.vob") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ifo") returned 0
	[0040.803] lstrlenA (lpString="*.ifo") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.lnk") returned 0
	[0040.803] lstrlenA (lpString="*.lnk") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.torrent") returned 0
	[0040.803] lstrlenA (lpString="*.torrent") returned 9
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mov") returned 0
	[0040.803] lstrlenA (lpString="*.mov") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.m2v") returned 0
	[0040.803] lstrlenA (lpString="*.m2v") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.3gp") returned 0
	[0040.803] lstrlenA (lpString="*.3gp") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mpeg") returned 0
	[0040.803] lstrlenA (lpString="*.mpeg") returned 6
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mpg") returned 0
	[0040.803] lstrlenA (lpString="*.mpg") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.flv") returned 0
	[0040.803] lstrlenA (lpString="*.flv") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.avi") returned 0
	[0040.803] lstrlenA (lpString="*.avi") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mp4") returned 0
	[0040.803] lstrlenA (lpString="*.mp4") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.wmv") returned 0
	[0040.803] lstrlenA (lpString="*.wmv") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.divx") returned 0
	[0040.803] lstrlenA (lpString="*.divx") returned 6
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mkv") returned 0
	[0040.803] lstrlenA (lpString="*.mkv") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mp3") returned 0
	[0040.803] lstrlenA (lpString="*.mp3") returned 5
	[0040.803] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.wav") returned 0
	[0040.804] lstrlenA (lpString="*.wav") returned 5
	[0040.804] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.flac") returned 0
	[0040.804] lstrlenA (lpString="*.flac") returned 6
	[0040.804] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ape") returned 0
	[0040.804] lstrlenA (lpString="*.ape") returned 5
	[0040.804] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.wma") returned 0
	[0040.804] lstrlenA (lpString="*.wma") returned 5
	[0040.804] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ac3") returned 0
	[0040.804] lstrlenA (lpString="*.ac3") returned 5
	[0040.804] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.exe") returned 0
	[0040.804] lstrlenA (lpString="*.exe") returned 5
	[0040.804] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.apk") returned 0
	[0040.804] lstrlenA (lpString="*.apk") returned 5
	[0040.804] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.804] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.804] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONCRETE.INF") returned 1
	[0040.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONCRETE.INF") returned 1
	[0040.804] lstrcmpiA (lpString1="", lpString2="CONCRETE.INF") returned -1
	[0040.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned="CONCRETE.ELM"
	[0040.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\"
	[0040.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned=""
	[0040.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt"
	[0040.804] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0x20
	[0040.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="CONCRETE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF"
	[0040.804] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.zip") returned 0
	[0040.804] lstrlenA (lpString="*.zip") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.rar") returned 0
	[0040.805] lstrlenA (lpString="*.rar") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.7z") returned 0
	[0040.805] lstrlenA (lpString="*.7z") returned 4
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.tar") returned 0
	[0040.805] lstrlenA (lpString="*.tar") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.gzip") returned 0
	[0040.805] lstrlenA (lpString="*.gzip") returned 6
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.jpg") returned 0
	[0040.805] lstrlenA (lpString="*.jpg") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.jpeg") returned 0
	[0040.805] lstrlenA (lpString="*.jpeg") returned 6
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.psd") returned 0
	[0040.805] lstrlenA (lpString="*.psd") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.cdr") returned 0
	[0040.805] lstrlenA (lpString="*.cdr") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.dwg") returned 0
	[0040.805] lstrlenA (lpString="*.dwg") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.max") returned 0
	[0040.805] lstrlenA (lpString="*.max") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.bmp") returned 0
	[0040.805] lstrlenA (lpString="*.bmp") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.gif") returned 0
	[0040.805] lstrlenA (lpString="*.gif") returned 5
	[0040.805] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.png") returned 0
	[0040.805] lstrlenA (lpString="*.png") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.doc") returned 0
	[0040.806] lstrlenA (lpString="*.doc") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.docx") returned 0
	[0040.806] lstrlenA (lpString="*.docx") returned 6
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.xls") returned 0
	[0040.806] lstrlenA (lpString="*.xls") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.xlsx") returned 0
	[0040.806] lstrlenA (lpString="*.xlsx") returned 6
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.ppt") returned 0
	[0040.806] lstrlenA (lpString="*.ppt") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.pptx") returned 0
	[0040.806] lstrlenA (lpString="*.pptx") returned 6
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.txt") returned 0
	[0040.806] lstrlenA (lpString="*.txt") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.pdf") returned 0
	[0040.806] lstrlenA (lpString="*.pdf") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.djvu") returned 0
	[0040.806] lstrlenA (lpString="*.djvu") returned 6
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.htm") returned 0
	[0040.806] lstrlenA (lpString="*.htm") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.html") returned 0
	[0040.806] lstrlenA (lpString="*.html") returned 6
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mdb") returned 0
	[0040.806] lstrlenA (lpString="*.mdb") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.cer") returned 0
	[0040.806] lstrlenA (lpString="*.cer") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.p12") returned 0
	[0040.806] lstrlenA (lpString="*.p12") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.pfx") returned 0
	[0040.806] lstrlenA (lpString="*.pfx") returned 5
	[0040.806] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.kwm") returned 0
	[0040.807] lstrlenA (lpString="*.kwm") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.pwm") returned 0
	[0040.807] lstrlenA (lpString="*.pwm") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.1cd") returned 0
	[0040.807] lstrlenA (lpString="*.1cd") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.md") returned 0
	[0040.807] lstrlenA (lpString="*.md") returned 4
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mdf") returned 0
	[0040.807] lstrlenA (lpString="*.mdf") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.dbf") returned 0
	[0040.807] lstrlenA (lpString="*.dbf") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.odt") returned 0
	[0040.807] lstrlenA (lpString="*.odt") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.vob") returned 0
	[0040.807] lstrlenA (lpString="*.vob") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.ifo") returned 0
	[0040.807] lstrlenA (lpString="*.ifo") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.lnk") returned 0
	[0040.807] lstrlenA (lpString="*.lnk") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.torrent") returned 0
	[0040.807] lstrlenA (lpString="*.torrent") returned 9
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mov") returned 0
	[0040.807] lstrlenA (lpString="*.mov") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.m2v") returned 0
	[0040.807] lstrlenA (lpString="*.m2v") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.3gp") returned 0
	[0040.807] lstrlenA (lpString="*.3gp") returned 5
	[0040.807] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mpeg") returned 0
	[0040.807] lstrlenA (lpString="*.mpeg") returned 6
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mpg") returned 0
	[0040.808] lstrlenA (lpString="*.mpg") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.flv") returned 0
	[0040.808] lstrlenA (lpString="*.flv") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.avi") returned 0
	[0040.808] lstrlenA (lpString="*.avi") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mp4") returned 0
	[0040.808] lstrlenA (lpString="*.mp4") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.wmv") returned 0
	[0040.808] lstrlenA (lpString="*.wmv") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.divx") returned 0
	[0040.808] lstrlenA (lpString="*.divx") returned 6
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mkv") returned 0
	[0040.808] lstrlenA (lpString="*.mkv") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mp3") returned 0
	[0040.808] lstrlenA (lpString="*.mp3") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.wav") returned 0
	[0040.808] lstrlenA (lpString="*.wav") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.flac") returned 0
	[0040.808] lstrlenA (lpString="*.flac") returned 6
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.ape") returned 0
	[0040.808] lstrlenA (lpString="*.ape") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.wma") returned 0
	[0040.808] lstrlenA (lpString="*.wma") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.ac3") returned 0
	[0040.808] lstrlenA (lpString="*.ac3") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.exe") returned 0
	[0040.808] lstrlenA (lpString="*.exe") returned 5
	[0040.808] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.apk") returned 0
	[0040.808] lstrlenA (lpString="*.apk") returned 5
	[0040.809] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.809] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.809] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.809] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned="CONCRETE.INF"
	[0040.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\"
	[0040.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned=""
	[0040.809] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt"
	[0040.809] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0x20
	[0040.809] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF"
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.809] lstrlenA (lpString="*.zip") returned 5
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.809] lstrlenA (lpString="*.rar") returned 5
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.809] lstrlenA (lpString="*.7z") returned 4
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.809] lstrlenA (lpString="*.tar") returned 5
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.809] lstrlenA (lpString="*.gzip") returned 6
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.809] lstrlenA (lpString="*.jpg") returned 5
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.809] lstrlenA (lpString="*.jpeg") returned 6
	[0040.809] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.810] lstrlenA (lpString="*.psd") returned 5
	[0040.810] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.810] lstrlenA (lpString="*.cdr") returned 5
	[0040.810] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.810] lstrlenA (lpString="*.dwg") returned 5
	[0040.810] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.810] lstrlenA (lpString="*.max") returned 5
	[0040.810] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.810] lstrlenA (lpString="*.bmp") returned 5
	[0040.810] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.810] lstrlenA (lpString="*.gif") returned 5
	[0040.810] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF"
	[0040.810] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF"
	[0040.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF."
	[0040.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.Boom"
	[0040.810] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.810] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x507
	[0040.810] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.810] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.811] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4e4, lpOverlapped=0x0) returned 1
	[0040.813] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.813] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.813] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4e4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4e4, lpOverlapped=0x0) returned 1
	[0040.813] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.813] CloseHandle (hObject=0x90) returned 1
	[0040.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.boom")) returned 1
	[0040.815] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.815] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.815] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.815] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.815] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\"
	[0040.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned=""
	[0040.815] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt"
	[0040.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0x20
	[0040.815] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG"
	[0040.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.815] lstrlenA (lpString="*.zip") returned 5
	[0040.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.815] lstrlenA (lpString="*.rar") returned 5
	[0040.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.815] lstrlenA (lpString="*.7z") returned 4
	[0040.815] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.816] lstrlenA (lpString="*.tar") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.816] lstrlenA (lpString="*.gzip") returned 6
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.816] lstrlenA (lpString="*.jpg") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.816] lstrlenA (lpString="*.jpeg") returned 6
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.816] lstrlenA (lpString="*.psd") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.816] lstrlenA (lpString="*.cdr") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.816] lstrlenA (lpString="*.dwg") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.816] lstrlenA (lpString="*.max") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.816] lstrlenA (lpString="*.bmp") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.816] lstrlenA (lpString="*.gif") returned 5
	[0040.816] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.816] lstrlenA (lpString="*.png") returned 5
	[0040.816] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG"
	[0040.816] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG"
	[0040.816] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG."
	[0040.816] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.Boom"
	[0040.816] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.817] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6fb3
	[0040.817] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.817] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.817] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6f90, lpOverlapped=0x0) returned 1
	[0040.819] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.819] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.819] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6f90, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6f90, lpOverlapped=0x0) returned 1
	[0040.819] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.819] CloseHandle (hObject=0x90) returned 1
	[0040.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.boom")) returned 1
	[0040.821] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.821] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.821] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.821] lstrcmpA (lpString1=".", lpString2="DEEPBLUE") returned -1
	[0040.821] lstrcmpA (lpString1="..", lpString2="DEEPBLUE") returned -1
	[0040.821] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.821] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="DEEPBLUE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE"
	[0040.821] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE") returned 64
	[0040.821] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.821] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.821] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.821] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.822] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.822] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.822] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.822] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DEEPBLUE.ELM") returned 1
	[0040.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEEPBLUE.ELM") returned 1
	[0040.822] lstrcmpiA (lpString1="", lpString2="DEEPBLUE.ELM") returned -1
	[0040.822] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*") returned="*.*"
	[0040.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\"
	[0040.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned=""
	[0040.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt"
	[0040.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0xffffffff
	[0040.822] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.826] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.826] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.827] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.827] CloseHandle (hObject=0x90) returned 1
	[0040.827] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="DEEPBLUE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM"
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.zip") returned 0
	[0040.827] lstrlenA (lpString="*.zip") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.rar") returned 0
	[0040.827] lstrlenA (lpString="*.rar") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.7z") returned 0
	[0040.827] lstrlenA (lpString="*.7z") returned 4
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.tar") returned 0
	[0040.827] lstrlenA (lpString="*.tar") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.gzip") returned 0
	[0040.827] lstrlenA (lpString="*.gzip") returned 6
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.jpg") returned 0
	[0040.827] lstrlenA (lpString="*.jpg") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.jpeg") returned 0
	[0040.827] lstrlenA (lpString="*.jpeg") returned 6
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.psd") returned 0
	[0040.827] lstrlenA (lpString="*.psd") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.cdr") returned 0
	[0040.827] lstrlenA (lpString="*.cdr") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.dwg") returned 0
	[0040.827] lstrlenA (lpString="*.dwg") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.max") returned 0
	[0040.827] lstrlenA (lpString="*.max") returned 5
	[0040.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.bmp") returned 0
	[0040.828] lstrlenA (lpString="*.bmp") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.gif") returned 0
	[0040.828] lstrlenA (lpString="*.gif") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.png") returned 0
	[0040.828] lstrlenA (lpString="*.png") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.doc") returned 0
	[0040.828] lstrlenA (lpString="*.doc") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.docx") returned 0
	[0040.828] lstrlenA (lpString="*.docx") returned 6
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.xls") returned 0
	[0040.828] lstrlenA (lpString="*.xls") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.xlsx") returned 0
	[0040.828] lstrlenA (lpString="*.xlsx") returned 6
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ppt") returned 0
	[0040.828] lstrlenA (lpString="*.ppt") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.pptx") returned 0
	[0040.828] lstrlenA (lpString="*.pptx") returned 6
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.txt") returned 0
	[0040.828] lstrlenA (lpString="*.txt") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.pdf") returned 0
	[0040.828] lstrlenA (lpString="*.pdf") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.djvu") returned 0
	[0040.828] lstrlenA (lpString="*.djvu") returned 6
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.htm") returned 0
	[0040.828] lstrlenA (lpString="*.htm") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.html") returned 0
	[0040.828] lstrlenA (lpString="*.html") returned 6
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mdb") returned 0
	[0040.828] lstrlenA (lpString="*.mdb") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.cer") returned 0
	[0040.828] lstrlenA (lpString="*.cer") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.p12") returned 0
	[0040.828] lstrlenA (lpString="*.p12") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.pfx") returned 0
	[0040.828] lstrlenA (lpString="*.pfx") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.kwm") returned 0
	[0040.828] lstrlenA (lpString="*.kwm") returned 5
	[0040.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.pwm") returned 0
	[0040.828] lstrlenA (lpString="*.pwm") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.1cd") returned 0
	[0040.829] lstrlenA (lpString="*.1cd") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.md") returned 0
	[0040.829] lstrlenA (lpString="*.md") returned 4
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mdf") returned 0
	[0040.829] lstrlenA (lpString="*.mdf") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.dbf") returned 0
	[0040.829] lstrlenA (lpString="*.dbf") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.odt") returned 0
	[0040.829] lstrlenA (lpString="*.odt") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.vob") returned 0
	[0040.829] lstrlenA (lpString="*.vob") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ifo") returned 0
	[0040.829] lstrlenA (lpString="*.ifo") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.lnk") returned 0
	[0040.829] lstrlenA (lpString="*.lnk") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.torrent") returned 0
	[0040.829] lstrlenA (lpString="*.torrent") returned 9
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mov") returned 0
	[0040.829] lstrlenA (lpString="*.mov") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.m2v") returned 0
	[0040.829] lstrlenA (lpString="*.m2v") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.3gp") returned 0
	[0040.829] lstrlenA (lpString="*.3gp") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mpeg") returned 0
	[0040.829] lstrlenA (lpString="*.mpeg") returned 6
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mpg") returned 0
	[0040.829] lstrlenA (lpString="*.mpg") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.flv") returned 0
	[0040.829] lstrlenA (lpString="*.flv") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.avi") returned 0
	[0040.829] lstrlenA (lpString="*.avi") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mp4") returned 0
	[0040.829] lstrlenA (lpString="*.mp4") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.wmv") returned 0
	[0040.829] lstrlenA (lpString="*.wmv") returned 5
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.divx") returned 0
	[0040.829] lstrlenA (lpString="*.divx") returned 6
	[0040.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mkv") returned 0
	[0040.829] lstrlenA (lpString="*.mkv") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mp3") returned 0
	[0040.830] lstrlenA (lpString="*.mp3") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.wav") returned 0
	[0040.830] lstrlenA (lpString="*.wav") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.flac") returned 0
	[0040.830] lstrlenA (lpString="*.flac") returned 6
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ape") returned 0
	[0040.830] lstrlenA (lpString="*.ape") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.wma") returned 0
	[0040.830] lstrlenA (lpString="*.wma") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ac3") returned 0
	[0040.830] lstrlenA (lpString="*.ac3") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.exe") returned 0
	[0040.830] lstrlenA (lpString="*.exe") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.apk") returned 0
	[0040.830] lstrlenA (lpString="*.apk") returned 5
	[0040.830] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.830] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.830] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DEEPBLUE.INF") returned 1
	[0040.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEEPBLUE.INF") returned 1
	[0040.830] lstrcmpiA (lpString1="", lpString2="DEEPBLUE.INF") returned -1
	[0040.830] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned="DEEPBLUE.ELM"
	[0040.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\"
	[0040.830] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned=""
	[0040.830] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt"
	[0040.830] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0x20
	[0040.830] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="DEEPBLUE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF"
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.zip") returned 0
	[0040.830] lstrlenA (lpString="*.zip") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.rar") returned 0
	[0040.830] lstrlenA (lpString="*.rar") returned 5
	[0040.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.7z") returned 0
	[0040.830] lstrlenA (lpString="*.7z") returned 4
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.tar") returned 0
	[0040.831] lstrlenA (lpString="*.tar") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.gzip") returned 0
	[0040.831] lstrlenA (lpString="*.gzip") returned 6
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.jpg") returned 0
	[0040.831] lstrlenA (lpString="*.jpg") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.jpeg") returned 0
	[0040.831] lstrlenA (lpString="*.jpeg") returned 6
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.psd") returned 0
	[0040.831] lstrlenA (lpString="*.psd") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.cdr") returned 0
	[0040.831] lstrlenA (lpString="*.cdr") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.dwg") returned 0
	[0040.831] lstrlenA (lpString="*.dwg") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.max") returned 0
	[0040.831] lstrlenA (lpString="*.max") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.bmp") returned 0
	[0040.831] lstrlenA (lpString="*.bmp") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.gif") returned 0
	[0040.831] lstrlenA (lpString="*.gif") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.png") returned 0
	[0040.831] lstrlenA (lpString="*.png") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.doc") returned 0
	[0040.831] lstrlenA (lpString="*.doc") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.docx") returned 0
	[0040.831] lstrlenA (lpString="*.docx") returned 6
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.xls") returned 0
	[0040.831] lstrlenA (lpString="*.xls") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.xlsx") returned 0
	[0040.831] lstrlenA (lpString="*.xlsx") returned 6
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.ppt") returned 0
	[0040.831] lstrlenA (lpString="*.ppt") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.pptx") returned 0
	[0040.831] lstrlenA (lpString="*.pptx") returned 6
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.txt") returned 0
	[0040.831] lstrlenA (lpString="*.txt") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.pdf") returned 0
	[0040.831] lstrlenA (lpString="*.pdf") returned 5
	[0040.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.djvu") returned 0
	[0040.831] lstrlenA (lpString="*.djvu") returned 6
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.htm") returned 0
	[0040.832] lstrlenA (lpString="*.htm") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.html") returned 0
	[0040.832] lstrlenA (lpString="*.html") returned 6
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mdb") returned 0
	[0040.832] lstrlenA (lpString="*.mdb") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.cer") returned 0
	[0040.832] lstrlenA (lpString="*.cer") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.p12") returned 0
	[0040.832] lstrlenA (lpString="*.p12") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.pfx") returned 0
	[0040.832] lstrlenA (lpString="*.pfx") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.kwm") returned 0
	[0040.832] lstrlenA (lpString="*.kwm") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.pwm") returned 0
	[0040.832] lstrlenA (lpString="*.pwm") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.1cd") returned 0
	[0040.832] lstrlenA (lpString="*.1cd") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.md") returned 0
	[0040.832] lstrlenA (lpString="*.md") returned 4
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mdf") returned 0
	[0040.832] lstrlenA (lpString="*.mdf") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.dbf") returned 0
	[0040.832] lstrlenA (lpString="*.dbf") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.odt") returned 0
	[0040.832] lstrlenA (lpString="*.odt") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.vob") returned 0
	[0040.832] lstrlenA (lpString="*.vob") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.ifo") returned 0
	[0040.832] lstrlenA (lpString="*.ifo") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.lnk") returned 0
	[0040.832] lstrlenA (lpString="*.lnk") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.torrent") returned 0
	[0040.832] lstrlenA (lpString="*.torrent") returned 9
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mov") returned 0
	[0040.832] lstrlenA (lpString="*.mov") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.m2v") returned 0
	[0040.832] lstrlenA (lpString="*.m2v") returned 5
	[0040.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.3gp") returned 0
	[0040.833] lstrlenA (lpString="*.3gp") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mpeg") returned 0
	[0040.833] lstrlenA (lpString="*.mpeg") returned 6
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mpg") returned 0
	[0040.833] lstrlenA (lpString="*.mpg") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.flv") returned 0
	[0040.833] lstrlenA (lpString="*.flv") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.avi") returned 0
	[0040.833] lstrlenA (lpString="*.avi") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mp4") returned 0
	[0040.833] lstrlenA (lpString="*.mp4") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.wmv") returned 0
	[0040.833] lstrlenA (lpString="*.wmv") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.divx") returned 0
	[0040.833] lstrlenA (lpString="*.divx") returned 6
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mkv") returned 0
	[0040.833] lstrlenA (lpString="*.mkv") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mp3") returned 0
	[0040.833] lstrlenA (lpString="*.mp3") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.wav") returned 0
	[0040.833] lstrlenA (lpString="*.wav") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.flac") returned 0
	[0040.833] lstrlenA (lpString="*.flac") returned 6
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.ape") returned 0
	[0040.833] lstrlenA (lpString="*.ape") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.wma") returned 0
	[0040.833] lstrlenA (lpString="*.wma") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.ac3") returned 0
	[0040.833] lstrlenA (lpString="*.ac3") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.exe") returned 0
	[0040.833] lstrlenA (lpString="*.exe") returned 5
	[0040.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.apk") returned 0
	[0040.833] lstrlenA (lpString="*.apk") returned 5
	[0040.833] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.833] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.833] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned="DEEPBLUE.INF"
	[0040.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\"
	[0040.834] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned=""
	[0040.834] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt"
	[0040.834] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0x20
	[0040.834] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF"
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.834] lstrlenA (lpString="*.zip") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.834] lstrlenA (lpString="*.rar") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.834] lstrlenA (lpString="*.7z") returned 4
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.834] lstrlenA (lpString="*.tar") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.834] lstrlenA (lpString="*.gzip") returned 6
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.834] lstrlenA (lpString="*.jpg") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.834] lstrlenA (lpString="*.jpeg") returned 6
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.834] lstrlenA (lpString="*.psd") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.834] lstrlenA (lpString="*.cdr") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.834] lstrlenA (lpString="*.dwg") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.834] lstrlenA (lpString="*.max") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.834] lstrlenA (lpString="*.bmp") returned 5
	[0040.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.834] lstrlenA (lpString="*.gif") returned 5
	[0040.834] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF"
	[0040.834] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF"
	[0040.834] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF."
	[0040.834] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.Boom"
	[0040.835] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.835] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf75
	[0040.835] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.835] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.835] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf52, lpOverlapped=0x0) returned 1
	[0040.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.836] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.836] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf52, lpOverlapped=0x0) returned 1
	[0040.836] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.837] CloseHandle (hObject=0x90) returned 1
	[0040.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.boom")) returned 1
	[0040.838] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.838] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.838] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\"
	[0040.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned=""
	[0040.838] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt"
	[0040.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0x20
	[0040.838] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG"
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.838] lstrlenA (lpString="*.zip") returned 5
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.838] lstrlenA (lpString="*.rar") returned 5
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.838] lstrlenA (lpString="*.7z") returned 4
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.838] lstrlenA (lpString="*.tar") returned 5
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.838] lstrlenA (lpString="*.gzip") returned 6
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.838] lstrlenA (lpString="*.jpg") returned 5
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.838] lstrlenA (lpString="*.jpeg") returned 6
	[0040.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.838] lstrlenA (lpString="*.psd") returned 5
	[0040.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.839] lstrlenA (lpString="*.cdr") returned 5
	[0040.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.839] lstrlenA (lpString="*.dwg") returned 5
	[0040.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.839] lstrlenA (lpString="*.max") returned 5
	[0040.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.839] lstrlenA (lpString="*.bmp") returned 5
	[0040.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.839] lstrlenA (lpString="*.gif") returned 5
	[0040.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.839] lstrlenA (lpString="*.png") returned 5
	[0040.839] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG"
	[0040.839] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG"
	[0040.839] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG."
	[0040.839] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.Boom"
	[0040.839] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.840] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81fd
	[0040.840] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.840] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.840] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x81da, lpOverlapped=0x0) returned 1
	[0040.841] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.841] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.841] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x81da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x81da, lpOverlapped=0x0) returned 1
	[0040.841] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.842] CloseHandle (hObject=0x90) returned 1
	[0040.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.boom")) returned 1
	[0040.843] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.843] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.843] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.843] lstrcmpA (lpString1=".", lpString2="ECHO") returned -1
	[0040.843] lstrcmpA (lpString1="..", lpString2="ECHO") returned -1
	[0040.843] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ECHO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO"
	[0040.843] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO") returned 60
	[0040.843] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.844] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.844] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.844] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.844] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.844] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.844] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ECHO.ELM") returned -1
	[0040.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECHO.ELM") returned 1
	[0040.844] lstrcmpiA (lpString1="", lpString2="ECHO.ELM") returned -1
	[0040.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*") returned="*.*"
	[0040.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\"
	[0040.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned=""
	[0040.844] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt"
	[0040.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0xffffffff
	[0040.845] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.845] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.845] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.846] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.846] CloseHandle (hObject=0x90) returned 1
	[0040.846] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="ECHO.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM"
	[0040.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.zip") returned 0
	[0040.846] lstrlenA (lpString="*.zip") returned 5
	[0040.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.rar") returned 0
	[0040.846] lstrlenA (lpString="*.rar") returned 5
	[0040.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.7z") returned 0
	[0040.846] lstrlenA (lpString="*.7z") returned 4
	[0040.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.tar") returned 0
	[0040.846] lstrlenA (lpString="*.tar") returned 5
	[0040.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.gzip") returned 0
	[0040.846] lstrlenA (lpString="*.gzip") returned 6
	[0040.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.jpg") returned 0
	[0040.846] lstrlenA (lpString="*.jpg") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.jpeg") returned 0
	[0040.847] lstrlenA (lpString="*.jpeg") returned 6
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.psd") returned 0
	[0040.847] lstrlenA (lpString="*.psd") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.cdr") returned 0
	[0040.847] lstrlenA (lpString="*.cdr") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.dwg") returned 0
	[0040.847] lstrlenA (lpString="*.dwg") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.max") returned 0
	[0040.847] lstrlenA (lpString="*.max") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.bmp") returned 0
	[0040.847] lstrlenA (lpString="*.bmp") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.gif") returned 0
	[0040.847] lstrlenA (lpString="*.gif") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.png") returned 0
	[0040.847] lstrlenA (lpString="*.png") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.doc") returned 0
	[0040.847] lstrlenA (lpString="*.doc") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.docx") returned 0
	[0040.847] lstrlenA (lpString="*.docx") returned 6
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.xls") returned 0
	[0040.847] lstrlenA (lpString="*.xls") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.xlsx") returned 0
	[0040.847] lstrlenA (lpString="*.xlsx") returned 6
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ppt") returned 0
	[0040.847] lstrlenA (lpString="*.ppt") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.pptx") returned 0
	[0040.847] lstrlenA (lpString="*.pptx") returned 6
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.txt") returned 0
	[0040.847] lstrlenA (lpString="*.txt") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.pdf") returned 0
	[0040.847] lstrlenA (lpString="*.pdf") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.djvu") returned 0
	[0040.847] lstrlenA (lpString="*.djvu") returned 6
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.htm") returned 0
	[0040.847] lstrlenA (lpString="*.htm") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.html") returned 0
	[0040.847] lstrlenA (lpString="*.html") returned 6
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mdb") returned 0
	[0040.847] lstrlenA (lpString="*.mdb") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.cer") returned 0
	[0040.847] lstrlenA (lpString="*.cer") returned 5
	[0040.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.p12") returned 0
	[0040.848] lstrlenA (lpString="*.p12") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.pfx") returned 0
	[0040.848] lstrlenA (lpString="*.pfx") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.kwm") returned 0
	[0040.848] lstrlenA (lpString="*.kwm") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.pwm") returned 0
	[0040.848] lstrlenA (lpString="*.pwm") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.1cd") returned 0
	[0040.848] lstrlenA (lpString="*.1cd") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.md") returned 0
	[0040.848] lstrlenA (lpString="*.md") returned 4
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mdf") returned 0
	[0040.848] lstrlenA (lpString="*.mdf") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.dbf") returned 0
	[0040.848] lstrlenA (lpString="*.dbf") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.odt") returned 0
	[0040.848] lstrlenA (lpString="*.odt") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.vob") returned 0
	[0040.848] lstrlenA (lpString="*.vob") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ifo") returned 0
	[0040.848] lstrlenA (lpString="*.ifo") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.lnk") returned 0
	[0040.848] lstrlenA (lpString="*.lnk") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.torrent") returned 0
	[0040.848] lstrlenA (lpString="*.torrent") returned 9
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mov") returned 0
	[0040.848] lstrlenA (lpString="*.mov") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.m2v") returned 0
	[0040.848] lstrlenA (lpString="*.m2v") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.3gp") returned 0
	[0040.848] lstrlenA (lpString="*.3gp") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mpeg") returned 0
	[0040.848] lstrlenA (lpString="*.mpeg") returned 6
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mpg") returned 0
	[0040.848] lstrlenA (lpString="*.mpg") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.flv") returned 0
	[0040.848] lstrlenA (lpString="*.flv") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.avi") returned 0
	[0040.848] lstrlenA (lpString="*.avi") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mp4") returned 0
	[0040.848] lstrlenA (lpString="*.mp4") returned 5
	[0040.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.wmv") returned 0
	[0040.848] lstrlenA (lpString="*.wmv") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.divx") returned 0
	[0040.849] lstrlenA (lpString="*.divx") returned 6
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mkv") returned 0
	[0040.849] lstrlenA (lpString="*.mkv") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mp3") returned 0
	[0040.849] lstrlenA (lpString="*.mp3") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.wav") returned 0
	[0040.849] lstrlenA (lpString="*.wav") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.flac") returned 0
	[0040.849] lstrlenA (lpString="*.flac") returned 6
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ape") returned 0
	[0040.849] lstrlenA (lpString="*.ape") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.wma") returned 0
	[0040.849] lstrlenA (lpString="*.wma") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ac3") returned 0
	[0040.849] lstrlenA (lpString="*.ac3") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.exe") returned 0
	[0040.849] lstrlenA (lpString="*.exe") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.apk") returned 0
	[0040.849] lstrlenA (lpString="*.apk") returned 5
	[0040.849] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.849] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ECHO.INF") returned -1
	[0040.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECHO.INF") returned 1
	[0040.849] lstrcmpiA (lpString1="", lpString2="ECHO.INF") returned -1
	[0040.849] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned="ECHO.ELM"
	[0040.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\"
	[0040.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned=""
	[0040.849] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt"
	[0040.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0x20
	[0040.849] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="ECHO.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF"
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.zip") returned 0
	[0040.849] lstrlenA (lpString="*.zip") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.rar") returned 0
	[0040.849] lstrlenA (lpString="*.rar") returned 5
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.7z") returned 0
	[0040.849] lstrlenA (lpString="*.7z") returned 4
	[0040.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.tar") returned 0
	[0040.850] lstrlenA (lpString="*.tar") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.gzip") returned 0
	[0040.850] lstrlenA (lpString="*.gzip") returned 6
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.jpg") returned 0
	[0040.850] lstrlenA (lpString="*.jpg") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.jpeg") returned 0
	[0040.850] lstrlenA (lpString="*.jpeg") returned 6
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.psd") returned 0
	[0040.850] lstrlenA (lpString="*.psd") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.cdr") returned 0
	[0040.850] lstrlenA (lpString="*.cdr") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.dwg") returned 0
	[0040.850] lstrlenA (lpString="*.dwg") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.max") returned 0
	[0040.850] lstrlenA (lpString="*.max") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.bmp") returned 0
	[0040.850] lstrlenA (lpString="*.bmp") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.gif") returned 0
	[0040.850] lstrlenA (lpString="*.gif") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.png") returned 0
	[0040.850] lstrlenA (lpString="*.png") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.doc") returned 0
	[0040.850] lstrlenA (lpString="*.doc") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.docx") returned 0
	[0040.850] lstrlenA (lpString="*.docx") returned 6
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.xls") returned 0
	[0040.850] lstrlenA (lpString="*.xls") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.xlsx") returned 0
	[0040.850] lstrlenA (lpString="*.xlsx") returned 6
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.ppt") returned 0
	[0040.850] lstrlenA (lpString="*.ppt") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.pptx") returned 0
	[0040.850] lstrlenA (lpString="*.pptx") returned 6
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.txt") returned 0
	[0040.850] lstrlenA (lpString="*.txt") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.pdf") returned 0
	[0040.850] lstrlenA (lpString="*.pdf") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.djvu") returned 0
	[0040.850] lstrlenA (lpString="*.djvu") returned 6
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.htm") returned 0
	[0040.850] lstrlenA (lpString="*.htm") returned 5
	[0040.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.html") returned 0
	[0040.850] lstrlenA (lpString="*.html") returned 6
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mdb") returned 0
	[0040.851] lstrlenA (lpString="*.mdb") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.cer") returned 0
	[0040.851] lstrlenA (lpString="*.cer") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.p12") returned 0
	[0040.851] lstrlenA (lpString="*.p12") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.pfx") returned 0
	[0040.851] lstrlenA (lpString="*.pfx") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.kwm") returned 0
	[0040.851] lstrlenA (lpString="*.kwm") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.pwm") returned 0
	[0040.851] lstrlenA (lpString="*.pwm") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.1cd") returned 0
	[0040.851] lstrlenA (lpString="*.1cd") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.md") returned 0
	[0040.851] lstrlenA (lpString="*.md") returned 4
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mdf") returned 0
	[0040.851] lstrlenA (lpString="*.mdf") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.dbf") returned 0
	[0040.851] lstrlenA (lpString="*.dbf") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.odt") returned 0
	[0040.851] lstrlenA (lpString="*.odt") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.vob") returned 0
	[0040.851] lstrlenA (lpString="*.vob") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.ifo") returned 0
	[0040.851] lstrlenA (lpString="*.ifo") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.lnk") returned 0
	[0040.851] lstrlenA (lpString="*.lnk") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.torrent") returned 0
	[0040.851] lstrlenA (lpString="*.torrent") returned 9
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mov") returned 0
	[0040.851] lstrlenA (lpString="*.mov") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.m2v") returned 0
	[0040.851] lstrlenA (lpString="*.m2v") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.3gp") returned 0
	[0040.851] lstrlenA (lpString="*.3gp") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mpeg") returned 0
	[0040.851] lstrlenA (lpString="*.mpeg") returned 6
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mpg") returned 0
	[0040.851] lstrlenA (lpString="*.mpg") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.flv") returned 0
	[0040.851] lstrlenA (lpString="*.flv") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.avi") returned 0
	[0040.851] lstrlenA (lpString="*.avi") returned 5
	[0040.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mp4") returned 0
	[0040.852] lstrlenA (lpString="*.mp4") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.wmv") returned 0
	[0040.852] lstrlenA (lpString="*.wmv") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.divx") returned 0
	[0040.852] lstrlenA (lpString="*.divx") returned 6
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mkv") returned 0
	[0040.852] lstrlenA (lpString="*.mkv") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mp3") returned 0
	[0040.852] lstrlenA (lpString="*.mp3") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.wav") returned 0
	[0040.852] lstrlenA (lpString="*.wav") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.flac") returned 0
	[0040.852] lstrlenA (lpString="*.flac") returned 6
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.ape") returned 0
	[0040.852] lstrlenA (lpString="*.ape") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.wma") returned 0
	[0040.852] lstrlenA (lpString="*.wma") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.ac3") returned 0
	[0040.852] lstrlenA (lpString="*.ac3") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.exe") returned 0
	[0040.852] lstrlenA (lpString="*.exe") returned 5
	[0040.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.apk") returned 0
	[0040.852] lstrlenA (lpString="*.apk") returned 5
	[0040.852] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.852] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.852] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.852] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.852] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned="ECHO.INF"
	[0040.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\"
	[0040.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned=""
	[0040.852] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt"
	[0040.852] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0x20
	[0040.853] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF"
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.853] lstrlenA (lpString="*.zip") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.853] lstrlenA (lpString="*.rar") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.853] lstrlenA (lpString="*.7z") returned 4
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.853] lstrlenA (lpString="*.tar") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.853] lstrlenA (lpString="*.gzip") returned 6
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.853] lstrlenA (lpString="*.jpg") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.853] lstrlenA (lpString="*.jpeg") returned 6
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.853] lstrlenA (lpString="*.psd") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.853] lstrlenA (lpString="*.cdr") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.853] lstrlenA (lpString="*.dwg") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.853] lstrlenA (lpString="*.max") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.853] lstrlenA (lpString="*.bmp") returned 5
	[0040.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.853] lstrlenA (lpString="*.gif") returned 5
	[0040.853] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF"
	[0040.853] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF"
	[0040.853] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF."
	[0040.853] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.Boom"
	[0040.853] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.853] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ad
	[0040.854] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.854] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.854] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x58a, lpOverlapped=0x0) returned 1
	[0040.855] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.855] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.855] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x58a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x58a, lpOverlapped=0x0) returned 1
	[0040.855] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.855] CloseHandle (hObject=0x90) returned 1
	[0040.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.boom")) returned 1
	[0040.858] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.858] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.858] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.858] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.858] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\"
	[0040.858] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned=""
	[0040.858] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt"
	[0040.858] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0x20
	[0040.858] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG"
	[0040.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.858] lstrlenA (lpString="*.zip") returned 5
	[0040.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.858] lstrlenA (lpString="*.rar") returned 5
	[0040.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.858] lstrlenA (lpString="*.7z") returned 4
	[0040.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.858] lstrlenA (lpString="*.tar") returned 5
	[0040.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.859] lstrlenA (lpString="*.gzip") returned 6
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.859] lstrlenA (lpString="*.jpg") returned 5
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.859] lstrlenA (lpString="*.jpeg") returned 6
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.859] lstrlenA (lpString="*.psd") returned 5
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.859] lstrlenA (lpString="*.cdr") returned 5
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.859] lstrlenA (lpString="*.dwg") returned 5
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.859] lstrlenA (lpString="*.max") returned 5
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.859] lstrlenA (lpString="*.bmp") returned 5
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.859] lstrlenA (lpString="*.gif") returned 5
	[0040.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.859] lstrlenA (lpString="*.png") returned 5
	[0040.859] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG"
	[0040.859] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG"
	[0040.859] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG."
	[0040.859] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.Boom"
	[0040.859] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.859] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6212
	[0040.859] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.859] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.859] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x61ef, lpOverlapped=0x0) returned 1
	[0040.861] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.861] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.861] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x61ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x61ef, lpOverlapped=0x0) returned 1
	[0040.861] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.861] CloseHandle (hObject=0x90) returned 1
	[0040.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.boom")) returned 1
	[0040.863] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.863] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.863] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.863] lstrcmpA (lpString1=".", lpString2="ECLIPSE") returned -1
	[0040.863] lstrcmpA (lpString1="..", lpString2="ECLIPSE") returned -1
	[0040.863] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.863] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ECLIPSE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE"
	[0040.863] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE") returned 63
	[0040.863] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.864] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.864] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.864] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.864] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.864] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.864] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.864] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ECLIPSE.ELM") returned -1
	[0040.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECLIPSE.ELM") returned 1
	[0040.864] lstrcmpiA (lpString1="", lpString2="ECLIPSE.ELM") returned -1
	[0040.864] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*") returned="*.*"
	[0040.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\"
	[0040.864] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned=""
	[0040.864] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt"
	[0040.864] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0xffffffff
	[0040.864] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.864] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.864] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.865] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.865] CloseHandle (hObject=0x90) returned 1
	[0040.865] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="ECLIPSE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM"
	[0040.865] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.zip") returned 0
	[0040.865] lstrlenA (lpString="*.zip") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.rar") returned 0
	[0040.866] lstrlenA (lpString="*.rar") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.7z") returned 0
	[0040.866] lstrlenA (lpString="*.7z") returned 4
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.tar") returned 0
	[0040.866] lstrlenA (lpString="*.tar") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.gzip") returned 0
	[0040.866] lstrlenA (lpString="*.gzip") returned 6
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.jpg") returned 0
	[0040.866] lstrlenA (lpString="*.jpg") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.jpeg") returned 0
	[0040.866] lstrlenA (lpString="*.jpeg") returned 6
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.psd") returned 0
	[0040.866] lstrlenA (lpString="*.psd") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.cdr") returned 0
	[0040.866] lstrlenA (lpString="*.cdr") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.dwg") returned 0
	[0040.866] lstrlenA (lpString="*.dwg") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.max") returned 0
	[0040.866] lstrlenA (lpString="*.max") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.bmp") returned 0
	[0040.866] lstrlenA (lpString="*.bmp") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.gif") returned 0
	[0040.866] lstrlenA (lpString="*.gif") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.png") returned 0
	[0040.866] lstrlenA (lpString="*.png") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.doc") returned 0
	[0040.866] lstrlenA (lpString="*.doc") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.docx") returned 0
	[0040.866] lstrlenA (lpString="*.docx") returned 6
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.xls") returned 0
	[0040.866] lstrlenA (lpString="*.xls") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.xlsx") returned 0
	[0040.866] lstrlenA (lpString="*.xlsx") returned 6
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ppt") returned 0
	[0040.866] lstrlenA (lpString="*.ppt") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.pptx") returned 0
	[0040.866] lstrlenA (lpString="*.pptx") returned 6
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.txt") returned 0
	[0040.866] lstrlenA (lpString="*.txt") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.pdf") returned 0
	[0040.866] lstrlenA (lpString="*.pdf") returned 5
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.djvu") returned 0
	[0040.866] lstrlenA (lpString="*.djvu") returned 6
	[0040.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.htm") returned 0
	[0040.867] lstrlenA (lpString="*.htm") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.html") returned 0
	[0040.867] lstrlenA (lpString="*.html") returned 6
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mdb") returned 0
	[0040.867] lstrlenA (lpString="*.mdb") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.cer") returned 0
	[0040.867] lstrlenA (lpString="*.cer") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.p12") returned 0
	[0040.867] lstrlenA (lpString="*.p12") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.pfx") returned 0
	[0040.867] lstrlenA (lpString="*.pfx") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.kwm") returned 0
	[0040.867] lstrlenA (lpString="*.kwm") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.pwm") returned 0
	[0040.867] lstrlenA (lpString="*.pwm") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.1cd") returned 0
	[0040.867] lstrlenA (lpString="*.1cd") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.md") returned 0
	[0040.867] lstrlenA (lpString="*.md") returned 4
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mdf") returned 0
	[0040.867] lstrlenA (lpString="*.mdf") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.dbf") returned 0
	[0040.867] lstrlenA (lpString="*.dbf") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.odt") returned 0
	[0040.867] lstrlenA (lpString="*.odt") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.vob") returned 0
	[0040.867] lstrlenA (lpString="*.vob") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ifo") returned 0
	[0040.867] lstrlenA (lpString="*.ifo") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.lnk") returned 0
	[0040.867] lstrlenA (lpString="*.lnk") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.torrent") returned 0
	[0040.867] lstrlenA (lpString="*.torrent") returned 9
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mov") returned 0
	[0040.867] lstrlenA (lpString="*.mov") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.m2v") returned 0
	[0040.867] lstrlenA (lpString="*.m2v") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.3gp") returned 0
	[0040.867] lstrlenA (lpString="*.3gp") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mpeg") returned 0
	[0040.867] lstrlenA (lpString="*.mpeg") returned 6
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mpg") returned 0
	[0040.867] lstrlenA (lpString="*.mpg") returned 5
	[0040.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.flv") returned 0
	[0040.867] lstrlenA (lpString="*.flv") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.avi") returned 0
	[0040.868] lstrlenA (lpString="*.avi") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mp4") returned 0
	[0040.868] lstrlenA (lpString="*.mp4") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.wmv") returned 0
	[0040.868] lstrlenA (lpString="*.wmv") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.divx") returned 0
	[0040.868] lstrlenA (lpString="*.divx") returned 6
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mkv") returned 0
	[0040.868] lstrlenA (lpString="*.mkv") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mp3") returned 0
	[0040.868] lstrlenA (lpString="*.mp3") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.wav") returned 0
	[0040.868] lstrlenA (lpString="*.wav") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.flac") returned 0
	[0040.868] lstrlenA (lpString="*.flac") returned 6
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ape") returned 0
	[0040.868] lstrlenA (lpString="*.ape") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.wma") returned 0
	[0040.868] lstrlenA (lpString="*.wma") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ac3") returned 0
	[0040.868] lstrlenA (lpString="*.ac3") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.exe") returned 0
	[0040.868] lstrlenA (lpString="*.exe") returned 5
	[0040.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.apk") returned 0
	[0040.868] lstrlenA (lpString="*.apk") returned 5
	[0040.868] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.868] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ECLIPSE.INF") returned -1
	[0040.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECLIPSE.INF") returned 1
	[0040.868] lstrcmpiA (lpString1="", lpString2="ECLIPSE.INF") returned -1
	[0040.868] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned="ECLIPSE.ELM"
	[0040.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\"
	[0040.869] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned=""
	[0040.869] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt"
	[0040.869] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0x20
	[0040.869] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="ECLIPSE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF"
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.zip") returned 0
	[0040.869] lstrlenA (lpString="*.zip") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.rar") returned 0
	[0040.869] lstrlenA (lpString="*.rar") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.7z") returned 0
	[0040.869] lstrlenA (lpString="*.7z") returned 4
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.tar") returned 0
	[0040.869] lstrlenA (lpString="*.tar") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.gzip") returned 0
	[0040.869] lstrlenA (lpString="*.gzip") returned 6
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.jpg") returned 0
	[0040.869] lstrlenA (lpString="*.jpg") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.jpeg") returned 0
	[0040.869] lstrlenA (lpString="*.jpeg") returned 6
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.psd") returned 0
	[0040.869] lstrlenA (lpString="*.psd") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.cdr") returned 0
	[0040.869] lstrlenA (lpString="*.cdr") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.dwg") returned 0
	[0040.869] lstrlenA (lpString="*.dwg") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.max") returned 0
	[0040.869] lstrlenA (lpString="*.max") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.bmp") returned 0
	[0040.869] lstrlenA (lpString="*.bmp") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.gif") returned 0
	[0040.869] lstrlenA (lpString="*.gif") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.png") returned 0
	[0040.869] lstrlenA (lpString="*.png") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.doc") returned 0
	[0040.869] lstrlenA (lpString="*.doc") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.docx") returned 0
	[0040.869] lstrlenA (lpString="*.docx") returned 6
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.xls") returned 0
	[0040.869] lstrlenA (lpString="*.xls") returned 5
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.xlsx") returned 0
	[0040.869] lstrlenA (lpString="*.xlsx") returned 6
	[0040.869] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.ppt") returned 0
	[0040.870] lstrlenA (lpString="*.ppt") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.pptx") returned 0
	[0040.870] lstrlenA (lpString="*.pptx") returned 6
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.txt") returned 0
	[0040.870] lstrlenA (lpString="*.txt") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.pdf") returned 0
	[0040.870] lstrlenA (lpString="*.pdf") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.djvu") returned 0
	[0040.870] lstrlenA (lpString="*.djvu") returned 6
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.htm") returned 0
	[0040.870] lstrlenA (lpString="*.htm") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.html") returned 0
	[0040.870] lstrlenA (lpString="*.html") returned 6
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mdb") returned 0
	[0040.870] lstrlenA (lpString="*.mdb") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.cer") returned 0
	[0040.870] lstrlenA (lpString="*.cer") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.p12") returned 0
	[0040.870] lstrlenA (lpString="*.p12") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.pfx") returned 0
	[0040.870] lstrlenA (lpString="*.pfx") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.kwm") returned 0
	[0040.870] lstrlenA (lpString="*.kwm") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.pwm") returned 0
	[0040.870] lstrlenA (lpString="*.pwm") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.1cd") returned 0
	[0040.870] lstrlenA (lpString="*.1cd") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.md") returned 0
	[0040.870] lstrlenA (lpString="*.md") returned 4
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mdf") returned 0
	[0040.870] lstrlenA (lpString="*.mdf") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.dbf") returned 0
	[0040.870] lstrlenA (lpString="*.dbf") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.odt") returned 0
	[0040.870] lstrlenA (lpString="*.odt") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.vob") returned 0
	[0040.870] lstrlenA (lpString="*.vob") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.ifo") returned 0
	[0040.870] lstrlenA (lpString="*.ifo") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.lnk") returned 0
	[0040.870] lstrlenA (lpString="*.lnk") returned 5
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.torrent") returned 0
	[0040.870] lstrlenA (lpString="*.torrent") returned 9
	[0040.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mov") returned 0
	[0040.870] lstrlenA (lpString="*.mov") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.m2v") returned 0
	[0040.871] lstrlenA (lpString="*.m2v") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.3gp") returned 0
	[0040.871] lstrlenA (lpString="*.3gp") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mpeg") returned 0
	[0040.871] lstrlenA (lpString="*.mpeg") returned 6
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mpg") returned 0
	[0040.871] lstrlenA (lpString="*.mpg") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.flv") returned 0
	[0040.871] lstrlenA (lpString="*.flv") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.avi") returned 0
	[0040.871] lstrlenA (lpString="*.avi") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mp4") returned 0
	[0040.871] lstrlenA (lpString="*.mp4") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.wmv") returned 0
	[0040.871] lstrlenA (lpString="*.wmv") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.divx") returned 0
	[0040.871] lstrlenA (lpString="*.divx") returned 6
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mkv") returned 0
	[0040.871] lstrlenA (lpString="*.mkv") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mp3") returned 0
	[0040.871] lstrlenA (lpString="*.mp3") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.wav") returned 0
	[0040.871] lstrlenA (lpString="*.wav") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.flac") returned 0
	[0040.871] lstrlenA (lpString="*.flac") returned 6
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.ape") returned 0
	[0040.871] lstrlenA (lpString="*.ape") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.wma") returned 0
	[0040.871] lstrlenA (lpString="*.wma") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.ac3") returned 0
	[0040.871] lstrlenA (lpString="*.ac3") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.exe") returned 0
	[0040.871] lstrlenA (lpString="*.exe") returned 5
	[0040.871] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.apk") returned 0
	[0040.871] lstrlenA (lpString="*.apk") returned 5
	[0040.871] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.871] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.871] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.871] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.871] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned="ECLIPSE.INF"
	[0040.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\"
	[0040.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned=""
	[0040.871] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt"
	[0040.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0x20
	[0040.872] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF"
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.872] lstrlenA (lpString="*.zip") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.872] lstrlenA (lpString="*.rar") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.872] lstrlenA (lpString="*.7z") returned 4
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.872] lstrlenA (lpString="*.tar") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.872] lstrlenA (lpString="*.gzip") returned 6
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.872] lstrlenA (lpString="*.jpg") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.872] lstrlenA (lpString="*.jpeg") returned 6
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.872] lstrlenA (lpString="*.psd") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.872] lstrlenA (lpString="*.cdr") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.872] lstrlenA (lpString="*.dwg") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.872] lstrlenA (lpString="*.max") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.872] lstrlenA (lpString="*.bmp") returned 5
	[0040.872] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.872] lstrlenA (lpString="*.gif") returned 5
	[0040.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF"
	[0040.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF"
	[0040.872] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF."
	[0040.872] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.Boom"
	[0040.872] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.873] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x543
	[0040.873] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.873] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.873] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x520, lpOverlapped=0x0) returned 1
	[0040.892] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.892] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.892] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x520, lpOverlapped=0x0) returned 1
	[0040.892] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.893] CloseHandle (hObject=0x90) returned 1
	[0040.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.boom")) returned 1
	[0040.901] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.901] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.901] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\"
	[0040.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned=""
	[0040.901] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt"
	[0040.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0x20
	[0040.901] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG"
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.901] lstrlenA (lpString="*.zip") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.901] lstrlenA (lpString="*.rar") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.901] lstrlenA (lpString="*.7z") returned 4
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.901] lstrlenA (lpString="*.tar") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.901] lstrlenA (lpString="*.gzip") returned 6
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.901] lstrlenA (lpString="*.jpg") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.901] lstrlenA (lpString="*.jpeg") returned 6
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.901] lstrlenA (lpString="*.psd") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.901] lstrlenA (lpString="*.cdr") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.901] lstrlenA (lpString="*.dwg") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.901] lstrlenA (lpString="*.max") returned 5
	[0040.901] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.902] lstrlenA (lpString="*.bmp") returned 5
	[0040.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.902] lstrlenA (lpString="*.gif") returned 5
	[0040.902] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.902] lstrlenA (lpString="*.png") returned 5
	[0040.902] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG"
	[0040.902] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG"
	[0040.902] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG."
	[0040.902] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.Boom"
	[0040.902] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.902] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e93
	[0040.902] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.902] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.902] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7e70, lpOverlapped=0x0) returned 1
	[0040.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.903] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.904] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7e70, lpOverlapped=0x0) returned 1
	[0040.904] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.904] CloseHandle (hObject=0x90) returned 1
	[0040.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.boom")) returned 1
	[0040.905] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.905] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.905] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.905] lstrcmpA (lpString1=".", lpString2="EDGE") returned -1
	[0040.905] lstrcmpA (lpString1="..", lpString2="EDGE") returned -1
	[0040.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.905] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="EDGE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE"
	[0040.905] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE") returned 60
	[0040.905] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0040.906] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.906] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.906] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.906] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.906] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.906] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.906] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EDGE.ELM") returned -1
	[0040.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EDGE.ELM") returned 1
	[0040.906] lstrcmpiA (lpString1="", lpString2="EDGE.ELM") returned -1
	[0040.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*") returned="*.*"
	[0040.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\"
	[0040.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned=""
	[0040.906] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt"
	[0040.906] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0xffffffff
	[0040.906] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.907] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.907] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.907] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.908] CloseHandle (hObject=0x90) returned 1
	[0040.908] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="EDGE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM"
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.zip") returned 0
	[0040.908] lstrlenA (lpString="*.zip") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.rar") returned 0
	[0040.908] lstrlenA (lpString="*.rar") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.7z") returned 0
	[0040.908] lstrlenA (lpString="*.7z") returned 4
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.tar") returned 0
	[0040.908] lstrlenA (lpString="*.tar") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.gzip") returned 0
	[0040.908] lstrlenA (lpString="*.gzip") returned 6
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.jpg") returned 0
	[0040.908] lstrlenA (lpString="*.jpg") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.jpeg") returned 0
	[0040.908] lstrlenA (lpString="*.jpeg") returned 6
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.psd") returned 0
	[0040.908] lstrlenA (lpString="*.psd") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.cdr") returned 0
	[0040.908] lstrlenA (lpString="*.cdr") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.dwg") returned 0
	[0040.908] lstrlenA (lpString="*.dwg") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.max") returned 0
	[0040.908] lstrlenA (lpString="*.max") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.bmp") returned 0
	[0040.908] lstrlenA (lpString="*.bmp") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.gif") returned 0
	[0040.908] lstrlenA (lpString="*.gif") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.png") returned 0
	[0040.908] lstrlenA (lpString="*.png") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.doc") returned 0
	[0040.908] lstrlenA (lpString="*.doc") returned 5
	[0040.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.docx") returned 0
	[0040.908] lstrlenA (lpString="*.docx") returned 6
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.xls") returned 0
	[0040.909] lstrlenA (lpString="*.xls") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.xlsx") returned 0
	[0040.909] lstrlenA (lpString="*.xlsx") returned 6
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ppt") returned 0
	[0040.909] lstrlenA (lpString="*.ppt") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.pptx") returned 0
	[0040.909] lstrlenA (lpString="*.pptx") returned 6
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.txt") returned 0
	[0040.909] lstrlenA (lpString="*.txt") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.pdf") returned 0
	[0040.909] lstrlenA (lpString="*.pdf") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.djvu") returned 0
	[0040.909] lstrlenA (lpString="*.djvu") returned 6
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.htm") returned 0
	[0040.909] lstrlenA (lpString="*.htm") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.html") returned 0
	[0040.909] lstrlenA (lpString="*.html") returned 6
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mdb") returned 0
	[0040.909] lstrlenA (lpString="*.mdb") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.cer") returned 0
	[0040.909] lstrlenA (lpString="*.cer") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.p12") returned 0
	[0040.909] lstrlenA (lpString="*.p12") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.pfx") returned 0
	[0040.909] lstrlenA (lpString="*.pfx") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.kwm") returned 0
	[0040.909] lstrlenA (lpString="*.kwm") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.pwm") returned 0
	[0040.909] lstrlenA (lpString="*.pwm") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.1cd") returned 0
	[0040.909] lstrlenA (lpString="*.1cd") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.md") returned 0
	[0040.909] lstrlenA (lpString="*.md") returned 4
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mdf") returned 0
	[0040.909] lstrlenA (lpString="*.mdf") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.dbf") returned 0
	[0040.909] lstrlenA (lpString="*.dbf") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.odt") returned 0
	[0040.909] lstrlenA (lpString="*.odt") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.vob") returned 0
	[0040.909] lstrlenA (lpString="*.vob") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ifo") returned 0
	[0040.909] lstrlenA (lpString="*.ifo") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.lnk") returned 0
	[0040.909] lstrlenA (lpString="*.lnk") returned 5
	[0040.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.torrent") returned 0
	[0040.910] lstrlenA (lpString="*.torrent") returned 9
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mov") returned 0
	[0040.910] lstrlenA (lpString="*.mov") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.m2v") returned 0
	[0040.910] lstrlenA (lpString="*.m2v") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.3gp") returned 0
	[0040.910] lstrlenA (lpString="*.3gp") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mpeg") returned 0
	[0040.910] lstrlenA (lpString="*.mpeg") returned 6
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mpg") returned 0
	[0040.910] lstrlenA (lpString="*.mpg") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.flv") returned 0
	[0040.910] lstrlenA (lpString="*.flv") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.avi") returned 0
	[0040.910] lstrlenA (lpString="*.avi") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mp4") returned 0
	[0040.910] lstrlenA (lpString="*.mp4") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.wmv") returned 0
	[0040.910] lstrlenA (lpString="*.wmv") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.divx") returned 0
	[0040.910] lstrlenA (lpString="*.divx") returned 6
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mkv") returned 0
	[0040.910] lstrlenA (lpString="*.mkv") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mp3") returned 0
	[0040.910] lstrlenA (lpString="*.mp3") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.wav") returned 0
	[0040.910] lstrlenA (lpString="*.wav") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.flac") returned 0
	[0040.910] lstrlenA (lpString="*.flac") returned 6
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ape") returned 0
	[0040.910] lstrlenA (lpString="*.ape") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.wma") returned 0
	[0040.910] lstrlenA (lpString="*.wma") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ac3") returned 0
	[0040.910] lstrlenA (lpString="*.ac3") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.exe") returned 0
	[0040.910] lstrlenA (lpString="*.exe") returned 5
	[0040.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.apk") returned 0
	[0040.910] lstrlenA (lpString="*.apk") returned 5
	[0040.910] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.910] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.910] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EDGE.INF") returned -1
	[0040.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EDGE.INF") returned 1
	[0040.910] lstrcmpiA (lpString1="", lpString2="EDGE.INF") returned -1
	[0040.911] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned="EDGE.ELM"
	[0040.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\"
	[0040.911] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned=""
	[0040.911] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt"
	[0040.911] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0x20
	[0040.911] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="EDGE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF"
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.zip") returned 0
	[0040.911] lstrlenA (lpString="*.zip") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.rar") returned 0
	[0040.911] lstrlenA (lpString="*.rar") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.7z") returned 0
	[0040.911] lstrlenA (lpString="*.7z") returned 4
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.tar") returned 0
	[0040.911] lstrlenA (lpString="*.tar") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.gzip") returned 0
	[0040.911] lstrlenA (lpString="*.gzip") returned 6
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.jpg") returned 0
	[0040.911] lstrlenA (lpString="*.jpg") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.jpeg") returned 0
	[0040.911] lstrlenA (lpString="*.jpeg") returned 6
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.psd") returned 0
	[0040.911] lstrlenA (lpString="*.psd") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.cdr") returned 0
	[0040.911] lstrlenA (lpString="*.cdr") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.dwg") returned 0
	[0040.911] lstrlenA (lpString="*.dwg") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.max") returned 0
	[0040.911] lstrlenA (lpString="*.max") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.bmp") returned 0
	[0040.911] lstrlenA (lpString="*.bmp") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.gif") returned 0
	[0040.911] lstrlenA (lpString="*.gif") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.png") returned 0
	[0040.911] lstrlenA (lpString="*.png") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.doc") returned 0
	[0040.911] lstrlenA (lpString="*.doc") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.docx") returned 0
	[0040.911] lstrlenA (lpString="*.docx") returned 6
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.xls") returned 0
	[0040.911] lstrlenA (lpString="*.xls") returned 5
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.xlsx") returned 0
	[0040.911] lstrlenA (lpString="*.xlsx") returned 6
	[0040.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.ppt") returned 0
	[0040.912] lstrlenA (lpString="*.ppt") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.pptx") returned 0
	[0040.912] lstrlenA (lpString="*.pptx") returned 6
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.txt") returned 0
	[0040.912] lstrlenA (lpString="*.txt") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.pdf") returned 0
	[0040.912] lstrlenA (lpString="*.pdf") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.djvu") returned 0
	[0040.912] lstrlenA (lpString="*.djvu") returned 6
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.htm") returned 0
	[0040.912] lstrlenA (lpString="*.htm") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.html") returned 0
	[0040.912] lstrlenA (lpString="*.html") returned 6
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mdb") returned 0
	[0040.912] lstrlenA (lpString="*.mdb") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.cer") returned 0
	[0040.912] lstrlenA (lpString="*.cer") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.p12") returned 0
	[0040.912] lstrlenA (lpString="*.p12") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.pfx") returned 0
	[0040.912] lstrlenA (lpString="*.pfx") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.kwm") returned 0
	[0040.912] lstrlenA (lpString="*.kwm") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.pwm") returned 0
	[0040.912] lstrlenA (lpString="*.pwm") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.1cd") returned 0
	[0040.912] lstrlenA (lpString="*.1cd") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.md") returned 0
	[0040.912] lstrlenA (lpString="*.md") returned 4
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mdf") returned 0
	[0040.912] lstrlenA (lpString="*.mdf") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.dbf") returned 0
	[0040.912] lstrlenA (lpString="*.dbf") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.odt") returned 0
	[0040.912] lstrlenA (lpString="*.odt") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.vob") returned 0
	[0040.912] lstrlenA (lpString="*.vob") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.ifo") returned 0
	[0040.912] lstrlenA (lpString="*.ifo") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.lnk") returned 0
	[0040.912] lstrlenA (lpString="*.lnk") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.torrent") returned 0
	[0040.912] lstrlenA (lpString="*.torrent") returned 9
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mov") returned 0
	[0040.912] lstrlenA (lpString="*.mov") returned 5
	[0040.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.m2v") returned 0
	[0040.912] lstrlenA (lpString="*.m2v") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.3gp") returned 0
	[0040.913] lstrlenA (lpString="*.3gp") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mpeg") returned 0
	[0040.913] lstrlenA (lpString="*.mpeg") returned 6
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mpg") returned 0
	[0040.913] lstrlenA (lpString="*.mpg") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.flv") returned 0
	[0040.913] lstrlenA (lpString="*.flv") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.avi") returned 0
	[0040.913] lstrlenA (lpString="*.avi") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mp4") returned 0
	[0040.913] lstrlenA (lpString="*.mp4") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.wmv") returned 0
	[0040.913] lstrlenA (lpString="*.wmv") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.divx") returned 0
	[0040.913] lstrlenA (lpString="*.divx") returned 6
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mkv") returned 0
	[0040.913] lstrlenA (lpString="*.mkv") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mp3") returned 0
	[0040.913] lstrlenA (lpString="*.mp3") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.wav") returned 0
	[0040.913] lstrlenA (lpString="*.wav") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.flac") returned 0
	[0040.913] lstrlenA (lpString="*.flac") returned 6
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.ape") returned 0
	[0040.913] lstrlenA (lpString="*.ape") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.wma") returned 0
	[0040.913] lstrlenA (lpString="*.wma") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.ac3") returned 0
	[0040.913] lstrlenA (lpString="*.ac3") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.exe") returned 0
	[0040.913] lstrlenA (lpString="*.exe") returned 5
	[0040.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.apk") returned 0
	[0040.913] lstrlenA (lpString="*.apk") returned 5
	[0040.913] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.913] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.913] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.913] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.913] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned="EDGE.INF"
	[0040.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\"
	[0040.913] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned=""
	[0040.913] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt"
	[0040.913] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0x20
	[0040.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF"
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.914] lstrlenA (lpString="*.zip") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.914] lstrlenA (lpString="*.rar") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.914] lstrlenA (lpString="*.7z") returned 4
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.914] lstrlenA (lpString="*.tar") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.914] lstrlenA (lpString="*.gzip") returned 6
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.914] lstrlenA (lpString="*.jpg") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.914] lstrlenA (lpString="*.jpeg") returned 6
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.914] lstrlenA (lpString="*.psd") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.914] lstrlenA (lpString="*.cdr") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.914] lstrlenA (lpString="*.dwg") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.914] lstrlenA (lpString="*.max") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.914] lstrlenA (lpString="*.bmp") returned 5
	[0040.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.914] lstrlenA (lpString="*.gif") returned 5
	[0040.914] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF"
	[0040.914] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF"
	[0040.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF."
	[0040.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.Boom"
	[0040.914] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.915] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x543
	[0040.915] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.915] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.915] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x520, lpOverlapped=0x0) returned 1
	[0040.916] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.916] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.916] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x520, lpOverlapped=0x0) returned 1
	[0040.916] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.916] CloseHandle (hObject=0x90) returned 1
	[0040.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.boom")) returned 1
	[0040.919] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.919] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.919] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.919] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.919] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\"
	[0040.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned=""
	[0040.919] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt"
	[0040.919] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0x20
	[0040.919] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG"
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.919] lstrlenA (lpString="*.zip") returned 5
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.919] lstrlenA (lpString="*.rar") returned 5
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.919] lstrlenA (lpString="*.7z") returned 4
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.919] lstrlenA (lpString="*.tar") returned 5
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.919] lstrlenA (lpString="*.gzip") returned 6
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.919] lstrlenA (lpString="*.jpg") returned 5
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.919] lstrlenA (lpString="*.jpeg") returned 6
	[0040.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.920] lstrlenA (lpString="*.psd") returned 5
	[0040.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.920] lstrlenA (lpString="*.cdr") returned 5
	[0040.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.920] lstrlenA (lpString="*.dwg") returned 5
	[0040.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.920] lstrlenA (lpString="*.max") returned 5
	[0040.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.920] lstrlenA (lpString="*.bmp") returned 5
	[0040.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.920] lstrlenA (lpString="*.gif") returned 5
	[0040.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.920] lstrlenA (lpString="*.png") returned 5
	[0040.920] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG"
	[0040.920] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG"
	[0040.920] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG."
	[0040.920] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.Boom"
	[0040.920] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.920] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6722
	[0040.920] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.920] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.920] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x66ff, lpOverlapped=0x0) returned 1
	[0040.932] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.932] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.933] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x66ff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x66ff, lpOverlapped=0x0) returned 1
	[0040.933] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.933] CloseHandle (hObject=0x90) returned 1
	[0040.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.boom")) returned 1
	[0040.934] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.934] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0040.934] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.934] lstrcmpA (lpString1=".", lpString2="EVRGREEN") returned -1
	[0040.934] lstrcmpA (lpString1="..", lpString2="EVRGREEN") returned -1
	[0040.935] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.935] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="EVRGREEN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN"
	[0040.935] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN") returned 64
	[0040.935] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.943] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.943] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.944] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.944] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.944] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.944] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.944] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EVRGREEN.ELM") returned -1
	[0040.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EVRGREEN.ELM") returned 1
	[0040.944] lstrcmpiA (lpString1="", lpString2="EVRGREEN.ELM") returned -1
	[0040.944] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*") returned="*.*"
	[0040.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\"
	[0040.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned=""
	[0040.944] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt"
	[0040.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0xffffffff
	[0040.944] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.945] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.945] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.946] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.946] CloseHandle (hObject=0x90) returned 1
	[0040.947] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="EVRGREEN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM"
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.zip") returned 0
	[0040.947] lstrlenA (lpString="*.zip") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.rar") returned 0
	[0040.947] lstrlenA (lpString="*.rar") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.7z") returned 0
	[0040.947] lstrlenA (lpString="*.7z") returned 4
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.tar") returned 0
	[0040.947] lstrlenA (lpString="*.tar") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.gzip") returned 0
	[0040.947] lstrlenA (lpString="*.gzip") returned 6
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.jpg") returned 0
	[0040.947] lstrlenA (lpString="*.jpg") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.jpeg") returned 0
	[0040.947] lstrlenA (lpString="*.jpeg") returned 6
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.psd") returned 0
	[0040.947] lstrlenA (lpString="*.psd") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.cdr") returned 0
	[0040.947] lstrlenA (lpString="*.cdr") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.dwg") returned 0
	[0040.947] lstrlenA (lpString="*.dwg") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.max") returned 0
	[0040.947] lstrlenA (lpString="*.max") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.bmp") returned 0
	[0040.947] lstrlenA (lpString="*.bmp") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.gif") returned 0
	[0040.947] lstrlenA (lpString="*.gif") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.png") returned 0
	[0040.947] lstrlenA (lpString="*.png") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.doc") returned 0
	[0040.947] lstrlenA (lpString="*.doc") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.docx") returned 0
	[0040.947] lstrlenA (lpString="*.docx") returned 6
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.xls") returned 0
	[0040.947] lstrlenA (lpString="*.xls") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.xlsx") returned 0
	[0040.947] lstrlenA (lpString="*.xlsx") returned 6
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ppt") returned 0
	[0040.947] lstrlenA (lpString="*.ppt") returned 5
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.pptx") returned 0
	[0040.947] lstrlenA (lpString="*.pptx") returned 6
	[0040.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.txt") returned 0
	[0040.948] lstrlenA (lpString="*.txt") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.pdf") returned 0
	[0040.948] lstrlenA (lpString="*.pdf") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.djvu") returned 0
	[0040.948] lstrlenA (lpString="*.djvu") returned 6
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.htm") returned 0
	[0040.948] lstrlenA (lpString="*.htm") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.html") returned 0
	[0040.948] lstrlenA (lpString="*.html") returned 6
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mdb") returned 0
	[0040.948] lstrlenA (lpString="*.mdb") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.cer") returned 0
	[0040.948] lstrlenA (lpString="*.cer") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.p12") returned 0
	[0040.948] lstrlenA (lpString="*.p12") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.pfx") returned 0
	[0040.948] lstrlenA (lpString="*.pfx") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.kwm") returned 0
	[0040.948] lstrlenA (lpString="*.kwm") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.pwm") returned 0
	[0040.948] lstrlenA (lpString="*.pwm") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.1cd") returned 0
	[0040.948] lstrlenA (lpString="*.1cd") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.md") returned 0
	[0040.948] lstrlenA (lpString="*.md") returned 4
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mdf") returned 0
	[0040.948] lstrlenA (lpString="*.mdf") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.dbf") returned 0
	[0040.948] lstrlenA (lpString="*.dbf") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.odt") returned 0
	[0040.948] lstrlenA (lpString="*.odt") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.vob") returned 0
	[0040.948] lstrlenA (lpString="*.vob") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ifo") returned 0
	[0040.948] lstrlenA (lpString="*.ifo") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.lnk") returned 0
	[0040.948] lstrlenA (lpString="*.lnk") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.torrent") returned 0
	[0040.948] lstrlenA (lpString="*.torrent") returned 9
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mov") returned 0
	[0040.948] lstrlenA (lpString="*.mov") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.m2v") returned 0
	[0040.948] lstrlenA (lpString="*.m2v") returned 5
	[0040.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.3gp") returned 0
	[0040.948] lstrlenA (lpString="*.3gp") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mpeg") returned 0
	[0040.949] lstrlenA (lpString="*.mpeg") returned 6
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mpg") returned 0
	[0040.949] lstrlenA (lpString="*.mpg") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.flv") returned 0
	[0040.949] lstrlenA (lpString="*.flv") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.avi") returned 0
	[0040.949] lstrlenA (lpString="*.avi") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mp4") returned 0
	[0040.949] lstrlenA (lpString="*.mp4") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.wmv") returned 0
	[0040.949] lstrlenA (lpString="*.wmv") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.divx") returned 0
	[0040.949] lstrlenA (lpString="*.divx") returned 6
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mkv") returned 0
	[0040.949] lstrlenA (lpString="*.mkv") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mp3") returned 0
	[0040.949] lstrlenA (lpString="*.mp3") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.wav") returned 0
	[0040.949] lstrlenA (lpString="*.wav") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.flac") returned 0
	[0040.949] lstrlenA (lpString="*.flac") returned 6
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ape") returned 0
	[0040.949] lstrlenA (lpString="*.ape") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.wma") returned 0
	[0040.949] lstrlenA (lpString="*.wma") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ac3") returned 0
	[0040.949] lstrlenA (lpString="*.ac3") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.exe") returned 0
	[0040.949] lstrlenA (lpString="*.exe") returned 5
	[0040.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.apk") returned 0
	[0040.949] lstrlenA (lpString="*.apk") returned 5
	[0040.949] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.949] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.949] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EVRGREEN.INF") returned -1
	[0040.949] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EVRGREEN.INF") returned 1
	[0040.949] lstrcmpiA (lpString1="", lpString2="EVRGREEN.INF") returned -1
	[0040.949] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned="EVRGREEN.ELM"
	[0040.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\"
	[0040.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned=""
	[0040.949] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt"
	[0040.949] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0x20
	[0040.950] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="EVRGREEN.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF"
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.zip") returned 0
	[0040.950] lstrlenA (lpString="*.zip") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.rar") returned 0
	[0040.950] lstrlenA (lpString="*.rar") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.7z") returned 0
	[0040.950] lstrlenA (lpString="*.7z") returned 4
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.tar") returned 0
	[0040.950] lstrlenA (lpString="*.tar") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.gzip") returned 0
	[0040.950] lstrlenA (lpString="*.gzip") returned 6
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.jpg") returned 0
	[0040.950] lstrlenA (lpString="*.jpg") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.jpeg") returned 0
	[0040.950] lstrlenA (lpString="*.jpeg") returned 6
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.psd") returned 0
	[0040.950] lstrlenA (lpString="*.psd") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.cdr") returned 0
	[0040.950] lstrlenA (lpString="*.cdr") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.dwg") returned 0
	[0040.950] lstrlenA (lpString="*.dwg") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.max") returned 0
	[0040.950] lstrlenA (lpString="*.max") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.bmp") returned 0
	[0040.950] lstrlenA (lpString="*.bmp") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.gif") returned 0
	[0040.950] lstrlenA (lpString="*.gif") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.png") returned 0
	[0040.950] lstrlenA (lpString="*.png") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.doc") returned 0
	[0040.950] lstrlenA (lpString="*.doc") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.docx") returned 0
	[0040.950] lstrlenA (lpString="*.docx") returned 6
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.xls") returned 0
	[0040.950] lstrlenA (lpString="*.xls") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.xlsx") returned 0
	[0040.950] lstrlenA (lpString="*.xlsx") returned 6
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.ppt") returned 0
	[0040.950] lstrlenA (lpString="*.ppt") returned 5
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.pptx") returned 0
	[0040.950] lstrlenA (lpString="*.pptx") returned 6
	[0040.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.txt") returned 0
	[0040.950] lstrlenA (lpString="*.txt") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.pdf") returned 0
	[0040.951] lstrlenA (lpString="*.pdf") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.djvu") returned 0
	[0040.951] lstrlenA (lpString="*.djvu") returned 6
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.htm") returned 0
	[0040.951] lstrlenA (lpString="*.htm") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.html") returned 0
	[0040.951] lstrlenA (lpString="*.html") returned 6
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mdb") returned 0
	[0040.951] lstrlenA (lpString="*.mdb") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.cer") returned 0
	[0040.951] lstrlenA (lpString="*.cer") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.p12") returned 0
	[0040.951] lstrlenA (lpString="*.p12") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.pfx") returned 0
	[0040.951] lstrlenA (lpString="*.pfx") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.kwm") returned 0
	[0040.951] lstrlenA (lpString="*.kwm") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.pwm") returned 0
	[0040.951] lstrlenA (lpString="*.pwm") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.1cd") returned 0
	[0040.951] lstrlenA (lpString="*.1cd") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.md") returned 0
	[0040.951] lstrlenA (lpString="*.md") returned 4
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mdf") returned 0
	[0040.951] lstrlenA (lpString="*.mdf") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.dbf") returned 0
	[0040.951] lstrlenA (lpString="*.dbf") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.odt") returned 0
	[0040.951] lstrlenA (lpString="*.odt") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.vob") returned 0
	[0040.951] lstrlenA (lpString="*.vob") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.ifo") returned 0
	[0040.951] lstrlenA (lpString="*.ifo") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.lnk") returned 0
	[0040.951] lstrlenA (lpString="*.lnk") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.torrent") returned 0
	[0040.951] lstrlenA (lpString="*.torrent") returned 9
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mov") returned 0
	[0040.951] lstrlenA (lpString="*.mov") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.m2v") returned 0
	[0040.951] lstrlenA (lpString="*.m2v") returned 5
	[0040.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.3gp") returned 0
	[0040.951] lstrlenA (lpString="*.3gp") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mpeg") returned 0
	[0040.952] lstrlenA (lpString="*.mpeg") returned 6
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mpg") returned 0
	[0040.952] lstrlenA (lpString="*.mpg") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.flv") returned 0
	[0040.952] lstrlenA (lpString="*.flv") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.avi") returned 0
	[0040.952] lstrlenA (lpString="*.avi") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mp4") returned 0
	[0040.952] lstrlenA (lpString="*.mp4") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.wmv") returned 0
	[0040.952] lstrlenA (lpString="*.wmv") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.divx") returned 0
	[0040.952] lstrlenA (lpString="*.divx") returned 6
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mkv") returned 0
	[0040.952] lstrlenA (lpString="*.mkv") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mp3") returned 0
	[0040.952] lstrlenA (lpString="*.mp3") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.wav") returned 0
	[0040.952] lstrlenA (lpString="*.wav") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.flac") returned 0
	[0040.952] lstrlenA (lpString="*.flac") returned 6
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.ape") returned 0
	[0040.952] lstrlenA (lpString="*.ape") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.wma") returned 0
	[0040.952] lstrlenA (lpString="*.wma") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.ac3") returned 0
	[0040.952] lstrlenA (lpString="*.ac3") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.exe") returned 0
	[0040.952] lstrlenA (lpString="*.exe") returned 5
	[0040.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.apk") returned 0
	[0040.952] lstrlenA (lpString="*.apk") returned 5
	[0040.952] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.952] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.952] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.952] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned="EVRGREEN.INF"
	[0040.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\"
	[0040.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned=""
	[0040.952] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt"
	[0040.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0x20
	[0040.953] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF"
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.953] lstrlenA (lpString="*.zip") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.953] lstrlenA (lpString="*.rar") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.953] lstrlenA (lpString="*.7z") returned 4
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.953] lstrlenA (lpString="*.tar") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.953] lstrlenA (lpString="*.gzip") returned 6
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.953] lstrlenA (lpString="*.jpg") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.953] lstrlenA (lpString="*.jpeg") returned 6
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.953] lstrlenA (lpString="*.psd") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.953] lstrlenA (lpString="*.cdr") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.953] lstrlenA (lpString="*.dwg") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.953] lstrlenA (lpString="*.max") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.953] lstrlenA (lpString="*.bmp") returned 5
	[0040.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.953] lstrlenA (lpString="*.gif") returned 5
	[0040.953] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF"
	[0040.953] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF"
	[0040.953] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF."
	[0040.953] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.Boom"
	[0040.953] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.953] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54a
	[0040.954] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.954] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.954] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x527, lpOverlapped=0x0) returned 1
	[0040.979] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.979] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.979] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x527, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x527, lpOverlapped=0x0) returned 1
	[0040.979] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.979] CloseHandle (hObject=0x90) returned 1
	[0040.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.boom")) returned 1
	[0040.980] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.981] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0040.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0040.981] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0040.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0040.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\"
	[0040.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned=""
	[0040.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt"
	[0040.981] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0x20
	[0040.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG"
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0040.981] lstrlenA (lpString="*.zip") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0040.981] lstrlenA (lpString="*.rar") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0040.981] lstrlenA (lpString="*.7z") returned 4
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0040.981] lstrlenA (lpString="*.tar") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0040.981] lstrlenA (lpString="*.gzip") returned 6
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0040.981] lstrlenA (lpString="*.jpg") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0040.981] lstrlenA (lpString="*.jpeg") returned 6
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0040.981] lstrlenA (lpString="*.psd") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0040.981] lstrlenA (lpString="*.cdr") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0040.981] lstrlenA (lpString="*.dwg") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0040.981] lstrlenA (lpString="*.max") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0040.981] lstrlenA (lpString="*.bmp") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0040.981] lstrlenA (lpString="*.gif") returned 5
	[0040.981] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0040.981] lstrlenA (lpString="*.png") returned 5
	[0040.982] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG"
	[0040.982] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG"
	[0040.982] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG."
	[0040.982] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.Boom"
	[0040.982] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.982] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7eb1
	[0040.982] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.982] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.982] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7e8e, lpOverlapped=0x0) returned 1
	[0040.983] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0040.983] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.983] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7e8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7e8e, lpOverlapped=0x0) returned 1
	[0040.983] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0040.984] CloseHandle (hObject=0x90) returned 1
	[0040.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.boom")) returned 1
	[0040.985] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0040.985] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0040.985] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0040.985] lstrcmpA (lpString1=".", lpString2="EXPEDITN") returned -1
	[0040.985] lstrcmpA (lpString1="..", lpString2="EXPEDITN") returned -1
	[0040.985] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0040.985] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="EXPEDITN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN"
	[0040.985] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN") returned 64
	[0040.985] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba480
	[0040.985] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0040.985] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.985] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0040.985] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0040.985] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.986] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXPEDITN.ELM") returned -1
	[0040.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPEDITN.ELM") returned 1
	[0040.986] lstrcmpiA (lpString1="", lpString2="EXPEDITN.ELM") returned -1
	[0040.986] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*") returned="*.*"
	[0040.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\"
	[0040.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned=""
	[0040.986] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt"
	[0040.986] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0xffffffff
	[0040.986] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.991] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0040.991] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0040.991] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0040.991] CloseHandle (hObject=0x90) returned 1
	[0040.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="EXPEDITN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM"
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.zip") returned 0
	[0040.992] lstrlenA (lpString="*.zip") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.rar") returned 0
	[0040.992] lstrlenA (lpString="*.rar") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.7z") returned 0
	[0040.992] lstrlenA (lpString="*.7z") returned 4
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.tar") returned 0
	[0040.992] lstrlenA (lpString="*.tar") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.gzip") returned 0
	[0040.992] lstrlenA (lpString="*.gzip") returned 6
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.jpg") returned 0
	[0040.992] lstrlenA (lpString="*.jpg") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.jpeg") returned 0
	[0040.992] lstrlenA (lpString="*.jpeg") returned 6
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.psd") returned 0
	[0040.992] lstrlenA (lpString="*.psd") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.cdr") returned 0
	[0040.992] lstrlenA (lpString="*.cdr") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.dwg") returned 0
	[0040.992] lstrlenA (lpString="*.dwg") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.max") returned 0
	[0040.992] lstrlenA (lpString="*.max") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.bmp") returned 0
	[0040.992] lstrlenA (lpString="*.bmp") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.gif") returned 0
	[0040.992] lstrlenA (lpString="*.gif") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.png") returned 0
	[0040.992] lstrlenA (lpString="*.png") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.doc") returned 0
	[0040.992] lstrlenA (lpString="*.doc") returned 5
	[0040.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.docx") returned 0
	[0040.993] lstrlenA (lpString="*.docx") returned 6
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.xls") returned 0
	[0040.993] lstrlenA (lpString="*.xls") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.xlsx") returned 0
	[0040.993] lstrlenA (lpString="*.xlsx") returned 6
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ppt") returned 0
	[0040.993] lstrlenA (lpString="*.ppt") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.pptx") returned 0
	[0040.993] lstrlenA (lpString="*.pptx") returned 6
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.txt") returned 0
	[0040.993] lstrlenA (lpString="*.txt") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.pdf") returned 0
	[0040.993] lstrlenA (lpString="*.pdf") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.djvu") returned 0
	[0040.993] lstrlenA (lpString="*.djvu") returned 6
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.htm") returned 0
	[0040.993] lstrlenA (lpString="*.htm") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.html") returned 0
	[0040.993] lstrlenA (lpString="*.html") returned 6
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mdb") returned 0
	[0040.993] lstrlenA (lpString="*.mdb") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.cer") returned 0
	[0040.993] lstrlenA (lpString="*.cer") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.p12") returned 0
	[0040.993] lstrlenA (lpString="*.p12") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.pfx") returned 0
	[0040.993] lstrlenA (lpString="*.pfx") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.kwm") returned 0
	[0040.993] lstrlenA (lpString="*.kwm") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.pwm") returned 0
	[0040.993] lstrlenA (lpString="*.pwm") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.1cd") returned 0
	[0040.993] lstrlenA (lpString="*.1cd") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.md") returned 0
	[0040.993] lstrlenA (lpString="*.md") returned 4
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mdf") returned 0
	[0040.993] lstrlenA (lpString="*.mdf") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.dbf") returned 0
	[0040.993] lstrlenA (lpString="*.dbf") returned 5
	[0040.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.odt") returned 0
	[0040.993] lstrlenA (lpString="*.odt") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.vob") returned 0
	[0040.994] lstrlenA (lpString="*.vob") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ifo") returned 0
	[0040.994] lstrlenA (lpString="*.ifo") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.lnk") returned 0
	[0040.994] lstrlenA (lpString="*.lnk") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.torrent") returned 0
	[0040.994] lstrlenA (lpString="*.torrent") returned 9
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mov") returned 0
	[0040.994] lstrlenA (lpString="*.mov") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.m2v") returned 0
	[0040.994] lstrlenA (lpString="*.m2v") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.3gp") returned 0
	[0040.994] lstrlenA (lpString="*.3gp") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mpeg") returned 0
	[0040.994] lstrlenA (lpString="*.mpeg") returned 6
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mpg") returned 0
	[0040.994] lstrlenA (lpString="*.mpg") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.flv") returned 0
	[0040.994] lstrlenA (lpString="*.flv") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.avi") returned 0
	[0040.994] lstrlenA (lpString="*.avi") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mp4") returned 0
	[0040.994] lstrlenA (lpString="*.mp4") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.wmv") returned 0
	[0040.994] lstrlenA (lpString="*.wmv") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.divx") returned 0
	[0040.994] lstrlenA (lpString="*.divx") returned 6
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mkv") returned 0
	[0040.994] lstrlenA (lpString="*.mkv") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mp3") returned 0
	[0040.994] lstrlenA (lpString="*.mp3") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.wav") returned 0
	[0040.994] lstrlenA (lpString="*.wav") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.flac") returned 0
	[0040.994] lstrlenA (lpString="*.flac") returned 6
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ape") returned 0
	[0040.994] lstrlenA (lpString="*.ape") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.wma") returned 0
	[0040.994] lstrlenA (lpString="*.wma") returned 5
	[0040.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ac3") returned 0
	[0040.994] lstrlenA (lpString="*.ac3") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.exe") returned 0
	[0040.995] lstrlenA (lpString="*.exe") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.apk") returned 0
	[0040.995] lstrlenA (lpString="*.apk") returned 5
	[0040.995] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.995] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXPEDITN.INF") returned -1
	[0040.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPEDITN.INF") returned 1
	[0040.995] lstrcmpiA (lpString1="", lpString2="EXPEDITN.INF") returned -1
	[0040.995] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned="EXPEDITN.ELM"
	[0040.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\"
	[0040.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned=""
	[0040.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt"
	[0040.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0x20
	[0040.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="EXPEDITN.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF"
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.zip") returned 0
	[0040.995] lstrlenA (lpString="*.zip") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.rar") returned 0
	[0040.995] lstrlenA (lpString="*.rar") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.7z") returned 0
	[0040.995] lstrlenA (lpString="*.7z") returned 4
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.tar") returned 0
	[0040.995] lstrlenA (lpString="*.tar") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.gzip") returned 0
	[0040.995] lstrlenA (lpString="*.gzip") returned 6
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.jpg") returned 0
	[0040.995] lstrlenA (lpString="*.jpg") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.jpeg") returned 0
	[0040.995] lstrlenA (lpString="*.jpeg") returned 6
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.psd") returned 0
	[0040.995] lstrlenA (lpString="*.psd") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.cdr") returned 0
	[0040.995] lstrlenA (lpString="*.cdr") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.dwg") returned 0
	[0040.995] lstrlenA (lpString="*.dwg") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.max") returned 0
	[0040.995] lstrlenA (lpString="*.max") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.bmp") returned 0
	[0040.995] lstrlenA (lpString="*.bmp") returned 5
	[0040.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.gif") returned 0
	[0040.996] lstrlenA (lpString="*.gif") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.png") returned 0
	[0040.996] lstrlenA (lpString="*.png") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.doc") returned 0
	[0040.996] lstrlenA (lpString="*.doc") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.docx") returned 0
	[0040.996] lstrlenA (lpString="*.docx") returned 6
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.xls") returned 0
	[0040.996] lstrlenA (lpString="*.xls") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.xlsx") returned 0
	[0040.996] lstrlenA (lpString="*.xlsx") returned 6
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.ppt") returned 0
	[0040.996] lstrlenA (lpString="*.ppt") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.pptx") returned 0
	[0040.996] lstrlenA (lpString="*.pptx") returned 6
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.txt") returned 0
	[0040.996] lstrlenA (lpString="*.txt") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.pdf") returned 0
	[0040.996] lstrlenA (lpString="*.pdf") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.djvu") returned 0
	[0040.996] lstrlenA (lpString="*.djvu") returned 6
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.htm") returned 0
	[0040.996] lstrlenA (lpString="*.htm") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.html") returned 0
	[0040.996] lstrlenA (lpString="*.html") returned 6
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mdb") returned 0
	[0040.996] lstrlenA (lpString="*.mdb") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.cer") returned 0
	[0040.996] lstrlenA (lpString="*.cer") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.p12") returned 0
	[0040.996] lstrlenA (lpString="*.p12") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.pfx") returned 0
	[0040.996] lstrlenA (lpString="*.pfx") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.kwm") returned 0
	[0040.996] lstrlenA (lpString="*.kwm") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.pwm") returned 0
	[0040.996] lstrlenA (lpString="*.pwm") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.1cd") returned 0
	[0040.996] lstrlenA (lpString="*.1cd") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.md") returned 0
	[0040.996] lstrlenA (lpString="*.md") returned 4
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mdf") returned 0
	[0040.996] lstrlenA (lpString="*.mdf") returned 5
	[0040.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.dbf") returned 0
	[0040.997] lstrlenA (lpString="*.dbf") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.odt") returned 0
	[0040.997] lstrlenA (lpString="*.odt") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.vob") returned 0
	[0040.997] lstrlenA (lpString="*.vob") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.ifo") returned 0
	[0040.997] lstrlenA (lpString="*.ifo") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.lnk") returned 0
	[0040.997] lstrlenA (lpString="*.lnk") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.torrent") returned 0
	[0040.997] lstrlenA (lpString="*.torrent") returned 9
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mov") returned 0
	[0040.997] lstrlenA (lpString="*.mov") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.m2v") returned 0
	[0040.997] lstrlenA (lpString="*.m2v") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.3gp") returned 0
	[0040.997] lstrlenA (lpString="*.3gp") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mpeg") returned 0
	[0040.997] lstrlenA (lpString="*.mpeg") returned 6
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mpg") returned 0
	[0040.997] lstrlenA (lpString="*.mpg") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.flv") returned 0
	[0040.997] lstrlenA (lpString="*.flv") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.avi") returned 0
	[0040.997] lstrlenA (lpString="*.avi") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mp4") returned 0
	[0040.997] lstrlenA (lpString="*.mp4") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.wmv") returned 0
	[0040.997] lstrlenA (lpString="*.wmv") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.divx") returned 0
	[0040.997] lstrlenA (lpString="*.divx") returned 6
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mkv") returned 0
	[0040.997] lstrlenA (lpString="*.mkv") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mp3") returned 0
	[0040.997] lstrlenA (lpString="*.mp3") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.wav") returned 0
	[0040.997] lstrlenA (lpString="*.wav") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.flac") returned 0
	[0040.997] lstrlenA (lpString="*.flac") returned 6
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.ape") returned 0
	[0040.997] lstrlenA (lpString="*.ape") returned 5
	[0040.997] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.wma") returned 0
	[0040.997] lstrlenA (lpString="*.wma") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.ac3") returned 0
	[0040.998] lstrlenA (lpString="*.ac3") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.exe") returned 0
	[0040.998] lstrlenA (lpString="*.exe") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.apk") returned 0
	[0040.998] lstrlenA (lpString="*.apk") returned 5
	[0040.998] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0040.998] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0040.998] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0040.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0040.998] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0040.998] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned="EXPEDITN.INF"
	[0040.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\"
	[0040.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned=""
	[0040.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt"
	[0040.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0x20
	[0040.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF"
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0040.998] lstrlenA (lpString="*.zip") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0040.998] lstrlenA (lpString="*.rar") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0040.998] lstrlenA (lpString="*.7z") returned 4
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0040.998] lstrlenA (lpString="*.tar") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0040.998] lstrlenA (lpString="*.gzip") returned 6
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0040.998] lstrlenA (lpString="*.jpg") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0040.998] lstrlenA (lpString="*.jpeg") returned 6
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0040.998] lstrlenA (lpString="*.psd") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0040.998] lstrlenA (lpString="*.cdr") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0040.998] lstrlenA (lpString="*.dwg") returned 5
	[0040.998] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0040.998] lstrlenA (lpString="*.max") returned 5
	[0040.999] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0040.999] lstrlenA (lpString="*.bmp") returned 5
	[0040.999] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0040.999] lstrlenA (lpString="*.gif") returned 5
	[0040.999] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF"
	[0040.999] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF"
	[0040.999] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF."
	[0040.999] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.Boom"
	[0040.999] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0040.999] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1400
	[0040.999] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0040.999] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0040.999] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x13dd, lpOverlapped=0x0) returned 1
	[0041.000] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.000] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.000] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x13dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x13dd, lpOverlapped=0x0) returned 1
	[0041.000] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.000] CloseHandle (hObject=0x90) returned 1
	[0041.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.boom")) returned 1
	[0041.001] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.001] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.001] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.002] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.002] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\"
	[0041.002] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned=""
	[0041.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt"
	[0041.002] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0x20
	[0041.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG"
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.002] lstrlenA (lpString="*.zip") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.002] lstrlenA (lpString="*.rar") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.002] lstrlenA (lpString="*.7z") returned 4
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.002] lstrlenA (lpString="*.tar") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.002] lstrlenA (lpString="*.gzip") returned 6
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.002] lstrlenA (lpString="*.jpg") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.002] lstrlenA (lpString="*.jpeg") returned 6
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.002] lstrlenA (lpString="*.psd") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.002] lstrlenA (lpString="*.cdr") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.002] lstrlenA (lpString="*.dwg") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.002] lstrlenA (lpString="*.max") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.002] lstrlenA (lpString="*.bmp") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.002] lstrlenA (lpString="*.gif") returned 5
	[0041.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.002] lstrlenA (lpString="*.png") returned 5
	[0041.002] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG"
	[0041.002] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG"
	[0041.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG."
	[0041.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.Boom"
	[0041.003] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.003] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed34
	[0041.003] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.003] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.003] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xed11, lpOverlapped=0x0) returned 1
	[0041.005] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.005] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.005] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xed11, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xed11, lpOverlapped=0x0) returned 1
	[0041.005] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.005] CloseHandle (hObject=0x90) returned 1
	[0041.006] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.boom")) returned 1
	[0041.007] FindNextFileA (in: hFindFile=0x8ba480, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.007] FindClose (in: hFindFile=0x8ba480 | out: hFindFile=0x8ba480) returned 1
	[0041.007] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.007] lstrcmpA (lpString1=".", lpString2="ICE") returned -1
	[0041.007] lstrcmpA (lpString1="..", lpString2="ICE") returned -1
	[0041.007] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ICE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE"
	[0041.007] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned 59
	[0041.007] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba470
	[0041.008] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.008] FindNextFileA (in: hFindFile=0x8ba470, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.008] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.008] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.008] FindNextFileA (in: hFindFile=0x8ba470, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.008] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.008] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ICE.ELM") returned -1
	[0041.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ICE.ELM") returned -1
	[0041.008] lstrcmpiA (lpString1="", lpString2="ICE.ELM") returned -1
	[0041.008] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*") returned="*.*"
	[0041.008] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\"
	[0041.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned=""
	[0041.008] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt"
	[0041.008] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0xffffffff
	[0041.008] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.008] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.008] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.009] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.009] CloseHandle (hObject=0x90) returned 1
	[0041.009] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="ICE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM"
	[0041.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.zip") returned 0
	[0041.009] lstrlenA (lpString="*.zip") returned 5
	[0041.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.rar") returned 0
	[0041.009] lstrlenA (lpString="*.rar") returned 5
	[0041.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.7z") returned 0
	[0041.009] lstrlenA (lpString="*.7z") returned 4
	[0041.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.tar") returned 0
	[0041.009] lstrlenA (lpString="*.tar") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.gzip") returned 0
	[0041.010] lstrlenA (lpString="*.gzip") returned 6
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.jpg") returned 0
	[0041.010] lstrlenA (lpString="*.jpg") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.jpeg") returned 0
	[0041.010] lstrlenA (lpString="*.jpeg") returned 6
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.psd") returned 0
	[0041.010] lstrlenA (lpString="*.psd") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.cdr") returned 0
	[0041.010] lstrlenA (lpString="*.cdr") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.dwg") returned 0
	[0041.010] lstrlenA (lpString="*.dwg") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.max") returned 0
	[0041.010] lstrlenA (lpString="*.max") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.bmp") returned 0
	[0041.010] lstrlenA (lpString="*.bmp") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.gif") returned 0
	[0041.010] lstrlenA (lpString="*.gif") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.png") returned 0
	[0041.010] lstrlenA (lpString="*.png") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.doc") returned 0
	[0041.010] lstrlenA (lpString="*.doc") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.docx") returned 0
	[0041.010] lstrlenA (lpString="*.docx") returned 6
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.xls") returned 0
	[0041.010] lstrlenA (lpString="*.xls") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.xlsx") returned 0
	[0041.010] lstrlenA (lpString="*.xlsx") returned 6
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ppt") returned 0
	[0041.010] lstrlenA (lpString="*.ppt") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.pptx") returned 0
	[0041.010] lstrlenA (lpString="*.pptx") returned 6
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.txt") returned 0
	[0041.010] lstrlenA (lpString="*.txt") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.pdf") returned 0
	[0041.010] lstrlenA (lpString="*.pdf") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.djvu") returned 0
	[0041.010] lstrlenA (lpString="*.djvu") returned 6
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.htm") returned 0
	[0041.010] lstrlenA (lpString="*.htm") returned 5
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.html") returned 0
	[0041.010] lstrlenA (lpString="*.html") returned 6
	[0041.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mdb") returned 0
	[0041.011] lstrlenA (lpString="*.mdb") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.cer") returned 0
	[0041.011] lstrlenA (lpString="*.cer") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.p12") returned 0
	[0041.011] lstrlenA (lpString="*.p12") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.pfx") returned 0
	[0041.011] lstrlenA (lpString="*.pfx") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.kwm") returned 0
	[0041.011] lstrlenA (lpString="*.kwm") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.pwm") returned 0
	[0041.011] lstrlenA (lpString="*.pwm") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.1cd") returned 0
	[0041.011] lstrlenA (lpString="*.1cd") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.md") returned 0
	[0041.011] lstrlenA (lpString="*.md") returned 4
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mdf") returned 0
	[0041.011] lstrlenA (lpString="*.mdf") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.dbf") returned 0
	[0041.011] lstrlenA (lpString="*.dbf") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.odt") returned 0
	[0041.011] lstrlenA (lpString="*.odt") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.vob") returned 0
	[0041.011] lstrlenA (lpString="*.vob") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ifo") returned 0
	[0041.011] lstrlenA (lpString="*.ifo") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.lnk") returned 0
	[0041.011] lstrlenA (lpString="*.lnk") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.torrent") returned 0
	[0041.011] lstrlenA (lpString="*.torrent") returned 9
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mov") returned 0
	[0041.011] lstrlenA (lpString="*.mov") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.m2v") returned 0
	[0041.011] lstrlenA (lpString="*.m2v") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.3gp") returned 0
	[0041.011] lstrlenA (lpString="*.3gp") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mpeg") returned 0
	[0041.011] lstrlenA (lpString="*.mpeg") returned 6
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mpg") returned 0
	[0041.011] lstrlenA (lpString="*.mpg") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.flv") returned 0
	[0041.011] lstrlenA (lpString="*.flv") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.avi") returned 0
	[0041.011] lstrlenA (lpString="*.avi") returned 5
	[0041.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mp4") returned 0
	[0041.011] lstrlenA (lpString="*.mp4") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.wmv") returned 0
	[0041.012] lstrlenA (lpString="*.wmv") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.divx") returned 0
	[0041.012] lstrlenA (lpString="*.divx") returned 6
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mkv") returned 0
	[0041.012] lstrlenA (lpString="*.mkv") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mp3") returned 0
	[0041.012] lstrlenA (lpString="*.mp3") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.wav") returned 0
	[0041.012] lstrlenA (lpString="*.wav") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.flac") returned 0
	[0041.012] lstrlenA (lpString="*.flac") returned 6
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ape") returned 0
	[0041.012] lstrlenA (lpString="*.ape") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.wma") returned 0
	[0041.012] lstrlenA (lpString="*.wma") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ac3") returned 0
	[0041.012] lstrlenA (lpString="*.ac3") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.exe") returned 0
	[0041.012] lstrlenA (lpString="*.exe") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.apk") returned 0
	[0041.012] lstrlenA (lpString="*.apk") returned 5
	[0041.012] FindNextFileA (in: hFindFile=0x8ba470, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.012] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.012] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ICE.INF") returned -1
	[0041.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ICE.INF") returned -1
	[0041.012] lstrcmpiA (lpString1="", lpString2="ICE.INF") returned -1
	[0041.012] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned="ICE.ELM"
	[0041.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\"
	[0041.012] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned=""
	[0041.012] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt"
	[0041.012] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0x20
	[0041.012] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="ICE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF"
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.zip") returned 0
	[0041.012] lstrlenA (lpString="*.zip") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.rar") returned 0
	[0041.012] lstrlenA (lpString="*.rar") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.7z") returned 0
	[0041.012] lstrlenA (lpString="*.7z") returned 4
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.tar") returned 0
	[0041.012] lstrlenA (lpString="*.tar") returned 5
	[0041.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.gzip") returned 0
	[0041.013] lstrlenA (lpString="*.gzip") returned 6
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.jpg") returned 0
	[0041.013] lstrlenA (lpString="*.jpg") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.jpeg") returned 0
	[0041.013] lstrlenA (lpString="*.jpeg") returned 6
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.psd") returned 0
	[0041.013] lstrlenA (lpString="*.psd") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.cdr") returned 0
	[0041.013] lstrlenA (lpString="*.cdr") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.dwg") returned 0
	[0041.013] lstrlenA (lpString="*.dwg") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.max") returned 0
	[0041.013] lstrlenA (lpString="*.max") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.bmp") returned 0
	[0041.013] lstrlenA (lpString="*.bmp") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.gif") returned 0
	[0041.013] lstrlenA (lpString="*.gif") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.png") returned 0
	[0041.013] lstrlenA (lpString="*.png") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.doc") returned 0
	[0041.013] lstrlenA (lpString="*.doc") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.docx") returned 0
	[0041.013] lstrlenA (lpString="*.docx") returned 6
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.xls") returned 0
	[0041.013] lstrlenA (lpString="*.xls") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.xlsx") returned 0
	[0041.013] lstrlenA (lpString="*.xlsx") returned 6
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.ppt") returned 0
	[0041.013] lstrlenA (lpString="*.ppt") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.pptx") returned 0
	[0041.013] lstrlenA (lpString="*.pptx") returned 6
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.txt") returned 0
	[0041.013] lstrlenA (lpString="*.txt") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.pdf") returned 0
	[0041.013] lstrlenA (lpString="*.pdf") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.djvu") returned 0
	[0041.013] lstrlenA (lpString="*.djvu") returned 6
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.htm") returned 0
	[0041.013] lstrlenA (lpString="*.htm") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.html") returned 0
	[0041.013] lstrlenA (lpString="*.html") returned 6
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mdb") returned 0
	[0041.013] lstrlenA (lpString="*.mdb") returned 5
	[0041.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.cer") returned 0
	[0041.013] lstrlenA (lpString="*.cer") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.p12") returned 0
	[0041.014] lstrlenA (lpString="*.p12") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.pfx") returned 0
	[0041.014] lstrlenA (lpString="*.pfx") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.kwm") returned 0
	[0041.014] lstrlenA (lpString="*.kwm") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.pwm") returned 0
	[0041.014] lstrlenA (lpString="*.pwm") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.1cd") returned 0
	[0041.014] lstrlenA (lpString="*.1cd") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.md") returned 0
	[0041.014] lstrlenA (lpString="*.md") returned 4
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mdf") returned 0
	[0041.014] lstrlenA (lpString="*.mdf") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.dbf") returned 0
	[0041.014] lstrlenA (lpString="*.dbf") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.odt") returned 0
	[0041.014] lstrlenA (lpString="*.odt") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.vob") returned 0
	[0041.014] lstrlenA (lpString="*.vob") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.ifo") returned 0
	[0041.014] lstrlenA (lpString="*.ifo") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.lnk") returned 0
	[0041.014] lstrlenA (lpString="*.lnk") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.torrent") returned 0
	[0041.014] lstrlenA (lpString="*.torrent") returned 9
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mov") returned 0
	[0041.014] lstrlenA (lpString="*.mov") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.m2v") returned 0
	[0041.014] lstrlenA (lpString="*.m2v") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.3gp") returned 0
	[0041.014] lstrlenA (lpString="*.3gp") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mpeg") returned 0
	[0041.014] lstrlenA (lpString="*.mpeg") returned 6
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mpg") returned 0
	[0041.014] lstrlenA (lpString="*.mpg") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.flv") returned 0
	[0041.014] lstrlenA (lpString="*.flv") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.avi") returned 0
	[0041.014] lstrlenA (lpString="*.avi") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mp4") returned 0
	[0041.014] lstrlenA (lpString="*.mp4") returned 5
	[0041.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.wmv") returned 0
	[0041.014] lstrlenA (lpString="*.wmv") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.divx") returned 0
	[0041.015] lstrlenA (lpString="*.divx") returned 6
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mkv") returned 0
	[0041.015] lstrlenA (lpString="*.mkv") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mp3") returned 0
	[0041.015] lstrlenA (lpString="*.mp3") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.wav") returned 0
	[0041.015] lstrlenA (lpString="*.wav") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.flac") returned 0
	[0041.015] lstrlenA (lpString="*.flac") returned 6
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.ape") returned 0
	[0041.015] lstrlenA (lpString="*.ape") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.wma") returned 0
	[0041.015] lstrlenA (lpString="*.wma") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.ac3") returned 0
	[0041.015] lstrlenA (lpString="*.ac3") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.exe") returned 0
	[0041.015] lstrlenA (lpString="*.exe") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.apk") returned 0
	[0041.015] lstrlenA (lpString="*.apk") returned 5
	[0041.015] FindNextFileA (in: hFindFile=0x8ba470, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.015] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.015] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.015] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.015] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned="ICE.INF"
	[0041.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\"
	[0041.015] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned=""
	[0041.015] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt"
	[0041.015] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0x20
	[0041.015] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF"
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.015] lstrlenA (lpString="*.zip") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.015] lstrlenA (lpString="*.rar") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.015] lstrlenA (lpString="*.7z") returned 4
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.015] lstrlenA (lpString="*.tar") returned 5
	[0041.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.015] lstrlenA (lpString="*.gzip") returned 6
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.016] lstrlenA (lpString="*.jpg") returned 5
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.016] lstrlenA (lpString="*.jpeg") returned 6
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.016] lstrlenA (lpString="*.psd") returned 5
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.016] lstrlenA (lpString="*.cdr") returned 5
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.016] lstrlenA (lpString="*.dwg") returned 5
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.016] lstrlenA (lpString="*.max") returned 5
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.016] lstrlenA (lpString="*.bmp") returned 5
	[0041.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.016] lstrlenA (lpString="*.gif") returned 5
	[0041.016] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF"
	[0041.016] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF"
	[0041.016] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF."
	[0041.016] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.Boom"
	[0041.016] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.016] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f8
	[0041.016] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.016] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.016] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9d5, lpOverlapped=0x0) returned 1
	[0041.020] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.020] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.020] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9d5, lpOverlapped=0x0) returned 1
	[0041.020] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.021] CloseHandle (hObject=0x90) returned 1
	[0041.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.boom")) returned 1
	[0041.023] FindNextFileA (in: hFindFile=0x8ba470, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.023] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.023] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.023] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\"
	[0041.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned=""
	[0041.023] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt"
	[0041.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0x20
	[0041.023] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG"
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.023] lstrlenA (lpString="*.zip") returned 5
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.023] lstrlenA (lpString="*.rar") returned 5
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.023] lstrlenA (lpString="*.7z") returned 4
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.023] lstrlenA (lpString="*.tar") returned 5
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.023] lstrlenA (lpString="*.gzip") returned 6
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.023] lstrlenA (lpString="*.jpg") returned 5
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.023] lstrlenA (lpString="*.jpeg") returned 6
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.023] lstrlenA (lpString="*.psd") returned 5
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.023] lstrlenA (lpString="*.cdr") returned 5
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.023] lstrlenA (lpString="*.dwg") returned 5
	[0041.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.024] lstrlenA (lpString="*.max") returned 5
	[0041.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.024] lstrlenA (lpString="*.bmp") returned 5
	[0041.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.024] lstrlenA (lpString="*.gif") returned 5
	[0041.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.024] lstrlenA (lpString="*.png") returned 5
	[0041.024] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG"
	[0041.024] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG"
	[0041.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG."
	[0041.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.Boom"
	[0041.024] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.024] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4981
	[0041.024] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.024] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.024] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x495e, lpOverlapped=0x0) returned 1
	[0041.025] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.025] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.026] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x495e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x495e, lpOverlapped=0x0) returned 1
	[0041.026] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.026] CloseHandle (hObject=0x90) returned 1
	[0041.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.boom")) returned 1
	[0041.027] FindNextFileA (in: hFindFile=0x8ba470, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.027] FindClose (in: hFindFile=0x8ba470 | out: hFindFile=0x8ba470) returned 1
	[0041.027] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.027] lstrcmpA (lpString1=".", lpString2="INDUST") returned -1
	[0041.027] lstrcmpA (lpString1="..", lpString2="INDUST") returned -1
	[0041.027] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.027] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="INDUST" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST"
	[0041.027] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST") returned 62
	[0041.027] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0041.036] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.036] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.037] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.037] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.037] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.037] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.037] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INDUST.ELM") returned -1
	[0041.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDUST.ELM") returned -1
	[0041.037] lstrcmpiA (lpString1="", lpString2="INDUST.ELM") returned -1
	[0041.037] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*") returned="*.*"
	[0041.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\"
	[0041.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned=""
	[0041.037] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt"
	[0041.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0xffffffff
	[0041.037] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.037] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.037] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.038] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.038] CloseHandle (hObject=0x90) returned 1
	[0041.038] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="INDUST.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM"
	[0041.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.zip") returned 0
	[0041.038] lstrlenA (lpString="*.zip") returned 5
	[0041.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.rar") returned 0
	[0041.038] lstrlenA (lpString="*.rar") returned 5
	[0041.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.7z") returned 0
	[0041.038] lstrlenA (lpString="*.7z") returned 4
	[0041.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.tar") returned 0
	[0041.038] lstrlenA (lpString="*.tar") returned 5
	[0041.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.gzip") returned 0
	[0041.039] lstrlenA (lpString="*.gzip") returned 6
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.jpg") returned 0
	[0041.039] lstrlenA (lpString="*.jpg") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.jpeg") returned 0
	[0041.039] lstrlenA (lpString="*.jpeg") returned 6
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.psd") returned 0
	[0041.039] lstrlenA (lpString="*.psd") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.cdr") returned 0
	[0041.039] lstrlenA (lpString="*.cdr") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.dwg") returned 0
	[0041.039] lstrlenA (lpString="*.dwg") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.max") returned 0
	[0041.039] lstrlenA (lpString="*.max") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.bmp") returned 0
	[0041.039] lstrlenA (lpString="*.bmp") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.gif") returned 0
	[0041.039] lstrlenA (lpString="*.gif") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.png") returned 0
	[0041.039] lstrlenA (lpString="*.png") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.doc") returned 0
	[0041.039] lstrlenA (lpString="*.doc") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.docx") returned 0
	[0041.039] lstrlenA (lpString="*.docx") returned 6
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.xls") returned 0
	[0041.039] lstrlenA (lpString="*.xls") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.xlsx") returned 0
	[0041.039] lstrlenA (lpString="*.xlsx") returned 6
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ppt") returned 0
	[0041.039] lstrlenA (lpString="*.ppt") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.pptx") returned 0
	[0041.039] lstrlenA (lpString="*.pptx") returned 6
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.txt") returned 0
	[0041.039] lstrlenA (lpString="*.txt") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.pdf") returned 0
	[0041.039] lstrlenA (lpString="*.pdf") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.djvu") returned 0
	[0041.039] lstrlenA (lpString="*.djvu") returned 6
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.htm") returned 0
	[0041.039] lstrlenA (lpString="*.htm") returned 5
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.html") returned 0
	[0041.039] lstrlenA (lpString="*.html") returned 6
	[0041.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mdb") returned 0
	[0041.040] lstrlenA (lpString="*.mdb") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.cer") returned 0
	[0041.040] lstrlenA (lpString="*.cer") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.p12") returned 0
	[0041.040] lstrlenA (lpString="*.p12") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.pfx") returned 0
	[0041.040] lstrlenA (lpString="*.pfx") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.kwm") returned 0
	[0041.040] lstrlenA (lpString="*.kwm") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.pwm") returned 0
	[0041.040] lstrlenA (lpString="*.pwm") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.1cd") returned 0
	[0041.040] lstrlenA (lpString="*.1cd") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.md") returned 0
	[0041.040] lstrlenA (lpString="*.md") returned 4
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mdf") returned 0
	[0041.040] lstrlenA (lpString="*.mdf") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.dbf") returned 0
	[0041.040] lstrlenA (lpString="*.dbf") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.odt") returned 0
	[0041.040] lstrlenA (lpString="*.odt") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.vob") returned 0
	[0041.040] lstrlenA (lpString="*.vob") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ifo") returned 0
	[0041.040] lstrlenA (lpString="*.ifo") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.lnk") returned 0
	[0041.040] lstrlenA (lpString="*.lnk") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.torrent") returned 0
	[0041.040] lstrlenA (lpString="*.torrent") returned 9
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mov") returned 0
	[0041.040] lstrlenA (lpString="*.mov") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.m2v") returned 0
	[0041.040] lstrlenA (lpString="*.m2v") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.3gp") returned 0
	[0041.040] lstrlenA (lpString="*.3gp") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mpeg") returned 0
	[0041.040] lstrlenA (lpString="*.mpeg") returned 6
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mpg") returned 0
	[0041.040] lstrlenA (lpString="*.mpg") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.flv") returned 0
	[0041.040] lstrlenA (lpString="*.flv") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.avi") returned 0
	[0041.040] lstrlenA (lpString="*.avi") returned 5
	[0041.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mp4") returned 0
	[0041.040] lstrlenA (lpString="*.mp4") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.wmv") returned 0
	[0041.041] lstrlenA (lpString="*.wmv") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.divx") returned 0
	[0041.041] lstrlenA (lpString="*.divx") returned 6
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mkv") returned 0
	[0041.041] lstrlenA (lpString="*.mkv") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mp3") returned 0
	[0041.041] lstrlenA (lpString="*.mp3") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.wav") returned 0
	[0041.041] lstrlenA (lpString="*.wav") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.flac") returned 0
	[0041.041] lstrlenA (lpString="*.flac") returned 6
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ape") returned 0
	[0041.041] lstrlenA (lpString="*.ape") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.wma") returned 0
	[0041.041] lstrlenA (lpString="*.wma") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ac3") returned 0
	[0041.041] lstrlenA (lpString="*.ac3") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.exe") returned 0
	[0041.041] lstrlenA (lpString="*.exe") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.apk") returned 0
	[0041.041] lstrlenA (lpString="*.apk") returned 5
	[0041.041] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.041] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.041] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INDUST.INF") returned -1
	[0041.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDUST.INF") returned -1
	[0041.041] lstrcmpiA (lpString1="", lpString2="INDUST.INF") returned -1
	[0041.041] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned="INDUST.ELM"
	[0041.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\"
	[0041.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned=""
	[0041.041] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt"
	[0041.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0x20
	[0041.041] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="INDUST.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF"
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.zip") returned 0
	[0041.041] lstrlenA (lpString="*.zip") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.rar") returned 0
	[0041.041] lstrlenA (lpString="*.rar") returned 5
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.7z") returned 0
	[0041.041] lstrlenA (lpString="*.7z") returned 4
	[0041.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.tar") returned 0
	[0041.041] lstrlenA (lpString="*.tar") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.gzip") returned 0
	[0041.042] lstrlenA (lpString="*.gzip") returned 6
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.jpg") returned 0
	[0041.042] lstrlenA (lpString="*.jpg") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.jpeg") returned 0
	[0041.042] lstrlenA (lpString="*.jpeg") returned 6
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.psd") returned 0
	[0041.042] lstrlenA (lpString="*.psd") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.cdr") returned 0
	[0041.042] lstrlenA (lpString="*.cdr") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.dwg") returned 0
	[0041.042] lstrlenA (lpString="*.dwg") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.max") returned 0
	[0041.042] lstrlenA (lpString="*.max") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.bmp") returned 0
	[0041.042] lstrlenA (lpString="*.bmp") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.gif") returned 0
	[0041.042] lstrlenA (lpString="*.gif") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.png") returned 0
	[0041.042] lstrlenA (lpString="*.png") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.doc") returned 0
	[0041.042] lstrlenA (lpString="*.doc") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.docx") returned 0
	[0041.042] lstrlenA (lpString="*.docx") returned 6
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.xls") returned 0
	[0041.042] lstrlenA (lpString="*.xls") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.xlsx") returned 0
	[0041.042] lstrlenA (lpString="*.xlsx") returned 6
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.ppt") returned 0
	[0041.042] lstrlenA (lpString="*.ppt") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.pptx") returned 0
	[0041.042] lstrlenA (lpString="*.pptx") returned 6
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.txt") returned 0
	[0041.042] lstrlenA (lpString="*.txt") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.pdf") returned 0
	[0041.042] lstrlenA (lpString="*.pdf") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.djvu") returned 0
	[0041.042] lstrlenA (lpString="*.djvu") returned 6
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.htm") returned 0
	[0041.042] lstrlenA (lpString="*.htm") returned 5
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.html") returned 0
	[0041.042] lstrlenA (lpString="*.html") returned 6
	[0041.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mdb") returned 0
	[0041.042] lstrlenA (lpString="*.mdb") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.cer") returned 0
	[0041.043] lstrlenA (lpString="*.cer") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.p12") returned 0
	[0041.043] lstrlenA (lpString="*.p12") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.pfx") returned 0
	[0041.043] lstrlenA (lpString="*.pfx") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.kwm") returned 0
	[0041.043] lstrlenA (lpString="*.kwm") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.pwm") returned 0
	[0041.043] lstrlenA (lpString="*.pwm") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.1cd") returned 0
	[0041.043] lstrlenA (lpString="*.1cd") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.md") returned 0
	[0041.043] lstrlenA (lpString="*.md") returned 4
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mdf") returned 0
	[0041.043] lstrlenA (lpString="*.mdf") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.dbf") returned 0
	[0041.043] lstrlenA (lpString="*.dbf") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.odt") returned 0
	[0041.043] lstrlenA (lpString="*.odt") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.vob") returned 0
	[0041.043] lstrlenA (lpString="*.vob") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.ifo") returned 0
	[0041.043] lstrlenA (lpString="*.ifo") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.lnk") returned 0
	[0041.043] lstrlenA (lpString="*.lnk") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.torrent") returned 0
	[0041.043] lstrlenA (lpString="*.torrent") returned 9
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mov") returned 0
	[0041.043] lstrlenA (lpString="*.mov") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.m2v") returned 0
	[0041.043] lstrlenA (lpString="*.m2v") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.3gp") returned 0
	[0041.043] lstrlenA (lpString="*.3gp") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mpeg") returned 0
	[0041.043] lstrlenA (lpString="*.mpeg") returned 6
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mpg") returned 0
	[0041.043] lstrlenA (lpString="*.mpg") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.flv") returned 0
	[0041.043] lstrlenA (lpString="*.flv") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.avi") returned 0
	[0041.043] lstrlenA (lpString="*.avi") returned 5
	[0041.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mp4") returned 0
	[0041.044] lstrlenA (lpString="*.mp4") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.wmv") returned 0
	[0041.044] lstrlenA (lpString="*.wmv") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.divx") returned 0
	[0041.044] lstrlenA (lpString="*.divx") returned 6
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mkv") returned 0
	[0041.044] lstrlenA (lpString="*.mkv") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mp3") returned 0
	[0041.044] lstrlenA (lpString="*.mp3") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.wav") returned 0
	[0041.044] lstrlenA (lpString="*.wav") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.flac") returned 0
	[0041.044] lstrlenA (lpString="*.flac") returned 6
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.ape") returned 0
	[0041.044] lstrlenA (lpString="*.ape") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.wma") returned 0
	[0041.044] lstrlenA (lpString="*.wma") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.ac3") returned 0
	[0041.044] lstrlenA (lpString="*.ac3") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.exe") returned 0
	[0041.044] lstrlenA (lpString="*.exe") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.apk") returned 0
	[0041.044] lstrlenA (lpString="*.apk") returned 5
	[0041.044] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.044] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.044] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.044] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.044] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned="INDUST.INF"
	[0041.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\"
	[0041.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned=""
	[0041.044] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt"
	[0041.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0x20
	[0041.044] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF"
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.044] lstrlenA (lpString="*.zip") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.044] lstrlenA (lpString="*.rar") returned 5
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.044] lstrlenA (lpString="*.7z") returned 4
	[0041.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.045] lstrlenA (lpString="*.tar") returned 5
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.045] lstrlenA (lpString="*.gzip") returned 6
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.045] lstrlenA (lpString="*.jpg") returned 5
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.045] lstrlenA (lpString="*.jpeg") returned 6
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.045] lstrlenA (lpString="*.psd") returned 5
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.045] lstrlenA (lpString="*.cdr") returned 5
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.045] lstrlenA (lpString="*.dwg") returned 5
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.045] lstrlenA (lpString="*.max") returned 5
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.045] lstrlenA (lpString="*.bmp") returned 5
	[0041.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.045] lstrlenA (lpString="*.gif") returned 5
	[0041.045] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF"
	[0041.045] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF"
	[0041.045] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF."
	[0041.045] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.Boom"
	[0041.045] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.045] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143b
	[0041.045] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.045] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.045] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1418, lpOverlapped=0x0) returned 1
	[0041.054] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.054] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.054] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1418, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1418, lpOverlapped=0x0) returned 1
	[0041.054] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.054] CloseHandle (hObject=0x90) returned 1
	[0041.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.boom")) returned 1
	[0041.057] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.057] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.057] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.057] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.057] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\"
	[0041.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned=""
	[0041.057] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt"
	[0041.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0x20
	[0041.057] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG"
	[0041.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.057] lstrlenA (lpString="*.zip") returned 5
	[0041.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.057] lstrlenA (lpString="*.rar") returned 5
	[0041.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.057] lstrlenA (lpString="*.7z") returned 4
	[0041.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.057] lstrlenA (lpString="*.tar") returned 5
	[0041.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.057] lstrlenA (lpString="*.gzip") returned 6
	[0041.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.058] lstrlenA (lpString="*.jpg") returned 5
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.058] lstrlenA (lpString="*.jpeg") returned 6
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.058] lstrlenA (lpString="*.psd") returned 5
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.058] lstrlenA (lpString="*.cdr") returned 5
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.058] lstrlenA (lpString="*.dwg") returned 5
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.058] lstrlenA (lpString="*.max") returned 5
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.058] lstrlenA (lpString="*.bmp") returned 5
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.058] lstrlenA (lpString="*.gif") returned 5
	[0041.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.058] lstrlenA (lpString="*.png") returned 5
	[0041.058] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG"
	[0041.058] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG"
	[0041.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG."
	[0041.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.Boom"
	[0041.058] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.058] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8317
	[0041.058] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d489150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.058] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.058] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x82f4, lpOverlapped=0x0) returned 1
	[0041.070] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.071] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.071] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x82f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x82f4, lpOverlapped=0x0) returned 1
	[0041.071] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.071] CloseHandle (hObject=0x90) returned 1
	[0041.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.boom")) returned 1
	[0041.072] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.073] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0041.073] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.073] lstrcmpA (lpString1=".", lpString2="IRIS") returned -1
	[0041.073] lstrcmpA (lpString1="..", lpString2="IRIS") returned -1
	[0041.073] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="IRIS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS"
	[0041.073] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS") returned 60
	[0041.073] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0041.073] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.073] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.073] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.073] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.073] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.073] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.073] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IRIS.ELM") returned -1
	[0041.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IRIS.ELM") returned -1
	[0041.073] lstrcmpiA (lpString1="", lpString2="IRIS.ELM") returned -1
	[0041.073] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*") returned="*.*"
	[0041.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\"
	[0041.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned=""
	[0041.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt"
	[0041.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0xffffffff
	[0041.073] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.074] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.074] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.074] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.075] CloseHandle (hObject=0x90) returned 1
	[0041.075] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="IRIS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM"
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.zip") returned 0
	[0041.075] lstrlenA (lpString="*.zip") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.rar") returned 0
	[0041.075] lstrlenA (lpString="*.rar") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.7z") returned 0
	[0041.075] lstrlenA (lpString="*.7z") returned 4
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.tar") returned 0
	[0041.075] lstrlenA (lpString="*.tar") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.gzip") returned 0
	[0041.075] lstrlenA (lpString="*.gzip") returned 6
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.jpg") returned 0
	[0041.075] lstrlenA (lpString="*.jpg") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.jpeg") returned 0
	[0041.075] lstrlenA (lpString="*.jpeg") returned 6
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.psd") returned 0
	[0041.075] lstrlenA (lpString="*.psd") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.cdr") returned 0
	[0041.075] lstrlenA (lpString="*.cdr") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.dwg") returned 0
	[0041.075] lstrlenA (lpString="*.dwg") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.max") returned 0
	[0041.075] lstrlenA (lpString="*.max") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.bmp") returned 0
	[0041.075] lstrlenA (lpString="*.bmp") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.gif") returned 0
	[0041.075] lstrlenA (lpString="*.gif") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.png") returned 0
	[0041.075] lstrlenA (lpString="*.png") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.doc") returned 0
	[0041.075] lstrlenA (lpString="*.doc") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.docx") returned 0
	[0041.075] lstrlenA (lpString="*.docx") returned 6
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.xls") returned 0
	[0041.075] lstrlenA (lpString="*.xls") returned 5
	[0041.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.xlsx") returned 0
	[0041.076] lstrlenA (lpString="*.xlsx") returned 6
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ppt") returned 0
	[0041.076] lstrlenA (lpString="*.ppt") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.pptx") returned 0
	[0041.076] lstrlenA (lpString="*.pptx") returned 6
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.txt") returned 0
	[0041.076] lstrlenA (lpString="*.txt") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.pdf") returned 0
	[0041.076] lstrlenA (lpString="*.pdf") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.djvu") returned 0
	[0041.076] lstrlenA (lpString="*.djvu") returned 6
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.htm") returned 0
	[0041.076] lstrlenA (lpString="*.htm") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.html") returned 0
	[0041.076] lstrlenA (lpString="*.html") returned 6
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mdb") returned 0
	[0041.076] lstrlenA (lpString="*.mdb") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.cer") returned 0
	[0041.076] lstrlenA (lpString="*.cer") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.p12") returned 0
	[0041.076] lstrlenA (lpString="*.p12") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.pfx") returned 0
	[0041.076] lstrlenA (lpString="*.pfx") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.kwm") returned 0
	[0041.076] lstrlenA (lpString="*.kwm") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.pwm") returned 0
	[0041.076] lstrlenA (lpString="*.pwm") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.1cd") returned 0
	[0041.076] lstrlenA (lpString="*.1cd") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.md") returned 0
	[0041.076] lstrlenA (lpString="*.md") returned 4
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mdf") returned 0
	[0041.076] lstrlenA (lpString="*.mdf") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.dbf") returned 0
	[0041.076] lstrlenA (lpString="*.dbf") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.odt") returned 0
	[0041.076] lstrlenA (lpString="*.odt") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.vob") returned 0
	[0041.076] lstrlenA (lpString="*.vob") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ifo") returned 0
	[0041.076] lstrlenA (lpString="*.ifo") returned 5
	[0041.076] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.lnk") returned 0
	[0041.076] lstrlenA (lpString="*.lnk") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.torrent") returned 0
	[0041.077] lstrlenA (lpString="*.torrent") returned 9
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mov") returned 0
	[0041.077] lstrlenA (lpString="*.mov") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.m2v") returned 0
	[0041.077] lstrlenA (lpString="*.m2v") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.3gp") returned 0
	[0041.077] lstrlenA (lpString="*.3gp") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mpeg") returned 0
	[0041.077] lstrlenA (lpString="*.mpeg") returned 6
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mpg") returned 0
	[0041.077] lstrlenA (lpString="*.mpg") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.flv") returned 0
	[0041.077] lstrlenA (lpString="*.flv") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.avi") returned 0
	[0041.077] lstrlenA (lpString="*.avi") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mp4") returned 0
	[0041.077] lstrlenA (lpString="*.mp4") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.wmv") returned 0
	[0041.077] lstrlenA (lpString="*.wmv") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.divx") returned 0
	[0041.077] lstrlenA (lpString="*.divx") returned 6
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mkv") returned 0
	[0041.077] lstrlenA (lpString="*.mkv") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mp3") returned 0
	[0041.077] lstrlenA (lpString="*.mp3") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.wav") returned 0
	[0041.077] lstrlenA (lpString="*.wav") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.flac") returned 0
	[0041.077] lstrlenA (lpString="*.flac") returned 6
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ape") returned 0
	[0041.077] lstrlenA (lpString="*.ape") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.wma") returned 0
	[0041.077] lstrlenA (lpString="*.wma") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ac3") returned 0
	[0041.077] lstrlenA (lpString="*.ac3") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.exe") returned 0
	[0041.077] lstrlenA (lpString="*.exe") returned 5
	[0041.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.apk") returned 0
	[0041.077] lstrlenA (lpString="*.apk") returned 5
	[0041.077] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.077] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IRIS.INF") returned -1
	[0041.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IRIS.INF") returned -1
	[0041.078] lstrcmpiA (lpString1="", lpString2="IRIS.INF") returned -1
	[0041.078] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned="IRIS.ELM"
	[0041.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\"
	[0041.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned=""
	[0041.078] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt"
	[0041.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0x20
	[0041.078] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="IRIS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF"
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.zip") returned 0
	[0041.078] lstrlenA (lpString="*.zip") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.rar") returned 0
	[0041.078] lstrlenA (lpString="*.rar") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.7z") returned 0
	[0041.078] lstrlenA (lpString="*.7z") returned 4
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.tar") returned 0
	[0041.078] lstrlenA (lpString="*.tar") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.gzip") returned 0
	[0041.078] lstrlenA (lpString="*.gzip") returned 6
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.jpg") returned 0
	[0041.078] lstrlenA (lpString="*.jpg") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.jpeg") returned 0
	[0041.078] lstrlenA (lpString="*.jpeg") returned 6
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.psd") returned 0
	[0041.078] lstrlenA (lpString="*.psd") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.cdr") returned 0
	[0041.078] lstrlenA (lpString="*.cdr") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.dwg") returned 0
	[0041.078] lstrlenA (lpString="*.dwg") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.max") returned 0
	[0041.078] lstrlenA (lpString="*.max") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.bmp") returned 0
	[0041.078] lstrlenA (lpString="*.bmp") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.gif") returned 0
	[0041.078] lstrlenA (lpString="*.gif") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.png") returned 0
	[0041.078] lstrlenA (lpString="*.png") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.doc") returned 0
	[0041.078] lstrlenA (lpString="*.doc") returned 5
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.docx") returned 0
	[0041.078] lstrlenA (lpString="*.docx") returned 6
	[0041.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.xls") returned 0
	[0041.079] lstrlenA (lpString="*.xls") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.xlsx") returned 0
	[0041.079] lstrlenA (lpString="*.xlsx") returned 6
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.ppt") returned 0
	[0041.079] lstrlenA (lpString="*.ppt") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.pptx") returned 0
	[0041.079] lstrlenA (lpString="*.pptx") returned 6
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.txt") returned 0
	[0041.079] lstrlenA (lpString="*.txt") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.pdf") returned 0
	[0041.079] lstrlenA (lpString="*.pdf") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.djvu") returned 0
	[0041.079] lstrlenA (lpString="*.djvu") returned 6
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.htm") returned 0
	[0041.079] lstrlenA (lpString="*.htm") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.html") returned 0
	[0041.079] lstrlenA (lpString="*.html") returned 6
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mdb") returned 0
	[0041.079] lstrlenA (lpString="*.mdb") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.cer") returned 0
	[0041.079] lstrlenA (lpString="*.cer") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.p12") returned 0
	[0041.079] lstrlenA (lpString="*.p12") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.pfx") returned 0
	[0041.079] lstrlenA (lpString="*.pfx") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.kwm") returned 0
	[0041.079] lstrlenA (lpString="*.kwm") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.pwm") returned 0
	[0041.079] lstrlenA (lpString="*.pwm") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.1cd") returned 0
	[0041.079] lstrlenA (lpString="*.1cd") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.md") returned 0
	[0041.079] lstrlenA (lpString="*.md") returned 4
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mdf") returned 0
	[0041.079] lstrlenA (lpString="*.mdf") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.dbf") returned 0
	[0041.079] lstrlenA (lpString="*.dbf") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.odt") returned 0
	[0041.079] lstrlenA (lpString="*.odt") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.vob") returned 0
	[0041.079] lstrlenA (lpString="*.vob") returned 5
	[0041.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.ifo") returned 0
	[0041.079] lstrlenA (lpString="*.ifo") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.lnk") returned 0
	[0041.080] lstrlenA (lpString="*.lnk") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.torrent") returned 0
	[0041.080] lstrlenA (lpString="*.torrent") returned 9
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mov") returned 0
	[0041.080] lstrlenA (lpString="*.mov") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.m2v") returned 0
	[0041.080] lstrlenA (lpString="*.m2v") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.3gp") returned 0
	[0041.080] lstrlenA (lpString="*.3gp") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mpeg") returned 0
	[0041.080] lstrlenA (lpString="*.mpeg") returned 6
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mpg") returned 0
	[0041.080] lstrlenA (lpString="*.mpg") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.flv") returned 0
	[0041.080] lstrlenA (lpString="*.flv") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.avi") returned 0
	[0041.080] lstrlenA (lpString="*.avi") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mp4") returned 0
	[0041.080] lstrlenA (lpString="*.mp4") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.wmv") returned 0
	[0041.080] lstrlenA (lpString="*.wmv") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.divx") returned 0
	[0041.080] lstrlenA (lpString="*.divx") returned 6
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mkv") returned 0
	[0041.080] lstrlenA (lpString="*.mkv") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mp3") returned 0
	[0041.080] lstrlenA (lpString="*.mp3") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.wav") returned 0
	[0041.080] lstrlenA (lpString="*.wav") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.flac") returned 0
	[0041.080] lstrlenA (lpString="*.flac") returned 6
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.ape") returned 0
	[0041.080] lstrlenA (lpString="*.ape") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.wma") returned 0
	[0041.080] lstrlenA (lpString="*.wma") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.ac3") returned 0
	[0041.080] lstrlenA (lpString="*.ac3") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.exe") returned 0
	[0041.080] lstrlenA (lpString="*.exe") returned 5
	[0041.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.apk") returned 0
	[0041.080] lstrlenA (lpString="*.apk") returned 5
	[0041.080] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.080] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.081] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.081] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.081] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned="IRIS.INF"
	[0041.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\"
	[0041.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned=""
	[0041.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt"
	[0041.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0x20
	[0041.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF"
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.081] lstrlenA (lpString="*.zip") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.081] lstrlenA (lpString="*.rar") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.081] lstrlenA (lpString="*.7z") returned 4
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.081] lstrlenA (lpString="*.tar") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.081] lstrlenA (lpString="*.gzip") returned 6
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.081] lstrlenA (lpString="*.jpg") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.081] lstrlenA (lpString="*.jpeg") returned 6
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.081] lstrlenA (lpString="*.psd") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.081] lstrlenA (lpString="*.cdr") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.081] lstrlenA (lpString="*.dwg") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.081] lstrlenA (lpString="*.max") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.081] lstrlenA (lpString="*.bmp") returned 5
	[0041.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.081] lstrlenA (lpString="*.gif") returned 5
	[0041.081] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF"
	[0041.081] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF"
	[0041.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF."
	[0041.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.Boom"
	[0041.082] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.082] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ac
	[0041.083] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.083] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.083] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x989, lpOverlapped=0x0) returned 1
	[0041.094] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.094] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.094] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x989, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x989, lpOverlapped=0x0) returned 1
	[0041.095] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.095] CloseHandle (hObject=0x90) returned 1
	[0041.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.boom")) returned 1
	[0041.101] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.101] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.101] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.101] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.101] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\"
	[0041.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned=""
	[0041.101] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt"
	[0041.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0x20
	[0041.101] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG"
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.101] lstrlenA (lpString="*.zip") returned 5
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.101] lstrlenA (lpString="*.rar") returned 5
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.101] lstrlenA (lpString="*.7z") returned 4
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.101] lstrlenA (lpString="*.tar") returned 5
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.101] lstrlenA (lpString="*.gzip") returned 6
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.101] lstrlenA (lpString="*.jpg") returned 5
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.101] lstrlenA (lpString="*.jpeg") returned 6
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.101] lstrlenA (lpString="*.psd") returned 5
	[0041.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.101] lstrlenA (lpString="*.cdr") returned 5
	[0041.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.102] lstrlenA (lpString="*.dwg") returned 5
	[0041.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.102] lstrlenA (lpString="*.max") returned 5
	[0041.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.102] lstrlenA (lpString="*.bmp") returned 5
	[0041.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.102] lstrlenA (lpString="*.gif") returned 5
	[0041.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.102] lstrlenA (lpString="*.png") returned 5
	[0041.102] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG"
	[0041.102] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG"
	[0041.102] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG."
	[0041.102] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.Boom"
	[0041.102] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.102] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c1d
	[0041.102] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.102] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.102] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4bfa, lpOverlapped=0x0) returned 1
	[0041.103] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.103] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.104] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4bfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4bfa, lpOverlapped=0x0) returned 1
	[0041.104] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.104] CloseHandle (hObject=0x90) returned 1
	[0041.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.boom")) returned 1
	[0041.105] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.105] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0041.105] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.105] lstrcmpA (lpString1=".", lpString2="JOURNAL") returned -1
	[0041.105] lstrcmpA (lpString1="..", lpString2="JOURNAL") returned -1
	[0041.105] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.105] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="JOURNAL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL"
	[0041.105] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL") returned 63
	[0041.105] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0041.106] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.106] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.106] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.106] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.106] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.106] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JOURNAL.ELM") returned -1
	[0041.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JOURNAL.ELM") returned -1
	[0041.106] lstrcmpiA (lpString1="", lpString2="JOURNAL.ELM") returned -1
	[0041.106] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*") returned="*.*"
	[0041.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\"
	[0041.106] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned=""
	[0041.106] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt"
	[0041.106] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0xffffffff
	[0041.106] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.106] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.107] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.107] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.107] CloseHandle (hObject=0x90) returned 1
	[0041.108] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="JOURNAL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM"
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.zip") returned 0
	[0041.108] lstrlenA (lpString="*.zip") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.rar") returned 0
	[0041.108] lstrlenA (lpString="*.rar") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.7z") returned 0
	[0041.108] lstrlenA (lpString="*.7z") returned 4
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.tar") returned 0
	[0041.108] lstrlenA (lpString="*.tar") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.gzip") returned 0
	[0041.108] lstrlenA (lpString="*.gzip") returned 6
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.jpg") returned 0
	[0041.108] lstrlenA (lpString="*.jpg") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.jpeg") returned 0
	[0041.108] lstrlenA (lpString="*.jpeg") returned 6
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.psd") returned 0
	[0041.108] lstrlenA (lpString="*.psd") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.cdr") returned 0
	[0041.108] lstrlenA (lpString="*.cdr") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.dwg") returned 0
	[0041.108] lstrlenA (lpString="*.dwg") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.max") returned 0
	[0041.108] lstrlenA (lpString="*.max") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.bmp") returned 0
	[0041.108] lstrlenA (lpString="*.bmp") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.gif") returned 0
	[0041.108] lstrlenA (lpString="*.gif") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.png") returned 0
	[0041.108] lstrlenA (lpString="*.png") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.doc") returned 0
	[0041.108] lstrlenA (lpString="*.doc") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.docx") returned 0
	[0041.108] lstrlenA (lpString="*.docx") returned 6
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.xls") returned 0
	[0041.108] lstrlenA (lpString="*.xls") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.xlsx") returned 0
	[0041.108] lstrlenA (lpString="*.xlsx") returned 6
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ppt") returned 0
	[0041.108] lstrlenA (lpString="*.ppt") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.pptx") returned 0
	[0041.108] lstrlenA (lpString="*.pptx") returned 6
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.txt") returned 0
	[0041.108] lstrlenA (lpString="*.txt") returned 5
	[0041.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.pdf") returned 0
	[0041.109] lstrlenA (lpString="*.pdf") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.djvu") returned 0
	[0041.109] lstrlenA (lpString="*.djvu") returned 6
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.htm") returned 0
	[0041.109] lstrlenA (lpString="*.htm") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.html") returned 0
	[0041.109] lstrlenA (lpString="*.html") returned 6
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mdb") returned 0
	[0041.109] lstrlenA (lpString="*.mdb") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.cer") returned 0
	[0041.109] lstrlenA (lpString="*.cer") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.p12") returned 0
	[0041.109] lstrlenA (lpString="*.p12") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.pfx") returned 0
	[0041.109] lstrlenA (lpString="*.pfx") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.kwm") returned 0
	[0041.109] lstrlenA (lpString="*.kwm") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.pwm") returned 0
	[0041.109] lstrlenA (lpString="*.pwm") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.1cd") returned 0
	[0041.109] lstrlenA (lpString="*.1cd") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.md") returned 0
	[0041.109] lstrlenA (lpString="*.md") returned 4
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mdf") returned 0
	[0041.109] lstrlenA (lpString="*.mdf") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.dbf") returned 0
	[0041.109] lstrlenA (lpString="*.dbf") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.odt") returned 0
	[0041.109] lstrlenA (lpString="*.odt") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.vob") returned 0
	[0041.109] lstrlenA (lpString="*.vob") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ifo") returned 0
	[0041.109] lstrlenA (lpString="*.ifo") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.lnk") returned 0
	[0041.109] lstrlenA (lpString="*.lnk") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.torrent") returned 0
	[0041.109] lstrlenA (lpString="*.torrent") returned 9
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mov") returned 0
	[0041.109] lstrlenA (lpString="*.mov") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.m2v") returned 0
	[0041.109] lstrlenA (lpString="*.m2v") returned 5
	[0041.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.3gp") returned 0
	[0041.109] lstrlenA (lpString="*.3gp") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mpeg") returned 0
	[0041.110] lstrlenA (lpString="*.mpeg") returned 6
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mpg") returned 0
	[0041.110] lstrlenA (lpString="*.mpg") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.flv") returned 0
	[0041.110] lstrlenA (lpString="*.flv") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.avi") returned 0
	[0041.110] lstrlenA (lpString="*.avi") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mp4") returned 0
	[0041.110] lstrlenA (lpString="*.mp4") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.wmv") returned 0
	[0041.110] lstrlenA (lpString="*.wmv") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.divx") returned 0
	[0041.110] lstrlenA (lpString="*.divx") returned 6
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mkv") returned 0
	[0041.110] lstrlenA (lpString="*.mkv") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mp3") returned 0
	[0041.110] lstrlenA (lpString="*.mp3") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.wav") returned 0
	[0041.110] lstrlenA (lpString="*.wav") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.flac") returned 0
	[0041.110] lstrlenA (lpString="*.flac") returned 6
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ape") returned 0
	[0041.110] lstrlenA (lpString="*.ape") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.wma") returned 0
	[0041.110] lstrlenA (lpString="*.wma") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ac3") returned 0
	[0041.110] lstrlenA (lpString="*.ac3") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.exe") returned 0
	[0041.110] lstrlenA (lpString="*.exe") returned 5
	[0041.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.apk") returned 0
	[0041.110] lstrlenA (lpString="*.apk") returned 5
	[0041.110] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.110] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.110] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JOURNAL.INF") returned -1
	[0041.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JOURNAL.INF") returned -1
	[0041.110] lstrcmpiA (lpString1="", lpString2="JOURNAL.INF") returned -1
	[0041.110] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned="JOURNAL.ELM"
	[0041.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\"
	[0041.110] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned=""
	[0041.110] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt"
	[0041.110] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0x20
	[0041.111] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="JOURNAL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF"
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.zip") returned 0
	[0041.111] lstrlenA (lpString="*.zip") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.rar") returned 0
	[0041.111] lstrlenA (lpString="*.rar") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.7z") returned 0
	[0041.111] lstrlenA (lpString="*.7z") returned 4
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.tar") returned 0
	[0041.111] lstrlenA (lpString="*.tar") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.gzip") returned 0
	[0041.111] lstrlenA (lpString="*.gzip") returned 6
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.jpg") returned 0
	[0041.111] lstrlenA (lpString="*.jpg") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.jpeg") returned 0
	[0041.111] lstrlenA (lpString="*.jpeg") returned 6
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.psd") returned 0
	[0041.111] lstrlenA (lpString="*.psd") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.cdr") returned 0
	[0041.111] lstrlenA (lpString="*.cdr") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.dwg") returned 0
	[0041.111] lstrlenA (lpString="*.dwg") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.max") returned 0
	[0041.111] lstrlenA (lpString="*.max") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.bmp") returned 0
	[0041.111] lstrlenA (lpString="*.bmp") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.gif") returned 0
	[0041.111] lstrlenA (lpString="*.gif") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.png") returned 0
	[0041.111] lstrlenA (lpString="*.png") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.doc") returned 0
	[0041.111] lstrlenA (lpString="*.doc") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.docx") returned 0
	[0041.111] lstrlenA (lpString="*.docx") returned 6
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.xls") returned 0
	[0041.111] lstrlenA (lpString="*.xls") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.xlsx") returned 0
	[0041.111] lstrlenA (lpString="*.xlsx") returned 6
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.ppt") returned 0
	[0041.111] lstrlenA (lpString="*.ppt") returned 5
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.pptx") returned 0
	[0041.111] lstrlenA (lpString="*.pptx") returned 6
	[0041.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.txt") returned 0
	[0041.111] lstrlenA (lpString="*.txt") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.pdf") returned 0
	[0041.112] lstrlenA (lpString="*.pdf") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.djvu") returned 0
	[0041.112] lstrlenA (lpString="*.djvu") returned 6
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.htm") returned 0
	[0041.112] lstrlenA (lpString="*.htm") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.html") returned 0
	[0041.112] lstrlenA (lpString="*.html") returned 6
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mdb") returned 0
	[0041.112] lstrlenA (lpString="*.mdb") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.cer") returned 0
	[0041.112] lstrlenA (lpString="*.cer") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.p12") returned 0
	[0041.112] lstrlenA (lpString="*.p12") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.pfx") returned 0
	[0041.112] lstrlenA (lpString="*.pfx") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.kwm") returned 0
	[0041.112] lstrlenA (lpString="*.kwm") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.pwm") returned 0
	[0041.112] lstrlenA (lpString="*.pwm") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.1cd") returned 0
	[0041.112] lstrlenA (lpString="*.1cd") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.md") returned 0
	[0041.112] lstrlenA (lpString="*.md") returned 4
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mdf") returned 0
	[0041.112] lstrlenA (lpString="*.mdf") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.dbf") returned 0
	[0041.112] lstrlenA (lpString="*.dbf") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.odt") returned 0
	[0041.112] lstrlenA (lpString="*.odt") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.vob") returned 0
	[0041.112] lstrlenA (lpString="*.vob") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.ifo") returned 0
	[0041.112] lstrlenA (lpString="*.ifo") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.lnk") returned 0
	[0041.112] lstrlenA (lpString="*.lnk") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.torrent") returned 0
	[0041.112] lstrlenA (lpString="*.torrent") returned 9
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mov") returned 0
	[0041.112] lstrlenA (lpString="*.mov") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.m2v") returned 0
	[0041.112] lstrlenA (lpString="*.m2v") returned 5
	[0041.112] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.3gp") returned 0
	[0041.112] lstrlenA (lpString="*.3gp") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mpeg") returned 0
	[0041.113] lstrlenA (lpString="*.mpeg") returned 6
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mpg") returned 0
	[0041.113] lstrlenA (lpString="*.mpg") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.flv") returned 0
	[0041.113] lstrlenA (lpString="*.flv") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.avi") returned 0
	[0041.113] lstrlenA (lpString="*.avi") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mp4") returned 0
	[0041.113] lstrlenA (lpString="*.mp4") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.wmv") returned 0
	[0041.113] lstrlenA (lpString="*.wmv") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.divx") returned 0
	[0041.113] lstrlenA (lpString="*.divx") returned 6
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mkv") returned 0
	[0041.113] lstrlenA (lpString="*.mkv") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mp3") returned 0
	[0041.113] lstrlenA (lpString="*.mp3") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.wav") returned 0
	[0041.113] lstrlenA (lpString="*.wav") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.flac") returned 0
	[0041.113] lstrlenA (lpString="*.flac") returned 6
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.ape") returned 0
	[0041.113] lstrlenA (lpString="*.ape") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.wma") returned 0
	[0041.113] lstrlenA (lpString="*.wma") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.ac3") returned 0
	[0041.113] lstrlenA (lpString="*.ac3") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.exe") returned 0
	[0041.113] lstrlenA (lpString="*.exe") returned 5
	[0041.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.apk") returned 0
	[0041.113] lstrlenA (lpString="*.apk") returned 5
	[0041.113] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.113] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.113] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.113] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.113] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned="JOURNAL.INF"
	[0041.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\"
	[0041.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned=""
	[0041.113] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt"
	[0041.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0x20
	[0041.114] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF"
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.114] lstrlenA (lpString="*.zip") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.114] lstrlenA (lpString="*.rar") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.114] lstrlenA (lpString="*.7z") returned 4
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.114] lstrlenA (lpString="*.tar") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.114] lstrlenA (lpString="*.gzip") returned 6
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.114] lstrlenA (lpString="*.jpg") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.114] lstrlenA (lpString="*.jpeg") returned 6
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.114] lstrlenA (lpString="*.psd") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.114] lstrlenA (lpString="*.cdr") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.114] lstrlenA (lpString="*.dwg") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.114] lstrlenA (lpString="*.max") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.114] lstrlenA (lpString="*.bmp") returned 5
	[0041.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.114] lstrlenA (lpString="*.gif") returned 5
	[0041.114] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF"
	[0041.114] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF"
	[0041.114] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF."
	[0041.114] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.Boom"
	[0041.114] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.114] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d0
	[0041.115] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.115] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.115] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4ad, lpOverlapped=0x0) returned 1
	[0041.116] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.116] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.116] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4ad, lpOverlapped=0x0) returned 1
	[0041.116] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.116] CloseHandle (hObject=0x90) returned 1
	[0041.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.boom")) returned 1
	[0041.118] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.118] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.118] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.118] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.118] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\"
	[0041.118] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned=""
	[0041.118] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt"
	[0041.118] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0x20
	[0041.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG"
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.119] lstrlenA (lpString="*.zip") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.119] lstrlenA (lpString="*.rar") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.119] lstrlenA (lpString="*.7z") returned 4
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.119] lstrlenA (lpString="*.tar") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.119] lstrlenA (lpString="*.gzip") returned 6
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.119] lstrlenA (lpString="*.jpg") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.119] lstrlenA (lpString="*.jpeg") returned 6
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.119] lstrlenA (lpString="*.psd") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.119] lstrlenA (lpString="*.cdr") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.119] lstrlenA (lpString="*.dwg") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.119] lstrlenA (lpString="*.max") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.119] lstrlenA (lpString="*.bmp") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.119] lstrlenA (lpString="*.gif") returned 5
	[0041.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.119] lstrlenA (lpString="*.png") returned 5
	[0041.119] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG"
	[0041.119] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG"
	[0041.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG."
	[0041.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.Boom"
	[0041.119] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.119] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47ed
	[0041.120] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d489150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.120] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.120] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x47ca, lpOverlapped=0x0) returned 1
	[0041.132] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.132] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.132] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x47ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x47ca, lpOverlapped=0x0) returned 1
	[0041.132] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.132] CloseHandle (hObject=0x90) returned 1
	[0041.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.boom")) returned 1
	[0041.133] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.133] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0041.133] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.134] lstrcmpA (lpString1=".", lpString2="LAYERS") returned -1
	[0041.134] lstrcmpA (lpString1="..", lpString2="LAYERS") returned -1
	[0041.134] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="LAYERS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS"
	[0041.134] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned 62
	[0041.134] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0041.135] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.135] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.135] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.135] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.135] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.135] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAYERS.ELM") returned -1
	[0041.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAYERS.ELM") returned -1
	[0041.135] lstrcmpiA (lpString1="", lpString2="LAYERS.ELM") returned -1
	[0041.135] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*") returned="*.*"
	[0041.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\"
	[0041.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned=""
	[0041.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt"
	[0041.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0xffffffff
	[0041.135] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.135] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.135] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.136] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.136] CloseHandle (hObject=0x90) returned 1
	[0041.136] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="LAYERS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM"
	[0041.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.zip") returned 0
	[0041.136] lstrlenA (lpString="*.zip") returned 5
	[0041.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.rar") returned 0
	[0041.136] lstrlenA (lpString="*.rar") returned 5
	[0041.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.7z") returned 0
	[0041.136] lstrlenA (lpString="*.7z") returned 4
	[0041.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.tar") returned 0
	[0041.136] lstrlenA (lpString="*.tar") returned 5
	[0041.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.gzip") returned 0
	[0041.136] lstrlenA (lpString="*.gzip") returned 6
	[0041.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.jpg") returned 0
	[0041.137] lstrlenA (lpString="*.jpg") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.jpeg") returned 0
	[0041.137] lstrlenA (lpString="*.jpeg") returned 6
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.psd") returned 0
	[0041.137] lstrlenA (lpString="*.psd") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.cdr") returned 0
	[0041.137] lstrlenA (lpString="*.cdr") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.dwg") returned 0
	[0041.137] lstrlenA (lpString="*.dwg") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.max") returned 0
	[0041.137] lstrlenA (lpString="*.max") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.bmp") returned 0
	[0041.137] lstrlenA (lpString="*.bmp") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.gif") returned 0
	[0041.137] lstrlenA (lpString="*.gif") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.png") returned 0
	[0041.137] lstrlenA (lpString="*.png") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.doc") returned 0
	[0041.137] lstrlenA (lpString="*.doc") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.docx") returned 0
	[0041.137] lstrlenA (lpString="*.docx") returned 6
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.xls") returned 0
	[0041.137] lstrlenA (lpString="*.xls") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.xlsx") returned 0
	[0041.137] lstrlenA (lpString="*.xlsx") returned 6
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ppt") returned 0
	[0041.137] lstrlenA (lpString="*.ppt") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.pptx") returned 0
	[0041.137] lstrlenA (lpString="*.pptx") returned 6
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.txt") returned 0
	[0041.137] lstrlenA (lpString="*.txt") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.pdf") returned 0
	[0041.137] lstrlenA (lpString="*.pdf") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.djvu") returned 0
	[0041.137] lstrlenA (lpString="*.djvu") returned 6
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.htm") returned 0
	[0041.137] lstrlenA (lpString="*.htm") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.html") returned 0
	[0041.137] lstrlenA (lpString="*.html") returned 6
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mdb") returned 0
	[0041.137] lstrlenA (lpString="*.mdb") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.cer") returned 0
	[0041.137] lstrlenA (lpString="*.cer") returned 5
	[0041.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.p12") returned 0
	[0041.138] lstrlenA (lpString="*.p12") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.pfx") returned 0
	[0041.138] lstrlenA (lpString="*.pfx") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.kwm") returned 0
	[0041.138] lstrlenA (lpString="*.kwm") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.pwm") returned 0
	[0041.138] lstrlenA (lpString="*.pwm") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.1cd") returned 0
	[0041.138] lstrlenA (lpString="*.1cd") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.md") returned 0
	[0041.138] lstrlenA (lpString="*.md") returned 4
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mdf") returned 0
	[0041.138] lstrlenA (lpString="*.mdf") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.dbf") returned 0
	[0041.138] lstrlenA (lpString="*.dbf") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.odt") returned 0
	[0041.138] lstrlenA (lpString="*.odt") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.vob") returned 0
	[0041.138] lstrlenA (lpString="*.vob") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ifo") returned 0
	[0041.138] lstrlenA (lpString="*.ifo") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.lnk") returned 0
	[0041.138] lstrlenA (lpString="*.lnk") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.torrent") returned 0
	[0041.138] lstrlenA (lpString="*.torrent") returned 9
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mov") returned 0
	[0041.138] lstrlenA (lpString="*.mov") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.m2v") returned 0
	[0041.138] lstrlenA (lpString="*.m2v") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.3gp") returned 0
	[0041.138] lstrlenA (lpString="*.3gp") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mpeg") returned 0
	[0041.138] lstrlenA (lpString="*.mpeg") returned 6
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mpg") returned 0
	[0041.138] lstrlenA (lpString="*.mpg") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.flv") returned 0
	[0041.138] lstrlenA (lpString="*.flv") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.avi") returned 0
	[0041.138] lstrlenA (lpString="*.avi") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mp4") returned 0
	[0041.138] lstrlenA (lpString="*.mp4") returned 5
	[0041.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.wmv") returned 0
	[0041.138] lstrlenA (lpString="*.wmv") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.divx") returned 0
	[0041.139] lstrlenA (lpString="*.divx") returned 6
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mkv") returned 0
	[0041.139] lstrlenA (lpString="*.mkv") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mp3") returned 0
	[0041.139] lstrlenA (lpString="*.mp3") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.wav") returned 0
	[0041.139] lstrlenA (lpString="*.wav") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.flac") returned 0
	[0041.139] lstrlenA (lpString="*.flac") returned 6
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ape") returned 0
	[0041.139] lstrlenA (lpString="*.ape") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.wma") returned 0
	[0041.139] lstrlenA (lpString="*.wma") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ac3") returned 0
	[0041.139] lstrlenA (lpString="*.ac3") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.exe") returned 0
	[0041.139] lstrlenA (lpString="*.exe") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.apk") returned 0
	[0041.139] lstrlenA (lpString="*.apk") returned 5
	[0041.139] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.139] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.139] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAYERS.INF") returned -1
	[0041.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAYERS.INF") returned -1
	[0041.139] lstrcmpiA (lpString1="", lpString2="LAYERS.INF") returned -1
	[0041.139] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned="LAYERS.ELM"
	[0041.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\"
	[0041.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned=""
	[0041.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt"
	[0041.139] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0x20
	[0041.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="LAYERS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF"
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.zip") returned 0
	[0041.139] lstrlenA (lpString="*.zip") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.rar") returned 0
	[0041.139] lstrlenA (lpString="*.rar") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.7z") returned 0
	[0041.139] lstrlenA (lpString="*.7z") returned 4
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.tar") returned 0
	[0041.139] lstrlenA (lpString="*.tar") returned 5
	[0041.139] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.gzip") returned 0
	[0041.139] lstrlenA (lpString="*.gzip") returned 6
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.jpg") returned 0
	[0041.140] lstrlenA (lpString="*.jpg") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.jpeg") returned 0
	[0041.140] lstrlenA (lpString="*.jpeg") returned 6
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.psd") returned 0
	[0041.140] lstrlenA (lpString="*.psd") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.cdr") returned 0
	[0041.140] lstrlenA (lpString="*.cdr") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.dwg") returned 0
	[0041.140] lstrlenA (lpString="*.dwg") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.max") returned 0
	[0041.140] lstrlenA (lpString="*.max") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.bmp") returned 0
	[0041.140] lstrlenA (lpString="*.bmp") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.gif") returned 0
	[0041.140] lstrlenA (lpString="*.gif") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.png") returned 0
	[0041.140] lstrlenA (lpString="*.png") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.doc") returned 0
	[0041.140] lstrlenA (lpString="*.doc") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.docx") returned 0
	[0041.140] lstrlenA (lpString="*.docx") returned 6
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.xls") returned 0
	[0041.140] lstrlenA (lpString="*.xls") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.xlsx") returned 0
	[0041.140] lstrlenA (lpString="*.xlsx") returned 6
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.ppt") returned 0
	[0041.140] lstrlenA (lpString="*.ppt") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.pptx") returned 0
	[0041.140] lstrlenA (lpString="*.pptx") returned 6
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.txt") returned 0
	[0041.140] lstrlenA (lpString="*.txt") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.pdf") returned 0
	[0041.140] lstrlenA (lpString="*.pdf") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.djvu") returned 0
	[0041.140] lstrlenA (lpString="*.djvu") returned 6
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.htm") returned 0
	[0041.140] lstrlenA (lpString="*.htm") returned 5
	[0041.140] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.html") returned 0
	[0041.141] lstrlenA (lpString="*.html") returned 6
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mdb") returned 0
	[0041.141] lstrlenA (lpString="*.mdb") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.cer") returned 0
	[0041.141] lstrlenA (lpString="*.cer") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.p12") returned 0
	[0041.141] lstrlenA (lpString="*.p12") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.pfx") returned 0
	[0041.141] lstrlenA (lpString="*.pfx") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.kwm") returned 0
	[0041.141] lstrlenA (lpString="*.kwm") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.pwm") returned 0
	[0041.141] lstrlenA (lpString="*.pwm") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.1cd") returned 0
	[0041.141] lstrlenA (lpString="*.1cd") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.md") returned 0
	[0041.141] lstrlenA (lpString="*.md") returned 4
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mdf") returned 0
	[0041.141] lstrlenA (lpString="*.mdf") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.dbf") returned 0
	[0041.141] lstrlenA (lpString="*.dbf") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.odt") returned 0
	[0041.141] lstrlenA (lpString="*.odt") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.vob") returned 0
	[0041.141] lstrlenA (lpString="*.vob") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.ifo") returned 0
	[0041.141] lstrlenA (lpString="*.ifo") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.lnk") returned 0
	[0041.141] lstrlenA (lpString="*.lnk") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.torrent") returned 0
	[0041.141] lstrlenA (lpString="*.torrent") returned 9
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mov") returned 0
	[0041.141] lstrlenA (lpString="*.mov") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.m2v") returned 0
	[0041.141] lstrlenA (lpString="*.m2v") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.3gp") returned 0
	[0041.141] lstrlenA (lpString="*.3gp") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mpeg") returned 0
	[0041.141] lstrlenA (lpString="*.mpeg") returned 6
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mpg") returned 0
	[0041.141] lstrlenA (lpString="*.mpg") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.flv") returned 0
	[0041.141] lstrlenA (lpString="*.flv") returned 5
	[0041.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.avi") returned 0
	[0041.142] lstrlenA (lpString="*.avi") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mp4") returned 0
	[0041.142] lstrlenA (lpString="*.mp4") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.wmv") returned 0
	[0041.142] lstrlenA (lpString="*.wmv") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.divx") returned 0
	[0041.142] lstrlenA (lpString="*.divx") returned 6
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mkv") returned 0
	[0041.142] lstrlenA (lpString="*.mkv") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mp3") returned 0
	[0041.142] lstrlenA (lpString="*.mp3") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.wav") returned 0
	[0041.142] lstrlenA (lpString="*.wav") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.flac") returned 0
	[0041.142] lstrlenA (lpString="*.flac") returned 6
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.ape") returned 0
	[0041.142] lstrlenA (lpString="*.ape") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.wma") returned 0
	[0041.142] lstrlenA (lpString="*.wma") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.ac3") returned 0
	[0041.142] lstrlenA (lpString="*.ac3") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.exe") returned 0
	[0041.142] lstrlenA (lpString="*.exe") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.apk") returned 0
	[0041.142] lstrlenA (lpString="*.apk") returned 5
	[0041.142] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.142] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.142] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.142] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.142] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned="LAYERS.INF"
	[0041.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\"
	[0041.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned=""
	[0041.142] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt"
	[0041.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0x20
	[0041.142] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF"
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.142] lstrlenA (lpString="*.zip") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.142] lstrlenA (lpString="*.rar") returned 5
	[0041.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.143] lstrlenA (lpString="*.7z") returned 4
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.143] lstrlenA (lpString="*.tar") returned 5
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.143] lstrlenA (lpString="*.gzip") returned 6
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.143] lstrlenA (lpString="*.jpg") returned 5
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.143] lstrlenA (lpString="*.jpeg") returned 6
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.143] lstrlenA (lpString="*.psd") returned 5
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.143] lstrlenA (lpString="*.cdr") returned 5
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.143] lstrlenA (lpString="*.dwg") returned 5
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.143] lstrlenA (lpString="*.max") returned 5
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.143] lstrlenA (lpString="*.bmp") returned 5
	[0041.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.143] lstrlenA (lpString="*.gif") returned 5
	[0041.143] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF"
	[0041.143] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF"
	[0041.143] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF."
	[0041.143] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.Boom"
	[0041.143] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.143] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67b
	[0041.143] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.143] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.143] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x658, lpOverlapped=0x0) returned 1
	[0041.145] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.145] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.145] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x658, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x658, lpOverlapped=0x0) returned 1
	[0041.145] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.145] CloseHandle (hObject=0x90) returned 1
	[0041.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.boom")) returned 1
	[0041.147] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.147] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.147] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\"
	[0041.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned=""
	[0041.147] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt"
	[0041.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0x20
	[0041.147] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG"
	[0041.147] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.147] lstrlenA (lpString="*.zip") returned 5
	[0041.147] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.147] lstrlenA (lpString="*.rar") returned 5
	[0041.147] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.148] lstrlenA (lpString="*.7z") returned 4
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.148] lstrlenA (lpString="*.tar") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.148] lstrlenA (lpString="*.gzip") returned 6
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.148] lstrlenA (lpString="*.jpg") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.148] lstrlenA (lpString="*.jpeg") returned 6
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.148] lstrlenA (lpString="*.psd") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.148] lstrlenA (lpString="*.cdr") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.148] lstrlenA (lpString="*.dwg") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.148] lstrlenA (lpString="*.max") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.148] lstrlenA (lpString="*.bmp") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.148] lstrlenA (lpString="*.gif") returned 5
	[0041.148] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.148] lstrlenA (lpString="*.png") returned 5
	[0041.148] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG"
	[0041.148] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG"
	[0041.148] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG."
	[0041.148] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.Boom"
	[0041.148] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.149] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf32
	[0041.149] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d489150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.149] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.149] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xaf0f, lpOverlapped=0x0) returned 1
	[0041.154] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.154] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.154] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xaf0f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xaf0f, lpOverlapped=0x0) returned 1
	[0041.154] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.154] CloseHandle (hObject=0x90) returned 1
	[0041.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.boom")) returned 1
	[0041.155] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.155] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0041.155] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.155] lstrcmpA (lpString1=".", lpString2="LEVEL") returned -1
	[0041.155] lstrcmpA (lpString1="..", lpString2="LEVEL") returned -1
	[0041.156] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="LEVEL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL"
	[0041.156] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL") returned 61
	[0041.156] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8ba478
	[0041.156] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.156] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.156] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.156] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.156] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.156] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.156] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LEVEL.ELM") returned -1
	[0041.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LEVEL.ELM") returned -1
	[0041.156] lstrcmpiA (lpString1="", lpString2="LEVEL.ELM") returned -1
	[0041.156] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*") returned="*.*"
	[0041.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\"
	[0041.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned=""
	[0041.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt"
	[0041.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0xffffffff
	[0041.156] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.156] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.156] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.157] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.157] CloseHandle (hObject=0x90) returned 1
	[0041.158] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="LEVEL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM"
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.zip") returned 0
	[0041.158] lstrlenA (lpString="*.zip") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.rar") returned 0
	[0041.158] lstrlenA (lpString="*.rar") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.7z") returned 0
	[0041.158] lstrlenA (lpString="*.7z") returned 4
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.tar") returned 0
	[0041.158] lstrlenA (lpString="*.tar") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.gzip") returned 0
	[0041.158] lstrlenA (lpString="*.gzip") returned 6
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.jpg") returned 0
	[0041.158] lstrlenA (lpString="*.jpg") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.jpeg") returned 0
	[0041.158] lstrlenA (lpString="*.jpeg") returned 6
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.psd") returned 0
	[0041.158] lstrlenA (lpString="*.psd") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.cdr") returned 0
	[0041.158] lstrlenA (lpString="*.cdr") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.dwg") returned 0
	[0041.158] lstrlenA (lpString="*.dwg") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.max") returned 0
	[0041.158] lstrlenA (lpString="*.max") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.bmp") returned 0
	[0041.158] lstrlenA (lpString="*.bmp") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.gif") returned 0
	[0041.158] lstrlenA (lpString="*.gif") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.png") returned 0
	[0041.158] lstrlenA (lpString="*.png") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.doc") returned 0
	[0041.158] lstrlenA (lpString="*.doc") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.docx") returned 0
	[0041.158] lstrlenA (lpString="*.docx") returned 6
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.xls") returned 0
	[0041.158] lstrlenA (lpString="*.xls") returned 5
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.xlsx") returned 0
	[0041.158] lstrlenA (lpString="*.xlsx") returned 6
	[0041.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ppt") returned 0
	[0041.158] lstrlenA (lpString="*.ppt") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.pptx") returned 0
	[0041.159] lstrlenA (lpString="*.pptx") returned 6
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.txt") returned 0
	[0041.159] lstrlenA (lpString="*.txt") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.pdf") returned 0
	[0041.159] lstrlenA (lpString="*.pdf") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.djvu") returned 0
	[0041.159] lstrlenA (lpString="*.djvu") returned 6
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.htm") returned 0
	[0041.159] lstrlenA (lpString="*.htm") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.html") returned 0
	[0041.159] lstrlenA (lpString="*.html") returned 6
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mdb") returned 0
	[0041.159] lstrlenA (lpString="*.mdb") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.cer") returned 0
	[0041.159] lstrlenA (lpString="*.cer") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.p12") returned 0
	[0041.159] lstrlenA (lpString="*.p12") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.pfx") returned 0
	[0041.159] lstrlenA (lpString="*.pfx") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.kwm") returned 0
	[0041.159] lstrlenA (lpString="*.kwm") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.pwm") returned 0
	[0041.159] lstrlenA (lpString="*.pwm") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.1cd") returned 0
	[0041.159] lstrlenA (lpString="*.1cd") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.md") returned 0
	[0041.159] lstrlenA (lpString="*.md") returned 4
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mdf") returned 0
	[0041.159] lstrlenA (lpString="*.mdf") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.dbf") returned 0
	[0041.159] lstrlenA (lpString="*.dbf") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.odt") returned 0
	[0041.159] lstrlenA (lpString="*.odt") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.vob") returned 0
	[0041.159] lstrlenA (lpString="*.vob") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ifo") returned 0
	[0041.159] lstrlenA (lpString="*.ifo") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.lnk") returned 0
	[0041.159] lstrlenA (lpString="*.lnk") returned 5
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.torrent") returned 0
	[0041.159] lstrlenA (lpString="*.torrent") returned 9
	[0041.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mov") returned 0
	[0041.160] lstrlenA (lpString="*.mov") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.m2v") returned 0
	[0041.160] lstrlenA (lpString="*.m2v") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.3gp") returned 0
	[0041.160] lstrlenA (lpString="*.3gp") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mpeg") returned 0
	[0041.160] lstrlenA (lpString="*.mpeg") returned 6
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mpg") returned 0
	[0041.160] lstrlenA (lpString="*.mpg") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.flv") returned 0
	[0041.160] lstrlenA (lpString="*.flv") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.avi") returned 0
	[0041.160] lstrlenA (lpString="*.avi") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mp4") returned 0
	[0041.160] lstrlenA (lpString="*.mp4") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.wmv") returned 0
	[0041.160] lstrlenA (lpString="*.wmv") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.divx") returned 0
	[0041.160] lstrlenA (lpString="*.divx") returned 6
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mkv") returned 0
	[0041.160] lstrlenA (lpString="*.mkv") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mp3") returned 0
	[0041.160] lstrlenA (lpString="*.mp3") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.wav") returned 0
	[0041.160] lstrlenA (lpString="*.wav") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.flac") returned 0
	[0041.160] lstrlenA (lpString="*.flac") returned 6
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ape") returned 0
	[0041.160] lstrlenA (lpString="*.ape") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.wma") returned 0
	[0041.160] lstrlenA (lpString="*.wma") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ac3") returned 0
	[0041.160] lstrlenA (lpString="*.ac3") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.exe") returned 0
	[0041.160] lstrlenA (lpString="*.exe") returned 5
	[0041.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.apk") returned 0
	[0041.160] lstrlenA (lpString="*.apk") returned 5
	[0041.160] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.160] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.160] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LEVEL.INF") returned -1
	[0041.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LEVEL.INF") returned -1
	[0041.160] lstrcmpiA (lpString1="", lpString2="LEVEL.INF") returned -1
	[0041.160] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned="LEVEL.ELM"
	[0041.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\"
	[0041.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned=""
	[0041.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt"
	[0041.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0x20
	[0041.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="LEVEL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF"
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.zip") returned 0
	[0041.161] lstrlenA (lpString="*.zip") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.rar") returned 0
	[0041.161] lstrlenA (lpString="*.rar") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.7z") returned 0
	[0041.161] lstrlenA (lpString="*.7z") returned 4
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.tar") returned 0
	[0041.161] lstrlenA (lpString="*.tar") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.gzip") returned 0
	[0041.161] lstrlenA (lpString="*.gzip") returned 6
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.jpg") returned 0
	[0041.161] lstrlenA (lpString="*.jpg") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.jpeg") returned 0
	[0041.161] lstrlenA (lpString="*.jpeg") returned 6
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.psd") returned 0
	[0041.161] lstrlenA (lpString="*.psd") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.cdr") returned 0
	[0041.161] lstrlenA (lpString="*.cdr") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.dwg") returned 0
	[0041.161] lstrlenA (lpString="*.dwg") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.max") returned 0
	[0041.161] lstrlenA (lpString="*.max") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.bmp") returned 0
	[0041.161] lstrlenA (lpString="*.bmp") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.gif") returned 0
	[0041.161] lstrlenA (lpString="*.gif") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.png") returned 0
	[0041.161] lstrlenA (lpString="*.png") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.doc") returned 0
	[0041.161] lstrlenA (lpString="*.doc") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.docx") returned 0
	[0041.161] lstrlenA (lpString="*.docx") returned 6
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.xls") returned 0
	[0041.161] lstrlenA (lpString="*.xls") returned 5
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.xlsx") returned 0
	[0041.161] lstrlenA (lpString="*.xlsx") returned 6
	[0041.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.ppt") returned 0
	[0041.161] lstrlenA (lpString="*.ppt") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.pptx") returned 0
	[0041.162] lstrlenA (lpString="*.pptx") returned 6
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.txt") returned 0
	[0041.162] lstrlenA (lpString="*.txt") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.pdf") returned 0
	[0041.162] lstrlenA (lpString="*.pdf") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.djvu") returned 0
	[0041.162] lstrlenA (lpString="*.djvu") returned 6
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.htm") returned 0
	[0041.162] lstrlenA (lpString="*.htm") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.html") returned 0
	[0041.162] lstrlenA (lpString="*.html") returned 6
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mdb") returned 0
	[0041.162] lstrlenA (lpString="*.mdb") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.cer") returned 0
	[0041.162] lstrlenA (lpString="*.cer") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.p12") returned 0
	[0041.162] lstrlenA (lpString="*.p12") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.pfx") returned 0
	[0041.162] lstrlenA (lpString="*.pfx") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.kwm") returned 0
	[0041.162] lstrlenA (lpString="*.kwm") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.pwm") returned 0
	[0041.162] lstrlenA (lpString="*.pwm") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.1cd") returned 0
	[0041.162] lstrlenA (lpString="*.1cd") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.md") returned 0
	[0041.162] lstrlenA (lpString="*.md") returned 4
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mdf") returned 0
	[0041.162] lstrlenA (lpString="*.mdf") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.dbf") returned 0
	[0041.162] lstrlenA (lpString="*.dbf") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.odt") returned 0
	[0041.162] lstrlenA (lpString="*.odt") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.vob") returned 0
	[0041.162] lstrlenA (lpString="*.vob") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.ifo") returned 0
	[0041.162] lstrlenA (lpString="*.ifo") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.lnk") returned 0
	[0041.162] lstrlenA (lpString="*.lnk") returned 5
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.torrent") returned 0
	[0041.162] lstrlenA (lpString="*.torrent") returned 9
	[0041.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mov") returned 0
	[0041.163] lstrlenA (lpString="*.mov") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.m2v") returned 0
	[0041.163] lstrlenA (lpString="*.m2v") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.3gp") returned 0
	[0041.163] lstrlenA (lpString="*.3gp") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mpeg") returned 0
	[0041.163] lstrlenA (lpString="*.mpeg") returned 6
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mpg") returned 0
	[0041.163] lstrlenA (lpString="*.mpg") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.flv") returned 0
	[0041.163] lstrlenA (lpString="*.flv") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.avi") returned 0
	[0041.163] lstrlenA (lpString="*.avi") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mp4") returned 0
	[0041.163] lstrlenA (lpString="*.mp4") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.wmv") returned 0
	[0041.163] lstrlenA (lpString="*.wmv") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.divx") returned 0
	[0041.163] lstrlenA (lpString="*.divx") returned 6
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mkv") returned 0
	[0041.163] lstrlenA (lpString="*.mkv") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mp3") returned 0
	[0041.163] lstrlenA (lpString="*.mp3") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.wav") returned 0
	[0041.163] lstrlenA (lpString="*.wav") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.flac") returned 0
	[0041.163] lstrlenA (lpString="*.flac") returned 6
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.ape") returned 0
	[0041.163] lstrlenA (lpString="*.ape") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.wma") returned 0
	[0041.163] lstrlenA (lpString="*.wma") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.ac3") returned 0
	[0041.163] lstrlenA (lpString="*.ac3") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.exe") returned 0
	[0041.163] lstrlenA (lpString="*.exe") returned 5
	[0041.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.apk") returned 0
	[0041.163] lstrlenA (lpString="*.apk") returned 5
	[0041.163] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.163] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.163] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.163] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.163] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned="LEVEL.INF"
	[0041.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\"
	[0041.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned=""
	[0041.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt"
	[0041.164] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0x20
	[0041.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF"
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.164] lstrlenA (lpString="*.zip") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.164] lstrlenA (lpString="*.rar") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.164] lstrlenA (lpString="*.7z") returned 4
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.164] lstrlenA (lpString="*.tar") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.164] lstrlenA (lpString="*.gzip") returned 6
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.164] lstrlenA (lpString="*.jpg") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.164] lstrlenA (lpString="*.jpeg") returned 6
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.164] lstrlenA (lpString="*.psd") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.164] lstrlenA (lpString="*.cdr") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.164] lstrlenA (lpString="*.dwg") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.164] lstrlenA (lpString="*.max") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.164] lstrlenA (lpString="*.bmp") returned 5
	[0041.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.164] lstrlenA (lpString="*.gif") returned 5
	[0041.164] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF"
	[0041.164] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF"
	[0041.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF."
	[0041.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.Boom"
	[0041.164] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.165] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x563
	[0041.165] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.165] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.165] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x540, lpOverlapped=0x0) returned 1
	[0041.167] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.167] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.167] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x540, lpOverlapped=0x0) returned 1
	[0041.167] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.167] CloseHandle (hObject=0x90) returned 1
	[0041.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.boom")) returned 1
	[0041.169] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.169] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.169] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.169] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.169] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\"
	[0041.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned=""
	[0041.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt"
	[0041.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0x20
	[0041.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG"
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.170] lstrlenA (lpString="*.zip") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.170] lstrlenA (lpString="*.rar") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.170] lstrlenA (lpString="*.7z") returned 4
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.170] lstrlenA (lpString="*.tar") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.170] lstrlenA (lpString="*.gzip") returned 6
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.170] lstrlenA (lpString="*.jpg") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.170] lstrlenA (lpString="*.jpeg") returned 6
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.170] lstrlenA (lpString="*.psd") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.170] lstrlenA (lpString="*.cdr") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.170] lstrlenA (lpString="*.dwg") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.170] lstrlenA (lpString="*.max") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.170] lstrlenA (lpString="*.bmp") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.170] lstrlenA (lpString="*.gif") returned 5
	[0041.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.170] lstrlenA (lpString="*.png") returned 5
	[0041.171] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG"
	[0041.171] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG"
	[0041.171] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG."
	[0041.171] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.Boom"
	[0041.171] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.171] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbbf3
	[0041.171] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.171] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.171] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbbd0, lpOverlapped=0x0) returned 1
	[0041.173] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.173] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.173] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbbd0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbbd0, lpOverlapped=0x0) returned 1
	[0041.173] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.173] CloseHandle (hObject=0x90) returned 1
	[0041.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.boom")) returned 1
	[0041.175] FindNextFileA (in: hFindFile=0x8ba478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.175] FindClose (in: hFindFile=0x8ba478 | out: hFindFile=0x8ba478) returned 1
	[0041.175] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.175] lstrcmpA (lpString1=".", lpString2="NETWORK") returned -1
	[0041.175] lstrcmpA (lpString1="..", lpString2="NETWORK") returned -1
	[0041.175] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.175] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="NETWORK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK"
	[0041.175] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK") returned 63
	[0041.175] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.176] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.176] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.176] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.176] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.176] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.176] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NETWORK.ELM") returned -1
	[0041.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK.ELM") returned -1
	[0041.176] lstrcmpiA (lpString1="", lpString2="NETWORK.ELM") returned -1
	[0041.176] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*") returned="*.*"
	[0041.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\"
	[0041.176] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned=""
	[0041.176] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt"
	[0041.176] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0xffffffff
	[0041.176] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.176] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.176] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.177] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.177] CloseHandle (hObject=0x90) returned 1
	[0041.178] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="NETWORK.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM"
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.zip") returned 0
	[0041.178] lstrlenA (lpString="*.zip") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.rar") returned 0
	[0041.178] lstrlenA (lpString="*.rar") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.7z") returned 0
	[0041.178] lstrlenA (lpString="*.7z") returned 4
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.tar") returned 0
	[0041.178] lstrlenA (lpString="*.tar") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.gzip") returned 0
	[0041.178] lstrlenA (lpString="*.gzip") returned 6
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.jpg") returned 0
	[0041.178] lstrlenA (lpString="*.jpg") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.jpeg") returned 0
	[0041.178] lstrlenA (lpString="*.jpeg") returned 6
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.psd") returned 0
	[0041.178] lstrlenA (lpString="*.psd") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.cdr") returned 0
	[0041.178] lstrlenA (lpString="*.cdr") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.dwg") returned 0
	[0041.178] lstrlenA (lpString="*.dwg") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.max") returned 0
	[0041.178] lstrlenA (lpString="*.max") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.bmp") returned 0
	[0041.178] lstrlenA (lpString="*.bmp") returned 5
	[0041.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.gif") returned 0
	[0041.178] lstrlenA (lpString="*.gif") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.png") returned 0
	[0041.179] lstrlenA (lpString="*.png") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.doc") returned 0
	[0041.179] lstrlenA (lpString="*.doc") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.docx") returned 0
	[0041.179] lstrlenA (lpString="*.docx") returned 6
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.xls") returned 0
	[0041.179] lstrlenA (lpString="*.xls") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.xlsx") returned 0
	[0041.179] lstrlenA (lpString="*.xlsx") returned 6
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ppt") returned 0
	[0041.179] lstrlenA (lpString="*.ppt") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.pptx") returned 0
	[0041.179] lstrlenA (lpString="*.pptx") returned 6
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.txt") returned 0
	[0041.179] lstrlenA (lpString="*.txt") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.pdf") returned 0
	[0041.179] lstrlenA (lpString="*.pdf") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.djvu") returned 0
	[0041.179] lstrlenA (lpString="*.djvu") returned 6
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.htm") returned 0
	[0041.179] lstrlenA (lpString="*.htm") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.html") returned 0
	[0041.179] lstrlenA (lpString="*.html") returned 6
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mdb") returned 0
	[0041.179] lstrlenA (lpString="*.mdb") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.cer") returned 0
	[0041.179] lstrlenA (lpString="*.cer") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.p12") returned 0
	[0041.179] lstrlenA (lpString="*.p12") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.pfx") returned 0
	[0041.179] lstrlenA (lpString="*.pfx") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.kwm") returned 0
	[0041.179] lstrlenA (lpString="*.kwm") returned 5
	[0041.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.pwm") returned 0
	[0041.179] lstrlenA (lpString="*.pwm") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.1cd") returned 0
	[0041.180] lstrlenA (lpString="*.1cd") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.md") returned 0
	[0041.180] lstrlenA (lpString="*.md") returned 4
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mdf") returned 0
	[0041.180] lstrlenA (lpString="*.mdf") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.dbf") returned 0
	[0041.180] lstrlenA (lpString="*.dbf") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.odt") returned 0
	[0041.180] lstrlenA (lpString="*.odt") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.vob") returned 0
	[0041.180] lstrlenA (lpString="*.vob") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ifo") returned 0
	[0041.180] lstrlenA (lpString="*.ifo") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.lnk") returned 0
	[0041.180] lstrlenA (lpString="*.lnk") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.torrent") returned 0
	[0041.180] lstrlenA (lpString="*.torrent") returned 9
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mov") returned 0
	[0041.180] lstrlenA (lpString="*.mov") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.m2v") returned 0
	[0041.180] lstrlenA (lpString="*.m2v") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.3gp") returned 0
	[0041.180] lstrlenA (lpString="*.3gp") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mpeg") returned 0
	[0041.180] lstrlenA (lpString="*.mpeg") returned 6
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mpg") returned 0
	[0041.180] lstrlenA (lpString="*.mpg") returned 5
	[0041.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.flv") returned 0
	[0041.180] lstrlenA (lpString="*.flv") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.avi") returned 0
	[0041.181] lstrlenA (lpString="*.avi") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mp4") returned 0
	[0041.181] lstrlenA (lpString="*.mp4") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.wmv") returned 0
	[0041.181] lstrlenA (lpString="*.wmv") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.divx") returned 0
	[0041.181] lstrlenA (lpString="*.divx") returned 6
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mkv") returned 0
	[0041.181] lstrlenA (lpString="*.mkv") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mp3") returned 0
	[0041.181] lstrlenA (lpString="*.mp3") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.wav") returned 0
	[0041.181] lstrlenA (lpString="*.wav") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.flac") returned 0
	[0041.181] lstrlenA (lpString="*.flac") returned 6
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ape") returned 0
	[0041.181] lstrlenA (lpString="*.ape") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.wma") returned 0
	[0041.181] lstrlenA (lpString="*.wma") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ac3") returned 0
	[0041.181] lstrlenA (lpString="*.ac3") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.exe") returned 0
	[0041.181] lstrlenA (lpString="*.exe") returned 5
	[0041.181] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.apk") returned 0
	[0041.181] lstrlenA (lpString="*.apk") returned 5
	[0041.181] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.181] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NETWORK.INF") returned -1
	[0041.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK.INF") returned -1
	[0041.181] lstrcmpiA (lpString1="", lpString2="NETWORK.INF") returned -1
	[0041.181] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned="NETWORK.ELM"
	[0041.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\"
	[0041.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned=""
	[0041.181] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt"
	[0041.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0x20
	[0041.182] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="NETWORK.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF"
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.zip") returned 0
	[0041.182] lstrlenA (lpString="*.zip") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.rar") returned 0
	[0041.182] lstrlenA (lpString="*.rar") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.7z") returned 0
	[0041.182] lstrlenA (lpString="*.7z") returned 4
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.tar") returned 0
	[0041.182] lstrlenA (lpString="*.tar") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.gzip") returned 0
	[0041.182] lstrlenA (lpString="*.gzip") returned 6
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.jpg") returned 0
	[0041.182] lstrlenA (lpString="*.jpg") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.jpeg") returned 0
	[0041.182] lstrlenA (lpString="*.jpeg") returned 6
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.psd") returned 0
	[0041.182] lstrlenA (lpString="*.psd") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.cdr") returned 0
	[0041.182] lstrlenA (lpString="*.cdr") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.dwg") returned 0
	[0041.182] lstrlenA (lpString="*.dwg") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.max") returned 0
	[0041.182] lstrlenA (lpString="*.max") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.bmp") returned 0
	[0041.182] lstrlenA (lpString="*.bmp") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.gif") returned 0
	[0041.182] lstrlenA (lpString="*.gif") returned 5
	[0041.182] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.png") returned 0
	[0041.182] lstrlenA (lpString="*.png") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.doc") returned 0
	[0041.183] lstrlenA (lpString="*.doc") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.docx") returned 0
	[0041.183] lstrlenA (lpString="*.docx") returned 6
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.xls") returned 0
	[0041.183] lstrlenA (lpString="*.xls") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.xlsx") returned 0
	[0041.183] lstrlenA (lpString="*.xlsx") returned 6
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.ppt") returned 0
	[0041.183] lstrlenA (lpString="*.ppt") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.pptx") returned 0
	[0041.183] lstrlenA (lpString="*.pptx") returned 6
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.txt") returned 0
	[0041.183] lstrlenA (lpString="*.txt") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.pdf") returned 0
	[0041.183] lstrlenA (lpString="*.pdf") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.djvu") returned 0
	[0041.183] lstrlenA (lpString="*.djvu") returned 6
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.htm") returned 0
	[0041.183] lstrlenA (lpString="*.htm") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.html") returned 0
	[0041.183] lstrlenA (lpString="*.html") returned 6
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mdb") returned 0
	[0041.183] lstrlenA (lpString="*.mdb") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.cer") returned 0
	[0041.183] lstrlenA (lpString="*.cer") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.p12") returned 0
	[0041.183] lstrlenA (lpString="*.p12") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.pfx") returned 0
	[0041.183] lstrlenA (lpString="*.pfx") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.kwm") returned 0
	[0041.183] lstrlenA (lpString="*.kwm") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.pwm") returned 0
	[0041.183] lstrlenA (lpString="*.pwm") returned 5
	[0041.183] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.1cd") returned 0
	[0041.183] lstrlenA (lpString="*.1cd") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.md") returned 0
	[0041.184] lstrlenA (lpString="*.md") returned 4
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mdf") returned 0
	[0041.184] lstrlenA (lpString="*.mdf") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.dbf") returned 0
	[0041.184] lstrlenA (lpString="*.dbf") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.odt") returned 0
	[0041.184] lstrlenA (lpString="*.odt") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.vob") returned 0
	[0041.184] lstrlenA (lpString="*.vob") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.ifo") returned 0
	[0041.184] lstrlenA (lpString="*.ifo") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.lnk") returned 0
	[0041.184] lstrlenA (lpString="*.lnk") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.torrent") returned 0
	[0041.184] lstrlenA (lpString="*.torrent") returned 9
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mov") returned 0
	[0041.184] lstrlenA (lpString="*.mov") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.m2v") returned 0
	[0041.184] lstrlenA (lpString="*.m2v") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.3gp") returned 0
	[0041.184] lstrlenA (lpString="*.3gp") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mpeg") returned 0
	[0041.184] lstrlenA (lpString="*.mpeg") returned 6
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mpg") returned 0
	[0041.184] lstrlenA (lpString="*.mpg") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.flv") returned 0
	[0041.184] lstrlenA (lpString="*.flv") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.avi") returned 0
	[0041.184] lstrlenA (lpString="*.avi") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mp4") returned 0
	[0041.184] lstrlenA (lpString="*.mp4") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.wmv") returned 0
	[0041.184] lstrlenA (lpString="*.wmv") returned 5
	[0041.184] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.divx") returned 0
	[0041.184] lstrlenA (lpString="*.divx") returned 6
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mkv") returned 0
	[0041.185] lstrlenA (lpString="*.mkv") returned 5
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mp3") returned 0
	[0041.185] lstrlenA (lpString="*.mp3") returned 5
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.wav") returned 0
	[0041.185] lstrlenA (lpString="*.wav") returned 5
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.flac") returned 0
	[0041.185] lstrlenA (lpString="*.flac") returned 6
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.ape") returned 0
	[0041.185] lstrlenA (lpString="*.ape") returned 5
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.wma") returned 0
	[0041.185] lstrlenA (lpString="*.wma") returned 5
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.ac3") returned 0
	[0041.185] lstrlenA (lpString="*.ac3") returned 5
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.exe") returned 0
	[0041.185] lstrlenA (lpString="*.exe") returned 5
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.apk") returned 0
	[0041.185] lstrlenA (lpString="*.apk") returned 5
	[0041.185] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.185] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.185] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.185] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.185] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned="NETWORK.INF"
	[0041.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\"
	[0041.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned=""
	[0041.185] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt"
	[0041.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0x20
	[0041.185] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF"
	[0041.185] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.185] lstrlenA (lpString="*.zip") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.186] lstrlenA (lpString="*.rar") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.186] lstrlenA (lpString="*.7z") returned 4
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.186] lstrlenA (lpString="*.tar") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.186] lstrlenA (lpString="*.gzip") returned 6
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.186] lstrlenA (lpString="*.jpg") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.186] lstrlenA (lpString="*.jpeg") returned 6
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.186] lstrlenA (lpString="*.psd") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.186] lstrlenA (lpString="*.cdr") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.186] lstrlenA (lpString="*.dwg") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.186] lstrlenA (lpString="*.max") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.186] lstrlenA (lpString="*.bmp") returned 5
	[0041.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.186] lstrlenA (lpString="*.gif") returned 5
	[0041.186] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF"
	[0041.186] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF"
	[0041.186] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF."
	[0041.186] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.Boom"
	[0041.186] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.187] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554
	[0041.187] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.187] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.187] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x531, lpOverlapped=0x0) returned 1
	[0041.188] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.188] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.189] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x531, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x531, lpOverlapped=0x0) returned 1
	[0041.189] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.189] CloseHandle (hObject=0x90) returned 1
	[0041.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.boom")) returned 1
	[0041.205] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.205] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.205] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.205] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.205] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\"
	[0041.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned=""
	[0041.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt"
	[0041.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0x20
	[0041.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG"
	[0041.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.205] lstrlenA (lpString="*.zip") returned 5
	[0041.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.206] lstrlenA (lpString="*.rar") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.206] lstrlenA (lpString="*.7z") returned 4
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.206] lstrlenA (lpString="*.tar") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.206] lstrlenA (lpString="*.gzip") returned 6
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.206] lstrlenA (lpString="*.jpg") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.206] lstrlenA (lpString="*.jpeg") returned 6
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.206] lstrlenA (lpString="*.psd") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.206] lstrlenA (lpString="*.cdr") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.206] lstrlenA (lpString="*.dwg") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.206] lstrlenA (lpString="*.max") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.206] lstrlenA (lpString="*.bmp") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.206] lstrlenA (lpString="*.gif") returned 5
	[0041.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.206] lstrlenA (lpString="*.png") returned 5
	[0041.206] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG"
	[0041.206] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG"
	[0041.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG."
	[0041.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.Boom"
	[0041.206] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.207] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d35
	[0041.207] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d489150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.207] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.207] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2d12, lpOverlapped=0x0) returned 1
	[0041.212] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.213] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.213] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2d12, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2d12, lpOverlapped=0x0) returned 1
	[0041.213] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.213] CloseHandle (hObject=0x90) returned 1
	[0041.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.boom")) returned 1
	[0041.214] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.214] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0041.214] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.214] lstrcmpA (lpString1=".", lpString2="PAPYRUS") returned -1
	[0041.214] lstrcmpA (lpString1="..", lpString2="PAPYRUS") returned -1
	[0041.214] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.215] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="PAPYRUS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS"
	[0041.215] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS") returned 63
	[0041.215] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.216] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.216] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.216] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.216] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.216] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.216] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PAPYRUS.ELM") returned -1
	[0041.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PAPYRUS.ELM") returned -1
	[0041.216] lstrcmpiA (lpString1="", lpString2="PAPYRUS.ELM") returned -1
	[0041.216] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*") returned="*.*"
	[0041.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\"
	[0041.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned=""
	[0041.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt"
	[0041.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0xffffffff
	[0041.216] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.216] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.216] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.217] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.217] CloseHandle (hObject=0x90) returned 1
	[0041.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="PAPYRUS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM"
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.zip") returned 0
	[0041.218] lstrlenA (lpString="*.zip") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.rar") returned 0
	[0041.218] lstrlenA (lpString="*.rar") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.7z") returned 0
	[0041.218] lstrlenA (lpString="*.7z") returned 4
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.tar") returned 0
	[0041.218] lstrlenA (lpString="*.tar") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.gzip") returned 0
	[0041.218] lstrlenA (lpString="*.gzip") returned 6
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.jpg") returned 0
	[0041.218] lstrlenA (lpString="*.jpg") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.jpeg") returned 0
	[0041.218] lstrlenA (lpString="*.jpeg") returned 6
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.psd") returned 0
	[0041.218] lstrlenA (lpString="*.psd") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.cdr") returned 0
	[0041.218] lstrlenA (lpString="*.cdr") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.dwg") returned 0
	[0041.218] lstrlenA (lpString="*.dwg") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.max") returned 0
	[0041.218] lstrlenA (lpString="*.max") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.bmp") returned 0
	[0041.218] lstrlenA (lpString="*.bmp") returned 5
	[0041.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.gif") returned 0
	[0041.219] lstrlenA (lpString="*.gif") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.png") returned 0
	[0041.219] lstrlenA (lpString="*.png") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.doc") returned 0
	[0041.219] lstrlenA (lpString="*.doc") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.docx") returned 0
	[0041.219] lstrlenA (lpString="*.docx") returned 6
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.xls") returned 0
	[0041.219] lstrlenA (lpString="*.xls") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.xlsx") returned 0
	[0041.219] lstrlenA (lpString="*.xlsx") returned 6
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ppt") returned 0
	[0041.219] lstrlenA (lpString="*.ppt") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.pptx") returned 0
	[0041.219] lstrlenA (lpString="*.pptx") returned 6
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.txt") returned 0
	[0041.219] lstrlenA (lpString="*.txt") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.pdf") returned 0
	[0041.219] lstrlenA (lpString="*.pdf") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.djvu") returned 0
	[0041.219] lstrlenA (lpString="*.djvu") returned 6
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.htm") returned 0
	[0041.219] lstrlenA (lpString="*.htm") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.html") returned 0
	[0041.219] lstrlenA (lpString="*.html") returned 6
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mdb") returned 0
	[0041.219] lstrlenA (lpString="*.mdb") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.cer") returned 0
	[0041.219] lstrlenA (lpString="*.cer") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.p12") returned 0
	[0041.219] lstrlenA (lpString="*.p12") returned 5
	[0041.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.pfx") returned 0
	[0041.219] lstrlenA (lpString="*.pfx") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.kwm") returned 0
	[0041.220] lstrlenA (lpString="*.kwm") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.pwm") returned 0
	[0041.220] lstrlenA (lpString="*.pwm") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.1cd") returned 0
	[0041.220] lstrlenA (lpString="*.1cd") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.md") returned 0
	[0041.220] lstrlenA (lpString="*.md") returned 4
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mdf") returned 0
	[0041.220] lstrlenA (lpString="*.mdf") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.dbf") returned 0
	[0041.220] lstrlenA (lpString="*.dbf") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.odt") returned 0
	[0041.220] lstrlenA (lpString="*.odt") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.vob") returned 0
	[0041.220] lstrlenA (lpString="*.vob") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ifo") returned 0
	[0041.220] lstrlenA (lpString="*.ifo") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.lnk") returned 0
	[0041.220] lstrlenA (lpString="*.lnk") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.torrent") returned 0
	[0041.220] lstrlenA (lpString="*.torrent") returned 9
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mov") returned 0
	[0041.220] lstrlenA (lpString="*.mov") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.m2v") returned 0
	[0041.220] lstrlenA (lpString="*.m2v") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.3gp") returned 0
	[0041.220] lstrlenA (lpString="*.3gp") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mpeg") returned 0
	[0041.220] lstrlenA (lpString="*.mpeg") returned 6
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mpg") returned 0
	[0041.220] lstrlenA (lpString="*.mpg") returned 5
	[0041.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.flv") returned 0
	[0041.221] lstrlenA (lpString="*.flv") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.avi") returned 0
	[0041.221] lstrlenA (lpString="*.avi") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mp4") returned 0
	[0041.221] lstrlenA (lpString="*.mp4") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.wmv") returned 0
	[0041.221] lstrlenA (lpString="*.wmv") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.divx") returned 0
	[0041.221] lstrlenA (lpString="*.divx") returned 6
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mkv") returned 0
	[0041.221] lstrlenA (lpString="*.mkv") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mp3") returned 0
	[0041.221] lstrlenA (lpString="*.mp3") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.wav") returned 0
	[0041.221] lstrlenA (lpString="*.wav") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.flac") returned 0
	[0041.221] lstrlenA (lpString="*.flac") returned 6
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ape") returned 0
	[0041.221] lstrlenA (lpString="*.ape") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.wma") returned 0
	[0041.221] lstrlenA (lpString="*.wma") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ac3") returned 0
	[0041.221] lstrlenA (lpString="*.ac3") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.exe") returned 0
	[0041.221] lstrlenA (lpString="*.exe") returned 5
	[0041.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.apk") returned 0
	[0041.221] lstrlenA (lpString="*.apk") returned 5
	[0041.221] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.221] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PAPYRUS.INF") returned -1
	[0041.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PAPYRUS.INF") returned -1
	[0041.221] lstrcmpiA (lpString1="", lpString2="PAPYRUS.INF") returned -1
	[0041.221] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned="PAPYRUS.ELM"
	[0041.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\"
	[0041.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned=""
	[0041.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt"
	[0041.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0x20
	[0041.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="PAPYRUS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF"
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.zip") returned 0
	[0041.222] lstrlenA (lpString="*.zip") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.rar") returned 0
	[0041.222] lstrlenA (lpString="*.rar") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.7z") returned 0
	[0041.222] lstrlenA (lpString="*.7z") returned 4
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.tar") returned 0
	[0041.222] lstrlenA (lpString="*.tar") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.gzip") returned 0
	[0041.222] lstrlenA (lpString="*.gzip") returned 6
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.jpg") returned 0
	[0041.222] lstrlenA (lpString="*.jpg") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.jpeg") returned 0
	[0041.222] lstrlenA (lpString="*.jpeg") returned 6
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.psd") returned 0
	[0041.222] lstrlenA (lpString="*.psd") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.cdr") returned 0
	[0041.222] lstrlenA (lpString="*.cdr") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.dwg") returned 0
	[0041.222] lstrlenA (lpString="*.dwg") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.max") returned 0
	[0041.222] lstrlenA (lpString="*.max") returned 5
	[0041.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.bmp") returned 0
	[0041.222] lstrlenA (lpString="*.bmp") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.gif") returned 0
	[0041.223] lstrlenA (lpString="*.gif") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.png") returned 0
	[0041.223] lstrlenA (lpString="*.png") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.doc") returned 0
	[0041.223] lstrlenA (lpString="*.doc") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.docx") returned 0
	[0041.223] lstrlenA (lpString="*.docx") returned 6
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.xls") returned 0
	[0041.223] lstrlenA (lpString="*.xls") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.xlsx") returned 0
	[0041.223] lstrlenA (lpString="*.xlsx") returned 6
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.ppt") returned 0
	[0041.223] lstrlenA (lpString="*.ppt") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.pptx") returned 0
	[0041.223] lstrlenA (lpString="*.pptx") returned 6
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.txt") returned 0
	[0041.223] lstrlenA (lpString="*.txt") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.pdf") returned 0
	[0041.223] lstrlenA (lpString="*.pdf") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.djvu") returned 0
	[0041.223] lstrlenA (lpString="*.djvu") returned 6
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.htm") returned 0
	[0041.223] lstrlenA (lpString="*.htm") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.html") returned 0
	[0041.223] lstrlenA (lpString="*.html") returned 6
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mdb") returned 0
	[0041.223] lstrlenA (lpString="*.mdb") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.cer") returned 0
	[0041.223] lstrlenA (lpString="*.cer") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.p12") returned 0
	[0041.223] lstrlenA (lpString="*.p12") returned 5
	[0041.223] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.pfx") returned 0
	[0041.223] lstrlenA (lpString="*.pfx") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.kwm") returned 0
	[0041.224] lstrlenA (lpString="*.kwm") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.pwm") returned 0
	[0041.224] lstrlenA (lpString="*.pwm") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.1cd") returned 0
	[0041.224] lstrlenA (lpString="*.1cd") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.md") returned 0
	[0041.224] lstrlenA (lpString="*.md") returned 4
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mdf") returned 0
	[0041.224] lstrlenA (lpString="*.mdf") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.dbf") returned 0
	[0041.224] lstrlenA (lpString="*.dbf") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.odt") returned 0
	[0041.224] lstrlenA (lpString="*.odt") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.vob") returned 0
	[0041.224] lstrlenA (lpString="*.vob") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.ifo") returned 0
	[0041.224] lstrlenA (lpString="*.ifo") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.lnk") returned 0
	[0041.224] lstrlenA (lpString="*.lnk") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.torrent") returned 0
	[0041.224] lstrlenA (lpString="*.torrent") returned 9
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mov") returned 0
	[0041.224] lstrlenA (lpString="*.mov") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.m2v") returned 0
	[0041.224] lstrlenA (lpString="*.m2v") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.3gp") returned 0
	[0041.224] lstrlenA (lpString="*.3gp") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mpeg") returned 0
	[0041.224] lstrlenA (lpString="*.mpeg") returned 6
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mpg") returned 0
	[0041.224] lstrlenA (lpString="*.mpg") returned 5
	[0041.224] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.flv") returned 0
	[0041.224] lstrlenA (lpString="*.flv") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.avi") returned 0
	[0041.225] lstrlenA (lpString="*.avi") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mp4") returned 0
	[0041.225] lstrlenA (lpString="*.mp4") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.wmv") returned 0
	[0041.225] lstrlenA (lpString="*.wmv") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.divx") returned 0
	[0041.225] lstrlenA (lpString="*.divx") returned 6
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mkv") returned 0
	[0041.225] lstrlenA (lpString="*.mkv") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mp3") returned 0
	[0041.225] lstrlenA (lpString="*.mp3") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.wav") returned 0
	[0041.225] lstrlenA (lpString="*.wav") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.flac") returned 0
	[0041.225] lstrlenA (lpString="*.flac") returned 6
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.ape") returned 0
	[0041.225] lstrlenA (lpString="*.ape") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.wma") returned 0
	[0041.225] lstrlenA (lpString="*.wma") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.ac3") returned 0
	[0041.225] lstrlenA (lpString="*.ac3") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.exe") returned 0
	[0041.225] lstrlenA (lpString="*.exe") returned 5
	[0041.225] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.apk") returned 0
	[0041.225] lstrlenA (lpString="*.apk") returned 5
	[0041.225] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.225] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.225] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.225] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned="PAPYRUS.INF"
	[0041.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\"
	[0041.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned=""
	[0041.226] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt"
	[0041.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0x20
	[0041.226] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF"
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.226] lstrlenA (lpString="*.zip") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.226] lstrlenA (lpString="*.rar") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.226] lstrlenA (lpString="*.7z") returned 4
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.226] lstrlenA (lpString="*.tar") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.226] lstrlenA (lpString="*.gzip") returned 6
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.226] lstrlenA (lpString="*.jpg") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.226] lstrlenA (lpString="*.jpeg") returned 6
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.226] lstrlenA (lpString="*.psd") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.226] lstrlenA (lpString="*.cdr") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.226] lstrlenA (lpString="*.dwg") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.226] lstrlenA (lpString="*.max") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.226] lstrlenA (lpString="*.bmp") returned 5
	[0041.226] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.226] lstrlenA (lpString="*.gif") returned 5
	[0041.227] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF"
	[0041.227] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF"
	[0041.227] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF."
	[0041.227] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.Boom"
	[0041.227] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.227] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0e
	[0041.227] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.227] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.227] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9eb, lpOverlapped=0x0) returned 1
	[0041.229] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.229] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.229] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9eb, lpOverlapped=0x0) returned 1
	[0041.229] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.229] CloseHandle (hObject=0x90) returned 1
	[0041.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.boom")) returned 1
	[0041.232] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.232] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.232] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\"
	[0041.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned=""
	[0041.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt"
	[0041.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0x20
	[0041.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG"
	[0041.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.232] lstrlenA (lpString="*.zip") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.233] lstrlenA (lpString="*.rar") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.233] lstrlenA (lpString="*.7z") returned 4
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.233] lstrlenA (lpString="*.tar") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.233] lstrlenA (lpString="*.gzip") returned 6
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.233] lstrlenA (lpString="*.jpg") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.233] lstrlenA (lpString="*.jpeg") returned 6
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.233] lstrlenA (lpString="*.psd") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.233] lstrlenA (lpString="*.cdr") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.233] lstrlenA (lpString="*.dwg") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.233] lstrlenA (lpString="*.max") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.233] lstrlenA (lpString="*.bmp") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.233] lstrlenA (lpString="*.gif") returned 5
	[0041.233] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.233] lstrlenA (lpString="*.png") returned 5
	[0041.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG"
	[0041.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG"
	[0041.233] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG."
	[0041.233] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.Boom"
	[0041.233] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.234] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9240
	[0041.234] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d489150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.234] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.234] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x921d, lpOverlapped=0x0) returned 1
	[0041.240] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.240] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.240] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x921d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x921d, lpOverlapped=0x0) returned 1
	[0041.240] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.241] CloseHandle (hObject=0x90) returned 1
	[0041.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.boom")) returned 1
	[0041.242] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.242] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0041.243] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.243] lstrcmpA (lpString1=".", lpString2="PIXEL") returned -1
	[0041.243] lstrcmpA (lpString1="..", lpString2="PIXEL") returned -1
	[0041.243] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.243] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="PIXEL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL"
	[0041.243] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL") returned 61
	[0041.243] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.243] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.243] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.243] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.243] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.243] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.243] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PIXEL.ELM") returned -1
	[0041.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PIXEL.ELM") returned -1
	[0041.243] lstrcmpiA (lpString1="", lpString2="PIXEL.ELM") returned -1
	[0041.243] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*") returned="*.*"
	[0041.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\"
	[0041.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned=""
	[0041.243] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt"
	[0041.244] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0xffffffff
	[0041.244] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.244] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.244] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.245] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.245] CloseHandle (hObject=0x90) returned 1
	[0041.245] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="PIXEL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM"
	[0041.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.zip") returned 0
	[0041.245] lstrlenA (lpString="*.zip") returned 5
	[0041.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.rar") returned 0
	[0041.245] lstrlenA (lpString="*.rar") returned 5
	[0041.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.7z") returned 0
	[0041.245] lstrlenA (lpString="*.7z") returned 4
	[0041.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.tar") returned 0
	[0041.245] lstrlenA (lpString="*.tar") returned 5
	[0041.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.gzip") returned 0
	[0041.245] lstrlenA (lpString="*.gzip") returned 6
	[0041.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.jpg") returned 0
	[0041.245] lstrlenA (lpString="*.jpg") returned 5
	[0041.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.jpeg") returned 0
	[0041.245] lstrlenA (lpString="*.jpeg") returned 6
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.psd") returned 0
	[0041.246] lstrlenA (lpString="*.psd") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.cdr") returned 0
	[0041.246] lstrlenA (lpString="*.cdr") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.dwg") returned 0
	[0041.246] lstrlenA (lpString="*.dwg") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.max") returned 0
	[0041.246] lstrlenA (lpString="*.max") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.bmp") returned 0
	[0041.246] lstrlenA (lpString="*.bmp") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.gif") returned 0
	[0041.246] lstrlenA (lpString="*.gif") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.png") returned 0
	[0041.246] lstrlenA (lpString="*.png") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.doc") returned 0
	[0041.246] lstrlenA (lpString="*.doc") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.docx") returned 0
	[0041.246] lstrlenA (lpString="*.docx") returned 6
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.xls") returned 0
	[0041.246] lstrlenA (lpString="*.xls") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.xlsx") returned 0
	[0041.246] lstrlenA (lpString="*.xlsx") returned 6
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ppt") returned 0
	[0041.246] lstrlenA (lpString="*.ppt") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.pptx") returned 0
	[0041.246] lstrlenA (lpString="*.pptx") returned 6
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.txt") returned 0
	[0041.246] lstrlenA (lpString="*.txt") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.pdf") returned 0
	[0041.246] lstrlenA (lpString="*.pdf") returned 5
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.djvu") returned 0
	[0041.246] lstrlenA (lpString="*.djvu") returned 6
	[0041.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.htm") returned 0
	[0041.247] lstrlenA (lpString="*.htm") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.html") returned 0
	[0041.247] lstrlenA (lpString="*.html") returned 6
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mdb") returned 0
	[0041.247] lstrlenA (lpString="*.mdb") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.cer") returned 0
	[0041.247] lstrlenA (lpString="*.cer") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.p12") returned 0
	[0041.247] lstrlenA (lpString="*.p12") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.pfx") returned 0
	[0041.247] lstrlenA (lpString="*.pfx") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.kwm") returned 0
	[0041.247] lstrlenA (lpString="*.kwm") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.pwm") returned 0
	[0041.247] lstrlenA (lpString="*.pwm") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.1cd") returned 0
	[0041.247] lstrlenA (lpString="*.1cd") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.md") returned 0
	[0041.247] lstrlenA (lpString="*.md") returned 4
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mdf") returned 0
	[0041.247] lstrlenA (lpString="*.mdf") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.dbf") returned 0
	[0041.247] lstrlenA (lpString="*.dbf") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.odt") returned 0
	[0041.247] lstrlenA (lpString="*.odt") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.vob") returned 0
	[0041.247] lstrlenA (lpString="*.vob") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ifo") returned 0
	[0041.247] lstrlenA (lpString="*.ifo") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.lnk") returned 0
	[0041.247] lstrlenA (lpString="*.lnk") returned 5
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.torrent") returned 0
	[0041.247] lstrlenA (lpString="*.torrent") returned 9
	[0041.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mov") returned 0
	[0041.247] lstrlenA (lpString="*.mov") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.m2v") returned 0
	[0041.248] lstrlenA (lpString="*.m2v") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.3gp") returned 0
	[0041.248] lstrlenA (lpString="*.3gp") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mpeg") returned 0
	[0041.248] lstrlenA (lpString="*.mpeg") returned 6
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mpg") returned 0
	[0041.248] lstrlenA (lpString="*.mpg") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.flv") returned 0
	[0041.248] lstrlenA (lpString="*.flv") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.avi") returned 0
	[0041.248] lstrlenA (lpString="*.avi") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mp4") returned 0
	[0041.248] lstrlenA (lpString="*.mp4") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.wmv") returned 0
	[0041.248] lstrlenA (lpString="*.wmv") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.divx") returned 0
	[0041.248] lstrlenA (lpString="*.divx") returned 6
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mkv") returned 0
	[0041.248] lstrlenA (lpString="*.mkv") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mp3") returned 0
	[0041.248] lstrlenA (lpString="*.mp3") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.wav") returned 0
	[0041.248] lstrlenA (lpString="*.wav") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.flac") returned 0
	[0041.248] lstrlenA (lpString="*.flac") returned 6
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ape") returned 0
	[0041.248] lstrlenA (lpString="*.ape") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.wma") returned 0
	[0041.248] lstrlenA (lpString="*.wma") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ac3") returned 0
	[0041.248] lstrlenA (lpString="*.ac3") returned 5
	[0041.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.exe") returned 0
	[0041.249] lstrlenA (lpString="*.exe") returned 5
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.apk") returned 0
	[0041.249] lstrlenA (lpString="*.apk") returned 5
	[0041.249] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.249] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PIXEL.INF") returned -1
	[0041.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PIXEL.INF") returned -1
	[0041.249] lstrcmpiA (lpString1="", lpString2="PIXEL.INF") returned -1
	[0041.249] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned="PIXEL.ELM"
	[0041.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\"
	[0041.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned=""
	[0041.249] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt"
	[0041.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0x20
	[0041.249] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="PIXEL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF"
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.zip") returned 0
	[0041.249] lstrlenA (lpString="*.zip") returned 5
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.rar") returned 0
	[0041.249] lstrlenA (lpString="*.rar") returned 5
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.7z") returned 0
	[0041.249] lstrlenA (lpString="*.7z") returned 4
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.tar") returned 0
	[0041.249] lstrlenA (lpString="*.tar") returned 5
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.gzip") returned 0
	[0041.249] lstrlenA (lpString="*.gzip") returned 6
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.jpg") returned 0
	[0041.249] lstrlenA (lpString="*.jpg") returned 5
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.jpeg") returned 0
	[0041.249] lstrlenA (lpString="*.jpeg") returned 6
	[0041.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.psd") returned 0
	[0041.249] lstrlenA (lpString="*.psd") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.cdr") returned 0
	[0041.250] lstrlenA (lpString="*.cdr") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.dwg") returned 0
	[0041.250] lstrlenA (lpString="*.dwg") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.max") returned 0
	[0041.250] lstrlenA (lpString="*.max") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.bmp") returned 0
	[0041.250] lstrlenA (lpString="*.bmp") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.gif") returned 0
	[0041.250] lstrlenA (lpString="*.gif") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.png") returned 0
	[0041.250] lstrlenA (lpString="*.png") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.doc") returned 0
	[0041.250] lstrlenA (lpString="*.doc") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.docx") returned 0
	[0041.250] lstrlenA (lpString="*.docx") returned 6
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.xls") returned 0
	[0041.250] lstrlenA (lpString="*.xls") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.xlsx") returned 0
	[0041.250] lstrlenA (lpString="*.xlsx") returned 6
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.ppt") returned 0
	[0041.250] lstrlenA (lpString="*.ppt") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.pptx") returned 0
	[0041.250] lstrlenA (lpString="*.pptx") returned 6
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.txt") returned 0
	[0041.250] lstrlenA (lpString="*.txt") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.pdf") returned 0
	[0041.250] lstrlenA (lpString="*.pdf") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.djvu") returned 0
	[0041.250] lstrlenA (lpString="*.djvu") returned 6
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.htm") returned 0
	[0041.250] lstrlenA (lpString="*.htm") returned 5
	[0041.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.html") returned 0
	[0041.251] lstrlenA (lpString="*.html") returned 6
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mdb") returned 0
	[0041.251] lstrlenA (lpString="*.mdb") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.cer") returned 0
	[0041.251] lstrlenA (lpString="*.cer") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.p12") returned 0
	[0041.251] lstrlenA (lpString="*.p12") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.pfx") returned 0
	[0041.251] lstrlenA (lpString="*.pfx") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.kwm") returned 0
	[0041.251] lstrlenA (lpString="*.kwm") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.pwm") returned 0
	[0041.251] lstrlenA (lpString="*.pwm") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.1cd") returned 0
	[0041.251] lstrlenA (lpString="*.1cd") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.md") returned 0
	[0041.251] lstrlenA (lpString="*.md") returned 4
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mdf") returned 0
	[0041.251] lstrlenA (lpString="*.mdf") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.dbf") returned 0
	[0041.251] lstrlenA (lpString="*.dbf") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.odt") returned 0
	[0041.251] lstrlenA (lpString="*.odt") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.vob") returned 0
	[0041.251] lstrlenA (lpString="*.vob") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.ifo") returned 0
	[0041.251] lstrlenA (lpString="*.ifo") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.lnk") returned 0
	[0041.251] lstrlenA (lpString="*.lnk") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.torrent") returned 0
	[0041.251] lstrlenA (lpString="*.torrent") returned 9
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mov") returned 0
	[0041.251] lstrlenA (lpString="*.mov") returned 5
	[0041.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.m2v") returned 0
	[0041.251] lstrlenA (lpString="*.m2v") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.3gp") returned 0
	[0041.252] lstrlenA (lpString="*.3gp") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mpeg") returned 0
	[0041.252] lstrlenA (lpString="*.mpeg") returned 6
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mpg") returned 0
	[0041.252] lstrlenA (lpString="*.mpg") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.flv") returned 0
	[0041.252] lstrlenA (lpString="*.flv") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.avi") returned 0
	[0041.252] lstrlenA (lpString="*.avi") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mp4") returned 0
	[0041.252] lstrlenA (lpString="*.mp4") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.wmv") returned 0
	[0041.252] lstrlenA (lpString="*.wmv") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.divx") returned 0
	[0041.252] lstrlenA (lpString="*.divx") returned 6
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mkv") returned 0
	[0041.252] lstrlenA (lpString="*.mkv") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mp3") returned 0
	[0041.252] lstrlenA (lpString="*.mp3") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.wav") returned 0
	[0041.252] lstrlenA (lpString="*.wav") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.flac") returned 0
	[0041.252] lstrlenA (lpString="*.flac") returned 6
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.ape") returned 0
	[0041.252] lstrlenA (lpString="*.ape") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.wma") returned 0
	[0041.252] lstrlenA (lpString="*.wma") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.ac3") returned 0
	[0041.252] lstrlenA (lpString="*.ac3") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.exe") returned 0
	[0041.252] lstrlenA (lpString="*.exe") returned 5
	[0041.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.apk") returned 0
	[0041.252] lstrlenA (lpString="*.apk") returned 5
	[0041.253] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.253] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.253] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned="PIXEL.INF"
	[0041.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\"
	[0041.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned=""
	[0041.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt"
	[0041.253] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0x20
	[0041.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF"
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.253] lstrlenA (lpString="*.zip") returned 5
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.253] lstrlenA (lpString="*.rar") returned 5
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.253] lstrlenA (lpString="*.7z") returned 4
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.253] lstrlenA (lpString="*.tar") returned 5
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.253] lstrlenA (lpString="*.gzip") returned 6
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.253] lstrlenA (lpString="*.jpg") returned 5
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.253] lstrlenA (lpString="*.jpeg") returned 6
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.253] lstrlenA (lpString="*.psd") returned 5
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.253] lstrlenA (lpString="*.cdr") returned 5
	[0041.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.254] lstrlenA (lpString="*.dwg") returned 5
	[0041.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.254] lstrlenA (lpString="*.max") returned 5
	[0041.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.254] lstrlenA (lpString="*.bmp") returned 5
	[0041.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.254] lstrlenA (lpString="*.gif") returned 5
	[0041.254] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF"
	[0041.254] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF"
	[0041.254] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF."
	[0041.254] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.Boom"
	[0041.254] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.254] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x639
	[0041.254] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.254] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.254] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x616, lpOverlapped=0x0) returned 1
	[0041.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.256] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.256] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x616, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x616, lpOverlapped=0x0) returned 1
	[0041.256] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.256] CloseHandle (hObject=0x90) returned 1
	[0041.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.boom")) returned 1
	[0041.259] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.260] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.260] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\"
	[0041.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned=""
	[0041.260] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt"
	[0041.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0x20
	[0041.260] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG"
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.260] lstrlenA (lpString="*.zip") returned 5
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.260] lstrlenA (lpString="*.rar") returned 5
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.260] lstrlenA (lpString="*.7z") returned 4
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.260] lstrlenA (lpString="*.tar") returned 5
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.260] lstrlenA (lpString="*.gzip") returned 6
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.260] lstrlenA (lpString="*.jpg") returned 5
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.260] lstrlenA (lpString="*.jpeg") returned 6
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.260] lstrlenA (lpString="*.psd") returned 5
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.260] lstrlenA (lpString="*.cdr") returned 5
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.260] lstrlenA (lpString="*.dwg") returned 5
	[0041.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.260] lstrlenA (lpString="*.max") returned 5
	[0041.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.261] lstrlenA (lpString="*.bmp") returned 5
	[0041.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.261] lstrlenA (lpString="*.gif") returned 5
	[0041.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.261] lstrlenA (lpString="*.png") returned 5
	[0041.261] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG"
	[0041.261] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG"
	[0041.261] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG."
	[0041.261] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.Boom"
	[0041.261] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.280] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54f1
	[0041.280] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.280] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.280] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x54ce, lpOverlapped=0x0) returned 1
	[0041.281] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.281] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.281] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x54ce, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x54ce, lpOverlapped=0x0) returned 1
	[0041.282] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.282] CloseHandle (hObject=0x90) returned 1
	[0041.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.boom")) returned 1
	[0041.283] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.283] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0041.283] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.283] lstrcmpA (lpString1=".", lpString2="PROFILE") returned -1
	[0041.283] lstrcmpA (lpString1="..", lpString2="PROFILE") returned -1
	[0041.283] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.283] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="PROFILE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE"
	[0041.283] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE") returned 63
	[0041.283] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.283] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.283] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.283] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.283] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.283] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.283] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.284] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.284] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*") returned="*.*"
	[0041.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\"
	[0041.286] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned=""
	[0041.286] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt"
	[0041.288] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0xffffffff
	[0041.288] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.289] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.289] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.289] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.289] CloseHandle (hObject=0x90) returned 1
	[0041.290] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF"
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.290] lstrlenA (lpString="*.zip") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.290] lstrlenA (lpString="*.rar") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.290] lstrlenA (lpString="*.7z") returned 4
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.290] lstrlenA (lpString="*.tar") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.290] lstrlenA (lpString="*.gzip") returned 6
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.290] lstrlenA (lpString="*.jpg") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.290] lstrlenA (lpString="*.jpeg") returned 6
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.290] lstrlenA (lpString="*.psd") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.290] lstrlenA (lpString="*.cdr") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.290] lstrlenA (lpString="*.dwg") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.290] lstrlenA (lpString="*.max") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.290] lstrlenA (lpString="*.bmp") returned 5
	[0041.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.290] lstrlenA (lpString="*.gif") returned 5
	[0041.290] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF"
	[0041.290] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF"
	[0041.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF."
	[0041.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.Boom"
	[0041.292] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.293] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53b
	[0041.293] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.293] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.293] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x518, lpOverlapped=0x0) returned 1
	[0041.323] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.323] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.323] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x518, lpOverlapped=0x0) returned 1
	[0041.324] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.324] CloseHandle (hObject=0x90) returned 1
	[0041.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.boom")) returned 1
	[0041.328] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.328] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.328] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PROFILE.ELM") returned -1
	[0041.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROFILE.ELM") returned -1
	[0041.328] lstrcmpiA (lpString1="", lpString2="PROFILE.ELM") returned -1
	[0041.328] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\"
	[0041.328] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned=""
	[0041.328] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt"
	[0041.328] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0x20
	[0041.328] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="PROFILE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM"
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.zip") returned 0
	[0041.329] lstrlenA (lpString="*.zip") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.rar") returned 0
	[0041.329] lstrlenA (lpString="*.rar") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.7z") returned 0
	[0041.329] lstrlenA (lpString="*.7z") returned 4
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.tar") returned 0
	[0041.329] lstrlenA (lpString="*.tar") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.gzip") returned 0
	[0041.329] lstrlenA (lpString="*.gzip") returned 6
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.jpg") returned 0
	[0041.329] lstrlenA (lpString="*.jpg") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.jpeg") returned 0
	[0041.329] lstrlenA (lpString="*.jpeg") returned 6
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.psd") returned 0
	[0041.329] lstrlenA (lpString="*.psd") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.cdr") returned 0
	[0041.329] lstrlenA (lpString="*.cdr") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.dwg") returned 0
	[0041.329] lstrlenA (lpString="*.dwg") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.max") returned 0
	[0041.329] lstrlenA (lpString="*.max") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.bmp") returned 0
	[0041.329] lstrlenA (lpString="*.bmp") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.gif") returned 0
	[0041.329] lstrlenA (lpString="*.gif") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.png") returned 0
	[0041.329] lstrlenA (lpString="*.png") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.doc") returned 0
	[0041.329] lstrlenA (lpString="*.doc") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.docx") returned 0
	[0041.329] lstrlenA (lpString="*.docx") returned 6
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.xls") returned 0
	[0041.329] lstrlenA (lpString="*.xls") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.xlsx") returned 0
	[0041.329] lstrlenA (lpString="*.xlsx") returned 6
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.ppt") returned 0
	[0041.329] lstrlenA (lpString="*.ppt") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.pptx") returned 0
	[0041.329] lstrlenA (lpString="*.pptx") returned 6
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.txt") returned 0
	[0041.329] lstrlenA (lpString="*.txt") returned 5
	[0041.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.pdf") returned 0
	[0041.330] lstrlenA (lpString="*.pdf") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.djvu") returned 0
	[0041.330] lstrlenA (lpString="*.djvu") returned 6
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.htm") returned 0
	[0041.330] lstrlenA (lpString="*.htm") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.html") returned 0
	[0041.330] lstrlenA (lpString="*.html") returned 6
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mdb") returned 0
	[0041.330] lstrlenA (lpString="*.mdb") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.cer") returned 0
	[0041.330] lstrlenA (lpString="*.cer") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.p12") returned 0
	[0041.330] lstrlenA (lpString="*.p12") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.pfx") returned 0
	[0041.330] lstrlenA (lpString="*.pfx") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.kwm") returned 0
	[0041.330] lstrlenA (lpString="*.kwm") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.pwm") returned 0
	[0041.330] lstrlenA (lpString="*.pwm") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.1cd") returned 0
	[0041.330] lstrlenA (lpString="*.1cd") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.md") returned 0
	[0041.330] lstrlenA (lpString="*.md") returned 4
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mdf") returned 0
	[0041.330] lstrlenA (lpString="*.mdf") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.dbf") returned 0
	[0041.330] lstrlenA (lpString="*.dbf") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.odt") returned 0
	[0041.330] lstrlenA (lpString="*.odt") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.vob") returned 0
	[0041.330] lstrlenA (lpString="*.vob") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.ifo") returned 0
	[0041.330] lstrlenA (lpString="*.ifo") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.lnk") returned 0
	[0041.330] lstrlenA (lpString="*.lnk") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.torrent") returned 0
	[0041.330] lstrlenA (lpString="*.torrent") returned 9
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mov") returned 0
	[0041.330] lstrlenA (lpString="*.mov") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.m2v") returned 0
	[0041.330] lstrlenA (lpString="*.m2v") returned 5
	[0041.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.3gp") returned 0
	[0041.330] lstrlenA (lpString="*.3gp") returned 5
	[0041.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mpeg") returned 0
	[0041.331] lstrlenA (lpString="*.mpeg") returned 6
	[0041.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mpg") returned 0
	[0041.331] lstrlenA (lpString="*.mpg") returned 5
	[0041.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.flv") returned 0
	[0041.331] lstrlenA (lpString="*.flv") returned 5
	[0041.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.avi") returned 0
	[0041.331] lstrlenA (lpString="*.avi") returned 5
	[0041.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mp4") returned 0
	[0041.331] lstrlenA (lpString="*.mp4") returned 5
	[0041.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.wmv") returned 0
	[0041.331] lstrlenA (lpString="*.wmv") returned 5
	[0041.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.divx") returned 0
	[0041.331] lstrlenA (lpString="*.divx") returned 6
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mkv") returned 0
	[0041.332] lstrlenA (lpString="*.mkv") returned 5
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mp3") returned 0
	[0041.332] lstrlenA (lpString="*.mp3") returned 5
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.wav") returned 0
	[0041.332] lstrlenA (lpString="*.wav") returned 5
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.flac") returned 0
	[0041.332] lstrlenA (lpString="*.flac") returned 6
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.ape") returned 0
	[0041.332] lstrlenA (lpString="*.ape") returned 5
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.wma") returned 0
	[0041.332] lstrlenA (lpString="*.wma") returned 5
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.ac3") returned 0
	[0041.332] lstrlenA (lpString="*.ac3") returned 5
	[0041.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.exe") returned 0
	[0041.333] lstrlenA (lpString="*.exe") returned 5
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.apk") returned 0
	[0041.333] lstrlenA (lpString="*.apk") returned 5
	[0041.333] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.333] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PROFILE.INF") returned -1
	[0041.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROFILE.INF") returned -1
	[0041.333] lstrcmpiA (lpString1="", lpString2="PROFILE.INF") returned -1
	[0041.333] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned="PROFILE.ELM"
	[0041.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\"
	[0041.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned=""
	[0041.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt"
	[0041.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0x20
	[0041.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="PROFILE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF"
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.zip") returned 0
	[0041.333] lstrlenA (lpString="*.zip") returned 5
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.rar") returned 0
	[0041.333] lstrlenA (lpString="*.rar") returned 5
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.7z") returned 0
	[0041.333] lstrlenA (lpString="*.7z") returned 4
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.tar") returned 0
	[0041.333] lstrlenA (lpString="*.tar") returned 5
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.gzip") returned 0
	[0041.333] lstrlenA (lpString="*.gzip") returned 6
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.jpg") returned 0
	[0041.333] lstrlenA (lpString="*.jpg") returned 5
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.jpeg") returned 0
	[0041.333] lstrlenA (lpString="*.jpeg") returned 6
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.psd") returned 0
	[0041.333] lstrlenA (lpString="*.psd") returned 5
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.cdr") returned 0
	[0041.333] lstrlenA (lpString="*.cdr") returned 5
	[0041.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.dwg") returned 0
	[0041.334] lstrlenA (lpString="*.dwg") returned 5
	[0041.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.max") returned 0
	[0041.334] lstrlenA (lpString="*.max") returned 5
	[0041.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.bmp") returned 0
	[0041.334] lstrlenA (lpString="*.bmp") returned 5
	[0041.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.gif") returned 0
	[0041.335] lstrlenA (lpString="*.gif") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.png") returned 0
	[0041.335] lstrlenA (lpString="*.png") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.doc") returned 0
	[0041.335] lstrlenA (lpString="*.doc") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.docx") returned 0
	[0041.335] lstrlenA (lpString="*.docx") returned 6
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.xls") returned 0
	[0041.335] lstrlenA (lpString="*.xls") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.xlsx") returned 0
	[0041.335] lstrlenA (lpString="*.xlsx") returned 6
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.ppt") returned 0
	[0041.335] lstrlenA (lpString="*.ppt") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.pptx") returned 0
	[0041.335] lstrlenA (lpString="*.pptx") returned 6
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.txt") returned 0
	[0041.335] lstrlenA (lpString="*.txt") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.pdf") returned 0
	[0041.335] lstrlenA (lpString="*.pdf") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.djvu") returned 0
	[0041.335] lstrlenA (lpString="*.djvu") returned 6
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.htm") returned 0
	[0041.335] lstrlenA (lpString="*.htm") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.html") returned 0
	[0041.335] lstrlenA (lpString="*.html") returned 6
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mdb") returned 0
	[0041.335] lstrlenA (lpString="*.mdb") returned 5
	[0041.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.cer") returned 0
	[0041.336] lstrlenA (lpString="*.cer") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.p12") returned 0
	[0041.336] lstrlenA (lpString="*.p12") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.pfx") returned 0
	[0041.336] lstrlenA (lpString="*.pfx") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.kwm") returned 0
	[0041.336] lstrlenA (lpString="*.kwm") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.pwm") returned 0
	[0041.336] lstrlenA (lpString="*.pwm") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.1cd") returned 0
	[0041.336] lstrlenA (lpString="*.1cd") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.md") returned 0
	[0041.336] lstrlenA (lpString="*.md") returned 4
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mdf") returned 0
	[0041.336] lstrlenA (lpString="*.mdf") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.dbf") returned 0
	[0041.336] lstrlenA (lpString="*.dbf") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.odt") returned 0
	[0041.336] lstrlenA (lpString="*.odt") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.vob") returned 0
	[0041.336] lstrlenA (lpString="*.vob") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.ifo") returned 0
	[0041.336] lstrlenA (lpString="*.ifo") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.lnk") returned 0
	[0041.336] lstrlenA (lpString="*.lnk") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.torrent") returned 0
	[0041.336] lstrlenA (lpString="*.torrent") returned 9
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mov") returned 0
	[0041.336] lstrlenA (lpString="*.mov") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.m2v") returned 0
	[0041.336] lstrlenA (lpString="*.m2v") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.3gp") returned 0
	[0041.336] lstrlenA (lpString="*.3gp") returned 5
	[0041.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mpeg") returned 0
	[0041.337] lstrlenA (lpString="*.mpeg") returned 6
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mpg") returned 0
	[0041.337] lstrlenA (lpString="*.mpg") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.flv") returned 0
	[0041.337] lstrlenA (lpString="*.flv") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.avi") returned 0
	[0041.337] lstrlenA (lpString="*.avi") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mp4") returned 0
	[0041.337] lstrlenA (lpString="*.mp4") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.wmv") returned 0
	[0041.337] lstrlenA (lpString="*.wmv") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.divx") returned 0
	[0041.337] lstrlenA (lpString="*.divx") returned 6
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mkv") returned 0
	[0041.337] lstrlenA (lpString="*.mkv") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mp3") returned 0
	[0041.337] lstrlenA (lpString="*.mp3") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.wav") returned 0
	[0041.337] lstrlenA (lpString="*.wav") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.flac") returned 0
	[0041.337] lstrlenA (lpString="*.flac") returned 6
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.ape") returned 0
	[0041.337] lstrlenA (lpString="*.ape") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.wma") returned 0
	[0041.337] lstrlenA (lpString="*.wma") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.ac3") returned 0
	[0041.337] lstrlenA (lpString="*.ac3") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.exe") returned 0
	[0041.337] lstrlenA (lpString="*.exe") returned 5
	[0041.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.apk") returned 0
	[0041.337] lstrlenA (lpString="*.apk") returned 5
	[0041.337] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.337] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.337] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.337] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.337] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned="PROFILE.INF"
	[0041.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\"
	[0041.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned=""
	[0041.337] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt"
	[0041.338] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0x20
	[0041.338] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG"
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.338] lstrlenA (lpString="*.zip") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.338] lstrlenA (lpString="*.rar") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.338] lstrlenA (lpString="*.7z") returned 4
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.338] lstrlenA (lpString="*.tar") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.338] lstrlenA (lpString="*.gzip") returned 6
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.338] lstrlenA (lpString="*.jpg") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.338] lstrlenA (lpString="*.jpeg") returned 6
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.338] lstrlenA (lpString="*.psd") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.338] lstrlenA (lpString="*.cdr") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.338] lstrlenA (lpString="*.dwg") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.338] lstrlenA (lpString="*.max") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.338] lstrlenA (lpString="*.bmp") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.338] lstrlenA (lpString="*.gif") returned 5
	[0041.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.340] lstrlenA (lpString="*.png") returned 5
	[0041.340] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG"
	[0041.340] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG"
	[0041.340] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG."
	[0041.340] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.Boom"
	[0041.341] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.341] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4162
	[0041.341] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.341] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.341] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x413f, lpOverlapped=0x0) returned 1
	[0041.344] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.344] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.345] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x413f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x413f, lpOverlapped=0x0) returned 1
	[0041.345] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.345] CloseHandle (hObject=0x90) returned 1
	[0041.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.boom")) returned 1
	[0041.351] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.351] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0041.351] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.351] lstrcmpA (lpString1=".", lpString2="QUAD") returned -1
	[0041.351] lstrcmpA (lpString1="..", lpString2="QUAD") returned -1
	[0041.351] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.351] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="QUAD" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD"
	[0041.351] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD") returned 60
	[0041.351] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.351] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.351] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.352] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.352] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.352] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.352] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.352] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.352] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.352] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*") returned="*.*"
	[0041.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\"
	[0041.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned=""
	[0041.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt"
	[0041.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0xffffffff
	[0041.379] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.379] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.379] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.380] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.380] CloseHandle (hObject=0x90) returned 1
	[0041.380] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF"
	[0041.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.380] lstrlenA (lpString="*.zip") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.381] lstrlenA (lpString="*.rar") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.381] lstrlenA (lpString="*.7z") returned 4
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.381] lstrlenA (lpString="*.tar") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.381] lstrlenA (lpString="*.gzip") returned 6
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.381] lstrlenA (lpString="*.jpg") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.381] lstrlenA (lpString="*.jpeg") returned 6
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.381] lstrlenA (lpString="*.psd") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.381] lstrlenA (lpString="*.cdr") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.381] lstrlenA (lpString="*.dwg") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.381] lstrlenA (lpString="*.max") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.381] lstrlenA (lpString="*.bmp") returned 5
	[0041.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.381] lstrlenA (lpString="*.gif") returned 5
	[0041.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF"
	[0041.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF"
	[0041.381] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF."
	[0041.381] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.Boom"
	[0041.381] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.382] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59f
	[0041.382] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.382] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.382] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x57c, lpOverlapped=0x0) returned 1
	[0041.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.419] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.419] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x57c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x57c, lpOverlapped=0x0) returned 1
	[0041.420] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.420] CloseHandle (hObject=0x90) returned 1
	[0041.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.boom")) returned 1
	[0041.424] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.424] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.424] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="QUAD.ELM") returned -1
	[0041.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QUAD.ELM") returned -1
	[0041.424] lstrcmpiA (lpString1="", lpString2="QUAD.ELM") returned -1
	[0041.424] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\"
	[0041.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned=""
	[0041.424] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt"
	[0041.424] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0x20
	[0041.424] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="QUAD.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM"
	[0041.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.zip") returned 0
	[0041.424] lstrlenA (lpString="*.zip") returned 5
	[0041.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.rar") returned 0
	[0041.424] lstrlenA (lpString="*.rar") returned 5
	[0041.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.7z") returned 0
	[0041.424] lstrlenA (lpString="*.7z") returned 4
	[0041.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.tar") returned 0
	[0041.424] lstrlenA (lpString="*.tar") returned 5
	[0041.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.gzip") returned 0
	[0041.424] lstrlenA (lpString="*.gzip") returned 6
	[0041.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.jpg") returned 0
	[0041.424] lstrlenA (lpString="*.jpg") returned 5
	[0041.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.jpeg") returned 0
	[0041.425] lstrlenA (lpString="*.jpeg") returned 6
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.psd") returned 0
	[0041.425] lstrlenA (lpString="*.psd") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.cdr") returned 0
	[0041.425] lstrlenA (lpString="*.cdr") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.dwg") returned 0
	[0041.425] lstrlenA (lpString="*.dwg") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.max") returned 0
	[0041.425] lstrlenA (lpString="*.max") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.bmp") returned 0
	[0041.425] lstrlenA (lpString="*.bmp") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.gif") returned 0
	[0041.425] lstrlenA (lpString="*.gif") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.png") returned 0
	[0041.425] lstrlenA (lpString="*.png") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.doc") returned 0
	[0041.425] lstrlenA (lpString="*.doc") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.docx") returned 0
	[0041.425] lstrlenA (lpString="*.docx") returned 6
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.xls") returned 0
	[0041.425] lstrlenA (lpString="*.xls") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.xlsx") returned 0
	[0041.425] lstrlenA (lpString="*.xlsx") returned 6
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.ppt") returned 0
	[0041.425] lstrlenA (lpString="*.ppt") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.pptx") returned 0
	[0041.425] lstrlenA (lpString="*.pptx") returned 6
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.txt") returned 0
	[0041.425] lstrlenA (lpString="*.txt") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.pdf") returned 0
	[0041.425] lstrlenA (lpString="*.pdf") returned 5
	[0041.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.djvu") returned 0
	[0041.425] lstrlenA (lpString="*.djvu") returned 6
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.htm") returned 0
	[0041.426] lstrlenA (lpString="*.htm") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.html") returned 0
	[0041.426] lstrlenA (lpString="*.html") returned 6
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mdb") returned 0
	[0041.426] lstrlenA (lpString="*.mdb") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.cer") returned 0
	[0041.426] lstrlenA (lpString="*.cer") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.p12") returned 0
	[0041.426] lstrlenA (lpString="*.p12") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.pfx") returned 0
	[0041.426] lstrlenA (lpString="*.pfx") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.kwm") returned 0
	[0041.426] lstrlenA (lpString="*.kwm") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.pwm") returned 0
	[0041.426] lstrlenA (lpString="*.pwm") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.1cd") returned 0
	[0041.426] lstrlenA (lpString="*.1cd") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.md") returned 0
	[0041.426] lstrlenA (lpString="*.md") returned 4
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mdf") returned 0
	[0041.426] lstrlenA (lpString="*.mdf") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.dbf") returned 0
	[0041.426] lstrlenA (lpString="*.dbf") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.odt") returned 0
	[0041.426] lstrlenA (lpString="*.odt") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.vob") returned 0
	[0041.426] lstrlenA (lpString="*.vob") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.ifo") returned 0
	[0041.426] lstrlenA (lpString="*.ifo") returned 5
	[0041.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.lnk") returned 0
	[0041.426] lstrlenA (lpString="*.lnk") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.torrent") returned 0
	[0041.427] lstrlenA (lpString="*.torrent") returned 9
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mov") returned 0
	[0041.427] lstrlenA (lpString="*.mov") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.m2v") returned 0
	[0041.427] lstrlenA (lpString="*.m2v") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.3gp") returned 0
	[0041.427] lstrlenA (lpString="*.3gp") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mpeg") returned 0
	[0041.427] lstrlenA (lpString="*.mpeg") returned 6
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mpg") returned 0
	[0041.427] lstrlenA (lpString="*.mpg") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.flv") returned 0
	[0041.427] lstrlenA (lpString="*.flv") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.avi") returned 0
	[0041.427] lstrlenA (lpString="*.avi") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mp4") returned 0
	[0041.427] lstrlenA (lpString="*.mp4") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.wmv") returned 0
	[0041.427] lstrlenA (lpString="*.wmv") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.divx") returned 0
	[0041.427] lstrlenA (lpString="*.divx") returned 6
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mkv") returned 0
	[0041.427] lstrlenA (lpString="*.mkv") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mp3") returned 0
	[0041.427] lstrlenA (lpString="*.mp3") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.wav") returned 0
	[0041.427] lstrlenA (lpString="*.wav") returned 5
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.flac") returned 0
	[0041.427] lstrlenA (lpString="*.flac") returned 6
	[0041.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.ape") returned 0
	[0041.427] lstrlenA (lpString="*.ape") returned 5
	[0041.428] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.wma") returned 0
	[0041.428] lstrlenA (lpString="*.wma") returned 5
	[0041.428] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.ac3") returned 0
	[0041.428] lstrlenA (lpString="*.ac3") returned 5
	[0041.428] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.exe") returned 0
	[0041.428] lstrlenA (lpString="*.exe") returned 5
	[0041.428] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.apk") returned 0
	[0041.428] lstrlenA (lpString="*.apk") returned 5
	[0041.428] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="QUAD.INF") returned -1
	[0041.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QUAD.INF") returned -1
	[0041.428] lstrcmpiA (lpString1="", lpString2="QUAD.INF") returned -1
	[0041.428] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned="QUAD.ELM"
	[0041.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\"
	[0041.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned=""
	[0041.428] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt"
	[0041.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0x20
	[0041.428] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="QUAD.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF"
	[0041.428] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.zip") returned 0
	[0041.428] lstrlenA (lpString="*.zip") returned 5
	[0041.428] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.rar") returned 0
	[0041.428] lstrlenA (lpString="*.rar") returned 5
	[0041.428] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.7z") returned 0
	[0041.429] lstrlenA (lpString="*.7z") returned 4
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.tar") returned 0
	[0041.429] lstrlenA (lpString="*.tar") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.gzip") returned 0
	[0041.429] lstrlenA (lpString="*.gzip") returned 6
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.jpg") returned 0
	[0041.429] lstrlenA (lpString="*.jpg") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.jpeg") returned 0
	[0041.429] lstrlenA (lpString="*.jpeg") returned 6
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.psd") returned 0
	[0041.429] lstrlenA (lpString="*.psd") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.cdr") returned 0
	[0041.429] lstrlenA (lpString="*.cdr") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.dwg") returned 0
	[0041.429] lstrlenA (lpString="*.dwg") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.max") returned 0
	[0041.429] lstrlenA (lpString="*.max") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.bmp") returned 0
	[0041.429] lstrlenA (lpString="*.bmp") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.gif") returned 0
	[0041.429] lstrlenA (lpString="*.gif") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.png") returned 0
	[0041.429] lstrlenA (lpString="*.png") returned 5
	[0041.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.doc") returned 0
	[0041.429] lstrlenA (lpString="*.doc") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.docx") returned 0
	[0041.430] lstrlenA (lpString="*.docx") returned 6
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.xls") returned 0
	[0041.430] lstrlenA (lpString="*.xls") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.xlsx") returned 0
	[0041.430] lstrlenA (lpString="*.xlsx") returned 6
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.ppt") returned 0
	[0041.430] lstrlenA (lpString="*.ppt") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.pptx") returned 0
	[0041.430] lstrlenA (lpString="*.pptx") returned 6
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.txt") returned 0
	[0041.430] lstrlenA (lpString="*.txt") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.pdf") returned 0
	[0041.430] lstrlenA (lpString="*.pdf") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.djvu") returned 0
	[0041.430] lstrlenA (lpString="*.djvu") returned 6
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.htm") returned 0
	[0041.430] lstrlenA (lpString="*.htm") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.html") returned 0
	[0041.430] lstrlenA (lpString="*.html") returned 6
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mdb") returned 0
	[0041.430] lstrlenA (lpString="*.mdb") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.cer") returned 0
	[0041.430] lstrlenA (lpString="*.cer") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.p12") returned 0
	[0041.430] lstrlenA (lpString="*.p12") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.pfx") returned 0
	[0041.430] lstrlenA (lpString="*.pfx") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.kwm") returned 0
	[0041.430] lstrlenA (lpString="*.kwm") returned 5
	[0041.430] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.pwm") returned 0
	[0041.431] lstrlenA (lpString="*.pwm") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.1cd") returned 0
	[0041.431] lstrlenA (lpString="*.1cd") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.md") returned 0
	[0041.431] lstrlenA (lpString="*.md") returned 4
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mdf") returned 0
	[0041.431] lstrlenA (lpString="*.mdf") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.dbf") returned 0
	[0041.431] lstrlenA (lpString="*.dbf") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.odt") returned 0
	[0041.431] lstrlenA (lpString="*.odt") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.vob") returned 0
	[0041.431] lstrlenA (lpString="*.vob") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.ifo") returned 0
	[0041.431] lstrlenA (lpString="*.ifo") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.lnk") returned 0
	[0041.431] lstrlenA (lpString="*.lnk") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.torrent") returned 0
	[0041.431] lstrlenA (lpString="*.torrent") returned 9
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mov") returned 0
	[0041.431] lstrlenA (lpString="*.mov") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.m2v") returned 0
	[0041.431] lstrlenA (lpString="*.m2v") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.3gp") returned 0
	[0041.431] lstrlenA (lpString="*.3gp") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mpeg") returned 0
	[0041.431] lstrlenA (lpString="*.mpeg") returned 6
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mpg") returned 0
	[0041.431] lstrlenA (lpString="*.mpg") returned 5
	[0041.431] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.flv") returned 0
	[0041.431] lstrlenA (lpString="*.flv") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.avi") returned 0
	[0041.432] lstrlenA (lpString="*.avi") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mp4") returned 0
	[0041.432] lstrlenA (lpString="*.mp4") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.wmv") returned 0
	[0041.432] lstrlenA (lpString="*.wmv") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.divx") returned 0
	[0041.432] lstrlenA (lpString="*.divx") returned 6
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mkv") returned 0
	[0041.432] lstrlenA (lpString="*.mkv") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mp3") returned 0
	[0041.432] lstrlenA (lpString="*.mp3") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.wav") returned 0
	[0041.432] lstrlenA (lpString="*.wav") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.flac") returned 0
	[0041.432] lstrlenA (lpString="*.flac") returned 6
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.ape") returned 0
	[0041.432] lstrlenA (lpString="*.ape") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.wma") returned 0
	[0041.432] lstrlenA (lpString="*.wma") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.ac3") returned 0
	[0041.432] lstrlenA (lpString="*.ac3") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.exe") returned 0
	[0041.432] lstrlenA (lpString="*.exe") returned 5
	[0041.432] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.apk") returned 0
	[0041.432] lstrlenA (lpString="*.apk") returned 5
	[0041.432] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.432] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.432] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.433] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.433] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned="QUAD.INF"
	[0041.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\"
	[0041.433] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned=""
	[0041.433] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt"
	[0041.433] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0x20
	[0041.433] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG"
	[0041.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.433] lstrlenA (lpString="*.zip") returned 5
	[0041.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.433] lstrlenA (lpString="*.rar") returned 5
	[0041.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.433] lstrlenA (lpString="*.7z") returned 4
	[0041.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.433] lstrlenA (lpString="*.tar") returned 5
	[0041.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.433] lstrlenA (lpString="*.gzip") returned 6
	[0041.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.433] lstrlenA (lpString="*.jpg") returned 5
	[0041.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.433] lstrlenA (lpString="*.jpeg") returned 6
	[0041.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.434] lstrlenA (lpString="*.psd") returned 5
	[0041.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.434] lstrlenA (lpString="*.cdr") returned 5
	[0041.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.434] lstrlenA (lpString="*.dwg") returned 5
	[0041.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.434] lstrlenA (lpString="*.max") returned 5
	[0041.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.434] lstrlenA (lpString="*.bmp") returned 5
	[0041.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.434] lstrlenA (lpString="*.gif") returned 5
	[0041.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.434] lstrlenA (lpString="*.png") returned 5
	[0041.434] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG"
	[0041.434] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG"
	[0041.434] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG."
	[0041.434] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.Boom"
	[0041.434] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.435] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90f8
	[0041.435] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d489150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.435] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.435] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x90d5, lpOverlapped=0x0) returned 1
	[0041.452] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.453] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.458] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x90d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x90d5, lpOverlapped=0x0) returned 1
	[0041.519] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.519] CloseHandle (hObject=0x90) returned 1
	[0041.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.boom")) returned 1
	[0041.521] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.521] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0041.521] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.521] lstrcmpA (lpString1=".", lpString2="RADIAL") returned -1
	[0041.521] lstrcmpA (lpString1="..", lpString2="RADIAL") returned -1
	[0041.521] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.521] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RADIAL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL"
	[0041.521] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL") returned 62
	[0041.521] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.523] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.523] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.523] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.523] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.523] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.523] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.523] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.523] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.523] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*") returned="*.*"
	[0041.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\"
	[0041.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned=""
	[0041.523] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt"
	[0041.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0xffffffff
	[0041.523] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.524] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.524] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.525] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.525] CloseHandle (hObject=0x90) returned 1
	[0041.525] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF"
	[0041.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.525] lstrlenA (lpString="*.zip") returned 5
	[0041.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.525] lstrlenA (lpString="*.rar") returned 5
	[0041.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.525] lstrlenA (lpString="*.7z") returned 4
	[0041.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.525] lstrlenA (lpString="*.tar") returned 5
	[0041.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.525] lstrlenA (lpString="*.gzip") returned 6
	[0041.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.525] lstrlenA (lpString="*.jpg") returned 5
	[0041.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.525] lstrlenA (lpString="*.jpeg") returned 6
	[0041.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.526] lstrlenA (lpString="*.psd") returned 5
	[0041.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.526] lstrlenA (lpString="*.cdr") returned 5
	[0041.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.526] lstrlenA (lpString="*.dwg") returned 5
	[0041.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.526] lstrlenA (lpString="*.max") returned 5
	[0041.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.526] lstrlenA (lpString="*.bmp") returned 5
	[0041.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.526] lstrlenA (lpString="*.gif") returned 5
	[0041.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF"
	[0041.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF"
	[0041.526] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF."
	[0041.526] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.Boom"
	[0041.526] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.527] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x682
	[0041.527] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.527] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.527] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x65f, lpOverlapped=0x0) returned 1
	[0041.590] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.590] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.590] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x65f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x65f, lpOverlapped=0x0) returned 1
	[0041.590] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.590] CloseHandle (hObject=0x90) returned 1
	[0041.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.boom")) returned 1
	[0041.595] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.595] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RADIAL.ELM") returned -1
	[0041.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADIAL.ELM") returned -1
	[0041.595] lstrcmpiA (lpString1="", lpString2="RADIAL.ELM") returned -1
	[0041.595] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\"
	[0041.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned=""
	[0041.595] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt"
	[0041.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0x20
	[0041.596] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="RADIAL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM"
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.zip") returned 0
	[0041.596] lstrlenA (lpString="*.zip") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.rar") returned 0
	[0041.596] lstrlenA (lpString="*.rar") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.7z") returned 0
	[0041.596] lstrlenA (lpString="*.7z") returned 4
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.tar") returned 0
	[0041.596] lstrlenA (lpString="*.tar") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.gzip") returned 0
	[0041.596] lstrlenA (lpString="*.gzip") returned 6
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.jpg") returned 0
	[0041.596] lstrlenA (lpString="*.jpg") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.jpeg") returned 0
	[0041.596] lstrlenA (lpString="*.jpeg") returned 6
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.psd") returned 0
	[0041.596] lstrlenA (lpString="*.psd") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.cdr") returned 0
	[0041.596] lstrlenA (lpString="*.cdr") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.dwg") returned 0
	[0041.596] lstrlenA (lpString="*.dwg") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.max") returned 0
	[0041.596] lstrlenA (lpString="*.max") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.bmp") returned 0
	[0041.596] lstrlenA (lpString="*.bmp") returned 5
	[0041.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.gif") returned 0
	[0041.596] lstrlenA (lpString="*.gif") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.png") returned 0
	[0041.597] lstrlenA (lpString="*.png") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.doc") returned 0
	[0041.597] lstrlenA (lpString="*.doc") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.docx") returned 0
	[0041.597] lstrlenA (lpString="*.docx") returned 6
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.xls") returned 0
	[0041.597] lstrlenA (lpString="*.xls") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.xlsx") returned 0
	[0041.597] lstrlenA (lpString="*.xlsx") returned 6
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.ppt") returned 0
	[0041.597] lstrlenA (lpString="*.ppt") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.pptx") returned 0
	[0041.597] lstrlenA (lpString="*.pptx") returned 6
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.txt") returned 0
	[0041.597] lstrlenA (lpString="*.txt") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.pdf") returned 0
	[0041.597] lstrlenA (lpString="*.pdf") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.djvu") returned 0
	[0041.597] lstrlenA (lpString="*.djvu") returned 6
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.htm") returned 0
	[0041.597] lstrlenA (lpString="*.htm") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.html") returned 0
	[0041.597] lstrlenA (lpString="*.html") returned 6
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mdb") returned 0
	[0041.597] lstrlenA (lpString="*.mdb") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.cer") returned 0
	[0041.597] lstrlenA (lpString="*.cer") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.p12") returned 0
	[0041.597] lstrlenA (lpString="*.p12") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.pfx") returned 0
	[0041.597] lstrlenA (lpString="*.pfx") returned 5
	[0041.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.kwm") returned 0
	[0041.598] lstrlenA (lpString="*.kwm") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.pwm") returned 0
	[0041.598] lstrlenA (lpString="*.pwm") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.1cd") returned 0
	[0041.598] lstrlenA (lpString="*.1cd") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.md") returned 0
	[0041.598] lstrlenA (lpString="*.md") returned 4
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mdf") returned 0
	[0041.598] lstrlenA (lpString="*.mdf") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.dbf") returned 0
	[0041.598] lstrlenA (lpString="*.dbf") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.odt") returned 0
	[0041.598] lstrlenA (lpString="*.odt") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.vob") returned 0
	[0041.598] lstrlenA (lpString="*.vob") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.ifo") returned 0
	[0041.598] lstrlenA (lpString="*.ifo") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.lnk") returned 0
	[0041.598] lstrlenA (lpString="*.lnk") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.torrent") returned 0
	[0041.598] lstrlenA (lpString="*.torrent") returned 9
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mov") returned 0
	[0041.598] lstrlenA (lpString="*.mov") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.m2v") returned 0
	[0041.598] lstrlenA (lpString="*.m2v") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.3gp") returned 0
	[0041.598] lstrlenA (lpString="*.3gp") returned 5
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mpeg") returned 0
	[0041.598] lstrlenA (lpString="*.mpeg") returned 6
	[0041.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mpg") returned 0
	[0041.599] lstrlenA (lpString="*.mpg") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.flv") returned 0
	[0041.599] lstrlenA (lpString="*.flv") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.avi") returned 0
	[0041.599] lstrlenA (lpString="*.avi") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mp4") returned 0
	[0041.599] lstrlenA (lpString="*.mp4") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.wmv") returned 0
	[0041.599] lstrlenA (lpString="*.wmv") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.divx") returned 0
	[0041.599] lstrlenA (lpString="*.divx") returned 6
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mkv") returned 0
	[0041.599] lstrlenA (lpString="*.mkv") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mp3") returned 0
	[0041.599] lstrlenA (lpString="*.mp3") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.wav") returned 0
	[0041.599] lstrlenA (lpString="*.wav") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.flac") returned 0
	[0041.599] lstrlenA (lpString="*.flac") returned 6
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.ape") returned 0
	[0041.599] lstrlenA (lpString="*.ape") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.wma") returned 0
	[0041.599] lstrlenA (lpString="*.wma") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.ac3") returned 0
	[0041.599] lstrlenA (lpString="*.ac3") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.exe") returned 0
	[0041.599] lstrlenA (lpString="*.exe") returned 5
	[0041.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.apk") returned 0
	[0041.599] lstrlenA (lpString="*.apk") returned 5
	[0041.599] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.599] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.599] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RADIAL.INF") returned -1
	[0041.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADIAL.INF") returned -1
	[0041.600] lstrcmpiA (lpString1="", lpString2="RADIAL.INF") returned -1
	[0041.600] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned="RADIAL.ELM"
	[0041.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\"
	[0041.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned=""
	[0041.600] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt"
	[0041.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0x20
	[0041.600] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="RADIAL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF"
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.zip") returned 0
	[0041.600] lstrlenA (lpString="*.zip") returned 5
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.rar") returned 0
	[0041.600] lstrlenA (lpString="*.rar") returned 5
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.7z") returned 0
	[0041.600] lstrlenA (lpString="*.7z") returned 4
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.tar") returned 0
	[0041.600] lstrlenA (lpString="*.tar") returned 5
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.gzip") returned 0
	[0041.600] lstrlenA (lpString="*.gzip") returned 6
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.jpg") returned 0
	[0041.600] lstrlenA (lpString="*.jpg") returned 5
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.jpeg") returned 0
	[0041.600] lstrlenA (lpString="*.jpeg") returned 6
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.psd") returned 0
	[0041.600] lstrlenA (lpString="*.psd") returned 5
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.cdr") returned 0
	[0041.600] lstrlenA (lpString="*.cdr") returned 5
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.dwg") returned 0
	[0041.600] lstrlenA (lpString="*.dwg") returned 5
	[0041.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.max") returned 0
	[0041.601] lstrlenA (lpString="*.max") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.bmp") returned 0
	[0041.601] lstrlenA (lpString="*.bmp") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.gif") returned 0
	[0041.601] lstrlenA (lpString="*.gif") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.png") returned 0
	[0041.601] lstrlenA (lpString="*.png") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.doc") returned 0
	[0041.601] lstrlenA (lpString="*.doc") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.docx") returned 0
	[0041.601] lstrlenA (lpString="*.docx") returned 6
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.xls") returned 0
	[0041.601] lstrlenA (lpString="*.xls") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.xlsx") returned 0
	[0041.601] lstrlenA (lpString="*.xlsx") returned 6
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.ppt") returned 0
	[0041.601] lstrlenA (lpString="*.ppt") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.pptx") returned 0
	[0041.601] lstrlenA (lpString="*.pptx") returned 6
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.txt") returned 0
	[0041.601] lstrlenA (lpString="*.txt") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.pdf") returned 0
	[0041.601] lstrlenA (lpString="*.pdf") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.djvu") returned 0
	[0041.601] lstrlenA (lpString="*.djvu") returned 6
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.htm") returned 0
	[0041.601] lstrlenA (lpString="*.htm") returned 5
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.html") returned 0
	[0041.601] lstrlenA (lpString="*.html") returned 6
	[0041.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mdb") returned 0
	[0041.601] lstrlenA (lpString="*.mdb") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.cer") returned 0
	[0041.602] lstrlenA (lpString="*.cer") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.p12") returned 0
	[0041.602] lstrlenA (lpString="*.p12") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.pfx") returned 0
	[0041.602] lstrlenA (lpString="*.pfx") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.kwm") returned 0
	[0041.602] lstrlenA (lpString="*.kwm") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.pwm") returned 0
	[0041.602] lstrlenA (lpString="*.pwm") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.1cd") returned 0
	[0041.602] lstrlenA (lpString="*.1cd") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.md") returned 0
	[0041.602] lstrlenA (lpString="*.md") returned 4
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mdf") returned 0
	[0041.602] lstrlenA (lpString="*.mdf") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.dbf") returned 0
	[0041.602] lstrlenA (lpString="*.dbf") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.odt") returned 0
	[0041.602] lstrlenA (lpString="*.odt") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.vob") returned 0
	[0041.602] lstrlenA (lpString="*.vob") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.ifo") returned 0
	[0041.602] lstrlenA (lpString="*.ifo") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.lnk") returned 0
	[0041.602] lstrlenA (lpString="*.lnk") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.torrent") returned 0
	[0041.602] lstrlenA (lpString="*.torrent") returned 9
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mov") returned 0
	[0041.602] lstrlenA (lpString="*.mov") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.m2v") returned 0
	[0041.602] lstrlenA (lpString="*.m2v") returned 5
	[0041.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.3gp") returned 0
	[0041.603] lstrlenA (lpString="*.3gp") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mpeg") returned 0
	[0041.603] lstrlenA (lpString="*.mpeg") returned 6
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mpg") returned 0
	[0041.603] lstrlenA (lpString="*.mpg") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.flv") returned 0
	[0041.603] lstrlenA (lpString="*.flv") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.avi") returned 0
	[0041.603] lstrlenA (lpString="*.avi") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mp4") returned 0
	[0041.603] lstrlenA (lpString="*.mp4") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.wmv") returned 0
	[0041.603] lstrlenA (lpString="*.wmv") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.divx") returned 0
	[0041.603] lstrlenA (lpString="*.divx") returned 6
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mkv") returned 0
	[0041.603] lstrlenA (lpString="*.mkv") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mp3") returned 0
	[0041.603] lstrlenA (lpString="*.mp3") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.wav") returned 0
	[0041.603] lstrlenA (lpString="*.wav") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.flac") returned 0
	[0041.603] lstrlenA (lpString="*.flac") returned 6
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.ape") returned 0
	[0041.603] lstrlenA (lpString="*.ape") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.wma") returned 0
	[0041.603] lstrlenA (lpString="*.wma") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.ac3") returned 0
	[0041.603] lstrlenA (lpString="*.ac3") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.exe") returned 0
	[0041.603] lstrlenA (lpString="*.exe") returned 5
	[0041.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.apk") returned 0
	[0041.603] lstrlenA (lpString="*.apk") returned 5
	[0041.604] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.604] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.604] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.604] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.604] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned="RADIAL.INF"
	[0041.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\"
	[0041.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned=""
	[0041.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt"
	[0041.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0x20
	[0041.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG"
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.604] lstrlenA (lpString="*.zip") returned 5
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.604] lstrlenA (lpString="*.rar") returned 5
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.604] lstrlenA (lpString="*.7z") returned 4
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.604] lstrlenA (lpString="*.tar") returned 5
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.604] lstrlenA (lpString="*.gzip") returned 6
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.604] lstrlenA (lpString="*.jpg") returned 5
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.604] lstrlenA (lpString="*.jpeg") returned 6
	[0041.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.605] lstrlenA (lpString="*.psd") returned 5
	[0041.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.605] lstrlenA (lpString="*.cdr") returned 5
	[0041.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.605] lstrlenA (lpString="*.dwg") returned 5
	[0041.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.605] lstrlenA (lpString="*.max") returned 5
	[0041.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.605] lstrlenA (lpString="*.bmp") returned 5
	[0041.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.605] lstrlenA (lpString="*.gif") returned 5
	[0041.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.605] lstrlenA (lpString="*.png") returned 5
	[0041.605] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG"
	[0041.605] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG"
	[0041.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG."
	[0041.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.Boom"
	[0041.605] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.605] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c6b
	[0041.606] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.606] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.606] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4c48, lpOverlapped=0x0) returned 1
	[0041.651] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.651] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.651] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4c48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4c48, lpOverlapped=0x0) returned 1
	[0041.651] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.652] CloseHandle (hObject=0x90) returned 1
	[0041.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.boom")) returned 1
	[0041.653] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.653] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0041.653] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.653] lstrcmpA (lpString1=".", lpString2="REFINED") returned -1
	[0041.653] lstrcmpA (lpString1="..", lpString2="REFINED") returned -1
	[0041.654] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.654] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="REFINED" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED"
	[0041.654] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned 63
	[0041.654] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.654] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.654] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.654] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.654] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.654] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.654] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.654] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.654] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.654] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*") returned="*.*"
	[0041.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\"
	[0041.654] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned=""
	[0041.654] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt"
	[0041.654] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0xffffffff
	[0041.654] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.655] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.655] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.656] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.656] CloseHandle (hObject=0x90) returned 1
	[0041.656] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF"
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.657] lstrlenA (lpString="*.zip") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.657] lstrlenA (lpString="*.rar") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.657] lstrlenA (lpString="*.7z") returned 4
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.657] lstrlenA (lpString="*.tar") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.657] lstrlenA (lpString="*.gzip") returned 6
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.657] lstrlenA (lpString="*.jpg") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.657] lstrlenA (lpString="*.jpeg") returned 6
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.657] lstrlenA (lpString="*.psd") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.657] lstrlenA (lpString="*.cdr") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.657] lstrlenA (lpString="*.dwg") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.657] lstrlenA (lpString="*.max") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.657] lstrlenA (lpString="*.bmp") returned 5
	[0041.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.657] lstrlenA (lpString="*.gif") returned 5
	[0041.657] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF"
	[0041.657] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF"
	[0041.657] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF."
	[0041.658] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.Boom"
	[0041.658] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.658] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58f
	[0041.658] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.658] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.658] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x56c, lpOverlapped=0x0) returned 1
	[0041.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.844] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.844] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x56c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x56c, lpOverlapped=0x0) returned 1
	[0041.844] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.844] CloseHandle (hObject=0x90) returned 1
	[0041.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.boom")) returned 1
	[0041.847] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.847] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REFINED.ELM") returned -1
	[0041.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REFINED.ELM") returned -1
	[0041.847] lstrcmpiA (lpString1="", lpString2="REFINED.ELM") returned -1
	[0041.847] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0041.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\"
	[0041.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned=""
	[0041.847] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt"
	[0041.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0x20
	[0041.847] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="REFINED.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM"
	[0041.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.zip") returned 0
	[0041.847] lstrlenA (lpString="*.zip") returned 5
	[0041.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.rar") returned 0
	[0041.847] lstrlenA (lpString="*.rar") returned 5
	[0041.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.7z") returned 0
	[0041.847] lstrlenA (lpString="*.7z") returned 4
	[0041.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.tar") returned 0
	[0041.847] lstrlenA (lpString="*.tar") returned 5
	[0041.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.gzip") returned 0
	[0041.847] lstrlenA (lpString="*.gzip") returned 6
	[0041.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.jpg") returned 0
	[0041.847] lstrlenA (lpString="*.jpg") returned 5
	[0041.847] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.jpeg") returned 0
	[0041.848] lstrlenA (lpString="*.jpeg") returned 6
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.psd") returned 0
	[0041.848] lstrlenA (lpString="*.psd") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.cdr") returned 0
	[0041.848] lstrlenA (lpString="*.cdr") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.dwg") returned 0
	[0041.848] lstrlenA (lpString="*.dwg") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.max") returned 0
	[0041.848] lstrlenA (lpString="*.max") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.bmp") returned 0
	[0041.848] lstrlenA (lpString="*.bmp") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.gif") returned 0
	[0041.848] lstrlenA (lpString="*.gif") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.png") returned 0
	[0041.848] lstrlenA (lpString="*.png") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.doc") returned 0
	[0041.848] lstrlenA (lpString="*.doc") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.docx") returned 0
	[0041.848] lstrlenA (lpString="*.docx") returned 6
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.xls") returned 0
	[0041.848] lstrlenA (lpString="*.xls") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.xlsx") returned 0
	[0041.848] lstrlenA (lpString="*.xlsx") returned 6
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.ppt") returned 0
	[0041.848] lstrlenA (lpString="*.ppt") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.pptx") returned 0
	[0041.848] lstrlenA (lpString="*.pptx") returned 6
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.txt") returned 0
	[0041.848] lstrlenA (lpString="*.txt") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.pdf") returned 0
	[0041.848] lstrlenA (lpString="*.pdf") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.djvu") returned 0
	[0041.848] lstrlenA (lpString="*.djvu") returned 6
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.htm") returned 0
	[0041.848] lstrlenA (lpString="*.htm") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.html") returned 0
	[0041.848] lstrlenA (lpString="*.html") returned 6
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mdb") returned 0
	[0041.848] lstrlenA (lpString="*.mdb") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.cer") returned 0
	[0041.848] lstrlenA (lpString="*.cer") returned 5
	[0041.848] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.p12") returned 0
	[0041.849] lstrlenA (lpString="*.p12") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.pfx") returned 0
	[0041.849] lstrlenA (lpString="*.pfx") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.kwm") returned 0
	[0041.849] lstrlenA (lpString="*.kwm") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.pwm") returned 0
	[0041.849] lstrlenA (lpString="*.pwm") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.1cd") returned 0
	[0041.849] lstrlenA (lpString="*.1cd") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.md") returned 0
	[0041.849] lstrlenA (lpString="*.md") returned 4
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mdf") returned 0
	[0041.849] lstrlenA (lpString="*.mdf") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.dbf") returned 0
	[0041.849] lstrlenA (lpString="*.dbf") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.odt") returned 0
	[0041.849] lstrlenA (lpString="*.odt") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.vob") returned 0
	[0041.849] lstrlenA (lpString="*.vob") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.ifo") returned 0
	[0041.849] lstrlenA (lpString="*.ifo") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.lnk") returned 0
	[0041.849] lstrlenA (lpString="*.lnk") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.torrent") returned 0
	[0041.849] lstrlenA (lpString="*.torrent") returned 9
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mov") returned 0
	[0041.849] lstrlenA (lpString="*.mov") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.m2v") returned 0
	[0041.849] lstrlenA (lpString="*.m2v") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.3gp") returned 0
	[0041.849] lstrlenA (lpString="*.3gp") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mpeg") returned 0
	[0041.849] lstrlenA (lpString="*.mpeg") returned 6
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mpg") returned 0
	[0041.849] lstrlenA (lpString="*.mpg") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.flv") returned 0
	[0041.849] lstrlenA (lpString="*.flv") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.avi") returned 0
	[0041.849] lstrlenA (lpString="*.avi") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mp4") returned 0
	[0041.849] lstrlenA (lpString="*.mp4") returned 5
	[0041.849] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.wmv") returned 0
	[0041.850] lstrlenA (lpString="*.wmv") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.divx") returned 0
	[0041.850] lstrlenA (lpString="*.divx") returned 6
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mkv") returned 0
	[0041.850] lstrlenA (lpString="*.mkv") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mp3") returned 0
	[0041.850] lstrlenA (lpString="*.mp3") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.wav") returned 0
	[0041.850] lstrlenA (lpString="*.wav") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.flac") returned 0
	[0041.850] lstrlenA (lpString="*.flac") returned 6
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.ape") returned 0
	[0041.850] lstrlenA (lpString="*.ape") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.wma") returned 0
	[0041.850] lstrlenA (lpString="*.wma") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.ac3") returned 0
	[0041.850] lstrlenA (lpString="*.ac3") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.exe") returned 0
	[0041.850] lstrlenA (lpString="*.exe") returned 5
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.apk") returned 0
	[0041.850] lstrlenA (lpString="*.apk") returned 5
	[0041.850] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.850] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.850] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REFINED.INF") returned -1
	[0041.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REFINED.INF") returned -1
	[0041.850] lstrcmpiA (lpString1="", lpString2="REFINED.INF") returned -1
	[0041.850] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned="REFINED.ELM"
	[0041.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\"
	[0041.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned=""
	[0041.850] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt"
	[0041.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0x20
	[0041.850] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="REFINED.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF"
	[0041.850] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.zip") returned 0
	[0041.851] lstrlenA (lpString="*.zip") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.rar") returned 0
	[0041.851] lstrlenA (lpString="*.rar") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.7z") returned 0
	[0041.851] lstrlenA (lpString="*.7z") returned 4
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.tar") returned 0
	[0041.851] lstrlenA (lpString="*.tar") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.gzip") returned 0
	[0041.851] lstrlenA (lpString="*.gzip") returned 6
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.jpg") returned 0
	[0041.851] lstrlenA (lpString="*.jpg") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.jpeg") returned 0
	[0041.851] lstrlenA (lpString="*.jpeg") returned 6
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.psd") returned 0
	[0041.851] lstrlenA (lpString="*.psd") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.cdr") returned 0
	[0041.851] lstrlenA (lpString="*.cdr") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.dwg") returned 0
	[0041.851] lstrlenA (lpString="*.dwg") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.max") returned 0
	[0041.851] lstrlenA (lpString="*.max") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.bmp") returned 0
	[0041.851] lstrlenA (lpString="*.bmp") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.gif") returned 0
	[0041.851] lstrlenA (lpString="*.gif") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.png") returned 0
	[0041.851] lstrlenA (lpString="*.png") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.doc") returned 0
	[0041.851] lstrlenA (lpString="*.doc") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.docx") returned 0
	[0041.851] lstrlenA (lpString="*.docx") returned 6
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.xls") returned 0
	[0041.851] lstrlenA (lpString="*.xls") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.xlsx") returned 0
	[0041.851] lstrlenA (lpString="*.xlsx") returned 6
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.ppt") returned 0
	[0041.851] lstrlenA (lpString="*.ppt") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.pptx") returned 0
	[0041.851] lstrlenA (lpString="*.pptx") returned 6
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.txt") returned 0
	[0041.851] lstrlenA (lpString="*.txt") returned 5
	[0041.851] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.pdf") returned 0
	[0041.852] lstrlenA (lpString="*.pdf") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.djvu") returned 0
	[0041.852] lstrlenA (lpString="*.djvu") returned 6
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.htm") returned 0
	[0041.852] lstrlenA (lpString="*.htm") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.html") returned 0
	[0041.852] lstrlenA (lpString="*.html") returned 6
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mdb") returned 0
	[0041.852] lstrlenA (lpString="*.mdb") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.cer") returned 0
	[0041.852] lstrlenA (lpString="*.cer") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.p12") returned 0
	[0041.852] lstrlenA (lpString="*.p12") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.pfx") returned 0
	[0041.852] lstrlenA (lpString="*.pfx") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.kwm") returned 0
	[0041.852] lstrlenA (lpString="*.kwm") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.pwm") returned 0
	[0041.852] lstrlenA (lpString="*.pwm") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.1cd") returned 0
	[0041.852] lstrlenA (lpString="*.1cd") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.md") returned 0
	[0041.852] lstrlenA (lpString="*.md") returned 4
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mdf") returned 0
	[0041.852] lstrlenA (lpString="*.mdf") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.dbf") returned 0
	[0041.852] lstrlenA (lpString="*.dbf") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.odt") returned 0
	[0041.852] lstrlenA (lpString="*.odt") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.vob") returned 0
	[0041.852] lstrlenA (lpString="*.vob") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.ifo") returned 0
	[0041.852] lstrlenA (lpString="*.ifo") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.lnk") returned 0
	[0041.852] lstrlenA (lpString="*.lnk") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.torrent") returned 0
	[0041.852] lstrlenA (lpString="*.torrent") returned 9
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mov") returned 0
	[0041.852] lstrlenA (lpString="*.mov") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.m2v") returned 0
	[0041.852] lstrlenA (lpString="*.m2v") returned 5
	[0041.852] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.3gp") returned 0
	[0041.853] lstrlenA (lpString="*.3gp") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mpeg") returned 0
	[0041.853] lstrlenA (lpString="*.mpeg") returned 6
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mpg") returned 0
	[0041.853] lstrlenA (lpString="*.mpg") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.flv") returned 0
	[0041.853] lstrlenA (lpString="*.flv") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.avi") returned 0
	[0041.853] lstrlenA (lpString="*.avi") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mp4") returned 0
	[0041.853] lstrlenA (lpString="*.mp4") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.wmv") returned 0
	[0041.853] lstrlenA (lpString="*.wmv") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.divx") returned 0
	[0041.853] lstrlenA (lpString="*.divx") returned 6
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mkv") returned 0
	[0041.853] lstrlenA (lpString="*.mkv") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mp3") returned 0
	[0041.853] lstrlenA (lpString="*.mp3") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.wav") returned 0
	[0041.853] lstrlenA (lpString="*.wav") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.flac") returned 0
	[0041.853] lstrlenA (lpString="*.flac") returned 6
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.ape") returned 0
	[0041.853] lstrlenA (lpString="*.ape") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.wma") returned 0
	[0041.853] lstrlenA (lpString="*.wma") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.ac3") returned 0
	[0041.853] lstrlenA (lpString="*.ac3") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.exe") returned 0
	[0041.853] lstrlenA (lpString="*.exe") returned 5
	[0041.853] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.apk") returned 0
	[0041.853] lstrlenA (lpString="*.apk") returned 5
	[0041.853] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.853] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0041.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0041.853] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0041.853] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned="REFINED.INF"
	[0041.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\"
	[0041.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned=""
	[0041.854] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt"
	[0041.854] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0x20
	[0041.854] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG"
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0041.854] lstrlenA (lpString="*.zip") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0041.854] lstrlenA (lpString="*.rar") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0041.854] lstrlenA (lpString="*.7z") returned 4
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0041.854] lstrlenA (lpString="*.tar") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0041.854] lstrlenA (lpString="*.gzip") returned 6
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0041.854] lstrlenA (lpString="*.jpg") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0041.854] lstrlenA (lpString="*.jpeg") returned 6
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0041.854] lstrlenA (lpString="*.psd") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0041.854] lstrlenA (lpString="*.cdr") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0041.854] lstrlenA (lpString="*.dwg") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0041.854] lstrlenA (lpString="*.max") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0041.854] lstrlenA (lpString="*.bmp") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0041.854] lstrlenA (lpString="*.gif") returned 5
	[0041.854] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0041.854] lstrlenA (lpString="*.png") returned 5
	[0041.854] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG"
	[0041.854] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG"
	[0041.854] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG."
	[0041.854] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.Boom"
	[0041.854] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.855] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d79
	[0041.855] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.855] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.855] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3d56, lpOverlapped=0x0) returned 1
	[0041.927] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0041.928] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.928] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3d56, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3d56, lpOverlapped=0x0) returned 1
	[0041.928] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0041.928] CloseHandle (hObject=0x90) returned 1
	[0041.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.boom")) returned 1
	[0041.930] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0041.930] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0041.931] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0041.931] lstrcmpA (lpString1=".", lpString2="RICEPAPR") returned -1
	[0041.931] lstrcmpA (lpString1="..", lpString2="RICEPAPR") returned -1
	[0041.931] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0041.931] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RICEPAPR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR"
	[0041.931] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR") returned 64
	[0041.931] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0041.981] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0041.981] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.981] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0041.981] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0041.981] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0041.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0041.981] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0041.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0041.981] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0041.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*") returned="*.*"
	[0041.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\"
	[0041.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned=""
	[0041.981] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt"
	[0041.981] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0xffffffff
	[0041.981] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.983] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0041.983] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0041.984] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0041.984] CloseHandle (hObject=0x90) returned 1
	[0041.984] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF"
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0041.985] lstrlenA (lpString="*.zip") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0041.985] lstrlenA (lpString="*.rar") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0041.985] lstrlenA (lpString="*.7z") returned 4
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0041.985] lstrlenA (lpString="*.tar") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0041.985] lstrlenA (lpString="*.gzip") returned 6
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0041.985] lstrlenA (lpString="*.jpg") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0041.985] lstrlenA (lpString="*.jpeg") returned 6
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0041.985] lstrlenA (lpString="*.psd") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0041.985] lstrlenA (lpString="*.cdr") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0041.985] lstrlenA (lpString="*.dwg") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0041.985] lstrlenA (lpString="*.max") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0041.985] lstrlenA (lpString="*.bmp") returned 5
	[0041.985] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0041.985] lstrlenA (lpString="*.gif") returned 5
	[0041.985] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF"
	[0041.985] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF"
	[0041.985] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF."
	[0041.985] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.Boom"
	[0041.986] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0041.986] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf82
	[0041.986] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0041.986] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0041.986] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf5f, lpOverlapped=0x0) returned 1
	[0042.001] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.001] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.001] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf5f, lpOverlapped=0x0) returned 1
	[0042.002] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.002] CloseHandle (hObject=0x90) returned 1
	[0042.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.boom")) returned 1
	[0042.003] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.003] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.003] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RICEPAPR.ELM") returned -1
	[0042.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RICEPAPR.ELM") returned -1
	[0042.003] lstrcmpiA (lpString1="", lpString2="RICEPAPR.ELM") returned -1
	[0042.003] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\"
	[0042.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned=""
	[0042.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt"
	[0042.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0x20
	[0042.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="RICEPAPR.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM"
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.zip") returned 0
	[0042.004] lstrlenA (lpString="*.zip") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.rar") returned 0
	[0042.004] lstrlenA (lpString="*.rar") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.7z") returned 0
	[0042.004] lstrlenA (lpString="*.7z") returned 4
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.tar") returned 0
	[0042.004] lstrlenA (lpString="*.tar") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.gzip") returned 0
	[0042.004] lstrlenA (lpString="*.gzip") returned 6
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.jpg") returned 0
	[0042.004] lstrlenA (lpString="*.jpg") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.jpeg") returned 0
	[0042.004] lstrlenA (lpString="*.jpeg") returned 6
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.psd") returned 0
	[0042.004] lstrlenA (lpString="*.psd") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.cdr") returned 0
	[0042.004] lstrlenA (lpString="*.cdr") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.dwg") returned 0
	[0042.004] lstrlenA (lpString="*.dwg") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.max") returned 0
	[0042.004] lstrlenA (lpString="*.max") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.bmp") returned 0
	[0042.004] lstrlenA (lpString="*.bmp") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.gif") returned 0
	[0042.004] lstrlenA (lpString="*.gif") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.png") returned 0
	[0042.004] lstrlenA (lpString="*.png") returned 5
	[0042.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.doc") returned 0
	[0042.004] lstrlenA (lpString="*.doc") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.docx") returned 0
	[0042.005] lstrlenA (lpString="*.docx") returned 6
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.xls") returned 0
	[0042.005] lstrlenA (lpString="*.xls") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.xlsx") returned 0
	[0042.005] lstrlenA (lpString="*.xlsx") returned 6
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.ppt") returned 0
	[0042.005] lstrlenA (lpString="*.ppt") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.pptx") returned 0
	[0042.005] lstrlenA (lpString="*.pptx") returned 6
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.txt") returned 0
	[0042.005] lstrlenA (lpString="*.txt") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.pdf") returned 0
	[0042.005] lstrlenA (lpString="*.pdf") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.djvu") returned 0
	[0042.005] lstrlenA (lpString="*.djvu") returned 6
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.htm") returned 0
	[0042.005] lstrlenA (lpString="*.htm") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.html") returned 0
	[0042.005] lstrlenA (lpString="*.html") returned 6
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mdb") returned 0
	[0042.005] lstrlenA (lpString="*.mdb") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.cer") returned 0
	[0042.005] lstrlenA (lpString="*.cer") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.p12") returned 0
	[0042.005] lstrlenA (lpString="*.p12") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.pfx") returned 0
	[0042.005] lstrlenA (lpString="*.pfx") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.kwm") returned 0
	[0042.005] lstrlenA (lpString="*.kwm") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.pwm") returned 0
	[0042.005] lstrlenA (lpString="*.pwm") returned 5
	[0042.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.1cd") returned 0
	[0042.005] lstrlenA (lpString="*.1cd") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.md") returned 0
	[0042.006] lstrlenA (lpString="*.md") returned 4
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mdf") returned 0
	[0042.006] lstrlenA (lpString="*.mdf") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.dbf") returned 0
	[0042.006] lstrlenA (lpString="*.dbf") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.odt") returned 0
	[0042.006] lstrlenA (lpString="*.odt") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.vob") returned 0
	[0042.006] lstrlenA (lpString="*.vob") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.ifo") returned 0
	[0042.006] lstrlenA (lpString="*.ifo") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.lnk") returned 0
	[0042.006] lstrlenA (lpString="*.lnk") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.torrent") returned 0
	[0042.006] lstrlenA (lpString="*.torrent") returned 9
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mov") returned 0
	[0042.006] lstrlenA (lpString="*.mov") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.m2v") returned 0
	[0042.006] lstrlenA (lpString="*.m2v") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.3gp") returned 0
	[0042.006] lstrlenA (lpString="*.3gp") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mpeg") returned 0
	[0042.006] lstrlenA (lpString="*.mpeg") returned 6
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mpg") returned 0
	[0042.006] lstrlenA (lpString="*.mpg") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.flv") returned 0
	[0042.006] lstrlenA (lpString="*.flv") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.avi") returned 0
	[0042.006] lstrlenA (lpString="*.avi") returned 5
	[0042.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mp4") returned 0
	[0042.006] lstrlenA (lpString="*.mp4") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.wmv") returned 0
	[0042.007] lstrlenA (lpString="*.wmv") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.divx") returned 0
	[0042.007] lstrlenA (lpString="*.divx") returned 6
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mkv") returned 0
	[0042.007] lstrlenA (lpString="*.mkv") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mp3") returned 0
	[0042.007] lstrlenA (lpString="*.mp3") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.wav") returned 0
	[0042.007] lstrlenA (lpString="*.wav") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.flac") returned 0
	[0042.007] lstrlenA (lpString="*.flac") returned 6
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.ape") returned 0
	[0042.007] lstrlenA (lpString="*.ape") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.wma") returned 0
	[0042.007] lstrlenA (lpString="*.wma") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.ac3") returned 0
	[0042.007] lstrlenA (lpString="*.ac3") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.exe") returned 0
	[0042.007] lstrlenA (lpString="*.exe") returned 5
	[0042.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.apk") returned 0
	[0042.007] lstrlenA (lpString="*.apk") returned 5
	[0042.007] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.007] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RICEPAPR.INF") returned -1
	[0042.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RICEPAPR.INF") returned -1
	[0042.007] lstrcmpiA (lpString1="", lpString2="RICEPAPR.INF") returned -1
	[0042.008] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned="RICEPAPR.ELM"
	[0042.008] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\"
	[0042.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned=""
	[0042.008] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt"
	[0042.008] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0x20
	[0042.008] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="RICEPAPR.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF"
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.zip") returned 0
	[0042.008] lstrlenA (lpString="*.zip") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.rar") returned 0
	[0042.008] lstrlenA (lpString="*.rar") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.7z") returned 0
	[0042.008] lstrlenA (lpString="*.7z") returned 4
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.tar") returned 0
	[0042.008] lstrlenA (lpString="*.tar") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.gzip") returned 0
	[0042.008] lstrlenA (lpString="*.gzip") returned 6
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.jpg") returned 0
	[0042.008] lstrlenA (lpString="*.jpg") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.jpeg") returned 0
	[0042.008] lstrlenA (lpString="*.jpeg") returned 6
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.psd") returned 0
	[0042.008] lstrlenA (lpString="*.psd") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.cdr") returned 0
	[0042.008] lstrlenA (lpString="*.cdr") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.dwg") returned 0
	[0042.008] lstrlenA (lpString="*.dwg") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.max") returned 0
	[0042.008] lstrlenA (lpString="*.max") returned 5
	[0042.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.bmp") returned 0
	[0042.009] lstrlenA (lpString="*.bmp") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.gif") returned 0
	[0042.009] lstrlenA (lpString="*.gif") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.png") returned 0
	[0042.009] lstrlenA (lpString="*.png") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.doc") returned 0
	[0042.009] lstrlenA (lpString="*.doc") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.docx") returned 0
	[0042.009] lstrlenA (lpString="*.docx") returned 6
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.xls") returned 0
	[0042.009] lstrlenA (lpString="*.xls") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.xlsx") returned 0
	[0042.009] lstrlenA (lpString="*.xlsx") returned 6
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.ppt") returned 0
	[0042.009] lstrlenA (lpString="*.ppt") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.pptx") returned 0
	[0042.009] lstrlenA (lpString="*.pptx") returned 6
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.txt") returned 0
	[0042.009] lstrlenA (lpString="*.txt") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.pdf") returned 0
	[0042.009] lstrlenA (lpString="*.pdf") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.djvu") returned 0
	[0042.009] lstrlenA (lpString="*.djvu") returned 6
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.htm") returned 0
	[0042.009] lstrlenA (lpString="*.htm") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.html") returned 0
	[0042.009] lstrlenA (lpString="*.html") returned 6
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mdb") returned 0
	[0042.009] lstrlenA (lpString="*.mdb") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.cer") returned 0
	[0042.009] lstrlenA (lpString="*.cer") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.p12") returned 0
	[0042.009] lstrlenA (lpString="*.p12") returned 5
	[0042.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.pfx") returned 0
	[0042.010] lstrlenA (lpString="*.pfx") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.kwm") returned 0
	[0042.010] lstrlenA (lpString="*.kwm") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.pwm") returned 0
	[0042.010] lstrlenA (lpString="*.pwm") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.1cd") returned 0
	[0042.010] lstrlenA (lpString="*.1cd") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.md") returned 0
	[0042.010] lstrlenA (lpString="*.md") returned 4
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mdf") returned 0
	[0042.010] lstrlenA (lpString="*.mdf") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.dbf") returned 0
	[0042.010] lstrlenA (lpString="*.dbf") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.odt") returned 0
	[0042.010] lstrlenA (lpString="*.odt") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.vob") returned 0
	[0042.010] lstrlenA (lpString="*.vob") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.ifo") returned 0
	[0042.010] lstrlenA (lpString="*.ifo") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.lnk") returned 0
	[0042.010] lstrlenA (lpString="*.lnk") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.torrent") returned 0
	[0042.010] lstrlenA (lpString="*.torrent") returned 9
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mov") returned 0
	[0042.010] lstrlenA (lpString="*.mov") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.m2v") returned 0
	[0042.010] lstrlenA (lpString="*.m2v") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.3gp") returned 0
	[0042.010] lstrlenA (lpString="*.3gp") returned 5
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mpeg") returned 0
	[0042.010] lstrlenA (lpString="*.mpeg") returned 6
	[0042.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mpg") returned 0
	[0042.010] lstrlenA (lpString="*.mpg") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.flv") returned 0
	[0042.011] lstrlenA (lpString="*.flv") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.avi") returned 0
	[0042.011] lstrlenA (lpString="*.avi") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mp4") returned 0
	[0042.011] lstrlenA (lpString="*.mp4") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.wmv") returned 0
	[0042.011] lstrlenA (lpString="*.wmv") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.divx") returned 0
	[0042.011] lstrlenA (lpString="*.divx") returned 6
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mkv") returned 0
	[0042.011] lstrlenA (lpString="*.mkv") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mp3") returned 0
	[0042.011] lstrlenA (lpString="*.mp3") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.wav") returned 0
	[0042.011] lstrlenA (lpString="*.wav") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.flac") returned 0
	[0042.011] lstrlenA (lpString="*.flac") returned 6
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.ape") returned 0
	[0042.011] lstrlenA (lpString="*.ape") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.wma") returned 0
	[0042.011] lstrlenA (lpString="*.wma") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.ac3") returned 0
	[0042.011] lstrlenA (lpString="*.ac3") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.exe") returned 0
	[0042.011] lstrlenA (lpString="*.exe") returned 5
	[0042.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.apk") returned 0
	[0042.011] lstrlenA (lpString="*.apk") returned 5
	[0042.011] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.011] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0042.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0042.012] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0042.012] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned="RICEPAPR.INF"
	[0042.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\"
	[0042.012] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned=""
	[0042.012] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt"
	[0042.012] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0x20
	[0042.012] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG"
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0042.012] lstrlenA (lpString="*.zip") returned 5
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0042.012] lstrlenA (lpString="*.rar") returned 5
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0042.012] lstrlenA (lpString="*.7z") returned 4
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0042.012] lstrlenA (lpString="*.tar") returned 5
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0042.012] lstrlenA (lpString="*.gzip") returned 6
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0042.012] lstrlenA (lpString="*.jpg") returned 5
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0042.012] lstrlenA (lpString="*.jpeg") returned 6
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0042.012] lstrlenA (lpString="*.psd") returned 5
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0042.012] lstrlenA (lpString="*.cdr") returned 5
	[0042.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0042.012] lstrlenA (lpString="*.dwg") returned 5
	[0042.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0042.013] lstrlenA (lpString="*.max") returned 5
	[0042.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0042.013] lstrlenA (lpString="*.bmp") returned 5
	[0042.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0042.013] lstrlenA (lpString="*.gif") returned 5
	[0042.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0042.013] lstrlenA (lpString="*.png") returned 5
	[0042.013] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG"
	[0042.013] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG"
	[0042.013] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG."
	[0042.013] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.Boom"
	[0042.013] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.013] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf7b
	[0042.013] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.013] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.014] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xcf58, lpOverlapped=0x0) returned 1
	[0042.099] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0042.099] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.099] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xcf58, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xcf58, lpOverlapped=0x0) returned 1
	[0042.100] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.100] CloseHandle (hObject=0x90) returned 1
	[0042.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.boom")) returned 1
	[0042.102] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0042.102] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0042.102] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0042.102] lstrcmpA (lpString1=".", lpString2="RIPPLE") returned -1
	[0042.102] lstrcmpA (lpString1="..", lpString2="RIPPLE") returned -1
	[0042.102] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0042.102] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RIPPLE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE"
	[0042.103] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE") returned 62
	[0042.103] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0042.103] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0042.103] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.103] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0042.103] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0042.103] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.103] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.103] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0042.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0042.103] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0042.103] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*") returned="*.*"
	[0042.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\"
	[0042.103] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned=""
	[0042.103] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt"
	[0042.103] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0xffffffff
	[0042.103] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.104] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0042.104] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0042.105] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0042.105] CloseHandle (hObject=0x90) returned 1
	[0042.105] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF"
	[0042.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0042.105] lstrlenA (lpString="*.zip") returned 5
	[0042.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0042.105] lstrlenA (lpString="*.rar") returned 5
	[0042.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0042.105] lstrlenA (lpString="*.7z") returned 4
	[0042.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0042.105] lstrlenA (lpString="*.tar") returned 5
	[0042.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0042.105] lstrlenA (lpString="*.gzip") returned 6
	[0042.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0042.105] lstrlenA (lpString="*.jpg") returned 5
	[0042.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0042.105] lstrlenA (lpString="*.jpeg") returned 6
	[0042.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0042.106] lstrlenA (lpString="*.psd") returned 5
	[0042.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0042.106] lstrlenA (lpString="*.cdr") returned 5
	[0042.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0042.106] lstrlenA (lpString="*.dwg") returned 5
	[0042.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0042.106] lstrlenA (lpString="*.max") returned 5
	[0042.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0042.106] lstrlenA (lpString="*.bmp") returned 5
	[0042.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0042.106] lstrlenA (lpString="*.gif") returned 5
	[0042.106] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF"
	[0042.106] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF"
	[0042.106] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF."
	[0042.106] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.Boom"
	[0042.106] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.107] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2c
	[0042.107] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.107] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.107] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa09, lpOverlapped=0x0) returned 1
	[0042.109] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.109] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.109] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa09, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa09, lpOverlapped=0x0) returned 1
	[0042.109] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.109] CloseHandle (hObject=0x90) returned 1
	[0042.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.boom")) returned 1
	[0042.113] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.113] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.113] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RIPPLE.ELM") returned -1
	[0042.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RIPPLE.ELM") returned -1
	[0042.113] lstrcmpiA (lpString1="", lpString2="RIPPLE.ELM") returned -1
	[0042.113] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\"
	[0042.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned=""
	[0042.113] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt"
	[0042.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0x20
	[0042.113] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="RIPPLE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM"
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.zip") returned 0
	[0042.113] lstrlenA (lpString="*.zip") returned 5
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.rar") returned 0
	[0042.113] lstrlenA (lpString="*.rar") returned 5
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.7z") returned 0
	[0042.113] lstrlenA (lpString="*.7z") returned 4
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.tar") returned 0
	[0042.113] lstrlenA (lpString="*.tar") returned 5
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.gzip") returned 0
	[0042.113] lstrlenA (lpString="*.gzip") returned 6
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.jpg") returned 0
	[0042.113] lstrlenA (lpString="*.jpg") returned 5
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.jpeg") returned 0
	[0042.113] lstrlenA (lpString="*.jpeg") returned 6
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.psd") returned 0
	[0042.113] lstrlenA (lpString="*.psd") returned 5
	[0042.113] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.cdr") returned 0
	[0042.113] lstrlenA (lpString="*.cdr") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.dwg") returned 0
	[0042.114] lstrlenA (lpString="*.dwg") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.max") returned 0
	[0042.114] lstrlenA (lpString="*.max") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.bmp") returned 0
	[0042.114] lstrlenA (lpString="*.bmp") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.gif") returned 0
	[0042.114] lstrlenA (lpString="*.gif") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.png") returned 0
	[0042.114] lstrlenA (lpString="*.png") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.doc") returned 0
	[0042.114] lstrlenA (lpString="*.doc") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.docx") returned 0
	[0042.114] lstrlenA (lpString="*.docx") returned 6
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.xls") returned 0
	[0042.114] lstrlenA (lpString="*.xls") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.xlsx") returned 0
	[0042.114] lstrlenA (lpString="*.xlsx") returned 6
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.ppt") returned 0
	[0042.114] lstrlenA (lpString="*.ppt") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.pptx") returned 0
	[0042.114] lstrlenA (lpString="*.pptx") returned 6
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.txt") returned 0
	[0042.114] lstrlenA (lpString="*.txt") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.pdf") returned 0
	[0042.114] lstrlenA (lpString="*.pdf") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.djvu") returned 0
	[0042.114] lstrlenA (lpString="*.djvu") returned 6
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.htm") returned 0
	[0042.114] lstrlenA (lpString="*.htm") returned 5
	[0042.114] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.html") returned 0
	[0042.114] lstrlenA (lpString="*.html") returned 6
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mdb") returned 0
	[0042.115] lstrlenA (lpString="*.mdb") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.cer") returned 0
	[0042.115] lstrlenA (lpString="*.cer") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.p12") returned 0
	[0042.115] lstrlenA (lpString="*.p12") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.pfx") returned 0
	[0042.115] lstrlenA (lpString="*.pfx") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.kwm") returned 0
	[0042.115] lstrlenA (lpString="*.kwm") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.pwm") returned 0
	[0042.115] lstrlenA (lpString="*.pwm") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.1cd") returned 0
	[0042.115] lstrlenA (lpString="*.1cd") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.md") returned 0
	[0042.115] lstrlenA (lpString="*.md") returned 4
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mdf") returned 0
	[0042.115] lstrlenA (lpString="*.mdf") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.dbf") returned 0
	[0042.115] lstrlenA (lpString="*.dbf") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.odt") returned 0
	[0042.115] lstrlenA (lpString="*.odt") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.vob") returned 0
	[0042.115] lstrlenA (lpString="*.vob") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.ifo") returned 0
	[0042.115] lstrlenA (lpString="*.ifo") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.lnk") returned 0
	[0042.115] lstrlenA (lpString="*.lnk") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.torrent") returned 0
	[0042.115] lstrlenA (lpString="*.torrent") returned 9
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mov") returned 0
	[0042.115] lstrlenA (lpString="*.mov") returned 5
	[0042.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.m2v") returned 0
	[0042.115] lstrlenA (lpString="*.m2v") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.3gp") returned 0
	[0042.116] lstrlenA (lpString="*.3gp") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mpeg") returned 0
	[0042.116] lstrlenA (lpString="*.mpeg") returned 6
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mpg") returned 0
	[0042.116] lstrlenA (lpString="*.mpg") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.flv") returned 0
	[0042.116] lstrlenA (lpString="*.flv") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.avi") returned 0
	[0042.116] lstrlenA (lpString="*.avi") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mp4") returned 0
	[0042.116] lstrlenA (lpString="*.mp4") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.wmv") returned 0
	[0042.116] lstrlenA (lpString="*.wmv") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.divx") returned 0
	[0042.116] lstrlenA (lpString="*.divx") returned 6
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mkv") returned 0
	[0042.116] lstrlenA (lpString="*.mkv") returned 5
	[0042.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mp3") returned 0
	[0042.117] lstrlenA (lpString="*.mp3") returned 5
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.wav") returned 0
	[0042.117] lstrlenA (lpString="*.wav") returned 5
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.flac") returned 0
	[0042.117] lstrlenA (lpString="*.flac") returned 6
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.ape") returned 0
	[0042.117] lstrlenA (lpString="*.ape") returned 5
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.wma") returned 0
	[0042.117] lstrlenA (lpString="*.wma") returned 5
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.ac3") returned 0
	[0042.117] lstrlenA (lpString="*.ac3") returned 5
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.exe") returned 0
	[0042.117] lstrlenA (lpString="*.exe") returned 5
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.apk") returned 0
	[0042.117] lstrlenA (lpString="*.apk") returned 5
	[0042.117] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.117] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.117] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RIPPLE.INF") returned -1
	[0042.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RIPPLE.INF") returned -1
	[0042.117] lstrcmpiA (lpString1="", lpString2="RIPPLE.INF") returned -1
	[0042.117] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned="RIPPLE.ELM"
	[0042.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\"
	[0042.117] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned=""
	[0042.117] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt"
	[0042.117] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0x20
	[0042.117] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="RIPPLE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF"
	[0042.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.zip") returned 0
	[0042.117] lstrlenA (lpString="*.zip") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.rar") returned 0
	[0042.118] lstrlenA (lpString="*.rar") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.7z") returned 0
	[0042.118] lstrlenA (lpString="*.7z") returned 4
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.tar") returned 0
	[0042.118] lstrlenA (lpString="*.tar") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.gzip") returned 0
	[0042.118] lstrlenA (lpString="*.gzip") returned 6
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.jpg") returned 0
	[0042.118] lstrlenA (lpString="*.jpg") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.jpeg") returned 0
	[0042.118] lstrlenA (lpString="*.jpeg") returned 6
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.psd") returned 0
	[0042.118] lstrlenA (lpString="*.psd") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.cdr") returned 0
	[0042.118] lstrlenA (lpString="*.cdr") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.dwg") returned 0
	[0042.118] lstrlenA (lpString="*.dwg") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.max") returned 0
	[0042.118] lstrlenA (lpString="*.max") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.bmp") returned 0
	[0042.118] lstrlenA (lpString="*.bmp") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.gif") returned 0
	[0042.118] lstrlenA (lpString="*.gif") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.png") returned 0
	[0042.118] lstrlenA (lpString="*.png") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.doc") returned 0
	[0042.118] lstrlenA (lpString="*.doc") returned 5
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.docx") returned 0
	[0042.118] lstrlenA (lpString="*.docx") returned 6
	[0042.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.xls") returned 0
	[0042.119] lstrlenA (lpString="*.xls") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.xlsx") returned 0
	[0042.119] lstrlenA (lpString="*.xlsx") returned 6
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.ppt") returned 0
	[0042.119] lstrlenA (lpString="*.ppt") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.pptx") returned 0
	[0042.119] lstrlenA (lpString="*.pptx") returned 6
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.txt") returned 0
	[0042.119] lstrlenA (lpString="*.txt") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.pdf") returned 0
	[0042.119] lstrlenA (lpString="*.pdf") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.djvu") returned 0
	[0042.119] lstrlenA (lpString="*.djvu") returned 6
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.htm") returned 0
	[0042.119] lstrlenA (lpString="*.htm") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.html") returned 0
	[0042.119] lstrlenA (lpString="*.html") returned 6
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mdb") returned 0
	[0042.119] lstrlenA (lpString="*.mdb") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.cer") returned 0
	[0042.119] lstrlenA (lpString="*.cer") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.p12") returned 0
	[0042.119] lstrlenA (lpString="*.p12") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.pfx") returned 0
	[0042.119] lstrlenA (lpString="*.pfx") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.kwm") returned 0
	[0042.119] lstrlenA (lpString="*.kwm") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.pwm") returned 0
	[0042.119] lstrlenA (lpString="*.pwm") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.1cd") returned 0
	[0042.119] lstrlenA (lpString="*.1cd") returned 5
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.md") returned 0
	[0042.119] lstrlenA (lpString="*.md") returned 4
	[0042.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mdf") returned 0
	[0042.120] lstrlenA (lpString="*.mdf") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.dbf") returned 0
	[0042.120] lstrlenA (lpString="*.dbf") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.odt") returned 0
	[0042.120] lstrlenA (lpString="*.odt") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.vob") returned 0
	[0042.120] lstrlenA (lpString="*.vob") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.ifo") returned 0
	[0042.120] lstrlenA (lpString="*.ifo") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.lnk") returned 0
	[0042.120] lstrlenA (lpString="*.lnk") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.torrent") returned 0
	[0042.120] lstrlenA (lpString="*.torrent") returned 9
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mov") returned 0
	[0042.120] lstrlenA (lpString="*.mov") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.m2v") returned 0
	[0042.120] lstrlenA (lpString="*.m2v") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.3gp") returned 0
	[0042.120] lstrlenA (lpString="*.3gp") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mpeg") returned 0
	[0042.120] lstrlenA (lpString="*.mpeg") returned 6
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mpg") returned 0
	[0042.120] lstrlenA (lpString="*.mpg") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.flv") returned 0
	[0042.120] lstrlenA (lpString="*.flv") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.avi") returned 0
	[0042.120] lstrlenA (lpString="*.avi") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mp4") returned 0
	[0042.120] lstrlenA (lpString="*.mp4") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.wmv") returned 0
	[0042.120] lstrlenA (lpString="*.wmv") returned 5
	[0042.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.divx") returned 0
	[0042.120] lstrlenA (lpString="*.divx") returned 6
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mkv") returned 0
	[0042.121] lstrlenA (lpString="*.mkv") returned 5
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mp3") returned 0
	[0042.121] lstrlenA (lpString="*.mp3") returned 5
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.wav") returned 0
	[0042.121] lstrlenA (lpString="*.wav") returned 5
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.flac") returned 0
	[0042.121] lstrlenA (lpString="*.flac") returned 6
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.ape") returned 0
	[0042.121] lstrlenA (lpString="*.ape") returned 5
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.wma") returned 0
	[0042.121] lstrlenA (lpString="*.wma") returned 5
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.ac3") returned 0
	[0042.121] lstrlenA (lpString="*.ac3") returned 5
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.exe") returned 0
	[0042.121] lstrlenA (lpString="*.exe") returned 5
	[0042.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.apk") returned 0
	[0042.121] lstrlenA (lpString="*.apk") returned 5
	[0042.121] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.121] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.121] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0042.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0042.121] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0042.121] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned="RIPPLE.INF"
	[0042.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\"
	[0042.121] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned=""
	[0042.121] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt"
	[0042.121] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0x20
	[0042.122] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG"
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0042.122] lstrlenA (lpString="*.zip") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0042.122] lstrlenA (lpString="*.rar") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0042.122] lstrlenA (lpString="*.7z") returned 4
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0042.122] lstrlenA (lpString="*.tar") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0042.122] lstrlenA (lpString="*.gzip") returned 6
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0042.122] lstrlenA (lpString="*.jpg") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0042.122] lstrlenA (lpString="*.jpeg") returned 6
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0042.122] lstrlenA (lpString="*.psd") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0042.122] lstrlenA (lpString="*.cdr") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0042.122] lstrlenA (lpString="*.dwg") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0042.122] lstrlenA (lpString="*.max") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0042.122] lstrlenA (lpString="*.bmp") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0042.122] lstrlenA (lpString="*.gif") returned 5
	[0042.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0042.122] lstrlenA (lpString="*.png") returned 5
	[0042.122] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG"
	[0042.122] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG"
	[0042.123] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG."
	[0042.123] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.Boom"
	[0042.123] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.124] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ce7
	[0042.124] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d489150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.124] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.124] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7cc4, lpOverlapped=0x0) returned 1
	[0042.172] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0042.172] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.172] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7cc4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7cc4, lpOverlapped=0x0) returned 1
	[0042.173] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.173] CloseHandle (hObject=0x90) returned 1
	[0042.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.boom")) returned 1
	[0042.175] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0042.175] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0042.175] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0042.175] lstrcmpA (lpString1=".", lpString2="RMNSQUE") returned -1
	[0042.175] lstrcmpA (lpString1="..", lpString2="RMNSQUE") returned -1
	[0042.175] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0042.175] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RMNSQUE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE"
	[0042.175] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE") returned 63
	[0042.175] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0042.175] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0042.175] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.175] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0042.175] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0042.175] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.175] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.175] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0042.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0042.175] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0042.175] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*") returned="*.*"
	[0042.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\"
	[0042.176] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned=""
	[0042.176] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt"
	[0042.176] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0xffffffff
	[0042.176] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.176] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0042.176] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0042.177] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0042.177] CloseHandle (hObject=0x90) returned 1
	[0042.177] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF"
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0042.177] lstrlenA (lpString="*.zip") returned 5
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0042.177] lstrlenA (lpString="*.rar") returned 5
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0042.177] lstrlenA (lpString="*.7z") returned 4
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0042.177] lstrlenA (lpString="*.tar") returned 5
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0042.177] lstrlenA (lpString="*.gzip") returned 6
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0042.177] lstrlenA (lpString="*.jpg") returned 5
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0042.177] lstrlenA (lpString="*.jpeg") returned 6
	[0042.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0042.178] lstrlenA (lpString="*.psd") returned 5
	[0042.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0042.178] lstrlenA (lpString="*.cdr") returned 5
	[0042.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0042.178] lstrlenA (lpString="*.dwg") returned 5
	[0042.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0042.178] lstrlenA (lpString="*.max") returned 5
	[0042.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0042.178] lstrlenA (lpString="*.bmp") returned 5
	[0042.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0042.178] lstrlenA (lpString="*.gif") returned 5
	[0042.178] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF"
	[0042.178] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF"
	[0042.178] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF."
	[0042.178] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.Boom"
	[0042.178] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.179] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1004
	[0042.179] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.179] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.179] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xfe1, lpOverlapped=0x0) returned 1
	[0042.257] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.257] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.257] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xfe1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xfe1, lpOverlapped=0x0) returned 1
	[0042.257] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.257] CloseHandle (hObject=0x90) returned 1
	[0042.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.boom")) returned 1
	[0042.260] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.260] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RMNSQUE.ELM") returned -1
	[0042.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RMNSQUE.ELM") returned -1
	[0042.260] lstrcmpiA (lpString1="", lpString2="RMNSQUE.ELM") returned -1
	[0042.260] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\"
	[0042.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned=""
	[0042.260] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt"
	[0042.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0x20
	[0042.260] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="RMNSQUE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM"
	[0042.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.zip") returned 0
	[0042.260] lstrlenA (lpString="*.zip") returned 5
	[0042.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.rar") returned 0
	[0042.260] lstrlenA (lpString="*.rar") returned 5
	[0042.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.7z") returned 0
	[0042.260] lstrlenA (lpString="*.7z") returned 4
	[0042.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.tar") returned 0
	[0042.260] lstrlenA (lpString="*.tar") returned 5
	[0042.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.gzip") returned 0
	[0042.260] lstrlenA (lpString="*.gzip") returned 6
	[0042.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.jpg") returned 0
	[0042.261] lstrlenA (lpString="*.jpg") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.jpeg") returned 0
	[0042.261] lstrlenA (lpString="*.jpeg") returned 6
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.psd") returned 0
	[0042.261] lstrlenA (lpString="*.psd") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.cdr") returned 0
	[0042.261] lstrlenA (lpString="*.cdr") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.dwg") returned 0
	[0042.261] lstrlenA (lpString="*.dwg") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.max") returned 0
	[0042.261] lstrlenA (lpString="*.max") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.bmp") returned 0
	[0042.261] lstrlenA (lpString="*.bmp") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.gif") returned 0
	[0042.261] lstrlenA (lpString="*.gif") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.png") returned 0
	[0042.261] lstrlenA (lpString="*.png") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.doc") returned 0
	[0042.261] lstrlenA (lpString="*.doc") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.docx") returned 0
	[0042.261] lstrlenA (lpString="*.docx") returned 6
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.xls") returned 0
	[0042.261] lstrlenA (lpString="*.xls") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.xlsx") returned 0
	[0042.261] lstrlenA (lpString="*.xlsx") returned 6
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.ppt") returned 0
	[0042.261] lstrlenA (lpString="*.ppt") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.pptx") returned 0
	[0042.261] lstrlenA (lpString="*.pptx") returned 6
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.txt") returned 0
	[0042.261] lstrlenA (lpString="*.txt") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.pdf") returned 0
	[0042.261] lstrlenA (lpString="*.pdf") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.djvu") returned 0
	[0042.261] lstrlenA (lpString="*.djvu") returned 6
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.htm") returned 0
	[0042.261] lstrlenA (lpString="*.htm") returned 5
	[0042.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.html") returned 0
	[0042.261] lstrlenA (lpString="*.html") returned 6
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mdb") returned 0
	[0042.262] lstrlenA (lpString="*.mdb") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.cer") returned 0
	[0042.262] lstrlenA (lpString="*.cer") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.p12") returned 0
	[0042.262] lstrlenA (lpString="*.p12") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.pfx") returned 0
	[0042.262] lstrlenA (lpString="*.pfx") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.kwm") returned 0
	[0042.262] lstrlenA (lpString="*.kwm") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.pwm") returned 0
	[0042.262] lstrlenA (lpString="*.pwm") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.1cd") returned 0
	[0042.262] lstrlenA (lpString="*.1cd") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.md") returned 0
	[0042.262] lstrlenA (lpString="*.md") returned 4
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mdf") returned 0
	[0042.262] lstrlenA (lpString="*.mdf") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.dbf") returned 0
	[0042.262] lstrlenA (lpString="*.dbf") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.odt") returned 0
	[0042.262] lstrlenA (lpString="*.odt") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.vob") returned 0
	[0042.262] lstrlenA (lpString="*.vob") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.ifo") returned 0
	[0042.262] lstrlenA (lpString="*.ifo") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.lnk") returned 0
	[0042.262] lstrlenA (lpString="*.lnk") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.torrent") returned 0
	[0042.262] lstrlenA (lpString="*.torrent") returned 9
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mov") returned 0
	[0042.262] lstrlenA (lpString="*.mov") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.m2v") returned 0
	[0042.262] lstrlenA (lpString="*.m2v") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.3gp") returned 0
	[0042.262] lstrlenA (lpString="*.3gp") returned 5
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mpeg") returned 0
	[0042.262] lstrlenA (lpString="*.mpeg") returned 6
	[0042.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mpg") returned 0
	[0042.263] lstrlenA (lpString="*.mpg") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.flv") returned 0
	[0042.263] lstrlenA (lpString="*.flv") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.avi") returned 0
	[0042.263] lstrlenA (lpString="*.avi") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mp4") returned 0
	[0042.263] lstrlenA (lpString="*.mp4") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.wmv") returned 0
	[0042.263] lstrlenA (lpString="*.wmv") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.divx") returned 0
	[0042.263] lstrlenA (lpString="*.divx") returned 6
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mkv") returned 0
	[0042.263] lstrlenA (lpString="*.mkv") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mp3") returned 0
	[0042.263] lstrlenA (lpString="*.mp3") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.wav") returned 0
	[0042.263] lstrlenA (lpString="*.wav") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.flac") returned 0
	[0042.263] lstrlenA (lpString="*.flac") returned 6
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.ape") returned 0
	[0042.263] lstrlenA (lpString="*.ape") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.wma") returned 0
	[0042.263] lstrlenA (lpString="*.wma") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.ac3") returned 0
	[0042.263] lstrlenA (lpString="*.ac3") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.exe") returned 0
	[0042.263] lstrlenA (lpString="*.exe") returned 5
	[0042.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.apk") returned 0
	[0042.263] lstrlenA (lpString="*.apk") returned 5
	[0042.263] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.263] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RMNSQUE.INF") returned -1
	[0042.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RMNSQUE.INF") returned -1
	[0042.263] lstrcmpiA (lpString1="", lpString2="RMNSQUE.INF") returned -1
	[0042.264] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned="RMNSQUE.ELM"
	[0042.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\"
	[0042.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned=""
	[0042.264] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt"
	[0042.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0x20
	[0042.264] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="RMNSQUE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF"
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.zip") returned 0
	[0042.264] lstrlenA (lpString="*.zip") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.rar") returned 0
	[0042.264] lstrlenA (lpString="*.rar") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.7z") returned 0
	[0042.264] lstrlenA (lpString="*.7z") returned 4
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.tar") returned 0
	[0042.264] lstrlenA (lpString="*.tar") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.gzip") returned 0
	[0042.264] lstrlenA (lpString="*.gzip") returned 6
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.jpg") returned 0
	[0042.264] lstrlenA (lpString="*.jpg") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.jpeg") returned 0
	[0042.264] lstrlenA (lpString="*.jpeg") returned 6
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.psd") returned 0
	[0042.264] lstrlenA (lpString="*.psd") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.cdr") returned 0
	[0042.264] lstrlenA (lpString="*.cdr") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.dwg") returned 0
	[0042.264] lstrlenA (lpString="*.dwg") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.max") returned 0
	[0042.264] lstrlenA (lpString="*.max") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.bmp") returned 0
	[0042.264] lstrlenA (lpString="*.bmp") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.gif") returned 0
	[0042.264] lstrlenA (lpString="*.gif") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.png") returned 0
	[0042.264] lstrlenA (lpString="*.png") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.doc") returned 0
	[0042.264] lstrlenA (lpString="*.doc") returned 5
	[0042.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.docx") returned 0
	[0042.264] lstrlenA (lpString="*.docx") returned 6
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.xls") returned 0
	[0042.265] lstrlenA (lpString="*.xls") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.xlsx") returned 0
	[0042.265] lstrlenA (lpString="*.xlsx") returned 6
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.ppt") returned 0
	[0042.265] lstrlenA (lpString="*.ppt") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.pptx") returned 0
	[0042.265] lstrlenA (lpString="*.pptx") returned 6
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.txt") returned 0
	[0042.265] lstrlenA (lpString="*.txt") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.pdf") returned 0
	[0042.265] lstrlenA (lpString="*.pdf") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.djvu") returned 0
	[0042.265] lstrlenA (lpString="*.djvu") returned 6
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.htm") returned 0
	[0042.265] lstrlenA (lpString="*.htm") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.html") returned 0
	[0042.265] lstrlenA (lpString="*.html") returned 6
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mdb") returned 0
	[0042.265] lstrlenA (lpString="*.mdb") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.cer") returned 0
	[0042.265] lstrlenA (lpString="*.cer") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.p12") returned 0
	[0042.265] lstrlenA (lpString="*.p12") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.pfx") returned 0
	[0042.265] lstrlenA (lpString="*.pfx") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.kwm") returned 0
	[0042.265] lstrlenA (lpString="*.kwm") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.pwm") returned 0
	[0042.265] lstrlenA (lpString="*.pwm") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.1cd") returned 0
	[0042.265] lstrlenA (lpString="*.1cd") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.md") returned 0
	[0042.265] lstrlenA (lpString="*.md") returned 4
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mdf") returned 0
	[0042.265] lstrlenA (lpString="*.mdf") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.dbf") returned 0
	[0042.265] lstrlenA (lpString="*.dbf") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.odt") returned 0
	[0042.265] lstrlenA (lpString="*.odt") returned 5
	[0042.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.vob") returned 0
	[0042.266] lstrlenA (lpString="*.vob") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.ifo") returned 0
	[0042.266] lstrlenA (lpString="*.ifo") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.lnk") returned 0
	[0042.266] lstrlenA (lpString="*.lnk") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.torrent") returned 0
	[0042.266] lstrlenA (lpString="*.torrent") returned 9
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mov") returned 0
	[0042.266] lstrlenA (lpString="*.mov") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.m2v") returned 0
	[0042.266] lstrlenA (lpString="*.m2v") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.3gp") returned 0
	[0042.266] lstrlenA (lpString="*.3gp") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mpeg") returned 0
	[0042.266] lstrlenA (lpString="*.mpeg") returned 6
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mpg") returned 0
	[0042.266] lstrlenA (lpString="*.mpg") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.flv") returned 0
	[0042.266] lstrlenA (lpString="*.flv") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.avi") returned 0
	[0042.266] lstrlenA (lpString="*.avi") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mp4") returned 0
	[0042.266] lstrlenA (lpString="*.mp4") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.wmv") returned 0
	[0042.266] lstrlenA (lpString="*.wmv") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.divx") returned 0
	[0042.266] lstrlenA (lpString="*.divx") returned 6
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mkv") returned 0
	[0042.266] lstrlenA (lpString="*.mkv") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mp3") returned 0
	[0042.266] lstrlenA (lpString="*.mp3") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.wav") returned 0
	[0042.266] lstrlenA (lpString="*.wav") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.flac") returned 0
	[0042.266] lstrlenA (lpString="*.flac") returned 6
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.ape") returned 0
	[0042.266] lstrlenA (lpString="*.ape") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.wma") returned 0
	[0042.266] lstrlenA (lpString="*.wma") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.ac3") returned 0
	[0042.266] lstrlenA (lpString="*.ac3") returned 5
	[0042.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.exe") returned 0
	[0042.267] lstrlenA (lpString="*.exe") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.apk") returned 0
	[0042.267] lstrlenA (lpString="*.apk") returned 5
	[0042.267] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.267] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.267] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0042.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0042.267] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0042.267] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned="RMNSQUE.INF"
	[0042.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\"
	[0042.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned=""
	[0042.267] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt"
	[0042.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0x20
	[0042.267] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG"
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0042.267] lstrlenA (lpString="*.zip") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0042.267] lstrlenA (lpString="*.rar") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0042.267] lstrlenA (lpString="*.7z") returned 4
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0042.267] lstrlenA (lpString="*.tar") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0042.267] lstrlenA (lpString="*.gzip") returned 6
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0042.267] lstrlenA (lpString="*.jpg") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0042.267] lstrlenA (lpString="*.jpeg") returned 6
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0042.267] lstrlenA (lpString="*.psd") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0042.267] lstrlenA (lpString="*.cdr") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0042.267] lstrlenA (lpString="*.dwg") returned 5
	[0042.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0042.267] lstrlenA (lpString="*.max") returned 5
	[0042.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0042.268] lstrlenA (lpString="*.bmp") returned 5
	[0042.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0042.268] lstrlenA (lpString="*.gif") returned 5
	[0042.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0042.268] lstrlenA (lpString="*.png") returned 5
	[0042.268] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG"
	[0042.268] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG"
	[0042.268] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG."
	[0042.268] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.Boom"
	[0042.268] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.268] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb5a
	[0042.268] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d4d5410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.268] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.268] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb37, lpOverlapped=0x0) returned 1
	[0042.362] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0042.363] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.363] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb37, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb37, lpOverlapped=0x0) returned 1
	[0042.363] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.363] CloseHandle (hObject=0x90) returned 1
	[0042.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.boom")) returned 1
	[0042.365] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0042.365] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0042.365] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0042.365] lstrcmpA (lpString1=".", lpString2="SATIN") returned -1
	[0042.365] lstrcmpA (lpString1="..", lpString2="SATIN") returned -1
	[0042.365] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0042.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SATIN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN"
	[0042.365] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN") returned 61
	[0042.365] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0042.366] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0042.366] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.366] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0042.366] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0042.366] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.366] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0042.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0042.366] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0042.366] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*") returned="*.*"
	[0042.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\"
	[0042.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned=""
	[0042.366] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt"
	[0042.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0xffffffff
	[0042.366] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.367] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0042.367] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0042.368] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0042.368] CloseHandle (hObject=0x90) returned 1
	[0042.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF"
	[0042.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0042.368] lstrlenA (lpString="*.zip") returned 5
	[0042.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0042.368] lstrlenA (lpString="*.rar") returned 5
	[0042.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0042.368] lstrlenA (lpString="*.7z") returned 4
	[0042.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0042.368] lstrlenA (lpString="*.tar") returned 5
	[0042.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0042.369] lstrlenA (lpString="*.gzip") returned 6
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0042.369] lstrlenA (lpString="*.jpg") returned 5
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0042.369] lstrlenA (lpString="*.jpeg") returned 6
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0042.369] lstrlenA (lpString="*.psd") returned 5
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0042.369] lstrlenA (lpString="*.cdr") returned 5
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0042.369] lstrlenA (lpString="*.dwg") returned 5
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0042.369] lstrlenA (lpString="*.max") returned 5
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0042.369] lstrlenA (lpString="*.bmp") returned 5
	[0042.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0042.369] lstrlenA (lpString="*.gif") returned 5
	[0042.369] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF"
	[0042.369] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF"
	[0042.369] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF."
	[0042.369] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.Boom"
	[0042.369] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.370] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1b
	[0042.370] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.370] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.370] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xdf8, lpOverlapped=0x0) returned 1
	[0042.458] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.458] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.458] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xdf8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xdf8, lpOverlapped=0x0) returned 1
	[0042.458] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.458] CloseHandle (hObject=0x90) returned 1
	[0042.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.boom")) returned 1
	[0042.461] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.461] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SATIN.ELM") returned -1
	[0042.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SATIN.ELM") returned -1
	[0042.461] lstrcmpiA (lpString1="", lpString2="SATIN.ELM") returned -1
	[0042.461] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\"
	[0042.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned=""
	[0042.462] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt"
	[0042.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0x20
	[0042.462] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="SATIN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM"
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.zip") returned 0
	[0042.462] lstrlenA (lpString="*.zip") returned 5
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.rar") returned 0
	[0042.462] lstrlenA (lpString="*.rar") returned 5
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.7z") returned 0
	[0042.462] lstrlenA (lpString="*.7z") returned 4
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.tar") returned 0
	[0042.462] lstrlenA (lpString="*.tar") returned 5
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.gzip") returned 0
	[0042.462] lstrlenA (lpString="*.gzip") returned 6
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.jpg") returned 0
	[0042.462] lstrlenA (lpString="*.jpg") returned 5
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.jpeg") returned 0
	[0042.462] lstrlenA (lpString="*.jpeg") returned 6
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.psd") returned 0
	[0042.462] lstrlenA (lpString="*.psd") returned 5
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.cdr") returned 0
	[0042.462] lstrlenA (lpString="*.cdr") returned 5
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.dwg") returned 0
	[0042.462] lstrlenA (lpString="*.dwg") returned 5
	[0042.462] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.max") returned 0
	[0042.462] lstrlenA (lpString="*.max") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.bmp") returned 0
	[0042.463] lstrlenA (lpString="*.bmp") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.gif") returned 0
	[0042.463] lstrlenA (lpString="*.gif") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.png") returned 0
	[0042.463] lstrlenA (lpString="*.png") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.doc") returned 0
	[0042.463] lstrlenA (lpString="*.doc") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.docx") returned 0
	[0042.463] lstrlenA (lpString="*.docx") returned 6
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.xls") returned 0
	[0042.463] lstrlenA (lpString="*.xls") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.xlsx") returned 0
	[0042.463] lstrlenA (lpString="*.xlsx") returned 6
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.ppt") returned 0
	[0042.463] lstrlenA (lpString="*.ppt") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.pptx") returned 0
	[0042.463] lstrlenA (lpString="*.pptx") returned 6
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.txt") returned 0
	[0042.463] lstrlenA (lpString="*.txt") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.pdf") returned 0
	[0042.463] lstrlenA (lpString="*.pdf") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.djvu") returned 0
	[0042.463] lstrlenA (lpString="*.djvu") returned 6
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.htm") returned 0
	[0042.463] lstrlenA (lpString="*.htm") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.html") returned 0
	[0042.463] lstrlenA (lpString="*.html") returned 6
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mdb") returned 0
	[0042.463] lstrlenA (lpString="*.mdb") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.cer") returned 0
	[0042.463] lstrlenA (lpString="*.cer") returned 5
	[0042.463] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.p12") returned 0
	[0042.463] lstrlenA (lpString="*.p12") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.pfx") returned 0
	[0042.464] lstrlenA (lpString="*.pfx") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.kwm") returned 0
	[0042.464] lstrlenA (lpString="*.kwm") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.pwm") returned 0
	[0042.464] lstrlenA (lpString="*.pwm") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.1cd") returned 0
	[0042.464] lstrlenA (lpString="*.1cd") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.md") returned 0
	[0042.464] lstrlenA (lpString="*.md") returned 4
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mdf") returned 0
	[0042.464] lstrlenA (lpString="*.mdf") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.dbf") returned 0
	[0042.464] lstrlenA (lpString="*.dbf") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.odt") returned 0
	[0042.464] lstrlenA (lpString="*.odt") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.vob") returned 0
	[0042.464] lstrlenA (lpString="*.vob") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.ifo") returned 0
	[0042.464] lstrlenA (lpString="*.ifo") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.lnk") returned 0
	[0042.464] lstrlenA (lpString="*.lnk") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.torrent") returned 0
	[0042.464] lstrlenA (lpString="*.torrent") returned 9
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mov") returned 0
	[0042.464] lstrlenA (lpString="*.mov") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.m2v") returned 0
	[0042.464] lstrlenA (lpString="*.m2v") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.3gp") returned 0
	[0042.464] lstrlenA (lpString="*.3gp") returned 5
	[0042.464] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mpeg") returned 0
	[0042.464] lstrlenA (lpString="*.mpeg") returned 6
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mpg") returned 0
	[0042.465] lstrlenA (lpString="*.mpg") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.flv") returned 0
	[0042.465] lstrlenA (lpString="*.flv") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.avi") returned 0
	[0042.465] lstrlenA (lpString="*.avi") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mp4") returned 0
	[0042.465] lstrlenA (lpString="*.mp4") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.wmv") returned 0
	[0042.465] lstrlenA (lpString="*.wmv") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.divx") returned 0
	[0042.465] lstrlenA (lpString="*.divx") returned 6
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mkv") returned 0
	[0042.465] lstrlenA (lpString="*.mkv") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mp3") returned 0
	[0042.465] lstrlenA (lpString="*.mp3") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.wav") returned 0
	[0042.465] lstrlenA (lpString="*.wav") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.flac") returned 0
	[0042.465] lstrlenA (lpString="*.flac") returned 6
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.ape") returned 0
	[0042.465] lstrlenA (lpString="*.ape") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.wma") returned 0
	[0042.465] lstrlenA (lpString="*.wma") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.ac3") returned 0
	[0042.465] lstrlenA (lpString="*.ac3") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.exe") returned 0
	[0042.465] lstrlenA (lpString="*.exe") returned 5
	[0042.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.apk") returned 0
	[0042.465] lstrlenA (lpString="*.apk") returned 5
	[0042.465] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.465] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.465] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SATIN.INF") returned -1
	[0042.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SATIN.INF") returned -1
	[0042.466] lstrcmpiA (lpString1="", lpString2="SATIN.INF") returned -1
	[0042.466] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned="SATIN.ELM"
	[0042.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\"
	[0042.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned=""
	[0042.466] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt"
	[0042.466] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0x20
	[0042.466] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="SATIN.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF"
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.zip") returned 0
	[0042.466] lstrlenA (lpString="*.zip") returned 5
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.rar") returned 0
	[0042.466] lstrlenA (lpString="*.rar") returned 5
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.7z") returned 0
	[0042.466] lstrlenA (lpString="*.7z") returned 4
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.tar") returned 0
	[0042.466] lstrlenA (lpString="*.tar") returned 5
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.gzip") returned 0
	[0042.466] lstrlenA (lpString="*.gzip") returned 6
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.jpg") returned 0
	[0042.466] lstrlenA (lpString="*.jpg") returned 5
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.jpeg") returned 0
	[0042.466] lstrlenA (lpString="*.jpeg") returned 6
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.psd") returned 0
	[0042.466] lstrlenA (lpString="*.psd") returned 5
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.cdr") returned 0
	[0042.466] lstrlenA (lpString="*.cdr") returned 5
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.dwg") returned 0
	[0042.466] lstrlenA (lpString="*.dwg") returned 5
	[0042.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.max") returned 0
	[0042.467] lstrlenA (lpString="*.max") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.bmp") returned 0
	[0042.467] lstrlenA (lpString="*.bmp") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.gif") returned 0
	[0042.467] lstrlenA (lpString="*.gif") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.png") returned 0
	[0042.467] lstrlenA (lpString="*.png") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.doc") returned 0
	[0042.467] lstrlenA (lpString="*.doc") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.docx") returned 0
	[0042.467] lstrlenA (lpString="*.docx") returned 6
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.xls") returned 0
	[0042.467] lstrlenA (lpString="*.xls") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.xlsx") returned 0
	[0042.467] lstrlenA (lpString="*.xlsx") returned 6
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.ppt") returned 0
	[0042.467] lstrlenA (lpString="*.ppt") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.pptx") returned 0
	[0042.467] lstrlenA (lpString="*.pptx") returned 6
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.txt") returned 0
	[0042.467] lstrlenA (lpString="*.txt") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.pdf") returned 0
	[0042.467] lstrlenA (lpString="*.pdf") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.djvu") returned 0
	[0042.467] lstrlenA (lpString="*.djvu") returned 6
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.htm") returned 0
	[0042.467] lstrlenA (lpString="*.htm") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.html") returned 0
	[0042.467] lstrlenA (lpString="*.html") returned 6
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mdb") returned 0
	[0042.467] lstrlenA (lpString="*.mdb") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.cer") returned 0
	[0042.467] lstrlenA (lpString="*.cer") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.p12") returned 0
	[0042.467] lstrlenA (lpString="*.p12") returned 5
	[0042.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.pfx") returned 0
	[0042.468] lstrlenA (lpString="*.pfx") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.kwm") returned 0
	[0042.468] lstrlenA (lpString="*.kwm") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.pwm") returned 0
	[0042.468] lstrlenA (lpString="*.pwm") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.1cd") returned 0
	[0042.468] lstrlenA (lpString="*.1cd") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.md") returned 0
	[0042.468] lstrlenA (lpString="*.md") returned 4
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mdf") returned 0
	[0042.468] lstrlenA (lpString="*.mdf") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.dbf") returned 0
	[0042.468] lstrlenA (lpString="*.dbf") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.odt") returned 0
	[0042.468] lstrlenA (lpString="*.odt") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.vob") returned 0
	[0042.468] lstrlenA (lpString="*.vob") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.ifo") returned 0
	[0042.468] lstrlenA (lpString="*.ifo") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.lnk") returned 0
	[0042.468] lstrlenA (lpString="*.lnk") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.torrent") returned 0
	[0042.468] lstrlenA (lpString="*.torrent") returned 9
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mov") returned 0
	[0042.468] lstrlenA (lpString="*.mov") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.m2v") returned 0
	[0042.468] lstrlenA (lpString="*.m2v") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.3gp") returned 0
	[0042.468] lstrlenA (lpString="*.3gp") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mpeg") returned 0
	[0042.468] lstrlenA (lpString="*.mpeg") returned 6
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mpg") returned 0
	[0042.468] lstrlenA (lpString="*.mpg") returned 5
	[0042.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.flv") returned 0
	[0042.468] lstrlenA (lpString="*.flv") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.avi") returned 0
	[0042.469] lstrlenA (lpString="*.avi") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mp4") returned 0
	[0042.469] lstrlenA (lpString="*.mp4") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.wmv") returned 0
	[0042.469] lstrlenA (lpString="*.wmv") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.divx") returned 0
	[0042.469] lstrlenA (lpString="*.divx") returned 6
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mkv") returned 0
	[0042.469] lstrlenA (lpString="*.mkv") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mp3") returned 0
	[0042.469] lstrlenA (lpString="*.mp3") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.wav") returned 0
	[0042.469] lstrlenA (lpString="*.wav") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.flac") returned 0
	[0042.469] lstrlenA (lpString="*.flac") returned 6
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.ape") returned 0
	[0042.469] lstrlenA (lpString="*.ape") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.wma") returned 0
	[0042.469] lstrlenA (lpString="*.wma") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.ac3") returned 0
	[0042.469] lstrlenA (lpString="*.ac3") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.exe") returned 0
	[0042.469] lstrlenA (lpString="*.exe") returned 5
	[0042.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.apk") returned 0
	[0042.469] lstrlenA (lpString="*.apk") returned 5
	[0042.469] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.469] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.469] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0042.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0042.469] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0042.469] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned="SATIN.INF"
	[0042.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\"
	[0042.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned=""
	[0042.470] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt"
	[0042.470] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0x20
	[0042.470] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG"
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0042.470] lstrlenA (lpString="*.zip") returned 5
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0042.470] lstrlenA (lpString="*.rar") returned 5
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0042.470] lstrlenA (lpString="*.7z") returned 4
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0042.470] lstrlenA (lpString="*.tar") returned 5
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0042.470] lstrlenA (lpString="*.gzip") returned 6
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0042.470] lstrlenA (lpString="*.jpg") returned 5
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0042.470] lstrlenA (lpString="*.jpeg") returned 6
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0042.470] lstrlenA (lpString="*.psd") returned 5
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0042.470] lstrlenA (lpString="*.cdr") returned 5
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0042.470] lstrlenA (lpString="*.dwg") returned 5
	[0042.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0042.470] lstrlenA (lpString="*.max") returned 5
	[0042.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0042.471] lstrlenA (lpString="*.bmp") returned 5
	[0042.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0042.471] lstrlenA (lpString="*.gif") returned 5
	[0042.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0042.471] lstrlenA (lpString="*.png") returned 5
	[0042.471] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG"
	[0042.471] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG"
	[0042.471] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG."
	[0042.471] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.Boom"
	[0042.471] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.471] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8573
	[0042.471] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.471] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.471] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x8550, lpOverlapped=0x0) returned 1
	[0042.545] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0042.545] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.545] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x8550, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x8550, lpOverlapped=0x0) returned 1
	[0042.545] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.546] CloseHandle (hObject=0x90) returned 1
	[0042.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.boom")) returned 1
	[0042.547] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0042.547] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0042.548] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0042.548] lstrcmpA (lpString1=".", lpString2="SKY") returned -1
	[0042.548] lstrcmpA (lpString1="..", lpString2="SKY") returned -1
	[0042.548] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0042.548] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SKY" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY"
	[0042.548] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY") returned 59
	[0042.548] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0042.627] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0042.627] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.628] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0042.628] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0042.628] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.628] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.628] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0042.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0042.628] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0042.628] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*") returned="*.*"
	[0042.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\"
	[0042.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned=""
	[0042.628] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt"
	[0042.628] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0xffffffff
	[0042.628] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.629] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0042.629] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0042.630] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0042.630] CloseHandle (hObject=0x90) returned 1
	[0042.630] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF"
	[0042.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0042.630] lstrlenA (lpString="*.zip") returned 5
	[0042.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0042.630] lstrlenA (lpString="*.rar") returned 5
	[0042.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0042.630] lstrlenA (lpString="*.7z") returned 4
	[0042.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0042.630] lstrlenA (lpString="*.tar") returned 5
	[0042.630] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0042.631] lstrlenA (lpString="*.gzip") returned 6
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0042.631] lstrlenA (lpString="*.jpg") returned 5
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0042.631] lstrlenA (lpString="*.jpeg") returned 6
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0042.631] lstrlenA (lpString="*.psd") returned 5
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0042.631] lstrlenA (lpString="*.cdr") returned 5
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0042.631] lstrlenA (lpString="*.dwg") returned 5
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0042.631] lstrlenA (lpString="*.max") returned 5
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0042.631] lstrlenA (lpString="*.bmp") returned 5
	[0042.631] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0042.631] lstrlenA (lpString="*.gif") returned 5
	[0042.631] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF"
	[0042.631] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF"
	[0042.631] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF."
	[0042.631] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.Boom"
	[0042.631] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.632] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a9
	[0042.632] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.632] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.632] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x386, lpOverlapped=0x0) returned 1
	[0042.725] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.725] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.725] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x386, lpOverlapped=0x0) returned 1
	[0042.726] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.726] CloseHandle (hObject=0x90) returned 1
	[0042.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.boom")) returned 1
	[0042.739] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.739] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SKY.ELM") returned -1
	[0042.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SKY.ELM") returned -1
	[0042.740] lstrcmpiA (lpString1="", lpString2="SKY.ELM") returned -1
	[0042.740] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0042.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\"
	[0042.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned=""
	[0042.740] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt"
	[0042.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0x20
	[0042.740] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="SKY.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM"
	[0042.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.zip") returned 0
	[0042.740] lstrlenA (lpString="*.zip") returned 5
	[0042.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.rar") returned 0
	[0042.740] lstrlenA (lpString="*.rar") returned 5
	[0042.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.7z") returned 0
	[0042.740] lstrlenA (lpString="*.7z") returned 4
	[0042.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.tar") returned 0
	[0042.740] lstrlenA (lpString="*.tar") returned 5
	[0042.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.gzip") returned 0
	[0042.740] lstrlenA (lpString="*.gzip") returned 6
	[0042.740] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.jpg") returned 0
	[0042.741] lstrlenA (lpString="*.jpg") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.jpeg") returned 0
	[0042.741] lstrlenA (lpString="*.jpeg") returned 6
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.psd") returned 0
	[0042.741] lstrlenA (lpString="*.psd") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.cdr") returned 0
	[0042.741] lstrlenA (lpString="*.cdr") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.dwg") returned 0
	[0042.741] lstrlenA (lpString="*.dwg") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.max") returned 0
	[0042.741] lstrlenA (lpString="*.max") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.bmp") returned 0
	[0042.741] lstrlenA (lpString="*.bmp") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.gif") returned 0
	[0042.741] lstrlenA (lpString="*.gif") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.png") returned 0
	[0042.741] lstrlenA (lpString="*.png") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.doc") returned 0
	[0042.741] lstrlenA (lpString="*.doc") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.docx") returned 0
	[0042.741] lstrlenA (lpString="*.docx") returned 6
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.xls") returned 0
	[0042.741] lstrlenA (lpString="*.xls") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.xlsx") returned 0
	[0042.741] lstrlenA (lpString="*.xlsx") returned 6
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.ppt") returned 0
	[0042.741] lstrlenA (lpString="*.ppt") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.pptx") returned 0
	[0042.741] lstrlenA (lpString="*.pptx") returned 6
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.txt") returned 0
	[0042.741] lstrlenA (lpString="*.txt") returned 5
	[0042.741] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.pdf") returned 0
	[0042.741] lstrlenA (lpString="*.pdf") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.djvu") returned 0
	[0042.742] lstrlenA (lpString="*.djvu") returned 6
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.htm") returned 0
	[0042.742] lstrlenA (lpString="*.htm") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.html") returned 0
	[0042.742] lstrlenA (lpString="*.html") returned 6
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mdb") returned 0
	[0042.742] lstrlenA (lpString="*.mdb") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.cer") returned 0
	[0042.742] lstrlenA (lpString="*.cer") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.p12") returned 0
	[0042.742] lstrlenA (lpString="*.p12") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.pfx") returned 0
	[0042.742] lstrlenA (lpString="*.pfx") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.kwm") returned 0
	[0042.742] lstrlenA (lpString="*.kwm") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.pwm") returned 0
	[0042.742] lstrlenA (lpString="*.pwm") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.1cd") returned 0
	[0042.742] lstrlenA (lpString="*.1cd") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.md") returned 0
	[0042.742] lstrlenA (lpString="*.md") returned 4
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mdf") returned 0
	[0042.742] lstrlenA (lpString="*.mdf") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.dbf") returned 0
	[0042.742] lstrlenA (lpString="*.dbf") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.odt") returned 0
	[0042.742] lstrlenA (lpString="*.odt") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.vob") returned 0
	[0042.742] lstrlenA (lpString="*.vob") returned 5
	[0042.742] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.ifo") returned 0
	[0042.743] lstrlenA (lpString="*.ifo") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.lnk") returned 0
	[0042.743] lstrlenA (lpString="*.lnk") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.torrent") returned 0
	[0042.743] lstrlenA (lpString="*.torrent") returned 9
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mov") returned 0
	[0042.743] lstrlenA (lpString="*.mov") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.m2v") returned 0
	[0042.743] lstrlenA (lpString="*.m2v") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.3gp") returned 0
	[0042.743] lstrlenA (lpString="*.3gp") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mpeg") returned 0
	[0042.743] lstrlenA (lpString="*.mpeg") returned 6
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mpg") returned 0
	[0042.743] lstrlenA (lpString="*.mpg") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.flv") returned 0
	[0042.743] lstrlenA (lpString="*.flv") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.avi") returned 0
	[0042.743] lstrlenA (lpString="*.avi") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mp4") returned 0
	[0042.743] lstrlenA (lpString="*.mp4") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.wmv") returned 0
	[0042.743] lstrlenA (lpString="*.wmv") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.divx") returned 0
	[0042.743] lstrlenA (lpString="*.divx") returned 6
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mkv") returned 0
	[0042.743] lstrlenA (lpString="*.mkv") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mp3") returned 0
	[0042.743] lstrlenA (lpString="*.mp3") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.wav") returned 0
	[0042.743] lstrlenA (lpString="*.wav") returned 5
	[0042.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.flac") returned 0
	[0042.744] lstrlenA (lpString="*.flac") returned 6
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.ape") returned 0
	[0042.744] lstrlenA (lpString="*.ape") returned 5
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.wma") returned 0
	[0042.744] lstrlenA (lpString="*.wma") returned 5
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.ac3") returned 0
	[0042.744] lstrlenA (lpString="*.ac3") returned 5
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.exe") returned 0
	[0042.744] lstrlenA (lpString="*.exe") returned 5
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.apk") returned 0
	[0042.744] lstrlenA (lpString="*.apk") returned 5
	[0042.744] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.744] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.744] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SKY.INF") returned -1
	[0042.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SKY.INF") returned -1
	[0042.744] lstrcmpiA (lpString1="", lpString2="SKY.INF") returned -1
	[0042.744] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned="SKY.ELM"
	[0042.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\"
	[0042.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned=""
	[0042.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt"
	[0042.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0x20
	[0042.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="SKY.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF"
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.zip") returned 0
	[0042.744] lstrlenA (lpString="*.zip") returned 5
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.rar") returned 0
	[0042.744] lstrlenA (lpString="*.rar") returned 5
	[0042.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.7z") returned 0
	[0042.745] lstrlenA (lpString="*.7z") returned 4
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.tar") returned 0
	[0042.745] lstrlenA (lpString="*.tar") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.gzip") returned 0
	[0042.745] lstrlenA (lpString="*.gzip") returned 6
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.jpg") returned 0
	[0042.745] lstrlenA (lpString="*.jpg") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.jpeg") returned 0
	[0042.745] lstrlenA (lpString="*.jpeg") returned 6
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.psd") returned 0
	[0042.745] lstrlenA (lpString="*.psd") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.cdr") returned 0
	[0042.745] lstrlenA (lpString="*.cdr") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.dwg") returned 0
	[0042.745] lstrlenA (lpString="*.dwg") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.max") returned 0
	[0042.745] lstrlenA (lpString="*.max") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.bmp") returned 0
	[0042.745] lstrlenA (lpString="*.bmp") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.gif") returned 0
	[0042.745] lstrlenA (lpString="*.gif") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.png") returned 0
	[0042.745] lstrlenA (lpString="*.png") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.doc") returned 0
	[0042.745] lstrlenA (lpString="*.doc") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.docx") returned 0
	[0042.745] lstrlenA (lpString="*.docx") returned 6
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.xls") returned 0
	[0042.745] lstrlenA (lpString="*.xls") returned 5
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.xlsx") returned 0
	[0042.745] lstrlenA (lpString="*.xlsx") returned 6
	[0042.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.ppt") returned 0
	[0042.745] lstrlenA (lpString="*.ppt") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.pptx") returned 0
	[0042.746] lstrlenA (lpString="*.pptx") returned 6
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.txt") returned 0
	[0042.746] lstrlenA (lpString="*.txt") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.pdf") returned 0
	[0042.746] lstrlenA (lpString="*.pdf") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.djvu") returned 0
	[0042.746] lstrlenA (lpString="*.djvu") returned 6
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.htm") returned 0
	[0042.746] lstrlenA (lpString="*.htm") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.html") returned 0
	[0042.746] lstrlenA (lpString="*.html") returned 6
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mdb") returned 0
	[0042.746] lstrlenA (lpString="*.mdb") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.cer") returned 0
	[0042.746] lstrlenA (lpString="*.cer") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.p12") returned 0
	[0042.746] lstrlenA (lpString="*.p12") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.pfx") returned 0
	[0042.746] lstrlenA (lpString="*.pfx") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.kwm") returned 0
	[0042.746] lstrlenA (lpString="*.kwm") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.pwm") returned 0
	[0042.746] lstrlenA (lpString="*.pwm") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.1cd") returned 0
	[0042.746] lstrlenA (lpString="*.1cd") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.md") returned 0
	[0042.746] lstrlenA (lpString="*.md") returned 4
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mdf") returned 0
	[0042.746] lstrlenA (lpString="*.mdf") returned 5
	[0042.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.dbf") returned 0
	[0042.746] lstrlenA (lpString="*.dbf") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.odt") returned 0
	[0042.747] lstrlenA (lpString="*.odt") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.vob") returned 0
	[0042.747] lstrlenA (lpString="*.vob") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.ifo") returned 0
	[0042.747] lstrlenA (lpString="*.ifo") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.lnk") returned 0
	[0042.747] lstrlenA (lpString="*.lnk") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.torrent") returned 0
	[0042.747] lstrlenA (lpString="*.torrent") returned 9
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mov") returned 0
	[0042.747] lstrlenA (lpString="*.mov") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.m2v") returned 0
	[0042.747] lstrlenA (lpString="*.m2v") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.3gp") returned 0
	[0042.747] lstrlenA (lpString="*.3gp") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mpeg") returned 0
	[0042.747] lstrlenA (lpString="*.mpeg") returned 6
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mpg") returned 0
	[0042.747] lstrlenA (lpString="*.mpg") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.flv") returned 0
	[0042.747] lstrlenA (lpString="*.flv") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.avi") returned 0
	[0042.747] lstrlenA (lpString="*.avi") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mp4") returned 0
	[0042.747] lstrlenA (lpString="*.mp4") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.wmv") returned 0
	[0042.747] lstrlenA (lpString="*.wmv") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.divx") returned 0
	[0042.747] lstrlenA (lpString="*.divx") returned 6
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mkv") returned 0
	[0042.747] lstrlenA (lpString="*.mkv") returned 5
	[0042.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mp3") returned 0
	[0042.747] lstrlenA (lpString="*.mp3") returned 5
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.wav") returned 0
	[0042.748] lstrlenA (lpString="*.wav") returned 5
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.flac") returned 0
	[0042.748] lstrlenA (lpString="*.flac") returned 6
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.ape") returned 0
	[0042.748] lstrlenA (lpString="*.ape") returned 5
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.wma") returned 0
	[0042.748] lstrlenA (lpString="*.wma") returned 5
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.ac3") returned 0
	[0042.748] lstrlenA (lpString="*.ac3") returned 5
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.exe") returned 0
	[0042.748] lstrlenA (lpString="*.exe") returned 5
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.apk") returned 0
	[0042.748] lstrlenA (lpString="*.apk") returned 5
	[0042.748] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.748] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.748] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0042.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0042.748] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0042.748] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned="SKY.INF"
	[0042.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\"
	[0042.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned=""
	[0042.748] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt"
	[0042.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0x20
	[0042.748] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG"
	[0042.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0042.748] lstrlenA (lpString="*.zip") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0042.749] lstrlenA (lpString="*.rar") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0042.749] lstrlenA (lpString="*.7z") returned 4
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0042.749] lstrlenA (lpString="*.tar") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0042.749] lstrlenA (lpString="*.gzip") returned 6
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0042.749] lstrlenA (lpString="*.jpg") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0042.749] lstrlenA (lpString="*.jpeg") returned 6
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0042.749] lstrlenA (lpString="*.psd") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0042.749] lstrlenA (lpString="*.cdr") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0042.749] lstrlenA (lpString="*.dwg") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0042.749] lstrlenA (lpString="*.max") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0042.749] lstrlenA (lpString="*.bmp") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0042.749] lstrlenA (lpString="*.gif") returned 5
	[0042.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0042.749] lstrlenA (lpString="*.png") returned 5
	[0042.749] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG"
	[0042.749] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG"
	[0042.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG."
	[0042.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.Boom"
	[0042.749] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.750] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7279
	[0042.750] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.750] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.750] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7256, lpOverlapped=0x0) returned 1
	[0042.798] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0042.798] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.798] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7256, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7256, lpOverlapped=0x0) returned 1
	[0042.799] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0042.799] CloseHandle (hObject=0x90) returned 1
	[0042.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.boom")) returned 1
	[0042.801] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0042.801] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0042.801] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0042.801] lstrcmpA (lpString1=".", lpString2="SLATE") returned -1
	[0042.801] lstrcmpA (lpString1="..", lpString2="SLATE") returned -1
	[0042.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0042.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SLATE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE"
	[0042.801] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE") returned 61
	[0042.801] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0042.944] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0042.944] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.944] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0042.944] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0042.944] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0042.944] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0042.944] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0042.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0042.944] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0042.944] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*") returned="*.*"
	[0042.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\"
	[0042.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned=""
	[0042.945] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt"
	[0042.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0xffffffff
	[0042.945] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.945] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0042.945] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0042.946] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0042.946] CloseHandle (hObject=0x90) returned 1
	[0042.947] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF"
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0042.947] lstrlenA (lpString="*.zip") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0042.947] lstrlenA (lpString="*.rar") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0042.947] lstrlenA (lpString="*.7z") returned 4
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0042.947] lstrlenA (lpString="*.tar") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0042.947] lstrlenA (lpString="*.gzip") returned 6
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0042.947] lstrlenA (lpString="*.jpg") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0042.947] lstrlenA (lpString="*.jpeg") returned 6
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0042.947] lstrlenA (lpString="*.psd") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0042.947] lstrlenA (lpString="*.cdr") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0042.947] lstrlenA (lpString="*.dwg") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0042.947] lstrlenA (lpString="*.max") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0042.947] lstrlenA (lpString="*.bmp") returned 5
	[0042.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0042.947] lstrlenA (lpString="*.gif") returned 5
	[0042.947] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF"
	[0042.947] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF"
	[0042.948] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF."
	[0042.948] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.Boom"
	[0042.948] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0042.949] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f1
	[0042.949] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0042.949] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0042.949] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3ce, lpOverlapped=0x0) returned 1
	[0043.194] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.194] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.194] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3ce, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3ce, lpOverlapped=0x0) returned 1
	[0043.194] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.194] CloseHandle (hObject=0x90) returned 1
	[0043.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.boom")) returned 1
	[0043.197] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.197] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.197] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SLATE.ELM") returned -1
	[0043.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SLATE.ELM") returned -1
	[0043.197] lstrcmpiA (lpString1="", lpString2="SLATE.ELM") returned -1
	[0043.197] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\"
	[0043.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned=""
	[0043.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt"
	[0043.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0x20
	[0043.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="SLATE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM"
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.zip") returned 0
	[0043.198] lstrlenA (lpString="*.zip") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.rar") returned 0
	[0043.198] lstrlenA (lpString="*.rar") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.7z") returned 0
	[0043.198] lstrlenA (lpString="*.7z") returned 4
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.tar") returned 0
	[0043.198] lstrlenA (lpString="*.tar") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.gzip") returned 0
	[0043.198] lstrlenA (lpString="*.gzip") returned 6
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.jpg") returned 0
	[0043.198] lstrlenA (lpString="*.jpg") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.jpeg") returned 0
	[0043.198] lstrlenA (lpString="*.jpeg") returned 6
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.psd") returned 0
	[0043.198] lstrlenA (lpString="*.psd") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.cdr") returned 0
	[0043.198] lstrlenA (lpString="*.cdr") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.dwg") returned 0
	[0043.198] lstrlenA (lpString="*.dwg") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.max") returned 0
	[0043.198] lstrlenA (lpString="*.max") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.bmp") returned 0
	[0043.198] lstrlenA (lpString="*.bmp") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.gif") returned 0
	[0043.198] lstrlenA (lpString="*.gif") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.png") returned 0
	[0043.198] lstrlenA (lpString="*.png") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.doc") returned 0
	[0043.198] lstrlenA (lpString="*.doc") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.docx") returned 0
	[0043.198] lstrlenA (lpString="*.docx") returned 6
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.xls") returned 0
	[0043.198] lstrlenA (lpString="*.xls") returned 5
	[0043.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.xlsx") returned 0
	[0043.199] lstrlenA (lpString="*.xlsx") returned 6
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.ppt") returned 0
	[0043.199] lstrlenA (lpString="*.ppt") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.pptx") returned 0
	[0043.199] lstrlenA (lpString="*.pptx") returned 6
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.txt") returned 0
	[0043.199] lstrlenA (lpString="*.txt") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.pdf") returned 0
	[0043.199] lstrlenA (lpString="*.pdf") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.djvu") returned 0
	[0043.199] lstrlenA (lpString="*.djvu") returned 6
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.htm") returned 0
	[0043.199] lstrlenA (lpString="*.htm") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.html") returned 0
	[0043.199] lstrlenA (lpString="*.html") returned 6
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mdb") returned 0
	[0043.199] lstrlenA (lpString="*.mdb") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.cer") returned 0
	[0043.199] lstrlenA (lpString="*.cer") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.p12") returned 0
	[0043.199] lstrlenA (lpString="*.p12") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.pfx") returned 0
	[0043.199] lstrlenA (lpString="*.pfx") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.kwm") returned 0
	[0043.199] lstrlenA (lpString="*.kwm") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.pwm") returned 0
	[0043.199] lstrlenA (lpString="*.pwm") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.1cd") returned 0
	[0043.199] lstrlenA (lpString="*.1cd") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.md") returned 0
	[0043.199] lstrlenA (lpString="*.md") returned 4
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mdf") returned 0
	[0043.199] lstrlenA (lpString="*.mdf") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.dbf") returned 0
	[0043.199] lstrlenA (lpString="*.dbf") returned 5
	[0043.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.odt") returned 0
	[0043.200] lstrlenA (lpString="*.odt") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.vob") returned 0
	[0043.200] lstrlenA (lpString="*.vob") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.ifo") returned 0
	[0043.200] lstrlenA (lpString="*.ifo") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.lnk") returned 0
	[0043.200] lstrlenA (lpString="*.lnk") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.torrent") returned 0
	[0043.200] lstrlenA (lpString="*.torrent") returned 9
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mov") returned 0
	[0043.200] lstrlenA (lpString="*.mov") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.m2v") returned 0
	[0043.200] lstrlenA (lpString="*.m2v") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.3gp") returned 0
	[0043.200] lstrlenA (lpString="*.3gp") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mpeg") returned 0
	[0043.200] lstrlenA (lpString="*.mpeg") returned 6
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mpg") returned 0
	[0043.200] lstrlenA (lpString="*.mpg") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.flv") returned 0
	[0043.200] lstrlenA (lpString="*.flv") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.avi") returned 0
	[0043.200] lstrlenA (lpString="*.avi") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mp4") returned 0
	[0043.200] lstrlenA (lpString="*.mp4") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.wmv") returned 0
	[0043.200] lstrlenA (lpString="*.wmv") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.divx") returned 0
	[0043.200] lstrlenA (lpString="*.divx") returned 6
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mkv") returned 0
	[0043.200] lstrlenA (lpString="*.mkv") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mp3") returned 0
	[0043.200] lstrlenA (lpString="*.mp3") returned 5
	[0043.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.wav") returned 0
	[0043.200] lstrlenA (lpString="*.wav") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.flac") returned 0
	[0043.201] lstrlenA (lpString="*.flac") returned 6
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.ape") returned 0
	[0043.201] lstrlenA (lpString="*.ape") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.wma") returned 0
	[0043.201] lstrlenA (lpString="*.wma") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.ac3") returned 0
	[0043.201] lstrlenA (lpString="*.ac3") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.exe") returned 0
	[0043.201] lstrlenA (lpString="*.exe") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.apk") returned 0
	[0043.201] lstrlenA (lpString="*.apk") returned 5
	[0043.201] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.201] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SLATE.INF") returned -1
	[0043.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SLATE.INF") returned -1
	[0043.201] lstrcmpiA (lpString1="", lpString2="SLATE.INF") returned -1
	[0043.201] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned="SLATE.ELM"
	[0043.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\"
	[0043.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned=""
	[0043.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt"
	[0043.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0x20
	[0043.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="SLATE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF"
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.zip") returned 0
	[0043.201] lstrlenA (lpString="*.zip") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.rar") returned 0
	[0043.201] lstrlenA (lpString="*.rar") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.7z") returned 0
	[0043.201] lstrlenA (lpString="*.7z") returned 4
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.tar") returned 0
	[0043.201] lstrlenA (lpString="*.tar") returned 5
	[0043.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.gzip") returned 0
	[0043.202] lstrlenA (lpString="*.gzip") returned 6
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.jpg") returned 0
	[0043.202] lstrlenA (lpString="*.jpg") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.jpeg") returned 0
	[0043.202] lstrlenA (lpString="*.jpeg") returned 6
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.psd") returned 0
	[0043.202] lstrlenA (lpString="*.psd") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.cdr") returned 0
	[0043.202] lstrlenA (lpString="*.cdr") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.dwg") returned 0
	[0043.202] lstrlenA (lpString="*.dwg") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.max") returned 0
	[0043.202] lstrlenA (lpString="*.max") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.bmp") returned 0
	[0043.202] lstrlenA (lpString="*.bmp") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.gif") returned 0
	[0043.202] lstrlenA (lpString="*.gif") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.png") returned 0
	[0043.202] lstrlenA (lpString="*.png") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.doc") returned 0
	[0043.202] lstrlenA (lpString="*.doc") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.docx") returned 0
	[0043.202] lstrlenA (lpString="*.docx") returned 6
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.xls") returned 0
	[0043.202] lstrlenA (lpString="*.xls") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.xlsx") returned 0
	[0043.202] lstrlenA (lpString="*.xlsx") returned 6
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.ppt") returned 0
	[0043.202] lstrlenA (lpString="*.ppt") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.pptx") returned 0
	[0043.202] lstrlenA (lpString="*.pptx") returned 6
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.txt") returned 0
	[0043.202] lstrlenA (lpString="*.txt") returned 5
	[0043.202] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.pdf") returned 0
	[0043.202] lstrlenA (lpString="*.pdf") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.djvu") returned 0
	[0043.203] lstrlenA (lpString="*.djvu") returned 6
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.htm") returned 0
	[0043.203] lstrlenA (lpString="*.htm") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.html") returned 0
	[0043.203] lstrlenA (lpString="*.html") returned 6
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mdb") returned 0
	[0043.203] lstrlenA (lpString="*.mdb") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.cer") returned 0
	[0043.203] lstrlenA (lpString="*.cer") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.p12") returned 0
	[0043.203] lstrlenA (lpString="*.p12") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.pfx") returned 0
	[0043.203] lstrlenA (lpString="*.pfx") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.kwm") returned 0
	[0043.203] lstrlenA (lpString="*.kwm") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.pwm") returned 0
	[0043.203] lstrlenA (lpString="*.pwm") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.1cd") returned 0
	[0043.203] lstrlenA (lpString="*.1cd") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.md") returned 0
	[0043.203] lstrlenA (lpString="*.md") returned 4
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mdf") returned 0
	[0043.203] lstrlenA (lpString="*.mdf") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.dbf") returned 0
	[0043.203] lstrlenA (lpString="*.dbf") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.odt") returned 0
	[0043.203] lstrlenA (lpString="*.odt") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.vob") returned 0
	[0043.203] lstrlenA (lpString="*.vob") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.ifo") returned 0
	[0043.203] lstrlenA (lpString="*.ifo") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.lnk") returned 0
	[0043.203] lstrlenA (lpString="*.lnk") returned 5
	[0043.203] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.torrent") returned 0
	[0043.204] lstrlenA (lpString="*.torrent") returned 9
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mov") returned 0
	[0043.204] lstrlenA (lpString="*.mov") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.m2v") returned 0
	[0043.204] lstrlenA (lpString="*.m2v") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.3gp") returned 0
	[0043.204] lstrlenA (lpString="*.3gp") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mpeg") returned 0
	[0043.204] lstrlenA (lpString="*.mpeg") returned 6
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mpg") returned 0
	[0043.204] lstrlenA (lpString="*.mpg") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.flv") returned 0
	[0043.204] lstrlenA (lpString="*.flv") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.avi") returned 0
	[0043.204] lstrlenA (lpString="*.avi") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mp4") returned 0
	[0043.204] lstrlenA (lpString="*.mp4") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.wmv") returned 0
	[0043.204] lstrlenA (lpString="*.wmv") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.divx") returned 0
	[0043.204] lstrlenA (lpString="*.divx") returned 6
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mkv") returned 0
	[0043.204] lstrlenA (lpString="*.mkv") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mp3") returned 0
	[0043.204] lstrlenA (lpString="*.mp3") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.wav") returned 0
	[0043.204] lstrlenA (lpString="*.wav") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.flac") returned 0
	[0043.204] lstrlenA (lpString="*.flac") returned 6
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.ape") returned 0
	[0043.204] lstrlenA (lpString="*.ape") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.wma") returned 0
	[0043.204] lstrlenA (lpString="*.wma") returned 5
	[0043.204] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.ac3") returned 0
	[0043.205] lstrlenA (lpString="*.ac3") returned 5
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.exe") returned 0
	[0043.205] lstrlenA (lpString="*.exe") returned 5
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.apk") returned 0
	[0043.205] lstrlenA (lpString="*.apk") returned 5
	[0043.205] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.205] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.205] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0043.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0043.205] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0043.205] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned="SLATE.INF"
	[0043.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\"
	[0043.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned=""
	[0043.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt"
	[0043.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0x20
	[0043.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG"
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0043.205] lstrlenA (lpString="*.zip") returned 5
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0043.205] lstrlenA (lpString="*.rar") returned 5
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0043.205] lstrlenA (lpString="*.7z") returned 4
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0043.205] lstrlenA (lpString="*.tar") returned 5
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0043.205] lstrlenA (lpString="*.gzip") returned 6
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0043.205] lstrlenA (lpString="*.jpg") returned 5
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0043.205] lstrlenA (lpString="*.jpeg") returned 6
	[0043.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0043.205] lstrlenA (lpString="*.psd") returned 5
	[0043.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0043.206] lstrlenA (lpString="*.cdr") returned 5
	[0043.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0043.206] lstrlenA (lpString="*.dwg") returned 5
	[0043.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0043.206] lstrlenA (lpString="*.max") returned 5
	[0043.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0043.206] lstrlenA (lpString="*.bmp") returned 5
	[0043.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0043.206] lstrlenA (lpString="*.gif") returned 5
	[0043.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0043.206] lstrlenA (lpString="*.png") returned 5
	[0043.206] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG"
	[0043.206] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG"
	[0043.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG."
	[0043.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.Boom"
	[0043.206] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.206] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a29
	[0043.206] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d4d5410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.206] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.207] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6a06, lpOverlapped=0x0) returned 1
	[0043.308] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0043.308] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.308] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6a06, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6a06, lpOverlapped=0x0) returned 1
	[0043.308] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.308] CloseHandle (hObject=0x90) returned 1
	[0043.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.boom")) returned 1
	[0043.310] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0043.310] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0043.310] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0043.310] lstrcmpA (lpString1=".", lpString2="SONORA") returned -1
	[0043.310] lstrcmpA (lpString1="..", lpString2="SONORA") returned -1
	[0043.310] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0043.310] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SONORA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA"
	[0043.310] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA") returned 62
	[0043.310] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0043.412] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0043.412] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.412] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0043.412] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0043.412] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.412] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.412] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0043.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0043.412] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0043.412] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*") returned="*.*"
	[0043.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\"
	[0043.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned=""
	[0043.412] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt"
	[0043.412] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0xffffffff
	[0043.413] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.413] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0043.413] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0043.414] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0043.414] CloseHandle (hObject=0x90) returned 1
	[0043.414] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF"
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0043.414] lstrlenA (lpString="*.zip") returned 5
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0043.414] lstrlenA (lpString="*.rar") returned 5
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0043.414] lstrlenA (lpString="*.7z") returned 4
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0043.414] lstrlenA (lpString="*.tar") returned 5
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0043.414] lstrlenA (lpString="*.gzip") returned 6
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0043.414] lstrlenA (lpString="*.jpg") returned 5
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0043.414] lstrlenA (lpString="*.jpeg") returned 6
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0043.414] lstrlenA (lpString="*.psd") returned 5
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0043.414] lstrlenA (lpString="*.cdr") returned 5
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0043.414] lstrlenA (lpString="*.dwg") returned 5
	[0043.414] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0043.414] lstrlenA (lpString="*.max") returned 5
	[0043.415] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0043.415] lstrlenA (lpString="*.bmp") returned 5
	[0043.415] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0043.415] lstrlenA (lpString="*.gif") returned 5
	[0043.415] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF"
	[0043.415] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF"
	[0043.415] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF."
	[0043.415] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.Boom"
	[0043.415] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.415] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a1
	[0043.415] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.415] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.415] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x87e, lpOverlapped=0x0) returned 1
	[0043.525] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.525] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.525] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x87e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x87e, lpOverlapped=0x0) returned 1
	[0043.525] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.525] CloseHandle (hObject=0x90) returned 1
	[0043.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.boom")) returned 1
	[0043.530] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.530] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.530] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SONORA.ELM") returned -1
	[0043.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SONORA.ELM") returned -1
	[0043.530] lstrcmpiA (lpString1="", lpString2="SONORA.ELM") returned -1
	[0043.530] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\"
	[0043.530] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned=""
	[0043.530] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt"
	[0043.530] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0x20
	[0043.530] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="SONORA.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM"
	[0043.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.zip") returned 0
	[0043.530] lstrlenA (lpString="*.zip") returned 5
	[0043.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.rar") returned 0
	[0043.530] lstrlenA (lpString="*.rar") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.7z") returned 0
	[0043.531] lstrlenA (lpString="*.7z") returned 4
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.tar") returned 0
	[0043.531] lstrlenA (lpString="*.tar") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.gzip") returned 0
	[0043.531] lstrlenA (lpString="*.gzip") returned 6
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.jpg") returned 0
	[0043.531] lstrlenA (lpString="*.jpg") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.jpeg") returned 0
	[0043.531] lstrlenA (lpString="*.jpeg") returned 6
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.psd") returned 0
	[0043.531] lstrlenA (lpString="*.psd") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.cdr") returned 0
	[0043.531] lstrlenA (lpString="*.cdr") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.dwg") returned 0
	[0043.531] lstrlenA (lpString="*.dwg") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.max") returned 0
	[0043.531] lstrlenA (lpString="*.max") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.bmp") returned 0
	[0043.531] lstrlenA (lpString="*.bmp") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.gif") returned 0
	[0043.531] lstrlenA (lpString="*.gif") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.png") returned 0
	[0043.531] lstrlenA (lpString="*.png") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.doc") returned 0
	[0043.531] lstrlenA (lpString="*.doc") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.docx") returned 0
	[0043.531] lstrlenA (lpString="*.docx") returned 6
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.xls") returned 0
	[0043.531] lstrlenA (lpString="*.xls") returned 5
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.xlsx") returned 0
	[0043.531] lstrlenA (lpString="*.xlsx") returned 6
	[0043.531] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.ppt") returned 0
	[0043.532] lstrlenA (lpString="*.ppt") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.pptx") returned 0
	[0043.532] lstrlenA (lpString="*.pptx") returned 6
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.txt") returned 0
	[0043.532] lstrlenA (lpString="*.txt") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.pdf") returned 0
	[0043.532] lstrlenA (lpString="*.pdf") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.djvu") returned 0
	[0043.532] lstrlenA (lpString="*.djvu") returned 6
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.htm") returned 0
	[0043.532] lstrlenA (lpString="*.htm") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.html") returned 0
	[0043.532] lstrlenA (lpString="*.html") returned 6
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mdb") returned 0
	[0043.532] lstrlenA (lpString="*.mdb") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.cer") returned 0
	[0043.532] lstrlenA (lpString="*.cer") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.p12") returned 0
	[0043.532] lstrlenA (lpString="*.p12") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.pfx") returned 0
	[0043.532] lstrlenA (lpString="*.pfx") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.kwm") returned 0
	[0043.532] lstrlenA (lpString="*.kwm") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.pwm") returned 0
	[0043.532] lstrlenA (lpString="*.pwm") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.1cd") returned 0
	[0043.532] lstrlenA (lpString="*.1cd") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.md") returned 0
	[0043.532] lstrlenA (lpString="*.md") returned 4
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mdf") returned 0
	[0043.532] lstrlenA (lpString="*.mdf") returned 5
	[0043.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.dbf") returned 0
	[0043.532] lstrlenA (lpString="*.dbf") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.odt") returned 0
	[0043.533] lstrlenA (lpString="*.odt") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.vob") returned 0
	[0043.533] lstrlenA (lpString="*.vob") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.ifo") returned 0
	[0043.533] lstrlenA (lpString="*.ifo") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.lnk") returned 0
	[0043.533] lstrlenA (lpString="*.lnk") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.torrent") returned 0
	[0043.533] lstrlenA (lpString="*.torrent") returned 9
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mov") returned 0
	[0043.533] lstrlenA (lpString="*.mov") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.m2v") returned 0
	[0043.533] lstrlenA (lpString="*.m2v") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.3gp") returned 0
	[0043.533] lstrlenA (lpString="*.3gp") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mpeg") returned 0
	[0043.533] lstrlenA (lpString="*.mpeg") returned 6
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mpg") returned 0
	[0043.533] lstrlenA (lpString="*.mpg") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.flv") returned 0
	[0043.533] lstrlenA (lpString="*.flv") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.avi") returned 0
	[0043.533] lstrlenA (lpString="*.avi") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mp4") returned 0
	[0043.533] lstrlenA (lpString="*.mp4") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.wmv") returned 0
	[0043.533] lstrlenA (lpString="*.wmv") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.divx") returned 0
	[0043.533] lstrlenA (lpString="*.divx") returned 6
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mkv") returned 0
	[0043.533] lstrlenA (lpString="*.mkv") returned 5
	[0043.533] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mp3") returned 0
	[0043.534] lstrlenA (lpString="*.mp3") returned 5
	[0043.534] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.wav") returned 0
	[0043.534] lstrlenA (lpString="*.wav") returned 5
	[0043.534] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.flac") returned 0
	[0043.534] lstrlenA (lpString="*.flac") returned 6
	[0043.534] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.ape") returned 0
	[0043.534] lstrlenA (lpString="*.ape") returned 5
	[0043.534] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.wma") returned 0
	[0043.534] lstrlenA (lpString="*.wma") returned 5
	[0043.534] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.ac3") returned 0
	[0043.534] lstrlenA (lpString="*.ac3") returned 5
	[0043.534] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.exe") returned 0
	[0043.534] lstrlenA (lpString="*.exe") returned 5
	[0043.534] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.apk") returned 0
	[0043.534] lstrlenA (lpString="*.apk") returned 5
	[0043.534] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.534] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.534] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SONORA.INF") returned -1
	[0043.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SONORA.INF") returned -1
	[0043.534] lstrcmpiA (lpString1="", lpString2="SONORA.INF") returned -1
	[0043.534] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned="SONORA.ELM"
	[0043.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\"
	[0043.534] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned=""
	[0043.534] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt"
	[0043.534] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0x20
	[0043.534] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="SONORA.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF"
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.zip") returned 0
	[0043.535] lstrlenA (lpString="*.zip") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.rar") returned 0
	[0043.535] lstrlenA (lpString="*.rar") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.7z") returned 0
	[0043.535] lstrlenA (lpString="*.7z") returned 4
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.tar") returned 0
	[0043.535] lstrlenA (lpString="*.tar") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.gzip") returned 0
	[0043.535] lstrlenA (lpString="*.gzip") returned 6
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.jpg") returned 0
	[0043.535] lstrlenA (lpString="*.jpg") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.jpeg") returned 0
	[0043.535] lstrlenA (lpString="*.jpeg") returned 6
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.psd") returned 0
	[0043.535] lstrlenA (lpString="*.psd") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.cdr") returned 0
	[0043.535] lstrlenA (lpString="*.cdr") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.dwg") returned 0
	[0043.535] lstrlenA (lpString="*.dwg") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.max") returned 0
	[0043.535] lstrlenA (lpString="*.max") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.bmp") returned 0
	[0043.535] lstrlenA (lpString="*.bmp") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.gif") returned 0
	[0043.535] lstrlenA (lpString="*.gif") returned 5
	[0043.535] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.png") returned 0
	[0043.535] lstrlenA (lpString="*.png") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.doc") returned 0
	[0043.536] lstrlenA (lpString="*.doc") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.docx") returned 0
	[0043.536] lstrlenA (lpString="*.docx") returned 6
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.xls") returned 0
	[0043.536] lstrlenA (lpString="*.xls") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.xlsx") returned 0
	[0043.536] lstrlenA (lpString="*.xlsx") returned 6
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.ppt") returned 0
	[0043.536] lstrlenA (lpString="*.ppt") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.pptx") returned 0
	[0043.536] lstrlenA (lpString="*.pptx") returned 6
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.txt") returned 0
	[0043.536] lstrlenA (lpString="*.txt") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.pdf") returned 0
	[0043.536] lstrlenA (lpString="*.pdf") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.djvu") returned 0
	[0043.536] lstrlenA (lpString="*.djvu") returned 6
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.htm") returned 0
	[0043.536] lstrlenA (lpString="*.htm") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.html") returned 0
	[0043.536] lstrlenA (lpString="*.html") returned 6
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mdb") returned 0
	[0043.536] lstrlenA (lpString="*.mdb") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.cer") returned 0
	[0043.536] lstrlenA (lpString="*.cer") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.p12") returned 0
	[0043.536] lstrlenA (lpString="*.p12") returned 5
	[0043.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.pfx") returned 0
	[0043.536] lstrlenA (lpString="*.pfx") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.kwm") returned 0
	[0043.537] lstrlenA (lpString="*.kwm") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.pwm") returned 0
	[0043.537] lstrlenA (lpString="*.pwm") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.1cd") returned 0
	[0043.537] lstrlenA (lpString="*.1cd") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.md") returned 0
	[0043.537] lstrlenA (lpString="*.md") returned 4
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mdf") returned 0
	[0043.537] lstrlenA (lpString="*.mdf") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.dbf") returned 0
	[0043.537] lstrlenA (lpString="*.dbf") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.odt") returned 0
	[0043.537] lstrlenA (lpString="*.odt") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.vob") returned 0
	[0043.537] lstrlenA (lpString="*.vob") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.ifo") returned 0
	[0043.537] lstrlenA (lpString="*.ifo") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.lnk") returned 0
	[0043.537] lstrlenA (lpString="*.lnk") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.torrent") returned 0
	[0043.537] lstrlenA (lpString="*.torrent") returned 9
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mov") returned 0
	[0043.537] lstrlenA (lpString="*.mov") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.m2v") returned 0
	[0043.537] lstrlenA (lpString="*.m2v") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.3gp") returned 0
	[0043.537] lstrlenA (lpString="*.3gp") returned 5
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mpeg") returned 0
	[0043.537] lstrlenA (lpString="*.mpeg") returned 6
	[0043.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mpg") returned 0
	[0043.537] lstrlenA (lpString="*.mpg") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.flv") returned 0
	[0043.538] lstrlenA (lpString="*.flv") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.avi") returned 0
	[0043.538] lstrlenA (lpString="*.avi") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mp4") returned 0
	[0043.538] lstrlenA (lpString="*.mp4") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.wmv") returned 0
	[0043.538] lstrlenA (lpString="*.wmv") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.divx") returned 0
	[0043.538] lstrlenA (lpString="*.divx") returned 6
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mkv") returned 0
	[0043.538] lstrlenA (lpString="*.mkv") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mp3") returned 0
	[0043.538] lstrlenA (lpString="*.mp3") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.wav") returned 0
	[0043.538] lstrlenA (lpString="*.wav") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.flac") returned 0
	[0043.538] lstrlenA (lpString="*.flac") returned 6
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.ape") returned 0
	[0043.538] lstrlenA (lpString="*.ape") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.wma") returned 0
	[0043.538] lstrlenA (lpString="*.wma") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.ac3") returned 0
	[0043.538] lstrlenA (lpString="*.ac3") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.exe") returned 0
	[0043.538] lstrlenA (lpString="*.exe") returned 5
	[0043.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.apk") returned 0
	[0043.538] lstrlenA (lpString="*.apk") returned 5
	[0043.538] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.538] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.538] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0043.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0043.538] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0043.539] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned="SONORA.INF"
	[0043.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\"
	[0043.539] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned=""
	[0043.539] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt"
	[0043.539] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0x20
	[0043.539] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG"
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0043.539] lstrlenA (lpString="*.zip") returned 5
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0043.539] lstrlenA (lpString="*.rar") returned 5
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0043.539] lstrlenA (lpString="*.7z") returned 4
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0043.539] lstrlenA (lpString="*.tar") returned 5
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0043.539] lstrlenA (lpString="*.gzip") returned 6
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0043.539] lstrlenA (lpString="*.jpg") returned 5
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0043.539] lstrlenA (lpString="*.jpeg") returned 6
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0043.539] lstrlenA (lpString="*.psd") returned 5
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0043.539] lstrlenA (lpString="*.cdr") returned 5
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0043.539] lstrlenA (lpString="*.dwg") returned 5
	[0043.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0043.540] lstrlenA (lpString="*.max") returned 5
	[0043.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0043.540] lstrlenA (lpString="*.bmp") returned 5
	[0043.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0043.540] lstrlenA (lpString="*.gif") returned 5
	[0043.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0043.540] lstrlenA (lpString="*.png") returned 5
	[0043.540] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG"
	[0043.540] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG"
	[0043.540] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG."
	[0043.540] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.Boom"
	[0043.540] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.540] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5534
	[0043.540] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d4d5410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.540] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.540] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5511, lpOverlapped=0x0) returned 1
	[0043.603] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0043.603] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.603] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5511, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5511, lpOverlapped=0x0) returned 1
	[0043.603] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.604] CloseHandle (hObject=0x90) returned 1
	[0043.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.boom")) returned 1
	[0043.607] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0043.607] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0043.607] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0043.607] lstrcmpA (lpString1=".", lpString2="SPRING") returned -1
	[0043.607] lstrcmpA (lpString1="..", lpString2="SPRING") returned -1
	[0043.607] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0043.607] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SPRING" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING"
	[0043.607] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING") returned 62
	[0043.607] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0043.607] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0043.607] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.607] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0043.607] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0043.607] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.607] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.608] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0043.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0043.608] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0043.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*") returned="*.*"
	[0043.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\"
	[0043.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned=""
	[0043.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt"
	[0043.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0xffffffff
	[0043.608] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.608] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0043.608] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0043.609] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0043.609] CloseHandle (hObject=0x90) returned 1
	[0043.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF"
	[0043.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0043.610] lstrlenA (lpString="*.zip") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0043.610] lstrlenA (lpString="*.rar") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0043.610] lstrlenA (lpString="*.7z") returned 4
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0043.610] lstrlenA (lpString="*.tar") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0043.610] lstrlenA (lpString="*.gzip") returned 6
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0043.610] lstrlenA (lpString="*.jpg") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0043.610] lstrlenA (lpString="*.jpeg") returned 6
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0043.610] lstrlenA (lpString="*.psd") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0043.610] lstrlenA (lpString="*.cdr") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0043.610] lstrlenA (lpString="*.dwg") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0043.610] lstrlenA (lpString="*.max") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0043.610] lstrlenA (lpString="*.bmp") returned 5
	[0043.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0043.610] lstrlenA (lpString="*.gif") returned 5
	[0043.610] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF"
	[0043.610] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF"
	[0043.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF."
	[0043.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.Boom"
	[0043.610] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.611] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9df
	[0043.611] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.611] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.611] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9bc, lpOverlapped=0x0) returned 1
	[0043.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.778] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.778] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9bc, lpOverlapped=0x0) returned 1
	[0043.779] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.779] CloseHandle (hObject=0x90) returned 1
	[0043.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.boom")) returned 1
	[0043.782] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.782] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.782] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SPRING.ELM") returned -1
	[0043.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPRING.ELM") returned -1
	[0043.782] lstrcmpiA (lpString1="", lpString2="SPRING.ELM") returned -1
	[0043.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\"
	[0043.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned=""
	[0043.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt"
	[0043.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0x20
	[0043.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="SPRING.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM"
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.zip") returned 0
	[0043.783] lstrlenA (lpString="*.zip") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.rar") returned 0
	[0043.783] lstrlenA (lpString="*.rar") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.7z") returned 0
	[0043.783] lstrlenA (lpString="*.7z") returned 4
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.tar") returned 0
	[0043.783] lstrlenA (lpString="*.tar") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.gzip") returned 0
	[0043.783] lstrlenA (lpString="*.gzip") returned 6
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.jpg") returned 0
	[0043.783] lstrlenA (lpString="*.jpg") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.jpeg") returned 0
	[0043.783] lstrlenA (lpString="*.jpeg") returned 6
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.psd") returned 0
	[0043.783] lstrlenA (lpString="*.psd") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.cdr") returned 0
	[0043.783] lstrlenA (lpString="*.cdr") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.dwg") returned 0
	[0043.783] lstrlenA (lpString="*.dwg") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.max") returned 0
	[0043.783] lstrlenA (lpString="*.max") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.bmp") returned 0
	[0043.783] lstrlenA (lpString="*.bmp") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.gif") returned 0
	[0043.783] lstrlenA (lpString="*.gif") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.png") returned 0
	[0043.783] lstrlenA (lpString="*.png") returned 5
	[0043.783] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.doc") returned 0
	[0043.784] lstrlenA (lpString="*.doc") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.docx") returned 0
	[0043.784] lstrlenA (lpString="*.docx") returned 6
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.xls") returned 0
	[0043.784] lstrlenA (lpString="*.xls") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.xlsx") returned 0
	[0043.784] lstrlenA (lpString="*.xlsx") returned 6
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.ppt") returned 0
	[0043.784] lstrlenA (lpString="*.ppt") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.pptx") returned 0
	[0043.784] lstrlenA (lpString="*.pptx") returned 6
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.txt") returned 0
	[0043.784] lstrlenA (lpString="*.txt") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.pdf") returned 0
	[0043.784] lstrlenA (lpString="*.pdf") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.djvu") returned 0
	[0043.784] lstrlenA (lpString="*.djvu") returned 6
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.htm") returned 0
	[0043.784] lstrlenA (lpString="*.htm") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.html") returned 0
	[0043.784] lstrlenA (lpString="*.html") returned 6
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mdb") returned 0
	[0043.784] lstrlenA (lpString="*.mdb") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.cer") returned 0
	[0043.784] lstrlenA (lpString="*.cer") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.p12") returned 0
	[0043.784] lstrlenA (lpString="*.p12") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.pfx") returned 0
	[0043.784] lstrlenA (lpString="*.pfx") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.kwm") returned 0
	[0043.784] lstrlenA (lpString="*.kwm") returned 5
	[0043.784] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.pwm") returned 0
	[0043.785] lstrlenA (lpString="*.pwm") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.1cd") returned 0
	[0043.785] lstrlenA (lpString="*.1cd") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.md") returned 0
	[0043.785] lstrlenA (lpString="*.md") returned 4
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mdf") returned 0
	[0043.785] lstrlenA (lpString="*.mdf") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.dbf") returned 0
	[0043.785] lstrlenA (lpString="*.dbf") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.odt") returned 0
	[0043.785] lstrlenA (lpString="*.odt") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.vob") returned 0
	[0043.785] lstrlenA (lpString="*.vob") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.ifo") returned 0
	[0043.785] lstrlenA (lpString="*.ifo") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.lnk") returned 0
	[0043.785] lstrlenA (lpString="*.lnk") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.torrent") returned 0
	[0043.785] lstrlenA (lpString="*.torrent") returned 9
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mov") returned 0
	[0043.785] lstrlenA (lpString="*.mov") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.m2v") returned 0
	[0043.785] lstrlenA (lpString="*.m2v") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.3gp") returned 0
	[0043.785] lstrlenA (lpString="*.3gp") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mpeg") returned 0
	[0043.785] lstrlenA (lpString="*.mpeg") returned 6
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mpg") returned 0
	[0043.785] lstrlenA (lpString="*.mpg") returned 5
	[0043.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.flv") returned 0
	[0043.786] lstrlenA (lpString="*.flv") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.avi") returned 0
	[0043.786] lstrlenA (lpString="*.avi") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mp4") returned 0
	[0043.786] lstrlenA (lpString="*.mp4") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.wmv") returned 0
	[0043.786] lstrlenA (lpString="*.wmv") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.divx") returned 0
	[0043.786] lstrlenA (lpString="*.divx") returned 6
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mkv") returned 0
	[0043.786] lstrlenA (lpString="*.mkv") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mp3") returned 0
	[0043.786] lstrlenA (lpString="*.mp3") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.wav") returned 0
	[0043.786] lstrlenA (lpString="*.wav") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.flac") returned 0
	[0043.786] lstrlenA (lpString="*.flac") returned 6
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.ape") returned 0
	[0043.786] lstrlenA (lpString="*.ape") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.wma") returned 0
	[0043.786] lstrlenA (lpString="*.wma") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.ac3") returned 0
	[0043.786] lstrlenA (lpString="*.ac3") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.exe") returned 0
	[0043.786] lstrlenA (lpString="*.exe") returned 5
	[0043.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.apk") returned 0
	[0043.786] lstrlenA (lpString="*.apk") returned 5
	[0043.786] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.786] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.786] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SPRING.INF") returned -1
	[0043.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPRING.INF") returned -1
	[0043.786] lstrcmpiA (lpString1="", lpString2="SPRING.INF") returned -1
	[0043.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned="SPRING.ELM"
	[0043.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\"
	[0043.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned=""
	[0043.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt"
	[0043.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0x20
	[0043.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="SPRING.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF"
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.zip") returned 0
	[0043.787] lstrlenA (lpString="*.zip") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.rar") returned 0
	[0043.787] lstrlenA (lpString="*.rar") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.7z") returned 0
	[0043.787] lstrlenA (lpString="*.7z") returned 4
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.tar") returned 0
	[0043.787] lstrlenA (lpString="*.tar") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.gzip") returned 0
	[0043.787] lstrlenA (lpString="*.gzip") returned 6
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.jpg") returned 0
	[0043.787] lstrlenA (lpString="*.jpg") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.jpeg") returned 0
	[0043.787] lstrlenA (lpString="*.jpeg") returned 6
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.psd") returned 0
	[0043.787] lstrlenA (lpString="*.psd") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.cdr") returned 0
	[0043.787] lstrlenA (lpString="*.cdr") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.dwg") returned 0
	[0043.787] lstrlenA (lpString="*.dwg") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.max") returned 0
	[0043.787] lstrlenA (lpString="*.max") returned 5
	[0043.787] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.bmp") returned 0
	[0043.787] lstrlenA (lpString="*.bmp") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.gif") returned 0
	[0043.788] lstrlenA (lpString="*.gif") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.png") returned 0
	[0043.788] lstrlenA (lpString="*.png") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.doc") returned 0
	[0043.788] lstrlenA (lpString="*.doc") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.docx") returned 0
	[0043.788] lstrlenA (lpString="*.docx") returned 6
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.xls") returned 0
	[0043.788] lstrlenA (lpString="*.xls") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.xlsx") returned 0
	[0043.788] lstrlenA (lpString="*.xlsx") returned 6
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.ppt") returned 0
	[0043.788] lstrlenA (lpString="*.ppt") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.pptx") returned 0
	[0043.788] lstrlenA (lpString="*.pptx") returned 6
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.txt") returned 0
	[0043.788] lstrlenA (lpString="*.txt") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.pdf") returned 0
	[0043.788] lstrlenA (lpString="*.pdf") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.djvu") returned 0
	[0043.788] lstrlenA (lpString="*.djvu") returned 6
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.htm") returned 0
	[0043.788] lstrlenA (lpString="*.htm") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.html") returned 0
	[0043.788] lstrlenA (lpString="*.html") returned 6
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mdb") returned 0
	[0043.788] lstrlenA (lpString="*.mdb") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.cer") returned 0
	[0043.788] lstrlenA (lpString="*.cer") returned 5
	[0043.788] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.p12") returned 0
	[0043.788] lstrlenA (lpString="*.p12") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.pfx") returned 0
	[0043.789] lstrlenA (lpString="*.pfx") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.kwm") returned 0
	[0043.789] lstrlenA (lpString="*.kwm") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.pwm") returned 0
	[0043.789] lstrlenA (lpString="*.pwm") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.1cd") returned 0
	[0043.789] lstrlenA (lpString="*.1cd") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.md") returned 0
	[0043.789] lstrlenA (lpString="*.md") returned 4
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mdf") returned 0
	[0043.789] lstrlenA (lpString="*.mdf") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.dbf") returned 0
	[0043.789] lstrlenA (lpString="*.dbf") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.odt") returned 0
	[0043.789] lstrlenA (lpString="*.odt") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.vob") returned 0
	[0043.789] lstrlenA (lpString="*.vob") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.ifo") returned 0
	[0043.789] lstrlenA (lpString="*.ifo") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.lnk") returned 0
	[0043.789] lstrlenA (lpString="*.lnk") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.torrent") returned 0
	[0043.789] lstrlenA (lpString="*.torrent") returned 9
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mov") returned 0
	[0043.789] lstrlenA (lpString="*.mov") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.m2v") returned 0
	[0043.789] lstrlenA (lpString="*.m2v") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.3gp") returned 0
	[0043.789] lstrlenA (lpString="*.3gp") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mpeg") returned 0
	[0043.789] lstrlenA (lpString="*.mpeg") returned 6
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mpg") returned 0
	[0043.789] lstrlenA (lpString="*.mpg") returned 5
	[0043.789] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.flv") returned 0
	[0043.790] lstrlenA (lpString="*.flv") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.avi") returned 0
	[0043.790] lstrlenA (lpString="*.avi") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mp4") returned 0
	[0043.790] lstrlenA (lpString="*.mp4") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.wmv") returned 0
	[0043.790] lstrlenA (lpString="*.wmv") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.divx") returned 0
	[0043.790] lstrlenA (lpString="*.divx") returned 6
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mkv") returned 0
	[0043.790] lstrlenA (lpString="*.mkv") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mp3") returned 0
	[0043.790] lstrlenA (lpString="*.mp3") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.wav") returned 0
	[0043.790] lstrlenA (lpString="*.wav") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.flac") returned 0
	[0043.790] lstrlenA (lpString="*.flac") returned 6
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.ape") returned 0
	[0043.790] lstrlenA (lpString="*.ape") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.wma") returned 0
	[0043.790] lstrlenA (lpString="*.wma") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.ac3") returned 0
	[0043.790] lstrlenA (lpString="*.ac3") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.exe") returned 0
	[0043.790] lstrlenA (lpString="*.exe") returned 5
	[0043.790] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.apk") returned 0
	[0043.790] lstrlenA (lpString="*.apk") returned 5
	[0043.790] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.790] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0043.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0043.790] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0043.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned="SPRING.INF"
	[0043.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\"
	[0043.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned=""
	[0043.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt"
	[0043.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0x20
	[0043.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG"
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0043.791] lstrlenA (lpString="*.zip") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0043.791] lstrlenA (lpString="*.rar") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0043.791] lstrlenA (lpString="*.7z") returned 4
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0043.791] lstrlenA (lpString="*.tar") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0043.791] lstrlenA (lpString="*.gzip") returned 6
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0043.791] lstrlenA (lpString="*.jpg") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0043.791] lstrlenA (lpString="*.jpeg") returned 6
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0043.791] lstrlenA (lpString="*.psd") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0043.791] lstrlenA (lpString="*.cdr") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0043.791] lstrlenA (lpString="*.dwg") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0043.791] lstrlenA (lpString="*.max") returned 5
	[0043.791] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0043.792] lstrlenA (lpString="*.bmp") returned 5
	[0043.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0043.792] lstrlenA (lpString="*.gif") returned 5
	[0043.792] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0043.792] lstrlenA (lpString="*.png") returned 5
	[0043.792] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG"
	[0043.792] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG"
	[0043.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG."
	[0043.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.Boom"
	[0043.792] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.793] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c45
	[0043.793] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d4d5410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.793] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.793] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4c22, lpOverlapped=0x0) returned 1
	[0043.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0043.806] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.806] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4c22, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4c22, lpOverlapped=0x0) returned 1
	[0043.806] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.806] CloseHandle (hObject=0x90) returned 1
	[0043.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.boom")) returned 1
	[0043.808] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0043.808] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0043.808] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0043.808] lstrcmpA (lpString1=".", lpString2="STRTEDGE") returned -1
	[0043.808] lstrcmpA (lpString1="..", lpString2="STRTEDGE") returned -1
	[0043.808] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0043.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="STRTEDGE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE"
	[0043.808] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE") returned 64
	[0043.808] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0043.809] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0043.809] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.809] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0043.809] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0043.809] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.809] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.809] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0043.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0043.809] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0043.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*") returned="*.*"
	[0043.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\"
	[0043.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned=""
	[0043.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt"
	[0043.810] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0xffffffff
	[0043.810] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.817] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0043.817] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0043.818] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0043.818] CloseHandle (hObject=0x90) returned 1
	[0043.818] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF"
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0043.818] lstrlenA (lpString="*.zip") returned 5
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0043.818] lstrlenA (lpString="*.rar") returned 5
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0043.818] lstrlenA (lpString="*.7z") returned 4
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0043.818] lstrlenA (lpString="*.tar") returned 5
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0043.818] lstrlenA (lpString="*.gzip") returned 6
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0043.818] lstrlenA (lpString="*.jpg") returned 5
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0043.818] lstrlenA (lpString="*.jpeg") returned 6
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0043.818] lstrlenA (lpString="*.psd") returned 5
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0043.818] lstrlenA (lpString="*.cdr") returned 5
	[0043.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0043.818] lstrlenA (lpString="*.dwg") returned 5
	[0043.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0043.819] lstrlenA (lpString="*.max") returned 5
	[0043.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0043.819] lstrlenA (lpString="*.bmp") returned 5
	[0043.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0043.819] lstrlenA (lpString="*.gif") returned 5
	[0043.819] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF"
	[0043.819] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF"
	[0043.819] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF."
	[0043.819] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.Boom"
	[0043.819] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.819] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c9
	[0043.819] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.819] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.819] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6a6, lpOverlapped=0x0) returned 1
	[0043.834] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.835] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.835] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6a6, lpOverlapped=0x0) returned 1
	[0043.835] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.835] CloseHandle (hObject=0x90) returned 1
	[0043.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.boom")) returned 1
	[0043.836] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STRTEDGE.ELM") returned -1
	[0043.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STRTEDGE.ELM") returned -1
	[0043.836] lstrcmpiA (lpString1="", lpString2="STRTEDGE.ELM") returned -1
	[0043.837] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\"
	[0043.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned=""
	[0043.837] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt"
	[0043.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0x20
	[0043.837] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="STRTEDGE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM"
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.zip") returned 0
	[0043.837] lstrlenA (lpString="*.zip") returned 5
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.rar") returned 0
	[0043.837] lstrlenA (lpString="*.rar") returned 5
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.7z") returned 0
	[0043.837] lstrlenA (lpString="*.7z") returned 4
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.tar") returned 0
	[0043.837] lstrlenA (lpString="*.tar") returned 5
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.gzip") returned 0
	[0043.837] lstrlenA (lpString="*.gzip") returned 6
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.jpg") returned 0
	[0043.837] lstrlenA (lpString="*.jpg") returned 5
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.jpeg") returned 0
	[0043.837] lstrlenA (lpString="*.jpeg") returned 6
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.psd") returned 0
	[0043.837] lstrlenA (lpString="*.psd") returned 5
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.cdr") returned 0
	[0043.837] lstrlenA (lpString="*.cdr") returned 5
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.dwg") returned 0
	[0043.837] lstrlenA (lpString="*.dwg") returned 5
	[0043.837] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.max") returned 0
	[0043.837] lstrlenA (lpString="*.max") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.bmp") returned 0
	[0043.838] lstrlenA (lpString="*.bmp") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.gif") returned 0
	[0043.838] lstrlenA (lpString="*.gif") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.png") returned 0
	[0043.838] lstrlenA (lpString="*.png") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.doc") returned 0
	[0043.838] lstrlenA (lpString="*.doc") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.docx") returned 0
	[0043.838] lstrlenA (lpString="*.docx") returned 6
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.xls") returned 0
	[0043.838] lstrlenA (lpString="*.xls") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.xlsx") returned 0
	[0043.838] lstrlenA (lpString="*.xlsx") returned 6
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.ppt") returned 0
	[0043.838] lstrlenA (lpString="*.ppt") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.pptx") returned 0
	[0043.838] lstrlenA (lpString="*.pptx") returned 6
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.txt") returned 0
	[0043.838] lstrlenA (lpString="*.txt") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.pdf") returned 0
	[0043.838] lstrlenA (lpString="*.pdf") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.djvu") returned 0
	[0043.838] lstrlenA (lpString="*.djvu") returned 6
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.htm") returned 0
	[0043.838] lstrlenA (lpString="*.htm") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.html") returned 0
	[0043.838] lstrlenA (lpString="*.html") returned 6
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mdb") returned 0
	[0043.838] lstrlenA (lpString="*.mdb") returned 5
	[0043.838] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.cer") returned 0
	[0043.838] lstrlenA (lpString="*.cer") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.p12") returned 0
	[0043.839] lstrlenA (lpString="*.p12") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.pfx") returned 0
	[0043.839] lstrlenA (lpString="*.pfx") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.kwm") returned 0
	[0043.839] lstrlenA (lpString="*.kwm") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.pwm") returned 0
	[0043.839] lstrlenA (lpString="*.pwm") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.1cd") returned 0
	[0043.839] lstrlenA (lpString="*.1cd") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.md") returned 0
	[0043.839] lstrlenA (lpString="*.md") returned 4
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mdf") returned 0
	[0043.839] lstrlenA (lpString="*.mdf") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.dbf") returned 0
	[0043.839] lstrlenA (lpString="*.dbf") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.odt") returned 0
	[0043.839] lstrlenA (lpString="*.odt") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.vob") returned 0
	[0043.839] lstrlenA (lpString="*.vob") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.ifo") returned 0
	[0043.839] lstrlenA (lpString="*.ifo") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.lnk") returned 0
	[0043.839] lstrlenA (lpString="*.lnk") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.torrent") returned 0
	[0043.839] lstrlenA (lpString="*.torrent") returned 9
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mov") returned 0
	[0043.839] lstrlenA (lpString="*.mov") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.m2v") returned 0
	[0043.839] lstrlenA (lpString="*.m2v") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.3gp") returned 0
	[0043.839] lstrlenA (lpString="*.3gp") returned 5
	[0043.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mpeg") returned 0
	[0043.840] lstrlenA (lpString="*.mpeg") returned 6
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mpg") returned 0
	[0043.840] lstrlenA (lpString="*.mpg") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.flv") returned 0
	[0043.840] lstrlenA (lpString="*.flv") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.avi") returned 0
	[0043.840] lstrlenA (lpString="*.avi") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mp4") returned 0
	[0043.840] lstrlenA (lpString="*.mp4") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.wmv") returned 0
	[0043.840] lstrlenA (lpString="*.wmv") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.divx") returned 0
	[0043.840] lstrlenA (lpString="*.divx") returned 6
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mkv") returned 0
	[0043.840] lstrlenA (lpString="*.mkv") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mp3") returned 0
	[0043.840] lstrlenA (lpString="*.mp3") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.wav") returned 0
	[0043.840] lstrlenA (lpString="*.wav") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.flac") returned 0
	[0043.840] lstrlenA (lpString="*.flac") returned 6
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.ape") returned 0
	[0043.840] lstrlenA (lpString="*.ape") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.wma") returned 0
	[0043.840] lstrlenA (lpString="*.wma") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.ac3") returned 0
	[0043.840] lstrlenA (lpString="*.ac3") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.exe") returned 0
	[0043.840] lstrlenA (lpString="*.exe") returned 5
	[0043.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.apk") returned 0
	[0043.840] lstrlenA (lpString="*.apk") returned 5
	[0043.840] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STRTEDGE.INF") returned -1
	[0043.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STRTEDGE.INF") returned -1
	[0043.841] lstrcmpiA (lpString1="", lpString2="STRTEDGE.INF") returned -1
	[0043.841] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned="STRTEDGE.ELM"
	[0043.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\"
	[0043.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned=""
	[0043.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt"
	[0043.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0x20
	[0043.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="STRTEDGE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF"
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.zip") returned 0
	[0043.841] lstrlenA (lpString="*.zip") returned 5
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.rar") returned 0
	[0043.841] lstrlenA (lpString="*.rar") returned 5
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.7z") returned 0
	[0043.841] lstrlenA (lpString="*.7z") returned 4
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.tar") returned 0
	[0043.841] lstrlenA (lpString="*.tar") returned 5
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.gzip") returned 0
	[0043.841] lstrlenA (lpString="*.gzip") returned 6
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.jpg") returned 0
	[0043.841] lstrlenA (lpString="*.jpg") returned 5
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.jpeg") returned 0
	[0043.841] lstrlenA (lpString="*.jpeg") returned 6
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.psd") returned 0
	[0043.841] lstrlenA (lpString="*.psd") returned 5
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.cdr") returned 0
	[0043.841] lstrlenA (lpString="*.cdr") returned 5
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.dwg") returned 0
	[0043.841] lstrlenA (lpString="*.dwg") returned 5
	[0043.841] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.max") returned 0
	[0043.841] lstrlenA (lpString="*.max") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.bmp") returned 0
	[0043.842] lstrlenA (lpString="*.bmp") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.gif") returned 0
	[0043.842] lstrlenA (lpString="*.gif") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.png") returned 0
	[0043.842] lstrlenA (lpString="*.png") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.doc") returned 0
	[0043.842] lstrlenA (lpString="*.doc") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.docx") returned 0
	[0043.842] lstrlenA (lpString="*.docx") returned 6
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.xls") returned 0
	[0043.842] lstrlenA (lpString="*.xls") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.xlsx") returned 0
	[0043.842] lstrlenA (lpString="*.xlsx") returned 6
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.ppt") returned 0
	[0043.842] lstrlenA (lpString="*.ppt") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.pptx") returned 0
	[0043.842] lstrlenA (lpString="*.pptx") returned 6
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.txt") returned 0
	[0043.842] lstrlenA (lpString="*.txt") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.pdf") returned 0
	[0043.842] lstrlenA (lpString="*.pdf") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.djvu") returned 0
	[0043.842] lstrlenA (lpString="*.djvu") returned 6
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.htm") returned 0
	[0043.842] lstrlenA (lpString="*.htm") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.html") returned 0
	[0043.842] lstrlenA (lpString="*.html") returned 6
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mdb") returned 0
	[0043.842] lstrlenA (lpString="*.mdb") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.cer") returned 0
	[0043.842] lstrlenA (lpString="*.cer") returned 5
	[0043.842] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.p12") returned 0
	[0043.843] lstrlenA (lpString="*.p12") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.pfx") returned 0
	[0043.843] lstrlenA (lpString="*.pfx") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.kwm") returned 0
	[0043.843] lstrlenA (lpString="*.kwm") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.pwm") returned 0
	[0043.843] lstrlenA (lpString="*.pwm") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.1cd") returned 0
	[0043.843] lstrlenA (lpString="*.1cd") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.md") returned 0
	[0043.843] lstrlenA (lpString="*.md") returned 4
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mdf") returned 0
	[0043.843] lstrlenA (lpString="*.mdf") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.dbf") returned 0
	[0043.843] lstrlenA (lpString="*.dbf") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.odt") returned 0
	[0043.843] lstrlenA (lpString="*.odt") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.vob") returned 0
	[0043.843] lstrlenA (lpString="*.vob") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.ifo") returned 0
	[0043.843] lstrlenA (lpString="*.ifo") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.lnk") returned 0
	[0043.843] lstrlenA (lpString="*.lnk") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.torrent") returned 0
	[0043.843] lstrlenA (lpString="*.torrent") returned 9
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mov") returned 0
	[0043.843] lstrlenA (lpString="*.mov") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.m2v") returned 0
	[0043.843] lstrlenA (lpString="*.m2v") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.3gp") returned 0
	[0043.843] lstrlenA (lpString="*.3gp") returned 5
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mpeg") returned 0
	[0043.843] lstrlenA (lpString="*.mpeg") returned 6
	[0043.843] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mpg") returned 0
	[0043.844] lstrlenA (lpString="*.mpg") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.flv") returned 0
	[0043.844] lstrlenA (lpString="*.flv") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.avi") returned 0
	[0043.844] lstrlenA (lpString="*.avi") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mp4") returned 0
	[0043.844] lstrlenA (lpString="*.mp4") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.wmv") returned 0
	[0043.844] lstrlenA (lpString="*.wmv") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.divx") returned 0
	[0043.844] lstrlenA (lpString="*.divx") returned 6
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mkv") returned 0
	[0043.844] lstrlenA (lpString="*.mkv") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mp3") returned 0
	[0043.844] lstrlenA (lpString="*.mp3") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.wav") returned 0
	[0043.844] lstrlenA (lpString="*.wav") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.flac") returned 0
	[0043.844] lstrlenA (lpString="*.flac") returned 6
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.ape") returned 0
	[0043.844] lstrlenA (lpString="*.ape") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.wma") returned 0
	[0043.844] lstrlenA (lpString="*.wma") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.ac3") returned 0
	[0043.844] lstrlenA (lpString="*.ac3") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.exe") returned 0
	[0043.844] lstrlenA (lpString="*.exe") returned 5
	[0043.844] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.apk") returned 0
	[0043.844] lstrlenA (lpString="*.apk") returned 5
	[0043.844] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.844] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0043.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0043.845] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0043.845] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned="STRTEDGE.INF"
	[0043.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\"
	[0043.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned=""
	[0043.845] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt"
	[0043.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0x20
	[0043.845] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG"
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0043.845] lstrlenA (lpString="*.zip") returned 5
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0043.845] lstrlenA (lpString="*.rar") returned 5
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0043.845] lstrlenA (lpString="*.7z") returned 4
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0043.845] lstrlenA (lpString="*.tar") returned 5
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0043.845] lstrlenA (lpString="*.gzip") returned 6
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0043.845] lstrlenA (lpString="*.jpg") returned 5
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0043.845] lstrlenA (lpString="*.jpeg") returned 6
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0043.845] lstrlenA (lpString="*.psd") returned 5
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0043.845] lstrlenA (lpString="*.cdr") returned 5
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0043.845] lstrlenA (lpString="*.dwg") returned 5
	[0043.845] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0043.846] lstrlenA (lpString="*.max") returned 5
	[0043.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0043.846] lstrlenA (lpString="*.bmp") returned 5
	[0043.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0043.846] lstrlenA (lpString="*.gif") returned 5
	[0043.846] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0043.846] lstrlenA (lpString="*.png") returned 5
	[0043.846] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG"
	[0043.846] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG"
	[0043.846] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG."
	[0043.846] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.Boom"
	[0043.846] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.847] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82c7
	[0043.847] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.847] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.848] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x82a4, lpOverlapped=0x0) returned 1
	[0043.860] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0043.860] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.860] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x82a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x82a4, lpOverlapped=0x0) returned 1
	[0043.861] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.861] CloseHandle (hObject=0x90) returned 1
	[0043.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.boom")) returned 1
	[0043.862] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0043.863] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0043.863] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0043.863] lstrcmpA (lpString1=".", lpString2="STUDIO") returned -1
	[0043.863] lstrcmpA (lpString1="..", lpString2="STUDIO") returned -1
	[0043.863] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0043.863] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="STUDIO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO"
	[0043.863] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO") returned 62
	[0043.863] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0043.863] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0043.863] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.863] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0043.864] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0043.864] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.864] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.864] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0043.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0043.864] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0043.864] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*") returned="*.*"
	[0043.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\"
	[0043.864] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned=""
	[0043.864] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt"
	[0043.864] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0xffffffff
	[0043.864] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.864] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0043.864] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0043.865] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0043.866] CloseHandle (hObject=0x90) returned 1
	[0043.866] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF"
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0043.866] lstrlenA (lpString="*.zip") returned 5
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0043.866] lstrlenA (lpString="*.rar") returned 5
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0043.866] lstrlenA (lpString="*.7z") returned 4
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0043.866] lstrlenA (lpString="*.tar") returned 5
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0043.866] lstrlenA (lpString="*.gzip") returned 6
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0043.866] lstrlenA (lpString="*.jpg") returned 5
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0043.866] lstrlenA (lpString="*.jpeg") returned 6
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0043.866] lstrlenA (lpString="*.psd") returned 5
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0043.866] lstrlenA (lpString="*.cdr") returned 5
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0043.866] lstrlenA (lpString="*.dwg") returned 5
	[0043.866] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0043.867] lstrlenA (lpString="*.max") returned 5
	[0043.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0043.867] lstrlenA (lpString="*.bmp") returned 5
	[0043.867] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0043.867] lstrlenA (lpString="*.gif") returned 5
	[0043.867] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF"
	[0043.867] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF"
	[0043.867] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF."
	[0043.867] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.Boom"
	[0043.867] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.868] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68b
	[0043.868] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.868] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.868] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x668, lpOverlapped=0x0) returned 1
	[0043.886] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.886] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.886] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x668, lpOverlapped=0x0) returned 1
	[0043.886] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.886] CloseHandle (hObject=0x90) returned 1
	[0043.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.boom")) returned 1
	[0043.889] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.889] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.889] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STUDIO.ELM") returned -1
	[0043.889] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STUDIO.ELM") returned -1
	[0043.889] lstrcmpiA (lpString1="", lpString2="STUDIO.ELM") returned -1
	[0043.889] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\"
	[0043.890] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned=""
	[0043.890] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt"
	[0043.890] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0x20
	[0043.890] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="STUDIO.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM"
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.zip") returned 0
	[0043.890] lstrlenA (lpString="*.zip") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.rar") returned 0
	[0043.890] lstrlenA (lpString="*.rar") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.7z") returned 0
	[0043.890] lstrlenA (lpString="*.7z") returned 4
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.tar") returned 0
	[0043.890] lstrlenA (lpString="*.tar") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.gzip") returned 0
	[0043.890] lstrlenA (lpString="*.gzip") returned 6
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.jpg") returned 0
	[0043.890] lstrlenA (lpString="*.jpg") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.jpeg") returned 0
	[0043.890] lstrlenA (lpString="*.jpeg") returned 6
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.psd") returned 0
	[0043.890] lstrlenA (lpString="*.psd") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.cdr") returned 0
	[0043.890] lstrlenA (lpString="*.cdr") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.dwg") returned 0
	[0043.890] lstrlenA (lpString="*.dwg") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.max") returned 0
	[0043.890] lstrlenA (lpString="*.max") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.bmp") returned 0
	[0043.890] lstrlenA (lpString="*.bmp") returned 5
	[0043.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.gif") returned 0
	[0043.891] lstrlenA (lpString="*.gif") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.png") returned 0
	[0043.891] lstrlenA (lpString="*.png") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.doc") returned 0
	[0043.891] lstrlenA (lpString="*.doc") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.docx") returned 0
	[0043.891] lstrlenA (lpString="*.docx") returned 6
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.xls") returned 0
	[0043.891] lstrlenA (lpString="*.xls") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.xlsx") returned 0
	[0043.891] lstrlenA (lpString="*.xlsx") returned 6
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.ppt") returned 0
	[0043.891] lstrlenA (lpString="*.ppt") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.pptx") returned 0
	[0043.891] lstrlenA (lpString="*.pptx") returned 6
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.txt") returned 0
	[0043.891] lstrlenA (lpString="*.txt") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.pdf") returned 0
	[0043.891] lstrlenA (lpString="*.pdf") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.djvu") returned 0
	[0043.891] lstrlenA (lpString="*.djvu") returned 6
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.htm") returned 0
	[0043.891] lstrlenA (lpString="*.htm") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.html") returned 0
	[0043.891] lstrlenA (lpString="*.html") returned 6
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mdb") returned 0
	[0043.891] lstrlenA (lpString="*.mdb") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.cer") returned 0
	[0043.891] lstrlenA (lpString="*.cer") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.p12") returned 0
	[0043.891] lstrlenA (lpString="*.p12") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.pfx") returned 0
	[0043.891] lstrlenA (lpString="*.pfx") returned 5
	[0043.891] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.kwm") returned 0
	[0043.892] lstrlenA (lpString="*.kwm") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.pwm") returned 0
	[0043.892] lstrlenA (lpString="*.pwm") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.1cd") returned 0
	[0043.892] lstrlenA (lpString="*.1cd") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.md") returned 0
	[0043.892] lstrlenA (lpString="*.md") returned 4
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mdf") returned 0
	[0043.892] lstrlenA (lpString="*.mdf") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.dbf") returned 0
	[0043.892] lstrlenA (lpString="*.dbf") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.odt") returned 0
	[0043.892] lstrlenA (lpString="*.odt") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.vob") returned 0
	[0043.892] lstrlenA (lpString="*.vob") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.ifo") returned 0
	[0043.892] lstrlenA (lpString="*.ifo") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.lnk") returned 0
	[0043.892] lstrlenA (lpString="*.lnk") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.torrent") returned 0
	[0043.892] lstrlenA (lpString="*.torrent") returned 9
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mov") returned 0
	[0043.892] lstrlenA (lpString="*.mov") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.m2v") returned 0
	[0043.892] lstrlenA (lpString="*.m2v") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.3gp") returned 0
	[0043.892] lstrlenA (lpString="*.3gp") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mpeg") returned 0
	[0043.892] lstrlenA (lpString="*.mpeg") returned 6
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mpg") returned 0
	[0043.892] lstrlenA (lpString="*.mpg") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.flv") returned 0
	[0043.892] lstrlenA (lpString="*.flv") returned 5
	[0043.892] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.avi") returned 0
	[0043.892] lstrlenA (lpString="*.avi") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mp4") returned 0
	[0043.893] lstrlenA (lpString="*.mp4") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.wmv") returned 0
	[0043.893] lstrlenA (lpString="*.wmv") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.divx") returned 0
	[0043.893] lstrlenA (lpString="*.divx") returned 6
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mkv") returned 0
	[0043.893] lstrlenA (lpString="*.mkv") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mp3") returned 0
	[0043.893] lstrlenA (lpString="*.mp3") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.wav") returned 0
	[0043.893] lstrlenA (lpString="*.wav") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.flac") returned 0
	[0043.893] lstrlenA (lpString="*.flac") returned 6
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.ape") returned 0
	[0043.893] lstrlenA (lpString="*.ape") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.wma") returned 0
	[0043.893] lstrlenA (lpString="*.wma") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.ac3") returned 0
	[0043.893] lstrlenA (lpString="*.ac3") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.exe") returned 0
	[0043.893] lstrlenA (lpString="*.exe") returned 5
	[0043.893] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.apk") returned 0
	[0043.893] lstrlenA (lpString="*.apk") returned 5
	[0043.893] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.893] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.893] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STUDIO.INF") returned -1
	[0043.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STUDIO.INF") returned -1
	[0043.893] lstrcmpiA (lpString1="", lpString2="STUDIO.INF") returned -1
	[0043.893] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned="STUDIO.ELM"
	[0043.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\"
	[0043.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned=""
	[0043.893] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt"
	[0043.894] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0x20
	[0043.894] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="STUDIO.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF"
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.zip") returned 0
	[0043.894] lstrlenA (lpString="*.zip") returned 5
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.rar") returned 0
	[0043.894] lstrlenA (lpString="*.rar") returned 5
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.7z") returned 0
	[0043.894] lstrlenA (lpString="*.7z") returned 4
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.tar") returned 0
	[0043.894] lstrlenA (lpString="*.tar") returned 5
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.gzip") returned 0
	[0043.894] lstrlenA (lpString="*.gzip") returned 6
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.jpg") returned 0
	[0043.894] lstrlenA (lpString="*.jpg") returned 5
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.jpeg") returned 0
	[0043.894] lstrlenA (lpString="*.jpeg") returned 6
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.psd") returned 0
	[0043.894] lstrlenA (lpString="*.psd") returned 5
	[0043.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.cdr") returned 0
	[0043.895] lstrlenA (lpString="*.cdr") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.dwg") returned 0
	[0043.895] lstrlenA (lpString="*.dwg") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.max") returned 0
	[0043.895] lstrlenA (lpString="*.max") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.bmp") returned 0
	[0043.895] lstrlenA (lpString="*.bmp") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.gif") returned 0
	[0043.895] lstrlenA (lpString="*.gif") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.png") returned 0
	[0043.895] lstrlenA (lpString="*.png") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.doc") returned 0
	[0043.895] lstrlenA (lpString="*.doc") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.docx") returned 0
	[0043.895] lstrlenA (lpString="*.docx") returned 6
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.xls") returned 0
	[0043.895] lstrlenA (lpString="*.xls") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.xlsx") returned 0
	[0043.895] lstrlenA (lpString="*.xlsx") returned 6
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.ppt") returned 0
	[0043.895] lstrlenA (lpString="*.ppt") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.pptx") returned 0
	[0043.895] lstrlenA (lpString="*.pptx") returned 6
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.txt") returned 0
	[0043.895] lstrlenA (lpString="*.txt") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.pdf") returned 0
	[0043.895] lstrlenA (lpString="*.pdf") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.djvu") returned 0
	[0043.895] lstrlenA (lpString="*.djvu") returned 6
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.htm") returned 0
	[0043.895] lstrlenA (lpString="*.htm") returned 5
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.html") returned 0
	[0043.895] lstrlenA (lpString="*.html") returned 6
	[0043.895] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mdb") returned 0
	[0043.896] lstrlenA (lpString="*.mdb") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.cer") returned 0
	[0043.896] lstrlenA (lpString="*.cer") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.p12") returned 0
	[0043.896] lstrlenA (lpString="*.p12") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.pfx") returned 0
	[0043.896] lstrlenA (lpString="*.pfx") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.kwm") returned 0
	[0043.896] lstrlenA (lpString="*.kwm") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.pwm") returned 0
	[0043.896] lstrlenA (lpString="*.pwm") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.1cd") returned 0
	[0043.896] lstrlenA (lpString="*.1cd") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.md") returned 0
	[0043.896] lstrlenA (lpString="*.md") returned 4
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mdf") returned 0
	[0043.896] lstrlenA (lpString="*.mdf") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.dbf") returned 0
	[0043.896] lstrlenA (lpString="*.dbf") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.odt") returned 0
	[0043.896] lstrlenA (lpString="*.odt") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.vob") returned 0
	[0043.896] lstrlenA (lpString="*.vob") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.ifo") returned 0
	[0043.896] lstrlenA (lpString="*.ifo") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.lnk") returned 0
	[0043.896] lstrlenA (lpString="*.lnk") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.torrent") returned 0
	[0043.896] lstrlenA (lpString="*.torrent") returned 9
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mov") returned 0
	[0043.896] lstrlenA (lpString="*.mov") returned 5
	[0043.896] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.m2v") returned 0
	[0043.896] lstrlenA (lpString="*.m2v") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.3gp") returned 0
	[0043.897] lstrlenA (lpString="*.3gp") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mpeg") returned 0
	[0043.897] lstrlenA (lpString="*.mpeg") returned 6
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mpg") returned 0
	[0043.897] lstrlenA (lpString="*.mpg") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.flv") returned 0
	[0043.897] lstrlenA (lpString="*.flv") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.avi") returned 0
	[0043.897] lstrlenA (lpString="*.avi") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mp4") returned 0
	[0043.897] lstrlenA (lpString="*.mp4") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.wmv") returned 0
	[0043.897] lstrlenA (lpString="*.wmv") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.divx") returned 0
	[0043.897] lstrlenA (lpString="*.divx") returned 6
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mkv") returned 0
	[0043.897] lstrlenA (lpString="*.mkv") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mp3") returned 0
	[0043.897] lstrlenA (lpString="*.mp3") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.wav") returned 0
	[0043.897] lstrlenA (lpString="*.wav") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.flac") returned 0
	[0043.897] lstrlenA (lpString="*.flac") returned 6
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.ape") returned 0
	[0043.897] lstrlenA (lpString="*.ape") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.wma") returned 0
	[0043.897] lstrlenA (lpString="*.wma") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.ac3") returned 0
	[0043.897] lstrlenA (lpString="*.ac3") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.exe") returned 0
	[0043.897] lstrlenA (lpString="*.exe") returned 5
	[0043.897] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.apk") returned 0
	[0043.897] lstrlenA (lpString="*.apk") returned 5
	[0043.897] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.898] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0043.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0043.898] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0043.898] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned="STUDIO.INF"
	[0043.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\"
	[0043.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned=""
	[0043.898] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt"
	[0043.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0x20
	[0043.898] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG"
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0043.898] lstrlenA (lpString="*.zip") returned 5
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0043.898] lstrlenA (lpString="*.rar") returned 5
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0043.898] lstrlenA (lpString="*.7z") returned 4
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0043.898] lstrlenA (lpString="*.tar") returned 5
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0043.898] lstrlenA (lpString="*.gzip") returned 6
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0043.898] lstrlenA (lpString="*.jpg") returned 5
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0043.898] lstrlenA (lpString="*.jpeg") returned 6
	[0043.898] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0043.898] lstrlenA (lpString="*.psd") returned 5
	[0043.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0043.899] lstrlenA (lpString="*.cdr") returned 5
	[0043.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0043.899] lstrlenA (lpString="*.dwg") returned 5
	[0043.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0043.899] lstrlenA (lpString="*.max") returned 5
	[0043.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0043.899] lstrlenA (lpString="*.bmp") returned 5
	[0043.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0043.899] lstrlenA (lpString="*.gif") returned 5
	[0043.899] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0043.899] lstrlenA (lpString="*.png") returned 5
	[0043.899] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG"
	[0043.899] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG"
	[0043.899] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG."
	[0043.899] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.Boom"
	[0043.899] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.899] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47cc
	[0043.899] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d4d5410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.900] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.900] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x47a9, lpOverlapped=0x0) returned 1
	[0043.913] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0043.913] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.913] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x47a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x47a9, lpOverlapped=0x0) returned 1
	[0043.913] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.913] CloseHandle (hObject=0x90) returned 1
	[0043.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.boom")) returned 1
	[0043.915] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0043.915] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0043.915] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0043.915] lstrcmpA (lpString1=".", lpString2="SUMIPNTG") returned -1
	[0043.915] lstrcmpA (lpString1="..", lpString2="SUMIPNTG") returned -1
	[0043.915] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0043.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SUMIPNTG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG"
	[0043.915] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG") returned 64
	[0043.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0043.916] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0043.916] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.916] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0043.916] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0043.916] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.916] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0043.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0043.916] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0043.916] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*") returned="*.*"
	[0043.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\"
	[0043.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned=""
	[0043.916] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt"
	[0043.916] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0xffffffff
	[0043.916] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.918] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0043.918] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0043.919] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0043.919] CloseHandle (hObject=0x90) returned 1
	[0043.919] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF"
	[0043.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0043.919] lstrlenA (lpString="*.zip") returned 5
	[0043.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0043.919] lstrlenA (lpString="*.rar") returned 5
	[0043.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0043.919] lstrlenA (lpString="*.7z") returned 4
	[0043.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0043.919] lstrlenA (lpString="*.tar") returned 5
	[0043.919] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0043.919] lstrlenA (lpString="*.gzip") returned 6
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0043.920] lstrlenA (lpString="*.jpg") returned 5
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0043.920] lstrlenA (lpString="*.jpeg") returned 6
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0043.920] lstrlenA (lpString="*.psd") returned 5
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0043.920] lstrlenA (lpString="*.cdr") returned 5
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0043.920] lstrlenA (lpString="*.dwg") returned 5
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0043.920] lstrlenA (lpString="*.max") returned 5
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0043.920] lstrlenA (lpString="*.bmp") returned 5
	[0043.920] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0043.920] lstrlenA (lpString="*.gif") returned 5
	[0043.920] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF"
	[0043.920] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF"
	[0043.920] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF."
	[0043.920] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.Boom"
	[0043.920] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.921] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x137f
	[0043.921] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.921] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.921] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x135c, lpOverlapped=0x0) returned 1
	[0043.942] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.942] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.942] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x135c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x135c, lpOverlapped=0x0) returned 1
	[0043.943] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.943] CloseHandle (hObject=0x90) returned 1
	[0043.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.boom")) returned 1
	[0043.944] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.944] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.944] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUMIPNTG.ELM") returned -1
	[0043.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUMIPNTG.ELM") returned -1
	[0043.944] lstrcmpiA (lpString1="", lpString2="SUMIPNTG.ELM") returned -1
	[0043.944] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\"
	[0043.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned=""
	[0043.945] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt"
	[0043.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0x20
	[0043.945] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="SUMIPNTG.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM"
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.zip") returned 0
	[0043.945] lstrlenA (lpString="*.zip") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.rar") returned 0
	[0043.945] lstrlenA (lpString="*.rar") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.7z") returned 0
	[0043.945] lstrlenA (lpString="*.7z") returned 4
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.tar") returned 0
	[0043.945] lstrlenA (lpString="*.tar") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.gzip") returned 0
	[0043.945] lstrlenA (lpString="*.gzip") returned 6
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.jpg") returned 0
	[0043.945] lstrlenA (lpString="*.jpg") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.jpeg") returned 0
	[0043.945] lstrlenA (lpString="*.jpeg") returned 6
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.psd") returned 0
	[0043.945] lstrlenA (lpString="*.psd") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.cdr") returned 0
	[0043.945] lstrlenA (lpString="*.cdr") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.dwg") returned 0
	[0043.945] lstrlenA (lpString="*.dwg") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.max") returned 0
	[0043.945] lstrlenA (lpString="*.max") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.bmp") returned 0
	[0043.945] lstrlenA (lpString="*.bmp") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.gif") returned 0
	[0043.945] lstrlenA (lpString="*.gif") returned 5
	[0043.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.png") returned 0
	[0043.946] lstrlenA (lpString="*.png") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.doc") returned 0
	[0043.946] lstrlenA (lpString="*.doc") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.docx") returned 0
	[0043.946] lstrlenA (lpString="*.docx") returned 6
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.xls") returned 0
	[0043.946] lstrlenA (lpString="*.xls") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.xlsx") returned 0
	[0043.946] lstrlenA (lpString="*.xlsx") returned 6
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.ppt") returned 0
	[0043.946] lstrlenA (lpString="*.ppt") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.pptx") returned 0
	[0043.946] lstrlenA (lpString="*.pptx") returned 6
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.txt") returned 0
	[0043.946] lstrlenA (lpString="*.txt") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.pdf") returned 0
	[0043.946] lstrlenA (lpString="*.pdf") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.djvu") returned 0
	[0043.946] lstrlenA (lpString="*.djvu") returned 6
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.htm") returned 0
	[0043.946] lstrlenA (lpString="*.htm") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.html") returned 0
	[0043.946] lstrlenA (lpString="*.html") returned 6
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mdb") returned 0
	[0043.946] lstrlenA (lpString="*.mdb") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.cer") returned 0
	[0043.946] lstrlenA (lpString="*.cer") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.p12") returned 0
	[0043.946] lstrlenA (lpString="*.p12") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.pfx") returned 0
	[0043.946] lstrlenA (lpString="*.pfx") returned 5
	[0043.946] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.kwm") returned 0
	[0043.946] lstrlenA (lpString="*.kwm") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.pwm") returned 0
	[0043.947] lstrlenA (lpString="*.pwm") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.1cd") returned 0
	[0043.947] lstrlenA (lpString="*.1cd") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.md") returned 0
	[0043.947] lstrlenA (lpString="*.md") returned 4
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mdf") returned 0
	[0043.947] lstrlenA (lpString="*.mdf") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.dbf") returned 0
	[0043.947] lstrlenA (lpString="*.dbf") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.odt") returned 0
	[0043.947] lstrlenA (lpString="*.odt") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.vob") returned 0
	[0043.947] lstrlenA (lpString="*.vob") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.ifo") returned 0
	[0043.947] lstrlenA (lpString="*.ifo") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.lnk") returned 0
	[0043.947] lstrlenA (lpString="*.lnk") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.torrent") returned 0
	[0043.947] lstrlenA (lpString="*.torrent") returned 9
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mov") returned 0
	[0043.947] lstrlenA (lpString="*.mov") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.m2v") returned 0
	[0043.947] lstrlenA (lpString="*.m2v") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.3gp") returned 0
	[0043.947] lstrlenA (lpString="*.3gp") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mpeg") returned 0
	[0043.947] lstrlenA (lpString="*.mpeg") returned 6
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mpg") returned 0
	[0043.947] lstrlenA (lpString="*.mpg") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.flv") returned 0
	[0043.947] lstrlenA (lpString="*.flv") returned 5
	[0043.947] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.avi") returned 0
	[0043.948] lstrlenA (lpString="*.avi") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mp4") returned 0
	[0043.948] lstrlenA (lpString="*.mp4") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.wmv") returned 0
	[0043.948] lstrlenA (lpString="*.wmv") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.divx") returned 0
	[0043.948] lstrlenA (lpString="*.divx") returned 6
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mkv") returned 0
	[0043.948] lstrlenA (lpString="*.mkv") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mp3") returned 0
	[0043.948] lstrlenA (lpString="*.mp3") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.wav") returned 0
	[0043.948] lstrlenA (lpString="*.wav") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.flac") returned 0
	[0043.948] lstrlenA (lpString="*.flac") returned 6
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.ape") returned 0
	[0043.948] lstrlenA (lpString="*.ape") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.wma") returned 0
	[0043.948] lstrlenA (lpString="*.wma") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.ac3") returned 0
	[0043.948] lstrlenA (lpString="*.ac3") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.exe") returned 0
	[0043.948] lstrlenA (lpString="*.exe") returned 5
	[0043.948] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.apk") returned 0
	[0043.948] lstrlenA (lpString="*.apk") returned 5
	[0043.948] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.948] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.948] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUMIPNTG.INF") returned -1
	[0043.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUMIPNTG.INF") returned -1
	[0043.948] lstrcmpiA (lpString1="", lpString2="SUMIPNTG.INF") returned -1
	[0043.948] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned="SUMIPNTG.ELM"
	[0043.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\"
	[0043.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned=""
	[0043.949] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt"
	[0043.949] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0x20
	[0043.949] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="SUMIPNTG.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF"
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.zip") returned 0
	[0043.949] lstrlenA (lpString="*.zip") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.rar") returned 0
	[0043.949] lstrlenA (lpString="*.rar") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.7z") returned 0
	[0043.949] lstrlenA (lpString="*.7z") returned 4
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.tar") returned 0
	[0043.949] lstrlenA (lpString="*.tar") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.gzip") returned 0
	[0043.949] lstrlenA (lpString="*.gzip") returned 6
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.jpg") returned 0
	[0043.949] lstrlenA (lpString="*.jpg") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.jpeg") returned 0
	[0043.949] lstrlenA (lpString="*.jpeg") returned 6
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.psd") returned 0
	[0043.949] lstrlenA (lpString="*.psd") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.cdr") returned 0
	[0043.949] lstrlenA (lpString="*.cdr") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.dwg") returned 0
	[0043.949] lstrlenA (lpString="*.dwg") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.max") returned 0
	[0043.949] lstrlenA (lpString="*.max") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.bmp") returned 0
	[0043.949] lstrlenA (lpString="*.bmp") returned 5
	[0043.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.gif") returned 0
	[0043.950] lstrlenA (lpString="*.gif") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.png") returned 0
	[0043.950] lstrlenA (lpString="*.png") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.doc") returned 0
	[0043.950] lstrlenA (lpString="*.doc") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.docx") returned 0
	[0043.950] lstrlenA (lpString="*.docx") returned 6
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.xls") returned 0
	[0043.950] lstrlenA (lpString="*.xls") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.xlsx") returned 0
	[0043.950] lstrlenA (lpString="*.xlsx") returned 6
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.ppt") returned 0
	[0043.950] lstrlenA (lpString="*.ppt") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.pptx") returned 0
	[0043.950] lstrlenA (lpString="*.pptx") returned 6
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.txt") returned 0
	[0043.950] lstrlenA (lpString="*.txt") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.pdf") returned 0
	[0043.950] lstrlenA (lpString="*.pdf") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.djvu") returned 0
	[0043.950] lstrlenA (lpString="*.djvu") returned 6
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.htm") returned 0
	[0043.950] lstrlenA (lpString="*.htm") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.html") returned 0
	[0043.950] lstrlenA (lpString="*.html") returned 6
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mdb") returned 0
	[0043.950] lstrlenA (lpString="*.mdb") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.cer") returned 0
	[0043.950] lstrlenA (lpString="*.cer") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.p12") returned 0
	[0043.950] lstrlenA (lpString="*.p12") returned 5
	[0043.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.pfx") returned 0
	[0043.951] lstrlenA (lpString="*.pfx") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.kwm") returned 0
	[0043.951] lstrlenA (lpString="*.kwm") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.pwm") returned 0
	[0043.951] lstrlenA (lpString="*.pwm") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.1cd") returned 0
	[0043.951] lstrlenA (lpString="*.1cd") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.md") returned 0
	[0043.951] lstrlenA (lpString="*.md") returned 4
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mdf") returned 0
	[0043.951] lstrlenA (lpString="*.mdf") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.dbf") returned 0
	[0043.951] lstrlenA (lpString="*.dbf") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.odt") returned 0
	[0043.951] lstrlenA (lpString="*.odt") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.vob") returned 0
	[0043.951] lstrlenA (lpString="*.vob") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.ifo") returned 0
	[0043.951] lstrlenA (lpString="*.ifo") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.lnk") returned 0
	[0043.951] lstrlenA (lpString="*.lnk") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.torrent") returned 0
	[0043.951] lstrlenA (lpString="*.torrent") returned 9
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mov") returned 0
	[0043.951] lstrlenA (lpString="*.mov") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.m2v") returned 0
	[0043.951] lstrlenA (lpString="*.m2v") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.3gp") returned 0
	[0043.951] lstrlenA (lpString="*.3gp") returned 5
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mpeg") returned 0
	[0043.951] lstrlenA (lpString="*.mpeg") returned 6
	[0043.951] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mpg") returned 0
	[0043.952] lstrlenA (lpString="*.mpg") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.flv") returned 0
	[0043.952] lstrlenA (lpString="*.flv") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.avi") returned 0
	[0043.952] lstrlenA (lpString="*.avi") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mp4") returned 0
	[0043.952] lstrlenA (lpString="*.mp4") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.wmv") returned 0
	[0043.952] lstrlenA (lpString="*.wmv") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.divx") returned 0
	[0043.952] lstrlenA (lpString="*.divx") returned 6
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mkv") returned 0
	[0043.952] lstrlenA (lpString="*.mkv") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mp3") returned 0
	[0043.952] lstrlenA (lpString="*.mp3") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.wav") returned 0
	[0043.952] lstrlenA (lpString="*.wav") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.flac") returned 0
	[0043.952] lstrlenA (lpString="*.flac") returned 6
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.ape") returned 0
	[0043.952] lstrlenA (lpString="*.ape") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.wma") returned 0
	[0043.952] lstrlenA (lpString="*.wma") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.ac3") returned 0
	[0043.952] lstrlenA (lpString="*.ac3") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.exe") returned 0
	[0043.952] lstrlenA (lpString="*.exe") returned 5
	[0043.952] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.apk") returned 0
	[0043.952] lstrlenA (lpString="*.apk") returned 5
	[0043.952] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.952] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.952] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0043.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0043.952] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0043.952] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned="SUMIPNTG.INF"
	[0043.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\"
	[0043.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned=""
	[0043.953] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt"
	[0043.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0x20
	[0043.953] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG"
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0043.953] lstrlenA (lpString="*.zip") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0043.953] lstrlenA (lpString="*.rar") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0043.953] lstrlenA (lpString="*.7z") returned 4
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0043.953] lstrlenA (lpString="*.tar") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0043.953] lstrlenA (lpString="*.gzip") returned 6
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0043.953] lstrlenA (lpString="*.jpg") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0043.953] lstrlenA (lpString="*.jpeg") returned 6
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0043.953] lstrlenA (lpString="*.psd") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0043.953] lstrlenA (lpString="*.cdr") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0043.953] lstrlenA (lpString="*.dwg") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0043.953] lstrlenA (lpString="*.max") returned 5
	[0043.953] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0043.953] lstrlenA (lpString="*.bmp") returned 5
	[0043.954] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0043.954] lstrlenA (lpString="*.gif") returned 5
	[0043.954] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0043.954] lstrlenA (lpString="*.png") returned 5
	[0043.954] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG"
	[0043.954] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG"
	[0043.954] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG."
	[0043.954] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.Boom"
	[0043.954] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.954] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad0e
	[0043.954] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.954] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.954] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xaceb, lpOverlapped=0x0) returned 1
	[0043.966] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0043.966] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.967] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xaceb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xaceb, lpOverlapped=0x0) returned 1
	[0043.967] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.967] CloseHandle (hObject=0x90) returned 1
	[0043.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.boom")) returned 1
	[0043.969] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0043.969] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0043.969] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0043.969] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0043.969] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THEMES.INF") returned -1
	[0043.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THEMES.INF") returned -1
	[0043.969] lstrcmpiA (lpString1="", lpString2="THEMES.INF") returned -1
	[0043.969] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0043.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\"
	[0043.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\") returned=""
	[0043.969] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt"
	[0043.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how to decrypt files.txt")) returned 0xffffffff
	[0043.969] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0043.970] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0043.970] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0043.971] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0043.971] CloseHandle (hObject=0x8c) returned 1
	[0043.971] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="THEMES.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF"
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.zip") returned 0
	[0043.971] lstrlenA (lpString="*.zip") returned 5
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.rar") returned 0
	[0043.971] lstrlenA (lpString="*.rar") returned 5
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.7z") returned 0
	[0043.971] lstrlenA (lpString="*.7z") returned 4
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.tar") returned 0
	[0043.971] lstrlenA (lpString="*.tar") returned 5
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.gzip") returned 0
	[0043.971] lstrlenA (lpString="*.gzip") returned 6
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.jpg") returned 0
	[0043.971] lstrlenA (lpString="*.jpg") returned 5
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.jpeg") returned 0
	[0043.971] lstrlenA (lpString="*.jpeg") returned 6
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.psd") returned 0
	[0043.971] lstrlenA (lpString="*.psd") returned 5
	[0043.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.cdr") returned 0
	[0043.971] lstrlenA (lpString="*.cdr") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.dwg") returned 0
	[0043.972] lstrlenA (lpString="*.dwg") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.max") returned 0
	[0043.972] lstrlenA (lpString="*.max") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.bmp") returned 0
	[0043.972] lstrlenA (lpString="*.bmp") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.gif") returned 0
	[0043.972] lstrlenA (lpString="*.gif") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.png") returned 0
	[0043.972] lstrlenA (lpString="*.png") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.doc") returned 0
	[0043.972] lstrlenA (lpString="*.doc") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.docx") returned 0
	[0043.972] lstrlenA (lpString="*.docx") returned 6
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.xls") returned 0
	[0043.972] lstrlenA (lpString="*.xls") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.xlsx") returned 0
	[0043.972] lstrlenA (lpString="*.xlsx") returned 6
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ppt") returned 0
	[0043.972] lstrlenA (lpString="*.ppt") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.pptx") returned 0
	[0043.972] lstrlenA (lpString="*.pptx") returned 6
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.txt") returned 0
	[0043.972] lstrlenA (lpString="*.txt") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.pdf") returned 0
	[0043.972] lstrlenA (lpString="*.pdf") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.djvu") returned 0
	[0043.972] lstrlenA (lpString="*.djvu") returned 6
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.htm") returned 0
	[0043.972] lstrlenA (lpString="*.htm") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.html") returned 0
	[0043.972] lstrlenA (lpString="*.html") returned 6
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mdb") returned 0
	[0043.972] lstrlenA (lpString="*.mdb") returned 5
	[0043.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.cer") returned 0
	[0043.973] lstrlenA (lpString="*.cer") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.p12") returned 0
	[0043.973] lstrlenA (lpString="*.p12") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.pfx") returned 0
	[0043.973] lstrlenA (lpString="*.pfx") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.kwm") returned 0
	[0043.973] lstrlenA (lpString="*.kwm") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.pwm") returned 0
	[0043.973] lstrlenA (lpString="*.pwm") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.1cd") returned 0
	[0043.973] lstrlenA (lpString="*.1cd") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.md") returned 0
	[0043.973] lstrlenA (lpString="*.md") returned 4
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mdf") returned 0
	[0043.973] lstrlenA (lpString="*.mdf") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.dbf") returned 0
	[0043.973] lstrlenA (lpString="*.dbf") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.odt") returned 0
	[0043.973] lstrlenA (lpString="*.odt") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.vob") returned 0
	[0043.973] lstrlenA (lpString="*.vob") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ifo") returned 0
	[0043.973] lstrlenA (lpString="*.ifo") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.lnk") returned 0
	[0043.973] lstrlenA (lpString="*.lnk") returned 5
	[0043.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.torrent") returned 0
	[0043.974] lstrlenA (lpString="*.torrent") returned 9
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mov") returned 0
	[0043.974] lstrlenA (lpString="*.mov") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.m2v") returned 0
	[0043.974] lstrlenA (lpString="*.m2v") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.3gp") returned 0
	[0043.974] lstrlenA (lpString="*.3gp") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mpeg") returned 0
	[0043.974] lstrlenA (lpString="*.mpeg") returned 6
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mpg") returned 0
	[0043.974] lstrlenA (lpString="*.mpg") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.flv") returned 0
	[0043.974] lstrlenA (lpString="*.flv") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.avi") returned 0
	[0043.974] lstrlenA (lpString="*.avi") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mp4") returned 0
	[0043.974] lstrlenA (lpString="*.mp4") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.wmv") returned 0
	[0043.974] lstrlenA (lpString="*.wmv") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.divx") returned 0
	[0043.974] lstrlenA (lpString="*.divx") returned 6
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mkv") returned 0
	[0043.974] lstrlenA (lpString="*.mkv") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mp3") returned 0
	[0043.974] lstrlenA (lpString="*.mp3") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.wav") returned 0
	[0043.974] lstrlenA (lpString="*.wav") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.flac") returned 0
	[0043.974] lstrlenA (lpString="*.flac") returned 6
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ape") returned 0
	[0043.974] lstrlenA (lpString="*.ape") returned 5
	[0043.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.wma") returned 0
	[0043.975] lstrlenA (lpString="*.wma") returned 5
	[0043.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ac3") returned 0
	[0043.975] lstrlenA (lpString="*.ac3") returned 5
	[0043.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.exe") returned 0
	[0043.975] lstrlenA (lpString="*.exe") returned 5
	[0043.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.apk") returned 0
	[0043.975] lstrlenA (lpString="*.apk") returned 5
	[0043.975] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0043.975] lstrcmpA (lpString1=".", lpString2="WATER") returned -1
	[0043.975] lstrcmpA (lpString1="..", lpString2="WATER") returned -1
	[0043.975] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned="THEMES.INF"
	[0043.975] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="WATER" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER"
	[0043.975] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER") returned 61
	[0043.975] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0043.975] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0043.975] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.975] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0043.975] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0043.975] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.975] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.976] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0043.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0043.976] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0043.976] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*") returned="*.*"
	[0043.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\"
	[0043.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned=""
	[0043.976] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt"
	[0043.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0xffffffff
	[0043.976] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.976] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0043.976] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0043.977] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0043.977] CloseHandle (hObject=0x90) returned 1
	[0043.978] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF"
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0043.978] lstrlenA (lpString="*.zip") returned 5
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0043.978] lstrlenA (lpString="*.rar") returned 5
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0043.978] lstrlenA (lpString="*.7z") returned 4
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0043.978] lstrlenA (lpString="*.tar") returned 5
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0043.978] lstrlenA (lpString="*.gzip") returned 6
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0043.978] lstrlenA (lpString="*.jpg") returned 5
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0043.978] lstrlenA (lpString="*.jpeg") returned 6
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0043.978] lstrlenA (lpString="*.psd") returned 5
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0043.978] lstrlenA (lpString="*.cdr") returned 5
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0043.978] lstrlenA (lpString="*.dwg") returned 5
	[0043.978] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0043.978] lstrlenA (lpString="*.max") returned 5
	[0043.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0043.979] lstrlenA (lpString="*.bmp") returned 5
	[0043.979] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0043.979] lstrlenA (lpString="*.gif") returned 5
	[0043.979] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF"
	[0043.979] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF"
	[0043.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF."
	[0043.979] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.Boom"
	[0043.979] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.979] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6c
	[0043.979] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.979] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.979] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa49, lpOverlapped=0x0) returned 1
	[0043.992] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.992] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.992] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa49, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa49, lpOverlapped=0x0) returned 1
	[0043.992] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.992] CloseHandle (hObject=0x90) returned 1
	[0043.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.boom")) returned 1
	[0043.995] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0043.995] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0043.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0043.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0043.995] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0043.995] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0043.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\"
	[0043.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned=""
	[0043.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt"
	[0043.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0x20
	[0043.995] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG"
	[0043.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0043.996] lstrlenA (lpString="*.zip") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0043.996] lstrlenA (lpString="*.rar") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0043.996] lstrlenA (lpString="*.7z") returned 4
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0043.996] lstrlenA (lpString="*.tar") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0043.996] lstrlenA (lpString="*.gzip") returned 6
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0043.996] lstrlenA (lpString="*.jpg") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0043.996] lstrlenA (lpString="*.jpeg") returned 6
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0043.996] lstrlenA (lpString="*.psd") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0043.996] lstrlenA (lpString="*.cdr") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0043.996] lstrlenA (lpString="*.dwg") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0043.996] lstrlenA (lpString="*.max") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0043.996] lstrlenA (lpString="*.bmp") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0043.996] lstrlenA (lpString="*.gif") returned 5
	[0043.996] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0043.996] lstrlenA (lpString="*.png") returned 5
	[0043.996] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG"
	[0043.996] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG"
	[0043.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG."
	[0043.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.Boom"
	[0043.996] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0043.996] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5d5
	[0043.997] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0043.997] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.997] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa5b2, lpOverlapped=0x0) returned 1
	[0043.998] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0043.998] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0043.998] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa5b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa5b2, lpOverlapped=0x0) returned 1
	[0043.998] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0043.999] CloseHandle (hObject=0x90) returned 1
	[0043.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.boom")) returned 1
	[0044.000] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.000] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.000] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WATER.ELM") returned -1
	[0044.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATER.ELM") returned -1
	[0044.000] lstrcmpiA (lpString1="", lpString2="WATER.ELM") returned -1
	[0044.000] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0044.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\"
	[0044.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned=""
	[0044.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt"
	[0044.000] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0x20
	[0044.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="WATER.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM"
	[0044.000] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.zip") returned 0
	[0044.000] lstrlenA (lpString="*.zip") returned 5
	[0044.000] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.rar") returned 0
	[0044.000] lstrlenA (lpString="*.rar") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.7z") returned 0
	[0044.001] lstrlenA (lpString="*.7z") returned 4
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.tar") returned 0
	[0044.001] lstrlenA (lpString="*.tar") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.gzip") returned 0
	[0044.001] lstrlenA (lpString="*.gzip") returned 6
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.jpg") returned 0
	[0044.001] lstrlenA (lpString="*.jpg") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.jpeg") returned 0
	[0044.001] lstrlenA (lpString="*.jpeg") returned 6
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.psd") returned 0
	[0044.001] lstrlenA (lpString="*.psd") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.cdr") returned 0
	[0044.001] lstrlenA (lpString="*.cdr") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.dwg") returned 0
	[0044.001] lstrlenA (lpString="*.dwg") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.max") returned 0
	[0044.001] lstrlenA (lpString="*.max") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.bmp") returned 0
	[0044.001] lstrlenA (lpString="*.bmp") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.gif") returned 0
	[0044.001] lstrlenA (lpString="*.gif") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.png") returned 0
	[0044.001] lstrlenA (lpString="*.png") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.doc") returned 0
	[0044.001] lstrlenA (lpString="*.doc") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.docx") returned 0
	[0044.001] lstrlenA (lpString="*.docx") returned 6
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.xls") returned 0
	[0044.001] lstrlenA (lpString="*.xls") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.xlsx") returned 0
	[0044.001] lstrlenA (lpString="*.xlsx") returned 6
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.ppt") returned 0
	[0044.001] lstrlenA (lpString="*.ppt") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.pptx") returned 0
	[0044.001] lstrlenA (lpString="*.pptx") returned 6
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.txt") returned 0
	[0044.001] lstrlenA (lpString="*.txt") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.pdf") returned 0
	[0044.001] lstrlenA (lpString="*.pdf") returned 5
	[0044.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.djvu") returned 0
	[0044.002] lstrlenA (lpString="*.djvu") returned 6
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.htm") returned 0
	[0044.002] lstrlenA (lpString="*.htm") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.html") returned 0
	[0044.002] lstrlenA (lpString="*.html") returned 6
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mdb") returned 0
	[0044.002] lstrlenA (lpString="*.mdb") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.cer") returned 0
	[0044.002] lstrlenA (lpString="*.cer") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.p12") returned 0
	[0044.002] lstrlenA (lpString="*.p12") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.pfx") returned 0
	[0044.002] lstrlenA (lpString="*.pfx") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.kwm") returned 0
	[0044.002] lstrlenA (lpString="*.kwm") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.pwm") returned 0
	[0044.002] lstrlenA (lpString="*.pwm") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.1cd") returned 0
	[0044.002] lstrlenA (lpString="*.1cd") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.md") returned 0
	[0044.002] lstrlenA (lpString="*.md") returned 4
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mdf") returned 0
	[0044.002] lstrlenA (lpString="*.mdf") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.dbf") returned 0
	[0044.002] lstrlenA (lpString="*.dbf") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.odt") returned 0
	[0044.002] lstrlenA (lpString="*.odt") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.vob") returned 0
	[0044.002] lstrlenA (lpString="*.vob") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.ifo") returned 0
	[0044.002] lstrlenA (lpString="*.ifo") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.lnk") returned 0
	[0044.002] lstrlenA (lpString="*.lnk") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.torrent") returned 0
	[0044.002] lstrlenA (lpString="*.torrent") returned 9
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mov") returned 0
	[0044.002] lstrlenA (lpString="*.mov") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.m2v") returned 0
	[0044.002] lstrlenA (lpString="*.m2v") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.3gp") returned 0
	[0044.002] lstrlenA (lpString="*.3gp") returned 5
	[0044.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mpeg") returned 0
	[0044.003] lstrlenA (lpString="*.mpeg") returned 6
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mpg") returned 0
	[0044.003] lstrlenA (lpString="*.mpg") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.flv") returned 0
	[0044.003] lstrlenA (lpString="*.flv") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.avi") returned 0
	[0044.003] lstrlenA (lpString="*.avi") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mp4") returned 0
	[0044.003] lstrlenA (lpString="*.mp4") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.wmv") returned 0
	[0044.003] lstrlenA (lpString="*.wmv") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.divx") returned 0
	[0044.003] lstrlenA (lpString="*.divx") returned 6
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mkv") returned 0
	[0044.003] lstrlenA (lpString="*.mkv") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mp3") returned 0
	[0044.003] lstrlenA (lpString="*.mp3") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.wav") returned 0
	[0044.003] lstrlenA (lpString="*.wav") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.flac") returned 0
	[0044.003] lstrlenA (lpString="*.flac") returned 6
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.ape") returned 0
	[0044.003] lstrlenA (lpString="*.ape") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.wma") returned 0
	[0044.003] lstrlenA (lpString="*.wma") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.ac3") returned 0
	[0044.003] lstrlenA (lpString="*.ac3") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.exe") returned 0
	[0044.003] lstrlenA (lpString="*.exe") returned 5
	[0044.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.apk") returned 0
	[0044.003] lstrlenA (lpString="*.apk") returned 5
	[0044.003] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.004] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.004] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WATER.INF") returned -1
	[0044.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATER.INF") returned -1
	[0044.004] lstrcmpiA (lpString1="", lpString2="WATER.INF") returned -1
	[0044.004] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned="WATER.ELM"
	[0044.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\"
	[0044.004] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned=""
	[0044.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt"
	[0044.004] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0x20
	[0044.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="WATER.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF"
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.zip") returned 0
	[0044.004] lstrlenA (lpString="*.zip") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.rar") returned 0
	[0044.004] lstrlenA (lpString="*.rar") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.7z") returned 0
	[0044.004] lstrlenA (lpString="*.7z") returned 4
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.tar") returned 0
	[0044.004] lstrlenA (lpString="*.tar") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.gzip") returned 0
	[0044.004] lstrlenA (lpString="*.gzip") returned 6
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.jpg") returned 0
	[0044.004] lstrlenA (lpString="*.jpg") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.jpeg") returned 0
	[0044.004] lstrlenA (lpString="*.jpeg") returned 6
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.psd") returned 0
	[0044.004] lstrlenA (lpString="*.psd") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.cdr") returned 0
	[0044.004] lstrlenA (lpString="*.cdr") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.dwg") returned 0
	[0044.004] lstrlenA (lpString="*.dwg") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.max") returned 0
	[0044.004] lstrlenA (lpString="*.max") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.bmp") returned 0
	[0044.004] lstrlenA (lpString="*.bmp") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.gif") returned 0
	[0044.004] lstrlenA (lpString="*.gif") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.png") returned 0
	[0044.004] lstrlenA (lpString="*.png") returned 5
	[0044.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.doc") returned 0
	[0044.005] lstrlenA (lpString="*.doc") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.docx") returned 0
	[0044.005] lstrlenA (lpString="*.docx") returned 6
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.xls") returned 0
	[0044.005] lstrlenA (lpString="*.xls") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.xlsx") returned 0
	[0044.005] lstrlenA (lpString="*.xlsx") returned 6
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.ppt") returned 0
	[0044.005] lstrlenA (lpString="*.ppt") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.pptx") returned 0
	[0044.005] lstrlenA (lpString="*.pptx") returned 6
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.txt") returned 0
	[0044.005] lstrlenA (lpString="*.txt") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.pdf") returned 0
	[0044.005] lstrlenA (lpString="*.pdf") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.djvu") returned 0
	[0044.005] lstrlenA (lpString="*.djvu") returned 6
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.htm") returned 0
	[0044.005] lstrlenA (lpString="*.htm") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.html") returned 0
	[0044.005] lstrlenA (lpString="*.html") returned 6
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mdb") returned 0
	[0044.005] lstrlenA (lpString="*.mdb") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.cer") returned 0
	[0044.005] lstrlenA (lpString="*.cer") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.p12") returned 0
	[0044.005] lstrlenA (lpString="*.p12") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.pfx") returned 0
	[0044.005] lstrlenA (lpString="*.pfx") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.kwm") returned 0
	[0044.005] lstrlenA (lpString="*.kwm") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.pwm") returned 0
	[0044.005] lstrlenA (lpString="*.pwm") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.1cd") returned 0
	[0044.005] lstrlenA (lpString="*.1cd") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.md") returned 0
	[0044.005] lstrlenA (lpString="*.md") returned 4
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mdf") returned 0
	[0044.005] lstrlenA (lpString="*.mdf") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.dbf") returned 0
	[0044.005] lstrlenA (lpString="*.dbf") returned 5
	[0044.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.odt") returned 0
	[0044.005] lstrlenA (lpString="*.odt") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.vob") returned 0
	[0044.006] lstrlenA (lpString="*.vob") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.ifo") returned 0
	[0044.006] lstrlenA (lpString="*.ifo") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.lnk") returned 0
	[0044.006] lstrlenA (lpString="*.lnk") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.torrent") returned 0
	[0044.006] lstrlenA (lpString="*.torrent") returned 9
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mov") returned 0
	[0044.006] lstrlenA (lpString="*.mov") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.m2v") returned 0
	[0044.006] lstrlenA (lpString="*.m2v") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.3gp") returned 0
	[0044.006] lstrlenA (lpString="*.3gp") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mpeg") returned 0
	[0044.006] lstrlenA (lpString="*.mpeg") returned 6
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mpg") returned 0
	[0044.006] lstrlenA (lpString="*.mpg") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.flv") returned 0
	[0044.006] lstrlenA (lpString="*.flv") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.avi") returned 0
	[0044.006] lstrlenA (lpString="*.avi") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mp4") returned 0
	[0044.006] lstrlenA (lpString="*.mp4") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.wmv") returned 0
	[0044.006] lstrlenA (lpString="*.wmv") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.divx") returned 0
	[0044.006] lstrlenA (lpString="*.divx") returned 6
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mkv") returned 0
	[0044.006] lstrlenA (lpString="*.mkv") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mp3") returned 0
	[0044.006] lstrlenA (lpString="*.mp3") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.wav") returned 0
	[0044.006] lstrlenA (lpString="*.wav") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.flac") returned 0
	[0044.006] lstrlenA (lpString="*.flac") returned 6
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.ape") returned 0
	[0044.006] lstrlenA (lpString="*.ape") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.wma") returned 0
	[0044.006] lstrlenA (lpString="*.wma") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.ac3") returned 0
	[0044.006] lstrlenA (lpString="*.ac3") returned 5
	[0044.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.exe") returned 0
	[0044.007] lstrlenA (lpString="*.exe") returned 5
	[0044.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.apk") returned 0
	[0044.007] lstrlenA (lpString="*.apk") returned 5
	[0044.007] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.007] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.007] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.007] lstrcmpA (lpString1=".", lpString2="WATERMAR") returned -1
	[0044.007] lstrcmpA (lpString1="..", lpString2="WATERMAR") returned -1
	[0044.007] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*"
	[0044.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="WATERMAR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR"
	[0044.007] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR") returned 64
	[0044.007] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7de8
	[0044.007] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.007] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.007] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.007] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.007] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.007] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1
	[0044.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1
	[0044.007] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1
	[0044.007] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*") returned="*.*"
	[0044.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\"
	[0044.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned=""
	[0044.008] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt"
	[0044.008] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0xffffffff
	[0044.008] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.009] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.009] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.010] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.010] CloseHandle (hObject=0x90) returned 1
	[0044.010] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF"
	[0044.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.zip") returned 0
	[0044.010] lstrlenA (lpString="*.zip") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.rar") returned 0
	[0044.011] lstrlenA (lpString="*.rar") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.7z") returned 0
	[0044.011] lstrlenA (lpString="*.7z") returned 4
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.tar") returned 0
	[0044.011] lstrlenA (lpString="*.tar") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.gzip") returned 0
	[0044.011] lstrlenA (lpString="*.gzip") returned 6
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.jpg") returned 0
	[0044.011] lstrlenA (lpString="*.jpg") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0
	[0044.011] lstrlenA (lpString="*.jpeg") returned 6
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.psd") returned 0
	[0044.011] lstrlenA (lpString="*.psd") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.cdr") returned 0
	[0044.011] lstrlenA (lpString="*.cdr") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.dwg") returned 0
	[0044.011] lstrlenA (lpString="*.dwg") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.max") returned 0
	[0044.011] lstrlenA (lpString="*.max") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.bmp") returned 0
	[0044.011] lstrlenA (lpString="*.bmp") returned 5
	[0044.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.gif") returned 1
	[0044.011] lstrlenA (lpString="*.gif") returned 5
	[0044.011] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF"
	[0044.011] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF"
	[0044.011] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF."
	[0044.011] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.Boom"
	[0044.011] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.012] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x623
	[0044.012] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0044.012] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.012] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x600, lpOverlapped=0x0) returned 1
	[0044.014] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0044.014] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.014] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x600, lpOverlapped=0x0) returned 1
	[0044.014] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.014] CloseHandle (hObject=0x90) returned 1
	[0044.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.boom")) returned 1
	[0044.015] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.015] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.015] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1
	[0044.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1
	[0044.015] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1
	[0044.015] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="PREVIEW.GIF"
	[0044.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\"
	[0044.015] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned=""
	[0044.015] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt"
	[0044.015] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0x20
	[0044.015] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG"
	[0044.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.zip") returned 0
	[0044.015] lstrlenA (lpString="*.zip") returned 5
	[0044.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.rar") returned 0
	[0044.016] lstrlenA (lpString="*.rar") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.7z") returned 0
	[0044.016] lstrlenA (lpString="*.7z") returned 4
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.tar") returned 0
	[0044.016] lstrlenA (lpString="*.tar") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0
	[0044.016] lstrlenA (lpString="*.gzip") returned 6
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0
	[0044.016] lstrlenA (lpString="*.jpg") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0
	[0044.016] lstrlenA (lpString="*.jpeg") returned 6
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.psd") returned 0
	[0044.016] lstrlenA (lpString="*.psd") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.cdr") returned 0
	[0044.016] lstrlenA (lpString="*.cdr") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.dwg") returned 0
	[0044.016] lstrlenA (lpString="*.dwg") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.max") returned 0
	[0044.016] lstrlenA (lpString="*.max") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.bmp") returned 0
	[0044.016] lstrlenA (lpString="*.bmp") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.gif") returned 0
	[0044.016] lstrlenA (lpString="*.gif") returned 5
	[0044.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.png") returned 1
	[0044.016] lstrlenA (lpString="*.png") returned 5
	[0044.016] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG"
	[0044.016] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG"
	[0044.016] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG."
	[0044.016] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.Boom"
	[0044.016] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.017] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75da
	[0044.017] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad387f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1
	[0044.017] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.017] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x75b7, lpOverlapped=0x0) returned 1
	[0044.036] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0044.036] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.036] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x75b7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x75b7, lpOverlapped=0x0) returned 1
	[0044.036] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.036] CloseHandle (hObject=0x90) returned 1
	[0044.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.boom")) returned 1
	[0044.039] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.039] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WATERMAR.ELM") returned -1
	[0044.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATERMAR.ELM") returned -1
	[0044.039] lstrcmpiA (lpString1="", lpString2="WATERMAR.ELM") returned -1
	[0044.039] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="THMBNAIL.PNG"
	[0044.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\"
	[0044.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned=""
	[0044.039] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt"
	[0044.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0x20
	[0044.039] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="WATERMAR.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM"
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.zip") returned 0
	[0044.039] lstrlenA (lpString="*.zip") returned 5
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.rar") returned 0
	[0044.039] lstrlenA (lpString="*.rar") returned 5
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.7z") returned 0
	[0044.039] lstrlenA (lpString="*.7z") returned 4
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.tar") returned 0
	[0044.039] lstrlenA (lpString="*.tar") returned 5
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.gzip") returned 0
	[0044.039] lstrlenA (lpString="*.gzip") returned 6
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.jpg") returned 0
	[0044.039] lstrlenA (lpString="*.jpg") returned 5
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.jpeg") returned 0
	[0044.039] lstrlenA (lpString="*.jpeg") returned 6
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.psd") returned 0
	[0044.039] lstrlenA (lpString="*.psd") returned 5
	[0044.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.cdr") returned 0
	[0044.039] lstrlenA (lpString="*.cdr") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.dwg") returned 0
	[0044.040] lstrlenA (lpString="*.dwg") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.max") returned 0
	[0044.040] lstrlenA (lpString="*.max") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.bmp") returned 0
	[0044.040] lstrlenA (lpString="*.bmp") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.gif") returned 0
	[0044.040] lstrlenA (lpString="*.gif") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.png") returned 0
	[0044.040] lstrlenA (lpString="*.png") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.doc") returned 0
	[0044.040] lstrlenA (lpString="*.doc") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.docx") returned 0
	[0044.040] lstrlenA (lpString="*.docx") returned 6
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.xls") returned 0
	[0044.040] lstrlenA (lpString="*.xls") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.xlsx") returned 0
	[0044.040] lstrlenA (lpString="*.xlsx") returned 6
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.ppt") returned 0
	[0044.040] lstrlenA (lpString="*.ppt") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.pptx") returned 0
	[0044.040] lstrlenA (lpString="*.pptx") returned 6
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.txt") returned 0
	[0044.040] lstrlenA (lpString="*.txt") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.pdf") returned 0
	[0044.040] lstrlenA (lpString="*.pdf") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.djvu") returned 0
	[0044.040] lstrlenA (lpString="*.djvu") returned 6
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.htm") returned 0
	[0044.040] lstrlenA (lpString="*.htm") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.html") returned 0
	[0044.040] lstrlenA (lpString="*.html") returned 6
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mdb") returned 0
	[0044.040] lstrlenA (lpString="*.mdb") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.cer") returned 0
	[0044.040] lstrlenA (lpString="*.cer") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.p12") returned 0
	[0044.040] lstrlenA (lpString="*.p12") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.pfx") returned 0
	[0044.040] lstrlenA (lpString="*.pfx") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.kwm") returned 0
	[0044.040] lstrlenA (lpString="*.kwm") returned 5
	[0044.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.pwm") returned 0
	[0044.041] lstrlenA (lpString="*.pwm") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.1cd") returned 0
	[0044.041] lstrlenA (lpString="*.1cd") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.md") returned 0
	[0044.041] lstrlenA (lpString="*.md") returned 4
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mdf") returned 0
	[0044.041] lstrlenA (lpString="*.mdf") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.dbf") returned 0
	[0044.041] lstrlenA (lpString="*.dbf") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.odt") returned 0
	[0044.041] lstrlenA (lpString="*.odt") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.vob") returned 0
	[0044.041] lstrlenA (lpString="*.vob") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.ifo") returned 0
	[0044.041] lstrlenA (lpString="*.ifo") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.lnk") returned 0
	[0044.041] lstrlenA (lpString="*.lnk") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.torrent") returned 0
	[0044.041] lstrlenA (lpString="*.torrent") returned 9
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mov") returned 0
	[0044.041] lstrlenA (lpString="*.mov") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.m2v") returned 0
	[0044.041] lstrlenA (lpString="*.m2v") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.3gp") returned 0
	[0044.041] lstrlenA (lpString="*.3gp") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mpeg") returned 0
	[0044.041] lstrlenA (lpString="*.mpeg") returned 6
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mpg") returned 0
	[0044.041] lstrlenA (lpString="*.mpg") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.flv") returned 0
	[0044.041] lstrlenA (lpString="*.flv") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.avi") returned 0
	[0044.041] lstrlenA (lpString="*.avi") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mp4") returned 0
	[0044.041] lstrlenA (lpString="*.mp4") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.wmv") returned 0
	[0044.041] lstrlenA (lpString="*.wmv") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.divx") returned 0
	[0044.041] lstrlenA (lpString="*.divx") returned 6
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mkv") returned 0
	[0044.041] lstrlenA (lpString="*.mkv") returned 5
	[0044.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mp3") returned 0
	[0044.041] lstrlenA (lpString="*.mp3") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.wav") returned 0
	[0044.042] lstrlenA (lpString="*.wav") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.flac") returned 0
	[0044.042] lstrlenA (lpString="*.flac") returned 6
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.ape") returned 0
	[0044.042] lstrlenA (lpString="*.ape") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.wma") returned 0
	[0044.042] lstrlenA (lpString="*.wma") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.ac3") returned 0
	[0044.042] lstrlenA (lpString="*.ac3") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.exe") returned 0
	[0044.042] lstrlenA (lpString="*.exe") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.apk") returned 0
	[0044.042] lstrlenA (lpString="*.apk") returned 5
	[0044.042] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.042] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WATERMAR.INF") returned -1
	[0044.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATERMAR.INF") returned -1
	[0044.042] lstrcmpiA (lpString1="", lpString2="WATERMAR.INF") returned -1
	[0044.042] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned="WATERMAR.ELM"
	[0044.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\"
	[0044.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned=""
	[0044.042] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt"
	[0044.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0x20
	[0044.042] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="WATERMAR.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF"
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.zip") returned 0
	[0044.042] lstrlenA (lpString="*.zip") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.rar") returned 0
	[0044.042] lstrlenA (lpString="*.rar") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.7z") returned 0
	[0044.042] lstrlenA (lpString="*.7z") returned 4
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.tar") returned 0
	[0044.042] lstrlenA (lpString="*.tar") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.gzip") returned 0
	[0044.042] lstrlenA (lpString="*.gzip") returned 6
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.jpg") returned 0
	[0044.042] lstrlenA (lpString="*.jpg") returned 5
	[0044.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.jpeg") returned 0
	[0044.042] lstrlenA (lpString="*.jpeg") returned 6
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.psd") returned 0
	[0044.043] lstrlenA (lpString="*.psd") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.cdr") returned 0
	[0044.043] lstrlenA (lpString="*.cdr") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.dwg") returned 0
	[0044.043] lstrlenA (lpString="*.dwg") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.max") returned 0
	[0044.043] lstrlenA (lpString="*.max") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.bmp") returned 0
	[0044.043] lstrlenA (lpString="*.bmp") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.gif") returned 0
	[0044.043] lstrlenA (lpString="*.gif") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.png") returned 0
	[0044.043] lstrlenA (lpString="*.png") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.doc") returned 0
	[0044.043] lstrlenA (lpString="*.doc") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.docx") returned 0
	[0044.043] lstrlenA (lpString="*.docx") returned 6
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.xls") returned 0
	[0044.043] lstrlenA (lpString="*.xls") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.xlsx") returned 0
	[0044.043] lstrlenA (lpString="*.xlsx") returned 6
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.ppt") returned 0
	[0044.043] lstrlenA (lpString="*.ppt") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.pptx") returned 0
	[0044.043] lstrlenA (lpString="*.pptx") returned 6
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.txt") returned 0
	[0044.043] lstrlenA (lpString="*.txt") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.pdf") returned 0
	[0044.043] lstrlenA (lpString="*.pdf") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.djvu") returned 0
	[0044.043] lstrlenA (lpString="*.djvu") returned 6
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.htm") returned 0
	[0044.043] lstrlenA (lpString="*.htm") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.html") returned 0
	[0044.043] lstrlenA (lpString="*.html") returned 6
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mdb") returned 0
	[0044.043] lstrlenA (lpString="*.mdb") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.cer") returned 0
	[0044.043] lstrlenA (lpString="*.cer") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.p12") returned 0
	[0044.043] lstrlenA (lpString="*.p12") returned 5
	[0044.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.pfx") returned 0
	[0044.044] lstrlenA (lpString="*.pfx") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.kwm") returned 0
	[0044.044] lstrlenA (lpString="*.kwm") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.pwm") returned 0
	[0044.044] lstrlenA (lpString="*.pwm") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.1cd") returned 0
	[0044.044] lstrlenA (lpString="*.1cd") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.md") returned 0
	[0044.044] lstrlenA (lpString="*.md") returned 4
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mdf") returned 0
	[0044.044] lstrlenA (lpString="*.mdf") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.dbf") returned 0
	[0044.044] lstrlenA (lpString="*.dbf") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.odt") returned 0
	[0044.044] lstrlenA (lpString="*.odt") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.vob") returned 0
	[0044.044] lstrlenA (lpString="*.vob") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.ifo") returned 0
	[0044.044] lstrlenA (lpString="*.ifo") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.lnk") returned 0
	[0044.044] lstrlenA (lpString="*.lnk") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.torrent") returned 0
	[0044.044] lstrlenA (lpString="*.torrent") returned 9
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mov") returned 0
	[0044.044] lstrlenA (lpString="*.mov") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.m2v") returned 0
	[0044.044] lstrlenA (lpString="*.m2v") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.3gp") returned 0
	[0044.044] lstrlenA (lpString="*.3gp") returned 5
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mpeg") returned 0
	[0044.044] lstrlenA (lpString="*.mpeg") returned 6
	[0044.044] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mpg") returned 0
	[0044.044] lstrlenA (lpString="*.mpg") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.flv") returned 0
	[0044.045] lstrlenA (lpString="*.flv") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.avi") returned 0
	[0044.045] lstrlenA (lpString="*.avi") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mp4") returned 0
	[0044.045] lstrlenA (lpString="*.mp4") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.wmv") returned 0
	[0044.045] lstrlenA (lpString="*.wmv") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.divx") returned 0
	[0044.045] lstrlenA (lpString="*.divx") returned 6
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mkv") returned 0
	[0044.045] lstrlenA (lpString="*.mkv") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mp3") returned 0
	[0044.045] lstrlenA (lpString="*.mp3") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.wav") returned 0
	[0044.045] lstrlenA (lpString="*.wav") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.flac") returned 0
	[0044.045] lstrlenA (lpString="*.flac") returned 6
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.ape") returned 0
	[0044.045] lstrlenA (lpString="*.ape") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.wma") returned 0
	[0044.045] lstrlenA (lpString="*.wma") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.ac3") returned 0
	[0044.045] lstrlenA (lpString="*.ac3") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.exe") returned 0
	[0044.045] lstrlenA (lpString="*.exe") returned 5
	[0044.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.apk") returned 0
	[0044.045] lstrlenA (lpString="*.apk") returned 5
	[0044.045] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.045] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.046] FindNextFileA (in: hFindFile=0x8ba3a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.046] FindClose (in: hFindFile=0x8ba3a8 | out: hFindFile=0x8ba3a8) returned 1
	[0044.046] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.046] lstrcmpA (lpString1=".", lpString2="TRANSLAT") returned -1
	[0044.046] lstrcmpA (lpString1="..", lpString2="TRANSLAT") returned -1
	[0044.046] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.046] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="TRANSLAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT"
	[0044.046] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned 55
	[0044.046] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.059] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.059] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.059] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.059] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.059] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.059] lstrcmpA (lpString1=".", lpString2="ARFR") returned -1
	[0044.059] lstrcmpA (lpString1="..", lpString2="ARFR") returned -1
	[0044.059] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*"
	[0044.059] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ARFR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR"
	[0044.059] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR") returned 60
	[0044.059] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.060] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.060] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.060] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.060] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.060] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.060] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.060] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1ARFR.ITS") returned -1
	[0044.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ARFR.ITS") returned -1
	[0044.060] lstrcmpiA (lpString1="", lpString2="MSB1ARFR.ITS") returned -1
	[0044.060] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*") returned="*.*"
	[0044.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\"
	[0044.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned=""
	[0044.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt"
	[0044.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to decrypt files.txt")) returned 0xffffffff
	[0044.061] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.061] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.061] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.062] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.062] CloseHandle (hObject=0x90) returned 1
	[0044.063] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="MSB1ARFR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS"
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.zip") returned 0
	[0044.063] lstrlenA (lpString="*.zip") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.rar") returned 0
	[0044.063] lstrlenA (lpString="*.rar") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.7z") returned 0
	[0044.063] lstrlenA (lpString="*.7z") returned 4
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.tar") returned 0
	[0044.063] lstrlenA (lpString="*.tar") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.gzip") returned 0
	[0044.063] lstrlenA (lpString="*.gzip") returned 6
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.jpg") returned 0
	[0044.063] lstrlenA (lpString="*.jpg") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.jpeg") returned 0
	[0044.063] lstrlenA (lpString="*.jpeg") returned 6
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.psd") returned 0
	[0044.063] lstrlenA (lpString="*.psd") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.cdr") returned 0
	[0044.063] lstrlenA (lpString="*.cdr") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.dwg") returned 0
	[0044.063] lstrlenA (lpString="*.dwg") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.max") returned 0
	[0044.063] lstrlenA (lpString="*.max") returned 5
	[0044.063] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.bmp") returned 0
	[0044.064] lstrlenA (lpString="*.bmp") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.gif") returned 0
	[0044.064] lstrlenA (lpString="*.gif") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.png") returned 0
	[0044.064] lstrlenA (lpString="*.png") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.doc") returned 0
	[0044.064] lstrlenA (lpString="*.doc") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.docx") returned 0
	[0044.064] lstrlenA (lpString="*.docx") returned 6
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xls") returned 0
	[0044.064] lstrlenA (lpString="*.xls") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xlsx") returned 0
	[0044.064] lstrlenA (lpString="*.xlsx") returned 6
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ppt") returned 0
	[0044.064] lstrlenA (lpString="*.ppt") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pptx") returned 0
	[0044.064] lstrlenA (lpString="*.pptx") returned 6
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.txt") returned 0
	[0044.064] lstrlenA (lpString="*.txt") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pdf") returned 0
	[0044.064] lstrlenA (lpString="*.pdf") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.djvu") returned 0
	[0044.064] lstrlenA (lpString="*.djvu") returned 6
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.htm") returned 0
	[0044.064] lstrlenA (lpString="*.htm") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.html") returned 0
	[0044.064] lstrlenA (lpString="*.html") returned 6
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mdb") returned 0
	[0044.064] lstrlenA (lpString="*.mdb") returned 5
	[0044.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.cer") returned 0
	[0044.064] lstrlenA (lpString="*.cer") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.p12") returned 0
	[0044.065] lstrlenA (lpString="*.p12") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pfx") returned 0
	[0044.065] lstrlenA (lpString="*.pfx") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.kwm") returned 0
	[0044.065] lstrlenA (lpString="*.kwm") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pwm") returned 0
	[0044.065] lstrlenA (lpString="*.pwm") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.1cd") returned 0
	[0044.065] lstrlenA (lpString="*.1cd") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.md") returned 0
	[0044.065] lstrlenA (lpString="*.md") returned 4
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mdf") returned 0
	[0044.065] lstrlenA (lpString="*.mdf") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.dbf") returned 0
	[0044.065] lstrlenA (lpString="*.dbf") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.odt") returned 0
	[0044.065] lstrlenA (lpString="*.odt") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.vob") returned 0
	[0044.065] lstrlenA (lpString="*.vob") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ifo") returned 0
	[0044.065] lstrlenA (lpString="*.ifo") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.lnk") returned 0
	[0044.065] lstrlenA (lpString="*.lnk") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.torrent") returned 0
	[0044.065] lstrlenA (lpString="*.torrent") returned 9
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mov") returned 0
	[0044.065] lstrlenA (lpString="*.mov") returned 5
	[0044.065] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.m2v") returned 0
	[0044.065] lstrlenA (lpString="*.m2v") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.3gp") returned 0
	[0044.066] lstrlenA (lpString="*.3gp") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mpeg") returned 0
	[0044.066] lstrlenA (lpString="*.mpeg") returned 6
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mpg") returned 0
	[0044.066] lstrlenA (lpString="*.mpg") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.flv") returned 0
	[0044.066] lstrlenA (lpString="*.flv") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.avi") returned 0
	[0044.066] lstrlenA (lpString="*.avi") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mp4") returned 0
	[0044.066] lstrlenA (lpString="*.mp4") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wmv") returned 0
	[0044.066] lstrlenA (lpString="*.wmv") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.divx") returned 0
	[0044.066] lstrlenA (lpString="*.divx") returned 6
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mkv") returned 0
	[0044.066] lstrlenA (lpString="*.mkv") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mp3") returned 0
	[0044.066] lstrlenA (lpString="*.mp3") returned 5
	[0044.066] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wav") returned 0
	[0044.067] lstrlenA (lpString="*.wav") returned 5
	[0044.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.flac") returned 0
	[0044.067] lstrlenA (lpString="*.flac") returned 6
	[0044.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ape") returned 0
	[0044.067] lstrlenA (lpString="*.ape") returned 5
	[0044.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wma") returned 0
	[0044.067] lstrlenA (lpString="*.wma") returned 5
	[0044.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ac3") returned 0
	[0044.067] lstrlenA (lpString="*.ac3") returned 5
	[0044.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.exe") returned 0
	[0044.067] lstrlenA (lpString="*.exe") returned 5
	[0044.067] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.apk") returned 0
	[0044.067] lstrlenA (lpString="*.apk") returned 5
	[0044.067] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.067] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.067] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.067] lstrcmpA (lpString1=".", lpString2="ENES") returned -1
	[0044.067] lstrcmpA (lpString1="..", lpString2="ENES") returned -1
	[0044.067] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*"
	[0044.067] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ENES" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES"
	[0044.067] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned 60
	[0044.067] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.068] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.069] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.069] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.069] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.069] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.069] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1ENES.ITS") returned -1
	[0044.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ENES.ITS") returned -1
	[0044.069] lstrcmpiA (lpString1="", lpString2="MSB1ENES.ITS") returned -1
	[0044.069] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*") returned="*.*"
	[0044.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\"
	[0044.069] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned=""
	[0044.069] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt"
	[0044.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to decrypt files.txt")) returned 0xffffffff
	[0044.069] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.070] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.070] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.071] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.071] CloseHandle (hObject=0x90) returned 1
	[0044.071] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="MSB1ENES.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS"
	[0044.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.zip") returned 0
	[0044.071] lstrlenA (lpString="*.zip") returned 5
	[0044.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.rar") returned 0
	[0044.071] lstrlenA (lpString="*.rar") returned 5
	[0044.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.7z") returned 0
	[0044.071] lstrlenA (lpString="*.7z") returned 4
	[0044.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.tar") returned 0
	[0044.071] lstrlenA (lpString="*.tar") returned 5
	[0044.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.gzip") returned 0
	[0044.072] lstrlenA (lpString="*.gzip") returned 6
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.jpg") returned 0
	[0044.072] lstrlenA (lpString="*.jpg") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.jpeg") returned 0
	[0044.072] lstrlenA (lpString="*.jpeg") returned 6
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.psd") returned 0
	[0044.072] lstrlenA (lpString="*.psd") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.cdr") returned 0
	[0044.072] lstrlenA (lpString="*.cdr") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.dwg") returned 0
	[0044.072] lstrlenA (lpString="*.dwg") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.max") returned 0
	[0044.072] lstrlenA (lpString="*.max") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.bmp") returned 0
	[0044.072] lstrlenA (lpString="*.bmp") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.gif") returned 0
	[0044.072] lstrlenA (lpString="*.gif") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.png") returned 0
	[0044.072] lstrlenA (lpString="*.png") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.doc") returned 0
	[0044.072] lstrlenA (lpString="*.doc") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.docx") returned 0
	[0044.072] lstrlenA (lpString="*.docx") returned 6
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xls") returned 0
	[0044.072] lstrlenA (lpString="*.xls") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xlsx") returned 0
	[0044.072] lstrlenA (lpString="*.xlsx") returned 6
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ppt") returned 0
	[0044.072] lstrlenA (lpString="*.ppt") returned 5
	[0044.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pptx") returned 0
	[0044.073] lstrlenA (lpString="*.pptx") returned 6
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.txt") returned 0
	[0044.073] lstrlenA (lpString="*.txt") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pdf") returned 0
	[0044.073] lstrlenA (lpString="*.pdf") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.djvu") returned 0
	[0044.073] lstrlenA (lpString="*.djvu") returned 6
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.htm") returned 0
	[0044.073] lstrlenA (lpString="*.htm") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.html") returned 0
	[0044.073] lstrlenA (lpString="*.html") returned 6
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mdb") returned 0
	[0044.073] lstrlenA (lpString="*.mdb") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.cer") returned 0
	[0044.073] lstrlenA (lpString="*.cer") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.p12") returned 0
	[0044.073] lstrlenA (lpString="*.p12") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pfx") returned 0
	[0044.073] lstrlenA (lpString="*.pfx") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.kwm") returned 0
	[0044.073] lstrlenA (lpString="*.kwm") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pwm") returned 0
	[0044.073] lstrlenA (lpString="*.pwm") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.1cd") returned 0
	[0044.073] lstrlenA (lpString="*.1cd") returned 5
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.md") returned 0
	[0044.073] lstrlenA (lpString="*.md") returned 4
	[0044.073] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mdf") returned 0
	[0044.073] lstrlenA (lpString="*.mdf") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.dbf") returned 0
	[0044.074] lstrlenA (lpString="*.dbf") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.odt") returned 0
	[0044.074] lstrlenA (lpString="*.odt") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.vob") returned 0
	[0044.074] lstrlenA (lpString="*.vob") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ifo") returned 0
	[0044.074] lstrlenA (lpString="*.ifo") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.lnk") returned 0
	[0044.074] lstrlenA (lpString="*.lnk") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.torrent") returned 0
	[0044.074] lstrlenA (lpString="*.torrent") returned 9
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mov") returned 0
	[0044.074] lstrlenA (lpString="*.mov") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.m2v") returned 0
	[0044.074] lstrlenA (lpString="*.m2v") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.3gp") returned 0
	[0044.074] lstrlenA (lpString="*.3gp") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mpeg") returned 0
	[0044.074] lstrlenA (lpString="*.mpeg") returned 6
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mpg") returned 0
	[0044.074] lstrlenA (lpString="*.mpg") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.flv") returned 0
	[0044.074] lstrlenA (lpString="*.flv") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.avi") returned 0
	[0044.074] lstrlenA (lpString="*.avi") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mp4") returned 0
	[0044.074] lstrlenA (lpString="*.mp4") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wmv") returned 0
	[0044.074] lstrlenA (lpString="*.wmv") returned 5
	[0044.074] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.divx") returned 0
	[0044.075] lstrlenA (lpString="*.divx") returned 6
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mkv") returned 0
	[0044.075] lstrlenA (lpString="*.mkv") returned 5
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mp3") returned 0
	[0044.075] lstrlenA (lpString="*.mp3") returned 5
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wav") returned 0
	[0044.075] lstrlenA (lpString="*.wav") returned 5
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.flac") returned 0
	[0044.075] lstrlenA (lpString="*.flac") returned 6
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ape") returned 0
	[0044.075] lstrlenA (lpString="*.ape") returned 5
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wma") returned 0
	[0044.075] lstrlenA (lpString="*.wma") returned 5
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ac3") returned 0
	[0044.075] lstrlenA (lpString="*.ac3") returned 5
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.exe") returned 0
	[0044.075] lstrlenA (lpString="*.exe") returned 5
	[0044.075] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.apk") returned 0
	[0044.075] lstrlenA (lpString="*.apk") returned 5
	[0044.075] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.075] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.075] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.075] lstrcmpA (lpString1=".", lpString2="ENFR") returned -1
	[0044.075] lstrcmpA (lpString1="..", lpString2="ENFR") returned -1
	[0044.075] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*"
	[0044.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ENFR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR"
	[0044.076] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned 60
	[0044.076] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.076] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.076] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.076] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.076] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.076] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.076] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.076] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1ENFR.ITS") returned -1
	[0044.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ENFR.ITS") returned -1
	[0044.076] lstrcmpiA (lpString1="", lpString2="MSB1ENFR.ITS") returned -1
	[0044.076] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*") returned="*.*"
	[0044.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\"
	[0044.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned=""
	[0044.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt"
	[0044.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to decrypt files.txt")) returned 0xffffffff
	[0044.077] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.077] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.077] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.078] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.078] CloseHandle (hObject=0x90) returned 1
	[0044.078] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="MSB1ENFR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS"
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.zip") returned 0
	[0044.079] lstrlenA (lpString="*.zip") returned 5
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.rar") returned 0
	[0044.079] lstrlenA (lpString="*.rar") returned 5
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.7z") returned 0
	[0044.079] lstrlenA (lpString="*.7z") returned 4
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.tar") returned 0
	[0044.079] lstrlenA (lpString="*.tar") returned 5
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.gzip") returned 0
	[0044.079] lstrlenA (lpString="*.gzip") returned 6
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.jpg") returned 0
	[0044.079] lstrlenA (lpString="*.jpg") returned 5
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.jpeg") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.psd") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.cdr") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.dwg") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.max") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.bmp") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.gif") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.png") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.doc") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.docx") returned 0
	[0044.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.xls") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.xlsx") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ppt") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pptx") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.txt") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pdf") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.djvu") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.htm") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.html") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mdb") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.cer") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.p12") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pfx") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.kwm") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pwm") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.1cd") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.md") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mdf") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.dbf") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.odt") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.vob") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ifo") returned 0
	[0044.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.lnk") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.torrent") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mov") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.m2v") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.3gp") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mpeg") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mpg") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.flv") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.avi") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mp4") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.wmv") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.divx") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mkv") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mp3") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.wav") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.flac") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ape") returned 0
	[0044.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.wma") returned 0
	[0044.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ac3") returned 0
	[0044.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.exe") returned 0
	[0044.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.apk") returned 0
	[0044.082] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.082] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.083] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.083] lstrcmpA (lpString1=".", lpString2="ESEN") returned -1
	[0044.083] lstrcmpA (lpString1="..", lpString2="ESEN") returned -1
	[0044.083] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*"
	[0044.083] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ESEN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN"
	[0044.084] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.084] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.084] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.084] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.084] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.084] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.084] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1ESEN.DLL") returned -1
	[0044.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ESEN.DLL") returned -1
	[0044.084] lstrcmpiA (lpString1="", lpString2="MSB1ESEN.DLL") returned -1
	[0044.084] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*") returned="*.*"
	[0044.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\"
	[0044.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned=""
	[0044.084] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt"
	[0044.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0xffffffff
	[0044.085] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.085] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.086] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.086] CloseHandle (hObject=0x90) returned 1
	[0044.086] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="MSB1ESEN.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL"
	[0044.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.zip") returned 0
	[0044.086] lstrlenA (lpString="*.zip") returned 5
	[0044.086] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.rar") returned 0
	[0044.087] lstrlenA (lpString="*.rar") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.7z") returned 0
	[0044.087] lstrlenA (lpString="*.7z") returned 4
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.tar") returned 0
	[0044.087] lstrlenA (lpString="*.tar") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.gzip") returned 0
	[0044.087] lstrlenA (lpString="*.gzip") returned 6
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.jpg") returned 0
	[0044.087] lstrlenA (lpString="*.jpg") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.jpeg") returned 0
	[0044.087] lstrlenA (lpString="*.jpeg") returned 6
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.psd") returned 0
	[0044.087] lstrlenA (lpString="*.psd") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.cdr") returned 0
	[0044.087] lstrlenA (lpString="*.cdr") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.dwg") returned 0
	[0044.087] lstrlenA (lpString="*.dwg") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.max") returned 0
	[0044.087] lstrlenA (lpString="*.max") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.bmp") returned 0
	[0044.087] lstrlenA (lpString="*.bmp") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.gif") returned 0
	[0044.087] lstrlenA (lpString="*.gif") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.png") returned 0
	[0044.087] lstrlenA (lpString="*.png") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.doc") returned 0
	[0044.087] lstrlenA (lpString="*.doc") returned 5
	[0044.087] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.docx") returned 0
	[0044.087] lstrlenA (lpString="*.docx") returned 6
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.xls") returned 0
	[0044.088] lstrlenA (lpString="*.xls") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.xlsx") returned 0
	[0044.088] lstrlenA (lpString="*.xlsx") returned 6
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ppt") returned 0
	[0044.088] lstrlenA (lpString="*.ppt") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.pptx") returned 0
	[0044.088] lstrlenA (lpString="*.pptx") returned 6
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.txt") returned 0
	[0044.088] lstrlenA (lpString="*.txt") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.pdf") returned 0
	[0044.088] lstrlenA (lpString="*.pdf") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.djvu") returned 0
	[0044.088] lstrlenA (lpString="*.djvu") returned 6
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.htm") returned 0
	[0044.088] lstrlenA (lpString="*.htm") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.html") returned 0
	[0044.088] lstrlenA (lpString="*.html") returned 6
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mdb") returned 0
	[0044.088] lstrlenA (lpString="*.mdb") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.cer") returned 0
	[0044.088] lstrlenA (lpString="*.cer") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.p12") returned 0
	[0044.088] lstrlenA (lpString="*.p12") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.pfx") returned 0
	[0044.088] lstrlenA (lpString="*.pfx") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.kwm") returned 0
	[0044.088] lstrlenA (lpString="*.kwm") returned 5
	[0044.088] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.pwm") returned 0
	[0044.088] lstrlenA (lpString="*.pwm") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.1cd") returned 0
	[0044.089] lstrlenA (lpString="*.1cd") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.md") returned 0
	[0044.089] lstrlenA (lpString="*.md") returned 4
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mdf") returned 0
	[0044.089] lstrlenA (lpString="*.mdf") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.dbf") returned 0
	[0044.089] lstrlenA (lpString="*.dbf") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.odt") returned 0
	[0044.089] lstrlenA (lpString="*.odt") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.vob") returned 0
	[0044.089] lstrlenA (lpString="*.vob") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ifo") returned 0
	[0044.089] lstrlenA (lpString="*.ifo") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.lnk") returned 0
	[0044.089] lstrlenA (lpString="*.lnk") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.torrent") returned 0
	[0044.089] lstrlenA (lpString="*.torrent") returned 9
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mov") returned 0
	[0044.089] lstrlenA (lpString="*.mov") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.m2v") returned 0
	[0044.089] lstrlenA (lpString="*.m2v") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.3gp") returned 0
	[0044.089] lstrlenA (lpString="*.3gp") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mpeg") returned 0
	[0044.089] lstrlenA (lpString="*.mpeg") returned 6
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mpg") returned 0
	[0044.089] lstrlenA (lpString="*.mpg") returned 5
	[0044.089] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.flv") returned 0
	[0044.090] lstrlenA (lpString="*.flv") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.avi") returned 0
	[0044.090] lstrlenA (lpString="*.avi") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mp4") returned 0
	[0044.090] lstrlenA (lpString="*.mp4") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.wmv") returned 0
	[0044.090] lstrlenA (lpString="*.wmv") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.divx") returned 0
	[0044.090] lstrlenA (lpString="*.divx") returned 6
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mkv") returned 0
	[0044.090] lstrlenA (lpString="*.mkv") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mp3") returned 0
	[0044.090] lstrlenA (lpString="*.mp3") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.wav") returned 0
	[0044.090] lstrlenA (lpString="*.wav") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.flac") returned 0
	[0044.090] lstrlenA (lpString="*.flac") returned 6
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ape") returned 0
	[0044.090] lstrlenA (lpString="*.ape") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.wma") returned 0
	[0044.090] lstrlenA (lpString="*.wma") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ac3") returned 0
	[0044.090] lstrlenA (lpString="*.ac3") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.exe") returned 0
	[0044.090] lstrlenA (lpString="*.exe") returned 5
	[0044.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.apk") returned 0
	[0044.090] lstrlenA (lpString="*.apk") returned 5
	[0044.091] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.091] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.091] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1ESEN.ITS") returned -1
	[0044.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ESEN.ITS") returned -1
	[0044.091] lstrcmpiA (lpString1="", lpString2="MSB1ESEN.ITS") returned -1
	[0044.091] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned="MSB1ESEN.DLL"
	[0044.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\"
	[0044.091] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned=""
	[0044.091] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt"
	[0044.091] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0x20
	[0044.091] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="MSB1ESEN.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS"
	[0044.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.zip") returned 0
	[0044.091] lstrlenA (lpString="*.zip") returned 5
	[0044.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.rar") returned 0
	[0044.091] lstrlenA (lpString="*.rar") returned 5
	[0044.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.7z") returned 0
	[0044.091] lstrlenA (lpString="*.7z") returned 4
	[0044.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.tar") returned 0
	[0044.091] lstrlenA (lpString="*.tar") returned 5
	[0044.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.gzip") returned 0
	[0044.091] lstrlenA (lpString="*.gzip") returned 6
	[0044.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.jpg") returned 0
	[0044.091] lstrlenA (lpString="*.jpg") returned 5
	[0044.091] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.jpeg") returned 0
	[0044.091] lstrlenA (lpString="*.jpeg") returned 6
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.psd") returned 0
	[0044.092] lstrlenA (lpString="*.psd") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.cdr") returned 0
	[0044.092] lstrlenA (lpString="*.cdr") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.dwg") returned 0
	[0044.092] lstrlenA (lpString="*.dwg") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.max") returned 0
	[0044.092] lstrlenA (lpString="*.max") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.bmp") returned 0
	[0044.092] lstrlenA (lpString="*.bmp") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.gif") returned 0
	[0044.092] lstrlenA (lpString="*.gif") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.png") returned 0
	[0044.092] lstrlenA (lpString="*.png") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.doc") returned 0
	[0044.092] lstrlenA (lpString="*.doc") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.docx") returned 0
	[0044.092] lstrlenA (lpString="*.docx") returned 6
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.xls") returned 0
	[0044.092] lstrlenA (lpString="*.xls") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.xlsx") returned 0
	[0044.092] lstrlenA (lpString="*.xlsx") returned 6
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ppt") returned 0
	[0044.092] lstrlenA (lpString="*.ppt") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.pptx") returned 0
	[0044.092] lstrlenA (lpString="*.pptx") returned 6
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.txt") returned 0
	[0044.092] lstrlenA (lpString="*.txt") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.pdf") returned 0
	[0044.092] lstrlenA (lpString="*.pdf") returned 5
	[0044.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.djvu") returned 0
	[0044.093] lstrlenA (lpString="*.djvu") returned 6
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.htm") returned 0
	[0044.093] lstrlenA (lpString="*.htm") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.html") returned 0
	[0044.093] lstrlenA (lpString="*.html") returned 6
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mdb") returned 0
	[0044.093] lstrlenA (lpString="*.mdb") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.cer") returned 0
	[0044.093] lstrlenA (lpString="*.cer") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.p12") returned 0
	[0044.093] lstrlenA (lpString="*.p12") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.pfx") returned 0
	[0044.093] lstrlenA (lpString="*.pfx") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.kwm") returned 0
	[0044.093] lstrlenA (lpString="*.kwm") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.pwm") returned 0
	[0044.093] lstrlenA (lpString="*.pwm") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.1cd") returned 0
	[0044.093] lstrlenA (lpString="*.1cd") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.md") returned 0
	[0044.093] lstrlenA (lpString="*.md") returned 4
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mdf") returned 0
	[0044.093] lstrlenA (lpString="*.mdf") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.dbf") returned 0
	[0044.093] lstrlenA (lpString="*.dbf") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.odt") returned 0
	[0044.093] lstrlenA (lpString="*.odt") returned 5
	[0044.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.vob") returned 0
	[0044.093] lstrlenA (lpString="*.vob") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ifo") returned 0
	[0044.094] lstrlenA (lpString="*.ifo") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.lnk") returned 0
	[0044.094] lstrlenA (lpString="*.lnk") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.torrent") returned 0
	[0044.094] lstrlenA (lpString="*.torrent") returned 9
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mov") returned 0
	[0044.094] lstrlenA (lpString="*.mov") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.m2v") returned 0
	[0044.094] lstrlenA (lpString="*.m2v") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.3gp") returned 0
	[0044.094] lstrlenA (lpString="*.3gp") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mpeg") returned 0
	[0044.094] lstrlenA (lpString="*.mpeg") returned 6
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mpg") returned 0
	[0044.094] lstrlenA (lpString="*.mpg") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.flv") returned 0
	[0044.094] lstrlenA (lpString="*.flv") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.avi") returned 0
	[0044.094] lstrlenA (lpString="*.avi") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mp4") returned 0
	[0044.094] lstrlenA (lpString="*.mp4") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.wmv") returned 0
	[0044.094] lstrlenA (lpString="*.wmv") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.divx") returned 0
	[0044.094] lstrlenA (lpString="*.divx") returned 6
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mkv") returned 0
	[0044.094] lstrlenA (lpString="*.mkv") returned 5
	[0044.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mp3") returned 0
	[0044.095] lstrlenA (lpString="*.mp3") returned 5
	[0044.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.wav") returned 0
	[0044.095] lstrlenA (lpString="*.wav") returned 5
	[0044.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.flac") returned 0
	[0044.095] lstrlenA (lpString="*.flac") returned 6
	[0044.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ape") returned 0
	[0044.095] lstrlenA (lpString="*.ape") returned 5
	[0044.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.wma") returned 0
	[0044.095] lstrlenA (lpString="*.wma") returned 5
	[0044.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ac3") returned 0
	[0044.095] lstrlenA (lpString="*.ac3") returned 5
	[0044.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.exe") returned 0
	[0044.095] lstrlenA (lpString="*.exe") returned 5
	[0044.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.apk") returned 0
	[0044.095] lstrlenA (lpString="*.apk") returned 5
	[0044.095] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.095] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.095] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WT61ES.LEX") returned -1
	[0044.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WT61ES.LEX") returned -1
	[0044.095] lstrcmpiA (lpString1="", lpString2="WT61ES.LEX") returned -1
	[0044.095] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned="MSB1ESEN.ITS"
	[0044.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\"
	[0044.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned=""
	[0044.095] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt"
	[0044.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0x20
	[0044.096] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="WT61ES.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX"
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.zip") returned 0
	[0044.096] lstrlenA (lpString="*.zip") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.rar") returned 0
	[0044.096] lstrlenA (lpString="*.rar") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.7z") returned 0
	[0044.096] lstrlenA (lpString="*.7z") returned 4
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.tar") returned 0
	[0044.096] lstrlenA (lpString="*.tar") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.gzip") returned 0
	[0044.096] lstrlenA (lpString="*.gzip") returned 6
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.jpg") returned 0
	[0044.096] lstrlenA (lpString="*.jpg") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.jpeg") returned 0
	[0044.096] lstrlenA (lpString="*.jpeg") returned 6
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.psd") returned 0
	[0044.096] lstrlenA (lpString="*.psd") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.cdr") returned 0
	[0044.096] lstrlenA (lpString="*.cdr") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.dwg") returned 0
	[0044.096] lstrlenA (lpString="*.dwg") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.max") returned 0
	[0044.096] lstrlenA (lpString="*.max") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.bmp") returned 0
	[0044.096] lstrlenA (lpString="*.bmp") returned 5
	[0044.096] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.gif") returned 0
	[0044.097] lstrlenA (lpString="*.gif") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.png") returned 0
	[0044.097] lstrlenA (lpString="*.png") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.doc") returned 0
	[0044.097] lstrlenA (lpString="*.doc") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.docx") returned 0
	[0044.097] lstrlenA (lpString="*.docx") returned 6
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.xls") returned 0
	[0044.097] lstrlenA (lpString="*.xls") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.xlsx") returned 0
	[0044.097] lstrlenA (lpString="*.xlsx") returned 6
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ppt") returned 0
	[0044.097] lstrlenA (lpString="*.ppt") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.pptx") returned 0
	[0044.097] lstrlenA (lpString="*.pptx") returned 6
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.txt") returned 0
	[0044.097] lstrlenA (lpString="*.txt") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.pdf") returned 0
	[0044.097] lstrlenA (lpString="*.pdf") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.djvu") returned 0
	[0044.097] lstrlenA (lpString="*.djvu") returned 6
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.htm") returned 0
	[0044.097] lstrlenA (lpString="*.htm") returned 5
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.html") returned 0
	[0044.097] lstrlenA (lpString="*.html") returned 6
	[0044.097] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mdb") returned 0
	[0044.098] lstrlenA (lpString="*.mdb") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.cer") returned 0
	[0044.098] lstrlenA (lpString="*.cer") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.p12") returned 0
	[0044.098] lstrlenA (lpString="*.p12") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.pfx") returned 0
	[0044.098] lstrlenA (lpString="*.pfx") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.kwm") returned 0
	[0044.098] lstrlenA (lpString="*.kwm") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.pwm") returned 0
	[0044.098] lstrlenA (lpString="*.pwm") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.1cd") returned 0
	[0044.098] lstrlenA (lpString="*.1cd") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.md") returned 0
	[0044.098] lstrlenA (lpString="*.md") returned 4
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mdf") returned 0
	[0044.098] lstrlenA (lpString="*.mdf") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.dbf") returned 0
	[0044.098] lstrlenA (lpString="*.dbf") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.odt") returned 0
	[0044.098] lstrlenA (lpString="*.odt") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.vob") returned 0
	[0044.098] lstrlenA (lpString="*.vob") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ifo") returned 0
	[0044.098] lstrlenA (lpString="*.ifo") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.lnk") returned 0
	[0044.098] lstrlenA (lpString="*.lnk") returned 5
	[0044.098] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.torrent") returned 0
	[0044.098] lstrlenA (lpString="*.torrent") returned 9
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mov") returned 0
	[0044.099] lstrlenA (lpString="*.mov") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.m2v") returned 0
	[0044.099] lstrlenA (lpString="*.m2v") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.3gp") returned 0
	[0044.099] lstrlenA (lpString="*.3gp") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mpeg") returned 0
	[0044.099] lstrlenA (lpString="*.mpeg") returned 6
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mpg") returned 0
	[0044.099] lstrlenA (lpString="*.mpg") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.flv") returned 0
	[0044.099] lstrlenA (lpString="*.flv") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.avi") returned 0
	[0044.099] lstrlenA (lpString="*.avi") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mp4") returned 0
	[0044.099] lstrlenA (lpString="*.mp4") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.wmv") returned 0
	[0044.099] lstrlenA (lpString="*.wmv") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.divx") returned 0
	[0044.099] lstrlenA (lpString="*.divx") returned 6
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mkv") returned 0
	[0044.099] lstrlenA (lpString="*.mkv") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mp3") returned 0
	[0044.099] lstrlenA (lpString="*.mp3") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.wav") returned 0
	[0044.099] lstrlenA (lpString="*.wav") returned 5
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.flac") returned 0
	[0044.099] lstrlenA (lpString="*.flac") returned 6
	[0044.099] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ape") returned 0
	[0044.100] lstrlenA (lpString="*.ape") returned 5
	[0044.100] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.wma") returned 0
	[0044.100] lstrlenA (lpString="*.wma") returned 5
	[0044.100] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ac3") returned 0
	[0044.100] lstrlenA (lpString="*.ac3") returned 5
	[0044.100] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.exe") returned 0
	[0044.100] lstrlenA (lpString="*.exe") returned 5
	[0044.100] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.apk") returned 0
	[0044.100] lstrlenA (lpString="*.apk") returned 5
	[0044.100] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.100] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.100] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.100] lstrcmpA (lpString1=".", lpString2="FRAR") returned -1
	[0044.100] lstrcmpA (lpString1="..", lpString2="FRAR") returned -1
	[0044.100] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*"
	[0044.100] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="FRAR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR"
	[0044.100] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR") returned 60
	[0044.100] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.104] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.104] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.104] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.104] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.104] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.104] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.104] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1FRAR.ITS") returned -1
	[0044.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FRAR.ITS") returned -1
	[0044.104] lstrcmpiA (lpString1="", lpString2="MSB1FRAR.ITS") returned -1
	[0044.104] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*") returned="*.*"
	[0044.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\"
	[0044.104] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned=""
	[0044.104] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt"
	[0044.104] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to decrypt files.txt")) returned 0xffffffff
	[0044.105] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.105] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.105] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.106] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.106] CloseHandle (hObject=0x90) returned 1
	[0044.107] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="MSB1FRAR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS"
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.zip") returned 0
	[0044.107] lstrlenA (lpString="*.zip") returned 5
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.rar") returned 0
	[0044.107] lstrlenA (lpString="*.rar") returned 5
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.7z") returned 0
	[0044.107] lstrlenA (lpString="*.7z") returned 4
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.tar") returned 0
	[0044.107] lstrlenA (lpString="*.tar") returned 5
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.gzip") returned 0
	[0044.107] lstrlenA (lpString="*.gzip") returned 6
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.jpg") returned 0
	[0044.107] lstrlenA (lpString="*.jpg") returned 5
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.jpeg") returned 0
	[0044.107] lstrlenA (lpString="*.jpeg") returned 6
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.psd") returned 0
	[0044.107] lstrlenA (lpString="*.psd") returned 5
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.cdr") returned 0
	[0044.107] lstrlenA (lpString="*.cdr") returned 5
	[0044.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.dwg") returned 0
	[0044.108] lstrlenA (lpString="*.dwg") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.max") returned 0
	[0044.108] lstrlenA (lpString="*.max") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.bmp") returned 0
	[0044.108] lstrlenA (lpString="*.bmp") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.gif") returned 0
	[0044.108] lstrlenA (lpString="*.gif") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.png") returned 0
	[0044.108] lstrlenA (lpString="*.png") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.doc") returned 0
	[0044.108] lstrlenA (lpString="*.doc") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.docx") returned 0
	[0044.108] lstrlenA (lpString="*.docx") returned 6
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.xls") returned 0
	[0044.108] lstrlenA (lpString="*.xls") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.xlsx") returned 0
	[0044.108] lstrlenA (lpString="*.xlsx") returned 6
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ppt") returned 0
	[0044.108] lstrlenA (lpString="*.ppt") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.pptx") returned 0
	[0044.108] lstrlenA (lpString="*.pptx") returned 6
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.txt") returned 0
	[0044.108] lstrlenA (lpString="*.txt") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.pdf") returned 0
	[0044.108] lstrlenA (lpString="*.pdf") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.djvu") returned 0
	[0044.108] lstrlenA (lpString="*.djvu") returned 6
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.htm") returned 0
	[0044.108] lstrlenA (lpString="*.htm") returned 5
	[0044.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.html") returned 0
	[0044.108] lstrlenA (lpString="*.html") returned 6
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mdb") returned 0
	[0044.109] lstrlenA (lpString="*.mdb") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.cer") returned 0
	[0044.109] lstrlenA (lpString="*.cer") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.p12") returned 0
	[0044.109] lstrlenA (lpString="*.p12") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.pfx") returned 0
	[0044.109] lstrlenA (lpString="*.pfx") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.kwm") returned 0
	[0044.109] lstrlenA (lpString="*.kwm") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.pwm") returned 0
	[0044.109] lstrlenA (lpString="*.pwm") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.1cd") returned 0
	[0044.109] lstrlenA (lpString="*.1cd") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.md") returned 0
	[0044.109] lstrlenA (lpString="*.md") returned 4
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mdf") returned 0
	[0044.109] lstrlenA (lpString="*.mdf") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.dbf") returned 0
	[0044.109] lstrlenA (lpString="*.dbf") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.odt") returned 0
	[0044.109] lstrlenA (lpString="*.odt") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.vob") returned 0
	[0044.109] lstrlenA (lpString="*.vob") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ifo") returned 0
	[0044.109] lstrlenA (lpString="*.ifo") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.lnk") returned 0
	[0044.109] lstrlenA (lpString="*.lnk") returned 5
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.torrent") returned 0
	[0044.109] lstrlenA (lpString="*.torrent") returned 9
	[0044.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mov") returned 0
	[0044.109] lstrlenA (lpString="*.mov") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.m2v") returned 0
	[0044.110] lstrlenA (lpString="*.m2v") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.3gp") returned 0
	[0044.110] lstrlenA (lpString="*.3gp") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mpeg") returned 0
	[0044.110] lstrlenA (lpString="*.mpeg") returned 6
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mpg") returned 0
	[0044.110] lstrlenA (lpString="*.mpg") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.flv") returned 0
	[0044.110] lstrlenA (lpString="*.flv") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.avi") returned 0
	[0044.110] lstrlenA (lpString="*.avi") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mp4") returned 0
	[0044.110] lstrlenA (lpString="*.mp4") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.wmv") returned 0
	[0044.110] lstrlenA (lpString="*.wmv") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.divx") returned 0
	[0044.110] lstrlenA (lpString="*.divx") returned 6
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mkv") returned 0
	[0044.110] lstrlenA (lpString="*.mkv") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mp3") returned 0
	[0044.110] lstrlenA (lpString="*.mp3") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.wav") returned 0
	[0044.110] lstrlenA (lpString="*.wav") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.flac") returned 0
	[0044.110] lstrlenA (lpString="*.flac") returned 6
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ape") returned 0
	[0044.110] lstrlenA (lpString="*.ape") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.wma") returned 0
	[0044.110] lstrlenA (lpString="*.wma") returned 5
	[0044.110] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ac3") returned 0
	[0044.111] lstrlenA (lpString="*.ac3") returned 5
	[0044.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.exe") returned 0
	[0044.111] lstrlenA (lpString="*.exe") returned 5
	[0044.111] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.apk") returned 0
	[0044.111] lstrlenA (lpString="*.apk") returned 5
	[0044.111] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.111] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.111] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.111] lstrcmpA (lpString1=".", lpString2="FREN") returned -1
	[0044.111] lstrcmpA (lpString1="..", lpString2="FREN") returned -1
	[0044.111] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*"
	[0044.111] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="FREN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN"
	[0044.111] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN") returned 60
	[0044.111] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.112] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.112] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.113] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.113] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.113] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.113] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.113] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1FREN.DLL") returned -1
	[0044.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FREN.DLL") returned -1
	[0044.113] lstrcmpiA (lpString1="", lpString2="MSB1FREN.DLL") returned -1
	[0044.113] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*") returned="*.*"
	[0044.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\"
	[0044.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned=""
	[0044.113] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt"
	[0044.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0xffffffff
	[0044.113] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.114] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.114] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.115] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.115] CloseHandle (hObject=0x90) returned 1
	[0044.115] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="MSB1FREN.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL"
	[0044.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.zip") returned 0
	[0044.115] lstrlenA (lpString="*.zip") returned 5
	[0044.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.rar") returned 0
	[0044.115] lstrlenA (lpString="*.rar") returned 5
	[0044.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.7z") returned 0
	[0044.115] lstrlenA (lpString="*.7z") returned 4
	[0044.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.tar") returned 0
	[0044.115] lstrlenA (lpString="*.tar") returned 5
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.gzip") returned 0
	[0044.116] lstrlenA (lpString="*.gzip") returned 6
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.jpg") returned 0
	[0044.116] lstrlenA (lpString="*.jpg") returned 5
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.jpeg") returned 0
	[0044.116] lstrlenA (lpString="*.jpeg") returned 6
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.psd") returned 0
	[0044.116] lstrlenA (lpString="*.psd") returned 5
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.cdr") returned 0
	[0044.116] lstrlenA (lpString="*.cdr") returned 5
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.dwg") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.max") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.bmp") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.gif") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.png") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.doc") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.docx") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.xls") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.xlsx") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ppt") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.pptx") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.txt") returned 0
	[0044.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.pdf") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.djvu") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.htm") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.html") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mdb") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.cer") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.p12") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.pfx") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.kwm") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.pwm") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.1cd") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.md") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mdf") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.dbf") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.odt") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.vob") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ifo") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.lnk") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.torrent") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mov") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.m2v") returned 0
	[0044.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.3gp") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mpeg") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mpg") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.flv") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.avi") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mp4") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.wmv") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.divx") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mkv") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mp3") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.wav") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.flac") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ape") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.wma") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ac3") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.exe") returned 0
	[0044.118] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.apk") returned 0
	[0044.118] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.118] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.118] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1FREN.ITS") returned -1
	[0044.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FREN.ITS") returned -1
	[0044.118] lstrcmpiA (lpString1="", lpString2="MSB1FREN.ITS") returned -1
	[0044.119] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned="MSB1FREN.DLL"
	[0044.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\"
	[0044.119] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned=""
	[0044.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt"
	[0044.119] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0x20
	[0044.119] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="MSB1FREN.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS"
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.zip") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.rar") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.7z") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.tar") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.gzip") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.jpg") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.jpeg") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.psd") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.cdr") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.dwg") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.max") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.bmp") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.gif") returned 0
	[0044.119] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.png") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.doc") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.docx") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.xls") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.xlsx") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ppt") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.pptx") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.txt") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.pdf") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.djvu") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.htm") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.html") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mdb") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.cer") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.p12") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.pfx") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.kwm") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.pwm") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.1cd") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.md") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mdf") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.dbf") returned 0
	[0044.120] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.odt") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.vob") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ifo") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.lnk") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.torrent") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mov") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.m2v") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.3gp") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mpeg") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mpg") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.flv") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.avi") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mp4") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.wmv") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.divx") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mkv") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mp3") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.wav") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.flac") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ape") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.wma") returned 0
	[0044.121] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ac3") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.exe") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.apk") returned 0
	[0044.122] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.122] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.122] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WT61FR.LEX") returned -1
	[0044.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WT61FR.LEX") returned -1
	[0044.122] lstrcmpiA (lpString1="", lpString2="WT61FR.LEX") returned -1
	[0044.122] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned="MSB1FREN.ITS"
	[0044.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\"
	[0044.122] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned=""
	[0044.122] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt"
	[0044.122] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0x20
	[0044.122] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="WT61FR.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX"
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.zip") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.rar") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.7z") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.tar") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.gzip") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.jpg") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.jpeg") returned 0
	[0044.122] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.psd") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.cdr") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.dwg") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.max") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.bmp") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.gif") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.png") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.doc") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.docx") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.xls") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.xlsx") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ppt") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.pptx") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.txt") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.pdf") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.djvu") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.htm") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.html") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mdb") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.cer") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.p12") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.pfx") returned 0
	[0044.123] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.kwm") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.pwm") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.1cd") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.md") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mdf") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.dbf") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.odt") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.vob") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ifo") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.lnk") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.torrent") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mov") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.m2v") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.3gp") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mpeg") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mpg") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.flv") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.avi") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mp4") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.wmv") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.divx") returned 0
	[0044.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mkv") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mp3") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.wav") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.flac") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ape") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.wma") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ac3") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.exe") returned 0
	[0044.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.apk") returned 0
	[0044.125] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.125] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.125] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.125] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1AR.LEX") returned -1
	[0044.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1AR.LEX") returned -1
	[0044.125] lstrcmpiA (lpString1="", lpString2="MSB1AR.LEX") returned -1
	[0044.125] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*"
	[0044.125] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\"
	[0044.125] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned=""
	[0044.126] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt"
	[0044.126] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0xffffffff
	[0044.126] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.126] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.127] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.127] CloseHandle (hObject=0x8c) returned 1
	[0044.128] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1AR.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX"
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.zip") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.rar") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.7z") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.tar") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.gzip") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.jpg") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.jpeg") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.psd") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.cdr") returned 0
	[0044.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.dwg") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.max") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.bmp") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.gif") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.png") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.doc") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.docx") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.xls") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.xlsx") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ppt") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.pptx") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.txt") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.pdf") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.djvu") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.htm") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.html") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mdb") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.cer") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.p12") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.pfx") returned 0
	[0044.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.kwm") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.pwm") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.1cd") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.md") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mdf") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.dbf") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.odt") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.vob") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ifo") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.lnk") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.torrent") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mov") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.m2v") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.3gp") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mpeg") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mpg") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.flv") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.avi") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mp4") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.wmv") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.divx") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mkv") returned 0
	[0044.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mp3") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.wav") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.flac") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ape") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.wma") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ac3") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.exe") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.apk") returned 0
	[0044.131] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.131] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.131] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1CACH.LEX") returned -1
	[0044.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1CACH.LEX") returned -1
	[0044.131] lstrcmpiA (lpString1="", lpString2="MSB1CACH.LEX") returned -1
	[0044.131] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned="MSB1AR.LEX"
	[0044.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\"
	[0044.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned=""
	[0044.131] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt"
	[0044.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20
	[0044.131] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1CACH.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX"
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.zip") returned 0
	[0044.131] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.rar") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.7z") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.tar") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.gzip") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.jpg") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.jpeg") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.psd") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.cdr") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.dwg") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.max") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.bmp") returned 0
	[0044.132] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.gif") returned 0
	[0044.132] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.132] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1CORE.DLL") returned -1
	[0044.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1CORE.DLL") returned -1
	[0044.132] lstrcmpiA (lpString1="", lpString2="MSB1CORE.DLL") returned -1
	[0044.133] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned="MSB1CACH.LEX"
	[0044.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\"
	[0044.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned=""
	[0044.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt"
	[0044.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20
	[0044.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1CORE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL"
	[0044.133] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1STAR.DLL") returned -1
	[0044.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1STAR.DLL") returned -1
	[0044.133] lstrcmpiA (lpString1="", lpString2="MSB1STAR.DLL") returned -1
	[0044.133] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned="MSB1CORE.DLL"
	[0044.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\"
	[0044.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned=""
	[0044.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt"
	[0044.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20
	[0044.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1STAR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL"
	[0044.133] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSB1XTOR.DLL") returned -1
	[0044.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1XTOR.DLL") returned -1
	[0044.133] lstrcmpiA (lpString1="", lpString2="MSB1XTOR.DLL") returned -1
	[0044.134] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned="MSB1STAR.DLL"
	[0044.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\"
	[0044.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned=""
	[0044.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt"
	[0044.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20
	[0044.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1XTOR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL"
	[0044.134] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.134] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WTSP61MS.DLL") returned -1
	[0044.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WTSP61MS.DLL") returned -1
	[0044.134] lstrcmpiA (lpString1="", lpString2="WTSP61MS.DLL") returned -1
	[0044.134] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned="MSB1XTOR.DLL"
	[0044.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\"
	[0044.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned=""
	[0044.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt"
	[0044.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20
	[0044.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="WTSP61MS.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL"
	[0044.134] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.134] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.135] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.135] lstrcmpA (lpString1=".", lpString2="Triedit") returned -1
	[0044.135] lstrcmpA (lpString1="..", lpString2="Triedit") returned -1
	[0044.135] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Triedit" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit"
	[0044.135] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.135] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.135] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.135] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.135] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.135] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.135] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.135] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.135] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*") returned="*.*"
	[0044.136] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US"
	[0044.136] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US") returned 60
	[0044.136] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.137] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.137] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.137] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.137] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.137] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.137] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.137] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.137] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.137] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.137] lstrcmpA (lpString1=".", lpString2="VBA") returned -1
	[0044.137] lstrcmpA (lpString1="..", lpString2="VBA") returned -1
	[0044.137] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.137] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VBA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA"
	[0044.137] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned 50
	[0044.137] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.139] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.139] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.139] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.139] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.139] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.139] lstrcmpA (lpString1=".", lpString2="VBA7") returned -1
	[0044.139] lstrcmpA (lpString1="..", lpString2="VBA7") returned -1
	[0044.139] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*") returned="*.*"
	[0044.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", lpString2="VBA7" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7"
	[0044.139] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7") returned 55
	[0044.139] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.139] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.139] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.139] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.139] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.139] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.139] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0044.139] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0044.139] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned="*.*"
	[0044.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033"
	[0044.139] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033") returned 60
	[0044.140] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7e68
	[0044.146] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.146] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.146] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.146] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.146] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.146] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FM20.CHM") returned -1
	[0044.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FM20.CHM") returned 1
	[0044.146] lstrcmpiA (lpString1="", lpString2="FM20.CHM") returned -1
	[0044.146] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*") returned="*.*"
	[0044.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.147] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0044.147] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0044.147] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.147] WriteFile (in: hFile=0x94, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.148] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.149] CloseHandle (hObject=0x94) returned 1
	[0044.149] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="FM20.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM"
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.zip") returned 0
	[0044.149] lstrlenA (lpString="*.zip") returned 5
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.rar") returned 0
	[0044.149] lstrlenA (lpString="*.rar") returned 5
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.7z") returned 0
	[0044.149] lstrlenA (lpString="*.7z") returned 4
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.tar") returned 0
	[0044.149] lstrlenA (lpString="*.tar") returned 5
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.gzip") returned 0
	[0044.149] lstrlenA (lpString="*.gzip") returned 6
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.jpg") returned 0
	[0044.149] lstrlenA (lpString="*.jpg") returned 5
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.jpeg") returned 0
	[0044.149] lstrlenA (lpString="*.jpeg") returned 6
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.psd") returned 0
	[0044.149] lstrlenA (lpString="*.psd") returned 5
	[0044.149] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.cdr") returned 0
	[0044.149] lstrlenA (lpString="*.cdr") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.dwg") returned 0
	[0044.150] lstrlenA (lpString="*.dwg") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.max") returned 0
	[0044.150] lstrlenA (lpString="*.max") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.bmp") returned 0
	[0044.150] lstrlenA (lpString="*.bmp") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.gif") returned 0
	[0044.150] lstrlenA (lpString="*.gif") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.png") returned 0
	[0044.150] lstrlenA (lpString="*.png") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.doc") returned 0
	[0044.150] lstrlenA (lpString="*.doc") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.docx") returned 0
	[0044.150] lstrlenA (lpString="*.docx") returned 6
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.xls") returned 0
	[0044.150] lstrlenA (lpString="*.xls") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.xlsx") returned 0
	[0044.150] lstrlenA (lpString="*.xlsx") returned 6
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ppt") returned 0
	[0044.150] lstrlenA (lpString="*.ppt") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pptx") returned 0
	[0044.150] lstrlenA (lpString="*.pptx") returned 6
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.txt") returned 0
	[0044.150] lstrlenA (lpString="*.txt") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pdf") returned 0
	[0044.150] lstrlenA (lpString="*.pdf") returned 5
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.djvu") returned 0
	[0044.150] lstrlenA (lpString="*.djvu") returned 6
	[0044.150] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.htm") returned 0
	[0044.151] lstrlenA (lpString="*.htm") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.html") returned 0
	[0044.151] lstrlenA (lpString="*.html") returned 6
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mdb") returned 0
	[0044.151] lstrlenA (lpString="*.mdb") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.cer") returned 0
	[0044.151] lstrlenA (lpString="*.cer") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.p12") returned 0
	[0044.151] lstrlenA (lpString="*.p12") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pfx") returned 0
	[0044.151] lstrlenA (lpString="*.pfx") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.kwm") returned 0
	[0044.151] lstrlenA (lpString="*.kwm") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pwm") returned 0
	[0044.151] lstrlenA (lpString="*.pwm") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.1cd") returned 0
	[0044.151] lstrlenA (lpString="*.1cd") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.md") returned 0
	[0044.151] lstrlenA (lpString="*.md") returned 4
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mdf") returned 0
	[0044.151] lstrlenA (lpString="*.mdf") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.dbf") returned 0
	[0044.151] lstrlenA (lpString="*.dbf") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.odt") returned 0
	[0044.151] lstrlenA (lpString="*.odt") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.vob") returned 0
	[0044.151] lstrlenA (lpString="*.vob") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ifo") returned 0
	[0044.151] lstrlenA (lpString="*.ifo") returned 5
	[0044.151] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.lnk") returned 0
	[0044.152] lstrlenA (lpString="*.lnk") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.torrent") returned 0
	[0044.152] lstrlenA (lpString="*.torrent") returned 9
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mov") returned 0
	[0044.152] lstrlenA (lpString="*.mov") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.m2v") returned 0
	[0044.152] lstrlenA (lpString="*.m2v") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.3gp") returned 0
	[0044.152] lstrlenA (lpString="*.3gp") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mpeg") returned 0
	[0044.152] lstrlenA (lpString="*.mpeg") returned 6
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mpg") returned 0
	[0044.152] lstrlenA (lpString="*.mpg") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.flv") returned 0
	[0044.152] lstrlenA (lpString="*.flv") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.avi") returned 0
	[0044.152] lstrlenA (lpString="*.avi") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mp4") returned 0
	[0044.152] lstrlenA (lpString="*.mp4") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.wmv") returned 0
	[0044.152] lstrlenA (lpString="*.wmv") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.divx") returned 0
	[0044.152] lstrlenA (lpString="*.divx") returned 6
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mkv") returned 0
	[0044.152] lstrlenA (lpString="*.mkv") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mp3") returned 0
	[0044.152] lstrlenA (lpString="*.mp3") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.wav") returned 0
	[0044.152] lstrlenA (lpString="*.wav") returned 5
	[0044.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.flac") returned 0
	[0044.152] lstrlenA (lpString="*.flac") returned 6
	[0044.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ape") returned 0
	[0044.153] lstrlenA (lpString="*.ape") returned 5
	[0044.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.wma") returned 0
	[0044.153] lstrlenA (lpString="*.wma") returned 5
	[0044.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ac3") returned 0
	[0044.153] lstrlenA (lpString="*.ac3") returned 5
	[0044.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.exe") returned 0
	[0044.153] lstrlenA (lpString="*.exe") returned 5
	[0044.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.apk") returned 0
	[0044.153] lstrlenA (lpString="*.apk") returned 5
	[0044.153] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.153] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBCN6.CHM") returned -1
	[0044.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBCN6.CHM") returned -1
	[0044.153] lstrcmpiA (lpString1="", lpString2="VBCN6.CHM") returned -1
	[0044.153] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned="FM20.CHM"
	[0044.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.153] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.153] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBCN6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM"
	[0044.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.zip") returned 0
	[0044.153] lstrlenA (lpString="*.zip") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.rar") returned 0
	[0044.154] lstrlenA (lpString="*.rar") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.7z") returned 0
	[0044.154] lstrlenA (lpString="*.7z") returned 4
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.tar") returned 0
	[0044.154] lstrlenA (lpString="*.tar") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.gzip") returned 0
	[0044.154] lstrlenA (lpString="*.gzip") returned 6
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.jpg") returned 0
	[0044.154] lstrlenA (lpString="*.jpg") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.jpeg") returned 0
	[0044.154] lstrlenA (lpString="*.jpeg") returned 6
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.psd") returned 0
	[0044.154] lstrlenA (lpString="*.psd") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.cdr") returned 0
	[0044.154] lstrlenA (lpString="*.cdr") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.dwg") returned 0
	[0044.154] lstrlenA (lpString="*.dwg") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.max") returned 0
	[0044.154] lstrlenA (lpString="*.max") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.bmp") returned 0
	[0044.154] lstrlenA (lpString="*.bmp") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.gif") returned 0
	[0044.154] lstrlenA (lpString="*.gif") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.png") returned 0
	[0044.154] lstrlenA (lpString="*.png") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.doc") returned 0
	[0044.154] lstrlenA (lpString="*.doc") returned 5
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.docx") returned 0
	[0044.154] lstrlenA (lpString="*.docx") returned 6
	[0044.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.xls") returned 0
	[0044.155] lstrlenA (lpString="*.xls") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.xlsx") returned 0
	[0044.155] lstrlenA (lpString="*.xlsx") returned 6
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ppt") returned 0
	[0044.155] lstrlenA (lpString="*.ppt") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pptx") returned 0
	[0044.155] lstrlenA (lpString="*.pptx") returned 6
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.txt") returned 0
	[0044.155] lstrlenA (lpString="*.txt") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pdf") returned 0
	[0044.155] lstrlenA (lpString="*.pdf") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.djvu") returned 0
	[0044.155] lstrlenA (lpString="*.djvu") returned 6
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.htm") returned 0
	[0044.155] lstrlenA (lpString="*.htm") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.html") returned 0
	[0044.155] lstrlenA (lpString="*.html") returned 6
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mdb") returned 0
	[0044.155] lstrlenA (lpString="*.mdb") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.cer") returned 0
	[0044.155] lstrlenA (lpString="*.cer") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.p12") returned 0
	[0044.155] lstrlenA (lpString="*.p12") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pfx") returned 0
	[0044.155] lstrlenA (lpString="*.pfx") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.kwm") returned 0
	[0044.155] lstrlenA (lpString="*.kwm") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pwm") returned 0
	[0044.155] lstrlenA (lpString="*.pwm") returned 5
	[0044.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.1cd") returned 0
	[0044.156] lstrlenA (lpString="*.1cd") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.md") returned 0
	[0044.156] lstrlenA (lpString="*.md") returned 4
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mdf") returned 0
	[0044.156] lstrlenA (lpString="*.mdf") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.dbf") returned 0
	[0044.156] lstrlenA (lpString="*.dbf") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.odt") returned 0
	[0044.156] lstrlenA (lpString="*.odt") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.vob") returned 0
	[0044.156] lstrlenA (lpString="*.vob") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ifo") returned 0
	[0044.156] lstrlenA (lpString="*.ifo") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.lnk") returned 0
	[0044.156] lstrlenA (lpString="*.lnk") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.torrent") returned 0
	[0044.156] lstrlenA (lpString="*.torrent") returned 9
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mov") returned 0
	[0044.156] lstrlenA (lpString="*.mov") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.m2v") returned 0
	[0044.156] lstrlenA (lpString="*.m2v") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.3gp") returned 0
	[0044.156] lstrlenA (lpString="*.3gp") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mpeg") returned 0
	[0044.156] lstrlenA (lpString="*.mpeg") returned 6
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mpg") returned 0
	[0044.156] lstrlenA (lpString="*.mpg") returned 5
	[0044.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.flv") returned 0
	[0044.156] lstrlenA (lpString="*.flv") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.avi") returned 0
	[0044.157] lstrlenA (lpString="*.avi") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mp4") returned 0
	[0044.157] lstrlenA (lpString="*.mp4") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.wmv") returned 0
	[0044.157] lstrlenA (lpString="*.wmv") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.divx") returned 0
	[0044.157] lstrlenA (lpString="*.divx") returned 6
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mkv") returned 0
	[0044.157] lstrlenA (lpString="*.mkv") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mp3") returned 0
	[0044.157] lstrlenA (lpString="*.mp3") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.wav") returned 0
	[0044.157] lstrlenA (lpString="*.wav") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.flac") returned 0
	[0044.157] lstrlenA (lpString="*.flac") returned 6
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ape") returned 0
	[0044.157] lstrlenA (lpString="*.ape") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.wma") returned 0
	[0044.157] lstrlenA (lpString="*.wma") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ac3") returned 0
	[0044.157] lstrlenA (lpString="*.ac3") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.exe") returned 0
	[0044.157] lstrlenA (lpString="*.exe") returned 5
	[0044.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.apk") returned 0
	[0044.157] lstrlenA (lpString="*.apk") returned 5
	[0044.157] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.157] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.158] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBE7INTL.DLL") returned -1
	[0044.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBE7INTL.DLL") returned -1
	[0044.158] lstrcmpiA (lpString1="", lpString2="VBE7INTL.DLL") returned -1
	[0044.158] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned="VBCN6.CHM"
	[0044.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.158] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.158] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBE7INTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL"
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.zip") returned 0
	[0044.158] lstrlenA (lpString="*.zip") returned 5
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.rar") returned 0
	[0044.158] lstrlenA (lpString="*.rar") returned 5
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.7z") returned 0
	[0044.158] lstrlenA (lpString="*.7z") returned 4
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.tar") returned 0
	[0044.158] lstrlenA (lpString="*.tar") returned 5
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.gzip") returned 0
	[0044.158] lstrlenA (lpString="*.gzip") returned 6
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.jpg") returned 0
	[0044.158] lstrlenA (lpString="*.jpg") returned 5
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.jpeg") returned 0
	[0044.158] lstrlenA (lpString="*.jpeg") returned 6
	[0044.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.psd") returned 0
	[0044.159] lstrlenA (lpString="*.psd") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.cdr") returned 0
	[0044.159] lstrlenA (lpString="*.cdr") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.dwg") returned 0
	[0044.159] lstrlenA (lpString="*.dwg") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.max") returned 0
	[0044.159] lstrlenA (lpString="*.max") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.bmp") returned 0
	[0044.159] lstrlenA (lpString="*.bmp") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.gif") returned 0
	[0044.159] lstrlenA (lpString="*.gif") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.png") returned 0
	[0044.159] lstrlenA (lpString="*.png") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.doc") returned 0
	[0044.159] lstrlenA (lpString="*.doc") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.docx") returned 0
	[0044.159] lstrlenA (lpString="*.docx") returned 6
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.xls") returned 0
	[0044.159] lstrlenA (lpString="*.xls") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.xlsx") returned 0
	[0044.159] lstrlenA (lpString="*.xlsx") returned 6
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ppt") returned 0
	[0044.159] lstrlenA (lpString="*.ppt") returned 5
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pptx") returned 0
	[0044.159] lstrlenA (lpString="*.pptx") returned 6
	[0044.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.txt") returned 0
	[0044.159] lstrlenA (lpString="*.txt") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pdf") returned 0
	[0044.160] lstrlenA (lpString="*.pdf") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.djvu") returned 0
	[0044.160] lstrlenA (lpString="*.djvu") returned 6
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.htm") returned 0
	[0044.160] lstrlenA (lpString="*.htm") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.html") returned 0
	[0044.160] lstrlenA (lpString="*.html") returned 6
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mdb") returned 0
	[0044.160] lstrlenA (lpString="*.mdb") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.cer") returned 0
	[0044.160] lstrlenA (lpString="*.cer") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.p12") returned 0
	[0044.160] lstrlenA (lpString="*.p12") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pfx") returned 0
	[0044.160] lstrlenA (lpString="*.pfx") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.kwm") returned 0
	[0044.160] lstrlenA (lpString="*.kwm") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pwm") returned 0
	[0044.160] lstrlenA (lpString="*.pwm") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.1cd") returned 0
	[0044.160] lstrlenA (lpString="*.1cd") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.md") returned 0
	[0044.160] lstrlenA (lpString="*.md") returned 4
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mdf") returned 0
	[0044.160] lstrlenA (lpString="*.mdf") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.dbf") returned 0
	[0044.160] lstrlenA (lpString="*.dbf") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.odt") returned 0
	[0044.160] lstrlenA (lpString="*.odt") returned 5
	[0044.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.vob") returned 0
	[0044.161] lstrlenA (lpString="*.vob") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ifo") returned 0
	[0044.161] lstrlenA (lpString="*.ifo") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.lnk") returned 0
	[0044.161] lstrlenA (lpString="*.lnk") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.torrent") returned 0
	[0044.161] lstrlenA (lpString="*.torrent") returned 9
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mov") returned 0
	[0044.161] lstrlenA (lpString="*.mov") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.m2v") returned 0
	[0044.161] lstrlenA (lpString="*.m2v") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.3gp") returned 0
	[0044.161] lstrlenA (lpString="*.3gp") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mpeg") returned 0
	[0044.161] lstrlenA (lpString="*.mpeg") returned 6
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mpg") returned 0
	[0044.161] lstrlenA (lpString="*.mpg") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.flv") returned 0
	[0044.161] lstrlenA (lpString="*.flv") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.avi") returned 0
	[0044.161] lstrlenA (lpString="*.avi") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mp4") returned 0
	[0044.161] lstrlenA (lpString="*.mp4") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.wmv") returned 0
	[0044.161] lstrlenA (lpString="*.wmv") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.divx") returned 0
	[0044.161] lstrlenA (lpString="*.divx") returned 6
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mkv") returned 0
	[0044.161] lstrlenA (lpString="*.mkv") returned 5
	[0044.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mp3") returned 0
	[0044.161] lstrlenA (lpString="*.mp3") returned 5
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.wav") returned 0
	[0044.162] lstrlenA (lpString="*.wav") returned 5
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.flac") returned 0
	[0044.162] lstrlenA (lpString="*.flac") returned 6
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ape") returned 0
	[0044.162] lstrlenA (lpString="*.ape") returned 5
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.wma") returned 0
	[0044.162] lstrlenA (lpString="*.wma") returned 5
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ac3") returned 0
	[0044.162] lstrlenA (lpString="*.ac3") returned 5
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.exe") returned 0
	[0044.162] lstrlenA (lpString="*.exe") returned 5
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.apk") returned 0
	[0044.162] lstrlenA (lpString="*.apk") returned 5
	[0044.162] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.162] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBENDF98.CHM") returned -1
	[0044.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBENDF98.CHM") returned -1
	[0044.162] lstrcmpiA (lpString1="", lpString2="VBENDF98.CHM") returned -1
	[0044.162] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned="VBE7INTL.DLL"
	[0044.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBENDF98.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM"
	[0044.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.zip") returned 0
	[0044.163] lstrlenA (lpString="*.zip") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.rar") returned 0
	[0044.163] lstrlenA (lpString="*.rar") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.7z") returned 0
	[0044.163] lstrlenA (lpString="*.7z") returned 4
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.tar") returned 0
	[0044.163] lstrlenA (lpString="*.tar") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.gzip") returned 0
	[0044.163] lstrlenA (lpString="*.gzip") returned 6
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.jpg") returned 0
	[0044.163] lstrlenA (lpString="*.jpg") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.jpeg") returned 0
	[0044.163] lstrlenA (lpString="*.jpeg") returned 6
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.psd") returned 0
	[0044.163] lstrlenA (lpString="*.psd") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.cdr") returned 0
	[0044.163] lstrlenA (lpString="*.cdr") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.dwg") returned 0
	[0044.163] lstrlenA (lpString="*.dwg") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.max") returned 0
	[0044.163] lstrlenA (lpString="*.max") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.bmp") returned 0
	[0044.163] lstrlenA (lpString="*.bmp") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.gif") returned 0
	[0044.163] lstrlenA (lpString="*.gif") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.png") returned 0
	[0044.163] lstrlenA (lpString="*.png") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.doc") returned 0
	[0044.163] lstrlenA (lpString="*.doc") returned 5
	[0044.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.docx") returned 0
	[0044.164] lstrlenA (lpString="*.docx") returned 6
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.xls") returned 0
	[0044.164] lstrlenA (lpString="*.xls") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.xlsx") returned 0
	[0044.164] lstrlenA (lpString="*.xlsx") returned 6
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ppt") returned 0
	[0044.164] lstrlenA (lpString="*.ppt") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pptx") returned 0
	[0044.164] lstrlenA (lpString="*.pptx") returned 6
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.txt") returned 0
	[0044.164] lstrlenA (lpString="*.txt") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pdf") returned 0
	[0044.164] lstrlenA (lpString="*.pdf") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.djvu") returned 0
	[0044.164] lstrlenA (lpString="*.djvu") returned 6
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.htm") returned 0
	[0044.164] lstrlenA (lpString="*.htm") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.html") returned 0
	[0044.164] lstrlenA (lpString="*.html") returned 6
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mdb") returned 0
	[0044.164] lstrlenA (lpString="*.mdb") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.cer") returned 0
	[0044.164] lstrlenA (lpString="*.cer") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.p12") returned 0
	[0044.164] lstrlenA (lpString="*.p12") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pfx") returned 0
	[0044.164] lstrlenA (lpString="*.pfx") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.kwm") returned 0
	[0044.164] lstrlenA (lpString="*.kwm") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pwm") returned 0
	[0044.164] lstrlenA (lpString="*.pwm") returned 5
	[0044.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.1cd") returned 0
	[0044.165] lstrlenA (lpString="*.1cd") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.md") returned 0
	[0044.165] lstrlenA (lpString="*.md") returned 4
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mdf") returned 0
	[0044.165] lstrlenA (lpString="*.mdf") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.dbf") returned 0
	[0044.165] lstrlenA (lpString="*.dbf") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.odt") returned 0
	[0044.165] lstrlenA (lpString="*.odt") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.vob") returned 0
	[0044.165] lstrlenA (lpString="*.vob") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ifo") returned 0
	[0044.165] lstrlenA (lpString="*.ifo") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.lnk") returned 0
	[0044.165] lstrlenA (lpString="*.lnk") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.torrent") returned 0
	[0044.165] lstrlenA (lpString="*.torrent") returned 9
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mov") returned 0
	[0044.165] lstrlenA (lpString="*.mov") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.m2v") returned 0
	[0044.165] lstrlenA (lpString="*.m2v") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.3gp") returned 0
	[0044.165] lstrlenA (lpString="*.3gp") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mpeg") returned 0
	[0044.165] lstrlenA (lpString="*.mpeg") returned 6
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mpg") returned 0
	[0044.165] lstrlenA (lpString="*.mpg") returned 5
	[0044.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.flv") returned 0
	[0044.165] lstrlenA (lpString="*.flv") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.avi") returned 0
	[0044.166] lstrlenA (lpString="*.avi") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mp4") returned 0
	[0044.166] lstrlenA (lpString="*.mp4") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.wmv") returned 0
	[0044.166] lstrlenA (lpString="*.wmv") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.divx") returned 0
	[0044.166] lstrlenA (lpString="*.divx") returned 6
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mkv") returned 0
	[0044.166] lstrlenA (lpString="*.mkv") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mp3") returned 0
	[0044.166] lstrlenA (lpString="*.mp3") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.wav") returned 0
	[0044.166] lstrlenA (lpString="*.wav") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.flac") returned 0
	[0044.166] lstrlenA (lpString="*.flac") returned 6
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ape") returned 0
	[0044.166] lstrlenA (lpString="*.ape") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.wma") returned 0
	[0044.166] lstrlenA (lpString="*.wma") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ac3") returned 0
	[0044.166] lstrlenA (lpString="*.ac3") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.exe") returned 0
	[0044.166] lstrlenA (lpString="*.exe") returned 5
	[0044.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.apk") returned 0
	[0044.166] lstrlenA (lpString="*.apk") returned 5
	[0044.166] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.166] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBHW6.CHM") returned -1
	[0044.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBHW6.CHM") returned -1
	[0044.167] lstrcmpiA (lpString1="", lpString2="VBHW6.CHM") returned -1
	[0044.167] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned="VBENDF98.CHM"
	[0044.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.167] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.167] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBHW6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM"
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.zip") returned 0
	[0044.167] lstrlenA (lpString="*.zip") returned 5
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.rar") returned 0
	[0044.167] lstrlenA (lpString="*.rar") returned 5
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.7z") returned 0
	[0044.167] lstrlenA (lpString="*.7z") returned 4
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.tar") returned 0
	[0044.167] lstrlenA (lpString="*.tar") returned 5
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.gzip") returned 0
	[0044.167] lstrlenA (lpString="*.gzip") returned 6
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.jpg") returned 0
	[0044.167] lstrlenA (lpString="*.jpg") returned 5
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.jpeg") returned 0
	[0044.167] lstrlenA (lpString="*.jpeg") returned 6
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.psd") returned 0
	[0044.167] lstrlenA (lpString="*.psd") returned 5
	[0044.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.cdr") returned 0
	[0044.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.dwg") returned 0
	[0044.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.max") returned 0
	[0044.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.bmp") returned 0
	[0044.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.gif") returned 0
	[0044.168] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.168] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.168] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBLR6.CHM") returned -1
	[0044.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBLR6.CHM") returned -1
	[0044.168] lstrcmpiA (lpString1="", lpString2="VBLR6.CHM") returned -1
	[0044.168] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned="VBHW6.CHM"
	[0044.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.168] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.168] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBLR6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM"
	[0044.169] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.169] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.169] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBOB6.CHM") returned -1
	[0044.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBOB6.CHM") returned -1
	[0044.169] lstrcmpiA (lpString1="", lpString2="VBOB6.CHM") returned -1
	[0044.169] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned="VBLR6.CHM"
	[0044.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBOB6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM"
	[0044.169] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.169] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.169] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBUI6.CHM") returned -1
	[0044.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBUI6.CHM") returned -1
	[0044.169] lstrcmpiA (lpString1="", lpString2="VBUI6.CHM") returned -1
	[0044.169] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned="VBOB6.CHM"
	[0044.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\"
	[0044.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned=""
	[0044.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBUI6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM"
	[0044.170] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0044.170] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.170] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.170] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.170] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VBE7.DLL") returned -1
	[0044.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBE7.DLL") returned -1
	[0044.170] lstrcmpiA (lpString1="", lpString2="VBE7.DLL") returned -1
	[0044.170] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned="*.*"
	[0044.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\"
	[0044.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned=""
	[0044.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt"
	[0044.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\how to decrypt files.txt")) returned 0xffffffff
	[0044.170] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.174] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.174] CloseHandle (hObject=0x90) returned 1
	[0044.174] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="VBE7.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL"
	[0044.174] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.174] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.174] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.175] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.175] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.175] lstrcmpA (lpString1=".", lpString2="VC") returned -1
	[0044.175] lstrcmpA (lpString1="..", lpString2="VC") returned -1
	[0044.175] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.175] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VC" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC"
	[0044.175] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.177] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.177] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.177] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.177] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.177] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdia100.dll") returned -1
	[0044.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia100.dll") returned -1
	[0044.177] lstrcmpiA (lpString1="", lpString2="msdia100.dll") returned -1
	[0044.177] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*") returned="*.*"
	[0044.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\"
	[0044.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned=""
	[0044.177] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt"
	[0044.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to decrypt files.txt")) returned 0xffffffff
	[0044.177] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.179] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.179] CloseHandle (hObject=0x8c) returned 1
	[0044.179] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="msdia100.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll"
	[0044.179] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdia90.dll") returned -1
	[0044.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia90.dll") returned -1
	[0044.180] lstrcmpiA (lpString1="", lpString2="msdia90.dll") returned -1
	[0044.180] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned="msdia100.dll"
	[0044.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\"
	[0044.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned=""
	[0044.180] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt"
	[0044.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to decrypt files.txt")) returned 0x20
	[0044.180] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="msdia90.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll"
	[0044.180] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.180] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.180] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.180] lstrcmpA (lpString1=".", lpString2="VGX") returned -1
	[0044.180] lstrcmpA (lpString1="..", lpString2="VGX") returned -1
	[0044.180] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.180] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VGX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX"
	[0044.180] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.181] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.181] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.181] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.181] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.181] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VGX.dll") returned -1
	[0044.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VGX.dll") returned -1
	[0044.181] lstrcmpiA (lpString1="", lpString2="VGX.dll") returned -1
	[0044.181] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*") returned="*.*"
	[0044.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\"
	[0044.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned=""
	[0044.181] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt"
	[0044.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how to decrypt files.txt")) returned 0xffffffff
	[0044.181] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.183] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.183] CloseHandle (hObject=0x8c) returned 1
	[0044.183] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", lpString2="VGX.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll"
	[0044.183] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.183] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.184] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.184] lstrcmpA (lpString1=".", lpString2="Visio Shared") returned -1
	[0044.184] lstrcmpA (lpString1="..", lpString2="Visio Shared") returned -1
	[0044.184] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.184] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Visio Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared"
	[0044.184] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.189] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.189] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.189] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.189] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.189] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.189] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1
	[0044.189] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1
	[0044.189] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*") returned="*.*"
	[0044.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", lpString2="Fonts" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts"
	[0044.190] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.201] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.201] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.201] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.201] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.201] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.201] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BIGFONT.SHX") returned 1
	[0044.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIGFONT.SHX") returned 1
	[0044.201] lstrcmpiA (lpString1="", lpString2="BIGFONT.SHX") returned -1
	[0044.201] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*") returned="*.*"
	[0044.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0xffffffff
	[0044.201] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.203] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.203] CloseHandle (hObject=0x90) returned 1
	[0044.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="BIGFONT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX"
	[0044.204] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.204] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.204] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHINESET.SHX") returned 1
	[0044.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHINESET.SHX") returned 1
	[0044.204] lstrcmpiA (lpString1="", lpString2="CHINESET.SHX") returned -1
	[0044.204] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned="BIGFONT.SHX"
	[0044.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.204] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="CHINESET.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX"
	[0044.204] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.204] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.204] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXTFONT.SHX") returned -1
	[0044.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXTFONT.SHX") returned 1
	[0044.204] lstrcmpiA (lpString1="", lpString2="EXTFONT.SHX") returned -1
	[0044.204] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned="CHINESET.SHX"
	[0044.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="EXTFONT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX"
	[0044.205] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.205] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.205] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GBCBIG.SHX") returned -1
	[0044.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GBCBIG.SHX") returned 1
	[0044.205] lstrcmpiA (lpString1="", lpString2="GBCBIG.SHX") returned -1
	[0044.205] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned="EXTFONT.SHX"
	[0044.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="GBCBIG.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX"
	[0044.205] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.205] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.205] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IC-TXT.SHX") returned -1
	[0044.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IC-TXT.SHX") returned -1
	[0044.205] lstrcmpiA (lpString1="", lpString2="IC-TXT.SHX") returned -1
	[0044.206] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned="GBCBIG.SHX"
	[0044.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.206] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="IC-TXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX"
	[0044.206] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.206] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.206] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ICAD.FMP") returned -1
	[0044.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ICAD.FMP") returned -1
	[0044.206] lstrcmpiA (lpString1="", lpString2="ICAD.FMP") returned -1
	[0044.206] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned="IC-TXT.SHX"
	[0044.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.206] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.206] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.207] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="ICAD.FMP" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP"
	[0044.207] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.207] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.207] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHGDTXT.SHX") returned -1
	[0044.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHGDTXT.SHX") returned -1
	[0044.207] lstrcmpiA (lpString1="", lpString2="WHGDTXT.SHX") returned -1
	[0044.207] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned="ICAD.FMP"
	[0044.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.207] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.207] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHGDTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX"
	[0044.207] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.207] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.207] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHGTXT.SHX") returned -1
	[0044.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHGTXT.SHX") returned -1
	[0044.207] lstrcmpiA (lpString1="", lpString2="WHGTXT.SHX") returned -1
	[0044.207] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned="WHGDTXT.SHX"
	[0044.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.207] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHGTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX"
	[0044.208] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.208] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.208] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHTGTXT.SHX") returned -1
	[0044.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHTGTXT.SHX") returned -1
	[0044.208] lstrcmpiA (lpString1="", lpString2="WHTGTXT.SHX") returned -1
	[0044.208] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned="WHGTXT.SHX"
	[0044.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHTGTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX"
	[0044.208] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.208] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.208] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHTMTXT.SHX") returned -1
	[0044.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHTMTXT.SHX") returned -1
	[0044.208] lstrcmpiA (lpString1="", lpString2="WHTMTXT.SHX") returned -1
	[0044.208] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned="WHTGTXT.SHX"
	[0044.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\"
	[0044.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned=""
	[0044.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt"
	[0044.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20
	[0044.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHTMTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX"
	[0044.209] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.209] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.209] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.209] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.209] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.209] lstrcmpA (lpString1=".", lpString2="VSTO") returned -1
	[0044.209] lstrcmpA (lpString1="..", lpString2="VSTO") returned -1
	[0044.209] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.209] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VSTO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO"
	[0044.209] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.211] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.211] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.211] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.211] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.211] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.211] lstrcmpA (lpString1=".", lpString2="10.0") returned -1
	[0044.211] lstrcmpA (lpString1="..", lpString2="10.0") returned -1
	[0044.211] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned="*.*"
	[0044.211] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="10.0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0"
	[0044.211] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.225] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.225] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.225] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.225] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.225] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.225] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0044.225] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0044.225] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned="*.*"
	[0044.225] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033"
	[0044.225] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7e68
	[0044.226] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.226] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.226] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.226] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.227] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.227] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VSTOInstallerUI.dll") returned -1
	[0044.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstallerUI.dll") returned -1
	[0044.227] lstrcmpiA (lpString1="", lpString2="VSTOInstallerUI.dll") returned -1
	[0044.227] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*") returned="*.*"
	[0044.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\"
	[0044.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned=""
	[0044.227] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0044.227] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0044.230] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.230] CloseHandle (hObject=0x94) returned 1
	[0044.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="VSTOInstallerUI.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll"
	[0044.231] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.231] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.231] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VSTOLoaderUI.dll") returned -1
	[0044.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoaderUI.dll") returned -1
	[0044.231] lstrcmpiA (lpString1="", lpString2="VSTOLoaderUI.dll") returned -1
	[0044.231] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned="VSTOInstallerUI.dll"
	[0044.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\"
	[0044.231] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned=""
	[0044.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.231] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\how to decrypt files.txt")) returned 0x20
	[0044.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="VSTOLoaderUI.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll"
	[0044.231] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0044.231] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.232] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VSTOInstaller.config") returned -1
	[0044.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.config") returned -1
	[0044.232] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.config") returned -1
	[0044.232] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned="*.*"
	[0044.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\"
	[0044.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned=""
	[0044.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt"
	[0044.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0xffffffff
	[0044.232] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.239] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.239] CloseHandle (hObject=0x90) returned 1
	[0044.239] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOInstaller.config" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config"
	[0044.240] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VSTOInstaller.exe") returned -1
	[0044.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.exe") returned -1
	[0044.240] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.exe") returned -1
	[0044.240] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned="VSTOInstaller.config"
	[0044.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\"
	[0044.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned=""
	[0044.240] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt"
	[0044.240] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0x20
	[0044.240] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOInstaller.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe"
	[0044.240] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe"
	[0044.240] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe"
	[0044.240] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe."
	[0044.240] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.Boom") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.Boom"
	[0044.240] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.243] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18558
	[0044.243] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6a612c00, dwHighDateTime=0x1cb6585), lpLastAccessTime=0x407536*(dwLowDateTime=0xd6d27ac0, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6a612c00, dwHighDateTime=0x1cb6585)) returned 1
	[0044.243] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.243] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x18535, lpOverlapped=0x0) returned 1
	[0044.260] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="VSTOInstaller.exe"
	[0044.261] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.261] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x18535, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x18535, lpOverlapped=0x0) returned 1
	[0044.261] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.262] CloseHandle (hObject=0x90) returned 1
	[0044.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.Boom" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.boom")) returned 1
	[0044.264] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.264] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.264] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VSTOLoader.dll") returned -1
	[0044.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoader.dll") returned -1
	[0044.264] lstrcmpiA (lpString1="", lpString2="VSTOLoader.dll") returned -1
	[0044.264] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="VSTOInstaller.exe"
	[0044.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\"
	[0044.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned=""
	[0044.264] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt"
	[0044.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0x20
	[0044.264] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOLoader.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll"
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.zip") returned 0
	[0044.265] lstrlenA (lpString="*.zip") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.rar") returned 0
	[0044.265] lstrlenA (lpString="*.rar") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.7z") returned 0
	[0044.265] lstrlenA (lpString="*.7z") returned 4
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.tar") returned 0
	[0044.265] lstrlenA (lpString="*.tar") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.gzip") returned 0
	[0044.265] lstrlenA (lpString="*.gzip") returned 6
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.jpg") returned 0
	[0044.265] lstrlenA (lpString="*.jpg") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.jpeg") returned 0
	[0044.265] lstrlenA (lpString="*.jpeg") returned 6
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.psd") returned 0
	[0044.265] lstrlenA (lpString="*.psd") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.cdr") returned 0
	[0044.265] lstrlenA (lpString="*.cdr") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.dwg") returned 0
	[0044.265] lstrlenA (lpString="*.dwg") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.max") returned 0
	[0044.265] lstrlenA (lpString="*.max") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.bmp") returned 0
	[0044.265] lstrlenA (lpString="*.bmp") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.gif") returned 0
	[0044.265] lstrlenA (lpString="*.gif") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.png") returned 0
	[0044.265] lstrlenA (lpString="*.png") returned 5
	[0044.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.doc") returned 0
	[0044.266] lstrlenA (lpString="*.doc") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.docx") returned 0
	[0044.266] lstrlenA (lpString="*.docx") returned 6
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.xls") returned 0
	[0044.266] lstrlenA (lpString="*.xls") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.xlsx") returned 0
	[0044.266] lstrlenA (lpString="*.xlsx") returned 6
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.ppt") returned 0
	[0044.266] lstrlenA (lpString="*.ppt") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.pptx") returned 0
	[0044.266] lstrlenA (lpString="*.pptx") returned 6
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.txt") returned 0
	[0044.266] lstrlenA (lpString="*.txt") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.pdf") returned 0
	[0044.266] lstrlenA (lpString="*.pdf") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.djvu") returned 0
	[0044.266] lstrlenA (lpString="*.djvu") returned 6
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.htm") returned 0
	[0044.266] lstrlenA (lpString="*.htm") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.html") returned 0
	[0044.266] lstrlenA (lpString="*.html") returned 6
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mdb") returned 0
	[0044.266] lstrlenA (lpString="*.mdb") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.cer") returned 0
	[0044.266] lstrlenA (lpString="*.cer") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.p12") returned 0
	[0044.266] lstrlenA (lpString="*.p12") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.pfx") returned 0
	[0044.266] lstrlenA (lpString="*.pfx") returned 5
	[0044.266] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.kwm") returned 0
	[0044.266] lstrlenA (lpString="*.kwm") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.pwm") returned 0
	[0044.267] lstrlenA (lpString="*.pwm") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.1cd") returned 0
	[0044.267] lstrlenA (lpString="*.1cd") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.md") returned 0
	[0044.267] lstrlenA (lpString="*.md") returned 4
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mdf") returned 0
	[0044.267] lstrlenA (lpString="*.mdf") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.dbf") returned 0
	[0044.267] lstrlenA (lpString="*.dbf") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.odt") returned 0
	[0044.267] lstrlenA (lpString="*.odt") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.vob") returned 0
	[0044.267] lstrlenA (lpString="*.vob") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.ifo") returned 0
	[0044.267] lstrlenA (lpString="*.ifo") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.lnk") returned 0
	[0044.267] lstrlenA (lpString="*.lnk") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.torrent") returned 0
	[0044.267] lstrlenA (lpString="*.torrent") returned 9
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mov") returned 0
	[0044.267] lstrlenA (lpString="*.mov") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.m2v") returned 0
	[0044.267] lstrlenA (lpString="*.m2v") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.3gp") returned 0
	[0044.267] lstrlenA (lpString="*.3gp") returned 5
	[0044.267] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mpeg") returned 0
	[0044.268] lstrlenA (lpString="*.mpeg") returned 6
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mpg") returned 0
	[0044.268] lstrlenA (lpString="*.mpg") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.flv") returned 0
	[0044.268] lstrlenA (lpString="*.flv") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.avi") returned 0
	[0044.268] lstrlenA (lpString="*.avi") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mp4") returned 0
	[0044.268] lstrlenA (lpString="*.mp4") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.wmv") returned 0
	[0044.268] lstrlenA (lpString="*.wmv") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.divx") returned 0
	[0044.268] lstrlenA (lpString="*.divx") returned 6
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mkv") returned 0
	[0044.268] lstrlenA (lpString="*.mkv") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.mp3") returned 0
	[0044.268] lstrlenA (lpString="*.mp3") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.wav") returned 0
	[0044.268] lstrlenA (lpString="*.wav") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.flac") returned 0
	[0044.268] lstrlenA (lpString="*.flac") returned 6
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.ape") returned 0
	[0044.268] lstrlenA (lpString="*.ape") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.wma") returned 0
	[0044.268] lstrlenA (lpString="*.wma") returned 5
	[0044.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.ac3") returned 0
	[0044.268] lstrlenA (lpString="*.ac3") returned 5
	[0044.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.exe") returned 0
	[0044.269] lstrlenA (lpString="*.exe") returned 5
	[0044.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", pszSpec="*.apk") returned 0
	[0044.269] lstrlenA (lpString="*.apk") returned 5
	[0044.269] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.269] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VSTOMessageProvider.dll") returned -1
	[0044.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOMessageProvider.dll") returned -1
	[0044.269] lstrcmpiA (lpString1="", lpString2="VSTOMessageProvider.dll") returned -1
	[0044.269] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned="VSTOLoader.dll"
	[0044.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\"
	[0044.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned=""
	[0044.269] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt"
	[0044.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0x20
	[0044.270] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOMessageProvider.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll"
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.zip") returned 0
	[0044.270] lstrlenA (lpString="*.zip") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.rar") returned 0
	[0044.270] lstrlenA (lpString="*.rar") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.7z") returned 0
	[0044.270] lstrlenA (lpString="*.7z") returned 4
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.tar") returned 0
	[0044.270] lstrlenA (lpString="*.tar") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.gzip") returned 0
	[0044.270] lstrlenA (lpString="*.gzip") returned 6
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.jpg") returned 0
	[0044.270] lstrlenA (lpString="*.jpg") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.jpeg") returned 0
	[0044.270] lstrlenA (lpString="*.jpeg") returned 6
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.psd") returned 0
	[0044.270] lstrlenA (lpString="*.psd") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.cdr") returned 0
	[0044.270] lstrlenA (lpString="*.cdr") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.dwg") returned 0
	[0044.270] lstrlenA (lpString="*.dwg") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.max") returned 0
	[0044.270] lstrlenA (lpString="*.max") returned 5
	[0044.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.bmp") returned 0
	[0044.270] lstrlenA (lpString="*.bmp") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.gif") returned 0
	[0044.271] lstrlenA (lpString="*.gif") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.png") returned 0
	[0044.271] lstrlenA (lpString="*.png") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.doc") returned 0
	[0044.271] lstrlenA (lpString="*.doc") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.docx") returned 0
	[0044.271] lstrlenA (lpString="*.docx") returned 6
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.xls") returned 0
	[0044.271] lstrlenA (lpString="*.xls") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.xlsx") returned 0
	[0044.271] lstrlenA (lpString="*.xlsx") returned 6
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.ppt") returned 0
	[0044.271] lstrlenA (lpString="*.ppt") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.pptx") returned 0
	[0044.271] lstrlenA (lpString="*.pptx") returned 6
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.txt") returned 0
	[0044.271] lstrlenA (lpString="*.txt") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.pdf") returned 0
	[0044.271] lstrlenA (lpString="*.pdf") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.djvu") returned 0
	[0044.271] lstrlenA (lpString="*.djvu") returned 6
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.htm") returned 0
	[0044.271] lstrlenA (lpString="*.htm") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.html") returned 0
	[0044.271] lstrlenA (lpString="*.html") returned 6
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mdb") returned 0
	[0044.271] lstrlenA (lpString="*.mdb") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.cer") returned 0
	[0044.271] lstrlenA (lpString="*.cer") returned 5
	[0044.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.p12") returned 0
	[0044.272] lstrlenA (lpString="*.p12") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.pfx") returned 0
	[0044.272] lstrlenA (lpString="*.pfx") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.kwm") returned 0
	[0044.272] lstrlenA (lpString="*.kwm") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.pwm") returned 0
	[0044.272] lstrlenA (lpString="*.pwm") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.1cd") returned 0
	[0044.272] lstrlenA (lpString="*.1cd") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.md") returned 0
	[0044.272] lstrlenA (lpString="*.md") returned 4
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mdf") returned 0
	[0044.272] lstrlenA (lpString="*.mdf") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.dbf") returned 0
	[0044.272] lstrlenA (lpString="*.dbf") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.odt") returned 0
	[0044.272] lstrlenA (lpString="*.odt") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.vob") returned 0
	[0044.272] lstrlenA (lpString="*.vob") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.ifo") returned 0
	[0044.272] lstrlenA (lpString="*.ifo") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.lnk") returned 0
	[0044.272] lstrlenA (lpString="*.lnk") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.torrent") returned 0
	[0044.272] lstrlenA (lpString="*.torrent") returned 9
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mov") returned 0
	[0044.272] lstrlenA (lpString="*.mov") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.m2v") returned 0
	[0044.272] lstrlenA (lpString="*.m2v") returned 5
	[0044.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.3gp") returned 0
	[0044.273] lstrlenA (lpString="*.3gp") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mpeg") returned 0
	[0044.273] lstrlenA (lpString="*.mpeg") returned 6
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mpg") returned 0
	[0044.273] lstrlenA (lpString="*.mpg") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.flv") returned 0
	[0044.273] lstrlenA (lpString="*.flv") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.avi") returned 0
	[0044.273] lstrlenA (lpString="*.avi") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mp4") returned 0
	[0044.273] lstrlenA (lpString="*.mp4") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.wmv") returned 0
	[0044.273] lstrlenA (lpString="*.wmv") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.divx") returned 0
	[0044.273] lstrlenA (lpString="*.divx") returned 6
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mkv") returned 0
	[0044.273] lstrlenA (lpString="*.mkv") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.mp3") returned 0
	[0044.273] lstrlenA (lpString="*.mp3") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.wav") returned 0
	[0044.273] lstrlenA (lpString="*.wav") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.flac") returned 0
	[0044.273] lstrlenA (lpString="*.flac") returned 6
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.ape") returned 0
	[0044.273] lstrlenA (lpString="*.ape") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.wma") returned 0
	[0044.273] lstrlenA (lpString="*.wma") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.ac3") returned 0
	[0044.273] lstrlenA (lpString="*.ac3") returned 5
	[0044.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.exe") returned 0
	[0044.273] lstrlenA (lpString="*.exe") returned 5
	[0044.274] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", pszSpec="*.apk") returned 0
	[0044.274] lstrlenA (lpString="*.apk") returned 5
	[0044.274] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.274] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.274] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.274] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="vstoee.dll") returned -1
	[0044.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee.dll") returned -1
	[0044.274] lstrcmpiA (lpString1="", lpString2="vstoee.dll") returned -1
	[0044.274] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned="*.*"
	[0044.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\"
	[0044.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned=""
	[0044.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt"
	[0044.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt")) returned 0xffffffff
	[0044.274] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.277] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.277] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.278] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.278] CloseHandle (hObject=0x8c) returned 1
	[0044.279] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="vstoee.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.zip") returned 0
	[0044.279] lstrlenA (lpString="*.zip") returned 5
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.rar") returned 0
	[0044.279] lstrlenA (lpString="*.rar") returned 5
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.7z") returned 0
	[0044.279] lstrlenA (lpString="*.7z") returned 4
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.tar") returned 0
	[0044.279] lstrlenA (lpString="*.tar") returned 5
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.gzip") returned 0
	[0044.279] lstrlenA (lpString="*.gzip") returned 6
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.jpg") returned 0
	[0044.279] lstrlenA (lpString="*.jpg") returned 5
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.jpeg") returned 0
	[0044.279] lstrlenA (lpString="*.jpeg") returned 6
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.psd") returned 0
	[0044.279] lstrlenA (lpString="*.psd") returned 5
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.cdr") returned 0
	[0044.279] lstrlenA (lpString="*.cdr") returned 5
	[0044.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.dwg") returned 0
	[0044.280] lstrlenA (lpString="*.dwg") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.max") returned 0
	[0044.280] lstrlenA (lpString="*.max") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.bmp") returned 0
	[0044.280] lstrlenA (lpString="*.bmp") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.gif") returned 0
	[0044.280] lstrlenA (lpString="*.gif") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.png") returned 0
	[0044.280] lstrlenA (lpString="*.png") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.doc") returned 0
	[0044.280] lstrlenA (lpString="*.doc") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.docx") returned 0
	[0044.280] lstrlenA (lpString="*.docx") returned 6
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.xls") returned 0
	[0044.280] lstrlenA (lpString="*.xls") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.xlsx") returned 0
	[0044.280] lstrlenA (lpString="*.xlsx") returned 6
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.ppt") returned 0
	[0044.280] lstrlenA (lpString="*.ppt") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.pptx") returned 0
	[0044.280] lstrlenA (lpString="*.pptx") returned 6
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.txt") returned 0
	[0044.280] lstrlenA (lpString="*.txt") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.pdf") returned 0
	[0044.280] lstrlenA (lpString="*.pdf") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.djvu") returned 0
	[0044.280] lstrlenA (lpString="*.djvu") returned 6
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.htm") returned 0
	[0044.280] lstrlenA (lpString="*.htm") returned 5
	[0044.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.html") returned 0
	[0044.281] lstrlenA (lpString="*.html") returned 6
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mdb") returned 0
	[0044.281] lstrlenA (lpString="*.mdb") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.cer") returned 0
	[0044.281] lstrlenA (lpString="*.cer") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.p12") returned 0
	[0044.281] lstrlenA (lpString="*.p12") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.pfx") returned 0
	[0044.281] lstrlenA (lpString="*.pfx") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.kwm") returned 0
	[0044.281] lstrlenA (lpString="*.kwm") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.pwm") returned 0
	[0044.281] lstrlenA (lpString="*.pwm") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.1cd") returned 0
	[0044.281] lstrlenA (lpString="*.1cd") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.md") returned 0
	[0044.281] lstrlenA (lpString="*.md") returned 4
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mdf") returned 0
	[0044.281] lstrlenA (lpString="*.mdf") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.dbf") returned 0
	[0044.281] lstrlenA (lpString="*.dbf") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.odt") returned 0
	[0044.281] lstrlenA (lpString="*.odt") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.vob") returned 0
	[0044.281] lstrlenA (lpString="*.vob") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.ifo") returned 0
	[0044.281] lstrlenA (lpString="*.ifo") returned 5
	[0044.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.lnk") returned 0
	[0044.281] lstrlenA (lpString="*.lnk") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.torrent") returned 0
	[0044.282] lstrlenA (lpString="*.torrent") returned 9
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mov") returned 0
	[0044.282] lstrlenA (lpString="*.mov") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.m2v") returned 0
	[0044.282] lstrlenA (lpString="*.m2v") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.3gp") returned 0
	[0044.282] lstrlenA (lpString="*.3gp") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mpeg") returned 0
	[0044.282] lstrlenA (lpString="*.mpeg") returned 6
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mpg") returned 0
	[0044.282] lstrlenA (lpString="*.mpg") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.flv") returned 0
	[0044.282] lstrlenA (lpString="*.flv") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.avi") returned 0
	[0044.282] lstrlenA (lpString="*.avi") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mp4") returned 0
	[0044.282] lstrlenA (lpString="*.mp4") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.wmv") returned 0
	[0044.282] lstrlenA (lpString="*.wmv") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.divx") returned 0
	[0044.282] lstrlenA (lpString="*.divx") returned 6
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mkv") returned 0
	[0044.282] lstrlenA (lpString="*.mkv") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.mp3") returned 0
	[0044.282] lstrlenA (lpString="*.mp3") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.wav") returned 0
	[0044.282] lstrlenA (lpString="*.wav") returned 5
	[0044.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.flac") returned 0
	[0044.282] lstrlenA (lpString="*.flac") returned 6
	[0044.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.ape") returned 0
	[0044.283] lstrlenA (lpString="*.ape") returned 5
	[0044.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.wma") returned 0
	[0044.283] lstrlenA (lpString="*.wma") returned 5
	[0044.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.ac3") returned 0
	[0044.283] lstrlenA (lpString="*.ac3") returned 5
	[0044.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.exe") returned 0
	[0044.283] lstrlenA (lpString="*.exe") returned 5
	[0044.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", pszSpec="*.apk") returned 0
	[0044.283] lstrlenA (lpString="*.apk") returned 5
	[0044.283] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.283] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.283] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="vstoee100.tlb") returned -1
	[0044.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee100.tlb") returned -1
	[0044.283] lstrcmpiA (lpString1="", lpString2="vstoee100.tlb") returned -1
	[0044.283] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned="vstoee.dll"
	[0044.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\"
	[0044.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned=""
	[0044.283] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt"
	[0044.283] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt")) returned 0x20
	[0044.284] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="vstoee100.tlb" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb"
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.zip") returned 0
	[0044.284] lstrlenA (lpString="*.zip") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.rar") returned 0
	[0044.284] lstrlenA (lpString="*.rar") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.7z") returned 0
	[0044.284] lstrlenA (lpString="*.7z") returned 4
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.tar") returned 0
	[0044.284] lstrlenA (lpString="*.tar") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.gzip") returned 0
	[0044.284] lstrlenA (lpString="*.gzip") returned 6
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.jpg") returned 0
	[0044.284] lstrlenA (lpString="*.jpg") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.jpeg") returned 0
	[0044.284] lstrlenA (lpString="*.jpeg") returned 6
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.psd") returned 0
	[0044.284] lstrlenA (lpString="*.psd") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.cdr") returned 0
	[0044.284] lstrlenA (lpString="*.cdr") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.dwg") returned 0
	[0044.284] lstrlenA (lpString="*.dwg") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.max") returned 0
	[0044.284] lstrlenA (lpString="*.max") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.bmp") returned 0
	[0044.284] lstrlenA (lpString="*.bmp") returned 5
	[0044.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.gif") returned 0
	[0044.285] lstrlenA (lpString="*.gif") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.png") returned 0
	[0044.285] lstrlenA (lpString="*.png") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.doc") returned 0
	[0044.285] lstrlenA (lpString="*.doc") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.docx") returned 0
	[0044.285] lstrlenA (lpString="*.docx") returned 6
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.xls") returned 0
	[0044.285] lstrlenA (lpString="*.xls") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.xlsx") returned 0
	[0044.285] lstrlenA (lpString="*.xlsx") returned 6
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.ppt") returned 0
	[0044.285] lstrlenA (lpString="*.ppt") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.pptx") returned 0
	[0044.285] lstrlenA (lpString="*.pptx") returned 6
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.txt") returned 0
	[0044.285] lstrlenA (lpString="*.txt") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.pdf") returned 0
	[0044.285] lstrlenA (lpString="*.pdf") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.djvu") returned 0
	[0044.285] lstrlenA (lpString="*.djvu") returned 6
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.htm") returned 0
	[0044.285] lstrlenA (lpString="*.htm") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.html") returned 0
	[0044.285] lstrlenA (lpString="*.html") returned 6
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mdb") returned 0
	[0044.285] lstrlenA (lpString="*.mdb") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.cer") returned 0
	[0044.285] lstrlenA (lpString="*.cer") returned 5
	[0044.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.p12") returned 0
	[0044.286] lstrlenA (lpString="*.p12") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.pfx") returned 0
	[0044.286] lstrlenA (lpString="*.pfx") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.kwm") returned 0
	[0044.286] lstrlenA (lpString="*.kwm") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.pwm") returned 0
	[0044.286] lstrlenA (lpString="*.pwm") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.1cd") returned 0
	[0044.286] lstrlenA (lpString="*.1cd") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.md") returned 0
	[0044.286] lstrlenA (lpString="*.md") returned 4
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mdf") returned 0
	[0044.286] lstrlenA (lpString="*.mdf") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.dbf") returned 0
	[0044.286] lstrlenA (lpString="*.dbf") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.odt") returned 0
	[0044.286] lstrlenA (lpString="*.odt") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.vob") returned 0
	[0044.286] lstrlenA (lpString="*.vob") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.ifo") returned 0
	[0044.286] lstrlenA (lpString="*.ifo") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.lnk") returned 0
	[0044.286] lstrlenA (lpString="*.lnk") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.torrent") returned 0
	[0044.286] lstrlenA (lpString="*.torrent") returned 9
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mov") returned 0
	[0044.286] lstrlenA (lpString="*.mov") returned 5
	[0044.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.m2v") returned 0
	[0044.286] lstrlenA (lpString="*.m2v") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.3gp") returned 0
	[0044.287] lstrlenA (lpString="*.3gp") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mpeg") returned 0
	[0044.287] lstrlenA (lpString="*.mpeg") returned 6
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mpg") returned 0
	[0044.287] lstrlenA (lpString="*.mpg") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.flv") returned 0
	[0044.287] lstrlenA (lpString="*.flv") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.avi") returned 0
	[0044.287] lstrlenA (lpString="*.avi") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mp4") returned 0
	[0044.287] lstrlenA (lpString="*.mp4") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.wmv") returned 0
	[0044.287] lstrlenA (lpString="*.wmv") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.divx") returned 0
	[0044.287] lstrlenA (lpString="*.divx") returned 6
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mkv") returned 0
	[0044.287] lstrlenA (lpString="*.mkv") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.mp3") returned 0
	[0044.287] lstrlenA (lpString="*.mp3") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.wav") returned 0
	[0044.287] lstrlenA (lpString="*.wav") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.flac") returned 0
	[0044.287] lstrlenA (lpString="*.flac") returned 6
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.ape") returned 0
	[0044.287] lstrlenA (lpString="*.ape") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.wma") returned 0
	[0044.287] lstrlenA (lpString="*.wma") returned 5
	[0044.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.ac3") returned 0
	[0044.287] lstrlenA (lpString="*.ac3") returned 5
	[0044.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.exe") returned 0
	[0044.288] lstrlenA (lpString="*.exe") returned 5
	[0044.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", pszSpec="*.apk") returned 0
	[0044.288] lstrlenA (lpString="*.apk") returned 5
	[0044.288] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.288] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.288] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="vstoee90.tlb") returned -1
	[0044.288] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee90.tlb") returned -1
	[0044.288] lstrcmpiA (lpString1="", lpString2="vstoee90.tlb") returned -1
	[0044.288] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned="vstoee100.tlb"
	[0044.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\"
	[0044.288] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned=""
	[0044.288] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt"
	[0044.288] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt")) returned 0x20
	[0044.288] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="vstoee90.tlb" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb"
	[0044.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.zip") returned 0
	[0044.288] lstrlenA (lpString="*.zip") returned 5
	[0044.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.rar") returned 0
	[0044.288] lstrlenA (lpString="*.rar") returned 5
	[0044.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.7z") returned 0
	[0044.288] lstrlenA (lpString="*.7z") returned 4
	[0044.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.tar") returned 0
	[0044.289] lstrlenA (lpString="*.tar") returned 5
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.gzip") returned 0
	[0044.289] lstrlenA (lpString="*.gzip") returned 6
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.jpg") returned 0
	[0044.289] lstrlenA (lpString="*.jpg") returned 5
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.jpeg") returned 0
	[0044.289] lstrlenA (lpString="*.jpeg") returned 6
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.psd") returned 0
	[0044.289] lstrlenA (lpString="*.psd") returned 5
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.cdr") returned 0
	[0044.289] lstrlenA (lpString="*.cdr") returned 5
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.dwg") returned 0
	[0044.289] lstrlenA (lpString="*.dwg") returned 5
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.max") returned 0
	[0044.289] lstrlenA (lpString="*.max") returned 5
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.bmp") returned 0
	[0044.289] lstrlenA (lpString="*.bmp") returned 5
	[0044.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", pszSpec="*.gif") returned 0
	[0044.289] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.290] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.290] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.290] lstrcmpA (lpString1=".", lpString2="Web Folders") returned -1
	[0044.290] lstrcmpA (lpString1="..", lpString2="Web Folders") returned -1
	[0044.290] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.290] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Web Folders" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders"
	[0044.290] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.291] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.291] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.291] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.291] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.291] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.291] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0044.291] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0044.292] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned="*.*"
	[0044.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033"
	[0044.292] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.292] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.292] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.292] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.292] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.292] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.292] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.292] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSVINT.DLL") returned -1
	[0044.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSVINT.DLL") returned -1
	[0044.292] lstrcmpiA (lpString1="", lpString2="MSOSVINT.DLL") returned -1
	[0044.292] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*") returned="*.*"
	[0044.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\"
	[0044.292] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned=""
	[0044.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.292] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0044.293] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.296] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.296] CloseHandle (hObject=0x90) returned 1
	[0044.296] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", lpString2="MSOSVINT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL"
	[0044.296] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.296] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.297] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.297] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.297] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSV.DLL") returned -1
	[0044.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSV.DLL") returned -1
	[0044.297] lstrcmpiA (lpString1="", lpString2="MSOSV.DLL") returned -1
	[0044.297] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned="*.*"
	[0044.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\"
	[0044.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned=""
	[0044.297] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt"
	[0044.297] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how to decrypt files.txt")) returned 0xffffffff
	[0044.297] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.299] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.299] CloseHandle (hObject=0x8c) returned 1
	[0044.299] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="MSOSV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL"
	[0044.299] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.300] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.300] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.300] lstrcmpA (lpString1=".", lpString2="Web Server Extensions") returned -1
	[0044.300] lstrcmpA (lpString1="..", lpString2="Web Server Extensions") returned -1
	[0044.300] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*"
	[0044.300] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Web Server Extensions" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions"
	[0044.300] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0044.302] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.302] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.302] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.302] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.302] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.302] lstrcmpA (lpString1=".", lpString2="14") returned -1
	[0044.302] lstrcmpA (lpString1="..", lpString2="14") returned -1
	[0044.302] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*") returned="*.*"
	[0044.302] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", lpString2="14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14"
	[0044.302] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e28
	[0044.302] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.302] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.302] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.302] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.302] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.302] lstrcmpA (lpString1=".", lpString2="BIN") returned -1
	[0044.302] lstrcmpA (lpString1="..", lpString2="BIN") returned -1
	[0044.302] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*") returned="*.*"
	[0044.303] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", lpString2="BIN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN"
	[0044.303] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7e68
	[0044.304] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.304] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.304] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.304] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.304] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.304] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0044.304] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0044.304] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned="*.*"
	[0044.304] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033"
	[0044.304] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7ea8
	[0044.304] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.304] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0044.305] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.305] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.305] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0044.305] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0044.305] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FPEXT.MSG") returned -1
	[0044.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPEXT.MSG") returned 1
	[0044.305] lstrcmpiA (lpString1="", lpString2="FPEXT.MSG") returned -1
	[0044.305] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*") returned="*.*"
	[0044.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\"
	[0044.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned=""
	[0044.305] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt"
	[0044.305] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0044.305] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0044.307] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.307] CloseHandle (hObject=0x98) returned 1
	[0044.307] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", lpString2="FPEXT.MSG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG"
	[0044.307] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0044.307] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0044.308] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.308] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.308] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FPSRVUTL.DLL") returned -1
	[0044.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPSRVUTL.DLL") returned 1
	[0044.308] lstrcmpiA (lpString1="", lpString2="FPSRVUTL.DLL") returned -1
	[0044.308] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned="*.*"
	[0044.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\"
	[0044.308] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned=""
	[0044.308] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt"
	[0044.308] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt")) returned 0xffffffff
	[0044.308] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0044.310] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.310] CloseHandle (hObject=0x94) returned 1
	[0044.310] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="FPSRVUTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL"
	[0044.310] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.310] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.310] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FPWEC.DLL") returned -1
	[0044.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPWEC.DLL") returned 1
	[0044.310] lstrcmpiA (lpString1="", lpString2="FPWEC.DLL") returned -1
	[0044.310] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned="FPSRVUTL.DLL"
	[0044.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\"
	[0044.310] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned=""
	[0044.311] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt"
	[0044.311] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt")) returned 0x20
	[0044.311] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="FPWEC.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL"
	[0044.311] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0044.311] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.311] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.311] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.311] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.311] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.311] FindNextFileA (in: hFindFile=0x8ba318, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0044.312] FindClose (in: hFindFile=0x8ba318 | out: hFindFile=0x8ba318) returned 1
	[0044.312] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.312] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0044.312] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0044.312] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0044.312] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="Services" | out: lpString1="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services"
	[0044.312] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0044.312] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.312] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.312] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.312] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.312] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.312] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.312] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="verisign.bmp") returned -1
	[0044.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="verisign.bmp") returned -1
	[0044.312] lstrcmpiA (lpString1="", lpString2="verisign.bmp") returned -1
	[0044.313] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Services\\*.*") returned="*.*"
	[0044.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Services\\" | out: lpString1="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\"
	[0044.313] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Services\\" | out: pszPath="C:\\Program Files\\Common Files\\Services\\") returned=""
	[0044.313] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Services\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt"
	[0044.313] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\services\\how to decrypt files.txt")) returned 0xffffffff
	[0044.313] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\services\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0044.314] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.314] CloseHandle (hObject=0x88) returned 1
	[0044.315] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Services\\", lpString2="verisign.bmp" | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp"
	[0044.315] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Services\\verisign.bmp" | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp"
	[0044.315] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Services\\verisign.bmp" | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp"
	[0044.315] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp.") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp."
	[0044.315] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp.Boom") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp.Boom"
	[0044.315] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0044.316] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0044.316] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.316] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.316] lstrcmpA (lpString1=".", lpString2="SpeechEngines") returned -1
	[0044.316] lstrcmpA (lpString1="..", lpString2="SpeechEngines") returned -1
	[0044.316] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0044.316] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="SpeechEngines" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines"
	[0044.316] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0044.317] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.317] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.317] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.317] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.317] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.317] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1
	[0044.317] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1
	[0044.317] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\*.*") returned="*.*"
	[0044.317] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\", lpString2="Microsoft" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft"
	[0044.317] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e28
	[0044.318] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.318] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.318] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.318] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.319] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.319] lstrcmpA (lpString1=".", lpString2="TTS20") returned -1
	[0044.319] lstrcmpA (lpString1="..", lpString2="TTS20") returned -1
	[0044.319] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*") returned="*.*"
	[0044.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpString2="TTS20" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20"
	[0044.319] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e68
	[0044.319] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.319] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.319] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.319] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.319] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.319] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.319] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.319] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*"
	[0044.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US"
	[0044.319] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ea8
	[0044.320] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.320] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.320] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.320] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.320] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.320] lstrcmpA (lpString1=".", lpString2="enu-dsk") returned -1
	[0044.320] lstrcmpA (lpString1="..", lpString2="enu-dsk") returned -1
	[0044.320] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*"
	[0044.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="enu-dsk" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk"
	[0044.320] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7ee8
	[0044.320] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.320] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0044.321] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.321] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.321] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0044.321] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0044.321] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.321] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.321] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTTSFrontendENU.dll") returned -1
	[0044.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSFrontendENU.dll") returned -1
	[0044.321] lstrcmpiA (lpString1="", lpString2="MSTTSFrontendENU.dll") returned -1
	[0044.321] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*"
	[0044.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\"
	[0044.321] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned=""
	[0044.321] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.321] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0044.321] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0044.322] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0044.322] CloseHandle (hObject=0xffffffff) returned 0
	[0044.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="MSTTSFrontendENU.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll"
	[0044.322] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0044.322] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0044.322] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTTSLoc.dll.mui") returned -1
	[0044.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSLoc.dll.mui") returned -1
	[0044.322] lstrcmpiA (lpString1="", lpString2="MSTTSLoc.dll.mui") returned -1
	[0044.322] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned="MSTTSFrontendENU.dll"
	[0044.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\"
	[0044.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned=""
	[0044.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0044.323] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0044.323] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0044.323] CloseHandle (hObject=0xffffffff) returned 0
	[0044.323] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="MSTTSLoc.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui"
	[0044.323] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0044.323] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0044.323] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.331] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTTSCommon.dll") returned -1
	[0044.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSCommon.dll") returned -1
	[0044.331] lstrcmpiA (lpString1="", lpString2="MSTTSCommon.dll") returned -1
	[0044.331] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*"
	[0044.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\"
	[0044.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned=""
	[0044.331] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt"
	[0044.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt")) returned 0xffffffff
	[0044.332] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0044.332] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0044.332] CloseHandle (hObject=0xffffffff) returned 0
	[0044.332] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="MSTTSCommon.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll"
	[0044.332] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.332] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTTSEngine.dll") returned -1
	[0044.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSEngine.dll") returned -1
	[0044.332] lstrcmpiA (lpString1="", lpString2="MSTTSEngine.dll") returned -1
	[0044.332] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned="MSTTSCommon.dll"
	[0044.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\"
	[0044.332] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned=""
	[0044.332] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt"
	[0044.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt")) returned 0xffffffff
	[0044.333] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0044.333] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0044.333] CloseHandle (hObject=0xffffffff) returned 0
	[0044.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="MSTTSEngine.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll"
	[0044.333] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.333] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTTSLoc.dll") returned -1
	[0044.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSLoc.dll") returned -1
	[0044.333] lstrcmpiA (lpString1="", lpString2="MSTTSLoc.dll") returned -1
	[0044.333] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned="MSTTSEngine.dll"
	[0044.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\"
	[0044.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned=""
	[0044.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt"
	[0044.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt")) returned 0xffffffff
	[0044.333] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0044.334] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0044.334] CloseHandle (hObject=0xffffffff) returned 0
	[0044.334] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="MSTTSLoc.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll"
	[0044.334] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.334] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.334] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.334] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.334] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0044.334] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.334] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.334] lstrcmpA (lpString1=".", lpString2="System") returned -1
	[0044.334] lstrcmpA (lpString1="..", lpString2="System") returned -1
	[0044.334] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0044.335] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="System" | out: lpString1="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System"
	[0044.335] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0044.337] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.337] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.337] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.337] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.337] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.337] lstrcmpA (lpString1=".", lpString2="ado") returned -1
	[0044.337] lstrcmpA (lpString1="..", lpString2="ado") returned -1
	[0044.337] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*"
	[0044.337] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="ado" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado") returned="C:\\Program Files\\Common Files\\System\\ado"
	[0044.338] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e28
	[0044.340] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.340] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.340] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.340] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.340] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.340] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.340] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="adojavas.inc") returned 1
	[0044.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adojavas.inc") returned 1
	[0044.340] lstrcmpiA (lpString1="", lpString2="adojavas.inc") returned -1
	[0044.340] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*"
	[0044.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.340] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.340] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0xffffffff
	[0044.340] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.342] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.342] CloseHandle (hObject=0x8c) returned 1
	[0044.342] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="adojavas.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc"
	[0044.342] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.342] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.342] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="adovbs.inc") returned 1
	[0044.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adovbs.inc") returned 1
	[0044.343] lstrcmpiA (lpString1="", lpString2="adovbs.inc") returned -1
	[0044.343] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="adojavas.inc"
	[0044.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.343] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.343] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.343] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="adovbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc"
	[0044.343] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.343] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.343] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.343] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="adovbs.inc"
	[0044.343] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US"
	[0044.343] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e68
	[0044.343] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.343] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.344] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.344] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.344] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msader15.dll.mui") returned -1
	[0044.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msader15.dll.mui") returned -1
	[0044.344] lstrcmpiA (lpString1="", lpString2="msader15.dll.mui") returned -1
	[0044.344] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*") returned="*.*"
	[0044.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\"
	[0044.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned=""
	[0044.344] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.344] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0044.344] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.345] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.346] CloseHandle (hObject=0x90) returned 1
	[0044.346] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="msader15.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui"
	[0044.346] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.346] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.346] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.346] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msader15.dll") returned -1
	[0044.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msader15.dll") returned -1
	[0044.346] lstrcmpiA (lpString1="", lpString2="msader15.dll") returned -1
	[0044.346] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*"
	[0044.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.347] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.347] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msader15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll"
	[0044.347] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.347] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msado15.dll") returned -1
	[0044.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado15.dll") returned -1
	[0044.347] lstrcmpiA (lpString1="", lpString2="msado15.dll") returned -1
	[0044.347] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned="msader15.dll"
	[0044.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.348] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.348] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.348] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll"
	[0044.348] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.348] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.348] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msado20.tlb") returned -1
	[0044.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado20.tlb") returned -1
	[0044.348] lstrcmpiA (lpString1="", lpString2="msado20.tlb") returned -1
	[0044.348] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned="msado15.dll"
	[0044.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.348] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.348] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.348] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado20.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb"
	[0044.348] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.348] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.348] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msado21.tlb") returned -1
	[0044.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado21.tlb") returned -1
	[0044.348] lstrcmpiA (lpString1="", lpString2="msado21.tlb") returned -1
	[0044.348] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="msado20.tlb"
	[0044.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.348] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.349] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.349] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado21.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb"
	[0044.349] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.349] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.349] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msado25.tlb") returned -1
	[0044.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado25.tlb") returned -1
	[0044.349] lstrcmpiA (lpString1="", lpString2="msado25.tlb") returned -1
	[0044.349] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="msado21.tlb"
	[0044.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.349] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.349] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.349] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado25.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb"
	[0044.349] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.349] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.349] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msado26.tlb") returned -1
	[0044.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado26.tlb") returned -1
	[0044.349] lstrcmpiA (lpString1="", lpString2="msado26.tlb") returned -1
	[0044.349] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="msado25.tlb"
	[0044.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado26.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb"
	[0044.350] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.350] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.350] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msado27.tlb") returned -1
	[0044.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado27.tlb") returned -1
	[0044.350] lstrcmpiA (lpString1="", lpString2="msado27.tlb") returned -1
	[0044.350] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="msado26.tlb"
	[0044.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado27.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb"
	[0044.350] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.350] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.350] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msado28.tlb") returned -1
	[0044.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado28.tlb") returned -1
	[0044.350] lstrcmpiA (lpString1="", lpString2="msado28.tlb") returned -1
	[0044.350] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="msado27.tlb"
	[0044.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.351] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.351] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb"
	[0044.351] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.351] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.351] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadomd.dll") returned -1
	[0044.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadomd.dll") returned -1
	[0044.351] lstrcmpiA (lpString1="", lpString2="msadomd.dll") returned -1
	[0044.351] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="msado28.tlb"
	[0044.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.351] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.351] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.351] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.351] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadomd.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll"
	[0044.351] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.351] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.351] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadomd28.tlb") returned -1
	[0044.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadomd28.tlb") returned -1
	[0044.351] lstrcmpiA (lpString1="", lpString2="msadomd28.tlb") returned -1
	[0044.351] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned="msadomd.dll"
	[0044.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.351] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.351] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.351] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadomd28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb"
	[0044.352] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.352] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msador15.dll") returned -1
	[0044.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msador15.dll") returned -1
	[0044.352] lstrcmpiA (lpString1="", lpString2="msador15.dll") returned -1
	[0044.352] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="msadomd28.tlb"
	[0044.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msador15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll"
	[0044.352] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.352] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadox.dll") returned -1
	[0044.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadox.dll") returned -1
	[0044.352] lstrcmpiA (lpString1="", lpString2="msadox.dll") returned -1
	[0044.352] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned="msador15.dll"
	[0044.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadox.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll"
	[0044.353] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.353] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadox28.tlb") returned -1
	[0044.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadox28.tlb") returned -1
	[0044.353] lstrcmpiA (lpString1="", lpString2="msadox28.tlb") returned -1
	[0044.353] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned="msadox.dll"
	[0044.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.353] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.353] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.353] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadox28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb"
	[0044.353] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.353] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadrh15.dll") returned -1
	[0044.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadrh15.dll") returned -1
	[0044.353] lstrcmpiA (lpString1="", lpString2="msadrh15.dll") returned -1
	[0044.353] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="msadox28.tlb"
	[0044.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\"
	[0044.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned=""
	[0044.353] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt"
	[0044.353] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20
	[0044.353] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadrh15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll"
	[0044.353] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.354] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.354] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.354] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.354] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DirectDB.dll") returned 1
	[0044.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DirectDB.dll") returned 1
	[0044.354] lstrcmpiA (lpString1="", lpString2="DirectDB.dll") returned -1
	[0044.354] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*"
	[0044.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\"
	[0044.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned=""
	[0044.354] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt"
	[0044.354] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt")) returned 0xffffffff
	[0044.354] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0044.355] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.355] WriteFile (in: hFile=0x88, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.356] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.356] CloseHandle (hObject=0x88) returned 1
	[0044.356] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="DirectDB.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned="C:\\Program Files\\Common Files\\System\\DirectDB.dll"
	[0044.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.zip") returned 0
	[0044.356] lstrlenA (lpString="*.zip") returned 5
	[0044.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.rar") returned 0
	[0044.356] lstrlenA (lpString="*.rar") returned 5
	[0044.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.7z") returned 0
	[0044.357] lstrlenA (lpString="*.7z") returned 4
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.tar") returned 0
	[0044.357] lstrlenA (lpString="*.tar") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.gzip") returned 0
	[0044.357] lstrlenA (lpString="*.gzip") returned 6
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.jpg") returned 0
	[0044.357] lstrlenA (lpString="*.jpg") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.jpeg") returned 0
	[0044.357] lstrlenA (lpString="*.jpeg") returned 6
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.psd") returned 0
	[0044.357] lstrlenA (lpString="*.psd") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.cdr") returned 0
	[0044.357] lstrlenA (lpString="*.cdr") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.dwg") returned 0
	[0044.357] lstrlenA (lpString="*.dwg") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.max") returned 0
	[0044.357] lstrlenA (lpString="*.max") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.bmp") returned 0
	[0044.357] lstrlenA (lpString="*.bmp") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.gif") returned 0
	[0044.357] lstrlenA (lpString="*.gif") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.png") returned 0
	[0044.357] lstrlenA (lpString="*.png") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.doc") returned 0
	[0044.357] lstrlenA (lpString="*.doc") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.docx") returned 0
	[0044.357] lstrlenA (lpString="*.docx") returned 6
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.xls") returned 0
	[0044.357] lstrlenA (lpString="*.xls") returned 5
	[0044.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.xlsx") returned 0
	[0044.357] lstrlenA (lpString="*.xlsx") returned 6
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.ppt") returned 0
	[0044.358] lstrlenA (lpString="*.ppt") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.pptx") returned 0
	[0044.358] lstrlenA (lpString="*.pptx") returned 6
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.txt") returned 0
	[0044.358] lstrlenA (lpString="*.txt") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.pdf") returned 0
	[0044.358] lstrlenA (lpString="*.pdf") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.djvu") returned 0
	[0044.358] lstrlenA (lpString="*.djvu") returned 6
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.htm") returned 0
	[0044.358] lstrlenA (lpString="*.htm") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.html") returned 0
	[0044.358] lstrlenA (lpString="*.html") returned 6
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mdb") returned 0
	[0044.358] lstrlenA (lpString="*.mdb") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.cer") returned 0
	[0044.358] lstrlenA (lpString="*.cer") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.p12") returned 0
	[0044.358] lstrlenA (lpString="*.p12") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.pfx") returned 0
	[0044.358] lstrlenA (lpString="*.pfx") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.kwm") returned 0
	[0044.358] lstrlenA (lpString="*.kwm") returned 5
	[0044.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.pwm") returned 0
	[0044.358] lstrlenA (lpString="*.pwm") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.1cd") returned 0
	[0044.359] lstrlenA (lpString="*.1cd") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.md") returned 0
	[0044.359] lstrlenA (lpString="*.md") returned 4
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mdf") returned 0
	[0044.359] lstrlenA (lpString="*.mdf") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.dbf") returned 0
	[0044.359] lstrlenA (lpString="*.dbf") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.odt") returned 0
	[0044.359] lstrlenA (lpString="*.odt") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.vob") returned 0
	[0044.359] lstrlenA (lpString="*.vob") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.ifo") returned 0
	[0044.359] lstrlenA (lpString="*.ifo") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.lnk") returned 0
	[0044.359] lstrlenA (lpString="*.lnk") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.torrent") returned 0
	[0044.359] lstrlenA (lpString="*.torrent") returned 9
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mov") returned 0
	[0044.359] lstrlenA (lpString="*.mov") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.m2v") returned 0
	[0044.359] lstrlenA (lpString="*.m2v") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.3gp") returned 0
	[0044.359] lstrlenA (lpString="*.3gp") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mpeg") returned 0
	[0044.359] lstrlenA (lpString="*.mpeg") returned 6
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mpg") returned 0
	[0044.359] lstrlenA (lpString="*.mpg") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.flv") returned 0
	[0044.359] lstrlenA (lpString="*.flv") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.avi") returned 0
	[0044.359] lstrlenA (lpString="*.avi") returned 5
	[0044.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mp4") returned 0
	[0044.360] lstrlenA (lpString="*.mp4") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.wmv") returned 0
	[0044.360] lstrlenA (lpString="*.wmv") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.divx") returned 0
	[0044.360] lstrlenA (lpString="*.divx") returned 6
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mkv") returned 0
	[0044.360] lstrlenA (lpString="*.mkv") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.mp3") returned 0
	[0044.360] lstrlenA (lpString="*.mp3") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.wav") returned 0
	[0044.360] lstrlenA (lpString="*.wav") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.flac") returned 0
	[0044.360] lstrlenA (lpString="*.flac") returned 6
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.ape") returned 0
	[0044.360] lstrlenA (lpString="*.ape") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.wma") returned 0
	[0044.360] lstrlenA (lpString="*.wma") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.ac3") returned 0
	[0044.360] lstrlenA (lpString="*.ac3") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.exe") returned 0
	[0044.360] lstrlenA (lpString="*.exe") returned 5
	[0044.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\DirectDB.dll", pszSpec="*.apk") returned 0
	[0044.360] lstrlenA (lpString="*.apk") returned 5
	[0044.360] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.360] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.360] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.360] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned="DirectDB.dll"
	[0044.360] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US") returned="C:\\Program Files\\Common Files\\System\\en-US"
	[0044.360] lstrlenA (lpString="C:\\Program Files\\Common Files\\System\\en-US") returned 42
	[0044.361] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e28
	[0044.361] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.361] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.361] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.362] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.362] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.362] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.362] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wab32res.dll.mui") returned -1
	[0044.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab32res.dll.mui") returned -1
	[0044.362] lstrcmpiA (lpString1="", lpString2="wab32res.dll.mui") returned -1
	[0044.362] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\en-US\\*.*") returned="*.*"
	[0044.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\en-US\\"
	[0044.362] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\") returned=""
	[0044.362] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.362] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0044.362] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.363] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.363] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.364] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.364] CloseHandle (hObject=0x8c) returned 1
	[0044.364] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="wab32res.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui"
	[0044.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.zip") returned 0
	[0044.364] lstrlenA (lpString="*.zip") returned 5
	[0044.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.rar") returned 0
	[0044.364] lstrlenA (lpString="*.rar") returned 5
	[0044.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.7z") returned 0
	[0044.364] lstrlenA (lpString="*.7z") returned 4
	[0044.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.tar") returned 0
	[0044.364] lstrlenA (lpString="*.tar") returned 5
	[0044.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.gzip") returned 0
	[0044.365] lstrlenA (lpString="*.gzip") returned 6
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.jpg") returned 0
	[0044.365] lstrlenA (lpString="*.jpg") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.jpeg") returned 0
	[0044.365] lstrlenA (lpString="*.jpeg") returned 6
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.psd") returned 0
	[0044.365] lstrlenA (lpString="*.psd") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.cdr") returned 0
	[0044.365] lstrlenA (lpString="*.cdr") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.dwg") returned 0
	[0044.365] lstrlenA (lpString="*.dwg") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.max") returned 0
	[0044.365] lstrlenA (lpString="*.max") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.bmp") returned 0
	[0044.365] lstrlenA (lpString="*.bmp") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.gif") returned 0
	[0044.365] lstrlenA (lpString="*.gif") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.png") returned 0
	[0044.365] lstrlenA (lpString="*.png") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.doc") returned 0
	[0044.365] lstrlenA (lpString="*.doc") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.docx") returned 0
	[0044.365] lstrlenA (lpString="*.docx") returned 6
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.xls") returned 0
	[0044.365] lstrlenA (lpString="*.xls") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.xlsx") returned 0
	[0044.365] lstrlenA (lpString="*.xlsx") returned 6
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.ppt") returned 0
	[0044.365] lstrlenA (lpString="*.ppt") returned 5
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.pptx") returned 0
	[0044.365] lstrlenA (lpString="*.pptx") returned 6
	[0044.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.txt") returned 0
	[0044.365] lstrlenA (lpString="*.txt") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.pdf") returned 0
	[0044.366] lstrlenA (lpString="*.pdf") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.djvu") returned 0
	[0044.366] lstrlenA (lpString="*.djvu") returned 6
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.htm") returned 0
	[0044.366] lstrlenA (lpString="*.htm") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.html") returned 0
	[0044.366] lstrlenA (lpString="*.html") returned 6
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mdb") returned 0
	[0044.366] lstrlenA (lpString="*.mdb") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.cer") returned 0
	[0044.366] lstrlenA (lpString="*.cer") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.p12") returned 0
	[0044.366] lstrlenA (lpString="*.p12") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.pfx") returned 0
	[0044.366] lstrlenA (lpString="*.pfx") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.kwm") returned 0
	[0044.366] lstrlenA (lpString="*.kwm") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.pwm") returned 0
	[0044.366] lstrlenA (lpString="*.pwm") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.1cd") returned 0
	[0044.366] lstrlenA (lpString="*.1cd") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.md") returned 0
	[0044.366] lstrlenA (lpString="*.md") returned 4
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mdf") returned 0
	[0044.366] lstrlenA (lpString="*.mdf") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.dbf") returned 0
	[0044.366] lstrlenA (lpString="*.dbf") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.odt") returned 0
	[0044.366] lstrlenA (lpString="*.odt") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.vob") returned 0
	[0044.366] lstrlenA (lpString="*.vob") returned 5
	[0044.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.ifo") returned 0
	[0044.366] lstrlenA (lpString="*.ifo") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.lnk") returned 0
	[0044.367] lstrlenA (lpString="*.lnk") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.torrent") returned 0
	[0044.367] lstrlenA (lpString="*.torrent") returned 9
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mov") returned 0
	[0044.367] lstrlenA (lpString="*.mov") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.m2v") returned 0
	[0044.367] lstrlenA (lpString="*.m2v") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.3gp") returned 0
	[0044.367] lstrlenA (lpString="*.3gp") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mpeg") returned 0
	[0044.367] lstrlenA (lpString="*.mpeg") returned 6
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mpg") returned 0
	[0044.367] lstrlenA (lpString="*.mpg") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.flv") returned 0
	[0044.367] lstrlenA (lpString="*.flv") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.avi") returned 0
	[0044.367] lstrlenA (lpString="*.avi") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mp4") returned 0
	[0044.367] lstrlenA (lpString="*.mp4") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.wmv") returned 0
	[0044.367] lstrlenA (lpString="*.wmv") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.divx") returned 0
	[0044.367] lstrlenA (lpString="*.divx") returned 6
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mkv") returned 0
	[0044.367] lstrlenA (lpString="*.mkv") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.mp3") returned 0
	[0044.367] lstrlenA (lpString="*.mp3") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.wav") returned 0
	[0044.367] lstrlenA (lpString="*.wav") returned 5
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.flac") returned 0
	[0044.367] lstrlenA (lpString="*.flac") returned 6
	[0044.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.ape") returned 0
	[0044.368] lstrlenA (lpString="*.ape") returned 5
	[0044.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.wma") returned 0
	[0044.368] lstrlenA (lpString="*.wma") returned 5
	[0044.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.ac3") returned 0
	[0044.368] lstrlenA (lpString="*.ac3") returned 5
	[0044.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.exe") returned 0
	[0044.368] lstrlenA (lpString="*.exe") returned 5
	[0044.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", pszSpec="*.apk") returned 0
	[0044.368] lstrlenA (lpString="*.apk") returned 5
	[0044.368] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.368] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.368] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.368] lstrcmpA (lpString1=".", lpString2="msadc") returned -1
	[0044.368] lstrcmpA (lpString1="..", lpString2="msadc") returned -1
	[0044.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*"
	[0044.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="msadc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc") returned="C:\\Program Files\\Common Files\\System\\msadc"
	[0044.368] lstrlenA (lpString="C:\\Program Files\\Common Files\\System\\msadc") returned 42
	[0044.368] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e28
	[0044.371] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.371] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.371] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.371] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.371] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.371] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.371] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="adcjavas.inc") returned 1
	[0044.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adcjavas.inc") returned 1
	[0044.371] lstrcmpiA (lpString1="", lpString2="adcjavas.inc") returned -1
	[0044.371] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="*.*"
	[0044.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.371] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.371] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt"
	[0044.371] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0xffffffff
	[0044.371] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.372] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.372] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.373] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.373] CloseHandle (hObject=0x8c) returned 1
	[0044.374] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="adcjavas.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc"
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.zip") returned 0
	[0044.374] lstrlenA (lpString="*.zip") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.rar") returned 0
	[0044.374] lstrlenA (lpString="*.rar") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.7z") returned 0
	[0044.374] lstrlenA (lpString="*.7z") returned 4
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.tar") returned 0
	[0044.374] lstrlenA (lpString="*.tar") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.gzip") returned 0
	[0044.374] lstrlenA (lpString="*.gzip") returned 6
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.jpg") returned 0
	[0044.374] lstrlenA (lpString="*.jpg") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.jpeg") returned 0
	[0044.374] lstrlenA (lpString="*.jpeg") returned 6
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.psd") returned 0
	[0044.374] lstrlenA (lpString="*.psd") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.cdr") returned 0
	[0044.374] lstrlenA (lpString="*.cdr") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.dwg") returned 0
	[0044.374] lstrlenA (lpString="*.dwg") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.max") returned 0
	[0044.374] lstrlenA (lpString="*.max") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.bmp") returned 0
	[0044.374] lstrlenA (lpString="*.bmp") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.gif") returned 0
	[0044.374] lstrlenA (lpString="*.gif") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.png") returned 0
	[0044.374] lstrlenA (lpString="*.png") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.doc") returned 0
	[0044.374] lstrlenA (lpString="*.doc") returned 5
	[0044.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.docx") returned 0
	[0044.375] lstrlenA (lpString="*.docx") returned 6
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.xls") returned 0
	[0044.375] lstrlenA (lpString="*.xls") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.xlsx") returned 0
	[0044.375] lstrlenA (lpString="*.xlsx") returned 6
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.ppt") returned 0
	[0044.375] lstrlenA (lpString="*.ppt") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.pptx") returned 0
	[0044.375] lstrlenA (lpString="*.pptx") returned 6
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.txt") returned 0
	[0044.375] lstrlenA (lpString="*.txt") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.pdf") returned 0
	[0044.375] lstrlenA (lpString="*.pdf") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.djvu") returned 0
	[0044.375] lstrlenA (lpString="*.djvu") returned 6
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.htm") returned 0
	[0044.375] lstrlenA (lpString="*.htm") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.html") returned 0
	[0044.375] lstrlenA (lpString="*.html") returned 6
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mdb") returned 0
	[0044.375] lstrlenA (lpString="*.mdb") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.cer") returned 0
	[0044.375] lstrlenA (lpString="*.cer") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.p12") returned 0
	[0044.375] lstrlenA (lpString="*.p12") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.pfx") returned 0
	[0044.375] lstrlenA (lpString="*.pfx") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.kwm") returned 0
	[0044.375] lstrlenA (lpString="*.kwm") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.pwm") returned 0
	[0044.375] lstrlenA (lpString="*.pwm") returned 5
	[0044.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.1cd") returned 0
	[0044.375] lstrlenA (lpString="*.1cd") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.md") returned 0
	[0044.376] lstrlenA (lpString="*.md") returned 4
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mdf") returned 0
	[0044.376] lstrlenA (lpString="*.mdf") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.dbf") returned 0
	[0044.376] lstrlenA (lpString="*.dbf") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.odt") returned 0
	[0044.376] lstrlenA (lpString="*.odt") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.vob") returned 0
	[0044.376] lstrlenA (lpString="*.vob") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.ifo") returned 0
	[0044.376] lstrlenA (lpString="*.ifo") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.lnk") returned 0
	[0044.376] lstrlenA (lpString="*.lnk") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.torrent") returned 0
	[0044.376] lstrlenA (lpString="*.torrent") returned 9
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mov") returned 0
	[0044.376] lstrlenA (lpString="*.mov") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.m2v") returned 0
	[0044.376] lstrlenA (lpString="*.m2v") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.3gp") returned 0
	[0044.376] lstrlenA (lpString="*.3gp") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mpeg") returned 0
	[0044.376] lstrlenA (lpString="*.mpeg") returned 6
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mpg") returned 0
	[0044.376] lstrlenA (lpString="*.mpg") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.flv") returned 0
	[0044.376] lstrlenA (lpString="*.flv") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.avi") returned 0
	[0044.376] lstrlenA (lpString="*.avi") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mp4") returned 0
	[0044.376] lstrlenA (lpString="*.mp4") returned 5
	[0044.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.wmv") returned 0
	[0044.376] lstrlenA (lpString="*.wmv") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.divx") returned 0
	[0044.377] lstrlenA (lpString="*.divx") returned 6
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mkv") returned 0
	[0044.377] lstrlenA (lpString="*.mkv") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.mp3") returned 0
	[0044.377] lstrlenA (lpString="*.mp3") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.wav") returned 0
	[0044.377] lstrlenA (lpString="*.wav") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.flac") returned 0
	[0044.377] lstrlenA (lpString="*.flac") returned 6
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.ape") returned 0
	[0044.377] lstrlenA (lpString="*.ape") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.wma") returned 0
	[0044.377] lstrlenA (lpString="*.wma") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.ac3") returned 0
	[0044.377] lstrlenA (lpString="*.ac3") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.exe") returned 0
	[0044.377] lstrlenA (lpString="*.exe") returned 5
	[0044.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", pszSpec="*.apk") returned 0
	[0044.377] lstrlenA (lpString="*.apk") returned 5
	[0044.377] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.377] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.377] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="adcvbs.inc") returned 1
	[0044.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adcvbs.inc") returned 1
	[0044.377] lstrcmpiA (lpString1="", lpString2="adcvbs.inc") returned -1
	[0044.377] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="adcjavas.inc"
	[0044.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.377] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.377] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt"
	[0044.377] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20
	[0044.378] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="adcvbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc"
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.zip") returned 0
	[0044.378] lstrlenA (lpString="*.zip") returned 5
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.rar") returned 0
	[0044.378] lstrlenA (lpString="*.rar") returned 5
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.7z") returned 0
	[0044.378] lstrlenA (lpString="*.7z") returned 4
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.tar") returned 0
	[0044.378] lstrlenA (lpString="*.tar") returned 5
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.gzip") returned 0
	[0044.378] lstrlenA (lpString="*.gzip") returned 6
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.jpg") returned 0
	[0044.378] lstrlenA (lpString="*.jpg") returned 5
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.jpeg") returned 0
	[0044.378] lstrlenA (lpString="*.jpeg") returned 6
	[0044.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.psd") returned 0
	[0044.379] lstrlenA (lpString="*.psd") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.cdr") returned 0
	[0044.379] lstrlenA (lpString="*.cdr") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.dwg") returned 0
	[0044.379] lstrlenA (lpString="*.dwg") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.max") returned 0
	[0044.379] lstrlenA (lpString="*.max") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.bmp") returned 0
	[0044.379] lstrlenA (lpString="*.bmp") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.gif") returned 0
	[0044.379] lstrlenA (lpString="*.gif") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.png") returned 0
	[0044.379] lstrlenA (lpString="*.png") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.doc") returned 0
	[0044.379] lstrlenA (lpString="*.doc") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.docx") returned 0
	[0044.379] lstrlenA (lpString="*.docx") returned 6
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.xls") returned 0
	[0044.379] lstrlenA (lpString="*.xls") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.xlsx") returned 0
	[0044.379] lstrlenA (lpString="*.xlsx") returned 6
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.ppt") returned 0
	[0044.379] lstrlenA (lpString="*.ppt") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.pptx") returned 0
	[0044.379] lstrlenA (lpString="*.pptx") returned 6
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.txt") returned 0
	[0044.379] lstrlenA (lpString="*.txt") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.pdf") returned 0
	[0044.379] lstrlenA (lpString="*.pdf") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.djvu") returned 0
	[0044.379] lstrlenA (lpString="*.djvu") returned 6
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.htm") returned 0
	[0044.379] lstrlenA (lpString="*.htm") returned 5
	[0044.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.html") returned 0
	[0044.380] lstrlenA (lpString="*.html") returned 6
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mdb") returned 0
	[0044.380] lstrlenA (lpString="*.mdb") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.cer") returned 0
	[0044.380] lstrlenA (lpString="*.cer") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.p12") returned 0
	[0044.380] lstrlenA (lpString="*.p12") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.pfx") returned 0
	[0044.380] lstrlenA (lpString="*.pfx") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.kwm") returned 0
	[0044.380] lstrlenA (lpString="*.kwm") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.pwm") returned 0
	[0044.380] lstrlenA (lpString="*.pwm") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.1cd") returned 0
	[0044.380] lstrlenA (lpString="*.1cd") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.md") returned 0
	[0044.380] lstrlenA (lpString="*.md") returned 4
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mdf") returned 0
	[0044.380] lstrlenA (lpString="*.mdf") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.dbf") returned 0
	[0044.380] lstrlenA (lpString="*.dbf") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.odt") returned 0
	[0044.380] lstrlenA (lpString="*.odt") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.vob") returned 0
	[0044.380] lstrlenA (lpString="*.vob") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.ifo") returned 0
	[0044.380] lstrlenA (lpString="*.ifo") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.lnk") returned 0
	[0044.380] lstrlenA (lpString="*.lnk") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.torrent") returned 0
	[0044.380] lstrlenA (lpString="*.torrent") returned 9
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mov") returned 0
	[0044.380] lstrlenA (lpString="*.mov") returned 5
	[0044.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.m2v") returned 0
	[0044.381] lstrlenA (lpString="*.m2v") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.3gp") returned 0
	[0044.381] lstrlenA (lpString="*.3gp") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mpeg") returned 0
	[0044.381] lstrlenA (lpString="*.mpeg") returned 6
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mpg") returned 0
	[0044.381] lstrlenA (lpString="*.mpg") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.flv") returned 0
	[0044.381] lstrlenA (lpString="*.flv") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.avi") returned 0
	[0044.381] lstrlenA (lpString="*.avi") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mp4") returned 0
	[0044.381] lstrlenA (lpString="*.mp4") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.wmv") returned 0
	[0044.381] lstrlenA (lpString="*.wmv") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.divx") returned 0
	[0044.381] lstrlenA (lpString="*.divx") returned 6
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mkv") returned 0
	[0044.381] lstrlenA (lpString="*.mkv") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.mp3") returned 0
	[0044.381] lstrlenA (lpString="*.mp3") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.wav") returned 0
	[0044.381] lstrlenA (lpString="*.wav") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.flac") returned 0
	[0044.381] lstrlenA (lpString="*.flac") returned 6
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.ape") returned 0
	[0044.381] lstrlenA (lpString="*.ape") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.wma") returned 0
	[0044.381] lstrlenA (lpString="*.wma") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.ac3") returned 0
	[0044.381] lstrlenA (lpString="*.ac3") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.exe") returned 0
	[0044.381] lstrlenA (lpString="*.exe") returned 5
	[0044.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", pszSpec="*.apk") returned 0
	[0044.382] lstrlenA (lpString="*.apk") returned 5
	[0044.382] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.382] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.382] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.382] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="adcvbs.inc"
	[0044.382] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US"
	[0044.382] lstrlenA (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US") returned 48
	[0044.382] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e68
	[0044.394] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.394] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.394] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.394] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.394] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.394] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcer.dll.mui") returned -1
	[0044.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcer.dll.mui") returned -1
	[0044.394] lstrcmpiA (lpString1="", lpString2="msadcer.dll.mui") returned -1
	[0044.394] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*") returned="*.*"
	[0044.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\"
	[0044.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned=""
	[0044.394] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.394] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0044.394] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0044.395] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0044.395] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0044.396] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.396] CloseHandle (hObject=0x90) returned 1
	[0044.396] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcer.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui"
	[0044.396] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.zip") returned 0
	[0044.396] lstrlenA (lpString="*.zip") returned 5
	[0044.396] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.rar") returned 0
	[0044.396] lstrlenA (lpString="*.rar") returned 5
	[0044.396] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.7z") returned 0
	[0044.396] lstrlenA (lpString="*.7z") returned 4
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.tar") returned 0
	[0044.397] lstrlenA (lpString="*.tar") returned 5
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.gzip") returned 0
	[0044.397] lstrlenA (lpString="*.gzip") returned 6
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.jpg") returned 0
	[0044.397] lstrlenA (lpString="*.jpg") returned 5
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.jpeg") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.psd") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.cdr") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.dwg") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.max") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.bmp") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.gif") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.png") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.doc") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.docx") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.xls") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.xlsx") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.ppt") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.pptx") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.txt") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.pdf") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.djvu") returned 0
	[0044.397] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.htm") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.html") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mdb") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.cer") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.p12") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.pfx") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.kwm") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.pwm") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.1cd") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.md") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mdf") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.dbf") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.odt") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.vob") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.ifo") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.lnk") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.torrent") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mov") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.m2v") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.3gp") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mpeg") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mpg") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.flv") returned 0
	[0044.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.avi") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mp4") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.wmv") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.divx") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mkv") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.mp3") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.wav") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.flac") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.ape") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.wma") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.ac3") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.exe") returned 0
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", pszSpec="*.apk") returned 0
	[0044.399] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.399] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcfr.dll.mui") returned -1
	[0044.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcfr.dll.mui") returned -1
	[0044.399] lstrcmpiA (lpString1="", lpString2="msadcfr.dll.mui") returned -1
	[0044.399] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="msadcer.dll.mui"
	[0044.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\"
	[0044.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned=""
	[0044.399] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20
	[0044.399] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcfr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui"
	[0044.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.zip") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.rar") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.7z") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.tar") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.gzip") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.jpg") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.jpeg") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.psd") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.cdr") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.dwg") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.max") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.bmp") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.gif") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.png") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.doc") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.docx") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.xls") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.xlsx") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.ppt") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.pptx") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.txt") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.pdf") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.djvu") returned 0
	[0044.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.htm") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.html") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mdb") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.cer") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.p12") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.pfx") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.kwm") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.pwm") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.1cd") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.md") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mdf") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.dbf") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.odt") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.vob") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.ifo") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.lnk") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.torrent") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mov") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.m2v") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.3gp") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mpeg") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mpg") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.flv") returned 0
	[0044.401] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.avi") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mp4") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.wmv") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.divx") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mkv") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.mp3") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.wav") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.flac") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.ape") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.wma") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.ac3") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.exe") returned 0
	[0044.402] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", pszSpec="*.apk") returned 0
	[0044.402] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcor.dll.mui") returned -1
	[0044.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcor.dll.mui") returned -1
	[0044.402] lstrcmpiA (lpString1="", lpString2="msadcor.dll.mui") returned -1
	[0044.402] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="msadcfr.dll.mui"
	[0044.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\"
	[0044.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned=""
	[0044.402] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.402] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20
	[0044.403] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcor.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui"
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.zip") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.rar") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.7z") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.tar") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.gzip") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.jpg") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.jpeg") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.psd") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.cdr") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.dwg") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.max") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.bmp") returned 0
	[0044.403] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", pszSpec="*.gif") returned 0
	[0044.403] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msaddsr.dll.mui") returned -1
	[0044.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaddsr.dll.mui") returned -1
	[0044.404] lstrcmpiA (lpString1="", lpString2="msaddsr.dll.mui") returned -1
	[0044.404] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="msadcor.dll.mui"
	[0044.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\"
	[0044.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned=""
	[0044.404] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20
	[0044.404] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msaddsr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui"
	[0044.404] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdaprsr.dll.mui") returned -1
	[0044.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaprsr.dll.mui") returned -1
	[0044.404] lstrcmpiA (lpString1="", lpString2="msdaprsr.dll.mui") returned -1
	[0044.404] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="msaddsr.dll.mui"
	[0044.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\"
	[0044.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned=""
	[0044.404] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20
	[0044.404] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msdaprsr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui"
	[0044.405] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdaremr.dll.mui") returned -1
	[0044.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaremr.dll.mui") returned -1
	[0044.405] lstrcmpiA (lpString1="", lpString2="msdaremr.dll.mui") returned -1
	[0044.405] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned="msdaprsr.dll.mui"
	[0044.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\"
	[0044.405] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned=""
	[0044.405] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt"
	[0044.405] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20
	[0044.405] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msdaremr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui"
	[0044.405] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.405] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.405] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.405] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="handler.reg") returned -1
	[0044.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="handler.reg") returned 1
	[0044.405] lstrcmpiA (lpString1="", lpString2="handler.reg") returned -1
	[0044.405] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="*.*"
	[0044.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.406] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt"
	[0044.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20
	[0044.406] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="handler.reg" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg"
	[0044.406] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.406] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.406] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="handsafe.reg") returned -1
	[0044.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="handsafe.reg") returned 1
	[0044.406] lstrcmpiA (lpString1="", lpString2="handsafe.reg") returned -1
	[0044.406] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="handler.reg"
	[0044.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.406] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt"
	[0044.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20
	[0044.406] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="handsafe.reg" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg"
	[0044.406] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.406] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.406] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadce.dll") returned -1
	[0044.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadce.dll") returned -1
	[0044.406] lstrcmpiA (lpString1="", lpString2="msadce.dll") returned -1
	[0044.406] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="handsafe.reg"
	[0044.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.407] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt"
	[0044.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20
	[0044.407] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadce.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll"
	[0044.407] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.407] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.407] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcer.dll") returned -1
	[0044.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcer.dll") returned -1
	[0044.407] lstrcmpiA (lpString1="", lpString2="msadcer.dll") returned -1
	[0044.407] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned="msadce.dll"
	[0044.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.407] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt"
	[0044.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20
	[0044.407] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcer.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll"
	[0044.407] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.407] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.407] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcf.dll") returned -1
	[0044.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcf.dll") returned -1
	[0044.407] lstrcmpiA (lpString1="", lpString2="msadcf.dll") returned -1
	[0044.407] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned="msadcer.dll"
	[0044.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.408] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt"
	[0044.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20
	[0044.408] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcf.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll"
	[0044.408] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.408] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.408] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcfr.dll") returned -1
	[0044.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcfr.dll") returned -1
	[0044.408] lstrcmpiA (lpString1="", lpString2="msadcfr.dll") returned -1
	[0044.408] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned="msadcf.dll"
	[0044.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.410] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.410] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.410] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadco.dll") returned -1
	[0044.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadco.dll") returned -1
	[0044.410] lstrcmpiA (lpString1="", lpString2="msadco.dll") returned -1
	[0044.410] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned="msadcfr.dll"
	[0044.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.410] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.410] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.410] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcor.dll") returned -1
	[0044.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcor.dll") returned -1
	[0044.410] lstrcmpiA (lpString1="", lpString2="msadcor.dll") returned -1
	[0044.410] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned="msadco.dll"
	[0044.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.411] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.411] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.411] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadcs.dll") returned -1
	[0044.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcs.dll") returned -1
	[0044.411] lstrcmpiA (lpString1="", lpString2="msadcs.dll") returned -1
	[0044.411] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned="msadcor.dll"
	[0044.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.411] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.411] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.411] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msadds.dll") returned -1
	[0044.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadds.dll") returned -1
	[0044.411] lstrcmpiA (lpString1="", lpString2="msadds.dll") returned -1
	[0044.411] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned="msadcs.dll"
	[0044.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.411] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.411] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.411] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msaddsr.dll") returned -1
	[0044.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaddsr.dll") returned -1
	[0044.411] lstrcmpiA (lpString1="", lpString2="msaddsr.dll") returned -1
	[0044.411] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned="msadds.dll"
	[0044.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.412] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.412] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdaprsr.dll") returned -1
	[0044.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaprsr.dll") returned -1
	[0044.412] lstrcmpiA (lpString1="", lpString2="msdaprsr.dll") returned -1
	[0044.412] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned="msaddsr.dll"
	[0044.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.412] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.412] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdaprst.dll") returned -1
	[0044.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaprst.dll") returned -1
	[0044.412] lstrcmpiA (lpString1="", lpString2="msdaprst.dll") returned -1
	[0044.412] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned="msdaprsr.dll"
	[0044.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.412] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.412] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdarem.dll") returned -1
	[0044.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdarem.dll") returned -1
	[0044.412] lstrcmpiA (lpString1="", lpString2="msdarem.dll") returned -1
	[0044.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned="msdaprst.dll"
	[0044.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.413] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.413] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdaremr.dll") returned -1
	[0044.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaremr.dll") returned -1
	[0044.413] lstrcmpiA (lpString1="", lpString2="msdaremr.dll") returned -1
	[0044.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned="msdarem.dll"
	[0044.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.413] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.413] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdfmap.dll") returned -1
	[0044.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdfmap.dll") returned -1
	[0044.413] lstrcmpiA (lpString1="", lpString2="msdfmap.dll") returned -1
	[0044.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned="msdaremr.dll"
	[0044.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\"
	[0044.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned=""
	[0044.413] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.413] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.413] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.414] lstrcmpA (lpString1=".", lpString2="MSMAPI") returned -1
	[0044.414] lstrcmpA (lpString1="..", lpString2="MSMAPI") returned -1
	[0044.414] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*"
	[0044.414] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e28
	[0044.415] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.415] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.415] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.415] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.415] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.415] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0044.415] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0044.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*") returned="*.*"
	[0044.415] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e68
	[0044.415] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.415] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.415] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.415] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.415] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.415] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSMAPI32.DLL") returned -1
	[0044.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSMAPI32.DLL") returned -1
	[0044.415] lstrcmpiA (lpString1="", lpString2="MSMAPI32.DLL") returned -1
	[0044.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*") returned="*.*"
	[0044.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\"
	[0044.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned=""
	[0044.418] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.418] CloseHandle (hObject=0x90) returned 1
	[0044.419] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.419] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.419] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.419] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.419] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.419] lstrcmpA (lpString1=".", lpString2="Ole DB") returned -1
	[0044.419] lstrcmpA (lpString1="..", lpString2="Ole DB") returned -1
	[0044.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*"
	[0044.419] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e28
	[0044.421] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.422] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.422] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.422] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.422] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.422] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.422] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.422] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned="*.*"
	[0044.422] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7e68
	[0044.422] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.422] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.422] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.422] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.422] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.422] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.422] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdasqlr.dll.mui") returned -1
	[0044.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdasqlr.dll.mui") returned -1
	[0044.422] lstrcmpiA (lpString1="", lpString2="msdasqlr.dll.mui") returned -1
	[0044.422] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*") returned="*.*"
	[0044.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\"
	[0044.422] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned=""
	[0044.428] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.428] CloseHandle (hObject=0x90) returned 1
	[0044.428] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oledb32r.dll.mui") returned -1
	[0044.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledb32r.dll.mui") returned -1
	[0044.428] lstrcmpiA (lpString1="", lpString2="oledb32r.dll.mui") returned -1
	[0044.428] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned="msdasqlr.dll.mui"
	[0044.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\"
	[0044.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned=""
	[0044.428] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqloledb.rll.mui") returned -1
	[0044.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqloledb.rll.mui") returned -1
	[0044.428] lstrcmpiA (lpString1="", lpString2="sqloledb.rll.mui") returned -1
	[0044.429] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned="oledb32r.dll.mui"
	[0044.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\"
	[0044.429] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned=""
	[0044.429] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.429] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlxmlx.rll.mui") returned -1
	[0044.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlxmlx.rll.mui") returned -1
	[0044.429] lstrcmpiA (lpString1="", lpString2="sqlxmlx.rll.mui") returned -1
	[0044.429] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned="sqloledb.rll.mui"
	[0044.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\"
	[0044.429] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned=""
	[0044.429] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.429] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0044.429] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.429] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.429] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdaosp.dll") returned -1
	[0044.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaosp.dll") returned -1
	[0044.429] lstrcmpiA (lpString1="", lpString2="msdaosp.dll") returned -1
	[0044.429] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned="*.*"
	[0044.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.429] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.430] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.430] CloseHandle (hObject=0x8c) returned 1
	[0044.431] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.431] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.431] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdaps.dll") returned -1
	[0044.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaps.dll") returned -1
	[0044.431] lstrcmpiA (lpString1="", lpString2="msdaps.dll") returned -1
	[0044.431] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned="msdaosp.dll"
	[0044.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.431] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.431] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.431] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdasql.dll") returned -1
	[0044.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdasql.dll") returned -1
	[0044.431] lstrcmpiA (lpString1="", lpString2="msdasql.dll") returned -1
	[0044.431] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned="msdaps.dll"
	[0044.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.431] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.431] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.431] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdasqlr.dll") returned -1
	[0044.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdasqlr.dll") returned -1
	[0044.431] lstrcmpiA (lpString1="", lpString2="msdasqlr.dll") returned -1
	[0044.431] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned="msdasql.dll"
	[0044.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.432] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.432] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.432] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msdatl3.dll") returned -1
	[0044.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdatl3.dll") returned -1
	[0044.432] lstrcmpiA (lpString1="", lpString2="msdatl3.dll") returned -1
	[0044.432] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned="msdasqlr.dll"
	[0044.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.432] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.432] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.432] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.432] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msxactps.dll") returned -1
	[0044.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msxactps.dll") returned -1
	[0044.432] lstrcmpiA (lpString1="", lpString2="msxactps.dll") returned -1
	[0044.432] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned="msdatl3.dll"
	[0044.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.432] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.432] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.432] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.432] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oledb32.dll") returned -1
	[0044.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledb32.dll") returned -1
	[0044.432] lstrcmpiA (lpString1="", lpString2="oledb32.dll") returned -1
	[0044.432] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned="msxactps.dll"
	[0044.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.432] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.433] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.433] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.433] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oledb32r.dll") returned -1
	[0044.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledb32r.dll") returned -1
	[0044.433] lstrcmpiA (lpString1="", lpString2="oledb32r.dll") returned -1
	[0044.433] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned="oledb32.dll"
	[0044.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.433] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.433] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.433] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.433] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oledbjvs.inc") returned -1
	[0044.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledbjvs.inc") returned -1
	[0044.433] lstrcmpiA (lpString1="", lpString2="oledbjvs.inc") returned -1
	[0044.433] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned="oledb32r.dll"
	[0044.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.433] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.433] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.433] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.433] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oledbvbs.inc") returned -1
	[0044.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledbvbs.inc") returned -1
	[0044.433] lstrcmpiA (lpString1="", lpString2="oledbvbs.inc") returned -1
	[0044.433] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned="oledbjvs.inc"
	[0044.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.434] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.434] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.434] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.434] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqloledb.dll") returned -1
	[0044.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqloledb.dll") returned -1
	[0044.434] lstrcmpiA (lpString1="", lpString2="sqloledb.dll") returned -1
	[0044.434] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned="oledbvbs.inc"
	[0044.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.434] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.434] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.434] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.434] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqloledb.rll") returned -1
	[0044.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqloledb.rll") returned -1
	[0044.434] lstrcmpiA (lpString1="", lpString2="sqloledb.rll") returned -1
	[0044.434] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned="sqloledb.dll"
	[0044.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.434] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.434] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.434] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.434] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlxmlx.dll") returned -1
	[0044.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlxmlx.dll") returned -1
	[0044.434] lstrcmpiA (lpString1="", lpString2="sqlxmlx.dll") returned -1
	[0044.434] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned="sqloledb.rll"
	[0044.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.434] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.435] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.435] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.435] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlxmlx.rll") returned -1
	[0044.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlxmlx.rll") returned -1
	[0044.435] lstrcmpiA (lpString1="", lpString2="sqlxmlx.rll") returned -1
	[0044.435] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned="sqlxmlx.dll"
	[0044.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.435] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.435] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.435] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="xmlrw.dll") returned -1
	[0044.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xmlrw.dll") returned -1
	[0044.435] lstrcmpiA (lpString1="", lpString2="xmlrw.dll") returned -1
	[0044.435] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned="sqlxmlx.rll"
	[0044.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.435] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.435] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.435] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="xmlrwbin.dll") returned -1
	[0044.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xmlrwbin.dll") returned -1
	[0044.435] lstrcmpiA (lpString1="", lpString2="xmlrwbin.dll") returned -1
	[0044.435] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned="xmlrw.dll"
	[0044.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\"
	[0044.436] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned=""
	[0044.436] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0044.436] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.436] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.436] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.436] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wab32.dll") returned -1
	[0044.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab32.dll") returned -1
	[0044.436] lstrcmpiA (lpString1="", lpString2="wab32.dll") returned -1
	[0044.436] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*"
	[0044.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\"
	[0044.436] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned=""
	[0044.436] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.436] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.436] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wab32res.dll") returned -1
	[0044.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab32res.dll") returned -1
	[0044.436] lstrcmpiA (lpString1="", lpString2="wab32res.dll") returned -1
	[0044.436] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\wab32.dll") returned="wab32.dll"
	[0044.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\"
	[0044.437] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned=""
	[0044.437] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0044.437] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0044.437] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.437] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.437] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tu_adipex.exe") returned -1
	[0044.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tu_adipex.exe") returned -1
	[0044.437] lstrcmpiA (lpString1="", lpString2="tu_adipex.exe") returned -1
	[0044.437] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*"
	[0044.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\"
	[0044.437] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned=""
	[0044.438] FindNextFileA (in: hFindFile=0x8ba368, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0044.438] FindClose (in: hFindFile=0x8ba368 | out: hFindFile=0x8ba368) returned 1
	[0044.438] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0044.438] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0
	[0044.438] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1
	[0044.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1
	[0044.438] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1
	[0044.438] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0044.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\"
	[0044.438] PathAddBackslashA (in: pszPath="C:\\Program Files\\" | out: pszPath="C:\\Program Files\\") returned=""
	[0044.439] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.440] CloseHandle (hObject=0x74) returned 1
	[0044.440] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0044.440] lstrcmpA (lpString1=".", lpString2="DVD Maker") returned -1
	[0044.440] lstrcmpA (lpString1="..", lpString2="DVD Maker") returned -1
	[0044.440] PathFindFileNameA (pszPath="C:\\Program Files\\desktop.ini") returned="desktop.ini"
	[0044.440] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0044.441] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.441] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.441] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.441] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.441] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.441] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.441] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="audiodepthconverter.ax") returned 1
	[0044.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="audiodepthconverter.ax") returned 1
	[0044.442] lstrcmpiA (lpString1="", lpString2="audiodepthconverter.ax") returned -1
	[0044.442] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\*.*") returned="*.*"
	[0044.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.442] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.443] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.443] CloseHandle (hObject=0x84) returned 1
	[0044.443] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.443] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.443] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bod_r.TTF") returned 1
	[0044.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bod_r.TTF") returned 1
	[0044.443] lstrcmpiA (lpString1="", lpString2="bod_r.TTF") returned -1
	[0044.443] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned="audiodepthconverter.ax"
	[0044.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.444] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.444] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.444] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="directshowtap.ax") returned 1
	[0044.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="directshowtap.ax") returned 1
	[0044.444] lstrcmpiA (lpString1="", lpString2="directshowtap.ax") returned -1
	[0044.444] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned="bod_r.TTF"
	[0044.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.444] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.444] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.444] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DVDMaker.exe") returned 1
	[0044.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVDMaker.exe") returned 1
	[0044.444] lstrcmpiA (lpString1="", lpString2="DVDMaker.exe") returned -1
	[0044.444] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned="directshowtap.ax"
	[0044.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.445] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.445] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.445] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.445] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned="DVDMaker.exe"
	[0044.445] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0044.445] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.445] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.445] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.445] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.445] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.445] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.445] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DVDMaker.exe.mui") returned 1
	[0044.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVDMaker.exe.mui") returned 1
	[0044.446] lstrcmpiA (lpString1="", lpString2="DVDMaker.exe.mui") returned -1
	[0044.446] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\*.*") returned="*.*"
	[0044.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\"
	[0044.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned=""
	[0044.447] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.447] CloseHandle (hObject=0x88) returned 1
	[0044.447] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.447] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.447] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OmdProject.dll.mui") returned -1
	[0044.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OmdProject.dll.mui") returned -1
	[0044.447] lstrcmpiA (lpString1="", lpString2="OmdProject.dll.mui") returned -1
	[0044.447] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned="DVDMaker.exe.mui"
	[0044.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\"
	[0044.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned=""
	[0044.448] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.448] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.448] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WMM2CLIP.dll.mui") returned -1
	[0044.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMM2CLIP.dll.mui") returned -1
	[0044.448] lstrcmpiA (lpString1="", lpString2="WMM2CLIP.dll.mui") returned -1
	[0044.448] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned="OmdProject.dll.mui"
	[0044.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\"
	[0044.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned=""
	[0044.448] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0044.448] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0044.448] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.448] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.448] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Eurosti.TTF") returned -1
	[0044.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Eurosti.TTF") returned 1
	[0044.448] lstrcmpiA (lpString1="", lpString2="Eurosti.TTF") returned -1
	[0044.448] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\*.*") returned="*.*"
	[0044.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.449] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.449] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="fieldswitch.ax") returned -1
	[0044.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fieldswitch.ax") returned 1
	[0044.449] lstrcmpiA (lpString1="", lpString2="fieldswitch.ax") returned -1
	[0044.449] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned="Eurosti.TTF"
	[0044.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.449] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.449] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="offset.ax") returned -1
	[0044.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="offset.ax") returned -1
	[0044.449] lstrcmpiA (lpString1="", lpString2="offset.ax") returned -1
	[0044.449] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned="fieldswitch.ax"
	[0044.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.449] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.449] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OmdBase.dll") returned -1
	[0044.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OmdBase.dll") returned -1
	[0044.450] lstrcmpiA (lpString1="", lpString2="OmdBase.dll") returned -1
	[0044.450] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\offset.ax") returned="offset.ax"
	[0044.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.450] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.450] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.450] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OmdProject.dll") returned -1
	[0044.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OmdProject.dll") returned -1
	[0044.450] lstrcmpiA (lpString1="", lpString2="OmdProject.dll") returned -1
	[0044.450] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned="OmdBase.dll"
	[0044.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.450] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.450] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.450] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pipeline.dll") returned -1
	[0044.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pipeline.dll") returned -1
	[0044.450] lstrcmpiA (lpString1="", lpString2="Pipeline.dll") returned -1
	[0044.450] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned="OmdProject.dll"
	[0044.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.450] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.451] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.451] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PipeTran.dll") returned -1
	[0044.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PipeTran.dll") returned -1
	[0044.451] lstrcmpiA (lpString1="", lpString2="PipeTran.dll") returned -1
	[0044.451] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned="Pipeline.dll"
	[0044.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.451] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.451] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.451] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtstreamsink.ax") returned -1
	[0044.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtstreamsink.ax") returned -1
	[0044.451] lstrcmpiA (lpString1="", lpString2="rtstreamsink.ax") returned -1
	[0044.451] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned="PipeTran.dll"
	[0044.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.451] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.451] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.451] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtstreamsource.ax") returned -1
	[0044.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtstreamsource.ax") returned -1
	[0044.451] lstrcmpiA (lpString1="", lpString2="rtstreamsource.ax") returned -1
	[0044.451] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned="rtstreamsink.ax"
	[0044.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.452] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.452] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0044.452] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SecretST.TTF") returned -1
	[0044.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecretST.TTF") returned -1
	[0044.452] lstrcmpiA (lpString1="", lpString2="SecretST.TTF") returned -1
	[0044.452] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned="rtstreamsource.ax"
	[0044.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\"
	[0044.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned=""
	[0044.452] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0044.452] lstrcmpA (lpString1=".", lpString2="Shared") returned -1
	[0044.452] lstrcmpA (lpString1="..", lpString2="Shared") returned -1
	[0044.452] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned="SecretST.TTF"
	[0044.452] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0044.454] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.454] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.454] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.454] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.454] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.454] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.454] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Common.fxh") returned 1
	[0044.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Common.fxh") returned 1
	[0044.455] lstrcmpiA (lpString1="", lpString2="Common.fxh") returned -1
	[0044.455] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\*.*") returned="*.*"
	[0044.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\"
	[0044.455] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned=""
	[0044.456] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.456] CloseHandle (hObject=0x88) returned 1
	[0044.457] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.457] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.457] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DissolveAnother.png") returned 1
	[0044.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DissolveAnother.png") returned 1
	[0044.457] lstrcmpiA (lpString1="", lpString2="DissolveAnother.png") returned -1
	[0044.457] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned="Common.fxh"
	[0044.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\"
	[0044.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned=""
	[0044.458] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.458] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0044.458] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DissolveNoise.png") returned 1
	[0044.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DissolveNoise.png") returned 1
	[0044.458] lstrcmpiA (lpString1="", lpString2="DissolveNoise.png") returned -1
	[0044.458] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="DissolveAnother.png"
	[0044.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\"
	[0044.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned=""
	[0044.458] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0044.458] lstrcmpA (lpString1=".", lpString2="DvdStyles") returned -1
	[0044.458] lstrcmpA (lpString1="..", lpString2="DvdStyles") returned -1
	[0044.458] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="DissolveNoise.png"
	[0044.459] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0044.461] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.461] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.462] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.462] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.462] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.462] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="16to9Squareframe_Buttongraphic.png") returned 1
	[0044.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16to9Squareframe_Buttongraphic.png") returned 1
	[0044.462] lstrcmpiA (lpString1="", lpString2="16to9Squareframe_Buttongraphic.png") returned -1
	[0044.462] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.464] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.464] CloseHandle (hObject=0x8c) returned 1
	[0044.475] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.475] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="16to9Squareframe_SelectionSubpicture.png") returned 1
	[0044.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16to9Squareframe_SelectionSubpicture.png") returned 1
	[0044.475] lstrcmpiA (lpString1="", lpString2="16to9Squareframe_SelectionSubpicture.png") returned -1
	[0044.475] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="16to9Squareframe_Buttongraphic.png"
	[0044.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.475] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.475] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="16to9Squareframe_VideoInset.png") returned 1
	[0044.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16to9Squareframe_VideoInset.png") returned 1
	[0044.475] lstrcmpiA (lpString1="", lpString2="16to9Squareframe_VideoInset.png") returned -1
	[0044.475] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="16to9Squareframe_SelectionSubpicture.png"
	[0044.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.481] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.481] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4to3Squareframe_Buttongraphic.png") returned 1
	[0044.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4to3Squareframe_Buttongraphic.png") returned 1
	[0044.482] lstrcmpiA (lpString1="", lpString2="4to3Squareframe_Buttongraphic.png") returned -1
	[0044.482] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="16to9Squareframe_VideoInset.png"
	[0044.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.482] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.482] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4to3Squareframe_SelectionSubpicture.png") returned 1
	[0044.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4to3Squareframe_SelectionSubpicture.png") returned 1
	[0044.482] lstrcmpiA (lpString1="", lpString2="4to3Squareframe_SelectionSubpicture.png") returned -1
	[0044.482] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="4to3Squareframe_Buttongraphic.png"
	[0044.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.482] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.482] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4to3Squareframe_VideoInset.png") returned 1
	[0044.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4to3Squareframe_VideoInset.png") returned 1
	[0044.482] lstrcmpiA (lpString1="", lpString2="4to3Squareframe_VideoInset.png") returned -1
	[0044.482] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="4to3Squareframe_SelectionSubpicture.png"
	[0044.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.483] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.483] lstrcmpA (lpString1=".", lpString2="BabyBoy") returned -1
	[0044.483] lstrcmpA (lpString1="..", lpString2="BabyBoy") returned -1
	[0044.483] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="4to3Squareframe_VideoInset.png"
	[0044.483] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.495] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.495] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.495] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.495] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.495] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.495] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.495] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="babyblue.png") returned 1
	[0044.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="babyblue.png") returned 1
	[0044.495] lstrcmpiA (lpString1="", lpString2="babyblue.png") returned -1
	[0044.495] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*") returned="*.*"
	[0044.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.495] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.497] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.497] CloseHandle (hObject=0x90) returned 1
	[0044.507] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.507] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.507] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBoyMainBackground.wmv") returned 1
	[0044.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainBackground.wmv") returned 1
	[0044.507] lstrcmpiA (lpString1="", lpString2="BabyBoyMainBackground.wmv") returned -1
	[0044.507] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="babyblue.png"
	[0044.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.507] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.508] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.508] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.508] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBoyMainBackground_PAL.wmv") returned 1
	[0044.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainBackground_PAL.wmv") returned 1
	[0044.508] lstrcmpiA (lpString1="", lpString2="BabyBoyMainBackground_PAL.wmv") returned -1
	[0044.508] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="BabyBoyMainBackground.wmv"
	[0044.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.509] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.509] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.518] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBoyMainToNotesBackground.wmv") returned 1
	[0044.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToNotesBackground.wmv") returned 1
	[0044.518] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToNotesBackground.wmv") returned -1
	[0044.518] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="BabyBoyMainBackground_PAL.wmv"
	[0044.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.519] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.519] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBoyMainToNotesBackground_PAL.wmv") returned 1
	[0044.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToNotesBackground_PAL.wmv") returned 1
	[0044.519] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToNotesBackground_PAL.wmv") returned -1
	[0044.519] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="BabyBoyMainToNotesBackground.wmv"
	[0044.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.519] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.519] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBoyMainToScenesBackground.wmv") returned 1
	[0044.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToScenesBackground.wmv") returned 1
	[0044.520] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToScenesBackground.wmv") returned -1
	[0044.520] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="BabyBoyMainToNotesBackground_PAL.wmv"
	[0044.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.520] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.520] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.521] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBoyMainToScenesBackground_PAL.wmv") returned 1
	[0044.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToScenesBackground_PAL.wmv") returned 1
	[0044.521] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToScenesBackground_PAL.wmv") returned -1
	[0044.521] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="BabyBoyMainToScenesBackground.wmv"
	[0044.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.521] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.521] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.521] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBoyNotesBackground.wmv") returned 1
	[0044.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyNotesBackground.wmv") returned 1
	[0044.521] lstrcmpiA (lpString1="", lpString2="BabyBoyNotesBackground.wmv") returned -1
	[0044.521] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="BabyBoyMainToScenesBackground_PAL.wmv"
	[0044.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.521] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.521] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.521] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="BabyBoyNotesBackground.wmv"
	[0044.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.522] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.522] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.522] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned="BabyBoyNotesBackground_PAL.wmv"
	[0044.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.522] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.523] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.523] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.523] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned="BabyBoyScenesBackground.wmv"
	[0044.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.523] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.523] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.523] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned="BabyBoyScenesBackground_PAL.wmv"
	[0044.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.523] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.523] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.523] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned="LightBlueRectangle.PNG"
	[0044.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.524] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.524] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.524] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.524] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned="MainMenuButtonIcon.png"
	[0044.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.524] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.525] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.525] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.525] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned="navSubpicture.png"
	[0044.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.526] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.526] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.526] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.526] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned="nav_leftarrow.png"
	[0044.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.526] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.526] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.526] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.526] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned="nav_rightarrow.png"
	[0044.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\"
	[0044.526] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned=""
	[0044.526] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.526] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0044.527] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.527] lstrcmpA (lpString1=".", lpString2="BabyGirl") returned -1
	[0044.527] lstrcmpA (lpString1="..", lpString2="BabyGirl") returned -1
	[0044.527] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.527] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.529] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.529] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.529] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.529] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.529] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.529] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.529] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*") returned="*.*"
	[0044.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.531] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.531] CloseHandle (hObject=0x90) returned 1
	[0044.531] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.531] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.531] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned="16_9-frame-background.png"
	[0044.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.531] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.532] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.532] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned="16_9-frame-highlight.png"
	[0044.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.532] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.532] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.532] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png"
	[0044.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.532] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.533] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.533] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.533] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned="babypink.png"
	[0044.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.533] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.533] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.533] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned="background.png"
	[0044.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.534] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.534] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.534] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned="bear_formatted_matte2.wmv"
	[0044.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.534] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.534] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.534] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.534] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned="Bear_Formatted_MATTE2_PAL.wmv"
	[0044.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.534] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.534] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.534] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.534] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned="bear_formatted_rgb6.wmv"
	[0044.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.535] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.535] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.535] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned="Bear_Formatted_RGB6_PAL.wmv"
	[0044.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.535] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.536] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.536] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.536] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned="btn-back-static.png"
	[0044.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.536] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.536] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.536] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned="btn-next-static.png"
	[0044.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.536] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.536] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.536] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned="btn-previous-static.png"
	[0044.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.537] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.537] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.537] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned="button-highlight.png"
	[0044.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.537] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.538] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.538] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.538] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned="chapters-static.png"
	[0044.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.538] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.538] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.538] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.538] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned="content-background.png"
	[0044.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.538] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.538] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.538] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.538] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned="content-foreground.png"
	[0044.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.538] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.538] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.538] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.538] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned="curtains.png"
	[0044.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.539] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.539] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.539] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.539] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned="flower_precomp_matte.wmv"
	[0044.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.539] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.540] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.540] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.540] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned="flower_PreComp_MATTE_PAL.wmv"
	[0044.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.540] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.540] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.540] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.540] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned="flower_trans_matte.wmv"
	[0044.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.540] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.540] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.540] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.540] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned="flower_trans_MATTE_PAL.wmv"
	[0044.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.540] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.548] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.548] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.548] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned="flower_trans_rgb.wmv"
	[0044.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.548] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.548] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.548] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.548] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned="flower_trans_RGB_PAL.wmv"
	[0044.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.548] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.549] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.549] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.549] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned="highlight.png"
	[0044.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.549] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.549] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.549] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.549] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned="mainimage-mask.png"
	[0044.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.549] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.550] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0044.550] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.550] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned="notes-static.png"
	[0044.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\"
	[0044.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned=""
	[0044.550] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0044.550] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0044.550] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.550] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.550] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.551] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.551] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.551] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned="BlackRectangle.bmp"
	[0044.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.552] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.552] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned="circleround_glass.png"
	[0044.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.552] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.552] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.552] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.552] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned="circleround_selectionsubpicture.png"
	[0044.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.552] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.553] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.553] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned="circleround_videoinset.png"
	[0044.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.553] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.553] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned="Circle_ButtonGraphic.png"
	[0044.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.553] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.553] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned="circle_glass_Thumbnail.bmp"
	[0044.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.553] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.553] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned="Circle_SelectionSubpictureA.png"
	[0044.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.554] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.554] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned="Circle_SelectionSubpictureB.png"
	[0044.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.554] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.554] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.554] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned="Circle_VideoInset.png"
	[0044.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.555] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.555] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned="cloud_Thumbnail.bmp"
	[0044.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.555] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.555] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned="Dot.png"
	[0044.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.555] lstrcmpA (lpString1=".", lpString2="FlipPage") returned -1
	[0044.555] lstrcmpA (lpString1="..", lpString2="FlipPage") returned -1
	[0044.555] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned="DvdTransform.fx"
	[0044.555] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.561] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.562] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.562] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.562] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.562] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*") returned="*.*"
	[0044.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.564] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.564] CloseHandle (hObject=0x90) returned 1
	[0044.565] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.565] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned="1047x576black.png"
	[0044.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.566] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.567] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned="203x8subpicture.png"
	[0044.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.568] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.568] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png"
	[0044.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.569] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.569] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png"
	[0044.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.570] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.570] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png"
	[0044.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.571] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.571] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png"
	[0044.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.572] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.572] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png"
	[0044.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.573] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.573] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png"
	[0044.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\"
	[0044.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned=""
	[0044.573] lstrcmpA (lpString1=".", lpString2="Full") returned -1
	[0044.573] lstrcmpA (lpString1="..", lpString2="Full") returned -1
	[0044.573] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.573] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.575] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.575] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.575] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.575] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.575] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*") returned="*.*"
	[0044.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.576] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.577] CloseHandle (hObject=0x90) returned 1
	[0044.578] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.578] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned="1047x576black.png"
	[0044.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.579] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.579] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned="15x15dot.png"
	[0044.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.579] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.579] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned="dotsdarkoverlay.png"
	[0044.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.580] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.580] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned="dotslightoverlay.png"
	[0044.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.581] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.581] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned="full.png"
	[0044.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.582] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.582] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png"
	[0044.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.583] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.583] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png"
	[0044.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.584] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.584] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png"
	[0044.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.585] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.585] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png"
	[0044.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.586] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.586] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png"
	[0044.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.587] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.587] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png"
	[0044.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\"
	[0044.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned=""
	[0044.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.587] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.588] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned="Heart_ButtonGraphic.png"
	[0044.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.588] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned="heart_glass_Thumbnail.bmp"
	[0044.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.588] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned="Heart_SelectionSubpicture.png"
	[0044.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.588] lstrcmpA (lpString1=".", lpString2="HueCycle") returned -1
	[0044.588] lstrcmpA (lpString1="..", lpString2="HueCycle") returned -1
	[0044.588] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned="Heart_VideoInset.png"
	[0044.588] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.591] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.591] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.591] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.591] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.591] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*") returned="*.*"
	[0044.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.593] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.593] CloseHandle (hObject=0x90) returned 1
	[0044.593] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.593] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned="1047x576black.png"
	[0044.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.594] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.594] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned="15x15dot.png"
	[0044.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.595] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned="colorcycle.png"
	[0044.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.595] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned="huemainsubpicture2.png"
	[0044.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.595] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png"
	[0044.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.595] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png"
	[0044.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.596] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.596] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png"
	[0044.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.596] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.596] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png"
	[0044.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.596] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.596] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png"
	[0044.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.597] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.597] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png"
	[0044.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\"
	[0044.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned=""
	[0044.597] lstrcmpA (lpString1=".", lpString2="LayeredTitles") returned -1
	[0044.597] lstrcmpA (lpString1="..", lpString2="LayeredTitles") returned -1
	[0044.597] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.597] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.599] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.599] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.599] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.599] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.599] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*") returned="*.*"
	[0044.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.600] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.600] CloseHandle (hObject=0x90) returned 1
	[0044.601] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.601] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned="1047x576black.png"
	[0044.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.602] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.602] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned="203x8subpicture.png"
	[0044.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.602] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.602] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned="blackbars60.png"
	[0044.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.603] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.603] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned="layers.png"
	[0044.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.604] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.604] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png"
	[0044.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.609] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.609] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png"
	[0044.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.610] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png"
	[0044.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.611] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png"
	[0044.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.612] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.612] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png"
	[0044.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\"
	[0044.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned=""
	[0044.614] lstrcmpA (lpString1=".", lpString2="Memories") returned -1
	[0044.614] lstrcmpA (lpString1="..", lpString2="Memories") returned -1
	[0044.614] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.614] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.624] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.624] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.624] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.624] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.624] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*") returned="*.*"
	[0044.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.626] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.626] CloseHandle (hObject=0x90) returned 1
	[0044.627] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.627] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned="16_9-frame-background.png"
	[0044.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.628] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.628] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned="16_9-frame-highlight.png"
	[0044.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.628] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.628] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png"
	[0044.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.628] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.628] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned="16_9-frame-overlay.png"
	[0044.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.629] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.629] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned="background.png"
	[0044.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.629] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.629] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned="btn-back-static.png"
	[0044.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.630] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.630] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned="btn-next-static.png"
	[0044.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.631] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.631] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned="btn-previous-static.png"
	[0044.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.631] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.631] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned="button-highlight.png"
	[0044.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.631] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.631] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned="button-overlay.png"
	[0044.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.631] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.631] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned="Memories_buttonClear.png"
	[0044.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.632] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.632] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned="Notes_btn-back-static.png"
	[0044.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.632] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.632] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned="Notes_content-background.png"
	[0044.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.633] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.633] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned="scrapbook.png"
	[0044.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.633] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.633] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned="Title_content-background.png"
	[0044.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.633] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.633] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned="Title_mainImage-mask.png"
	[0044.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\"
	[0044.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned=""
	[0044.634] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.634] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.635] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned="menu_style_default_Thumbnail.png"
	[0044.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.635] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png"
	[0044.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.636] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png"
	[0044.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.636] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png"
	[0044.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.637] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.637] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png"
	[0044.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.637] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.637] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png"
	[0044.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\"
	[0044.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned=""
	[0044.637] lstrcmpA (lpString1=".", lpString2="OldAge") returned -1
	[0044.637] lstrcmpA (lpString1="..", lpString2="OldAge") returned -1
	[0044.637] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png"
	[0044.637] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.644] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.644] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.644] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.644] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.644] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*") returned="*.*"
	[0044.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.644] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.645] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.645] CloseHandle (hObject=0x90) returned 1
	[0044.645] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.645] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned="1047x576black.png"
	[0044.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.646] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.646] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned="15x15dot.png"
	[0044.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.647] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.647] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned="decorative_rule.png"
	[0044.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.647] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.647] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png"
	[0044.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.647] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.647] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png"
	[0044.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.647] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.647] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png"
	[0044.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.648] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.648] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png"
	[0044.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.648] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.648] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png"
	[0044.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.648] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.648] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png"
	[0044.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\"
	[0044.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned=""
	[0044.648] lstrcmpA (lpString1=".", lpString2="Performance") returned -1
	[0044.648] lstrcmpA (lpString1="..", lpString2="Performance") returned -1
	[0044.648] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.648] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.651] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.651] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.651] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.651] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.651] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*") returned="*.*"
	[0044.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.652] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.652] CloseHandle (hObject=0x90) returned 1
	[0044.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.653] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned="720x480blacksquare.png"
	[0044.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.653] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.653] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned="NextMenuButtonIcon.png"
	[0044.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.653] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.654] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned="NextMenuButtonIconSubpictur.png"
	[0044.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.654] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.654] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.654] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned="Notes_loop.wmv"
	[0044.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.654] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.655] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.655] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned="Notes_loop_PAL.wmv"
	[0044.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.655] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.655] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned="ParentMenuButtonIcon.png"
	[0044.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.655] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.655] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned="ParentMenuButtonIconSubpict.png"
	[0044.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.656] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.656] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned="performance.png"
	[0044.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.656] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.656] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.656] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned="Perf_Scenes_Mask1.png"
	[0044.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.656] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.656] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.657] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned="Perf_Scenes_Subpicture1.png"
	[0044.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.657] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned="PreviousMenuButtonIcon.png"
	[0044.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.658] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned="PreviousMenuButtonIconSubpi.png"
	[0044.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.658] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned="redmenu.png"
	[0044.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.658] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned="Scene_loop.wmv"
	[0044.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.666] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned="Scene_loop_PAL.wmv"
	[0044.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.666] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.670] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.670] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned="TitleButtonIcon.png"
	[0044.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.670] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.670] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned="TitleButtonSubpicture.png"
	[0044.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.671] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.671] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned="Title_Page.wmv"
	[0044.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.671] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.671] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned="Title_Page_PAL.wmv"
	[0044.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.671] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.672] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.672] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned="title_trans_notes.wmv"
	[0044.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.672] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.672] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned="Title_Trans_Notes_PAL.wmv"
	[0044.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.672] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.672] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned="title_trans_scene.wmv"
	[0044.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.673] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.673] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned="Title_Trans_Scene_PAL.wmv"
	[0044.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.673] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.673] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.673] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned="userContent_16x9_imagemask.png"
	[0044.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\"
	[0044.673] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned=""
	[0044.673] lstrcmpA (lpString1=".", lpString2="Pets") returned -1
	[0044.673] lstrcmpA (lpString1="..", lpString2="Pets") returned -1
	[0044.673] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*"
	[0044.673] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.682] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.682] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.682] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.682] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.682] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*") returned="*.*"
	[0044.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.684] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.684] CloseHandle (hObject=0x90) returned 1
	[0044.685] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.685] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned="Notes_INTRO_BG.wmv"
	[0044.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.686] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned="Notes_INTRO_BG_PAL.wmv"
	[0044.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.686] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned="Notes_LOOP_BG.wmv"
	[0044.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.686] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned="Notes_LOOP_BG_PAL.wmv"
	[0044.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.689] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.689] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned="Pets_btn-back-over-select.png"
	[0044.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.690] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.690] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned="Pets_btn-back-static.png"
	[0044.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.690] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.690] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned="Pets_btn-next-over-select.png"
	[0044.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.691] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.691] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned="Pets_btn-next-static.png"
	[0044.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.692] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned="Pets_btn-over-DOT.png"
	[0044.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.692] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned="Pets_btn-previous-over-select.png"
	[0044.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.692] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned="Pets_btn-previous-static.png"
	[0044.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0044.693] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned="Pets_frame-border.png"
	[0044.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\"
	[0044.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned=""
	[0044.693] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned="Pets_frame-highlight.png"
	[0044.694] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned="Pets_frame-imageMask.png"
	[0044.694] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned="Pets_frame-shadow.png"
	[0044.698] lstrcmpA (lpString1=".", lpString2="Push") returned -1
	[0044.698] lstrcmpA (lpString1="..", lpString2="Push") returned -1
	[0044.698] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.700] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.700] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.700] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.702] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.702] CloseHandle (hObject=0x90) returned 1
	[0044.703] lstrcmpA (lpString1=".", lpString2="Rectangles") returned -1
	[0044.703] lstrcmpA (lpString1="..", lpString2="Rectangles") returned -1
	[0044.703] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.705] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.706] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.706] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.707] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.707] CloseHandle (hObject=0x90) returned 1
	[0044.712] lstrcmpA (lpString1=".", lpString2="ResizingPanels") returned -1
	[0044.712] lstrcmpA (lpString1="..", lpString2="ResizingPanels") returned -1
	[0044.712] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.715] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.715] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.715] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.716] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.716] CloseHandle (hObject=0x90) returned 1
	[0044.719] lstrcmpA (lpString1=".", lpString2="Shatter") returned -1
	[0044.719] lstrcmpA (lpString1="..", lpString2="Shatter") returned -1
	[0044.719] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.722] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.722] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.722] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.723] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.723] CloseHandle (hObject=0x90) returned 1
	[0044.725] lstrcmpA (lpString1=".", lpString2="SpecialOccasion") returned -1
	[0044.725] lstrcmpA (lpString1="..", lpString2="SpecialOccasion") returned -1
	[0044.725] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.727] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.727] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.727] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.728] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.728] CloseHandle (hObject=0x90) returned 1
	[0044.732] lstrcmpA (lpString1=".", lpString2="Sports") returned -1
	[0044.732] lstrcmpA (lpString1="..", lpString2="Sports") returned -1
	[0044.732] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.744] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.744] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.744] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.745] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.745] CloseHandle (hObject=0x90) returned 1
	[0044.749] lstrcmpA (lpString1=".", lpString2="Stacking") returned -1
	[0044.749] lstrcmpA (lpString1="..", lpString2="Stacking") returned -1
	[0044.749] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.751] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.751] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.751] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.752] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.752] CloseHandle (hObject=0x90) returned 1
	[0044.768] lstrcmpA (lpString1=".", lpString2="Travel") returned -1
	[0044.768] lstrcmpA (lpString1="..", lpString2="Travel") returned -1
	[0044.768] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.770] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.770] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.770] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.771] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.771] CloseHandle (hObject=0x90) returned 1
	[0044.776] lstrcmpA (lpString1=".", lpString2="VideoWall") returned -1
	[0044.776] lstrcmpA (lpString1="..", lpString2="VideoWall") returned -1
	[0044.776] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.777] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.777] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.777] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.778] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.778] CloseHandle (hObject=0x90) returned 1
	[0044.778] lstrcmpA (lpString1=".", lpString2="Vignette") returned -1
	[0044.778] lstrcmpA (lpString1="..", lpString2="Vignette") returned -1
	[0044.778] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.780] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.780] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.780] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.781] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.781] CloseHandle (hObject=0x90) returned 1
	[0044.782] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1
	[0044.782] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1
	[0044.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0044.782] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.782] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.782] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.782] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0044.782] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0044.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0044.783] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.783] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.783] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.784] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.784] CloseHandle (hObject=0x88) returned 1
	[0044.786] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.786] CloseHandle (hObject=0x84) returned 1
	[0044.787] lstrcmpA (lpString1=".", lpString2="SIGNUP") returned -1
	[0044.787] lstrcmpA (lpString1="..", lpString2="SIGNUP") returned -1
	[0044.787] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0044.788] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.788] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.788] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.789] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.789] CloseHandle (hObject=0x88) returned 1
	[0044.789] lstrcmpA (lpString1=".", lpString2="Microsoft Analysis Services") returned -1
	[0044.789] lstrcmpA (lpString1="..", lpString2="Microsoft Analysis Services") returned -1
	[0044.789] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0044.789] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.789] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.789] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.790] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.790] CloseHandle (hObject=0x84) returned 1
	[0044.792] lstrcmpA (lpString1=".", lpString2="AS OLEDB") returned -1
	[0044.792] lstrcmpA (lpString1="..", lpString2="AS OLEDB") returned -1
	[0044.792] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0044.793] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.793] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.793] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.793] lstrcmpA (lpString1=".", lpString2="10") returned -1
	[0044.793] lstrcmpA (lpString1="..", lpString2="10") returned -1
	[0044.793] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0044.803] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.803] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.803] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.803] lstrcmpA (lpString1=".", lpString2="Cartridges") returned -1
	[0044.803] lstrcmpA (lpString1="..", lpString2="Cartridges") returned -1
	[0044.803] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.823] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.824] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.824] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.825] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.825] CloseHandle (hObject=0x90) returned 1
	[0044.826] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.826] CloseHandle (hObject=0x8c) returned 1
	[0044.826] lstrcmpA (lpString1=".", lpString2="Resources") returned -1
	[0044.826] lstrcmpA (lpString1="..", lpString2="Resources") returned -1
	[0044.826] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0044.827] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.827] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.827] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.827] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0044.827] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0044.827] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0044.827] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.828] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.828] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.828] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.829] CloseHandle (hObject=0x94) returned 1
	[0044.829] lstrcmpA (lpString1=".", lpString2="Microsoft Office") returned -1
	[0044.829] lstrcmpA (lpString1="..", lpString2="Microsoft Office") returned -1
	[0044.829] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0044.829] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.829] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.829] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.829] lstrcmpA (lpString1=".", lpString2="CLIPART") returned -1
	[0044.829] lstrcmpA (lpString1="..", lpString2="CLIPART") returned -1
	[0044.829] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0044.830] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.830] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.830] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.830] lstrcmpA (lpString1=".", lpString2="PUB60COR") returned -1
	[0044.830] lstrcmpA (lpString1="..", lpString2="PUB60COR") returned -1
	[0044.830] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0044.846] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0044.847] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0044.847] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0044.849] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0044.849] CloseHandle (hObject=0x8c) returned 1
	[0044.875] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.875] CloseHandle (hObject=0x8c) returned 1
	[0044.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.boom")) returned 1
	[0044.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.zip") returned 0
	[0044.876] lstrlenA (lpString="*.zip") returned 5
	[0044.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.rar") returned 0
	[0044.876] lstrlenA (lpString="*.rar") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.7z") returned 0
	[0044.877] lstrlenA (lpString="*.7z") returned 4
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.tar") returned 0
	[0044.877] lstrlenA (lpString="*.tar") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.gzip") returned 0
	[0044.877] lstrlenA (lpString="*.gzip") returned 6
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.jpg") returned 0
	[0044.877] lstrlenA (lpString="*.jpg") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.jpeg") returned 0
	[0044.877] lstrlenA (lpString="*.jpeg") returned 6
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.psd") returned 0
	[0044.877] lstrlenA (lpString="*.psd") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.cdr") returned 0
	[0044.877] lstrlenA (lpString="*.cdr") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.dwg") returned 0
	[0044.877] lstrlenA (lpString="*.dwg") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.max") returned 0
	[0044.877] lstrlenA (lpString="*.max") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.bmp") returned 0
	[0044.877] lstrlenA (lpString="*.bmp") returned 5
	[0044.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", pszSpec="*.gif") returned 1
	[0044.877] lstrlenA (lpString="*.gif") returned 5
	[0044.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.877] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c30
	[0044.878] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83130700, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83130700, dwHighDateTime=0x1bd4b49)) returned 1
	[0044.878] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.878] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c0d, lpOverlapped=0x0) returned 1
	[0044.896] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.896] CloseHandle (hObject=0x8c) returned 1
	[0044.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.boom")) returned 1
	[0044.896] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.896] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.896] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00021_.GIF") returned 1
	[0044.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00021_.GIF") returned 1
	[0044.896] lstrcmpiA (lpString1="", lpString2="AG00021_.GIF") returned -1
	[0044.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned="AG00011_.GIF"
	[0044.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.897] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF"
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.zip") returned 0
	[0044.897] lstrlenA (lpString="*.zip") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.rar") returned 0
	[0044.897] lstrlenA (lpString="*.rar") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.7z") returned 0
	[0044.897] lstrlenA (lpString="*.7z") returned 4
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.tar") returned 0
	[0044.897] lstrlenA (lpString="*.tar") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.gzip") returned 0
	[0044.897] lstrlenA (lpString="*.gzip") returned 6
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.jpg") returned 0
	[0044.897] lstrlenA (lpString="*.jpg") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.jpeg") returned 0
	[0044.897] lstrlenA (lpString="*.jpeg") returned 6
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.psd") returned 0
	[0044.897] lstrlenA (lpString="*.psd") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.cdr") returned 0
	[0044.897] lstrlenA (lpString="*.cdr") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.dwg") returned 0
	[0044.897] lstrlenA (lpString="*.dwg") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.max") returned 0
	[0044.897] lstrlenA (lpString="*.max") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.bmp") returned 0
	[0044.897] lstrlenA (lpString="*.bmp") returned 5
	[0044.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.gif") returned 1
	[0044.897] lstrlenA (lpString="*.gif") returned 5
	[0044.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF"
	[0044.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF"
	[0044.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF."
	[0044.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.Boom"
	[0044.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.898] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a19
	[0044.898] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78587200, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78587200, dwHighDateTime=0x1bd4b49)) returned 1
	[0044.898] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.898] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x39f6, lpOverlapped=0x0) returned 1
	[0044.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="AG00021_.GIF"
	[0044.899] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.900] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x39f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x39f6, lpOverlapped=0x0) returned 1
	[0044.900] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.900] CloseHandle (hObject=0x8c) returned 1
	[0044.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.boom")) returned 1
	[0044.901] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.901] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00037_.GIF") returned 1
	[0044.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00037_.GIF") returned 1
	[0044.901] lstrcmpiA (lpString1="", lpString2="AG00037_.GIF") returned -1
	[0044.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="AG00021_.GIF"
	[0044.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00037_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF"
	[0044.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.zip") returned 0
	[0044.901] lstrlenA (lpString="*.zip") returned 5
	[0044.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.rar") returned 0
	[0044.901] lstrlenA (lpString="*.rar") returned 5
	[0044.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.7z") returned 0
	[0044.901] lstrlenA (lpString="*.7z") returned 4
	[0044.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.tar") returned 0
	[0044.901] lstrlenA (lpString="*.tar") returned 5
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.gzip") returned 0
	[0044.902] lstrlenA (lpString="*.gzip") returned 6
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.jpg") returned 0
	[0044.902] lstrlenA (lpString="*.jpg") returned 5
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.jpeg") returned 0
	[0044.902] lstrlenA (lpString="*.jpeg") returned 6
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.psd") returned 0
	[0044.902] lstrlenA (lpString="*.psd") returned 5
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.cdr") returned 0
	[0044.902] lstrlenA (lpString="*.cdr") returned 5
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.dwg") returned 0
	[0044.902] lstrlenA (lpString="*.dwg") returned 5
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.max") returned 0
	[0044.902] lstrlenA (lpString="*.max") returned 5
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.bmp") returned 0
	[0044.902] lstrlenA (lpString="*.bmp") returned 5
	[0044.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.gif") returned 1
	[0044.902] lstrlenA (lpString="*.gif") returned 5
	[0044.902] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF"
	[0044.902] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF"
	[0044.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF."
	[0044.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.Boom"
	[0044.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.902] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a1c
	[0044.902] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x64147500, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x64147500, dwHighDateTime=0x1bd4b49)) returned 1
	[0044.903] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.903] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x19f9, lpOverlapped=0x0) returned 1
	[0044.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="AG00037_.GIF"
	[0044.918] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.919] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x19f9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x19f9, lpOverlapped=0x0) returned 1
	[0044.919] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.919] CloseHandle (hObject=0x8c) returned 1
	[0044.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.boom")) returned 1
	[0044.920] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.920] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00038_.GIF") returned 1
	[0044.921] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00038_.GIF") returned 1
	[0044.921] lstrcmpiA (lpString1="", lpString2="AG00038_.GIF") returned -1
	[0044.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="AG00037_.GIF"
	[0044.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00038_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF"
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.zip") returned 0
	[0044.921] lstrlenA (lpString="*.zip") returned 5
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.rar") returned 0
	[0044.921] lstrlenA (lpString="*.rar") returned 5
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.7z") returned 0
	[0044.921] lstrlenA (lpString="*.7z") returned 4
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.tar") returned 0
	[0044.921] lstrlenA (lpString="*.tar") returned 5
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.gzip") returned 0
	[0044.921] lstrlenA (lpString="*.gzip") returned 6
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.jpg") returned 0
	[0044.921] lstrlenA (lpString="*.jpg") returned 5
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.jpeg") returned 0
	[0044.921] lstrlenA (lpString="*.jpeg") returned 6
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.psd") returned 0
	[0044.921] lstrlenA (lpString="*.psd") returned 5
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.cdr") returned 0
	[0044.921] lstrlenA (lpString="*.cdr") returned 5
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.dwg") returned 0
	[0044.921] lstrlenA (lpString="*.dwg") returned 5
	[0044.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.max") returned 0
	[0044.921] lstrlenA (lpString="*.max") returned 5
	[0044.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.bmp") returned 0
	[0044.922] lstrlenA (lpString="*.bmp") returned 5
	[0044.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.gif") returned 1
	[0044.922] lstrlenA (lpString="*.gif") returned 5
	[0044.922] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF"
	[0044.922] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF"
	[0044.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF."
	[0044.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.Boom"
	[0044.922] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.923] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb3
	[0044.923] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x47589c00, dwHighDateTime=0x1bf325d), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x47589c00, dwHighDateTime=0x1bf325d)) returned 1
	[0044.923] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.923] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc90, lpOverlapped=0x0) returned 1
	[0044.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="AG00038_.GIF"
	[0044.928] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.928] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc90, lpOverlapped=0x0) returned 1
	[0044.928] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.928] CloseHandle (hObject=0x8c) returned 1
	[0044.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.boom")) returned 1
	[0044.931] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.931] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00040_.GIF") returned 1
	[0044.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00040_.GIF") returned 1
	[0044.931] lstrcmpiA (lpString1="", lpString2="AG00040_.GIF") returned -1
	[0044.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="AG00038_.GIF"
	[0044.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.931] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00040_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF"
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.zip") returned 0
	[0044.931] lstrlenA (lpString="*.zip") returned 5
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.rar") returned 0
	[0044.931] lstrlenA (lpString="*.rar") returned 5
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.7z") returned 0
	[0044.931] lstrlenA (lpString="*.7z") returned 4
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.tar") returned 0
	[0044.931] lstrlenA (lpString="*.tar") returned 5
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.gzip") returned 0
	[0044.931] lstrlenA (lpString="*.gzip") returned 6
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.jpg") returned 0
	[0044.931] lstrlenA (lpString="*.jpg") returned 5
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.jpeg") returned 0
	[0044.931] lstrlenA (lpString="*.jpeg") returned 6
	[0044.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.psd") returned 0
	[0044.931] lstrlenA (lpString="*.psd") returned 5
	[0044.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.cdr") returned 0
	[0044.932] lstrlenA (lpString="*.cdr") returned 5
	[0044.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.dwg") returned 0
	[0044.932] lstrlenA (lpString="*.dwg") returned 5
	[0044.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.max") returned 0
	[0044.932] lstrlenA (lpString="*.max") returned 5
	[0044.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.bmp") returned 0
	[0044.932] lstrlenA (lpString="*.bmp") returned 5
	[0044.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.gif") returned 1
	[0044.932] lstrlenA (lpString="*.gif") returned 5
	[0044.932] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF"
	[0044.932] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF"
	[0044.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF."
	[0044.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.Boom"
	[0044.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.932] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fa1
	[0044.932] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5f4fc100, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5f4fc100, dwHighDateTime=0x1bd4b49)) returned 1
	[0044.932] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.932] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1f7e, lpOverlapped=0x0) returned 1
	[0044.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="AG00040_.GIF"
	[0044.941] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.941] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1f7e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1f7e, lpOverlapped=0x0) returned 1
	[0044.941] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.942] CloseHandle (hObject=0x8c) returned 1
	[0044.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.boom")) returned 1
	[0044.943] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.943] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00052_.GIF") returned 1
	[0044.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00052_.GIF") returned 1
	[0044.943] lstrcmpiA (lpString1="", lpString2="AG00052_.GIF") returned -1
	[0044.943] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="AG00040_.GIF"
	[0044.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.943] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00052_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF"
	[0044.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.zip") returned 0
	[0044.943] lstrlenA (lpString="*.zip") returned 5
	[0044.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.rar") returned 0
	[0044.943] lstrlenA (lpString="*.rar") returned 5
	[0044.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.7z") returned 0
	[0044.943] lstrlenA (lpString="*.7z") returned 4
	[0044.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.tar") returned 0
	[0044.943] lstrlenA (lpString="*.tar") returned 5
	[0044.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.gzip") returned 0
	[0044.943] lstrlenA (lpString="*.gzip") returned 6
	[0044.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.jpg") returned 0
	[0044.943] lstrlenA (lpString="*.jpg") returned 5
	[0044.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.jpeg") returned 0
	[0044.943] lstrlenA (lpString="*.jpeg") returned 6
	[0044.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.psd") returned 0
	[0044.944] lstrlenA (lpString="*.psd") returned 5
	[0044.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.cdr") returned 0
	[0044.944] lstrlenA (lpString="*.cdr") returned 5
	[0044.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.dwg") returned 0
	[0044.944] lstrlenA (lpString="*.dwg") returned 5
	[0044.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.max") returned 0
	[0044.944] lstrlenA (lpString="*.max") returned 5
	[0044.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.bmp") returned 0
	[0044.944] lstrlenA (lpString="*.bmp") returned 5
	[0044.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.gif") returned 1
	[0044.944] lstrlenA (lpString="*.gif") returned 5
	[0044.944] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF"
	[0044.944] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF"
	[0044.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF."
	[0044.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.Boom"
	[0044.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.944] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e06
	[0044.944] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x262e5400, dwHighDateTime=0x1bd4c10), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x262e5400, dwHighDateTime=0x1bd4c10)) returned 1
	[0044.944] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.944] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1de3, lpOverlapped=0x0) returned 1
	[0044.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="AG00052_.GIF"
	[0044.952] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.952] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1de3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1de3, lpOverlapped=0x0) returned 1
	[0044.952] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.952] CloseHandle (hObject=0x8c) returned 1
	[0044.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.boom")) returned 1
	[0044.953] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.953] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.953] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00057_.GIF") returned 1
	[0044.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00057_.GIF") returned 1
	[0044.953] lstrcmpiA (lpString1="", lpString2="AG00057_.GIF") returned -1
	[0044.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="AG00052_.GIF"
	[0044.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF"
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.zip") returned 0
	[0044.954] lstrlenA (lpString="*.zip") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.rar") returned 0
	[0044.954] lstrlenA (lpString="*.rar") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.7z") returned 0
	[0044.954] lstrlenA (lpString="*.7z") returned 4
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.tar") returned 0
	[0044.954] lstrlenA (lpString="*.tar") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.gzip") returned 0
	[0044.954] lstrlenA (lpString="*.gzip") returned 6
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.jpg") returned 0
	[0044.954] lstrlenA (lpString="*.jpg") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.jpeg") returned 0
	[0044.954] lstrlenA (lpString="*.jpeg") returned 6
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.psd") returned 0
	[0044.954] lstrlenA (lpString="*.psd") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.cdr") returned 0
	[0044.954] lstrlenA (lpString="*.cdr") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.dwg") returned 0
	[0044.954] lstrlenA (lpString="*.dwg") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.max") returned 0
	[0044.954] lstrlenA (lpString="*.max") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.bmp") returned 0
	[0044.954] lstrlenA (lpString="*.bmp") returned 5
	[0044.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.gif") returned 1
	[0044.954] lstrlenA (lpString="*.gif") returned 5
	[0044.954] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF"
	[0044.954] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF"
	[0044.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF."
	[0044.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.Boom"
	[0044.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.955] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e73
	[0044.955] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8b6b4200, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8b6b4200, dwHighDateTime=0x1bd4b49)) returned 1
	[0044.955] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.955] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2e50, lpOverlapped=0x0) returned 1
	[0044.965] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="AG00057_.GIF"
	[0044.965] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.965] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2e50, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2e50, lpOverlapped=0x0) returned 1
	[0044.965] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.966] CloseHandle (hObject=0x8c) returned 1
	[0044.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.boom")) returned 1
	[0044.967] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.967] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00090_.GIF") returned 1
	[0044.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00090_.GIF") returned 1
	[0044.967] lstrcmpiA (lpString1="", lpString2="AG00090_.GIF") returned -1
	[0044.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="AG00057_.GIF"
	[0044.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.967] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.967] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00090_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF"
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.zip") returned 0
	[0044.967] lstrlenA (lpString="*.zip") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.rar") returned 0
	[0044.967] lstrlenA (lpString="*.rar") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.7z") returned 0
	[0044.967] lstrlenA (lpString="*.7z") returned 4
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.tar") returned 0
	[0044.967] lstrlenA (lpString="*.tar") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.gzip") returned 0
	[0044.967] lstrlenA (lpString="*.gzip") returned 6
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.jpg") returned 0
	[0044.967] lstrlenA (lpString="*.jpg") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.jpeg") returned 0
	[0044.967] lstrlenA (lpString="*.jpeg") returned 6
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.psd") returned 0
	[0044.967] lstrlenA (lpString="*.psd") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.cdr") returned 0
	[0044.967] lstrlenA (lpString="*.cdr") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.dwg") returned 0
	[0044.967] lstrlenA (lpString="*.dwg") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.max") returned 0
	[0044.967] lstrlenA (lpString="*.max") returned 5
	[0044.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.bmp") returned 0
	[0044.967] lstrlenA (lpString="*.bmp") returned 5
	[0044.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.gif") returned 1
	[0044.968] lstrlenA (lpString="*.gif") returned 5
	[0044.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF"
	[0044.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF"
	[0044.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF."
	[0044.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.Boom"
	[0044.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.968] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x205
	[0044.968] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x29618e00, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x29618e00, dwHighDateTime=0x1bd50af)) returned 1
	[0044.968] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.968] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1e2, lpOverlapped=0x0) returned 1
	[0044.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="AG00090_.GIF"
	[0044.969] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.969] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1e2, lpOverlapped=0x0) returned 1
	[0044.969] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.969] CloseHandle (hObject=0x8c) returned 1
	[0044.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.boom")) returned 1
	[0044.970] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.970] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00092_.GIF") returned 1
	[0044.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00092_.GIF") returned 1
	[0044.970] lstrcmpiA (lpString1="", lpString2="AG00092_.GIF") returned -1
	[0044.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="AG00090_.GIF"
	[0044.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.970] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00092_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF"
	[0044.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.zip") returned 0
	[0044.970] lstrlenA (lpString="*.zip") returned 5
	[0044.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.rar") returned 0
	[0044.970] lstrlenA (lpString="*.rar") returned 5
	[0044.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.7z") returned 0
	[0044.971] lstrlenA (lpString="*.7z") returned 4
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.tar") returned 0
	[0044.971] lstrlenA (lpString="*.tar") returned 5
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.gzip") returned 0
	[0044.971] lstrlenA (lpString="*.gzip") returned 6
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.jpg") returned 0
	[0044.971] lstrlenA (lpString="*.jpg") returned 5
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.jpeg") returned 0
	[0044.971] lstrlenA (lpString="*.jpeg") returned 6
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.psd") returned 0
	[0044.971] lstrlenA (lpString="*.psd") returned 5
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.cdr") returned 0
	[0044.971] lstrlenA (lpString="*.cdr") returned 5
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.dwg") returned 0
	[0044.971] lstrlenA (lpString="*.dwg") returned 5
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.max") returned 0
	[0044.971] lstrlenA (lpString="*.max") returned 5
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.bmp") returned 0
	[0044.971] lstrlenA (lpString="*.bmp") returned 5
	[0044.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.gif") returned 1
	[0044.971] lstrlenA (lpString="*.gif") returned 5
	[0044.971] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF"
	[0044.971] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF"
	[0044.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF."
	[0044.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.Boom"
	[0044.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.971] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f6
	[0044.971] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x26ff3400, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x26ff3400, dwHighDateTime=0x1bd50af)) returned 1
	[0044.972] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.972] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1d3, lpOverlapped=0x0) returned 1
	[0044.972] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="AG00092_.GIF"
	[0044.972] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.972] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1d3, lpOverlapped=0x0) returned 1
	[0044.972] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.972] CloseHandle (hObject=0x8c) returned 1
	[0044.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.boom")) returned 1
	[0044.973] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.974] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.974] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00103_.GIF") returned 1
	[0044.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00103_.GIF") returned 1
	[0044.974] lstrcmpiA (lpString1="", lpString2="AG00103_.GIF") returned -1
	[0044.974] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="AG00092_.GIF"
	[0044.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.974] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.974] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00103_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF"
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.zip") returned 0
	[0044.974] lstrlenA (lpString="*.zip") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.rar") returned 0
	[0044.974] lstrlenA (lpString="*.rar") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.7z") returned 0
	[0044.974] lstrlenA (lpString="*.7z") returned 4
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.tar") returned 0
	[0044.974] lstrlenA (lpString="*.tar") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.gzip") returned 0
	[0044.974] lstrlenA (lpString="*.gzip") returned 6
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.jpg") returned 0
	[0044.974] lstrlenA (lpString="*.jpg") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.jpeg") returned 0
	[0044.974] lstrlenA (lpString="*.jpeg") returned 6
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.psd") returned 0
	[0044.974] lstrlenA (lpString="*.psd") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.cdr") returned 0
	[0044.974] lstrlenA (lpString="*.cdr") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.dwg") returned 0
	[0044.974] lstrlenA (lpString="*.dwg") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.max") returned 0
	[0044.974] lstrlenA (lpString="*.max") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.bmp") returned 0
	[0044.974] lstrlenA (lpString="*.bmp") returned 5
	[0044.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.gif") returned 1
	[0044.975] lstrlenA (lpString="*.gif") returned 5
	[0044.975] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF"
	[0044.975] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF"
	[0044.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF."
	[0044.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.Boom"
	[0044.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.975] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x319e
	[0044.976] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4ef57700, dwHighDateTime=0x1bd4f8b), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4ef57700, dwHighDateTime=0x1bd4f8b)) returned 1
	[0044.976] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.976] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x317b, lpOverlapped=0x0) returned 1
	[0044.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="AG00103_.GIF"
	[0044.988] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.988] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x317b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x317b, lpOverlapped=0x0) returned 1
	[0044.988] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0044.988] CloseHandle (hObject=0x8c) returned 1
	[0044.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.boom")) returned 1
	[0044.989] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0044.989] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0044.990] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00120_.GIF") returned 1
	[0044.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00120_.GIF") returned 1
	[0044.990] lstrcmpiA (lpString1="", lpString2="AG00120_.GIF") returned -1
	[0044.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="AG00103_.GIF"
	[0044.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0044.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0044.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0044.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0044.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00120_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF"
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.zip") returned 0
	[0044.990] lstrlenA (lpString="*.zip") returned 5
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.rar") returned 0
	[0044.990] lstrlenA (lpString="*.rar") returned 5
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.7z") returned 0
	[0044.990] lstrlenA (lpString="*.7z") returned 4
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.tar") returned 0
	[0044.990] lstrlenA (lpString="*.tar") returned 5
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.gzip") returned 0
	[0044.990] lstrlenA (lpString="*.gzip") returned 6
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.jpg") returned 0
	[0044.990] lstrlenA (lpString="*.jpg") returned 5
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.jpeg") returned 0
	[0044.990] lstrlenA (lpString="*.jpeg") returned 6
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.psd") returned 0
	[0044.990] lstrlenA (lpString="*.psd") returned 5
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.cdr") returned 0
	[0044.990] lstrlenA (lpString="*.cdr") returned 5
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.dwg") returned 0
	[0044.990] lstrlenA (lpString="*.dwg") returned 5
	[0044.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.max") returned 0
	[0044.991] lstrlenA (lpString="*.max") returned 5
	[0044.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.bmp") returned 0
	[0044.991] lstrlenA (lpString="*.bmp") returned 5
	[0044.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.gif") returned 1
	[0044.991] lstrlenA (lpString="*.gif") returned 5
	[0044.991] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF"
	[0044.991] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF"
	[0044.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF."
	[0044.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.Boom"
	[0044.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0044.991] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9c
	[0044.991] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf316a100, dwHighDateTime=0x1bd4bcc), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf316a100, dwHighDateTime=0x1bd4bcc)) returned 1
	[0044.991] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0044.991] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd79, lpOverlapped=0x0) returned 1
	[0045.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="AG00120_.GIF"
	[0045.013] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.013] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd79, lpOverlapped=0x0) returned 1
	[0045.013] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.013] CloseHandle (hObject=0x8c) returned 1
	[0045.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.boom")) returned 1
	[0045.014] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.014] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.014] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00126_.GIF") returned 1
	[0045.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00126_.GIF") returned 1
	[0045.014] lstrcmpiA (lpString1="", lpString2="AG00126_.GIF") returned -1
	[0045.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="AG00120_.GIF"
	[0045.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.014] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.014] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00126_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF"
	[0045.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.zip") returned 0
	[0045.014] lstrlenA (lpString="*.zip") returned 5
	[0045.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.rar") returned 0
	[0045.014] lstrlenA (lpString="*.rar") returned 5
	[0045.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.7z") returned 0
	[0045.014] lstrlenA (lpString="*.7z") returned 4
	[0045.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.tar") returned 0
	[0045.014] lstrlenA (lpString="*.tar") returned 5
	[0045.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.gzip") returned 0
	[0045.014] lstrlenA (lpString="*.gzip") returned 6
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.jpg") returned 0
	[0045.015] lstrlenA (lpString="*.jpg") returned 5
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.jpeg") returned 0
	[0045.015] lstrlenA (lpString="*.jpeg") returned 6
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.psd") returned 0
	[0045.015] lstrlenA (lpString="*.psd") returned 5
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.cdr") returned 0
	[0045.015] lstrlenA (lpString="*.cdr") returned 5
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.dwg") returned 0
	[0045.015] lstrlenA (lpString="*.dwg") returned 5
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.max") returned 0
	[0045.015] lstrlenA (lpString="*.max") returned 5
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.bmp") returned 0
	[0045.015] lstrlenA (lpString="*.bmp") returned 5
	[0045.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.gif") returned 1
	[0045.015] lstrlenA (lpString="*.gif") returned 5
	[0045.015] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF"
	[0045.015] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF"
	[0045.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF."
	[0045.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.Boom"
	[0045.015] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.015] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc44
	[0045.015] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x33bee00, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x33bee00, dwHighDateTime=0x1bd50af)) returned 1
	[0045.015] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.015] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc21, lpOverlapped=0x0) returned 1
	[0045.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="AG00126_.GIF"
	[0045.021] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.021] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc21, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc21, lpOverlapped=0x0) returned 1
	[0045.021] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.021] CloseHandle (hObject=0x8c) returned 1
	[0045.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.boom")) returned 1
	[0045.023] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.023] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.023] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00129_.GIF") returned 1
	[0045.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00129_.GIF") returned 1
	[0045.023] lstrcmpiA (lpString1="", lpString2="AG00129_.GIF") returned -1
	[0045.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="AG00126_.GIF"
	[0045.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00129_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF"
	[0045.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.zip") returned 0
	[0045.023] lstrlenA (lpString="*.zip") returned 5
	[0045.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.rar") returned 0
	[0045.023] lstrlenA (lpString="*.rar") returned 5
	[0045.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.7z") returned 0
	[0045.023] lstrlenA (lpString="*.7z") returned 4
	[0045.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.tar") returned 0
	[0045.023] lstrlenA (lpString="*.tar") returned 5
	[0045.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.gzip") returned 0
	[0045.023] lstrlenA (lpString="*.gzip") returned 6
	[0045.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.jpg") returned 0
	[0045.023] lstrlenA (lpString="*.jpg") returned 5
	[0045.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.jpeg") returned 0
	[0045.024] lstrlenA (lpString="*.jpeg") returned 6
	[0045.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.psd") returned 0
	[0045.024] lstrlenA (lpString="*.psd") returned 5
	[0045.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.cdr") returned 0
	[0045.024] lstrlenA (lpString="*.cdr") returned 5
	[0045.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.dwg") returned 0
	[0045.024] lstrlenA (lpString="*.dwg") returned 5
	[0045.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.max") returned 0
	[0045.024] lstrlenA (lpString="*.max") returned 5
	[0045.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.bmp") returned 0
	[0045.024] lstrlenA (lpString="*.bmp") returned 5
	[0045.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.gif") returned 1
	[0045.024] lstrlenA (lpString="*.gif") returned 5
	[0045.024] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF"
	[0045.024] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF"
	[0045.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF."
	[0045.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.Boom"
	[0045.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.024] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30c2
	[0045.024] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd99400, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd99400, dwHighDateTime=0x1bd50af)) returned 1
	[0045.024] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.024] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x309f, lpOverlapped=0x0) returned 1
	[0045.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="AG00129_.GIF"
	[0045.031] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.031] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x309f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x309f, lpOverlapped=0x0) returned 1
	[0045.031] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.031] CloseHandle (hObject=0x8c) returned 1
	[0045.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.boom")) returned 1
	[0045.033] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.033] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.033] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00130_.GIF") returned 1
	[0045.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00130_.GIF") returned 1
	[0045.033] lstrcmpiA (lpString1="", lpString2="AG00130_.GIF") returned -1
	[0045.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="AG00129_.GIF"
	[0045.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00130_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF"
	[0045.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.zip") returned 0
	[0045.033] lstrlenA (lpString="*.zip") returned 5
	[0045.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.rar") returned 0
	[0045.033] lstrlenA (lpString="*.rar") returned 5
	[0045.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.7z") returned 0
	[0045.033] lstrlenA (lpString="*.7z") returned 4
	[0045.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.tar") returned 0
	[0045.033] lstrlenA (lpString="*.tar") returned 5
	[0045.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.gzip") returned 0
	[0045.033] lstrlenA (lpString="*.gzip") returned 6
	[0045.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.jpg") returned 0
	[0045.033] lstrlenA (lpString="*.jpg") returned 5
	[0045.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.jpeg") returned 0
	[0045.033] lstrlenA (lpString="*.jpeg") returned 6
	[0045.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.psd") returned 0
	[0045.034] lstrlenA (lpString="*.psd") returned 5
	[0045.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.cdr") returned 0
	[0045.034] lstrlenA (lpString="*.cdr") returned 5
	[0045.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.dwg") returned 0
	[0045.034] lstrlenA (lpString="*.dwg") returned 5
	[0045.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.max") returned 0
	[0045.034] lstrlenA (lpString="*.max") returned 5
	[0045.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.bmp") returned 0
	[0045.034] lstrlenA (lpString="*.bmp") returned 5
	[0045.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.gif") returned 1
	[0045.034] lstrlenA (lpString="*.gif") returned 5
	[0045.034] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF"
	[0045.034] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF"
	[0045.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF."
	[0045.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.Boom"
	[0045.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.034] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1485
	[0045.034] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xffa86700, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xffa86700, dwHighDateTime=0x1bd50ae)) returned 1
	[0045.034] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.034] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1462, lpOverlapped=0x0) returned 1
	[0045.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="AG00130_.GIF"
	[0045.042] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.042] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1462, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1462, lpOverlapped=0x0) returned 1
	[0045.042] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.042] CloseHandle (hObject=0x8c) returned 1
	[0045.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.boom")) returned 1
	[0045.043] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.043] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.043] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00135_.GIF") returned 1
	[0045.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00135_.GIF") returned 1
	[0045.043] lstrcmpiA (lpString1="", lpString2="AG00135_.GIF") returned -1
	[0045.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="AG00130_.GIF"
	[0045.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF"
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.zip") returned 0
	[0045.044] lstrlenA (lpString="*.zip") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.rar") returned 0
	[0045.044] lstrlenA (lpString="*.rar") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.7z") returned 0
	[0045.044] lstrlenA (lpString="*.7z") returned 4
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.tar") returned 0
	[0045.044] lstrlenA (lpString="*.tar") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.gzip") returned 0
	[0045.044] lstrlenA (lpString="*.gzip") returned 6
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.jpg") returned 0
	[0045.044] lstrlenA (lpString="*.jpg") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.jpeg") returned 0
	[0045.044] lstrlenA (lpString="*.jpeg") returned 6
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.psd") returned 0
	[0045.044] lstrlenA (lpString="*.psd") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.cdr") returned 0
	[0045.044] lstrlenA (lpString="*.cdr") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.dwg") returned 0
	[0045.044] lstrlenA (lpString="*.dwg") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.max") returned 0
	[0045.044] lstrlenA (lpString="*.max") returned 5
	[0045.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.bmp") returned 0
	[0045.044] lstrlenA (lpString="*.bmp") returned 5
	[0045.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.gif") returned 1
	[0045.045] lstrlenA (lpString="*.gif") returned 5
	[0045.045] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF"
	[0045.045] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF"
	[0045.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF."
	[0045.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.Boom"
	[0045.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.046] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa24
	[0045.046] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf9b28600, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9b28600, dwHighDateTime=0x1bd50ae)) returned 1
	[0045.046] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.046] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa01, lpOverlapped=0x0) returned 1
	[0045.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="AG00135_.GIF"
	[0045.054] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.054] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa01, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa01, lpOverlapped=0x0) returned 1
	[0045.055] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.055] CloseHandle (hObject=0x8c) returned 1
	[0045.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.boom")) returned 1
	[0045.056] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00139_.GIF") returned 1
	[0045.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00139_.GIF") returned 1
	[0045.056] lstrcmpiA (lpString1="", lpString2="AG00139_.GIF") returned -1
	[0045.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="AG00135_.GIF"
	[0045.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00139_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF"
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.zip") returned 0
	[0045.056] lstrlenA (lpString="*.zip") returned 5
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.rar") returned 0
	[0045.056] lstrlenA (lpString="*.rar") returned 5
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.7z") returned 0
	[0045.056] lstrlenA (lpString="*.7z") returned 4
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.tar") returned 0
	[0045.056] lstrlenA (lpString="*.tar") returned 5
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.gzip") returned 0
	[0045.056] lstrlenA (lpString="*.gzip") returned 6
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.jpg") returned 0
	[0045.056] lstrlenA (lpString="*.jpg") returned 5
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.jpeg") returned 0
	[0045.056] lstrlenA (lpString="*.jpeg") returned 6
	[0045.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.psd") returned 0
	[0045.056] lstrlenA (lpString="*.psd") returned 5
	[0045.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.cdr") returned 0
	[0045.057] lstrlenA (lpString="*.cdr") returned 5
	[0045.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.dwg") returned 0
	[0045.057] lstrlenA (lpString="*.dwg") returned 5
	[0045.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.max") returned 0
	[0045.057] lstrlenA (lpString="*.max") returned 5
	[0045.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.bmp") returned 0
	[0045.057] lstrlenA (lpString="*.bmp") returned 5
	[0045.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.gif") returned 1
	[0045.057] lstrlenA (lpString="*.gif") returned 5
	[0045.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF"
	[0045.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF"
	[0045.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF."
	[0045.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.Boom"
	[0045.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.058] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x296f
	[0045.058] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3bca500, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3bca500, dwHighDateTime=0x1bd50ae)) returned 1
	[0045.058] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.058] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x294c, lpOverlapped=0x0) returned 1
	[0045.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="AG00139_.GIF"
	[0045.060] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.060] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x294c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x294c, lpOverlapped=0x0) returned 1
	[0045.060] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.060] CloseHandle (hObject=0x8c) returned 1
	[0045.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.boom")) returned 1
	[0045.061] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.061] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.061] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00142_.GIF") returned 1
	[0045.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00142_.GIF") returned 1
	[0045.061] lstrcmpiA (lpString1="", lpString2="AG00142_.GIF") returned -1
	[0045.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="AG00139_.GIF"
	[0045.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00142_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF"
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.zip") returned 0
	[0045.062] lstrlenA (lpString="*.zip") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.rar") returned 0
	[0045.062] lstrlenA (lpString="*.rar") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.7z") returned 0
	[0045.062] lstrlenA (lpString="*.7z") returned 4
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.tar") returned 0
	[0045.062] lstrlenA (lpString="*.tar") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.gzip") returned 0
	[0045.062] lstrlenA (lpString="*.gzip") returned 6
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.jpg") returned 0
	[0045.062] lstrlenA (lpString="*.jpg") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.jpeg") returned 0
	[0045.062] lstrlenA (lpString="*.jpeg") returned 6
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.psd") returned 0
	[0045.062] lstrlenA (lpString="*.psd") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.cdr") returned 0
	[0045.062] lstrlenA (lpString="*.cdr") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.dwg") returned 0
	[0045.062] lstrlenA (lpString="*.dwg") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.max") returned 0
	[0045.062] lstrlenA (lpString="*.max") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.bmp") returned 0
	[0045.062] lstrlenA (lpString="*.bmp") returned 5
	[0045.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.gif") returned 1
	[0045.062] lstrlenA (lpString="*.gif") returned 5
	[0045.062] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF"
	[0045.062] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF"
	[0045.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF."
	[0045.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.Boom"
	[0045.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.063] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bcc
	[0045.063] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xedc6c400, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xedc6c400, dwHighDateTime=0x1bd50ae)) returned 1
	[0045.063] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.063] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3ba9, lpOverlapped=0x0) returned 1
	[0045.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="AG00142_.GIF"
	[0045.064] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.065] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3ba9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3ba9, lpOverlapped=0x0) returned 1
	[0045.065] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.065] CloseHandle (hObject=0x8c) returned 1
	[0045.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.boom")) returned 1
	[0045.066] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.066] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00154_.GIF") returned 1
	[0045.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00154_.GIF") returned 1
	[0045.066] lstrcmpiA (lpString1="", lpString2="AG00154_.GIF") returned -1
	[0045.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="AG00142_.GIF"
	[0045.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.066] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.066] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00154_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF"
	[0045.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.zip") returned 0
	[0045.066] lstrlenA (lpString="*.zip") returned 5
	[0045.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.rar") returned 0
	[0045.066] lstrlenA (lpString="*.rar") returned 5
	[0045.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.7z") returned 0
	[0045.066] lstrlenA (lpString="*.7z") returned 4
	[0045.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.tar") returned 0
	[0045.066] lstrlenA (lpString="*.tar") returned 5
	[0045.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.gzip") returned 0
	[0045.066] lstrlenA (lpString="*.gzip") returned 6
	[0045.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.jpg") returned 0
	[0045.067] lstrlenA (lpString="*.jpg") returned 5
	[0045.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.jpeg") returned 0
	[0045.067] lstrlenA (lpString="*.jpeg") returned 6
	[0045.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.psd") returned 0
	[0045.067] lstrlenA (lpString="*.psd") returned 5
	[0045.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.cdr") returned 0
	[0045.067] lstrlenA (lpString="*.cdr") returned 5
	[0045.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.dwg") returned 0
	[0045.067] lstrlenA (lpString="*.dwg") returned 5
	[0045.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.max") returned 0
	[0045.067] lstrlenA (lpString="*.max") returned 5
	[0045.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.bmp") returned 0
	[0045.067] lstrlenA (lpString="*.bmp") returned 5
	[0045.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.gif") returned 1
	[0045.067] lstrlenA (lpString="*.gif") returned 5
	[0045.067] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF"
	[0045.067] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF"
	[0045.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF."
	[0045.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.Boom"
	[0045.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.067] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c3
	[0045.067] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb9688900, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb9688900, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.067] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.067] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14a0, lpOverlapped=0x0) returned 1
	[0045.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="AG00154_.GIF"
	[0045.134] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.135] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14a0, lpOverlapped=0x0) returned 1
	[0045.135] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.135] CloseHandle (hObject=0x8c) returned 1
	[0045.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.boom")) returned 1
	[0045.136] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.136] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00157_.GIF") returned 1
	[0045.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00157_.GIF") returned 1
	[0045.136] lstrcmpiA (lpString1="", lpString2="AG00157_.GIF") returned -1
	[0045.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="AG00154_.GIF"
	[0045.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00157_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF"
	[0045.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.zip") returned 0
	[0045.136] lstrlenA (lpString="*.zip") returned 5
	[0045.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.rar") returned 0
	[0045.136] lstrlenA (lpString="*.rar") returned 5
	[0045.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.7z") returned 0
	[0045.136] lstrlenA (lpString="*.7z") returned 4
	[0045.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.tar") returned 0
	[0045.137] lstrlenA (lpString="*.tar") returned 5
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.gzip") returned 0
	[0045.137] lstrlenA (lpString="*.gzip") returned 6
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.jpg") returned 0
	[0045.137] lstrlenA (lpString="*.jpg") returned 5
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.jpeg") returned 0
	[0045.137] lstrlenA (lpString="*.jpeg") returned 6
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.psd") returned 0
	[0045.137] lstrlenA (lpString="*.psd") returned 5
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.cdr") returned 0
	[0045.137] lstrlenA (lpString="*.cdr") returned 5
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.dwg") returned 0
	[0045.137] lstrlenA (lpString="*.dwg") returned 5
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.max") returned 0
	[0045.137] lstrlenA (lpString="*.max") returned 5
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.bmp") returned 0
	[0045.137] lstrlenA (lpString="*.bmp") returned 5
	[0045.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.gif") returned 1
	[0045.137] lstrlenA (lpString="*.gif") returned 5
	[0045.137] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF"
	[0045.137] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF"
	[0045.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF."
	[0045.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.Boom"
	[0045.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.137] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135b
	[0045.137] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2417b00, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2417b00, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.137] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.137] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1338, lpOverlapped=0x0) returned 1
	[0045.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="AG00157_.GIF"
	[0045.160] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.160] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1338, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1338, lpOverlapped=0x0) returned 1
	[0045.160] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.160] CloseHandle (hObject=0x8c) returned 1
	[0045.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.boom")) returned 1
	[0045.162] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.162] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00158_.GIF") returned 1
	[0045.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00158_.GIF") returned 1
	[0045.162] lstrcmpiA (lpString1="", lpString2="AG00158_.GIF") returned -1
	[0045.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="AG00157_.GIF"
	[0045.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00158_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF"
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.zip") returned 0
	[0045.162] lstrlenA (lpString="*.zip") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.rar") returned 0
	[0045.162] lstrlenA (lpString="*.rar") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.7z") returned 0
	[0045.162] lstrlenA (lpString="*.7z") returned 4
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.tar") returned 0
	[0045.162] lstrlenA (lpString="*.tar") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.gzip") returned 0
	[0045.162] lstrlenA (lpString="*.gzip") returned 6
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.jpg") returned 0
	[0045.162] lstrlenA (lpString="*.jpg") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.jpeg") returned 0
	[0045.162] lstrlenA (lpString="*.jpeg") returned 6
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.psd") returned 0
	[0045.162] lstrlenA (lpString="*.psd") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.cdr") returned 0
	[0045.162] lstrlenA (lpString="*.cdr") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.dwg") returned 0
	[0045.162] lstrlenA (lpString="*.dwg") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.max") returned 0
	[0045.162] lstrlenA (lpString="*.max") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.bmp") returned 0
	[0045.162] lstrlenA (lpString="*.bmp") returned 5
	[0045.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.gif") returned 1
	[0045.162] lstrlenA (lpString="*.gif") returned 5
	[0045.163] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF"
	[0045.163] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF"
	[0045.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF."
	[0045.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.Boom"
	[0045.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.163] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a6
	[0045.163] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xad7cc700, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xad7cc700, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.163] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.163] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1383, lpOverlapped=0x0) returned 1
	[0045.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="AG00158_.GIF"
	[0045.173] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.174] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1383, lpOverlapped=0x0) returned 1
	[0045.174] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.174] CloseHandle (hObject=0x8c) returned 1
	[0045.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.boom")) returned 1
	[0045.175] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.175] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.175] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00160_.GIF") returned 1
	[0045.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00160_.GIF") returned 1
	[0045.175] lstrcmpiA (lpString1="", lpString2="AG00160_.GIF") returned -1
	[0045.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="AG00158_.GIF"
	[0045.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.175] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.175] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00160_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF"
	[0045.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.zip") returned 0
	[0045.175] lstrlenA (lpString="*.zip") returned 5
	[0045.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.rar") returned 0
	[0045.175] lstrlenA (lpString="*.rar") returned 5
	[0045.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.7z") returned 0
	[0045.175] lstrlenA (lpString="*.7z") returned 4
	[0045.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.tar") returned 0
	[0045.176] lstrlenA (lpString="*.tar") returned 5
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.gzip") returned 0
	[0045.176] lstrlenA (lpString="*.gzip") returned 6
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.jpg") returned 0
	[0045.176] lstrlenA (lpString="*.jpg") returned 5
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.jpeg") returned 0
	[0045.176] lstrlenA (lpString="*.jpeg") returned 6
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.psd") returned 0
	[0045.176] lstrlenA (lpString="*.psd") returned 5
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.cdr") returned 0
	[0045.176] lstrlenA (lpString="*.cdr") returned 5
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.dwg") returned 0
	[0045.176] lstrlenA (lpString="*.dwg") returned 5
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.max") returned 0
	[0045.176] lstrlenA (lpString="*.max") returned 5
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.bmp") returned 0
	[0045.176] lstrlenA (lpString="*.bmp") returned 5
	[0045.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.gif") returned 1
	[0045.176] lstrlenA (lpString="*.gif") returned 5
	[0045.176] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF"
	[0045.176] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF"
	[0045.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF."
	[0045.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.Boom"
	[0045.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.177] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47a
	[0045.177] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a69f700, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a69f700, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.177] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.177] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x457, lpOverlapped=0x0) returned 1
	[0045.178] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="AG00160_.GIF"
	[0045.178] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.178] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x457, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x457, lpOverlapped=0x0) returned 1
	[0045.179] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.179] CloseHandle (hObject=0x8c) returned 1
	[0045.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.boom")) returned 1
	[0045.180] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00161_.GIF") returned 1
	[0045.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00161_.GIF") returned 1
	[0045.180] lstrcmpiA (lpString1="", lpString2="AG00161_.GIF") returned -1
	[0045.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="AG00160_.GIF"
	[0045.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00161_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF"
	[0045.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.zip") returned 0
	[0045.181] lstrlenA (lpString="*.zip") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.rar") returned 0
	[0045.181] lstrlenA (lpString="*.rar") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.7z") returned 0
	[0045.181] lstrlenA (lpString="*.7z") returned 4
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.tar") returned 0
	[0045.181] lstrlenA (lpString="*.tar") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.gzip") returned 0
	[0045.181] lstrlenA (lpString="*.gzip") returned 6
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.jpg") returned 0
	[0045.181] lstrlenA (lpString="*.jpg") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.jpeg") returned 0
	[0045.181] lstrlenA (lpString="*.jpeg") returned 6
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.psd") returned 0
	[0045.181] lstrlenA (lpString="*.psd") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.cdr") returned 0
	[0045.181] lstrlenA (lpString="*.cdr") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.dwg") returned 0
	[0045.181] lstrlenA (lpString="*.dwg") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.max") returned 0
	[0045.181] lstrlenA (lpString="*.max") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.bmp") returned 0
	[0045.181] lstrlenA (lpString="*.bmp") returned 5
	[0045.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.gif") returned 1
	[0045.181] lstrlenA (lpString="*.gif") returned 5
	[0045.181] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF"
	[0045.181] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF"
	[0045.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF."
	[0045.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.Boom"
	[0045.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.181] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d9f
	[0045.182] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95a54300, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95a54300, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.182] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.182] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1d7c, lpOverlapped=0x0) returned 1
	[0045.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="AG00161_.GIF"
	[0045.189] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.189] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1d7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1d7c, lpOverlapped=0x0) returned 1
	[0045.189] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.190] CloseHandle (hObject=0x8c) returned 1
	[0045.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.boom")) returned 1
	[0045.191] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.191] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.191] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00163_.GIF") returned 1
	[0045.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00163_.GIF") returned 1
	[0045.191] lstrcmpiA (lpString1="", lpString2="AG00163_.GIF") returned -1
	[0045.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="AG00161_.GIF"
	[0045.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00163_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF"
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.zip") returned 0
	[0045.191] lstrlenA (lpString="*.zip") returned 5
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.rar") returned 0
	[0045.191] lstrlenA (lpString="*.rar") returned 5
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.7z") returned 0
	[0045.191] lstrlenA (lpString="*.7z") returned 4
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.tar") returned 0
	[0045.191] lstrlenA (lpString="*.tar") returned 5
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.gzip") returned 0
	[0045.191] lstrlenA (lpString="*.gzip") returned 6
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.jpg") returned 0
	[0045.191] lstrlenA (lpString="*.jpg") returned 5
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.jpeg") returned 0
	[0045.191] lstrlenA (lpString="*.jpeg") returned 6
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.psd") returned 0
	[0045.191] lstrlenA (lpString="*.psd") returned 5
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.cdr") returned 0
	[0045.191] lstrlenA (lpString="*.cdr") returned 5
	[0045.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.dwg") returned 0
	[0045.192] lstrlenA (lpString="*.dwg") returned 5
	[0045.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.max") returned 0
	[0045.192] lstrlenA (lpString="*.max") returned 5
	[0045.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.bmp") returned 0
	[0045.192] lstrlenA (lpString="*.bmp") returned 5
	[0045.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.gif") returned 1
	[0045.192] lstrlenA (lpString="*.gif") returned 5
	[0045.192] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF"
	[0045.192] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF"
	[0045.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF."
	[0045.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.Boom"
	[0045.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.193] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b48
	[0045.193] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x65e47e00, dwHighDateTime=0x1bd4e52), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x65e47e00, dwHighDateTime=0x1bd4e52)) returned 1
	[0045.193] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.193] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1b25, lpOverlapped=0x0) returned 1
	[0045.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="AG00163_.GIF"
	[0045.195] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.196] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1b25, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1b25, lpOverlapped=0x0) returned 1
	[0045.196] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.196] CloseHandle (hObject=0x8c) returned 1
	[0045.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.boom")) returned 1
	[0045.197] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.197] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00164_.GIF") returned 1
	[0045.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00164_.GIF") returned 1
	[0045.197] lstrcmpiA (lpString1="", lpString2="AG00164_.GIF") returned -1
	[0045.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="AG00163_.GIF"
	[0045.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00164_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF"
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.zip") returned 0
	[0045.197] lstrlenA (lpString="*.zip") returned 5
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.rar") returned 0
	[0045.197] lstrlenA (lpString="*.rar") returned 5
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.7z") returned 0
	[0045.197] lstrlenA (lpString="*.7z") returned 4
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.tar") returned 0
	[0045.197] lstrlenA (lpString="*.tar") returned 5
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.gzip") returned 0
	[0045.197] lstrlenA (lpString="*.gzip") returned 6
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.jpg") returned 0
	[0045.197] lstrlenA (lpString="*.jpg") returned 5
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.jpeg") returned 0
	[0045.197] lstrlenA (lpString="*.jpeg") returned 6
	[0045.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.psd") returned 0
	[0045.198] lstrlenA (lpString="*.psd") returned 5
	[0045.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.cdr") returned 0
	[0045.198] lstrlenA (lpString="*.cdr") returned 5
	[0045.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.dwg") returned 0
	[0045.198] lstrlenA (lpString="*.dwg") returned 5
	[0045.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.max") returned 0
	[0045.198] lstrlenA (lpString="*.max") returned 5
	[0045.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.bmp") returned 0
	[0045.198] lstrlenA (lpString="*.bmp") returned 5
	[0045.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.gif") returned 1
	[0045.198] lstrlenA (lpString="*.gif") returned 5
	[0045.198] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF"
	[0045.198] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF"
	[0045.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF."
	[0045.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.Boom"
	[0045.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.198] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33c6
	[0045.198] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d4d0800, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d4d0800, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.198] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.198] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33a3, lpOverlapped=0x0) returned 1
	[0045.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="AG00164_.GIF"
	[0045.207] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.207] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33a3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33a3, lpOverlapped=0x0) returned 1
	[0045.207] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.207] CloseHandle (hObject=0x8c) returned 1
	[0045.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.boom")) returned 1
	[0045.208] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.208] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.208] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00165_.GIF") returned 1
	[0045.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00165_.GIF") returned 1
	[0045.208] lstrcmpiA (lpString1="", lpString2="AG00165_.GIF") returned -1
	[0045.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="AG00164_.GIF"
	[0045.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00165_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF"
	[0045.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.zip") returned 0
	[0045.208] lstrlenA (lpString="*.zip") returned 5
	[0045.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.rar") returned 0
	[0045.208] lstrlenA (lpString="*.rar") returned 5
	[0045.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.7z") returned 0
	[0045.208] lstrlenA (lpString="*.7z") returned 4
	[0045.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.tar") returned 0
	[0045.208] lstrlenA (lpString="*.tar") returned 5
	[0045.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.gzip") returned 0
	[0045.208] lstrlenA (lpString="*.gzip") returned 6
	[0045.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.jpg") returned 0
	[0045.209] lstrlenA (lpString="*.jpg") returned 5
	[0045.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.jpeg") returned 0
	[0045.209] lstrlenA (lpString="*.jpeg") returned 6
	[0045.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.psd") returned 0
	[0045.209] lstrlenA (lpString="*.psd") returned 5
	[0045.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.cdr") returned 0
	[0045.209] lstrlenA (lpString="*.cdr") returned 5
	[0045.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.dwg") returned 0
	[0045.209] lstrlenA (lpString="*.dwg") returned 5
	[0045.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.max") returned 0
	[0045.209] lstrlenA (lpString="*.max") returned 5
	[0045.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.bmp") returned 0
	[0045.209] lstrlenA (lpString="*.bmp") returned 5
	[0045.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.gif") returned 1
	[0045.209] lstrlenA (lpString="*.gif") returned 5
	[0045.209] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF"
	[0045.209] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF"
	[0045.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF."
	[0045.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.Boom"
	[0045.209] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.212] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2186
	[0045.212] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89b98100, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89b98100, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.212] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.212] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2163, lpOverlapped=0x0) returned 1
	[0045.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="AG00165_.GIF"
	[0045.216] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.216] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2163, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2163, lpOverlapped=0x0) returned 1
	[0045.216] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.216] CloseHandle (hObject=0x8c) returned 1
	[0045.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.boom")) returned 1
	[0045.218] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.218] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.218] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00167_.GIF") returned 1
	[0045.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00167_.GIF") returned 1
	[0045.218] lstrcmpiA (lpString1="", lpString2="AG00167_.GIF") returned -1
	[0045.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="AG00165_.GIF"
	[0045.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00167_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF"
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.zip") returned 0
	[0045.218] lstrlenA (lpString="*.zip") returned 5
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.rar") returned 0
	[0045.218] lstrlenA (lpString="*.rar") returned 5
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.7z") returned 0
	[0045.218] lstrlenA (lpString="*.7z") returned 4
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.tar") returned 0
	[0045.218] lstrlenA (lpString="*.tar") returned 5
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.gzip") returned 0
	[0045.218] lstrlenA (lpString="*.gzip") returned 6
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.jpg") returned 0
	[0045.218] lstrlenA (lpString="*.jpg") returned 5
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.jpeg") returned 0
	[0045.218] lstrlenA (lpString="*.jpeg") returned 6
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.psd") returned 0
	[0045.218] lstrlenA (lpString="*.psd") returned 5
	[0045.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.cdr") returned 0
	[0045.218] lstrlenA (lpString="*.cdr") returned 5
	[0045.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.dwg") returned 0
	[0045.219] lstrlenA (lpString="*.dwg") returned 5
	[0045.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.max") returned 0
	[0045.219] lstrlenA (lpString="*.max") returned 5
	[0045.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.bmp") returned 0
	[0045.219] lstrlenA (lpString="*.bmp") returned 5
	[0045.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.gif") returned 1
	[0045.219] lstrlenA (lpString="*.gif") returned 5
	[0045.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF"
	[0045.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF"
	[0045.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF."
	[0045.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.Boom"
	[0045.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.219] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x131e
	[0045.219] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81614600, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81614600, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.219] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.219] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x12fb, lpOverlapped=0x0) returned 1
	[0045.244] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="AG00167_.GIF"
	[0045.244] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.244] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x12fb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x12fb, lpOverlapped=0x0) returned 1
	[0045.244] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.244] CloseHandle (hObject=0x8c) returned 1
	[0045.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.boom")) returned 1
	[0045.246] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.246] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.246] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00169_.GIF") returned 1
	[0045.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00169_.GIF") returned 1
	[0045.246] lstrcmpiA (lpString1="", lpString2="AG00169_.GIF") returned -1
	[0045.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="AG00167_.GIF"
	[0045.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.246] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.246] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF"
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.zip") returned 0
	[0045.246] lstrlenA (lpString="*.zip") returned 5
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.rar") returned 0
	[0045.246] lstrlenA (lpString="*.rar") returned 5
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.7z") returned 0
	[0045.246] lstrlenA (lpString="*.7z") returned 4
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.tar") returned 0
	[0045.246] lstrlenA (lpString="*.tar") returned 5
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.gzip") returned 0
	[0045.246] lstrlenA (lpString="*.gzip") returned 6
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.jpg") returned 0
	[0045.246] lstrlenA (lpString="*.jpg") returned 5
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.jpeg") returned 0
	[0045.246] lstrlenA (lpString="*.jpeg") returned 6
	[0045.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.psd") returned 0
	[0045.247] lstrlenA (lpString="*.psd") returned 5
	[0045.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.cdr") returned 0
	[0045.247] lstrlenA (lpString="*.cdr") returned 5
	[0045.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.dwg") returned 0
	[0045.247] lstrlenA (lpString="*.dwg") returned 5
	[0045.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.max") returned 0
	[0045.247] lstrlenA (lpString="*.max") returned 5
	[0045.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.bmp") returned 0
	[0045.247] lstrlenA (lpString="*.bmp") returned 5
	[0045.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.gif") returned 1
	[0045.247] lstrlenA (lpString="*.gif") returned 5
	[0045.247] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF"
	[0045.247] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF"
	[0045.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF."
	[0045.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.Boom"
	[0045.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.247] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14ff
	[0045.247] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c9c9200, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c9c9200, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.247] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.247] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14dc, lpOverlapped=0x0) returned 1
	[0045.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="AG00169_.GIF"
	[0045.290] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.290] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14dc, lpOverlapped=0x0) returned 1
	[0045.290] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.290] CloseHandle (hObject=0x8c) returned 1
	[0045.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.boom")) returned 1
	[0045.291] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.291] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.291] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00170_.GIF") returned 1
	[0045.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00170_.GIF") returned 1
	[0045.291] lstrcmpiA (lpString1="", lpString2="AG00170_.GIF") returned -1
	[0045.291] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="AG00169_.GIF"
	[0045.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.291] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.291] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF"
	[0045.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.zip") returned 0
	[0045.292] lstrlenA (lpString="*.zip") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.rar") returned 0
	[0045.292] lstrlenA (lpString="*.rar") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.7z") returned 0
	[0045.292] lstrlenA (lpString="*.7z") returned 4
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.tar") returned 0
	[0045.292] lstrlenA (lpString="*.tar") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.gzip") returned 0
	[0045.292] lstrlenA (lpString="*.gzip") returned 6
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.jpg") returned 0
	[0045.292] lstrlenA (lpString="*.jpg") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.jpeg") returned 0
	[0045.292] lstrlenA (lpString="*.jpeg") returned 6
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.psd") returned 0
	[0045.292] lstrlenA (lpString="*.psd") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.cdr") returned 0
	[0045.292] lstrlenA (lpString="*.cdr") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.dwg") returned 0
	[0045.292] lstrlenA (lpString="*.dwg") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.max") returned 0
	[0045.292] lstrlenA (lpString="*.max") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.bmp") returned 0
	[0045.292] lstrlenA (lpString="*.bmp") returned 5
	[0045.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.gif") returned 1
	[0045.292] lstrlenA (lpString="*.gif") returned 5
	[0045.292] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF"
	[0045.292] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF"
	[0045.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF."
	[0045.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.Boom"
	[0045.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.292] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2420
	[0045.292] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x76a6b100, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x76a6b100, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.292] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.293] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x23fd, lpOverlapped=0x0) returned 1
	[0045.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="AG00170_.GIF"
	[0045.313] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.313] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x23fd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x23fd, lpOverlapped=0x0) returned 1
	[0045.313] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.313] CloseHandle (hObject=0x8c) returned 1
	[0045.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.boom")) returned 1
	[0045.315] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.315] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00171_.GIF") returned 1
	[0045.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00171_.GIF") returned 1
	[0045.315] lstrcmpiA (lpString1="", lpString2="AG00171_.GIF") returned -1
	[0045.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="AG00170_.GIF"
	[0045.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.315] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF"
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.zip") returned 0
	[0045.315] lstrlenA (lpString="*.zip") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.rar") returned 0
	[0045.315] lstrlenA (lpString="*.rar") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.7z") returned 0
	[0045.315] lstrlenA (lpString="*.7z") returned 4
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.tar") returned 0
	[0045.315] lstrlenA (lpString="*.tar") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.gzip") returned 0
	[0045.315] lstrlenA (lpString="*.gzip") returned 6
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.jpg") returned 0
	[0045.315] lstrlenA (lpString="*.jpg") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.jpeg") returned 0
	[0045.315] lstrlenA (lpString="*.jpeg") returned 6
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.psd") returned 0
	[0045.315] lstrlenA (lpString="*.psd") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.cdr") returned 0
	[0045.315] lstrlenA (lpString="*.cdr") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.dwg") returned 0
	[0045.315] lstrlenA (lpString="*.dwg") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.max") returned 0
	[0045.315] lstrlenA (lpString="*.max") returned 5
	[0045.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.bmp") returned 0
	[0045.316] lstrlenA (lpString="*.bmp") returned 5
	[0045.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.gif") returned 1
	[0045.316] lstrlenA (lpString="*.gif") returned 5
	[0045.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF"
	[0045.316] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF"
	[0045.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF."
	[0045.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.Boom"
	[0045.316] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.316] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1398
	[0045.316] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71e1fd00, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71e1fd00, dwHighDateTime=0x1bd4c12)) returned 1
	[0045.316] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.316] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1375, lpOverlapped=0x0) returned 1
	[0045.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="AG00171_.GIF"
	[0045.358] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.358] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1375, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1375, lpOverlapped=0x0) returned 1
	[0045.358] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.358] CloseHandle (hObject=0x8c) returned 1
	[0045.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.boom")) returned 1
	[0045.360] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.360] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.360] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00172_.GIF") returned 1
	[0045.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00172_.GIF") returned 1
	[0045.360] lstrcmpiA (lpString1="", lpString2="AG00172_.GIF") returned -1
	[0045.360] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="AG00171_.GIF"
	[0045.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.360] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.360] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF"
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.zip") returned 0
	[0045.360] lstrlenA (lpString="*.zip") returned 5
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.rar") returned 0
	[0045.360] lstrlenA (lpString="*.rar") returned 5
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.7z") returned 0
	[0045.360] lstrlenA (lpString="*.7z") returned 4
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.tar") returned 0
	[0045.360] lstrlenA (lpString="*.tar") returned 5
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.gzip") returned 0
	[0045.360] lstrlenA (lpString="*.gzip") returned 6
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.jpg") returned 0
	[0045.360] lstrlenA (lpString="*.jpg") returned 5
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.jpeg") returned 0
	[0045.360] lstrlenA (lpString="*.jpeg") returned 6
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.psd") returned 0
	[0045.360] lstrlenA (lpString="*.psd") returned 5
	[0045.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.cdr") returned 0
	[0045.363] lstrlenA (lpString="*.cdr") returned 5
	[0045.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.dwg") returned 0
	[0045.363] lstrlenA (lpString="*.dwg") returned 5
	[0045.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.max") returned 0
	[0045.363] lstrlenA (lpString="*.max") returned 5
	[0045.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.bmp") returned 0
	[0045.363] lstrlenA (lpString="*.bmp") returned 5
	[0045.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.gif") returned 1
	[0045.363] lstrlenA (lpString="*.gif") returned 5
	[0045.363] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF"
	[0045.363] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF"
	[0045.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF."
	[0045.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.Boom"
	[0045.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.364] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1126
	[0045.364] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2a04e500, dwHighDateTime=0x1bd4e61), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2a04e500, dwHighDateTime=0x1bd4e61)) returned 1
	[0045.364] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.364] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1103, lpOverlapped=0x0) returned 1
	[0045.381] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="AG00172_.GIF"
	[0045.381] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.381] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1103, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1103, lpOverlapped=0x0) returned 1
	[0045.381] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.381] CloseHandle (hObject=0x8c) returned 1
	[0045.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.boom")) returned 1
	[0045.382] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.382] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.382] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00174_.GIF") returned 1
	[0045.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00174_.GIF") returned 1
	[0045.382] lstrcmpiA (lpString1="", lpString2="AG00174_.GIF") returned -1
	[0045.382] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="AG00172_.GIF"
	[0045.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.382] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.382] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.382] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.382] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00174_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF"
	[0045.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.zip") returned 0
	[0045.383] lstrlenA (lpString="*.zip") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.rar") returned 0
	[0045.383] lstrlenA (lpString="*.rar") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.7z") returned 0
	[0045.383] lstrlenA (lpString="*.7z") returned 4
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.tar") returned 0
	[0045.383] lstrlenA (lpString="*.tar") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.gzip") returned 0
	[0045.383] lstrlenA (lpString="*.gzip") returned 6
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.jpg") returned 0
	[0045.383] lstrlenA (lpString="*.jpg") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.jpeg") returned 0
	[0045.383] lstrlenA (lpString="*.jpeg") returned 6
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.psd") returned 0
	[0045.383] lstrlenA (lpString="*.psd") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.cdr") returned 0
	[0045.383] lstrlenA (lpString="*.cdr") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.dwg") returned 0
	[0045.383] lstrlenA (lpString="*.dwg") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.max") returned 0
	[0045.383] lstrlenA (lpString="*.max") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.bmp") returned 0
	[0045.383] lstrlenA (lpString="*.bmp") returned 5
	[0045.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.gif") returned 1
	[0045.383] lstrlenA (lpString="*.gif") returned 5
	[0045.383] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF"
	[0045.383] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF"
	[0045.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF."
	[0045.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.Boom"
	[0045.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.383] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7e
	[0045.383] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xde4d3e00, dwHighDateTime=0x1bd4e56), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xde4d3e00, dwHighDateTime=0x1bd4e56)) returned 1
	[0045.383] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.384] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf5b, lpOverlapped=0x0) returned 1
	[0045.385] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="AG00174_.GIF"
	[0045.385] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.385] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf5b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf5b, lpOverlapped=0x0) returned 1
	[0045.385] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.385] CloseHandle (hObject=0x8c) returned 1
	[0045.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.boom")) returned 1
	[0045.386] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.386] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00175_.GIF") returned 1
	[0045.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00175_.GIF") returned 1
	[0045.386] lstrcmpiA (lpString1="", lpString2="AG00175_.GIF") returned -1
	[0045.386] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="AG00174_.GIF"
	[0045.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.386] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.386] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00175_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF"
	[0045.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.zip") returned 0
	[0045.386] lstrlenA (lpString="*.zip") returned 5
	[0045.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.rar") returned 0
	[0045.386] lstrlenA (lpString="*.rar") returned 5
	[0045.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.7z") returned 0
	[0045.386] lstrlenA (lpString="*.7z") returned 4
	[0045.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.tar") returned 0
	[0045.387] lstrlenA (lpString="*.tar") returned 5
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.gzip") returned 0
	[0045.387] lstrlenA (lpString="*.gzip") returned 6
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.jpg") returned 0
	[0045.387] lstrlenA (lpString="*.jpg") returned 5
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.jpeg") returned 0
	[0045.387] lstrlenA (lpString="*.jpeg") returned 6
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.psd") returned 0
	[0045.387] lstrlenA (lpString="*.psd") returned 5
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.cdr") returned 0
	[0045.387] lstrlenA (lpString="*.cdr") returned 5
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.dwg") returned 0
	[0045.387] lstrlenA (lpString="*.dwg") returned 5
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.max") returned 0
	[0045.387] lstrlenA (lpString="*.max") returned 5
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.bmp") returned 0
	[0045.387] lstrlenA (lpString="*.bmp") returned 5
	[0045.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.gif") returned 1
	[0045.387] lstrlenA (lpString="*.gif") returned 5
	[0045.387] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF"
	[0045.387] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF"
	[0045.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF."
	[0045.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.Boom"
	[0045.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.387] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd32
	[0045.387] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc18a400, dwHighDateTime=0x1bd4e52), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc18a400, dwHighDateTime=0x1bd4e52)) returned 1
	[0045.387] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.387] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd0f, lpOverlapped=0x0) returned 1
	[0045.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="AG00175_.GIF"
	[0045.410] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.410] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd0f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd0f, lpOverlapped=0x0) returned 1
	[0045.411] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.411] CloseHandle (hObject=0x8c) returned 1
	[0045.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.boom")) returned 1
	[0045.412] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AG00176_.GIF") returned 1
	[0045.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00176_.GIF") returned 1
	[0045.413] lstrcmpiA (lpString1="", lpString2="AG00176_.GIF") returned -1
	[0045.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="AG00175_.GIF"
	[0045.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00176_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF"
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.zip") returned 0
	[0045.413] lstrlenA (lpString="*.zip") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.rar") returned 0
	[0045.413] lstrlenA (lpString="*.rar") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.7z") returned 0
	[0045.413] lstrlenA (lpString="*.7z") returned 4
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.tar") returned 0
	[0045.413] lstrlenA (lpString="*.tar") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.gzip") returned 0
	[0045.413] lstrlenA (lpString="*.gzip") returned 6
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.jpg") returned 0
	[0045.413] lstrlenA (lpString="*.jpg") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.jpeg") returned 0
	[0045.413] lstrlenA (lpString="*.jpeg") returned 6
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.psd") returned 0
	[0045.413] lstrlenA (lpString="*.psd") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.cdr") returned 0
	[0045.413] lstrlenA (lpString="*.cdr") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.dwg") returned 0
	[0045.413] lstrlenA (lpString="*.dwg") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.max") returned 0
	[0045.413] lstrlenA (lpString="*.max") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.bmp") returned 0
	[0045.413] lstrlenA (lpString="*.bmp") returned 5
	[0045.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.gif") returned 1
	[0045.413] lstrlenA (lpString="*.gif") returned 5
	[0045.413] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF"
	[0045.413] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF"
	[0045.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF."
	[0045.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.Boom"
	[0045.413] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.414] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc30
	[0045.414] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e3cb900, dwHighDateTime=0x1bd4e52), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e3cb900, dwHighDateTime=0x1bd4e52)) returned 1
	[0045.414] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.414] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc0d, lpOverlapped=0x0) returned 1
	[0045.440] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="AG00176_.GIF"
	[0045.440] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.440] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc0d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc0d, lpOverlapped=0x0) returned 1
	[0045.441] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.441] CloseHandle (hObject=0x8c) returned 1
	[0045.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.boom")) returned 1
	[0045.442] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.442] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.442] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN00010_.WMF") returned 1
	[0045.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00010_.WMF") returned 1
	[0045.443] lstrcmpiA (lpString1="", lpString2="AN00010_.WMF") returned -1
	[0045.443] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="AG00176_.GIF"
	[0045.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.443] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.443] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00010_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF"
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.zip") returned 0
	[0045.443] lstrlenA (lpString="*.zip") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.rar") returned 0
	[0045.443] lstrlenA (lpString="*.rar") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.7z") returned 0
	[0045.443] lstrlenA (lpString="*.7z") returned 4
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.tar") returned 0
	[0045.443] lstrlenA (lpString="*.tar") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.gzip") returned 0
	[0045.443] lstrlenA (lpString="*.gzip") returned 6
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.jpg") returned 0
	[0045.443] lstrlenA (lpString="*.jpg") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.jpeg") returned 0
	[0045.443] lstrlenA (lpString="*.jpeg") returned 6
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.psd") returned 0
	[0045.443] lstrlenA (lpString="*.psd") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.cdr") returned 0
	[0045.443] lstrlenA (lpString="*.cdr") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.dwg") returned 0
	[0045.443] lstrlenA (lpString="*.dwg") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.max") returned 0
	[0045.443] lstrlenA (lpString="*.max") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.bmp") returned 0
	[0045.443] lstrlenA (lpString="*.bmp") returned 5
	[0045.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.gif") returned 0
	[0045.444] lstrlenA (lpString="*.gif") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.png") returned 0
	[0045.444] lstrlenA (lpString="*.png") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.doc") returned 0
	[0045.444] lstrlenA (lpString="*.doc") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.docx") returned 0
	[0045.444] lstrlenA (lpString="*.docx") returned 6
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.xls") returned 0
	[0045.444] lstrlenA (lpString="*.xls") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.xlsx") returned 0
	[0045.444] lstrlenA (lpString="*.xlsx") returned 6
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.ppt") returned 0
	[0045.444] lstrlenA (lpString="*.ppt") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.pptx") returned 0
	[0045.444] lstrlenA (lpString="*.pptx") returned 6
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.txt") returned 0
	[0045.444] lstrlenA (lpString="*.txt") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.pdf") returned 0
	[0045.444] lstrlenA (lpString="*.pdf") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.djvu") returned 0
	[0045.444] lstrlenA (lpString="*.djvu") returned 6
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.htm") returned 0
	[0045.444] lstrlenA (lpString="*.htm") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.html") returned 0
	[0045.444] lstrlenA (lpString="*.html") returned 6
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mdb") returned 0
	[0045.444] lstrlenA (lpString="*.mdb") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.cer") returned 0
	[0045.444] lstrlenA (lpString="*.cer") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.p12") returned 0
	[0045.444] lstrlenA (lpString="*.p12") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.pfx") returned 0
	[0045.444] lstrlenA (lpString="*.pfx") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.kwm") returned 0
	[0045.444] lstrlenA (lpString="*.kwm") returned 5
	[0045.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.pwm") returned 0
	[0045.444] lstrlenA (lpString="*.pwm") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.1cd") returned 0
	[0045.445] lstrlenA (lpString="*.1cd") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.md") returned 0
	[0045.445] lstrlenA (lpString="*.md") returned 4
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mdf") returned 0
	[0045.445] lstrlenA (lpString="*.mdf") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.dbf") returned 0
	[0045.445] lstrlenA (lpString="*.dbf") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.odt") returned 0
	[0045.445] lstrlenA (lpString="*.odt") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.vob") returned 0
	[0045.445] lstrlenA (lpString="*.vob") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.ifo") returned 0
	[0045.445] lstrlenA (lpString="*.ifo") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.lnk") returned 0
	[0045.445] lstrlenA (lpString="*.lnk") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.torrent") returned 0
	[0045.445] lstrlenA (lpString="*.torrent") returned 9
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mov") returned 0
	[0045.445] lstrlenA (lpString="*.mov") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.m2v") returned 0
	[0045.445] lstrlenA (lpString="*.m2v") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.3gp") returned 0
	[0045.445] lstrlenA (lpString="*.3gp") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mpeg") returned 0
	[0045.445] lstrlenA (lpString="*.mpeg") returned 6
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mpg") returned 0
	[0045.445] lstrlenA (lpString="*.mpg") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.flv") returned 0
	[0045.445] lstrlenA (lpString="*.flv") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.avi") returned 0
	[0045.445] lstrlenA (lpString="*.avi") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mp4") returned 0
	[0045.445] lstrlenA (lpString="*.mp4") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.wmv") returned 0
	[0045.445] lstrlenA (lpString="*.wmv") returned 5
	[0045.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.divx") returned 0
	[0045.446] lstrlenA (lpString="*.divx") returned 6
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mkv") returned 0
	[0045.446] lstrlenA (lpString="*.mkv") returned 5
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mp3") returned 0
	[0045.446] lstrlenA (lpString="*.mp3") returned 5
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.wav") returned 0
	[0045.446] lstrlenA (lpString="*.wav") returned 5
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.flac") returned 0
	[0045.446] lstrlenA (lpString="*.flac") returned 6
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.ape") returned 0
	[0045.446] lstrlenA (lpString="*.ape") returned 5
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.wma") returned 0
	[0045.446] lstrlenA (lpString="*.wma") returned 5
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.ac3") returned 0
	[0045.446] lstrlenA (lpString="*.ac3") returned 5
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.exe") returned 0
	[0045.446] lstrlenA (lpString="*.exe") returned 5
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.apk") returned 0
	[0045.446] lstrlenA (lpString="*.apk") returned 5
	[0045.446] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.446] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.446] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN00015_.WMF") returned 1
	[0045.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00015_.WMF") returned 1
	[0045.446] lstrcmpiA (lpString1="", lpString2="AN00015_.WMF") returned -1
	[0045.446] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned="AN00010_.WMF"
	[0045.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.446] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00015_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF"
	[0045.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.zip") returned 0
	[0045.446] lstrlenA (lpString="*.zip") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.rar") returned 0
	[0045.447] lstrlenA (lpString="*.rar") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.7z") returned 0
	[0045.447] lstrlenA (lpString="*.7z") returned 4
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.tar") returned 0
	[0045.447] lstrlenA (lpString="*.tar") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.gzip") returned 0
	[0045.447] lstrlenA (lpString="*.gzip") returned 6
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.jpg") returned 0
	[0045.447] lstrlenA (lpString="*.jpg") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.jpeg") returned 0
	[0045.447] lstrlenA (lpString="*.jpeg") returned 6
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.psd") returned 0
	[0045.447] lstrlenA (lpString="*.psd") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.cdr") returned 0
	[0045.447] lstrlenA (lpString="*.cdr") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.dwg") returned 0
	[0045.447] lstrlenA (lpString="*.dwg") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.max") returned 0
	[0045.447] lstrlenA (lpString="*.max") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.bmp") returned 0
	[0045.447] lstrlenA (lpString="*.bmp") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.gif") returned 0
	[0045.447] lstrlenA (lpString="*.gif") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.png") returned 0
	[0045.447] lstrlenA (lpString="*.png") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.doc") returned 0
	[0045.447] lstrlenA (lpString="*.doc") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.docx") returned 0
	[0045.447] lstrlenA (lpString="*.docx") returned 6
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.xls") returned 0
	[0045.447] lstrlenA (lpString="*.xls") returned 5
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.xlsx") returned 0
	[0045.447] lstrlenA (lpString="*.xlsx") returned 6
	[0045.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.ppt") returned 0
	[0045.448] lstrlenA (lpString="*.ppt") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.pptx") returned 0
	[0045.448] lstrlenA (lpString="*.pptx") returned 6
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.txt") returned 0
	[0045.448] lstrlenA (lpString="*.txt") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.pdf") returned 0
	[0045.448] lstrlenA (lpString="*.pdf") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.djvu") returned 0
	[0045.448] lstrlenA (lpString="*.djvu") returned 6
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.htm") returned 0
	[0045.448] lstrlenA (lpString="*.htm") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.html") returned 0
	[0045.448] lstrlenA (lpString="*.html") returned 6
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mdb") returned 0
	[0045.448] lstrlenA (lpString="*.mdb") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.cer") returned 0
	[0045.448] lstrlenA (lpString="*.cer") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.p12") returned 0
	[0045.448] lstrlenA (lpString="*.p12") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.pfx") returned 0
	[0045.448] lstrlenA (lpString="*.pfx") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.kwm") returned 0
	[0045.448] lstrlenA (lpString="*.kwm") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.pwm") returned 0
	[0045.448] lstrlenA (lpString="*.pwm") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.1cd") returned 0
	[0045.448] lstrlenA (lpString="*.1cd") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.md") returned 0
	[0045.448] lstrlenA (lpString="*.md") returned 4
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mdf") returned 0
	[0045.448] lstrlenA (lpString="*.mdf") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.dbf") returned 0
	[0045.448] lstrlenA (lpString="*.dbf") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.odt") returned 0
	[0045.448] lstrlenA (lpString="*.odt") returned 5
	[0045.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.vob") returned 0
	[0045.449] lstrlenA (lpString="*.vob") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.ifo") returned 0
	[0045.449] lstrlenA (lpString="*.ifo") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.lnk") returned 0
	[0045.449] lstrlenA (lpString="*.lnk") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.torrent") returned 0
	[0045.449] lstrlenA (lpString="*.torrent") returned 9
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mov") returned 0
	[0045.449] lstrlenA (lpString="*.mov") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.m2v") returned 0
	[0045.449] lstrlenA (lpString="*.m2v") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.3gp") returned 0
	[0045.449] lstrlenA (lpString="*.3gp") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mpeg") returned 0
	[0045.449] lstrlenA (lpString="*.mpeg") returned 6
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mpg") returned 0
	[0045.449] lstrlenA (lpString="*.mpg") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.flv") returned 0
	[0045.449] lstrlenA (lpString="*.flv") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.avi") returned 0
	[0045.449] lstrlenA (lpString="*.avi") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mp4") returned 0
	[0045.449] lstrlenA (lpString="*.mp4") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.wmv") returned 0
	[0045.449] lstrlenA (lpString="*.wmv") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.divx") returned 0
	[0045.449] lstrlenA (lpString="*.divx") returned 6
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mkv") returned 0
	[0045.449] lstrlenA (lpString="*.mkv") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mp3") returned 0
	[0045.449] lstrlenA (lpString="*.mp3") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.wav") returned 0
	[0045.449] lstrlenA (lpString="*.wav") returned 5
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.flac") returned 0
	[0045.449] lstrlenA (lpString="*.flac") returned 6
	[0045.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.ape") returned 0
	[0045.450] lstrlenA (lpString="*.ape") returned 5
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.wma") returned 0
	[0045.450] lstrlenA (lpString="*.wma") returned 5
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.ac3") returned 0
	[0045.450] lstrlenA (lpString="*.ac3") returned 5
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.exe") returned 0
	[0045.450] lstrlenA (lpString="*.exe") returned 5
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.apk") returned 0
	[0045.450] lstrlenA (lpString="*.apk") returned 5
	[0045.450] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.450] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.450] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN00790_.WMF") returned 1
	[0045.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00790_.WMF") returned 1
	[0045.450] lstrcmpiA (lpString1="", lpString2="AN00790_.WMF") returned -1
	[0045.450] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned="AN00015_.WMF"
	[0045.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.450] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00790_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF"
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.zip") returned 0
	[0045.450] lstrlenA (lpString="*.zip") returned 5
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.rar") returned 0
	[0045.450] lstrlenA (lpString="*.rar") returned 5
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.7z") returned 0
	[0045.450] lstrlenA (lpString="*.7z") returned 4
	[0045.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.tar") returned 0
	[0045.450] lstrlenA (lpString="*.tar") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.gzip") returned 0
	[0045.451] lstrlenA (lpString="*.gzip") returned 6
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.jpg") returned 0
	[0045.451] lstrlenA (lpString="*.jpg") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.jpeg") returned 0
	[0045.451] lstrlenA (lpString="*.jpeg") returned 6
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.psd") returned 0
	[0045.451] lstrlenA (lpString="*.psd") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.cdr") returned 0
	[0045.451] lstrlenA (lpString="*.cdr") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.dwg") returned 0
	[0045.451] lstrlenA (lpString="*.dwg") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.max") returned 0
	[0045.451] lstrlenA (lpString="*.max") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.bmp") returned 0
	[0045.451] lstrlenA (lpString="*.bmp") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.gif") returned 0
	[0045.451] lstrlenA (lpString="*.gif") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.png") returned 0
	[0045.451] lstrlenA (lpString="*.png") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.doc") returned 0
	[0045.451] lstrlenA (lpString="*.doc") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.docx") returned 0
	[0045.451] lstrlenA (lpString="*.docx") returned 6
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.xls") returned 0
	[0045.451] lstrlenA (lpString="*.xls") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.xlsx") returned 0
	[0045.451] lstrlenA (lpString="*.xlsx") returned 6
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.ppt") returned 0
	[0045.451] lstrlenA (lpString="*.ppt") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.pptx") returned 0
	[0045.451] lstrlenA (lpString="*.pptx") returned 6
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.txt") returned 0
	[0045.451] lstrlenA (lpString="*.txt") returned 5
	[0045.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.pdf") returned 0
	[0045.451] lstrlenA (lpString="*.pdf") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.djvu") returned 0
	[0045.452] lstrlenA (lpString="*.djvu") returned 6
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.htm") returned 0
	[0045.452] lstrlenA (lpString="*.htm") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.html") returned 0
	[0045.452] lstrlenA (lpString="*.html") returned 6
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mdb") returned 0
	[0045.452] lstrlenA (lpString="*.mdb") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.cer") returned 0
	[0045.452] lstrlenA (lpString="*.cer") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.p12") returned 0
	[0045.452] lstrlenA (lpString="*.p12") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.pfx") returned 0
	[0045.452] lstrlenA (lpString="*.pfx") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.kwm") returned 0
	[0045.452] lstrlenA (lpString="*.kwm") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.pwm") returned 0
	[0045.452] lstrlenA (lpString="*.pwm") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.1cd") returned 0
	[0045.452] lstrlenA (lpString="*.1cd") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.md") returned 0
	[0045.452] lstrlenA (lpString="*.md") returned 4
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mdf") returned 0
	[0045.452] lstrlenA (lpString="*.mdf") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.dbf") returned 0
	[0045.452] lstrlenA (lpString="*.dbf") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.odt") returned 0
	[0045.452] lstrlenA (lpString="*.odt") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.vob") returned 0
	[0045.452] lstrlenA (lpString="*.vob") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.ifo") returned 0
	[0045.452] lstrlenA (lpString="*.ifo") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.lnk") returned 0
	[0045.452] lstrlenA (lpString="*.lnk") returned 5
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.torrent") returned 0
	[0045.452] lstrlenA (lpString="*.torrent") returned 9
	[0045.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mov") returned 0
	[0045.453] lstrlenA (lpString="*.mov") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.m2v") returned 0
	[0045.453] lstrlenA (lpString="*.m2v") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.3gp") returned 0
	[0045.453] lstrlenA (lpString="*.3gp") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mpeg") returned 0
	[0045.453] lstrlenA (lpString="*.mpeg") returned 6
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mpg") returned 0
	[0045.453] lstrlenA (lpString="*.mpg") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.flv") returned 0
	[0045.453] lstrlenA (lpString="*.flv") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.avi") returned 0
	[0045.453] lstrlenA (lpString="*.avi") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mp4") returned 0
	[0045.453] lstrlenA (lpString="*.mp4") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.wmv") returned 0
	[0045.453] lstrlenA (lpString="*.wmv") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.divx") returned 0
	[0045.453] lstrlenA (lpString="*.divx") returned 6
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mkv") returned 0
	[0045.453] lstrlenA (lpString="*.mkv") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mp3") returned 0
	[0045.453] lstrlenA (lpString="*.mp3") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.wav") returned 0
	[0045.453] lstrlenA (lpString="*.wav") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.flac") returned 0
	[0045.453] lstrlenA (lpString="*.flac") returned 6
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.ape") returned 0
	[0045.453] lstrlenA (lpString="*.ape") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.wma") returned 0
	[0045.453] lstrlenA (lpString="*.wma") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.ac3") returned 0
	[0045.453] lstrlenA (lpString="*.ac3") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.exe") returned 0
	[0045.453] lstrlenA (lpString="*.exe") returned 5
	[0045.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.apk") returned 0
	[0045.454] lstrlenA (lpString="*.apk") returned 5
	[0045.454] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.454] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN00853_.WMF") returned 1
	[0045.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00853_.WMF") returned 1
	[0045.454] lstrcmpiA (lpString1="", lpString2="AN00853_.WMF") returned -1
	[0045.454] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned="AN00790_.WMF"
	[0045.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.454] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.454] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.454] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.454] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00853_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF"
	[0045.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.zip") returned 0
	[0045.454] lstrlenA (lpString="*.zip") returned 5
	[0045.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.rar") returned 0
	[0045.454] lstrlenA (lpString="*.rar") returned 5
	[0045.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.7z") returned 0
	[0045.454] lstrlenA (lpString="*.7z") returned 4
	[0045.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.tar") returned 0
	[0045.454] lstrlenA (lpString="*.tar") returned 5
	[0045.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.gzip") returned 0
	[0045.454] lstrlenA (lpString="*.gzip") returned 6
	[0045.454] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.jpg") returned 0
	[0045.454] lstrlenA (lpString="*.jpg") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.jpeg") returned 0
	[0045.455] lstrlenA (lpString="*.jpeg") returned 6
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.psd") returned 0
	[0045.455] lstrlenA (lpString="*.psd") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.cdr") returned 0
	[0045.455] lstrlenA (lpString="*.cdr") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.dwg") returned 0
	[0045.455] lstrlenA (lpString="*.dwg") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.max") returned 0
	[0045.455] lstrlenA (lpString="*.max") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.bmp") returned 0
	[0045.455] lstrlenA (lpString="*.bmp") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.gif") returned 0
	[0045.455] lstrlenA (lpString="*.gif") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.png") returned 0
	[0045.455] lstrlenA (lpString="*.png") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.doc") returned 0
	[0045.455] lstrlenA (lpString="*.doc") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.docx") returned 0
	[0045.455] lstrlenA (lpString="*.docx") returned 6
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.xls") returned 0
	[0045.455] lstrlenA (lpString="*.xls") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.xlsx") returned 0
	[0045.455] lstrlenA (lpString="*.xlsx") returned 6
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.ppt") returned 0
	[0045.455] lstrlenA (lpString="*.ppt") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.pptx") returned 0
	[0045.455] lstrlenA (lpString="*.pptx") returned 6
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.txt") returned 0
	[0045.455] lstrlenA (lpString="*.txt") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.pdf") returned 0
	[0045.455] lstrlenA (lpString="*.pdf") returned 5
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.djvu") returned 0
	[0045.455] lstrlenA (lpString="*.djvu") returned 6
	[0045.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.htm") returned 0
	[0045.455] lstrlenA (lpString="*.htm") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.html") returned 0
	[0045.456] lstrlenA (lpString="*.html") returned 6
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mdb") returned 0
	[0045.456] lstrlenA (lpString="*.mdb") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.cer") returned 0
	[0045.456] lstrlenA (lpString="*.cer") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.p12") returned 0
	[0045.456] lstrlenA (lpString="*.p12") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.pfx") returned 0
	[0045.456] lstrlenA (lpString="*.pfx") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.kwm") returned 0
	[0045.456] lstrlenA (lpString="*.kwm") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.pwm") returned 0
	[0045.456] lstrlenA (lpString="*.pwm") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.1cd") returned 0
	[0045.456] lstrlenA (lpString="*.1cd") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.md") returned 0
	[0045.456] lstrlenA (lpString="*.md") returned 4
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mdf") returned 0
	[0045.456] lstrlenA (lpString="*.mdf") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.dbf") returned 0
	[0045.456] lstrlenA (lpString="*.dbf") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.odt") returned 0
	[0045.456] lstrlenA (lpString="*.odt") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.vob") returned 0
	[0045.456] lstrlenA (lpString="*.vob") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.ifo") returned 0
	[0045.456] lstrlenA (lpString="*.ifo") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.lnk") returned 0
	[0045.456] lstrlenA (lpString="*.lnk") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.torrent") returned 0
	[0045.456] lstrlenA (lpString="*.torrent") returned 9
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mov") returned 0
	[0045.456] lstrlenA (lpString="*.mov") returned 5
	[0045.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.m2v") returned 0
	[0045.457] lstrlenA (lpString="*.m2v") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.3gp") returned 0
	[0045.457] lstrlenA (lpString="*.3gp") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mpeg") returned 0
	[0045.457] lstrlenA (lpString="*.mpeg") returned 6
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mpg") returned 0
	[0045.457] lstrlenA (lpString="*.mpg") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.flv") returned 0
	[0045.457] lstrlenA (lpString="*.flv") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.avi") returned 0
	[0045.457] lstrlenA (lpString="*.avi") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mp4") returned 0
	[0045.457] lstrlenA (lpString="*.mp4") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.wmv") returned 0
	[0045.457] lstrlenA (lpString="*.wmv") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.divx") returned 0
	[0045.457] lstrlenA (lpString="*.divx") returned 6
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mkv") returned 0
	[0045.457] lstrlenA (lpString="*.mkv") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mp3") returned 0
	[0045.457] lstrlenA (lpString="*.mp3") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.wav") returned 0
	[0045.457] lstrlenA (lpString="*.wav") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.flac") returned 0
	[0045.457] lstrlenA (lpString="*.flac") returned 6
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.ape") returned 0
	[0045.457] lstrlenA (lpString="*.ape") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.wma") returned 0
	[0045.457] lstrlenA (lpString="*.wma") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.ac3") returned 0
	[0045.457] lstrlenA (lpString="*.ac3") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.exe") returned 0
	[0045.457] lstrlenA (lpString="*.exe") returned 5
	[0045.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.apk") returned 0
	[0045.457] lstrlenA (lpString="*.apk") returned 5
	[0045.457] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.457] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN00914_.WMF") returned 1
	[0045.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00914_.WMF") returned 1
	[0045.458] lstrcmpiA (lpString1="", lpString2="AN00914_.WMF") returned -1
	[0045.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned="AN00853_.WMF"
	[0045.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.458] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00914_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF"
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.zip") returned 0
	[0045.458] lstrlenA (lpString="*.zip") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.rar") returned 0
	[0045.458] lstrlenA (lpString="*.rar") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.7z") returned 0
	[0045.458] lstrlenA (lpString="*.7z") returned 4
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.tar") returned 0
	[0045.458] lstrlenA (lpString="*.tar") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.gzip") returned 0
	[0045.458] lstrlenA (lpString="*.gzip") returned 6
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.jpg") returned 0
	[0045.458] lstrlenA (lpString="*.jpg") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.jpeg") returned 0
	[0045.458] lstrlenA (lpString="*.jpeg") returned 6
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.psd") returned 0
	[0045.458] lstrlenA (lpString="*.psd") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.cdr") returned 0
	[0045.458] lstrlenA (lpString="*.cdr") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.dwg") returned 0
	[0045.458] lstrlenA (lpString="*.dwg") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.max") returned 0
	[0045.458] lstrlenA (lpString="*.max") returned 5
	[0045.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.bmp") returned 0
	[0045.458] lstrlenA (lpString="*.bmp") returned 5
	[0045.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.gif") returned 0
	[0045.459] lstrlenA (lpString="*.gif") returned 5
	[0045.459] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.459] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.459] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN00932_.WMF") returned 1
	[0045.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00932_.WMF") returned 1
	[0045.459] lstrcmpiA (lpString1="", lpString2="AN00932_.WMF") returned -1
	[0045.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned="AN00914_.WMF"
	[0045.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.459] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00932_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF"
	[0045.459] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.459] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.459] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN00965_.WMF") returned 1
	[0045.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00965_.WMF") returned 1
	[0045.459] lstrcmpiA (lpString1="", lpString2="AN00965_.WMF") returned -1
	[0045.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned="AN00932_.WMF"
	[0045.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.460] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00965_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF"
	[0045.460] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01039_.WMF") returned 1
	[0045.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01039_.WMF") returned 1
	[0045.460] lstrcmpiA (lpString1="", lpString2="AN01039_.WMF") returned -1
	[0045.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned="AN00965_.WMF"
	[0045.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.460] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01039_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF"
	[0045.460] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01044_.WMF") returned 1
	[0045.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01044_.WMF") returned 1
	[0045.460] lstrcmpiA (lpString1="", lpString2="AN01044_.WMF") returned -1
	[0045.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned="AN01039_.WMF"
	[0045.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.460] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01044_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF"
	[0045.461] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.461] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01060_.WMF") returned 1
	[0045.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01060_.WMF") returned 1
	[0045.461] lstrcmpiA (lpString1="", lpString2="AN01060_.WMF") returned -1
	[0045.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned="AN01044_.WMF"
	[0045.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.461] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01060_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF"
	[0045.461] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.461] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01084_.WMF") returned 1
	[0045.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01084_.WMF") returned 1
	[0045.461] lstrcmpiA (lpString1="", lpString2="AN01084_.WMF") returned -1
	[0045.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned="AN01060_.WMF"
	[0045.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.461] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01084_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF"
	[0045.461] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.461] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01173_.WMF") returned 1
	[0045.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01173_.WMF") returned 1
	[0045.462] lstrcmpiA (lpString1="", lpString2="AN01173_.WMF") returned -1
	[0045.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned="AN01084_.WMF"
	[0045.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01173_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF"
	[0045.462] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.462] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01174_.WMF") returned 1
	[0045.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01174_.WMF") returned 1
	[0045.462] lstrcmpiA (lpString1="", lpString2="AN01174_.WMF") returned -1
	[0045.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned="AN01173_.WMF"
	[0045.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01174_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF"
	[0045.462] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.462] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01184_.WMF") returned 1
	[0045.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01184_.WMF") returned 1
	[0045.462] lstrcmpiA (lpString1="", lpString2="AN01184_.WMF") returned -1
	[0045.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned="AN01174_.WMF"
	[0045.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.463] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01184_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF"
	[0045.463] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.463] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.463] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01216_.WMF") returned 1
	[0045.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01216_.WMF") returned 1
	[0045.463] lstrcmpiA (lpString1="", lpString2="AN01216_.WMF") returned -1
	[0045.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned="AN01184_.WMF"
	[0045.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.463] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01216_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF"
	[0045.463] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.463] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.463] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01218_.WMF") returned 1
	[0045.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01218_.WMF") returned 1
	[0045.463] lstrcmpiA (lpString1="", lpString2="AN01218_.WMF") returned -1
	[0045.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned="AN01216_.WMF"
	[0045.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.463] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01218_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF"
	[0045.464] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.464] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01251_.WMF") returned 1
	[0045.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01251_.WMF") returned 1
	[0045.464] lstrcmpiA (lpString1="", lpString2="AN01251_.WMF") returned -1
	[0045.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned="AN01218_.WMF"
	[0045.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.464] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.464] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01251_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF"
	[0045.464] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.464] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN01545_.WMF") returned 1
	[0045.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01545_.WMF") returned 1
	[0045.464] lstrcmpiA (lpString1="", lpString2="AN01545_.WMF") returned -1
	[0045.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned="AN01251_.WMF"
	[0045.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.464] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.464] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01545_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF"
	[0045.464] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.464] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN02122_.WMF") returned 1
	[0045.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN02122_.WMF") returned 1
	[0045.465] lstrcmpiA (lpString1="", lpString2="AN02122_.WMF") returned -1
	[0045.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned="AN01545_.WMF"
	[0045.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.465] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.465] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN02122_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF"
	[0045.465] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.465] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN02559_.WMF") returned 1
	[0045.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN02559_.WMF") returned 1
	[0045.465] lstrcmpiA (lpString1="", lpString2="AN02559_.WMF") returned -1
	[0045.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned="AN02122_.WMF"
	[0045.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.465] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.465] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN02559_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF"
	[0045.465] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.465] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN02724_.WMF") returned 1
	[0045.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN02724_.WMF") returned 1
	[0045.465] lstrcmpiA (lpString1="", lpString2="AN02724_.WMF") returned -1
	[0045.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned="AN02559_.WMF"
	[0045.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.465] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.466] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN02724_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF"
	[0045.466] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.466] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN03500_.WMF") returned 1
	[0045.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN03500_.WMF") returned 1
	[0045.466] lstrcmpiA (lpString1="", lpString2="AN03500_.WMF") returned -1
	[0045.466] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned="AN02724_.WMF"
	[0045.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.466] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN03500_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF"
	[0045.466] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.466] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04108_.WMF") returned 1
	[0045.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04108_.WMF") returned 1
	[0045.466] lstrcmpiA (lpString1="", lpString2="AN04108_.WMF") returned -1
	[0045.466] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned="AN03500_.WMF"
	[0045.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.466] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04108_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF"
	[0045.467] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.467] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04117_.WMF") returned 1
	[0045.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04117_.WMF") returned 1
	[0045.467] lstrcmpiA (lpString1="", lpString2="AN04117_.WMF") returned -1
	[0045.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned="AN04108_.WMF"
	[0045.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.467] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.467] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04117_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF"
	[0045.467] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.467] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04134_.WMF") returned 1
	[0045.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04134_.WMF") returned 1
	[0045.467] lstrcmpiA (lpString1="", lpString2="AN04134_.WMF") returned -1
	[0045.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned="AN04117_.WMF"
	[0045.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.467] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.467] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04134_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF"
	[0045.467] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.468] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04174_.WMF") returned 1
	[0045.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04174_.WMF") returned 1
	[0045.468] lstrcmpiA (lpString1="", lpString2="AN04174_.WMF") returned -1
	[0045.468] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned="AN04134_.WMF"
	[0045.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.468] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.468] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04174_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF"
	[0045.468] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.468] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04191_.WMF") returned 1
	[0045.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04191_.WMF") returned 1
	[0045.468] lstrcmpiA (lpString1="", lpString2="AN04191_.WMF") returned -1
	[0045.468] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned="AN04174_.WMF"
	[0045.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.468] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.468] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04191_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF"
	[0045.468] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.468] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04195_.WMF") returned 1
	[0045.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04195_.WMF") returned 1
	[0045.468] lstrcmpiA (lpString1="", lpString2="AN04195_.WMF") returned -1
	[0045.468] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned="AN04191_.WMF"
	[0045.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.469] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.469] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04195_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF"
	[0045.469] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.469] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04196_.WMF") returned 1
	[0045.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04196_.WMF") returned 1
	[0045.469] lstrcmpiA (lpString1="", lpString2="AN04196_.WMF") returned -1
	[0045.469] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned="AN04195_.WMF"
	[0045.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.469] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.469] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04196_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF"
	[0045.469] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.469] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04206_.WMF") returned 1
	[0045.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04206_.WMF") returned 1
	[0045.469] lstrcmpiA (lpString1="", lpString2="AN04206_.WMF") returned -1
	[0045.469] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned="AN04196_.WMF"
	[0045.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.469] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.469] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04206_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF"
	[0045.470] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04225_.WMF") returned 1
	[0045.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04225_.WMF") returned 1
	[0045.470] lstrcmpiA (lpString1="", lpString2="AN04225_.WMF") returned -1
	[0045.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned="AN04206_.WMF"
	[0045.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.470] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04225_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF"
	[0045.470] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04235_.WMF") returned 1
	[0045.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04235_.WMF") returned 1
	[0045.470] lstrcmpiA (lpString1="", lpString2="AN04235_.WMF") returned -1
	[0045.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned="AN04225_.WMF"
	[0045.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.470] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04235_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF"
	[0045.470] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.471] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.471] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04267_.WMF") returned 1
	[0045.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04267_.WMF") returned 1
	[0045.471] lstrcmpiA (lpString1="", lpString2="AN04267_.WMF") returned -1
	[0045.471] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned="AN04235_.WMF"
	[0045.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.471] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.471] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04267_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF"
	[0045.471] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.473] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.473] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04269_.WMF") returned 1
	[0045.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04269_.WMF") returned 1
	[0045.473] lstrcmpiA (lpString1="", lpString2="AN04269_.WMF") returned -1
	[0045.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned="AN04267_.WMF"
	[0045.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.473] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.473] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04269_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF"
	[0045.473] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.473] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.473] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04323_.WMF") returned 1
	[0045.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04323_.WMF") returned 1
	[0045.473] lstrcmpiA (lpString1="", lpString2="AN04323_.WMF") returned -1
	[0045.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned="AN04269_.WMF"
	[0045.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.473] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.473] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04323_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF"
	[0045.474] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.474] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.474] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04326_.WMF") returned 1
	[0045.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04326_.WMF") returned 1
	[0045.474] lstrcmpiA (lpString1="", lpString2="AN04326_.WMF") returned -1
	[0045.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned="AN04323_.WMF"
	[0045.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.474] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04326_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF"
	[0045.474] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.474] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.474] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04332_.WMF") returned 1
	[0045.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04332_.WMF") returned 1
	[0045.474] lstrcmpiA (lpString1="", lpString2="AN04332_.WMF") returned -1
	[0045.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned="AN04326_.WMF"
	[0045.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.474] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04332_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF"
	[0045.475] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.475] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04355_.WMF") returned 1
	[0045.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04355_.WMF") returned 1
	[0045.475] lstrcmpiA (lpString1="", lpString2="AN04355_.WMF") returned -1
	[0045.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned="AN04332_.WMF"
	[0045.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.475] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04355_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF"
	[0045.475] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.475] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04369_.WMF") returned 1
	[0045.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04369_.WMF") returned 1
	[0045.475] lstrcmpiA (lpString1="", lpString2="AN04369_.WMF") returned -1
	[0045.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned="AN04355_.WMF"
	[0045.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.475] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04369_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF"
	[0045.475] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.475] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04384_.WMF") returned 1
	[0045.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04384_.WMF") returned 1
	[0045.475] lstrcmpiA (lpString1="", lpString2="AN04384_.WMF") returned -1
	[0045.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned="AN04369_.WMF"
	[0045.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.476] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.476] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04384_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF"
	[0045.476] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.476] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.476] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AN04385_.WMF") returned 1
	[0045.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04385_.WMF") returned 1
	[0045.476] lstrcmpiA (lpString1="", lpString2="AN04385_.WMF") returned -1
	[0045.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned="AN04384_.WMF"
	[0045.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.476] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.476] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04385_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF"
	[0045.476] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.476] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.476] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BABY_01.MID") returned 1
	[0045.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BABY_01.MID") returned 1
	[0045.476] lstrcmpiA (lpString1="", lpString2="BABY_01.MID") returned -1
	[0045.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned="AN04385_.WMF"
	[0045.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.476] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BABY_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID"
	[0045.477] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.477] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.477] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD00116_.WMF") returned 1
	[0045.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00116_.WMF") returned 1
	[0045.477] lstrcmpiA (lpString1="", lpString2="BD00116_.WMF") returned -1
	[0045.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned="BABY_01.MID"
	[0045.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00116_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF"
	[0045.477] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.477] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.477] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD00141_.WMF") returned 1
	[0045.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00141_.WMF") returned 1
	[0045.477] lstrcmpiA (lpString1="", lpString2="BD00141_.WMF") returned -1
	[0045.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned="BD00116_.WMF"
	[0045.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00141_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF"
	[0045.478] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.478] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.478] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD00146_.WMF") returned 1
	[0045.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00146_.WMF") returned 1
	[0045.478] lstrcmpiA (lpString1="", lpString2="BD00146_.WMF") returned -1
	[0045.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned="BD00141_.WMF"
	[0045.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.478] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.478] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00146_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF"
	[0045.478] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.478] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.478] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD00155_.WMF") returned 1
	[0045.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00155_.WMF") returned 1
	[0045.478] lstrcmpiA (lpString1="", lpString2="BD00155_.WMF") returned -1
	[0045.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned="BD00146_.WMF"
	[0045.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.478] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.478] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00155_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF"
	[0045.478] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.478] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.478] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD00160_.WMF") returned 1
	[0045.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00160_.WMF") returned 1
	[0045.479] lstrcmpiA (lpString1="", lpString2="BD00160_.WMF") returned -1
	[0045.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned="BD00155_.WMF"
	[0045.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.479] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.479] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00160_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF"
	[0045.479] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.479] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD00173_.WMF") returned 1
	[0045.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00173_.WMF") returned 1
	[0045.479] lstrcmpiA (lpString1="", lpString2="BD00173_.WMF") returned -1
	[0045.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned="BD00160_.WMF"
	[0045.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.479] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.479] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00173_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF"
	[0045.479] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.479] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD05119_.WMF") returned 1
	[0045.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD05119_.WMF") returned 1
	[0045.479] lstrcmpiA (lpString1="", lpString2="BD05119_.WMF") returned -1
	[0045.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned="BD00173_.WMF"
	[0045.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD05119_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF"
	[0045.480] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.480] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD06102_.WMF") returned 1
	[0045.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD06102_.WMF") returned 1
	[0045.480] lstrcmpiA (lpString1="", lpString2="BD06102_.WMF") returned -1
	[0045.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned="BD05119_.WMF"
	[0045.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD06102_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF"
	[0045.480] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.480] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD06200_.WMF") returned 1
	[0045.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD06200_.WMF") returned 1
	[0045.480] lstrcmpiA (lpString1="", lpString2="BD06200_.WMF") returned -1
	[0045.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned="BD06102_.WMF"
	[0045.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD06200_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF"
	[0045.481] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.481] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD07761_.WMF") returned 1
	[0045.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD07761_.WMF") returned 1
	[0045.481] lstrcmpiA (lpString1="", lpString2="BD07761_.WMF") returned -1
	[0045.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned="BD06200_.WMF"
	[0045.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.481] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.481] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD07761_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF"
	[0045.481] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.481] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD07804_.WMF") returned 1
	[0045.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD07804_.WMF") returned 1
	[0045.481] lstrcmpiA (lpString1="", lpString2="BD07804_.WMF") returned -1
	[0045.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned="BD07761_.WMF"
	[0045.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.481] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.481] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD07804_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF"
	[0045.481] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.481] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD07831_.WMF") returned 1
	[0045.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD07831_.WMF") returned 1
	[0045.482] lstrcmpiA (lpString1="", lpString2="BD07831_.WMF") returned -1
	[0045.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned="BD07804_.WMF"
	[0045.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD07831_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF"
	[0045.482] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.482] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD08758_.WMF") returned 1
	[0045.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08758_.WMF") returned 1
	[0045.482] lstrcmpiA (lpString1="", lpString2="BD08758_.WMF") returned -1
	[0045.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned="BD07831_.WMF"
	[0045.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08758_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF"
	[0045.482] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.482] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD08773_.WMF") returned 1
	[0045.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08773_.WMF") returned 1
	[0045.482] lstrcmpiA (lpString1="", lpString2="BD08773_.WMF") returned -1
	[0045.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned="BD08758_.WMF"
	[0045.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08773_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF"
	[0045.483] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.483] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.483] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD08808_.WMF") returned 1
	[0045.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08808_.WMF") returned 1
	[0045.483] lstrcmpiA (lpString1="", lpString2="BD08808_.WMF") returned -1
	[0045.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned="BD08773_.WMF"
	[0045.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08808_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF"
	[0045.483] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.483] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.483] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD08868_.WMF") returned 1
	[0045.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08868_.WMF") returned 1
	[0045.483] lstrcmpiA (lpString1="", lpString2="BD08868_.WMF") returned -1
	[0045.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned="BD08808_.WMF"
	[0045.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08868_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF"
	[0045.484] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.484] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.484] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD09031_.WMF") returned 1
	[0045.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09031_.WMF") returned 1
	[0045.484] lstrcmpiA (lpString1="", lpString2="BD09031_.WMF") returned -1
	[0045.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned="BD08868_.WMF"
	[0045.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09031_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF"
	[0045.484] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.484] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.484] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD09194_.WMF") returned 1
	[0045.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09194_.WMF") returned 1
	[0045.484] lstrcmpiA (lpString1="", lpString2="BD09194_.WMF") returned -1
	[0045.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned="BD09031_.WMF"
	[0045.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09194_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF"
	[0045.484] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.485] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.485] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD09662_.WMF") returned 1
	[0045.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09662_.WMF") returned 1
	[0045.485] lstrcmpiA (lpString1="", lpString2="BD09662_.WMF") returned -1
	[0045.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned="BD09194_.WMF"
	[0045.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09662_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF"
	[0045.485] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.485] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.485] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD09664_.WMF") returned 1
	[0045.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09664_.WMF") returned 1
	[0045.485] lstrcmpiA (lpString1="", lpString2="BD09664_.WMF") returned -1
	[0045.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned="BD09662_.WMF"
	[0045.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09664_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF"
	[0045.486] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.486] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.486] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10890_.GIF") returned 1
	[0045.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10890_.GIF") returned 1
	[0045.486] lstrcmpiA (lpString1="", lpString2="BD10890_.GIF") returned -1
	[0045.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned="BD09664_.WMF"
	[0045.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD10890_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF"
	[0045.486] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF"
	[0045.486] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF"
	[0045.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF."
	[0045.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.Boom"
	[0045.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.487] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34cb
	[0045.487] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4c365a00, dwHighDateTime=0x1bd4f6a), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f47ba90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4c365a00, dwHighDateTime=0x1bd4f6a)) returned 1
	[0045.487] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.487] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x34a8, lpOverlapped=0x0) returned 1
	[0045.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="BD10890_.GIF"
	[0045.506] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.506] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x34a8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x34a8, lpOverlapped=0x0) returned 1
	[0045.506] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.507] CloseHandle (hObject=0x8c) returned 1
	[0045.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.boom")) returned 1
	[0045.508] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.508] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.508] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10972_.GIF") returned 1
	[0045.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10972_.GIF") returned 1
	[0045.508] lstrcmpiA (lpString1="", lpString2="BD10972_.GIF") returned -1
	[0045.508] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="BD10890_.GIF"
	[0045.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.508] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD10972_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF"
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.zip") returned 0
	[0045.509] lstrlenA (lpString="*.zip") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.rar") returned 0
	[0045.509] lstrlenA (lpString="*.rar") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.7z") returned 0
	[0045.509] lstrlenA (lpString="*.7z") returned 4
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.tar") returned 0
	[0045.509] lstrlenA (lpString="*.tar") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.gzip") returned 0
	[0045.509] lstrlenA (lpString="*.gzip") returned 6
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.jpg") returned 0
	[0045.509] lstrlenA (lpString="*.jpg") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.jpeg") returned 0
	[0045.509] lstrlenA (lpString="*.jpeg") returned 6
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.psd") returned 0
	[0045.509] lstrlenA (lpString="*.psd") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.cdr") returned 0
	[0045.509] lstrlenA (lpString="*.cdr") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.dwg") returned 0
	[0045.509] lstrlenA (lpString="*.dwg") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.max") returned 0
	[0045.509] lstrlenA (lpString="*.max") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.bmp") returned 0
	[0045.509] lstrlenA (lpString="*.bmp") returned 5
	[0045.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.gif") returned 1
	[0045.509] lstrlenA (lpString="*.gif") returned 5
	[0045.509] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF"
	[0045.509] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF"
	[0045.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF."
	[0045.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.Boom"
	[0045.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.511] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4edd
	[0045.511] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93701b00, dwHighDateTime=0x1bd4f69), lpLastAccessTime=0x407536*(dwLowDateTime=0x517da370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93701b00, dwHighDateTime=0x1bd4f69)) returned 1
	[0045.511] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.511] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4eba, lpOverlapped=0x0) returned 1
	[0045.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="BD10972_.GIF"
	[0045.520] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.520] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4eba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4eba, lpOverlapped=0x0) returned 1
	[0045.521] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.521] CloseHandle (hObject=0x8c) returned 1
	[0045.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.boom")) returned 1
	[0045.525] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.525] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD19563_.GIF") returned 1
	[0045.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19563_.GIF") returned 1
	[0045.525] lstrcmpiA (lpString1="", lpString2="BD19563_.GIF") returned -1
	[0045.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="BD10972_.GIF"
	[0045.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19563_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF"
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.zip") returned 0
	[0045.526] lstrlenA (lpString="*.zip") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.rar") returned 0
	[0045.526] lstrlenA (lpString="*.rar") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.7z") returned 0
	[0045.526] lstrlenA (lpString="*.7z") returned 4
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.tar") returned 0
	[0045.526] lstrlenA (lpString="*.tar") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.gzip") returned 0
	[0045.526] lstrlenA (lpString="*.gzip") returned 6
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.jpg") returned 0
	[0045.526] lstrlenA (lpString="*.jpg") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.jpeg") returned 0
	[0045.526] lstrlenA (lpString="*.jpeg") returned 6
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.psd") returned 0
	[0045.526] lstrlenA (lpString="*.psd") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.cdr") returned 0
	[0045.526] lstrlenA (lpString="*.cdr") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.dwg") returned 0
	[0045.526] lstrlenA (lpString="*.dwg") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.max") returned 0
	[0045.526] lstrlenA (lpString="*.max") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.bmp") returned 0
	[0045.526] lstrlenA (lpString="*.bmp") returned 5
	[0045.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.gif") returned 1
	[0045.526] lstrlenA (lpString="*.gif") returned 5
	[0045.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF"
	[0045.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF"
	[0045.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF."
	[0045.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.Boom"
	[0045.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.527] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fe6
	[0045.527] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6557800, dwHighDateTime=0x1bd4d57), lpLastAccessTime=0x407536*(dwLowDateTime=0x5190ae70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6557800, dwHighDateTime=0x1bd4d57)) returned 1
	[0045.527] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.527] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4fc3, lpOverlapped=0x0) returned 1
	[0045.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="BD19563_.GIF"
	[0045.529] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.529] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4fc3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4fc3, lpOverlapped=0x0) returned 1
	[0045.529] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.529] CloseHandle (hObject=0x8c) returned 1
	[0045.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.boom")) returned 1
	[0045.531] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.531] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.531] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD19582_.GIF") returned 1
	[0045.531] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19582_.GIF") returned 1
	[0045.531] lstrcmpiA (lpString1="", lpString2="BD19582_.GIF") returned -1
	[0045.531] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="BD19563_.GIF"
	[0045.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.531] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.531] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF"
	[0045.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.zip") returned 0
	[0045.531] lstrlenA (lpString="*.zip") returned 5
	[0045.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.rar") returned 0
	[0045.531] lstrlenA (lpString="*.rar") returned 5
	[0045.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.7z") returned 0
	[0045.531] lstrlenA (lpString="*.7z") returned 4
	[0045.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.tar") returned 0
	[0045.531] lstrlenA (lpString="*.tar") returned 5
	[0045.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.gzip") returned 0
	[0045.531] lstrlenA (lpString="*.gzip") returned 6
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.jpg") returned 0
	[0045.532] lstrlenA (lpString="*.jpg") returned 5
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.jpeg") returned 0
	[0045.532] lstrlenA (lpString="*.jpeg") returned 6
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.psd") returned 0
	[0045.532] lstrlenA (lpString="*.psd") returned 5
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.cdr") returned 0
	[0045.532] lstrlenA (lpString="*.cdr") returned 5
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.dwg") returned 0
	[0045.532] lstrlenA (lpString="*.dwg") returned 5
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.max") returned 0
	[0045.532] lstrlenA (lpString="*.max") returned 5
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.bmp") returned 0
	[0045.532] lstrlenA (lpString="*.bmp") returned 5
	[0045.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.gif") returned 1
	[0045.532] lstrlenA (lpString="*.gif") returned 5
	[0045.532] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF"
	[0045.532] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF"
	[0045.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF."
	[0045.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.Boom"
	[0045.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0045.534] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d75
	[0045.534] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe4f48c00, dwHighDateTime=0x1bd4d56), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f586430, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe4f48c00, dwHighDateTime=0x1bd4d56)) returned 1
	[0045.534] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.534] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3d52, lpOverlapped=0x0) returned 1
	[0045.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="BD19582_.GIF"
	[0045.560] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0045.560] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3d52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3d52, lpOverlapped=0x0) returned 1
	[0045.560] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.560] CloseHandle (hObject=0x8c) returned 1
	[0045.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.boom")) returned 1
	[0045.562] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.562] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.562] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD19695_.WMF") returned 1
	[0045.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19695_.WMF") returned 1
	[0045.562] lstrcmpiA (lpString1="", lpString2="BD19695_.WMF") returned -1
	[0045.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="BD19582_.GIF"
	[0045.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19695_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF"
	[0045.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.zip") returned 0
	[0045.562] lstrlenA (lpString="*.zip") returned 5
	[0045.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.rar") returned 0
	[0045.562] lstrlenA (lpString="*.rar") returned 5
	[0045.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.7z") returned 0
	[0045.562] lstrlenA (lpString="*.7z") returned 4
	[0045.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.tar") returned 0
	[0045.562] lstrlenA (lpString="*.tar") returned 5
	[0045.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.gzip") returned 0
	[0045.563] lstrlenA (lpString="*.gzip") returned 6
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.jpg") returned 0
	[0045.563] lstrlenA (lpString="*.jpg") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.jpeg") returned 0
	[0045.563] lstrlenA (lpString="*.jpeg") returned 6
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.psd") returned 0
	[0045.563] lstrlenA (lpString="*.psd") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.cdr") returned 0
	[0045.563] lstrlenA (lpString="*.cdr") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.dwg") returned 0
	[0045.563] lstrlenA (lpString="*.dwg") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.max") returned 0
	[0045.563] lstrlenA (lpString="*.max") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.bmp") returned 0
	[0045.563] lstrlenA (lpString="*.bmp") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.gif") returned 0
	[0045.563] lstrlenA (lpString="*.gif") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.png") returned 0
	[0045.563] lstrlenA (lpString="*.png") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.doc") returned 0
	[0045.563] lstrlenA (lpString="*.doc") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.docx") returned 0
	[0045.563] lstrlenA (lpString="*.docx") returned 6
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.xls") returned 0
	[0045.563] lstrlenA (lpString="*.xls") returned 5
	[0045.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.xlsx") returned 0
	[0045.564] lstrlenA (lpString="*.xlsx") returned 6
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.ppt") returned 0
	[0045.564] lstrlenA (lpString="*.ppt") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.pptx") returned 0
	[0045.564] lstrlenA (lpString="*.pptx") returned 6
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.txt") returned 0
	[0045.564] lstrlenA (lpString="*.txt") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.pdf") returned 0
	[0045.564] lstrlenA (lpString="*.pdf") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.djvu") returned 0
	[0045.564] lstrlenA (lpString="*.djvu") returned 6
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.htm") returned 0
	[0045.564] lstrlenA (lpString="*.htm") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.html") returned 0
	[0045.564] lstrlenA (lpString="*.html") returned 6
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mdb") returned 0
	[0045.564] lstrlenA (lpString="*.mdb") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.cer") returned 0
	[0045.564] lstrlenA (lpString="*.cer") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.p12") returned 0
	[0045.564] lstrlenA (lpString="*.p12") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.pfx") returned 0
	[0045.564] lstrlenA (lpString="*.pfx") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.kwm") returned 0
	[0045.564] lstrlenA (lpString="*.kwm") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.pwm") returned 0
	[0045.564] lstrlenA (lpString="*.pwm") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.1cd") returned 0
	[0045.564] lstrlenA (lpString="*.1cd") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.md") returned 0
	[0045.564] lstrlenA (lpString="*.md") returned 4
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mdf") returned 0
	[0045.564] lstrlenA (lpString="*.mdf") returned 5
	[0045.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.dbf") returned 0
	[0045.564] lstrlenA (lpString="*.dbf") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.odt") returned 0
	[0045.565] lstrlenA (lpString="*.odt") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.vob") returned 0
	[0045.565] lstrlenA (lpString="*.vob") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.ifo") returned 0
	[0045.565] lstrlenA (lpString="*.ifo") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.lnk") returned 0
	[0045.565] lstrlenA (lpString="*.lnk") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.torrent") returned 0
	[0045.565] lstrlenA (lpString="*.torrent") returned 9
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mov") returned 0
	[0045.565] lstrlenA (lpString="*.mov") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.m2v") returned 0
	[0045.565] lstrlenA (lpString="*.m2v") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.3gp") returned 0
	[0045.565] lstrlenA (lpString="*.3gp") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mpeg") returned 0
	[0045.565] lstrlenA (lpString="*.mpeg") returned 6
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mpg") returned 0
	[0045.565] lstrlenA (lpString="*.mpg") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.flv") returned 0
	[0045.565] lstrlenA (lpString="*.flv") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.avi") returned 0
	[0045.565] lstrlenA (lpString="*.avi") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mp4") returned 0
	[0045.565] lstrlenA (lpString="*.mp4") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.wmv") returned 0
	[0045.565] lstrlenA (lpString="*.wmv") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.divx") returned 0
	[0045.565] lstrlenA (lpString="*.divx") returned 6
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mkv") returned 0
	[0045.565] lstrlenA (lpString="*.mkv") returned 5
	[0045.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mp3") returned 0
	[0045.565] lstrlenA (lpString="*.mp3") returned 5
	[0045.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.wav") returned 0
	[0045.566] lstrlenA (lpString="*.wav") returned 5
	[0045.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.flac") returned 0
	[0045.566] lstrlenA (lpString="*.flac") returned 6
	[0045.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.ape") returned 0
	[0045.566] lstrlenA (lpString="*.ape") returned 5
	[0045.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.wma") returned 0
	[0045.566] lstrlenA (lpString="*.wma") returned 5
	[0045.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.ac3") returned 0
	[0045.566] lstrlenA (lpString="*.ac3") returned 5
	[0045.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.exe") returned 0
	[0045.566] lstrlenA (lpString="*.exe") returned 5
	[0045.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.apk") returned 0
	[0045.566] lstrlenA (lpString="*.apk") returned 5
	[0045.566] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD19827_.WMF") returned 1
	[0045.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19827_.WMF") returned 1
	[0045.567] lstrcmpiA (lpString1="", lpString2="BD19827_.WMF") returned -1
	[0045.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned="BD19695_.WMF"
	[0045.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19827_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF"
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.zip") returned 0
	[0045.567] lstrlenA (lpString="*.zip") returned 5
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.rar") returned 0
	[0045.567] lstrlenA (lpString="*.rar") returned 5
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.7z") returned 0
	[0045.567] lstrlenA (lpString="*.7z") returned 4
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.tar") returned 0
	[0045.567] lstrlenA (lpString="*.tar") returned 5
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.gzip") returned 0
	[0045.567] lstrlenA (lpString="*.gzip") returned 6
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.jpg") returned 0
	[0045.567] lstrlenA (lpString="*.jpg") returned 5
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.jpeg") returned 0
	[0045.567] lstrlenA (lpString="*.jpeg") returned 6
	[0045.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.psd") returned 0
	[0045.567] lstrlenA (lpString="*.psd") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.cdr") returned 0
	[0045.568] lstrlenA (lpString="*.cdr") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.dwg") returned 0
	[0045.568] lstrlenA (lpString="*.dwg") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.max") returned 0
	[0045.568] lstrlenA (lpString="*.max") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.bmp") returned 0
	[0045.568] lstrlenA (lpString="*.bmp") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.gif") returned 0
	[0045.568] lstrlenA (lpString="*.gif") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.png") returned 0
	[0045.568] lstrlenA (lpString="*.png") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.doc") returned 0
	[0045.568] lstrlenA (lpString="*.doc") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.docx") returned 0
	[0045.568] lstrlenA (lpString="*.docx") returned 6
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.xls") returned 0
	[0045.568] lstrlenA (lpString="*.xls") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.xlsx") returned 0
	[0045.568] lstrlenA (lpString="*.xlsx") returned 6
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.ppt") returned 0
	[0045.568] lstrlenA (lpString="*.ppt") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.pptx") returned 0
	[0045.568] lstrlenA (lpString="*.pptx") returned 6
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.txt") returned 0
	[0045.568] lstrlenA (lpString="*.txt") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.pdf") returned 0
	[0045.568] lstrlenA (lpString="*.pdf") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.djvu") returned 0
	[0045.568] lstrlenA (lpString="*.djvu") returned 6
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.htm") returned 0
	[0045.568] lstrlenA (lpString="*.htm") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.html") returned 0
	[0045.568] lstrlenA (lpString="*.html") returned 6
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mdb") returned 0
	[0045.568] lstrlenA (lpString="*.mdb") returned 5
	[0045.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.cer") returned 0
	[0045.568] lstrlenA (lpString="*.cer") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.p12") returned 0
	[0045.569] lstrlenA (lpString="*.p12") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.pfx") returned 0
	[0045.569] lstrlenA (lpString="*.pfx") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.kwm") returned 0
	[0045.569] lstrlenA (lpString="*.kwm") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.pwm") returned 0
	[0045.569] lstrlenA (lpString="*.pwm") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.1cd") returned 0
	[0045.569] lstrlenA (lpString="*.1cd") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.md") returned 0
	[0045.569] lstrlenA (lpString="*.md") returned 4
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mdf") returned 0
	[0045.569] lstrlenA (lpString="*.mdf") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.dbf") returned 0
	[0045.569] lstrlenA (lpString="*.dbf") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.odt") returned 0
	[0045.569] lstrlenA (lpString="*.odt") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.vob") returned 0
	[0045.569] lstrlenA (lpString="*.vob") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.ifo") returned 0
	[0045.569] lstrlenA (lpString="*.ifo") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.lnk") returned 0
	[0045.569] lstrlenA (lpString="*.lnk") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.torrent") returned 0
	[0045.569] lstrlenA (lpString="*.torrent") returned 9
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mov") returned 0
	[0045.569] lstrlenA (lpString="*.mov") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.m2v") returned 0
	[0045.569] lstrlenA (lpString="*.m2v") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.3gp") returned 0
	[0045.569] lstrlenA (lpString="*.3gp") returned 5
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mpeg") returned 0
	[0045.569] lstrlenA (lpString="*.mpeg") returned 6
	[0045.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mpg") returned 0
	[0045.569] lstrlenA (lpString="*.mpg") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.flv") returned 0
	[0045.570] lstrlenA (lpString="*.flv") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.avi") returned 0
	[0045.570] lstrlenA (lpString="*.avi") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mp4") returned 0
	[0045.570] lstrlenA (lpString="*.mp4") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.wmv") returned 0
	[0045.570] lstrlenA (lpString="*.wmv") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.divx") returned 0
	[0045.570] lstrlenA (lpString="*.divx") returned 6
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mkv") returned 0
	[0045.570] lstrlenA (lpString="*.mkv") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mp3") returned 0
	[0045.570] lstrlenA (lpString="*.mp3") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.wav") returned 0
	[0045.570] lstrlenA (lpString="*.wav") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.flac") returned 0
	[0045.570] lstrlenA (lpString="*.flac") returned 6
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.ape") returned 0
	[0045.570] lstrlenA (lpString="*.ape") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.wma") returned 0
	[0045.570] lstrlenA (lpString="*.wma") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.ac3") returned 0
	[0045.570] lstrlenA (lpString="*.ac3") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.exe") returned 0
	[0045.570] lstrlenA (lpString="*.exe") returned 5
	[0045.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.apk") returned 0
	[0045.570] lstrlenA (lpString="*.apk") returned 5
	[0045.570] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.570] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.570] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD19828_.WMF") returned 1
	[0045.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19828_.WMF") returned 1
	[0045.570] lstrcmpiA (lpString1="", lpString2="BD19828_.WMF") returned -1
	[0045.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned="BD19827_.WMF"
	[0045.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19828_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF"
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.zip") returned 0
	[0045.571] lstrlenA (lpString="*.zip") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.rar") returned 0
	[0045.571] lstrlenA (lpString="*.rar") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.7z") returned 0
	[0045.571] lstrlenA (lpString="*.7z") returned 4
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.tar") returned 0
	[0045.571] lstrlenA (lpString="*.tar") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.gzip") returned 0
	[0045.571] lstrlenA (lpString="*.gzip") returned 6
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.jpg") returned 0
	[0045.571] lstrlenA (lpString="*.jpg") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.jpeg") returned 0
	[0045.571] lstrlenA (lpString="*.jpeg") returned 6
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.psd") returned 0
	[0045.571] lstrlenA (lpString="*.psd") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.cdr") returned 0
	[0045.571] lstrlenA (lpString="*.cdr") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.dwg") returned 0
	[0045.571] lstrlenA (lpString="*.dwg") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.max") returned 0
	[0045.571] lstrlenA (lpString="*.max") returned 5
	[0045.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.bmp") returned 0
	[0045.571] lstrlenA (lpString="*.bmp") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.gif") returned 0
	[0045.572] lstrlenA (lpString="*.gif") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.png") returned 0
	[0045.572] lstrlenA (lpString="*.png") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.doc") returned 0
	[0045.572] lstrlenA (lpString="*.doc") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.docx") returned 0
	[0045.572] lstrlenA (lpString="*.docx") returned 6
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.xls") returned 0
	[0045.572] lstrlenA (lpString="*.xls") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.xlsx") returned 0
	[0045.572] lstrlenA (lpString="*.xlsx") returned 6
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.ppt") returned 0
	[0045.572] lstrlenA (lpString="*.ppt") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.pptx") returned 0
	[0045.572] lstrlenA (lpString="*.pptx") returned 6
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.txt") returned 0
	[0045.572] lstrlenA (lpString="*.txt") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.pdf") returned 0
	[0045.572] lstrlenA (lpString="*.pdf") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.djvu") returned 0
	[0045.572] lstrlenA (lpString="*.djvu") returned 6
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.htm") returned 0
	[0045.572] lstrlenA (lpString="*.htm") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.html") returned 0
	[0045.572] lstrlenA (lpString="*.html") returned 6
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mdb") returned 0
	[0045.572] lstrlenA (lpString="*.mdb") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.cer") returned 0
	[0045.572] lstrlenA (lpString="*.cer") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.p12") returned 0
	[0045.572] lstrlenA (lpString="*.p12") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.pfx") returned 0
	[0045.572] lstrlenA (lpString="*.pfx") returned 5
	[0045.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.kwm") returned 0
	[0045.573] lstrlenA (lpString="*.kwm") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.pwm") returned 0
	[0045.573] lstrlenA (lpString="*.pwm") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.1cd") returned 0
	[0045.573] lstrlenA (lpString="*.1cd") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.md") returned 0
	[0045.573] lstrlenA (lpString="*.md") returned 4
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mdf") returned 0
	[0045.573] lstrlenA (lpString="*.mdf") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.dbf") returned 0
	[0045.573] lstrlenA (lpString="*.dbf") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.odt") returned 0
	[0045.573] lstrlenA (lpString="*.odt") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.vob") returned 0
	[0045.573] lstrlenA (lpString="*.vob") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.ifo") returned 0
	[0045.573] lstrlenA (lpString="*.ifo") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.lnk") returned 0
	[0045.573] lstrlenA (lpString="*.lnk") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.torrent") returned 0
	[0045.573] lstrlenA (lpString="*.torrent") returned 9
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mov") returned 0
	[0045.573] lstrlenA (lpString="*.mov") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.m2v") returned 0
	[0045.573] lstrlenA (lpString="*.m2v") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.3gp") returned 0
	[0045.573] lstrlenA (lpString="*.3gp") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mpeg") returned 0
	[0045.573] lstrlenA (lpString="*.mpeg") returned 6
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mpg") returned 0
	[0045.573] lstrlenA (lpString="*.mpg") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.flv") returned 0
	[0045.573] lstrlenA (lpString="*.flv") returned 5
	[0045.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.avi") returned 0
	[0045.574] lstrlenA (lpString="*.avi") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mp4") returned 0
	[0045.574] lstrlenA (lpString="*.mp4") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.wmv") returned 0
	[0045.574] lstrlenA (lpString="*.wmv") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.divx") returned 0
	[0045.574] lstrlenA (lpString="*.divx") returned 6
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mkv") returned 0
	[0045.574] lstrlenA (lpString="*.mkv") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mp3") returned 0
	[0045.574] lstrlenA (lpString="*.mp3") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.wav") returned 0
	[0045.574] lstrlenA (lpString="*.wav") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.flac") returned 0
	[0045.574] lstrlenA (lpString="*.flac") returned 6
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.ape") returned 0
	[0045.574] lstrlenA (lpString="*.ape") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.wma") returned 0
	[0045.574] lstrlenA (lpString="*.wma") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.ac3") returned 0
	[0045.574] lstrlenA (lpString="*.ac3") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.exe") returned 0
	[0045.574] lstrlenA (lpString="*.exe") returned 5
	[0045.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.apk") returned 0
	[0045.574] lstrlenA (lpString="*.apk") returned 5
	[0045.574] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.574] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.574] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD19986_.WMF") returned 1
	[0045.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19986_.WMF") returned 1
	[0045.574] lstrcmpiA (lpString1="", lpString2="BD19986_.WMF") returned -1
	[0045.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned="BD19828_.WMF"
	[0045.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19986_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF"
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.zip") returned 0
	[0045.575] lstrlenA (lpString="*.zip") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.rar") returned 0
	[0045.575] lstrlenA (lpString="*.rar") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.7z") returned 0
	[0045.575] lstrlenA (lpString="*.7z") returned 4
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.tar") returned 0
	[0045.575] lstrlenA (lpString="*.tar") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.gzip") returned 0
	[0045.575] lstrlenA (lpString="*.gzip") returned 6
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.jpg") returned 0
	[0045.575] lstrlenA (lpString="*.jpg") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.jpeg") returned 0
	[0045.575] lstrlenA (lpString="*.jpeg") returned 6
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.psd") returned 0
	[0045.575] lstrlenA (lpString="*.psd") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.cdr") returned 0
	[0045.575] lstrlenA (lpString="*.cdr") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.dwg") returned 0
	[0045.575] lstrlenA (lpString="*.dwg") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.max") returned 0
	[0045.575] lstrlenA (lpString="*.max") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.bmp") returned 0
	[0045.575] lstrlenA (lpString="*.bmp") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.gif") returned 0
	[0045.575] lstrlenA (lpString="*.gif") returned 5
	[0045.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.png") returned 0
	[0045.576] lstrlenA (lpString="*.png") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.doc") returned 0
	[0045.576] lstrlenA (lpString="*.doc") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.docx") returned 0
	[0045.576] lstrlenA (lpString="*.docx") returned 6
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.xls") returned 0
	[0045.576] lstrlenA (lpString="*.xls") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.xlsx") returned 0
	[0045.576] lstrlenA (lpString="*.xlsx") returned 6
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.ppt") returned 0
	[0045.576] lstrlenA (lpString="*.ppt") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.pptx") returned 0
	[0045.576] lstrlenA (lpString="*.pptx") returned 6
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.txt") returned 0
	[0045.576] lstrlenA (lpString="*.txt") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.pdf") returned 0
	[0045.576] lstrlenA (lpString="*.pdf") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.djvu") returned 0
	[0045.576] lstrlenA (lpString="*.djvu") returned 6
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.htm") returned 0
	[0045.576] lstrlenA (lpString="*.htm") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.html") returned 0
	[0045.576] lstrlenA (lpString="*.html") returned 6
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mdb") returned 0
	[0045.576] lstrlenA (lpString="*.mdb") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.cer") returned 0
	[0045.576] lstrlenA (lpString="*.cer") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.p12") returned 0
	[0045.576] lstrlenA (lpString="*.p12") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.pfx") returned 0
	[0045.576] lstrlenA (lpString="*.pfx") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.kwm") returned 0
	[0045.576] lstrlenA (lpString="*.kwm") returned 5
	[0045.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.pwm") returned 0
	[0045.577] lstrlenA (lpString="*.pwm") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.1cd") returned 0
	[0045.577] lstrlenA (lpString="*.1cd") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.md") returned 0
	[0045.577] lstrlenA (lpString="*.md") returned 4
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mdf") returned 0
	[0045.577] lstrlenA (lpString="*.mdf") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.dbf") returned 0
	[0045.577] lstrlenA (lpString="*.dbf") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.odt") returned 0
	[0045.577] lstrlenA (lpString="*.odt") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.vob") returned 0
	[0045.577] lstrlenA (lpString="*.vob") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.ifo") returned 0
	[0045.577] lstrlenA (lpString="*.ifo") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.lnk") returned 0
	[0045.577] lstrlenA (lpString="*.lnk") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.torrent") returned 0
	[0045.577] lstrlenA (lpString="*.torrent") returned 9
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mov") returned 0
	[0045.577] lstrlenA (lpString="*.mov") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.m2v") returned 0
	[0045.577] lstrlenA (lpString="*.m2v") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.3gp") returned 0
	[0045.577] lstrlenA (lpString="*.3gp") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mpeg") returned 0
	[0045.577] lstrlenA (lpString="*.mpeg") returned 6
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mpg") returned 0
	[0045.577] lstrlenA (lpString="*.mpg") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.flv") returned 0
	[0045.577] lstrlenA (lpString="*.flv") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.avi") returned 0
	[0045.577] lstrlenA (lpString="*.avi") returned 5
	[0045.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mp4") returned 0
	[0045.577] lstrlenA (lpString="*.mp4") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.wmv") returned 0
	[0045.578] lstrlenA (lpString="*.wmv") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.divx") returned 0
	[0045.578] lstrlenA (lpString="*.divx") returned 6
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mkv") returned 0
	[0045.578] lstrlenA (lpString="*.mkv") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mp3") returned 0
	[0045.578] lstrlenA (lpString="*.mp3") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.wav") returned 0
	[0045.578] lstrlenA (lpString="*.wav") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.flac") returned 0
	[0045.578] lstrlenA (lpString="*.flac") returned 6
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.ape") returned 0
	[0045.578] lstrlenA (lpString="*.ape") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.wma") returned 0
	[0045.578] lstrlenA (lpString="*.wma") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.ac3") returned 0
	[0045.578] lstrlenA (lpString="*.ac3") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.exe") returned 0
	[0045.578] lstrlenA (lpString="*.exe") returned 5
	[0045.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.apk") returned 0
	[0045.578] lstrlenA (lpString="*.apk") returned 5
	[0045.578] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.578] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.578] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD19988_.WMF") returned 1
	[0045.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19988_.WMF") returned 1
	[0045.578] lstrcmpiA (lpString1="", lpString2="BD19988_.WMF") returned -1
	[0045.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned="BD19986_.WMF"
	[0045.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19988_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF"
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.zip") returned 0
	[0045.579] lstrlenA (lpString="*.zip") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.rar") returned 0
	[0045.579] lstrlenA (lpString="*.rar") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.7z") returned 0
	[0045.579] lstrlenA (lpString="*.7z") returned 4
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.tar") returned 0
	[0045.579] lstrlenA (lpString="*.tar") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.gzip") returned 0
	[0045.579] lstrlenA (lpString="*.gzip") returned 6
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.jpg") returned 0
	[0045.579] lstrlenA (lpString="*.jpg") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.jpeg") returned 0
	[0045.579] lstrlenA (lpString="*.jpeg") returned 6
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.psd") returned 0
	[0045.579] lstrlenA (lpString="*.psd") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.cdr") returned 0
	[0045.579] lstrlenA (lpString="*.cdr") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.dwg") returned 0
	[0045.579] lstrlenA (lpString="*.dwg") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.max") returned 0
	[0045.579] lstrlenA (lpString="*.max") returned 5
	[0045.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.bmp") returned 0
	[0045.580] lstrlenA (lpString="*.bmp") returned 5
	[0045.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.gif") returned 0
	[0045.580] lstrlenA (lpString="*.gif") returned 5
	[0045.580] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.580] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD20013_.WMF") returned 1
	[0045.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD20013_.WMF") returned 1
	[0045.580] lstrcmpiA (lpString1="", lpString2="BD20013_.WMF") returned -1
	[0045.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned="BD19988_.WMF"
	[0045.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD20013_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF"
	[0045.580] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.580] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00008_.WMF") returned 1
	[0045.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00008_.WMF") returned 1
	[0045.581] lstrcmpiA (lpString1="", lpString2="BL00008_.WMF") returned -1
	[0045.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned="BD20013_.WMF"
	[0045.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00008_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF"
	[0045.581] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.581] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00012_.WMF") returned 1
	[0045.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00012_.WMF") returned 1
	[0045.581] lstrcmpiA (lpString1="", lpString2="BL00012_.WMF") returned -1
	[0045.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned="BL00008_.WMF"
	[0045.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00012_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF"
	[0045.581] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.581] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00045_.WMF") returned 1
	[0045.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00045_.WMF") returned 1
	[0045.581] lstrcmpiA (lpString1="", lpString2="BL00045_.WMF") returned -1
	[0045.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned="BL00012_.WMF"
	[0045.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00045_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF"
	[0045.582] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.582] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00098_.WMF") returned 1
	[0045.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00098_.WMF") returned 1
	[0045.582] lstrcmpiA (lpString1="", lpString2="BL00098_.WMF") returned -1
	[0045.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned="BL00045_.WMF"
	[0045.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00098_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF"
	[0045.582] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.582] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00105_.WMF") returned 1
	[0045.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00105_.WMF") returned 1
	[0045.582] lstrcmpiA (lpString1="", lpString2="BL00105_.WMF") returned -1
	[0045.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned="BL00098_.WMF"
	[0045.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00105_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF"
	[0045.583] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.583] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00122_.WMF") returned 1
	[0045.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00122_.WMF") returned 1
	[0045.583] lstrcmpiA (lpString1="", lpString2="BL00122_.WMF") returned -1
	[0045.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned="BL00105_.WMF"
	[0045.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00122_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF"
	[0045.583] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.583] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00130_.WMF") returned 1
	[0045.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00130_.WMF") returned 1
	[0045.583] lstrcmpiA (lpString1="", lpString2="BL00130_.WMF") returned -1
	[0045.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned="BL00122_.WMF"
	[0045.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00130_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF"
	[0045.584] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.584] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.584] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00148_.WMF") returned 1
	[0045.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00148_.WMF") returned 1
	[0045.584] lstrcmpiA (lpString1="", lpString2="BL00148_.WMF") returned -1
	[0045.584] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned="BL00130_.WMF"
	[0045.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00148_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF"
	[0045.584] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.584] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.584] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00152_.WMF") returned 1
	[0045.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00152_.WMF") returned 1
	[0045.584] lstrcmpiA (lpString1="", lpString2="BL00152_.WMF") returned -1
	[0045.584] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned="BL00148_.WMF"
	[0045.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt"
	[0045.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20
	[0045.584] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.584] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.584] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00194_.WMF") returned 1
	[0045.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00194_.WMF") returned 1
	[0045.585] lstrcmpiA (lpString1="", lpString2="BL00194_.WMF") returned -1
	[0045.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned="BL00152_.WMF"
	[0045.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.586] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.586] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00195_.WMF") returned 1
	[0045.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00195_.WMF") returned 1
	[0045.586] lstrcmpiA (lpString1="", lpString2="BL00195_.WMF") returned -1
	[0045.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned="BL00194_.WMF"
	[0045.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.586] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.587] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00234_.WMF") returned 1
	[0045.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00234_.WMF") returned 1
	[0045.587] lstrcmpiA (lpString1="", lpString2="BL00234_.WMF") returned -1
	[0045.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned="BL00195_.WMF"
	[0045.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.587] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00242_.WMF") returned 1
	[0045.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00242_.WMF") returned 1
	[0045.587] lstrcmpiA (lpString1="", lpString2="BL00242_.WMF") returned -1
	[0045.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned="BL00234_.WMF"
	[0045.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.587] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00247_.WMF") returned 1
	[0045.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00247_.WMF") returned 1
	[0045.587] lstrcmpiA (lpString1="", lpString2="BL00247_.WMF") returned -1
	[0045.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned="BL00242_.WMF"
	[0045.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.587] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00248_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00248_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="", lpString2="BL00248_.WMF") returned -1
	[0045.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned="BL00247_.WMF"
	[0045.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.588] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.588] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00252_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00252_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="", lpString2="BL00252_.WMF") returned -1
	[0045.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned="BL00248_.WMF"
	[0045.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.588] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.588] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00254_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00254_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="", lpString2="BL00254_.WMF") returned -1
	[0045.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned="BL00252_.WMF"
	[0045.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.588] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.588] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00261_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00261_.WMF") returned 1
	[0045.588] lstrcmpiA (lpString1="", lpString2="BL00261_.WMF") returned -1
	[0045.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned="BL00254_.WMF"
	[0045.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.589] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.589] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00262_.WMF") returned 1
	[0045.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00262_.WMF") returned 1
	[0045.589] lstrcmpiA (lpString1="", lpString2="BL00262_.WMF") returned -1
	[0045.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned="BL00261_.WMF"
	[0045.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.589] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.589] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00265_.WMF") returned 1
	[0045.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00265_.WMF") returned 1
	[0045.589] lstrcmpiA (lpString1="", lpString2="BL00265_.WMF") returned -1
	[0045.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned="BL00262_.WMF"
	[0045.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.589] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.589] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00267_.WMF") returned 1
	[0045.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00267_.WMF") returned 1
	[0045.589] lstrcmpiA (lpString1="", lpString2="BL00267_.WMF") returned -1
	[0045.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned="BL00265_.WMF"
	[0045.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.590] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.590] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00269_.WMF") returned 1
	[0045.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00269_.WMF") returned 1
	[0045.590] lstrcmpiA (lpString1="", lpString2="BL00269_.WMF") returned -1
	[0045.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned="BL00267_.WMF"
	[0045.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.590] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.590] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00270_.WMF") returned 1
	[0045.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00270_.WMF") returned 1
	[0045.590] lstrcmpiA (lpString1="", lpString2="BL00270_.WMF") returned -1
	[0045.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned="BL00269_.WMF"
	[0045.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.590] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.590] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00273_.WMF") returned 1
	[0045.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00273_.WMF") returned 1
	[0045.590] lstrcmpiA (lpString1="", lpString2="BL00273_.WMF") returned -1
	[0045.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned="BL00270_.WMF"
	[0045.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.590] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.590] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00274_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00274_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="", lpString2="BL00274_.WMF") returned -1
	[0045.591] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned="BL00273_.WMF"
	[0045.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.591] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.591] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00296_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00296_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="", lpString2="BL00296_.WMF") returned -1
	[0045.591] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned="BL00274_.WMF"
	[0045.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.591] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.591] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00390_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00390_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="", lpString2="BL00390_.WMF") returned -1
	[0045.591] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned="BL00296_.WMF"
	[0045.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.591] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.591] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00392_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00392_.WMF") returned 1
	[0045.591] lstrcmpiA (lpString1="", lpString2="BL00392_.WMF") returned -1
	[0045.591] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned="BL00390_.WMF"
	[0045.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.592] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.592] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.592] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00524_.WMF") returned 1
	[0045.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00524_.WMF") returned 1
	[0045.592] lstrcmpiA (lpString1="", lpString2="BL00524_.WMF") returned -1
	[0045.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned="BL00392_.WMF"
	[0045.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.592] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.593] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.593] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00525_.WMF") returned 1
	[0045.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00525_.WMF") returned 1
	[0045.593] lstrcmpiA (lpString1="", lpString2="BL00525_.WMF") returned -1
	[0045.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned="BL00524_.WMF"
	[0045.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.594] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.594] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.594] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00526_.WMF") returned 1
	[0045.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00526_.WMF") returned 1
	[0045.594] lstrcmpiA (lpString1="", lpString2="BL00526_.WMF") returned -1
	[0045.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned="BL00525_.WMF"
	[0045.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.594] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.594] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.594] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00648_.WMF") returned 1
	[0045.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00648_.WMF") returned 1
	[0045.594] lstrcmpiA (lpString1="", lpString2="BL00648_.WMF") returned -1
	[0045.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned="BL00526_.WMF"
	[0045.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.594] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.594] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.594] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00921_.WMF") returned 1
	[0045.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00921_.WMF") returned 1
	[0045.594] lstrcmpiA (lpString1="", lpString2="BL00921_.WMF") returned -1
	[0045.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned="BL00648_.WMF"
	[0045.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.595] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.595] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.595] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00923_.WMF") returned 1
	[0045.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00923_.WMF") returned 1
	[0045.595] lstrcmpiA (lpString1="", lpString2="BL00923_.WMF") returned -1
	[0045.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned="BL00921_.WMF"
	[0045.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.595] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.595] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.595] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00932_.WMF") returned 1
	[0045.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00932_.WMF") returned 1
	[0045.595] lstrcmpiA (lpString1="", lpString2="BL00932_.WMF") returned -1
	[0045.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned="BL00923_.WMF"
	[0045.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.595] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.595] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.595] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BL00985_.WMF") returned 1
	[0045.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00985_.WMF") returned 1
	[0045.595] lstrcmpiA (lpString1="", lpString2="BL00985_.WMF") returned -1
	[0045.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned="BL00932_.WMF"
	[0045.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.596] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.596] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.596] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOAT.WMF") returned 1
	[0045.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOAT.WMF") returned 1
	[0045.596] lstrcmpiA (lpString1="", lpString2="BOAT.WMF") returned -1
	[0045.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned="BL00985_.WMF"
	[0045.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.596] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.596] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.596] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOATINST.WMF") returned 1
	[0045.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOATINST.WMF") returned 1
	[0045.596] lstrcmpiA (lpString1="", lpString2="BOATINST.WMF") returned -1
	[0045.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned="BOAT.WMF"
	[0045.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.596] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.596] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.596] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00076_.WMF") returned 1
	[0045.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00076_.WMF") returned 1
	[0045.596] lstrcmpiA (lpString1="", lpString2="BS00076_.WMF") returned -1
	[0045.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned="BOATINST.WMF"
	[0045.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.597] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.597] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.597] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00078_.WMF") returned 1
	[0045.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00078_.WMF") returned 1
	[0045.597] lstrcmpiA (lpString1="", lpString2="BS00078_.WMF") returned -1
	[0045.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned="BS00076_.WMF"
	[0045.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.597] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.597] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.597] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00092_.WMF") returned 1
	[0045.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00092_.WMF") returned 1
	[0045.597] lstrcmpiA (lpString1="", lpString2="BS00092_.WMF") returned -1
	[0045.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned="BS00078_.WMF"
	[0045.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.597] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.597] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.597] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00100_.WMF") returned 1
	[0045.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00100_.WMF") returned 1
	[0045.597] lstrcmpiA (lpString1="", lpString2="BS00100_.WMF") returned -1
	[0045.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned="BS00092_.WMF"
	[0045.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.598] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.598] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00135_.WMF") returned 1
	[0045.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00135_.WMF") returned 1
	[0045.598] lstrcmpiA (lpString1="", lpString2="BS00135_.WMF") returned -1
	[0045.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned="BS00100_.WMF"
	[0045.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.598] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.598] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00136_.WMF") returned 1
	[0045.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00136_.WMF") returned 1
	[0045.598] lstrcmpiA (lpString1="", lpString2="BS00136_.WMF") returned -1
	[0045.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned="BS00135_.WMF"
	[0045.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.598] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.598] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00145_.WMF") returned 1
	[0045.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00145_.WMF") returned 1
	[0045.598] lstrcmpiA (lpString1="", lpString2="BS00145_.WMF") returned -1
	[0045.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned="BS00136_.WMF"
	[0045.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.599] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.599] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00174_.WMF") returned 1
	[0045.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00174_.WMF") returned 1
	[0045.599] lstrcmpiA (lpString1="", lpString2="BS00174_.WMF") returned -1
	[0045.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned="BS00145_.WMF"
	[0045.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.599] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.599] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00184_.WMF") returned 1
	[0045.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00184_.WMF") returned 1
	[0045.599] lstrcmpiA (lpString1="", lpString2="BS00184_.WMF") returned -1
	[0045.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned="BS00174_.WMF"
	[0045.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.599] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.599] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00186_.WMF") returned 1
	[0045.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00186_.WMF") returned 1
	[0045.599] lstrcmpiA (lpString1="", lpString2="BS00186_.WMF") returned -1
	[0045.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned="BS00184_.WMF"
	[0045.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.599] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.600] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00200_.WMF") returned 1
	[0045.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00200_.WMF") returned 1
	[0045.600] lstrcmpiA (lpString1="", lpString2="BS00200_.WMF") returned -1
	[0045.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned="BS00186_.WMF"
	[0045.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.600] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.600] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00224_.WMF") returned 1
	[0045.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00224_.WMF") returned 1
	[0045.600] lstrcmpiA (lpString1="", lpString2="BS00224_.WMF") returned -1
	[0045.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned="BS00200_.WMF"
	[0045.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.600] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.600] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00438_.WMF") returned 1
	[0045.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00438_.WMF") returned 1
	[0045.600] lstrcmpiA (lpString1="", lpString2="BS00438_.WMF") returned -1
	[0045.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned="BS00224_.WMF"
	[0045.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.600] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.600] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00439_.WMF") returned 1
	[0045.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00439_.WMF") returned 1
	[0045.601] lstrcmpiA (lpString1="", lpString2="BS00439_.WMF") returned -1
	[0045.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned="BS00438_.WMF"
	[0045.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.601] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.601] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00440_.WMF") returned 1
	[0045.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00440_.WMF") returned 1
	[0045.601] lstrcmpiA (lpString1="", lpString2="BS00440_.WMF") returned -1
	[0045.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned="BS00439_.WMF"
	[0045.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.601] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.601] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00441_.WMF") returned 1
	[0045.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00441_.WMF") returned 1
	[0045.601] lstrcmpiA (lpString1="", lpString2="BS00441_.WMF") returned -1
	[0045.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned="BS00440_.WMF"
	[0045.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.601] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.601] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00442_.WMF") returned 1
	[0045.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00442_.WMF") returned 1
	[0045.601] lstrcmpiA (lpString1="", lpString2="BS00442_.WMF") returned -1
	[0045.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned="BS00441_.WMF"
	[0045.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.602] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.602] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.602] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00443_.WMF") returned 1
	[0045.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00443_.WMF") returned 1
	[0045.602] lstrcmpiA (lpString1="", lpString2="BS00443_.WMF") returned -1
	[0045.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned="BS00442_.WMF"
	[0045.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.602] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.602] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.602] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00444_.WMF") returned 1
	[0045.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00444_.WMF") returned 1
	[0045.602] lstrcmpiA (lpString1="", lpString2="BS00444_.WMF") returned -1
	[0045.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned="BS00443_.WMF"
	[0045.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.602] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.602] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.602] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00445_.WMF") returned 1
	[0045.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00445_.WMF") returned 1
	[0045.602] lstrcmpiA (lpString1="", lpString2="BS00445_.WMF") returned -1
	[0045.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned="BS00444_.WMF"
	[0045.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.603] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.603] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS00453_.WMF") returned 1
	[0045.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00453_.WMF") returned 1
	[0045.603] lstrcmpiA (lpString1="", lpString2="BS00453_.WMF") returned -1
	[0045.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned="BS00445_.WMF"
	[0045.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.603] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.603] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01080_.WMF") returned 1
	[0045.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01080_.WMF") returned 1
	[0045.603] lstrcmpiA (lpString1="", lpString2="BS01080_.WMF") returned -1
	[0045.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned="BS00453_.WMF"
	[0045.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.603] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.603] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01603_.WMF") returned 1
	[0045.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01603_.WMF") returned 1
	[0045.603] lstrcmpiA (lpString1="", lpString2="BS01603_.WMF") returned -1
	[0045.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned="BS01080_.WMF"
	[0045.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.604] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.604] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.604] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01634_.WMF") returned 1
	[0045.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01634_.WMF") returned 1
	[0045.604] lstrcmpiA (lpString1="", lpString2="BS01634_.WMF") returned -1
	[0045.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned="BS01603_.WMF"
	[0045.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.604] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.604] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.604] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01635_.WMF") returned 1
	[0045.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01635_.WMF") returned 1
	[0045.604] lstrcmpiA (lpString1="", lpString2="BS01635_.WMF") returned -1
	[0045.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned="BS01634_.WMF"
	[0045.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.604] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.627] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.627] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01636_.WMF") returned 1
	[0045.627] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01636_.WMF") returned 1
	[0045.627] lstrcmpiA (lpString1="", lpString2="BS01636_.WMF") returned -1
	[0045.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned="BS01635_.WMF"
	[0045.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.627] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.627] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.627] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.627] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01637_.WMF") returned 1
	[0045.627] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01637_.WMF") returned 1
	[0045.627] lstrcmpiA (lpString1="", lpString2="BS01637_.WMF") returned -1
	[0045.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned="BS01636_.WMF"
	[0045.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.627] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.627] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.627] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.627] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01638_.WMF") returned 1
	[0045.627] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01638_.WMF") returned 1
	[0045.627] lstrcmpiA (lpString1="", lpString2="BS01638_.WMF") returned -1
	[0045.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned="BS01637_.WMF"
	[0045.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.628] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.628] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.628] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS01639_.WMF") returned 1
	[0045.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01639_.WMF") returned 1
	[0045.628] lstrcmpiA (lpString1="", lpString2="BS01639_.WMF") returned -1
	[0045.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned="BS01638_.WMF"
	[0045.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.628] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.628] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.628] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CARBN_01.MID") returned 1
	[0045.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CARBN_01.MID") returned 1
	[0045.628] lstrcmpiA (lpString1="", lpString2="CARBN_01.MID") returned -1
	[0045.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned="BS01639_.WMF"
	[0045.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.628] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.628] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.628] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CG1606.WMF") returned 1
	[0045.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CG1606.WMF") returned 1
	[0045.628] lstrcmpiA (lpString1="", lpString2="CG1606.WMF") returned -1
	[0045.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned="CARBN_01.MID"
	[0045.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.629] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.629] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.629] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CLASSIC1.WMF") returned 1
	[0045.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLASSIC1.WMF") returned 1
	[0045.629] lstrcmpiA (lpString1="", lpString2="CLASSIC1.WMF") returned -1
	[0045.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned="CG1606.WMF"
	[0045.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.629] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.629] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.629] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CLASSIC2.WMF") returned 1
	[0045.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLASSIC2.WMF") returned 1
	[0045.629] lstrcmpiA (lpString1="", lpString2="CLASSIC2.WMF") returned -1
	[0045.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned="CLASSIC1.WMF"
	[0045.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.629] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.629] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.629] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CLIP.WMF") returned 1
	[0045.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLIP.WMF") returned 1
	[0045.629] lstrcmpiA (lpString1="", lpString2="CLIP.WMF") returned -1
	[0045.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned="CLASSIC2.WMF"
	[0045.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.629] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.630] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.630] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CMNTY_01.MID") returned 1
	[0045.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CMNTY_01.MID") returned 1
	[0045.630] lstrcmpiA (lpString1="", lpString2="CMNTY_01.MID") returned -1
	[0045.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned="CLIP.WMF"
	[0045.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\"
	[0045.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned=""
	[0045.630] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.630] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.630] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CRANE.WMF") returned 1
	[0045.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CRANE.WMF") returned 1
	[0045.630] lstrcmpiA (lpString1="", lpString2="CRANE.WMF") returned -1
	[0045.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned="CMNTY_01.MID"
	[0045.630] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.630] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.630] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CRANINST.WMF") returned 1
	[0045.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CRANINST.WMF") returned 1
	[0045.630] lstrcmpiA (lpString1="", lpString2="CRANINST.WMF") returned -1
	[0045.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned="CRANE.WMF"
	[0045.630] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.630] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.630] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CUP.WMF") returned 1
	[0045.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CUP.WMF") returned 1
	[0045.630] lstrcmpiA (lpString1="", lpString2="CUP.WMF") returned -1
	[0045.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned="CRANINST.WMF"
	[0045.630] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.631] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.631] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CUPINST.WMF") returned 1
	[0045.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CUPINST.WMF") returned 1
	[0045.631] lstrcmpiA (lpString1="", lpString2="CUPINST.WMF") returned -1
	[0045.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned="CUP.WMF"
	[0045.631] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.631] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned="CUPINST.WMF"
	[0045.631] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.631] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned="DD00117_.WMF"
	[0045.631] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.631] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned="DD00121_.WMF"
	[0045.631] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.631] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned="DD00234_.WMF"
	[0045.631] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.631] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned="DD00255_.WMF"
	[0045.632] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.632] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned="DD00256_.WMF"
	[0045.632] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.632] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned="DD00261_.WMF"
	[0045.632] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.632] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned="DD00297_.WMF"
	[0045.632] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.632] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned="DD00372_.WMF"
	[0045.632] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.632] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned="DD00405_.WMF"
	[0045.632] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.632] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned="DD00407_.WMF"
	[0045.633] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned="DD00413_.WMF"
	[0045.633] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned="DD00414_.WMF"
	[0045.633] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned="DD00419_.WMF"
	[0045.633] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned="DD00437_.WMF"
	[0045.633] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned="DD00448_.WMF"
	[0045.633] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned="DD00449_.WMF"
	[0045.634] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.634] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned="DD00687_.WMF"
	[0045.634] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.634] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned="DD00705_.WMF"
	[0045.634] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.634] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned="DD01015_.WMF"
	[0045.634] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned="DD01039_.WMF"
	[0045.635] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned="DD01138_.WMF"
	[0045.635] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned="DD01139_.WMF"
	[0045.635] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned="DD01140_.WMF"
	[0045.635] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned="DD01143_.WMF"
	[0045.636] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned="DD01145_.WMF"
	[0045.636] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned="DD01146_.WMF"
	[0045.636] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned="DD01151_.WMF"
	[0045.636] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned="DD01152_.WMF"
	[0045.642] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.642] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned="DD01157_.WMF"
	[0045.642] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.642] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned="DD01160_.WMF"
	[0045.642] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.642] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned="DD01162_.WMF"
	[0045.642] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.642] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.642] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.642] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.643] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.644] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.645] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.645] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.645] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.645] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.645] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.646] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.647] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.648] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.649] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.650] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.650] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.651] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.651] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.651] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.652] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.653] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.654] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.655] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.655] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.655] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.655] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.655] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.655] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.655] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.657] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.657] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.657] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.662] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.663] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.663] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.663] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.663] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.673] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.673] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.673] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.673] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.673] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.673] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.673] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.673] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.673] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.673] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.673] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.673] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.674] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.675] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.676] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.676] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.676] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.676] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.676] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.676] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.676] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.676] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.676] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.677] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.677] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.677] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.677] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.677] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.677] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.678] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.678] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.678] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.678] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.678] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0045.678] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0045.706] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.706] CloseHandle (hObject=0x8c) returned 1
	[0045.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.boom")) returned 1
	[0045.737] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.738] CloseHandle (hObject=0x8c) returned 1
	[0045.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.boom")) returned 1
	[0045.754] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.754] CloseHandle (hObject=0x8c) returned 1
	[0045.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.boom")) returned 1
	[0045.772] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.772] CloseHandle (hObject=0x8c) returned 1
	[0045.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.boom")) returned 1
	[0045.787] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.787] CloseHandle (hObject=0x8c) returned 1
	[0045.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.boom")) returned 1
	[0045.803] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.803] CloseHandle (hObject=0x8c) returned 1
	[0045.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.boom")) returned 1
	[0045.821] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.821] CloseHandle (hObject=0x8c) returned 1
	[0045.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.boom")) returned 1
	[0045.830] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.830] CloseHandle (hObject=0x8c) returned 1
	[0045.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.boom")) returned 1
	[0045.843] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.843] CloseHandle (hObject=0x8c) returned 1
	[0045.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.boom")) returned 1
	[0045.874] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.874] CloseHandle (hObject=0x8c) returned 1
	[0045.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.boom")) returned 1
	[0045.909] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.909] CloseHandle (hObject=0x8c) returned 1
	[0045.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.boom")) returned 1
	[0045.917] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.917] CloseHandle (hObject=0x8c) returned 1
	[0045.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.boom")) returned 1
	[0045.922] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.922] CloseHandle (hObject=0x8c) returned 1
	[0045.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.boom")) returned 1
	[0045.926] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.926] CloseHandle (hObject=0x8c) returned 1
	[0045.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.boom")) returned 1
	[0045.982] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0045.982] CloseHandle (hObject=0x8c) returned 1
	[0045.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.boom")) returned 1
	[0046.002] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.002] CloseHandle (hObject=0x8c) returned 1
	[0046.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.boom")) returned 1
	[0046.005] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.005] CloseHandle (hObject=0x8c) returned 1
	[0046.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.boom")) returned 1
	[0046.019] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.019] CloseHandle (hObject=0x8c) returned 1
	[0046.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.boom")) returned 1
	[0046.039] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.040] CloseHandle (hObject=0x8c) returned 1
	[0046.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.boom")) returned 1
	[0046.061] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.061] CloseHandle (hObject=0x8c) returned 1
	[0046.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.boom")) returned 1
	[0046.093] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.093] CloseHandle (hObject=0x8c) returned 1
	[0046.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.boom")) returned 1
	[0046.132] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.132] CloseHandle (hObject=0x8c) returned 1
	[0046.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.boom")) returned 1
	[0046.157] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.157] CloseHandle (hObject=0x8c) returned 1
	[0046.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.boom")) returned 1
	[0046.177] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.177] CloseHandle (hObject=0x8c) returned 1
	[0046.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.boom")) returned 1
	[0046.190] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.190] CloseHandle (hObject=0x8c) returned 1
	[0046.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.boom")) returned 1
	[0046.219] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.219] CloseHandle (hObject=0x8c) returned 1
	[0046.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.boom")) returned 1
	[0046.230] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.230] CloseHandle (hObject=0x8c) returned 1
	[0046.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.boom")) returned 1
	[0046.248] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.248] CloseHandle (hObject=0x8c) returned 1
	[0046.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.boom")) returned 1
	[0046.274] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.274] CloseHandle (hObject=0x8c) returned 1
	[0046.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.boom")) returned 1
	[0046.282] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.282] CloseHandle (hObject=0x8c) returned 1
	[0046.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.boom")) returned 1
	[0046.290] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.290] CloseHandle (hObject=0x8c) returned 1
	[0046.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.boom")) returned 1
	[0046.301] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.301] CloseHandle (hObject=0x8c) returned 1
	[0046.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.boom")) returned 1
	[0046.320] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.320] CloseHandle (hObject=0x8c) returned 1
	[0046.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.boom")) returned 1
	[0046.323] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.323] CloseHandle (hObject=0x8c) returned 1
	[0046.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.boom")) returned 1
	[0046.333] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.333] CloseHandle (hObject=0x8c) returned 1
	[0046.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.boom")) returned 1
	[0046.338] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.338] CloseHandle (hObject=0x8c) returned 1
	[0046.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.boom")) returned 1
	[0046.367] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.367] CloseHandle (hObject=0x8c) returned 1
	[0046.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.boom")) returned 1
	[0046.370] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.370] CloseHandle (hObject=0x8c) returned 1
	[0046.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.boom")) returned 1
	[0046.373] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.373] CloseHandle (hObject=0x8c) returned 1
	[0046.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.boom")) returned 1
	[0046.376] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.376] CloseHandle (hObject=0x8c) returned 1
	[0046.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.boom")) returned 1
	[0046.388] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.388] CloseHandle (hObject=0x8c) returned 1
	[0046.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.boom")) returned 1
	[0046.425] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.425] CloseHandle (hObject=0x8c) returned 1
	[0046.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.boom")) returned 1
	[0046.467] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.467] CloseHandle (hObject=0x8c) returned 1
	[0046.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.boom")) returned 1
	[0046.485] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.485] CloseHandle (hObject=0x8c) returned 1
	[0046.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.boom")) returned 1
	[0046.487] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.487] CloseHandle (hObject=0x8c) returned 1
	[0046.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.boom")) returned 1
	[0046.498] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.498] CloseHandle (hObject=0x8c) returned 1
	[0046.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.boom")) returned 1
	[0046.502] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.502] CloseHandle (hObject=0x8c) returned 1
	[0046.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.boom")) returned 1
	[0046.511] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.512] CloseHandle (hObject=0x8c) returned 1
	[0046.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.boom")) returned 1
	[0046.549] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.549] CloseHandle (hObject=0x8c) returned 1
	[0046.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.boom")) returned 1
	[0046.551] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.551] CloseHandle (hObject=0x8c) returned 1
	[0046.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.boom")) returned 1
	[0046.585] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.585] CloseHandle (hObject=0x8c) returned 1
	[0046.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.boom")) returned 1
	[0046.612] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.612] CloseHandle (hObject=0x8c) returned 1
	[0046.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.boom")) returned 1
	[0046.631] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.631] CloseHandle (hObject=0x8c) returned 1
	[0046.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.boom")) returned 1
	[0046.641] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.642] CloseHandle (hObject=0x8c) returned 1
	[0046.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.boom")) returned 1
	[0046.660] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.660] CloseHandle (hObject=0x8c) returned 1
	[0046.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.boom")) returned 1
	[0046.678] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.679] CloseHandle (hObject=0x8c) returned 1
	[0046.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.boom")) returned 1
	[0046.710] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.710] CloseHandle (hObject=0x8c) returned 1
	[0046.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.boom")) returned 1
	[0046.731] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.731] CloseHandle (hObject=0x8c) returned 1
	[0046.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.boom")) returned 1
	[0046.742] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.743] CloseHandle (hObject=0x8c) returned 1
	[0046.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.boom")) returned 1
	[0046.760] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.760] CloseHandle (hObject=0x8c) returned 1
	[0046.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.boom")) returned 1
	[0046.770] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.770] CloseHandle (hObject=0x8c) returned 1
	[0046.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.boom")) returned 1
	[0046.794] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.794] CloseHandle (hObject=0x8c) returned 1
	[0046.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.boom")) returned 1
	[0046.801] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.801] CloseHandle (hObject=0x8c) returned 1
	[0046.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.boom")) returned 1
	[0046.811] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.812] CloseHandle (hObject=0x8c) returned 1
	[0046.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.boom")) returned 1
	[0046.822] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.823] CloseHandle (hObject=0x8c) returned 1
	[0046.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.boom")) returned 1
	[0046.836] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.836] CloseHandle (hObject=0x8c) returned 1
	[0046.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.boom")) returned 1
	[0046.882] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.882] CloseHandle (hObject=0x8c) returned 1
	[0046.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.boom")) returned 1
	[0046.894] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.894] CloseHandle (hObject=0x8c) returned 1
	[0046.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.boom")) returned 1
	[0046.908] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.908] CloseHandle (hObject=0x8c) returned 1
	[0046.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.boom")) returned 1
	[0046.914] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.914] CloseHandle (hObject=0x8c) returned 1
	[0046.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.boom")) returned 1
	[0046.930] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.930] CloseHandle (hObject=0x8c) returned 1
	[0046.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.boom")) returned 1
	[0046.944] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.944] CloseHandle (hObject=0x8c) returned 1
	[0046.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.boom")) returned 1
	[0046.953] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.953] CloseHandle (hObject=0x8c) returned 1
	[0046.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.boom")) returned 1
	[0046.962] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.962] CloseHandle (hObject=0x8c) returned 1
	[0046.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.boom")) returned 1
	[0046.967] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.967] CloseHandle (hObject=0x8c) returned 1
	[0046.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.boom")) returned 1
	[0046.982] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.982] CloseHandle (hObject=0x8c) returned 1
	[0046.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.boom")) returned 1
	[0046.996] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0046.996] CloseHandle (hObject=0x8c) returned 1
	[0046.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.boom")) returned 1
	[0047.006] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.006] CloseHandle (hObject=0x8c) returned 1
	[0047.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.boom")) returned 1
	[0047.009] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.010] CloseHandle (hObject=0x8c) returned 1
	[0047.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.boom")) returned 1
	[0047.016] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.016] CloseHandle (hObject=0x8c) returned 1
	[0047.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.boom")) returned 1
	[0047.038] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.039] CloseHandle (hObject=0x8c) returned 1
	[0047.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.boom")) returned 1
	[0047.061] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.061] CloseHandle (hObject=0x8c) returned 1
	[0047.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.boom")) returned 1
	[0047.065] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.065] CloseHandle (hObject=0x8c) returned 1
	[0047.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.boom")) returned 1
	[0047.077] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.077] CloseHandle (hObject=0x8c) returned 1
	[0047.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.boom")) returned 1
	[0047.090] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.090] CloseHandle (hObject=0x8c) returned 1
	[0047.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.boom")) returned 1
	[0047.108] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.109] CloseHandle (hObject=0x8c) returned 1
	[0047.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.boom")) returned 1
	[0047.124] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.124] CloseHandle (hObject=0x8c) returned 1
	[0047.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.boom")) returned 1
	[0047.127] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.127] CloseHandle (hObject=0x8c) returned 1
	[0047.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.boom")) returned 1
	[0047.138] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.138] CloseHandle (hObject=0x8c) returned 1
	[0047.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.boom")) returned 1
	[0047.159] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.159] CloseHandle (hObject=0x8c) returned 1
	[0047.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.boom")) returned 1
	[0047.183] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.183] CloseHandle (hObject=0x8c) returned 1
	[0047.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.boom")) returned 1
	[0047.214] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.214] CloseHandle (hObject=0x8c) returned 1
	[0047.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.boom")) returned 1
	[0047.231] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.232] CloseHandle (hObject=0x8c) returned 1
	[0047.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.boom")) returned 1
	[0047.257] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.257] CloseHandle (hObject=0x8c) returned 1
	[0047.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.boom")) returned 1
	[0047.319] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.319] CloseHandle (hObject=0x8c) returned 1
	[0047.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.boom")) returned 1
	[0047.347] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.347] CloseHandle (hObject=0x8c) returned 1
	[0047.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.boom")) returned 1
	[0047.385] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.385] CloseHandle (hObject=0x8c) returned 1
	[0047.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.boom")) returned 1
	[0047.393] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.393] CloseHandle (hObject=0x8c) returned 1
	[0047.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.boom")) returned 1
	[0047.403] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.403] CloseHandle (hObject=0x8c) returned 1
	[0047.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.boom")) returned 1
	[0047.405] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.405] CloseHandle (hObject=0x8c) returned 1
	[0047.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.boom")) returned 1
	[0047.423] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.423] CloseHandle (hObject=0x8c) returned 1
	[0047.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.boom")) returned 1
	[0047.445] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.445] CloseHandle (hObject=0x8c) returned 1
	[0047.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.boom")) returned 1
	[0047.454] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.454] CloseHandle (hObject=0x8c) returned 1
	[0047.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.boom")) returned 1
	[0047.474] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.474] CloseHandle (hObject=0x8c) returned 1
	[0047.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.boom")) returned 1
	[0047.476] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.476] CloseHandle (hObject=0x8c) returned 1
	[0047.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.boom")) returned 1
	[0047.494] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.494] CloseHandle (hObject=0x8c) returned 1
	[0047.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.boom")) returned 1
	[0047.517] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.517] CloseHandle (hObject=0x8c) returned 1
	[0047.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.boom")) returned 1
	[0047.521] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.521] CloseHandle (hObject=0x8c) returned 1
	[0047.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.boom")) returned 1
	[0047.542] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.542] CloseHandle (hObject=0x8c) returned 1
	[0047.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.boom")) returned 1
	[0047.564] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.564] CloseHandle (hObject=0x8c) returned 1
	[0047.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.boom")) returned 1
	[0047.572] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.572] CloseHandle (hObject=0x8c) returned 1
	[0047.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.boom")) returned 1
	[0047.595] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.595] CloseHandle (hObject=0x8c) returned 1
	[0047.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.boom")) returned 1
	[0047.610] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.610] CloseHandle (hObject=0x8c) returned 1
	[0047.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.boom")) returned 1
	[0047.640] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.640] CloseHandle (hObject=0x8c) returned 1
	[0047.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.boom")) returned 1
	[0047.690] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.690] CloseHandle (hObject=0x8c) returned 1
	[0047.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.boom")) returned 1
	[0047.707] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.707] CloseHandle (hObject=0x8c) returned 1
	[0047.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.boom")) returned 1
	[0047.716] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.717] CloseHandle (hObject=0x8c) returned 1
	[0047.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.boom")) returned 1
	[0047.740] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.740] CloseHandle (hObject=0x8c) returned 1
	[0047.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.boom")) returned 1
	[0047.758] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.758] CloseHandle (hObject=0x8c) returned 1
	[0047.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.boom")) returned 1
	[0047.780] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.780] CloseHandle (hObject=0x8c) returned 1
	[0047.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.boom")) returned 1
	[0047.783] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.783] CloseHandle (hObject=0x8c) returned 1
	[0047.783] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.boom")) returned 1
	[0047.807] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.808] CloseHandle (hObject=0x8c) returned 1
	[0047.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.boom")) returned 1
	[0047.825] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.825] CloseHandle (hObject=0x8c) returned 1
	[0047.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.boom")) returned 1
	[0047.838] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.838] CloseHandle (hObject=0x8c) returned 1
	[0047.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.boom")) returned 1
	[0047.861] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.861] CloseHandle (hObject=0x8c) returned 1
	[0047.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.boom")) returned 1
	[0047.869] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.869] CloseHandle (hObject=0x8c) returned 1
	[0047.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.boom")) returned 1
	[0047.891] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.891] CloseHandle (hObject=0x8c) returned 1
	[0047.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.boom")) returned 1
	[0047.901] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.901] CloseHandle (hObject=0x8c) returned 1
	[0047.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.boom")) returned 1
	[0047.924] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.924] CloseHandle (hObject=0x8c) returned 1
	[0047.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.boom")) returned 1
	[0047.958] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.958] CloseHandle (hObject=0x8c) returned 1
	[0047.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.boom")) returned 1
	[0047.972] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0047.972] CloseHandle (hObject=0x8c) returned 1
	[0047.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.boom")) returned 1
	[0048.018] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.018] CloseHandle (hObject=0x8c) returned 1
	[0048.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.boom")) returned 1
	[0048.046] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.046] CloseHandle (hObject=0x8c) returned 1
	[0048.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.boom")) returned 1
	[0048.055] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.055] CloseHandle (hObject=0x8c) returned 1
	[0048.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.boom")) returned 1
	[0048.071] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.071] CloseHandle (hObject=0x8c) returned 1
	[0048.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.boom")) returned 1
	[0048.111] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.111] CloseHandle (hObject=0x8c) returned 1
	[0048.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.boom")) returned 1
	[0048.126] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.126] CloseHandle (hObject=0x8c) returned 1
	[0048.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.boom")) returned 1
	[0048.132] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.132] CloseHandle (hObject=0x8c) returned 1
	[0048.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.boom")) returned 1
	[0048.135] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.136] CloseHandle (hObject=0x8c) returned 1
	[0048.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.boom")) returned 1
	[0048.157] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.157] CloseHandle (hObject=0x8c) returned 1
	[0048.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.boom")) returned 1
	[0048.172] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.172] CloseHandle (hObject=0x8c) returned 1
	[0048.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.boom")) returned 1
	[0048.176] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.176] CloseHandle (hObject=0x8c) returned 1
	[0048.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.boom")) returned 1
	[0048.189] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.189] CloseHandle (hObject=0x8c) returned 1
	[0048.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.boom")) returned 1
	[0048.201] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.201] CloseHandle (hObject=0x8c) returned 1
	[0048.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.boom")) returned 1
	[0048.204] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.205] CloseHandle (hObject=0x8c) returned 1
	[0048.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.boom")) returned 1
	[0048.209] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.209] CloseHandle (hObject=0x8c) returned 1
	[0048.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.boom")) returned 1
	[0048.213] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.213] CloseHandle (hObject=0x8c) returned 1
	[0048.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.boom")) returned 1
	[0048.235] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.235] CloseHandle (hObject=0x8c) returned 1
	[0048.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.boom")) returned 1
	[0048.239] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.239] CloseHandle (hObject=0x8c) returned 1
	[0048.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.boom")) returned 1
	[0048.258] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.258] CloseHandle (hObject=0x8c) returned 1
	[0048.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.boom")) returned 1
	[0048.262] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.262] CloseHandle (hObject=0x8c) returned 1
	[0048.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.boom")) returned 1
	[0048.275] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.275] CloseHandle (hObject=0x8c) returned 1
	[0048.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.boom")) returned 1
	[0048.278] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.279] CloseHandle (hObject=0x8c) returned 1
	[0048.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.boom")) returned 1
	[0048.320] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.320] CloseHandle (hObject=0x8c) returned 1
	[0048.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.boom")) returned 1
	[0048.325] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.326] CloseHandle (hObject=0x8c) returned 1
	[0048.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.boom")) returned 1
	[0048.329] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.329] CloseHandle (hObject=0x8c) returned 1
	[0048.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.boom")) returned 1
	[0048.333] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.333] CloseHandle (hObject=0x8c) returned 1
	[0048.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.boom")) returned 1
	[0048.339] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.339] CloseHandle (hObject=0x8c) returned 1
	[0048.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.boom")) returned 1
	[0048.355] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.355] CloseHandle (hObject=0x8c) returned 1
	[0048.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.boom")) returned 1
	[0048.377] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.377] CloseHandle (hObject=0x8c) returned 1
	[0048.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.boom")) returned 1
	[0048.380] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.380] CloseHandle (hObject=0x8c) returned 1
	[0048.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.boom")) returned 1
	[0048.416] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.416] CloseHandle (hObject=0x8c) returned 1
	[0048.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.boom")) returned 1
	[0048.422] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.422] CloseHandle (hObject=0x8c) returned 1
	[0048.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.boom")) returned 1
	[0048.424] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.425] CloseHandle (hObject=0x8c) returned 1
	[0048.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.boom")) returned 1
	[0048.435] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.435] CloseHandle (hObject=0x8c) returned 1
	[0048.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.boom")) returned 1
	[0048.437] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.437] CloseHandle (hObject=0x8c) returned 1
	[0048.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.boom")) returned 1
	[0048.444] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.444] CloseHandle (hObject=0x8c) returned 1
	[0048.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.boom")) returned 1
	[0048.447] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.447] CloseHandle (hObject=0x8c) returned 1
	[0048.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.boom")) returned 1
	[0048.455] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.455] CloseHandle (hObject=0x8c) returned 1
	[0048.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.boom")) returned 1
	[0048.458] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.458] CloseHandle (hObject=0x8c) returned 1
	[0048.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.boom")) returned 1
	[0048.461] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.461] CloseHandle (hObject=0x8c) returned 1
	[0048.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.boom")) returned 1
	[0048.463] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.464] CloseHandle (hObject=0x8c) returned 1
	[0048.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.boom")) returned 1
	[0048.469] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.469] CloseHandle (hObject=0x8c) returned 1
	[0048.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.boom")) returned 1
	[0048.481] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.481] CloseHandle (hObject=0x8c) returned 1
	[0048.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.boom")) returned 1
	[0048.516] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.516] CloseHandle (hObject=0x8c) returned 1
	[0048.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.boom")) returned 1
	[0048.520] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.520] CloseHandle (hObject=0x8c) returned 1
	[0048.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.boom")) returned 1
	[0048.523] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.524] CloseHandle (hObject=0x8c) returned 1
	[0048.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.boom")) returned 1
	[0048.527] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.527] CloseHandle (hObject=0x8c) returned 1
	[0048.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.boom")) returned 1
	[0048.534] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.534] CloseHandle (hObject=0x8c) returned 1
	[0048.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.boom")) returned 1
	[0048.568] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.569] CloseHandle (hObject=0x8c) returned 1
	[0048.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.boom")) returned 1
	[0048.579] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.579] CloseHandle (hObject=0x8c) returned 1
	[0048.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.boom")) returned 1
	[0048.586] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.586] CloseHandle (hObject=0x8c) returned 1
	[0048.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.boom")) returned 1
	[0048.604] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.604] CloseHandle (hObject=0x8c) returned 1
	[0048.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.boom")) returned 1
	[0048.607] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.607] CloseHandle (hObject=0x8c) returned 1
	[0048.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.boom")) returned 1
	[0048.628] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.628] CloseHandle (hObject=0x8c) returned 1
	[0048.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.boom")) returned 1
	[0048.638] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.638] CloseHandle (hObject=0x8c) returned 1
	[0048.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.boom")) returned 1
	[0048.641] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.641] CloseHandle (hObject=0x8c) returned 1
	[0048.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.boom")) returned 1
	[0048.643] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.643] CloseHandle (hObject=0x8c) returned 1
	[0048.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.boom")) returned 1
	[0048.675] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.675] CloseHandle (hObject=0x8c) returned 1
	[0048.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.boom")) returned 1
	[0048.677] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.678] CloseHandle (hObject=0x8c) returned 1
	[0048.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.boom")) returned 1
	[0048.693] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.693] CloseHandle (hObject=0x8c) returned 1
	[0048.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.boom")) returned 1
	[0048.696] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.696] CloseHandle (hObject=0x8c) returned 1
	[0048.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.boom")) returned 1
	[0048.698] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.699] CloseHandle (hObject=0x8c) returned 1
	[0048.699] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.boom")) returned 1
	[0048.703] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.703] CloseHandle (hObject=0x8c) returned 1
	[0048.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.boom")) returned 1
	[0048.706] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.706] CloseHandle (hObject=0x8c) returned 1
	[0048.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.boom")) returned 1
	[0048.709] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.709] CloseHandle (hObject=0x8c) returned 1
	[0048.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.boom")) returned 1
	[0048.738] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.738] CloseHandle (hObject=0x8c) returned 1
	[0048.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.boom")) returned 1
	[0048.740] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.740] CloseHandle (hObject=0x8c) returned 1
	[0048.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.boom")) returned 1
	[0048.749] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.749] CloseHandle (hObject=0x8c) returned 1
	[0048.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.boom")) returned 1
	[0048.752] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.752] CloseHandle (hObject=0x8c) returned 1
	[0048.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.boom")) returned 1
	[0048.766] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.766] CloseHandle (hObject=0x8c) returned 1
	[0048.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.boom")) returned 1
	[0048.769] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.769] CloseHandle (hObject=0x8c) returned 1
	[0048.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.boom")) returned 1
	[0048.782] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.782] CloseHandle (hObject=0x8c) returned 1
	[0048.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.boom")) returned 1
	[0048.786] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.786] CloseHandle (hObject=0x8c) returned 1
	[0048.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.boom")) returned 1
	[0048.788] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.788] CloseHandle (hObject=0x8c) returned 1
	[0048.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.boom")) returned 1
	[0048.802] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.802] CloseHandle (hObject=0x8c) returned 1
	[0048.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.boom")) returned 1
	[0048.805] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.805] CloseHandle (hObject=0x8c) returned 1
	[0048.805] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.boom")) returned 1
	[0048.823] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.823] CloseHandle (hObject=0x8c) returned 1
	[0048.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.boom")) returned 1
	[0048.844] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.844] CloseHandle (hObject=0x8c) returned 1
	[0048.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.boom")) returned 1
	[0048.847] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.847] CloseHandle (hObject=0x8c) returned 1
	[0048.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.boom")) returned 1
	[0048.858] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.858] CloseHandle (hObject=0x8c) returned 1
	[0048.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.boom")) returned 1
	[0048.861] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.861] CloseHandle (hObject=0x8c) returned 1
	[0048.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.boom")) returned 1
	[0048.869] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.869] CloseHandle (hObject=0x8c) returned 1
	[0048.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.boom")) returned 1
	[0048.872] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.872] CloseHandle (hObject=0x8c) returned 1
	[0048.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.boom")) returned 1
	[0048.881] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.881] CloseHandle (hObject=0x8c) returned 1
	[0048.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.boom")) returned 1
	[0048.884] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.884] CloseHandle (hObject=0x8c) returned 1
	[0048.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.boom")) returned 1
	[0048.893] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.893] CloseHandle (hObject=0x8c) returned 1
	[0048.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.boom")) returned 1
	[0048.901] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.901] CloseHandle (hObject=0x8c) returned 1
	[0048.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.boom")) returned 1
	[0048.907] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.908] CloseHandle (hObject=0x8c) returned 1
	[0048.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.boom")) returned 1
	[0048.916] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.916] CloseHandle (hObject=0x8c) returned 1
	[0048.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.boom")) returned 1
	[0048.919] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.919] CloseHandle (hObject=0x8c) returned 1
	[0048.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.boom")) returned 1
	[0048.967] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.967] CloseHandle (hObject=0x8c) returned 1
	[0048.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.boom")) returned 1
	[0048.978] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.978] CloseHandle (hObject=0x8c) returned 1
	[0048.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.boom")) returned 1
	[0048.981] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.981] CloseHandle (hObject=0x8c) returned 1
	[0048.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.boom")) returned 1
	[0048.984] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0048.984] CloseHandle (hObject=0x8c) returned 1
	[0048.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.boom")) returned 1
	[0049.007] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.007] CloseHandle (hObject=0x8c) returned 1
	[0049.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.boom")) returned 1
	[0049.028] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.028] CloseHandle (hObject=0x8c) returned 1
	[0049.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.boom")) returned 1
	[0049.031] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.031] CloseHandle (hObject=0x8c) returned 1
	[0049.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.boom")) returned 1
	[0049.033] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.034] CloseHandle (hObject=0x8c) returned 1
	[0049.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.boom")) returned 1
	[0049.036] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.036] CloseHandle (hObject=0x8c) returned 1
	[0049.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.boom")) returned 1
	[0049.039] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.039] CloseHandle (hObject=0x8c) returned 1
	[0049.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.boom")) returned 1
	[0049.042] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.042] CloseHandle (hObject=0x8c) returned 1
	[0049.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.boom")) returned 1
	[0049.046] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.046] CloseHandle (hObject=0x8c) returned 1
	[0049.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.boom")) returned 1
	[0049.056] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.056] CloseHandle (hObject=0x8c) returned 1
	[0049.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.boom")) returned 1
	[0049.071] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.071] CloseHandle (hObject=0x8c) returned 1
	[0049.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.boom")) returned 1
	[0049.075] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.075] CloseHandle (hObject=0x8c) returned 1
	[0049.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.boom")) returned 1
	[0049.088] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.088] CloseHandle (hObject=0x8c) returned 1
	[0049.089] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.boom")) returned 1
	[0049.114] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.114] CloseHandle (hObject=0x8c) returned 1
	[0049.114] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.boom")) returned 1
	[0049.124] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.125] CloseHandle (hObject=0x8c) returned 1
	[0049.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.boom")) returned 1
	[0049.148] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.148] CloseHandle (hObject=0x8c) returned 1
	[0049.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.boom")) returned 1
	[0049.151] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.151] CloseHandle (hObject=0x8c) returned 1
	[0049.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.boom")) returned 1
	[0049.153] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.154] CloseHandle (hObject=0x8c) returned 1
	[0049.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.boom")) returned 1
	[0049.156] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.156] CloseHandle (hObject=0x8c) returned 1
	[0049.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.boom")) returned 1
	[0049.180] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.180] CloseHandle (hObject=0x8c) returned 1
	[0049.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.boom")) returned 1
	[0049.186] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.186] CloseHandle (hObject=0x8c) returned 1
	[0049.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.boom")) returned 1
	[0049.188] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.188] CloseHandle (hObject=0x8c) returned 1
	[0049.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.boom")) returned 1
	[0049.195] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.195] CloseHandle (hObject=0x8c) returned 1
	[0049.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.boom")) returned 1
	[0049.203] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.203] CloseHandle (hObject=0x8c) returned 1
	[0049.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.boom")) returned 1
	[0049.213] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.213] CloseHandle (hObject=0x8c) returned 1
	[0049.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.boom")) returned 1
	[0049.220] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.220] CloseHandle (hObject=0x8c) returned 1
	[0049.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.boom")) returned 1
	[0049.251] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.251] CloseHandle (hObject=0x8c) returned 1
	[0049.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.boom")) returned 1
	[0049.254] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.254] CloseHandle (hObject=0x8c) returned 1
	[0049.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.boom")) returned 1
	[0049.319] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.319] CloseHandle (hObject=0x8c) returned 1
	[0049.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.boom")) returned 1
	[0049.336] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.336] CloseHandle (hObject=0x8c) returned 1
	[0049.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.boom")) returned 1
	[0049.339] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.340] CloseHandle (hObject=0x8c) returned 1
	[0049.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.boom")) returned 1
	[0049.470] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.470] CloseHandle (hObject=0x8c) returned 1
	[0049.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.boom")) returned 1
	[0049.472] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.472] CloseHandle (hObject=0x8c) returned 1
	[0049.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.boom")) returned 1
	[0049.474] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.474] CloseHandle (hObject=0x8c) returned 1
	[0049.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.boom")) returned 1
	[0049.476] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.476] CloseHandle (hObject=0x8c) returned 1
	[0049.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.boom")) returned 1
	[0049.477] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.478] CloseHandle (hObject=0x8c) returned 1
	[0049.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.boom")) returned 1
	[0049.480] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.480] CloseHandle (hObject=0x8c) returned 1
	[0049.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.boom")) returned 1
	[0049.481] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.482] CloseHandle (hObject=0x8c) returned 1
	[0049.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.boom")) returned 1
	[0049.484] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.484] CloseHandle (hObject=0x8c) returned 1
	[0049.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.boom")) returned 1
	[0049.486] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.486] CloseHandle (hObject=0x8c) returned 1
	[0049.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.boom")) returned 1
	[0049.489] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.489] CloseHandle (hObject=0x8c) returned 1
	[0049.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.boom")) returned 1
	[0049.491] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.491] CloseHandle (hObject=0x8c) returned 1
	[0049.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.boom")) returned 1
	[0049.502] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.502] CloseHandle (hObject=0x8c) returned 1
	[0049.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.boom")) returned 1
	[0049.503] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.504] CloseHandle (hObject=0x8c) returned 1
	[0049.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.boom")) returned 1
	[0049.505] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.505] CloseHandle (hObject=0x8c) returned 1
	[0049.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.boom")) returned 1
	[0049.507] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.507] CloseHandle (hObject=0x8c) returned 1
	[0049.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.boom")) returned 1
	[0049.512] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.512] CloseHandle (hObject=0x8c) returned 1
	[0049.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.boom")) returned 1
	[0049.514] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.516] CloseHandle (hObject=0x8c) returned 1
	[0049.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.boom")) returned 1
	[0049.517] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.517] CloseHandle (hObject=0x8c) returned 1
	[0049.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.boom")) returned 1
	[0049.521] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.521] CloseHandle (hObject=0x8c) returned 1
	[0049.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.boom")) returned 1
	[0049.524] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.524] CloseHandle (hObject=0x8c) returned 1
	[0049.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.boom")) returned 1
	[0049.527] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.527] CloseHandle (hObject=0x8c) returned 1
	[0049.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.boom")) returned 1
	[0049.529] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.529] CloseHandle (hObject=0x8c) returned 1
	[0049.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.boom")) returned 1
	[0049.530] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.530] CloseHandle (hObject=0x8c) returned 1
	[0049.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.boom")) returned 1
	[0049.542] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.542] CloseHandle (hObject=0x8c) returned 1
	[0049.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.boom")) returned 1
	[0049.545] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.545] CloseHandle (hObject=0x8c) returned 1
	[0049.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.boom")) returned 1
	[0049.582] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.582] CloseHandle (hObject=0x8c) returned 1
	[0049.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.boom")) returned 1
	[0049.584] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.584] CloseHandle (hObject=0x8c) returned 1
	[0049.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.boom")) returned 1
	[0049.587] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.587] CloseHandle (hObject=0x8c) returned 1
	[0049.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.boom")) returned 1
	[0049.590] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.590] CloseHandle (hObject=0x8c) returned 1
	[0049.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.boom")) returned 1
	[0049.600] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.600] CloseHandle (hObject=0x8c) returned 1
	[0049.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.boom")) returned 1
	[0049.608] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.609] CloseHandle (hObject=0x8c) returned 1
	[0049.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.boom")) returned 1
	[0049.611] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.611] CloseHandle (hObject=0x8c) returned 1
	[0049.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.boom")) returned 1
	[0049.614] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.614] CloseHandle (hObject=0x8c) returned 1
	[0049.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.boom")) returned 1
	[0049.690] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.690] CloseHandle (hObject=0x8c) returned 1
	[0049.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.boom")) returned 1
	[0049.692] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.692] CloseHandle (hObject=0x8c) returned 1
	[0049.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.boom")) returned 1
	[0049.694] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.694] CloseHandle (hObject=0x8c) returned 1
	[0049.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.boom")) returned 1
	[0049.721] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.721] CloseHandle (hObject=0x8c) returned 1
	[0049.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.boom")) returned 1
	[0049.738] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.738] CloseHandle (hObject=0x8c) returned 1
	[0049.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.boom")) returned 1
	[0049.740] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.740] CloseHandle (hObject=0x8c) returned 1
	[0049.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.boom")) returned 1
	[0049.742] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.742] CloseHandle (hObject=0x8c) returned 1
	[0049.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.boom")) returned 1
	[0049.744] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.744] CloseHandle (hObject=0x8c) returned 1
	[0049.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.boom")) returned 1
	[0049.746] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.746] CloseHandle (hObject=0x8c) returned 1
	[0049.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.boom")) returned 1
	[0049.767] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.767] CloseHandle (hObject=0x8c) returned 1
	[0049.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.boom")) returned 1
	[0049.780] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.780] CloseHandle (hObject=0x8c) returned 1
	[0049.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.boom")) returned 1
	[0049.781] lstrcmpA (lpString1=".", lpString2="Publisher") returned -1
	[0049.781] lstrcmpA (lpString1="..", lpString2="Publisher") returned -1
	[0049.781] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0049.796] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.796] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.797] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.797] lstrcmpA (lpString1=".", lpString2="Backgrounds") returned -1
	[0049.797] lstrcmpA (lpString1="..", lpString2="Backgrounds") returned -1
	[0049.797] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned 63
	[0049.797] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0049.810] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0049.810] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0049.810] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0049.810] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0049.813] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0049.813] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0049.814] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0049.814] CloseHandle (hObject=0x90) returned 1
	[0049.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143743.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF"
	[0049.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.zip") returned 0
	[0049.814] lstrlenA (lpString="*.zip") returned 5
	[0049.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.rar") returned 0
	[0049.814] lstrlenA (lpString="*.rar") returned 5
	[0049.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.7z") returned 0
	[0049.814] lstrlenA (lpString="*.7z") returned 4
	[0049.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.tar") returned 0
	[0049.815] lstrlenA (lpString="*.tar") returned 5
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.gzip") returned 0
	[0049.815] lstrlenA (lpString="*.gzip") returned 6
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.jpg") returned 0
	[0049.815] lstrlenA (lpString="*.jpg") returned 5
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.jpeg") returned 0
	[0049.815] lstrlenA (lpString="*.jpeg") returned 6
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.psd") returned 0
	[0049.815] lstrlenA (lpString="*.psd") returned 5
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.cdr") returned 0
	[0049.815] lstrlenA (lpString="*.cdr") returned 5
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.dwg") returned 0
	[0049.815] lstrlenA (lpString="*.dwg") returned 5
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.max") returned 0
	[0049.815] lstrlenA (lpString="*.max") returned 5
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.bmp") returned 0
	[0049.815] lstrlenA (lpString="*.bmp") returned 5
	[0049.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", pszSpec="*.gif") returned 1
	[0049.815] lstrlenA (lpString="*.gif") returned 5
	[0049.815] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF"
	[0049.815] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF"
	[0049.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF."
	[0049.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.Boom"
	[0049.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0049.816] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf77
	[0049.816] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6f046d00, dwHighDateTime=0x1bd9a89), lpLastAccessTime=0x407536*(dwLowDateTime=0x65f01310, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6f046d00, dwHighDateTime=0x1bd9a89)) returned 1
	[0049.816] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.816] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf54, lpOverlapped=0x0) returned 1
	[0049.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="J0143743.GIF"
	[0049.825] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.825] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf54, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf54, lpOverlapped=0x0) returned 1
	[0049.825] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.825] CloseHandle (hObject=0x90) returned 1
	[0049.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.boom")) returned 1
	[0049.826] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0049.826] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0049.827] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143744.GIF") returned -1
	[0049.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143744.GIF") returned -1
	[0049.827] lstrcmpiA (lpString1="", lpString2="J0143744.GIF") returned -1
	[0049.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="J0143743.GIF"
	[0049.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0049.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0049.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0049.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0049.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143744.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF"
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.zip") returned 0
	[0049.827] lstrlenA (lpString="*.zip") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.rar") returned 0
	[0049.827] lstrlenA (lpString="*.rar") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.7z") returned 0
	[0049.827] lstrlenA (lpString="*.7z") returned 4
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.tar") returned 0
	[0049.827] lstrlenA (lpString="*.tar") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.gzip") returned 0
	[0049.827] lstrlenA (lpString="*.gzip") returned 6
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.jpg") returned 0
	[0049.827] lstrlenA (lpString="*.jpg") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.jpeg") returned 0
	[0049.827] lstrlenA (lpString="*.jpeg") returned 6
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.psd") returned 0
	[0049.827] lstrlenA (lpString="*.psd") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.cdr") returned 0
	[0049.827] lstrlenA (lpString="*.cdr") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.dwg") returned 0
	[0049.827] lstrlenA (lpString="*.dwg") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.max") returned 0
	[0049.827] lstrlenA (lpString="*.max") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.bmp") returned 0
	[0049.827] lstrlenA (lpString="*.bmp") returned 5
	[0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", pszSpec="*.gif") returned 1
	[0049.827] lstrlenA (lpString="*.gif") returned 5
	[0049.827] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF"
	[0049.827] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF"
	[0049.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF."
	[0049.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.Boom"
	[0049.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0049.828] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f
	[0049.828] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa4ed3400, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x56406370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa4ed3400, dwHighDateTime=0x1bd9b11)) returned 1
	[0049.828] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.828] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc, lpOverlapped=0x0) returned 1
	[0049.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="J0143744.GIF"
	[0049.829] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.829] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc, lpOverlapped=0x0) returned 1
	[0049.829] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.829] CloseHandle (hObject=0x90) returned 1
	[0049.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.boom")) returned 1
	[0049.830] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0049.830] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0049.830] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143745.GIF") returned -1
	[0049.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143745.GIF") returned -1
	[0049.830] lstrcmpiA (lpString1="", lpString2="J0143745.GIF") returned -1
	[0049.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="J0143744.GIF"
	[0049.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0049.830] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0049.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0049.830] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0049.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143745.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF"
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.zip") returned 0
	[0049.830] lstrlenA (lpString="*.zip") returned 5
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.rar") returned 0
	[0049.830] lstrlenA (lpString="*.rar") returned 5
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.7z") returned 0
	[0049.830] lstrlenA (lpString="*.7z") returned 4
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.tar") returned 0
	[0049.830] lstrlenA (lpString="*.tar") returned 5
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.gzip") returned 0
	[0049.830] lstrlenA (lpString="*.gzip") returned 6
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.jpg") returned 0
	[0049.830] lstrlenA (lpString="*.jpg") returned 5
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.jpeg") returned 0
	[0049.830] lstrlenA (lpString="*.jpeg") returned 6
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.psd") returned 0
	[0049.830] lstrlenA (lpString="*.psd") returned 5
	[0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.cdr") returned 0
	[0049.831] lstrlenA (lpString="*.cdr") returned 5
	[0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.dwg") returned 0
	[0049.831] lstrlenA (lpString="*.dwg") returned 5
	[0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.max") returned 0
	[0049.831] lstrlenA (lpString="*.max") returned 5
	[0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.bmp") returned 0
	[0049.831] lstrlenA (lpString="*.bmp") returned 5
	[0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", pszSpec="*.gif") returned 1
	[0049.831] lstrlenA (lpString="*.gif") returned 5
	[0049.831] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF"
	[0049.831] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF"
	[0049.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF."
	[0049.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.Boom"
	[0049.831] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0049.863] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dd
	[0049.863] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xac144200, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x56406370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xac144200, dwHighDateTime=0x1bd9b11)) returned 1
	[0049.863] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.863] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2ba, lpOverlapped=0x0) returned 1
	[0049.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="J0143745.GIF"
	[0049.903] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.903] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2ba, lpOverlapped=0x0) returned 1
	[0049.903] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.903] CloseHandle (hObject=0x90) returned 1
	[0049.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.boom")) returned 1
	[0049.904] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0049.904] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0049.904] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143746.GIF") returned -1
	[0049.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143746.GIF") returned -1
	[0049.904] lstrcmpiA (lpString1="", lpString2="J0143746.GIF") returned -1
	[0049.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="J0143745.GIF"
	[0049.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0049.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0049.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0049.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0049.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143746.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF"
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.zip") returned 0
	[0049.905] lstrlenA (lpString="*.zip") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.rar") returned 0
	[0049.905] lstrlenA (lpString="*.rar") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.7z") returned 0
	[0049.905] lstrlenA (lpString="*.7z") returned 4
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.tar") returned 0
	[0049.905] lstrlenA (lpString="*.tar") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.gzip") returned 0
	[0049.905] lstrlenA (lpString="*.gzip") returned 6
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.jpg") returned 0
	[0049.905] lstrlenA (lpString="*.jpg") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.jpeg") returned 0
	[0049.905] lstrlenA (lpString="*.jpeg") returned 6
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.psd") returned 0
	[0049.905] lstrlenA (lpString="*.psd") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.cdr") returned 0
	[0049.905] lstrlenA (lpString="*.cdr") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.dwg") returned 0
	[0049.905] lstrlenA (lpString="*.dwg") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.max") returned 0
	[0049.905] lstrlenA (lpString="*.max") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.bmp") returned 0
	[0049.905] lstrlenA (lpString="*.bmp") returned 5
	[0049.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", pszSpec="*.gif") returned 1
	[0049.905] lstrlenA (lpString="*.gif") returned 5
	[0049.905] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF"
	[0049.905] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF"
	[0049.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF."
	[0049.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.Boom"
	[0049.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0049.906] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x595
	[0049.906] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77a08600, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x65f01310, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77a08600, dwHighDateTime=0x1bd9b11)) returned 1
	[0049.906] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.906] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x572, lpOverlapped=0x0) returned 1
	[0049.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="J0143746.GIF"
	[0049.920] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.920] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x572, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x572, lpOverlapped=0x0) returned 1
	[0049.920] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.920] CloseHandle (hObject=0x90) returned 1
	[0049.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.boom")) returned 1
	[0049.921] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0049.921] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0049.921] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143748.GIF") returned -1
	[0049.921] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143748.GIF") returned -1
	[0049.921] lstrcmpiA (lpString1="", lpString2="J0143748.GIF") returned -1
	[0049.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="J0143746.GIF"
	[0049.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0049.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0049.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0049.922] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0049.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143748.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF"
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.zip") returned 0
	[0049.922] lstrlenA (lpString="*.zip") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.rar") returned 0
	[0049.922] lstrlenA (lpString="*.rar") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.7z") returned 0
	[0049.922] lstrlenA (lpString="*.7z") returned 4
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.tar") returned 0
	[0049.922] lstrlenA (lpString="*.tar") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.gzip") returned 0
	[0049.922] lstrlenA (lpString="*.gzip") returned 6
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.jpg") returned 0
	[0049.922] lstrlenA (lpString="*.jpg") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.jpeg") returned 0
	[0049.922] lstrlenA (lpString="*.jpeg") returned 6
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.psd") returned 0
	[0049.922] lstrlenA (lpString="*.psd") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.cdr") returned 0
	[0049.922] lstrlenA (lpString="*.cdr") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.dwg") returned 0
	[0049.922] lstrlenA (lpString="*.dwg") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.max") returned 0
	[0049.922] lstrlenA (lpString="*.max") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.bmp") returned 0
	[0049.922] lstrlenA (lpString="*.bmp") returned 5
	[0049.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", pszSpec="*.gif") returned 1
	[0049.922] lstrlenA (lpString="*.gif") returned 5
	[0049.922] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF"
	[0049.922] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF"
	[0049.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF."
	[0049.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.Boom"
	[0049.922] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0049.923] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11d1
	[0049.923] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4cbfb00, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x65f01310, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4cbfb00, dwHighDateTime=0x1bd9b11)) returned 1
	[0049.923] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.923] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x11ae, lpOverlapped=0x0) returned 1
	[0049.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="J0143748.GIF"
	[0049.963] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.963] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x11ae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x11ae, lpOverlapped=0x0) returned 1
	[0049.963] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.963] CloseHandle (hObject=0x90) returned 1
	[0049.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.boom")) returned 1
	[0049.964] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0049.964] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0049.964] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143749.GIF") returned -1
	[0049.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143749.GIF") returned -1
	[0049.964] lstrcmpiA (lpString1="", lpString2="J0143749.GIF") returned -1
	[0049.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="J0143748.GIF"
	[0049.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0049.965] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0049.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0049.965] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0049.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143749.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF"
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.zip") returned 0
	[0049.965] lstrlenA (lpString="*.zip") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.rar") returned 0
	[0049.965] lstrlenA (lpString="*.rar") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.7z") returned 0
	[0049.965] lstrlenA (lpString="*.7z") returned 4
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.tar") returned 0
	[0049.965] lstrlenA (lpString="*.tar") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.gzip") returned 0
	[0049.965] lstrlenA (lpString="*.gzip") returned 6
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.jpg") returned 0
	[0049.965] lstrlenA (lpString="*.jpg") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.jpeg") returned 0
	[0049.965] lstrlenA (lpString="*.jpeg") returned 6
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.psd") returned 0
	[0049.965] lstrlenA (lpString="*.psd") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.cdr") returned 0
	[0049.965] lstrlenA (lpString="*.cdr") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.dwg") returned 0
	[0049.965] lstrlenA (lpString="*.dwg") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.max") returned 0
	[0049.965] lstrlenA (lpString="*.max") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.bmp") returned 0
	[0049.965] lstrlenA (lpString="*.bmp") returned 5
	[0049.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", pszSpec="*.gif") returned 1
	[0049.965] lstrlenA (lpString="*.gif") returned 5
	[0049.965] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF"
	[0049.965] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF"
	[0049.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF."
	[0049.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.Boom"
	[0049.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0049.966] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1323
	[0049.966] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9ef75300, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x65f01310, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9ef75300, dwHighDateTime=0x1bd9b11)) returned 1
	[0049.966] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.966] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1300, lpOverlapped=0x0) returned 1
	[0049.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="J0143749.GIF"
	[0049.983] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.983] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1300, lpOverlapped=0x0) returned 1
	[0049.984] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0049.984] CloseHandle (hObject=0x90) returned 1
	[0049.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.boom")) returned 1
	[0049.985] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0049.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0049.985] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143750.GIF") returned -1
	[0049.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143750.GIF") returned -1
	[0049.985] lstrcmpiA (lpString1="", lpString2="J0143750.GIF") returned -1
	[0049.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="J0143749.GIF"
	[0049.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0049.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0049.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0049.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0049.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143750.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF"
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.zip") returned 0
	[0049.986] lstrlenA (lpString="*.zip") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.rar") returned 0
	[0049.986] lstrlenA (lpString="*.rar") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.7z") returned 0
	[0049.986] lstrlenA (lpString="*.7z") returned 4
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.tar") returned 0
	[0049.986] lstrlenA (lpString="*.tar") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.gzip") returned 0
	[0049.986] lstrlenA (lpString="*.gzip") returned 6
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.jpg") returned 0
	[0049.986] lstrlenA (lpString="*.jpg") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.jpeg") returned 0
	[0049.986] lstrlenA (lpString="*.jpeg") returned 6
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.psd") returned 0
	[0049.986] lstrlenA (lpString="*.psd") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.cdr") returned 0
	[0049.986] lstrlenA (lpString="*.cdr") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.dwg") returned 0
	[0049.986] lstrlenA (lpString="*.dwg") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.max") returned 0
	[0049.986] lstrlenA (lpString="*.max") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.bmp") returned 0
	[0049.986] lstrlenA (lpString="*.bmp") returned 5
	[0049.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", pszSpec="*.gif") returned 1
	[0049.986] lstrlenA (lpString="*.gif") returned 5
	[0049.986] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF"
	[0049.986] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF"
	[0049.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF."
	[0049.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.Boom"
	[0049.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0049.987] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43e
	[0049.987] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc1896c00, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x56406370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc1896c00, dwHighDateTime=0x1bd9b11)) returned 1
	[0049.987] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0049.987] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x41b, lpOverlapped=0x0) returned 1
	[0050.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="J0143750.GIF"
	[0050.007] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.007] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x41b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x41b, lpOverlapped=0x0) returned 1
	[0050.007] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.007] CloseHandle (hObject=0x90) returned 1
	[0050.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.boom")) returned 1
	[0050.008] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.008] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.008] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143752.GIF") returned -1
	[0050.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143752.GIF") returned -1
	[0050.008] lstrcmpiA (lpString1="", lpString2="J0143752.GIF") returned -1
	[0050.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="J0143750.GIF"
	[0050.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.009] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143752.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF"
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.zip") returned 0
	[0050.009] lstrlenA (lpString="*.zip") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.rar") returned 0
	[0050.009] lstrlenA (lpString="*.rar") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.7z") returned 0
	[0050.009] lstrlenA (lpString="*.7z") returned 4
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.tar") returned 0
	[0050.009] lstrlenA (lpString="*.tar") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.gzip") returned 0
	[0050.009] lstrlenA (lpString="*.gzip") returned 6
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.jpg") returned 0
	[0050.009] lstrlenA (lpString="*.jpg") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.jpeg") returned 0
	[0050.009] lstrlenA (lpString="*.jpeg") returned 6
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.psd") returned 0
	[0050.009] lstrlenA (lpString="*.psd") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.cdr") returned 0
	[0050.009] lstrlenA (lpString="*.cdr") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.dwg") returned 0
	[0050.009] lstrlenA (lpString="*.dwg") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.max") returned 0
	[0050.009] lstrlenA (lpString="*.max") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.bmp") returned 0
	[0050.009] lstrlenA (lpString="*.bmp") returned 5
	[0050.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", pszSpec="*.gif") returned 1
	[0050.010] lstrlenA (lpString="*.gif") returned 5
	[0050.010] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF"
	[0050.010] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF"
	[0050.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF."
	[0050.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.Boom"
	[0050.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.010] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x412
	[0050.010] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb9313100, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x65f01310, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb9313100, dwHighDateTime=0x1bd9b11)) returned 1
	[0050.010] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.010] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3ef, lpOverlapped=0x0) returned 1
	[0050.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="J0143752.GIF"
	[0050.016] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.016] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3ef, lpOverlapped=0x0) returned 1
	[0050.016] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.016] CloseHandle (hObject=0x90) returned 1
	[0050.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.boom")) returned 1
	[0050.017] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.017] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.017] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143753.GIF") returned -1
	[0050.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143753.GIF") returned -1
	[0050.017] lstrcmpiA (lpString1="", lpString2="J0143753.GIF") returned -1
	[0050.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="J0143752.GIF"
	[0050.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.017] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.017] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143753.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF"
	[0050.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.zip") returned 0
	[0050.017] lstrlenA (lpString="*.zip") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.rar") returned 0
	[0050.017] lstrlenA (lpString="*.rar") returned 5
	[0050.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.7z") returned 0
	[0050.017] lstrlenA (lpString="*.7z") returned 4
	[0050.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.tar") returned 0
	[0050.017] lstrlenA (lpString="*.tar") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.gzip") returned 0
	[0050.018] lstrlenA (lpString="*.gzip") returned 6
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.jpg") returned 0
	[0050.018] lstrlenA (lpString="*.jpg") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.jpeg") returned 0
	[0050.018] lstrlenA (lpString="*.jpeg") returned 6
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.psd") returned 0
	[0050.018] lstrlenA (lpString="*.psd") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.cdr") returned 0
	[0050.018] lstrlenA (lpString="*.cdr") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.dwg") returned 0
	[0050.018] lstrlenA (lpString="*.dwg") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.max") returned 0
	[0050.018] lstrlenA (lpString="*.max") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.bmp") returned 0
	[0050.018] lstrlenA (lpString="*.bmp") returned 5
	[0050.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", pszSpec="*.gif") returned 1
	[0050.018] lstrlenA (lpString="*.gif") returned 5
	[0050.018] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF"
	[0050.018] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF"
	[0050.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF."
	[0050.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.Boom"
	[0050.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.018] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b7f
	[0050.018] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd6fe9600, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x65f01310, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd6fe9600, dwHighDateTime=0x1bd9b11)) returned 1
	[0050.018] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.018] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1b5c, lpOverlapped=0x0) returned 1
	[0050.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="J0143753.GIF"
	[0050.038] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.038] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1b5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1b5c, lpOverlapped=0x0) returned 1
	[0050.039] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.039] CloseHandle (hObject=0x90) returned 1
	[0050.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.boom")) returned 1
	[0050.040] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.040] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.040] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143754.GIF") returned -1
	[0050.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143754.GIF") returned -1
	[0050.040] lstrcmpiA (lpString1="", lpString2="J0143754.GIF") returned -1
	[0050.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="J0143753.GIF"
	[0050.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143754.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF"
	[0050.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.zip") returned 0
	[0050.040] lstrlenA (lpString="*.zip") returned 5
	[0050.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.rar") returned 0
	[0050.041] lstrlenA (lpString="*.rar") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.7z") returned 0
	[0050.041] lstrlenA (lpString="*.7z") returned 4
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.tar") returned 0
	[0050.041] lstrlenA (lpString="*.tar") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.gzip") returned 0
	[0050.041] lstrlenA (lpString="*.gzip") returned 6
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.jpg") returned 0
	[0050.041] lstrlenA (lpString="*.jpg") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.jpeg") returned 0
	[0050.041] lstrlenA (lpString="*.jpeg") returned 6
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.psd") returned 0
	[0050.041] lstrlenA (lpString="*.psd") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.cdr") returned 0
	[0050.041] lstrlenA (lpString="*.cdr") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.dwg") returned 0
	[0050.041] lstrlenA (lpString="*.dwg") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.max") returned 0
	[0050.041] lstrlenA (lpString="*.max") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.bmp") returned 0
	[0050.041] lstrlenA (lpString="*.bmp") returned 5
	[0050.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", pszSpec="*.gif") returned 1
	[0050.041] lstrlenA (lpString="*.gif") returned 5
	[0050.041] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF"
	[0050.041] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF"
	[0050.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF."
	[0050.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.Boom"
	[0050.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.041] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ad
	[0050.042] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfbf30900, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x56406370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfbf30900, dwHighDateTime=0x1bd9b11)) returned 1
	[0050.042] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.042] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x68a, lpOverlapped=0x0) returned 1
	[0050.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="J0143754.GIF"
	[0050.051] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.051] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x68a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x68a, lpOverlapped=0x0) returned 1
	[0050.051] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.051] CloseHandle (hObject=0x90) returned 1
	[0050.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.boom")) returned 1
	[0050.054] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.055] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.055] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0143758.GIF") returned -1
	[0050.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0143758.GIF") returned -1
	[0050.055] lstrcmpiA (lpString1="", lpString2="J0143758.GIF") returned -1
	[0050.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="J0143754.GIF"
	[0050.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="J0143758.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF"
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.zip") returned 0
	[0050.055] lstrlenA (lpString="*.zip") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.rar") returned 0
	[0050.055] lstrlenA (lpString="*.rar") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.7z") returned 0
	[0050.055] lstrlenA (lpString="*.7z") returned 4
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.tar") returned 0
	[0050.055] lstrlenA (lpString="*.tar") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.gzip") returned 0
	[0050.055] lstrlenA (lpString="*.gzip") returned 6
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.jpg") returned 0
	[0050.055] lstrlenA (lpString="*.jpg") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.jpeg") returned 0
	[0050.055] lstrlenA (lpString="*.jpeg") returned 6
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.psd") returned 0
	[0050.055] lstrlenA (lpString="*.psd") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.cdr") returned 0
	[0050.055] lstrlenA (lpString="*.cdr") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.dwg") returned 0
	[0050.055] lstrlenA (lpString="*.dwg") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.max") returned 0
	[0050.055] lstrlenA (lpString="*.max") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.bmp") returned 0
	[0050.055] lstrlenA (lpString="*.bmp") returned 5
	[0050.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", pszSpec="*.gif") returned 1
	[0050.055] lstrlenA (lpString="*.gif") returned 5
	[0050.055] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF"
	[0050.055] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF"
	[0050.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF."
	[0050.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.Boom"
	[0050.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.056] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69f
	[0050.056] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc8b07a00, dwHighDateTime=0x1bd9b11), lpLastAccessTime=0x407536*(dwLowDateTime=0x56406370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8b07a00, dwHighDateTime=0x1bd9b11)) returned 1
	[0050.056] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.056] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x67c, lpOverlapped=0x0) returned 1
	[0050.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="J0143758.GIF"
	[0050.061] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.061] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x67c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x67c, lpOverlapped=0x0) returned 1
	[0050.061] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.061] CloseHandle (hObject=0x90) returned 1
	[0050.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.boom")) returned 1
	[0050.062] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.062] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.062] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB00516L.GIF") returned -1
	[0050.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00516L.GIF") returned -1
	[0050.062] lstrcmpiA (lpString1="", lpString2="WB00516L.GIF") returned -1
	[0050.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="J0143758.GIF"
	[0050.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00516L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF"
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.zip") returned 0
	[0050.063] lstrlenA (lpString="*.zip") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.rar") returned 0
	[0050.063] lstrlenA (lpString="*.rar") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.7z") returned 0
	[0050.063] lstrlenA (lpString="*.7z") returned 4
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.tar") returned 0
	[0050.063] lstrlenA (lpString="*.tar") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.gzip") returned 0
	[0050.063] lstrlenA (lpString="*.gzip") returned 6
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.jpg") returned 0
	[0050.063] lstrlenA (lpString="*.jpg") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.jpeg") returned 0
	[0050.063] lstrlenA (lpString="*.jpeg") returned 6
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.psd") returned 0
	[0050.063] lstrlenA (lpString="*.psd") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.cdr") returned 0
	[0050.063] lstrlenA (lpString="*.cdr") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.dwg") returned 0
	[0050.063] lstrlenA (lpString="*.dwg") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.max") returned 0
	[0050.063] lstrlenA (lpString="*.max") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.bmp") returned 0
	[0050.063] lstrlenA (lpString="*.bmp") returned 5
	[0050.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", pszSpec="*.gif") returned 1
	[0050.063] lstrlenA (lpString="*.gif") returned 5
	[0050.063] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF"
	[0050.063] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF"
	[0050.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF."
	[0050.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.Boom"
	[0050.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.064] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124a
	[0050.064] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x70875130, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.064] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.064] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1227, lpOverlapped=0x0) returned 1
	[0050.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="WB00516L.GIF"
	[0050.067] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.068] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1227, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1227, lpOverlapped=0x0) returned 1
	[0050.068] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.068] CloseHandle (hObject=0x90) returned 1
	[0050.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.boom")) returned 1
	[0050.069] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.069] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB00531L.GIF") returned -1
	[0050.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00531L.GIF") returned -1
	[0050.069] lstrcmpiA (lpString1="", lpString2="WB00531L.GIF") returned -1
	[0050.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="WB00516L.GIF"
	[0050.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.069] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00531L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF"
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.zip") returned 0
	[0050.069] lstrlenA (lpString="*.zip") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.rar") returned 0
	[0050.069] lstrlenA (lpString="*.rar") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.7z") returned 0
	[0050.069] lstrlenA (lpString="*.7z") returned 4
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.tar") returned 0
	[0050.069] lstrlenA (lpString="*.tar") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.gzip") returned 0
	[0050.069] lstrlenA (lpString="*.gzip") returned 6
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.jpg") returned 0
	[0050.069] lstrlenA (lpString="*.jpg") returned 5
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.jpeg") returned 0
	[0050.069] lstrlenA (lpString="*.jpeg") returned 6
	[0050.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.psd") returned 0
	[0050.070] lstrlenA (lpString="*.psd") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.cdr") returned 0
	[0050.070] lstrlenA (lpString="*.cdr") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.dwg") returned 0
	[0050.070] lstrlenA (lpString="*.dwg") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.max") returned 0
	[0050.070] lstrlenA (lpString="*.max") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.bmp") returned 0
	[0050.070] lstrlenA (lpString="*.bmp") returned 5
	[0050.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", pszSpec="*.gif") returned 1
	[0050.070] lstrlenA (lpString="*.gif") returned 5
	[0050.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF"
	[0050.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF"
	[0050.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF."
	[0050.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.Boom"
	[0050.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.079] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2017
	[0050.079] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e574fb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.079] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.079] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ff4, lpOverlapped=0x0) returned 1
	[0050.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="WB00531L.GIF"
	[0050.098] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.098] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ff4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ff4, lpOverlapped=0x0) returned 1
	[0050.098] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.098] CloseHandle (hObject=0x90) returned 1
	[0050.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.boom")) returned 1
	[0050.100] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.100] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.100] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB00673L.GIF") returned -1
	[0050.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00673L.GIF") returned -1
	[0050.100] lstrcmpiA (lpString1="", lpString2="WB00673L.GIF") returned -1
	[0050.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="WB00531L.GIF"
	[0050.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00673L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF"
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.zip") returned 0
	[0050.100] lstrlenA (lpString="*.zip") returned 5
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.rar") returned 0
	[0050.100] lstrlenA (lpString="*.rar") returned 5
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.7z") returned 0
	[0050.100] lstrlenA (lpString="*.7z") returned 4
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.tar") returned 0
	[0050.100] lstrlenA (lpString="*.tar") returned 5
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.gzip") returned 0
	[0050.100] lstrlenA (lpString="*.gzip") returned 6
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.jpg") returned 0
	[0050.100] lstrlenA (lpString="*.jpg") returned 5
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.jpeg") returned 0
	[0050.100] lstrlenA (lpString="*.jpeg") returned 6
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.psd") returned 0
	[0050.100] lstrlenA (lpString="*.psd") returned 5
	[0050.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.cdr") returned 0
	[0050.101] lstrlenA (lpString="*.cdr") returned 5
	[0050.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.dwg") returned 0
	[0050.101] lstrlenA (lpString="*.dwg") returned 5
	[0050.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.max") returned 0
	[0050.101] lstrlenA (lpString="*.max") returned 5
	[0050.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.bmp") returned 0
	[0050.101] lstrlenA (lpString="*.bmp") returned 5
	[0050.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", pszSpec="*.gif") returned 1
	[0050.101] lstrlenA (lpString="*.gif") returned 5
	[0050.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF"
	[0050.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF"
	[0050.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF."
	[0050.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.Boom"
	[0050.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.101] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20ee
	[0050.101] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e574fb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.101] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.101] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x20cb, lpOverlapped=0x0) returned 1
	[0050.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="WB00673L.GIF"
	[0050.117] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.117] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x20cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x20cb, lpOverlapped=0x0) returned 1
	[0050.117] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.117] CloseHandle (hObject=0x90) returned 1
	[0050.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.boom")) returned 1
	[0050.119] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.119] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.119] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB00703L.GIF") returned -1
	[0050.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00703L.GIF") returned -1
	[0050.119] lstrcmpiA (lpString1="", lpString2="WB00703L.GIF") returned -1
	[0050.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="WB00673L.GIF"
	[0050.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.119] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.119] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00703L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF"
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.zip") returned 0
	[0050.119] lstrlenA (lpString="*.zip") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.rar") returned 0
	[0050.119] lstrlenA (lpString="*.rar") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.7z") returned 0
	[0050.119] lstrlenA (lpString="*.7z") returned 4
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.tar") returned 0
	[0050.119] lstrlenA (lpString="*.tar") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.gzip") returned 0
	[0050.119] lstrlenA (lpString="*.gzip") returned 6
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.jpg") returned 0
	[0050.119] lstrlenA (lpString="*.jpg") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.jpeg") returned 0
	[0050.119] lstrlenA (lpString="*.jpeg") returned 6
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.psd") returned 0
	[0050.119] lstrlenA (lpString="*.psd") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.cdr") returned 0
	[0050.119] lstrlenA (lpString="*.cdr") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.dwg") returned 0
	[0050.119] lstrlenA (lpString="*.dwg") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.max") returned 0
	[0050.119] lstrlenA (lpString="*.max") returned 5
	[0050.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.bmp") returned 0
	[0050.120] lstrlenA (lpString="*.bmp") returned 5
	[0050.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", pszSpec="*.gif") returned 1
	[0050.120] lstrlenA (lpString="*.gif") returned 5
	[0050.120] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF"
	[0050.120] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF"
	[0050.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF."
	[0050.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.Boom"
	[0050.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.120] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2026
	[0050.120] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x70875130, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.120] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.120] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2003, lpOverlapped=0x0) returned 1
	[0050.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="WB00703L.GIF"
	[0050.143] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.143] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2003, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2003, lpOverlapped=0x0) returned 1
	[0050.143] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.143] CloseHandle (hObject=0x90) returned 1
	[0050.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.boom")) returned 1
	[0050.145] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.145] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.145] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB00760L.GIF") returned -1
	[0050.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00760L.GIF") returned -1
	[0050.145] lstrcmpiA (lpString1="", lpString2="WB00760L.GIF") returned -1
	[0050.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="WB00703L.GIF"
	[0050.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00760L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF"
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.zip") returned 0
	[0050.145] lstrlenA (lpString="*.zip") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.rar") returned 0
	[0050.145] lstrlenA (lpString="*.rar") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.7z") returned 0
	[0050.145] lstrlenA (lpString="*.7z") returned 4
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.tar") returned 0
	[0050.145] lstrlenA (lpString="*.tar") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.gzip") returned 0
	[0050.145] lstrlenA (lpString="*.gzip") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.jpg") returned 0
	[0050.145] lstrlenA (lpString="*.jpg") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.jpeg") returned 0
	[0050.145] lstrlenA (lpString="*.jpeg") returned 6
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.psd") returned 0
	[0050.145] lstrlenA (lpString="*.psd") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.cdr") returned 0
	[0050.145] lstrlenA (lpString="*.cdr") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.dwg") returned 0
	[0050.145] lstrlenA (lpString="*.dwg") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.max") returned 0
	[0050.145] lstrlenA (lpString="*.max") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.bmp") returned 0
	[0050.145] lstrlenA (lpString="*.bmp") returned 5
	[0050.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", pszSpec="*.gif") returned 1
	[0050.145] lstrlenA (lpString="*.gif") returned 5
	[0050.146] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF"
	[0050.146] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF"
	[0050.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF."
	[0050.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.Boom"
	[0050.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.146] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2313
	[0050.146] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e574fb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.146] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.146] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x22f0, lpOverlapped=0x0) returned 1
	[0050.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="WB00760L.GIF"
	[0050.181] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.181] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x22f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x22f0, lpOverlapped=0x0) returned 1
	[0050.181] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.181] CloseHandle (hObject=0x90) returned 1
	[0050.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.boom")) returned 1
	[0050.183] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.183] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.183] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB00780L.GIF") returned -1
	[0050.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB00780L.GIF") returned -1
	[0050.183] lstrcmpiA (lpString1="", lpString2="WB00780L.GIF") returned -1
	[0050.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="WB00760L.GIF"
	[0050.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB00780L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF"
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.zip") returned 0
	[0050.183] lstrlenA (lpString="*.zip") returned 5
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.rar") returned 0
	[0050.183] lstrlenA (lpString="*.rar") returned 5
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.7z") returned 0
	[0050.183] lstrlenA (lpString="*.7z") returned 4
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.tar") returned 0
	[0050.183] lstrlenA (lpString="*.tar") returned 5
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.gzip") returned 0
	[0050.183] lstrlenA (lpString="*.gzip") returned 6
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.jpg") returned 0
	[0050.183] lstrlenA (lpString="*.jpg") returned 5
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.jpeg") returned 0
	[0050.183] lstrlenA (lpString="*.jpeg") returned 6
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.psd") returned 0
	[0050.183] lstrlenA (lpString="*.psd") returned 5
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.cdr") returned 0
	[0050.183] lstrlenA (lpString="*.cdr") returned 5
	[0050.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.dwg") returned 0
	[0050.183] lstrlenA (lpString="*.dwg") returned 5
	[0050.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.max") returned 0
	[0050.184] lstrlenA (lpString="*.max") returned 5
	[0050.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.bmp") returned 0
	[0050.184] lstrlenA (lpString="*.bmp") returned 5
	[0050.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", pszSpec="*.gif") returned 1
	[0050.184] lstrlenA (lpString="*.gif") returned 5
	[0050.184] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF"
	[0050.184] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF"
	[0050.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF."
	[0050.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.Boom"
	[0050.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.184] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8f
	[0050.184] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x70875130, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.184] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.184] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1f6c, lpOverlapped=0x0) returned 1
	[0050.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="WB00780L.GIF"
	[0050.192] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.192] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1f6c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1f6c, lpOverlapped=0x0) returned 1
	[0050.192] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.192] CloseHandle (hObject=0x90) returned 1
	[0050.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.boom")) returned 1
	[0050.193] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.193] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.193] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB01741L.GIF") returned -1
	[0050.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB01741L.GIF") returned -1
	[0050.193] lstrcmpiA (lpString1="", lpString2="WB01741L.GIF") returned -1
	[0050.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="WB00780L.GIF"
	[0050.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB01741L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF"
	[0050.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.zip") returned 0
	[0050.193] lstrlenA (lpString="*.zip") returned 5
	[0050.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.rar") returned 0
	[0050.193] lstrlenA (lpString="*.rar") returned 5
	[0050.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.7z") returned 0
	[0050.193] lstrlenA (lpString="*.7z") returned 4
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.tar") returned 0
	[0050.194] lstrlenA (lpString="*.tar") returned 5
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.gzip") returned 0
	[0050.194] lstrlenA (lpString="*.gzip") returned 6
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.jpg") returned 0
	[0050.194] lstrlenA (lpString="*.jpg") returned 5
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.jpeg") returned 0
	[0050.194] lstrlenA (lpString="*.jpeg") returned 6
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.psd") returned 0
	[0050.194] lstrlenA (lpString="*.psd") returned 5
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.cdr") returned 0
	[0050.194] lstrlenA (lpString="*.cdr") returned 5
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.dwg") returned 0
	[0050.194] lstrlenA (lpString="*.dwg") returned 5
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.max") returned 0
	[0050.194] lstrlenA (lpString="*.max") returned 5
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.bmp") returned 0
	[0050.194] lstrlenA (lpString="*.bmp") returned 5
	[0050.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", pszSpec="*.gif") returned 1
	[0050.194] lstrlenA (lpString="*.gif") returned 5
	[0050.194] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF"
	[0050.194] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF"
	[0050.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF."
	[0050.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.Boom"
	[0050.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.194] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1d
	[0050.194] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x70875130, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.194] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.195] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xdfa, lpOverlapped=0x0) returned 1
	[0050.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="WB01741L.GIF"
	[0050.259] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.259] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xdfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xdfa, lpOverlapped=0x0) returned 1
	[0050.259] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.260] CloseHandle (hObject=0x90) returned 1
	[0050.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.boom")) returned 1
	[0050.261] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02039_.GIF") returned -1
	[0050.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02039_.GIF") returned -1
	[0050.261] lstrcmpiA (lpString1="", lpString2="WB02039_.GIF") returned -1
	[0050.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="WB01741L.GIF"
	[0050.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.261] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02039_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF"
	[0050.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.zip") returned 0
	[0050.261] lstrlenA (lpString="*.zip") returned 5
	[0050.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.rar") returned 0
	[0050.261] lstrlenA (lpString="*.rar") returned 5
	[0050.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.7z") returned 0
	[0050.262] lstrlenA (lpString="*.7z") returned 4
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.tar") returned 0
	[0050.262] lstrlenA (lpString="*.tar") returned 5
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.gzip") returned 0
	[0050.262] lstrlenA (lpString="*.gzip") returned 6
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.jpg") returned 0
	[0050.262] lstrlenA (lpString="*.jpg") returned 5
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.jpeg") returned 0
	[0050.262] lstrlenA (lpString="*.jpeg") returned 6
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.psd") returned 0
	[0050.262] lstrlenA (lpString="*.psd") returned 5
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.cdr") returned 0
	[0050.262] lstrlenA (lpString="*.cdr") returned 5
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.dwg") returned 0
	[0050.262] lstrlenA (lpString="*.dwg") returned 5
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.max") returned 0
	[0050.262] lstrlenA (lpString="*.max") returned 5
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.bmp") returned 0
	[0050.262] lstrlenA (lpString="*.bmp") returned 5
	[0050.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", pszSpec="*.gif") returned 1
	[0050.262] lstrlenA (lpString="*.gif") returned 5
	[0050.262] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF"
	[0050.262] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF"
	[0050.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF."
	[0050.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.Boom"
	[0050.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.263] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38c
	[0050.263] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x7089b290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.263] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.263] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x369, lpOverlapped=0x0) returned 1
	[0050.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="WB02039_.GIF"
	[0050.279] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.279] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x369, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x369, lpOverlapped=0x0) returned 1
	[0050.279] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.279] CloseHandle (hObject=0x90) returned 1
	[0050.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.boom")) returned 1
	[0050.281] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.281] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.281] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02055_.GIF") returned -1
	[0050.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02055_.GIF") returned -1
	[0050.281] lstrcmpiA (lpString1="", lpString2="WB02055_.GIF") returned -1
	[0050.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="WB02039_.GIF"
	[0050.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02055_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF"
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.zip") returned 0
	[0050.281] lstrlenA (lpString="*.zip") returned 5
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.rar") returned 0
	[0050.281] lstrlenA (lpString="*.rar") returned 5
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.7z") returned 0
	[0050.281] lstrlenA (lpString="*.7z") returned 4
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.tar") returned 0
	[0050.281] lstrlenA (lpString="*.tar") returned 5
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.gzip") returned 0
	[0050.281] lstrlenA (lpString="*.gzip") returned 6
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.jpg") returned 0
	[0050.281] lstrlenA (lpString="*.jpg") returned 5
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.jpeg") returned 0
	[0050.281] lstrlenA (lpString="*.jpeg") returned 6
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.psd") returned 0
	[0050.281] lstrlenA (lpString="*.psd") returned 5
	[0050.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.cdr") returned 0
	[0050.282] lstrlenA (lpString="*.cdr") returned 5
	[0050.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.dwg") returned 0
	[0050.282] lstrlenA (lpString="*.dwg") returned 5
	[0050.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.max") returned 0
	[0050.282] lstrlenA (lpString="*.max") returned 5
	[0050.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.bmp") returned 0
	[0050.282] lstrlenA (lpString="*.bmp") returned 5
	[0050.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", pszSpec="*.gif") returned 1
	[0050.282] lstrlenA (lpString="*.gif") returned 5
	[0050.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF"
	[0050.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF"
	[0050.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF."
	[0050.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.Boom"
	[0050.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.283] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x987
	[0050.283] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.283] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.283] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x964, lpOverlapped=0x0) returned 1
	[0050.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="WB02055_.GIF"
	[0050.336] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.336] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x964, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x964, lpOverlapped=0x0) returned 1
	[0050.336] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.337] CloseHandle (hObject=0x90) returned 1
	[0050.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.boom")) returned 1
	[0050.339] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.339] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02073_.GIF") returned -1
	[0050.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02073_.GIF") returned -1
	[0050.339] lstrcmpiA (lpString1="", lpString2="WB02073_.GIF") returned -1
	[0050.339] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="WB02055_.GIF"
	[0050.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.339] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF"
	[0050.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.zip") returned 0
	[0050.339] lstrlenA (lpString="*.zip") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.rar") returned 0
	[0050.339] lstrlenA (lpString="*.rar") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.7z") returned 0
	[0050.339] lstrlenA (lpString="*.7z") returned 4
	[0050.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.tar") returned 0
	[0050.339] lstrlenA (lpString="*.tar") returned 5
	[0050.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.gzip") returned 0
	[0050.339] lstrlenA (lpString="*.gzip") returned 6
	[0050.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.jpg") returned 0
	[0050.339] lstrlenA (lpString="*.jpg") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.jpeg") returned 0
	[0050.340] lstrlenA (lpString="*.jpeg") returned 6
	[0050.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.psd") returned 0
	[0050.340] lstrlenA (lpString="*.psd") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.cdr") returned 0
	[0050.340] lstrlenA (lpString="*.cdr") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.dwg") returned 0
	[0050.340] lstrlenA (lpString="*.dwg") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.max") returned 0
	[0050.340] lstrlenA (lpString="*.max") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.bmp") returned 0
	[0050.340] lstrlenA (lpString="*.bmp") returned 5
	[0050.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", pszSpec="*.gif") returned 1
	[0050.340] lstrlenA (lpString="*.gif") returned 5
	[0050.340] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF"
	[0050.340] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF"
	[0050.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF."
	[0050.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.Boom"
	[0050.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.340] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37d
	[0050.341] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.341] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.341] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x35a, lpOverlapped=0x0) returned 1
	[0050.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="WB02073_.GIF"
	[0050.377] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.377] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x35a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x35a, lpOverlapped=0x0) returned 1
	[0050.377] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.377] CloseHandle (hObject=0x90) returned 1
	[0050.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.boom")) returned 1
	[0050.379] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.379] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.379] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02074_.GIF") returned -1
	[0050.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02074_.GIF") returned -1
	[0050.379] lstrcmpiA (lpString1="", lpString2="WB02074_.GIF") returned -1
	[0050.379] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="WB02073_.GIF"
	[0050.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.379] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02074_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF"
	[0050.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.zip") returned 0
	[0050.379] lstrlenA (lpString="*.zip") returned 5
	[0050.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.rar") returned 0
	[0050.379] lstrlenA (lpString="*.rar") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.7z") returned 0
	[0050.380] lstrlenA (lpString="*.7z") returned 4
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.tar") returned 0
	[0050.380] lstrlenA (lpString="*.tar") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.gzip") returned 0
	[0050.380] lstrlenA (lpString="*.gzip") returned 6
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.jpg") returned 0
	[0050.380] lstrlenA (lpString="*.jpg") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.jpeg") returned 0
	[0050.380] lstrlenA (lpString="*.jpeg") returned 6
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.psd") returned 0
	[0050.380] lstrlenA (lpString="*.psd") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.cdr") returned 0
	[0050.380] lstrlenA (lpString="*.cdr") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.dwg") returned 0
	[0050.380] lstrlenA (lpString="*.dwg") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.max") returned 0
	[0050.380] lstrlenA (lpString="*.max") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.bmp") returned 0
	[0050.380] lstrlenA (lpString="*.bmp") returned 5
	[0050.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", pszSpec="*.gif") returned 1
	[0050.380] lstrlenA (lpString="*.gif") returned 5
	[0050.380] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF"
	[0050.380] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF"
	[0050.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF."
	[0050.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.Boom"
	[0050.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.381] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x516
	[0050.381] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x7089b290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.381] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.381] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4f3, lpOverlapped=0x0) returned 1
	[0050.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="WB02074_.GIF"
	[0050.407] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.407] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4f3, lpOverlapped=0x0) returned 1
	[0050.408] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.408] CloseHandle (hObject=0x90) returned 1
	[0050.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.boom")) returned 1
	[0050.410] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.410] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.410] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02077_.GIF") returned -1
	[0050.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02077_.GIF") returned -1
	[0050.410] lstrcmpiA (lpString1="", lpString2="WB02077_.GIF") returned -1
	[0050.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="WB02074_.GIF"
	[0050.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02077_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF"
	[0050.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.zip") returned 0
	[0050.410] lstrlenA (lpString="*.zip") returned 5
	[0050.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.rar") returned 0
	[0050.410] lstrlenA (lpString="*.rar") returned 5
	[0050.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.7z") returned 0
	[0050.410] lstrlenA (lpString="*.7z") returned 4
	[0050.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.tar") returned 0
	[0050.410] lstrlenA (lpString="*.tar") returned 5
	[0050.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.gzip") returned 0
	[0050.410] lstrlenA (lpString="*.gzip") returned 6
	[0050.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.jpg") returned 0
	[0050.410] lstrlenA (lpString="*.jpg") returned 5
	[0050.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.jpeg") returned 0
	[0050.411] lstrlenA (lpString="*.jpeg") returned 6
	[0050.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.psd") returned 0
	[0050.411] lstrlenA (lpString="*.psd") returned 5
	[0050.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.cdr") returned 0
	[0050.411] lstrlenA (lpString="*.cdr") returned 5
	[0050.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.dwg") returned 0
	[0050.411] lstrlenA (lpString="*.dwg") returned 5
	[0050.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.max") returned 0
	[0050.411] lstrlenA (lpString="*.max") returned 5
	[0050.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.bmp") returned 0
	[0050.411] lstrlenA (lpString="*.bmp") returned 5
	[0050.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", pszSpec="*.gif") returned 1
	[0050.411] lstrlenA (lpString="*.gif") returned 5
	[0050.411] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF"
	[0050.411] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF"
	[0050.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF."
	[0050.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.Boom"
	[0050.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.411] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fd
	[0050.411] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x7089b290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.411] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.412] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2da, lpOverlapped=0x0) returned 1
	[0050.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="WB02077_.GIF"
	[0050.460] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.461] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2da, lpOverlapped=0x0) returned 1
	[0050.461] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.461] CloseHandle (hObject=0x90) returned 1
	[0050.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.boom")) returned 1
	[0050.462] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.462] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02082_.GIF") returned -1
	[0050.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02082_.GIF") returned -1
	[0050.462] lstrcmpiA (lpString1="", lpString2="WB02082_.GIF") returned -1
	[0050.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="WB02077_.GIF"
	[0050.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.463] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02082_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF"
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.zip") returned 0
	[0050.463] lstrlenA (lpString="*.zip") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.rar") returned 0
	[0050.463] lstrlenA (lpString="*.rar") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.7z") returned 0
	[0050.463] lstrlenA (lpString="*.7z") returned 4
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.tar") returned 0
	[0050.463] lstrlenA (lpString="*.tar") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.gzip") returned 0
	[0050.463] lstrlenA (lpString="*.gzip") returned 6
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.jpg") returned 0
	[0050.463] lstrlenA (lpString="*.jpg") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.jpeg") returned 0
	[0050.463] lstrlenA (lpString="*.jpeg") returned 6
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.psd") returned 0
	[0050.463] lstrlenA (lpString="*.psd") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.cdr") returned 0
	[0050.463] lstrlenA (lpString="*.cdr") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.dwg") returned 0
	[0050.463] lstrlenA (lpString="*.dwg") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.max") returned 0
	[0050.463] lstrlenA (lpString="*.max") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.bmp") returned 0
	[0050.463] lstrlenA (lpString="*.bmp") returned 5
	[0050.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", pszSpec="*.gif") returned 1
	[0050.463] lstrlenA (lpString="*.gif") returned 5
	[0050.463] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF"
	[0050.463] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF"
	[0050.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF."
	[0050.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.Boom"
	[0050.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.464] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x996
	[0050.464] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x7089b290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.464] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.464] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x973, lpOverlapped=0x0) returned 1
	[0050.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="WB02082_.GIF"
	[0050.485] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.485] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x973, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x973, lpOverlapped=0x0) returned 1
	[0050.485] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.485] CloseHandle (hObject=0x90) returned 1
	[0050.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.boom")) returned 1
	[0050.487] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.487] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.487] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02085_.GIF") returned -1
	[0050.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02085_.GIF") returned -1
	[0050.487] lstrcmpiA (lpString1="", lpString2="WB02085_.GIF") returned -1
	[0050.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="WB02082_.GIF"
	[0050.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02085_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF"
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.zip") returned 0
	[0050.487] lstrlenA (lpString="*.zip") returned 5
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.rar") returned 0
	[0050.487] lstrlenA (lpString="*.rar") returned 5
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.7z") returned 0
	[0050.487] lstrlenA (lpString="*.7z") returned 4
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.tar") returned 0
	[0050.487] lstrlenA (lpString="*.tar") returned 5
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.gzip") returned 0
	[0050.487] lstrlenA (lpString="*.gzip") returned 6
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.jpg") returned 0
	[0050.487] lstrlenA (lpString="*.jpg") returned 5
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.jpeg") returned 0
	[0050.487] lstrlenA (lpString="*.jpeg") returned 6
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.psd") returned 0
	[0050.487] lstrlenA (lpString="*.psd") returned 5
	[0050.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.cdr") returned 0
	[0050.487] lstrlenA (lpString="*.cdr") returned 5
	[0050.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.dwg") returned 0
	[0050.488] lstrlenA (lpString="*.dwg") returned 5
	[0050.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.max") returned 0
	[0050.488] lstrlenA (lpString="*.max") returned 5
	[0050.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.bmp") returned 0
	[0050.488] lstrlenA (lpString="*.bmp") returned 5
	[0050.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", pszSpec="*.gif") returned 1
	[0050.488] lstrlenA (lpString="*.gif") returned 5
	[0050.488] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF"
	[0050.488] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF"
	[0050.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF."
	[0050.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.Boom"
	[0050.488] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.488] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90c
	[0050.488] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.488] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.488] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x8e9, lpOverlapped=0x0) returned 1
	[0050.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="WB02085_.GIF"
	[0050.490] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.490] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x8e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x8e9, lpOverlapped=0x0) returned 1
	[0050.490] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.490] CloseHandle (hObject=0x90) returned 1
	[0050.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.boom")) returned 1
	[0050.492] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.492] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.492] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02097_.GIF") returned -1
	[0050.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02097_.GIF") returned -1
	[0050.492] lstrcmpiA (lpString1="", lpString2="WB02097_.GIF") returned -1
	[0050.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="WB02085_.GIF"
	[0050.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.492] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02097_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF"
	[0050.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.zip") returned 0
	[0050.492] lstrlenA (lpString="*.zip") returned 5
	[0050.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.rar") returned 0
	[0050.492] lstrlenA (lpString="*.rar") returned 5
	[0050.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.7z") returned 0
	[0050.492] lstrlenA (lpString="*.7z") returned 4
	[0050.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.tar") returned 0
	[0050.492] lstrlenA (lpString="*.tar") returned 5
	[0050.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.gzip") returned 0
	[0050.492] lstrlenA (lpString="*.gzip") returned 6
	[0050.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.jpg") returned 0
	[0050.492] lstrlenA (lpString="*.jpg") returned 5
	[0050.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.jpeg") returned 0
	[0050.493] lstrlenA (lpString="*.jpeg") returned 6
	[0050.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.psd") returned 0
	[0050.493] lstrlenA (lpString="*.psd") returned 5
	[0050.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.cdr") returned 0
	[0050.493] lstrlenA (lpString="*.cdr") returned 5
	[0050.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.dwg") returned 0
	[0050.493] lstrlenA (lpString="*.dwg") returned 5
	[0050.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.max") returned 0
	[0050.493] lstrlenA (lpString="*.max") returned 5
	[0050.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.bmp") returned 0
	[0050.493] lstrlenA (lpString="*.bmp") returned 5
	[0050.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", pszSpec="*.gif") returned 1
	[0050.493] lstrlenA (lpString="*.gif") returned 5
	[0050.493] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF"
	[0050.493] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF"
	[0050.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF."
	[0050.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.Boom"
	[0050.493] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.493] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x581
	[0050.493] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.493] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.493] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x55e, lpOverlapped=0x0) returned 1
	[0050.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="WB02097_.GIF"
	[0050.495] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.495] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x55e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x55e, lpOverlapped=0x0) returned 1
	[0050.495] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.495] CloseHandle (hObject=0x90) returned 1
	[0050.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.boom")) returned 1
	[0050.496] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.496] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02106_.GIF") returned -1
	[0050.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02106_.GIF") returned -1
	[0050.496] lstrcmpiA (lpString1="", lpString2="WB02106_.GIF") returned -1
	[0050.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="WB02097_.GIF"
	[0050.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.496] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.497] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02106_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF"
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.zip") returned 0
	[0050.497] lstrlenA (lpString="*.zip") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.rar") returned 0
	[0050.497] lstrlenA (lpString="*.rar") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.7z") returned 0
	[0050.497] lstrlenA (lpString="*.7z") returned 4
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.tar") returned 0
	[0050.497] lstrlenA (lpString="*.tar") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.gzip") returned 0
	[0050.497] lstrlenA (lpString="*.gzip") returned 6
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.jpg") returned 0
	[0050.497] lstrlenA (lpString="*.jpg") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.jpeg") returned 0
	[0050.497] lstrlenA (lpString="*.jpeg") returned 6
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.psd") returned 0
	[0050.497] lstrlenA (lpString="*.psd") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.cdr") returned 0
	[0050.497] lstrlenA (lpString="*.cdr") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.dwg") returned 0
	[0050.497] lstrlenA (lpString="*.dwg") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.max") returned 0
	[0050.497] lstrlenA (lpString="*.max") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.bmp") returned 0
	[0050.497] lstrlenA (lpString="*.bmp") returned 5
	[0050.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", pszSpec="*.gif") returned 1
	[0050.497] lstrlenA (lpString="*.gif") returned 5
	[0050.497] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF"
	[0050.497] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF"
	[0050.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF."
	[0050.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.Boom"
	[0050.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.498] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15fa
	[0050.498] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x7089b290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.498] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.498] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x15d7, lpOverlapped=0x0) returned 1
	[0050.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="WB02106_.GIF"
	[0050.513] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.513] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x15d7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x15d7, lpOverlapped=0x0) returned 1
	[0050.513] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.513] CloseHandle (hObject=0x90) returned 1
	[0050.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.boom")) returned 1
	[0050.515] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.515] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.515] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02116_.GIF") returned -1
	[0050.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02116_.GIF") returned -1
	[0050.515] lstrcmpiA (lpString1="", lpString2="WB02116_.GIF") returned -1
	[0050.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="WB02106_.GIF"
	[0050.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.515] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02116_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF"
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.zip") returned 0
	[0050.515] lstrlenA (lpString="*.zip") returned 5
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.rar") returned 0
	[0050.515] lstrlenA (lpString="*.rar") returned 5
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.7z") returned 0
	[0050.515] lstrlenA (lpString="*.7z") returned 4
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.tar") returned 0
	[0050.515] lstrlenA (lpString="*.tar") returned 5
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.gzip") returned 0
	[0050.515] lstrlenA (lpString="*.gzip") returned 6
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.jpg") returned 0
	[0050.515] lstrlenA (lpString="*.jpg") returned 5
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.jpeg") returned 0
	[0050.515] lstrlenA (lpString="*.jpeg") returned 6
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.psd") returned 0
	[0050.515] lstrlenA (lpString="*.psd") returned 5
	[0050.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.cdr") returned 0
	[0050.515] lstrlenA (lpString="*.cdr") returned 5
	[0050.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.dwg") returned 0
	[0050.516] lstrlenA (lpString="*.dwg") returned 5
	[0050.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.max") returned 0
	[0050.516] lstrlenA (lpString="*.max") returned 5
	[0050.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.bmp") returned 0
	[0050.516] lstrlenA (lpString="*.bmp") returned 5
	[0050.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", pszSpec="*.gif") returned 1
	[0050.516] lstrlenA (lpString="*.gif") returned 5
	[0050.516] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF"
	[0050.516] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF"
	[0050.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF."
	[0050.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.Boom"
	[0050.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.517] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ef
	[0050.517] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.517] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.517] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3cc, lpOverlapped=0x0) returned 1
	[0050.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="WB02116_.GIF"
	[0050.518] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.518] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3cc, lpOverlapped=0x0) returned 1
	[0050.519] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.519] CloseHandle (hObject=0x90) returned 1
	[0050.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.boom")) returned 1
	[0050.520] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.520] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02134_.GIF") returned -1
	[0050.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02134_.GIF") returned -1
	[0050.520] lstrcmpiA (lpString1="", lpString2="WB02134_.GIF") returned -1
	[0050.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="WB02116_.GIF"
	[0050.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.520] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF"
	[0050.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.zip") returned 0
	[0050.520] lstrlenA (lpString="*.zip") returned 5
	[0050.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.rar") returned 0
	[0050.520] lstrlenA (lpString="*.rar") returned 5
	[0050.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.7z") returned 0
	[0050.520] lstrlenA (lpString="*.7z") returned 4
	[0050.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.tar") returned 0
	[0050.520] lstrlenA (lpString="*.tar") returned 5
	[0050.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.gzip") returned 0
	[0050.521] lstrlenA (lpString="*.gzip") returned 6
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.jpg") returned 0
	[0050.521] lstrlenA (lpString="*.jpg") returned 5
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.jpeg") returned 0
	[0050.521] lstrlenA (lpString="*.jpeg") returned 6
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.psd") returned 0
	[0050.521] lstrlenA (lpString="*.psd") returned 5
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.cdr") returned 0
	[0050.521] lstrlenA (lpString="*.cdr") returned 5
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.dwg") returned 0
	[0050.521] lstrlenA (lpString="*.dwg") returned 5
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.max") returned 0
	[0050.521] lstrlenA (lpString="*.max") returned 5
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.bmp") returned 0
	[0050.521] lstrlenA (lpString="*.bmp") returned 5
	[0050.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", pszSpec="*.gif") returned 1
	[0050.521] lstrlenA (lpString="*.gif") returned 5
	[0050.521] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF"
	[0050.521] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF"
	[0050.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF."
	[0050.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.Boom"
	[0050.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.521] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97f
	[0050.521] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.521] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.522] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x95c, lpOverlapped=0x0) returned 1
	[0050.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="WB02134_.GIF"
	[0050.523] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.523] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x95c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x95c, lpOverlapped=0x0) returned 1
	[0050.523] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.523] CloseHandle (hObject=0x90) returned 1
	[0050.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.boom")) returned 1
	[0050.524] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.524] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02187_.GIF") returned -1
	[0050.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02187_.GIF") returned -1
	[0050.525] lstrcmpiA (lpString1="", lpString2="WB02187_.GIF") returned -1
	[0050.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="WB02134_.GIF"
	[0050.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02187_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF"
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.zip") returned 0
	[0050.525] lstrlenA (lpString="*.zip") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.rar") returned 0
	[0050.525] lstrlenA (lpString="*.rar") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.7z") returned 0
	[0050.525] lstrlenA (lpString="*.7z") returned 4
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.tar") returned 0
	[0050.525] lstrlenA (lpString="*.tar") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.gzip") returned 0
	[0050.525] lstrlenA (lpString="*.gzip") returned 6
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.jpg") returned 0
	[0050.525] lstrlenA (lpString="*.jpg") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.jpeg") returned 0
	[0050.525] lstrlenA (lpString="*.jpeg") returned 6
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.psd") returned 0
	[0050.525] lstrlenA (lpString="*.psd") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.cdr") returned 0
	[0050.525] lstrlenA (lpString="*.cdr") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.dwg") returned 0
	[0050.525] lstrlenA (lpString="*.dwg") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.max") returned 0
	[0050.525] lstrlenA (lpString="*.max") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.bmp") returned 0
	[0050.525] lstrlenA (lpString="*.bmp") returned 5
	[0050.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", pszSpec="*.gif") returned 1
	[0050.526] lstrlenA (lpString="*.gif") returned 5
	[0050.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF"
	[0050.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF"
	[0050.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF."
	[0050.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.Boom"
	[0050.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.526] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x579
	[0050.526] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x7089b290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.526] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.526] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x556, lpOverlapped=0x0) returned 1
	[0050.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="WB02187_.GIF"
	[0050.595] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.595] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x556, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x556, lpOverlapped=0x0) returned 1
	[0050.595] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.595] CloseHandle (hObject=0x90) returned 1
	[0050.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.boom")) returned 1
	[0050.597] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.597] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.597] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02198_.GIF") returned -1
	[0050.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02198_.GIF") returned -1
	[0050.597] lstrcmpiA (lpString1="", lpString2="WB02198_.GIF") returned -1
	[0050.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="WB02187_.GIF"
	[0050.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02198_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF"
	[0050.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.zip") returned 0
	[0050.597] lstrlenA (lpString="*.zip") returned 5
	[0050.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.rar") returned 0
	[0050.598] lstrlenA (lpString="*.rar") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.7z") returned 0
	[0050.598] lstrlenA (lpString="*.7z") returned 4
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.tar") returned 0
	[0050.598] lstrlenA (lpString="*.tar") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.gzip") returned 0
	[0050.598] lstrlenA (lpString="*.gzip") returned 6
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.jpg") returned 0
	[0050.598] lstrlenA (lpString="*.jpg") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.jpeg") returned 0
	[0050.598] lstrlenA (lpString="*.jpeg") returned 6
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.psd") returned 0
	[0050.598] lstrlenA (lpString="*.psd") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.cdr") returned 0
	[0050.598] lstrlenA (lpString="*.cdr") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.dwg") returned 0
	[0050.598] lstrlenA (lpString="*.dwg") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.max") returned 0
	[0050.598] lstrlenA (lpString="*.max") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.bmp") returned 0
	[0050.598] lstrlenA (lpString="*.bmp") returned 5
	[0050.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", pszSpec="*.gif") returned 1
	[0050.598] lstrlenA (lpString="*.gif") returned 5
	[0050.598] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF"
	[0050.598] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF"
	[0050.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF."
	[0050.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.Boom"
	[0050.598] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.599] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4abc
	[0050.599] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.599] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.599] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4a99, lpOverlapped=0x0) returned 1
	[0050.655] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="WB02198_.GIF"
	[0050.655] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.655] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4a99, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4a99, lpOverlapped=0x0) returned 1
	[0050.656] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.656] CloseHandle (hObject=0x90) returned 1
	[0050.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.boom")) returned 1
	[0050.657] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.657] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02201_.GIF") returned -1
	[0050.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02201_.GIF") returned -1
	[0050.657] lstrcmpiA (lpString1="", lpString2="WB02201_.GIF") returned -1
	[0050.657] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="WB02198_.GIF"
	[0050.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.658] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02201_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF"
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.zip") returned 0
	[0050.658] lstrlenA (lpString="*.zip") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.rar") returned 0
	[0050.658] lstrlenA (lpString="*.rar") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.7z") returned 0
	[0050.658] lstrlenA (lpString="*.7z") returned 4
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.tar") returned 0
	[0050.658] lstrlenA (lpString="*.tar") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.gzip") returned 0
	[0050.658] lstrlenA (lpString="*.gzip") returned 6
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.jpg") returned 0
	[0050.658] lstrlenA (lpString="*.jpg") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.jpeg") returned 0
	[0050.658] lstrlenA (lpString="*.jpeg") returned 6
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.psd") returned 0
	[0050.658] lstrlenA (lpString="*.psd") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.cdr") returned 0
	[0050.658] lstrlenA (lpString="*.cdr") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.dwg") returned 0
	[0050.658] lstrlenA (lpString="*.dwg") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.max") returned 0
	[0050.658] lstrlenA (lpString="*.max") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.bmp") returned 0
	[0050.658] lstrlenA (lpString="*.bmp") returned 5
	[0050.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", pszSpec="*.gif") returned 1
	[0050.658] lstrlenA (lpString="*.gif") returned 5
	[0050.658] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF"
	[0050.658] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF"
	[0050.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF."
	[0050.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.Boom"
	[0050.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.659] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1653
	[0050.659] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.659] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.659] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1630, lpOverlapped=0x0) returned 1
	[0050.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="WB02201_.GIF"
	[0050.678] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.678] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1630, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1630, lpOverlapped=0x0) returned 1
	[0050.679] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.679] CloseHandle (hObject=0x90) returned 1
	[0050.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.boom")) returned 1
	[0050.680] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.680] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.680] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02214_.GIF") returned -1
	[0050.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02214_.GIF") returned -1
	[0050.680] lstrcmpiA (lpString1="", lpString2="WB02214_.GIF") returned -1
	[0050.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="WB02201_.GIF"
	[0050.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02214_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF"
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.zip") returned 0
	[0050.681] lstrlenA (lpString="*.zip") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.rar") returned 0
	[0050.681] lstrlenA (lpString="*.rar") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.7z") returned 0
	[0050.681] lstrlenA (lpString="*.7z") returned 4
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.tar") returned 0
	[0050.681] lstrlenA (lpString="*.tar") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.gzip") returned 0
	[0050.681] lstrlenA (lpString="*.gzip") returned 6
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.jpg") returned 0
	[0050.681] lstrlenA (lpString="*.jpg") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.jpeg") returned 0
	[0050.681] lstrlenA (lpString="*.jpeg") returned 6
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.psd") returned 0
	[0050.681] lstrlenA (lpString="*.psd") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.cdr") returned 0
	[0050.681] lstrlenA (lpString="*.cdr") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.dwg") returned 0
	[0050.681] lstrlenA (lpString="*.dwg") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.max") returned 0
	[0050.681] lstrlenA (lpString="*.max") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.bmp") returned 0
	[0050.681] lstrlenA (lpString="*.bmp") returned 5
	[0050.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", pszSpec="*.gif") returned 1
	[0050.681] lstrlenA (lpString="*.gif") returned 5
	[0050.681] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF"
	[0050.681] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF"
	[0050.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF."
	[0050.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.Boom"
	[0050.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.682] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136b
	[0050.682] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x7089b290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.682] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.682] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1348, lpOverlapped=0x0) returned 1
	[0050.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="WB02214_.GIF"
	[0050.707] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.707] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1348, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1348, lpOverlapped=0x0) returned 1
	[0050.707] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.707] CloseHandle (hObject=0x90) returned 1
	[0050.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.boom")) returned 1
	[0050.709] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.709] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.709] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WB02218_.GIF") returned -1
	[0050.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WB02218_.GIF") returned -1
	[0050.709] lstrcmpiA (lpString1="", lpString2="WB02218_.GIF") returned -1
	[0050.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="WB02214_.GIF"
	[0050.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\"
	[0050.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned=""
	[0050.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt"
	[0050.709] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to decrypt files.txt")) returned 0x20
	[0050.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpString2="WB02218_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF"
	[0050.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.zip") returned 0
	[0050.709] lstrlenA (lpString="*.zip") returned 5
	[0050.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.rar") returned 0
	[0050.709] lstrlenA (lpString="*.rar") returned 5
	[0050.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.7z") returned 0
	[0050.709] lstrlenA (lpString="*.7z") returned 4
	[0050.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.tar") returned 0
	[0050.709] lstrlenA (lpString="*.tar") returned 5
	[0050.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.gzip") returned 0
	[0050.709] lstrlenA (lpString="*.gzip") returned 6
	[0050.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.jpg") returned 0
	[0050.709] lstrlenA (lpString="*.jpg") returned 5
	[0050.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.jpeg") returned 0
	[0050.709] lstrlenA (lpString="*.jpeg") returned 6
	[0050.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.psd") returned 0
	[0050.710] lstrlenA (lpString="*.psd") returned 5
	[0050.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.cdr") returned 0
	[0050.710] lstrlenA (lpString="*.cdr") returned 5
	[0050.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.dwg") returned 0
	[0050.710] lstrlenA (lpString="*.dwg") returned 5
	[0050.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.max") returned 0
	[0050.710] lstrlenA (lpString="*.max") returned 5
	[0050.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.bmp") returned 0
	[0050.710] lstrlenA (lpString="*.bmp") returned 5
	[0050.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", pszSpec="*.gif") returned 1
	[0050.710] lstrlenA (lpString="*.gif") returned 5
	[0050.710] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF"
	[0050.710] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF"
	[0050.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF."
	[0050.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.Boom"
	[0050.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0050.711] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc4
	[0050.711] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e59b110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1
	[0050.711] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.711] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xba1, lpOverlapped=0x0) returned 1
	[0050.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="WB02218_.GIF"
	[0050.712] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.712] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xba1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xba1, lpOverlapped=0x0) returned 1
	[0050.712] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.712] CloseHandle (hObject=0x90) returned 1
	[0050.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.boom")) returned 1
	[0050.713] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0050.713] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0050.713] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0050.714] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0050.714] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0050.714] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0050.714] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0050.714] lstrcmpA (lpString1=".", lpString2="Document Themes 14") returned -1
	[0050.714] lstrcmpA (lpString1="..", lpString2="Document Themes 14") returned -1
	[0050.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\*.*") returned="*.*"
	[0050.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\", lpString2="Document Themes 14" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14"
	[0050.714] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned 52
	[0050.714] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0050.765] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.765] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.766] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.766] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.766] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.766] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Adjacency.thmx") returned 1
	[0050.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adjacency.thmx") returned 1
	[0050.766] lstrcmpiA (lpString1="", lpString2="Adjacency.thmx") returned -1
	[0050.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*") returned="*.*"
	[0050.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0xffffffff
	[0050.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0050.767] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0050.767] WriteFile (in: hFile=0x88, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0050.768] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.768] CloseHandle (hObject=0x88) returned 1
	[0050.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Adjacency.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx"
	[0050.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.zip") returned 0
	[0050.768] lstrlenA (lpString="*.zip") returned 5
	[0050.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.rar") returned 0
	[0050.768] lstrlenA (lpString="*.rar") returned 5
	[0050.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.7z") returned 0
	[0050.768] lstrlenA (lpString="*.7z") returned 4
	[0050.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.tar") returned 0
	[0050.768] lstrlenA (lpString="*.tar") returned 5
	[0050.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.gzip") returned 0
	[0050.768] lstrlenA (lpString="*.gzip") returned 6
	[0050.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.jpg") returned 0
	[0050.768] lstrlenA (lpString="*.jpg") returned 5
	[0050.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.jpeg") returned 0
	[0050.769] lstrlenA (lpString="*.jpeg") returned 6
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.psd") returned 0
	[0050.769] lstrlenA (lpString="*.psd") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.cdr") returned 0
	[0050.769] lstrlenA (lpString="*.cdr") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.dwg") returned 0
	[0050.769] lstrlenA (lpString="*.dwg") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.max") returned 0
	[0050.769] lstrlenA (lpString="*.max") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.bmp") returned 0
	[0050.769] lstrlenA (lpString="*.bmp") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.gif") returned 0
	[0050.769] lstrlenA (lpString="*.gif") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.png") returned 0
	[0050.769] lstrlenA (lpString="*.png") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.doc") returned 0
	[0050.769] lstrlenA (lpString="*.doc") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.docx") returned 0
	[0050.769] lstrlenA (lpString="*.docx") returned 6
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.xls") returned 0
	[0050.769] lstrlenA (lpString="*.xls") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.xlsx") returned 0
	[0050.769] lstrlenA (lpString="*.xlsx") returned 6
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.ppt") returned 0
	[0050.769] lstrlenA (lpString="*.ppt") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.pptx") returned 0
	[0050.769] lstrlenA (lpString="*.pptx") returned 6
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.txt") returned 0
	[0050.769] lstrlenA (lpString="*.txt") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.pdf") returned 0
	[0050.769] lstrlenA (lpString="*.pdf") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.djvu") returned 0
	[0050.769] lstrlenA (lpString="*.djvu") returned 6
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.htm") returned 0
	[0050.769] lstrlenA (lpString="*.htm") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.html") returned 0
	[0050.769] lstrlenA (lpString="*.html") returned 6
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mdb") returned 0
	[0050.769] lstrlenA (lpString="*.mdb") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.cer") returned 0
	[0050.769] lstrlenA (lpString="*.cer") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.p12") returned 0
	[0050.769] lstrlenA (lpString="*.p12") returned 5
	[0050.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.pfx") returned 0
	[0050.769] lstrlenA (lpString="*.pfx") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.kwm") returned 0
	[0050.770] lstrlenA (lpString="*.kwm") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.pwm") returned 0
	[0050.770] lstrlenA (lpString="*.pwm") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.1cd") returned 0
	[0050.770] lstrlenA (lpString="*.1cd") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.md") returned 0
	[0050.770] lstrlenA (lpString="*.md") returned 4
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mdf") returned 0
	[0050.770] lstrlenA (lpString="*.mdf") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.dbf") returned 0
	[0050.770] lstrlenA (lpString="*.dbf") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.odt") returned 0
	[0050.770] lstrlenA (lpString="*.odt") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.vob") returned 0
	[0050.770] lstrlenA (lpString="*.vob") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.ifo") returned 0
	[0050.770] lstrlenA (lpString="*.ifo") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.lnk") returned 0
	[0050.770] lstrlenA (lpString="*.lnk") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.torrent") returned 0
	[0050.770] lstrlenA (lpString="*.torrent") returned 9
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mov") returned 0
	[0050.770] lstrlenA (lpString="*.mov") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.m2v") returned 0
	[0050.770] lstrlenA (lpString="*.m2v") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.3gp") returned 0
	[0050.770] lstrlenA (lpString="*.3gp") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mpeg") returned 0
	[0050.770] lstrlenA (lpString="*.mpeg") returned 6
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mpg") returned 0
	[0050.770] lstrlenA (lpString="*.mpg") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.flv") returned 0
	[0050.770] lstrlenA (lpString="*.flv") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.avi") returned 0
	[0050.770] lstrlenA (lpString="*.avi") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mp4") returned 0
	[0050.770] lstrlenA (lpString="*.mp4") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.wmv") returned 0
	[0050.770] lstrlenA (lpString="*.wmv") returned 5
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.divx") returned 0
	[0050.770] lstrlenA (lpString="*.divx") returned 6
	[0050.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mkv") returned 0
	[0050.770] lstrlenA (lpString="*.mkv") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.mp3") returned 0
	[0050.771] lstrlenA (lpString="*.mp3") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.wav") returned 0
	[0050.771] lstrlenA (lpString="*.wav") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.flac") returned 0
	[0050.771] lstrlenA (lpString="*.flac") returned 6
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.ape") returned 0
	[0050.771] lstrlenA (lpString="*.ape") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.wma") returned 0
	[0050.771] lstrlenA (lpString="*.wma") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.ac3") returned 0
	[0050.771] lstrlenA (lpString="*.ac3") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.exe") returned 0
	[0050.771] lstrlenA (lpString="*.exe") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", pszSpec="*.apk") returned 0
	[0050.771] lstrlenA (lpString="*.apk") returned 5
	[0050.771] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.771] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.771] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Angles.thmx") returned 1
	[0050.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Angles.thmx") returned 1
	[0050.771] lstrcmpiA (lpString1="", lpString2="Angles.thmx") returned -1
	[0050.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned="Adjacency.thmx"
	[0050.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Angles.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx"
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.zip") returned 0
	[0050.771] lstrlenA (lpString="*.zip") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.rar") returned 0
	[0050.771] lstrlenA (lpString="*.rar") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.7z") returned 0
	[0050.771] lstrlenA (lpString="*.7z") returned 4
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.tar") returned 0
	[0050.771] lstrlenA (lpString="*.tar") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.gzip") returned 0
	[0050.771] lstrlenA (lpString="*.gzip") returned 6
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.jpg") returned 0
	[0050.771] lstrlenA (lpString="*.jpg") returned 5
	[0050.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.jpeg") returned 0
	[0050.771] lstrlenA (lpString="*.jpeg") returned 6
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.psd") returned 0
	[0050.772] lstrlenA (lpString="*.psd") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.cdr") returned 0
	[0050.772] lstrlenA (lpString="*.cdr") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.dwg") returned 0
	[0050.772] lstrlenA (lpString="*.dwg") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.max") returned 0
	[0050.772] lstrlenA (lpString="*.max") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.bmp") returned 0
	[0050.772] lstrlenA (lpString="*.bmp") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.gif") returned 0
	[0050.772] lstrlenA (lpString="*.gif") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.png") returned 0
	[0050.772] lstrlenA (lpString="*.png") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.doc") returned 0
	[0050.772] lstrlenA (lpString="*.doc") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.docx") returned 0
	[0050.772] lstrlenA (lpString="*.docx") returned 6
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.xls") returned 0
	[0050.772] lstrlenA (lpString="*.xls") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.xlsx") returned 0
	[0050.772] lstrlenA (lpString="*.xlsx") returned 6
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.ppt") returned 0
	[0050.772] lstrlenA (lpString="*.ppt") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.pptx") returned 0
	[0050.772] lstrlenA (lpString="*.pptx") returned 6
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.txt") returned 0
	[0050.772] lstrlenA (lpString="*.txt") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.pdf") returned 0
	[0050.772] lstrlenA (lpString="*.pdf") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.djvu") returned 0
	[0050.772] lstrlenA (lpString="*.djvu") returned 6
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.htm") returned 0
	[0050.772] lstrlenA (lpString="*.htm") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.html") returned 0
	[0050.772] lstrlenA (lpString="*.html") returned 6
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mdb") returned 0
	[0050.772] lstrlenA (lpString="*.mdb") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.cer") returned 0
	[0050.772] lstrlenA (lpString="*.cer") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.p12") returned 0
	[0050.772] lstrlenA (lpString="*.p12") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.pfx") returned 0
	[0050.772] lstrlenA (lpString="*.pfx") returned 5
	[0050.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.kwm") returned 0
	[0050.773] lstrlenA (lpString="*.kwm") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.pwm") returned 0
	[0050.773] lstrlenA (lpString="*.pwm") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.1cd") returned 0
	[0050.773] lstrlenA (lpString="*.1cd") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.md") returned 0
	[0050.773] lstrlenA (lpString="*.md") returned 4
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mdf") returned 0
	[0050.773] lstrlenA (lpString="*.mdf") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.dbf") returned 0
	[0050.773] lstrlenA (lpString="*.dbf") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.odt") returned 0
	[0050.773] lstrlenA (lpString="*.odt") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.vob") returned 0
	[0050.773] lstrlenA (lpString="*.vob") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.ifo") returned 0
	[0050.773] lstrlenA (lpString="*.ifo") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.lnk") returned 0
	[0050.773] lstrlenA (lpString="*.lnk") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.torrent") returned 0
	[0050.773] lstrlenA (lpString="*.torrent") returned 9
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mov") returned 0
	[0050.773] lstrlenA (lpString="*.mov") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.m2v") returned 0
	[0050.773] lstrlenA (lpString="*.m2v") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.3gp") returned 0
	[0050.773] lstrlenA (lpString="*.3gp") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mpeg") returned 0
	[0050.773] lstrlenA (lpString="*.mpeg") returned 6
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mpg") returned 0
	[0050.773] lstrlenA (lpString="*.mpg") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.flv") returned 0
	[0050.773] lstrlenA (lpString="*.flv") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.avi") returned 0
	[0050.773] lstrlenA (lpString="*.avi") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mp4") returned 0
	[0050.773] lstrlenA (lpString="*.mp4") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.wmv") returned 0
	[0050.773] lstrlenA (lpString="*.wmv") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.divx") returned 0
	[0050.773] lstrlenA (lpString="*.divx") returned 6
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mkv") returned 0
	[0050.773] lstrlenA (lpString="*.mkv") returned 5
	[0050.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.mp3") returned 0
	[0050.773] lstrlenA (lpString="*.mp3") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.wav") returned 0
	[0050.774] lstrlenA (lpString="*.wav") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.flac") returned 0
	[0050.774] lstrlenA (lpString="*.flac") returned 6
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.ape") returned 0
	[0050.774] lstrlenA (lpString="*.ape") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.wma") returned 0
	[0050.774] lstrlenA (lpString="*.wma") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.ac3") returned 0
	[0050.774] lstrlenA (lpString="*.ac3") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.exe") returned 0
	[0050.774] lstrlenA (lpString="*.exe") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", pszSpec="*.apk") returned 0
	[0050.774] lstrlenA (lpString="*.apk") returned 5
	[0050.774] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.774] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.774] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Apex.thmx") returned 1
	[0050.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Apex.thmx") returned 1
	[0050.774] lstrcmpiA (lpString1="", lpString2="Apex.thmx") returned -1
	[0050.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned="Angles.thmx"
	[0050.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Apex.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx"
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.zip") returned 0
	[0050.774] lstrlenA (lpString="*.zip") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.rar") returned 0
	[0050.774] lstrlenA (lpString="*.rar") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.7z") returned 0
	[0050.774] lstrlenA (lpString="*.7z") returned 4
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.tar") returned 0
	[0050.774] lstrlenA (lpString="*.tar") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.gzip") returned 0
	[0050.774] lstrlenA (lpString="*.gzip") returned 6
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.jpg") returned 0
	[0050.774] lstrlenA (lpString="*.jpg") returned 5
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.jpeg") returned 0
	[0050.774] lstrlenA (lpString="*.jpeg") returned 6
	[0050.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.psd") returned 0
	[0050.775] lstrlenA (lpString="*.psd") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.cdr") returned 0
	[0050.775] lstrlenA (lpString="*.cdr") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.dwg") returned 0
	[0050.775] lstrlenA (lpString="*.dwg") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.max") returned 0
	[0050.775] lstrlenA (lpString="*.max") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.bmp") returned 0
	[0050.775] lstrlenA (lpString="*.bmp") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.gif") returned 0
	[0050.775] lstrlenA (lpString="*.gif") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.png") returned 0
	[0050.775] lstrlenA (lpString="*.png") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.doc") returned 0
	[0050.775] lstrlenA (lpString="*.doc") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.docx") returned 0
	[0050.775] lstrlenA (lpString="*.docx") returned 6
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.xls") returned 0
	[0050.775] lstrlenA (lpString="*.xls") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.xlsx") returned 0
	[0050.775] lstrlenA (lpString="*.xlsx") returned 6
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.ppt") returned 0
	[0050.775] lstrlenA (lpString="*.ppt") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.pptx") returned 0
	[0050.775] lstrlenA (lpString="*.pptx") returned 6
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.txt") returned 0
	[0050.775] lstrlenA (lpString="*.txt") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.pdf") returned 0
	[0050.775] lstrlenA (lpString="*.pdf") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.djvu") returned 0
	[0050.775] lstrlenA (lpString="*.djvu") returned 6
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.htm") returned 0
	[0050.775] lstrlenA (lpString="*.htm") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.html") returned 0
	[0050.775] lstrlenA (lpString="*.html") returned 6
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mdb") returned 0
	[0050.775] lstrlenA (lpString="*.mdb") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.cer") returned 0
	[0050.775] lstrlenA (lpString="*.cer") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.p12") returned 0
	[0050.775] lstrlenA (lpString="*.p12") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.pfx") returned 0
	[0050.775] lstrlenA (lpString="*.pfx") returned 5
	[0050.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.kwm") returned 0
	[0050.775] lstrlenA (lpString="*.kwm") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.pwm") returned 0
	[0050.776] lstrlenA (lpString="*.pwm") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.1cd") returned 0
	[0050.776] lstrlenA (lpString="*.1cd") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.md") returned 0
	[0050.776] lstrlenA (lpString="*.md") returned 4
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mdf") returned 0
	[0050.776] lstrlenA (lpString="*.mdf") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.dbf") returned 0
	[0050.776] lstrlenA (lpString="*.dbf") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.odt") returned 0
	[0050.776] lstrlenA (lpString="*.odt") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.vob") returned 0
	[0050.776] lstrlenA (lpString="*.vob") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.ifo") returned 0
	[0050.776] lstrlenA (lpString="*.ifo") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.lnk") returned 0
	[0050.776] lstrlenA (lpString="*.lnk") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.torrent") returned 0
	[0050.776] lstrlenA (lpString="*.torrent") returned 9
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mov") returned 0
	[0050.776] lstrlenA (lpString="*.mov") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.m2v") returned 0
	[0050.776] lstrlenA (lpString="*.m2v") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.3gp") returned 0
	[0050.776] lstrlenA (lpString="*.3gp") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mpeg") returned 0
	[0050.776] lstrlenA (lpString="*.mpeg") returned 6
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mpg") returned 0
	[0050.776] lstrlenA (lpString="*.mpg") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.flv") returned 0
	[0050.776] lstrlenA (lpString="*.flv") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.avi") returned 0
	[0050.776] lstrlenA (lpString="*.avi") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mp4") returned 0
	[0050.776] lstrlenA (lpString="*.mp4") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.wmv") returned 0
	[0050.776] lstrlenA (lpString="*.wmv") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.divx") returned 0
	[0050.776] lstrlenA (lpString="*.divx") returned 6
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mkv") returned 0
	[0050.776] lstrlenA (lpString="*.mkv") returned 5
	[0050.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.mp3") returned 0
	[0050.776] lstrlenA (lpString="*.mp3") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.wav") returned 0
	[0050.777] lstrlenA (lpString="*.wav") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.flac") returned 0
	[0050.777] lstrlenA (lpString="*.flac") returned 6
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.ape") returned 0
	[0050.777] lstrlenA (lpString="*.ape") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.wma") returned 0
	[0050.777] lstrlenA (lpString="*.wma") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.ac3") returned 0
	[0050.777] lstrlenA (lpString="*.ac3") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.exe") returned 0
	[0050.777] lstrlenA (lpString="*.exe") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", pszSpec="*.apk") returned 0
	[0050.777] lstrlenA (lpString="*.apk") returned 5
	[0050.777] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.777] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Apothecary.thmx") returned 1
	[0050.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Apothecary.thmx") returned 1
	[0050.777] lstrcmpiA (lpString1="", lpString2="Apothecary.thmx") returned -1
	[0050.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned="Apex.thmx"
	[0050.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Apothecary.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx"
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.zip") returned 0
	[0050.777] lstrlenA (lpString="*.zip") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.rar") returned 0
	[0050.777] lstrlenA (lpString="*.rar") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.7z") returned 0
	[0050.777] lstrlenA (lpString="*.7z") returned 4
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.tar") returned 0
	[0050.777] lstrlenA (lpString="*.tar") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.gzip") returned 0
	[0050.777] lstrlenA (lpString="*.gzip") returned 6
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.jpg") returned 0
	[0050.777] lstrlenA (lpString="*.jpg") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.jpeg") returned 0
	[0050.777] lstrlenA (lpString="*.jpeg") returned 6
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.psd") returned 0
	[0050.777] lstrlenA (lpString="*.psd") returned 5
	[0050.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.cdr") returned 0
	[0050.778] lstrlenA (lpString="*.cdr") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.dwg") returned 0
	[0050.778] lstrlenA (lpString="*.dwg") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.max") returned 0
	[0050.778] lstrlenA (lpString="*.max") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.bmp") returned 0
	[0050.778] lstrlenA (lpString="*.bmp") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.gif") returned 0
	[0050.778] lstrlenA (lpString="*.gif") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.png") returned 0
	[0050.778] lstrlenA (lpString="*.png") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.doc") returned 0
	[0050.778] lstrlenA (lpString="*.doc") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.docx") returned 0
	[0050.778] lstrlenA (lpString="*.docx") returned 6
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.xls") returned 0
	[0050.778] lstrlenA (lpString="*.xls") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.xlsx") returned 0
	[0050.778] lstrlenA (lpString="*.xlsx") returned 6
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.ppt") returned 0
	[0050.778] lstrlenA (lpString="*.ppt") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.pptx") returned 0
	[0050.778] lstrlenA (lpString="*.pptx") returned 6
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.txt") returned 0
	[0050.778] lstrlenA (lpString="*.txt") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.pdf") returned 0
	[0050.778] lstrlenA (lpString="*.pdf") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.djvu") returned 0
	[0050.778] lstrlenA (lpString="*.djvu") returned 6
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.htm") returned 0
	[0050.778] lstrlenA (lpString="*.htm") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.html") returned 0
	[0050.778] lstrlenA (lpString="*.html") returned 6
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mdb") returned 0
	[0050.778] lstrlenA (lpString="*.mdb") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.cer") returned 0
	[0050.778] lstrlenA (lpString="*.cer") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.p12") returned 0
	[0050.778] lstrlenA (lpString="*.p12") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.pfx") returned 0
	[0050.778] lstrlenA (lpString="*.pfx") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.kwm") returned 0
	[0050.778] lstrlenA (lpString="*.kwm") returned 5
	[0050.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.pwm") returned 0
	[0050.779] lstrlenA (lpString="*.pwm") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.1cd") returned 0
	[0050.779] lstrlenA (lpString="*.1cd") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.md") returned 0
	[0050.779] lstrlenA (lpString="*.md") returned 4
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mdf") returned 0
	[0050.779] lstrlenA (lpString="*.mdf") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.dbf") returned 0
	[0050.779] lstrlenA (lpString="*.dbf") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.odt") returned 0
	[0050.779] lstrlenA (lpString="*.odt") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.vob") returned 0
	[0050.779] lstrlenA (lpString="*.vob") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.ifo") returned 0
	[0050.779] lstrlenA (lpString="*.ifo") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.lnk") returned 0
	[0050.779] lstrlenA (lpString="*.lnk") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.torrent") returned 0
	[0050.779] lstrlenA (lpString="*.torrent") returned 9
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mov") returned 0
	[0050.779] lstrlenA (lpString="*.mov") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.m2v") returned 0
	[0050.779] lstrlenA (lpString="*.m2v") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.3gp") returned 0
	[0050.779] lstrlenA (lpString="*.3gp") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mpeg") returned 0
	[0050.779] lstrlenA (lpString="*.mpeg") returned 6
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mpg") returned 0
	[0050.779] lstrlenA (lpString="*.mpg") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.flv") returned 0
	[0050.779] lstrlenA (lpString="*.flv") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.avi") returned 0
	[0050.779] lstrlenA (lpString="*.avi") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mp4") returned 0
	[0050.779] lstrlenA (lpString="*.mp4") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.wmv") returned 0
	[0050.779] lstrlenA (lpString="*.wmv") returned 5
	[0050.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.divx") returned 0
	[0050.779] lstrlenA (lpString="*.divx") returned 6
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mkv") returned 0
	[0050.780] lstrlenA (lpString="*.mkv") returned 5
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.mp3") returned 0
	[0050.780] lstrlenA (lpString="*.mp3") returned 5
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.wav") returned 0
	[0050.780] lstrlenA (lpString="*.wav") returned 5
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.flac") returned 0
	[0050.780] lstrlenA (lpString="*.flac") returned 6
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.ape") returned 0
	[0050.780] lstrlenA (lpString="*.ape") returned 5
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.wma") returned 0
	[0050.780] lstrlenA (lpString="*.wma") returned 5
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.ac3") returned 0
	[0050.780] lstrlenA (lpString="*.ac3") returned 5
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.exe") returned 0
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", pszSpec="*.apk") returned 0
	[0050.780] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.780] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Aspect.thmx") returned 1
	[0050.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Aspect.thmx") returned 1
	[0050.780] lstrcmpiA (lpString1="", lpString2="Aspect.thmx") returned -1
	[0050.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned="Apothecary.thmx"
	[0050.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Aspect.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx"
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.zip") returned 0
	[0050.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.rar") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.7z") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.tar") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.gzip") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.jpg") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.jpeg") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.psd") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.cdr") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.dwg") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.max") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.bmp") returned 0
	[0050.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", pszSpec="*.gif") returned 0
	[0050.781] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.781] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.781] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Austin.thmx") returned 1
	[0050.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Austin.thmx") returned 1
	[0050.781] lstrcmpiA (lpString1="", lpString2="Austin.thmx") returned -1
	[0050.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned="Aspect.thmx"
	[0050.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Austin.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx"
	[0050.782] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.782] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.782] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Black Tie.thmx") returned 1
	[0050.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Black Tie.thmx") returned 1
	[0050.782] lstrcmpiA (lpString1="", lpString2="Black Tie.thmx") returned -1
	[0050.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned="Austin.thmx"
	[0050.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Black Tie.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx"
	[0050.782] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.782] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.782] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Civic.thmx") returned 1
	[0050.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Civic.thmx") returned 1
	[0050.782] lstrcmpiA (lpString1="", lpString2="Civic.thmx") returned -1
	[0050.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned="Black Tie.thmx"
	[0050.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Civic.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx"
	[0050.782] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.782] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.782] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Clarity.thmx") returned 1
	[0050.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Clarity.thmx") returned 1
	[0050.782] lstrcmpiA (lpString1="", lpString2="Clarity.thmx") returned -1
	[0050.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned="Civic.thmx"
	[0050.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Clarity.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx"
	[0050.783] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.783] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.783] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Composite.thmx") returned 1
	[0050.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Composite.thmx") returned 1
	[0050.783] lstrcmpiA (lpString1="", lpString2="Composite.thmx") returned -1
	[0050.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned="Clarity.thmx"
	[0050.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Composite.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx"
	[0050.783] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.783] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.783] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Concourse.thmx") returned 1
	[0050.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Concourse.thmx") returned 1
	[0050.783] lstrcmpiA (lpString1="", lpString2="Concourse.thmx") returned -1
	[0050.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned="Composite.thmx"
	[0050.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Concourse.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx"
	[0050.783] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.783] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.783] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Couture.thmx") returned 1
	[0050.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Couture.thmx") returned 1
	[0050.783] lstrcmpiA (lpString1="", lpString2="Couture.thmx") returned -1
	[0050.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned="Concourse.thmx"
	[0050.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Couture.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx"
	[0050.784] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.784] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.784] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Elemental.thmx") returned -1
	[0050.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Elemental.thmx") returned 1
	[0050.784] lstrcmpiA (lpString1="", lpString2="Elemental.thmx") returned -1
	[0050.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned="Couture.thmx"
	[0050.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Elemental.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx"
	[0050.784] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.784] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.784] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Equity.thmx") returned -1
	[0050.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Equity.thmx") returned 1
	[0050.784] lstrcmpiA (lpString1="", lpString2="Equity.thmx") returned -1
	[0050.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned="Elemental.thmx"
	[0050.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Equity.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx"
	[0050.784] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.784] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.784] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Essential.thmx") returned -1
	[0050.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Essential.thmx") returned 1
	[0050.784] lstrcmpiA (lpString1="", lpString2="Essential.thmx") returned -1
	[0050.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned="Equity.thmx"
	[0050.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Essential.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx"
	[0050.785] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.785] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.785] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Executive.thmx") returned -1
	[0050.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Executive.thmx") returned 1
	[0050.785] lstrcmpiA (lpString1="", lpString2="Executive.thmx") returned -1
	[0050.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned="Essential.thmx"
	[0050.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Executive.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx"
	[0050.785] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.785] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.785] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Flow.thmx") returned -1
	[0050.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flow.thmx") returned 1
	[0050.785] lstrcmpiA (lpString1="", lpString2="Flow.thmx") returned -1
	[0050.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned="Executive.thmx"
	[0050.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Flow.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx"
	[0050.785] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.785] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.785] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Foundry.thmx") returned -1
	[0050.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Foundry.thmx") returned 1
	[0050.785] lstrcmpiA (lpString1="", lpString2="Foundry.thmx") returned -1
	[0050.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned="Flow.thmx"
	[0050.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Foundry.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx"
	[0050.786] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.786] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.786] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Grid.thmx") returned -1
	[0050.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Grid.thmx") returned 1
	[0050.786] lstrcmpiA (lpString1="", lpString2="Grid.thmx") returned -1
	[0050.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned="Foundry.thmx"
	[0050.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Grid.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx"
	[0050.786] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.786] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.786] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hardcover.thmx") returned -1
	[0050.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hardcover.thmx") returned 1
	[0050.786] lstrcmpiA (lpString1="", lpString2="Hardcover.thmx") returned -1
	[0050.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned="Grid.thmx"
	[0050.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Hardcover.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx"
	[0050.786] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.786] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.786] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Horizon.thmx") returned -1
	[0050.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Horizon.thmx") returned 1
	[0050.787] lstrcmpiA (lpString1="", lpString2="Horizon.thmx") returned -1
	[0050.787] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned="Hardcover.thmx"
	[0050.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Horizon.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx"
	[0050.787] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.787] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.787] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Median.thmx") returned -1
	[0050.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Median.thmx") returned -1
	[0050.787] lstrcmpiA (lpString1="", lpString2="Median.thmx") returned -1
	[0050.787] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned="Horizon.thmx"
	[0050.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Median.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx"
	[0050.787] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.787] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.787] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Metro.thmx") returned -1
	[0050.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Metro.thmx") returned -1
	[0050.787] lstrcmpiA (lpString1="", lpString2="Metro.thmx") returned -1
	[0050.787] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned="Median.thmx"
	[0050.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Metro.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx"
	[0050.787] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.787] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.787] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Module.thmx") returned -1
	[0050.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Module.thmx") returned -1
	[0050.788] lstrcmpiA (lpString1="", lpString2="Module.thmx") returned -1
	[0050.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned="Metro.thmx"
	[0050.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Module.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx"
	[0050.788] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.788] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.788] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Newsprint.thmx") returned -1
	[0050.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Newsprint.thmx") returned -1
	[0050.788] lstrcmpiA (lpString1="", lpString2="Newsprint.thmx") returned -1
	[0050.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned="Module.thmx"
	[0050.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Newsprint.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx"
	[0050.788] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.788] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.788] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Opulent.thmx") returned -1
	[0050.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Opulent.thmx") returned -1
	[0050.788] lstrcmpiA (lpString1="", lpString2="Opulent.thmx") returned -1
	[0050.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned="Newsprint.thmx"
	[0050.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Opulent.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx"
	[0050.788] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.788] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.788] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Oriel.thmx") returned -1
	[0050.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oriel.thmx") returned -1
	[0050.789] lstrcmpiA (lpString1="", lpString2="Oriel.thmx") returned -1
	[0050.789] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned="Opulent.thmx"
	[0050.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Oriel.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx"
	[0050.789] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.789] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.789] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Origin.thmx") returned -1
	[0050.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Origin.thmx") returned -1
	[0050.789] lstrcmpiA (lpString1="", lpString2="Origin.thmx") returned -1
	[0050.789] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned="Oriel.thmx"
	[0050.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Origin.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx"
	[0050.789] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.789] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.789] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Paper.thmx") returned -1
	[0050.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Paper.thmx") returned -1
	[0050.789] lstrcmpiA (lpString1="", lpString2="Paper.thmx") returned -1
	[0050.789] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned="Origin.thmx"
	[0050.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Paper.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx"
	[0050.790] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.790] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.790] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Perspective.thmx") returned -1
	[0050.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Perspective.thmx") returned -1
	[0050.790] lstrcmpiA (lpString1="", lpString2="Perspective.thmx") returned -1
	[0050.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned="Paper.thmx"
	[0050.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Perspective.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx"
	[0050.790] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.790] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.790] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pushpin.thmx") returned -1
	[0050.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pushpin.thmx") returned -1
	[0050.790] lstrcmpiA (lpString1="", lpString2="Pushpin.thmx") returned -1
	[0050.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned="Perspective.thmx"
	[0050.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Pushpin.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx"
	[0050.790] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.790] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.790] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Slipstream.thmx") returned -1
	[0050.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slipstream.thmx") returned -1
	[0050.790] lstrcmpiA (lpString1="", lpString2="Slipstream.thmx") returned -1
	[0050.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned="Pushpin.thmx"
	[0050.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Slipstream.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx"
	[0050.791] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.791] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.791] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Solstice.thmx") returned -1
	[0050.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Solstice.thmx") returned -1
	[0050.791] lstrcmpiA (lpString1="", lpString2="Solstice.thmx") returned -1
	[0050.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned="Slipstream.thmx"
	[0050.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Solstice.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx"
	[0050.791] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.791] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.791] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Technic.thmx") returned -1
	[0050.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Technic.thmx") returned -1
	[0050.791] lstrcmpiA (lpString1="", lpString2="Technic.thmx") returned -1
	[0050.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned="Solstice.thmx"
	[0050.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Technic.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx"
	[0050.791] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.791] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.791] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Thatch.thmx") returned -1
	[0050.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Thatch.thmx") returned -1
	[0050.791] lstrcmpiA (lpString1="", lpString2="Thatch.thmx") returned -1
	[0050.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned="Technic.thmx"
	[0050.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Thatch.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx"
	[0050.792] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.792] lstrcmpA (lpString1=".", lpString2="Theme Colors") returned -1
	[0050.792] lstrcmpA (lpString1="..", lpString2="Theme Colors") returned -1
	[0050.792] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned="Thatch.thmx"
	[0050.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Theme Colors" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors"
	[0050.792] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0050.810] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.810] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.811] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.811] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.811] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.811] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.811] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Adjacency.xml") returned 1
	[0050.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adjacency.xml") returned 1
	[0050.811] lstrcmpiA (lpString1="", lpString2="Adjacency.xml") returned -1
	[0050.811] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*") returned="*.*"
	[0050.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.811] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0xffffffff
	[0050.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0050.814] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.814] CloseHandle (hObject=0x8c) returned 1
	[0050.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Adjacency.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml"
	[0050.814] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.814] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.814] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Angles.xml") returned 1
	[0050.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Angles.xml") returned 1
	[0050.814] lstrcmpiA (lpString1="", lpString2="Angles.xml") returned -1
	[0050.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned="Adjacency.xml"
	[0050.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.814] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Angles.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml"
	[0050.814] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.814] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.814] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Apex.xml") returned 1
	[0050.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Apex.xml") returned 1
	[0050.814] lstrcmpiA (lpString1="", lpString2="Apex.xml") returned -1
	[0050.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned="Angles.xml"
	[0050.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Apex.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml"
	[0050.815] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.815] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.815] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Apothecary.xml") returned 1
	[0050.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Apothecary.xml") returned 1
	[0050.815] lstrcmpiA (lpString1="", lpString2="Apothecary.xml") returned -1
	[0050.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned="Apex.xml"
	[0050.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Apothecary.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml"
	[0050.815] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.815] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.815] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Aspect.xml") returned 1
	[0050.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Aspect.xml") returned 1
	[0050.815] lstrcmpiA (lpString1="", lpString2="Aspect.xml") returned -1
	[0050.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned="Apothecary.xml"
	[0050.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Aspect.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml"
	[0050.815] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.815] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.815] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Austin.xml") returned 1
	[0050.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Austin.xml") returned 1
	[0050.815] lstrcmpiA (lpString1="", lpString2="Austin.xml") returned -1
	[0050.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned="Aspect.xml"
	[0050.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Austin.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml"
	[0050.816] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.816] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.816] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Black Tie.xml") returned 1
	[0050.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Black Tie.xml") returned 1
	[0050.816] lstrcmpiA (lpString1="", lpString2="Black Tie.xml") returned -1
	[0050.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned="Austin.xml"
	[0050.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Black Tie.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml"
	[0050.816] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.816] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.816] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Civic.xml") returned 1
	[0050.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Civic.xml") returned 1
	[0050.816] lstrcmpiA (lpString1="", lpString2="Civic.xml") returned -1
	[0050.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned="Black Tie.xml"
	[0050.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Civic.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml"
	[0050.816] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.816] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.816] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Clarity.xml") returned 1
	[0050.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Clarity.xml") returned 1
	[0050.817] lstrcmpiA (lpString1="", lpString2="Clarity.xml") returned -1
	[0050.817] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned="Civic.xml"
	[0050.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.817] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.817] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Clarity.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml"
	[0050.817] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.817] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.817] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Composite.xml") returned 1
	[0050.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Composite.xml") returned 1
	[0050.817] lstrcmpiA (lpString1="", lpString2="Composite.xml") returned -1
	[0050.817] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned="Clarity.xml"
	[0050.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.817] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.817] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Composite.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml"
	[0050.817] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.817] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.817] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Concourse.xml") returned 1
	[0050.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Concourse.xml") returned 1
	[0050.817] lstrcmpiA (lpString1="", lpString2="Concourse.xml") returned -1
	[0050.817] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned="Composite.xml"
	[0050.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.817] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.817] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Concourse.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml"
	[0050.817] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.817] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.817] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Couture.xml") returned 1
	[0050.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Couture.xml") returned 1
	[0050.818] lstrcmpiA (lpString1="", lpString2="Couture.xml") returned -1
	[0050.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned="Concourse.xml"
	[0050.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.818] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.818] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Couture.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml"
	[0050.818] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.818] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.818] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Elemental.xml") returned -1
	[0050.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Elemental.xml") returned 1
	[0050.818] lstrcmpiA (lpString1="", lpString2="Elemental.xml") returned -1
	[0050.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned="Couture.xml"
	[0050.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.818] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.818] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Elemental.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml"
	[0050.818] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.818] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.818] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Equity.xml") returned -1
	[0050.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Equity.xml") returned 1
	[0050.818] lstrcmpiA (lpString1="", lpString2="Equity.xml") returned -1
	[0050.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned="Elemental.xml"
	[0050.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.818] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.818] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Equity.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml"
	[0050.818] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.819] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.819] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Essential.xml") returned -1
	[0050.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Essential.xml") returned 1
	[0050.819] lstrcmpiA (lpString1="", lpString2="Essential.xml") returned -1
	[0050.819] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned="Equity.xml"
	[0050.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.819] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.819] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Essential.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml"
	[0050.819] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.819] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.819] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Executive.xml") returned -1
	[0050.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Executive.xml") returned 1
	[0050.819] lstrcmpiA (lpString1="", lpString2="Executive.xml") returned -1
	[0050.819] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned="Essential.xml"
	[0050.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.819] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.819] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Executive.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml"
	[0050.819] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.819] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.819] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Flow.xml") returned -1
	[0050.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flow.xml") returned 1
	[0050.819] lstrcmpiA (lpString1="", lpString2="Flow.xml") returned -1
	[0050.819] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned="Executive.xml"
	[0050.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.819] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.819] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Flow.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml"
	[0050.819] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.820] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.820] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Foundry.xml") returned -1
	[0050.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Foundry.xml") returned 1
	[0050.820] lstrcmpiA (lpString1="", lpString2="Foundry.xml") returned -1
	[0050.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned="Flow.xml"
	[0050.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Foundry.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml"
	[0050.820] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.820] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.820] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Grayscale.xml") returned -1
	[0050.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Grayscale.xml") returned 1
	[0050.820] lstrcmpiA (lpString1="", lpString2="Grayscale.xml") returned -1
	[0050.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned="Foundry.xml"
	[0050.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Grayscale.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml"
	[0050.820] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.820] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.820] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Grid.xml") returned -1
	[0050.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Grid.xml") returned 1
	[0050.820] lstrcmpiA (lpString1="", lpString2="Grid.xml") returned -1
	[0050.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned="Grayscale.xml"
	[0050.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Grid.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml"
	[0050.821] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.821] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.821] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hardcover.xml") returned -1
	[0050.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hardcover.xml") returned 1
	[0050.821] lstrcmpiA (lpString1="", lpString2="Hardcover.xml") returned -1
	[0050.821] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned="Grid.xml"
	[0050.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.821] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.821] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Hardcover.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml"
	[0050.821] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.821] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.821] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Horizon.xml") returned -1
	[0050.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Horizon.xml") returned 1
	[0050.821] lstrcmpiA (lpString1="", lpString2="Horizon.xml") returned -1
	[0050.821] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned="Hardcover.xml"
	[0050.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.821] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.821] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Horizon.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml"
	[0050.821] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.821] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.821] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Median.xml") returned -1
	[0050.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Median.xml") returned -1
	[0050.822] lstrcmpiA (lpString1="", lpString2="Median.xml") returned -1
	[0050.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned="Horizon.xml"
	[0050.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Median.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml"
	[0050.822] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.822] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.822] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Metro.xml") returned -1
	[0050.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Metro.xml") returned -1
	[0050.822] lstrcmpiA (lpString1="", lpString2="Metro.xml") returned -1
	[0050.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") returned="Median.xml"
	[0050.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Metro.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml"
	[0050.822] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.822] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.822] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Module.xml") returned -1
	[0050.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Module.xml") returned -1
	[0050.822] lstrcmpiA (lpString1="", lpString2="Module.xml") returned -1
	[0050.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned="Metro.xml"
	[0050.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Module.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml"
	[0050.822] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.822] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.823] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Newsprint.xml") returned -1
	[0050.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Newsprint.xml") returned -1
	[0050.823] lstrcmpiA (lpString1="", lpString2="Newsprint.xml") returned -1
	[0050.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned="Module.xml"
	[0050.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.823] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Newsprint.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml"
	[0050.823] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.823] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.823] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Opulent.xml") returned -1
	[0050.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Opulent.xml") returned -1
	[0050.823] lstrcmpiA (lpString1="", lpString2="Opulent.xml") returned -1
	[0050.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned="Newsprint.xml"
	[0050.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.823] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Opulent.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml"
	[0050.823] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.823] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.823] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Oriel.xml") returned -1
	[0050.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oriel.xml") returned -1
	[0050.823] lstrcmpiA (lpString1="", lpString2="Oriel.xml") returned -1
	[0050.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned="Opulent.xml"
	[0050.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.823] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Oriel.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml"
	[0050.823] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.823] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.824] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Origin.xml") returned -1
	[0050.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Origin.xml") returned -1
	[0050.824] lstrcmpiA (lpString1="", lpString2="Origin.xml") returned -1
	[0050.824] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned="Oriel.xml"
	[0050.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.824] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Origin.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml"
	[0050.824] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.824] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.824] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Paper.xml") returned -1
	[0050.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Paper.xml") returned -1
	[0050.824] lstrcmpiA (lpString1="", lpString2="Paper.xml") returned -1
	[0050.824] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned="Origin.xml"
	[0050.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.824] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Paper.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml"
	[0050.824] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.824] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.824] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Perspective.xml") returned -1
	[0050.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Perspective.xml") returned -1
	[0050.824] lstrcmpiA (lpString1="", lpString2="Perspective.xml") returned -1
	[0050.824] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned="Paper.xml"
	[0050.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.824] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Perspective.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml"
	[0050.824] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.824] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.825] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pushpin.xml") returned -1
	[0050.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pushpin.xml") returned -1
	[0050.825] lstrcmpiA (lpString1="", lpString2="Pushpin.xml") returned -1
	[0050.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned="Perspective.xml"
	[0050.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.825] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Pushpin.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml"
	[0050.825] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.825] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.825] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Slipstream.xml") returned -1
	[0050.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slipstream.xml") returned -1
	[0050.825] lstrcmpiA (lpString1="", lpString2="Slipstream.xml") returned -1
	[0050.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned="Pushpin.xml"
	[0050.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.825] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Slipstream.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml"
	[0050.825] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.825] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.825] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Solstice.xml") returned -1
	[0050.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Solstice.xml") returned -1
	[0050.825] lstrcmpiA (lpString1="", lpString2="Solstice.xml") returned -1
	[0050.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned="Slipstream.xml"
	[0050.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.825] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Solstice.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml"
	[0050.825] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.826] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.826] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Technic.xml") returned -1
	[0050.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Technic.xml") returned -1
	[0050.826] lstrcmpiA (lpString1="", lpString2="Technic.xml") returned -1
	[0050.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned="Solstice.xml"
	[0050.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.826] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.826] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Technic.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml"
	[0050.826] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.826] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.826] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Thatch.xml") returned -1
	[0050.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Thatch.xml") returned -1
	[0050.826] lstrcmpiA (lpString1="", lpString2="Thatch.xml") returned -1
	[0050.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned="Technic.xml"
	[0050.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.826] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.826] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Thatch.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml"
	[0050.826] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.826] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.826] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Trek.xml") returned -1
	[0050.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Trek.xml") returned -1
	[0050.826] lstrcmpiA (lpString1="", lpString2="Trek.xml") returned -1
	[0050.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned="Thatch.xml"
	[0050.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.826] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.826] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Trek.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml"
	[0050.827] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.827] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.827] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Urban.xml") returned -1
	[0050.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Urban.xml") returned -1
	[0050.827] lstrcmpiA (lpString1="", lpString2="Urban.xml") returned -1
	[0050.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned="Trek.xml"
	[0050.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Urban.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml"
	[0050.827] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.827] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.827] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Verve.xml") returned -1
	[0050.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Verve.xml") returned -1
	[0050.827] lstrcmpiA (lpString1="", lpString2="Verve.xml") returned -1
	[0050.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned="Urban.xml"
	[0050.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Verve.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml"
	[0050.827] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.827] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.827] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Waveform.xml") returned -1
	[0050.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Waveform.xml") returned -1
	[0050.827] lstrcmpiA (lpString1="", lpString2="Waveform.xml") returned -1
	[0050.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned="Verve.xml"
	[0050.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\"
	[0050.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned=""
	[0050.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt"
	[0050.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to decrypt files.txt")) returned 0x20
	[0050.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpString2="Waveform.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml"
	[0050.828] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0050.828] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0050.828] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.828] lstrcmpA (lpString1=".", lpString2="Theme Effects") returned -1
	[0050.828] lstrcmpA (lpString1="..", lpString2="Theme Effects") returned -1
	[0050.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*") returned="*.*"
	[0050.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Theme Effects" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects"
	[0050.828] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned 66
	[0050.828] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0050.839] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.839] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.881] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.881] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.881] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.881] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.881] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Adjacency.eftx") returned 1
	[0050.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adjacency.eftx") returned 1
	[0050.881] lstrcmpiA (lpString1="", lpString2="Adjacency.eftx") returned -1
	[0050.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*") returned="*.*"
	[0050.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0xffffffff
	[0050.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0050.882] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0050.882] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0050.883] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.883] CloseHandle (hObject=0x8c) returned 1
	[0050.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Adjacency.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx"
	[0050.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.zip") returned 0
	[0050.883] lstrlenA (lpString="*.zip") returned 5
	[0050.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.rar") returned 0
	[0050.883] lstrlenA (lpString="*.rar") returned 5
	[0050.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.7z") returned 0
	[0050.883] lstrlenA (lpString="*.7z") returned 4
	[0050.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.tar") returned 0
	[0050.883] lstrlenA (lpString="*.tar") returned 5
	[0050.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.gzip") returned 0
	[0050.883] lstrlenA (lpString="*.gzip") returned 6
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.jpg") returned 0
	[0050.884] lstrlenA (lpString="*.jpg") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.jpeg") returned 0
	[0050.884] lstrlenA (lpString="*.jpeg") returned 6
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.psd") returned 0
	[0050.884] lstrlenA (lpString="*.psd") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.cdr") returned 0
	[0050.884] lstrlenA (lpString="*.cdr") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.dwg") returned 0
	[0050.884] lstrlenA (lpString="*.dwg") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.max") returned 0
	[0050.884] lstrlenA (lpString="*.max") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.bmp") returned 0
	[0050.884] lstrlenA (lpString="*.bmp") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.gif") returned 0
	[0050.884] lstrlenA (lpString="*.gif") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.png") returned 0
	[0050.884] lstrlenA (lpString="*.png") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.doc") returned 0
	[0050.884] lstrlenA (lpString="*.doc") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.docx") returned 0
	[0050.884] lstrlenA (lpString="*.docx") returned 6
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.xls") returned 0
	[0050.884] lstrlenA (lpString="*.xls") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.xlsx") returned 0
	[0050.884] lstrlenA (lpString="*.xlsx") returned 6
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.ppt") returned 0
	[0050.884] lstrlenA (lpString="*.ppt") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.pptx") returned 0
	[0050.884] lstrlenA (lpString="*.pptx") returned 6
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.txt") returned 0
	[0050.884] lstrlenA (lpString="*.txt") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.pdf") returned 0
	[0050.884] lstrlenA (lpString="*.pdf") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.djvu") returned 0
	[0050.884] lstrlenA (lpString="*.djvu") returned 6
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.htm") returned 0
	[0050.884] lstrlenA (lpString="*.htm") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.html") returned 0
	[0050.884] lstrlenA (lpString="*.html") returned 6
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mdb") returned 0
	[0050.884] lstrlenA (lpString="*.mdb") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.cer") returned 0
	[0050.884] lstrlenA (lpString="*.cer") returned 5
	[0050.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.p12") returned 0
	[0050.885] lstrlenA (lpString="*.p12") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.pfx") returned 0
	[0050.885] lstrlenA (lpString="*.pfx") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.kwm") returned 0
	[0050.885] lstrlenA (lpString="*.kwm") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.pwm") returned 0
	[0050.885] lstrlenA (lpString="*.pwm") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.1cd") returned 0
	[0050.885] lstrlenA (lpString="*.1cd") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.md") returned 0
	[0050.885] lstrlenA (lpString="*.md") returned 4
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mdf") returned 0
	[0050.885] lstrlenA (lpString="*.mdf") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.dbf") returned 0
	[0050.885] lstrlenA (lpString="*.dbf") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.odt") returned 0
	[0050.885] lstrlenA (lpString="*.odt") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.vob") returned 0
	[0050.885] lstrlenA (lpString="*.vob") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.ifo") returned 0
	[0050.885] lstrlenA (lpString="*.ifo") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.lnk") returned 0
	[0050.885] lstrlenA (lpString="*.lnk") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.torrent") returned 0
	[0050.885] lstrlenA (lpString="*.torrent") returned 9
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mov") returned 0
	[0050.885] lstrlenA (lpString="*.mov") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.m2v") returned 0
	[0050.885] lstrlenA (lpString="*.m2v") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.3gp") returned 0
	[0050.885] lstrlenA (lpString="*.3gp") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mpeg") returned 0
	[0050.885] lstrlenA (lpString="*.mpeg") returned 6
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mpg") returned 0
	[0050.885] lstrlenA (lpString="*.mpg") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.flv") returned 0
	[0050.885] lstrlenA (lpString="*.flv") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.avi") returned 0
	[0050.885] lstrlenA (lpString="*.avi") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mp4") returned 0
	[0050.885] lstrlenA (lpString="*.mp4") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.wmv") returned 0
	[0050.885] lstrlenA (lpString="*.wmv") returned 5
	[0050.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.divx") returned 0
	[0050.885] lstrlenA (lpString="*.divx") returned 6
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mkv") returned 0
	[0050.886] lstrlenA (lpString="*.mkv") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.mp3") returned 0
	[0050.886] lstrlenA (lpString="*.mp3") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.wav") returned 0
	[0050.886] lstrlenA (lpString="*.wav") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.flac") returned 0
	[0050.886] lstrlenA (lpString="*.flac") returned 6
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.ape") returned 0
	[0050.886] lstrlenA (lpString="*.ape") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.wma") returned 0
	[0050.886] lstrlenA (lpString="*.wma") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.ac3") returned 0
	[0050.886] lstrlenA (lpString="*.ac3") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.exe") returned 0
	[0050.886] lstrlenA (lpString="*.exe") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", pszSpec="*.apk") returned 0
	[0050.886] lstrlenA (lpString="*.apk") returned 5
	[0050.886] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.886] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.886] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Angles.eftx") returned 1
	[0050.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Angles.eftx") returned 1
	[0050.886] lstrcmpiA (lpString1="", lpString2="Angles.eftx") returned -1
	[0050.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned="Adjacency.eftx"
	[0050.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.886] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.886] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Angles.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx"
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.zip") returned 0
	[0050.886] lstrlenA (lpString="*.zip") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.rar") returned 0
	[0050.886] lstrlenA (lpString="*.rar") returned 5
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.7z") returned 0
	[0050.886] lstrlenA (lpString="*.7z") returned 4
	[0050.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.tar") returned 0
	[0050.886] lstrlenA (lpString="*.tar") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.gzip") returned 0
	[0050.887] lstrlenA (lpString="*.gzip") returned 6
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.jpg") returned 0
	[0050.887] lstrlenA (lpString="*.jpg") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.jpeg") returned 0
	[0050.887] lstrlenA (lpString="*.jpeg") returned 6
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.psd") returned 0
	[0050.887] lstrlenA (lpString="*.psd") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.cdr") returned 0
	[0050.887] lstrlenA (lpString="*.cdr") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.dwg") returned 0
	[0050.887] lstrlenA (lpString="*.dwg") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.max") returned 0
	[0050.887] lstrlenA (lpString="*.max") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.bmp") returned 0
	[0050.887] lstrlenA (lpString="*.bmp") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.gif") returned 0
	[0050.887] lstrlenA (lpString="*.gif") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.png") returned 0
	[0050.887] lstrlenA (lpString="*.png") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.doc") returned 0
	[0050.887] lstrlenA (lpString="*.doc") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.docx") returned 0
	[0050.887] lstrlenA (lpString="*.docx") returned 6
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.xls") returned 0
	[0050.887] lstrlenA (lpString="*.xls") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.xlsx") returned 0
	[0050.887] lstrlenA (lpString="*.xlsx") returned 6
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.ppt") returned 0
	[0050.887] lstrlenA (lpString="*.ppt") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.pptx") returned 0
	[0050.887] lstrlenA (lpString="*.pptx") returned 6
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.txt") returned 0
	[0050.887] lstrlenA (lpString="*.txt") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.pdf") returned 0
	[0050.887] lstrlenA (lpString="*.pdf") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.djvu") returned 0
	[0050.887] lstrlenA (lpString="*.djvu") returned 6
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.htm") returned 0
	[0050.887] lstrlenA (lpString="*.htm") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.html") returned 0
	[0050.887] lstrlenA (lpString="*.html") returned 6
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mdb") returned 0
	[0050.887] lstrlenA (lpString="*.mdb") returned 5
	[0050.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.cer") returned 0
	[0050.888] lstrlenA (lpString="*.cer") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.p12") returned 0
	[0050.888] lstrlenA (lpString="*.p12") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.pfx") returned 0
	[0050.888] lstrlenA (lpString="*.pfx") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.kwm") returned 0
	[0050.888] lstrlenA (lpString="*.kwm") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.pwm") returned 0
	[0050.888] lstrlenA (lpString="*.pwm") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.1cd") returned 0
	[0050.888] lstrlenA (lpString="*.1cd") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.md") returned 0
	[0050.888] lstrlenA (lpString="*.md") returned 4
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mdf") returned 0
	[0050.888] lstrlenA (lpString="*.mdf") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.dbf") returned 0
	[0050.888] lstrlenA (lpString="*.dbf") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.odt") returned 0
	[0050.888] lstrlenA (lpString="*.odt") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.vob") returned 0
	[0050.888] lstrlenA (lpString="*.vob") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.ifo") returned 0
	[0050.888] lstrlenA (lpString="*.ifo") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.lnk") returned 0
	[0050.888] lstrlenA (lpString="*.lnk") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.torrent") returned 0
	[0050.888] lstrlenA (lpString="*.torrent") returned 9
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mov") returned 0
	[0050.888] lstrlenA (lpString="*.mov") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.m2v") returned 0
	[0050.888] lstrlenA (lpString="*.m2v") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.3gp") returned 0
	[0050.888] lstrlenA (lpString="*.3gp") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mpeg") returned 0
	[0050.888] lstrlenA (lpString="*.mpeg") returned 6
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mpg") returned 0
	[0050.888] lstrlenA (lpString="*.mpg") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.flv") returned 0
	[0050.888] lstrlenA (lpString="*.flv") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.avi") returned 0
	[0050.888] lstrlenA (lpString="*.avi") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mp4") returned 0
	[0050.888] lstrlenA (lpString="*.mp4") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.wmv") returned 0
	[0050.888] lstrlenA (lpString="*.wmv") returned 5
	[0050.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.divx") returned 0
	[0050.889] lstrlenA (lpString="*.divx") returned 6
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mkv") returned 0
	[0050.889] lstrlenA (lpString="*.mkv") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.mp3") returned 0
	[0050.889] lstrlenA (lpString="*.mp3") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.wav") returned 0
	[0050.889] lstrlenA (lpString="*.wav") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.flac") returned 0
	[0050.889] lstrlenA (lpString="*.flac") returned 6
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.ape") returned 0
	[0050.889] lstrlenA (lpString="*.ape") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.wma") returned 0
	[0050.889] lstrlenA (lpString="*.wma") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.ac3") returned 0
	[0050.889] lstrlenA (lpString="*.ac3") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.exe") returned 0
	[0050.889] lstrlenA (lpString="*.exe") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", pszSpec="*.apk") returned 0
	[0050.889] lstrlenA (lpString="*.apk") returned 5
	[0050.889] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.889] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.889] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Apex.eftx") returned 1
	[0050.889] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Apex.eftx") returned 1
	[0050.889] lstrcmpiA (lpString1="", lpString2="Apex.eftx") returned -1
	[0050.889] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned="Angles.eftx"
	[0050.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.889] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.889] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Apex.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx"
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.zip") returned 0
	[0050.889] lstrlenA (lpString="*.zip") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.rar") returned 0
	[0050.889] lstrlenA (lpString="*.rar") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.7z") returned 0
	[0050.889] lstrlenA (lpString="*.7z") returned 4
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.tar") returned 0
	[0050.889] lstrlenA (lpString="*.tar") returned 5
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.gzip") returned 0
	[0050.889] lstrlenA (lpString="*.gzip") returned 6
	[0050.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.jpg") returned 0
	[0050.890] lstrlenA (lpString="*.jpg") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.jpeg") returned 0
	[0050.890] lstrlenA (lpString="*.jpeg") returned 6
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.psd") returned 0
	[0050.890] lstrlenA (lpString="*.psd") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.cdr") returned 0
	[0050.890] lstrlenA (lpString="*.cdr") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.dwg") returned 0
	[0050.890] lstrlenA (lpString="*.dwg") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.max") returned 0
	[0050.890] lstrlenA (lpString="*.max") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.bmp") returned 0
	[0050.890] lstrlenA (lpString="*.bmp") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.gif") returned 0
	[0050.890] lstrlenA (lpString="*.gif") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.png") returned 0
	[0050.890] lstrlenA (lpString="*.png") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.doc") returned 0
	[0050.890] lstrlenA (lpString="*.doc") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.docx") returned 0
	[0050.890] lstrlenA (lpString="*.docx") returned 6
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.xls") returned 0
	[0050.890] lstrlenA (lpString="*.xls") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.xlsx") returned 0
	[0050.890] lstrlenA (lpString="*.xlsx") returned 6
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.ppt") returned 0
	[0050.890] lstrlenA (lpString="*.ppt") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.pptx") returned 0
	[0050.890] lstrlenA (lpString="*.pptx") returned 6
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.txt") returned 0
	[0050.890] lstrlenA (lpString="*.txt") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.pdf") returned 0
	[0050.890] lstrlenA (lpString="*.pdf") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.djvu") returned 0
	[0050.890] lstrlenA (lpString="*.djvu") returned 6
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.htm") returned 0
	[0050.890] lstrlenA (lpString="*.htm") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.html") returned 0
	[0050.890] lstrlenA (lpString="*.html") returned 6
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mdb") returned 0
	[0050.890] lstrlenA (lpString="*.mdb") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.cer") returned 0
	[0050.890] lstrlenA (lpString="*.cer") returned 5
	[0050.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.p12") returned 0
	[0050.890] lstrlenA (lpString="*.p12") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.pfx") returned 0
	[0050.891] lstrlenA (lpString="*.pfx") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.kwm") returned 0
	[0050.891] lstrlenA (lpString="*.kwm") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.pwm") returned 0
	[0050.891] lstrlenA (lpString="*.pwm") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.1cd") returned 0
	[0050.891] lstrlenA (lpString="*.1cd") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.md") returned 0
	[0050.891] lstrlenA (lpString="*.md") returned 4
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mdf") returned 0
	[0050.891] lstrlenA (lpString="*.mdf") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.dbf") returned 0
	[0050.891] lstrlenA (lpString="*.dbf") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.odt") returned 0
	[0050.891] lstrlenA (lpString="*.odt") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.vob") returned 0
	[0050.891] lstrlenA (lpString="*.vob") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.ifo") returned 0
	[0050.891] lstrlenA (lpString="*.ifo") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.lnk") returned 0
	[0050.891] lstrlenA (lpString="*.lnk") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.torrent") returned 0
	[0050.891] lstrlenA (lpString="*.torrent") returned 9
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mov") returned 0
	[0050.891] lstrlenA (lpString="*.mov") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.m2v") returned 0
	[0050.891] lstrlenA (lpString="*.m2v") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.3gp") returned 0
	[0050.891] lstrlenA (lpString="*.3gp") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mpeg") returned 0
	[0050.891] lstrlenA (lpString="*.mpeg") returned 6
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mpg") returned 0
	[0050.891] lstrlenA (lpString="*.mpg") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.flv") returned 0
	[0050.891] lstrlenA (lpString="*.flv") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.avi") returned 0
	[0050.891] lstrlenA (lpString="*.avi") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mp4") returned 0
	[0050.891] lstrlenA (lpString="*.mp4") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.wmv") returned 0
	[0050.891] lstrlenA (lpString="*.wmv") returned 5
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.divx") returned 0
	[0050.891] lstrlenA (lpString="*.divx") returned 6
	[0050.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mkv") returned 0
	[0050.892] lstrlenA (lpString="*.mkv") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.mp3") returned 0
	[0050.892] lstrlenA (lpString="*.mp3") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.wav") returned 0
	[0050.892] lstrlenA (lpString="*.wav") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.flac") returned 0
	[0050.892] lstrlenA (lpString="*.flac") returned 6
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.ape") returned 0
	[0050.892] lstrlenA (lpString="*.ape") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.wma") returned 0
	[0050.892] lstrlenA (lpString="*.wma") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.ac3") returned 0
	[0050.892] lstrlenA (lpString="*.ac3") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.exe") returned 0
	[0050.892] lstrlenA (lpString="*.exe") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", pszSpec="*.apk") returned 0
	[0050.892] lstrlenA (lpString="*.apk") returned 5
	[0050.892] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.892] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.892] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Apothecary.eftx") returned 1
	[0050.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Apothecary.eftx") returned 1
	[0050.892] lstrcmpiA (lpString1="", lpString2="Apothecary.eftx") returned -1
	[0050.892] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned="Apex.eftx"
	[0050.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.892] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Apothecary.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx"
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.zip") returned 0
	[0050.892] lstrlenA (lpString="*.zip") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.rar") returned 0
	[0050.892] lstrlenA (lpString="*.rar") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.7z") returned 0
	[0050.892] lstrlenA (lpString="*.7z") returned 4
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.tar") returned 0
	[0050.892] lstrlenA (lpString="*.tar") returned 5
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.gzip") returned 0
	[0050.892] lstrlenA (lpString="*.gzip") returned 6
	[0050.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.jpg") returned 0
	[0050.892] lstrlenA (lpString="*.jpg") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.jpeg") returned 0
	[0050.893] lstrlenA (lpString="*.jpeg") returned 6
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.psd") returned 0
	[0050.893] lstrlenA (lpString="*.psd") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.cdr") returned 0
	[0050.893] lstrlenA (lpString="*.cdr") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.dwg") returned 0
	[0050.893] lstrlenA (lpString="*.dwg") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.max") returned 0
	[0050.893] lstrlenA (lpString="*.max") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.bmp") returned 0
	[0050.893] lstrlenA (lpString="*.bmp") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.gif") returned 0
	[0050.893] lstrlenA (lpString="*.gif") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.png") returned 0
	[0050.893] lstrlenA (lpString="*.png") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.doc") returned 0
	[0050.893] lstrlenA (lpString="*.doc") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.docx") returned 0
	[0050.893] lstrlenA (lpString="*.docx") returned 6
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.xls") returned 0
	[0050.893] lstrlenA (lpString="*.xls") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.xlsx") returned 0
	[0050.893] lstrlenA (lpString="*.xlsx") returned 6
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.ppt") returned 0
	[0050.893] lstrlenA (lpString="*.ppt") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.pptx") returned 0
	[0050.893] lstrlenA (lpString="*.pptx") returned 6
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.txt") returned 0
	[0050.893] lstrlenA (lpString="*.txt") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.pdf") returned 0
	[0050.893] lstrlenA (lpString="*.pdf") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.djvu") returned 0
	[0050.893] lstrlenA (lpString="*.djvu") returned 6
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.htm") returned 0
	[0050.893] lstrlenA (lpString="*.htm") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.html") returned 0
	[0050.893] lstrlenA (lpString="*.html") returned 6
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mdb") returned 0
	[0050.893] lstrlenA (lpString="*.mdb") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.cer") returned 0
	[0050.893] lstrlenA (lpString="*.cer") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.p12") returned 0
	[0050.893] lstrlenA (lpString="*.p12") returned 5
	[0050.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.pfx") returned 0
	[0050.894] lstrlenA (lpString="*.pfx") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.kwm") returned 0
	[0050.894] lstrlenA (lpString="*.kwm") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.pwm") returned 0
	[0050.894] lstrlenA (lpString="*.pwm") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.1cd") returned 0
	[0050.894] lstrlenA (lpString="*.1cd") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.md") returned 0
	[0050.894] lstrlenA (lpString="*.md") returned 4
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mdf") returned 0
	[0050.894] lstrlenA (lpString="*.mdf") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.dbf") returned 0
	[0050.894] lstrlenA (lpString="*.dbf") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.odt") returned 0
	[0050.894] lstrlenA (lpString="*.odt") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.vob") returned 0
	[0050.894] lstrlenA (lpString="*.vob") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.ifo") returned 0
	[0050.894] lstrlenA (lpString="*.ifo") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.lnk") returned 0
	[0050.894] lstrlenA (lpString="*.lnk") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.torrent") returned 0
	[0050.894] lstrlenA (lpString="*.torrent") returned 9
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mov") returned 0
	[0050.894] lstrlenA (lpString="*.mov") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.m2v") returned 0
	[0050.894] lstrlenA (lpString="*.m2v") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.3gp") returned 0
	[0050.894] lstrlenA (lpString="*.3gp") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mpeg") returned 0
	[0050.894] lstrlenA (lpString="*.mpeg") returned 6
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mpg") returned 0
	[0050.894] lstrlenA (lpString="*.mpg") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.flv") returned 0
	[0050.894] lstrlenA (lpString="*.flv") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.avi") returned 0
	[0050.894] lstrlenA (lpString="*.avi") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mp4") returned 0
	[0050.894] lstrlenA (lpString="*.mp4") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.wmv") returned 0
	[0050.894] lstrlenA (lpString="*.wmv") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.divx") returned 0
	[0050.894] lstrlenA (lpString="*.divx") returned 6
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mkv") returned 0
	[0050.894] lstrlenA (lpString="*.mkv") returned 5
	[0050.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.mp3") returned 0
	[0050.895] lstrlenA (lpString="*.mp3") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.wav") returned 0
	[0050.895] lstrlenA (lpString="*.wav") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.flac") returned 0
	[0050.895] lstrlenA (lpString="*.flac") returned 6
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.ape") returned 0
	[0050.895] lstrlenA (lpString="*.ape") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.wma") returned 0
	[0050.895] lstrlenA (lpString="*.wma") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.ac3") returned 0
	[0050.895] lstrlenA (lpString="*.ac3") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.exe") returned 0
	[0050.895] lstrlenA (lpString="*.exe") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", pszSpec="*.apk") returned 0
	[0050.895] lstrlenA (lpString="*.apk") returned 5
	[0050.895] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.895] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.895] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Aspect.eftx") returned 1
	[0050.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Aspect.eftx") returned 1
	[0050.895] lstrcmpiA (lpString1="", lpString2="Aspect.eftx") returned -1
	[0050.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned="Apothecary.eftx"
	[0050.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.895] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Aspect.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx"
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.zip") returned 0
	[0050.895] lstrlenA (lpString="*.zip") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.rar") returned 0
	[0050.895] lstrlenA (lpString="*.rar") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.7z") returned 0
	[0050.895] lstrlenA (lpString="*.7z") returned 4
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.tar") returned 0
	[0050.895] lstrlenA (lpString="*.tar") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.gzip") returned 0
	[0050.895] lstrlenA (lpString="*.gzip") returned 6
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.jpg") returned 0
	[0050.895] lstrlenA (lpString="*.jpg") returned 5
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.jpeg") returned 0
	[0050.895] lstrlenA (lpString="*.jpeg") returned 6
	[0050.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.psd") returned 0
	[0050.896] lstrlenA (lpString="*.psd") returned 5
	[0050.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.cdr") returned 0
	[0050.896] lstrlenA (lpString="*.cdr") returned 5
	[0050.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.dwg") returned 0
	[0050.896] lstrlenA (lpString="*.dwg") returned 5
	[0050.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.max") returned 0
	[0050.896] lstrlenA (lpString="*.max") returned 5
	[0050.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.bmp") returned 0
	[0050.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", pszSpec="*.gif") returned 0
	[0050.896] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.896] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.896] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Austin.eftx") returned 1
	[0050.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Austin.eftx") returned 1
	[0050.896] lstrcmpiA (lpString1="", lpString2="Austin.eftx") returned -1
	[0050.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned="Aspect.eftx"
	[0050.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.896] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Austin.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx"
	[0050.896] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.896] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.896] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Black Tie.eftx") returned 1
	[0050.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Black Tie.eftx") returned 1
	[0050.896] lstrcmpiA (lpString1="", lpString2="Black Tie.eftx") returned -1
	[0050.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned="Austin.eftx"
	[0050.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.897] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Black Tie.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx"
	[0050.897] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.897] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.897] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Civic.eftx") returned 1
	[0050.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Civic.eftx") returned 1
	[0050.897] lstrcmpiA (lpString1="", lpString2="Civic.eftx") returned -1
	[0050.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned="Black Tie.eftx"
	[0050.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.897] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Civic.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx"
	[0050.897] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.897] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned="Civic.eftx"
	[0050.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.897] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Clarity.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx"
	[0050.897] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.897] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned="Clarity.eftx"
	[0050.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Composite.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx"
	[0050.898] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.898] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned="Composite.eftx"
	[0050.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Concourse.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx"
	[0050.898] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.898] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned="Concourse.eftx"
	[0050.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Couture.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx"
	[0050.898] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.898] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned="Couture.eftx"
	[0050.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Elemental.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx"
	[0050.899] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.899] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned="Elemental.eftx"
	[0050.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.899] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Equity.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx"
	[0050.899] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.899] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned="Equity.eftx"
	[0050.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.899] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Essential.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx"
	[0050.899] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.899] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned="Essential.eftx"
	[0050.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Executive.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx"
	[0050.900] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned="Executive.eftx"
	[0050.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Flow.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx"
	[0050.900] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned="Flow.eftx"
	[0050.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Foundry.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx"
	[0050.900] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned="Foundry.eftx"
	[0050.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Grid.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx"
	[0050.901] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned="Grid.eftx"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Hardcover.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx"
	[0050.901] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned="Hardcover.eftx"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Horizon.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx"
	[0050.901] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned="Horizon.eftx"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Median.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx"
	[0050.901] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned="Median.eftx"
	[0050.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Metro.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx"
	[0050.902] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned="Metro.eftx"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Module.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx"
	[0050.902] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned="Module.eftx"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Newsprint.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx"
	[0050.902] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned="Newsprint.eftx"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Opulent.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx"
	[0050.902] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned="Opulent.eftx"
	[0050.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Oriel.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx"
	[0050.903] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.903] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned="Oriel.eftx"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Origin.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx"
	[0050.903] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.903] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned="Origin.eftx"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Paper.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx"
	[0050.903] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.903] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned="Paper.eftx"
	[0050.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Perspective.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx"
	[0050.904] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned="Perspective.eftx"
	[0050.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Pushpin.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx"
	[0050.904] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned="Pushpin.eftx"
	[0050.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Slipstream.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx"
	[0050.904] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned="Slipstream.eftx"
	[0050.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Solstice.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx"
	[0050.904] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned="Solstice.eftx"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Technic.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx"
	[0050.905] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned="Technic.eftx"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Thatch.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx"
	[0050.905] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned="Thatch.eftx"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Trek.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx"
	[0050.905] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned="Trek.eftx"
	[0050.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Urban.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx"
	[0050.906] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.906] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned="Urban.eftx"
	[0050.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.906] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Verve.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx"
	[0050.906] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.906] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned="Verve.eftx"
	[0050.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\"
	[0050.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned=""
	[0050.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt"
	[0050.906] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to decrypt files.txt")) returned 0x20
	[0050.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpString2="Waveform.eftx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx"
	[0050.906] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0050.906] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0050.906] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.906] lstrcmpA (lpString1=".", lpString2="Theme Fonts") returned -1
	[0050.906] lstrcmpA (lpString1="..", lpString2="Theme Fonts") returned -1
	[0050.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*") returned="*.*"
	[0050.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Theme Fonts" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts"
	[0050.907] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0050.910] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.910] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.910] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.910] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.910] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.910] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*") returned="*.*"
	[0050.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.910] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0xffffffff
	[0050.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0050.913] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.913] CloseHandle (hObject=0x8c) returned 1
	[0050.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Adjacency.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml"
	[0050.914] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.914] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned="Adjacency.xml"
	[0050.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Angles.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml"
	[0050.914] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.914] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned="Angles.xml"
	[0050.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Apex.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml"
	[0050.915] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.915] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned="Apex.xml"
	[0050.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.915] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.915] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Apothecary.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml"
	[0050.915] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.915] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned="Apothecary.xml"
	[0050.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.915] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.915] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Aspect.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml"
	[0050.915] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.915] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned="Aspect.xml"
	[0050.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.915] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.915] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Austin.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml"
	[0050.916] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.916] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.916] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned="Austin.xml"
	[0050.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.917] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Black Tie.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml"
	[0050.917] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.917] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned="Black Tie.xml"
	[0050.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.917] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.917] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Civic.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml"
	[0050.917] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.917] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned="Civic.xml"
	[0050.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.917] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.917] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Clarity.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml"
	[0050.917] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.917] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned="Clarity.xml"
	[0050.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.917] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.917] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Composite.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml"
	[0050.917] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned="Composite.xml"
	[0050.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.918] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.918] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Concourse.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml"
	[0050.918] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned="Concourse.xml"
	[0050.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.918] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.918] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Couture.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml"
	[0050.918] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned="Couture.xml"
	[0050.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.918] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.918] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Elemental.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml"
	[0050.918] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned="Elemental.xml"
	[0050.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.918] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.918] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Equity.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml"
	[0050.919] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned="Equity.xml"
	[0050.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.919] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Essential.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml"
	[0050.919] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned="Essential.xml"
	[0050.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.919] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Executive.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml"
	[0050.919] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned="Executive.xml"
	[0050.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.919] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Flow.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml"
	[0050.919] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned="Flow.xml"
	[0050.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.920] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Foundry.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml"
	[0050.920] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned="Foundry.xml"
	[0050.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.920] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Grid.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml"
	[0050.920] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned="Grid.xml"
	[0050.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.920] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Hardcover.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml"
	[0050.920] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned="Hardcover.xml"
	[0050.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.920] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Horizon.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml"
	[0050.920] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned="Horizon.xml"
	[0050.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Median.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml"
	[0050.921] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.921] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned="Median.xml"
	[0050.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Metro.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml"
	[0050.921] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.921] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned="Metro.xml"
	[0050.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Module.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml"
	[0050.921] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.921] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned="Module.xml"
	[0050.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Newsprint.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml"
	[0050.922] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned="Newsprint.xml"
	[0050.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.922] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Office 2.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml"
	[0050.922] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned="Office 2.xml"
	[0050.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.922] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Office Classic 2.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml"
	[0050.922] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned="Office Classic 2.xml"
	[0050.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.922] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Office Classic.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml"
	[0050.922] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned="Office Classic.xml"
	[0050.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.923] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Opulent.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml"
	[0050.923] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.923] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.923] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned="Opulent.xml"
	[0050.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.923] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Oriel.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml"
	[0050.923] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.923] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.923] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned="Oriel.xml"
	[0050.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.923] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Origin.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml"
	[0050.923] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.923] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.923] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned="Origin.xml"
	[0050.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.923] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Paper.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml"
	[0050.924] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.924] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.924] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned="Paper.xml"
	[0050.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Perspective.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml"
	[0050.924] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.924] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.924] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned="Perspective.xml"
	[0050.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Pushpin.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml"
	[0050.924] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.924] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.924] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned="Pushpin.xml"
	[0050.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Slipstream.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml"
	[0050.924] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.924] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.924] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned="Slipstream.xml"
	[0050.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.925] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Solstice.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml"
	[0050.925] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned="Solstice.xml"
	[0050.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.925] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Technic.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml"
	[0050.925] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned="Technic.xml"
	[0050.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.925] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Thatch.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml"
	[0050.925] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned="Thatch.xml"
	[0050.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.925] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Trek.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml"
	[0050.925] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned="Trek.xml"
	[0050.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Urban.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml"
	[0050.926] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.926] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned="Urban.xml"
	[0050.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Verve.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml"
	[0050.926] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.926] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned="Verve.xml"
	[0050.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\"
	[0050.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned=""
	[0050.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt"
	[0050.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to decrypt files.txt")) returned 0x20
	[0050.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpString2="Waveform.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml"
	[0050.926] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0050.926] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0050.926] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.927] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*") returned="*.*"
	[0050.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Trek.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx"
	[0050.927] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.927] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned="Trek.thmx"
	[0050.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Urban.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx"
	[0050.927] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.927] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned="Urban.thmx"
	[0050.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Verve.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx"
	[0050.927] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.927] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0050.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned="Verve.thmx"
	[0050.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\"
	[0050.927] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned=""
	[0050.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt"
	[0050.927] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to decrypt files.txt")) returned 0x20
	[0050.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpString2="Waveform.thmx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx"
	[0050.928] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0050.928] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0050.928] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0050.928] lstrcmpA (lpString1=".", lpString2="MEDIA") returned -1
	[0050.928] lstrcmpA (lpString1="..", lpString2="MEDIA") returned -1
	[0050.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\*.*") returned="*.*"
	[0050.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\", lpString2="MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA"
	[0050.928] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA") returned 39
	[0050.928] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0050.929] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.929] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.929] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.929] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.929] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0050.929] lstrcmpA (lpString1=".", lpString2="CAGCAT10") returned -1
	[0050.929] lstrcmpA (lpString1="..", lpString2="CAGCAT10") returned -1
	[0050.929] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*") returned="*.*"
	[0050.929] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned 48
	[0050.929] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0050.940] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.940] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.941] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.941] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.941] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.941] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0050.941] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0050.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*") returned="*.*"
	[0050.941] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned 53
	[0050.941] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0050.941] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0050.941] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.941] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0050.941] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0050.941] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0050.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0050.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*") returned="*.*"
	[0050.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\"
	[0050.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned=""
	[0050.944] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0050.944] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0050.945] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.945] CloseHandle (hObject=0x90) returned 1
	[0050.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.zip") returned 0
	[0050.945] lstrlenA (lpString="*.zip") returned 5
	[0050.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.rar") returned 0
	[0050.945] lstrlenA (lpString="*.rar") returned 5
	[0050.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.7z") returned 0
	[0050.945] lstrlenA (lpString="*.7z") returned 4
	[0050.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.tar") returned 0
	[0050.946] lstrlenA (lpString="*.tar") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.gzip") returned 0
	[0050.946] lstrlenA (lpString="*.gzip") returned 6
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.jpg") returned 0
	[0050.946] lstrlenA (lpString="*.jpg") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.jpeg") returned 0
	[0050.946] lstrlenA (lpString="*.jpeg") returned 6
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.psd") returned 0
	[0050.946] lstrlenA (lpString="*.psd") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.cdr") returned 0
	[0050.946] lstrlenA (lpString="*.cdr") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.dwg") returned 0
	[0050.946] lstrlenA (lpString="*.dwg") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.max") returned 0
	[0050.946] lstrlenA (lpString="*.max") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.bmp") returned 0
	[0050.946] lstrlenA (lpString="*.bmp") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.gif") returned 0
	[0050.946] lstrlenA (lpString="*.gif") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.png") returned 0
	[0050.946] lstrlenA (lpString="*.png") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.doc") returned 0
	[0050.946] lstrlenA (lpString="*.doc") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.docx") returned 0
	[0050.946] lstrlenA (lpString="*.docx") returned 6
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.xls") returned 0
	[0050.946] lstrlenA (lpString="*.xls") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.xlsx") returned 0
	[0050.946] lstrlenA (lpString="*.xlsx") returned 6
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.ppt") returned 0
	[0050.946] lstrlenA (lpString="*.ppt") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.pptx") returned 0
	[0050.946] lstrlenA (lpString="*.pptx") returned 6
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.txt") returned 0
	[0050.946] lstrlenA (lpString="*.txt") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.pdf") returned 0
	[0050.946] lstrlenA (lpString="*.pdf") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.djvu") returned 0
	[0050.946] lstrlenA (lpString="*.djvu") returned 6
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.htm") returned 0
	[0050.946] lstrlenA (lpString="*.htm") returned 5
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.html") returned 0
	[0050.946] lstrlenA (lpString="*.html") returned 6
	[0050.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mdb") returned 0
	[0050.947] lstrlenA (lpString="*.mdb") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.cer") returned 0
	[0050.947] lstrlenA (lpString="*.cer") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.p12") returned 0
	[0050.947] lstrlenA (lpString="*.p12") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.pfx") returned 0
	[0050.947] lstrlenA (lpString="*.pfx") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.kwm") returned 0
	[0050.947] lstrlenA (lpString="*.kwm") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.pwm") returned 0
	[0050.947] lstrlenA (lpString="*.pwm") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.1cd") returned 0
	[0050.947] lstrlenA (lpString="*.1cd") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.md") returned 0
	[0050.947] lstrlenA (lpString="*.md") returned 4
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mdf") returned 0
	[0050.947] lstrlenA (lpString="*.mdf") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.dbf") returned 0
	[0050.947] lstrlenA (lpString="*.dbf") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.odt") returned 0
	[0050.947] lstrlenA (lpString="*.odt") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.vob") returned 0
	[0050.947] lstrlenA (lpString="*.vob") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.ifo") returned 0
	[0050.947] lstrlenA (lpString="*.ifo") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.lnk") returned 0
	[0050.947] lstrlenA (lpString="*.lnk") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.torrent") returned 0
	[0050.947] lstrlenA (lpString="*.torrent") returned 9
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mov") returned 0
	[0050.947] lstrlenA (lpString="*.mov") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.m2v") returned 0
	[0050.947] lstrlenA (lpString="*.m2v") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.3gp") returned 0
	[0050.947] lstrlenA (lpString="*.3gp") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mpeg") returned 0
	[0050.947] lstrlenA (lpString="*.mpeg") returned 6
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mpg") returned 0
	[0050.947] lstrlenA (lpString="*.mpg") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.flv") returned 0
	[0050.947] lstrlenA (lpString="*.flv") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.avi") returned 0
	[0050.947] lstrlenA (lpString="*.avi") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mp4") returned 0
	[0050.947] lstrlenA (lpString="*.mp4") returned 5
	[0050.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.wmv") returned 0
	[0050.948] lstrlenA (lpString="*.wmv") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.divx") returned 0
	[0050.948] lstrlenA (lpString="*.divx") returned 6
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mkv") returned 0
	[0050.948] lstrlenA (lpString="*.mkv") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mp3") returned 0
	[0050.948] lstrlenA (lpString="*.mp3") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.wav") returned 0
	[0050.948] lstrlenA (lpString="*.wav") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.flac") returned 0
	[0050.948] lstrlenA (lpString="*.flac") returned 6
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.ape") returned 0
	[0050.948] lstrlenA (lpString="*.ape") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.wma") returned 0
	[0050.948] lstrlenA (lpString="*.wma") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.ac3") returned 0
	[0050.948] lstrlenA (lpString="*.ac3") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.exe") returned 0
	[0050.948] lstrlenA (lpString="*.exe") returned 5
	[0050.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.apk") returned 0
	[0050.948] lstrlenA (lpString="*.apk") returned 5
	[0050.948] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0050.948] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0050.948] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.948] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CAGCAT10.DLL") returned 1
	[0050.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAGCAT10.DLL") returned 1
	[0050.948] lstrcmpiA (lpString1="", lpString2="CAGCAT10.DLL") returned -1
	[0050.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*") returned="*.*"
	[0050.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0xffffffff
	[0050.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0050.949] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0050.949] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0050.950] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0050.950] CloseHandle (hObject=0x8c) returned 1
	[0050.950] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="CAGCAT10.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL"
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.zip") returned 0
	[0050.950] lstrlenA (lpString="*.zip") returned 5
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.rar") returned 0
	[0050.950] lstrlenA (lpString="*.rar") returned 5
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.7z") returned 0
	[0050.950] lstrlenA (lpString="*.7z") returned 4
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.tar") returned 0
	[0050.950] lstrlenA (lpString="*.tar") returned 5
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.gzip") returned 0
	[0050.950] lstrlenA (lpString="*.gzip") returned 6
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.jpg") returned 0
	[0050.950] lstrlenA (lpString="*.jpg") returned 5
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.jpeg") returned 0
	[0050.950] lstrlenA (lpString="*.jpeg") returned 6
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.psd") returned 0
	[0050.950] lstrlenA (lpString="*.psd") returned 5
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.cdr") returned 0
	[0050.950] lstrlenA (lpString="*.cdr") returned 5
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.dwg") returned 0
	[0050.950] lstrlenA (lpString="*.dwg") returned 5
	[0050.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.max") returned 0
	[0050.950] lstrlenA (lpString="*.max") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.bmp") returned 0
	[0050.951] lstrlenA (lpString="*.bmp") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.gif") returned 0
	[0050.951] lstrlenA (lpString="*.gif") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.png") returned 0
	[0050.951] lstrlenA (lpString="*.png") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.doc") returned 0
	[0050.951] lstrlenA (lpString="*.doc") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.docx") returned 0
	[0050.951] lstrlenA (lpString="*.docx") returned 6
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.xls") returned 0
	[0050.951] lstrlenA (lpString="*.xls") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.xlsx") returned 0
	[0050.951] lstrlenA (lpString="*.xlsx") returned 6
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.ppt") returned 0
	[0050.951] lstrlenA (lpString="*.ppt") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.pptx") returned 0
	[0050.951] lstrlenA (lpString="*.pptx") returned 6
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.txt") returned 0
	[0050.951] lstrlenA (lpString="*.txt") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.pdf") returned 0
	[0050.951] lstrlenA (lpString="*.pdf") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.djvu") returned 0
	[0050.951] lstrlenA (lpString="*.djvu") returned 6
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.htm") returned 0
	[0050.951] lstrlenA (lpString="*.htm") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.html") returned 0
	[0050.951] lstrlenA (lpString="*.html") returned 6
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mdb") returned 0
	[0050.951] lstrlenA (lpString="*.mdb") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.cer") returned 0
	[0050.951] lstrlenA (lpString="*.cer") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.p12") returned 0
	[0050.951] lstrlenA (lpString="*.p12") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.pfx") returned 0
	[0050.951] lstrlenA (lpString="*.pfx") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.kwm") returned 0
	[0050.951] lstrlenA (lpString="*.kwm") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.pwm") returned 0
	[0050.951] lstrlenA (lpString="*.pwm") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.1cd") returned 0
	[0050.951] lstrlenA (lpString="*.1cd") returned 5
	[0050.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.md") returned 0
	[0050.951] lstrlenA (lpString="*.md") returned 4
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mdf") returned 0
	[0050.952] lstrlenA (lpString="*.mdf") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.dbf") returned 0
	[0050.952] lstrlenA (lpString="*.dbf") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.odt") returned 0
	[0050.952] lstrlenA (lpString="*.odt") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.vob") returned 0
	[0050.952] lstrlenA (lpString="*.vob") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.ifo") returned 0
	[0050.952] lstrlenA (lpString="*.ifo") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.lnk") returned 0
	[0050.952] lstrlenA (lpString="*.lnk") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.torrent") returned 0
	[0050.952] lstrlenA (lpString="*.torrent") returned 9
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mov") returned 0
	[0050.952] lstrlenA (lpString="*.mov") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.m2v") returned 0
	[0050.952] lstrlenA (lpString="*.m2v") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.3gp") returned 0
	[0050.952] lstrlenA (lpString="*.3gp") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mpeg") returned 0
	[0050.952] lstrlenA (lpString="*.mpeg") returned 6
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mpg") returned 0
	[0050.952] lstrlenA (lpString="*.mpg") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.flv") returned 0
	[0050.952] lstrlenA (lpString="*.flv") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.avi") returned 0
	[0050.952] lstrlenA (lpString="*.avi") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mp4") returned 0
	[0050.952] lstrlenA (lpString="*.mp4") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.wmv") returned 0
	[0050.952] lstrlenA (lpString="*.wmv") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.divx") returned 0
	[0050.952] lstrlenA (lpString="*.divx") returned 6
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mkv") returned 0
	[0050.952] lstrlenA (lpString="*.mkv") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mp3") returned 0
	[0050.952] lstrlenA (lpString="*.mp3") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.wav") returned 0
	[0050.952] lstrlenA (lpString="*.wav") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.flac") returned 0
	[0050.952] lstrlenA (lpString="*.flac") returned 6
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.ape") returned 0
	[0050.952] lstrlenA (lpString="*.ape") returned 5
	[0050.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.wma") returned 0
	[0050.953] lstrlenA (lpString="*.wma") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.ac3") returned 0
	[0050.953] lstrlenA (lpString="*.ac3") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.exe") returned 0
	[0050.953] lstrlenA (lpString="*.exe") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.apk") returned 0
	[0050.953] lstrlenA (lpString="*.apk") returned 5
	[0050.953] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.953] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.953] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CAGCAT10.MMW") returned 1
	[0050.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAGCAT10.MMW") returned 1
	[0050.953] lstrcmpiA (lpString1="", lpString2="CAGCAT10.MMW") returned -1
	[0050.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned="CAGCAT10.DLL"
	[0050.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="CAGCAT10.MMW" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW"
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.zip") returned 0
	[0050.953] lstrlenA (lpString="*.zip") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.rar") returned 0
	[0050.953] lstrlenA (lpString="*.rar") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.7z") returned 0
	[0050.953] lstrlenA (lpString="*.7z") returned 4
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.tar") returned 0
	[0050.953] lstrlenA (lpString="*.tar") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.gzip") returned 0
	[0050.953] lstrlenA (lpString="*.gzip") returned 6
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.jpg") returned 0
	[0050.953] lstrlenA (lpString="*.jpg") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.jpeg") returned 0
	[0050.953] lstrlenA (lpString="*.jpeg") returned 6
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.psd") returned 0
	[0050.953] lstrlenA (lpString="*.psd") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.cdr") returned 0
	[0050.953] lstrlenA (lpString="*.cdr") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.dwg") returned 0
	[0050.953] lstrlenA (lpString="*.dwg") returned 5
	[0050.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.max") returned 0
	[0050.953] lstrlenA (lpString="*.max") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.bmp") returned 0
	[0050.954] lstrlenA (lpString="*.bmp") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.gif") returned 0
	[0050.954] lstrlenA (lpString="*.gif") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.png") returned 0
	[0050.954] lstrlenA (lpString="*.png") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.doc") returned 0
	[0050.954] lstrlenA (lpString="*.doc") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.docx") returned 0
	[0050.954] lstrlenA (lpString="*.docx") returned 6
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.xls") returned 0
	[0050.954] lstrlenA (lpString="*.xls") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.xlsx") returned 0
	[0050.954] lstrlenA (lpString="*.xlsx") returned 6
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.ppt") returned 0
	[0050.954] lstrlenA (lpString="*.ppt") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.pptx") returned 0
	[0050.954] lstrlenA (lpString="*.pptx") returned 6
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.txt") returned 0
	[0050.954] lstrlenA (lpString="*.txt") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.pdf") returned 0
	[0050.954] lstrlenA (lpString="*.pdf") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.djvu") returned 0
	[0050.954] lstrlenA (lpString="*.djvu") returned 6
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.htm") returned 0
	[0050.954] lstrlenA (lpString="*.htm") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.html") returned 0
	[0050.954] lstrlenA (lpString="*.html") returned 6
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mdb") returned 0
	[0050.954] lstrlenA (lpString="*.mdb") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.cer") returned 0
	[0050.954] lstrlenA (lpString="*.cer") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.p12") returned 0
	[0050.954] lstrlenA (lpString="*.p12") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.pfx") returned 0
	[0050.954] lstrlenA (lpString="*.pfx") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.kwm") returned 0
	[0050.954] lstrlenA (lpString="*.kwm") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.pwm") returned 0
	[0050.954] lstrlenA (lpString="*.pwm") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.1cd") returned 0
	[0050.954] lstrlenA (lpString="*.1cd") returned 5
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.md") returned 0
	[0050.954] lstrlenA (lpString="*.md") returned 4
	[0050.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mdf") returned 0
	[0050.955] lstrlenA (lpString="*.mdf") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.dbf") returned 0
	[0050.955] lstrlenA (lpString="*.dbf") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.odt") returned 0
	[0050.955] lstrlenA (lpString="*.odt") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.vob") returned 0
	[0050.955] lstrlenA (lpString="*.vob") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.ifo") returned 0
	[0050.955] lstrlenA (lpString="*.ifo") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.lnk") returned 0
	[0050.955] lstrlenA (lpString="*.lnk") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.torrent") returned 0
	[0050.955] lstrlenA (lpString="*.torrent") returned 9
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mov") returned 0
	[0050.955] lstrlenA (lpString="*.mov") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.m2v") returned 0
	[0050.955] lstrlenA (lpString="*.m2v") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.3gp") returned 0
	[0050.955] lstrlenA (lpString="*.3gp") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mpeg") returned 0
	[0050.955] lstrlenA (lpString="*.mpeg") returned 6
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mpg") returned 0
	[0050.955] lstrlenA (lpString="*.mpg") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.flv") returned 0
	[0050.955] lstrlenA (lpString="*.flv") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.avi") returned 0
	[0050.955] lstrlenA (lpString="*.avi") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mp4") returned 0
	[0050.955] lstrlenA (lpString="*.mp4") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.wmv") returned 0
	[0050.955] lstrlenA (lpString="*.wmv") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.divx") returned 0
	[0050.955] lstrlenA (lpString="*.divx") returned 6
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mkv") returned 0
	[0050.955] lstrlenA (lpString="*.mkv") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mp3") returned 0
	[0050.955] lstrlenA (lpString="*.mp3") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.wav") returned 0
	[0050.955] lstrlenA (lpString="*.wav") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.flac") returned 0
	[0050.955] lstrlenA (lpString="*.flac") returned 6
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.ape") returned 0
	[0050.955] lstrlenA (lpString="*.ape") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.wma") returned 0
	[0050.955] lstrlenA (lpString="*.wma") returned 5
	[0050.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.ac3") returned 0
	[0050.956] lstrlenA (lpString="*.ac3") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.exe") returned 0
	[0050.956] lstrlenA (lpString="*.exe") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.apk") returned 0
	[0050.956] lstrlenA (lpString="*.apk") returned 5
	[0050.956] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.956] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.956] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ELPHRG01.WAV") returned -1
	[0050.956] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ELPHRG01.WAV") returned 1
	[0050.956] lstrcmpiA (lpString1="", lpString2="ELPHRG01.WAV") returned -1
	[0050.956] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="CAGCAT10.MMW"
	[0050.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.956] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.956] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.956] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.956] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="ELPHRG01.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV"
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.zip") returned 0
	[0050.956] lstrlenA (lpString="*.zip") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.rar") returned 0
	[0050.956] lstrlenA (lpString="*.rar") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.7z") returned 0
	[0050.956] lstrlenA (lpString="*.7z") returned 4
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.tar") returned 0
	[0050.956] lstrlenA (lpString="*.tar") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.gzip") returned 0
	[0050.956] lstrlenA (lpString="*.gzip") returned 6
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.jpg") returned 0
	[0050.956] lstrlenA (lpString="*.jpg") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.jpeg") returned 0
	[0050.956] lstrlenA (lpString="*.jpeg") returned 6
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.psd") returned 0
	[0050.956] lstrlenA (lpString="*.psd") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.cdr") returned 0
	[0050.956] lstrlenA (lpString="*.cdr") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.dwg") returned 0
	[0050.956] lstrlenA (lpString="*.dwg") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.max") returned 0
	[0050.956] lstrlenA (lpString="*.max") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.bmp") returned 0
	[0050.956] lstrlenA (lpString="*.bmp") returned 5
	[0050.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.gif") returned 0
	[0050.957] lstrlenA (lpString="*.gif") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.png") returned 0
	[0050.957] lstrlenA (lpString="*.png") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.doc") returned 0
	[0050.957] lstrlenA (lpString="*.doc") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.docx") returned 0
	[0050.957] lstrlenA (lpString="*.docx") returned 6
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.xls") returned 0
	[0050.957] lstrlenA (lpString="*.xls") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.xlsx") returned 0
	[0050.957] lstrlenA (lpString="*.xlsx") returned 6
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.ppt") returned 0
	[0050.957] lstrlenA (lpString="*.ppt") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.pptx") returned 0
	[0050.957] lstrlenA (lpString="*.pptx") returned 6
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.txt") returned 0
	[0050.957] lstrlenA (lpString="*.txt") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.pdf") returned 0
	[0050.957] lstrlenA (lpString="*.pdf") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.djvu") returned 0
	[0050.957] lstrlenA (lpString="*.djvu") returned 6
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.htm") returned 0
	[0050.957] lstrlenA (lpString="*.htm") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.html") returned 0
	[0050.957] lstrlenA (lpString="*.html") returned 6
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mdb") returned 0
	[0050.957] lstrlenA (lpString="*.mdb") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.cer") returned 0
	[0050.957] lstrlenA (lpString="*.cer") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.p12") returned 0
	[0050.957] lstrlenA (lpString="*.p12") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.pfx") returned 0
	[0050.957] lstrlenA (lpString="*.pfx") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.kwm") returned 0
	[0050.957] lstrlenA (lpString="*.kwm") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.pwm") returned 0
	[0050.957] lstrlenA (lpString="*.pwm") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.1cd") returned 0
	[0050.957] lstrlenA (lpString="*.1cd") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.md") returned 0
	[0050.957] lstrlenA (lpString="*.md") returned 4
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mdf") returned 0
	[0050.957] lstrlenA (lpString="*.mdf") returned 5
	[0050.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.dbf") returned 0
	[0050.957] lstrlenA (lpString="*.dbf") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.odt") returned 0
	[0050.958] lstrlenA (lpString="*.odt") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.vob") returned 0
	[0050.958] lstrlenA (lpString="*.vob") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.ifo") returned 0
	[0050.958] lstrlenA (lpString="*.ifo") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.lnk") returned 0
	[0050.958] lstrlenA (lpString="*.lnk") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.torrent") returned 0
	[0050.958] lstrlenA (lpString="*.torrent") returned 9
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mov") returned 0
	[0050.958] lstrlenA (lpString="*.mov") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.m2v") returned 0
	[0050.958] lstrlenA (lpString="*.m2v") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.3gp") returned 0
	[0050.958] lstrlenA (lpString="*.3gp") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mpeg") returned 0
	[0050.958] lstrlenA (lpString="*.mpeg") returned 6
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mpg") returned 0
	[0050.958] lstrlenA (lpString="*.mpg") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.flv") returned 0
	[0050.958] lstrlenA (lpString="*.flv") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.avi") returned 0
	[0050.958] lstrlenA (lpString="*.avi") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mp4") returned 0
	[0050.958] lstrlenA (lpString="*.mp4") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.wmv") returned 0
	[0050.958] lstrlenA (lpString="*.wmv") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.divx") returned 0
	[0050.958] lstrlenA (lpString="*.divx") returned 6
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mkv") returned 0
	[0050.958] lstrlenA (lpString="*.mkv") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mp3") returned 0
	[0050.958] lstrlenA (lpString="*.mp3") returned 5
	[0050.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.wav") returned 1
	[0050.958] lstrlenA (lpString="*.wav") returned 5
	[0050.958] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV"
	[0050.958] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV"
	[0050.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV."
	[0050.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.Boom"
	[0050.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0050.959] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x585a
	[0050.959] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11ec5600, dwHighDateTime=0x1bd4c14), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd180ea0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11ec5600, dwHighDateTime=0x1bd4c14)) returned 1
	[0050.959] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.959] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5837, lpOverlapped=0x0) returned 1
	[0050.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="ELPHRG01.WAV"
	[0050.971] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0050.971] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5837, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5837, lpOverlapped=0x0) returned 1
	[0050.972] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0050.972] CloseHandle (hObject=0x8c) returned 1
	[0050.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.boom")) returned 1
	[0050.973] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.973] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.973] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0088542.WMF") returned -1
	[0050.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0088542.WMF") returned -1
	[0050.973] lstrcmpiA (lpString1="", lpString2="J0088542.WMF") returned -1
	[0050.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="ELPHRG01.WAV"
	[0050.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0088542.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF"
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.zip") returned 0
	[0050.974] lstrlenA (lpString="*.zip") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.rar") returned 0
	[0050.974] lstrlenA (lpString="*.rar") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.7z") returned 0
	[0050.974] lstrlenA (lpString="*.7z") returned 4
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.tar") returned 0
	[0050.974] lstrlenA (lpString="*.tar") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.gzip") returned 0
	[0050.974] lstrlenA (lpString="*.gzip") returned 6
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.jpg") returned 0
	[0050.974] lstrlenA (lpString="*.jpg") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.jpeg") returned 0
	[0050.974] lstrlenA (lpString="*.jpeg") returned 6
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.psd") returned 0
	[0050.974] lstrlenA (lpString="*.psd") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.cdr") returned 0
	[0050.974] lstrlenA (lpString="*.cdr") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.dwg") returned 0
	[0050.974] lstrlenA (lpString="*.dwg") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.max") returned 0
	[0050.974] lstrlenA (lpString="*.max") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.bmp") returned 0
	[0050.974] lstrlenA (lpString="*.bmp") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.gif") returned 0
	[0050.974] lstrlenA (lpString="*.gif") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.png") returned 0
	[0050.974] lstrlenA (lpString="*.png") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.doc") returned 0
	[0050.974] lstrlenA (lpString="*.doc") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.docx") returned 0
	[0050.974] lstrlenA (lpString="*.docx") returned 6
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.xls") returned 0
	[0050.974] lstrlenA (lpString="*.xls") returned 5
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.xlsx") returned 0
	[0050.974] lstrlenA (lpString="*.xlsx") returned 6
	[0050.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.ppt") returned 0
	[0050.975] lstrlenA (lpString="*.ppt") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.pptx") returned 0
	[0050.975] lstrlenA (lpString="*.pptx") returned 6
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.txt") returned 0
	[0050.975] lstrlenA (lpString="*.txt") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.pdf") returned 0
	[0050.975] lstrlenA (lpString="*.pdf") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.djvu") returned 0
	[0050.975] lstrlenA (lpString="*.djvu") returned 6
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.htm") returned 0
	[0050.975] lstrlenA (lpString="*.htm") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.html") returned 0
	[0050.975] lstrlenA (lpString="*.html") returned 6
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mdb") returned 0
	[0050.975] lstrlenA (lpString="*.mdb") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.cer") returned 0
	[0050.975] lstrlenA (lpString="*.cer") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.p12") returned 0
	[0050.975] lstrlenA (lpString="*.p12") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.pfx") returned 0
	[0050.975] lstrlenA (lpString="*.pfx") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.kwm") returned 0
	[0050.975] lstrlenA (lpString="*.kwm") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.pwm") returned 0
	[0050.975] lstrlenA (lpString="*.pwm") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.1cd") returned 0
	[0050.975] lstrlenA (lpString="*.1cd") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.md") returned 0
	[0050.975] lstrlenA (lpString="*.md") returned 4
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mdf") returned 0
	[0050.975] lstrlenA (lpString="*.mdf") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.dbf") returned 0
	[0050.975] lstrlenA (lpString="*.dbf") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.odt") returned 0
	[0050.975] lstrlenA (lpString="*.odt") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.vob") returned 0
	[0050.975] lstrlenA (lpString="*.vob") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.ifo") returned 0
	[0050.975] lstrlenA (lpString="*.ifo") returned 5
	[0050.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.lnk") returned 0
	[0050.976] lstrlenA (lpString="*.lnk") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.torrent") returned 0
	[0050.976] lstrlenA (lpString="*.torrent") returned 9
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mov") returned 0
	[0050.976] lstrlenA (lpString="*.mov") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.m2v") returned 0
	[0050.976] lstrlenA (lpString="*.m2v") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.3gp") returned 0
	[0050.976] lstrlenA (lpString="*.3gp") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mpeg") returned 0
	[0050.976] lstrlenA (lpString="*.mpeg") returned 6
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mpg") returned 0
	[0050.976] lstrlenA (lpString="*.mpg") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.flv") returned 0
	[0050.976] lstrlenA (lpString="*.flv") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.avi") returned 0
	[0050.976] lstrlenA (lpString="*.avi") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mp4") returned 0
	[0050.976] lstrlenA (lpString="*.mp4") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.wmv") returned 0
	[0050.976] lstrlenA (lpString="*.wmv") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.divx") returned 0
	[0050.976] lstrlenA (lpString="*.divx") returned 6
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mkv") returned 0
	[0050.976] lstrlenA (lpString="*.mkv") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mp3") returned 0
	[0050.976] lstrlenA (lpString="*.mp3") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.wav") returned 0
	[0050.976] lstrlenA (lpString="*.wav") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.flac") returned 0
	[0050.976] lstrlenA (lpString="*.flac") returned 6
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.ape") returned 0
	[0050.976] lstrlenA (lpString="*.ape") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.wma") returned 0
	[0050.976] lstrlenA (lpString="*.wma") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.ac3") returned 0
	[0050.976] lstrlenA (lpString="*.ac3") returned 5
	[0050.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.exe") returned 0
	[0050.977] lstrlenA (lpString="*.exe") returned 5
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.apk") returned 0
	[0050.977] lstrlenA (lpString="*.apk") returned 5
	[0050.977] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.977] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.977] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0090070.WMF") returned -1
	[0050.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0090070.WMF") returned -1
	[0050.977] lstrcmpiA (lpString1="", lpString2="J0090070.WMF") returned -1
	[0050.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="J0088542.WMF"
	[0050.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.977] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0090070.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF"
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.zip") returned 0
	[0050.977] lstrlenA (lpString="*.zip") returned 5
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.rar") returned 0
	[0050.977] lstrlenA (lpString="*.rar") returned 5
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.7z") returned 0
	[0050.977] lstrlenA (lpString="*.7z") returned 4
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.tar") returned 0
	[0050.977] lstrlenA (lpString="*.tar") returned 5
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.gzip") returned 0
	[0050.977] lstrlenA (lpString="*.gzip") returned 6
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.jpg") returned 0
	[0050.977] lstrlenA (lpString="*.jpg") returned 5
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.jpeg") returned 0
	[0050.977] lstrlenA (lpString="*.jpeg") returned 6
	[0050.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.psd") returned 0
	[0050.977] lstrlenA (lpString="*.psd") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.cdr") returned 0
	[0050.978] lstrlenA (lpString="*.cdr") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.dwg") returned 0
	[0050.978] lstrlenA (lpString="*.dwg") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.max") returned 0
	[0050.978] lstrlenA (lpString="*.max") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.bmp") returned 0
	[0050.978] lstrlenA (lpString="*.bmp") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.gif") returned 0
	[0050.978] lstrlenA (lpString="*.gif") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.png") returned 0
	[0050.978] lstrlenA (lpString="*.png") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.doc") returned 0
	[0050.978] lstrlenA (lpString="*.doc") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.docx") returned 0
	[0050.978] lstrlenA (lpString="*.docx") returned 6
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.xls") returned 0
	[0050.978] lstrlenA (lpString="*.xls") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.xlsx") returned 0
	[0050.978] lstrlenA (lpString="*.xlsx") returned 6
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.ppt") returned 0
	[0050.978] lstrlenA (lpString="*.ppt") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.pptx") returned 0
	[0050.978] lstrlenA (lpString="*.pptx") returned 6
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.txt") returned 0
	[0050.978] lstrlenA (lpString="*.txt") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.pdf") returned 0
	[0050.978] lstrlenA (lpString="*.pdf") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.djvu") returned 0
	[0050.978] lstrlenA (lpString="*.djvu") returned 6
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.htm") returned 0
	[0050.978] lstrlenA (lpString="*.htm") returned 5
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.html") returned 0
	[0050.978] lstrlenA (lpString="*.html") returned 6
	[0050.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mdb") returned 0
	[0050.978] lstrlenA (lpString="*.mdb") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.cer") returned 0
	[0050.979] lstrlenA (lpString="*.cer") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.p12") returned 0
	[0050.979] lstrlenA (lpString="*.p12") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.pfx") returned 0
	[0050.979] lstrlenA (lpString="*.pfx") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.kwm") returned 0
	[0050.979] lstrlenA (lpString="*.kwm") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.pwm") returned 0
	[0050.979] lstrlenA (lpString="*.pwm") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.1cd") returned 0
	[0050.979] lstrlenA (lpString="*.1cd") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.md") returned 0
	[0050.979] lstrlenA (lpString="*.md") returned 4
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mdf") returned 0
	[0050.979] lstrlenA (lpString="*.mdf") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.dbf") returned 0
	[0050.979] lstrlenA (lpString="*.dbf") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.odt") returned 0
	[0050.979] lstrlenA (lpString="*.odt") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.vob") returned 0
	[0050.979] lstrlenA (lpString="*.vob") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.ifo") returned 0
	[0050.979] lstrlenA (lpString="*.ifo") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.lnk") returned 0
	[0050.979] lstrlenA (lpString="*.lnk") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.torrent") returned 0
	[0050.979] lstrlenA (lpString="*.torrent") returned 9
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mov") returned 0
	[0050.979] lstrlenA (lpString="*.mov") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.m2v") returned 0
	[0050.979] lstrlenA (lpString="*.m2v") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.3gp") returned 0
	[0050.979] lstrlenA (lpString="*.3gp") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mpeg") returned 0
	[0050.979] lstrlenA (lpString="*.mpeg") returned 6
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mpg") returned 0
	[0050.979] lstrlenA (lpString="*.mpg") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.flv") returned 0
	[0050.979] lstrlenA (lpString="*.flv") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.avi") returned 0
	[0050.979] lstrlenA (lpString="*.avi") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mp4") returned 0
	[0050.979] lstrlenA (lpString="*.mp4") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.wmv") returned 0
	[0050.979] lstrlenA (lpString="*.wmv") returned 5
	[0050.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.divx") returned 0
	[0050.980] lstrlenA (lpString="*.divx") returned 6
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mkv") returned 0
	[0050.980] lstrlenA (lpString="*.mkv") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mp3") returned 0
	[0050.980] lstrlenA (lpString="*.mp3") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.wav") returned 0
	[0050.980] lstrlenA (lpString="*.wav") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.flac") returned 0
	[0050.980] lstrlenA (lpString="*.flac") returned 6
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.ape") returned 0
	[0050.980] lstrlenA (lpString="*.ape") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.wma") returned 0
	[0050.980] lstrlenA (lpString="*.wma") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.ac3") returned 0
	[0050.980] lstrlenA (lpString="*.ac3") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.exe") returned 0
	[0050.980] lstrlenA (lpString="*.exe") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.apk") returned 0
	[0050.980] lstrlenA (lpString="*.apk") returned 5
	[0050.980] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.980] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.980] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0090386.WMF") returned -1
	[0050.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0090386.WMF") returned -1
	[0050.980] lstrcmpiA (lpString1="", lpString2="J0090386.WMF") returned -1
	[0050.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="J0090070.WMF"
	[0050.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0090386.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF"
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.zip") returned 0
	[0050.980] lstrlenA (lpString="*.zip") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.rar") returned 0
	[0050.980] lstrlenA (lpString="*.rar") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.7z") returned 0
	[0050.980] lstrlenA (lpString="*.7z") returned 4
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.tar") returned 0
	[0050.980] lstrlenA (lpString="*.tar") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.gzip") returned 0
	[0050.980] lstrlenA (lpString="*.gzip") returned 6
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.jpg") returned 0
	[0050.980] lstrlenA (lpString="*.jpg") returned 5
	[0050.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.jpeg") returned 0
	[0050.981] lstrlenA (lpString="*.jpeg") returned 6
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.psd") returned 0
	[0050.981] lstrlenA (lpString="*.psd") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.cdr") returned 0
	[0050.981] lstrlenA (lpString="*.cdr") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.dwg") returned 0
	[0050.981] lstrlenA (lpString="*.dwg") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.max") returned 0
	[0050.981] lstrlenA (lpString="*.max") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.bmp") returned 0
	[0050.981] lstrlenA (lpString="*.bmp") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.gif") returned 0
	[0050.981] lstrlenA (lpString="*.gif") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.png") returned 0
	[0050.981] lstrlenA (lpString="*.png") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.doc") returned 0
	[0050.981] lstrlenA (lpString="*.doc") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.docx") returned 0
	[0050.981] lstrlenA (lpString="*.docx") returned 6
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.xls") returned 0
	[0050.981] lstrlenA (lpString="*.xls") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.xlsx") returned 0
	[0050.981] lstrlenA (lpString="*.xlsx") returned 6
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.ppt") returned 0
	[0050.981] lstrlenA (lpString="*.ppt") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.pptx") returned 0
	[0050.981] lstrlenA (lpString="*.pptx") returned 6
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.txt") returned 0
	[0050.981] lstrlenA (lpString="*.txt") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.pdf") returned 0
	[0050.981] lstrlenA (lpString="*.pdf") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.djvu") returned 0
	[0050.981] lstrlenA (lpString="*.djvu") returned 6
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.htm") returned 0
	[0050.981] lstrlenA (lpString="*.htm") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.html") returned 0
	[0050.981] lstrlenA (lpString="*.html") returned 6
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mdb") returned 0
	[0050.981] lstrlenA (lpString="*.mdb") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.cer") returned 0
	[0050.981] lstrlenA (lpString="*.cer") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.p12") returned 0
	[0050.981] lstrlenA (lpString="*.p12") returned 5
	[0050.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.pfx") returned 0
	[0050.981] lstrlenA (lpString="*.pfx") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.kwm") returned 0
	[0050.982] lstrlenA (lpString="*.kwm") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.pwm") returned 0
	[0050.982] lstrlenA (lpString="*.pwm") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.1cd") returned 0
	[0050.982] lstrlenA (lpString="*.1cd") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.md") returned 0
	[0050.982] lstrlenA (lpString="*.md") returned 4
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mdf") returned 0
	[0050.982] lstrlenA (lpString="*.mdf") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.dbf") returned 0
	[0050.982] lstrlenA (lpString="*.dbf") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.odt") returned 0
	[0050.982] lstrlenA (lpString="*.odt") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.vob") returned 0
	[0050.982] lstrlenA (lpString="*.vob") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.ifo") returned 0
	[0050.982] lstrlenA (lpString="*.ifo") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.lnk") returned 0
	[0050.982] lstrlenA (lpString="*.lnk") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.torrent") returned 0
	[0050.982] lstrlenA (lpString="*.torrent") returned 9
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mov") returned 0
	[0050.982] lstrlenA (lpString="*.mov") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.m2v") returned 0
	[0050.982] lstrlenA (lpString="*.m2v") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.3gp") returned 0
	[0050.982] lstrlenA (lpString="*.3gp") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mpeg") returned 0
	[0050.982] lstrlenA (lpString="*.mpeg") returned 6
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mpg") returned 0
	[0050.982] lstrlenA (lpString="*.mpg") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.flv") returned 0
	[0050.982] lstrlenA (lpString="*.flv") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.avi") returned 0
	[0050.982] lstrlenA (lpString="*.avi") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mp4") returned 0
	[0050.982] lstrlenA (lpString="*.mp4") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.wmv") returned 0
	[0050.982] lstrlenA (lpString="*.wmv") returned 5
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.divx") returned 0
	[0050.982] lstrlenA (lpString="*.divx") returned 6
	[0050.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mkv") returned 0
	[0050.983] lstrlenA (lpString="*.mkv") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mp3") returned 0
	[0050.983] lstrlenA (lpString="*.mp3") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.wav") returned 0
	[0050.983] lstrlenA (lpString="*.wav") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.flac") returned 0
	[0050.983] lstrlenA (lpString="*.flac") returned 6
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.ape") returned 0
	[0050.983] lstrlenA (lpString="*.ape") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.wma") returned 0
	[0050.983] lstrlenA (lpString="*.wma") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.ac3") returned 0
	[0050.983] lstrlenA (lpString="*.ac3") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.exe") returned 0
	[0050.983] lstrlenA (lpString="*.exe") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.apk") returned 0
	[0050.983] lstrlenA (lpString="*.apk") returned 5
	[0050.983] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.983] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.983] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0149407.WMF") returned -1
	[0050.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149407.WMF") returned -1
	[0050.983] lstrcmpiA (lpString1="", lpString2="J0149407.WMF") returned -1
	[0050.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="J0090386.WMF"
	[0050.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.983] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149407.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF"
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.zip") returned 0
	[0050.983] lstrlenA (lpString="*.zip") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.rar") returned 0
	[0050.983] lstrlenA (lpString="*.rar") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.7z") returned 0
	[0050.983] lstrlenA (lpString="*.7z") returned 4
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.tar") returned 0
	[0050.983] lstrlenA (lpString="*.tar") returned 5
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.gzip") returned 0
	[0050.983] lstrlenA (lpString="*.gzip") returned 6
	[0050.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.jpg") returned 0
	[0050.984] lstrlenA (lpString="*.jpg") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.jpeg") returned 0
	[0050.984] lstrlenA (lpString="*.jpeg") returned 6
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.psd") returned 0
	[0050.984] lstrlenA (lpString="*.psd") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.cdr") returned 0
	[0050.984] lstrlenA (lpString="*.cdr") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.dwg") returned 0
	[0050.984] lstrlenA (lpString="*.dwg") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.max") returned 0
	[0050.984] lstrlenA (lpString="*.max") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.bmp") returned 0
	[0050.984] lstrlenA (lpString="*.bmp") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.gif") returned 0
	[0050.984] lstrlenA (lpString="*.gif") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.png") returned 0
	[0050.984] lstrlenA (lpString="*.png") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.doc") returned 0
	[0050.984] lstrlenA (lpString="*.doc") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.docx") returned 0
	[0050.984] lstrlenA (lpString="*.docx") returned 6
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.xls") returned 0
	[0050.984] lstrlenA (lpString="*.xls") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.xlsx") returned 0
	[0050.984] lstrlenA (lpString="*.xlsx") returned 6
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.ppt") returned 0
	[0050.984] lstrlenA (lpString="*.ppt") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.pptx") returned 0
	[0050.984] lstrlenA (lpString="*.pptx") returned 6
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.txt") returned 0
	[0050.984] lstrlenA (lpString="*.txt") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.pdf") returned 0
	[0050.984] lstrlenA (lpString="*.pdf") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.djvu") returned 0
	[0050.984] lstrlenA (lpString="*.djvu") returned 6
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.htm") returned 0
	[0050.984] lstrlenA (lpString="*.htm") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.html") returned 0
	[0050.984] lstrlenA (lpString="*.html") returned 6
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mdb") returned 0
	[0050.984] lstrlenA (lpString="*.mdb") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.cer") returned 0
	[0050.984] lstrlenA (lpString="*.cer") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.p12") returned 0
	[0050.984] lstrlenA (lpString="*.p12") returned 5
	[0050.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.pfx") returned 0
	[0050.985] lstrlenA (lpString="*.pfx") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.kwm") returned 0
	[0050.985] lstrlenA (lpString="*.kwm") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.pwm") returned 0
	[0050.985] lstrlenA (lpString="*.pwm") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.1cd") returned 0
	[0050.985] lstrlenA (lpString="*.1cd") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.md") returned 0
	[0050.985] lstrlenA (lpString="*.md") returned 4
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mdf") returned 0
	[0050.985] lstrlenA (lpString="*.mdf") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.dbf") returned 0
	[0050.985] lstrlenA (lpString="*.dbf") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.odt") returned 0
	[0050.985] lstrlenA (lpString="*.odt") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.vob") returned 0
	[0050.985] lstrlenA (lpString="*.vob") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.ifo") returned 0
	[0050.985] lstrlenA (lpString="*.ifo") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.lnk") returned 0
	[0050.985] lstrlenA (lpString="*.lnk") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.torrent") returned 0
	[0050.985] lstrlenA (lpString="*.torrent") returned 9
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mov") returned 0
	[0050.985] lstrlenA (lpString="*.mov") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.m2v") returned 0
	[0050.985] lstrlenA (lpString="*.m2v") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.3gp") returned 0
	[0050.985] lstrlenA (lpString="*.3gp") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mpeg") returned 0
	[0050.985] lstrlenA (lpString="*.mpeg") returned 6
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mpg") returned 0
	[0050.985] lstrlenA (lpString="*.mpg") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.flv") returned 0
	[0050.985] lstrlenA (lpString="*.flv") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.avi") returned 0
	[0050.985] lstrlenA (lpString="*.avi") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mp4") returned 0
	[0050.985] lstrlenA (lpString="*.mp4") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.wmv") returned 0
	[0050.985] lstrlenA (lpString="*.wmv") returned 5
	[0050.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.divx") returned 0
	[0050.986] lstrlenA (lpString="*.divx") returned 6
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mkv") returned 0
	[0050.986] lstrlenA (lpString="*.mkv") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mp3") returned 0
	[0050.986] lstrlenA (lpString="*.mp3") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.wav") returned 0
	[0050.986] lstrlenA (lpString="*.wav") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.flac") returned 0
	[0050.986] lstrlenA (lpString="*.flac") returned 6
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.ape") returned 0
	[0050.986] lstrlenA (lpString="*.ape") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.wma") returned 0
	[0050.986] lstrlenA (lpString="*.wma") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.ac3") returned 0
	[0050.986] lstrlenA (lpString="*.ac3") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.exe") returned 0
	[0050.986] lstrlenA (lpString="*.exe") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.apk") returned 0
	[0050.986] lstrlenA (lpString="*.apk") returned 5
	[0050.986] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.986] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.986] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0149481.WMF") returned -1
	[0050.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149481.WMF") returned -1
	[0050.986] lstrcmpiA (lpString1="", lpString2="J0149481.WMF") returned -1
	[0050.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="J0149407.WMF"
	[0050.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.986] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149481.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF"
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.zip") returned 0
	[0050.986] lstrlenA (lpString="*.zip") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.rar") returned 0
	[0050.986] lstrlenA (lpString="*.rar") returned 5
	[0050.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.7z") returned 0
	[0050.987] lstrlenA (lpString="*.7z") returned 4
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.tar") returned 0
	[0050.987] lstrlenA (lpString="*.tar") returned 5
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.gzip") returned 0
	[0050.987] lstrlenA (lpString="*.gzip") returned 6
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.jpg") returned 0
	[0050.987] lstrlenA (lpString="*.jpg") returned 5
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.jpeg") returned 0
	[0050.987] lstrlenA (lpString="*.jpeg") returned 6
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.psd") returned 0
	[0050.987] lstrlenA (lpString="*.psd") returned 5
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.cdr") returned 0
	[0050.987] lstrlenA (lpString="*.cdr") returned 5
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.dwg") returned 0
	[0050.987] lstrlenA (lpString="*.dwg") returned 5
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.max") returned 0
	[0050.987] lstrlenA (lpString="*.max") returned 5
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.bmp") returned 0
	[0050.987] lstrlenA (lpString="*.bmp") returned 5
	[0050.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.gif") returned 0
	[0050.987] lstrlenA (lpString="*.gif") returned 5
	[0050.987] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0149627.WMF") returned -1
	[0050.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149627.WMF") returned -1
	[0050.987] lstrcmpiA (lpString1="", lpString2="J0149627.WMF") returned -1
	[0050.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="J0149481.WMF"
	[0050.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149627.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF"
	[0050.988] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.988] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0149887.WMF") returned -1
	[0050.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149887.WMF") returned -1
	[0050.988] lstrcmpiA (lpString1="", lpString2="J0149887.WMF") returned -1
	[0050.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="J0149627.WMF"
	[0050.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149887.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF"
	[0050.988] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.988] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0157763.WMF") returned -1
	[0050.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157763.WMF") returned -1
	[0050.988] lstrcmpiA (lpString1="", lpString2="J0157763.WMF") returned -1
	[0050.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="J0149887.WMF"
	[0050.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0157763.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF"
	[0050.988] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.988] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0157995.WMF") returned -1
	[0050.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157995.WMF") returned -1
	[0050.989] lstrcmpiA (lpString1="", lpString2="J0157995.WMF") returned -1
	[0050.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="J0157763.WMF"
	[0050.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0157995.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF"
	[0050.989] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.989] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.989] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0158007.WMF") returned -1
	[0050.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0158007.WMF") returned -1
	[0050.989] lstrcmpiA (lpString1="", lpString2="J0158007.WMF") returned -1
	[0050.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="J0157995.WMF"
	[0050.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0158007.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF"
	[0050.989] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.989] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.989] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0183168.WMF") returned -1
	[0050.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183168.WMF") returned -1
	[0050.989] lstrcmpiA (lpString1="", lpString2="J0183168.WMF") returned -1
	[0050.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="J0158007.WMF"
	[0050.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0183168.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF"
	[0050.990] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.990] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0183290.WMF") returned -1
	[0050.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183290.WMF") returned -1
	[0050.990] lstrcmpiA (lpString1="", lpString2="J0183290.WMF") returned -1
	[0050.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="J0183168.WMF"
	[0050.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0183290.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF"
	[0050.990] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.990] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0183328.WMF") returned -1
	[0050.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183328.WMF") returned -1
	[0050.990] lstrcmpiA (lpString1="", lpString2="J0183328.WMF") returned -1
	[0050.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="J0183290.WMF"
	[0050.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0183328.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF"
	[0050.990] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.990] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0185604.WMF") returned -1
	[0050.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185604.WMF") returned -1
	[0050.990] lstrcmpiA (lpString1="", lpString2="J0185604.WMF") returned -1
	[0050.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="J0183328.WMF"
	[0050.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0185604.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF"
	[0050.991] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0186002.WMF") returned -1
	[0050.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186002.WMF") returned -1
	[0050.991] lstrcmpiA (lpString1="", lpString2="J0186002.WMF") returned -1
	[0050.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="J0185604.WMF"
	[0050.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0186002.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF"
	[0050.991] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0186348.WMF") returned -1
	[0050.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186348.WMF") returned -1
	[0050.991] lstrcmpiA (lpString1="", lpString2="J0186348.WMF") returned -1
	[0050.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="J0186002.WMF"
	[0050.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0186348.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF"
	[0050.991] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0187423.WMF") returned -1
	[0050.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187423.WMF") returned -1
	[0050.991] lstrcmpiA (lpString1="", lpString2="J0187423.WMF") returned -1
	[0050.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="J0186348.WMF"
	[0050.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0187423.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF"
	[0050.992] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.992] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0195384.WMF") returned -1
	[0050.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195384.WMF") returned -1
	[0050.992] lstrcmpiA (lpString1="", lpString2="J0195384.WMF") returned -1
	[0050.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="J0187423.WMF"
	[0050.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0195384.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF"
	[0050.992] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.992] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0195534.WMF") returned -1
	[0050.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195534.WMF") returned -1
	[0050.992] lstrcmpiA (lpString1="", lpString2="J0195534.WMF") returned -1
	[0050.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="J0195384.WMF"
	[0050.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0195534.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF"
	[0050.992] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.992] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0195812.WMF") returned -1
	[0050.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195812.WMF") returned -1
	[0050.993] lstrcmpiA (lpString1="", lpString2="J0195812.WMF") returned -1
	[0050.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="J0195534.WMF"
	[0050.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0195812.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF"
	[0050.993] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.993] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0196164.WMF") returned -1
	[0050.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196164.WMF") returned -1
	[0050.993] lstrcmpiA (lpString1="", lpString2="J0196164.WMF") returned -1
	[0050.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="J0195812.WMF"
	[0050.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0196164.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF"
	[0050.993] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.993] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0196374.WMF") returned -1
	[0050.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196374.WMF") returned -1
	[0050.993] lstrcmpiA (lpString1="", lpString2="J0196374.WMF") returned -1
	[0050.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned="J0196164.WMF"
	[0050.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0196374.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF"
	[0050.993] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.993] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0196400.WMF") returned -1
	[0050.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196400.WMF") returned -1
	[0050.993] lstrcmpiA (lpString1="", lpString2="J0196400.WMF") returned -1
	[0050.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned="J0196374.WMF"
	[0050.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0196400.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF"
	[0050.994] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.994] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.994] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0199036.WMF") returned -1
	[0050.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199036.WMF") returned -1
	[0050.994] lstrcmpiA (lpString1="", lpString2="J0199036.WMF") returned -1
	[0050.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned="J0196400.WMF"
	[0050.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199036.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF"
	[0050.994] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.994] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.994] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0199283.WMF") returned -1
	[0050.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199283.WMF") returned -1
	[0050.994] lstrcmpiA (lpString1="", lpString2="J0199283.WMF") returned -1
	[0050.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned="J0199036.WMF"
	[0050.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199283.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF"
	[0050.994] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.994] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.994] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0199549.WMF") returned -1
	[0050.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199549.WMF") returned -1
	[0050.994] lstrcmpiA (lpString1="", lpString2="J0199549.WMF") returned -1
	[0050.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned="J0199283.WMF"
	[0050.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199549.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF"
	[0050.995] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0199661.WMF") returned -1
	[0050.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199661.WMF") returned -1
	[0050.995] lstrcmpiA (lpString1="", lpString2="J0199661.WMF") returned -1
	[0050.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned="J0199549.WMF"
	[0050.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199661.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF"
	[0050.995] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0199727.WMF") returned -1
	[0050.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199727.WMF") returned -1
	[0050.995] lstrcmpiA (lpString1="", lpString2="J0199727.WMF") returned -1
	[0050.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned="J0199661.WMF"
	[0050.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199727.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF"
	[0050.995] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0199755.WMF") returned -1
	[0050.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199755.WMF") returned -1
	[0050.996] lstrcmpiA (lpString1="", lpString2="J0199755.WMF") returned -1
	[0050.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned="J0199727.WMF"
	[0050.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199755.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF"
	[0050.996] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.996] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.996] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0199805.WMF") returned -1
	[0050.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199805.WMF") returned -1
	[0050.997] lstrcmpiA (lpString1="", lpString2="J0199805.WMF") returned -1
	[0050.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned="J0199755.WMF"
	[0050.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199805.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF"
	[0050.997] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.997] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.997] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0205462.WMF") returned -1
	[0050.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0205462.WMF") returned -1
	[0050.997] lstrcmpiA (lpString1="", lpString2="J0205462.WMF") returned -1
	[0050.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned="J0199805.WMF"
	[0050.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0205462.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF"
	[0050.997] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.997] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.997] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0205466.WMF") returned -1
	[0050.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0205466.WMF") returned -1
	[0050.997] lstrcmpiA (lpString1="", lpString2="J0205466.WMF") returned -1
	[0050.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned="J0205462.WMF"
	[0050.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0205466.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF"
	[0050.997] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.997] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.997] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0205582.WMF") returned -1
	[0050.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0205582.WMF") returned -1
	[0050.998] lstrcmpiA (lpString1="", lpString2="J0205582.WMF") returned -1
	[0050.998] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned="J0205466.WMF"
	[0050.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0205582.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF"
	[0050.998] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.998] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.998] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0211949.WMF") returned -1
	[0050.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0211949.WMF") returned -1
	[0050.998] lstrcmpiA (lpString1="", lpString2="J0211949.WMF") returned -1
	[0050.998] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned="J0205582.WMF"
	[0050.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0211949.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF"
	[0050.998] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.998] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.998] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0212219.WMF") returned -1
	[0050.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212219.WMF") returned -1
	[0050.998] lstrcmpiA (lpString1="", lpString2="J0212219.WMF") returned -1
	[0050.998] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned="J0211949.WMF"
	[0050.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212219.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF"
	[0050.999] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.999] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.999] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0212661.WMF") returned -1
	[0050.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212661.WMF") returned -1
	[0050.999] lstrcmpiA (lpString1="", lpString2="J0212661.WMF") returned -1
	[0050.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned="J0212219.WMF"
	[0050.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.999] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.999] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212661.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF"
	[0050.999] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.999] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.999] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0212701.WMF") returned -1
	[0050.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212701.WMF") returned -1
	[0050.999] lstrcmpiA (lpString1="", lpString2="J0212701.WMF") returned -1
	[0050.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned="J0212661.WMF"
	[0050.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0050.999] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0050.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0050.999] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0050.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212701.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF"
	[0050.999] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0050.999] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0050.999] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0212957.WMF") returned -1
	[0050.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212957.WMF") returned -1
	[0050.999] lstrcmpiA (lpString1="", lpString2="J0212957.WMF") returned -1
	[0050.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned="J0212701.WMF"
	[0050.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.000] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212957.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF"
	[0051.000] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.000] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.000] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0214098.WAV") returned -1
	[0051.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0214098.WAV") returned -1
	[0051.000] lstrcmpiA (lpString1="", lpString2="J0214098.WAV") returned -1
	[0051.000] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned="J0212957.WMF"
	[0051.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.000] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.000] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0214098.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV"
	[0051.000] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV"
	[0051.000] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV"
	[0051.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV."
	[0051.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.Boom"
	[0051.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0051.021] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68ba
	[0051.022] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8726e600, dwHighDateTime=0x1be59a2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd512fa0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8726e600, dwHighDateTime=0x1be59a2)) returned 1
	[0051.022] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.022] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6897, lpOverlapped=0x0) returned 1
	[0051.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="J0214098.WAV"
	[0051.039] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.039] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6897, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6897, lpOverlapped=0x0) returned 1
	[0051.039] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.040] CloseHandle (hObject=0x8c) returned 1
	[0051.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.boom")) returned 1
	[0051.042] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.042] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0215086.WMF") returned -1
	[0051.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215086.WMF") returned -1
	[0051.042] lstrcmpiA (lpString1="", lpString2="J0215086.WMF") returned -1
	[0051.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="J0214098.WAV"
	[0051.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0215086.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF"
	[0051.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.zip") returned 0
	[0051.043] lstrlenA (lpString="*.zip") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.rar") returned 0
	[0051.043] lstrlenA (lpString="*.rar") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.7z") returned 0
	[0051.043] lstrlenA (lpString="*.7z") returned 4
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.tar") returned 0
	[0051.043] lstrlenA (lpString="*.tar") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.gzip") returned 0
	[0051.043] lstrlenA (lpString="*.gzip") returned 6
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.jpg") returned 0
	[0051.043] lstrlenA (lpString="*.jpg") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.jpeg") returned 0
	[0051.043] lstrlenA (lpString="*.jpeg") returned 6
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.psd") returned 0
	[0051.043] lstrlenA (lpString="*.psd") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.cdr") returned 0
	[0051.043] lstrlenA (lpString="*.cdr") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.dwg") returned 0
	[0051.043] lstrlenA (lpString="*.dwg") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.max") returned 0
	[0051.043] lstrlenA (lpString="*.max") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.bmp") returned 0
	[0051.043] lstrlenA (lpString="*.bmp") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.gif") returned 0
	[0051.043] lstrlenA (lpString="*.gif") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.png") returned 0
	[0051.043] lstrlenA (lpString="*.png") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.doc") returned 0
	[0051.043] lstrlenA (lpString="*.doc") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.docx") returned 0
	[0051.043] lstrlenA (lpString="*.docx") returned 6
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.xls") returned 0
	[0051.043] lstrlenA (lpString="*.xls") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.xlsx") returned 0
	[0051.043] lstrlenA (lpString="*.xlsx") returned 6
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.ppt") returned 0
	[0051.043] lstrlenA (lpString="*.ppt") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.pptx") returned 0
	[0051.043] lstrlenA (lpString="*.pptx") returned 6
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.txt") returned 0
	[0051.043] lstrlenA (lpString="*.txt") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.pdf") returned 0
	[0051.043] lstrlenA (lpString="*.pdf") returned 5
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.djvu") returned 0
	[0051.043] lstrlenA (lpString="*.djvu") returned 6
	[0051.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.htm") returned 0
	[0051.044] lstrlenA (lpString="*.htm") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.html") returned 0
	[0051.044] lstrlenA (lpString="*.html") returned 6
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mdb") returned 0
	[0051.044] lstrlenA (lpString="*.mdb") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.cer") returned 0
	[0051.044] lstrlenA (lpString="*.cer") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.p12") returned 0
	[0051.044] lstrlenA (lpString="*.p12") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.pfx") returned 0
	[0051.044] lstrlenA (lpString="*.pfx") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.kwm") returned 0
	[0051.044] lstrlenA (lpString="*.kwm") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.pwm") returned 0
	[0051.044] lstrlenA (lpString="*.pwm") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.1cd") returned 0
	[0051.044] lstrlenA (lpString="*.1cd") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.md") returned 0
	[0051.044] lstrlenA (lpString="*.md") returned 4
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mdf") returned 0
	[0051.044] lstrlenA (lpString="*.mdf") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.dbf") returned 0
	[0051.044] lstrlenA (lpString="*.dbf") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.odt") returned 0
	[0051.044] lstrlenA (lpString="*.odt") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.vob") returned 0
	[0051.044] lstrlenA (lpString="*.vob") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.ifo") returned 0
	[0051.044] lstrlenA (lpString="*.ifo") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.lnk") returned 0
	[0051.044] lstrlenA (lpString="*.lnk") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.torrent") returned 0
	[0051.044] lstrlenA (lpString="*.torrent") returned 9
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mov") returned 0
	[0051.044] lstrlenA (lpString="*.mov") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.m2v") returned 0
	[0051.044] lstrlenA (lpString="*.m2v") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.3gp") returned 0
	[0051.044] lstrlenA (lpString="*.3gp") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mpeg") returned 0
	[0051.044] lstrlenA (lpString="*.mpeg") returned 6
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mpg") returned 0
	[0051.044] lstrlenA (lpString="*.mpg") returned 5
	[0051.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.flv") returned 0
	[0051.044] lstrlenA (lpString="*.flv") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.avi") returned 0
	[0051.045] lstrlenA (lpString="*.avi") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mp4") returned 0
	[0051.045] lstrlenA (lpString="*.mp4") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.wmv") returned 0
	[0051.045] lstrlenA (lpString="*.wmv") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.divx") returned 0
	[0051.045] lstrlenA (lpString="*.divx") returned 6
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mkv") returned 0
	[0051.045] lstrlenA (lpString="*.mkv") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mp3") returned 0
	[0051.045] lstrlenA (lpString="*.mp3") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.wav") returned 0
	[0051.045] lstrlenA (lpString="*.wav") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.flac") returned 0
	[0051.045] lstrlenA (lpString="*.flac") returned 6
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.ape") returned 0
	[0051.045] lstrlenA (lpString="*.ape") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.wma") returned 0
	[0051.045] lstrlenA (lpString="*.wma") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.ac3") returned 0
	[0051.045] lstrlenA (lpString="*.ac3") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.exe") returned 0
	[0051.045] lstrlenA (lpString="*.exe") returned 5
	[0051.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.apk") returned 0
	[0051.045] lstrlenA (lpString="*.apk") returned 5
	[0051.045] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.045] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.045] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0216516.WMF") returned -1
	[0051.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216516.WMF") returned -1
	[0051.045] lstrcmpiA (lpString1="", lpString2="J0216516.WMF") returned -1
	[0051.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned="J0215086.WMF"
	[0051.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216516.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF"
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.zip") returned 0
	[0051.046] lstrlenA (lpString="*.zip") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.rar") returned 0
	[0051.046] lstrlenA (lpString="*.rar") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.7z") returned 0
	[0051.046] lstrlenA (lpString="*.7z") returned 4
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.tar") returned 0
	[0051.046] lstrlenA (lpString="*.tar") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.gzip") returned 0
	[0051.046] lstrlenA (lpString="*.gzip") returned 6
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.jpg") returned 0
	[0051.046] lstrlenA (lpString="*.jpg") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.jpeg") returned 0
	[0051.046] lstrlenA (lpString="*.jpeg") returned 6
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.psd") returned 0
	[0051.046] lstrlenA (lpString="*.psd") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.cdr") returned 0
	[0051.046] lstrlenA (lpString="*.cdr") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.dwg") returned 0
	[0051.046] lstrlenA (lpString="*.dwg") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.max") returned 0
	[0051.046] lstrlenA (lpString="*.max") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.bmp") returned 0
	[0051.046] lstrlenA (lpString="*.bmp") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.gif") returned 0
	[0051.046] lstrlenA (lpString="*.gif") returned 5
	[0051.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.png") returned 0
	[0051.046] lstrlenA (lpString="*.png") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.doc") returned 0
	[0051.047] lstrlenA (lpString="*.doc") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.docx") returned 0
	[0051.047] lstrlenA (lpString="*.docx") returned 6
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.xls") returned 0
	[0051.047] lstrlenA (lpString="*.xls") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.xlsx") returned 0
	[0051.047] lstrlenA (lpString="*.xlsx") returned 6
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.ppt") returned 0
	[0051.047] lstrlenA (lpString="*.ppt") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.pptx") returned 0
	[0051.047] lstrlenA (lpString="*.pptx") returned 6
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.txt") returned 0
	[0051.047] lstrlenA (lpString="*.txt") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.pdf") returned 0
	[0051.047] lstrlenA (lpString="*.pdf") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.djvu") returned 0
	[0051.047] lstrlenA (lpString="*.djvu") returned 6
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.htm") returned 0
	[0051.047] lstrlenA (lpString="*.htm") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.html") returned 0
	[0051.047] lstrlenA (lpString="*.html") returned 6
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mdb") returned 0
	[0051.047] lstrlenA (lpString="*.mdb") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.cer") returned 0
	[0051.047] lstrlenA (lpString="*.cer") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.p12") returned 0
	[0051.047] lstrlenA (lpString="*.p12") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.pfx") returned 0
	[0051.047] lstrlenA (lpString="*.pfx") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.kwm") returned 0
	[0051.047] lstrlenA (lpString="*.kwm") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.pwm") returned 0
	[0051.047] lstrlenA (lpString="*.pwm") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.1cd") returned 0
	[0051.047] lstrlenA (lpString="*.1cd") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.md") returned 0
	[0051.047] lstrlenA (lpString="*.md") returned 4
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mdf") returned 0
	[0051.047] lstrlenA (lpString="*.mdf") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.dbf") returned 0
	[0051.047] lstrlenA (lpString="*.dbf") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.odt") returned 0
	[0051.047] lstrlenA (lpString="*.odt") returned 5
	[0051.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.vob") returned 0
	[0051.047] lstrlenA (lpString="*.vob") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.ifo") returned 0
	[0051.048] lstrlenA (lpString="*.ifo") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.lnk") returned 0
	[0051.048] lstrlenA (lpString="*.lnk") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.torrent") returned 0
	[0051.048] lstrlenA (lpString="*.torrent") returned 9
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mov") returned 0
	[0051.048] lstrlenA (lpString="*.mov") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.m2v") returned 0
	[0051.048] lstrlenA (lpString="*.m2v") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.3gp") returned 0
	[0051.048] lstrlenA (lpString="*.3gp") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mpeg") returned 0
	[0051.048] lstrlenA (lpString="*.mpeg") returned 6
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mpg") returned 0
	[0051.048] lstrlenA (lpString="*.mpg") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.flv") returned 0
	[0051.048] lstrlenA (lpString="*.flv") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.avi") returned 0
	[0051.048] lstrlenA (lpString="*.avi") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mp4") returned 0
	[0051.048] lstrlenA (lpString="*.mp4") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.wmv") returned 0
	[0051.048] lstrlenA (lpString="*.wmv") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.divx") returned 0
	[0051.048] lstrlenA (lpString="*.divx") returned 6
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mkv") returned 0
	[0051.048] lstrlenA (lpString="*.mkv") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mp3") returned 0
	[0051.048] lstrlenA (lpString="*.mp3") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.wav") returned 0
	[0051.048] lstrlenA (lpString="*.wav") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.flac") returned 0
	[0051.048] lstrlenA (lpString="*.flac") returned 6
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.ape") returned 0
	[0051.048] lstrlenA (lpString="*.ape") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.wma") returned 0
	[0051.048] lstrlenA (lpString="*.wma") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.ac3") returned 0
	[0051.048] lstrlenA (lpString="*.ac3") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.exe") returned 0
	[0051.048] lstrlenA (lpString="*.exe") returned 5
	[0051.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.apk") returned 0
	[0051.048] lstrlenA (lpString="*.apk") returned 5
	[0051.048] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.048] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.049] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0216588.WMF") returned -1
	[0051.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216588.WMF") returned -1
	[0051.049] lstrcmpiA (lpString1="", lpString2="J0216588.WMF") returned -1
	[0051.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned="J0216516.WMF"
	[0051.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216588.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF"
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.zip") returned 0
	[0051.049] lstrlenA (lpString="*.zip") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.rar") returned 0
	[0051.049] lstrlenA (lpString="*.rar") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.7z") returned 0
	[0051.049] lstrlenA (lpString="*.7z") returned 4
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.tar") returned 0
	[0051.049] lstrlenA (lpString="*.tar") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.gzip") returned 0
	[0051.049] lstrlenA (lpString="*.gzip") returned 6
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.jpg") returned 0
	[0051.049] lstrlenA (lpString="*.jpg") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.jpeg") returned 0
	[0051.049] lstrlenA (lpString="*.jpeg") returned 6
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.psd") returned 0
	[0051.049] lstrlenA (lpString="*.psd") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.cdr") returned 0
	[0051.049] lstrlenA (lpString="*.cdr") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.dwg") returned 0
	[0051.049] lstrlenA (lpString="*.dwg") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.max") returned 0
	[0051.049] lstrlenA (lpString="*.max") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.bmp") returned 0
	[0051.049] lstrlenA (lpString="*.bmp") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.gif") returned 0
	[0051.049] lstrlenA (lpString="*.gif") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.png") returned 0
	[0051.049] lstrlenA (lpString="*.png") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.doc") returned 0
	[0051.049] lstrlenA (lpString="*.doc") returned 5
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.docx") returned 0
	[0051.049] lstrlenA (lpString="*.docx") returned 6
	[0051.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.xls") returned 0
	[0051.049] lstrlenA (lpString="*.xls") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.xlsx") returned 0
	[0051.050] lstrlenA (lpString="*.xlsx") returned 6
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.ppt") returned 0
	[0051.050] lstrlenA (lpString="*.ppt") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.pptx") returned 0
	[0051.050] lstrlenA (lpString="*.pptx") returned 6
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.txt") returned 0
	[0051.050] lstrlenA (lpString="*.txt") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.pdf") returned 0
	[0051.050] lstrlenA (lpString="*.pdf") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.djvu") returned 0
	[0051.050] lstrlenA (lpString="*.djvu") returned 6
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.htm") returned 0
	[0051.050] lstrlenA (lpString="*.htm") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.html") returned 0
	[0051.050] lstrlenA (lpString="*.html") returned 6
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mdb") returned 0
	[0051.050] lstrlenA (lpString="*.mdb") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.cer") returned 0
	[0051.050] lstrlenA (lpString="*.cer") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.p12") returned 0
	[0051.050] lstrlenA (lpString="*.p12") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.pfx") returned 0
	[0051.050] lstrlenA (lpString="*.pfx") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.kwm") returned 0
	[0051.050] lstrlenA (lpString="*.kwm") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.pwm") returned 0
	[0051.050] lstrlenA (lpString="*.pwm") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.1cd") returned 0
	[0051.050] lstrlenA (lpString="*.1cd") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.md") returned 0
	[0051.050] lstrlenA (lpString="*.md") returned 4
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mdf") returned 0
	[0051.050] lstrlenA (lpString="*.mdf") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.dbf") returned 0
	[0051.050] lstrlenA (lpString="*.dbf") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.odt") returned 0
	[0051.050] lstrlenA (lpString="*.odt") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.vob") returned 0
	[0051.050] lstrlenA (lpString="*.vob") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.ifo") returned 0
	[0051.050] lstrlenA (lpString="*.ifo") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.lnk") returned 0
	[0051.050] lstrlenA (lpString="*.lnk") returned 5
	[0051.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.torrent") returned 0
	[0051.051] lstrlenA (lpString="*.torrent") returned 9
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mov") returned 0
	[0051.051] lstrlenA (lpString="*.mov") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.m2v") returned 0
	[0051.051] lstrlenA (lpString="*.m2v") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.3gp") returned 0
	[0051.051] lstrlenA (lpString="*.3gp") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mpeg") returned 0
	[0051.051] lstrlenA (lpString="*.mpeg") returned 6
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mpg") returned 0
	[0051.051] lstrlenA (lpString="*.mpg") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.flv") returned 0
	[0051.051] lstrlenA (lpString="*.flv") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.avi") returned 0
	[0051.051] lstrlenA (lpString="*.avi") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mp4") returned 0
	[0051.051] lstrlenA (lpString="*.mp4") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.wmv") returned 0
	[0051.051] lstrlenA (lpString="*.wmv") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.divx") returned 0
	[0051.051] lstrlenA (lpString="*.divx") returned 6
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mkv") returned 0
	[0051.051] lstrlenA (lpString="*.mkv") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mp3") returned 0
	[0051.051] lstrlenA (lpString="*.mp3") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.wav") returned 0
	[0051.051] lstrlenA (lpString="*.wav") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.flac") returned 0
	[0051.051] lstrlenA (lpString="*.flac") returned 6
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.ape") returned 0
	[0051.051] lstrlenA (lpString="*.ape") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.wma") returned 0
	[0051.051] lstrlenA (lpString="*.wma") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.ac3") returned 0
	[0051.051] lstrlenA (lpString="*.ac3") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.exe") returned 0
	[0051.051] lstrlenA (lpString="*.exe") returned 5
	[0051.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.apk") returned 0
	[0051.051] lstrlenA (lpString="*.apk") returned 5
	[0051.051] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.051] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.051] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0216724.WMF") returned -1
	[0051.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216724.WMF") returned -1
	[0051.051] lstrcmpiA (lpString1="", lpString2="J0216724.WMF") returned -1
	[0051.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned="J0216588.WMF"
	[0051.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216724.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF"
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.zip") returned 0
	[0051.052] lstrlenA (lpString="*.zip") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.rar") returned 0
	[0051.052] lstrlenA (lpString="*.rar") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.7z") returned 0
	[0051.052] lstrlenA (lpString="*.7z") returned 4
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.tar") returned 0
	[0051.052] lstrlenA (lpString="*.tar") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.gzip") returned 0
	[0051.052] lstrlenA (lpString="*.gzip") returned 6
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.jpg") returned 0
	[0051.052] lstrlenA (lpString="*.jpg") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.jpeg") returned 0
	[0051.052] lstrlenA (lpString="*.jpeg") returned 6
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.psd") returned 0
	[0051.052] lstrlenA (lpString="*.psd") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.cdr") returned 0
	[0051.052] lstrlenA (lpString="*.cdr") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.dwg") returned 0
	[0051.052] lstrlenA (lpString="*.dwg") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.max") returned 0
	[0051.052] lstrlenA (lpString="*.max") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.bmp") returned 0
	[0051.052] lstrlenA (lpString="*.bmp") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.gif") returned 0
	[0051.052] lstrlenA (lpString="*.gif") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.png") returned 0
	[0051.052] lstrlenA (lpString="*.png") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.doc") returned 0
	[0051.052] lstrlenA (lpString="*.doc") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.docx") returned 0
	[0051.052] lstrlenA (lpString="*.docx") returned 6
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.xls") returned 0
	[0051.052] lstrlenA (lpString="*.xls") returned 5
	[0051.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.xlsx") returned 0
	[0051.053] lstrlenA (lpString="*.xlsx") returned 6
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.ppt") returned 0
	[0051.053] lstrlenA (lpString="*.ppt") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.pptx") returned 0
	[0051.053] lstrlenA (lpString="*.pptx") returned 6
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.txt") returned 0
	[0051.053] lstrlenA (lpString="*.txt") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.pdf") returned 0
	[0051.053] lstrlenA (lpString="*.pdf") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.djvu") returned 0
	[0051.053] lstrlenA (lpString="*.djvu") returned 6
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.htm") returned 0
	[0051.053] lstrlenA (lpString="*.htm") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.html") returned 0
	[0051.053] lstrlenA (lpString="*.html") returned 6
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mdb") returned 0
	[0051.053] lstrlenA (lpString="*.mdb") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.cer") returned 0
	[0051.053] lstrlenA (lpString="*.cer") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.p12") returned 0
	[0051.053] lstrlenA (lpString="*.p12") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.pfx") returned 0
	[0051.053] lstrlenA (lpString="*.pfx") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.kwm") returned 0
	[0051.053] lstrlenA (lpString="*.kwm") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.pwm") returned 0
	[0051.053] lstrlenA (lpString="*.pwm") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.1cd") returned 0
	[0051.053] lstrlenA (lpString="*.1cd") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.md") returned 0
	[0051.053] lstrlenA (lpString="*.md") returned 4
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mdf") returned 0
	[0051.053] lstrlenA (lpString="*.mdf") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.dbf") returned 0
	[0051.053] lstrlenA (lpString="*.dbf") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.odt") returned 0
	[0051.053] lstrlenA (lpString="*.odt") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.vob") returned 0
	[0051.053] lstrlenA (lpString="*.vob") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.ifo") returned 0
	[0051.053] lstrlenA (lpString="*.ifo") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.lnk") returned 0
	[0051.053] lstrlenA (lpString="*.lnk") returned 5
	[0051.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.torrent") returned 0
	[0051.053] lstrlenA (lpString="*.torrent") returned 9
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mov") returned 0
	[0051.054] lstrlenA (lpString="*.mov") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.m2v") returned 0
	[0051.054] lstrlenA (lpString="*.m2v") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.3gp") returned 0
	[0051.054] lstrlenA (lpString="*.3gp") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mpeg") returned 0
	[0051.054] lstrlenA (lpString="*.mpeg") returned 6
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mpg") returned 0
	[0051.054] lstrlenA (lpString="*.mpg") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.flv") returned 0
	[0051.054] lstrlenA (lpString="*.flv") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.avi") returned 0
	[0051.054] lstrlenA (lpString="*.avi") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mp4") returned 0
	[0051.054] lstrlenA (lpString="*.mp4") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.wmv") returned 0
	[0051.054] lstrlenA (lpString="*.wmv") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.divx") returned 0
	[0051.054] lstrlenA (lpString="*.divx") returned 6
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mkv") returned 0
	[0051.054] lstrlenA (lpString="*.mkv") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mp3") returned 0
	[0051.054] lstrlenA (lpString="*.mp3") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.wav") returned 0
	[0051.054] lstrlenA (lpString="*.wav") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.flac") returned 0
	[0051.054] lstrlenA (lpString="*.flac") returned 6
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.ape") returned 0
	[0051.054] lstrlenA (lpString="*.ape") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.wma") returned 0
	[0051.054] lstrlenA (lpString="*.wma") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.ac3") returned 0
	[0051.054] lstrlenA (lpString="*.ac3") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.exe") returned 0
	[0051.054] lstrlenA (lpString="*.exe") returned 5
	[0051.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.apk") returned 0
	[0051.054] lstrlenA (lpString="*.apk") returned 5
	[0051.054] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.054] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.055] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0216858.WMF") returned -1
	[0051.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216858.WMF") returned -1
	[0051.055] lstrcmpiA (lpString1="", lpString2="J0216858.WMF") returned -1
	[0051.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned="J0216724.WMF"
	[0051.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216858.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF"
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.zip") returned 0
	[0051.055] lstrlenA (lpString="*.zip") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.rar") returned 0
	[0051.055] lstrlenA (lpString="*.rar") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.7z") returned 0
	[0051.055] lstrlenA (lpString="*.7z") returned 4
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.tar") returned 0
	[0051.055] lstrlenA (lpString="*.tar") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.gzip") returned 0
	[0051.055] lstrlenA (lpString="*.gzip") returned 6
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.jpg") returned 0
	[0051.055] lstrlenA (lpString="*.jpg") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.jpeg") returned 0
	[0051.055] lstrlenA (lpString="*.jpeg") returned 6
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.psd") returned 0
	[0051.055] lstrlenA (lpString="*.psd") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.cdr") returned 0
	[0051.055] lstrlenA (lpString="*.cdr") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.dwg") returned 0
	[0051.055] lstrlenA (lpString="*.dwg") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.max") returned 0
	[0051.055] lstrlenA (lpString="*.max") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.bmp") returned 0
	[0051.055] lstrlenA (lpString="*.bmp") returned 5
	[0051.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.gif") returned 0
	[0051.055] lstrlenA (lpString="*.gif") returned 5
	[0051.056] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0217698.WMF") returned -1
	[0051.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0217698.WMF") returned -1
	[0051.056] lstrcmpiA (lpString1="", lpString2="J0217698.WMF") returned -1
	[0051.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned="J0216858.WMF"
	[0051.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0217698.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF"
	[0051.056] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0221903.WMF") returned -1
	[0051.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0221903.WMF") returned -1
	[0051.056] lstrcmpiA (lpString1="", lpString2="J0221903.WMF") returned -1
	[0051.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned="J0217698.WMF"
	[0051.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0221903.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF"
	[0051.056] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0222015.WMF") returned -1
	[0051.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222015.WMF") returned -1
	[0051.056] lstrcmpiA (lpString1="", lpString2="J0222015.WMF") returned -1
	[0051.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned="J0221903.WMF"
	[0051.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222015.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF"
	[0051.057] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.057] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.057] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0222017.WMF") returned -1
	[0051.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222017.WMF") returned -1
	[0051.057] lstrcmpiA (lpString1="", lpString2="J0222017.WMF") returned -1
	[0051.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned="J0222015.WMF"
	[0051.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222017.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF"
	[0051.057] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.057] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.057] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0222019.WMF") returned -1
	[0051.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222019.WMF") returned -1
	[0051.057] lstrcmpiA (lpString1="", lpString2="J0222019.WMF") returned -1
	[0051.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned="J0222017.WMF"
	[0051.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222019.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF"
	[0051.057] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.057] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.057] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0222021.WMF") returned -1
	[0051.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222021.WMF") returned -1
	[0051.057] lstrcmpiA (lpString1="", lpString2="J0222021.WMF") returned -1
	[0051.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned="J0222019.WMF"
	[0051.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222021.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF"
	[0051.058] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.058] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0229385.WMF") returned -1
	[0051.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0229385.WMF") returned -1
	[0051.058] lstrcmpiA (lpString1="", lpString2="J0229385.WMF") returned -1
	[0051.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned="J0222021.WMF"
	[0051.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0229385.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF"
	[0051.058] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.058] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0229389.WMF") returned -1
	[0051.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0229389.WMF") returned -1
	[0051.058] lstrcmpiA (lpString1="", lpString2="J0229389.WMF") returned -1
	[0051.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned="J0229385.WMF"
	[0051.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0229389.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF"
	[0051.059] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.059] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0230876.WMF") returned -1
	[0051.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0230876.WMF") returned -1
	[0051.059] lstrcmpiA (lpString1="", lpString2="J0230876.WMF") returned -1
	[0051.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned="J0229389.WMF"
	[0051.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0230876.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF"
	[0051.059] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.059] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0233018.WMF") returned -1
	[0051.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233018.WMF") returned -1
	[0051.059] lstrcmpiA (lpString1="", lpString2="J0233018.WMF") returned -1
	[0051.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned="J0230876.WMF"
	[0051.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0233018.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF"
	[0051.059] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.059] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0233070.WMF") returned -1
	[0051.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233070.WMF") returned -1
	[0051.059] lstrcmpiA (lpString1="", lpString2="J0233070.WMF") returned -1
	[0051.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned="J0233018.WMF"
	[0051.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0233070.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF"
	[0051.060] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.060] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.060] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0233312.WMF") returned -1
	[0051.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233312.WMF") returned -1
	[0051.060] lstrcmpiA (lpString1="", lpString2="J0233312.WMF") returned -1
	[0051.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned="J0233070.WMF"
	[0051.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0233312.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF"
	[0051.060] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.060] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.060] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0234131.WMF") returned -1
	[0051.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234131.WMF") returned -1
	[0051.060] lstrcmpiA (lpString1="", lpString2="J0234131.WMF") returned -1
	[0051.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned="J0233312.WMF"
	[0051.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234131.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF"
	[0051.060] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.060] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.060] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0234266.WMF") returned -1
	[0051.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234266.WMF") returned -1
	[0051.060] lstrcmpiA (lpString1="", lpString2="J0234266.WMF") returned -1
	[0051.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned="J0234131.WMF"
	[0051.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234266.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF"
	[0051.061] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.061] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.061] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0234657.WMF") returned -1
	[0051.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234657.WMF") returned -1
	[0051.061] lstrcmpiA (lpString1="", lpString2="J0234657.WMF") returned -1
	[0051.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned="J0234266.WMF"
	[0051.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234657.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF"
	[0051.061] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.061] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.061] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0234687.GIF") returned -1
	[0051.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234687.GIF") returned -1
	[0051.061] lstrcmpiA (lpString1="", lpString2="J0234687.GIF") returned -1
	[0051.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned="J0234657.WMF"
	[0051.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234687.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF"
	[0051.061] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF"
	[0051.061] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF"
	[0051.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF."
	[0051.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.Boom"
	[0051.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0051.062] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4f
	[0051.062] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9eeb500, dwHighDateTime=0x1bf2be6), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd5853c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9eeb500, dwHighDateTime=0x1bf2be6)) returned 1
	[0051.062] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.063] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd2c, lpOverlapped=0x0) returned 1
	[0051.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="J0234687.GIF"
	[0051.092] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.092] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd2c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd2c, lpOverlapped=0x0) returned 1
	[0051.092] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.092] CloseHandle (hObject=0x8c) returned 1
	[0051.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.boom")) returned 1
	[0051.093] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.093] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.093] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0235241.WMF") returned -1
	[0051.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0235241.WMF") returned -1
	[0051.094] lstrcmpiA (lpString1="", lpString2="J0235241.WMF") returned -1
	[0051.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="J0234687.GIF"
	[0051.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.094] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.094] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0235241.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF"
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.zip") returned 0
	[0051.094] lstrlenA (lpString="*.zip") returned 5
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.rar") returned 0
	[0051.094] lstrlenA (lpString="*.rar") returned 5
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.7z") returned 0
	[0051.094] lstrlenA (lpString="*.7z") returned 4
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.tar") returned 0
	[0051.094] lstrlenA (lpString="*.tar") returned 5
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.gzip") returned 0
	[0051.094] lstrlenA (lpString="*.gzip") returned 6
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.jpg") returned 0
	[0051.094] lstrlenA (lpString="*.jpg") returned 5
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.jpeg") returned 0
	[0051.094] lstrlenA (lpString="*.jpeg") returned 6
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.psd") returned 0
	[0051.094] lstrlenA (lpString="*.psd") returned 5
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.cdr") returned 0
	[0051.094] lstrlenA (lpString="*.cdr") returned 5
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.dwg") returned 0
	[0051.094] lstrlenA (lpString="*.dwg") returned 5
	[0051.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.max") returned 0
	[0051.094] lstrlenA (lpString="*.max") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.bmp") returned 0
	[0051.095] lstrlenA (lpString="*.bmp") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.gif") returned 0
	[0051.095] lstrlenA (lpString="*.gif") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.png") returned 0
	[0051.095] lstrlenA (lpString="*.png") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.doc") returned 0
	[0051.095] lstrlenA (lpString="*.doc") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.docx") returned 0
	[0051.095] lstrlenA (lpString="*.docx") returned 6
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.xls") returned 0
	[0051.095] lstrlenA (lpString="*.xls") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.xlsx") returned 0
	[0051.095] lstrlenA (lpString="*.xlsx") returned 6
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.ppt") returned 0
	[0051.095] lstrlenA (lpString="*.ppt") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.pptx") returned 0
	[0051.095] lstrlenA (lpString="*.pptx") returned 6
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.txt") returned 0
	[0051.095] lstrlenA (lpString="*.txt") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.pdf") returned 0
	[0051.095] lstrlenA (lpString="*.pdf") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.djvu") returned 0
	[0051.095] lstrlenA (lpString="*.djvu") returned 6
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.htm") returned 0
	[0051.095] lstrlenA (lpString="*.htm") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.html") returned 0
	[0051.095] lstrlenA (lpString="*.html") returned 6
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mdb") returned 0
	[0051.095] lstrlenA (lpString="*.mdb") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.cer") returned 0
	[0051.095] lstrlenA (lpString="*.cer") returned 5
	[0051.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.p12") returned 0
	[0051.095] lstrlenA (lpString="*.p12") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.pfx") returned 0
	[0051.096] lstrlenA (lpString="*.pfx") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.kwm") returned 0
	[0051.096] lstrlenA (lpString="*.kwm") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.pwm") returned 0
	[0051.096] lstrlenA (lpString="*.pwm") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.1cd") returned 0
	[0051.096] lstrlenA (lpString="*.1cd") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.md") returned 0
	[0051.096] lstrlenA (lpString="*.md") returned 4
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mdf") returned 0
	[0051.096] lstrlenA (lpString="*.mdf") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.dbf") returned 0
	[0051.096] lstrlenA (lpString="*.dbf") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.odt") returned 0
	[0051.096] lstrlenA (lpString="*.odt") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.vob") returned 0
	[0051.096] lstrlenA (lpString="*.vob") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.ifo") returned 0
	[0051.096] lstrlenA (lpString="*.ifo") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.lnk") returned 0
	[0051.096] lstrlenA (lpString="*.lnk") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.torrent") returned 0
	[0051.096] lstrlenA (lpString="*.torrent") returned 9
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mov") returned 0
	[0051.096] lstrlenA (lpString="*.mov") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.m2v") returned 0
	[0051.096] lstrlenA (lpString="*.m2v") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.3gp") returned 0
	[0051.096] lstrlenA (lpString="*.3gp") returned 5
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mpeg") returned 0
	[0051.096] lstrlenA (lpString="*.mpeg") returned 6
	[0051.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mpg") returned 0
	[0051.096] lstrlenA (lpString="*.mpg") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.flv") returned 0
	[0051.097] lstrlenA (lpString="*.flv") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.avi") returned 0
	[0051.097] lstrlenA (lpString="*.avi") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mp4") returned 0
	[0051.097] lstrlenA (lpString="*.mp4") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.wmv") returned 0
	[0051.097] lstrlenA (lpString="*.wmv") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.divx") returned 0
	[0051.097] lstrlenA (lpString="*.divx") returned 6
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mkv") returned 0
	[0051.097] lstrlenA (lpString="*.mkv") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mp3") returned 0
	[0051.097] lstrlenA (lpString="*.mp3") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.wav") returned 0
	[0051.097] lstrlenA (lpString="*.wav") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.flac") returned 0
	[0051.097] lstrlenA (lpString="*.flac") returned 6
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.ape") returned 0
	[0051.097] lstrlenA (lpString="*.ape") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.wma") returned 0
	[0051.097] lstrlenA (lpString="*.wma") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.ac3") returned 0
	[0051.097] lstrlenA (lpString="*.ac3") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.exe") returned 0
	[0051.097] lstrlenA (lpString="*.exe") returned 5
	[0051.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.apk") returned 0
	[0051.097] lstrlenA (lpString="*.apk") returned 5
	[0051.097] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.097] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.097] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0235319.WMF") returned -1
	[0051.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0235319.WMF") returned -1
	[0051.097] lstrcmpiA (lpString1="", lpString2="J0235319.WMF") returned -1
	[0051.097] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned="J0235241.WMF"
	[0051.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.098] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.098] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0235319.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF"
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.zip") returned 0
	[0051.098] lstrlenA (lpString="*.zip") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.rar") returned 0
	[0051.098] lstrlenA (lpString="*.rar") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.7z") returned 0
	[0051.098] lstrlenA (lpString="*.7z") returned 4
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.tar") returned 0
	[0051.098] lstrlenA (lpString="*.tar") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.gzip") returned 0
	[0051.098] lstrlenA (lpString="*.gzip") returned 6
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.jpg") returned 0
	[0051.098] lstrlenA (lpString="*.jpg") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.jpeg") returned 0
	[0051.098] lstrlenA (lpString="*.jpeg") returned 6
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.psd") returned 0
	[0051.098] lstrlenA (lpString="*.psd") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.cdr") returned 0
	[0051.098] lstrlenA (lpString="*.cdr") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.dwg") returned 0
	[0051.098] lstrlenA (lpString="*.dwg") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.max") returned 0
	[0051.098] lstrlenA (lpString="*.max") returned 5
	[0051.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.bmp") returned 0
	[0051.098] lstrlenA (lpString="*.bmp") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.gif") returned 0
	[0051.099] lstrlenA (lpString="*.gif") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.png") returned 0
	[0051.099] lstrlenA (lpString="*.png") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.doc") returned 0
	[0051.099] lstrlenA (lpString="*.doc") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.docx") returned 0
	[0051.099] lstrlenA (lpString="*.docx") returned 6
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.xls") returned 0
	[0051.099] lstrlenA (lpString="*.xls") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.xlsx") returned 0
	[0051.099] lstrlenA (lpString="*.xlsx") returned 6
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.ppt") returned 0
	[0051.099] lstrlenA (lpString="*.ppt") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.pptx") returned 0
	[0051.099] lstrlenA (lpString="*.pptx") returned 6
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.txt") returned 0
	[0051.099] lstrlenA (lpString="*.txt") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.pdf") returned 0
	[0051.099] lstrlenA (lpString="*.pdf") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.djvu") returned 0
	[0051.099] lstrlenA (lpString="*.djvu") returned 6
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.htm") returned 0
	[0051.099] lstrlenA (lpString="*.htm") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.html") returned 0
	[0051.099] lstrlenA (lpString="*.html") returned 6
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mdb") returned 0
	[0051.099] lstrlenA (lpString="*.mdb") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.cer") returned 0
	[0051.099] lstrlenA (lpString="*.cer") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.p12") returned 0
	[0051.099] lstrlenA (lpString="*.p12") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.pfx") returned 0
	[0051.099] lstrlenA (lpString="*.pfx") returned 5
	[0051.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.kwm") returned 0
	[0051.100] lstrlenA (lpString="*.kwm") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.pwm") returned 0
	[0051.100] lstrlenA (lpString="*.pwm") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.1cd") returned 0
	[0051.100] lstrlenA (lpString="*.1cd") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.md") returned 0
	[0051.100] lstrlenA (lpString="*.md") returned 4
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mdf") returned 0
	[0051.100] lstrlenA (lpString="*.mdf") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.dbf") returned 0
	[0051.100] lstrlenA (lpString="*.dbf") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.odt") returned 0
	[0051.100] lstrlenA (lpString="*.odt") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.vob") returned 0
	[0051.100] lstrlenA (lpString="*.vob") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.ifo") returned 0
	[0051.100] lstrlenA (lpString="*.ifo") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.lnk") returned 0
	[0051.100] lstrlenA (lpString="*.lnk") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.torrent") returned 0
	[0051.100] lstrlenA (lpString="*.torrent") returned 9
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mov") returned 0
	[0051.100] lstrlenA (lpString="*.mov") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.m2v") returned 0
	[0051.100] lstrlenA (lpString="*.m2v") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.3gp") returned 0
	[0051.100] lstrlenA (lpString="*.3gp") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mpeg") returned 0
	[0051.100] lstrlenA (lpString="*.mpeg") returned 6
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mpg") returned 0
	[0051.100] lstrlenA (lpString="*.mpg") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.flv") returned 0
	[0051.100] lstrlenA (lpString="*.flv") returned 5
	[0051.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.avi") returned 0
	[0051.101] lstrlenA (lpString="*.avi") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mp4") returned 0
	[0051.101] lstrlenA (lpString="*.mp4") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.wmv") returned 0
	[0051.101] lstrlenA (lpString="*.wmv") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.divx") returned 0
	[0051.101] lstrlenA (lpString="*.divx") returned 6
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mkv") returned 0
	[0051.101] lstrlenA (lpString="*.mkv") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mp3") returned 0
	[0051.101] lstrlenA (lpString="*.mp3") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.wav") returned 0
	[0051.101] lstrlenA (lpString="*.wav") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.flac") returned 0
	[0051.101] lstrlenA (lpString="*.flac") returned 6
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.ape") returned 0
	[0051.101] lstrlenA (lpString="*.ape") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.wma") returned 0
	[0051.101] lstrlenA (lpString="*.wma") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.ac3") returned 0
	[0051.101] lstrlenA (lpString="*.ac3") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.exe") returned 0
	[0051.101] lstrlenA (lpString="*.exe") returned 5
	[0051.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.apk") returned 0
	[0051.101] lstrlenA (lpString="*.apk") returned 5
	[0051.101] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.101] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.102] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0240695.WMF") returned -1
	[0051.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240695.WMF") returned -1
	[0051.102] lstrcmpiA (lpString1="", lpString2="J0240695.WMF") returned -1
	[0051.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned="J0235319.WMF"
	[0051.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0240695.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF"
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.zip") returned 0
	[0051.102] lstrlenA (lpString="*.zip") returned 5
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.rar") returned 0
	[0051.102] lstrlenA (lpString="*.rar") returned 5
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.7z") returned 0
	[0051.102] lstrlenA (lpString="*.7z") returned 4
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.tar") returned 0
	[0051.102] lstrlenA (lpString="*.tar") returned 5
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.gzip") returned 0
	[0051.102] lstrlenA (lpString="*.gzip") returned 6
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.jpg") returned 0
	[0051.102] lstrlenA (lpString="*.jpg") returned 5
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.jpeg") returned 0
	[0051.102] lstrlenA (lpString="*.jpeg") returned 6
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.psd") returned 0
	[0051.102] lstrlenA (lpString="*.psd") returned 5
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.cdr") returned 0
	[0051.102] lstrlenA (lpString="*.cdr") returned 5
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.dwg") returned 0
	[0051.102] lstrlenA (lpString="*.dwg") returned 5
	[0051.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.max") returned 0
	[0051.103] lstrlenA (lpString="*.max") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.bmp") returned 0
	[0051.103] lstrlenA (lpString="*.bmp") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.gif") returned 0
	[0051.103] lstrlenA (lpString="*.gif") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.png") returned 0
	[0051.103] lstrlenA (lpString="*.png") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.doc") returned 0
	[0051.103] lstrlenA (lpString="*.doc") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.docx") returned 0
	[0051.103] lstrlenA (lpString="*.docx") returned 6
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.xls") returned 0
	[0051.103] lstrlenA (lpString="*.xls") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.xlsx") returned 0
	[0051.103] lstrlenA (lpString="*.xlsx") returned 6
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.ppt") returned 0
	[0051.103] lstrlenA (lpString="*.ppt") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.pptx") returned 0
	[0051.103] lstrlenA (lpString="*.pptx") returned 6
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.txt") returned 0
	[0051.103] lstrlenA (lpString="*.txt") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.pdf") returned 0
	[0051.103] lstrlenA (lpString="*.pdf") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.djvu") returned 0
	[0051.103] lstrlenA (lpString="*.djvu") returned 6
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.htm") returned 0
	[0051.103] lstrlenA (lpString="*.htm") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.html") returned 0
	[0051.103] lstrlenA (lpString="*.html") returned 6
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mdb") returned 0
	[0051.103] lstrlenA (lpString="*.mdb") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.cer") returned 0
	[0051.103] lstrlenA (lpString="*.cer") returned 5
	[0051.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.p12") returned 0
	[0051.104] lstrlenA (lpString="*.p12") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.pfx") returned 0
	[0051.104] lstrlenA (lpString="*.pfx") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.kwm") returned 0
	[0051.104] lstrlenA (lpString="*.kwm") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.pwm") returned 0
	[0051.104] lstrlenA (lpString="*.pwm") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.1cd") returned 0
	[0051.104] lstrlenA (lpString="*.1cd") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.md") returned 0
	[0051.104] lstrlenA (lpString="*.md") returned 4
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mdf") returned 0
	[0051.104] lstrlenA (lpString="*.mdf") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.dbf") returned 0
	[0051.104] lstrlenA (lpString="*.dbf") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.odt") returned 0
	[0051.104] lstrlenA (lpString="*.odt") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.vob") returned 0
	[0051.104] lstrlenA (lpString="*.vob") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.ifo") returned 0
	[0051.104] lstrlenA (lpString="*.ifo") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.lnk") returned 0
	[0051.104] lstrlenA (lpString="*.lnk") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.torrent") returned 0
	[0051.104] lstrlenA (lpString="*.torrent") returned 9
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mov") returned 0
	[0051.104] lstrlenA (lpString="*.mov") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.m2v") returned 0
	[0051.104] lstrlenA (lpString="*.m2v") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.3gp") returned 0
	[0051.104] lstrlenA (lpString="*.3gp") returned 5
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mpeg") returned 0
	[0051.104] lstrlenA (lpString="*.mpeg") returned 6
	[0051.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mpg") returned 0
	[0051.105] lstrlenA (lpString="*.mpg") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.flv") returned 0
	[0051.105] lstrlenA (lpString="*.flv") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.avi") returned 0
	[0051.105] lstrlenA (lpString="*.avi") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mp4") returned 0
	[0051.105] lstrlenA (lpString="*.mp4") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.wmv") returned 0
	[0051.105] lstrlenA (lpString="*.wmv") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.divx") returned 0
	[0051.105] lstrlenA (lpString="*.divx") returned 6
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mkv") returned 0
	[0051.105] lstrlenA (lpString="*.mkv") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mp3") returned 0
	[0051.105] lstrlenA (lpString="*.mp3") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.wav") returned 0
	[0051.105] lstrlenA (lpString="*.wav") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.flac") returned 0
	[0051.105] lstrlenA (lpString="*.flac") returned 6
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.ape") returned 0
	[0051.105] lstrlenA (lpString="*.ape") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.wma") returned 0
	[0051.105] lstrlenA (lpString="*.wma") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.ac3") returned 0
	[0051.105] lstrlenA (lpString="*.ac3") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.exe") returned 0
	[0051.105] lstrlenA (lpString="*.exe") returned 5
	[0051.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.apk") returned 0
	[0051.105] lstrlenA (lpString="*.apk") returned 5
	[0051.105] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.107] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.107] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0240719.WMF") returned -1
	[0051.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240719.WMF") returned -1
	[0051.107] lstrcmpiA (lpString1="", lpString2="J0240719.WMF") returned -1
	[0051.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned="J0240695.WMF"
	[0051.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.107] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.107] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0240719.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF"
	[0051.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.zip") returned 0
	[0051.107] lstrlenA (lpString="*.zip") returned 5
	[0051.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.rar") returned 0
	[0051.107] lstrlenA (lpString="*.rar") returned 5
	[0051.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.7z") returned 0
	[0051.107] lstrlenA (lpString="*.7z") returned 4
	[0051.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.tar") returned 0
	[0051.107] lstrlenA (lpString="*.tar") returned 5
	[0051.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.gzip") returned 0
	[0051.108] lstrlenA (lpString="*.gzip") returned 6
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.jpg") returned 0
	[0051.108] lstrlenA (lpString="*.jpg") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.jpeg") returned 0
	[0051.108] lstrlenA (lpString="*.jpeg") returned 6
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.psd") returned 0
	[0051.108] lstrlenA (lpString="*.psd") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.cdr") returned 0
	[0051.108] lstrlenA (lpString="*.cdr") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.dwg") returned 0
	[0051.108] lstrlenA (lpString="*.dwg") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.max") returned 0
	[0051.108] lstrlenA (lpString="*.max") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.bmp") returned 0
	[0051.108] lstrlenA (lpString="*.bmp") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.gif") returned 0
	[0051.108] lstrlenA (lpString="*.gif") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.png") returned 0
	[0051.108] lstrlenA (lpString="*.png") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.doc") returned 0
	[0051.108] lstrlenA (lpString="*.doc") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.docx") returned 0
	[0051.108] lstrlenA (lpString="*.docx") returned 6
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.xls") returned 0
	[0051.108] lstrlenA (lpString="*.xls") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.xlsx") returned 0
	[0051.108] lstrlenA (lpString="*.xlsx") returned 6
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.ppt") returned 0
	[0051.108] lstrlenA (lpString="*.ppt") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.pptx") returned 0
	[0051.108] lstrlenA (lpString="*.pptx") returned 6
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.txt") returned 0
	[0051.108] lstrlenA (lpString="*.txt") returned 5
	[0051.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.pdf") returned 0
	[0051.109] lstrlenA (lpString="*.pdf") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.djvu") returned 0
	[0051.109] lstrlenA (lpString="*.djvu") returned 6
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.htm") returned 0
	[0051.109] lstrlenA (lpString="*.htm") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.html") returned 0
	[0051.109] lstrlenA (lpString="*.html") returned 6
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mdb") returned 0
	[0051.109] lstrlenA (lpString="*.mdb") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.cer") returned 0
	[0051.109] lstrlenA (lpString="*.cer") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.p12") returned 0
	[0051.109] lstrlenA (lpString="*.p12") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.pfx") returned 0
	[0051.109] lstrlenA (lpString="*.pfx") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.kwm") returned 0
	[0051.109] lstrlenA (lpString="*.kwm") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.pwm") returned 0
	[0051.109] lstrlenA (lpString="*.pwm") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.1cd") returned 0
	[0051.109] lstrlenA (lpString="*.1cd") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.md") returned 0
	[0051.109] lstrlenA (lpString="*.md") returned 4
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mdf") returned 0
	[0051.109] lstrlenA (lpString="*.mdf") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.dbf") returned 0
	[0051.109] lstrlenA (lpString="*.dbf") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.odt") returned 0
	[0051.109] lstrlenA (lpString="*.odt") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.vob") returned 0
	[0051.109] lstrlenA (lpString="*.vob") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.ifo") returned 0
	[0051.109] lstrlenA (lpString="*.ifo") returned 5
	[0051.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.lnk") returned 0
	[0051.110] lstrlenA (lpString="*.lnk") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.torrent") returned 0
	[0051.110] lstrlenA (lpString="*.torrent") returned 9
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mov") returned 0
	[0051.110] lstrlenA (lpString="*.mov") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.m2v") returned 0
	[0051.110] lstrlenA (lpString="*.m2v") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.3gp") returned 0
	[0051.110] lstrlenA (lpString="*.3gp") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mpeg") returned 0
	[0051.110] lstrlenA (lpString="*.mpeg") returned 6
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mpg") returned 0
	[0051.110] lstrlenA (lpString="*.mpg") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.flv") returned 0
	[0051.110] lstrlenA (lpString="*.flv") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.avi") returned 0
	[0051.110] lstrlenA (lpString="*.avi") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mp4") returned 0
	[0051.110] lstrlenA (lpString="*.mp4") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.wmv") returned 0
	[0051.110] lstrlenA (lpString="*.wmv") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.divx") returned 0
	[0051.110] lstrlenA (lpString="*.divx") returned 6
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mkv") returned 0
	[0051.110] lstrlenA (lpString="*.mkv") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mp3") returned 0
	[0051.110] lstrlenA (lpString="*.mp3") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.wav") returned 0
	[0051.110] lstrlenA (lpString="*.wav") returned 5
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.flac") returned 0
	[0051.110] lstrlenA (lpString="*.flac") returned 6
	[0051.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.ape") returned 0
	[0051.111] lstrlenA (lpString="*.ape") returned 5
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.wma") returned 0
	[0051.111] lstrlenA (lpString="*.wma") returned 5
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.ac3") returned 0
	[0051.111] lstrlenA (lpString="*.ac3") returned 5
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.exe") returned 0
	[0051.111] lstrlenA (lpString="*.exe") returned 5
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.apk") returned 0
	[0051.111] lstrlenA (lpString="*.apk") returned 5
	[0051.111] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.111] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.111] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0251301.WMF") returned -1
	[0051.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0251301.WMF") returned -1
	[0051.111] lstrcmpiA (lpString1="", lpString2="J0251301.WMF") returned -1
	[0051.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned="J0240719.WMF"
	[0051.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0251301.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF"
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.zip") returned 0
	[0051.111] lstrlenA (lpString="*.zip") returned 5
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.rar") returned 0
	[0051.111] lstrlenA (lpString="*.rar") returned 5
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.7z") returned 0
	[0051.111] lstrlenA (lpString="*.7z") returned 4
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.tar") returned 0
	[0051.111] lstrlenA (lpString="*.tar") returned 5
	[0051.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.gzip") returned 0
	[0051.111] lstrlenA (lpString="*.gzip") returned 6
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.jpg") returned 0
	[0051.112] lstrlenA (lpString="*.jpg") returned 5
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.jpeg") returned 0
	[0051.112] lstrlenA (lpString="*.jpeg") returned 6
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.psd") returned 0
	[0051.112] lstrlenA (lpString="*.psd") returned 5
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.cdr") returned 0
	[0051.112] lstrlenA (lpString="*.cdr") returned 5
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.dwg") returned 0
	[0051.112] lstrlenA (lpString="*.dwg") returned 5
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.max") returned 0
	[0051.112] lstrlenA (lpString="*.max") returned 5
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.bmp") returned 0
	[0051.112] lstrlenA (lpString="*.bmp") returned 5
	[0051.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.gif") returned 0
	[0051.112] lstrlenA (lpString="*.gif") returned 5
	[0051.112] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.112] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.112] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0251871.WMF") returned -1
	[0051.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0251871.WMF") returned -1
	[0051.112] lstrcmpiA (lpString1="", lpString2="J0251871.WMF") returned -1
	[0051.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned="J0251301.WMF"
	[0051.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0251871.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF"
	[0051.113] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.113] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.113] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0251925.WMF") returned -1
	[0051.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0251925.WMF") returned -1
	[0051.113] lstrcmpiA (lpString1="", lpString2="J0251925.WMF") returned -1
	[0051.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned="J0251871.WMF"
	[0051.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0251925.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF"
	[0051.113] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.113] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.113] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0252349.WMF") returned -1
	[0051.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0252349.WMF") returned -1
	[0051.113] lstrcmpiA (lpString1="", lpString2="J0252349.WMF") returned -1
	[0051.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned="J0251925.WMF"
	[0051.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0252349.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF"
	[0051.114] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.114] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.114] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0278882.WMF") returned -1
	[0051.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0278882.WMF") returned -1
	[0051.114] lstrcmpiA (lpString1="", lpString2="J0278882.WMF") returned -1
	[0051.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned="J0252349.WMF"
	[0051.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0278882.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF"
	[0051.114] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.114] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.114] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0281904.WMF") returned -1
	[0051.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281904.WMF") returned -1
	[0051.114] lstrcmpiA (lpString1="", lpString2="J0281904.WMF") returned -1
	[0051.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned="J0278882.WMF"
	[0051.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0281904.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF"
	[0051.115] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.115] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.115] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0283209.GIF") returned -1
	[0051.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0283209.GIF") returned -1
	[0051.115] lstrcmpiA (lpString1="", lpString2="J0283209.GIF") returned -1
	[0051.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned="J0281904.WMF"
	[0051.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0283209.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF"
	[0051.115] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF"
	[0051.115] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF"
	[0051.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF."
	[0051.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.Boom"
	[0051.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0051.117] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4dc6
	[0051.117] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe1a4f200, dwHighDateTime=0x1bed3d9), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd5d1680, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe1a4f200, dwHighDateTime=0x1bed3d9)) returned 1
	[0051.117] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.117] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4da3, lpOverlapped=0x0) returned 1
	[0051.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="J0283209.GIF"
	[0051.142] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.142] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4da3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4da3, lpOverlapped=0x0) returned 1
	[0051.142] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.142] CloseHandle (hObject=0x8c) returned 1
	[0051.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.boom")) returned 1
	[0051.143] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.143] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0284916.JPG") returned -1
	[0051.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0284916.JPG") returned -1
	[0051.143] lstrcmpiA (lpString1="", lpString2="J0284916.JPG") returned -1
	[0051.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="J0283209.GIF"
	[0051.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0284916.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG"
	[0051.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.zip") returned 0
	[0051.143] lstrlenA (lpString="*.zip") returned 5
	[0051.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.rar") returned 0
	[0051.143] lstrlenA (lpString="*.rar") returned 5
	[0051.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.7z") returned 0
	[0051.144] lstrlenA (lpString="*.7z") returned 4
	[0051.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.tar") returned 0
	[0051.144] lstrlenA (lpString="*.tar") returned 5
	[0051.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.gzip") returned 0
	[0051.144] lstrlenA (lpString="*.gzip") returned 6
	[0051.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.jpg") returned 1
	[0051.144] lstrlenA (lpString="*.jpg") returned 5
	[0051.144] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG"
	[0051.144] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG"
	[0051.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG."
	[0051.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.Boom"
	[0051.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0051.144] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62e3
	[0051.144] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb7ae3400, dwHighDateTime=0x1bea1cc), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd5d1680, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb7ae3400, dwHighDateTime=0x1bea1cc)) returned 1
	[0051.144] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.145] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x62c0, lpOverlapped=0x0) returned 1
	[0051.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="J0284916.JPG"
	[0051.180] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.180] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x62c0, lpOverlapped=0x0) returned 1
	[0051.181] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.181] CloseHandle (hObject=0x8c) returned 1
	[0051.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.boom")) returned 1
	[0051.181] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0285360.WMF") returned -1
	[0051.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285360.WMF") returned -1
	[0051.182] lstrcmpiA (lpString1="", lpString2="J0285360.WMF") returned -1
	[0051.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="J0284916.JPG"
	[0051.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285360.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF"
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.zip") returned 0
	[0051.182] lstrlenA (lpString="*.zip") returned 5
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.rar") returned 0
	[0051.182] lstrlenA (lpString="*.rar") returned 5
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.7z") returned 0
	[0051.182] lstrlenA (lpString="*.7z") returned 4
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.tar") returned 0
	[0051.182] lstrlenA (lpString="*.tar") returned 5
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.gzip") returned 0
	[0051.182] lstrlenA (lpString="*.gzip") returned 6
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.jpg") returned 0
	[0051.182] lstrlenA (lpString="*.jpg") returned 5
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.jpeg") returned 0
	[0051.182] lstrlenA (lpString="*.jpeg") returned 6
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.psd") returned 0
	[0051.182] lstrlenA (lpString="*.psd") returned 5
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.cdr") returned 0
	[0051.182] lstrlenA (lpString="*.cdr") returned 5
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.dwg") returned 0
	[0051.182] lstrlenA (lpString="*.dwg") returned 5
	[0051.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.max") returned 0
	[0051.182] lstrlenA (lpString="*.max") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.bmp") returned 0
	[0051.183] lstrlenA (lpString="*.bmp") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.gif") returned 0
	[0051.183] lstrlenA (lpString="*.gif") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.png") returned 0
	[0051.183] lstrlenA (lpString="*.png") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.doc") returned 0
	[0051.183] lstrlenA (lpString="*.doc") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.docx") returned 0
	[0051.183] lstrlenA (lpString="*.docx") returned 6
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.xls") returned 0
	[0051.183] lstrlenA (lpString="*.xls") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.xlsx") returned 0
	[0051.183] lstrlenA (lpString="*.xlsx") returned 6
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.ppt") returned 0
	[0051.183] lstrlenA (lpString="*.ppt") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.pptx") returned 0
	[0051.183] lstrlenA (lpString="*.pptx") returned 6
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.txt") returned 0
	[0051.183] lstrlenA (lpString="*.txt") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.pdf") returned 0
	[0051.183] lstrlenA (lpString="*.pdf") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.djvu") returned 0
	[0051.183] lstrlenA (lpString="*.djvu") returned 6
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.htm") returned 0
	[0051.183] lstrlenA (lpString="*.htm") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.html") returned 0
	[0051.183] lstrlenA (lpString="*.html") returned 6
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mdb") returned 0
	[0051.183] lstrlenA (lpString="*.mdb") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.cer") returned 0
	[0051.183] lstrlenA (lpString="*.cer") returned 5
	[0051.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.p12") returned 0
	[0051.183] lstrlenA (lpString="*.p12") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.pfx") returned 0
	[0051.184] lstrlenA (lpString="*.pfx") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.kwm") returned 0
	[0051.184] lstrlenA (lpString="*.kwm") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.pwm") returned 0
	[0051.184] lstrlenA (lpString="*.pwm") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.1cd") returned 0
	[0051.184] lstrlenA (lpString="*.1cd") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.md") returned 0
	[0051.184] lstrlenA (lpString="*.md") returned 4
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mdf") returned 0
	[0051.184] lstrlenA (lpString="*.mdf") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.dbf") returned 0
	[0051.184] lstrlenA (lpString="*.dbf") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.odt") returned 0
	[0051.184] lstrlenA (lpString="*.odt") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.vob") returned 0
	[0051.184] lstrlenA (lpString="*.vob") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.ifo") returned 0
	[0051.184] lstrlenA (lpString="*.ifo") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.lnk") returned 0
	[0051.184] lstrlenA (lpString="*.lnk") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.torrent") returned 0
	[0051.184] lstrlenA (lpString="*.torrent") returned 9
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mov") returned 0
	[0051.184] lstrlenA (lpString="*.mov") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.m2v") returned 0
	[0051.184] lstrlenA (lpString="*.m2v") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.3gp") returned 0
	[0051.184] lstrlenA (lpString="*.3gp") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mpeg") returned 0
	[0051.184] lstrlenA (lpString="*.mpeg") returned 6
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mpg") returned 0
	[0051.184] lstrlenA (lpString="*.mpg") returned 5
	[0051.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.flv") returned 0
	[0051.185] lstrlenA (lpString="*.flv") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.avi") returned 0
	[0051.185] lstrlenA (lpString="*.avi") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mp4") returned 0
	[0051.185] lstrlenA (lpString="*.mp4") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.wmv") returned 0
	[0051.185] lstrlenA (lpString="*.wmv") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.divx") returned 0
	[0051.185] lstrlenA (lpString="*.divx") returned 6
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mkv") returned 0
	[0051.185] lstrlenA (lpString="*.mkv") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mp3") returned 0
	[0051.185] lstrlenA (lpString="*.mp3") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.wav") returned 0
	[0051.185] lstrlenA (lpString="*.wav") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.flac") returned 0
	[0051.185] lstrlenA (lpString="*.flac") returned 6
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.ape") returned 0
	[0051.185] lstrlenA (lpString="*.ape") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.wma") returned 0
	[0051.185] lstrlenA (lpString="*.wma") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.ac3") returned 0
	[0051.185] lstrlenA (lpString="*.ac3") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.exe") returned 0
	[0051.185] lstrlenA (lpString="*.exe") returned 5
	[0051.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.apk") returned 0
	[0051.185] lstrlenA (lpString="*.apk") returned 5
	[0051.185] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.185] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.185] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0285410.WMF") returned -1
	[0051.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285410.WMF") returned -1
	[0051.185] lstrcmpiA (lpString1="", lpString2="J0285410.WMF") returned -1
	[0051.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned="J0285360.WMF"
	[0051.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.186] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285410.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF"
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.zip") returned 0
	[0051.186] lstrlenA (lpString="*.zip") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.rar") returned 0
	[0051.186] lstrlenA (lpString="*.rar") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.7z") returned 0
	[0051.186] lstrlenA (lpString="*.7z") returned 4
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.tar") returned 0
	[0051.186] lstrlenA (lpString="*.tar") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.gzip") returned 0
	[0051.186] lstrlenA (lpString="*.gzip") returned 6
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.jpg") returned 0
	[0051.186] lstrlenA (lpString="*.jpg") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.jpeg") returned 0
	[0051.186] lstrlenA (lpString="*.jpeg") returned 6
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.psd") returned 0
	[0051.186] lstrlenA (lpString="*.psd") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.cdr") returned 0
	[0051.186] lstrlenA (lpString="*.cdr") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.dwg") returned 0
	[0051.186] lstrlenA (lpString="*.dwg") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.max") returned 0
	[0051.186] lstrlenA (lpString="*.max") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.bmp") returned 0
	[0051.186] lstrlenA (lpString="*.bmp") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.gif") returned 0
	[0051.186] lstrlenA (lpString="*.gif") returned 5
	[0051.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.png") returned 0
	[0051.187] lstrlenA (lpString="*.png") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.doc") returned 0
	[0051.187] lstrlenA (lpString="*.doc") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.docx") returned 0
	[0051.187] lstrlenA (lpString="*.docx") returned 6
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.xls") returned 0
	[0051.187] lstrlenA (lpString="*.xls") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.xlsx") returned 0
	[0051.187] lstrlenA (lpString="*.xlsx") returned 6
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.ppt") returned 0
	[0051.187] lstrlenA (lpString="*.ppt") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.pptx") returned 0
	[0051.187] lstrlenA (lpString="*.pptx") returned 6
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.txt") returned 0
	[0051.187] lstrlenA (lpString="*.txt") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.pdf") returned 0
	[0051.187] lstrlenA (lpString="*.pdf") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.djvu") returned 0
	[0051.187] lstrlenA (lpString="*.djvu") returned 6
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.htm") returned 0
	[0051.187] lstrlenA (lpString="*.htm") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.html") returned 0
	[0051.187] lstrlenA (lpString="*.html") returned 6
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mdb") returned 0
	[0051.187] lstrlenA (lpString="*.mdb") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.cer") returned 0
	[0051.187] lstrlenA (lpString="*.cer") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.p12") returned 0
	[0051.187] lstrlenA (lpString="*.p12") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.pfx") returned 0
	[0051.187] lstrlenA (lpString="*.pfx") returned 5
	[0051.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.kwm") returned 0
	[0051.187] lstrlenA (lpString="*.kwm") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.pwm") returned 0
	[0051.188] lstrlenA (lpString="*.pwm") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.1cd") returned 0
	[0051.188] lstrlenA (lpString="*.1cd") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.md") returned 0
	[0051.188] lstrlenA (lpString="*.md") returned 4
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mdf") returned 0
	[0051.188] lstrlenA (lpString="*.mdf") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.dbf") returned 0
	[0051.188] lstrlenA (lpString="*.dbf") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.odt") returned 0
	[0051.188] lstrlenA (lpString="*.odt") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.vob") returned 0
	[0051.188] lstrlenA (lpString="*.vob") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.ifo") returned 0
	[0051.188] lstrlenA (lpString="*.ifo") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.lnk") returned 0
	[0051.188] lstrlenA (lpString="*.lnk") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.torrent") returned 0
	[0051.188] lstrlenA (lpString="*.torrent") returned 9
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mov") returned 0
	[0051.188] lstrlenA (lpString="*.mov") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.m2v") returned 0
	[0051.188] lstrlenA (lpString="*.m2v") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.3gp") returned 0
	[0051.188] lstrlenA (lpString="*.3gp") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mpeg") returned 0
	[0051.188] lstrlenA (lpString="*.mpeg") returned 6
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mpg") returned 0
	[0051.188] lstrlenA (lpString="*.mpg") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.flv") returned 0
	[0051.188] lstrlenA (lpString="*.flv") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.avi") returned 0
	[0051.188] lstrlenA (lpString="*.avi") returned 5
	[0051.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mp4") returned 0
	[0051.189] lstrlenA (lpString="*.mp4") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.wmv") returned 0
	[0051.189] lstrlenA (lpString="*.wmv") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.divx") returned 0
	[0051.189] lstrlenA (lpString="*.divx") returned 6
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mkv") returned 0
	[0051.189] lstrlenA (lpString="*.mkv") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mp3") returned 0
	[0051.189] lstrlenA (lpString="*.mp3") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.wav") returned 0
	[0051.189] lstrlenA (lpString="*.wav") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.flac") returned 0
	[0051.189] lstrlenA (lpString="*.flac") returned 6
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.ape") returned 0
	[0051.189] lstrlenA (lpString="*.ape") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.wma") returned 0
	[0051.189] lstrlenA (lpString="*.wma") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.ac3") returned 0
	[0051.189] lstrlenA (lpString="*.ac3") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.exe") returned 0
	[0051.189] lstrlenA (lpString="*.exe") returned 5
	[0051.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.apk") returned 0
	[0051.189] lstrlenA (lpString="*.apk") returned 5
	[0051.189] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.189] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.189] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0285444.WMF") returned -1
	[0051.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285444.WMF") returned -1
	[0051.189] lstrcmpiA (lpString1="", lpString2="J0285444.WMF") returned -1
	[0051.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned="J0285410.WMF"
	[0051.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\"
	[0051.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285444.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF"
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.zip") returned 0
	[0051.190] lstrlenA (lpString="*.zip") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.rar") returned 0
	[0051.190] lstrlenA (lpString="*.rar") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.7z") returned 0
	[0051.190] lstrlenA (lpString="*.7z") returned 4
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.tar") returned 0
	[0051.190] lstrlenA (lpString="*.tar") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.gzip") returned 0
	[0051.190] lstrlenA (lpString="*.gzip") returned 6
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.jpg") returned 0
	[0051.190] lstrlenA (lpString="*.jpg") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.jpeg") returned 0
	[0051.190] lstrlenA (lpString="*.jpeg") returned 6
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.psd") returned 0
	[0051.190] lstrlenA (lpString="*.psd") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.cdr") returned 0
	[0051.190] lstrlenA (lpString="*.cdr") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.dwg") returned 0
	[0051.190] lstrlenA (lpString="*.dwg") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.max") returned 0
	[0051.190] lstrlenA (lpString="*.max") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.bmp") returned 0
	[0051.190] lstrlenA (lpString="*.bmp") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.gif") returned 0
	[0051.190] lstrlenA (lpString="*.gif") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.png") returned 0
	[0051.190] lstrlenA (lpString="*.png") returned 5
	[0051.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.doc") returned 0
	[0051.190] lstrlenA (lpString="*.doc") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.docx") returned 0
	[0051.191] lstrlenA (lpString="*.docx") returned 6
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.xls") returned 0
	[0051.191] lstrlenA (lpString="*.xls") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.xlsx") returned 0
	[0051.191] lstrlenA (lpString="*.xlsx") returned 6
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.ppt") returned 0
	[0051.191] lstrlenA (lpString="*.ppt") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.pptx") returned 0
	[0051.191] lstrlenA (lpString="*.pptx") returned 6
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.txt") returned 0
	[0051.191] lstrlenA (lpString="*.txt") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.pdf") returned 0
	[0051.191] lstrlenA (lpString="*.pdf") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.djvu") returned 0
	[0051.191] lstrlenA (lpString="*.djvu") returned 6
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.htm") returned 0
	[0051.191] lstrlenA (lpString="*.htm") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.html") returned 0
	[0051.191] lstrlenA (lpString="*.html") returned 6
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mdb") returned 0
	[0051.191] lstrlenA (lpString="*.mdb") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.cer") returned 0
	[0051.191] lstrlenA (lpString="*.cer") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.p12") returned 0
	[0051.191] lstrlenA (lpString="*.p12") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.pfx") returned 0
	[0051.191] lstrlenA (lpString="*.pfx") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.kwm") returned 0
	[0051.191] lstrlenA (lpString="*.kwm") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.pwm") returned 0
	[0051.191] lstrlenA (lpString="*.pwm") returned 5
	[0051.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.1cd") returned 0
	[0051.191] lstrlenA (lpString="*.1cd") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.md") returned 0
	[0051.192] lstrlenA (lpString="*.md") returned 4
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mdf") returned 0
	[0051.192] lstrlenA (lpString="*.mdf") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.dbf") returned 0
	[0051.192] lstrlenA (lpString="*.dbf") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.odt") returned 0
	[0051.192] lstrlenA (lpString="*.odt") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.vob") returned 0
	[0051.192] lstrlenA (lpString="*.vob") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.ifo") returned 0
	[0051.192] lstrlenA (lpString="*.ifo") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.lnk") returned 0
	[0051.192] lstrlenA (lpString="*.lnk") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.torrent") returned 0
	[0051.192] lstrlenA (lpString="*.torrent") returned 9
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mov") returned 0
	[0051.192] lstrlenA (lpString="*.mov") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.m2v") returned 0
	[0051.192] lstrlenA (lpString="*.m2v") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.3gp") returned 0
	[0051.192] lstrlenA (lpString="*.3gp") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mpeg") returned 0
	[0051.192] lstrlenA (lpString="*.mpeg") returned 6
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mpg") returned 0
	[0051.192] lstrlenA (lpString="*.mpg") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.flv") returned 0
	[0051.192] lstrlenA (lpString="*.flv") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.avi") returned 0
	[0051.192] lstrlenA (lpString="*.avi") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mp4") returned 0
	[0051.192] lstrlenA (lpString="*.mp4") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.wmv") returned 0
	[0051.192] lstrlenA (lpString="*.wmv") returned 5
	[0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.divx") returned 0
	[0051.193] lstrlenA (lpString="*.divx") returned 6
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mkv") returned 0
	[0051.193] lstrlenA (lpString="*.mkv") returned 5
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mp3") returned 0
	[0051.193] lstrlenA (lpString="*.mp3") returned 5
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.wav") returned 0
	[0051.193] lstrlenA (lpString="*.wav") returned 5
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.flac") returned 0
	[0051.193] lstrlenA (lpString="*.flac") returned 6
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.ape") returned 0
	[0051.193] lstrlenA (lpString="*.ape") returned 5
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.wma") returned 0
	[0051.193] lstrlenA (lpString="*.wma") returned 5
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.ac3") returned 0
	[0051.193] lstrlenA (lpString="*.ac3") returned 5
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.exe") returned 0
	[0051.193] lstrlenA (lpString="*.exe") returned 5
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.apk") returned 0
	[0051.193] lstrlenA (lpString="*.apk") returned 5
	[0051.193] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.193] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.193] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0285698.WMF") returned -1
	[0051.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285698.WMF") returned -1
	[0051.193] lstrcmpiA (lpString1="", lpString2="J0285698.WMF") returned -1
	[0051.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned="J0285444.WMF"
	[0051.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285698.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF"
	[0051.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.zip") returned 0
	[0051.194] lstrlenA (lpString="*.zip") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.rar") returned 0
	[0051.194] lstrlenA (lpString="*.rar") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.7z") returned 0
	[0051.194] lstrlenA (lpString="*.7z") returned 4
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.tar") returned 0
	[0051.194] lstrlenA (lpString="*.tar") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.gzip") returned 0
	[0051.194] lstrlenA (lpString="*.gzip") returned 6
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.jpg") returned 0
	[0051.194] lstrlenA (lpString="*.jpg") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.jpeg") returned 0
	[0051.194] lstrlenA (lpString="*.jpeg") returned 6
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.psd") returned 0
	[0051.194] lstrlenA (lpString="*.psd") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.cdr") returned 0
	[0051.194] lstrlenA (lpString="*.cdr") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.dwg") returned 0
	[0051.194] lstrlenA (lpString="*.dwg") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.max") returned 0
	[0051.194] lstrlenA (lpString="*.max") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.bmp") returned 0
	[0051.194] lstrlenA (lpString="*.bmp") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.gif") returned 0
	[0051.194] lstrlenA (lpString="*.gif") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.png") returned 0
	[0051.194] lstrlenA (lpString="*.png") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.doc") returned 0
	[0051.194] lstrlenA (lpString="*.doc") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.docx") returned 0
	[0051.194] lstrlenA (lpString="*.docx") returned 6
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.xls") returned 0
	[0051.194] lstrlenA (lpString="*.xls") returned 5
	[0051.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.xlsx") returned 0
	[0051.195] lstrlenA (lpString="*.xlsx") returned 6
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.ppt") returned 0
	[0051.195] lstrlenA (lpString="*.ppt") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.pptx") returned 0
	[0051.195] lstrlenA (lpString="*.pptx") returned 6
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.txt") returned 0
	[0051.195] lstrlenA (lpString="*.txt") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.pdf") returned 0
	[0051.195] lstrlenA (lpString="*.pdf") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.djvu") returned 0
	[0051.195] lstrlenA (lpString="*.djvu") returned 6
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.htm") returned 0
	[0051.195] lstrlenA (lpString="*.htm") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.html") returned 0
	[0051.195] lstrlenA (lpString="*.html") returned 6
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mdb") returned 0
	[0051.195] lstrlenA (lpString="*.mdb") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.cer") returned 0
	[0051.195] lstrlenA (lpString="*.cer") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.p12") returned 0
	[0051.195] lstrlenA (lpString="*.p12") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.pfx") returned 0
	[0051.195] lstrlenA (lpString="*.pfx") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.kwm") returned 0
	[0051.195] lstrlenA (lpString="*.kwm") returned 5
	[0051.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.pwm") returned 0
	[0051.196] lstrlenA (lpString="*.pwm") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.1cd") returned 0
	[0051.196] lstrlenA (lpString="*.1cd") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.md") returned 0
	[0051.196] lstrlenA (lpString="*.md") returned 4
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mdf") returned 0
	[0051.196] lstrlenA (lpString="*.mdf") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.dbf") returned 0
	[0051.196] lstrlenA (lpString="*.dbf") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.odt") returned 0
	[0051.196] lstrlenA (lpString="*.odt") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.vob") returned 0
	[0051.196] lstrlenA (lpString="*.vob") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.ifo") returned 0
	[0051.196] lstrlenA (lpString="*.ifo") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.lnk") returned 0
	[0051.196] lstrlenA (lpString="*.lnk") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.torrent") returned 0
	[0051.196] lstrlenA (lpString="*.torrent") returned 9
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mov") returned 0
	[0051.196] lstrlenA (lpString="*.mov") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.m2v") returned 0
	[0051.196] lstrlenA (lpString="*.m2v") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.3gp") returned 0
	[0051.196] lstrlenA (lpString="*.3gp") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mpeg") returned 0
	[0051.196] lstrlenA (lpString="*.mpeg") returned 6
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mpg") returned 0
	[0051.196] lstrlenA (lpString="*.mpg") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.flv") returned 0
	[0051.196] lstrlenA (lpString="*.flv") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.avi") returned 0
	[0051.196] lstrlenA (lpString="*.avi") returned 5
	[0051.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mp4") returned 0
	[0051.196] lstrlenA (lpString="*.mp4") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.wmv") returned 0
	[0051.197] lstrlenA (lpString="*.wmv") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.divx") returned 0
	[0051.197] lstrlenA (lpString="*.divx") returned 6
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mkv") returned 0
	[0051.197] lstrlenA (lpString="*.mkv") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mp3") returned 0
	[0051.197] lstrlenA (lpString="*.mp3") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.wav") returned 0
	[0051.197] lstrlenA (lpString="*.wav") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.flac") returned 0
	[0051.197] lstrlenA (lpString="*.flac") returned 6
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.ape") returned 0
	[0051.197] lstrlenA (lpString="*.ape") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.wma") returned 0
	[0051.197] lstrlenA (lpString="*.wma") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.ac3") returned 0
	[0051.197] lstrlenA (lpString="*.ac3") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.exe") returned 0
	[0051.197] lstrlenA (lpString="*.exe") returned 5
	[0051.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.apk") returned 0
	[0051.197] lstrlenA (lpString="*.apk") returned 5
	[0051.197] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.197] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0285750.WMF") returned -1
	[0051.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285750.WMF") returned -1
	[0051.197] lstrcmpiA (lpString1="", lpString2="J0285750.WMF") returned -1
	[0051.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned="J0285698.WMF"
	[0051.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned=""
	[0051.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt"
	[0051.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20
	[0051.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285750.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF"
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.zip") returned 0
	[0051.198] lstrlenA (lpString="*.zip") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.rar") returned 0
	[0051.198] lstrlenA (lpString="*.rar") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.7z") returned 0
	[0051.198] lstrlenA (lpString="*.7z") returned 4
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.tar") returned 0
	[0051.198] lstrlenA (lpString="*.tar") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.gzip") returned 0
	[0051.198] lstrlenA (lpString="*.gzip") returned 6
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.jpg") returned 0
	[0051.198] lstrlenA (lpString="*.jpg") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.jpeg") returned 0
	[0051.198] lstrlenA (lpString="*.jpeg") returned 6
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.psd") returned 0
	[0051.198] lstrlenA (lpString="*.psd") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.cdr") returned 0
	[0051.198] lstrlenA (lpString="*.cdr") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.dwg") returned 0
	[0051.198] lstrlenA (lpString="*.dwg") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.max") returned 0
	[0051.198] lstrlenA (lpString="*.max") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.bmp") returned 0
	[0051.198] lstrlenA (lpString="*.bmp") returned 5
	[0051.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.gif") returned 0
	[0051.198] lstrlenA (lpString="*.gif") returned 5
	[0051.199] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.199] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0285926.WMF") returned -1
	[0051.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285926.WMF") returned -1
	[0051.199] lstrcmpiA (lpString1="", lpString2="J0285926.WMF") returned -1
	[0051.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned="J0285750.WMF"
	[0051.200] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.200] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0286034.WMF") returned -1
	[0051.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0286034.WMF") returned -1
	[0051.200] lstrcmpiA (lpString1="", lpString2="J0286034.WMF") returned -1
	[0051.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned="J0285926.WMF"
	[0051.201] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0286068.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0286068.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="", lpString2="J0286068.WMF") returned -1
	[0051.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned="J0286034.WMF"
	[0051.201] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0287005.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287005.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="", lpString2="J0287005.WMF") returned -1
	[0051.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned="J0286068.WMF"
	[0051.201] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0291984.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0291984.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="", lpString2="J0291984.WMF") returned -1
	[0051.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned="J0287005.WMF"
	[0051.201] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0292020.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292020.WMF") returned -1
	[0051.201] lstrcmpiA (lpString1="", lpString2="J0292020.WMF") returned -1
	[0051.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned="J0291984.WMF"
	[0051.202] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.202] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0292152.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292152.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="", lpString2="J0292152.WMF") returned -1
	[0051.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned="J0292020.WMF"
	[0051.202] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.202] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0292982.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292982.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="", lpString2="J0292982.WMF") returned -1
	[0051.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned="J0292152.WMF"
	[0051.202] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.202] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0293234.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293234.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="", lpString2="J0293234.WMF") returned -1
	[0051.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned="J0292982.WMF"
	[0051.202] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.202] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0293236.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293236.WMF") returned -1
	[0051.202] lstrcmpiA (lpString1="", lpString2="J0293236.WMF") returned -1
	[0051.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned="J0293234.WMF"
	[0051.203] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.203] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.203] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0293238.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293238.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="", lpString2="J0293238.WMF") returned -1
	[0051.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned="J0293236.WMF"
	[0051.203] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.203] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.203] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0293240.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293240.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="", lpString2="J0293240.WMF") returned -1
	[0051.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned="J0293238.WMF"
	[0051.203] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.203] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.203] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0293570.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293570.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="", lpString2="J0293570.WMF") returned -1
	[0051.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned="J0293240.WMF"
	[0051.203] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.203] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.203] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0293828.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293828.WMF") returned -1
	[0051.203] lstrcmpiA (lpString1="", lpString2="J0293828.WMF") returned -1
	[0051.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned="J0293570.WMF"
	[0051.204] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.204] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.204] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0293844.WMF") returned -1
	[0051.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293844.WMF") returned -1
	[0051.204] lstrcmpiA (lpString1="", lpString2="J0293844.WMF") returned -1
	[0051.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned="J0293828.WMF"
	[0051.204] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.204] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.204] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0295241.GIF") returned -1
	[0051.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0295241.GIF") returned -1
	[0051.204] lstrcmpiA (lpString1="", lpString2="J0295241.GIF") returned -1
	[0051.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned="J0293844.WMF"
	[0051.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="J0295241.GIF"
	[0051.219] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.219] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x29c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x29c2, lpOverlapped=0x0) returned 1
	[0051.219] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.219] CloseHandle (hObject=0x8c) returned 1
	[0051.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.boom")) returned 1
	[0051.220] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.220] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.220] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0297185.WMF") returned -1
	[0051.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297185.WMF") returned -1
	[0051.220] lstrcmpiA (lpString1="", lpString2="J0297185.WMF") returned -1
	[0051.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="J0295241.GIF"
	[0051.220] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.220] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.220] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0297551.WMF") returned -1
	[0051.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297551.WMF") returned -1
	[0051.220] lstrcmpiA (lpString1="", lpString2="J0297551.WMF") returned -1
	[0051.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned="J0297185.WMF"
	[0051.221] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.221] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0297707.WMF") returned -1
	[0051.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297707.WMF") returned -1
	[0051.221] lstrcmpiA (lpString1="", lpString2="J0297707.WMF") returned -1
	[0051.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned="J0297551.WMF"
	[0051.221] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.221] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0297749.WMF") returned -1
	[0051.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297749.WMF") returned -1
	[0051.221] lstrcmpiA (lpString1="", lpString2="J0297749.WMF") returned -1
	[0051.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned="J0297707.WMF"
	[0051.221] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.221] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0298653.WMF") returned -1
	[0051.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0298653.WMF") returned -1
	[0051.221] lstrcmpiA (lpString1="", lpString2="J0298653.WMF") returned -1
	[0051.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned="J0297749.WMF"
	[0051.221] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.221] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0298897.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0298897.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="", lpString2="J0298897.WMF") returned -1
	[0051.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned="J0298653.WMF"
	[0051.222] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.222] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0299125.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299125.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="", lpString2="J0299125.WMF") returned -1
	[0051.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned="J0298897.WMF"
	[0051.222] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.222] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0299171.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299171.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="", lpString2="J0299171.WMF") returned -1
	[0051.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned="J0299125.WMF"
	[0051.222] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.222] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0299587.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299587.WMF") returned -1
	[0051.222] lstrcmpiA (lpString1="", lpString2="J0299587.WMF") returned -1
	[0051.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned="J0299171.WMF"
	[0051.222] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.222] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0299611.WMF") returned -1
	[0051.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299611.WMF") returned -1
	[0051.223] lstrcmpiA (lpString1="", lpString2="J0299611.WMF") returned -1
	[0051.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned="J0299587.WMF"
	[0051.223] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.223] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0299763.WMF") returned -1
	[0051.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299763.WMF") returned -1
	[0051.223] lstrcmpiA (lpString1="", lpString2="J0299763.WMF") returned -1
	[0051.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned="J0299611.WMF"
	[0051.223] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.223] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0300520.GIF") returned -1
	[0051.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0300520.GIF") returned -1
	[0051.223] lstrcmpiA (lpString1="", lpString2="J0300520.GIF") returned -1
	[0051.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned="J0299763.WMF"
	[0051.238] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="J0300520.GIF"
	[0051.238] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.238] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3442, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3442, lpOverlapped=0x0) returned 1
	[0051.239] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.239] CloseHandle (hObject=0x8c) returned 1
	[0051.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.boom")) returned 1
	[0051.239] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.239] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.239] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0300840.WMF") returned -1
	[0051.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0300840.WMF") returned -1
	[0051.239] lstrcmpiA (lpString1="", lpString2="J0300840.WMF") returned -1
	[0051.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="J0300520.GIF"
	[0051.240] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.240] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0300912.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0300912.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="", lpString2="J0300912.WMF") returned -1
	[0051.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned="J0300840.WMF"
	[0051.240] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.240] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0301050.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301050.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="", lpString2="J0301050.WMF") returned -1
	[0051.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned="J0300912.WMF"
	[0051.240] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.240] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0301076.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301076.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="", lpString2="J0301076.WMF") returned -1
	[0051.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned="J0301050.WMF"
	[0051.240] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.240] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0301252.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301252.WMF") returned -1
	[0051.240] lstrcmpiA (lpString1="", lpString2="J0301252.WMF") returned -1
	[0051.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned="J0301076.WMF"
	[0051.241] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.241] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0301480.WMF") returned -1
	[0051.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301480.WMF") returned -1
	[0051.241] lstrcmpiA (lpString1="", lpString2="J0301480.WMF") returned -1
	[0051.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned="J0301252.WMF"
	[0051.241] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.241] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0302827.JPG") returned -1
	[0051.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0302827.JPG") returned -1
	[0051.241] lstrcmpiA (lpString1="", lpString2="J0302827.JPG") returned -1
	[0051.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned="J0301480.WMF"
	[0051.318] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="J0302827.JPG"
	[0051.319] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.319] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5a08, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5a08, lpOverlapped=0x0) returned 1
	[0051.319] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.326] CloseHandle (hObject=0x8c) returned 1
	[0051.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.boom")) returned 1
	[0051.327] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.327] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0302953.JPG") returned -1
	[0051.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0302953.JPG") returned -1
	[0051.327] lstrcmpiA (lpString1="", lpString2="J0302953.JPG") returned -1
	[0051.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="J0302827.JPG"
	[0051.328] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="J0302953.JPG"
	[0051.328] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.328] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x259e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x259e, lpOverlapped=0x0) returned 1
	[0051.329] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.329] CloseHandle (hObject=0x8c) returned 1
	[0051.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.boom")) returned 1
	[0051.329] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.329] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.329] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0304933.WMF") returned -1
	[0051.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0304933.WMF") returned -1
	[0051.329] lstrcmpiA (lpString1="", lpString2="J0304933.WMF") returned -1
	[0051.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="J0302953.JPG"
	[0051.330] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.330] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.330] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0305257.WMF") returned -1
	[0051.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0305257.WMF") returned -1
	[0051.330] lstrcmpiA (lpString1="", lpString2="J0305257.WMF") returned -1
	[0051.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned="J0304933.WMF"
	[0051.330] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.330] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.330] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0305493.WMF") returned -1
	[0051.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0305493.WMF") returned -1
	[0051.330] lstrcmpiA (lpString1="", lpString2="J0305493.WMF") returned -1
	[0051.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned="J0305257.WMF"
	[0051.330] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.330] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.330] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0315447.JPG") returned -1
	[0051.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0315447.JPG") returned -1
	[0051.330] lstrcmpiA (lpString1="", lpString2="J0315447.JPG") returned -1
	[0051.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned="J0305493.WMF"
	[0051.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="J0315447.JPG"
	[0051.343] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0051.343] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x60c1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x60c1, lpOverlapped=0x0) returned 1
	[0051.344] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.344] CloseHandle (hObject=0x8c) returned 1
	[0051.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.boom")) returned 1
	[0051.344] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0332268.WMF") returned -1
	[0051.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0332268.WMF") returned -1
	[0051.344] lstrcmpiA (lpString1="", lpString2="J0332268.WMF") returned -1
	[0051.344] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="J0315447.JPG"
	[0051.345] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0332364.WMF") returned -1
	[0051.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0332364.WMF") returned -1
	[0051.345] lstrcmpiA (lpString1="", lpString2="J0332364.WMF") returned -1
	[0051.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned="J0332268.WMF"
	[0051.345] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0335112.WMF") returned -1
	[0051.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0335112.WMF") returned -1
	[0051.345] lstrcmpiA (lpString1="", lpString2="J0335112.WMF") returned -1
	[0051.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned="J0332364.WMF"
	[0051.345] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0051.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="J0336075.WMF") returned -1
	[0051.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0336075.WMF") returned -1
	[0051.345] lstrcmpiA (lpString1="", lpString2="J0336075.WMF") returned -1
	[0051.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned="J0335112.WMF"
	[0051.345] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0051.345] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0051.345] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0051.345] lstrcmpA (lpString1=".", lpString2="OFFICE14") returned -1
	[0051.345] lstrcmpA (lpString1="..", lpString2="OFFICE14") returned -1
	[0051.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*") returned="*.*"
	[0051.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\", lpString2="OFFICE14" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14"
	[0051.346] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0051.347] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0051.347] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.347] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0051.347] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0051.347] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.347] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0051.347] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0051.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="*.*"
	[0051.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033"
	[0051.347] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0051.347] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0051.347] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.347] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0051.347] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0051.347] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.347] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OFFICE10.MML") returned -1
	[0051.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE10.MML") returned -1
	[0051.347] lstrcmpiA (lpString1="", lpString2="OFFICE10.MML") returned -1
	[0051.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*") returned="*.*"
	[0051.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\"
	[0051.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned=""
	[0051.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt"
	[0051.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0051.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0051.348] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0051.351] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0051.352] CloseHandle (hObject=0x90) returned 1
	[0051.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpString2="OFFICE10.MML" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML"
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.zip") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.rar") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.7z") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.tar") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.gzip") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.jpg") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.jpeg") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.psd") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.cdr") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.dwg") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.max") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.bmp") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.gif") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.png") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.doc") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.docx") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.xls") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.xlsx") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.ppt") returned 0
	[0051.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.pptx") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.txt") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.pdf") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.djvu") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.htm") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.html") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mdb") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.cer") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.p12") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.pfx") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.kwm") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.pwm") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.1cd") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.md") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mdf") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.dbf") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.odt") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.vob") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.ifo") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.lnk") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.torrent") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mov") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.m2v") returned 0
	[0051.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.3gp") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mpeg") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mpg") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.flv") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.avi") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mp4") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.wmv") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.divx") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mkv") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mp3") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.wav") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.flac") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.ape") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.wma") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.ac3") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.exe") returned 0
	[0051.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.apk") returned 0
	[0051.354] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0051.354] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0051.354] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.354] lstrcmpA (lpString1=".", lpString2="AUTOSHAP") returned -1
	[0051.354] lstrcmpA (lpString1="..", lpString2="AUTOSHAP") returned -1
	[0051.354] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="*.*"
	[0051.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="AUTOSHAP" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP"
	[0051.355] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned 57
	[0051.355] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0051.357] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0051.357] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.357] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0051.357] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0051.357] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.357] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.357] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AUTOSHAP.DLL") returned 1
	[0051.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AUTOSHAP.DLL") returned 1
	[0051.357] lstrcmpiA (lpString1="", lpString2="AUTOSHAP.DLL") returned -1
	[0051.357] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*") returned="*.*"
	[0051.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.357] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.357] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0xffffffff
	[0051.358] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0051.359] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0051.359] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0051.359] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0051.359] CloseHandle (hObject=0x90) returned 1
	[0051.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="AUTOSHAP.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL"
	[0051.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.zip") returned 0
	[0051.359] lstrlenA (lpString="*.zip") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.rar") returned 0
	[0051.360] lstrlenA (lpString="*.rar") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.7z") returned 0
	[0051.360] lstrlenA (lpString="*.7z") returned 4
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.tar") returned 0
	[0051.360] lstrlenA (lpString="*.tar") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.gzip") returned 0
	[0051.360] lstrlenA (lpString="*.gzip") returned 6
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.jpg") returned 0
	[0051.360] lstrlenA (lpString="*.jpg") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.jpeg") returned 0
	[0051.360] lstrlenA (lpString="*.jpeg") returned 6
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.psd") returned 0
	[0051.360] lstrlenA (lpString="*.psd") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.cdr") returned 0
	[0051.360] lstrlenA (lpString="*.cdr") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.dwg") returned 0
	[0051.360] lstrlenA (lpString="*.dwg") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.max") returned 0
	[0051.360] lstrlenA (lpString="*.max") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.bmp") returned 0
	[0051.360] lstrlenA (lpString="*.bmp") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.gif") returned 0
	[0051.360] lstrlenA (lpString="*.gif") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.png") returned 0
	[0051.360] lstrlenA (lpString="*.png") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.doc") returned 0
	[0051.360] lstrlenA (lpString="*.doc") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.docx") returned 0
	[0051.360] lstrlenA (lpString="*.docx") returned 6
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.xls") returned 0
	[0051.360] lstrlenA (lpString="*.xls") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.xlsx") returned 0
	[0051.360] lstrlenA (lpString="*.xlsx") returned 6
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.ppt") returned 0
	[0051.360] lstrlenA (lpString="*.ppt") returned 5
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.pptx") returned 0
	[0051.360] lstrlenA (lpString="*.pptx") returned 6
	[0051.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.txt") returned 0
	[0051.361] lstrlenA (lpString="*.txt") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.pdf") returned 0
	[0051.361] lstrlenA (lpString="*.pdf") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.djvu") returned 0
	[0051.361] lstrlenA (lpString="*.djvu") returned 6
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.htm") returned 0
	[0051.361] lstrlenA (lpString="*.htm") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.html") returned 0
	[0051.361] lstrlenA (lpString="*.html") returned 6
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mdb") returned 0
	[0051.361] lstrlenA (lpString="*.mdb") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.cer") returned 0
	[0051.361] lstrlenA (lpString="*.cer") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.p12") returned 0
	[0051.361] lstrlenA (lpString="*.p12") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.pfx") returned 0
	[0051.361] lstrlenA (lpString="*.pfx") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.kwm") returned 0
	[0051.361] lstrlenA (lpString="*.kwm") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.pwm") returned 0
	[0051.361] lstrlenA (lpString="*.pwm") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.1cd") returned 0
	[0051.361] lstrlenA (lpString="*.1cd") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.md") returned 0
	[0051.361] lstrlenA (lpString="*.md") returned 4
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mdf") returned 0
	[0051.361] lstrlenA (lpString="*.mdf") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.dbf") returned 0
	[0051.361] lstrlenA (lpString="*.dbf") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.odt") returned 0
	[0051.361] lstrlenA (lpString="*.odt") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.vob") returned 0
	[0051.361] lstrlenA (lpString="*.vob") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.ifo") returned 0
	[0051.361] lstrlenA (lpString="*.ifo") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.lnk") returned 0
	[0051.361] lstrlenA (lpString="*.lnk") returned 5
	[0051.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.torrent") returned 0
	[0051.361] lstrlenA (lpString="*.torrent") returned 9
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mov") returned 0
	[0051.362] lstrlenA (lpString="*.mov") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.m2v") returned 0
	[0051.362] lstrlenA (lpString="*.m2v") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.3gp") returned 0
	[0051.362] lstrlenA (lpString="*.3gp") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mpeg") returned 0
	[0051.362] lstrlenA (lpString="*.mpeg") returned 6
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mpg") returned 0
	[0051.362] lstrlenA (lpString="*.mpg") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.flv") returned 0
	[0051.362] lstrlenA (lpString="*.flv") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.avi") returned 0
	[0051.362] lstrlenA (lpString="*.avi") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mp4") returned 0
	[0051.362] lstrlenA (lpString="*.mp4") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.wmv") returned 0
	[0051.362] lstrlenA (lpString="*.wmv") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.divx") returned 0
	[0051.362] lstrlenA (lpString="*.divx") returned 6
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mkv") returned 0
	[0051.362] lstrlenA (lpString="*.mkv") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mp3") returned 0
	[0051.362] lstrlenA (lpString="*.mp3") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.wav") returned 0
	[0051.362] lstrlenA (lpString="*.wav") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.flac") returned 0
	[0051.362] lstrlenA (lpString="*.flac") returned 6
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.ape") returned 0
	[0051.362] lstrlenA (lpString="*.ape") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.wma") returned 0
	[0051.362] lstrlenA (lpString="*.wma") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.ac3") returned 0
	[0051.362] lstrlenA (lpString="*.ac3") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.exe") returned 0
	[0051.362] lstrlenA (lpString="*.exe") returned 5
	[0051.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.apk") returned 0
	[0051.362] lstrlenA (lpString="*.apk") returned 5
	[0051.363] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.363] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.363] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18180_.WMF") returned 1
	[0051.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18180_.WMF") returned 1
	[0051.363] lstrcmpiA (lpString1="", lpString2="BD18180_.WMF") returned -1
	[0051.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned="AUTOSHAP.DLL"
	[0051.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.363] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18180_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF"
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.zip") returned 0
	[0051.363] lstrlenA (lpString="*.zip") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.rar") returned 0
	[0051.363] lstrlenA (lpString="*.rar") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.7z") returned 0
	[0051.363] lstrlenA (lpString="*.7z") returned 4
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.tar") returned 0
	[0051.363] lstrlenA (lpString="*.tar") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.gzip") returned 0
	[0051.363] lstrlenA (lpString="*.gzip") returned 6
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.jpg") returned 0
	[0051.363] lstrlenA (lpString="*.jpg") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.jpeg") returned 0
	[0051.363] lstrlenA (lpString="*.jpeg") returned 6
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.psd") returned 0
	[0051.363] lstrlenA (lpString="*.psd") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.cdr") returned 0
	[0051.363] lstrlenA (lpString="*.cdr") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.dwg") returned 0
	[0051.363] lstrlenA (lpString="*.dwg") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.max") returned 0
	[0051.363] lstrlenA (lpString="*.max") returned 5
	[0051.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.bmp") returned 0
	[0051.364] lstrlenA (lpString="*.bmp") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.gif") returned 0
	[0051.364] lstrlenA (lpString="*.gif") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.png") returned 0
	[0051.364] lstrlenA (lpString="*.png") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.doc") returned 0
	[0051.364] lstrlenA (lpString="*.doc") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.docx") returned 0
	[0051.364] lstrlenA (lpString="*.docx") returned 6
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.xls") returned 0
	[0051.364] lstrlenA (lpString="*.xls") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.xlsx") returned 0
	[0051.364] lstrlenA (lpString="*.xlsx") returned 6
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.ppt") returned 0
	[0051.364] lstrlenA (lpString="*.ppt") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.pptx") returned 0
	[0051.364] lstrlenA (lpString="*.pptx") returned 6
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.txt") returned 0
	[0051.364] lstrlenA (lpString="*.txt") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.pdf") returned 0
	[0051.364] lstrlenA (lpString="*.pdf") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.djvu") returned 0
	[0051.364] lstrlenA (lpString="*.djvu") returned 6
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.htm") returned 0
	[0051.364] lstrlenA (lpString="*.htm") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.html") returned 0
	[0051.364] lstrlenA (lpString="*.html") returned 6
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mdb") returned 0
	[0051.364] lstrlenA (lpString="*.mdb") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.cer") returned 0
	[0051.364] lstrlenA (lpString="*.cer") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.p12") returned 0
	[0051.364] lstrlenA (lpString="*.p12") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.pfx") returned 0
	[0051.364] lstrlenA (lpString="*.pfx") returned 5
	[0051.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.kwm") returned 0
	[0051.364] lstrlenA (lpString="*.kwm") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.pwm") returned 0
	[0051.365] lstrlenA (lpString="*.pwm") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.1cd") returned 0
	[0051.365] lstrlenA (lpString="*.1cd") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.md") returned 0
	[0051.365] lstrlenA (lpString="*.md") returned 4
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mdf") returned 0
	[0051.365] lstrlenA (lpString="*.mdf") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.dbf") returned 0
	[0051.365] lstrlenA (lpString="*.dbf") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.odt") returned 0
	[0051.365] lstrlenA (lpString="*.odt") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.vob") returned 0
	[0051.365] lstrlenA (lpString="*.vob") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.ifo") returned 0
	[0051.365] lstrlenA (lpString="*.ifo") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.lnk") returned 0
	[0051.365] lstrlenA (lpString="*.lnk") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.torrent") returned 0
	[0051.365] lstrlenA (lpString="*.torrent") returned 9
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mov") returned 0
	[0051.365] lstrlenA (lpString="*.mov") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.m2v") returned 0
	[0051.365] lstrlenA (lpString="*.m2v") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.3gp") returned 0
	[0051.365] lstrlenA (lpString="*.3gp") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mpeg") returned 0
	[0051.365] lstrlenA (lpString="*.mpeg") returned 6
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mpg") returned 0
	[0051.365] lstrlenA (lpString="*.mpg") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.flv") returned 0
	[0051.365] lstrlenA (lpString="*.flv") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.avi") returned 0
	[0051.365] lstrlenA (lpString="*.avi") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mp4") returned 0
	[0051.365] lstrlenA (lpString="*.mp4") returned 5
	[0051.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.wmv") returned 0
	[0051.365] lstrlenA (lpString="*.wmv") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.divx") returned 0
	[0051.366] lstrlenA (lpString="*.divx") returned 6
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mkv") returned 0
	[0051.366] lstrlenA (lpString="*.mkv") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mp3") returned 0
	[0051.366] lstrlenA (lpString="*.mp3") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.wav") returned 0
	[0051.366] lstrlenA (lpString="*.wav") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.flac") returned 0
	[0051.366] lstrlenA (lpString="*.flac") returned 6
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.ape") returned 0
	[0051.366] lstrlenA (lpString="*.ape") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.wma") returned 0
	[0051.366] lstrlenA (lpString="*.wma") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.ac3") returned 0
	[0051.366] lstrlenA (lpString="*.ac3") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.exe") returned 0
	[0051.366] lstrlenA (lpString="*.exe") returned 5
	[0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.apk") returned 0
	[0051.366] lstrlenA (lpString="*.apk") returned 5
	[0051.366] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.366] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18181_.WMF") returned 1
	[0051.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18181_.WMF") returned 1
	[0051.366] lstrcmpiA (lpString1="", lpString2="BD18181_.WMF") returned -1
	[0051.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="BD18180_.WMF"
	[0051.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18181_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF"
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.zip") returned 0
	[0051.378] lstrlenA (lpString="*.zip") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.rar") returned 0
	[0051.378] lstrlenA (lpString="*.rar") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.7z") returned 0
	[0051.378] lstrlenA (lpString="*.7z") returned 4
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.tar") returned 0
	[0051.378] lstrlenA (lpString="*.tar") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.gzip") returned 0
	[0051.378] lstrlenA (lpString="*.gzip") returned 6
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.jpg") returned 0
	[0051.378] lstrlenA (lpString="*.jpg") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.jpeg") returned 0
	[0051.378] lstrlenA (lpString="*.jpeg") returned 6
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.psd") returned 0
	[0051.378] lstrlenA (lpString="*.psd") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.cdr") returned 0
	[0051.378] lstrlenA (lpString="*.cdr") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.dwg") returned 0
	[0051.378] lstrlenA (lpString="*.dwg") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.max") returned 0
	[0051.378] lstrlenA (lpString="*.max") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.bmp") returned 0
	[0051.378] lstrlenA (lpString="*.bmp") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.gif") returned 0
	[0051.378] lstrlenA (lpString="*.gif") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.png") returned 0
	[0051.378] lstrlenA (lpString="*.png") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.doc") returned 0
	[0051.378] lstrlenA (lpString="*.doc") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.docx") returned 0
	[0051.378] lstrlenA (lpString="*.docx") returned 6
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.xls") returned 0
	[0051.378] lstrlenA (lpString="*.xls") returned 5
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.xlsx") returned 0
	[0051.378] lstrlenA (lpString="*.xlsx") returned 6
	[0051.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.ppt") returned 0
	[0051.379] lstrlenA (lpString="*.ppt") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.pptx") returned 0
	[0051.379] lstrlenA (lpString="*.pptx") returned 6
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.txt") returned 0
	[0051.379] lstrlenA (lpString="*.txt") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.pdf") returned 0
	[0051.379] lstrlenA (lpString="*.pdf") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.djvu") returned 0
	[0051.379] lstrlenA (lpString="*.djvu") returned 6
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.htm") returned 0
	[0051.379] lstrlenA (lpString="*.htm") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.html") returned 0
	[0051.379] lstrlenA (lpString="*.html") returned 6
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mdb") returned 0
	[0051.379] lstrlenA (lpString="*.mdb") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.cer") returned 0
	[0051.379] lstrlenA (lpString="*.cer") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.p12") returned 0
	[0051.379] lstrlenA (lpString="*.p12") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.pfx") returned 0
	[0051.379] lstrlenA (lpString="*.pfx") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.kwm") returned 0
	[0051.379] lstrlenA (lpString="*.kwm") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.pwm") returned 0
	[0051.379] lstrlenA (lpString="*.pwm") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.1cd") returned 0
	[0051.379] lstrlenA (lpString="*.1cd") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.md") returned 0
	[0051.379] lstrlenA (lpString="*.md") returned 4
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mdf") returned 0
	[0051.379] lstrlenA (lpString="*.mdf") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.dbf") returned 0
	[0051.379] lstrlenA (lpString="*.dbf") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.odt") returned 0
	[0051.379] lstrlenA (lpString="*.odt") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.vob") returned 0
	[0051.379] lstrlenA (lpString="*.vob") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.ifo") returned 0
	[0051.379] lstrlenA (lpString="*.ifo") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.lnk") returned 0
	[0051.379] lstrlenA (lpString="*.lnk") returned 5
	[0051.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.torrent") returned 0
	[0051.379] lstrlenA (lpString="*.torrent") returned 9
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mov") returned 0
	[0051.380] lstrlenA (lpString="*.mov") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.m2v") returned 0
	[0051.380] lstrlenA (lpString="*.m2v") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.3gp") returned 0
	[0051.380] lstrlenA (lpString="*.3gp") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mpeg") returned 0
	[0051.380] lstrlenA (lpString="*.mpeg") returned 6
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mpg") returned 0
	[0051.380] lstrlenA (lpString="*.mpg") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.flv") returned 0
	[0051.380] lstrlenA (lpString="*.flv") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.avi") returned 0
	[0051.380] lstrlenA (lpString="*.avi") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mp4") returned 0
	[0051.380] lstrlenA (lpString="*.mp4") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.wmv") returned 0
	[0051.380] lstrlenA (lpString="*.wmv") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.divx") returned 0
	[0051.380] lstrlenA (lpString="*.divx") returned 6
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mkv") returned 0
	[0051.380] lstrlenA (lpString="*.mkv") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mp3") returned 0
	[0051.380] lstrlenA (lpString="*.mp3") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.wav") returned 0
	[0051.380] lstrlenA (lpString="*.wav") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.flac") returned 0
	[0051.380] lstrlenA (lpString="*.flac") returned 6
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.ape") returned 0
	[0051.380] lstrlenA (lpString="*.ape") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.wma") returned 0
	[0051.380] lstrlenA (lpString="*.wma") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.ac3") returned 0
	[0051.380] lstrlenA (lpString="*.ac3") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.exe") returned 0
	[0051.380] lstrlenA (lpString="*.exe") returned 5
	[0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.apk") returned 0
	[0051.380] lstrlenA (lpString="*.apk") returned 5
	[0051.380] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.380] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.380] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18182_.WMF") returned 1
	[0051.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18182_.WMF") returned 1
	[0051.381] lstrcmpiA (lpString1="", lpString2="BD18182_.WMF") returned -1
	[0051.381] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="BD18181_.WMF"
	[0051.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.381] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.381] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18182_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF"
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.zip") returned 0
	[0051.381] lstrlenA (lpString="*.zip") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.rar") returned 0
	[0051.381] lstrlenA (lpString="*.rar") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.7z") returned 0
	[0051.381] lstrlenA (lpString="*.7z") returned 4
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.tar") returned 0
	[0051.381] lstrlenA (lpString="*.tar") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.gzip") returned 0
	[0051.381] lstrlenA (lpString="*.gzip") returned 6
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.jpg") returned 0
	[0051.381] lstrlenA (lpString="*.jpg") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.jpeg") returned 0
	[0051.381] lstrlenA (lpString="*.jpeg") returned 6
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.psd") returned 0
	[0051.381] lstrlenA (lpString="*.psd") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.cdr") returned 0
	[0051.381] lstrlenA (lpString="*.cdr") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.dwg") returned 0
	[0051.381] lstrlenA (lpString="*.dwg") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.max") returned 0
	[0051.381] lstrlenA (lpString="*.max") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.bmp") returned 0
	[0051.381] lstrlenA (lpString="*.bmp") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.gif") returned 0
	[0051.381] lstrlenA (lpString="*.gif") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.png") returned 0
	[0051.381] lstrlenA (lpString="*.png") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.doc") returned 0
	[0051.381] lstrlenA (lpString="*.doc") returned 5
	[0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.docx") returned 0
	[0051.381] lstrlenA (lpString="*.docx") returned 6
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.xls") returned 0
	[0051.382] lstrlenA (lpString="*.xls") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.xlsx") returned 0
	[0051.382] lstrlenA (lpString="*.xlsx") returned 6
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.ppt") returned 0
	[0051.382] lstrlenA (lpString="*.ppt") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.pptx") returned 0
	[0051.382] lstrlenA (lpString="*.pptx") returned 6
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.txt") returned 0
	[0051.382] lstrlenA (lpString="*.txt") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.pdf") returned 0
	[0051.382] lstrlenA (lpString="*.pdf") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.djvu") returned 0
	[0051.382] lstrlenA (lpString="*.djvu") returned 6
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.htm") returned 0
	[0051.382] lstrlenA (lpString="*.htm") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.html") returned 0
	[0051.382] lstrlenA (lpString="*.html") returned 6
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mdb") returned 0
	[0051.382] lstrlenA (lpString="*.mdb") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.cer") returned 0
	[0051.382] lstrlenA (lpString="*.cer") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.p12") returned 0
	[0051.382] lstrlenA (lpString="*.p12") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.pfx") returned 0
	[0051.382] lstrlenA (lpString="*.pfx") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.kwm") returned 0
	[0051.382] lstrlenA (lpString="*.kwm") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.pwm") returned 0
	[0051.382] lstrlenA (lpString="*.pwm") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.1cd") returned 0
	[0051.382] lstrlenA (lpString="*.1cd") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.md") returned 0
	[0051.382] lstrlenA (lpString="*.md") returned 4
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mdf") returned 0
	[0051.382] lstrlenA (lpString="*.mdf") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.dbf") returned 0
	[0051.382] lstrlenA (lpString="*.dbf") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.odt") returned 0
	[0051.382] lstrlenA (lpString="*.odt") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.vob") returned 0
	[0051.382] lstrlenA (lpString="*.vob") returned 5
	[0051.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.ifo") returned 0
	[0051.383] lstrlenA (lpString="*.ifo") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.lnk") returned 0
	[0051.383] lstrlenA (lpString="*.lnk") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.torrent") returned 0
	[0051.383] lstrlenA (lpString="*.torrent") returned 9
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mov") returned 0
	[0051.383] lstrlenA (lpString="*.mov") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.m2v") returned 0
	[0051.383] lstrlenA (lpString="*.m2v") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.3gp") returned 0
	[0051.383] lstrlenA (lpString="*.3gp") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mpeg") returned 0
	[0051.383] lstrlenA (lpString="*.mpeg") returned 6
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mpg") returned 0
	[0051.383] lstrlenA (lpString="*.mpg") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.flv") returned 0
	[0051.383] lstrlenA (lpString="*.flv") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.avi") returned 0
	[0051.383] lstrlenA (lpString="*.avi") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mp4") returned 0
	[0051.383] lstrlenA (lpString="*.mp4") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.wmv") returned 0
	[0051.383] lstrlenA (lpString="*.wmv") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.divx") returned 0
	[0051.383] lstrlenA (lpString="*.divx") returned 6
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mkv") returned 0
	[0051.383] lstrlenA (lpString="*.mkv") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mp3") returned 0
	[0051.383] lstrlenA (lpString="*.mp3") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.wav") returned 0
	[0051.383] lstrlenA (lpString="*.wav") returned 5
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.flac") returned 0
	[0051.383] lstrlenA (lpString="*.flac") returned 6
	[0051.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.ape") returned 0
	[0051.384] lstrlenA (lpString="*.ape") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.wma") returned 0
	[0051.384] lstrlenA (lpString="*.wma") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.ac3") returned 0
	[0051.384] lstrlenA (lpString="*.ac3") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.exe") returned 0
	[0051.384] lstrlenA (lpString="*.exe") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.apk") returned 0
	[0051.384] lstrlenA (lpString="*.apk") returned 5
	[0051.384] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.384] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.384] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18184_.WMF") returned 1
	[0051.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18184_.WMF") returned 1
	[0051.384] lstrcmpiA (lpString1="", lpString2="BD18184_.WMF") returned -1
	[0051.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="BD18182_.WMF"
	[0051.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.384] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18184_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF"
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.zip") returned 0
	[0051.384] lstrlenA (lpString="*.zip") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.rar") returned 0
	[0051.384] lstrlenA (lpString="*.rar") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.7z") returned 0
	[0051.384] lstrlenA (lpString="*.7z") returned 4
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.tar") returned 0
	[0051.384] lstrlenA (lpString="*.tar") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.gzip") returned 0
	[0051.384] lstrlenA (lpString="*.gzip") returned 6
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.jpg") returned 0
	[0051.384] lstrlenA (lpString="*.jpg") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.jpeg") returned 0
	[0051.384] lstrlenA (lpString="*.jpeg") returned 6
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.psd") returned 0
	[0051.384] lstrlenA (lpString="*.psd") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.cdr") returned 0
	[0051.384] lstrlenA (lpString="*.cdr") returned 5
	[0051.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.dwg") returned 0
	[0051.384] lstrlenA (lpString="*.dwg") returned 5
	[0051.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.max") returned 0
	[0051.385] lstrlenA (lpString="*.max") returned 5
	[0051.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.bmp") returned 0
	[0051.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.gif") returned 0
	[0051.385] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.385] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.385] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18185_.WMF") returned 1
	[0051.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18185_.WMF") returned 1
	[0051.385] lstrcmpiA (lpString1="", lpString2="BD18185_.WMF") returned -1
	[0051.385] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned="BD18184_.WMF"
	[0051.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.385] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.385] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18185_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF"
	[0051.385] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.385] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.385] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18187_.WMF") returned 1
	[0051.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18187_.WMF") returned 1
	[0051.385] lstrcmpiA (lpString1="", lpString2="BD18187_.WMF") returned -1
	[0051.385] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned="BD18185_.WMF"
	[0051.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.385] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.385] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18187_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF"
	[0051.386] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.386] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18189_.WMF") returned 1
	[0051.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18189_.WMF") returned 1
	[0051.386] lstrcmpiA (lpString1="", lpString2="BD18189_.WMF") returned -1
	[0051.386] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned="BD18187_.WMF"
	[0051.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.386] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.386] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18189_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF"
	[0051.386] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.386] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18190_.WMF") returned 1
	[0051.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18190_.WMF") returned 1
	[0051.386] lstrcmpiA (lpString1="", lpString2="BD18190_.WMF") returned -1
	[0051.386] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned="BD18189_.WMF"
	[0051.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.386] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.386] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18190_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF"
	[0051.386] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.386] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18191_.WMF") returned 1
	[0051.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18191_.WMF") returned 1
	[0051.386] lstrcmpiA (lpString1="", lpString2="BD18191_.WMF") returned -1
	[0051.386] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned="BD18190_.WMF"
	[0051.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.386] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.386] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18191_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF"
	[0051.387] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.387] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18192_.WMF") returned 1
	[0051.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18192_.WMF") returned 1
	[0051.387] lstrcmpiA (lpString1="", lpString2="BD18192_.WMF") returned -1
	[0051.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned="BD18191_.WMF"
	[0051.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.387] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.387] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18192_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF"
	[0051.387] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.387] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18193_.WMF") returned 1
	[0051.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18193_.WMF") returned 1
	[0051.387] lstrcmpiA (lpString1="", lpString2="BD18193_.WMF") returned -1
	[0051.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned="BD18192_.WMF"
	[0051.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.387] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.387] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18193_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF"
	[0051.387] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.387] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18194_.WMF") returned 1
	[0051.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18194_.WMF") returned 1
	[0051.387] lstrcmpiA (lpString1="", lpString2="BD18194_.WMF") returned -1
	[0051.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.387] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.387] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18194_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF"
	[0051.388] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.388] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.388] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18196_.WMF") returned 1
	[0051.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18196_.WMF") returned 1
	[0051.388] lstrcmpiA (lpString1="", lpString2="BD18196_.WMF") returned -1
	[0051.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.388] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.388] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18196_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF"
	[0051.388] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.388] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.388] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18197_.WMF") returned 1
	[0051.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18197_.WMF") returned 1
	[0051.388] lstrcmpiA (lpString1="", lpString2="BD18197_.WMF") returned -1
	[0051.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.388] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.388] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18197_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF"
	[0051.388] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.388] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.388] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18198_.WMF") returned 1
	[0051.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18198_.WMF") returned 1
	[0051.388] lstrcmpiA (lpString1="", lpString2="BD18198_.WMF") returned -1
	[0051.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.388] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.388] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18198_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF"
	[0051.388] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.388] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.389] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18199_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18199_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="", lpString2="BD18199_.WMF") returned -1
	[0051.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.389] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.389] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18199_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF"
	[0051.389] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.389] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18200_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18200_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="", lpString2="BD18200_.WMF") returned -1
	[0051.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.389] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.389] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18200_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF"
	[0051.389] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.389] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18201_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18201_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="", lpString2="BD18201_.WMF") returned -1
	[0051.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.389] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.389] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18201_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF"
	[0051.389] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.389] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18202_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18202_.WMF") returned 1
	[0051.389] lstrcmpiA (lpString1="", lpString2="BD18202_.WMF") returned -1
	[0051.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.390] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18202_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF"
	[0051.390] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.390] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18203_.WMF") returned 1
	[0051.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18203_.WMF") returned 1
	[0051.390] lstrcmpiA (lpString1="", lpString2="BD18203_.WMF") returned -1
	[0051.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.390] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18203_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF"
	[0051.390] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.390] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18204_.WMF") returned 1
	[0051.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18204_.WMF") returned 1
	[0051.390] lstrcmpiA (lpString1="", lpString2="BD18204_.WMF") returned -1
	[0051.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.390] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18204_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF"
	[0051.390] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.390] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18205_.WMF") returned 1
	[0051.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18205_.WMF") returned 1
	[0051.390] lstrcmpiA (lpString1="", lpString2="BD18205_.WMF") returned -1
	[0051.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18205_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF"
	[0051.391] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.391] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18206_.WMF") returned 1
	[0051.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18206_.WMF") returned 1
	[0051.391] lstrcmpiA (lpString1="", lpString2="BD18206_.WMF") returned -1
	[0051.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18206_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF"
	[0051.391] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.391] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18207_.WMF") returned 1
	[0051.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18207_.WMF") returned 1
	[0051.391] lstrcmpiA (lpString1="", lpString2="BD18207_.WMF") returned -1
	[0051.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18207_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF"
	[0051.391] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.391] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18208_.WMF") returned 1
	[0051.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18208_.WMF") returned 1
	[0051.391] lstrcmpiA (lpString1="", lpString2="BD18208_.WMF") returned -1
	[0051.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18208_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF"
	[0051.392] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.392] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18209_.WMF") returned 1
	[0051.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18209_.WMF") returned 1
	[0051.392] lstrcmpiA (lpString1="", lpString2="BD18209_.WMF") returned -1
	[0051.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.392] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.392] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18209_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF"
	[0051.392] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.392] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18210_.WMF") returned 1
	[0051.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18210_.WMF") returned 1
	[0051.392] lstrcmpiA (lpString1="", lpString2="BD18210_.WMF") returned -1
	[0051.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.392] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.392] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18210_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF"
	[0051.392] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.392] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18211_.WMF") returned 1
	[0051.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18211_.WMF") returned 1
	[0051.392] lstrcmpiA (lpString1="", lpString2="BD18211_.WMF") returned -1
	[0051.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.393] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.393] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18211_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF"
	[0051.393] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.393] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18212_.WMF") returned 1
	[0051.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18212_.WMF") returned 1
	[0051.393] lstrcmpiA (lpString1="", lpString2="BD18212_.WMF") returned -1
	[0051.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.393] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.393] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18212_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF"
	[0051.393] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.393] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18213_.WMF") returned 1
	[0051.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18213_.WMF") returned 1
	[0051.393] lstrcmpiA (lpString1="", lpString2="BD18213_.WMF") returned -1
	[0051.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.393] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.393] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18213_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF"
	[0051.393] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.394] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18214_.WMF") returned 1
	[0051.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18214_.WMF") returned 1
	[0051.394] lstrcmpiA (lpString1="", lpString2="BD18214_.WMF") returned -1
	[0051.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.396] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.396] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18214_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF"
	[0051.397] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.397] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.397] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18215_.WMF") returned 1
	[0051.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18215_.WMF") returned 1
	[0051.397] lstrcmpiA (lpString1="", lpString2="BD18215_.WMF") returned -1
	[0051.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18215_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF"
	[0051.397] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.397] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.397] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18216_.WMF") returned 1
	[0051.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18216_.WMF") returned 1
	[0051.397] lstrcmpiA (lpString1="", lpString2="BD18216_.WMF") returned -1
	[0051.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18216_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF"
	[0051.397] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.397] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.397] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18217_.WMF") returned 1
	[0051.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18217_.WMF") returned 1
	[0051.397] lstrcmpiA (lpString1="", lpString2="BD18217_.WMF") returned -1
	[0051.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18217_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF"
	[0051.398] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.398] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.398] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18218_.WMF") returned 1
	[0051.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18218_.WMF") returned 1
	[0051.398] lstrcmpiA (lpString1="", lpString2="BD18218_.WMF") returned -1
	[0051.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18218_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF"
	[0051.398] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.398] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.398] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18219_.WMF") returned 1
	[0051.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18219_.WMF") returned 1
	[0051.398] lstrcmpiA (lpString1="", lpString2="BD18219_.WMF") returned -1
	[0051.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18219_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF"
	[0051.398] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.398] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.398] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18220_.WMF") returned 1
	[0051.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18220_.WMF") returned 1
	[0051.398] lstrcmpiA (lpString1="", lpString2="BD18220_.WMF") returned -1
	[0051.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\"
	[0051.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned=""
	[0051.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt"
	[0051.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20
	[0051.398] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.399] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18221_.WMF") returned 1
	[0051.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18221_.WMF") returned 1
	[0051.399] lstrcmpiA (lpString1="", lpString2="BD18221_.WMF") returned -1
	[0051.400] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.400] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.400] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18222_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18222_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="", lpString2="BD18222_.WMF") returned -1
	[0051.400] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.400] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.400] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18223_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18223_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="", lpString2="BD18223_.WMF") returned -1
	[0051.400] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.400] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.400] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18224_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18224_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="", lpString2="BD18224_.WMF") returned -1
	[0051.400] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.400] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.400] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18225_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18225_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="", lpString2="BD18225_.WMF") returned -1
	[0051.400] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.400] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.400] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18226_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18226_.WMF") returned 1
	[0051.400] lstrcmpiA (lpString1="", lpString2="BD18226_.WMF") returned -1
	[0051.401] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18227_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18227_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="", lpString2="BD18227_.WMF") returned -1
	[0051.401] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18228_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18228_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="", lpString2="BD18228_.WMF") returned -1
	[0051.401] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18229_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18229_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="", lpString2="BD18229_.WMF") returned -1
	[0051.401] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18230_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18230_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="", lpString2="BD18230_.WMF") returned -1
	[0051.401] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18231_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18231_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="", lpString2="BD18231_.WMF") returned -1
	[0051.401] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18232_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18232_.WMF") returned 1
	[0051.401] lstrcmpiA (lpString1="", lpString2="BD18232_.WMF") returned -1
	[0051.402] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18233_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18233_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="", lpString2="BD18233_.WMF") returned -1
	[0051.402] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18234_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18234_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="", lpString2="BD18234_.WMF") returned -1
	[0051.402] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18235_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18235_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="", lpString2="BD18235_.WMF") returned -1
	[0051.402] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18236_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18236_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="", lpString2="BD18236_.WMF") returned -1
	[0051.402] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18237_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18237_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="", lpString2="BD18237_.WMF") returned -1
	[0051.402] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18238_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18238_.WMF") returned 1
	[0051.402] lstrcmpiA (lpString1="", lpString2="BD18238_.WMF") returned -1
	[0051.402] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.403] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18239_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18239_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="", lpString2="BD18239_.WMF") returned -1
	[0051.403] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.403] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18241_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18241_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="", lpString2="BD18241_.WMF") returned -1
	[0051.403] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.403] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18242_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18242_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="", lpString2="BD18242_.WMF") returned -1
	[0051.403] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.403] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18243_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18243_.WMF") returned 1
	[0051.403] lstrcmpiA (lpString1="", lpString2="BD18243_.WMF") returned -1
	[0051.404] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18244_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18244_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="", lpString2="BD18244_.WMF") returned -1
	[0051.404] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18245_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18245_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="", lpString2="BD18245_.WMF") returned -1
	[0051.404] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18246_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18246_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="", lpString2="BD18246_.WMF") returned -1
	[0051.404] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18247_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18247_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="", lpString2="BD18247_.WMF") returned -1
	[0051.404] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18248_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18248_.WMF") returned 1
	[0051.404] lstrcmpiA (lpString1="", lpString2="BD18248_.WMF") returned -1
	[0051.404] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18249_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18249_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="", lpString2="BD18249_.WMF") returned -1
	[0051.405] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18250_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18250_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="", lpString2="BD18250_.WMF") returned -1
	[0051.405] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18251_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18251_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="", lpString2="BD18251_.WMF") returned -1
	[0051.405] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18252_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18252_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="", lpString2="BD18252_.WMF") returned -1
	[0051.405] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18253_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18253_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="", lpString2="BD18253_.WMF") returned -1
	[0051.405] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.405] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18254_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18254_.WMF") returned 1
	[0051.405] lstrcmpiA (lpString1="", lpString2="BD18254_.WMF") returned -1
	[0051.405] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.406] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.406] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18255_.WMF") returned 1
	[0051.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18255_.WMF") returned 1
	[0051.406] lstrcmpiA (lpString1="", lpString2="BD18255_.WMF") returned -1
	[0051.406] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.406] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.406] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18256_.WMF") returned 1
	[0051.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18256_.WMF") returned 1
	[0051.406] lstrcmpiA (lpString1="", lpString2="BD18256_.WMF") returned -1
	[0051.406] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.406] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.406] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD18257_.WMF") returned 1
	[0051.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18257_.WMF") returned 1
	[0051.406] lstrcmpiA (lpString1="", lpString2="BD18257_.WMF") returned -1
	[0051.406] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.406] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.406] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HOW TO DECRYPT FILES.txt") returned -1
	[0051.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0
	[0051.406] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0051.406] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0051.406] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0051.406] lstrcmpA (lpString1=".", lpString2="BULLETS") returned -1
	[0051.406] lstrcmpA (lpString1="..", lpString2="BULLETS") returned -1
	[0051.406] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0051.437] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0051.437] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.437] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0051.438] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0051.438] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.438] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10253_.GIF") returned 1
	[0051.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10253_.GIF") returned 1
	[0051.438] lstrcmpiA (lpString1="", lpString2="BD10253_.GIF") returned -1
	[0051.442] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0051.442] CloseHandle (hObject=0x90) returned 1
	[0051.485] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.485] CloseHandle (hObject=0x90) returned 1
	[0051.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif.boom")) returned 1
	[0051.485] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.486] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.486] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10254_.GIF") returned 1
	[0051.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10254_.GIF") returned 1
	[0051.486] lstrcmpiA (lpString1="", lpString2="BD10254_.GIF") returned -1
	[0051.489] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.489] CloseHandle (hObject=0x90) returned 1
	[0051.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif.boom")) returned 1
	[0051.490] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.490] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.490] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10255_.GIF") returned 1
	[0051.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10255_.GIF") returned 1
	[0051.490] lstrcmpiA (lpString1="", lpString2="BD10255_.GIF") returned -1
	[0051.491] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.491] CloseHandle (hObject=0x90) returned 1
	[0051.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif.boom")) returned 1
	[0051.492] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.492] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.492] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10263_.GIF") returned 1
	[0051.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10263_.GIF") returned 1
	[0051.492] lstrcmpiA (lpString1="", lpString2="BD10263_.GIF") returned -1
	[0051.493] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.493] CloseHandle (hObject=0x90) returned 1
	[0051.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif.boom")) returned 1
	[0051.494] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.494] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.494] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10264_.GIF") returned 1
	[0051.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10264_.GIF") returned 1
	[0051.494] lstrcmpiA (lpString1="", lpString2="BD10264_.GIF") returned -1
	[0051.495] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.495] CloseHandle (hObject=0x90) returned 1
	[0051.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif.boom")) returned 1
	[0051.496] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.496] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10265_.GIF") returned 1
	[0051.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10265_.GIF") returned 1
	[0051.496] lstrcmpiA (lpString1="", lpString2="BD10265_.GIF") returned -1
	[0051.497] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.497] CloseHandle (hObject=0x90) returned 1
	[0051.497] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif.boom")) returned 1
	[0051.498] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.498] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10266_.GIF") returned 1
	[0051.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10266_.GIF") returned 1
	[0051.498] lstrcmpiA (lpString1="", lpString2="BD10266_.GIF") returned -1
	[0051.499] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.499] CloseHandle (hObject=0x90) returned 1
	[0051.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif.boom")) returned 1
	[0051.499] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.499] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.499] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10267_.GIF") returned 1
	[0051.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10267_.GIF") returned 1
	[0051.499] lstrcmpiA (lpString1="", lpString2="BD10267_.GIF") returned -1
	[0051.500] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.500] CloseHandle (hObject=0x90) returned 1
	[0051.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif.boom")) returned 1
	[0051.501] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.502] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.502] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BD10268_.GIF") returned 1
	[0051.503] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.503] CloseHandle (hObject=0x90) returned 1
	[0051.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif.boom")) returned 1
	[0051.503] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.503] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.534] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.535] CloseHandle (hObject=0x90) returned 1
	[0051.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif.boom")) returned 1
	[0051.535] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.545] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.545] CloseHandle (hObject=0x90) returned 1
	[0051.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif.boom")) returned 1
	[0051.546] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.546] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.547] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.547] CloseHandle (hObject=0x90) returned 1
	[0051.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif.boom")) returned 1
	[0051.548] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.548] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.548] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.548] CloseHandle (hObject=0x90) returned 1
	[0051.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif.boom")) returned 1
	[0051.549] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.549] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.550] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.550] CloseHandle (hObject=0x90) returned 1
	[0051.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif.boom")) returned 1
	[0051.550] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.550] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.551] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.551] CloseHandle (hObject=0x90) returned 1
	[0051.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif.boom")) returned 1
	[0051.552] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.552] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.553] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.553] CloseHandle (hObject=0x90) returned 1
	[0051.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif.boom")) returned 1
	[0051.554] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.554] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.555] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.555] CloseHandle (hObject=0x90) returned 1
	[0051.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif.boom")) returned 1
	[0051.556] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.556] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.558] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.558] CloseHandle (hObject=0x90) returned 1
	[0051.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif.boom")) returned 1
	[0051.559] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.559] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.561] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.561] CloseHandle (hObject=0x90) returned 1
	[0051.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif.boom")) returned 1
	[0051.562] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.562] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.563] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.564] CloseHandle (hObject=0x90) returned 1
	[0051.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif.boom")) returned 1
	[0051.564] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.564] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.566] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.566] CloseHandle (hObject=0x90) returned 1
	[0051.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif.boom")) returned 1
	[0051.567] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.567] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.568] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.569] CloseHandle (hObject=0x90) returned 1
	[0051.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif.boom")) returned 1
	[0051.569] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.570] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.571] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.571] CloseHandle (hObject=0x90) returned 1
	[0051.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif.boom")) returned 1
	[0051.571] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.571] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.572] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.572] CloseHandle (hObject=0x90) returned 1
	[0051.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif.boom")) returned 1
	[0051.573] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.573] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.574] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.574] CloseHandle (hObject=0x90) returned 1
	[0051.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif.boom")) returned 1
	[0051.574] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.574] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.575] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.575] CloseHandle (hObject=0x90) returned 1
	[0051.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif.boom")) returned 1
	[0051.576] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.576] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.577] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.577] CloseHandle (hObject=0x90) returned 1
	[0051.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif.boom")) returned 1
	[0051.577] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.577] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.579] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.579] CloseHandle (hObject=0x90) returned 1
	[0051.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif.boom")) returned 1
	[0051.579] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.579] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.580] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.580] CloseHandle (hObject=0x90) returned 1
	[0051.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif.boom")) returned 1
	[0051.581] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.581] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.583] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.583] CloseHandle (hObject=0x90) returned 1
	[0051.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif.boom")) returned 1
	[0051.583] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.583] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.584] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.585] CloseHandle (hObject=0x90) returned 1
	[0051.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif.boom")) returned 1
	[0051.585] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.585] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.586] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.586] CloseHandle (hObject=0x90) returned 1
	[0051.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.boom")) returned 1
	[0051.587] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.587] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.588] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.588] CloseHandle (hObject=0x90) returned 1
	[0051.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.boom")) returned 1
	[0051.589] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.598] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.600] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.600] CloseHandle (hObject=0x90) returned 1
	[0051.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif.boom")) returned 1
	[0051.601] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.601] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.602] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.602] CloseHandle (hObject=0x90) returned 1
	[0051.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif.boom")) returned 1
	[0051.602] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.602] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.604] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.604] CloseHandle (hObject=0x90) returned 1
	[0051.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif.boom")) returned 1
	[0051.604] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.604] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.605] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.605] CloseHandle (hObject=0x90) returned 1
	[0051.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif.boom")) returned 1
	[0051.606] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.606] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.607] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.607] CloseHandle (hObject=0x90) returned 1
	[0051.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif.boom")) returned 1
	[0051.608] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.608] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.609] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.609] CloseHandle (hObject=0x90) returned 1
	[0051.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif.boom")) returned 1
	[0051.609] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.609] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.610] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.610] CloseHandle (hObject=0x90) returned 1
	[0051.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif.boom")) returned 1
	[0051.611] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.612] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.612] CloseHandle (hObject=0x90) returned 1
	[0051.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif.boom")) returned 1
	[0051.614] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.614] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.614] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.615] CloseHandle (hObject=0x90) returned 1
	[0051.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif.boom")) returned 1
	[0051.615] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.615] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.616] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.616] CloseHandle (hObject=0x90) returned 1
	[0051.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif.boom")) returned 1
	[0051.617] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.617] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.620] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.620] CloseHandle (hObject=0x90) returned 1
	[0051.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif.boom")) returned 1
	[0051.621] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.621] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.623] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.623] CloseHandle (hObject=0x90) returned 1
	[0051.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif.boom")) returned 1
	[0051.624] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.624] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.625] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.625] CloseHandle (hObject=0x90) returned 1
	[0051.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif.boom")) returned 1
	[0051.626] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.626] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.628] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.628] CloseHandle (hObject=0x90) returned 1
	[0051.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif.boom")) returned 1
	[0051.628] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.629] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.641] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.642] CloseHandle (hObject=0x90) returned 1
	[0051.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif.boom")) returned 1
	[0051.642] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.642] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.644] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.644] CloseHandle (hObject=0x90) returned 1
	[0051.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif.boom")) returned 1
	[0051.645] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.645] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.646] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.646] CloseHandle (hObject=0x90) returned 1
	[0051.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif.boom")) returned 1
	[0051.647] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.647] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.649] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.649] CloseHandle (hObject=0x90) returned 1
	[0051.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif.boom")) returned 1
	[0051.650] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.650] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.651] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.652] CloseHandle (hObject=0x90) returned 1
	[0051.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif.boom")) returned 1
	[0051.653] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.656] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.656] CloseHandle (hObject=0x90) returned 1
	[0051.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif.boom")) returned 1
	[0051.657] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.659] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.659] CloseHandle (hObject=0x90) returned 1
	[0051.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif.boom")) returned 1
	[0051.660] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.660] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.660] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.661] CloseHandle (hObject=0x90) returned 1
	[0051.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif.boom")) returned 1
	[0051.661] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.661] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.662] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.662] CloseHandle (hObject=0x90) returned 1
	[0051.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif.boom")) returned 1
	[0051.663] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.670] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.670] CloseHandle (hObject=0x90) returned 1
	[0051.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif.boom")) returned 1
	[0051.671] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.671] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.672] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.672] CloseHandle (hObject=0x90) returned 1
	[0051.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif.boom")) returned 1
	[0051.672] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.672] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.674] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.674] CloseHandle (hObject=0x90) returned 1
	[0051.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif.boom")) returned 1
	[0051.675] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.675] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.676] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.676] CloseHandle (hObject=0x90) returned 1
	[0051.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif.boom")) returned 1
	[0051.677] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.677] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.677] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.678] CloseHandle (hObject=0x90) returned 1
	[0051.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif.boom")) returned 1
	[0051.678] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.678] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.680] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.680] CloseHandle (hObject=0x90) returned 1
	[0051.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif.boom")) returned 1
	[0051.681] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.681] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.682] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.682] CloseHandle (hObject=0x90) returned 1
	[0051.683] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif.boom")) returned 1
	[0051.683] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.683] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.684] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.684] CloseHandle (hObject=0x90) returned 1
	[0051.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif.boom")) returned 1
	[0051.685] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.685] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.687] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.687] CloseHandle (hObject=0x90) returned 1
	[0051.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif.boom")) returned 1
	[0051.687] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.687] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.688] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.688] CloseHandle (hObject=0x90) returned 1
	[0051.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.boom")) returned 1
	[0051.689] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.689] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.690] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.690] CloseHandle (hObject=0x90) returned 1
	[0051.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.boom")) returned 1
	[0051.690] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.690] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.691] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.691] CloseHandle (hObject=0x90) returned 1
	[0051.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif.boom")) returned 1
	[0051.692] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.693] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.693] CloseHandle (hObject=0x90) returned 1
	[0051.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif.boom")) returned 1
	[0051.694] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.694] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.695] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.695] CloseHandle (hObject=0x90) returned 1
	[0051.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif.boom")) returned 1
	[0051.696] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.696] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.698] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.698] CloseHandle (hObject=0x90) returned 1
	[0051.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif.boom")) returned 1
	[0051.699] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.699] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.700] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.700] CloseHandle (hObject=0x90) returned 1
	[0051.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif.boom")) returned 1
	[0051.700] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.700] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.701] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.701] CloseHandle (hObject=0x90) returned 1
	[0051.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif.boom")) returned 1
	[0051.702] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.702] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.702] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.703] CloseHandle (hObject=0x90) returned 1
	[0051.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif.boom")) returned 1
	[0051.704] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.704] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.706] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.706] CloseHandle (hObject=0x90) returned 1
	[0051.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif.boom")) returned 1
	[0051.706] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.706] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.707] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.707] CloseHandle (hObject=0x90) returned 1
	[0051.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif.boom")) returned 1
	[0051.708] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.708] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.712] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.712] CloseHandle (hObject=0x90) returned 1
	[0051.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif.boom")) returned 1
	[0051.713] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.713] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.714] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.714] CloseHandle (hObject=0x90) returned 1
	[0051.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif.boom")) returned 1
	[0051.715] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.715] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.715] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.716] CloseHandle (hObject=0x90) returned 1
	[0051.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif.boom")) returned 1
	[0051.716] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.716] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.717] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.717] CloseHandle (hObject=0x90) returned 1
	[0051.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif.boom")) returned 1
	[0051.718] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.718] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.720] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.720] CloseHandle (hObject=0x90) returned 1
	[0051.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif.boom")) returned 1
	[0051.721] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.721] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.721] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.722] CloseHandle (hObject=0x90) returned 1
	[0051.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif.boom")) returned 1
	[0051.722] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.722] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.724] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.724] CloseHandle (hObject=0x90) returned 1
	[0051.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif.boom")) returned 1
	[0051.725] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.725] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.726] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.726] CloseHandle (hObject=0x90) returned 1
	[0051.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif.boom")) returned 1
	[0051.726] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.726] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.727] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.728] CloseHandle (hObject=0x90) returned 1
	[0051.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif.boom")) returned 1
	[0051.728] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.728] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.729] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.729] CloseHandle (hObject=0x90) returned 1
	[0051.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif.boom")) returned 1
	[0051.730] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.731] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.731] CloseHandle (hObject=0x90) returned 1
	[0051.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif.boom")) returned 1
	[0051.732] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.733] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.733] CloseHandle (hObject=0x90) returned 1
	[0051.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif.boom")) returned 1
	[0051.734] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.735] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.735] CloseHandle (hObject=0x90) returned 1
	[0051.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif.boom")) returned 1
	[0051.736] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.736] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.737] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.737] CloseHandle (hObject=0x90) returned 1
	[0051.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif.boom")) returned 1
	[0051.738] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.738] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.739] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.739] CloseHandle (hObject=0x90) returned 1
	[0051.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif.boom")) returned 1
	[0051.740] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.740] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.740] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.741] CloseHandle (hObject=0x90) returned 1
	[0051.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif.boom")) returned 1
	[0051.741] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.743] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.743] CloseHandle (hObject=0x90) returned 1
	[0051.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif.boom")) returned 1
	[0051.744] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.744] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.745] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.745] CloseHandle (hObject=0x90) returned 1
	[0051.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif.boom")) returned 1
	[0051.746] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.746] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.747] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.747] CloseHandle (hObject=0x90) returned 1
	[0051.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif.boom")) returned 1
	[0051.748] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.748] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.749] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.749] CloseHandle (hObject=0x90) returned 1
	[0051.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif.boom")) returned 1
	[0051.750] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.750] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.751] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.751] CloseHandle (hObject=0x90) returned 1
	[0051.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif.boom")) returned 1
	[0051.751] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.751] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.752] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.752] CloseHandle (hObject=0x90) returned 1
	[0051.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif.boom")) returned 1
	[0051.753] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.753] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.755] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.755] CloseHandle (hObject=0x90) returned 1
	[0051.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif.boom")) returned 1
	[0051.756] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.756] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.758] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.758] CloseHandle (hObject=0x90) returned 1
	[0051.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif.boom")) returned 1
	[0051.759] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.759] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.760] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.760] CloseHandle (hObject=0x90) returned 1
	[0051.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.boom")) returned 1
	[0051.761] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.761] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.762] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.762] CloseHandle (hObject=0x90) returned 1
	[0051.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif.boom")) returned 1
	[0051.763] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.763] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.788] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.788] CloseHandle (hObject=0x90) returned 1
	[0051.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif.boom")) returned 1
	[0051.789] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.789] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.791] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.791] CloseHandle (hObject=0x90) returned 1
	[0051.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif.boom")) returned 1
	[0051.791] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.791] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.792] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.792] CloseHandle (hObject=0x90) returned 1
	[0051.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif.boom")) returned 1
	[0051.793] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.793] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.794] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.794] CloseHandle (hObject=0x90) returned 1
	[0051.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif.boom")) returned 1
	[0051.795] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.795] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.796] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.796] CloseHandle (hObject=0x90) returned 1
	[0051.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif.boom")) returned 1
	[0051.796] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.796] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.798] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.798] CloseHandle (hObject=0x90) returned 1
	[0051.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif.boom")) returned 1
	[0051.799] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.799] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.800] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.800] CloseHandle (hObject=0x90) returned 1
	[0051.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif.boom")) returned 1
	[0051.801] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.801] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.803] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.803] CloseHandle (hObject=0x90) returned 1
	[0051.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif.boom")) returned 1
	[0051.804] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.804] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.814] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.814] CloseHandle (hObject=0x90) returned 1
	[0051.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif.boom")) returned 1
	[0051.815] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.815] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.832] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.832] CloseHandle (hObject=0x90) returned 1
	[0051.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif.boom")) returned 1
	[0051.832] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0051.832] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.833] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.833] CloseHandle (hObject=0x90) returned 1
	[0051.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif.boom")) returned 1
	[0051.834] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.835] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.836] CloseHandle (hObject=0x90) returned 1
	[0051.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif.boom")) returned 1
	[0051.837] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.838] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.838] CloseHandle (hObject=0x90) returned 1
	[0051.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif.boom")) returned 1
	[0051.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.841] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.841] CloseHandle (hObject=0x90) returned 1
	[0051.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif.boom")) returned 1
	[0051.841] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.842] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.842] CloseHandle (hObject=0x90) returned 1
	[0051.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif.boom")) returned 1
	[0051.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.866] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.867] CloseHandle (hObject=0x90) returned 1
	[0051.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif.boom")) returned 1
	[0051.867] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.868] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.868] CloseHandle (hObject=0x90) returned 1
	[0051.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif.boom")) returned 1
	[0051.869] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.879] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.879] CloseHandle (hObject=0x90) returned 1
	[0051.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif.boom")) returned 1
	[0051.880] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.881] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.881] CloseHandle (hObject=0x90) returned 1
	[0051.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif.boom")) returned 1
	[0051.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.883] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.884] CloseHandle (hObject=0x90) returned 1
	[0051.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif.boom")) returned 1
	[0051.884] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.885] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.885] CloseHandle (hObject=0x90) returned 1
	[0051.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif.boom")) returned 1
	[0051.886] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.887] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.887] CloseHandle (hObject=0x90) returned 1
	[0051.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif.boom")) returned 1
	[0051.888] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.890] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.890] CloseHandle (hObject=0x90) returned 1
	[0051.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif.boom")) returned 1
	[0051.891] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.891] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.891] CloseHandle (hObject=0x90) returned 1
	[0051.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif.boom")) returned 1
	[0051.892] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.893] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.893] CloseHandle (hObject=0x90) returned 1
	[0051.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif.boom")) returned 1
	[0051.894] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.895] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.895] CloseHandle (hObject=0x90) returned 1
	[0051.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif.boom")) returned 1
	[0051.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.897] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.897] CloseHandle (hObject=0x90) returned 1
	[0051.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif.boom")) returned 1
	[0051.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.898] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.898] CloseHandle (hObject=0x90) returned 1
	[0051.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif.boom")) returned 1
	[0051.899] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.900] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.901] CloseHandle (hObject=0x90) returned 1
	[0051.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif.boom")) returned 1
	[0051.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.902] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.902] CloseHandle (hObject=0x90) returned 1
	[0051.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif.boom")) returned 1
	[0051.903] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.904] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.904] CloseHandle (hObject=0x90) returned 1
	[0051.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif.boom")) returned 1
	[0051.905] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.906] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.906] CloseHandle (hObject=0x90) returned 1
	[0051.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif.boom")) returned 1
	[0051.907] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.908] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.908] CloseHandle (hObject=0x90) returned 1
	[0051.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif.boom")) returned 1
	[0051.909] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.910] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.910] CloseHandle (hObject=0x90) returned 1
	[0051.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif.boom")) returned 1
	[0051.911] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.913] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.913] CloseHandle (hObject=0x90) returned 1
	[0051.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif.boom")) returned 1
	[0051.914] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.915] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.915] CloseHandle (hObject=0x90) returned 1
	[0051.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif.boom")) returned 1
	[0051.916] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.917] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.917] CloseHandle (hObject=0x90) returned 1
	[0051.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif.boom")) returned 1
	[0051.918] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.920] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.920] CloseHandle (hObject=0x90) returned 1
	[0051.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif.boom")) returned 1
	[0051.920] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.921] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.922] CloseHandle (hObject=0x90) returned 1
	[0051.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif.boom")) returned 1
	[0051.922] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.923] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.923] CloseHandle (hObject=0x90) returned 1
	[0051.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif.boom")) returned 1
	[0051.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.926] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.926] CloseHandle (hObject=0x90) returned 1
	[0051.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif.boom")) returned 1
	[0051.927] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.928] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.928] CloseHandle (hObject=0x90) returned 1
	[0051.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif.boom")) returned 1
	[0051.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.930] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.930] CloseHandle (hObject=0x90) returned 1
	[0051.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif.boom")) returned 1
	[0051.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.933] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.933] CloseHandle (hObject=0x90) returned 1
	[0051.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif.boom")) returned 1
	[0051.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.935] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.935] CloseHandle (hObject=0x90) returned 1
	[0051.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif.boom")) returned 1
	[0051.935] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.937] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.937] CloseHandle (hObject=0x90) returned 1
	[0051.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif.boom")) returned 1
	[0051.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.939] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.939] CloseHandle (hObject=0x90) returned 1
	[0051.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif.boom")) returned 1
	[0051.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.941] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.941] CloseHandle (hObject=0x90) returned 1
	[0051.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif.boom")) returned 1
	[0051.942] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.943] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.943] CloseHandle (hObject=0x90) returned 1
	[0051.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif.boom")) returned 1
	[0051.944] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.945] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.945] CloseHandle (hObject=0x90) returned 1
	[0051.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif.boom")) returned 1
	[0051.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.950] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.950] CloseHandle (hObject=0x90) returned 1
	[0051.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif.boom")) returned 1
	[0051.951] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.952] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.952] CloseHandle (hObject=0x90) returned 1
	[0051.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif.boom")) returned 1
	[0051.954] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.955] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.955] CloseHandle (hObject=0x90) returned 1
	[0051.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif.boom")) returned 1
	[0051.956] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.957] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.957] CloseHandle (hObject=0x90) returned 1
	[0051.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif.boom")) returned 1
	[0051.958] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.958] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.958] CloseHandle (hObject=0x90) returned 1
	[0051.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif.boom")) returned 1
	[0051.959] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.960] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.960] CloseHandle (hObject=0x90) returned 1
	[0051.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif.boom")) returned 1
	[0051.960] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.962] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.962] CloseHandle (hObject=0x90) returned 1
	[0051.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif.boom")) returned 1
	[0051.962] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.963] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.963] CloseHandle (hObject=0x90) returned 1
	[0051.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif.boom")) returned 1
	[0051.964] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.965] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.965] CloseHandle (hObject=0x90) returned 1
	[0051.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif.boom")) returned 1
	[0051.965] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.980] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.980] CloseHandle (hObject=0x90) returned 1
	[0051.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif.boom")) returned 1
	[0051.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.982] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.982] CloseHandle (hObject=0x90) returned 1
	[0051.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif.boom")) returned 1
	[0051.983] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.984] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.984] CloseHandle (hObject=0x90) returned 1
	[0051.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif.boom")) returned 1
	[0051.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.986] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.987] CloseHandle (hObject=0x90) returned 1
	[0051.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif.boom")) returned 1
	[0051.987] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.988] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.989] CloseHandle (hObject=0x90) returned 1
	[0051.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif.boom")) returned 1
	[0051.989] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.990] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0051.990] CloseHandle (hObject=0x90) returned 1
	[0051.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif.boom")) returned 1
	[0051.991] lstrcmpA (lpString1=".", lpString2="LINES") returned -1
	[0051.991] lstrcmpA (lpString1="..", lpString2="LINES") returned -1
	[0051.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0051.993] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0051.994] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0051.994] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0051.994] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0051.996] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0051.996] CloseHandle (hObject=0x90) returned 1
	[0052.007] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.007] CloseHandle (hObject=0x90) returned 1
	[0052.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif.boom")) returned 1
	[0052.008] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0052.010] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.010] CloseHandle (hObject=0x90) returned 1
	[0052.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif.boom")) returned 1
	[0052.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0052.014] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.014] CloseHandle (hObject=0x90) returned 1
	[0052.014] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif.boom")) returned 1
	[0052.015] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0052.016] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.016] CloseHandle (hObject=0x90) returned 1
	[0052.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif.boom")) returned 1
	[0052.016] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0052.018] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.018] CloseHandle (hObject=0x90) returned 1
	[0052.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif.boom")) returned 1
	[0052.019] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.019] CloseHandle (hObject=0x90) returned 1
	[0052.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif.boom")) returned 1
	[0052.022] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.022] CloseHandle (hObject=0x90) returned 1
	[0052.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif.boom")) returned 1
	[0052.024] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.024] CloseHandle (hObject=0x90) returned 1
	[0052.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif.boom")) returned 1
	[0052.041] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.041] CloseHandle (hObject=0x90) returned 1
	[0052.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif.boom")) returned 1
	[0052.062] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.063] CloseHandle (hObject=0x90) returned 1
	[0052.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif.boom")) returned 1
	[0052.064] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.064] CloseHandle (hObject=0x90) returned 1
	[0052.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.boom")) returned 1
	[0052.066] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.066] CloseHandle (hObject=0x90) returned 1
	[0052.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.boom")) returned 1
	[0052.068] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.068] CloseHandle (hObject=0x90) returned 1
	[0052.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.boom")) returned 1
	[0052.081] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.081] CloseHandle (hObject=0x90) returned 1
	[0052.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.boom")) returned 1
	[0052.091] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.091] CloseHandle (hObject=0x90) returned 1
	[0052.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.boom")) returned 1
	[0052.093] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.093] CloseHandle (hObject=0x90) returned 1
	[0052.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.boom")) returned 1
	[0052.095] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.095] CloseHandle (hObject=0x90) returned 1
	[0052.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.boom")) returned 1
	[0052.096] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.096] CloseHandle (hObject=0x90) returned 1
	[0052.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.boom")) returned 1
	[0052.100] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.101] CloseHandle (hObject=0x90) returned 1
	[0052.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.boom")) returned 1
	[0052.102] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.102] CloseHandle (hObject=0x90) returned 1
	[0052.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.boom")) returned 1
	[0052.104] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.104] CloseHandle (hObject=0x90) returned 1
	[0052.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.boom")) returned 1
	[0052.105] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.105] CloseHandle (hObject=0x90) returned 1
	[0052.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.boom")) returned 1
	[0052.106] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.106] CloseHandle (hObject=0x90) returned 1
	[0052.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.boom")) returned 1
	[0052.109] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.109] CloseHandle (hObject=0x90) returned 1
	[0052.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.boom")) returned 1
	[0052.110] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.110] CloseHandle (hObject=0x90) returned 1
	[0052.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.boom")) returned 1
	[0052.114] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.114] CloseHandle (hObject=0x90) returned 1
	[0052.114] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.boom")) returned 1
	[0052.115] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.115] CloseHandle (hObject=0x90) returned 1
	[0052.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.boom")) returned 1
	[0052.117] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.117] CloseHandle (hObject=0x90) returned 1
	[0052.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.boom")) returned 1
	[0052.118] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.118] CloseHandle (hObject=0x90) returned 1
	[0052.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.boom")) returned 1
	[0052.120] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.120] CloseHandle (hObject=0x90) returned 1
	[0052.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.boom")) returned 1
	[0052.121] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.121] CloseHandle (hObject=0x90) returned 1
	[0052.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.boom")) returned 1
	[0052.145] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.145] CloseHandle (hObject=0x90) returned 1
	[0052.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.boom")) returned 1
	[0052.147] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.147] CloseHandle (hObject=0x90) returned 1
	[0052.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif.boom")) returned 1
	[0052.154] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.154] CloseHandle (hObject=0x90) returned 1
	[0052.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif.boom")) returned 1
	[0052.156] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.156] CloseHandle (hObject=0x90) returned 1
	[0052.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif.boom")) returned 1
	[0052.157] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.158] CloseHandle (hObject=0x90) returned 1
	[0052.158] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif.boom")) returned 1
	[0052.159] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.159] CloseHandle (hObject=0x90) returned 1
	[0052.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif.boom")) returned 1
	[0052.161] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.161] CloseHandle (hObject=0x90) returned 1
	[0052.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif.boom")) returned 1
	[0052.163] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.163] CloseHandle (hObject=0x90) returned 1
	[0052.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif.boom")) returned 1
	[0052.166] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.166] CloseHandle (hObject=0x90) returned 1
	[0052.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif.boom")) returned 1
	[0052.173] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.173] CloseHandle (hObject=0x90) returned 1
	[0052.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif.boom")) returned 1
	[0052.175] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.175] CloseHandle (hObject=0x90) returned 1
	[0052.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif.boom")) returned 1
	[0052.176] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.176] CloseHandle (hObject=0x90) returned 1
	[0052.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif.boom")) returned 1
	[0052.178] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.178] CloseHandle (hObject=0x90) returned 1
	[0052.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif.boom")) returned 1
	[0052.180] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.180] CloseHandle (hObject=0x90) returned 1
	[0052.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif.boom")) returned 1
	[0052.182] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.182] CloseHandle (hObject=0x90) returned 1
	[0052.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif.boom")) returned 1
	[0052.184] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.184] CloseHandle (hObject=0x90) returned 1
	[0052.184] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif.boom")) returned 1
	[0052.196] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.197] CloseHandle (hObject=0x90) returned 1
	[0052.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif.boom")) returned 1
	[0052.208] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.208] CloseHandle (hObject=0x90) returned 1
	[0052.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif.boom")) returned 1
	[0052.210] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.210] CloseHandle (hObject=0x90) returned 1
	[0052.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif.boom")) returned 1
	[0052.214] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.214] CloseHandle (hObject=0x90) returned 1
	[0052.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif.boom")) returned 1
	[0052.216] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.216] CloseHandle (hObject=0x90) returned 1
	[0052.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif.boom")) returned 1
	[0052.217] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.217] CloseHandle (hObject=0x90) returned 1
	[0052.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif.boom")) returned 1
	[0052.219] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.219] CloseHandle (hObject=0x90) returned 1
	[0052.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif.boom")) returned 1
	[0052.221] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.221] CloseHandle (hObject=0x90) returned 1
	[0052.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif.boom")) returned 1
	[0052.223] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.223] CloseHandle (hObject=0x90) returned 1
	[0052.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif.boom")) returned 1
	[0052.225] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.225] CloseHandle (hObject=0x90) returned 1
	[0052.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif.boom")) returned 1
	[0052.227] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.227] CloseHandle (hObject=0x90) returned 1
	[0052.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif.boom")) returned 1
	[0052.228] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.229] CloseHandle (hObject=0x90) returned 1
	[0052.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif.boom")) returned 1
	[0052.240] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.240] CloseHandle (hObject=0x90) returned 1
	[0052.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif.boom")) returned 1
	[0052.242] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.242] CloseHandle (hObject=0x90) returned 1
	[0052.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif.boom")) returned 1
	[0052.244] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.244] CloseHandle (hObject=0x90) returned 1
	[0052.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif.boom")) returned 1
	[0052.262] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.262] CloseHandle (hObject=0x90) returned 1
	[0052.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif.boom")) returned 1
	[0052.264] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.264] CloseHandle (hObject=0x90) returned 1
	[0052.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif.boom")) returned 1
	[0052.304] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.304] CloseHandle (hObject=0x90) returned 1
	[0052.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif.boom")) returned 1
	[0052.330] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.330] CloseHandle (hObject=0x90) returned 1
	[0052.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif.boom")) returned 1
	[0052.332] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.332] CloseHandle (hObject=0x90) returned 1
	[0052.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif.boom")) returned 1
	[0052.386] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.387] CloseHandle (hObject=0x90) returned 1
	[0052.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif.boom")) returned 1
	[0052.388] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.388] CloseHandle (hObject=0x90) returned 1
	[0052.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif.boom")) returned 1
	[0052.390] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.390] CloseHandle (hObject=0x90) returned 1
	[0052.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif.boom")) returned 1
	[0052.392] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.392] CloseHandle (hObject=0x90) returned 1
	[0052.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif.boom")) returned 1
	[0052.394] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.394] CloseHandle (hObject=0x90) returned 1
	[0052.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif.boom")) returned 1
	[0052.397] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.397] CloseHandle (hObject=0x8c) returned 1
	[0052.397] lstrcmpA (lpString1=".", lpString2="Office14") returned -1
	[0052.397] lstrcmpA (lpString1="..", lpString2="Office14") returned -1
	[0052.397] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0052.397] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.414] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.414] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.414] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0052.414] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0052.414] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0052.454] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.455] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.455] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.456] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.456] CloseHandle (hObject=0x8c) returned 1
	[0052.460] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.460] CloseHandle (hObject=0x8c) returned 1
	[0052.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.boom")) returned 1
	[0052.461] lstrcmpA (lpString1=".", lpString2="Bibliography") returned -1
	[0052.461] lstrcmpA (lpString1="..", lpString2="Bibliography") returned -1
	[0052.462] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0052.463] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.463] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.463] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.464] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.464] CloseHandle (hObject=0x90) returned 1
	[0052.468] lstrcmpA (lpString1=".", lpString2="DataServices") returned -1
	[0052.468] lstrcmpA (lpString1="..", lpString2="DataServices") returned -1
	[0052.468] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0052.491] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.491] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.491] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.493] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.493] CloseHandle (hObject=0x90) returned 1
	[0052.554] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.554] CloseHandle (hObject=0x8c) returned 1
	[0052.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.boom")) returned 1
	[0052.599] lstrcmpA (lpString1=".", lpString2="GrooveForms5") returned -1
	[0052.599] lstrcmpA (lpString1="..", lpString2="GrooveForms5") returned -1
	[0052.599] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0052.607] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.607] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.607] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.608] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.608] CloseHandle (hObject=0x90) returned 1
	[0052.611] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.611] CloseHandle (hObject=0x90) returned 1
	[0052.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif.boom")) returned 1
	[0052.619] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.619] CloseHandle (hObject=0x90) returned 1
	[0052.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.boom")) returned 1
	[0052.710] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.710] CloseHandle (hObject=0x90) returned 1
	[0052.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.boom")) returned 1
	[0052.713] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.713] CloseHandle (hObject=0x90) returned 1
	[0052.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.boom")) returned 1
	[0052.737] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.738] CloseHandle (hObject=0x90) returned 1
	[0052.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.boom")) returned 1
	[0052.741] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.742] CloseHandle (hObject=0x90) returned 1
	[0052.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.boom")) returned 1
	[0052.793] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.793] CloseHandle (hObject=0x90) returned 1
	[0052.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.boom")) returned 1
	[0052.815] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.815] CloseHandle (hObject=0x90) returned 1
	[0052.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.boom")) returned 1
	[0052.818] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.818] CloseHandle (hObject=0x90) returned 1
	[0052.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.boom")) returned 1
	[0052.838] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.839] CloseHandle (hObject=0x90) returned 1
	[0052.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.boom")) returned 1
	[0052.861] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.861] CloseHandle (hObject=0x90) returned 1
	[0052.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.boom")) returned 1
	[0052.864] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.864] CloseHandle (hObject=0x90) returned 1
	[0052.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.boom")) returned 1
	[0052.865] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1
	[0052.865] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1
	[0052.865] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0052.870] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.871] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.871] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.872] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.872] CloseHandle (hObject=0x94) returned 1
	[0052.872] lstrcmpA (lpString1=".", lpString2="Americana") returned -1
	[0052.872] lstrcmpA (lpString1="..", lpString2="Americana") returned -1
	[0052.873] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.873] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.874] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.874] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.875] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.875] CloseHandle (hObject=0x98) returned 1
	[0052.876] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.876] CloseHandle (hObject=0x98) returned 1
	[0052.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif.boom")) returned 1
	[0052.879] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.879] CloseHandle (hObject=0x98) returned 1
	[0052.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif.boom")) returned 1
	[0052.880] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1
	[0052.880] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1
	[0052.880] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.881] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.881] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.881] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.882] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.883] CloseHandle (hObject=0x98) returned 1
	[0052.884] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.884] CloseHandle (hObject=0x98) returned 1
	[0052.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif.boom")) returned 1
	[0052.887] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.887] CloseHandle (hObject=0x98) returned 1
	[0052.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif.boom")) returned 1
	[0052.889] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.889] CloseHandle (hObject=0x98) returned 1
	[0052.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif.boom")) returned 1
	[0052.891] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.891] CloseHandle (hObject=0x98) returned 1
	[0052.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif.boom")) returned 1
	[0052.892] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1
	[0052.892] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1
	[0052.892] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.892] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.892] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.892] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.893] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.893] CloseHandle (hObject=0x98) returned 1
	[0052.894] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.894] CloseHandle (hObject=0x98) returned 1
	[0052.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif.boom")) returned 1
	[0052.896] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.896] CloseHandle (hObject=0x98) returned 1
	[0052.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif.boom")) returned 1
	[0052.903] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1
	[0052.904] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1
	[0052.904] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.904] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.904] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.904] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.907] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.907] CloseHandle (hObject=0x98) returned 1
	[0052.908] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.908] CloseHandle (hObject=0x98) returned 1
	[0052.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.boom")) returned 1
	[0052.910] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.910] CloseHandle (hObject=0x98) returned 1
	[0052.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif.boom")) returned 1
	[0052.911] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.911] CloseHandle (hObject=0x98) returned 1
	[0052.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif.boom")) returned 1
	[0052.914] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.914] CloseHandle (hObject=0x98) returned 1
	[0052.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif.boom")) returned 1
	[0052.915] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1
	[0052.915] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1
	[0052.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.915] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.915] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.915] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.918] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.918] CloseHandle (hObject=0x98) returned 1
	[0052.919] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.919] CloseHandle (hObject=0x98) returned 1
	[0052.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif.boom")) returned 1
	[0052.921] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.921] CloseHandle (hObject=0x98) returned 1
	[0052.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif.boom")) returned 1
	[0052.924] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.924] CloseHandle (hObject=0x98) returned 1
	[0052.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif.boom")) returned 1
	[0052.925] lstrcmpA (lpString1=".", lpString2="Desert") returned -1
	[0052.925] lstrcmpA (lpString1="..", lpString2="Desert") returned -1
	[0052.925] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.925] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.925] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.925] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.927] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.927] CloseHandle (hObject=0x98) returned 1
	[0052.928] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.928] CloseHandle (hObject=0x98) returned 1
	[0052.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif.boom")) returned 1
	[0052.930] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.930] CloseHandle (hObject=0x98) returned 1
	[0052.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif.boom")) returned 1
	[0052.951] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.951] CloseHandle (hObject=0x98) returned 1
	[0052.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif.boom")) returned 1
	[0052.952] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1
	[0052.952] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1
	[0052.952] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.953] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.953] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.953] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.954] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.954] CloseHandle (hObject=0x98) returned 1
	[0052.955] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.955] CloseHandle (hObject=0x98) returned 1
	[0052.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif.boom")) returned 1
	[0052.957] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.957] CloseHandle (hObject=0x98) returned 1
	[0052.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif.boom")) returned 1
	[0052.959] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.960] CloseHandle (hObject=0x98) returned 1
	[0052.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif.boom")) returned 1
	[0052.960] lstrcmpA (lpString1=".", lpString2="Lime") returned -1
	[0052.960] lstrcmpA (lpString1="..", lpString2="Lime") returned -1
	[0052.960] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.960] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.961] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.961] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.962] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.962] CloseHandle (hObject=0x98) returned 1
	[0052.963] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.963] CloseHandle (hObject=0x98) returned 1
	[0052.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif.boom")) returned 1
	[0052.964] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.964] CloseHandle (hObject=0x98) returned 1
	[0052.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif.boom")) returned 1
	[0052.966] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1
	[0052.966] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1
	[0052.966] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0052.967] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0052.967] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0052.967] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0052.968] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0052.968] CloseHandle (hObject=0x98) returned 1
	[0052.969] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.969] CloseHandle (hObject=0x98) returned 1
	[0052.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif.boom")) returned 1
	[0052.971] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.971] CloseHandle (hObject=0x98) returned 1
	[0052.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif.boom")) returned 1
	[0052.975] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0052.975] CloseHandle (hObject=0x98) returned 1
	[0052.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif.boom")) returned 1
	[0053.002] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.002] CloseHandle (hObject=0x94) returned 1
	[0053.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif.boom")) returned 1
	[0053.005] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.005] CloseHandle (hObject=0x94) returned 1
	[0053.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.boom")) returned 1
	[0053.012] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.012] CloseHandle (hObject=0x94) returned 1
	[0053.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.boom")) returned 1
	[0053.014] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.014] CloseHandle (hObject=0x94) returned 1
	[0053.014] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.boom")) returned 1
	[0053.017] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.017] CloseHandle (hObject=0x94) returned 1
	[0053.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.boom")) returned 1
	[0053.018] lstrcmpA (lpString1=".", lpString2="Slate") returned -1
	[0053.018] lstrcmpA (lpString1="..", lpString2="Slate") returned -1
	[0053.018] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0053.019] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.019] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.019] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.020] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.020] CloseHandle (hObject=0x98) returned 1
	[0053.021] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.021] CloseHandle (hObject=0x98) returned 1
	[0053.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif.boom")) returned 1
	[0053.023] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.023] CloseHandle (hObject=0x98) returned 1
	[0053.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif.boom")) returned 1
	[0053.025] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1
	[0053.025] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1
	[0053.025] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0053.025] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.025] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.025] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.027] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.027] CloseHandle (hObject=0x98) returned 1
	[0053.041] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.041] CloseHandle (hObject=0x98) returned 1
	[0053.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.boom")) returned 1
	[0053.043] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.043] CloseHandle (hObject=0x98) returned 1
	[0053.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif.boom")) returned 1
	[0053.044] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.044] CloseHandle (hObject=0x98) returned 1
	[0053.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif.boom")) returned 1
	[0053.045] lstrcmpA (lpString1=".", lpString2="Solutions") returned -1
	[0053.045] lstrcmpA (lpString1="..", lpString2="Solutions") returned -1
	[0053.045] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0053.055] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.055] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.055] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.056] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.057] CloseHandle (hObject=0x98) returned 1
	[0053.062] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.062] CloseHandle (hObject=0x98) returned 1
	[0053.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.boom")) returned 1
	[0053.075] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.075] CloseHandle (hObject=0x98) returned 1
	[0053.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.boom")) returned 1
	[0053.078] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.078] CloseHandle (hObject=0x98) returned 1
	[0053.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.boom")) returned 1
	[0053.080] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.080] CloseHandle (hObject=0x98) returned 1
	[0053.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.boom")) returned 1
	[0053.082] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.082] CloseHandle (hObject=0x98) returned 1
	[0053.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.boom")) returned 1
	[0053.084] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.084] CloseHandle (hObject=0x98) returned 1
	[0053.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.boom")) returned 1
	[0053.092] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.092] CloseHandle (hObject=0x98) returned 1
	[0053.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.boom")) returned 1
	[0053.093] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1
	[0053.093] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1
	[0053.093] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0053.093] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.093] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.093] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.094] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.094] CloseHandle (hObject=0x98) returned 1
	[0053.096] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.096] CloseHandle (hObject=0x98) returned 1
	[0053.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif.boom")) returned 1
	[0053.099] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.099] CloseHandle (hObject=0x98) returned 1
	[0053.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif.boom")) returned 1
	[0053.100] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.100] CloseHandle (hObject=0x98) returned 1
	[0053.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif.boom")) returned 1
	[0053.101] lstrcmpA (lpString1=".", lpString2="STS2") returned -1
	[0053.101] lstrcmpA (lpString1="..", lpString2="STS2") returned -1
	[0053.101] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0053.101] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.101] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.101] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.103] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.103] CloseHandle (hObject=0x98) returned 1
	[0053.105] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.105] CloseHandle (hObject=0x98) returned 1
	[0053.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.boom")) returned 1
	[0053.127] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.127] CloseHandle (hObject=0x98) returned 1
	[0053.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif.boom")) returned 1
	[0053.129] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.129] CloseHandle (hObject=0x98) returned 1
	[0053.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif.boom")) returned 1
	[0053.131] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.131] CloseHandle (hObject=0x98) returned 1
	[0053.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif.boom")) returned 1
	[0053.131] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1
	[0053.131] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1
	[0053.131] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0053.132] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.132] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.132] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.134] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.134] CloseHandle (hObject=0x98) returned 1
	[0053.136] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.136] CloseHandle (hObject=0x98) returned 1
	[0053.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif.boom")) returned 1
	[0053.149] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.149] CloseHandle (hObject=0x98) returned 1
	[0053.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif.boom")) returned 1
	[0053.151] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.151] CloseHandle (hObject=0x98) returned 1
	[0053.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif.boom")) returned 1
	[0053.153] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.153] CloseHandle (hObject=0x98) returned 1
	[0053.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif.boom")) returned 1
	[0053.191] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.191] CloseHandle (hObject=0x8c) returned 1
	[0053.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.boom")) returned 1
	[0053.206] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.206] CloseHandle (hObject=0x8c) returned 1
	[0053.206] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.boom")) returned 1
	[0053.215] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.216] CloseHandle (hObject=0x8c) returned 1
	[0053.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.boom")) returned 1
	[0053.220] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.220] CloseHandle (hObject=0x8c) returned 1
	[0053.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.boom")) returned 1
	[0053.225] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.225] CloseHandle (hObject=0x8c) returned 1
	[0053.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.boom")) returned 1
	[0053.234] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.235] CloseHandle (hObject=0x8c) returned 1
	[0053.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.boom")) returned 1
	[0053.238] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.238] CloseHandle (hObject=0x8c) returned 1
	[0053.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.boom")) returned 1
	[0053.239] lstrcmpA (lpString1=".", lpString2="PUBFTSCM") returned -1
	[0053.239] lstrcmpA (lpString1="..", lpString2="PUBFTSCM") returned -1
	[0053.239] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0053.249] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.250] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.250] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.251] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.251] CloseHandle (hObject=0x90) returned 1
	[0053.253] lstrcmpA (lpString1=".", lpString2="PUBSPAPR") returned -1
	[0053.253] lstrcmpA (lpString1="..", lpString2="PUBSPAPR") returned -1
	[0053.253] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0053.303] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0053.304] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0053.304] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0053.305] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0053.305] CloseHandle (hObject=0x90) returned 1
	[0053.318] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.318] CloseHandle (hObject=0x90) returned 1
	[0053.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif.boom")) returned 1
	[0053.325] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.325] CloseHandle (hObject=0x90) returned 1
	[0053.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif.boom")) returned 1
	[0053.338] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.338] CloseHandle (hObject=0x90) returned 1
	[0053.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif.boom")) returned 1
	[0053.352] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.352] CloseHandle (hObject=0x90) returned 1
	[0053.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif.boom")) returned 1
	[0053.372] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.372] CloseHandle (hObject=0x90) returned 1
	[0053.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif.boom")) returned 1
	[0053.441] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.441] CloseHandle (hObject=0x90) returned 1
	[0053.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif.boom")) returned 1
	[0053.450] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.450] CloseHandle (hObject=0x90) returned 1
	[0053.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif.boom")) returned 1
	[0053.476] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.476] CloseHandle (hObject=0x90) returned 1
	[0053.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif.boom")) returned 1
	[0053.491] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.491] CloseHandle (hObject=0x90) returned 1
	[0053.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif.boom")) returned 1
	[0053.518] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.518] CloseHandle (hObject=0x90) returned 1
	[0053.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif.boom")) returned 1
	[0053.535] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.535] CloseHandle (hObject=0x90) returned 1
	[0053.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif.boom")) returned 1
	[0053.569] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.569] CloseHandle (hObject=0x90) returned 1
	[0053.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif.boom")) returned 1
	[0053.606] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.606] CloseHandle (hObject=0x90) returned 1
	[0053.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif.boom")) returned 1
	[0053.617] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.617] CloseHandle (hObject=0x90) returned 1
	[0053.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif.boom")) returned 1
	[0053.630] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.630] CloseHandle (hObject=0x90) returned 1
	[0053.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif.boom")) returned 1
	[0053.652] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.652] CloseHandle (hObject=0x90) returned 1
	[0053.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif.boom")) returned 1
	[0053.677] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.677] CloseHandle (hObject=0x90) returned 1
	[0053.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif.boom")) returned 1
	[0053.685] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.685] CloseHandle (hObject=0x90) returned 1
	[0053.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif.boom")) returned 1
	[0053.704] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.704] CloseHandle (hObject=0x90) returned 1
	[0053.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif.boom")) returned 1
	[0053.719] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.719] CloseHandle (hObject=0x90) returned 1
	[0053.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif.boom")) returned 1
	[0053.766] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.766] CloseHandle (hObject=0x90) returned 1
	[0053.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif.boom")) returned 1
	[0053.792] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.793] CloseHandle (hObject=0x90) returned 1
	[0053.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif.boom")) returned 1
	[0053.801] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.801] CloseHandle (hObject=0x90) returned 1
	[0053.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif.boom")) returned 1
	[0053.804] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.804] CloseHandle (hObject=0x90) returned 1
	[0053.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif.boom")) returned 1
	[0053.829] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.829] CloseHandle (hObject=0x90) returned 1
	[0053.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif.boom")) returned 1
	[0053.841] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.841] CloseHandle (hObject=0x90) returned 1
	[0053.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif.boom")) returned 1
	[0053.863] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.863] CloseHandle (hObject=0x90) returned 1
	[0053.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif.boom")) returned 1
	[0053.879] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.879] CloseHandle (hObject=0x90) returned 1
	[0053.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif.boom")) returned 1
	[0053.889] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.889] CloseHandle (hObject=0x90) returned 1
	[0053.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif.boom")) returned 1
	[0053.915] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.916] CloseHandle (hObject=0x90) returned 1
	[0053.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif.boom")) returned 1
	[0053.918] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.918] CloseHandle (hObject=0x90) returned 1
	[0053.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif.boom")) returned 1
	[0053.929] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.929] CloseHandle (hObject=0x90) returned 1
	[0053.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif.boom")) returned 1
	[0053.939] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.940] CloseHandle (hObject=0x90) returned 1
	[0053.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif.boom")) returned 1
	[0053.962] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.962] CloseHandle (hObject=0x90) returned 1
	[0053.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif.boom")) returned 1
	[0053.978] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.978] CloseHandle (hObject=0x90) returned 1
	[0053.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif.boom")) returned 1
	[0053.981] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.982] CloseHandle (hObject=0x90) returned 1
	[0053.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif.boom")) returned 1
	[0053.990] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.990] CloseHandle (hObject=0x90) returned 1
	[0053.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif.boom")) returned 1
	[0053.995] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0053.995] CloseHandle (hObject=0x90) returned 1
	[0053.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif.boom")) returned 1
	[0054.007] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.007] CloseHandle (hObject=0x90) returned 1
	[0054.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif.boom")) returned 1
	[0054.015] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.015] CloseHandle (hObject=0x90) returned 1
	[0054.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif.boom")) returned 1
	[0054.030] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.030] CloseHandle (hObject=0x90) returned 1
	[0054.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif.boom")) returned 1
	[0054.036] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.036] CloseHandle (hObject=0x90) returned 1
	[0054.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif.boom")) returned 1
	[0054.046] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.047] CloseHandle (hObject=0x90) returned 1
	[0054.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif.boom")) returned 1
	[0054.053] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.053] CloseHandle (hObject=0x90) returned 1
	[0054.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif.boom")) returned 1
	[0054.065] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.065] CloseHandle (hObject=0x90) returned 1
	[0054.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif.boom")) returned 1
	[0054.077] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.078] CloseHandle (hObject=0x90) returned 1
	[0054.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif.boom")) returned 1
	[0054.097] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.097] CloseHandle (hObject=0x90) returned 1
	[0054.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif.boom")) returned 1
	[0054.105] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.105] CloseHandle (hObject=0x90) returned 1
	[0054.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif.boom")) returned 1
	[0054.111] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.111] CloseHandle (hObject=0x90) returned 1
	[0054.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif.boom")) returned 1
	[0054.113] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.113] CloseHandle (hObject=0x90) returned 1
	[0054.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif.boom")) returned 1
	[0054.125] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.125] CloseHandle (hObject=0x90) returned 1
	[0054.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif.boom")) returned 1
	[0054.171] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.172] CloseHandle (hObject=0x90) returned 1
	[0054.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif.boom")) returned 1
	[0054.214] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.214] CloseHandle (hObject=0x90) returned 1
	[0054.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif.boom")) returned 1
	[0054.217] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.217] CloseHandle (hObject=0x90) returned 1
	[0054.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif.boom")) returned 1
	[0054.220] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.220] CloseHandle (hObject=0x90) returned 1
	[0054.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif.boom")) returned 1
	[0054.227] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.227] CloseHandle (hObject=0x90) returned 1
	[0054.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif.boom")) returned 1
	[0054.259] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.259] CloseHandle (hObject=0x90) returned 1
	[0054.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif.boom")) returned 1
	[0054.262] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.262] CloseHandle (hObject=0x90) returned 1
	[0054.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif.boom")) returned 1
	[0054.293] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.293] CloseHandle (hObject=0x90) returned 1
	[0054.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif.boom")) returned 1
	[0054.296] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.296] CloseHandle (hObject=0x90) returned 1
	[0054.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif.boom")) returned 1
	[0054.307] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.307] CloseHandle (hObject=0x90) returned 1
	[0054.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif.boom")) returned 1
	[0054.315] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.315] CloseHandle (hObject=0x90) returned 1
	[0054.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif.boom")) returned 1
	[0054.318] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.318] CloseHandle (hObject=0x90) returned 1
	[0054.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif.boom")) returned 1
	[0054.345] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.345] CloseHandle (hObject=0x90) returned 1
	[0054.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif.boom")) returned 1
	[0054.347] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.347] CloseHandle (hObject=0x90) returned 1
	[0054.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif.boom")) returned 1
	[0054.349] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.349] CloseHandle (hObject=0x90) returned 1
	[0054.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif.boom")) returned 1
	[0054.401] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.401] CloseHandle (hObject=0x90) returned 1
	[0054.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif.boom")) returned 1
	[0054.403] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.403] CloseHandle (hObject=0x90) returned 1
	[0054.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif.boom")) returned 1
	[0054.416] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.416] CloseHandle (hObject=0x90) returned 1
	[0054.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif.boom")) returned 1
	[0054.428] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.428] CloseHandle (hObject=0x90) returned 1
	[0054.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif.boom")) returned 1
	[0054.431] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.431] CloseHandle (hObject=0x90) returned 1
	[0054.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif.boom")) returned 1
	[0054.449] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.449] CloseHandle (hObject=0x90) returned 1
	[0054.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif.boom")) returned 1
	[0054.453] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.453] CloseHandle (hObject=0x90) returned 1
	[0054.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif.boom")) returned 1
	[0054.455] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.455] CloseHandle (hObject=0x90) returned 1
	[0054.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif.boom")) returned 1
	[0054.457] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.458] CloseHandle (hObject=0x90) returned 1
	[0054.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif.boom")) returned 1
	[0054.472] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.472] CloseHandle (hObject=0x90) returned 1
	[0054.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif.boom")) returned 1
	[0054.482] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.482] CloseHandle (hObject=0x90) returned 1
	[0054.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif.boom")) returned 1
	[0054.487] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.487] CloseHandle (hObject=0x90) returned 1
	[0054.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif.boom")) returned 1
	[0054.490] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.490] CloseHandle (hObject=0x90) returned 1
	[0054.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif.boom")) returned 1
	[0054.492] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.492] CloseHandle (hObject=0x90) returned 1
	[0054.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif.boom")) returned 1
	[0054.499] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.499] CloseHandle (hObject=0x90) returned 1
	[0054.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif.boom")) returned 1
	[0054.509] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.509] CloseHandle (hObject=0x90) returned 1
	[0054.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif.boom")) returned 1
	[0054.512] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.512] CloseHandle (hObject=0x90) returned 1
	[0054.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif.boom")) returned 1
	[0054.522] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.522] CloseHandle (hObject=0x90) returned 1
	[0054.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif.boom")) returned 1
	[0054.539] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.540] CloseHandle (hObject=0x90) returned 1
	[0054.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif.boom")) returned 1
	[0054.564] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.564] CloseHandle (hObject=0x90) returned 1
	[0054.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif.boom")) returned 1
	[0054.566] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.566] CloseHandle (hObject=0x90) returned 1
	[0054.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif.boom")) returned 1
	[0054.584] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.584] CloseHandle (hObject=0x90) returned 1
	[0054.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif.boom")) returned 1
	[0054.587] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.587] CloseHandle (hObject=0x90) returned 1
	[0054.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif.boom")) returned 1
	[0054.594] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.594] CloseHandle (hObject=0x90) returned 1
	[0054.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif.boom")) returned 1
	[0054.617] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.617] CloseHandle (hObject=0x90) returned 1
	[0054.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif.boom")) returned 1
	[0054.632] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.632] CloseHandle (hObject=0x90) returned 1
	[0054.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif.boom")) returned 1
	[0054.643] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.644] CloseHandle (hObject=0x90) returned 1
	[0054.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif.boom")) returned 1
	[0054.700] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.700] CloseHandle (hObject=0x90) returned 1
	[0054.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif.boom")) returned 1
	[0054.763] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.763] CloseHandle (hObject=0x90) returned 1
	[0054.763] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif.boom")) returned 1
	[0054.785] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.785] CloseHandle (hObject=0x90) returned 1
	[0054.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif.boom")) returned 1
	[0054.850] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.850] CloseHandle (hObject=0x90) returned 1
	[0054.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif.boom")) returned 1
	[0054.863] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.863] CloseHandle (hObject=0x90) returned 1
	[0054.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif.boom")) returned 1
	[0054.979] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.979] CloseHandle (hObject=0x90) returned 1
	[0054.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif.boom")) returned 1
	[0054.981] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.982] CloseHandle (hObject=0x90) returned 1
	[0054.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif.boom")) returned 1
	[0054.994] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0054.994] CloseHandle (hObject=0x90) returned 1
	[0054.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif.boom")) returned 1
	[0055.007] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.007] CloseHandle (hObject=0x90) returned 1
	[0055.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif.boom")) returned 1
	[0055.010] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.010] CloseHandle (hObject=0x90) returned 1
	[0055.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif.boom")) returned 1
	[0055.013] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.013] CloseHandle (hObject=0x90) returned 1
	[0055.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif.boom")) returned 1
	[0055.024] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.025] CloseHandle (hObject=0x90) returned 1
	[0055.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif.boom")) returned 1
	[0055.033] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.033] CloseHandle (hObject=0x90) returned 1
	[0055.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif.boom")) returned 1
	[0055.047] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.047] CloseHandle (hObject=0x90) returned 1
	[0055.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif.boom")) returned 1
	[0055.059] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.059] CloseHandle (hObject=0x90) returned 1
	[0055.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif.boom")) returned 1
	[0055.077] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.077] CloseHandle (hObject=0x90) returned 1
	[0055.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif.boom")) returned 1
	[0055.103] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.103] CloseHandle (hObject=0x90) returned 1
	[0055.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif.boom")) returned 1
	[0055.127] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.127] CloseHandle (hObject=0x90) returned 1
	[0055.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif.boom")) returned 1
	[0055.145] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.146] CloseHandle (hObject=0x90) returned 1
	[0055.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif.boom")) returned 1
	[0055.148] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.149] CloseHandle (hObject=0x90) returned 1
	[0055.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif.boom")) returned 1
	[0055.161] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.161] CloseHandle (hObject=0x90) returned 1
	[0055.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif.boom")) returned 1
	[0055.178] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.178] CloseHandle (hObject=0x90) returned 1
	[0055.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif.boom")) returned 1
	[0055.192] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.192] CloseHandle (hObject=0x90) returned 1
	[0055.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif.boom")) returned 1
	[0055.212] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.212] CloseHandle (hObject=0x90) returned 1
	[0055.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif.boom")) returned 1
	[0055.261] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.261] CloseHandle (hObject=0x90) returned 1
	[0055.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif.boom")) returned 1
	[0055.279] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.280] CloseHandle (hObject=0x90) returned 1
	[0055.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif.boom")) returned 1
	[0055.283] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.284] CloseHandle (hObject=0x90) returned 1
	[0055.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif.boom")) returned 1
	[0055.310] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.310] CloseHandle (hObject=0x90) returned 1
	[0055.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif.boom")) returned 1
	[0055.346] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.347] CloseHandle (hObject=0x90) returned 1
	[0055.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif.boom")) returned 1
	[0055.412] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.412] CloseHandle (hObject=0x90) returned 1
	[0055.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif.boom")) returned 1
	[0055.415] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.415] CloseHandle (hObject=0x90) returned 1
	[0055.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif.boom")) returned 1
	[0055.422] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.422] CloseHandle (hObject=0x90) returned 1
	[0055.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif.boom")) returned 1
	[0055.440] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.440] CloseHandle (hObject=0x90) returned 1
	[0055.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif.boom")) returned 1
	[0055.497] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.497] CloseHandle (hObject=0x90) returned 1
	[0055.497] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif.boom")) returned 1
	[0055.534] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.534] CloseHandle (hObject=0x90) returned 1
	[0055.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif.boom")) returned 1
	[0055.542] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.542] CloseHandle (hObject=0x90) returned 1
	[0055.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif.boom")) returned 1
	[0055.549] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.549] CloseHandle (hObject=0x90) returned 1
	[0055.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif.boom")) returned 1
	[0055.560] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.560] CloseHandle (hObject=0x90) returned 1
	[0055.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif.boom")) returned 1
	[0055.563] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.563] CloseHandle (hObject=0x90) returned 1
	[0055.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif.boom")) returned 1
	[0055.578] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.578] CloseHandle (hObject=0x90) returned 1
	[0055.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif.boom")) returned 1
	[0055.595] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.595] CloseHandle (hObject=0x90) returned 1
	[0055.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif.boom")) returned 1
	[0055.608] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.608] CloseHandle (hObject=0x90) returned 1
	[0055.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif.boom")) returned 1
	[0055.611] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.611] CloseHandle (hObject=0x90) returned 1
	[0055.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif.boom")) returned 1
	[0055.626] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.626] CloseHandle (hObject=0x90) returned 1
	[0055.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif.boom")) returned 1
	[0055.630] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.630] CloseHandle (hObject=0x90) returned 1
	[0055.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif.boom")) returned 1
	[0055.679] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.679] CloseHandle (hObject=0x90) returned 1
	[0055.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif.boom")) returned 1
	[0055.685] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.685] CloseHandle (hObject=0x90) returned 1
	[0055.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif.boom")) returned 1
	[0055.700] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.700] CloseHandle (hObject=0x90) returned 1
	[0055.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif.boom")) returned 1
	[0055.714] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.714] CloseHandle (hObject=0x90) returned 1
	[0055.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif.boom")) returned 1
	[0055.725] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.726] CloseHandle (hObject=0x90) returned 1
	[0055.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif.boom")) returned 1
	[0055.729] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.729] CloseHandle (hObject=0x90) returned 1
	[0055.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif.boom")) returned 1
	[0055.774] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.774] CloseHandle (hObject=0x90) returned 1
	[0055.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif.boom")) returned 1
	[0055.802] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.802] CloseHandle (hObject=0x90) returned 1
	[0055.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif.boom")) returned 1
	[0055.805] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.805] CloseHandle (hObject=0x90) returned 1
	[0055.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif.boom")) returned 1
	[0055.892] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0055.892] CloseHandle (hObject=0x90) returned 1
	[0055.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif.boom")) returned 1
	[0055.893] lstrcmpA (lpString1=".", lpString2="QuickStyles") returned -1
	[0055.893] lstrcmpA (lpString1="..", lpString2="QuickStyles") returned -1
	[0055.893] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0056.028] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.028] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.028] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.029] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.029] CloseHandle (hObject=0x90) returned 1
	[0056.043] lstrcmpA (lpString1=".", lpString2="Vsdir") returned -1
	[0056.043] lstrcmpA (lpString1="..", lpString2="Vsdir") returned -1
	[0056.043] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0056.044] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.044] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.044] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.045] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.046] CloseHandle (hObject=0x90) returned 1
	[0056.052] lstrcmpA (lpString1=".", lpString2="1036") returned -1
	[0056.052] lstrcmpA (lpString1="..", lpString2="1036") returned -1
	[0056.052] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.054] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.055] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.055] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.055] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0056.055] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0056.056] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.057] CloseHandle (hObject=0x8c) returned 1
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.zip") returned 0
	[0056.057] lstrlenA (lpString="*.zip") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.rar") returned 0
	[0056.057] lstrlenA (lpString="*.rar") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.7z") returned 0
	[0056.057] lstrlenA (lpString="*.7z") returned 4
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.tar") returned 0
	[0056.057] lstrlenA (lpString="*.tar") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.gzip") returned 0
	[0056.057] lstrlenA (lpString="*.gzip") returned 6
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.jpg") returned 0
	[0056.057] lstrlenA (lpString="*.jpg") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.jpeg") returned 0
	[0056.057] lstrlenA (lpString="*.jpeg") returned 6
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.psd") returned 0
	[0056.057] lstrlenA (lpString="*.psd") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.cdr") returned 0
	[0056.057] lstrlenA (lpString="*.cdr") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.dwg") returned 0
	[0056.057] lstrlenA (lpString="*.dwg") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.max") returned 0
	[0056.057] lstrlenA (lpString="*.max") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.bmp") returned 0
	[0056.057] lstrlenA (lpString="*.bmp") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.gif") returned 0
	[0056.057] lstrlenA (lpString="*.gif") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.png") returned 0
	[0056.057] lstrlenA (lpString="*.png") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.doc") returned 0
	[0056.057] lstrlenA (lpString="*.doc") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.docx") returned 0
	[0056.057] lstrlenA (lpString="*.docx") returned 6
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.xls") returned 0
	[0056.057] lstrlenA (lpString="*.xls") returned 5
	[0056.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.xlsx") returned 0
	[0056.058] lstrlenA (lpString="*.xlsx") returned 6
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.ppt") returned 0
	[0056.058] lstrlenA (lpString="*.ppt") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.pptx") returned 0
	[0056.058] lstrlenA (lpString="*.pptx") returned 6
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.txt") returned 0
	[0056.058] lstrlenA (lpString="*.txt") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.pdf") returned 0
	[0056.058] lstrlenA (lpString="*.pdf") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.djvu") returned 0
	[0056.058] lstrlenA (lpString="*.djvu") returned 6
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.htm") returned 0
	[0056.058] lstrlenA (lpString="*.htm") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.html") returned 0
	[0056.058] lstrlenA (lpString="*.html") returned 6
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mdb") returned 0
	[0056.058] lstrlenA (lpString="*.mdb") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.cer") returned 0
	[0056.058] lstrlenA (lpString="*.cer") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.p12") returned 0
	[0056.058] lstrlenA (lpString="*.p12") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.pfx") returned 0
	[0056.058] lstrlenA (lpString="*.pfx") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.kwm") returned 0
	[0056.058] lstrlenA (lpString="*.kwm") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.pwm") returned 0
	[0056.058] lstrlenA (lpString="*.pwm") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.1cd") returned 0
	[0056.058] lstrlenA (lpString="*.1cd") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.md") returned 0
	[0056.058] lstrlenA (lpString="*.md") returned 4
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mdf") returned 0
	[0056.058] lstrlenA (lpString="*.mdf") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.dbf") returned 0
	[0056.058] lstrlenA (lpString="*.dbf") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.odt") returned 0
	[0056.058] lstrlenA (lpString="*.odt") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.vob") returned 0
	[0056.058] lstrlenA (lpString="*.vob") returned 5
	[0056.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.ifo") returned 0
	[0056.058] lstrlenA (lpString="*.ifo") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.lnk") returned 0
	[0056.059] lstrlenA (lpString="*.lnk") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.torrent") returned 0
	[0056.059] lstrlenA (lpString="*.torrent") returned 9
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mov") returned 0
	[0056.059] lstrlenA (lpString="*.mov") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.m2v") returned 0
	[0056.059] lstrlenA (lpString="*.m2v") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.3gp") returned 0
	[0056.059] lstrlenA (lpString="*.3gp") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mpeg") returned 0
	[0056.059] lstrlenA (lpString="*.mpeg") returned 6
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mpg") returned 0
	[0056.059] lstrlenA (lpString="*.mpg") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.flv") returned 0
	[0056.059] lstrlenA (lpString="*.flv") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.avi") returned 0
	[0056.059] lstrlenA (lpString="*.avi") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mp4") returned 0
	[0056.059] lstrlenA (lpString="*.mp4") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.wmv") returned 0
	[0056.059] lstrlenA (lpString="*.wmv") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.divx") returned 0
	[0056.059] lstrlenA (lpString="*.divx") returned 6
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mkv") returned 0
	[0056.059] lstrlenA (lpString="*.mkv") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mp3") returned 0
	[0056.059] lstrlenA (lpString="*.mp3") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.wav") returned 0
	[0056.059] lstrlenA (lpString="*.wav") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.flac") returned 0
	[0056.059] lstrlenA (lpString="*.flac") returned 6
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.ape") returned 0
	[0056.059] lstrlenA (lpString="*.ape") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.wma") returned 0
	[0056.059] lstrlenA (lpString="*.wma") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.ac3") returned 0
	[0056.059] lstrlenA (lpString="*.ac3") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.exe") returned 0
	[0056.059] lstrlenA (lpString="*.exe") returned 5
	[0056.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.apk") returned 0
	[0056.060] lstrlenA (lpString="*.apk") returned 5
	[0056.060] lstrcmpA (lpString1=".", lpString2="3082") returned -1
	[0056.060] lstrcmpA (lpString1="..", lpString2="3082") returned -1
	[0056.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.060] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.061] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.061] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.061] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*.*") returned="*.*"
	[0056.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\"
	[0056.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned=""
	[0056.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW TO DECRYPT FILES.txt"
	[0056.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\how to decrypt files.txt")) returned 0xffffffff
	[0056.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.063] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0056.063] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0056.064] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.064] CloseHandle (hObject=0x8c) returned 1
	[0056.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\3082\\", lpString2="MSO.ACL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL"
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.zip") returned 0
	[0056.064] lstrlenA (lpString="*.zip") returned 5
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.rar") returned 0
	[0056.064] lstrlenA (lpString="*.rar") returned 5
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.7z") returned 0
	[0056.064] lstrlenA (lpString="*.7z") returned 4
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.tar") returned 0
	[0056.064] lstrlenA (lpString="*.tar") returned 5
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.gzip") returned 0
	[0056.064] lstrlenA (lpString="*.gzip") returned 6
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.jpg") returned 0
	[0056.064] lstrlenA (lpString="*.jpg") returned 5
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.jpeg") returned 0
	[0056.064] lstrlenA (lpString="*.jpeg") returned 6
	[0056.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.psd") returned 0
	[0056.064] lstrlenA (lpString="*.psd") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.cdr") returned 0
	[0056.065] lstrlenA (lpString="*.cdr") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.dwg") returned 0
	[0056.065] lstrlenA (lpString="*.dwg") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.max") returned 0
	[0056.065] lstrlenA (lpString="*.max") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.bmp") returned 0
	[0056.065] lstrlenA (lpString="*.bmp") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.gif") returned 0
	[0056.065] lstrlenA (lpString="*.gif") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.png") returned 0
	[0056.065] lstrlenA (lpString="*.png") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.doc") returned 0
	[0056.065] lstrlenA (lpString="*.doc") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.docx") returned 0
	[0056.065] lstrlenA (lpString="*.docx") returned 6
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.xls") returned 0
	[0056.065] lstrlenA (lpString="*.xls") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.xlsx") returned 0
	[0056.065] lstrlenA (lpString="*.xlsx") returned 6
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.ppt") returned 0
	[0056.065] lstrlenA (lpString="*.ppt") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.pptx") returned 0
	[0056.065] lstrlenA (lpString="*.pptx") returned 6
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.txt") returned 0
	[0056.065] lstrlenA (lpString="*.txt") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.pdf") returned 0
	[0056.065] lstrlenA (lpString="*.pdf") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.djvu") returned 0
	[0056.065] lstrlenA (lpString="*.djvu") returned 6
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.htm") returned 0
	[0056.065] lstrlenA (lpString="*.htm") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.html") returned 0
	[0056.065] lstrlenA (lpString="*.html") returned 6
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mdb") returned 0
	[0056.065] lstrlenA (lpString="*.mdb") returned 5
	[0056.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.cer") returned 0
	[0056.065] lstrlenA (lpString="*.cer") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.p12") returned 0
	[0056.066] lstrlenA (lpString="*.p12") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.pfx") returned 0
	[0056.066] lstrlenA (lpString="*.pfx") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.kwm") returned 0
	[0056.066] lstrlenA (lpString="*.kwm") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.pwm") returned 0
	[0056.066] lstrlenA (lpString="*.pwm") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.1cd") returned 0
	[0056.066] lstrlenA (lpString="*.1cd") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.md") returned 0
	[0056.066] lstrlenA (lpString="*.md") returned 4
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mdf") returned 0
	[0056.066] lstrlenA (lpString="*.mdf") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.dbf") returned 0
	[0056.066] lstrlenA (lpString="*.dbf") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.odt") returned 0
	[0056.066] lstrlenA (lpString="*.odt") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.vob") returned 0
	[0056.066] lstrlenA (lpString="*.vob") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.ifo") returned 0
	[0056.066] lstrlenA (lpString="*.ifo") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.lnk") returned 0
	[0056.066] lstrlenA (lpString="*.lnk") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.torrent") returned 0
	[0056.066] lstrlenA (lpString="*.torrent") returned 9
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mov") returned 0
	[0056.066] lstrlenA (lpString="*.mov") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.m2v") returned 0
	[0056.066] lstrlenA (lpString="*.m2v") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.3gp") returned 0
	[0056.066] lstrlenA (lpString="*.3gp") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mpeg") returned 0
	[0056.066] lstrlenA (lpString="*.mpeg") returned 6
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mpg") returned 0
	[0056.066] lstrlenA (lpString="*.mpg") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.flv") returned 0
	[0056.066] lstrlenA (lpString="*.flv") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.avi") returned 0
	[0056.066] lstrlenA (lpString="*.avi") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mp4") returned 0
	[0056.066] lstrlenA (lpString="*.mp4") returned 5
	[0056.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.wmv") returned 0
	[0056.066] lstrlenA (lpString="*.wmv") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.divx") returned 0
	[0056.067] lstrlenA (lpString="*.divx") returned 6
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mkv") returned 0
	[0056.067] lstrlenA (lpString="*.mkv") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mp3") returned 0
	[0056.067] lstrlenA (lpString="*.mp3") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.wav") returned 0
	[0056.067] lstrlenA (lpString="*.wav") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.flac") returned 0
	[0056.067] lstrlenA (lpString="*.flac") returned 6
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.ape") returned 0
	[0056.067] lstrlenA (lpString="*.ape") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.wma") returned 0
	[0056.067] lstrlenA (lpString="*.wma") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.ac3") returned 0
	[0056.067] lstrlenA (lpString="*.ac3") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.exe") returned 0
	[0056.067] lstrlenA (lpString="*.exe") returned 5
	[0056.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.apk") returned 0
	[0056.067] lstrlenA (lpString="*.apk") returned 5
	[0056.067] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.067] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.067] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.067] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.067] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCDDS.DLL") returned 1
	[0056.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCDDS.DLL") returned 1
	[0056.067] lstrcmpiA (lpString1="", lpString2="ACCDDS.DLL") returned -1
	[0056.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0xffffffff
	[0056.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0056.068] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0056.068] WriteFile (in: hFile=0x88, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0056.070] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.070] CloseHandle (hObject=0x88) returned 1
	[0056.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACCDDS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL"
	[0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.zip") returned 0
	[0056.070] lstrlenA (lpString="*.zip") returned 5
	[0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.rar") returned 0
	[0056.070] lstrlenA (lpString="*.rar") returned 5
	[0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.7z") returned 0
	[0056.070] lstrlenA (lpString="*.7z") returned 4
	[0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.tar") returned 0
	[0056.070] lstrlenA (lpString="*.tar") returned 5
	[0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.gzip") returned 0
	[0056.071] lstrlenA (lpString="*.gzip") returned 6
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.jpg") returned 0
	[0056.071] lstrlenA (lpString="*.jpg") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.jpeg") returned 0
	[0056.071] lstrlenA (lpString="*.jpeg") returned 6
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.psd") returned 0
	[0056.071] lstrlenA (lpString="*.psd") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.cdr") returned 0
	[0056.071] lstrlenA (lpString="*.cdr") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.dwg") returned 0
	[0056.071] lstrlenA (lpString="*.dwg") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.max") returned 0
	[0056.071] lstrlenA (lpString="*.max") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.bmp") returned 0
	[0056.071] lstrlenA (lpString="*.bmp") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.gif") returned 0
	[0056.071] lstrlenA (lpString="*.gif") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.png") returned 0
	[0056.071] lstrlenA (lpString="*.png") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.doc") returned 0
	[0056.071] lstrlenA (lpString="*.doc") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.docx") returned 0
	[0056.071] lstrlenA (lpString="*.docx") returned 6
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.xls") returned 0
	[0056.071] lstrlenA (lpString="*.xls") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.xlsx") returned 0
	[0056.071] lstrlenA (lpString="*.xlsx") returned 6
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.ppt") returned 0
	[0056.071] lstrlenA (lpString="*.ppt") returned 5
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.pptx") returned 0
	[0056.071] lstrlenA (lpString="*.pptx") returned 6
	[0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.txt") returned 0
	[0056.071] lstrlenA (lpString="*.txt") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.pdf") returned 0
	[0056.072] lstrlenA (lpString="*.pdf") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.djvu") returned 0
	[0056.072] lstrlenA (lpString="*.djvu") returned 6
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.htm") returned 0
	[0056.072] lstrlenA (lpString="*.htm") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.html") returned 0
	[0056.072] lstrlenA (lpString="*.html") returned 6
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mdb") returned 0
	[0056.072] lstrlenA (lpString="*.mdb") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.cer") returned 0
	[0056.072] lstrlenA (lpString="*.cer") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.p12") returned 0
	[0056.072] lstrlenA (lpString="*.p12") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.pfx") returned 0
	[0056.072] lstrlenA (lpString="*.pfx") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.kwm") returned 0
	[0056.072] lstrlenA (lpString="*.kwm") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.pwm") returned 0
	[0056.072] lstrlenA (lpString="*.pwm") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.1cd") returned 0
	[0056.072] lstrlenA (lpString="*.1cd") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.md") returned 0
	[0056.072] lstrlenA (lpString="*.md") returned 4
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mdf") returned 0
	[0056.072] lstrlenA (lpString="*.mdf") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.dbf") returned 0
	[0056.072] lstrlenA (lpString="*.dbf") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.odt") returned 0
	[0056.072] lstrlenA (lpString="*.odt") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.vob") returned 0
	[0056.072] lstrlenA (lpString="*.vob") returned 5
	[0056.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.ifo") returned 0
	[0056.072] lstrlenA (lpString="*.ifo") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.lnk") returned 0
	[0056.073] lstrlenA (lpString="*.lnk") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.torrent") returned 0
	[0056.073] lstrlenA (lpString="*.torrent") returned 9
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mov") returned 0
	[0056.073] lstrlenA (lpString="*.mov") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.m2v") returned 0
	[0056.073] lstrlenA (lpString="*.m2v") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.3gp") returned 0
	[0056.073] lstrlenA (lpString="*.3gp") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mpeg") returned 0
	[0056.073] lstrlenA (lpString="*.mpeg") returned 6
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mpg") returned 0
	[0056.073] lstrlenA (lpString="*.mpg") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.flv") returned 0
	[0056.073] lstrlenA (lpString="*.flv") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.avi") returned 0
	[0056.073] lstrlenA (lpString="*.avi") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mp4") returned 0
	[0056.073] lstrlenA (lpString="*.mp4") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.wmv") returned 0
	[0056.073] lstrlenA (lpString="*.wmv") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.divx") returned 0
	[0056.073] lstrlenA (lpString="*.divx") returned 6
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mkv") returned 0
	[0056.073] lstrlenA (lpString="*.mkv") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mp3") returned 0
	[0056.073] lstrlenA (lpString="*.mp3") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.wav") returned 0
	[0056.073] lstrlenA (lpString="*.wav") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.flac") returned 0
	[0056.073] lstrlenA (lpString="*.flac") returned 6
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.ape") returned 0
	[0056.073] lstrlenA (lpString="*.ape") returned 5
	[0056.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.wma") returned 0
	[0056.074] lstrlenA (lpString="*.wma") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.ac3") returned 0
	[0056.074] lstrlenA (lpString="*.ac3") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.exe") returned 0
	[0056.074] lstrlenA (lpString="*.exe") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.apk") returned 0
	[0056.074] lstrlenA (lpString="*.apk") returned 5
	[0056.074] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.074] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.074] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCDDSF.DLL") returned 1
	[0056.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCDDSF.DLL") returned 1
	[0056.074] lstrcmpiA (lpString1="", lpString2="ACCDDSF.DLL") returned -1
	[0056.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned="ACCDDS.DLL"
	[0056.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACCDDSF.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL"
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.zip") returned 0
	[0056.074] lstrlenA (lpString="*.zip") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.rar") returned 0
	[0056.074] lstrlenA (lpString="*.rar") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.7z") returned 0
	[0056.074] lstrlenA (lpString="*.7z") returned 4
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.tar") returned 0
	[0056.074] lstrlenA (lpString="*.tar") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.gzip") returned 0
	[0056.074] lstrlenA (lpString="*.gzip") returned 6
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.jpg") returned 0
	[0056.074] lstrlenA (lpString="*.jpg") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.jpeg") returned 0
	[0056.074] lstrlenA (lpString="*.jpeg") returned 6
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.psd") returned 0
	[0056.074] lstrlenA (lpString="*.psd") returned 5
	[0056.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.cdr") returned 0
	[0056.075] lstrlenA (lpString="*.cdr") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.dwg") returned 0
	[0056.075] lstrlenA (lpString="*.dwg") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.max") returned 0
	[0056.075] lstrlenA (lpString="*.max") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.bmp") returned 0
	[0056.075] lstrlenA (lpString="*.bmp") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.gif") returned 0
	[0056.075] lstrlenA (lpString="*.gif") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.png") returned 0
	[0056.075] lstrlenA (lpString="*.png") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.doc") returned 0
	[0056.075] lstrlenA (lpString="*.doc") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.docx") returned 0
	[0056.075] lstrlenA (lpString="*.docx") returned 6
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.xls") returned 0
	[0056.075] lstrlenA (lpString="*.xls") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.xlsx") returned 0
	[0056.075] lstrlenA (lpString="*.xlsx") returned 6
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.ppt") returned 0
	[0056.075] lstrlenA (lpString="*.ppt") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.pptx") returned 0
	[0056.075] lstrlenA (lpString="*.pptx") returned 6
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.txt") returned 0
	[0056.075] lstrlenA (lpString="*.txt") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.pdf") returned 0
	[0056.075] lstrlenA (lpString="*.pdf") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.djvu") returned 0
	[0056.075] lstrlenA (lpString="*.djvu") returned 6
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.htm") returned 0
	[0056.075] lstrlenA (lpString="*.htm") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.html") returned 0
	[0056.075] lstrlenA (lpString="*.html") returned 6
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mdb") returned 0
	[0056.075] lstrlenA (lpString="*.mdb") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.cer") returned 0
	[0056.075] lstrlenA (lpString="*.cer") returned 5
	[0056.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.p12") returned 0
	[0056.076] lstrlenA (lpString="*.p12") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.pfx") returned 0
	[0056.076] lstrlenA (lpString="*.pfx") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.kwm") returned 0
	[0056.076] lstrlenA (lpString="*.kwm") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.pwm") returned 0
	[0056.076] lstrlenA (lpString="*.pwm") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.1cd") returned 0
	[0056.076] lstrlenA (lpString="*.1cd") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.md") returned 0
	[0056.076] lstrlenA (lpString="*.md") returned 4
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mdf") returned 0
	[0056.076] lstrlenA (lpString="*.mdf") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.dbf") returned 0
	[0056.076] lstrlenA (lpString="*.dbf") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.odt") returned 0
	[0056.076] lstrlenA (lpString="*.odt") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.vob") returned 0
	[0056.076] lstrlenA (lpString="*.vob") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.ifo") returned 0
	[0056.076] lstrlenA (lpString="*.ifo") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.lnk") returned 0
	[0056.076] lstrlenA (lpString="*.lnk") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.torrent") returned 0
	[0056.076] lstrlenA (lpString="*.torrent") returned 9
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mov") returned 0
	[0056.076] lstrlenA (lpString="*.mov") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.m2v") returned 0
	[0056.076] lstrlenA (lpString="*.m2v") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.3gp") returned 0
	[0056.076] lstrlenA (lpString="*.3gp") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mpeg") returned 0
	[0056.076] lstrlenA (lpString="*.mpeg") returned 6
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mpg") returned 0
	[0056.076] lstrlenA (lpString="*.mpg") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.flv") returned 0
	[0056.076] lstrlenA (lpString="*.flv") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.avi") returned 0
	[0056.076] lstrlenA (lpString="*.avi") returned 5
	[0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mp4") returned 0
	[0056.077] lstrlenA (lpString="*.mp4") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.wmv") returned 0
	[0056.077] lstrlenA (lpString="*.wmv") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.divx") returned 0
	[0056.077] lstrlenA (lpString="*.divx") returned 6
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mkv") returned 0
	[0056.077] lstrlenA (lpString="*.mkv") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mp3") returned 0
	[0056.077] lstrlenA (lpString="*.mp3") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.wav") returned 0
	[0056.077] lstrlenA (lpString="*.wav") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.flac") returned 0
	[0056.077] lstrlenA (lpString="*.flac") returned 6
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.ape") returned 0
	[0056.077] lstrlenA (lpString="*.ape") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.wma") returned 0
	[0056.077] lstrlenA (lpString="*.wma") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.ac3") returned 0
	[0056.077] lstrlenA (lpString="*.ac3") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.exe") returned 0
	[0056.077] lstrlenA (lpString="*.exe") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.apk") returned 0
	[0056.077] lstrlenA (lpString="*.apk") returned 5
	[0056.077] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.077] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.077] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCDDSLM.DLL") returned 1
	[0056.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCDDSLM.DLL") returned 1
	[0056.077] lstrcmpiA (lpString1="", lpString2="ACCDDSLM.DLL") returned -1
	[0056.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned="ACCDDSF.DLL"
	[0056.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACCDDSLM.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL"
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.zip") returned 0
	[0056.077] lstrlenA (lpString="*.zip") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.rar") returned 0
	[0056.077] lstrlenA (lpString="*.rar") returned 5
	[0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.7z") returned 0
	[0056.078] lstrlenA (lpString="*.7z") returned 4
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.tar") returned 0
	[0056.078] lstrlenA (lpString="*.tar") returned 5
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.gzip") returned 0
	[0056.078] lstrlenA (lpString="*.gzip") returned 6
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.jpg") returned 0
	[0056.078] lstrlenA (lpString="*.jpg") returned 5
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.jpeg") returned 0
	[0056.078] lstrlenA (lpString="*.jpeg") returned 6
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.psd") returned 0
	[0056.078] lstrlenA (lpString="*.psd") returned 5
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.cdr") returned 0
	[0056.078] lstrlenA (lpString="*.cdr") returned 5
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.dwg") returned 0
	[0056.078] lstrlenA (lpString="*.dwg") returned 5
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.max") returned 0
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.bmp") returned 0
	[0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.gif") returned 0
	[0056.078] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.078] lstrcmpA (lpString1=".", lpString2="AccessWeb") returned -1
	[0056.078] lstrcmpA (lpString1="..", lpString2="AccessWeb") returned -1
	[0056.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned="ACCDDSLM.DLL"
	[0056.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="AccessWeb" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb"
	[0056.078] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.079] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.079] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.079] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.079] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.079] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.079] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.079] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CLNTWRAP.HTM") returned 1
	[0056.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLNTWRAP.HTM") returned 1
	[0056.079] lstrcmpiA (lpString1="", lpString2="CLNTWRAP.HTM") returned -1
	[0056.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*.*") returned="*.*"
	[0056.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\"
	[0056.080] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned=""
	[0056.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt"
	[0056.080] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how to decrypt files.txt")) returned 0xffffffff
	[0056.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.090] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.091] CloseHandle (hObject=0x8c) returned 1
	[0056.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpString2="CLNTWRAP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM"
	[0056.091] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM"
	[0056.091] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM"
	[0056.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM."
	[0056.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.Boom"
	[0056.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.099] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cf
	[0056.099] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf0a45600, dwHighDateTime=0x1c90da0), lpLastAccessTime=0x407536*(dwLowDateTime=0x603a86d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf0a45600, dwHighDateTime=0x1c90da0)) returned 1
	[0056.099] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.099] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4ac, lpOverlapped=0x0) returned 1
	[0056.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM") returned="CLNTWRAP.HTM"
	[0056.110] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.111] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4ac, lpOverlapped=0x0) returned 1
	[0056.111] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.111] CloseHandle (hObject=0x8c) returned 1
	[0056.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.boom")) returned 1
	[0056.111] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.111] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.112] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RPT2HTM4.XSL") returned -1
	[0056.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RPT2HTM4.XSL") returned -1
	[0056.112] lstrcmpiA (lpString1="", lpString2="RPT2HTM4.XSL") returned -1
	[0056.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM") returned="CLNTWRAP.HTM"
	[0056.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\"
	[0056.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned=""
	[0056.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt"
	[0056.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how to decrypt files.txt")) returned 0x20
	[0056.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpString2="RPT2HTM4.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL"
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.zip") returned 0
	[0056.112] lstrlenA (lpString="*.zip") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.rar") returned 0
	[0056.112] lstrlenA (lpString="*.rar") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.7z") returned 0
	[0056.112] lstrlenA (lpString="*.7z") returned 4
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.tar") returned 0
	[0056.112] lstrlenA (lpString="*.tar") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.gzip") returned 0
	[0056.112] lstrlenA (lpString="*.gzip") returned 6
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.jpg") returned 0
	[0056.112] lstrlenA (lpString="*.jpg") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.jpeg") returned 0
	[0056.112] lstrlenA (lpString="*.jpeg") returned 6
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.psd") returned 0
	[0056.112] lstrlenA (lpString="*.psd") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.cdr") returned 0
	[0056.112] lstrlenA (lpString="*.cdr") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.dwg") returned 0
	[0056.112] lstrlenA (lpString="*.dwg") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.max") returned 0
	[0056.112] lstrlenA (lpString="*.max") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.bmp") returned 0
	[0056.112] lstrlenA (lpString="*.bmp") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.gif") returned 0
	[0056.112] lstrlenA (lpString="*.gif") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.png") returned 0
	[0056.112] lstrlenA (lpString="*.png") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.doc") returned 0
	[0056.112] lstrlenA (lpString="*.doc") returned 5
	[0056.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.docx") returned 0
	[0056.112] lstrlenA (lpString="*.docx") returned 6
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.xls") returned 0
	[0056.113] lstrlenA (lpString="*.xls") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.xlsx") returned 0
	[0056.113] lstrlenA (lpString="*.xlsx") returned 6
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.ppt") returned 0
	[0056.113] lstrlenA (lpString="*.ppt") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.pptx") returned 0
	[0056.113] lstrlenA (lpString="*.pptx") returned 6
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.txt") returned 0
	[0056.113] lstrlenA (lpString="*.txt") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.pdf") returned 0
	[0056.113] lstrlenA (lpString="*.pdf") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.djvu") returned 0
	[0056.113] lstrlenA (lpString="*.djvu") returned 6
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.htm") returned 0
	[0056.113] lstrlenA (lpString="*.htm") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.html") returned 0
	[0056.113] lstrlenA (lpString="*.html") returned 6
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mdb") returned 0
	[0056.113] lstrlenA (lpString="*.mdb") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.cer") returned 0
	[0056.113] lstrlenA (lpString="*.cer") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.p12") returned 0
	[0056.113] lstrlenA (lpString="*.p12") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.pfx") returned 0
	[0056.113] lstrlenA (lpString="*.pfx") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.kwm") returned 0
	[0056.113] lstrlenA (lpString="*.kwm") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.pwm") returned 0
	[0056.113] lstrlenA (lpString="*.pwm") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.1cd") returned 0
	[0056.113] lstrlenA (lpString="*.1cd") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.md") returned 0
	[0056.113] lstrlenA (lpString="*.md") returned 4
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mdf") returned 0
	[0056.113] lstrlenA (lpString="*.mdf") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.dbf") returned 0
	[0056.113] lstrlenA (lpString="*.dbf") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.odt") returned 0
	[0056.113] lstrlenA (lpString="*.odt") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.vob") returned 0
	[0056.113] lstrlenA (lpString="*.vob") returned 5
	[0056.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.ifo") returned 0
	[0056.113] lstrlenA (lpString="*.ifo") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.lnk") returned 0
	[0056.114] lstrlenA (lpString="*.lnk") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.torrent") returned 0
	[0056.114] lstrlenA (lpString="*.torrent") returned 9
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mov") returned 0
	[0056.114] lstrlenA (lpString="*.mov") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.m2v") returned 0
	[0056.114] lstrlenA (lpString="*.m2v") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.3gp") returned 0
	[0056.114] lstrlenA (lpString="*.3gp") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mpeg") returned 0
	[0056.114] lstrlenA (lpString="*.mpeg") returned 6
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mpg") returned 0
	[0056.114] lstrlenA (lpString="*.mpg") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.flv") returned 0
	[0056.114] lstrlenA (lpString="*.flv") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.avi") returned 0
	[0056.114] lstrlenA (lpString="*.avi") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mp4") returned 0
	[0056.114] lstrlenA (lpString="*.mp4") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.wmv") returned 0
	[0056.114] lstrlenA (lpString="*.wmv") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.divx") returned 0
	[0056.114] lstrlenA (lpString="*.divx") returned 6
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mkv") returned 0
	[0056.114] lstrlenA (lpString="*.mkv") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mp3") returned 0
	[0056.114] lstrlenA (lpString="*.mp3") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.wav") returned 0
	[0056.114] lstrlenA (lpString="*.wav") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.flac") returned 0
	[0056.114] lstrlenA (lpString="*.flac") returned 6
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.ape") returned 0
	[0056.114] lstrlenA (lpString="*.ape") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.wma") returned 0
	[0056.114] lstrlenA (lpString="*.wma") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.ac3") returned 0
	[0056.114] lstrlenA (lpString="*.ac3") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.exe") returned 0
	[0056.114] lstrlenA (lpString="*.exe") returned 5
	[0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.apk") returned 0
	[0056.114] lstrlenA (lpString="*.apk") returned 5
	[0056.114] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.114] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.115] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SERVWRAP.ASP") returned -1
	[0056.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SERVWRAP.ASP") returned -1
	[0056.115] lstrcmpiA (lpString1="", lpString2="SERVWRAP.ASP") returned -1
	[0056.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL") returned="RPT2HTM4.XSL"
	[0056.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\"
	[0056.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned=""
	[0056.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt"
	[0056.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how to decrypt files.txt")) returned 0x20
	[0056.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpString2="SERVWRAP.ASP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP"
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.zip") returned 0
	[0056.115] lstrlenA (lpString="*.zip") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.rar") returned 0
	[0056.115] lstrlenA (lpString="*.rar") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.7z") returned 0
	[0056.115] lstrlenA (lpString="*.7z") returned 4
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.tar") returned 0
	[0056.115] lstrlenA (lpString="*.tar") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.gzip") returned 0
	[0056.115] lstrlenA (lpString="*.gzip") returned 6
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.jpg") returned 0
	[0056.115] lstrlenA (lpString="*.jpg") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.jpeg") returned 0
	[0056.115] lstrlenA (lpString="*.jpeg") returned 6
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.psd") returned 0
	[0056.115] lstrlenA (lpString="*.psd") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.cdr") returned 0
	[0056.115] lstrlenA (lpString="*.cdr") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.dwg") returned 0
	[0056.115] lstrlenA (lpString="*.dwg") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.max") returned 0
	[0056.115] lstrlenA (lpString="*.max") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.bmp") returned 0
	[0056.115] lstrlenA (lpString="*.bmp") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.gif") returned 0
	[0056.115] lstrlenA (lpString="*.gif") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.png") returned 0
	[0056.115] lstrlenA (lpString="*.png") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.doc") returned 0
	[0056.115] lstrlenA (lpString="*.doc") returned 5
	[0056.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.docx") returned 0
	[0056.115] lstrlenA (lpString="*.docx") returned 6
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.xls") returned 0
	[0056.116] lstrlenA (lpString="*.xls") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.xlsx") returned 0
	[0056.116] lstrlenA (lpString="*.xlsx") returned 6
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.ppt") returned 0
	[0056.116] lstrlenA (lpString="*.ppt") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.pptx") returned 0
	[0056.116] lstrlenA (lpString="*.pptx") returned 6
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.txt") returned 0
	[0056.116] lstrlenA (lpString="*.txt") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.pdf") returned 0
	[0056.116] lstrlenA (lpString="*.pdf") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.djvu") returned 0
	[0056.116] lstrlenA (lpString="*.djvu") returned 6
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.htm") returned 0
	[0056.116] lstrlenA (lpString="*.htm") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.html") returned 0
	[0056.116] lstrlenA (lpString="*.html") returned 6
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mdb") returned 0
	[0056.116] lstrlenA (lpString="*.mdb") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.cer") returned 0
	[0056.116] lstrlenA (lpString="*.cer") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.p12") returned 0
	[0056.116] lstrlenA (lpString="*.p12") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.pfx") returned 0
	[0056.116] lstrlenA (lpString="*.pfx") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.kwm") returned 0
	[0056.116] lstrlenA (lpString="*.kwm") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.pwm") returned 0
	[0056.116] lstrlenA (lpString="*.pwm") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.1cd") returned 0
	[0056.116] lstrlenA (lpString="*.1cd") returned 5
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.md") returned 0
	[0056.116] lstrlenA (lpString="*.md") returned 4
	[0056.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mdf") returned 0
	[0056.116] lstrlenA (lpString="*.mdf") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.dbf") returned 0
	[0056.118] lstrlenA (lpString="*.dbf") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.odt") returned 0
	[0056.118] lstrlenA (lpString="*.odt") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.vob") returned 0
	[0056.118] lstrlenA (lpString="*.vob") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.ifo") returned 0
	[0056.118] lstrlenA (lpString="*.ifo") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.lnk") returned 0
	[0056.118] lstrlenA (lpString="*.lnk") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.torrent") returned 0
	[0056.118] lstrlenA (lpString="*.torrent") returned 9
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mov") returned 0
	[0056.118] lstrlenA (lpString="*.mov") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.m2v") returned 0
	[0056.118] lstrlenA (lpString="*.m2v") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.3gp") returned 0
	[0056.118] lstrlenA (lpString="*.3gp") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mpeg") returned 0
	[0056.118] lstrlenA (lpString="*.mpeg") returned 6
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mpg") returned 0
	[0056.118] lstrlenA (lpString="*.mpg") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.flv") returned 0
	[0056.118] lstrlenA (lpString="*.flv") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.avi") returned 0
	[0056.118] lstrlenA (lpString="*.avi") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mp4") returned 0
	[0056.118] lstrlenA (lpString="*.mp4") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.wmv") returned 0
	[0056.118] lstrlenA (lpString="*.wmv") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.divx") returned 0
	[0056.118] lstrlenA (lpString="*.divx") returned 6
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mkv") returned 0
	[0056.118] lstrlenA (lpString="*.mkv") returned 5
	[0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.mp3") returned 0
	[0056.118] lstrlenA (lpString="*.mp3") returned 5
	[0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.wav") returned 0
	[0056.119] lstrlenA (lpString="*.wav") returned 5
	[0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.flac") returned 0
	[0056.119] lstrlenA (lpString="*.flac") returned 6
	[0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.ape") returned 0
	[0056.119] lstrlenA (lpString="*.ape") returned 5
	[0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.wma") returned 0
	[0056.119] lstrlenA (lpString="*.wma") returned 5
	[0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.ac3") returned 0
	[0056.119] lstrlenA (lpString="*.ac3") returned 5
	[0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.exe") returned 0
	[0056.119] lstrlenA (lpString="*.exe") returned 5
	[0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.apk") returned 0
	[0056.119] lstrlenA (lpString="*.apk") returned 5
	[0056.119] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.119] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.120] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.120] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.120] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCICONS.EXE") returned 1
	[0056.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCICONS.EXE") returned 1
	[0056.120] lstrcmpiA (lpString1="", lpString2="ACCICONS.EXE") returned -1
	[0056.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.120] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACCICONS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE"
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.zip") returned 0
	[0056.121] lstrlenA (lpString="*.zip") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.rar") returned 0
	[0056.121] lstrlenA (lpString="*.rar") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.7z") returned 0
	[0056.121] lstrlenA (lpString="*.7z") returned 4
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.tar") returned 0
	[0056.121] lstrlenA (lpString="*.tar") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.gzip") returned 0
	[0056.121] lstrlenA (lpString="*.gzip") returned 6
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.jpg") returned 0
	[0056.121] lstrlenA (lpString="*.jpg") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.jpeg") returned 0
	[0056.121] lstrlenA (lpString="*.jpeg") returned 6
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.psd") returned 0
	[0056.121] lstrlenA (lpString="*.psd") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.cdr") returned 0
	[0056.121] lstrlenA (lpString="*.cdr") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.dwg") returned 0
	[0056.121] lstrlenA (lpString="*.dwg") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.max") returned 0
	[0056.121] lstrlenA (lpString="*.max") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.bmp") returned 0
	[0056.121] lstrlenA (lpString="*.bmp") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.gif") returned 0
	[0056.121] lstrlenA (lpString="*.gif") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.png") returned 0
	[0056.121] lstrlenA (lpString="*.png") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.doc") returned 0
	[0056.121] lstrlenA (lpString="*.doc") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.docx") returned 0
	[0056.121] lstrlenA (lpString="*.docx") returned 6
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.xls") returned 0
	[0056.121] lstrlenA (lpString="*.xls") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.xlsx") returned 0
	[0056.121] lstrlenA (lpString="*.xlsx") returned 6
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.ppt") returned 0
	[0056.121] lstrlenA (lpString="*.ppt") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.pptx") returned 0
	[0056.121] lstrlenA (lpString="*.pptx") returned 6
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.txt") returned 0
	[0056.121] lstrlenA (lpString="*.txt") returned 5
	[0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.pdf") returned 0
	[0056.121] lstrlenA (lpString="*.pdf") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.djvu") returned 0
	[0056.122] lstrlenA (lpString="*.djvu") returned 6
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.htm") returned 0
	[0056.122] lstrlenA (lpString="*.htm") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.html") returned 0
	[0056.122] lstrlenA (lpString="*.html") returned 6
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mdb") returned 0
	[0056.122] lstrlenA (lpString="*.mdb") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.cer") returned 0
	[0056.122] lstrlenA (lpString="*.cer") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.p12") returned 0
	[0056.122] lstrlenA (lpString="*.p12") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.pfx") returned 0
	[0056.122] lstrlenA (lpString="*.pfx") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.kwm") returned 0
	[0056.122] lstrlenA (lpString="*.kwm") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.pwm") returned 0
	[0056.122] lstrlenA (lpString="*.pwm") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.1cd") returned 0
	[0056.122] lstrlenA (lpString="*.1cd") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.md") returned 0
	[0056.122] lstrlenA (lpString="*.md") returned 4
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mdf") returned 0
	[0056.122] lstrlenA (lpString="*.mdf") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.dbf") returned 0
	[0056.122] lstrlenA (lpString="*.dbf") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.odt") returned 0
	[0056.122] lstrlenA (lpString="*.odt") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.vob") returned 0
	[0056.122] lstrlenA (lpString="*.vob") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.ifo") returned 0
	[0056.122] lstrlenA (lpString="*.ifo") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.lnk") returned 0
	[0056.122] lstrlenA (lpString="*.lnk") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.torrent") returned 0
	[0056.122] lstrlenA (lpString="*.torrent") returned 9
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mov") returned 0
	[0056.122] lstrlenA (lpString="*.mov") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.m2v") returned 0
	[0056.122] lstrlenA (lpString="*.m2v") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.3gp") returned 0
	[0056.122] lstrlenA (lpString="*.3gp") returned 5
	[0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mpeg") returned 0
	[0056.123] lstrlenA (lpString="*.mpeg") returned 6
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mpg") returned 0
	[0056.123] lstrlenA (lpString="*.mpg") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.flv") returned 0
	[0056.123] lstrlenA (lpString="*.flv") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.avi") returned 0
	[0056.123] lstrlenA (lpString="*.avi") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mp4") returned 0
	[0056.123] lstrlenA (lpString="*.mp4") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.wmv") returned 0
	[0056.123] lstrlenA (lpString="*.wmv") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.divx") returned 0
	[0056.123] lstrlenA (lpString="*.divx") returned 6
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mkv") returned 0
	[0056.123] lstrlenA (lpString="*.mkv") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.mp3") returned 0
	[0056.123] lstrlenA (lpString="*.mp3") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.wav") returned 0
	[0056.123] lstrlenA (lpString="*.wav") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.flac") returned 0
	[0056.123] lstrlenA (lpString="*.flac") returned 6
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.ape") returned 0
	[0056.123] lstrlenA (lpString="*.ape") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.wma") returned 0
	[0056.123] lstrlenA (lpString="*.wma") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.ac3") returned 0
	[0056.123] lstrlenA (lpString="*.ac3") returned 5
	[0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", pszSpec="*.exe") returned 1
	[0056.123] lstrlenA (lpString="*.exe") returned 5
	[0056.123] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE"
	[0056.123] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE"
	[0056.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE."
	[0056.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.Boom"
	[0056.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0056.124] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d60
	[0056.124] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf73e1e00, dwHighDateTime=0x1cacb3c), lpLastAccessTime=0x407536*(dwLowDateTime=0x51090010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf73e1e00, dwHighDateTime=0x1cacb3c)) returned 1
	[0056.124] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.124] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x161d3d, lpOverlapped=0x0) returned 1
	[0056.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned="ACCICONS.EXE"
	[0056.201] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.201] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x161d3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x161d3d, lpOverlapped=0x0) returned 1
	[0056.206] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.206] CloseHandle (hObject=0x88) returned 1
	[0056.206] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.boom")) returned 1
	[0056.207] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.207] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.207] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCVDT.DLL") returned 1
	[0056.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCVDT.DLL") returned 1
	[0056.207] lstrcmpiA (lpString1="", lpString2="ACCVDT.DLL") returned -1
	[0056.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned="ACCICONS.EXE"
	[0056.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACCVDT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL"
	[0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.zip") returned 0
	[0056.208] lstrlenA (lpString="*.zip") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.rar") returned 0
	[0056.208] lstrlenA (lpString="*.rar") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.7z") returned 0
	[0056.208] lstrlenA (lpString="*.7z") returned 4
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.tar") returned 0
	[0056.208] lstrlenA (lpString="*.tar") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.gzip") returned 0
	[0056.208] lstrlenA (lpString="*.gzip") returned 6
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.jpg") returned 0
	[0056.208] lstrlenA (lpString="*.jpg") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.jpeg") returned 0
	[0056.208] lstrlenA (lpString="*.jpeg") returned 6
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.psd") returned 0
	[0056.208] lstrlenA (lpString="*.psd") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.cdr") returned 0
	[0056.208] lstrlenA (lpString="*.cdr") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.dwg") returned 0
	[0056.208] lstrlenA (lpString="*.dwg") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.max") returned 0
	[0056.208] lstrlenA (lpString="*.max") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.bmp") returned 0
	[0056.208] lstrlenA (lpString="*.bmp") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.gif") returned 0
	[0056.208] lstrlenA (lpString="*.gif") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.png") returned 0
	[0056.208] lstrlenA (lpString="*.png") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.doc") returned 0
	[0056.208] lstrlenA (lpString="*.doc") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.docx") returned 0
	[0056.208] lstrlenA (lpString="*.docx") returned 6
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.xls") returned 0
	[0056.208] lstrlenA (lpString="*.xls") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.xlsx") returned 0
	[0056.208] lstrlenA (lpString="*.xlsx") returned 6
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.ppt") returned 0
	[0056.208] lstrlenA (lpString="*.ppt") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.pptx") returned 0
	[0056.208] lstrlenA (lpString="*.pptx") returned 6
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.txt") returned 0
	[0056.208] lstrlenA (lpString="*.txt") returned 5
	[0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.pdf") returned 0
	[0056.208] lstrlenA (lpString="*.pdf") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.djvu") returned 0
	[0056.209] lstrlenA (lpString="*.djvu") returned 6
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.htm") returned 0
	[0056.209] lstrlenA (lpString="*.htm") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.html") returned 0
	[0056.209] lstrlenA (lpString="*.html") returned 6
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mdb") returned 0
	[0056.209] lstrlenA (lpString="*.mdb") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.cer") returned 0
	[0056.209] lstrlenA (lpString="*.cer") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.p12") returned 0
	[0056.209] lstrlenA (lpString="*.p12") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.pfx") returned 0
	[0056.209] lstrlenA (lpString="*.pfx") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.kwm") returned 0
	[0056.209] lstrlenA (lpString="*.kwm") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.pwm") returned 0
	[0056.209] lstrlenA (lpString="*.pwm") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.1cd") returned 0
	[0056.209] lstrlenA (lpString="*.1cd") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.md") returned 0
	[0056.209] lstrlenA (lpString="*.md") returned 4
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mdf") returned 0
	[0056.209] lstrlenA (lpString="*.mdf") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.dbf") returned 0
	[0056.209] lstrlenA (lpString="*.dbf") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.odt") returned 0
	[0056.209] lstrlenA (lpString="*.odt") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.vob") returned 0
	[0056.209] lstrlenA (lpString="*.vob") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.ifo") returned 0
	[0056.209] lstrlenA (lpString="*.ifo") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.lnk") returned 0
	[0056.209] lstrlenA (lpString="*.lnk") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.torrent") returned 0
	[0056.209] lstrlenA (lpString="*.torrent") returned 9
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mov") returned 0
	[0056.209] lstrlenA (lpString="*.mov") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.m2v") returned 0
	[0056.209] lstrlenA (lpString="*.m2v") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.3gp") returned 0
	[0056.209] lstrlenA (lpString="*.3gp") returned 5
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mpeg") returned 0
	[0056.209] lstrlenA (lpString="*.mpeg") returned 6
	[0056.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mpg") returned 0
	[0056.210] lstrlenA (lpString="*.mpg") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.flv") returned 0
	[0056.210] lstrlenA (lpString="*.flv") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.avi") returned 0
	[0056.210] lstrlenA (lpString="*.avi") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mp4") returned 0
	[0056.210] lstrlenA (lpString="*.mp4") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.wmv") returned 0
	[0056.210] lstrlenA (lpString="*.wmv") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.divx") returned 0
	[0056.210] lstrlenA (lpString="*.divx") returned 6
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mkv") returned 0
	[0056.210] lstrlenA (lpString="*.mkv") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.mp3") returned 0
	[0056.210] lstrlenA (lpString="*.mp3") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.wav") returned 0
	[0056.210] lstrlenA (lpString="*.wav") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.flac") returned 0
	[0056.210] lstrlenA (lpString="*.flac") returned 6
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.ape") returned 0
	[0056.210] lstrlenA (lpString="*.ape") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.wma") returned 0
	[0056.210] lstrlenA (lpString="*.wma") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.ac3") returned 0
	[0056.210] lstrlenA (lpString="*.ac3") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.exe") returned 0
	[0056.210] lstrlenA (lpString="*.exe") returned 5
	[0056.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", pszSpec="*.apk") returned 0
	[0056.210] lstrlenA (lpString="*.apk") returned 5
	[0056.210] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.210] lstrcmpA (lpString1=".", lpString2="ACCWIZ") returned -1
	[0056.210] lstrcmpA (lpString1="..", lpString2="ACCWIZ") returned -1
	[0056.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned="ACCVDT.DLL"
	[0056.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACCWIZ" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ"
	[0056.210] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned 49
	[0056.210] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.221] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.221] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.222] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.222] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.222] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.222] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACWZDAT12.ACCDU") returned 1
	[0056.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACWZDAT12.ACCDU") returned 1
	[0056.222] lstrcmpiA (lpString1="", lpString2="ACWZDAT12.ACCDU") returned -1
	[0056.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*.*") returned="*.*"
	[0056.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\"
	[0056.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned=""
	[0056.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt"
	[0056.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to decrypt files.txt")) returned 0xffffffff
	[0056.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.222] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0056.222] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0056.223] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.223] CloseHandle (hObject=0x8c) returned 1
	[0056.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="ACWZDAT12.ACCDU" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU"
	[0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.zip") returned 0
	[0056.223] lstrlenA (lpString="*.zip") returned 5
	[0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.rar") returned 0
	[0056.223] lstrlenA (lpString="*.rar") returned 5
	[0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.7z") returned 0
	[0056.223] lstrlenA (lpString="*.7z") returned 4
	[0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.tar") returned 0
	[0056.224] lstrlenA (lpString="*.tar") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.gzip") returned 0
	[0056.224] lstrlenA (lpString="*.gzip") returned 6
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.jpg") returned 0
	[0056.224] lstrlenA (lpString="*.jpg") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.jpeg") returned 0
	[0056.224] lstrlenA (lpString="*.jpeg") returned 6
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.psd") returned 0
	[0056.224] lstrlenA (lpString="*.psd") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.cdr") returned 0
	[0056.224] lstrlenA (lpString="*.cdr") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.dwg") returned 0
	[0056.224] lstrlenA (lpString="*.dwg") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.max") returned 0
	[0056.224] lstrlenA (lpString="*.max") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.bmp") returned 0
	[0056.224] lstrlenA (lpString="*.bmp") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.gif") returned 0
	[0056.224] lstrlenA (lpString="*.gif") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.png") returned 0
	[0056.224] lstrlenA (lpString="*.png") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.doc") returned 0
	[0056.224] lstrlenA (lpString="*.doc") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.docx") returned 0
	[0056.224] lstrlenA (lpString="*.docx") returned 6
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.xls") returned 0
	[0056.224] lstrlenA (lpString="*.xls") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.xlsx") returned 0
	[0056.224] lstrlenA (lpString="*.xlsx") returned 6
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.ppt") returned 0
	[0056.224] lstrlenA (lpString="*.ppt") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.pptx") returned 0
	[0056.224] lstrlenA (lpString="*.pptx") returned 6
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.txt") returned 0
	[0056.224] lstrlenA (lpString="*.txt") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.pdf") returned 0
	[0056.224] lstrlenA (lpString="*.pdf") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.djvu") returned 0
	[0056.224] lstrlenA (lpString="*.djvu") returned 6
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.htm") returned 0
	[0056.224] lstrlenA (lpString="*.htm") returned 5
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.html") returned 0
	[0056.224] lstrlenA (lpString="*.html") returned 6
	[0056.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mdb") returned 0
	[0056.225] lstrlenA (lpString="*.mdb") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.cer") returned 0
	[0056.225] lstrlenA (lpString="*.cer") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.p12") returned 0
	[0056.225] lstrlenA (lpString="*.p12") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.pfx") returned 0
	[0056.225] lstrlenA (lpString="*.pfx") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.kwm") returned 0
	[0056.225] lstrlenA (lpString="*.kwm") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.pwm") returned 0
	[0056.225] lstrlenA (lpString="*.pwm") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.1cd") returned 0
	[0056.225] lstrlenA (lpString="*.1cd") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.md") returned 0
	[0056.225] lstrlenA (lpString="*.md") returned 4
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mdf") returned 0
	[0056.225] lstrlenA (lpString="*.mdf") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.dbf") returned 0
	[0056.225] lstrlenA (lpString="*.dbf") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.odt") returned 0
	[0056.225] lstrlenA (lpString="*.odt") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.vob") returned 0
	[0056.225] lstrlenA (lpString="*.vob") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.ifo") returned 0
	[0056.225] lstrlenA (lpString="*.ifo") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.lnk") returned 0
	[0056.225] lstrlenA (lpString="*.lnk") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.torrent") returned 0
	[0056.225] lstrlenA (lpString="*.torrent") returned 9
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mov") returned 0
	[0056.225] lstrlenA (lpString="*.mov") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.m2v") returned 0
	[0056.225] lstrlenA (lpString="*.m2v") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.3gp") returned 0
	[0056.225] lstrlenA (lpString="*.3gp") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mpeg") returned 0
	[0056.225] lstrlenA (lpString="*.mpeg") returned 6
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mpg") returned 0
	[0056.225] lstrlenA (lpString="*.mpg") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.flv") returned 0
	[0056.225] lstrlenA (lpString="*.flv") returned 5
	[0056.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.avi") returned 0
	[0056.226] lstrlenA (lpString="*.avi") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mp4") returned 0
	[0056.226] lstrlenA (lpString="*.mp4") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.wmv") returned 0
	[0056.226] lstrlenA (lpString="*.wmv") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.divx") returned 0
	[0056.226] lstrlenA (lpString="*.divx") returned 6
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mkv") returned 0
	[0056.226] lstrlenA (lpString="*.mkv") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.mp3") returned 0
	[0056.226] lstrlenA (lpString="*.mp3") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.wav") returned 0
	[0056.226] lstrlenA (lpString="*.wav") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.flac") returned 0
	[0056.226] lstrlenA (lpString="*.flac") returned 6
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.ape") returned 0
	[0056.226] lstrlenA (lpString="*.ape") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.wma") returned 0
	[0056.226] lstrlenA (lpString="*.wma") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.ac3") returned 0
	[0056.226] lstrlenA (lpString="*.ac3") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.exe") returned 0
	[0056.226] lstrlenA (lpString="*.exe") returned 5
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", pszSpec="*.apk") returned 0
	[0056.226] lstrlenA (lpString="*.apk") returned 5
	[0056.226] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.226] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACWZLIB.ACCDE") returned 1
	[0056.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACWZLIB.ACCDE") returned 1
	[0056.226] lstrcmpiA (lpString1="", lpString2="ACWZLIB.ACCDE") returned -1
	[0056.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned="ACWZDAT12.ACCDU"
	[0056.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\"
	[0056.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned=""
	[0056.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt"
	[0056.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to decrypt files.txt")) returned 0x20
	[0056.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="ACWZLIB.ACCDE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE"
	[0056.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.zip") returned 0
	[0056.227] lstrlenA (lpString="*.zip") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.rar") returned 0
	[0056.227] lstrlenA (lpString="*.rar") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.7z") returned 0
	[0056.227] lstrlenA (lpString="*.7z") returned 4
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.tar") returned 0
	[0056.227] lstrlenA (lpString="*.tar") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.gzip") returned 0
	[0056.227] lstrlenA (lpString="*.gzip") returned 6
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.jpg") returned 0
	[0056.227] lstrlenA (lpString="*.jpg") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.jpeg") returned 0
	[0056.227] lstrlenA (lpString="*.jpeg") returned 6
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.psd") returned 0
	[0056.227] lstrlenA (lpString="*.psd") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.cdr") returned 0
	[0056.227] lstrlenA (lpString="*.cdr") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.dwg") returned 0
	[0056.227] lstrlenA (lpString="*.dwg") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.max") returned 0
	[0056.227] lstrlenA (lpString="*.max") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.bmp") returned 0
	[0056.227] lstrlenA (lpString="*.bmp") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.gif") returned 0
	[0056.227] lstrlenA (lpString="*.gif") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.png") returned 0
	[0056.227] lstrlenA (lpString="*.png") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.doc") returned 0
	[0056.227] lstrlenA (lpString="*.doc") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.docx") returned 0
	[0056.227] lstrlenA (lpString="*.docx") returned 6
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.xls") returned 0
	[0056.227] lstrlenA (lpString="*.xls") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.xlsx") returned 0
	[0056.227] lstrlenA (lpString="*.xlsx") returned 6
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.ppt") returned 0
	[0056.227] lstrlenA (lpString="*.ppt") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.pptx") returned 0
	[0056.227] lstrlenA (lpString="*.pptx") returned 6
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.txt") returned 0
	[0056.227] lstrlenA (lpString="*.txt") returned 5
	[0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.pdf") returned 0
	[0056.227] lstrlenA (lpString="*.pdf") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.djvu") returned 0
	[0056.228] lstrlenA (lpString="*.djvu") returned 6
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.htm") returned 0
	[0056.228] lstrlenA (lpString="*.htm") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.html") returned 0
	[0056.228] lstrlenA (lpString="*.html") returned 6
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mdb") returned 0
	[0056.228] lstrlenA (lpString="*.mdb") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.cer") returned 0
	[0056.228] lstrlenA (lpString="*.cer") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.p12") returned 0
	[0056.228] lstrlenA (lpString="*.p12") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.pfx") returned 0
	[0056.228] lstrlenA (lpString="*.pfx") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.kwm") returned 0
	[0056.228] lstrlenA (lpString="*.kwm") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.pwm") returned 0
	[0056.228] lstrlenA (lpString="*.pwm") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.1cd") returned 0
	[0056.228] lstrlenA (lpString="*.1cd") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.md") returned 0
	[0056.228] lstrlenA (lpString="*.md") returned 4
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mdf") returned 0
	[0056.228] lstrlenA (lpString="*.mdf") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.dbf") returned 0
	[0056.228] lstrlenA (lpString="*.dbf") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.odt") returned 0
	[0056.228] lstrlenA (lpString="*.odt") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.vob") returned 0
	[0056.228] lstrlenA (lpString="*.vob") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.ifo") returned 0
	[0056.228] lstrlenA (lpString="*.ifo") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.lnk") returned 0
	[0056.228] lstrlenA (lpString="*.lnk") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.torrent") returned 0
	[0056.228] lstrlenA (lpString="*.torrent") returned 9
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mov") returned 0
	[0056.228] lstrlenA (lpString="*.mov") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.m2v") returned 0
	[0056.228] lstrlenA (lpString="*.m2v") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.3gp") returned 0
	[0056.228] lstrlenA (lpString="*.3gp") returned 5
	[0056.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mpeg") returned 0
	[0056.228] lstrlenA (lpString="*.mpeg") returned 6
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mpg") returned 0
	[0056.229] lstrlenA (lpString="*.mpg") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.flv") returned 0
	[0056.229] lstrlenA (lpString="*.flv") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.avi") returned 0
	[0056.229] lstrlenA (lpString="*.avi") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mp4") returned 0
	[0056.229] lstrlenA (lpString="*.mp4") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.wmv") returned 0
	[0056.229] lstrlenA (lpString="*.wmv") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.divx") returned 0
	[0056.229] lstrlenA (lpString="*.divx") returned 6
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mkv") returned 0
	[0056.229] lstrlenA (lpString="*.mkv") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.mp3") returned 0
	[0056.229] lstrlenA (lpString="*.mp3") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.wav") returned 0
	[0056.229] lstrlenA (lpString="*.wav") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.flac") returned 0
	[0056.229] lstrlenA (lpString="*.flac") returned 6
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.ape") returned 0
	[0056.229] lstrlenA (lpString="*.ape") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.wma") returned 0
	[0056.229] lstrlenA (lpString="*.wma") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.ac3") returned 0
	[0056.229] lstrlenA (lpString="*.ac3") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.exe") returned 0
	[0056.229] lstrlenA (lpString="*.exe") returned 5
	[0056.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", pszSpec="*.apk") returned 0
	[0056.229] lstrlenA (lpString="*.apk") returned 5
	[0056.229] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.229] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.229] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACWZMAIN.ACCDE") returned 1
	[0056.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACWZMAIN.ACCDE") returned 1
	[0056.229] lstrcmpiA (lpString1="", lpString2="ACWZMAIN.ACCDE") returned -1
	[0056.229] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE") returned="ACWZLIB.ACCDE"
	[0056.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\"
	[0056.229] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned=""
	[0056.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt"
	[0056.229] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to decrypt files.txt")) returned 0x20
	[0056.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="ACWZMAIN.ACCDE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE"
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.zip") returned 0
	[0056.230] lstrlenA (lpString="*.zip") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.rar") returned 0
	[0056.230] lstrlenA (lpString="*.rar") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.7z") returned 0
	[0056.230] lstrlenA (lpString="*.7z") returned 4
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.tar") returned 0
	[0056.230] lstrlenA (lpString="*.tar") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.gzip") returned 0
	[0056.230] lstrlenA (lpString="*.gzip") returned 6
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.jpg") returned 0
	[0056.230] lstrlenA (lpString="*.jpg") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.jpeg") returned 0
	[0056.230] lstrlenA (lpString="*.jpeg") returned 6
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.psd") returned 0
	[0056.230] lstrlenA (lpString="*.psd") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.cdr") returned 0
	[0056.230] lstrlenA (lpString="*.cdr") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.dwg") returned 0
	[0056.230] lstrlenA (lpString="*.dwg") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.max") returned 0
	[0056.230] lstrlenA (lpString="*.max") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.bmp") returned 0
	[0056.230] lstrlenA (lpString="*.bmp") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.gif") returned 0
	[0056.230] lstrlenA (lpString="*.gif") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.png") returned 0
	[0056.230] lstrlenA (lpString="*.png") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.doc") returned 0
	[0056.230] lstrlenA (lpString="*.doc") returned 5
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.docx") returned 0
	[0056.230] lstrlenA (lpString="*.docx") returned 6
	[0056.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.xls") returned 0
	[0056.230] lstrlenA (lpString="*.xls") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.xlsx") returned 0
	[0056.231] lstrlenA (lpString="*.xlsx") returned 6
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.ppt") returned 0
	[0056.231] lstrlenA (lpString="*.ppt") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.pptx") returned 0
	[0056.231] lstrlenA (lpString="*.pptx") returned 6
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.txt") returned 0
	[0056.231] lstrlenA (lpString="*.txt") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.pdf") returned 0
	[0056.231] lstrlenA (lpString="*.pdf") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.djvu") returned 0
	[0056.231] lstrlenA (lpString="*.djvu") returned 6
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.htm") returned 0
	[0056.231] lstrlenA (lpString="*.htm") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.html") returned 0
	[0056.231] lstrlenA (lpString="*.html") returned 6
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mdb") returned 0
	[0056.231] lstrlenA (lpString="*.mdb") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.cer") returned 0
	[0056.231] lstrlenA (lpString="*.cer") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.p12") returned 0
	[0056.231] lstrlenA (lpString="*.p12") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.pfx") returned 0
	[0056.231] lstrlenA (lpString="*.pfx") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.kwm") returned 0
	[0056.231] lstrlenA (lpString="*.kwm") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.pwm") returned 0
	[0056.231] lstrlenA (lpString="*.pwm") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.1cd") returned 0
	[0056.231] lstrlenA (lpString="*.1cd") returned 5
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.md") returned 0
	[0056.231] lstrlenA (lpString="*.md") returned 4
	[0056.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mdf") returned 0
	[0056.232] lstrlenA (lpString="*.mdf") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.dbf") returned 0
	[0056.232] lstrlenA (lpString="*.dbf") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.odt") returned 0
	[0056.232] lstrlenA (lpString="*.odt") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.vob") returned 0
	[0056.232] lstrlenA (lpString="*.vob") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.ifo") returned 0
	[0056.232] lstrlenA (lpString="*.ifo") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.lnk") returned 0
	[0056.232] lstrlenA (lpString="*.lnk") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.torrent") returned 0
	[0056.232] lstrlenA (lpString="*.torrent") returned 9
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mov") returned 0
	[0056.232] lstrlenA (lpString="*.mov") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.m2v") returned 0
	[0056.232] lstrlenA (lpString="*.m2v") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.3gp") returned 0
	[0056.232] lstrlenA (lpString="*.3gp") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mpeg") returned 0
	[0056.232] lstrlenA (lpString="*.mpeg") returned 6
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mpg") returned 0
	[0056.232] lstrlenA (lpString="*.mpg") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.flv") returned 0
	[0056.232] lstrlenA (lpString="*.flv") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.avi") returned 0
	[0056.232] lstrlenA (lpString="*.avi") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mp4") returned 0
	[0056.232] lstrlenA (lpString="*.mp4") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.wmv") returned 0
	[0056.232] lstrlenA (lpString="*.wmv") returned 5
	[0056.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.divx") returned 0
	[0056.233] lstrlenA (lpString="*.divx") returned 6
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mkv") returned 0
	[0056.233] lstrlenA (lpString="*.mkv") returned 5
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.mp3") returned 0
	[0056.233] lstrlenA (lpString="*.mp3") returned 5
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.wav") returned 0
	[0056.233] lstrlenA (lpString="*.wav") returned 5
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.flac") returned 0
	[0056.233] lstrlenA (lpString="*.flac") returned 6
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.ape") returned 0
	[0056.233] lstrlenA (lpString="*.ape") returned 5
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.wma") returned 0
	[0056.233] lstrlenA (lpString="*.wma") returned 5
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.ac3") returned 0
	[0056.233] lstrlenA (lpString="*.ac3") returned 5
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.exe") returned 0
	[0056.233] lstrlenA (lpString="*.exe") returned 5
	[0056.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", pszSpec="*.apk") returned 0
	[0056.233] lstrlenA (lpString="*.apk") returned 5
	[0056.233] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.233] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.233] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACWZTOOL.ACCDE") returned 1
	[0056.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACWZTOOL.ACCDE") returned 1
	[0056.233] lstrcmpiA (lpString1="", lpString2="ACWZTOOL.ACCDE") returned -1
	[0056.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE") returned="ACWZMAIN.ACCDE"
	[0056.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\"
	[0056.233] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned=""
	[0056.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt"
	[0056.233] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to decrypt files.txt")) returned 0x20
	[0056.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="ACWZTOOL.ACCDE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE"
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.zip") returned 0
	[0056.234] lstrlenA (lpString="*.zip") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.rar") returned 0
	[0056.234] lstrlenA (lpString="*.rar") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.7z") returned 0
	[0056.234] lstrlenA (lpString="*.7z") returned 4
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.tar") returned 0
	[0056.234] lstrlenA (lpString="*.tar") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.gzip") returned 0
	[0056.234] lstrlenA (lpString="*.gzip") returned 6
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.jpg") returned 0
	[0056.234] lstrlenA (lpString="*.jpg") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.jpeg") returned 0
	[0056.234] lstrlenA (lpString="*.jpeg") returned 6
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.psd") returned 0
	[0056.234] lstrlenA (lpString="*.psd") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.cdr") returned 0
	[0056.234] lstrlenA (lpString="*.cdr") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.dwg") returned 0
	[0056.234] lstrlenA (lpString="*.dwg") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.max") returned 0
	[0056.234] lstrlenA (lpString="*.max") returned 5
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.bmp") returned 0
	[0056.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", pszSpec="*.gif") returned 0
	[0056.235] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.235] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.235] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACWZUSR12.ACCDU") returned 1
	[0056.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACWZUSR12.ACCDU") returned 1
	[0056.235] lstrcmpiA (lpString1="", lpString2="ACWZUSR12.ACCDU") returned -1
	[0056.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE") returned="ACWZTOOL.ACCDE"
	[0056.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\"
	[0056.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned=""
	[0056.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt"
	[0056.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to decrypt files.txt")) returned 0x20
	[0056.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="ACWZUSR12.ACCDU" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU"
	[0056.235] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.235] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.235] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UTILITY.ACCDA") returned -1
	[0056.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UTILITY.ACCDA") returned -1
	[0056.235] lstrcmpiA (lpString1="", lpString2="UTILITY.ACCDA") returned -1
	[0056.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned="ACWZUSR12.ACCDU"
	[0056.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\"
	[0056.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned=""
	[0056.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt"
	[0056.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to decrypt files.txt")) returned 0x20
	[0056.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpString2="UTILITY.ACCDA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA"
	[0056.235] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.235] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.235] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.235] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.236] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCWIZ.DLL") returned 1
	[0056.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCWIZ.DLL") returned 1
	[0056.236] lstrcmpiA (lpString1="", lpString2="ACCWIZ.DLL") returned -1
	[0056.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACCWIZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL"
	[0056.236] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.236] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.236] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEDAO.DLL") returned 1
	[0056.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEDAO.DLL") returned 1
	[0056.236] lstrcmpiA (lpString1="", lpString2="ACEDAO.DLL") returned -1
	[0056.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned="ACCWIZ.DLL"
	[0056.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ACEDAO.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL"
	[0056.236] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.236] lstrcmpA (lpString1=".", lpString2="ADDINS") returned -1
	[0056.236] lstrcmpA (lpString1="..", lpString2="ADDINS") returned -1
	[0056.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned="ACEDAO.DLL"
	[0056.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ADDINS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS"
	[0056.236] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.257] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.257] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.257] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.257] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.257] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.257] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCOLK.DLL") returned 1
	[0056.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCOLK.DLL") returned 1
	[0056.257] lstrcmpiA (lpString1="", lpString2="ACCOLK.DLL") returned -1
	[0056.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*.*") returned="*.*"
	[0056.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.257] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0xffffffff
	[0056.257] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.260] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.260] CloseHandle (hObject=0x8c) returned 1
	[0056.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="ACCOLK.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL"
	[0056.260] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.260] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSAddin.dll") returned 1
	[0056.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSAddin.dll") returned 1
	[0056.260] lstrcmpiA (lpString1="", lpString2="BCSAddin.dll") returned -1
	[0056.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned="ACCOLK.DLL"
	[0056.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="BCSAddin.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll"
	[0056.260] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.260] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ColleagueImport.dll") returned 1
	[0056.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ColleagueImport.dll") returned 1
	[0056.260] lstrcmpiA (lpString1="", lpString2="ColleagueImport.dll") returned -1
	[0056.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned="BCSAddin.dll"
	[0056.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="ColleagueImport.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll"
	[0056.261] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FAXEXT.ECF") returned -1
	[0056.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FAXEXT.ECF") returned 1
	[0056.261] lstrcmpiA (lpString1="", lpString2="FAXEXT.ECF") returned -1
	[0056.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned="ColleagueImport.dll"
	[0056.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.261] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="FAXEXT.ECF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF"
	[0056.261] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSEC.DLL") returned -1
	[0056.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSEC.DLL") returned -1
	[0056.261] lstrcmpiA (lpString1="", lpString2="MSOSEC.DLL") returned -1
	[0056.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned="FAXEXT.ECF"
	[0056.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.261] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="MSOSEC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL"
	[0056.261] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSEC.XML") returned -1
	[0056.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSEC.XML") returned -1
	[0056.261] lstrcmpiA (lpString1="", lpString2="MSOSEC.XML") returned -1
	[0056.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned="MSOSEC.DLL"
	[0056.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="MSOSEC.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML"
	[0056.262] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.262] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.262] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSPC.ECF") returned -1
	[0056.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSPC.ECF") returned -1
	[0056.262] lstrcmpiA (lpString1="", lpString2="MSSPC.ECF") returned -1
	[0056.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML") returned="MSOSEC.XML"
	[0056.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="MSSPC.ECF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF"
	[0056.262] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.262] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.262] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="otkloadr_x64.dll") returned -1
	[0056.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="otkloadr_x64.dll") returned -1
	[0056.262] lstrcmpiA (lpString1="", lpString2="otkloadr_x64.dll") returned -1
	[0056.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned="MSSPC.ECF"
	[0056.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="otkloadr_x64.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll"
	[0056.262] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.262] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.262] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTEX.ECF") returned -1
	[0056.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTEX.ECF") returned -1
	[0056.262] lstrcmpiA (lpString1="", lpString2="OUTEX.ECF") returned -1
	[0056.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned="otkloadr_x64.dll"
	[0056.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.263] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="OUTEX.ECF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF"
	[0056.263] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.263] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTEX2.ECF") returned -1
	[0056.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTEX2.ECF") returned -1
	[0056.263] lstrcmpiA (lpString1="", lpString2="OUTEX2.ECF") returned -1
	[0056.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned="OUTEX.ECF"
	[0056.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.263] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="OUTEX2.ECF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF"
	[0056.263] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.263] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLVBA.DLL") returned -1
	[0056.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLVBA.DLL") returned -1
	[0056.263] lstrcmpiA (lpString1="", lpString2="OUTLVBA.DLL") returned -1
	[0056.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned="OUTEX2.ECF"
	[0056.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.263] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="OUTLVBA.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL"
	[0056.263] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.263] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PMAILEXT.ECF") returned -1
	[0056.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PMAILEXT.ECF") returned -1
	[0056.263] lstrcmpiA (lpString1="", lpString2="PMAILEXT.ECF") returned -1
	[0056.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned="OUTLVBA.DLL"
	[0056.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="PMAILEXT.ECF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF"
	[0056.264] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.264] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.264] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UmOutlookAddin.dll") returned -1
	[0056.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UmOutlookAddin.dll") returned -1
	[0056.264] lstrcmpiA (lpString1="", lpString2="UmOutlookAddin.dll") returned -1
	[0056.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned="PMAILEXT.ECF"
	[0056.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\"
	[0056.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned=""
	[0056.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt"
	[0056.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to decrypt files.txt")) returned 0x20
	[0056.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpString2="UmOutlookAddin.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll"
	[0056.264] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.264] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.264] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.264] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.264] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADVCMP.DIC") returned 1
	[0056.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADVCMP.DIC") returned 1
	[0056.264] lstrcmpiA (lpString1="", lpString2="ADVCMP.DIC") returned -1
	[0056.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ADVCMP.DIC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC"
	[0056.264] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.265] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.265] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADVTEL.DIC") returned 1
	[0056.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADVTEL.DIC") returned 1
	[0056.265] lstrcmpiA (lpString1="", lpString2="ADVTEL.DIC") returned -1
	[0056.265] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC") returned="ADVCMP.DIC"
	[0056.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.265] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ADVTEL.DIC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC"
	[0056.265] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.265] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.265] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADVZIP.DIC") returned 1
	[0056.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADVZIP.DIC") returned 1
	[0056.265] lstrcmpiA (lpString1="", lpString2="ADVZIP.DIC") returned -1
	[0056.265] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC") returned="ADVTEL.DIC"
	[0056.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.265] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ADVZIP.DIC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC"
	[0056.265] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.265] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.266] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AEC.DLL") returned 1
	[0056.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AEC.DLL") returned 1
	[0056.266] lstrcmpiA (lpString1="", lpString2="AEC.DLL") returned -1
	[0056.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC") returned="ADVZIP.DIC"
	[0056.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="AEC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL"
	[0056.266] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.266] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.266] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AECUTILS.DLL") returned 1
	[0056.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AECUTILS.DLL") returned 1
	[0056.266] lstrcmpiA (lpString1="", lpString2="AECUTILS.DLL") returned -1
	[0056.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned="AEC.DLL"
	[0056.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="AECUTILS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL"
	[0056.266] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.266] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.266] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ASCIIENG.LNG") returned 1
	[0056.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ASCIIENG.LNG") returned 1
	[0056.266] lstrcmpiA (lpString1="", lpString2="ASCIIENG.LNG") returned -1
	[0056.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned="AECUTILS.DLL"
	[0056.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ASCIIENG.LNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG"
	[0056.267] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.267] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.267] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AUDIOSEARCHLTS.DLL") returned 1
	[0056.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AUDIOSEARCHLTS.DLL") returned 1
	[0056.267] lstrcmpiA (lpString1="", lpString2="AUDIOSEARCHLTS.DLL") returned -1
	[0056.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned="ASCIIENG.LNG"
	[0056.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="AUDIOSEARCHLTS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL"
	[0056.267] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.267] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.267] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AUDIOSEARCHMAIN.DLL") returned 1
	[0056.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AUDIOSEARCHMAIN.DLL") returned 1
	[0056.267] lstrcmpiA (lpString1="", lpString2="AUDIOSEARCHMAIN.DLL") returned -1
	[0056.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned="AUDIOSEARCHLTS.DLL"
	[0056.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="AUDIOSEARCHMAIN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL"
	[0056.267] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.267] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.267] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AUDIOSEARCHSAPIFE.DLL") returned 1
	[0056.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AUDIOSEARCHSAPIFE.DLL") returned 1
	[0056.267] lstrcmpiA (lpString1="", lpString2="AUDIOSEARCHSAPIFE.DLL") returned -1
	[0056.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned="AUDIOSEARCHMAIN.DLL"
	[0056.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="AUDIOSEARCHSAPIFE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL"
	[0056.268] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.268] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AUTHZAX.DLL") returned 1
	[0056.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AUTHZAX.DLL") returned 1
	[0056.268] lstrcmpiA (lpString1="", lpString2="AUTHZAX.DLL") returned -1
	[0056.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned="AUDIOSEARCHSAPIFE.DLL"
	[0056.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="AUTHZAX.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL"
	[0056.268] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.268] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSAutogen.dll") returned 1
	[0056.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSAutogen.dll") returned 1
	[0056.268] lstrcmpiA (lpString1="", lpString2="BCSAutogen.dll") returned -1
	[0056.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned="AUTHZAX.DLL"
	[0056.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSAutogen.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll"
	[0056.268] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.268] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSClient.Msg.dll") returned 1
	[0056.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSClient.Msg.dll") returned 1
	[0056.268] lstrcmpiA (lpString1="", lpString2="BCSClient.Msg.dll") returned -1
	[0056.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned="BCSAutogen.dll"
	[0056.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSClient.Msg.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll"
	[0056.269] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSClientManifest.man") returned 1
	[0056.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSClientManifest.man") returned 1
	[0056.269] lstrcmpiA (lpString1="", lpString2="BCSClientManifest.man") returned -1
	[0056.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned="BCSClient.Msg.dll"
	[0056.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSClientManifest.man" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man"
	[0056.269] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSEvents.man") returned 1
	[0056.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSEvents.man") returned 1
	[0056.269] lstrcmpiA (lpString1="", lpString2="BCSEvents.man") returned -1
	[0056.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned="BCSClientManifest.man"
	[0056.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSEvents.man" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man"
	[0056.269] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSLaunch.dll") returned 1
	[0056.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSLaunch.dll") returned 1
	[0056.269] lstrcmpiA (lpString1="", lpString2="BCSLaunch.dll") returned -1
	[0056.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned="BCSEvents.man"
	[0056.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSLaunch.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll"
	[0056.270] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.270] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSProxy.dll") returned 1
	[0056.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSProxy.dll") returned 1
	[0056.270] lstrcmpiA (lpString1="", lpString2="BCSProxy.dll") returned -1
	[0056.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned="BCSLaunch.dll"
	[0056.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSProxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll"
	[0056.270] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.270] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSRuntime.dll") returned 1
	[0056.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSRuntime.dll") returned 1
	[0056.270] lstrcmpiA (lpString1="", lpString2="BCSRuntime.dll") returned -1
	[0056.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned="BCSProxy.dll"
	[0056.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSRuntime.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll"
	[0056.270] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.270] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSRuntimeUI.dll") returned 1
	[0056.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSRuntimeUI.dll") returned 1
	[0056.270] lstrcmpiA (lpString1="", lpString2="BCSRuntimeUI.dll") returned -1
	[0056.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned="BCSRuntime.dll"
	[0056.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSRuntimeUI.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll"
	[0056.271] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSStr32.dll") returned 1
	[0056.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSStr32.dll") returned 1
	[0056.271] lstrcmpiA (lpString1="", lpString2="BCSStr32.dll") returned -1
	[0056.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned="BCSRuntimeUI.dll"
	[0056.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSStr32.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll"
	[0056.271] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCSSync.exe") returned 1
	[0056.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSSync.exe") returned 1
	[0056.271] lstrcmpiA (lpString1="", lpString2="BCSSync.exe") returned -1
	[0056.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned="BCSStr32.dll"
	[0056.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BCSSync.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe"
	[0056.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe"
	[0056.271] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe"
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe."
	[0056.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.Boom"
	[0056.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0056.272] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b780
	[0056.272] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4183ed00, dwHighDateTime=0x1cac269), lpLastAccessTime=0x407536*(dwLowDateTime=0x5812f0f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4183ed00, dwHighDateTime=0x1cac269)) returned 1
	[0056.272] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.272] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1b75d, lpOverlapped=0x0) returned 1
	[0056.282] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned="BCSSync.exe"
	[0056.283] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.283] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1b75d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1b75d, lpOverlapped=0x0) returned 1
	[0056.283] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.283] CloseHandle (hObject=0x88) returned 1
	[0056.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.boom")) returned 1
	[0056.284] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.284] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.284] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bdcmetadata.xsd") returned 1
	[0056.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bdcmetadata.xsd") returned 1
	[0056.284] lstrcmpiA (lpString1="", lpString2="bdcmetadata.xsd") returned -1
	[0056.284] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned="BCSSync.exe"
	[0056.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.284] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.284] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="bdcmetadata.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd"
	[0056.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.zip") returned 0
	[0056.285] lstrlenA (lpString="*.zip") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.rar") returned 0
	[0056.285] lstrlenA (lpString="*.rar") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.7z") returned 0
	[0056.285] lstrlenA (lpString="*.7z") returned 4
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.tar") returned 0
	[0056.285] lstrlenA (lpString="*.tar") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.gzip") returned 0
	[0056.285] lstrlenA (lpString="*.gzip") returned 6
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.jpg") returned 0
	[0056.285] lstrlenA (lpString="*.jpg") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.jpeg") returned 0
	[0056.285] lstrlenA (lpString="*.jpeg") returned 6
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.psd") returned 0
	[0056.285] lstrlenA (lpString="*.psd") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.cdr") returned 0
	[0056.285] lstrlenA (lpString="*.cdr") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.dwg") returned 0
	[0056.285] lstrlenA (lpString="*.dwg") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.max") returned 0
	[0056.285] lstrlenA (lpString="*.max") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.bmp") returned 0
	[0056.285] lstrlenA (lpString="*.bmp") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.gif") returned 0
	[0056.285] lstrlenA (lpString="*.gif") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.png") returned 0
	[0056.285] lstrlenA (lpString="*.png") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.doc") returned 0
	[0056.285] lstrlenA (lpString="*.doc") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.docx") returned 0
	[0056.285] lstrlenA (lpString="*.docx") returned 6
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.xls") returned 0
	[0056.285] lstrlenA (lpString="*.xls") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.xlsx") returned 0
	[0056.285] lstrlenA (lpString="*.xlsx") returned 6
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.ppt") returned 0
	[0056.285] lstrlenA (lpString="*.ppt") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.pptx") returned 0
	[0056.285] lstrlenA (lpString="*.pptx") returned 6
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.txt") returned 0
	[0056.285] lstrlenA (lpString="*.txt") returned 5
	[0056.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.pdf") returned 0
	[0056.285] lstrlenA (lpString="*.pdf") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.djvu") returned 0
	[0056.286] lstrlenA (lpString="*.djvu") returned 6
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.htm") returned 0
	[0056.286] lstrlenA (lpString="*.htm") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.html") returned 0
	[0056.286] lstrlenA (lpString="*.html") returned 6
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mdb") returned 0
	[0056.286] lstrlenA (lpString="*.mdb") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.cer") returned 0
	[0056.286] lstrlenA (lpString="*.cer") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.p12") returned 0
	[0056.286] lstrlenA (lpString="*.p12") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.pfx") returned 0
	[0056.286] lstrlenA (lpString="*.pfx") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.kwm") returned 0
	[0056.286] lstrlenA (lpString="*.kwm") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.pwm") returned 0
	[0056.286] lstrlenA (lpString="*.pwm") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.1cd") returned 0
	[0056.286] lstrlenA (lpString="*.1cd") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.md") returned 0
	[0056.286] lstrlenA (lpString="*.md") returned 4
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mdf") returned 0
	[0056.286] lstrlenA (lpString="*.mdf") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.dbf") returned 0
	[0056.286] lstrlenA (lpString="*.dbf") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.odt") returned 0
	[0056.286] lstrlenA (lpString="*.odt") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.vob") returned 0
	[0056.286] lstrlenA (lpString="*.vob") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.ifo") returned 0
	[0056.286] lstrlenA (lpString="*.ifo") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.lnk") returned 0
	[0056.286] lstrlenA (lpString="*.lnk") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.torrent") returned 0
	[0056.286] lstrlenA (lpString="*.torrent") returned 9
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mov") returned 0
	[0056.286] lstrlenA (lpString="*.mov") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.m2v") returned 0
	[0056.286] lstrlenA (lpString="*.m2v") returned 5
	[0056.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.3gp") returned 0
	[0056.286] lstrlenA (lpString="*.3gp") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mpeg") returned 0
	[0056.287] lstrlenA (lpString="*.mpeg") returned 6
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mpg") returned 0
	[0056.287] lstrlenA (lpString="*.mpg") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.flv") returned 0
	[0056.287] lstrlenA (lpString="*.flv") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.avi") returned 0
	[0056.287] lstrlenA (lpString="*.avi") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mp4") returned 0
	[0056.287] lstrlenA (lpString="*.mp4") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.wmv") returned 0
	[0056.287] lstrlenA (lpString="*.wmv") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.divx") returned 0
	[0056.287] lstrlenA (lpString="*.divx") returned 6
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mkv") returned 0
	[0056.287] lstrlenA (lpString="*.mkv") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.mp3") returned 0
	[0056.287] lstrlenA (lpString="*.mp3") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.wav") returned 0
	[0056.287] lstrlenA (lpString="*.wav") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.flac") returned 0
	[0056.287] lstrlenA (lpString="*.flac") returned 6
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.ape") returned 0
	[0056.287] lstrlenA (lpString="*.ape") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.wma") returned 0
	[0056.287] lstrlenA (lpString="*.wma") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.ac3") returned 0
	[0056.287] lstrlenA (lpString="*.ac3") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.exe") returned 0
	[0056.287] lstrlenA (lpString="*.exe") returned 5
	[0056.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", pszSpec="*.apk") returned 0
	[0056.287] lstrlenA (lpString="*.apk") returned 5
	[0056.287] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.287] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.287] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bdcmetadataresource.xsd") returned 1
	[0056.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bdcmetadataresource.xsd") returned 1
	[0056.287] lstrcmpiA (lpString1="", lpString2="bdcmetadataresource.xsd") returned -1
	[0056.287] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd") returned="bdcmetadata.xsd"
	[0056.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.288] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.288] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="bdcmetadataresource.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd"
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.zip") returned 0
	[0056.288] lstrlenA (lpString="*.zip") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.rar") returned 0
	[0056.288] lstrlenA (lpString="*.rar") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.7z") returned 0
	[0056.288] lstrlenA (lpString="*.7z") returned 4
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.tar") returned 0
	[0056.288] lstrlenA (lpString="*.tar") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.gzip") returned 0
	[0056.288] lstrlenA (lpString="*.gzip") returned 6
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.jpg") returned 0
	[0056.288] lstrlenA (lpString="*.jpg") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.jpeg") returned 0
	[0056.288] lstrlenA (lpString="*.jpeg") returned 6
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.psd") returned 0
	[0056.288] lstrlenA (lpString="*.psd") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.cdr") returned 0
	[0056.288] lstrlenA (lpString="*.cdr") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.dwg") returned 0
	[0056.288] lstrlenA (lpString="*.dwg") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.max") returned 0
	[0056.288] lstrlenA (lpString="*.max") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.bmp") returned 0
	[0056.288] lstrlenA (lpString="*.bmp") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.gif") returned 0
	[0056.288] lstrlenA (lpString="*.gif") returned 5
	[0056.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.png") returned 0
	[0056.289] lstrlenA (lpString="*.png") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.doc") returned 0
	[0056.289] lstrlenA (lpString="*.doc") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.docx") returned 0
	[0056.289] lstrlenA (lpString="*.docx") returned 6
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.xls") returned 0
	[0056.289] lstrlenA (lpString="*.xls") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.xlsx") returned 0
	[0056.289] lstrlenA (lpString="*.xlsx") returned 6
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.ppt") returned 0
	[0056.289] lstrlenA (lpString="*.ppt") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.pptx") returned 0
	[0056.289] lstrlenA (lpString="*.pptx") returned 6
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.txt") returned 0
	[0056.289] lstrlenA (lpString="*.txt") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.pdf") returned 0
	[0056.289] lstrlenA (lpString="*.pdf") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.djvu") returned 0
	[0056.289] lstrlenA (lpString="*.djvu") returned 6
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.htm") returned 0
	[0056.289] lstrlenA (lpString="*.htm") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.html") returned 0
	[0056.289] lstrlenA (lpString="*.html") returned 6
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mdb") returned 0
	[0056.289] lstrlenA (lpString="*.mdb") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.cer") returned 0
	[0056.289] lstrlenA (lpString="*.cer") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.p12") returned 0
	[0056.289] lstrlenA (lpString="*.p12") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.pfx") returned 0
	[0056.289] lstrlenA (lpString="*.pfx") returned 5
	[0056.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.kwm") returned 0
	[0056.290] lstrlenA (lpString="*.kwm") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.pwm") returned 0
	[0056.290] lstrlenA (lpString="*.pwm") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.1cd") returned 0
	[0056.290] lstrlenA (lpString="*.1cd") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.md") returned 0
	[0056.290] lstrlenA (lpString="*.md") returned 4
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mdf") returned 0
	[0056.290] lstrlenA (lpString="*.mdf") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.dbf") returned 0
	[0056.290] lstrlenA (lpString="*.dbf") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.odt") returned 0
	[0056.290] lstrlenA (lpString="*.odt") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.vob") returned 0
	[0056.290] lstrlenA (lpString="*.vob") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.ifo") returned 0
	[0056.290] lstrlenA (lpString="*.ifo") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.lnk") returned 0
	[0056.290] lstrlenA (lpString="*.lnk") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.torrent") returned 0
	[0056.290] lstrlenA (lpString="*.torrent") returned 9
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mov") returned 0
	[0056.290] lstrlenA (lpString="*.mov") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.m2v") returned 0
	[0056.290] lstrlenA (lpString="*.m2v") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.3gp") returned 0
	[0056.290] lstrlenA (lpString="*.3gp") returned 5
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mpeg") returned 0
	[0056.290] lstrlenA (lpString="*.mpeg") returned 6
	[0056.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mpg") returned 0
	[0056.290] lstrlenA (lpString="*.mpg") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.flv") returned 0
	[0056.291] lstrlenA (lpString="*.flv") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.avi") returned 0
	[0056.291] lstrlenA (lpString="*.avi") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mp4") returned 0
	[0056.291] lstrlenA (lpString="*.mp4") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.wmv") returned 0
	[0056.291] lstrlenA (lpString="*.wmv") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.divx") returned 0
	[0056.291] lstrlenA (lpString="*.divx") returned 6
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mkv") returned 0
	[0056.291] lstrlenA (lpString="*.mkv") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.mp3") returned 0
	[0056.291] lstrlenA (lpString="*.mp3") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.wav") returned 0
	[0056.291] lstrlenA (lpString="*.wav") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.flac") returned 0
	[0056.291] lstrlenA (lpString="*.flac") returned 6
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.ape") returned 0
	[0056.291] lstrlenA (lpString="*.ape") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.wma") returned 0
	[0056.291] lstrlenA (lpString="*.wma") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.ac3") returned 0
	[0056.291] lstrlenA (lpString="*.ac3") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.exe") returned 0
	[0056.291] lstrlenA (lpString="*.exe") returned 5
	[0056.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", pszSpec="*.apk") returned 0
	[0056.291] lstrlenA (lpString="*.apk") returned 5
	[0056.291] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.291] lstrcmpA (lpString1=".", lpString2="Bibliography") returned -1
	[0056.291] lstrcmpA (lpString1="..", lpString2="Bibliography") returned -1
	[0056.291] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd") returned="bdcmetadataresource.xsd"
	[0056.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Bibliography" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography"
	[0056.292] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned 55
	[0056.292] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.305] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.305] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.305] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.305] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.305] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.305] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.305] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Author2String.XSL") returned 1
	[0056.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Author2String.XSL") returned 1
	[0056.305] lstrcmpiA (lpString1="", lpString2="Author2String.XSL") returned -1
	[0056.305] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*.*") returned="*.*"
	[0056.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\"
	[0056.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned=""
	[0056.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO DECRYPT FILES.txt"
	[0056.305] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\how to decrypt files.txt")) returned 0xffffffff
	[0056.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.306] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0056.306] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0056.307] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.307] CloseHandle (hObject=0x8c) returned 1
	[0056.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpString2="Author2String.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL"
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.zip") returned 0
	[0056.307] lstrlenA (lpString="*.zip") returned 5
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.rar") returned 0
	[0056.307] lstrlenA (lpString="*.rar") returned 5
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.7z") returned 0
	[0056.307] lstrlenA (lpString="*.7z") returned 4
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.tar") returned 0
	[0056.307] lstrlenA (lpString="*.tar") returned 5
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.gzip") returned 0
	[0056.307] lstrlenA (lpString="*.gzip") returned 6
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.jpg") returned 0
	[0056.307] lstrlenA (lpString="*.jpg") returned 5
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.jpeg") returned 0
	[0056.307] lstrlenA (lpString="*.jpeg") returned 6
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.psd") returned 0
	[0056.307] lstrlenA (lpString="*.psd") returned 5
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.cdr") returned 0
	[0056.307] lstrlenA (lpString="*.cdr") returned 5
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.dwg") returned 0
	[0056.307] lstrlenA (lpString="*.dwg") returned 5
	[0056.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.max") returned 0
	[0056.307] lstrlenA (lpString="*.max") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.bmp") returned 0
	[0056.308] lstrlenA (lpString="*.bmp") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.gif") returned 0
	[0056.308] lstrlenA (lpString="*.gif") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.png") returned 0
	[0056.308] lstrlenA (lpString="*.png") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.doc") returned 0
	[0056.308] lstrlenA (lpString="*.doc") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.docx") returned 0
	[0056.308] lstrlenA (lpString="*.docx") returned 6
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.xls") returned 0
	[0056.308] lstrlenA (lpString="*.xls") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.xlsx") returned 0
	[0056.308] lstrlenA (lpString="*.xlsx") returned 6
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.ppt") returned 0
	[0056.308] lstrlenA (lpString="*.ppt") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.pptx") returned 0
	[0056.308] lstrlenA (lpString="*.pptx") returned 6
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.txt") returned 0
	[0056.308] lstrlenA (lpString="*.txt") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.pdf") returned 0
	[0056.308] lstrlenA (lpString="*.pdf") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.djvu") returned 0
	[0056.308] lstrlenA (lpString="*.djvu") returned 6
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.htm") returned 0
	[0056.308] lstrlenA (lpString="*.htm") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.html") returned 0
	[0056.308] lstrlenA (lpString="*.html") returned 6
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mdb") returned 0
	[0056.308] lstrlenA (lpString="*.mdb") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.cer") returned 0
	[0056.308] lstrlenA (lpString="*.cer") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.p12") returned 0
	[0056.308] lstrlenA (lpString="*.p12") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.pfx") returned 0
	[0056.308] lstrlenA (lpString="*.pfx") returned 5
	[0056.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.kwm") returned 0
	[0056.308] lstrlenA (lpString="*.kwm") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.pwm") returned 0
	[0056.309] lstrlenA (lpString="*.pwm") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.1cd") returned 0
	[0056.309] lstrlenA (lpString="*.1cd") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.md") returned 0
	[0056.309] lstrlenA (lpString="*.md") returned 4
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mdf") returned 0
	[0056.309] lstrlenA (lpString="*.mdf") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.dbf") returned 0
	[0056.309] lstrlenA (lpString="*.dbf") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.odt") returned 0
	[0056.309] lstrlenA (lpString="*.odt") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.vob") returned 0
	[0056.309] lstrlenA (lpString="*.vob") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.ifo") returned 0
	[0056.309] lstrlenA (lpString="*.ifo") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.lnk") returned 0
	[0056.309] lstrlenA (lpString="*.lnk") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.torrent") returned 0
	[0056.309] lstrlenA (lpString="*.torrent") returned 9
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mov") returned 0
	[0056.309] lstrlenA (lpString="*.mov") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.m2v") returned 0
	[0056.309] lstrlenA (lpString="*.m2v") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.3gp") returned 0
	[0056.309] lstrlenA (lpString="*.3gp") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mpeg") returned 0
	[0056.309] lstrlenA (lpString="*.mpeg") returned 6
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mpg") returned 0
	[0056.309] lstrlenA (lpString="*.mpg") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.flv") returned 0
	[0056.309] lstrlenA (lpString="*.flv") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.avi") returned 0
	[0056.309] lstrlenA (lpString="*.avi") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mp4") returned 0
	[0056.309] lstrlenA (lpString="*.mp4") returned 5
	[0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.wmv") returned 0
	[0056.309] lstrlenA (lpString="*.wmv") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.divx") returned 0
	[0056.310] lstrlenA (lpString="*.divx") returned 6
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mkv") returned 0
	[0056.310] lstrlenA (lpString="*.mkv") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.mp3") returned 0
	[0056.310] lstrlenA (lpString="*.mp3") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.wav") returned 0
	[0056.310] lstrlenA (lpString="*.wav") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.flac") returned 0
	[0056.310] lstrlenA (lpString="*.flac") returned 6
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.ape") returned 0
	[0056.310] lstrlenA (lpString="*.ape") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.wma") returned 0
	[0056.310] lstrlenA (lpString="*.wma") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.ac3") returned 0
	[0056.310] lstrlenA (lpString="*.ac3") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.exe") returned 0
	[0056.310] lstrlenA (lpString="*.exe") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", pszSpec="*.apk") returned 0
	[0056.310] lstrlenA (lpString="*.apk") returned 5
	[0056.310] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.310] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.310] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Author2XML.XSL") returned 1
	[0056.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Author2XML.XSL") returned 1
	[0056.310] lstrcmpiA (lpString1="", lpString2="Author2XML.XSL") returned -1
	[0056.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL") returned="Author2String.XSL"
	[0056.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\"
	[0056.310] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned=""
	[0056.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO DECRYPT FILES.txt"
	[0056.310] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\how to decrypt files.txt")) returned 0x20
	[0056.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpString2="Author2XML.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL"
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.zip") returned 0
	[0056.310] lstrlenA (lpString="*.zip") returned 5
	[0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.rar") returned 0
	[0056.310] lstrlenA (lpString="*.rar") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.7z") returned 0
	[0056.311] lstrlenA (lpString="*.7z") returned 4
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.tar") returned 0
	[0056.311] lstrlenA (lpString="*.tar") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.gzip") returned 0
	[0056.311] lstrlenA (lpString="*.gzip") returned 6
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.jpg") returned 0
	[0056.311] lstrlenA (lpString="*.jpg") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.jpeg") returned 0
	[0056.311] lstrlenA (lpString="*.jpeg") returned 6
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.psd") returned 0
	[0056.311] lstrlenA (lpString="*.psd") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.cdr") returned 0
	[0056.311] lstrlenA (lpString="*.cdr") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.dwg") returned 0
	[0056.311] lstrlenA (lpString="*.dwg") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.max") returned 0
	[0056.311] lstrlenA (lpString="*.max") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.bmp") returned 0
	[0056.311] lstrlenA (lpString="*.bmp") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.gif") returned 0
	[0056.311] lstrlenA (lpString="*.gif") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.png") returned 0
	[0056.311] lstrlenA (lpString="*.png") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.doc") returned 0
	[0056.311] lstrlenA (lpString="*.doc") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.docx") returned 0
	[0056.311] lstrlenA (lpString="*.docx") returned 6
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.xls") returned 0
	[0056.311] lstrlenA (lpString="*.xls") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.xlsx") returned 0
	[0056.311] lstrlenA (lpString="*.xlsx") returned 6
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.ppt") returned 0
	[0056.311] lstrlenA (lpString="*.ppt") returned 5
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.pptx") returned 0
	[0056.311] lstrlenA (lpString="*.pptx") returned 6
	[0056.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.txt") returned 0
	[0056.311] lstrlenA (lpString="*.txt") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.pdf") returned 0
	[0056.312] lstrlenA (lpString="*.pdf") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.djvu") returned 0
	[0056.312] lstrlenA (lpString="*.djvu") returned 6
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.htm") returned 0
	[0056.312] lstrlenA (lpString="*.htm") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.html") returned 0
	[0056.312] lstrlenA (lpString="*.html") returned 6
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mdb") returned 0
	[0056.312] lstrlenA (lpString="*.mdb") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.cer") returned 0
	[0056.312] lstrlenA (lpString="*.cer") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.p12") returned 0
	[0056.312] lstrlenA (lpString="*.p12") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.pfx") returned 0
	[0056.312] lstrlenA (lpString="*.pfx") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.kwm") returned 0
	[0056.312] lstrlenA (lpString="*.kwm") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.pwm") returned 0
	[0056.312] lstrlenA (lpString="*.pwm") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.1cd") returned 0
	[0056.312] lstrlenA (lpString="*.1cd") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.md") returned 0
	[0056.312] lstrlenA (lpString="*.md") returned 4
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mdf") returned 0
	[0056.312] lstrlenA (lpString="*.mdf") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.dbf") returned 0
	[0056.312] lstrlenA (lpString="*.dbf") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.odt") returned 0
	[0056.312] lstrlenA (lpString="*.odt") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.vob") returned 0
	[0056.312] lstrlenA (lpString="*.vob") returned 5
	[0056.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.ifo") returned 0
	[0056.313] lstrlenA (lpString="*.ifo") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.lnk") returned 0
	[0056.313] lstrlenA (lpString="*.lnk") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.torrent") returned 0
	[0056.313] lstrlenA (lpString="*.torrent") returned 9
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mov") returned 0
	[0056.313] lstrlenA (lpString="*.mov") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.m2v") returned 0
	[0056.313] lstrlenA (lpString="*.m2v") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.3gp") returned 0
	[0056.313] lstrlenA (lpString="*.3gp") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mpeg") returned 0
	[0056.313] lstrlenA (lpString="*.mpeg") returned 6
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mpg") returned 0
	[0056.313] lstrlenA (lpString="*.mpg") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.flv") returned 0
	[0056.313] lstrlenA (lpString="*.flv") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.avi") returned 0
	[0056.313] lstrlenA (lpString="*.avi") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mp4") returned 0
	[0056.313] lstrlenA (lpString="*.mp4") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.wmv") returned 0
	[0056.313] lstrlenA (lpString="*.wmv") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.divx") returned 0
	[0056.313] lstrlenA (lpString="*.divx") returned 6
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mkv") returned 0
	[0056.313] lstrlenA (lpString="*.mkv") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.mp3") returned 0
	[0056.313] lstrlenA (lpString="*.mp3") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.wav") returned 0
	[0056.313] lstrlenA (lpString="*.wav") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.flac") returned 0
	[0056.313] lstrlenA (lpString="*.flac") returned 6
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.ape") returned 0
	[0056.313] lstrlenA (lpString="*.ape") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.wma") returned 0
	[0056.313] lstrlenA (lpString="*.wma") returned 5
	[0056.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.ac3") returned 0
	[0056.313] lstrlenA (lpString="*.ac3") returned 5
	[0056.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.exe") returned 0
	[0056.314] lstrlenA (lpString="*.exe") returned 5
	[0056.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", pszSpec="*.apk") returned 0
	[0056.314] lstrlenA (lpString="*.apk") returned 5
	[0056.314] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.314] lstrcmpA (lpString1=".", lpString2="Sort") returned -1
	[0056.314] lstrcmpA (lpString1="..", lpString2="Sort") returned -1
	[0056.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL") returned="Author2XML.XSL"
	[0056.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpString2="Sort" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort"
	[0056.314] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned 60
	[0056.314] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0056.315] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.315] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.315] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.315] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.315] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.315] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.315] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AUTHOR.XSL") returned 1
	[0056.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AUTHOR.XSL") returned 1
	[0056.315] lstrcmpiA (lpString1="", lpString2="AUTHOR.XSL") returned -1
	[0056.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*.*") returned="*.*"
	[0056.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\"
	[0056.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned=""
	[0056.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt"
	[0056.315] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\how to decrypt files.txt")) returned 0xffffffff
	[0056.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0056.316] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0056.316] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0056.317] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.317] CloseHandle (hObject=0x90) returned 1
	[0056.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="AUTHOR.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL"
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.zip") returned 0
	[0056.317] lstrlenA (lpString="*.zip") returned 5
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.rar") returned 0
	[0056.317] lstrlenA (lpString="*.rar") returned 5
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.7z") returned 0
	[0056.317] lstrlenA (lpString="*.7z") returned 4
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.tar") returned 0
	[0056.317] lstrlenA (lpString="*.tar") returned 5
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.gzip") returned 0
	[0056.317] lstrlenA (lpString="*.gzip") returned 6
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.jpg") returned 0
	[0056.317] lstrlenA (lpString="*.jpg") returned 5
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.jpeg") returned 0
	[0056.317] lstrlenA (lpString="*.jpeg") returned 6
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.psd") returned 0
	[0056.317] lstrlenA (lpString="*.psd") returned 5
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.cdr") returned 0
	[0056.317] lstrlenA (lpString="*.cdr") returned 5
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.dwg") returned 0
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.max") returned 0
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.bmp") returned 0
	[0056.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", pszSpec="*.gif") returned 0
	[0056.318] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAG.XSL") returned -1
	[0056.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAG.XSL") returned -1
	[0056.318] lstrcmpiA (lpString1="", lpString2="TAG.XSL") returned -1
	[0056.318] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL") returned="AUTHOR.XSL"
	[0056.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\"
	[0056.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned=""
	[0056.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt"
	[0056.318] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\how to decrypt files.txt")) returned 0x20
	[0056.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="TAG.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL"
	[0056.318] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TITLE.XSL") returned -1
	[0056.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TITLE.XSL") returned -1
	[0056.318] lstrcmpiA (lpString1="", lpString2="TITLE.XSL") returned -1
	[0056.318] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL") returned="TAG.XSL"
	[0056.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\"
	[0056.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned=""
	[0056.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt"
	[0056.318] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\how to decrypt files.txt")) returned 0x20
	[0056.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="TITLE.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL"
	[0056.318] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YEAR.XSL") returned -1
	[0056.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YEAR.XSL") returned -1
	[0056.318] lstrcmpiA (lpString1="", lpString2="YEAR.XSL") returned -1
	[0056.318] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL") returned="TITLE.XSL"
	[0056.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\"
	[0056.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned=""
	[0056.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt"
	[0056.319] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\how to decrypt files.txt")) returned 0x20
	[0056.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpString2="YEAR.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL"
	[0056.319] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0056.319] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0056.319] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.319] lstrcmpA (lpString1=".", lpString2="Style") returned -1
	[0056.319] lstrcmpA (lpString1="..", lpString2="Style") returned -1
	[0056.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*.*") returned="*.*"
	[0056.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpString2="Style" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style"
	[0056.319] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0056.326] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.326] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.326] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.326] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.326] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.326] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.327] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="APA.XSL") returned 1
	[0056.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="APA.XSL") returned 1
	[0056.327] lstrcmpiA (lpString1="", lpString2="APA.XSL") returned -1
	[0056.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*.*") returned="*.*"
	[0056.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.327] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.327] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0xffffffff
	[0056.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0056.329] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.329] CloseHandle (hObject=0x90) returned 1
	[0056.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="APA.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL"
	[0056.329] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.329] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.329] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHICAGO.XSL") returned 1
	[0056.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHICAGO.XSL") returned 1
	[0056.329] lstrcmpiA (lpString1="", lpString2="CHICAGO.XSL") returned -1
	[0056.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL") returned="APA.XSL"
	[0056.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.330] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.330] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="CHICAGO.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL"
	[0056.330] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.330] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GB.XSL") returned -1
	[0056.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GB.XSL") returned 1
	[0056.330] lstrcmpiA (lpString1="", lpString2="GB.XSL") returned -1
	[0056.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL") returned="CHICAGO.XSL"
	[0056.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.330] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.330] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="GB.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL"
	[0056.330] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.330] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GostName.XSL") returned -1
	[0056.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GostName.XSL") returned 1
	[0056.330] lstrcmpiA (lpString1="", lpString2="GostName.XSL") returned -1
	[0056.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL") returned="GB.XSL"
	[0056.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.330] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.330] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="GostName.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL"
	[0056.331] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.331] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GostTitle.XSL") returned -1
	[0056.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GostTitle.XSL") returned 1
	[0056.331] lstrcmpiA (lpString1="", lpString2="GostTitle.XSL") returned -1
	[0056.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL") returned="GostName.XSL"
	[0056.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="GostTitle.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL"
	[0056.331] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.331] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ISO690.XSL") returned -1
	[0056.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ISO690.XSL") returned -1
	[0056.331] lstrcmpiA (lpString1="", lpString2="ISO690.XSL") returned -1
	[0056.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL") returned="GostTitle.XSL"
	[0056.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="ISO690.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL"
	[0056.331] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.331] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ISO690Nmerical.XSL") returned -1
	[0056.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ISO690Nmerical.XSL") returned -1
	[0056.331] lstrcmpiA (lpString1="", lpString2="ISO690Nmerical.XSL") returned -1
	[0056.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL") returned="ISO690.XSL"
	[0056.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="ISO690Nmerical.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL"
	[0056.332] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.332] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MLA.XSL") returned -1
	[0056.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLA.XSL") returned -1
	[0056.332] lstrcmpiA (lpString1="", lpString2="MLA.XSL") returned -1
	[0056.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="ISO690Nmerical.XSL"
	[0056.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.332] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.332] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="MLA.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL"
	[0056.332] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.332] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SIST02.XSL") returned -1
	[0056.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SIST02.XSL") returned -1
	[0056.332] lstrcmpiA (lpString1="", lpString2="SIST02.XSL") returned -1
	[0056.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL") returned="MLA.XSL"
	[0056.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.332] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.332] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="SIST02.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL"
	[0056.332] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.332] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TURABIAN.XSL") returned -1
	[0056.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TURABIAN.XSL") returned -1
	[0056.332] lstrcmpiA (lpString1="", lpString2="TURABIAN.XSL") returned -1
	[0056.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL") returned="SIST02.XSL"
	[0056.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\"
	[0056.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned=""
	[0056.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt"
	[0056.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to decrypt files.txt")) returned 0x20
	[0056.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpString2="TURABIAN.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL"
	[0056.333] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0056.333] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0056.333] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.333] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.333] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.333] lstrcmpA (lpString1=".", lpString2="BORDERS") returned -1
	[0056.333] lstrcmpA (lpString1="..", lpString2="BORDERS") returned -1
	[0056.333] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BORDERS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS"
	[0056.333] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.340] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.340] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.340] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.340] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.340] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.340] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.340] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART1.BDR") returned -1
	[0056.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART1.BDR") returned -1
	[0056.340] lstrcmpiA (lpString1="", lpString2="MSART1.BDR") returned -1
	[0056.340] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*.*") returned="*.*"
	[0056.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.340] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0xffffffff
	[0056.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.341] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.341] CloseHandle (hObject=0x8c) returned 1
	[0056.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART1.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR"
	[0056.341] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.341] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.341] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART10.BDR") returned -1
	[0056.341] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART10.BDR") returned -1
	[0056.341] lstrcmpiA (lpString1="", lpString2="MSART10.BDR") returned -1
	[0056.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned="MSART1.BDR"
	[0056.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.342] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART10.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR"
	[0056.342] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.342] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.342] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART11.BDR") returned -1
	[0056.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART11.BDR") returned -1
	[0056.342] lstrcmpiA (lpString1="", lpString2="MSART11.BDR") returned -1
	[0056.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned="MSART10.BDR"
	[0056.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.342] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART11.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR"
	[0056.342] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.342] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.342] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART12.BDR") returned -1
	[0056.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART12.BDR") returned -1
	[0056.342] lstrcmpiA (lpString1="", lpString2="MSART12.BDR") returned -1
	[0056.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned="MSART11.BDR"
	[0056.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.342] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART12.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR"
	[0056.342] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.342] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.343] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART13.BDR") returned -1
	[0056.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART13.BDR") returned -1
	[0056.343] lstrcmpiA (lpString1="", lpString2="MSART13.BDR") returned -1
	[0056.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned="MSART12.BDR"
	[0056.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.343] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART13.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR"
	[0056.343] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.343] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.343] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART14.BDR") returned -1
	[0056.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART14.BDR") returned -1
	[0056.343] lstrcmpiA (lpString1="", lpString2="MSART14.BDR") returned -1
	[0056.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned="MSART13.BDR"
	[0056.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.343] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART14.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR"
	[0056.343] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.343] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.343] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART15.BDR") returned -1
	[0056.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART15.BDR") returned -1
	[0056.343] lstrcmpiA (lpString1="", lpString2="MSART15.BDR") returned -1
	[0056.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned="MSART14.BDR"
	[0056.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.344] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART15.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR"
	[0056.344] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART2.BDR") returned -1
	[0056.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART2.BDR") returned -1
	[0056.344] lstrcmpiA (lpString1="", lpString2="MSART2.BDR") returned -1
	[0056.344] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned="MSART15.BDR"
	[0056.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.344] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART2.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR"
	[0056.344] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART3.BDR") returned -1
	[0056.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART3.BDR") returned -1
	[0056.344] lstrcmpiA (lpString1="", lpString2="MSART3.BDR") returned -1
	[0056.344] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned="MSART2.BDR"
	[0056.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.344] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART3.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR"
	[0056.344] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART4.BDR") returned -1
	[0056.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART4.BDR") returned -1
	[0056.345] lstrcmpiA (lpString1="", lpString2="MSART4.BDR") returned -1
	[0056.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned="MSART3.BDR"
	[0056.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.345] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.345] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART4.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR"
	[0056.345] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART5.BDR") returned -1
	[0056.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART5.BDR") returned -1
	[0056.345] lstrcmpiA (lpString1="", lpString2="MSART5.BDR") returned -1
	[0056.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned="MSART4.BDR"
	[0056.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.345] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.345] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART5.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR"
	[0056.345] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART6.BDR") returned -1
	[0056.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART6.BDR") returned -1
	[0056.345] lstrcmpiA (lpString1="", lpString2="MSART6.BDR") returned -1
	[0056.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned="MSART5.BDR"
	[0056.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.345] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.345] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART6.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR"
	[0056.345] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.346] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART7.BDR") returned -1
	[0056.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART7.BDR") returned -1
	[0056.346] lstrcmpiA (lpString1="", lpString2="MSART7.BDR") returned -1
	[0056.346] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned="MSART6.BDR"
	[0056.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.346] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART7.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR"
	[0056.346] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.346] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART8.BDR") returned -1
	[0056.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART8.BDR") returned -1
	[0056.346] lstrcmpiA (lpString1="", lpString2="MSART8.BDR") returned -1
	[0056.346] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned="MSART7.BDR"
	[0056.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.346] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART8.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR"
	[0056.346] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.346] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSART9.BDR") returned -1
	[0056.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSART9.BDR") returned -1
	[0056.346] lstrcmpiA (lpString1="", lpString2="MSART9.BDR") returned -1
	[0056.346] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned="MSART8.BDR"
	[0056.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\"
	[0056.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned=""
	[0056.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt"
	[0056.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to decrypt files.txt")) returned 0x20
	[0056.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpString2="MSART9.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR"
	[0056.347] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.347] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.347] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.347] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.347] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BRTVIEW.DLL") returned 1
	[0056.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRTVIEW.DLL") returned 1
	[0056.347] lstrcmpiA (lpString1="", lpString2="BRTVIEW.DLL") returned -1
	[0056.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BRTVIEW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL"
	[0056.347] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.347] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.347] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BSTORM.DLL") returned 1
	[0056.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BSTORM.DLL") returned 1
	[0056.347] lstrcmpiA (lpString1="", lpString2="BSTORM.DLL") returned -1
	[0056.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned="BRTVIEW.DLL"
	[0056.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="BSTORM.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL"
	[0056.347] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.348] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.348] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CDLMSO.DLL") returned 1
	[0056.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CDLMSO.DLL") returned 1
	[0056.348] lstrcmpiA (lpString1="", lpString2="CDLMSO.DLL") returned -1
	[0056.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned="BSTORM.DLL"
	[0056.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.348] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CDLMSO.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL"
	[0056.348] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.348] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.348] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CGMIMP32.HLP") returned 1
	[0056.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CGMIMP32.HLP") returned 1
	[0056.348] lstrcmpiA (lpString1="", lpString2="CGMIMP32.HLP") returned -1
	[0056.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned="CDLMSO.DLL"
	[0056.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.348] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CGMIMP32.HLP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP"
	[0056.348] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.348] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.348] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CharSetTable.chr") returned 1
	[0056.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CharSetTable.chr") returned 1
	[0056.348] lstrcmpiA (lpString1="", lpString2="CharSetTable.chr") returned -1
	[0056.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned="CGMIMP32.HLP"
	[0056.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.349] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CharSetTable.chr" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr"
	[0056.349] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.349] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.349] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CLVIEW.EXE") returned 1
	[0056.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLVIEW.EXE") returned 1
	[0056.349] lstrcmpiA (lpString1="", lpString2="CLVIEW.EXE") returned -1
	[0056.349] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned="CharSetTable.chr"
	[0056.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.349] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CLVIEW.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE"
	[0056.349] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE"
	[0056.349] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE"
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE."
	[0056.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.Boom"
	[0056.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0056.350] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41f78
	[0056.350] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x22bf4c00, dwHighDateTime=0x1cba06e), lpLastAccessTime=0x407536*(dwLowDateTime=0xcf0edea0, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x22bf4c00, dwHighDateTime=0x1cba06e)) returned 1
	[0056.350] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.350] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x41f55, lpOverlapped=0x0) returned 1
	[0056.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned="CLVIEW.EXE"
	[0056.364] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.364] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x41f55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x41f55, lpOverlapped=0x0) returned 1
	[0056.365] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.365] CloseHandle (hObject=0x88) returned 1
	[0056.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.boom")) returned 1
	[0056.366] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.366] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.366] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CMAX20.DLL") returned 1
	[0056.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CMAX20.DLL") returned 1
	[0056.366] lstrcmpiA (lpString1="", lpString2="CMAX20.DLL") returned -1
	[0056.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned="CLVIEW.EXE"
	[0056.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CMAX20.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL"
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.zip") returned 0
	[0056.366] lstrlenA (lpString="*.zip") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.rar") returned 0
	[0056.366] lstrlenA (lpString="*.rar") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.7z") returned 0
	[0056.366] lstrlenA (lpString="*.7z") returned 4
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.tar") returned 0
	[0056.366] lstrlenA (lpString="*.tar") returned 5
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.gzip") returned 0
	[0056.366] lstrlenA (lpString="*.gzip") returned 6
	[0056.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.jpg") returned 0
	[0056.366] lstrlenA (lpString="*.jpg") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.jpeg") returned 0
	[0056.367] lstrlenA (lpString="*.jpeg") returned 6
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.psd") returned 0
	[0056.367] lstrlenA (lpString="*.psd") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.cdr") returned 0
	[0056.367] lstrlenA (lpString="*.cdr") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.dwg") returned 0
	[0056.367] lstrlenA (lpString="*.dwg") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.max") returned 0
	[0056.367] lstrlenA (lpString="*.max") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.bmp") returned 0
	[0056.367] lstrlenA (lpString="*.bmp") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.gif") returned 0
	[0056.367] lstrlenA (lpString="*.gif") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.png") returned 0
	[0056.367] lstrlenA (lpString="*.png") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.doc") returned 0
	[0056.367] lstrlenA (lpString="*.doc") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.docx") returned 0
	[0056.367] lstrlenA (lpString="*.docx") returned 6
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.xls") returned 0
	[0056.367] lstrlenA (lpString="*.xls") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.xlsx") returned 0
	[0056.367] lstrlenA (lpString="*.xlsx") returned 6
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.ppt") returned 0
	[0056.367] lstrlenA (lpString="*.ppt") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.pptx") returned 0
	[0056.367] lstrlenA (lpString="*.pptx") returned 6
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.txt") returned 0
	[0056.367] lstrlenA (lpString="*.txt") returned 5
	[0056.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.pdf") returned 0
	[0056.367] lstrlenA (lpString="*.pdf") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.djvu") returned 0
	[0056.368] lstrlenA (lpString="*.djvu") returned 6
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.htm") returned 0
	[0056.368] lstrlenA (lpString="*.htm") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.html") returned 0
	[0056.368] lstrlenA (lpString="*.html") returned 6
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mdb") returned 0
	[0056.368] lstrlenA (lpString="*.mdb") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.cer") returned 0
	[0056.368] lstrlenA (lpString="*.cer") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.p12") returned 0
	[0056.368] lstrlenA (lpString="*.p12") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.pfx") returned 0
	[0056.368] lstrlenA (lpString="*.pfx") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.kwm") returned 0
	[0056.368] lstrlenA (lpString="*.kwm") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.pwm") returned 0
	[0056.368] lstrlenA (lpString="*.pwm") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.1cd") returned 0
	[0056.368] lstrlenA (lpString="*.1cd") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.md") returned 0
	[0056.368] lstrlenA (lpString="*.md") returned 4
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mdf") returned 0
	[0056.368] lstrlenA (lpString="*.mdf") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.dbf") returned 0
	[0056.368] lstrlenA (lpString="*.dbf") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.odt") returned 0
	[0056.368] lstrlenA (lpString="*.odt") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.vob") returned 0
	[0056.368] lstrlenA (lpString="*.vob") returned 5
	[0056.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.ifo") returned 0
	[0056.368] lstrlenA (lpString="*.ifo") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.lnk") returned 0
	[0056.369] lstrlenA (lpString="*.lnk") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.torrent") returned 0
	[0056.369] lstrlenA (lpString="*.torrent") returned 9
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mov") returned 0
	[0056.369] lstrlenA (lpString="*.mov") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.m2v") returned 0
	[0056.369] lstrlenA (lpString="*.m2v") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.3gp") returned 0
	[0056.369] lstrlenA (lpString="*.3gp") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mpeg") returned 0
	[0056.369] lstrlenA (lpString="*.mpeg") returned 6
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mpg") returned 0
	[0056.369] lstrlenA (lpString="*.mpg") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.flv") returned 0
	[0056.369] lstrlenA (lpString="*.flv") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.avi") returned 0
	[0056.369] lstrlenA (lpString="*.avi") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mp4") returned 0
	[0056.369] lstrlenA (lpString="*.mp4") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.wmv") returned 0
	[0056.369] lstrlenA (lpString="*.wmv") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.divx") returned 0
	[0056.369] lstrlenA (lpString="*.divx") returned 6
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mkv") returned 0
	[0056.369] lstrlenA (lpString="*.mkv") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.mp3") returned 0
	[0056.369] lstrlenA (lpString="*.mp3") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.wav") returned 0
	[0056.369] lstrlenA (lpString="*.wav") returned 5
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.flac") returned 0
	[0056.369] lstrlenA (lpString="*.flac") returned 6
	[0056.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.ape") returned 0
	[0056.370] lstrlenA (lpString="*.ape") returned 5
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.wma") returned 0
	[0056.370] lstrlenA (lpString="*.wma") returned 5
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.ac3") returned 0
	[0056.370] lstrlenA (lpString="*.ac3") returned 5
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.exe") returned 0
	[0056.370] lstrlenA (lpString="*.exe") returned 5
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", pszSpec="*.apk") returned 0
	[0056.370] lstrlenA (lpString="*.apk") returned 5
	[0056.370] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.370] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.370] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CNFNOT32.EXE") returned 1
	[0056.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CNFNOT32.EXE") returned 1
	[0056.370] lstrcmpiA (lpString1="", lpString2="CNFNOT32.EXE") returned -1
	[0056.370] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned="CMAX20.DLL"
	[0056.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.370] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.370] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.370] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.370] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CNFNOT32.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE"
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.zip") returned 0
	[0056.370] lstrlenA (lpString="*.zip") returned 5
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.rar") returned 0
	[0056.370] lstrlenA (lpString="*.rar") returned 5
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.7z") returned 0
	[0056.370] lstrlenA (lpString="*.7z") returned 4
	[0056.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.tar") returned 0
	[0056.370] lstrlenA (lpString="*.tar") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.gzip") returned 0
	[0056.371] lstrlenA (lpString="*.gzip") returned 6
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.jpg") returned 0
	[0056.371] lstrlenA (lpString="*.jpg") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.jpeg") returned 0
	[0056.371] lstrlenA (lpString="*.jpeg") returned 6
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.psd") returned 0
	[0056.371] lstrlenA (lpString="*.psd") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.cdr") returned 0
	[0056.371] lstrlenA (lpString="*.cdr") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.dwg") returned 0
	[0056.371] lstrlenA (lpString="*.dwg") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.max") returned 0
	[0056.371] lstrlenA (lpString="*.max") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.bmp") returned 0
	[0056.371] lstrlenA (lpString="*.bmp") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.gif") returned 0
	[0056.371] lstrlenA (lpString="*.gif") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.png") returned 0
	[0056.371] lstrlenA (lpString="*.png") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.doc") returned 0
	[0056.371] lstrlenA (lpString="*.doc") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.docx") returned 0
	[0056.371] lstrlenA (lpString="*.docx") returned 6
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.xls") returned 0
	[0056.371] lstrlenA (lpString="*.xls") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.xlsx") returned 0
	[0056.371] lstrlenA (lpString="*.xlsx") returned 6
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.ppt") returned 0
	[0056.371] lstrlenA (lpString="*.ppt") returned 5
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.pptx") returned 0
	[0056.371] lstrlenA (lpString="*.pptx") returned 6
	[0056.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.txt") returned 0
	[0056.372] lstrlenA (lpString="*.txt") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.pdf") returned 0
	[0056.372] lstrlenA (lpString="*.pdf") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.djvu") returned 0
	[0056.372] lstrlenA (lpString="*.djvu") returned 6
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.htm") returned 0
	[0056.372] lstrlenA (lpString="*.htm") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.html") returned 0
	[0056.372] lstrlenA (lpString="*.html") returned 6
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mdb") returned 0
	[0056.372] lstrlenA (lpString="*.mdb") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.cer") returned 0
	[0056.372] lstrlenA (lpString="*.cer") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.p12") returned 0
	[0056.372] lstrlenA (lpString="*.p12") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.pfx") returned 0
	[0056.372] lstrlenA (lpString="*.pfx") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.kwm") returned 0
	[0056.372] lstrlenA (lpString="*.kwm") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.pwm") returned 0
	[0056.372] lstrlenA (lpString="*.pwm") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.1cd") returned 0
	[0056.372] lstrlenA (lpString="*.1cd") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.md") returned 0
	[0056.372] lstrlenA (lpString="*.md") returned 4
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mdf") returned 0
	[0056.372] lstrlenA (lpString="*.mdf") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.dbf") returned 0
	[0056.372] lstrlenA (lpString="*.dbf") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.odt") returned 0
	[0056.372] lstrlenA (lpString="*.odt") returned 5
	[0056.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.vob") returned 0
	[0056.373] lstrlenA (lpString="*.vob") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.ifo") returned 0
	[0056.373] lstrlenA (lpString="*.ifo") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.lnk") returned 0
	[0056.373] lstrlenA (lpString="*.lnk") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.torrent") returned 0
	[0056.373] lstrlenA (lpString="*.torrent") returned 9
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mov") returned 0
	[0056.373] lstrlenA (lpString="*.mov") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.m2v") returned 0
	[0056.373] lstrlenA (lpString="*.m2v") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.3gp") returned 0
	[0056.373] lstrlenA (lpString="*.3gp") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mpeg") returned 0
	[0056.373] lstrlenA (lpString="*.mpeg") returned 6
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mpg") returned 0
	[0056.373] lstrlenA (lpString="*.mpg") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.flv") returned 0
	[0056.373] lstrlenA (lpString="*.flv") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.avi") returned 0
	[0056.373] lstrlenA (lpString="*.avi") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mp4") returned 0
	[0056.373] lstrlenA (lpString="*.mp4") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.wmv") returned 0
	[0056.373] lstrlenA (lpString="*.wmv") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.divx") returned 0
	[0056.373] lstrlenA (lpString="*.divx") returned 6
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mkv") returned 0
	[0056.373] lstrlenA (lpString="*.mkv") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.mp3") returned 0
	[0056.373] lstrlenA (lpString="*.mp3") returned 5
	[0056.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.wav") returned 0
	[0056.373] lstrlenA (lpString="*.wav") returned 5
	[0056.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.flac") returned 0
	[0056.374] lstrlenA (lpString="*.flac") returned 6
	[0056.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.ape") returned 0
	[0056.374] lstrlenA (lpString="*.ape") returned 5
	[0056.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.wma") returned 0
	[0056.374] lstrlenA (lpString="*.wma") returned 5
	[0056.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.ac3") returned 0
	[0056.374] lstrlenA (lpString="*.ac3") returned 5
	[0056.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", pszSpec="*.exe") returned 1
	[0056.374] lstrlenA (lpString="*.exe") returned 5
	[0056.374] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE"
	[0056.374] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE"
	[0056.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE."
	[0056.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.Boom"
	[0056.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0056.375] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37160
	[0056.375] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdd250400, dwHighDateTime=0x1cac9b3), lpLastAccessTime=0x407536*(dwLowDateTime=0x603a86d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdd250400, dwHighDateTime=0x1cac9b3)) returned 1
	[0056.375] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.375] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3713d, lpOverlapped=0x0) returned 1
	[0056.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned="CNFNOT32.EXE"
	[0056.395] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.395] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3713d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3713d, lpOverlapped=0x0) returned 1
	[0056.396] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.396] CloseHandle (hObject=0x88) returned 1
	[0056.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.boom")) returned 1
	[0056.397] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.397] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.397] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CODEEDIT.DLL") returned 1
	[0056.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CODEEDIT.DLL") returned 1
	[0056.397] lstrcmpiA (lpString1="", lpString2="CODEEDIT.DLL") returned -1
	[0056.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned="CNFNOT32.EXE"
	[0056.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CODEEDIT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL"
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.zip") returned 0
	[0056.397] lstrlenA (lpString="*.zip") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.rar") returned 0
	[0056.397] lstrlenA (lpString="*.rar") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.7z") returned 0
	[0056.397] lstrlenA (lpString="*.7z") returned 4
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.tar") returned 0
	[0056.397] lstrlenA (lpString="*.tar") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.gzip") returned 0
	[0056.397] lstrlenA (lpString="*.gzip") returned 6
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.jpg") returned 0
	[0056.397] lstrlenA (lpString="*.jpg") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.jpeg") returned 0
	[0056.397] lstrlenA (lpString="*.jpeg") returned 6
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.psd") returned 0
	[0056.397] lstrlenA (lpString="*.psd") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.cdr") returned 0
	[0056.397] lstrlenA (lpString="*.cdr") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.dwg") returned 0
	[0056.397] lstrlenA (lpString="*.dwg") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.max") returned 0
	[0056.397] lstrlenA (lpString="*.max") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.bmp") returned 0
	[0056.397] lstrlenA (lpString="*.bmp") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.gif") returned 0
	[0056.397] lstrlenA (lpString="*.gif") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.png") returned 0
	[0056.397] lstrlenA (lpString="*.png") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.doc") returned 0
	[0056.397] lstrlenA (lpString="*.doc") returned 5
	[0056.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.docx") returned 0
	[0056.398] lstrlenA (lpString="*.docx") returned 6
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.xls") returned 0
	[0056.398] lstrlenA (lpString="*.xls") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.xlsx") returned 0
	[0056.398] lstrlenA (lpString="*.xlsx") returned 6
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.ppt") returned 0
	[0056.398] lstrlenA (lpString="*.ppt") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.pptx") returned 0
	[0056.398] lstrlenA (lpString="*.pptx") returned 6
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.txt") returned 0
	[0056.398] lstrlenA (lpString="*.txt") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.pdf") returned 0
	[0056.398] lstrlenA (lpString="*.pdf") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.djvu") returned 0
	[0056.398] lstrlenA (lpString="*.djvu") returned 6
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.htm") returned 0
	[0056.398] lstrlenA (lpString="*.htm") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.html") returned 0
	[0056.398] lstrlenA (lpString="*.html") returned 6
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mdb") returned 0
	[0056.398] lstrlenA (lpString="*.mdb") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.cer") returned 0
	[0056.398] lstrlenA (lpString="*.cer") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.p12") returned 0
	[0056.398] lstrlenA (lpString="*.p12") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.pfx") returned 0
	[0056.398] lstrlenA (lpString="*.pfx") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.kwm") returned 0
	[0056.398] lstrlenA (lpString="*.kwm") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.pwm") returned 0
	[0056.398] lstrlenA (lpString="*.pwm") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.1cd") returned 0
	[0056.398] lstrlenA (lpString="*.1cd") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.md") returned 0
	[0056.398] lstrlenA (lpString="*.md") returned 4
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mdf") returned 0
	[0056.398] lstrlenA (lpString="*.mdf") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.dbf") returned 0
	[0056.398] lstrlenA (lpString="*.dbf") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.odt") returned 0
	[0056.398] lstrlenA (lpString="*.odt") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.vob") returned 0
	[0056.398] lstrlenA (lpString="*.vob") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.ifo") returned 0
	[0056.398] lstrlenA (lpString="*.ifo") returned 5
	[0056.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.lnk") returned 0
	[0056.398] lstrlenA (lpString="*.lnk") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.torrent") returned 0
	[0056.399] lstrlenA (lpString="*.torrent") returned 9
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mov") returned 0
	[0056.399] lstrlenA (lpString="*.mov") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.m2v") returned 0
	[0056.399] lstrlenA (lpString="*.m2v") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.3gp") returned 0
	[0056.399] lstrlenA (lpString="*.3gp") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mpeg") returned 0
	[0056.399] lstrlenA (lpString="*.mpeg") returned 6
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mpg") returned 0
	[0056.399] lstrlenA (lpString="*.mpg") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.flv") returned 0
	[0056.399] lstrlenA (lpString="*.flv") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.avi") returned 0
	[0056.399] lstrlenA (lpString="*.avi") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mp4") returned 0
	[0056.399] lstrlenA (lpString="*.mp4") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.wmv") returned 0
	[0056.399] lstrlenA (lpString="*.wmv") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.divx") returned 0
	[0056.399] lstrlenA (lpString="*.divx") returned 6
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mkv") returned 0
	[0056.399] lstrlenA (lpString="*.mkv") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.mp3") returned 0
	[0056.399] lstrlenA (lpString="*.mp3") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.wav") returned 0
	[0056.399] lstrlenA (lpString="*.wav") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.flac") returned 0
	[0056.399] lstrlenA (lpString="*.flac") returned 6
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.ape") returned 0
	[0056.399] lstrlenA (lpString="*.ape") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.wma") returned 0
	[0056.399] lstrlenA (lpString="*.wma") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.ac3") returned 0
	[0056.399] lstrlenA (lpString="*.ac3") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.exe") returned 0
	[0056.399] lstrlenA (lpString="*.exe") returned 5
	[0056.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", pszSpec="*.apk") returned 0
	[0056.399] lstrlenA (lpString="*.apk") returned 5
	[0056.399] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.399] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.399] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONTAB32.DLL") returned 1
	[0056.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONTAB32.DLL") returned 1
	[0056.399] lstrcmpiA (lpString1="", lpString2="CONTAB32.DLL") returned -1
	[0056.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned="CODEEDIT.DLL"
	[0056.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.400] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.400] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CONTAB32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL"
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.zip") returned 0
	[0056.400] lstrlenA (lpString="*.zip") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.rar") returned 0
	[0056.400] lstrlenA (lpString="*.rar") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.7z") returned 0
	[0056.400] lstrlenA (lpString="*.7z") returned 4
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.tar") returned 0
	[0056.400] lstrlenA (lpString="*.tar") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.gzip") returned 0
	[0056.400] lstrlenA (lpString="*.gzip") returned 6
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.jpg") returned 0
	[0056.400] lstrlenA (lpString="*.jpg") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.jpeg") returned 0
	[0056.400] lstrlenA (lpString="*.jpeg") returned 6
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.psd") returned 0
	[0056.400] lstrlenA (lpString="*.psd") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.cdr") returned 0
	[0056.400] lstrlenA (lpString="*.cdr") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.dwg") returned 0
	[0056.400] lstrlenA (lpString="*.dwg") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.max") returned 0
	[0056.400] lstrlenA (lpString="*.max") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.bmp") returned 0
	[0056.400] lstrlenA (lpString="*.bmp") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.gif") returned 0
	[0056.400] lstrlenA (lpString="*.gif") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.png") returned 0
	[0056.400] lstrlenA (lpString="*.png") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.doc") returned 0
	[0056.400] lstrlenA (lpString="*.doc") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.docx") returned 0
	[0056.400] lstrlenA (lpString="*.docx") returned 6
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.xls") returned 0
	[0056.400] lstrlenA (lpString="*.xls") returned 5
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.xlsx") returned 0
	[0056.400] lstrlenA (lpString="*.xlsx") returned 6
	[0056.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.ppt") returned 0
	[0056.400] lstrlenA (lpString="*.ppt") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.pptx") returned 0
	[0056.401] lstrlenA (lpString="*.pptx") returned 6
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.txt") returned 0
	[0056.401] lstrlenA (lpString="*.txt") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.pdf") returned 0
	[0056.401] lstrlenA (lpString="*.pdf") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.djvu") returned 0
	[0056.401] lstrlenA (lpString="*.djvu") returned 6
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.htm") returned 0
	[0056.401] lstrlenA (lpString="*.htm") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.html") returned 0
	[0056.401] lstrlenA (lpString="*.html") returned 6
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mdb") returned 0
	[0056.401] lstrlenA (lpString="*.mdb") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.cer") returned 0
	[0056.401] lstrlenA (lpString="*.cer") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.p12") returned 0
	[0056.401] lstrlenA (lpString="*.p12") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.pfx") returned 0
	[0056.401] lstrlenA (lpString="*.pfx") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.kwm") returned 0
	[0056.401] lstrlenA (lpString="*.kwm") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.pwm") returned 0
	[0056.401] lstrlenA (lpString="*.pwm") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.1cd") returned 0
	[0056.401] lstrlenA (lpString="*.1cd") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.md") returned 0
	[0056.401] lstrlenA (lpString="*.md") returned 4
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mdf") returned 0
	[0056.401] lstrlenA (lpString="*.mdf") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.dbf") returned 0
	[0056.401] lstrlenA (lpString="*.dbf") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.odt") returned 0
	[0056.401] lstrlenA (lpString="*.odt") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.vob") returned 0
	[0056.401] lstrlenA (lpString="*.vob") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.ifo") returned 0
	[0056.401] lstrlenA (lpString="*.ifo") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.lnk") returned 0
	[0056.401] lstrlenA (lpString="*.lnk") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.torrent") returned 0
	[0056.401] lstrlenA (lpString="*.torrent") returned 9
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mov") returned 0
	[0056.401] lstrlenA (lpString="*.mov") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.m2v") returned 0
	[0056.401] lstrlenA (lpString="*.m2v") returned 5
	[0056.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.3gp") returned 0
	[0056.402] lstrlenA (lpString="*.3gp") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mpeg") returned 0
	[0056.402] lstrlenA (lpString="*.mpeg") returned 6
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mpg") returned 0
	[0056.402] lstrlenA (lpString="*.mpg") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.flv") returned 0
	[0056.402] lstrlenA (lpString="*.flv") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.avi") returned 0
	[0056.402] lstrlenA (lpString="*.avi") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mp4") returned 0
	[0056.402] lstrlenA (lpString="*.mp4") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.wmv") returned 0
	[0056.402] lstrlenA (lpString="*.wmv") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.divx") returned 0
	[0056.402] lstrlenA (lpString="*.divx") returned 6
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mkv") returned 0
	[0056.402] lstrlenA (lpString="*.mkv") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.mp3") returned 0
	[0056.402] lstrlenA (lpString="*.mp3") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.wav") returned 0
	[0056.402] lstrlenA (lpString="*.wav") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.flac") returned 0
	[0056.402] lstrlenA (lpString="*.flac") returned 6
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.ape") returned 0
	[0056.402] lstrlenA (lpString="*.ape") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.wma") returned 0
	[0056.402] lstrlenA (lpString="*.wma") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.ac3") returned 0
	[0056.402] lstrlenA (lpString="*.ac3") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.exe") returned 0
	[0056.402] lstrlenA (lpString="*.exe") returned 5
	[0056.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", pszSpec="*.apk") returned 0
	[0056.402] lstrlenA (lpString="*.apk") returned 5
	[0056.402] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.402] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ContactPicker.dll") returned 1
	[0056.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContactPicker.dll") returned 1
	[0056.402] lstrcmpiA (lpString1="", lpString2="ContactPicker.dll") returned -1
	[0056.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned="CONTAB32.DLL"
	[0056.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.402] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ContactPicker.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll"
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.zip") returned 0
	[0056.403] lstrlenA (lpString="*.zip") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.rar") returned 0
	[0056.403] lstrlenA (lpString="*.rar") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.7z") returned 0
	[0056.403] lstrlenA (lpString="*.7z") returned 4
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.tar") returned 0
	[0056.403] lstrlenA (lpString="*.tar") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.gzip") returned 0
	[0056.403] lstrlenA (lpString="*.gzip") returned 6
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.jpg") returned 0
	[0056.403] lstrlenA (lpString="*.jpg") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.jpeg") returned 0
	[0056.403] lstrlenA (lpString="*.jpeg") returned 6
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.psd") returned 0
	[0056.403] lstrlenA (lpString="*.psd") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.cdr") returned 0
	[0056.403] lstrlenA (lpString="*.cdr") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.dwg") returned 0
	[0056.403] lstrlenA (lpString="*.dwg") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.max") returned 0
	[0056.403] lstrlenA (lpString="*.max") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.bmp") returned 0
	[0056.403] lstrlenA (lpString="*.bmp") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.gif") returned 0
	[0056.403] lstrlenA (lpString="*.gif") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.png") returned 0
	[0056.403] lstrlenA (lpString="*.png") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.doc") returned 0
	[0056.403] lstrlenA (lpString="*.doc") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.docx") returned 0
	[0056.403] lstrlenA (lpString="*.docx") returned 6
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.xls") returned 0
	[0056.403] lstrlenA (lpString="*.xls") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.xlsx") returned 0
	[0056.403] lstrlenA (lpString="*.xlsx") returned 6
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.ppt") returned 0
	[0056.403] lstrlenA (lpString="*.ppt") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.pptx") returned 0
	[0056.403] lstrlenA (lpString="*.pptx") returned 6
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.txt") returned 0
	[0056.403] lstrlenA (lpString="*.txt") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.pdf") returned 0
	[0056.403] lstrlenA (lpString="*.pdf") returned 5
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.djvu") returned 0
	[0056.403] lstrlenA (lpString="*.djvu") returned 6
	[0056.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.htm") returned 0
	[0056.404] lstrlenA (lpString="*.htm") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.html") returned 0
	[0056.404] lstrlenA (lpString="*.html") returned 6
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mdb") returned 0
	[0056.404] lstrlenA (lpString="*.mdb") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.cer") returned 0
	[0056.404] lstrlenA (lpString="*.cer") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.p12") returned 0
	[0056.404] lstrlenA (lpString="*.p12") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.pfx") returned 0
	[0056.404] lstrlenA (lpString="*.pfx") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.kwm") returned 0
	[0056.404] lstrlenA (lpString="*.kwm") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.pwm") returned 0
	[0056.404] lstrlenA (lpString="*.pwm") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.1cd") returned 0
	[0056.404] lstrlenA (lpString="*.1cd") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.md") returned 0
	[0056.404] lstrlenA (lpString="*.md") returned 4
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mdf") returned 0
	[0056.404] lstrlenA (lpString="*.mdf") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.dbf") returned 0
	[0056.404] lstrlenA (lpString="*.dbf") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.odt") returned 0
	[0056.404] lstrlenA (lpString="*.odt") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.vob") returned 0
	[0056.404] lstrlenA (lpString="*.vob") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.ifo") returned 0
	[0056.404] lstrlenA (lpString="*.ifo") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.lnk") returned 0
	[0056.404] lstrlenA (lpString="*.lnk") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.torrent") returned 0
	[0056.404] lstrlenA (lpString="*.torrent") returned 9
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mov") returned 0
	[0056.404] lstrlenA (lpString="*.mov") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.m2v") returned 0
	[0056.404] lstrlenA (lpString="*.m2v") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.3gp") returned 0
	[0056.404] lstrlenA (lpString="*.3gp") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mpeg") returned 0
	[0056.404] lstrlenA (lpString="*.mpeg") returned 6
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mpg") returned 0
	[0056.404] lstrlenA (lpString="*.mpg") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.flv") returned 0
	[0056.404] lstrlenA (lpString="*.flv") returned 5
	[0056.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.avi") returned 0
	[0056.404] lstrlenA (lpString="*.avi") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mp4") returned 0
	[0056.405] lstrlenA (lpString="*.mp4") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.wmv") returned 0
	[0056.405] lstrlenA (lpString="*.wmv") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.divx") returned 0
	[0056.405] lstrlenA (lpString="*.divx") returned 6
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mkv") returned 0
	[0056.405] lstrlenA (lpString="*.mkv") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.mp3") returned 0
	[0056.405] lstrlenA (lpString="*.mp3") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.wav") returned 0
	[0056.405] lstrlenA (lpString="*.wav") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.flac") returned 0
	[0056.405] lstrlenA (lpString="*.flac") returned 6
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.ape") returned 0
	[0056.405] lstrlenA (lpString="*.ape") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.wma") returned 0
	[0056.405] lstrlenA (lpString="*.wma") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.ac3") returned 0
	[0056.405] lstrlenA (lpString="*.ac3") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.exe") returned 0
	[0056.405] lstrlenA (lpString="*.exe") returned 5
	[0056.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", pszSpec="*.apk") returned 0
	[0056.405] lstrlenA (lpString="*.apk") returned 5
	[0056.405] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.405] lstrcmpA (lpString1=".", lpString2="CONVERT") returned -1
	[0056.405] lstrcmpA (lpString1="..", lpString2="CONVERT") returned -1
	[0056.405] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned="ContactPicker.dll"
	[0056.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="CONVERT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT"
	[0056.405] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned 50
	[0056.405] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.419] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.419] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.419] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.419] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.419] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.419] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0056.419] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0056.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*.*") returned="*.*"
	[0056.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033"
	[0056.420] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned 55
	[0056.420] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0056.438] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.438] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.438] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.438] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.438] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.438] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACT3R.SAM") returned 1
	[0056.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACT3R.SAM") returned 1
	[0056.438] lstrcmpiA (lpString1="", lpString2="ACT3R.SAM") returned -1
	[0056.438] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*.*") returned="*.*"
	[0056.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.438] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.438] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0056.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0056.439] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0056.439] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0056.440] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.440] CloseHandle (hObject=0x90) returned 1
	[0056.440] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="ACT3R.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM"
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.zip") returned 0
	[0056.440] lstrlenA (lpString="*.zip") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.rar") returned 0
	[0056.440] lstrlenA (lpString="*.rar") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.7z") returned 0
	[0056.440] lstrlenA (lpString="*.7z") returned 4
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.tar") returned 0
	[0056.440] lstrlenA (lpString="*.tar") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.gzip") returned 0
	[0056.440] lstrlenA (lpString="*.gzip") returned 6
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.jpg") returned 0
	[0056.440] lstrlenA (lpString="*.jpg") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.jpeg") returned 0
	[0056.440] lstrlenA (lpString="*.jpeg") returned 6
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.psd") returned 0
	[0056.440] lstrlenA (lpString="*.psd") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.cdr") returned 0
	[0056.440] lstrlenA (lpString="*.cdr") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.dwg") returned 0
	[0056.440] lstrlenA (lpString="*.dwg") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.max") returned 0
	[0056.440] lstrlenA (lpString="*.max") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.bmp") returned 0
	[0056.440] lstrlenA (lpString="*.bmp") returned 5
	[0056.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.gif") returned 0
	[0056.441] lstrlenA (lpString="*.gif") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.png") returned 0
	[0056.441] lstrlenA (lpString="*.png") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.doc") returned 0
	[0056.441] lstrlenA (lpString="*.doc") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.docx") returned 0
	[0056.441] lstrlenA (lpString="*.docx") returned 6
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.xls") returned 0
	[0056.441] lstrlenA (lpString="*.xls") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.xlsx") returned 0
	[0056.441] lstrlenA (lpString="*.xlsx") returned 6
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.ppt") returned 0
	[0056.441] lstrlenA (lpString="*.ppt") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.pptx") returned 0
	[0056.441] lstrlenA (lpString="*.pptx") returned 6
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.txt") returned 0
	[0056.441] lstrlenA (lpString="*.txt") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.pdf") returned 0
	[0056.441] lstrlenA (lpString="*.pdf") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.djvu") returned 0
	[0056.441] lstrlenA (lpString="*.djvu") returned 6
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.htm") returned 0
	[0056.441] lstrlenA (lpString="*.htm") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.html") returned 0
	[0056.441] lstrlenA (lpString="*.html") returned 6
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mdb") returned 0
	[0056.441] lstrlenA (lpString="*.mdb") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.cer") returned 0
	[0056.441] lstrlenA (lpString="*.cer") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.p12") returned 0
	[0056.441] lstrlenA (lpString="*.p12") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.pfx") returned 0
	[0056.441] lstrlenA (lpString="*.pfx") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.kwm") returned 0
	[0056.441] lstrlenA (lpString="*.kwm") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.pwm") returned 0
	[0056.441] lstrlenA (lpString="*.pwm") returned 5
	[0056.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.1cd") returned 0
	[0056.441] lstrlenA (lpString="*.1cd") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.md") returned 0
	[0056.442] lstrlenA (lpString="*.md") returned 4
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mdf") returned 0
	[0056.442] lstrlenA (lpString="*.mdf") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.dbf") returned 0
	[0056.442] lstrlenA (lpString="*.dbf") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.odt") returned 0
	[0056.442] lstrlenA (lpString="*.odt") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.vob") returned 0
	[0056.442] lstrlenA (lpString="*.vob") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.ifo") returned 0
	[0056.442] lstrlenA (lpString="*.ifo") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.lnk") returned 0
	[0056.442] lstrlenA (lpString="*.lnk") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.torrent") returned 0
	[0056.442] lstrlenA (lpString="*.torrent") returned 9
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mov") returned 0
	[0056.442] lstrlenA (lpString="*.mov") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.m2v") returned 0
	[0056.442] lstrlenA (lpString="*.m2v") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.3gp") returned 0
	[0056.442] lstrlenA (lpString="*.3gp") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mpeg") returned 0
	[0056.442] lstrlenA (lpString="*.mpeg") returned 6
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mpg") returned 0
	[0056.442] lstrlenA (lpString="*.mpg") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.flv") returned 0
	[0056.442] lstrlenA (lpString="*.flv") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.avi") returned 0
	[0056.442] lstrlenA (lpString="*.avi") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mp4") returned 0
	[0056.442] lstrlenA (lpString="*.mp4") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.wmv") returned 0
	[0056.442] lstrlenA (lpString="*.wmv") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.divx") returned 0
	[0056.442] lstrlenA (lpString="*.divx") returned 6
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mkv") returned 0
	[0056.442] lstrlenA (lpString="*.mkv") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.mp3") returned 0
	[0056.442] lstrlenA (lpString="*.mp3") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.wav") returned 0
	[0056.442] lstrlenA (lpString="*.wav") returned 5
	[0056.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.flac") returned 0
	[0056.442] lstrlenA (lpString="*.flac") returned 6
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.ape") returned 0
	[0056.443] lstrlenA (lpString="*.ape") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.wma") returned 0
	[0056.443] lstrlenA (lpString="*.wma") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.ac3") returned 0
	[0056.443] lstrlenA (lpString="*.ac3") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.exe") returned 0
	[0056.443] lstrlenA (lpString="*.exe") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", pszSpec="*.apk") returned 0
	[0056.443] lstrlenA (lpString="*.apk") returned 5
	[0056.443] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.443] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.443] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELIMR.FAE") returned 1
	[0056.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELIMR.FAE") returned 1
	[0056.443] lstrcmpiA (lpString1="", lpString2="DELIMR.FAE") returned -1
	[0056.443] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned="ACT3R.SAM"
	[0056.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.443] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.443] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="DELIMR.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE"
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.zip") returned 0
	[0056.443] lstrlenA (lpString="*.zip") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.rar") returned 0
	[0056.443] lstrlenA (lpString="*.rar") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.7z") returned 0
	[0056.443] lstrlenA (lpString="*.7z") returned 4
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.tar") returned 0
	[0056.443] lstrlenA (lpString="*.tar") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.gzip") returned 0
	[0056.443] lstrlenA (lpString="*.gzip") returned 6
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.jpg") returned 0
	[0056.443] lstrlenA (lpString="*.jpg") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.jpeg") returned 0
	[0056.443] lstrlenA (lpString="*.jpeg") returned 6
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.psd") returned 0
	[0056.443] lstrlenA (lpString="*.psd") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.cdr") returned 0
	[0056.443] lstrlenA (lpString="*.cdr") returned 5
	[0056.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.dwg") returned 0
	[0056.444] lstrlenA (lpString="*.dwg") returned 5
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.max") returned 0
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.bmp") returned 0
	[0056.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", pszSpec="*.gif") returned 0
	[0056.444] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.444] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.444] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LOCALDV.DLL") returned -1
	[0056.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOCALDV.DLL") returned -1
	[0056.444] lstrcmpiA (lpString1="", lpString2="LOCALDV.DLL") returned -1
	[0056.444] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned="DELIMR.FAE"
	[0056.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.444] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="LOCALDV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL"
	[0056.444] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.444] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.444] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ODBCR.SAM") returned -1
	[0056.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODBCR.SAM") returned -1
	[0056.444] lstrcmpiA (lpString1="", lpString2="ODBCR.SAM") returned -1
	[0056.444] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned="LOCALDV.DLL"
	[0056.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.444] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="ODBCR.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM"
	[0056.445] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.445] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.445] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLADDR.FAE") returned -1
	[0056.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLADDR.FAE") returned -1
	[0056.445] lstrcmpiA (lpString1="", lpString2="OLADDR.FAE") returned -1
	[0056.445] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned="ODBCR.SAM"
	[0056.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.445] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.445] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.445] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="OLADDR.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE"
	[0056.445] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.445] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.445] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLAPPTR.FAE") returned -1
	[0056.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLAPPTR.FAE") returned -1
	[0056.445] lstrcmpiA (lpString1="", lpString2="OLAPPTR.FAE") returned -1
	[0056.445] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned="OLADDR.FAE"
	[0056.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.445] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.445] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.445] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="OLAPPTR.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE"
	[0056.445] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.445] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.445] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLJRNLR.FAE") returned -1
	[0056.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLJRNLR.FAE") returned -1
	[0056.445] lstrcmpiA (lpString1="", lpString2="OLJRNLR.FAE") returned -1
	[0056.445] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned="OLAPPTR.FAE"
	[0056.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.445] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.446] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="OLJRNLR.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE"
	[0056.446] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.446] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.446] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLMAILR.FAE") returned -1
	[0056.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLMAILR.FAE") returned -1
	[0056.446] lstrcmpiA (lpString1="", lpString2="OLMAILR.FAE") returned -1
	[0056.446] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned="OLJRNLR.FAE"
	[0056.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.446] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="OLMAILR.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE"
	[0056.446] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.446] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.446] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLNOTER.FAE") returned -1
	[0056.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLNOTER.FAE") returned -1
	[0056.446] lstrcmpiA (lpString1="", lpString2="OLNOTER.FAE") returned -1
	[0056.446] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned="OLMAILR.FAE"
	[0056.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.446] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="OLNOTER.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE"
	[0056.446] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.446] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.446] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLR.SAM") returned -1
	[0056.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLR.SAM") returned -1
	[0056.447] lstrcmpiA (lpString1="", lpString2="OLR.SAM") returned -1
	[0056.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned="OLNOTER.FAE"
	[0056.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.447] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="OLR.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM"
	[0056.447] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.447] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.447] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLTASKR.FAE") returned -1
	[0056.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLTASKR.FAE") returned -1
	[0056.447] lstrcmpiA (lpString1="", lpString2="OLTASKR.FAE") returned -1
	[0056.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned="OLR.SAM"
	[0056.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.447] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="OLTASKR.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE"
	[0056.447] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.447] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.447] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ORG97R.SAM") returned -1
	[0056.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORG97R.SAM") returned -1
	[0056.447] lstrcmpiA (lpString1="", lpString2="ORG97R.SAM") returned -1
	[0056.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned="OLTASKR.FAE"
	[0056.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.447] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="ORG97R.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM"
	[0056.448] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.448] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.448] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PABR.SAM") returned -1
	[0056.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PABR.SAM") returned -1
	[0056.448] lstrcmpiA (lpString1="", lpString2="PABR.SAM") returned -1
	[0056.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned="ORG97R.SAM"
	[0056.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.448] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="PABR.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM"
	[0056.448] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.448] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.448] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TRANSMRR.DLL") returned -1
	[0056.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TRANSMRR.DLL") returned -1
	[0056.448] lstrcmpiA (lpString1="", lpString2="TRANSMRR.DLL") returned -1
	[0056.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned="PABR.SAM"
	[0056.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\"
	[0056.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned=""
	[0056.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.448] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpString2="TRANSMRR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL"
	[0056.448] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0056.448] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0056.448] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.448] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.448] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACT3.SAM") returned 1
	[0056.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACT3.SAM") returned 1
	[0056.448] lstrcmpiA (lpString1="", lpString2="ACT3.SAM") returned -1
	[0056.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*.*") returned="*.*"
	[0056.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt"
	[0056.449] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt")) returned 0xffffffff
	[0056.449] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0056.455] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.456] CloseHandle (hObject=0x8c) returned 1
	[0056.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="ACT3.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM"
	[0056.456] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.456] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELIMDOS.FAE") returned 1
	[0056.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELIMDOS.FAE") returned 1
	[0056.456] lstrcmpiA (lpString1="", lpString2="DELIMDOS.FAE") returned -1
	[0056.456] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned="ACT3.SAM"
	[0056.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt"
	[0056.456] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt")) returned 0x20
	[0056.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="DELIMDOS.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE"
	[0056.456] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.456] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELIMWIN.FAE") returned 1
	[0056.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELIMWIN.FAE") returned 1
	[0056.456] lstrcmpiA (lpString1="", lpString2="DELIMWIN.FAE") returned -1
	[0056.456] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned="DELIMDOS.FAE"
	[0056.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt"
	[0056.456] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt")) returned 0x20
	[0056.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="DELIMWIN.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE"
	[0056.457] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.457] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DESKSAM.SAM") returned 1
	[0056.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DESKSAM.SAM") returned 1
	[0056.457] lstrcmpiA (lpString1="", lpString2="DESKSAM.SAM") returned -1
	[0056.457] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned="DELIMWIN.FAE"
	[0056.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt"
	[0056.457] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt")) returned 0x20
	[0056.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="DESKSAM.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM"
	[0056.457] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.457] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ODBC.SAM") returned -1
	[0056.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODBC.SAM") returned -1
	[0056.457] lstrcmpiA (lpString1="", lpString2="ODBC.SAM") returned -1
	[0056.457] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned="DESKSAM.SAM"
	[0056.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt"
	[0056.457] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt")) returned 0x20
	[0056.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="ODBC.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM"
	[0056.457] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.457] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OL.SAM") returned -1
	[0056.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OL.SAM") returned -1
	[0056.457] lstrcmpiA (lpString1="", lpString2="OL.SAM") returned -1
	[0056.457] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned="ODBC.SAM"
	[0056.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt"
	[0056.457] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt")) returned 0x20
	[0056.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="OL.SAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM"
	[0056.458] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.458] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.458] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLADD.FAE") returned -1
	[0056.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLADD.FAE") returned -1
	[0056.458] lstrcmpiA (lpString1="", lpString2="OLADD.FAE") returned -1
	[0056.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned="OL.SAM"
	[0056.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt"
	[0056.458] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to decrypt files.txt")) returned 0x20
	[0056.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpString2="OLADD.FAE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE"
	[0056.458] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.458] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.458] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLAPPT.FAE") returned -1
	[0056.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLAPPT.FAE") returned -1
	[0056.458] lstrcmpiA (lpString1="", lpString2="OLAPPT.FAE") returned -1
	[0056.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned="OLADD.FAE"
	[0056.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.458] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.459] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.459] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.459] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLJRNL.FAE") returned -1
	[0056.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLJRNL.FAE") returned -1
	[0056.459] lstrcmpiA (lpString1="", lpString2="OLJRNL.FAE") returned -1
	[0056.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned="OLAPPT.FAE"
	[0056.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.459] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.459] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.459] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLMAIL.FAE") returned -1
	[0056.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLMAIL.FAE") returned -1
	[0056.459] lstrcmpiA (lpString1="", lpString2="OLMAIL.FAE") returned -1
	[0056.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned="OLJRNL.FAE"
	[0056.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.459] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.459] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.459] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLNOTE.FAE") returned -1
	[0056.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLNOTE.FAE") returned -1
	[0056.459] lstrcmpiA (lpString1="", lpString2="OLNOTE.FAE") returned -1
	[0056.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned="OLMAIL.FAE"
	[0056.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.459] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.459] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLTASK.FAE") returned -1
	[0056.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLTASK.FAE") returned -1
	[0056.460] lstrcmpiA (lpString1="", lpString2="OLTASK.FAE") returned -1
	[0056.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned="OLNOTE.FAE"
	[0056.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.460] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ORG97.SAM") returned -1
	[0056.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORG97.SAM") returned -1
	[0056.460] lstrcmpiA (lpString1="", lpString2="ORG97.SAM") returned -1
	[0056.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned="OLTASK.FAE"
	[0056.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.460] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PAB.SAM") returned -1
	[0056.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PAB.SAM") returned -1
	[0056.460] lstrcmpiA (lpString1="", lpString2="PAB.SAM") returned -1
	[0056.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned="ORG97.SAM"
	[0056.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.460] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RM.DLL") returned -1
	[0056.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RM.DLL") returned -1
	[0056.460] lstrcmpiA (lpString1="", lpString2="RM.DLL") returned -1
	[0056.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned="PAB.SAM"
	[0056.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.460] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0056.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TRANSMGR.DLL") returned -1
	[0056.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TRANSMGR.DLL") returned -1
	[0056.461] lstrcmpiA (lpString1="", lpString2="TRANSMGR.DLL") returned -1
	[0056.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned="RM.DLL"
	[0056.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\"
	[0056.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned=""
	[0056.461] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.461] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.461] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.461] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CSS7DATA0009.DLL") returned 1
	[0056.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CSS7DATA0009.DLL") returned 1
	[0056.461] lstrcmpiA (lpString1="", lpString2="CSS7DATA0009.DLL") returned -1
	[0056.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.461] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.461] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CSS7DATA000A.DLL") returned 1
	[0056.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CSS7DATA000A.DLL") returned 1
	[0056.461] lstrcmpiA (lpString1="", lpString2="CSS7DATA000A.DLL") returned -1
	[0056.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned="CSS7DATA0009.DLL"
	[0056.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.461] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.461] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CSS7DATA000C.DLL") returned 1
	[0056.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CSS7DATA000C.DLL") returned 1
	[0056.461] lstrcmpiA (lpString1="", lpString2="CSS7DATA000C.DLL") returned -1
	[0056.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned="CSS7DATA000A.DLL"
	[0056.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Custom.propdesc") returned 1
	[0056.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Custom.propdesc") returned 1
	[0056.462] lstrcmpiA (lpString1="", lpString2="Custom.propdesc") returned -1
	[0056.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned="CSS7DATA000C.DLL"
	[0056.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DATAGATH.DLL") returned 1
	[0056.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATAGATH.DLL") returned 1
	[0056.462] lstrcmpiA (lpString1="", lpString2="DATAGATH.DLL") returned -1
	[0056.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned="Custom.propdesc"
	[0056.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DBENGR.DLL") returned 1
	[0056.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBENGR.DLL") returned 1
	[0056.462] lstrcmpiA (lpString1="", lpString2="DBENGR.DLL") returned -1
	[0056.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned="DATAGATH.DLL"
	[0056.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DBGHELP.DLL") returned 1
	[0056.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBGHELP.DLL") returned 1
	[0056.462] lstrcmpiA (lpString1="", lpString2="DBGHELP.DLL") returned -1
	[0056.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned="DBENGR.DLL"
	[0056.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.463] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.463] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.463] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DBSHARE.DLL") returned 1
	[0056.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBSHARE.DLL") returned 1
	[0056.463] lstrcmpiA (lpString1="", lpString2="DBSHARE.DLL") returned -1
	[0056.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned="DBGHELP.DLL"
	[0056.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.463] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.463] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.463] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DBWIZ.DLL") returned 1
	[0056.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBWIZ.DLL") returned 1
	[0056.463] lstrcmpiA (lpString1="", lpString2="DBWIZ.DLL") returned -1
	[0056.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned="DBSHARE.DLL"
	[0056.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.463] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.463] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.463] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DGRMLNCH.DLL") returned 1
	[0056.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DGRMLNCH.DLL") returned 1
	[0056.463] lstrcmpiA (lpString1="", lpString2="DGRMLNCH.DLL") returned -1
	[0056.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned="DBWIZ.DLL"
	[0056.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.463] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.463] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.463] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DLGSETP.DLL") returned 1
	[0056.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DLGSETP.DLL") returned 1
	[0056.464] lstrcmpiA (lpString1="", lpString2="DLGSETP.DLL") returned -1
	[0056.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned="DGRMLNCH.DLL"
	[0056.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.464] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.464] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.464] lstrcmpA (lpString1=".", lpString2="Document Parts") returned -1
	[0056.464] lstrcmpA (lpString1="..", lpString2="Document Parts") returned -1
	[0056.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned="DLGSETP.DLL"
	[0056.464] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.465] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.465] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.465] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.465] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.465] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.465] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0056.465] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0056.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*.*") returned="*.*"
	[0056.465] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0056.465] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.465] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.465] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.465] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.465] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.465] lstrcmpA (lpString1=".", lpString2="14") returned -1
	[0056.465] lstrcmpA (lpString1="..", lpString2="14") returned -1
	[0056.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*.*") returned="*.*"
	[0056.466] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0056.466] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.466] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0056.466] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.466] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.466] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0056.466] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0056.466] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Built-In Building Blocks.dotx") returned 1
	[0056.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Built-In Building Blocks.dotx") returned 1
	[0056.466] lstrcmpiA (lpString1="", lpString2="Built-In Building Blocks.dotx") returned -1
	[0056.466] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*.*") returned="*.*"
	[0056.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\"
	[0056.466] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\") returned=""
	[0056.469] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.469] CloseHandle (hObject=0x94) returned 1
	[0056.469] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0056.469] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0056.469] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0056.469] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0056.469] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.469] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.469] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.470] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DRILLDWN.DLL") returned 1
	[0056.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DRILLDWN.DLL") returned 1
	[0056.470] lstrcmpiA (lpString1="", lpString2="DRILLDWN.DLL") returned -1
	[0056.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0056.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.470] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.470] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DWGCNV.DLL") returned 1
	[0056.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DWGCNV.DLL") returned 1
	[0056.470] lstrcmpiA (lpString1="", lpString2="DWGCNV.DLL") returned -1
	[0056.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned="DRILLDWN.DLL"
	[0056.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.470] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.470] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DWGDP.DLL") returned 1
	[0056.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DWGDP.DLL") returned 1
	[0056.470] lstrcmpiA (lpString1="", lpString2="DWGDP.DLL") returned -1
	[0056.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned="DWGCNV.DLL"
	[0056.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.471] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.471] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.471] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EDITOR.EXE") returned -1
	[0056.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EDITOR.EXE") returned 1
	[0056.471] lstrcmpiA (lpString1="", lpString2="EDITOR.EXE") returned -1
	[0056.471] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned="DWGDP.DLL"
	[0056.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.471] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned="EDITOR.EXE"
	[0056.523] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.523] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x30945, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x30945, lpOverlapped=0x0) returned 1
	[0056.524] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.524] CloseHandle (hObject=0x88) returned 1
	[0056.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.boom")) returned 1
	[0056.525] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.525] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EDITORS.DLL") returned -1
	[0056.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EDITORS.DLL") returned 1
	[0056.525] lstrcmpiA (lpString1="", lpString2="EDITORS.DLL") returned -1
	[0056.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned="EDITOR.EXE"
	[0056.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.zip") returned 0
	[0056.526] lstrlenA (lpString="*.zip") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.rar") returned 0
	[0056.526] lstrlenA (lpString="*.rar") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.7z") returned 0
	[0056.526] lstrlenA (lpString="*.7z") returned 4
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.tar") returned 0
	[0056.526] lstrlenA (lpString="*.tar") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.gzip") returned 0
	[0056.526] lstrlenA (lpString="*.gzip") returned 6
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.jpg") returned 0
	[0056.526] lstrlenA (lpString="*.jpg") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.jpeg") returned 0
	[0056.526] lstrlenA (lpString="*.jpeg") returned 6
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.psd") returned 0
	[0056.526] lstrlenA (lpString="*.psd") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.cdr") returned 0
	[0056.526] lstrlenA (lpString="*.cdr") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.dwg") returned 0
	[0056.526] lstrlenA (lpString="*.dwg") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.max") returned 0
	[0056.526] lstrlenA (lpString="*.max") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.bmp") returned 0
	[0056.526] lstrlenA (lpString="*.bmp") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.gif") returned 0
	[0056.526] lstrlenA (lpString="*.gif") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.png") returned 0
	[0056.526] lstrlenA (lpString="*.png") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.doc") returned 0
	[0056.526] lstrlenA (lpString="*.doc") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.docx") returned 0
	[0056.526] lstrlenA (lpString="*.docx") returned 6
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.xls") returned 0
	[0056.526] lstrlenA (lpString="*.xls") returned 5
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.xlsx") returned 0
	[0056.526] lstrlenA (lpString="*.xlsx") returned 6
	[0056.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.ppt") returned 0
	[0056.527] lstrlenA (lpString="*.ppt") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.pptx") returned 0
	[0056.527] lstrlenA (lpString="*.pptx") returned 6
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.txt") returned 0
	[0056.527] lstrlenA (lpString="*.txt") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.pdf") returned 0
	[0056.527] lstrlenA (lpString="*.pdf") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.djvu") returned 0
	[0056.527] lstrlenA (lpString="*.djvu") returned 6
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.htm") returned 0
	[0056.527] lstrlenA (lpString="*.htm") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.html") returned 0
	[0056.527] lstrlenA (lpString="*.html") returned 6
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mdb") returned 0
	[0056.527] lstrlenA (lpString="*.mdb") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.cer") returned 0
	[0056.527] lstrlenA (lpString="*.cer") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.p12") returned 0
	[0056.527] lstrlenA (lpString="*.p12") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.pfx") returned 0
	[0056.527] lstrlenA (lpString="*.pfx") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.kwm") returned 0
	[0056.527] lstrlenA (lpString="*.kwm") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.pwm") returned 0
	[0056.527] lstrlenA (lpString="*.pwm") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.1cd") returned 0
	[0056.527] lstrlenA (lpString="*.1cd") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.md") returned 0
	[0056.527] lstrlenA (lpString="*.md") returned 4
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mdf") returned 0
	[0056.527] lstrlenA (lpString="*.mdf") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.dbf") returned 0
	[0056.527] lstrlenA (lpString="*.dbf") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.odt") returned 0
	[0056.527] lstrlenA (lpString="*.odt") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.vob") returned 0
	[0056.527] lstrlenA (lpString="*.vob") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.ifo") returned 0
	[0056.527] lstrlenA (lpString="*.ifo") returned 5
	[0056.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.lnk") returned 0
	[0056.527] lstrlenA (lpString="*.lnk") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.torrent") returned 0
	[0056.528] lstrlenA (lpString="*.torrent") returned 9
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mov") returned 0
	[0056.528] lstrlenA (lpString="*.mov") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.m2v") returned 0
	[0056.528] lstrlenA (lpString="*.m2v") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.3gp") returned 0
	[0056.528] lstrlenA (lpString="*.3gp") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mpeg") returned 0
	[0056.528] lstrlenA (lpString="*.mpeg") returned 6
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mpg") returned 0
	[0056.528] lstrlenA (lpString="*.mpg") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.flv") returned 0
	[0056.528] lstrlenA (lpString="*.flv") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.avi") returned 0
	[0056.528] lstrlenA (lpString="*.avi") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mp4") returned 0
	[0056.528] lstrlenA (lpString="*.mp4") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.wmv") returned 0
	[0056.528] lstrlenA (lpString="*.wmv") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.divx") returned 0
	[0056.528] lstrlenA (lpString="*.divx") returned 6
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mkv") returned 0
	[0056.528] lstrlenA (lpString="*.mkv") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.mp3") returned 0
	[0056.528] lstrlenA (lpString="*.mp3") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.wav") returned 0
	[0056.528] lstrlenA (lpString="*.wav") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.flac") returned 0
	[0056.528] lstrlenA (lpString="*.flac") returned 6
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.ape") returned 0
	[0056.528] lstrlenA (lpString="*.ape") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.wma") returned 0
	[0056.528] lstrlenA (lpString="*.wma") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.ac3") returned 0
	[0056.528] lstrlenA (lpString="*.ac3") returned 5
	[0056.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.exe") returned 0
	[0056.529] lstrlenA (lpString="*.exe") returned 5
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", pszSpec="*.apk") returned 0
	[0056.529] lstrlenA (lpString="*.apk") returned 5
	[0056.529] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.529] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ELEMENTS.DLL") returned -1
	[0056.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ELEMENTS.DLL") returned 1
	[0056.529] lstrcmpiA (lpString1="", lpString2="ELEMENTS.DLL") returned -1
	[0056.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned="EDITORS.DLL"
	[0056.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ELEMENTS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL"
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.zip") returned 0
	[0056.529] lstrlenA (lpString="*.zip") returned 5
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.rar") returned 0
	[0056.529] lstrlenA (lpString="*.rar") returned 5
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.7z") returned 0
	[0056.529] lstrlenA (lpString="*.7z") returned 4
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.tar") returned 0
	[0056.529] lstrlenA (lpString="*.tar") returned 5
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.gzip") returned 0
	[0056.529] lstrlenA (lpString="*.gzip") returned 6
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.jpg") returned 0
	[0056.529] lstrlenA (lpString="*.jpg") returned 5
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.jpeg") returned 0
	[0056.529] lstrlenA (lpString="*.jpeg") returned 6
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.psd") returned 0
	[0056.529] lstrlenA (lpString="*.psd") returned 5
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.cdr") returned 0
	[0056.529] lstrlenA (lpString="*.cdr") returned 5
	[0056.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.dwg") returned 0
	[0056.530] lstrlenA (lpString="*.dwg") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.max") returned 0
	[0056.530] lstrlenA (lpString="*.max") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.bmp") returned 0
	[0056.530] lstrlenA (lpString="*.bmp") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.gif") returned 0
	[0056.530] lstrlenA (lpString="*.gif") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.png") returned 0
	[0056.530] lstrlenA (lpString="*.png") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.doc") returned 0
	[0056.530] lstrlenA (lpString="*.doc") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.docx") returned 0
	[0056.530] lstrlenA (lpString="*.docx") returned 6
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.xls") returned 0
	[0056.530] lstrlenA (lpString="*.xls") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.xlsx") returned 0
	[0056.530] lstrlenA (lpString="*.xlsx") returned 6
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.ppt") returned 0
	[0056.530] lstrlenA (lpString="*.ppt") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.pptx") returned 0
	[0056.530] lstrlenA (lpString="*.pptx") returned 6
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.txt") returned 0
	[0056.530] lstrlenA (lpString="*.txt") returned 5
	[0056.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.pdf") returned 0
	[0056.530] lstrlenA (lpString="*.pdf") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.djvu") returned 0
	[0056.531] lstrlenA (lpString="*.djvu") returned 6
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.htm") returned 0
	[0056.531] lstrlenA (lpString="*.htm") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.html") returned 0
	[0056.531] lstrlenA (lpString="*.html") returned 6
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mdb") returned 0
	[0056.531] lstrlenA (lpString="*.mdb") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.cer") returned 0
	[0056.531] lstrlenA (lpString="*.cer") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.p12") returned 0
	[0056.531] lstrlenA (lpString="*.p12") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.pfx") returned 0
	[0056.531] lstrlenA (lpString="*.pfx") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.kwm") returned 0
	[0056.531] lstrlenA (lpString="*.kwm") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.pwm") returned 0
	[0056.531] lstrlenA (lpString="*.pwm") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.1cd") returned 0
	[0056.531] lstrlenA (lpString="*.1cd") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.md") returned 0
	[0056.531] lstrlenA (lpString="*.md") returned 4
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mdf") returned 0
	[0056.531] lstrlenA (lpString="*.mdf") returned 5
	[0056.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.dbf") returned 0
	[0056.532] lstrlenA (lpString="*.dbf") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.odt") returned 0
	[0056.532] lstrlenA (lpString="*.odt") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.vob") returned 0
	[0056.532] lstrlenA (lpString="*.vob") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.ifo") returned 0
	[0056.532] lstrlenA (lpString="*.ifo") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.lnk") returned 0
	[0056.532] lstrlenA (lpString="*.lnk") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.torrent") returned 0
	[0056.532] lstrlenA (lpString="*.torrent") returned 9
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mov") returned 0
	[0056.532] lstrlenA (lpString="*.mov") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.m2v") returned 0
	[0056.532] lstrlenA (lpString="*.m2v") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.3gp") returned 0
	[0056.532] lstrlenA (lpString="*.3gp") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mpeg") returned 0
	[0056.532] lstrlenA (lpString="*.mpeg") returned 6
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mpg") returned 0
	[0056.532] lstrlenA (lpString="*.mpg") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.flv") returned 0
	[0056.532] lstrlenA (lpString="*.flv") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.avi") returned 0
	[0056.532] lstrlenA (lpString="*.avi") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mp4") returned 0
	[0056.532] lstrlenA (lpString="*.mp4") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.wmv") returned 0
	[0056.532] lstrlenA (lpString="*.wmv") returned 5
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.divx") returned 0
	[0056.532] lstrlenA (lpString="*.divx") returned 6
	[0056.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mkv") returned 0
	[0056.533] lstrlenA (lpString="*.mkv") returned 5
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.mp3") returned 0
	[0056.533] lstrlenA (lpString="*.mp3") returned 5
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.wav") returned 0
	[0056.533] lstrlenA (lpString="*.wav") returned 5
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.flac") returned 0
	[0056.533] lstrlenA (lpString="*.flac") returned 6
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.ape") returned 0
	[0056.533] lstrlenA (lpString="*.ape") returned 5
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.wma") returned 0
	[0056.533] lstrlenA (lpString="*.wma") returned 5
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.ac3") returned 0
	[0056.533] lstrlenA (lpString="*.ac3") returned 5
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.exe") returned 0
	[0056.533] lstrlenA (lpString="*.exe") returned 5
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", pszSpec="*.apk") returned 0
	[0056.533] lstrlenA (lpString="*.apk") returned 5
	[0056.533] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.533] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.533] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ELEMUTIL.DLL") returned -1
	[0056.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ELEMUTIL.DLL") returned 1
	[0056.533] lstrcmpiA (lpString1="", lpString2="ELEMUTIL.DLL") returned -1
	[0056.533] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned="ELEMENTS.DLL"
	[0056.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.533] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ELEMUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL"
	[0056.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.zip") returned 0
	[0056.534] lstrlenA (lpString="*.zip") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.rar") returned 0
	[0056.534] lstrlenA (lpString="*.rar") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.7z") returned 0
	[0056.534] lstrlenA (lpString="*.7z") returned 4
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.tar") returned 0
	[0056.534] lstrlenA (lpString="*.tar") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.gzip") returned 0
	[0056.534] lstrlenA (lpString="*.gzip") returned 6
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.jpg") returned 0
	[0056.534] lstrlenA (lpString="*.jpg") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.jpeg") returned 0
	[0056.534] lstrlenA (lpString="*.jpeg") returned 6
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.psd") returned 0
	[0056.534] lstrlenA (lpString="*.psd") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.cdr") returned 0
	[0056.534] lstrlenA (lpString="*.cdr") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.dwg") returned 0
	[0056.534] lstrlenA (lpString="*.dwg") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.max") returned 0
	[0056.534] lstrlenA (lpString="*.max") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.bmp") returned 0
	[0056.534] lstrlenA (lpString="*.bmp") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.gif") returned 0
	[0056.534] lstrlenA (lpString="*.gif") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.png") returned 0
	[0056.534] lstrlenA (lpString="*.png") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.doc") returned 0
	[0056.534] lstrlenA (lpString="*.doc") returned 5
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.docx") returned 0
	[0056.534] lstrlenA (lpString="*.docx") returned 6
	[0056.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.xls") returned 0
	[0056.535] lstrlenA (lpString="*.xls") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.xlsx") returned 0
	[0056.535] lstrlenA (lpString="*.xlsx") returned 6
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.ppt") returned 0
	[0056.535] lstrlenA (lpString="*.ppt") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.pptx") returned 0
	[0056.535] lstrlenA (lpString="*.pptx") returned 6
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.txt") returned 0
	[0056.535] lstrlenA (lpString="*.txt") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.pdf") returned 0
	[0056.535] lstrlenA (lpString="*.pdf") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.djvu") returned 0
	[0056.535] lstrlenA (lpString="*.djvu") returned 6
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.htm") returned 0
	[0056.535] lstrlenA (lpString="*.htm") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.html") returned 0
	[0056.535] lstrlenA (lpString="*.html") returned 6
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mdb") returned 0
	[0056.535] lstrlenA (lpString="*.mdb") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.cer") returned 0
	[0056.535] lstrlenA (lpString="*.cer") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.p12") returned 0
	[0056.535] lstrlenA (lpString="*.p12") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.pfx") returned 0
	[0056.535] lstrlenA (lpString="*.pfx") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.kwm") returned 0
	[0056.535] lstrlenA (lpString="*.kwm") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.pwm") returned 0
	[0056.535] lstrlenA (lpString="*.pwm") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.1cd") returned 0
	[0056.535] lstrlenA (lpString="*.1cd") returned 5
	[0056.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.md") returned 0
	[0056.536] lstrlenA (lpString="*.md") returned 4
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mdf") returned 0
	[0056.536] lstrlenA (lpString="*.mdf") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.dbf") returned 0
	[0056.536] lstrlenA (lpString="*.dbf") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.odt") returned 0
	[0056.536] lstrlenA (lpString="*.odt") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.vob") returned 0
	[0056.536] lstrlenA (lpString="*.vob") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.ifo") returned 0
	[0056.536] lstrlenA (lpString="*.ifo") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.lnk") returned 0
	[0056.536] lstrlenA (lpString="*.lnk") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.torrent") returned 0
	[0056.536] lstrlenA (lpString="*.torrent") returned 9
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mov") returned 0
	[0056.536] lstrlenA (lpString="*.mov") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.m2v") returned 0
	[0056.536] lstrlenA (lpString="*.m2v") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.3gp") returned 0
	[0056.536] lstrlenA (lpString="*.3gp") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mpeg") returned 0
	[0056.536] lstrlenA (lpString="*.mpeg") returned 6
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mpg") returned 0
	[0056.536] lstrlenA (lpString="*.mpg") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.flv") returned 0
	[0056.536] lstrlenA (lpString="*.flv") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.avi") returned 0
	[0056.536] lstrlenA (lpString="*.avi") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mp4") returned 0
	[0056.536] lstrlenA (lpString="*.mp4") returned 5
	[0056.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.wmv") returned 0
	[0056.536] lstrlenA (lpString="*.wmv") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.divx") returned 0
	[0056.537] lstrlenA (lpString="*.divx") returned 6
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mkv") returned 0
	[0056.537] lstrlenA (lpString="*.mkv") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.mp3") returned 0
	[0056.537] lstrlenA (lpString="*.mp3") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.wav") returned 0
	[0056.537] lstrlenA (lpString="*.wav") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.flac") returned 0
	[0056.537] lstrlenA (lpString="*.flac") returned 6
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.ape") returned 0
	[0056.537] lstrlenA (lpString="*.ape") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.wma") returned 0
	[0056.537] lstrlenA (lpString="*.wma") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.ac3") returned 0
	[0056.537] lstrlenA (lpString="*.ac3") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.exe") returned 0
	[0056.537] lstrlenA (lpString="*.exe") returned 5
	[0056.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", pszSpec="*.apk") returned 0
	[0056.537] lstrlenA (lpString="*.apk") returned 5
	[0056.537] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.537] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.537] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EMABLT32.DLL") returned -1
	[0056.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EMABLT32.DLL") returned 1
	[0056.537] lstrcmpiA (lpString1="", lpString2="EMABLT32.DLL") returned -1
	[0056.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned="ELEMUTIL.DLL"
	[0056.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.537] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.537] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EMABLT32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL"
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.zip") returned 0
	[0056.538] lstrlenA (lpString="*.zip") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.rar") returned 0
	[0056.538] lstrlenA (lpString="*.rar") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.7z") returned 0
	[0056.538] lstrlenA (lpString="*.7z") returned 4
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.tar") returned 0
	[0056.538] lstrlenA (lpString="*.tar") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.gzip") returned 0
	[0056.538] lstrlenA (lpString="*.gzip") returned 6
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.jpg") returned 0
	[0056.538] lstrlenA (lpString="*.jpg") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.jpeg") returned 0
	[0056.538] lstrlenA (lpString="*.jpeg") returned 6
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.psd") returned 0
	[0056.538] lstrlenA (lpString="*.psd") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.cdr") returned 0
	[0056.538] lstrlenA (lpString="*.cdr") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.dwg") returned 0
	[0056.538] lstrlenA (lpString="*.dwg") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.max") returned 0
	[0056.538] lstrlenA (lpString="*.max") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.bmp") returned 0
	[0056.538] lstrlenA (lpString="*.bmp") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.gif") returned 0
	[0056.538] lstrlenA (lpString="*.gif") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.png") returned 0
	[0056.538] lstrlenA (lpString="*.png") returned 5
	[0056.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.doc") returned 0
	[0056.538] lstrlenA (lpString="*.doc") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.docx") returned 0
	[0056.539] lstrlenA (lpString="*.docx") returned 6
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.xls") returned 0
	[0056.539] lstrlenA (lpString="*.xls") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.xlsx") returned 0
	[0056.539] lstrlenA (lpString="*.xlsx") returned 6
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.ppt") returned 0
	[0056.539] lstrlenA (lpString="*.ppt") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.pptx") returned 0
	[0056.539] lstrlenA (lpString="*.pptx") returned 6
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.txt") returned 0
	[0056.539] lstrlenA (lpString="*.txt") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.pdf") returned 0
	[0056.539] lstrlenA (lpString="*.pdf") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.djvu") returned 0
	[0056.539] lstrlenA (lpString="*.djvu") returned 6
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.htm") returned 0
	[0056.539] lstrlenA (lpString="*.htm") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.html") returned 0
	[0056.539] lstrlenA (lpString="*.html") returned 6
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mdb") returned 0
	[0056.539] lstrlenA (lpString="*.mdb") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.cer") returned 0
	[0056.539] lstrlenA (lpString="*.cer") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.p12") returned 0
	[0056.539] lstrlenA (lpString="*.p12") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.pfx") returned 0
	[0056.539] lstrlenA (lpString="*.pfx") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.kwm") returned 0
	[0056.539] lstrlenA (lpString="*.kwm") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.pwm") returned 0
	[0056.539] lstrlenA (lpString="*.pwm") returned 5
	[0056.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.1cd") returned 0
	[0056.540] lstrlenA (lpString="*.1cd") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.md") returned 0
	[0056.540] lstrlenA (lpString="*.md") returned 4
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mdf") returned 0
	[0056.540] lstrlenA (lpString="*.mdf") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.dbf") returned 0
	[0056.540] lstrlenA (lpString="*.dbf") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.odt") returned 0
	[0056.540] lstrlenA (lpString="*.odt") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.vob") returned 0
	[0056.540] lstrlenA (lpString="*.vob") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.ifo") returned 0
	[0056.540] lstrlenA (lpString="*.ifo") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.lnk") returned 0
	[0056.540] lstrlenA (lpString="*.lnk") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.torrent") returned 0
	[0056.540] lstrlenA (lpString="*.torrent") returned 9
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mov") returned 0
	[0056.540] lstrlenA (lpString="*.mov") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.m2v") returned 0
	[0056.540] lstrlenA (lpString="*.m2v") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.3gp") returned 0
	[0056.540] lstrlenA (lpString="*.3gp") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mpeg") returned 0
	[0056.540] lstrlenA (lpString="*.mpeg") returned 6
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mpg") returned 0
	[0056.540] lstrlenA (lpString="*.mpg") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.flv") returned 0
	[0056.540] lstrlenA (lpString="*.flv") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.avi") returned 0
	[0056.540] lstrlenA (lpString="*.avi") returned 5
	[0056.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mp4") returned 0
	[0056.541] lstrlenA (lpString="*.mp4") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.wmv") returned 0
	[0056.541] lstrlenA (lpString="*.wmv") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.divx") returned 0
	[0056.541] lstrlenA (lpString="*.divx") returned 6
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mkv") returned 0
	[0056.541] lstrlenA (lpString="*.mkv") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.mp3") returned 0
	[0056.541] lstrlenA (lpString="*.mp3") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.wav") returned 0
	[0056.541] lstrlenA (lpString="*.wav") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.flac") returned 0
	[0056.541] lstrlenA (lpString="*.flac") returned 6
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.ape") returned 0
	[0056.541] lstrlenA (lpString="*.ape") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.wma") returned 0
	[0056.541] lstrlenA (lpString="*.wma") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.ac3") returned 0
	[0056.541] lstrlenA (lpString="*.ac3") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.exe") returned 0
	[0056.541] lstrlenA (lpString="*.exe") returned 5
	[0056.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", pszSpec="*.apk") returned 0
	[0056.541] lstrlenA (lpString="*.apk") returned 5
	[0056.541] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.541] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.541] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EMSMDB32.DLL") returned -1
	[0056.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EMSMDB32.DLL") returned 1
	[0056.541] lstrcmpiA (lpString1="", lpString2="EMSMDB32.DLL") returned -1
	[0056.541] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned="EMABLT32.DLL"
	[0056.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.541] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.542] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EMSMDB32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL"
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.zip") returned 0
	[0056.542] lstrlenA (lpString="*.zip") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.rar") returned 0
	[0056.542] lstrlenA (lpString="*.rar") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.7z") returned 0
	[0056.542] lstrlenA (lpString="*.7z") returned 4
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.tar") returned 0
	[0056.542] lstrlenA (lpString="*.tar") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.gzip") returned 0
	[0056.542] lstrlenA (lpString="*.gzip") returned 6
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.jpg") returned 0
	[0056.542] lstrlenA (lpString="*.jpg") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.jpeg") returned 0
	[0056.542] lstrlenA (lpString="*.jpeg") returned 6
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.psd") returned 0
	[0056.542] lstrlenA (lpString="*.psd") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.cdr") returned 0
	[0056.542] lstrlenA (lpString="*.cdr") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.dwg") returned 0
	[0056.542] lstrlenA (lpString="*.dwg") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.max") returned 0
	[0056.542] lstrlenA (lpString="*.max") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.bmp") returned 0
	[0056.542] lstrlenA (lpString="*.bmp") returned 5
	[0056.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", pszSpec="*.gif") returned 0
	[0056.542] lstrlenA (lpString="*.gif") returned 5
	[0056.543] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.543] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.543] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ENGDIC.DAT") returned -1
	[0056.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ENGDIC.DAT") returned 1
	[0056.543] lstrcmpiA (lpString1="", lpString2="ENGDIC.DAT") returned -1
	[0056.543] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned="EMSMDB32.DLL"
	[0056.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.543] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.543] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ENGDIC.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT"
	[0056.543] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.543] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.543] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ENGIDX.DAT") returned -1
	[0056.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ENGIDX.DAT") returned 1
	[0056.543] lstrcmpiA (lpString1="", lpString2="ENGIDX.DAT") returned -1
	[0056.543] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned="ENGDIC.DAT"
	[0056.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.543] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ENGIDX.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT"
	[0056.544] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.544] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.544] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ENGLISH.LNG") returned -1
	[0056.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ENGLISH.LNG") returned 1
	[0056.544] lstrcmpiA (lpString1="", lpString2="ENGLISH.LNG") returned -1
	[0056.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned="ENGIDX.DAT"
	[0056.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ENGLISH.LNG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG"
	[0056.544] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.544] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.544] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EntityDataHandler.dll") returned -1
	[0056.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EntityDataHandler.dll") returned 1
	[0056.544] lstrcmpiA (lpString1="", lpString2="EntityDataHandler.dll") returned -1
	[0056.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned="ENGLISH.LNG"
	[0056.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EntityDataHandler.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll"
	[0056.545] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.545] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.545] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EntityPicker.dll") returned -1
	[0056.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EntityPicker.dll") returned 1
	[0056.545] lstrcmpiA (lpString1="", lpString2="EntityPicker.dll") returned -1
	[0056.545] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned="EntityDataHandler.dll"
	[0056.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.545] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.545] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EntityPicker.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll"
	[0056.545] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.545] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.545] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ENVELOPE.DLL") returned -1
	[0056.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ENVELOPE.DLL") returned 1
	[0056.545] lstrcmpiA (lpString1="", lpString2="ENVELOPE.DLL") returned -1
	[0056.545] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned="EntityPicker.dll"
	[0056.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.545] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.545] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ENVELOPE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL"
	[0056.546] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.546] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.546] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ERXIMP.ADD") returned -1
	[0056.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERXIMP.ADD") returned 1
	[0056.546] lstrcmpiA (lpString1="", lpString2="ERXIMP.ADD") returned -1
	[0056.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned="ENVELOPE.DLL"
	[0056.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.546] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.546] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ERXIMP.ADD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD"
	[0056.546] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.546] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.546] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXCEL.EXE") returned -1
	[0056.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL.EXE") returned 1
	[0056.546] lstrcmpiA (lpString1="", lpString2="EXCEL.EXE") returned -1
	[0056.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned="ERXIMP.ADD"
	[0056.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.546] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.547] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EXCEL.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE"
	[0056.547] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE"
	[0056.547] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE"
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE."
	[0056.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.Boom"
	[0056.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0056.547] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1aecb60
	[0056.548] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52cdf900, dwHighDateTime=0x1cac26b), lpLastAccessTime=0x407536*(dwLowDateTime=0x5221e250, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52cdf900, dwHighDateTime=0x1cac26b)) returned 1
	[0056.548] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.548] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0056.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned="EXCEL.EXE"
	[0056.625] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.625] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0056.631] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.631] CloseHandle (hObject=0x88) returned 1
	[0056.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.boom")) returned 1
	[0056.632] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.632] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.632] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="excel.exe.manifest") returned -1
	[0056.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="excel.exe.manifest") returned 1
	[0056.632] lstrcmpiA (lpString1="", lpString2="excel.exe.manifest") returned -1
	[0056.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned="EXCEL.EXE"
	[0056.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="excel.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest"
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.zip") returned 0
	[0056.633] lstrlenA (lpString="*.zip") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.rar") returned 0
	[0056.633] lstrlenA (lpString="*.rar") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.7z") returned 0
	[0056.633] lstrlenA (lpString="*.7z") returned 4
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.tar") returned 0
	[0056.633] lstrlenA (lpString="*.tar") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.gzip") returned 0
	[0056.633] lstrlenA (lpString="*.gzip") returned 6
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.jpg") returned 0
	[0056.633] lstrlenA (lpString="*.jpg") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.jpeg") returned 0
	[0056.633] lstrlenA (lpString="*.jpeg") returned 6
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.psd") returned 0
	[0056.633] lstrlenA (lpString="*.psd") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.cdr") returned 0
	[0056.633] lstrlenA (lpString="*.cdr") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.dwg") returned 0
	[0056.633] lstrlenA (lpString="*.dwg") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.max") returned 0
	[0056.633] lstrlenA (lpString="*.max") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.bmp") returned 0
	[0056.633] lstrlenA (lpString="*.bmp") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.gif") returned 0
	[0056.633] lstrlenA (lpString="*.gif") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.png") returned 0
	[0056.633] lstrlenA (lpString="*.png") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.doc") returned 0
	[0056.633] lstrlenA (lpString="*.doc") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.docx") returned 0
	[0056.633] lstrlenA (lpString="*.docx") returned 6
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.xls") returned 0
	[0056.633] lstrlenA (lpString="*.xls") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.xlsx") returned 0
	[0056.633] lstrlenA (lpString="*.xlsx") returned 6
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.ppt") returned 0
	[0056.633] lstrlenA (lpString="*.ppt") returned 5
	[0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.pptx") returned 0
	[0056.634] lstrlenA (lpString="*.pptx") returned 6
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.txt") returned 0
	[0056.634] lstrlenA (lpString="*.txt") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.pdf") returned 0
	[0056.634] lstrlenA (lpString="*.pdf") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.djvu") returned 0
	[0056.634] lstrlenA (lpString="*.djvu") returned 6
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.htm") returned 0
	[0056.634] lstrlenA (lpString="*.htm") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.html") returned 0
	[0056.634] lstrlenA (lpString="*.html") returned 6
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mdb") returned 0
	[0056.634] lstrlenA (lpString="*.mdb") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.cer") returned 0
	[0056.634] lstrlenA (lpString="*.cer") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.p12") returned 0
	[0056.634] lstrlenA (lpString="*.p12") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.pfx") returned 0
	[0056.634] lstrlenA (lpString="*.pfx") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.kwm") returned 0
	[0056.634] lstrlenA (lpString="*.kwm") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.pwm") returned 0
	[0056.634] lstrlenA (lpString="*.pwm") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.1cd") returned 0
	[0056.634] lstrlenA (lpString="*.1cd") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.md") returned 0
	[0056.634] lstrlenA (lpString="*.md") returned 4
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mdf") returned 0
	[0056.634] lstrlenA (lpString="*.mdf") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.dbf") returned 0
	[0056.634] lstrlenA (lpString="*.dbf") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.odt") returned 0
	[0056.634] lstrlenA (lpString="*.odt") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.vob") returned 0
	[0056.634] lstrlenA (lpString="*.vob") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.ifo") returned 0
	[0056.634] lstrlenA (lpString="*.ifo") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.lnk") returned 0
	[0056.634] lstrlenA (lpString="*.lnk") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.torrent") returned 0
	[0056.634] lstrlenA (lpString="*.torrent") returned 9
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mov") returned 0
	[0056.634] lstrlenA (lpString="*.mov") returned 5
	[0056.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.m2v") returned 0
	[0056.635] lstrlenA (lpString="*.m2v") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.3gp") returned 0
	[0056.635] lstrlenA (lpString="*.3gp") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mpeg") returned 0
	[0056.635] lstrlenA (lpString="*.mpeg") returned 6
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mpg") returned 0
	[0056.635] lstrlenA (lpString="*.mpg") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.flv") returned 0
	[0056.635] lstrlenA (lpString="*.flv") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.avi") returned 0
	[0056.635] lstrlenA (lpString="*.avi") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mp4") returned 0
	[0056.635] lstrlenA (lpString="*.mp4") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.wmv") returned 0
	[0056.635] lstrlenA (lpString="*.wmv") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.divx") returned 0
	[0056.635] lstrlenA (lpString="*.divx") returned 6
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mkv") returned 0
	[0056.635] lstrlenA (lpString="*.mkv") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.mp3") returned 0
	[0056.635] lstrlenA (lpString="*.mp3") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.wav") returned 0
	[0056.635] lstrlenA (lpString="*.wav") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.flac") returned 0
	[0056.635] lstrlenA (lpString="*.flac") returned 6
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.ape") returned 0
	[0056.635] lstrlenA (lpString="*.ape") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.wma") returned 0
	[0056.635] lstrlenA (lpString="*.wma") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.ac3") returned 0
	[0056.635] lstrlenA (lpString="*.ac3") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.exe") returned 0
	[0056.635] lstrlenA (lpString="*.exe") returned 5
	[0056.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", pszSpec="*.apk") returned 0
	[0056.635] lstrlenA (lpString="*.apk") returned 5
	[0056.635] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.635] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.635] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="excelcnv.exe") returned -1
	[0056.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="excelcnv.exe") returned 1
	[0056.635] lstrcmpiA (lpString1="", lpString2="excelcnv.exe") returned -1
	[0056.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned="excel.exe.manifest"
	[0056.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="excelcnv.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe"
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.zip") returned 0
	[0056.636] lstrlenA (lpString="*.zip") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.rar") returned 0
	[0056.636] lstrlenA (lpString="*.rar") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.7z") returned 0
	[0056.636] lstrlenA (lpString="*.7z") returned 4
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.tar") returned 0
	[0056.636] lstrlenA (lpString="*.tar") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.gzip") returned 0
	[0056.636] lstrlenA (lpString="*.gzip") returned 6
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.jpg") returned 0
	[0056.636] lstrlenA (lpString="*.jpg") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.jpeg") returned 0
	[0056.636] lstrlenA (lpString="*.jpeg") returned 6
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.psd") returned 0
	[0056.636] lstrlenA (lpString="*.psd") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.cdr") returned 0
	[0056.636] lstrlenA (lpString="*.cdr") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.dwg") returned 0
	[0056.636] lstrlenA (lpString="*.dwg") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.max") returned 0
	[0056.636] lstrlenA (lpString="*.max") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.bmp") returned 0
	[0056.636] lstrlenA (lpString="*.bmp") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.gif") returned 0
	[0056.636] lstrlenA (lpString="*.gif") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.png") returned 0
	[0056.636] lstrlenA (lpString="*.png") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.doc") returned 0
	[0056.636] lstrlenA (lpString="*.doc") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.docx") returned 0
	[0056.636] lstrlenA (lpString="*.docx") returned 6
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.xls") returned 0
	[0056.636] lstrlenA (lpString="*.xls") returned 5
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.xlsx") returned 0
	[0056.636] lstrlenA (lpString="*.xlsx") returned 6
	[0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.ppt") returned 0
	[0056.637] lstrlenA (lpString="*.ppt") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.pptx") returned 0
	[0056.637] lstrlenA (lpString="*.pptx") returned 6
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.txt") returned 0
	[0056.637] lstrlenA (lpString="*.txt") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.pdf") returned 0
	[0056.637] lstrlenA (lpString="*.pdf") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.djvu") returned 0
	[0056.637] lstrlenA (lpString="*.djvu") returned 6
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.htm") returned 0
	[0056.637] lstrlenA (lpString="*.htm") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.html") returned 0
	[0056.637] lstrlenA (lpString="*.html") returned 6
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mdb") returned 0
	[0056.637] lstrlenA (lpString="*.mdb") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.cer") returned 0
	[0056.637] lstrlenA (lpString="*.cer") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.p12") returned 0
	[0056.637] lstrlenA (lpString="*.p12") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.pfx") returned 0
	[0056.637] lstrlenA (lpString="*.pfx") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.kwm") returned 0
	[0056.637] lstrlenA (lpString="*.kwm") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.pwm") returned 0
	[0056.637] lstrlenA (lpString="*.pwm") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.1cd") returned 0
	[0056.637] lstrlenA (lpString="*.1cd") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.md") returned 0
	[0056.637] lstrlenA (lpString="*.md") returned 4
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mdf") returned 0
	[0056.637] lstrlenA (lpString="*.mdf") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.dbf") returned 0
	[0056.637] lstrlenA (lpString="*.dbf") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.odt") returned 0
	[0056.637] lstrlenA (lpString="*.odt") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.vob") returned 0
	[0056.637] lstrlenA (lpString="*.vob") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.ifo") returned 0
	[0056.637] lstrlenA (lpString="*.ifo") returned 5
	[0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.lnk") returned 0
	[0056.637] lstrlenA (lpString="*.lnk") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.torrent") returned 0
	[0056.638] lstrlenA (lpString="*.torrent") returned 9
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mov") returned 0
	[0056.638] lstrlenA (lpString="*.mov") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.m2v") returned 0
	[0056.638] lstrlenA (lpString="*.m2v") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.3gp") returned 0
	[0056.638] lstrlenA (lpString="*.3gp") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mpeg") returned 0
	[0056.638] lstrlenA (lpString="*.mpeg") returned 6
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mpg") returned 0
	[0056.638] lstrlenA (lpString="*.mpg") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.flv") returned 0
	[0056.638] lstrlenA (lpString="*.flv") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.avi") returned 0
	[0056.638] lstrlenA (lpString="*.avi") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mp4") returned 0
	[0056.638] lstrlenA (lpString="*.mp4") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.wmv") returned 0
	[0056.638] lstrlenA (lpString="*.wmv") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.divx") returned 0
	[0056.638] lstrlenA (lpString="*.divx") returned 6
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mkv") returned 0
	[0056.638] lstrlenA (lpString="*.mkv") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.mp3") returned 0
	[0056.638] lstrlenA (lpString="*.mp3") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.wav") returned 0
	[0056.638] lstrlenA (lpString="*.wav") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.flac") returned 0
	[0056.638] lstrlenA (lpString="*.flac") returned 6
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.ape") returned 0
	[0056.638] lstrlenA (lpString="*.ape") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.wma") returned 0
	[0056.638] lstrlenA (lpString="*.wma") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.ac3") returned 0
	[0056.638] lstrlenA (lpString="*.ac3") returned 5
	[0056.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", pszSpec="*.exe") returned 1
	[0056.638] lstrlenA (lpString="*.exe") returned 5
	[0056.638] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe"
	[0056.638] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe"
	[0056.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.") returned="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe."
	[0056.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.Boom"
	[0056.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0056.646] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17d6360
	[0056.646] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd64d0300, dwHighDateTime=0x1cac1f5), lpLastAccessTime=0x407536*(dwLowDateTime=0x70c534f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd64d0300, dwHighDateTime=0x1cac1f5)) returned 1
	[0056.646] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.646] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0056.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned="excelcnv.exe"
	[0056.740] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0056.740] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0056.748] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0056.748] CloseHandle (hObject=0x88) returned 1
	[0056.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.boom")) returned 1
	[0056.749] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.749] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.749] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="excelcnvpxy.dll") returned -1
	[0056.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="excelcnvpxy.dll") returned 1
	[0056.749] lstrcmpiA (lpString1="", lpString2="excelcnvpxy.dll") returned -1
	[0056.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned="excelcnv.exe"
	[0056.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.749] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.749] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="excelcnvpxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll"
	[0056.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.zip") returned 0
	[0056.749] lstrlenA (lpString="*.zip") returned 5
	[0056.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.rar") returned 0
	[0056.749] lstrlenA (lpString="*.rar") returned 5
	[0056.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.7z") returned 0
	[0056.749] lstrlenA (lpString="*.7z") returned 4
	[0056.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.tar") returned 0
	[0056.749] lstrlenA (lpString="*.tar") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.gzip") returned 0
	[0056.750] lstrlenA (lpString="*.gzip") returned 6
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.jpg") returned 0
	[0056.750] lstrlenA (lpString="*.jpg") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.jpeg") returned 0
	[0056.750] lstrlenA (lpString="*.jpeg") returned 6
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.psd") returned 0
	[0056.750] lstrlenA (lpString="*.psd") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.cdr") returned 0
	[0056.750] lstrlenA (lpString="*.cdr") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.dwg") returned 0
	[0056.750] lstrlenA (lpString="*.dwg") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.max") returned 0
	[0056.750] lstrlenA (lpString="*.max") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.bmp") returned 0
	[0056.750] lstrlenA (lpString="*.bmp") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.gif") returned 0
	[0056.750] lstrlenA (lpString="*.gif") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.png") returned 0
	[0056.750] lstrlenA (lpString="*.png") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.doc") returned 0
	[0056.750] lstrlenA (lpString="*.doc") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.docx") returned 0
	[0056.750] lstrlenA (lpString="*.docx") returned 6
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.xls") returned 0
	[0056.750] lstrlenA (lpString="*.xls") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.xlsx") returned 0
	[0056.750] lstrlenA (lpString="*.xlsx") returned 6
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.ppt") returned 0
	[0056.750] lstrlenA (lpString="*.ppt") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.pptx") returned 0
	[0056.750] lstrlenA (lpString="*.pptx") returned 6
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.txt") returned 0
	[0056.750] lstrlenA (lpString="*.txt") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.pdf") returned 0
	[0056.750] lstrlenA (lpString="*.pdf") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.djvu") returned 0
	[0056.750] lstrlenA (lpString="*.djvu") returned 6
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.htm") returned 0
	[0056.750] lstrlenA (lpString="*.htm") returned 5
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.html") returned 0
	[0056.750] lstrlenA (lpString="*.html") returned 6
	[0056.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mdb") returned 0
	[0056.751] lstrlenA (lpString="*.mdb") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.cer") returned 0
	[0056.751] lstrlenA (lpString="*.cer") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.p12") returned 0
	[0056.751] lstrlenA (lpString="*.p12") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.pfx") returned 0
	[0056.751] lstrlenA (lpString="*.pfx") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.kwm") returned 0
	[0056.751] lstrlenA (lpString="*.kwm") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.pwm") returned 0
	[0056.751] lstrlenA (lpString="*.pwm") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.1cd") returned 0
	[0056.751] lstrlenA (lpString="*.1cd") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.md") returned 0
	[0056.751] lstrlenA (lpString="*.md") returned 4
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mdf") returned 0
	[0056.751] lstrlenA (lpString="*.mdf") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.dbf") returned 0
	[0056.751] lstrlenA (lpString="*.dbf") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.odt") returned 0
	[0056.751] lstrlenA (lpString="*.odt") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.vob") returned 0
	[0056.751] lstrlenA (lpString="*.vob") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.ifo") returned 0
	[0056.751] lstrlenA (lpString="*.ifo") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.lnk") returned 0
	[0056.751] lstrlenA (lpString="*.lnk") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.torrent") returned 0
	[0056.751] lstrlenA (lpString="*.torrent") returned 9
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mov") returned 0
	[0056.751] lstrlenA (lpString="*.mov") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.m2v") returned 0
	[0056.751] lstrlenA (lpString="*.m2v") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.3gp") returned 0
	[0056.751] lstrlenA (lpString="*.3gp") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mpeg") returned 0
	[0056.751] lstrlenA (lpString="*.mpeg") returned 6
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mpg") returned 0
	[0056.751] lstrlenA (lpString="*.mpg") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.flv") returned 0
	[0056.751] lstrlenA (lpString="*.flv") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.avi") returned 0
	[0056.751] lstrlenA (lpString="*.avi") returned 5
	[0056.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mp4") returned 0
	[0056.752] lstrlenA (lpString="*.mp4") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.wmv") returned 0
	[0056.752] lstrlenA (lpString="*.wmv") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.divx") returned 0
	[0056.752] lstrlenA (lpString="*.divx") returned 6
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mkv") returned 0
	[0056.752] lstrlenA (lpString="*.mkv") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.mp3") returned 0
	[0056.752] lstrlenA (lpString="*.mp3") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.wav") returned 0
	[0056.752] lstrlenA (lpString="*.wav") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.flac") returned 0
	[0056.752] lstrlenA (lpString="*.flac") returned 6
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.ape") returned 0
	[0056.752] lstrlenA (lpString="*.ape") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.wma") returned 0
	[0056.752] lstrlenA (lpString="*.wma") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.ac3") returned 0
	[0056.752] lstrlenA (lpString="*.ac3") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.exe") returned 0
	[0056.752] lstrlenA (lpString="*.exe") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", pszSpec="*.apk") returned 0
	[0056.752] lstrlenA (lpString="*.apk") returned 5
	[0056.752] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.752] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.752] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXLIRM.XML") returned -1
	[0056.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXLIRM.XML") returned 1
	[0056.752] lstrcmpiA (lpString1="", lpString2="EXLIRM.XML") returned -1
	[0056.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned="excelcnvpxy.dll"
	[0056.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EXLIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML"
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.zip") returned 0
	[0056.752] lstrlenA (lpString="*.zip") returned 5
	[0056.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.rar") returned 0
	[0056.753] lstrlenA (lpString="*.rar") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.7z") returned 0
	[0056.753] lstrlenA (lpString="*.7z") returned 4
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.tar") returned 0
	[0056.753] lstrlenA (lpString="*.tar") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.gzip") returned 0
	[0056.753] lstrlenA (lpString="*.gzip") returned 6
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.jpg") returned 0
	[0056.753] lstrlenA (lpString="*.jpg") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.jpeg") returned 0
	[0056.753] lstrlenA (lpString="*.jpeg") returned 6
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.psd") returned 0
	[0056.753] lstrlenA (lpString="*.psd") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.cdr") returned 0
	[0056.753] lstrlenA (lpString="*.cdr") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.dwg") returned 0
	[0056.753] lstrlenA (lpString="*.dwg") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.max") returned 0
	[0056.753] lstrlenA (lpString="*.max") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.bmp") returned 0
	[0056.753] lstrlenA (lpString="*.bmp") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.gif") returned 0
	[0056.753] lstrlenA (lpString="*.gif") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.png") returned 0
	[0056.753] lstrlenA (lpString="*.png") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.doc") returned 0
	[0056.753] lstrlenA (lpString="*.doc") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.docx") returned 0
	[0056.753] lstrlenA (lpString="*.docx") returned 6
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.xls") returned 0
	[0056.753] lstrlenA (lpString="*.xls") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.xlsx") returned 0
	[0056.753] lstrlenA (lpString="*.xlsx") returned 6
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.ppt") returned 0
	[0056.753] lstrlenA (lpString="*.ppt") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.pptx") returned 0
	[0056.753] lstrlenA (lpString="*.pptx") returned 6
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.txt") returned 0
	[0056.753] lstrlenA (lpString="*.txt") returned 5
	[0056.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.pdf") returned 0
	[0056.753] lstrlenA (lpString="*.pdf") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.djvu") returned 0
	[0056.754] lstrlenA (lpString="*.djvu") returned 6
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.htm") returned 0
	[0056.754] lstrlenA (lpString="*.htm") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.html") returned 0
	[0056.754] lstrlenA (lpString="*.html") returned 6
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mdb") returned 0
	[0056.754] lstrlenA (lpString="*.mdb") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.cer") returned 0
	[0056.754] lstrlenA (lpString="*.cer") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.p12") returned 0
	[0056.754] lstrlenA (lpString="*.p12") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.pfx") returned 0
	[0056.754] lstrlenA (lpString="*.pfx") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.kwm") returned 0
	[0056.754] lstrlenA (lpString="*.kwm") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.pwm") returned 0
	[0056.754] lstrlenA (lpString="*.pwm") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.1cd") returned 0
	[0056.754] lstrlenA (lpString="*.1cd") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.md") returned 0
	[0056.754] lstrlenA (lpString="*.md") returned 4
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mdf") returned 0
	[0056.754] lstrlenA (lpString="*.mdf") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.dbf") returned 0
	[0056.754] lstrlenA (lpString="*.dbf") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.odt") returned 0
	[0056.754] lstrlenA (lpString="*.odt") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.vob") returned 0
	[0056.754] lstrlenA (lpString="*.vob") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.ifo") returned 0
	[0056.754] lstrlenA (lpString="*.ifo") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.lnk") returned 0
	[0056.754] lstrlenA (lpString="*.lnk") returned 5
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.torrent") returned 0
	[0056.754] lstrlenA (lpString="*.torrent") returned 9
	[0056.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mov") returned 0
	[0056.754] lstrlenA (lpString="*.mov") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.m2v") returned 0
	[0056.755] lstrlenA (lpString="*.m2v") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.3gp") returned 0
	[0056.755] lstrlenA (lpString="*.3gp") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mpeg") returned 0
	[0056.755] lstrlenA (lpString="*.mpeg") returned 6
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mpg") returned 0
	[0056.755] lstrlenA (lpString="*.mpg") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.flv") returned 0
	[0056.755] lstrlenA (lpString="*.flv") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.avi") returned 0
	[0056.755] lstrlenA (lpString="*.avi") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mp4") returned 0
	[0056.755] lstrlenA (lpString="*.mp4") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.wmv") returned 0
	[0056.755] lstrlenA (lpString="*.wmv") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.divx") returned 0
	[0056.755] lstrlenA (lpString="*.divx") returned 6
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mkv") returned 0
	[0056.755] lstrlenA (lpString="*.mkv") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.mp3") returned 0
	[0056.755] lstrlenA (lpString="*.mp3") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.wav") returned 0
	[0056.755] lstrlenA (lpString="*.wav") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.flac") returned 0
	[0056.755] lstrlenA (lpString="*.flac") returned 6
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.ape") returned 0
	[0056.755] lstrlenA (lpString="*.ape") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.wma") returned 0
	[0056.755] lstrlenA (lpString="*.wma") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.ac3") returned 0
	[0056.755] lstrlenA (lpString="*.ac3") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.exe") returned 0
	[0056.755] lstrlenA (lpString="*.exe") returned 5
	[0056.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", pszSpec="*.apk") returned 0
	[0056.755] lstrlenA (lpString="*.apk") returned 5
	[0056.755] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.755] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.756] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXLIRMV.XML") returned -1
	[0056.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXLIRMV.XML") returned 1
	[0056.756] lstrcmpiA (lpString1="", lpString2="EXLIRMV.XML") returned -1
	[0056.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned="EXLIRM.XML"
	[0056.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EXLIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML"
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.zip") returned 0
	[0056.756] lstrlenA (lpString="*.zip") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.rar") returned 0
	[0056.756] lstrlenA (lpString="*.rar") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.7z") returned 0
	[0056.756] lstrlenA (lpString="*.7z") returned 4
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.tar") returned 0
	[0056.756] lstrlenA (lpString="*.tar") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.gzip") returned 0
	[0056.756] lstrlenA (lpString="*.gzip") returned 6
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.jpg") returned 0
	[0056.756] lstrlenA (lpString="*.jpg") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.jpeg") returned 0
	[0056.756] lstrlenA (lpString="*.jpeg") returned 6
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.psd") returned 0
	[0056.756] lstrlenA (lpString="*.psd") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.cdr") returned 0
	[0056.756] lstrlenA (lpString="*.cdr") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.dwg") returned 0
	[0056.756] lstrlenA (lpString="*.dwg") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.max") returned 0
	[0056.756] lstrlenA (lpString="*.max") returned 5
	[0056.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.bmp") returned 0
	[0056.756] lstrlenA (lpString="*.bmp") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.gif") returned 0
	[0056.757] lstrlenA (lpString="*.gif") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.png") returned 0
	[0056.757] lstrlenA (lpString="*.png") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.doc") returned 0
	[0056.757] lstrlenA (lpString="*.doc") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.docx") returned 0
	[0056.757] lstrlenA (lpString="*.docx") returned 6
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.xls") returned 0
	[0056.757] lstrlenA (lpString="*.xls") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.xlsx") returned 0
	[0056.757] lstrlenA (lpString="*.xlsx") returned 6
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.ppt") returned 0
	[0056.757] lstrlenA (lpString="*.ppt") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.pptx") returned 0
	[0056.757] lstrlenA (lpString="*.pptx") returned 6
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.txt") returned 0
	[0056.757] lstrlenA (lpString="*.txt") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.pdf") returned 0
	[0056.757] lstrlenA (lpString="*.pdf") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.djvu") returned 0
	[0056.757] lstrlenA (lpString="*.djvu") returned 6
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.htm") returned 0
	[0056.757] lstrlenA (lpString="*.htm") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.html") returned 0
	[0056.757] lstrlenA (lpString="*.html") returned 6
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mdb") returned 0
	[0056.757] lstrlenA (lpString="*.mdb") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.cer") returned 0
	[0056.757] lstrlenA (lpString="*.cer") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.p12") returned 0
	[0056.757] lstrlenA (lpString="*.p12") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.pfx") returned 0
	[0056.757] lstrlenA (lpString="*.pfx") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.kwm") returned 0
	[0056.757] lstrlenA (lpString="*.kwm") returned 5
	[0056.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.pwm") returned 0
	[0056.757] lstrlenA (lpString="*.pwm") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.1cd") returned 0
	[0056.758] lstrlenA (lpString="*.1cd") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.md") returned 0
	[0056.758] lstrlenA (lpString="*.md") returned 4
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mdf") returned 0
	[0056.758] lstrlenA (lpString="*.mdf") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.dbf") returned 0
	[0056.758] lstrlenA (lpString="*.dbf") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.odt") returned 0
	[0056.758] lstrlenA (lpString="*.odt") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.vob") returned 0
	[0056.758] lstrlenA (lpString="*.vob") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.ifo") returned 0
	[0056.758] lstrlenA (lpString="*.ifo") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.lnk") returned 0
	[0056.758] lstrlenA (lpString="*.lnk") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.torrent") returned 0
	[0056.758] lstrlenA (lpString="*.torrent") returned 9
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mov") returned 0
	[0056.758] lstrlenA (lpString="*.mov") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.m2v") returned 0
	[0056.758] lstrlenA (lpString="*.m2v") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.3gp") returned 0
	[0056.758] lstrlenA (lpString="*.3gp") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mpeg") returned 0
	[0056.758] lstrlenA (lpString="*.mpeg") returned 6
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mpg") returned 0
	[0056.758] lstrlenA (lpString="*.mpg") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.flv") returned 0
	[0056.758] lstrlenA (lpString="*.flv") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.avi") returned 0
	[0056.758] lstrlenA (lpString="*.avi") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mp4") returned 0
	[0056.758] lstrlenA (lpString="*.mp4") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.wmv") returned 0
	[0056.758] lstrlenA (lpString="*.wmv") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.divx") returned 0
	[0056.758] lstrlenA (lpString="*.divx") returned 6
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mkv") returned 0
	[0056.758] lstrlenA (lpString="*.mkv") returned 5
	[0056.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.mp3") returned 0
	[0056.758] lstrlenA (lpString="*.mp3") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.wav") returned 0
	[0056.759] lstrlenA (lpString="*.wav") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.flac") returned 0
	[0056.759] lstrlenA (lpString="*.flac") returned 6
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.ape") returned 0
	[0056.759] lstrlenA (lpString="*.ape") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.wma") returned 0
	[0056.759] lstrlenA (lpString="*.wma") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.ac3") returned 0
	[0056.759] lstrlenA (lpString="*.ac3") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.exe") returned 0
	[0056.759] lstrlenA (lpString="*.exe") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", pszSpec="*.apk") returned 0
	[0056.759] lstrlenA (lpString="*.apk") returned 5
	[0056.759] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.759] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.759] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXSEC32.DLL") returned -1
	[0056.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXSEC32.DLL") returned 1
	[0056.759] lstrcmpiA (lpString1="", lpString2="EXSEC32.DLL") returned -1
	[0056.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned="EXLIRMV.XML"
	[0056.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.759] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.759] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EXSEC32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL"
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.zip") returned 0
	[0056.759] lstrlenA (lpString="*.zip") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.rar") returned 0
	[0056.759] lstrlenA (lpString="*.rar") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.7z") returned 0
	[0056.759] lstrlenA (lpString="*.7z") returned 4
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.tar") returned 0
	[0056.759] lstrlenA (lpString="*.tar") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.gzip") returned 0
	[0056.759] lstrlenA (lpString="*.gzip") returned 6
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.jpg") returned 0
	[0056.759] lstrlenA (lpString="*.jpg") returned 5
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.jpeg") returned 0
	[0056.759] lstrlenA (lpString="*.jpeg") returned 6
	[0056.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.psd") returned 0
	[0056.760] lstrlenA (lpString="*.psd") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.cdr") returned 0
	[0056.760] lstrlenA (lpString="*.cdr") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.dwg") returned 0
	[0056.760] lstrlenA (lpString="*.dwg") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.max") returned 0
	[0056.760] lstrlenA (lpString="*.max") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.bmp") returned 0
	[0056.760] lstrlenA (lpString="*.bmp") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.gif") returned 0
	[0056.760] lstrlenA (lpString="*.gif") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.png") returned 0
	[0056.760] lstrlenA (lpString="*.png") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.doc") returned 0
	[0056.760] lstrlenA (lpString="*.doc") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.docx") returned 0
	[0056.760] lstrlenA (lpString="*.docx") returned 6
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.xls") returned 0
	[0056.760] lstrlenA (lpString="*.xls") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.xlsx") returned 0
	[0056.760] lstrlenA (lpString="*.xlsx") returned 6
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.ppt") returned 0
	[0056.760] lstrlenA (lpString="*.ppt") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.pptx") returned 0
	[0056.760] lstrlenA (lpString="*.pptx") returned 6
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.txt") returned 0
	[0056.760] lstrlenA (lpString="*.txt") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.pdf") returned 0
	[0056.760] lstrlenA (lpString="*.pdf") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.djvu") returned 0
	[0056.760] lstrlenA (lpString="*.djvu") returned 6
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.htm") returned 0
	[0056.760] lstrlenA (lpString="*.htm") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.html") returned 0
	[0056.760] lstrlenA (lpString="*.html") returned 6
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mdb") returned 0
	[0056.760] lstrlenA (lpString="*.mdb") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.cer") returned 0
	[0056.760] lstrlenA (lpString="*.cer") returned 5
	[0056.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.p12") returned 0
	[0056.760] lstrlenA (lpString="*.p12") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.pfx") returned 0
	[0056.761] lstrlenA (lpString="*.pfx") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.kwm") returned 0
	[0056.761] lstrlenA (lpString="*.kwm") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.pwm") returned 0
	[0056.761] lstrlenA (lpString="*.pwm") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.1cd") returned 0
	[0056.761] lstrlenA (lpString="*.1cd") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.md") returned 0
	[0056.761] lstrlenA (lpString="*.md") returned 4
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mdf") returned 0
	[0056.761] lstrlenA (lpString="*.mdf") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.dbf") returned 0
	[0056.761] lstrlenA (lpString="*.dbf") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.odt") returned 0
	[0056.761] lstrlenA (lpString="*.odt") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.vob") returned 0
	[0056.761] lstrlenA (lpString="*.vob") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.ifo") returned 0
	[0056.761] lstrlenA (lpString="*.ifo") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.lnk") returned 0
	[0056.761] lstrlenA (lpString="*.lnk") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.torrent") returned 0
	[0056.761] lstrlenA (lpString="*.torrent") returned 9
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mov") returned 0
	[0056.761] lstrlenA (lpString="*.mov") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.m2v") returned 0
	[0056.761] lstrlenA (lpString="*.m2v") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.3gp") returned 0
	[0056.761] lstrlenA (lpString="*.3gp") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mpeg") returned 0
	[0056.761] lstrlenA (lpString="*.mpeg") returned 6
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mpg") returned 0
	[0056.761] lstrlenA (lpString="*.mpg") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.flv") returned 0
	[0056.761] lstrlenA (lpString="*.flv") returned 5
	[0056.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.avi") returned 0
	[0056.761] lstrlenA (lpString="*.avi") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mp4") returned 0
	[0056.762] lstrlenA (lpString="*.mp4") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.wmv") returned 0
	[0056.762] lstrlenA (lpString="*.wmv") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.divx") returned 0
	[0056.762] lstrlenA (lpString="*.divx") returned 6
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mkv") returned 0
	[0056.762] lstrlenA (lpString="*.mkv") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.mp3") returned 0
	[0056.762] lstrlenA (lpString="*.mp3") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.wav") returned 0
	[0056.762] lstrlenA (lpString="*.wav") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.flac") returned 0
	[0056.762] lstrlenA (lpString="*.flac") returned 6
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.ape") returned 0
	[0056.762] lstrlenA (lpString="*.ape") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.wma") returned 0
	[0056.762] lstrlenA (lpString="*.wma") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.ac3") returned 0
	[0056.762] lstrlenA (lpString="*.ac3") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.exe") returned 0
	[0056.762] lstrlenA (lpString="*.exe") returned 5
	[0056.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", pszSpec="*.apk") returned 0
	[0056.762] lstrlenA (lpString="*.apk") returned 5
	[0056.762] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.762] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.762] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXTRACT.DLL") returned -1
	[0056.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXTRACT.DLL") returned 1
	[0056.762] lstrcmpiA (lpString1="", lpString2="EXTRACT.DLL") returned -1
	[0056.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned="EXSEC32.DLL"
	[0056.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.762] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="EXTRACT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL"
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.zip") returned 0
	[0056.763] lstrlenA (lpString="*.zip") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.rar") returned 0
	[0056.763] lstrlenA (lpString="*.rar") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.7z") returned 0
	[0056.763] lstrlenA (lpString="*.7z") returned 4
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.tar") returned 0
	[0056.763] lstrlenA (lpString="*.tar") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.gzip") returned 0
	[0056.763] lstrlenA (lpString="*.gzip") returned 6
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.jpg") returned 0
	[0056.763] lstrlenA (lpString="*.jpg") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.jpeg") returned 0
	[0056.763] lstrlenA (lpString="*.jpeg") returned 6
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.psd") returned 0
	[0056.763] lstrlenA (lpString="*.psd") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.cdr") returned 0
	[0056.763] lstrlenA (lpString="*.cdr") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.dwg") returned 0
	[0056.763] lstrlenA (lpString="*.dwg") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.max") returned 0
	[0056.763] lstrlenA (lpString="*.max") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.bmp") returned 0
	[0056.763] lstrlenA (lpString="*.bmp") returned 5
	[0056.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", pszSpec="*.gif") returned 0
	[0056.763] lstrlenA (lpString="*.gif") returned 5
	[0056.763] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.764] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.764] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FACILITY.DLL") returned -1
	[0056.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FACILITY.DLL") returned 1
	[0056.764] lstrcmpiA (lpString1="", lpString2="FACILITY.DLL") returned -1
	[0056.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned="EXTRACT.DLL"
	[0056.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="FACILITY.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL"
	[0056.764] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.764] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.764] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.DLL") returned -1
	[0056.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.DLL") returned 1
	[0056.764] lstrcmpiA (lpString1="", lpString2="FORM.DLL") returned -1
	[0056.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned="FACILITY.DLL"
	[0056.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0056.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0056.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0056.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0056.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="FORM.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL"
	[0056.764] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.764] lstrcmpA (lpString1=".", lpString2="FORMS") returned -1
	[0056.764] lstrcmpA (lpString1="..", lpString2="FORMS") returned -1
	[0056.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned="FORM.DLL"
	[0056.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="FORMS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS"
	[0056.764] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0056.765] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.765] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.765] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.765] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.765] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0056.765] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0056.765] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0056.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*.*") returned="*.*"
	[0056.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033"
	[0056.765] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0056.811] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0056.811] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.825] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0056.825] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0056.825] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.825] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.825] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACTIVITL.ICO") returned 1
	[0056.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACTIVITL.ICO") returned 1
	[0056.825] lstrcmpiA (lpString1="", lpString2="ACTIVITL.ICO") returned -1
	[0056.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*.*") returned="*.*"
	[0056.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.825] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0056.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0056.828] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0056.828] CloseHandle (hObject=0x90) returned 1
	[0056.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="ACTIVITL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO"
	[0056.828] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.828] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACTIVITS.ICO") returned 1
	[0056.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACTIVITS.ICO") returned 1
	[0056.828] lstrcmpiA (lpString1="", lpString2="ACTIVITS.ICO") returned -1
	[0056.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned="ACTIVITL.ICO"
	[0056.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.828] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="ACTIVITS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO"
	[0056.828] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.828] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACTIVITY.CFG") returned 1
	[0056.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACTIVITY.CFG") returned 1
	[0056.828] lstrcmpiA (lpString1="", lpString2="ACTIVITY.CFG") returned -1
	[0056.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned="ACTIVITS.ICO"
	[0056.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="ACTIVITY.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG"
	[0056.829] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.829] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.829] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="APPT.CFG") returned 1
	[0056.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="APPT.CFG") returned 1
	[0056.829] lstrcmpiA (lpString1="", lpString2="APPT.CFG") returned -1
	[0056.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned="ACTIVITY.CFG"
	[0056.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="APPT.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG"
	[0056.829] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.829] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.829] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="APPTL.ICO") returned 1
	[0056.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="APPTL.ICO") returned 1
	[0056.829] lstrcmpiA (lpString1="", lpString2="APPTL.ICO") returned -1
	[0056.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned="APPT.CFG"
	[0056.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="APPTL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO"
	[0056.829] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.829] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.829] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="APPTS.ICO") returned 1
	[0056.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="APPTS.ICO") returned 1
	[0056.829] lstrcmpiA (lpString1="", lpString2="APPTS.ICO") returned -1
	[0056.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned="APPTL.ICO"
	[0056.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.830] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.830] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="APPTS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO"
	[0056.830] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.830] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.830] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CNFNOT.CFG") returned 1
	[0056.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CNFNOT.CFG") returned 1
	[0056.830] lstrcmpiA (lpString1="", lpString2="CNFNOT.CFG") returned -1
	[0056.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned="APPTS.ICO"
	[0056.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.830] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.830] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="CNFNOT.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG"
	[0056.830] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.830] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.830] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CNFNOT.ICO") returned 1
	[0056.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CNFNOT.ICO") returned 1
	[0056.830] lstrcmpiA (lpString1="", lpString2="CNFNOT.ICO") returned -1
	[0056.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned="CNFNOT.CFG"
	[0056.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.830] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.830] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="CNFNOT.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO"
	[0056.830] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.830] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.830] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CNFRES.CFG") returned 1
	[0056.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CNFRES.CFG") returned 1
	[0056.830] lstrcmpiA (lpString1="", lpString2="CNFRES.CFG") returned -1
	[0056.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned="CNFNOT.ICO"
	[0056.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.831] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="CNFRES.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG"
	[0056.831] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.831] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.831] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONFLICT.ICO") returned 1
	[0056.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONFLICT.ICO") returned 1
	[0056.831] lstrcmpiA (lpString1="", lpString2="CONFLICT.ICO") returned -1
	[0056.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned="CNFRES.CFG"
	[0056.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.831] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="CONFLICT.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO"
	[0056.831] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.831] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.831] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONTACT.CFG") returned 1
	[0056.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONTACT.CFG") returned 1
	[0056.831] lstrcmpiA (lpString1="", lpString2="CONTACT.CFG") returned -1
	[0056.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned="CONFLICT.ICO"
	[0056.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.831] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="CONTACT.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG"
	[0056.831] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.831] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.831] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONTACTL.ICO") returned 1
	[0056.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONTACTL.ICO") returned 1
	[0056.831] lstrcmpiA (lpString1="", lpString2="CONTACTL.ICO") returned -1
	[0056.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned="CONTACT.CFG"
	[0056.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.832] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.832] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="CONTACTL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO"
	[0056.832] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.832] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.832] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONTACTS.ICO") returned 1
	[0056.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONTACTS.ICO") returned 1
	[0056.832] lstrcmpiA (lpString1="", lpString2="CONTACTS.ICO") returned -1
	[0056.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned="CONTACTL.ICO"
	[0056.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.832] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.832] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="CONTACTS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO"
	[0056.832] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.832] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.832] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DISTLIST.CFG") returned 1
	[0056.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DISTLIST.CFG") returned 1
	[0056.832] lstrcmpiA (lpString1="", lpString2="DISTLIST.CFG") returned -1
	[0056.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned="CONTACTS.ICO"
	[0056.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.832] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.832] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="DISTLIST.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG"
	[0056.832] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.832] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.832] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DISTLSTL.ICO") returned 1
	[0056.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DISTLSTL.ICO") returned 1
	[0056.833] lstrcmpiA (lpString1="", lpString2="DISTLSTL.ICO") returned -1
	[0056.833] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned="DISTLIST.CFG"
	[0056.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="DISTLSTL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO"
	[0056.833] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.833] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DISTLSTS.ICO") returned 1
	[0056.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DISTLSTS.ICO") returned 1
	[0056.833] lstrcmpiA (lpString1="", lpString2="DISTLSTS.ICO") returned -1
	[0056.833] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned="DISTLSTL.ICO"
	[0056.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="DISTLSTS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO"
	[0056.833] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.833] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DOC.CFG") returned 1
	[0056.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DOC.CFG") returned 1
	[0056.833] lstrcmpiA (lpString1="", lpString2="DOC.CFG") returned -1
	[0056.833] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned="DISTLSTS.ICO"
	[0056.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="DOC.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG"
	[0056.833] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.833] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DOCL.ICO") returned 1
	[0056.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DOCL.ICO") returned 1
	[0056.834] lstrcmpiA (lpString1="", lpString2="DOCL.ICO") returned -1
	[0056.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned="DOC.CFG"
	[0056.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.834] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.834] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="DOCL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO"
	[0056.834] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.834] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DOCS.ICO") returned 1
	[0056.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DOCS.ICO") returned 1
	[0056.834] lstrcmpiA (lpString1="", lpString2="DOCS.ICO") returned -1
	[0056.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned="DOCL.ICO"
	[0056.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.834] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.834] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="DOCS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO"
	[0056.834] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.834] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXITEM.CFG") returned -1
	[0056.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXITEM.CFG") returned 1
	[0056.834] lstrcmpiA (lpString1="", lpString2="EXITEM.CFG") returned -1
	[0056.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned="DOCS.ICO"
	[0056.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.834] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.834] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="EXITEM.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG"
	[0056.834] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.834] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXITEML.ICO") returned -1
	[0056.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXITEML.ICO") returned 1
	[0056.835] lstrcmpiA (lpString1="", lpString2="EXITEML.ICO") returned -1
	[0056.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned="EXITEM.CFG"
	[0056.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="EXITEML.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO"
	[0056.835] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.835] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXITEMS.ICO") returned -1
	[0056.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXITEMS.ICO") returned 1
	[0056.835] lstrcmpiA (lpString1="", lpString2="EXITEMS.ICO") returned -1
	[0056.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned="EXITEML.ICO"
	[0056.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="EXITEMS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO"
	[0056.835] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.835] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INFOMAIL.CFG") returned -1
	[0056.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOMAIL.CFG") returned -1
	[0056.835] lstrcmpiA (lpString1="", lpString2="INFOMAIL.CFG") returned -1
	[0056.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned="EXITEMS.ICO"
	[0056.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="INFOMAIL.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG"
	[0056.835] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.835] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INFOML.ICO") returned -1
	[0056.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOML.ICO") returned -1
	[0056.836] lstrcmpiA (lpString1="", lpString2="INFOML.ICO") returned -1
	[0056.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned="INFOMAIL.CFG"
	[0056.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="INFOML.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO"
	[0056.836] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INFOMS.ICO") returned -1
	[0056.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOMS.ICO") returned -1
	[0056.836] lstrcmpiA (lpString1="", lpString2="INFOMS.ICO") returned -1
	[0056.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned="INFOML.ICO"
	[0056.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="INFOMS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO"
	[0056.836] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPM.CFG") returned -1
	[0056.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPM.CFG") returned -1
	[0056.836] lstrcmpiA (lpString1="", lpString2="IPM.CFG") returned -1
	[0056.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned="INFOMS.ICO"
	[0056.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="IPM.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG"
	[0056.836] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPML.ICO") returned -1
	[0056.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPML.ICO") returned -1
	[0056.837] lstrcmpiA (lpString1="", lpString2="IPML.ICO") returned -1
	[0056.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned="IPM.CFG"
	[0056.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="IPML.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO"
	[0056.837] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.837] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPMS.ICO") returned -1
	[0056.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPMS.ICO") returned -1
	[0056.837] lstrcmpiA (lpString1="", lpString2="IPMS.ICO") returned -1
	[0056.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned="IPML.ICO"
	[0056.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="IPMS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO"
	[0056.837] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.837] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MMSL.ICO") returned -1
	[0056.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMSL.ICO") returned -1
	[0056.837] lstrcmpiA (lpString1="", lpString2="MMSL.ICO") returned -1
	[0056.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned="IPMS.ICO"
	[0056.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="MMSL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO"
	[0056.838] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MMSS.ICO") returned -1
	[0056.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMSS.ICO") returned -1
	[0056.838] lstrcmpiA (lpString1="", lpString2="MMSS.ICO") returned -1
	[0056.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned="MMSL.ICO"
	[0056.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="MMSS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO"
	[0056.838] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NOTE.CFG") returned -1
	[0056.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NOTE.CFG") returned -1
	[0056.838] lstrcmpiA (lpString1="", lpString2="NOTE.CFG") returned -1
	[0056.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned="MMSS.ICO"
	[0056.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="NOTE.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG"
	[0056.838] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NOTEL.ICO") returned -1
	[0056.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NOTEL.ICO") returned -1
	[0056.838] lstrcmpiA (lpString1="", lpString2="NOTEL.ICO") returned -1
	[0056.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned="NOTE.CFG"
	[0056.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="NOTEL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO"
	[0056.839] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NOTES.ICO") returned -1
	[0056.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NOTES.ICO") returned -1
	[0056.839] lstrcmpiA (lpString1="", lpString2="NOTES.ICO") returned -1
	[0056.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned="NOTEL.ICO"
	[0056.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="NOTES.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO"
	[0056.839] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OMSMMS.CFG") returned -1
	[0056.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMSMMS.CFG") returned -1
	[0056.839] lstrcmpiA (lpString1="", lpString2="OMSMMS.CFG") returned -1
	[0056.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned="NOTES.ICO"
	[0056.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="OMSMMS.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG"
	[0056.839] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OMSSMS.CFG") returned -1
	[0056.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMSSMS.CFG") returned -1
	[0056.840] lstrcmpiA (lpString1="", lpString2="OMSSMS.CFG") returned -1
	[0056.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned="OMSMMS.CFG"
	[0056.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="OMSSMS.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG"
	[0056.841] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.841] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OOFL.ICO") returned -1
	[0056.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OOFL.ICO") returned -1
	[0056.841] lstrcmpiA (lpString1="", lpString2="OOFL.ICO") returned -1
	[0056.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned="OMSSMS.CFG"
	[0056.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="OOFL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO"
	[0056.841] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.841] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OOFS.ICO") returned -1
	[0056.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OOFS.ICO") returned -1
	[0056.841] lstrcmpiA (lpString1="", lpString2="OOFS.ICO") returned -1
	[0056.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned="OOFL.ICO"
	[0056.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="OOFS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO"
	[0056.841] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.841] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OOFTMPL.CFG") returned -1
	[0056.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OOFTMPL.CFG") returned -1
	[0056.842] lstrcmpiA (lpString1="", lpString2="OOFTMPL.CFG") returned -1
	[0056.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned="OOFS.ICO"
	[0056.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="OOFTMPL.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG"
	[0056.842] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POST.CFG") returned -1
	[0056.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POST.CFG") returned -1
	[0056.842] lstrcmpiA (lpString1="", lpString2="POST.CFG") returned -1
	[0056.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned="OOFTMPL.CFG"
	[0056.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="POST.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG"
	[0056.842] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POSTIT.CFG") returned -1
	[0056.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POSTIT.CFG") returned -1
	[0056.842] lstrcmpiA (lpString1="", lpString2="POSTIT.CFG") returned -1
	[0056.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned="POST.CFG"
	[0056.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="POSTIT.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG"
	[0056.843] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POSTITL.ICO") returned -1
	[0056.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POSTITL.ICO") returned -1
	[0056.843] lstrcmpiA (lpString1="", lpString2="POSTITL.ICO") returned -1
	[0056.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned="POSTIT.CFG"
	[0056.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.843] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="POSTITL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO"
	[0056.843] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POSTITS.ICO") returned -1
	[0056.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POSTITS.ICO") returned -1
	[0056.843] lstrcmpiA (lpString1="", lpString2="POSTITS.ICO") returned -1
	[0056.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned="POSTITL.ICO"
	[0056.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.843] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="POSTITS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO"
	[0056.843] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POSTL.ICO") returned -1
	[0056.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POSTL.ICO") returned -1
	[0056.843] lstrcmpiA (lpString1="", lpString2="POSTL.ICO") returned -1
	[0056.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned="POSTITS.ICO"
	[0056.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="POSTL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO"
	[0056.844] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.844] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POSTS.ICO") returned -1
	[0056.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POSTS.ICO") returned -1
	[0056.844] lstrcmpiA (lpString1="", lpString2="POSTS.ICO") returned -1
	[0056.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned="POSTL.ICO"
	[0056.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="POSTS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO"
	[0056.844] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.844] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RCLRPT.CFG") returned -1
	[0056.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RCLRPT.CFG") returned -1
	[0056.844] lstrcmpiA (lpString1="", lpString2="RCLRPT.CFG") returned -1
	[0056.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned="POSTS.ICO"
	[0056.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RCLRPT.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG"
	[0056.844] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.844] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REC.CFG") returned -1
	[0056.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REC.CFG") returned -1
	[0056.844] lstrcmpiA (lpString1="", lpString2="REC.CFG") returned -1
	[0056.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned="RCLRPT.CFG"
	[0056.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REC.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG"
	[0056.845] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.845] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.845] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RECL.ICO") returned -1
	[0056.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RECL.ICO") returned -1
	[0056.845] lstrcmpiA (lpString1="", lpString2="RECL.ICO") returned -1
	[0056.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned="REC.CFG"
	[0056.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RECL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO"
	[0056.845] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.845] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.845] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RECS.ICO") returned -1
	[0056.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RECS.ICO") returned -1
	[0056.845] lstrcmpiA (lpString1="", lpString2="RECS.ICO") returned -1
	[0056.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned="RECL.ICO"
	[0056.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RECS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO"
	[0056.845] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.845] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.845] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REMOTE.CFG") returned -1
	[0056.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REMOTE.CFG") returned -1
	[0056.845] lstrcmpiA (lpString1="", lpString2="REMOTE.CFG") returned -1
	[0056.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned="RECS.ICO"
	[0056.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REMOTE.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG"
	[0056.846] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.846] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.846] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REMOTEL.ICO") returned -1
	[0056.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REMOTEL.ICO") returned -1
	[0056.846] lstrcmpiA (lpString1="", lpString2="REMOTEL.ICO") returned -1
	[0056.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned="REMOTE.CFG"
	[0056.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REMOTEL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO"
	[0056.846] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.846] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.846] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REMOTES.ICO") returned -1
	[0056.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REMOTES.ICO") returned -1
	[0056.846] lstrcmpiA (lpString1="", lpString2="REMOTES.ICO") returned -1
	[0056.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned="REMOTEL.ICO"
	[0056.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REMOTES.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO"
	[0056.846] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.846] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.846] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REPLTMPL.CFG") returned -1
	[0056.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REPLTMPL.CFG") returned -1
	[0056.846] lstrcmpiA (lpString1="", lpString2="REPLTMPL.CFG") returned -1
	[0056.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned="REMOTES.ICO"
	[0056.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REPLTMPL.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG"
	[0056.847] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.847] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REPORT.CFG") returned -1
	[0056.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REPORT.CFG") returned -1
	[0056.847] lstrcmpiA (lpString1="", lpString2="REPORT.CFG") returned -1
	[0056.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned="REPLTMPL.CFG"
	[0056.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REPORT.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG"
	[0056.847] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.847] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REPORTL.ICO") returned -1
	[0056.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REPORTL.ICO") returned -1
	[0056.847] lstrcmpiA (lpString1="", lpString2="REPORTL.ICO") returned -1
	[0056.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned="REPORT.CFG"
	[0056.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REPORTL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO"
	[0056.847] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.847] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="REPORTS.ICO") returned -1
	[0056.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REPORTS.ICO") returned -1
	[0056.847] lstrcmpiA (lpString1="", lpString2="REPORTS.ICO") returned -1
	[0056.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned="REPORTL.ICO"
	[0056.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="REPORTS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO"
	[0056.848] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RESEND.CFG") returned -1
	[0056.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RESEND.CFG") returned -1
	[0056.848] lstrcmpiA (lpString1="", lpString2="RESEND.CFG") returned -1
	[0056.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned="REPORTS.ICO"
	[0056.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RESEND.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG"
	[0056.848] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RESENDL.ICO") returned -1
	[0056.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RESENDL.ICO") returned -1
	[0056.848] lstrcmpiA (lpString1="", lpString2="RESENDL.ICO") returned -1
	[0056.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned="RESEND.CFG"
	[0056.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RESENDL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO"
	[0056.848] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RESENDS.ICO") returned -1
	[0056.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RESENDS.ICO") returned -1
	[0056.848] lstrcmpiA (lpString1="", lpString2="RESENDS.ICO") returned -1
	[0056.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned="RESENDL.ICO"
	[0056.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RESENDS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO"
	[0056.849] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.849] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RSSITEM.CFG") returned -1
	[0056.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RSSITEM.CFG") returned -1
	[0056.849] lstrcmpiA (lpString1="", lpString2="RSSITEM.CFG") returned -1
	[0056.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned="RESENDS.ICO"
	[0056.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RSSITEM.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG"
	[0056.849] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.849] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RSSITEML.ICO") returned -1
	[0056.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RSSITEML.ICO") returned -1
	[0056.849] lstrcmpiA (lpString1="", lpString2="RSSITEML.ICO") returned -1
	[0056.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned="RSSITEM.CFG"
	[0056.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RSSITEML.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO"
	[0056.849] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.850] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.850] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RSSITEMS.ICO") returned -1
	[0056.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RSSITEMS.ICO") returned -1
	[0056.850] lstrcmpiA (lpString1="", lpString2="RSSITEMS.ICO") returned -1
	[0056.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned="RSSITEML.ICO"
	[0056.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="RSSITEMS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO"
	[0056.850] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.850] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.850] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDCNCLL.ICO") returned -1
	[0056.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDCNCLL.ICO") returned -1
	[0056.850] lstrcmpiA (lpString1="", lpString2="SCDCNCLL.ICO") returned -1
	[0056.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned="RSSITEMS.ICO"
	[0056.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDCNCLL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO"
	[0056.850] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.850] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.850] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDCNCLS.ICO") returned -1
	[0056.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDCNCLS.ICO") returned -1
	[0056.850] lstrcmpiA (lpString1="", lpString2="SCDCNCLS.ICO") returned -1
	[0056.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned="SCDCNCLL.ICO"
	[0056.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDCNCLS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO"
	[0056.851] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.851] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.851] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDREQL.ICO") returned -1
	[0056.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDREQL.ICO") returned -1
	[0056.851] lstrcmpiA (lpString1="", lpString2="SCDREQL.ICO") returned -1
	[0056.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned="SCDCNCLS.ICO"
	[0056.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.851] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDREQL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO"
	[0056.851] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.851] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.851] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDREQS.ICO") returned -1
	[0056.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDREQS.ICO") returned -1
	[0056.851] lstrcmpiA (lpString1="", lpString2="SCDREQS.ICO") returned -1
	[0056.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.851] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDREQS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO"
	[0056.851] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.851] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.851] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDRESNL.ICO") returned -1
	[0056.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDRESNL.ICO") returned -1
	[0056.851] lstrcmpiA (lpString1="", lpString2="SCDRESNL.ICO") returned -1
	[0056.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.851] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDRESNL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO"
	[0056.851] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.852] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.852] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDRESNS.ICO") returned -1
	[0056.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDRESNS.ICO") returned -1
	[0056.852] lstrcmpiA (lpString1="", lpString2="SCDRESNS.ICO") returned -1
	[0056.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.852] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDRESNS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO"
	[0056.852] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.852] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.852] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDRESPL.ICO") returned -1
	[0056.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDRESPL.ICO") returned -1
	[0056.852] lstrcmpiA (lpString1="", lpString2="SCDRESPL.ICO") returned -1
	[0056.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.852] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDRESPL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO"
	[0056.852] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.853] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDRESPS.ICO") returned -1
	[0056.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDRESPS.ICO") returned -1
	[0056.853] lstrcmpiA (lpString1="", lpString2="SCDRESPS.ICO") returned -1
	[0056.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.853] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDRESPS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO"
	[0056.853] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.853] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDRESTL.ICO") returned -1
	[0056.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDRESTL.ICO") returned -1
	[0056.853] lstrcmpiA (lpString1="", lpString2="SCDRESTL.ICO") returned -1
	[0056.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.853] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDRESTL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO"
	[0056.853] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.853] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCDRESTS.ICO") returned -1
	[0056.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCDRESTS.ICO") returned -1
	[0056.853] lstrcmpiA (lpString1="", lpString2="SCDRESTS.ICO") returned -1
	[0056.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.854] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCDRESTS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO"
	[0056.854] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.854] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.854] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCHDCNCL.CFG") returned -1
	[0056.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHDCNCL.CFG") returned -1
	[0056.854] lstrcmpiA (lpString1="", lpString2="SCHDCNCL.CFG") returned -1
	[0056.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.854] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCHDCNCL.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG"
	[0056.854] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.854] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.854] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCHDREQ.CFG") returned -1
	[0056.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHDREQ.CFG") returned -1
	[0056.854] lstrcmpiA (lpString1="", lpString2="SCHDREQ.CFG") returned -1
	[0056.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\"
	[0056.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned=""
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt"
	[0056.854] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to decrypt files.txt")) returned 0x20
	[0056.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpString2="SCHDREQ.CFG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG"
	[0056.854] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.854] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.858] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCHDRESN.CFG") returned -1
	[0056.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHDRESN.CFG") returned -1
	[0056.858] lstrcmpiA (lpString1="", lpString2="SCHDRESN.CFG") returned -1
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.859] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCHDRESP.CFG") returned -1
	[0056.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHDRESP.CFG") returned -1
	[0056.859] lstrcmpiA (lpString1="", lpString2="SCHDRESP.CFG") returned -1
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.859] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SCHDREST.CFG") returned -1
	[0056.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHDREST.CFG") returned -1
	[0056.859] lstrcmpiA (lpString1="", lpString2="SCHDREST.CFG") returned -1
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.859] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.860] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.861] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0056.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0056.862] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0056.862] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0056.862] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0056.862] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0056.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0057.045] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.045] CloseHandle (hObject=0x88) returned 1
	[0057.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.boom")) returned 1
	[0057.046] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0057.046] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0057.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0057.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0057.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0057.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Graph.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest"
	[0057.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.zip") returned 0
	[0057.047] lstrlenA (lpString="*.zip") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.rar") returned 0
	[0057.047] lstrlenA (lpString="*.rar") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.7z") returned 0
	[0057.047] lstrlenA (lpString="*.7z") returned 4
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.tar") returned 0
	[0057.047] lstrlenA (lpString="*.tar") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.gzip") returned 0
	[0057.047] lstrlenA (lpString="*.gzip") returned 6
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.jpg") returned 0
	[0057.047] lstrlenA (lpString="*.jpg") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.jpeg") returned 0
	[0057.047] lstrlenA (lpString="*.jpeg") returned 6
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.psd") returned 0
	[0057.047] lstrlenA (lpString="*.psd") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.cdr") returned 0
	[0057.047] lstrlenA (lpString="*.cdr") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.dwg") returned 0
	[0057.047] lstrlenA (lpString="*.dwg") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.max") returned 0
	[0057.047] lstrlenA (lpString="*.max") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.bmp") returned 0
	[0057.047] lstrlenA (lpString="*.bmp") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.gif") returned 0
	[0057.047] lstrlenA (lpString="*.gif") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.png") returned 0
	[0057.047] lstrlenA (lpString="*.png") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.doc") returned 0
	[0057.047] lstrlenA (lpString="*.doc") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.docx") returned 0
	[0057.047] lstrlenA (lpString="*.docx") returned 6
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.xls") returned 0
	[0057.047] lstrlenA (lpString="*.xls") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.xlsx") returned 0
	[0057.047] lstrlenA (lpString="*.xlsx") returned 6
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.ppt") returned 0
	[0057.047] lstrlenA (lpString="*.ppt") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.pptx") returned 0
	[0057.047] lstrlenA (lpString="*.pptx") returned 6
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.txt") returned 0
	[0057.047] lstrlenA (lpString="*.txt") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.pdf") returned 0
	[0057.047] lstrlenA (lpString="*.pdf") returned 5
	[0057.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.djvu") returned 0
	[0057.047] lstrlenA (lpString="*.djvu") returned 6
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.htm") returned 0
	[0057.048] lstrlenA (lpString="*.htm") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.html") returned 0
	[0057.048] lstrlenA (lpString="*.html") returned 6
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mdb") returned 0
	[0057.048] lstrlenA (lpString="*.mdb") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.cer") returned 0
	[0057.048] lstrlenA (lpString="*.cer") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.p12") returned 0
	[0057.048] lstrlenA (lpString="*.p12") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.pfx") returned 0
	[0057.048] lstrlenA (lpString="*.pfx") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.kwm") returned 0
	[0057.048] lstrlenA (lpString="*.kwm") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.pwm") returned 0
	[0057.048] lstrlenA (lpString="*.pwm") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.1cd") returned 0
	[0057.048] lstrlenA (lpString="*.1cd") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.md") returned 0
	[0057.048] lstrlenA (lpString="*.md") returned 4
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mdf") returned 0
	[0057.048] lstrlenA (lpString="*.mdf") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.dbf") returned 0
	[0057.048] lstrlenA (lpString="*.dbf") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.odt") returned 0
	[0057.048] lstrlenA (lpString="*.odt") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.vob") returned 0
	[0057.048] lstrlenA (lpString="*.vob") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.ifo") returned 0
	[0057.048] lstrlenA (lpString="*.ifo") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.lnk") returned 0
	[0057.048] lstrlenA (lpString="*.lnk") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.torrent") returned 0
	[0057.048] lstrlenA (lpString="*.torrent") returned 9
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mov") returned 0
	[0057.048] lstrlenA (lpString="*.mov") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.m2v") returned 0
	[0057.048] lstrlenA (lpString="*.m2v") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.3gp") returned 0
	[0057.048] lstrlenA (lpString="*.3gp") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mpeg") returned 0
	[0057.048] lstrlenA (lpString="*.mpeg") returned 6
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mpg") returned 0
	[0057.048] lstrlenA (lpString="*.mpg") returned 5
	[0057.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.flv") returned 0
	[0057.049] lstrlenA (lpString="*.flv") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.avi") returned 0
	[0057.049] lstrlenA (lpString="*.avi") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mp4") returned 0
	[0057.049] lstrlenA (lpString="*.mp4") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.wmv") returned 0
	[0057.049] lstrlenA (lpString="*.wmv") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.divx") returned 0
	[0057.049] lstrlenA (lpString="*.divx") returned 6
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mkv") returned 0
	[0057.049] lstrlenA (lpString="*.mkv") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.mp3") returned 0
	[0057.049] lstrlenA (lpString="*.mp3") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.wav") returned 0
	[0057.049] lstrlenA (lpString="*.wav") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.flac") returned 0
	[0057.049] lstrlenA (lpString="*.flac") returned 6
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.ape") returned 0
	[0057.049] lstrlenA (lpString="*.ape") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.wma") returned 0
	[0057.049] lstrlenA (lpString="*.wma") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.ac3") returned 0
	[0057.049] lstrlenA (lpString="*.ac3") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.exe") returned 0
	[0057.049] lstrlenA (lpString="*.exe") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", pszSpec="*.apk") returned 0
	[0057.049] lstrlenA (lpString="*.apk") returned 5
	[0057.049] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0057.049] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0057.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0057.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0057.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0057.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GRAPH.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO"
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.zip") returned 0
	[0057.049] lstrlenA (lpString="*.zip") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.rar") returned 0
	[0057.049] lstrlenA (lpString="*.rar") returned 5
	[0057.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.7z") returned 0
	[0057.049] lstrlenA (lpString="*.7z") returned 4
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.tar") returned 0
	[0057.050] lstrlenA (lpString="*.tar") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.gzip") returned 0
	[0057.050] lstrlenA (lpString="*.gzip") returned 6
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.jpg") returned 0
	[0057.050] lstrlenA (lpString="*.jpg") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.jpeg") returned 0
	[0057.050] lstrlenA (lpString="*.jpeg") returned 6
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.psd") returned 0
	[0057.050] lstrlenA (lpString="*.psd") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.cdr") returned 0
	[0057.050] lstrlenA (lpString="*.cdr") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.dwg") returned 0
	[0057.050] lstrlenA (lpString="*.dwg") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.max") returned 0
	[0057.050] lstrlenA (lpString="*.max") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.bmp") returned 0
	[0057.050] lstrlenA (lpString="*.bmp") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.gif") returned 0
	[0057.050] lstrlenA (lpString="*.gif") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.png") returned 0
	[0057.050] lstrlenA (lpString="*.png") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.doc") returned 0
	[0057.050] lstrlenA (lpString="*.doc") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.docx") returned 0
	[0057.050] lstrlenA (lpString="*.docx") returned 6
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.xls") returned 0
	[0057.050] lstrlenA (lpString="*.xls") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.xlsx") returned 0
	[0057.050] lstrlenA (lpString="*.xlsx") returned 6
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.ppt") returned 0
	[0057.050] lstrlenA (lpString="*.ppt") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.pptx") returned 0
	[0057.050] lstrlenA (lpString="*.pptx") returned 6
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.txt") returned 0
	[0057.050] lstrlenA (lpString="*.txt") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.pdf") returned 0
	[0057.050] lstrlenA (lpString="*.pdf") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.djvu") returned 0
	[0057.050] lstrlenA (lpString="*.djvu") returned 6
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.htm") returned 0
	[0057.050] lstrlenA (lpString="*.htm") returned 5
	[0057.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.html") returned 0
	[0057.050] lstrlenA (lpString="*.html") returned 6
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mdb") returned 0
	[0057.051] lstrlenA (lpString="*.mdb") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.cer") returned 0
	[0057.051] lstrlenA (lpString="*.cer") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.p12") returned 0
	[0057.051] lstrlenA (lpString="*.p12") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.pfx") returned 0
	[0057.051] lstrlenA (lpString="*.pfx") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.kwm") returned 0
	[0057.051] lstrlenA (lpString="*.kwm") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.pwm") returned 0
	[0057.051] lstrlenA (lpString="*.pwm") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.1cd") returned 0
	[0057.051] lstrlenA (lpString="*.1cd") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.md") returned 0
	[0057.051] lstrlenA (lpString="*.md") returned 4
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mdf") returned 0
	[0057.051] lstrlenA (lpString="*.mdf") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.dbf") returned 0
	[0057.051] lstrlenA (lpString="*.dbf") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.odt") returned 0
	[0057.051] lstrlenA (lpString="*.odt") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.vob") returned 0
	[0057.051] lstrlenA (lpString="*.vob") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.ifo") returned 0
	[0057.051] lstrlenA (lpString="*.ifo") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.lnk") returned 0
	[0057.051] lstrlenA (lpString="*.lnk") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.torrent") returned 0
	[0057.051] lstrlenA (lpString="*.torrent") returned 9
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mov") returned 0
	[0057.051] lstrlenA (lpString="*.mov") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.m2v") returned 0
	[0057.051] lstrlenA (lpString="*.m2v") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.3gp") returned 0
	[0057.051] lstrlenA (lpString="*.3gp") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mpeg") returned 0
	[0057.051] lstrlenA (lpString="*.mpeg") returned 6
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mpg") returned 0
	[0057.051] lstrlenA (lpString="*.mpg") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.flv") returned 0
	[0057.051] lstrlenA (lpString="*.flv") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.avi") returned 0
	[0057.051] lstrlenA (lpString="*.avi") returned 5
	[0057.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mp4") returned 0
	[0057.051] lstrlenA (lpString="*.mp4") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.wmv") returned 0
	[0057.052] lstrlenA (lpString="*.wmv") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.divx") returned 0
	[0057.052] lstrlenA (lpString="*.divx") returned 6
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mkv") returned 0
	[0057.052] lstrlenA (lpString="*.mkv") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.mp3") returned 0
	[0057.052] lstrlenA (lpString="*.mp3") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.wav") returned 0
	[0057.052] lstrlenA (lpString="*.wav") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.flac") returned 0
	[0057.052] lstrlenA (lpString="*.flac") returned 6
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.ape") returned 0
	[0057.052] lstrlenA (lpString="*.ape") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.wma") returned 0
	[0057.052] lstrlenA (lpString="*.wma") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.ac3") returned 0
	[0057.052] lstrlenA (lpString="*.ac3") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.exe") returned 0
	[0057.052] lstrlenA (lpString="*.exe") returned 5
	[0057.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", pszSpec="*.apk") returned 0
	[0057.052] lstrlenA (lpString="*.apk") returned 5
	[0057.052] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0057.052] lstrcmpA (lpString1=".", lpString2="Groove") returned -1
	[0057.052] lstrcmpA (lpString1="..", lpString2="Groove") returned -1
	[0057.052] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0057.120] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.120] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0057.120] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.120] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.120] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0057.120] lstrcmpA (lpString1=".", lpString2="Certificates") returned -1
	[0057.120] lstrcmpA (lpString1="..", lpString2="Certificates") returned -1
	[0057.120] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0057.121] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.121] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0057.121] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.121] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.121] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0057.121] lstrcmpA (lpString1=".", lpString2="groove.net") returned -1
	[0057.121] lstrcmpA (lpString1="..", lpString2="groove.net") returned -1
	[0057.121] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0057.122] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.122] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.122] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.122] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.122] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.122] lstrcmpA (lpString1=".", lpString2="Components") returned -1
	[0057.122] lstrcmpA (lpString1="..", lpString2="Components") returned -1
	[0057.122] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0057.123] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.123] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.123] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.123] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.123] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.123] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0057.123] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\") returned=""
	[0057.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\HOW TO DECRYPT FILES.txt"
	[0057.123] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\how to decrypt files.txt")) returned 0xffffffff
	[0057.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.124] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0057.124] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0057.125] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0057.125] CloseHandle (hObject=0x98) returned 1
	[0057.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", lpString2="SignedComponents.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer"
	[0057.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.zip") returned 0
	[0057.125] lstrlenA (lpString="*.zip") returned 5
	[0057.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.rar") returned 0
	[0057.125] lstrlenA (lpString="*.rar") returned 5
	[0057.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.7z") returned 0
	[0057.125] lstrlenA (lpString="*.7z") returned 4
	[0057.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.tar") returned 0
	[0057.125] lstrlenA (lpString="*.tar") returned 5
	[0057.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.gzip") returned 0
	[0057.125] lstrlenA (lpString="*.gzip") returned 6
	[0057.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.jpg") returned 0
	[0057.126] lstrlenA (lpString="*.jpg") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.jpeg") returned 0
	[0057.126] lstrlenA (lpString="*.jpeg") returned 6
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.psd") returned 0
	[0057.126] lstrlenA (lpString="*.psd") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.cdr") returned 0
	[0057.126] lstrlenA (lpString="*.cdr") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.dwg") returned 0
	[0057.126] lstrlenA (lpString="*.dwg") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.max") returned 0
	[0057.126] lstrlenA (lpString="*.max") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.bmp") returned 0
	[0057.126] lstrlenA (lpString="*.bmp") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.gif") returned 0
	[0057.126] lstrlenA (lpString="*.gif") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.png") returned 0
	[0057.126] lstrlenA (lpString="*.png") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.doc") returned 0
	[0057.126] lstrlenA (lpString="*.doc") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.docx") returned 0
	[0057.126] lstrlenA (lpString="*.docx") returned 6
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.xls") returned 0
	[0057.126] lstrlenA (lpString="*.xls") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.xlsx") returned 0
	[0057.126] lstrlenA (lpString="*.xlsx") returned 6
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.ppt") returned 0
	[0057.126] lstrlenA (lpString="*.ppt") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.pptx") returned 0
	[0057.126] lstrlenA (lpString="*.pptx") returned 6
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.txt") returned 0
	[0057.126] lstrlenA (lpString="*.txt") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.pdf") returned 0
	[0057.126] lstrlenA (lpString="*.pdf") returned 5
	[0057.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.djvu") returned 0
	[0057.126] lstrlenA (lpString="*.djvu") returned 6
	[0057.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.htm") returned 0
	[0057.127] lstrlenA (lpString="*.htm") returned 5
	[0057.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.html") returned 0
	[0057.127] lstrlenA (lpString="*.html") returned 6
	[0057.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.mdb") returned 0
	[0057.127] lstrlenA (lpString="*.mdb") returned 5
	[0057.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", pszSpec="*.cer") returned 1
	[0057.127] lstrlenA (lpString="*.cer") returned 5
	[0057.127] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer"
	[0057.127] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer"
	[0057.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer."
	[0057.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.Boom"
	[0057.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.127] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2de
	[0057.127] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6bcf1000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2c00d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6bcf1000, dwHighDateTime=0x1c747ea)) returned 1
	[0057.127] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.127] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2bb, lpOverlapped=0x0) returned 1
	[0057.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned="SignedComponents.cer"
	[0057.139] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.139] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2bb, lpOverlapped=0x0) returned 1
	[0057.139] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.139] CloseHandle (hObject=0x98) returned 1
	[0057.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.boom")) returned 1
	[0057.140] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0057.140] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0057.140] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.140] lstrcmpA (lpString1=".", lpString2="ManagedObjects") returned -1
	[0057.140] lstrcmpA (lpString1="..", lpString2="ManagedObjects") returned -1
	[0057.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*.*") returned="*.*"
	[0057.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", lpString2="ManagedObjects" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects"
	[0057.140] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned 88
	[0057.140] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0057.194] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.194] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.194] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.194] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.194] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.194] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0057.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SignedManagedObjects.cer") returned -1
	[0057.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignedManagedObjects.cer") returned -1
	[0057.194] lstrcmpiA (lpString1="", lpString2="SignedManagedObjects.cer") returned -1
	[0057.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*.*") returned="*.*"
	[0057.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\"
	[0057.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\") returned=""
	[0057.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\HOW TO DECRYPT FILES.txt"
	[0057.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\how to decrypt files.txt")) returned 0xffffffff
	[0057.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.195] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0057.195] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0057.196] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0057.196] CloseHandle (hObject=0x98) returned 1
	[0057.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", lpString2="SignedManagedObjects.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer"
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.zip") returned 0
	[0057.196] lstrlenA (lpString="*.zip") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.rar") returned 0
	[0057.196] lstrlenA (lpString="*.rar") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.7z") returned 0
	[0057.196] lstrlenA (lpString="*.7z") returned 4
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.tar") returned 0
	[0057.196] lstrlenA (lpString="*.tar") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.gzip") returned 0
	[0057.196] lstrlenA (lpString="*.gzip") returned 6
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.jpg") returned 0
	[0057.196] lstrlenA (lpString="*.jpg") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.jpeg") returned 0
	[0057.196] lstrlenA (lpString="*.jpeg") returned 6
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.psd") returned 0
	[0057.196] lstrlenA (lpString="*.psd") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.cdr") returned 0
	[0057.196] lstrlenA (lpString="*.cdr") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.dwg") returned 0
	[0057.196] lstrlenA (lpString="*.dwg") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.max") returned 0
	[0057.196] lstrlenA (lpString="*.max") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.bmp") returned 0
	[0057.196] lstrlenA (lpString="*.bmp") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.gif") returned 0
	[0057.196] lstrlenA (lpString="*.gif") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.png") returned 0
	[0057.196] lstrlenA (lpString="*.png") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.doc") returned 0
	[0057.196] lstrlenA (lpString="*.doc") returned 5
	[0057.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.docx") returned 0
	[0057.196] lstrlenA (lpString="*.docx") returned 6
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.xls") returned 0
	[0057.197] lstrlenA (lpString="*.xls") returned 5
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.xlsx") returned 0
	[0057.197] lstrlenA (lpString="*.xlsx") returned 6
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.ppt") returned 0
	[0057.197] lstrlenA (lpString="*.ppt") returned 5
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.pptx") returned 0
	[0057.197] lstrlenA (lpString="*.pptx") returned 6
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.txt") returned 0
	[0057.197] lstrlenA (lpString="*.txt") returned 5
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.pdf") returned 0
	[0057.197] lstrlenA (lpString="*.pdf") returned 5
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.djvu") returned 0
	[0057.197] lstrlenA (lpString="*.djvu") returned 6
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.htm") returned 0
	[0057.197] lstrlenA (lpString="*.htm") returned 5
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.html") returned 0
	[0057.197] lstrlenA (lpString="*.html") returned 6
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.mdb") returned 0
	[0057.197] lstrlenA (lpString="*.mdb") returned 5
	[0057.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", pszSpec="*.cer") returned 1
	[0057.197] lstrlenA (lpString="*.cer") returned 5
	[0057.197] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer"
	[0057.197] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer"
	[0057.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer."
	[0057.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.Boom"
	[0057.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.198] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x290
	[0057.198] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6bcf1000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a95a430, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6bcf1000, dwHighDateTime=0x1c747ea)) returned 1
	[0057.198] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.198] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x26d, lpOverlapped=0x0) returned 1
	[0057.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned="SignedManagedObjects.cer"
	[0057.217] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.217] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x26d, lpOverlapped=0x0) returned 1
	[0057.217] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.217] CloseHandle (hObject=0x98) returned 1
	[0057.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.boom")) returned 1
	[0057.218] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0057.218] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0057.218] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.218] lstrcmpA (lpString1=".", lpString2="Servers") returned -1
	[0057.218] lstrcmpA (lpString1="..", lpString2="Servers") returned -1
	[0057.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*.*") returned="*.*"
	[0057.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", lpString2="Servers" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers"
	[0057.218] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned 81
	[0057.218] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0057.219] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.219] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.219] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.219] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.219] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.219] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0057.219] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Management.cer") returned -1
	[0057.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Management.cer") returned -1
	[0057.219] lstrcmpiA (lpString1="", lpString2="Management.cer") returned -1
	[0057.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*.*") returned="*.*"
	[0057.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\"
	[0057.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned=""
	[0057.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW TO DECRYPT FILES.txt"
	[0057.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\how to decrypt files.txt")) returned 0xffffffff
	[0057.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.219] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0057.219] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0057.220] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0057.220] CloseHandle (hObject=0x98) returned 1
	[0057.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", lpString2="Management.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer"
	[0057.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.zip") returned 0
	[0057.220] lstrlenA (lpString="*.zip") returned 5
	[0057.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.rar") returned 0
	[0057.220] lstrlenA (lpString="*.rar") returned 5
	[0057.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.7z") returned 0
	[0057.221] lstrlenA (lpString="*.7z") returned 4
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.tar") returned 0
	[0057.221] lstrlenA (lpString="*.tar") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.gzip") returned 0
	[0057.221] lstrlenA (lpString="*.gzip") returned 6
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.jpg") returned 0
	[0057.221] lstrlenA (lpString="*.jpg") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.jpeg") returned 0
	[0057.221] lstrlenA (lpString="*.jpeg") returned 6
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.psd") returned 0
	[0057.221] lstrlenA (lpString="*.psd") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.cdr") returned 0
	[0057.221] lstrlenA (lpString="*.cdr") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.dwg") returned 0
	[0057.221] lstrlenA (lpString="*.dwg") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.max") returned 0
	[0057.221] lstrlenA (lpString="*.max") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.bmp") returned 0
	[0057.221] lstrlenA (lpString="*.bmp") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.gif") returned 0
	[0057.221] lstrlenA (lpString="*.gif") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.png") returned 0
	[0057.221] lstrlenA (lpString="*.png") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.doc") returned 0
	[0057.221] lstrlenA (lpString="*.doc") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.docx") returned 0
	[0057.221] lstrlenA (lpString="*.docx") returned 6
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.xls") returned 0
	[0057.221] lstrlenA (lpString="*.xls") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.xlsx") returned 0
	[0057.221] lstrlenA (lpString="*.xlsx") returned 6
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.ppt") returned 0
	[0057.221] lstrlenA (lpString="*.ppt") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.pptx") returned 0
	[0057.221] lstrlenA (lpString="*.pptx") returned 6
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.txt") returned 0
	[0057.221] lstrlenA (lpString="*.txt") returned 5
	[0057.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.pdf") returned 0
	[0057.222] lstrlenA (lpString="*.pdf") returned 5
	[0057.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.djvu") returned 0
	[0057.222] lstrlenA (lpString="*.djvu") returned 6
	[0057.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.htm") returned 0
	[0057.222] lstrlenA (lpString="*.htm") returned 5
	[0057.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.html") returned 0
	[0057.222] lstrlenA (lpString="*.html") returned 6
	[0057.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.mdb") returned 0
	[0057.222] lstrlenA (lpString="*.mdb") returned 5
	[0057.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", pszSpec="*.cer") returned 1
	[0057.222] lstrlenA (lpString="*.cer") returned 5
	[0057.222] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer"
	[0057.222] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer"
	[0057.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer."
	[0057.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.Boom"
	[0057.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.222] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b0
	[0057.222] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582abeb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.222] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.222] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x38d, lpOverlapped=0x0) returned 1
	[0057.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned="Management.cer"
	[0057.267] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.267] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x38d, lpOverlapped=0x0) returned 1
	[0057.267] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.267] CloseHandle (hObject=0x98) returned 1
	[0057.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer.boom")) returned 1
	[0057.268] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.268] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0057.268] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RELAY.CER") returned -1
	[0057.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RELAY.CER") returned -1
	[0057.268] lstrcmpiA (lpString1="", lpString2="RELAY.CER") returned -1
	[0057.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned="Management.cer"
	[0057.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\"
	[0057.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned=""
	[0057.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW TO DECRYPT FILES.txt"
	[0057.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\how to decrypt files.txt")) returned 0x20
	[0057.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", lpString2="RELAY.CER" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER"
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.zip") returned 0
	[0057.268] lstrlenA (lpString="*.zip") returned 5
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.rar") returned 0
	[0057.268] lstrlenA (lpString="*.rar") returned 5
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.7z") returned 0
	[0057.268] lstrlenA (lpString="*.7z") returned 4
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.tar") returned 0
	[0057.268] lstrlenA (lpString="*.tar") returned 5
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.gzip") returned 0
	[0057.268] lstrlenA (lpString="*.gzip") returned 6
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.jpg") returned 0
	[0057.268] lstrlenA (lpString="*.jpg") returned 5
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.jpeg") returned 0
	[0057.268] lstrlenA (lpString="*.jpeg") returned 6
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.psd") returned 0
	[0057.268] lstrlenA (lpString="*.psd") returned 5
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.cdr") returned 0
	[0057.268] lstrlenA (lpString="*.cdr") returned 5
	[0057.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.dwg") returned 0
	[0057.268] lstrlenA (lpString="*.dwg") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.max") returned 0
	[0057.269] lstrlenA (lpString="*.max") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.bmp") returned 0
	[0057.269] lstrlenA (lpString="*.bmp") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.gif") returned 0
	[0057.269] lstrlenA (lpString="*.gif") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.png") returned 0
	[0057.269] lstrlenA (lpString="*.png") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.doc") returned 0
	[0057.269] lstrlenA (lpString="*.doc") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.docx") returned 0
	[0057.269] lstrlenA (lpString="*.docx") returned 6
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.xls") returned 0
	[0057.269] lstrlenA (lpString="*.xls") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.xlsx") returned 0
	[0057.269] lstrlenA (lpString="*.xlsx") returned 6
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.ppt") returned 0
	[0057.269] lstrlenA (lpString="*.ppt") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.pptx") returned 0
	[0057.269] lstrlenA (lpString="*.pptx") returned 6
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.txt") returned 0
	[0057.269] lstrlenA (lpString="*.txt") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.pdf") returned 0
	[0057.269] lstrlenA (lpString="*.pdf") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.djvu") returned 0
	[0057.269] lstrlenA (lpString="*.djvu") returned 6
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.htm") returned 0
	[0057.269] lstrlenA (lpString="*.htm") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.html") returned 0
	[0057.269] lstrlenA (lpString="*.html") returned 6
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.mdb") returned 0
	[0057.269] lstrlenA (lpString="*.mdb") returned 5
	[0057.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", pszSpec="*.cer") returned 1
	[0057.269] lstrlenA (lpString="*.cer") returned 5
	[0057.269] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER"
	[0057.269] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER"
	[0057.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER."
	[0057.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.Boom"
	[0057.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.270] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3de
	[0057.270] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d169470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.270] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.270] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3bb, lpOverlapped=0x0) returned 1
	[0057.296] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER") returned="RELAY.CER"
	[0057.296] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.296] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3bb, lpOverlapped=0x0) returned 1
	[0057.296] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.296] CloseHandle (hObject=0x98) returned 1
	[0057.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer.boom")) returned 1
	[0057.300] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0057.300] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0057.300] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0057.300] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0057.300] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0057.300] lstrcmpA (lpString1=".", lpString2="Verisign") returned -1
	[0057.300] lstrcmpA (lpString1="..", lpString2="Verisign") returned -1
	[0057.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*.*") returned="*.*"
	[0057.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\", lpString2="Verisign" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign"
	[0057.301] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned 71
	[0057.301] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0057.302] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.302] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.302] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.302] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.302] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.302] lstrcmpA (lpString1=".", lpString2="Components") returned -1
	[0057.302] lstrcmpA (lpString1="..", lpString2="Components") returned -1
	[0057.302] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*.*") returned="*.*"
	[0057.302] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\", lpString2="Components" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components"
	[0057.302] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned 82
	[0057.302] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0057.313] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.313] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.313] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.313] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.313] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.313] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0057.313] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned -1
	[0057.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned -1
	[0057.314] lstrcmpiA (lpString1="", lpString2="VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned -1
	[0057.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*.*") returned="*.*"
	[0057.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\"
	[0057.314] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned=""
	[0057.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt"
	[0057.314] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\how to decrypt files.txt")) returned 0xffffffff
	[0057.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.314] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0057.314] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0057.315] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0057.315] CloseHandle (hObject=0x98) returned 1
	[0057.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpString2="VeriSign_Class_3_Code_Signing_2001-4_CA.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer"
	[0057.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.zip") returned 0
	[0057.315] lstrlenA (lpString="*.zip") returned 5
	[0057.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.rar") returned 0
	[0057.315] lstrlenA (lpString="*.rar") returned 5
	[0057.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.7z") returned 0
	[0057.315] lstrlenA (lpString="*.7z") returned 4
	[0057.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.tar") returned 0
	[0057.315] lstrlenA (lpString="*.tar") returned 5
	[0057.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.gzip") returned 0
	[0057.315] lstrlenA (lpString="*.gzip") returned 6
	[0057.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.jpg") returned 0
	[0057.315] lstrlenA (lpString="*.jpg") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.jpeg") returned 0
	[0057.316] lstrlenA (lpString="*.jpeg") returned 6
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.psd") returned 0
	[0057.316] lstrlenA (lpString="*.psd") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.cdr") returned 0
	[0057.316] lstrlenA (lpString="*.cdr") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.dwg") returned 0
	[0057.316] lstrlenA (lpString="*.dwg") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.max") returned 0
	[0057.316] lstrlenA (lpString="*.max") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.bmp") returned 0
	[0057.316] lstrlenA (lpString="*.bmp") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.gif") returned 0
	[0057.316] lstrlenA (lpString="*.gif") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.png") returned 0
	[0057.316] lstrlenA (lpString="*.png") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.doc") returned 0
	[0057.316] lstrlenA (lpString="*.doc") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.docx") returned 0
	[0057.316] lstrlenA (lpString="*.docx") returned 6
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.xls") returned 0
	[0057.316] lstrlenA (lpString="*.xls") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.xlsx") returned 0
	[0057.316] lstrlenA (lpString="*.xlsx") returned 6
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.ppt") returned 0
	[0057.316] lstrlenA (lpString="*.ppt") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.pptx") returned 0
	[0057.316] lstrlenA (lpString="*.pptx") returned 6
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.txt") returned 0
	[0057.316] lstrlenA (lpString="*.txt") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.pdf") returned 0
	[0057.316] lstrlenA (lpString="*.pdf") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.djvu") returned 0
	[0057.316] lstrlenA (lpString="*.djvu") returned 6
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.htm") returned 0
	[0057.316] lstrlenA (lpString="*.htm") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.html") returned 0
	[0057.316] lstrlenA (lpString="*.html") returned 6
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.mdb") returned 0
	[0057.316] lstrlenA (lpString="*.mdb") returned 5
	[0057.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", pszSpec="*.cer") returned 1
	[0057.316] lstrlenA (lpString="*.cer") returned 5
	[0057.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer"
	[0057.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer"
	[0057.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer."
	[0057.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.Boom"
	[0057.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.317] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ae
	[0057.317] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.317] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.317] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x38b, lpOverlapped=0x0) returned 1
	[0057.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned="VeriSign_Class_3_Code_Signing_2001-4_CA.cer"
	[0057.327] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.327] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x38b, lpOverlapped=0x0) returned 1
	[0057.327] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.327] CloseHandle (hObject=0x98) returned 1
	[0057.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.boom")) returned 1
	[0057.328] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.328] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0057.328] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VeriSign_Class_3_Public_Primary_CA.cer") returned -1
	[0057.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VeriSign_Class_3_Public_Primary_CA.cer") returned -1
	[0057.328] lstrcmpiA (lpString1="", lpString2="VeriSign_Class_3_Public_Primary_CA.cer") returned -1
	[0057.328] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned="VeriSign_Class_3_Code_Signing_2001-4_CA.cer"
	[0057.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\"
	[0057.328] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned=""
	[0057.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt"
	[0057.328] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\how to decrypt files.txt")) returned 0x20
	[0057.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpString2="VeriSign_Class_3_Public_Primary_CA.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer"
	[0057.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.zip") returned 0
	[0057.328] lstrlenA (lpString="*.zip") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.rar") returned 0
	[0057.329] lstrlenA (lpString="*.rar") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.7z") returned 0
	[0057.329] lstrlenA (lpString="*.7z") returned 4
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.tar") returned 0
	[0057.329] lstrlenA (lpString="*.tar") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.gzip") returned 0
	[0057.329] lstrlenA (lpString="*.gzip") returned 6
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.jpg") returned 0
	[0057.329] lstrlenA (lpString="*.jpg") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.jpeg") returned 0
	[0057.329] lstrlenA (lpString="*.jpeg") returned 6
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.psd") returned 0
	[0057.329] lstrlenA (lpString="*.psd") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.cdr") returned 0
	[0057.329] lstrlenA (lpString="*.cdr") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.dwg") returned 0
	[0057.329] lstrlenA (lpString="*.dwg") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.max") returned 0
	[0057.329] lstrlenA (lpString="*.max") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.bmp") returned 0
	[0057.329] lstrlenA (lpString="*.bmp") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.gif") returned 0
	[0057.329] lstrlenA (lpString="*.gif") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.png") returned 0
	[0057.329] lstrlenA (lpString="*.png") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.doc") returned 0
	[0057.329] lstrlenA (lpString="*.doc") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.docx") returned 0
	[0057.329] lstrlenA (lpString="*.docx") returned 6
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.xls") returned 0
	[0057.329] lstrlenA (lpString="*.xls") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.xlsx") returned 0
	[0057.329] lstrlenA (lpString="*.xlsx") returned 6
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.ppt") returned 0
	[0057.329] lstrlenA (lpString="*.ppt") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.pptx") returned 0
	[0057.329] lstrlenA (lpString="*.pptx") returned 6
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.txt") returned 0
	[0057.329] lstrlenA (lpString="*.txt") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.pdf") returned 0
	[0057.329] lstrlenA (lpString="*.pdf") returned 5
	[0057.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.djvu") returned 0
	[0057.330] lstrlenA (lpString="*.djvu") returned 6
	[0057.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.htm") returned 0
	[0057.330] lstrlenA (lpString="*.htm") returned 5
	[0057.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.html") returned 0
	[0057.330] lstrlenA (lpString="*.html") returned 6
	[0057.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.mdb") returned 0
	[0057.330] lstrlenA (lpString="*.mdb") returned 5
	[0057.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", pszSpec="*.cer") returned 1
	[0057.330] lstrlenA (lpString="*.cer") returned 5
	[0057.330] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer"
	[0057.330] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer"
	[0057.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer."
	[0057.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.Boom"
	[0057.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.331] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x240
	[0057.331] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.331] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.331] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x21d, lpOverlapped=0x0) returned 1
	[0057.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned="VeriSign_Class_3_Public_Primary_CA.cer"
	[0057.341] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.342] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x21d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x21d, lpOverlapped=0x0) returned 1
	[0057.342] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.342] CloseHandle (hObject=0x98) returned 1
	[0057.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.boom")) returned 1
	[0057.343] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0057.343] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0057.343] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VS_ComponentSigningIntermediate.cer") returned -1
	[0057.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VS_ComponentSigningIntermediate.cer") returned -1
	[0057.343] lstrcmpiA (lpString1="", lpString2="VS_ComponentSigningIntermediate.cer") returned -1
	[0057.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned="VeriSign_Class_3_Public_Primary_CA.cer"
	[0057.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\"
	[0057.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned=""
	[0057.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt"
	[0057.343] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\how to decrypt files.txt")) returned 0x20
	[0057.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpString2="VS_ComponentSigningIntermediate.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer"
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.zip") returned 0
	[0057.343] lstrlenA (lpString="*.zip") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.rar") returned 0
	[0057.343] lstrlenA (lpString="*.rar") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.7z") returned 0
	[0057.343] lstrlenA (lpString="*.7z") returned 4
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.tar") returned 0
	[0057.343] lstrlenA (lpString="*.tar") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.gzip") returned 0
	[0057.343] lstrlenA (lpString="*.gzip") returned 6
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.jpg") returned 0
	[0057.343] lstrlenA (lpString="*.jpg") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.jpeg") returned 0
	[0057.343] lstrlenA (lpString="*.jpeg") returned 6
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.psd") returned 0
	[0057.343] lstrlenA (lpString="*.psd") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.cdr") returned 0
	[0057.343] lstrlenA (lpString="*.cdr") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.dwg") returned 0
	[0057.343] lstrlenA (lpString="*.dwg") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.max") returned 0
	[0057.343] lstrlenA (lpString="*.max") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.bmp") returned 0
	[0057.343] lstrlenA (lpString="*.bmp") returned 5
	[0057.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.gif") returned 0
	[0057.343] lstrlenA (lpString="*.gif") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.png") returned 0
	[0057.344] lstrlenA (lpString="*.png") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.doc") returned 0
	[0057.344] lstrlenA (lpString="*.doc") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.docx") returned 0
	[0057.344] lstrlenA (lpString="*.docx") returned 6
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.xls") returned 0
	[0057.344] lstrlenA (lpString="*.xls") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.xlsx") returned 0
	[0057.344] lstrlenA (lpString="*.xlsx") returned 6
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.ppt") returned 0
	[0057.344] lstrlenA (lpString="*.ppt") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.pptx") returned 0
	[0057.344] lstrlenA (lpString="*.pptx") returned 6
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.txt") returned 0
	[0057.344] lstrlenA (lpString="*.txt") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.pdf") returned 0
	[0057.344] lstrlenA (lpString="*.pdf") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.djvu") returned 0
	[0057.344] lstrlenA (lpString="*.djvu") returned 6
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.htm") returned 0
	[0057.344] lstrlenA (lpString="*.htm") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.html") returned 0
	[0057.344] lstrlenA (lpString="*.html") returned 6
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.mdb") returned 0
	[0057.344] lstrlenA (lpString="*.mdb") returned 5
	[0057.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", pszSpec="*.cer") returned 1
	[0057.344] lstrlenA (lpString="*.cer") returned 5
	[0057.344] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer"
	[0057.344] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer"
	[0057.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer."
	[0057.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.Boom"
	[0057.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0057.347] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38b
	[0057.347] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x70744630, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.347] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.348] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x368, lpOverlapped=0x0) returned 1
	[0057.457] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer") returned="VS_ComponentSigningIntermediate.cer"
	[0057.457] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.457] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x368, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x368, lpOverlapped=0x0) returned 1
	[0057.457] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.457] CloseHandle (hObject=0x98) returned 1
	[0057.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.boom")) returned 1
	[0057.458] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0057.458] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0057.458] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0057.458] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0057.458] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0057.458] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0057.458] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0057.458] lstrcmpA (lpString1=".", lpString2="Sounds") returned -1
	[0057.458] lstrcmpA (lpString1="..", lpString2="Sounds") returned -1
	[0057.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*"
	[0057.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="Sounds" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds"
	[0057.458] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds") returned 56
	[0057.458] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0057.459] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.460] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0057.460] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.460] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.460] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0057.460] lstrcmpA (lpString1=".", lpString2="People") returned -1
	[0057.460] lstrcmpA (lpString1="..", lpString2="People") returned -1
	[0057.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*") returned="*.*"
	[0057.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", lpString2="People" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People"
	[0057.460] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People") returned 63
	[0057.460] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0057.567] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0057.567] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.567] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0057.567] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0057.567] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.567] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0057.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COUGH.WAV") returned 1
	[0057.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COUGH.WAV") returned 1
	[0057.567] lstrcmpiA (lpString1="", lpString2="COUGH.WAV") returned -1
	[0057.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*.*") returned="*.*"
	[0057.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\"
	[0057.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned=""
	[0057.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt"
	[0057.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0xffffffff
	[0057.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.568] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0057.568] WriteFile (in: hFile=0x94, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0057.569] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0057.569] CloseHandle (hObject=0x94) returned 1
	[0057.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="COUGH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV"
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.zip") returned 0
	[0057.569] lstrlenA (lpString="*.zip") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.rar") returned 0
	[0057.569] lstrlenA (lpString="*.rar") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.7z") returned 0
	[0057.569] lstrlenA (lpString="*.7z") returned 4
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.tar") returned 0
	[0057.569] lstrlenA (lpString="*.tar") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.gzip") returned 0
	[0057.569] lstrlenA (lpString="*.gzip") returned 6
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.jpg") returned 0
	[0057.569] lstrlenA (lpString="*.jpg") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.jpeg") returned 0
	[0057.569] lstrlenA (lpString="*.jpeg") returned 6
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.psd") returned 0
	[0057.569] lstrlenA (lpString="*.psd") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.cdr") returned 0
	[0057.569] lstrlenA (lpString="*.cdr") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.dwg") returned 0
	[0057.569] lstrlenA (lpString="*.dwg") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.max") returned 0
	[0057.569] lstrlenA (lpString="*.max") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.bmp") returned 0
	[0057.569] lstrlenA (lpString="*.bmp") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.gif") returned 0
	[0057.569] lstrlenA (lpString="*.gif") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.png") returned 0
	[0057.569] lstrlenA (lpString="*.png") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.doc") returned 0
	[0057.569] lstrlenA (lpString="*.doc") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.docx") returned 0
	[0057.569] lstrlenA (lpString="*.docx") returned 6
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.xls") returned 0
	[0057.569] lstrlenA (lpString="*.xls") returned 5
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.xlsx") returned 0
	[0057.569] lstrlenA (lpString="*.xlsx") returned 6
	[0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.ppt") returned 0
	[0057.569] lstrlenA (lpString="*.ppt") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.pptx") returned 0
	[0057.570] lstrlenA (lpString="*.pptx") returned 6
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.txt") returned 0
	[0057.570] lstrlenA (lpString="*.txt") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.pdf") returned 0
	[0057.570] lstrlenA (lpString="*.pdf") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.djvu") returned 0
	[0057.570] lstrlenA (lpString="*.djvu") returned 6
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.htm") returned 0
	[0057.570] lstrlenA (lpString="*.htm") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.html") returned 0
	[0057.570] lstrlenA (lpString="*.html") returned 6
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mdb") returned 0
	[0057.570] lstrlenA (lpString="*.mdb") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.cer") returned 0
	[0057.570] lstrlenA (lpString="*.cer") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.p12") returned 0
	[0057.570] lstrlenA (lpString="*.p12") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.pfx") returned 0
	[0057.570] lstrlenA (lpString="*.pfx") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.kwm") returned 0
	[0057.570] lstrlenA (lpString="*.kwm") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.pwm") returned 0
	[0057.570] lstrlenA (lpString="*.pwm") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.1cd") returned 0
	[0057.570] lstrlenA (lpString="*.1cd") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.md") returned 0
	[0057.570] lstrlenA (lpString="*.md") returned 4
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mdf") returned 0
	[0057.570] lstrlenA (lpString="*.mdf") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.dbf") returned 0
	[0057.570] lstrlenA (lpString="*.dbf") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.odt") returned 0
	[0057.570] lstrlenA (lpString="*.odt") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.vob") returned 0
	[0057.570] lstrlenA (lpString="*.vob") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.ifo") returned 0
	[0057.570] lstrlenA (lpString="*.ifo") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.lnk") returned 0
	[0057.570] lstrlenA (lpString="*.lnk") returned 5
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.torrent") returned 0
	[0057.570] lstrlenA (lpString="*.torrent") returned 9
	[0057.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mov") returned 0
	[0057.570] lstrlenA (lpString="*.mov") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.m2v") returned 0
	[0057.571] lstrlenA (lpString="*.m2v") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.3gp") returned 0
	[0057.571] lstrlenA (lpString="*.3gp") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mpeg") returned 0
	[0057.571] lstrlenA (lpString="*.mpeg") returned 6
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mpg") returned 0
	[0057.571] lstrlenA (lpString="*.mpg") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.flv") returned 0
	[0057.571] lstrlenA (lpString="*.flv") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.avi") returned 0
	[0057.571] lstrlenA (lpString="*.avi") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mp4") returned 0
	[0057.571] lstrlenA (lpString="*.mp4") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.wmv") returned 0
	[0057.571] lstrlenA (lpString="*.wmv") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.divx") returned 0
	[0057.571] lstrlenA (lpString="*.divx") returned 6
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mkv") returned 0
	[0057.571] lstrlenA (lpString="*.mkv") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.mp3") returned 0
	[0057.571] lstrlenA (lpString="*.mp3") returned 5
	[0057.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", pszSpec="*.wav") returned 1
	[0057.571] lstrlenA (lpString="*.wav") returned 5
	[0057.571] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV"
	[0057.571] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV"
	[0057.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV."
	[0057.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.Boom"
	[0057.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.599] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6bd4
	[0057.599] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x604d91d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.599] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.599] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6bb1, lpOverlapped=0x0) returned 1
	[0057.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned="COUGH.WAV"
	[0057.686] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.686] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6bb1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6bb1, lpOverlapped=0x0) returned 1
	[0057.686] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.686] CloseHandle (hObject=0x94) returned 1
	[0057.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.boom")) returned 1
	[0057.687] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.687] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0057.687] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GIGGLE.WAV") returned -1
	[0057.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GIGGLE.WAV") returned 1
	[0057.687] lstrcmpiA (lpString1="", lpString2="GIGGLE.WAV") returned -1
	[0057.687] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned="COUGH.WAV"
	[0057.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\"
	[0057.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned=""
	[0057.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt"
	[0057.687] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20
	[0057.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="GIGGLE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV"
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.zip") returned 0
	[0057.687] lstrlenA (lpString="*.zip") returned 5
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.rar") returned 0
	[0057.687] lstrlenA (lpString="*.rar") returned 5
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.7z") returned 0
	[0057.687] lstrlenA (lpString="*.7z") returned 4
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.tar") returned 0
	[0057.687] lstrlenA (lpString="*.tar") returned 5
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.gzip") returned 0
	[0057.687] lstrlenA (lpString="*.gzip") returned 6
	[0057.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.jpg") returned 0
	[0057.687] lstrlenA (lpString="*.jpg") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.jpeg") returned 0
	[0057.688] lstrlenA (lpString="*.jpeg") returned 6
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.psd") returned 0
	[0057.688] lstrlenA (lpString="*.psd") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.cdr") returned 0
	[0057.688] lstrlenA (lpString="*.cdr") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.dwg") returned 0
	[0057.688] lstrlenA (lpString="*.dwg") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.max") returned 0
	[0057.688] lstrlenA (lpString="*.max") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.bmp") returned 0
	[0057.688] lstrlenA (lpString="*.bmp") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.gif") returned 0
	[0057.688] lstrlenA (lpString="*.gif") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.png") returned 0
	[0057.688] lstrlenA (lpString="*.png") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.doc") returned 0
	[0057.688] lstrlenA (lpString="*.doc") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.docx") returned 0
	[0057.688] lstrlenA (lpString="*.docx") returned 6
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.xls") returned 0
	[0057.688] lstrlenA (lpString="*.xls") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.xlsx") returned 0
	[0057.688] lstrlenA (lpString="*.xlsx") returned 6
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.ppt") returned 0
	[0057.688] lstrlenA (lpString="*.ppt") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.pptx") returned 0
	[0057.688] lstrlenA (lpString="*.pptx") returned 6
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.txt") returned 0
	[0057.688] lstrlenA (lpString="*.txt") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.pdf") returned 0
	[0057.688] lstrlenA (lpString="*.pdf") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.djvu") returned 0
	[0057.688] lstrlenA (lpString="*.djvu") returned 6
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.htm") returned 0
	[0057.688] lstrlenA (lpString="*.htm") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.html") returned 0
	[0057.688] lstrlenA (lpString="*.html") returned 6
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mdb") returned 0
	[0057.688] lstrlenA (lpString="*.mdb") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.cer") returned 0
	[0057.688] lstrlenA (lpString="*.cer") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.p12") returned 0
	[0057.688] lstrlenA (lpString="*.p12") returned 5
	[0057.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.pfx") returned 0
	[0057.689] lstrlenA (lpString="*.pfx") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.kwm") returned 0
	[0057.689] lstrlenA (lpString="*.kwm") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.pwm") returned 0
	[0057.689] lstrlenA (lpString="*.pwm") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.1cd") returned 0
	[0057.689] lstrlenA (lpString="*.1cd") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.md") returned 0
	[0057.689] lstrlenA (lpString="*.md") returned 4
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mdf") returned 0
	[0057.689] lstrlenA (lpString="*.mdf") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.dbf") returned 0
	[0057.689] lstrlenA (lpString="*.dbf") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.odt") returned 0
	[0057.689] lstrlenA (lpString="*.odt") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.vob") returned 0
	[0057.689] lstrlenA (lpString="*.vob") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.ifo") returned 0
	[0057.689] lstrlenA (lpString="*.ifo") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.lnk") returned 0
	[0057.689] lstrlenA (lpString="*.lnk") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.torrent") returned 0
	[0057.689] lstrlenA (lpString="*.torrent") returned 9
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mov") returned 0
	[0057.689] lstrlenA (lpString="*.mov") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.m2v") returned 0
	[0057.689] lstrlenA (lpString="*.m2v") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.3gp") returned 0
	[0057.689] lstrlenA (lpString="*.3gp") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mpeg") returned 0
	[0057.689] lstrlenA (lpString="*.mpeg") returned 6
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mpg") returned 0
	[0057.689] lstrlenA (lpString="*.mpg") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.flv") returned 0
	[0057.689] lstrlenA (lpString="*.flv") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.avi") returned 0
	[0057.689] lstrlenA (lpString="*.avi") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mp4") returned 0
	[0057.689] lstrlenA (lpString="*.mp4") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.wmv") returned 0
	[0057.689] lstrlenA (lpString="*.wmv") returned 5
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.divx") returned 0
	[0057.689] lstrlenA (lpString="*.divx") returned 6
	[0057.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mkv") returned 0
	[0057.689] lstrlenA (lpString="*.mkv") returned 5
	[0057.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.mp3") returned 0
	[0057.690] lstrlenA (lpString="*.mp3") returned 5
	[0057.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", pszSpec="*.wav") returned 1
	[0057.690] lstrlenA (lpString="*.wav") returned 5
	[0057.690] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV"
	[0057.690] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV"
	[0057.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV."
	[0057.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.Boom"
	[0057.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.713] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7860
	[0057.713] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52a72f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.713] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.713] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x783d, lpOverlapped=0x0) returned 1
	[0057.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="GIGGLE.WAV"
	[0057.727] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.727] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x783d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x783d, lpOverlapped=0x0) returned 1
	[0057.727] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.727] CloseHandle (hObject=0x94) returned 1
	[0057.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.boom")) returned 1
	[0057.728] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.728] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0057.728] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HICCUP.WAV") returned -1
	[0057.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HICCUP.WAV") returned 1
	[0057.728] lstrcmpiA (lpString1="", lpString2="HICCUP.WAV") returned -1
	[0057.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="GIGGLE.WAV"
	[0057.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\"
	[0057.728] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned=""
	[0057.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt"
	[0057.728] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20
	[0057.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HICCUP.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV"
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.zip") returned 0
	[0057.728] lstrlenA (lpString="*.zip") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.rar") returned 0
	[0057.728] lstrlenA (lpString="*.rar") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.7z") returned 0
	[0057.728] lstrlenA (lpString="*.7z") returned 4
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.tar") returned 0
	[0057.728] lstrlenA (lpString="*.tar") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.gzip") returned 0
	[0057.728] lstrlenA (lpString="*.gzip") returned 6
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.jpg") returned 0
	[0057.728] lstrlenA (lpString="*.jpg") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.jpeg") returned 0
	[0057.728] lstrlenA (lpString="*.jpeg") returned 6
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.psd") returned 0
	[0057.728] lstrlenA (lpString="*.psd") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.cdr") returned 0
	[0057.728] lstrlenA (lpString="*.cdr") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.dwg") returned 0
	[0057.728] lstrlenA (lpString="*.dwg") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.max") returned 0
	[0057.728] lstrlenA (lpString="*.max") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.bmp") returned 0
	[0057.728] lstrlenA (lpString="*.bmp") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.gif") returned 0
	[0057.728] lstrlenA (lpString="*.gif") returned 5
	[0057.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.png") returned 0
	[0057.728] lstrlenA (lpString="*.png") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.doc") returned 0
	[0057.729] lstrlenA (lpString="*.doc") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.docx") returned 0
	[0057.729] lstrlenA (lpString="*.docx") returned 6
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.xls") returned 0
	[0057.729] lstrlenA (lpString="*.xls") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.xlsx") returned 0
	[0057.729] lstrlenA (lpString="*.xlsx") returned 6
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.ppt") returned 0
	[0057.729] lstrlenA (lpString="*.ppt") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.pptx") returned 0
	[0057.729] lstrlenA (lpString="*.pptx") returned 6
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.txt") returned 0
	[0057.729] lstrlenA (lpString="*.txt") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.pdf") returned 0
	[0057.729] lstrlenA (lpString="*.pdf") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.djvu") returned 0
	[0057.729] lstrlenA (lpString="*.djvu") returned 6
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.htm") returned 0
	[0057.729] lstrlenA (lpString="*.htm") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.html") returned 0
	[0057.729] lstrlenA (lpString="*.html") returned 6
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mdb") returned 0
	[0057.729] lstrlenA (lpString="*.mdb") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.cer") returned 0
	[0057.729] lstrlenA (lpString="*.cer") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.p12") returned 0
	[0057.729] lstrlenA (lpString="*.p12") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.pfx") returned 0
	[0057.729] lstrlenA (lpString="*.pfx") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.kwm") returned 0
	[0057.729] lstrlenA (lpString="*.kwm") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.pwm") returned 0
	[0057.729] lstrlenA (lpString="*.pwm") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.1cd") returned 0
	[0057.729] lstrlenA (lpString="*.1cd") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.md") returned 0
	[0057.729] lstrlenA (lpString="*.md") returned 4
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mdf") returned 0
	[0057.729] lstrlenA (lpString="*.mdf") returned 5
	[0057.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.dbf") returned 0
	[0057.730] lstrlenA (lpString="*.dbf") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.odt") returned 0
	[0057.730] lstrlenA (lpString="*.odt") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.vob") returned 0
	[0057.730] lstrlenA (lpString="*.vob") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.ifo") returned 0
	[0057.730] lstrlenA (lpString="*.ifo") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.lnk") returned 0
	[0057.730] lstrlenA (lpString="*.lnk") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.torrent") returned 0
	[0057.730] lstrlenA (lpString="*.torrent") returned 9
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mov") returned 0
	[0057.730] lstrlenA (lpString="*.mov") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.m2v") returned 0
	[0057.730] lstrlenA (lpString="*.m2v") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.3gp") returned 0
	[0057.730] lstrlenA (lpString="*.3gp") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mpeg") returned 0
	[0057.730] lstrlenA (lpString="*.mpeg") returned 6
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mpg") returned 0
	[0057.730] lstrlenA (lpString="*.mpg") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.flv") returned 0
	[0057.730] lstrlenA (lpString="*.flv") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.avi") returned 0
	[0057.730] lstrlenA (lpString="*.avi") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mp4") returned 0
	[0057.730] lstrlenA (lpString="*.mp4") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.wmv") returned 0
	[0057.730] lstrlenA (lpString="*.wmv") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.divx") returned 0
	[0057.730] lstrlenA (lpString="*.divx") returned 6
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mkv") returned 0
	[0057.730] lstrlenA (lpString="*.mkv") returned 5
	[0057.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mp3") returned 0
	[0057.731] lstrlenA (lpString="*.mp3") returned 5
	[0057.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.wav") returned 1
	[0057.731] lstrlenA (lpString="*.wav") returned 5
	[0057.731] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV"
	[0057.731] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV"
	[0057.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV."
	[0057.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.Boom"
	[0057.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.732] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38ea
	[0057.732] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.732] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.732] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x38c7, lpOverlapped=0x0) returned 1
	[0057.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="HICCUP.WAV"
	[0057.739] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.739] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x38c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x38c7, lpOverlapped=0x0) returned 1
	[0057.740] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.740] CloseHandle (hObject=0x94) returned 1
	[0057.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.boom")) returned 1
	[0057.740] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.740] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0057.740] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MMHMM.WAV") returned -1
	[0057.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMHMM.WAV") returned -1
	[0057.740] lstrcmpiA (lpString1="", lpString2="MMHMM.WAV") returned -1
	[0057.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="HICCUP.WAV"
	[0057.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\"
	[0057.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned=""
	[0057.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt"
	[0057.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20
	[0057.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="MMHMM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV"
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.zip") returned 0
	[0057.741] lstrlenA (lpString="*.zip") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.rar") returned 0
	[0057.741] lstrlenA (lpString="*.rar") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.7z") returned 0
	[0057.741] lstrlenA (lpString="*.7z") returned 4
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.tar") returned 0
	[0057.741] lstrlenA (lpString="*.tar") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.gzip") returned 0
	[0057.741] lstrlenA (lpString="*.gzip") returned 6
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.jpg") returned 0
	[0057.741] lstrlenA (lpString="*.jpg") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.jpeg") returned 0
	[0057.741] lstrlenA (lpString="*.jpeg") returned 6
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.psd") returned 0
	[0057.741] lstrlenA (lpString="*.psd") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.cdr") returned 0
	[0057.741] lstrlenA (lpString="*.cdr") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.dwg") returned 0
	[0057.741] lstrlenA (lpString="*.dwg") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.max") returned 0
	[0057.741] lstrlenA (lpString="*.max") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.bmp") returned 0
	[0057.741] lstrlenA (lpString="*.bmp") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.gif") returned 0
	[0057.741] lstrlenA (lpString="*.gif") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.png") returned 0
	[0057.741] lstrlenA (lpString="*.png") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.doc") returned 0
	[0057.741] lstrlenA (lpString="*.doc") returned 5
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.docx") returned 0
	[0057.741] lstrlenA (lpString="*.docx") returned 6
	[0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.xls") returned 0
	[0057.741] lstrlenA (lpString="*.xls") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.xlsx") returned 0
	[0057.742] lstrlenA (lpString="*.xlsx") returned 6
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.ppt") returned 0
	[0057.742] lstrlenA (lpString="*.ppt") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.pptx") returned 0
	[0057.742] lstrlenA (lpString="*.pptx") returned 6
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.txt") returned 0
	[0057.742] lstrlenA (lpString="*.txt") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.pdf") returned 0
	[0057.742] lstrlenA (lpString="*.pdf") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.djvu") returned 0
	[0057.742] lstrlenA (lpString="*.djvu") returned 6
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.htm") returned 0
	[0057.742] lstrlenA (lpString="*.htm") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.html") returned 0
	[0057.742] lstrlenA (lpString="*.html") returned 6
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mdb") returned 0
	[0057.742] lstrlenA (lpString="*.mdb") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.cer") returned 0
	[0057.742] lstrlenA (lpString="*.cer") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.p12") returned 0
	[0057.742] lstrlenA (lpString="*.p12") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.pfx") returned 0
	[0057.742] lstrlenA (lpString="*.pfx") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.kwm") returned 0
	[0057.742] lstrlenA (lpString="*.kwm") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.pwm") returned 0
	[0057.742] lstrlenA (lpString="*.pwm") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.1cd") returned 0
	[0057.742] lstrlenA (lpString="*.1cd") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.md") returned 0
	[0057.742] lstrlenA (lpString="*.md") returned 4
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mdf") returned 0
	[0057.742] lstrlenA (lpString="*.mdf") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.dbf") returned 0
	[0057.742] lstrlenA (lpString="*.dbf") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.odt") returned 0
	[0057.742] lstrlenA (lpString="*.odt") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.vob") returned 0
	[0057.742] lstrlenA (lpString="*.vob") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.ifo") returned 0
	[0057.742] lstrlenA (lpString="*.ifo") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.lnk") returned 0
	[0057.742] lstrlenA (lpString="*.lnk") returned 5
	[0057.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.torrent") returned 0
	[0057.743] lstrlenA (lpString="*.torrent") returned 9
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mov") returned 0
	[0057.743] lstrlenA (lpString="*.mov") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.m2v") returned 0
	[0057.743] lstrlenA (lpString="*.m2v") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.3gp") returned 0
	[0057.743] lstrlenA (lpString="*.3gp") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mpeg") returned 0
	[0057.743] lstrlenA (lpString="*.mpeg") returned 6
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mpg") returned 0
	[0057.743] lstrlenA (lpString="*.mpg") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.flv") returned 0
	[0057.743] lstrlenA (lpString="*.flv") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.avi") returned 0
	[0057.743] lstrlenA (lpString="*.avi") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mp4") returned 0
	[0057.743] lstrlenA (lpString="*.mp4") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.wmv") returned 0
	[0057.743] lstrlenA (lpString="*.wmv") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.divx") returned 0
	[0057.743] lstrlenA (lpString="*.divx") returned 6
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mkv") returned 0
	[0057.743] lstrlenA (lpString="*.mkv") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mp3") returned 0
	[0057.743] lstrlenA (lpString="*.mp3") returned 5
	[0057.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.wav") returned 1
	[0057.743] lstrlenA (lpString="*.wav") returned 5
	[0057.743] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV"
	[0057.743] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV"
	[0057.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV."
	[0057.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.Boom"
	[0057.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.744] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b00
	[0057.744] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x58adaa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.744] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.744] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3add, lpOverlapped=0x0) returned 1
	[0057.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="MMHMM.WAV"
	[0057.798] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.799] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3add, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3add, lpOverlapped=0x0) returned 1
	[0057.799] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.799] CloseHandle (hObject=0x94) returned 1
	[0057.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.boom")) returned 1
	[0057.800] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.800] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0057.800] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SNEEZE.WAV") returned -1
	[0057.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SNEEZE.WAV") returned -1
	[0057.800] lstrcmpiA (lpString1="", lpString2="SNEEZE.WAV") returned -1
	[0057.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="MMHMM.WAV"
	[0057.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\"
	[0057.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned=""
	[0057.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt"
	[0057.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20
	[0057.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="SNEEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV"
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.zip") returned 0
	[0057.800] lstrlenA (lpString="*.zip") returned 5
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.rar") returned 0
	[0057.800] lstrlenA (lpString="*.rar") returned 5
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.7z") returned 0
	[0057.800] lstrlenA (lpString="*.7z") returned 4
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.tar") returned 0
	[0057.800] lstrlenA (lpString="*.tar") returned 5
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.gzip") returned 0
	[0057.800] lstrlenA (lpString="*.gzip") returned 6
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.jpg") returned 0
	[0057.800] lstrlenA (lpString="*.jpg") returned 5
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.jpeg") returned 0
	[0057.800] lstrlenA (lpString="*.jpeg") returned 6
	[0057.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.psd") returned 0
	[0057.801] lstrlenA (lpString="*.psd") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.cdr") returned 0
	[0057.801] lstrlenA (lpString="*.cdr") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.dwg") returned 0
	[0057.801] lstrlenA (lpString="*.dwg") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.max") returned 0
	[0057.801] lstrlenA (lpString="*.max") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.bmp") returned 0
	[0057.801] lstrlenA (lpString="*.bmp") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.gif") returned 0
	[0057.801] lstrlenA (lpString="*.gif") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.png") returned 0
	[0057.801] lstrlenA (lpString="*.png") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.doc") returned 0
	[0057.801] lstrlenA (lpString="*.doc") returned 5
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.docx") returned 0
	[0057.801] lstrlenA (lpString="*.docx") returned 6
	[0057.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.xls") returned 0
	[0057.803] lstrlenA (lpString="*.xls") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.xlsx") returned 0
	[0057.803] lstrlenA (lpString="*.xlsx") returned 6
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.ppt") returned 0
	[0057.803] lstrlenA (lpString="*.ppt") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.pptx") returned 0
	[0057.803] lstrlenA (lpString="*.pptx") returned 6
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.txt") returned 0
	[0057.803] lstrlenA (lpString="*.txt") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.pdf") returned 0
	[0057.803] lstrlenA (lpString="*.pdf") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.djvu") returned 0
	[0057.803] lstrlenA (lpString="*.djvu") returned 6
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.htm") returned 0
	[0057.803] lstrlenA (lpString="*.htm") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.html") returned 0
	[0057.803] lstrlenA (lpString="*.html") returned 6
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mdb") returned 0
	[0057.803] lstrlenA (lpString="*.mdb") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.cer") returned 0
	[0057.803] lstrlenA (lpString="*.cer") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.p12") returned 0
	[0057.803] lstrlenA (lpString="*.p12") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.pfx") returned 0
	[0057.803] lstrlenA (lpString="*.pfx") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.kwm") returned 0
	[0057.803] lstrlenA (lpString="*.kwm") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.pwm") returned 0
	[0057.803] lstrlenA (lpString="*.pwm") returned 5
	[0057.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.1cd") returned 0
	[0057.804] lstrlenA (lpString="*.1cd") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.md") returned 0
	[0057.804] lstrlenA (lpString="*.md") returned 4
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mdf") returned 0
	[0057.804] lstrlenA (lpString="*.mdf") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.dbf") returned 0
	[0057.804] lstrlenA (lpString="*.dbf") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.odt") returned 0
	[0057.804] lstrlenA (lpString="*.odt") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.vob") returned 0
	[0057.804] lstrlenA (lpString="*.vob") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.ifo") returned 0
	[0057.804] lstrlenA (lpString="*.ifo") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.lnk") returned 0
	[0057.804] lstrlenA (lpString="*.lnk") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.torrent") returned 0
	[0057.804] lstrlenA (lpString="*.torrent") returned 9
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mov") returned 0
	[0057.804] lstrlenA (lpString="*.mov") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.m2v") returned 0
	[0057.804] lstrlenA (lpString="*.m2v") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.3gp") returned 0
	[0057.804] lstrlenA (lpString="*.3gp") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mpeg") returned 0
	[0057.804] lstrlenA (lpString="*.mpeg") returned 6
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mpg") returned 0
	[0057.804] lstrlenA (lpString="*.mpg") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.flv") returned 0
	[0057.804] lstrlenA (lpString="*.flv") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.avi") returned 0
	[0057.804] lstrlenA (lpString="*.avi") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mp4") returned 0
	[0057.804] lstrlenA (lpString="*.mp4") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.wmv") returned 0
	[0057.804] lstrlenA (lpString="*.wmv") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.divx") returned 0
	[0057.804] lstrlenA (lpString="*.divx") returned 6
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mkv") returned 0
	[0057.804] lstrlenA (lpString="*.mkv") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mp3") returned 0
	[0057.804] lstrlenA (lpString="*.mp3") returned 5
	[0057.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.wav") returned 1
	[0057.804] lstrlenA (lpString="*.wav") returned 5
	[0057.804] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV"
	[0057.805] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV"
	[0057.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV."
	[0057.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.Boom"
	[0057.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.810] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c84
	[0057.810] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9f29b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.810] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.810] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9c61, lpOverlapped=0x0) returned 1
	[0057.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="SNEEZE.WAV"
	[0057.840] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.840] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9c61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9c61, lpOverlapped=0x0) returned 1
	[0057.840] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.841] CloseHandle (hObject=0x94) returned 1
	[0057.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.boom")) returned 1
	[0057.841] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.841] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0057.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THROAT.WAV") returned -1
	[0057.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THROAT.WAV") returned -1
	[0057.841] lstrcmpiA (lpString1="", lpString2="THROAT.WAV") returned -1
	[0057.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="SNEEZE.WAV"
	[0057.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\"
	[0057.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned=""
	[0057.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt"
	[0057.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20
	[0057.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="THROAT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV"
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.zip") returned 0
	[0057.842] lstrlenA (lpString="*.zip") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.rar") returned 0
	[0057.842] lstrlenA (lpString="*.rar") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.7z") returned 0
	[0057.842] lstrlenA (lpString="*.7z") returned 4
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.tar") returned 0
	[0057.842] lstrlenA (lpString="*.tar") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.gzip") returned 0
	[0057.842] lstrlenA (lpString="*.gzip") returned 6
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.jpg") returned 0
	[0057.842] lstrlenA (lpString="*.jpg") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.jpeg") returned 0
	[0057.842] lstrlenA (lpString="*.jpeg") returned 6
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.psd") returned 0
	[0057.842] lstrlenA (lpString="*.psd") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.cdr") returned 0
	[0057.842] lstrlenA (lpString="*.cdr") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.dwg") returned 0
	[0057.842] lstrlenA (lpString="*.dwg") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.max") returned 0
	[0057.842] lstrlenA (lpString="*.max") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.bmp") returned 0
	[0057.842] lstrlenA (lpString="*.bmp") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.gif") returned 0
	[0057.842] lstrlenA (lpString="*.gif") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.png") returned 0
	[0057.842] lstrlenA (lpString="*.png") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.doc") returned 0
	[0057.842] lstrlenA (lpString="*.doc") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.docx") returned 0
	[0057.842] lstrlenA (lpString="*.docx") returned 6
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.xls") returned 0
	[0057.842] lstrlenA (lpString="*.xls") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.xlsx") returned 0
	[0057.842] lstrlenA (lpString="*.xlsx") returned 6
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.ppt") returned 0
	[0057.842] lstrlenA (lpString="*.ppt") returned 5
	[0057.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.pptx") returned 0
	[0057.843] lstrlenA (lpString="*.pptx") returned 6
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.txt") returned 0
	[0057.843] lstrlenA (lpString="*.txt") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.pdf") returned 0
	[0057.843] lstrlenA (lpString="*.pdf") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.djvu") returned 0
	[0057.843] lstrlenA (lpString="*.djvu") returned 6
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.htm") returned 0
	[0057.843] lstrlenA (lpString="*.htm") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.html") returned 0
	[0057.843] lstrlenA (lpString="*.html") returned 6
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mdb") returned 0
	[0057.843] lstrlenA (lpString="*.mdb") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.cer") returned 0
	[0057.843] lstrlenA (lpString="*.cer") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.p12") returned 0
	[0057.843] lstrlenA (lpString="*.p12") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.pfx") returned 0
	[0057.843] lstrlenA (lpString="*.pfx") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.kwm") returned 0
	[0057.843] lstrlenA (lpString="*.kwm") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.pwm") returned 0
	[0057.843] lstrlenA (lpString="*.pwm") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.1cd") returned 0
	[0057.843] lstrlenA (lpString="*.1cd") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.md") returned 0
	[0057.843] lstrlenA (lpString="*.md") returned 4
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mdf") returned 0
	[0057.843] lstrlenA (lpString="*.mdf") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.dbf") returned 0
	[0057.843] lstrlenA (lpString="*.dbf") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.odt") returned 0
	[0057.843] lstrlenA (lpString="*.odt") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.vob") returned 0
	[0057.843] lstrlenA (lpString="*.vob") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.ifo") returned 0
	[0057.843] lstrlenA (lpString="*.ifo") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.lnk") returned 0
	[0057.843] lstrlenA (lpString="*.lnk") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.torrent") returned 0
	[0057.843] lstrlenA (lpString="*.torrent") returned 9
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mov") returned 0
	[0057.843] lstrlenA (lpString="*.mov") returned 5
	[0057.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.m2v") returned 0
	[0057.844] lstrlenA (lpString="*.m2v") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.3gp") returned 0
	[0057.844] lstrlenA (lpString="*.3gp") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mpeg") returned 0
	[0057.844] lstrlenA (lpString="*.mpeg") returned 6
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mpg") returned 0
	[0057.844] lstrlenA (lpString="*.mpg") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.flv") returned 0
	[0057.844] lstrlenA (lpString="*.flv") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.avi") returned 0
	[0057.844] lstrlenA (lpString="*.avi") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mp4") returned 0
	[0057.844] lstrlenA (lpString="*.mp4") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.wmv") returned 0
	[0057.844] lstrlenA (lpString="*.wmv") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.divx") returned 0
	[0057.844] lstrlenA (lpString="*.divx") returned 6
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mkv") returned 0
	[0057.844] lstrlenA (lpString="*.mkv") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mp3") returned 0
	[0057.844] lstrlenA (lpString="*.mp3") returned 5
	[0057.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.wav") returned 1
	[0057.844] lstrlenA (lpString="*.wav") returned 5
	[0057.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV"
	[0057.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV"
	[0057.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV."
	[0057.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.Boom"
	[0057.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.845] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d36
	[0057.845] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d4d5410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.845] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.845] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x8d13, lpOverlapped=0x0) returned 1
	[0057.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="THROAT.WAV"
	[0057.980] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.980] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x8d13, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x8d13, lpOverlapped=0x0) returned 1
	[0057.980] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0057.980] CloseHandle (hObject=0x94) returned 1
	[0057.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.boom")) returned 1
	[0057.981] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0057.981] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0057.981] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Whistling.wav") returned -1
	[0057.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Whistling.wav") returned -1
	[0057.981] lstrcmpiA (lpString1="", lpString2="Whistling.wav") returned -1
	[0057.981] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="THROAT.WAV"
	[0057.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\"
	[0057.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned=""
	[0057.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt"
	[0057.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20
	[0057.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="Whistling.wav" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav"
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.zip") returned 0
	[0057.982] lstrlenA (lpString="*.zip") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.rar") returned 0
	[0057.982] lstrlenA (lpString="*.rar") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.7z") returned 0
	[0057.982] lstrlenA (lpString="*.7z") returned 4
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.tar") returned 0
	[0057.982] lstrlenA (lpString="*.tar") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.gzip") returned 0
	[0057.982] lstrlenA (lpString="*.gzip") returned 6
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.jpg") returned 0
	[0057.982] lstrlenA (lpString="*.jpg") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.jpeg") returned 0
	[0057.982] lstrlenA (lpString="*.jpeg") returned 6
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.psd") returned 0
	[0057.982] lstrlenA (lpString="*.psd") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.cdr") returned 0
	[0057.982] lstrlenA (lpString="*.cdr") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.dwg") returned 0
	[0057.982] lstrlenA (lpString="*.dwg") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.max") returned 0
	[0057.982] lstrlenA (lpString="*.max") returned 5
	[0057.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.bmp") returned 0
	[0057.983] lstrlenA (lpString="*.bmp") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.gif") returned 0
	[0057.983] lstrlenA (lpString="*.gif") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.png") returned 0
	[0057.983] lstrlenA (lpString="*.png") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.doc") returned 0
	[0057.983] lstrlenA (lpString="*.doc") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.docx") returned 0
	[0057.983] lstrlenA (lpString="*.docx") returned 6
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.xls") returned 0
	[0057.983] lstrlenA (lpString="*.xls") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.xlsx") returned 0
	[0057.983] lstrlenA (lpString="*.xlsx") returned 6
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.ppt") returned 0
	[0057.983] lstrlenA (lpString="*.ppt") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.pptx") returned 0
	[0057.983] lstrlenA (lpString="*.pptx") returned 6
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.txt") returned 0
	[0057.983] lstrlenA (lpString="*.txt") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.pdf") returned 0
	[0057.983] lstrlenA (lpString="*.pdf") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.djvu") returned 0
	[0057.983] lstrlenA (lpString="*.djvu") returned 6
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.htm") returned 0
	[0057.983] lstrlenA (lpString="*.htm") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.html") returned 0
	[0057.983] lstrlenA (lpString="*.html") returned 6
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mdb") returned 0
	[0057.983] lstrlenA (lpString="*.mdb") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.cer") returned 0
	[0057.983] lstrlenA (lpString="*.cer") returned 5
	[0057.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.p12") returned 0
	[0057.984] lstrlenA (lpString="*.p12") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.pfx") returned 0
	[0057.984] lstrlenA (lpString="*.pfx") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.kwm") returned 0
	[0057.984] lstrlenA (lpString="*.kwm") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.pwm") returned 0
	[0057.984] lstrlenA (lpString="*.pwm") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.1cd") returned 0
	[0057.984] lstrlenA (lpString="*.1cd") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.md") returned 0
	[0057.984] lstrlenA (lpString="*.md") returned 4
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mdf") returned 0
	[0057.984] lstrlenA (lpString="*.mdf") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.dbf") returned 0
	[0057.984] lstrlenA (lpString="*.dbf") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.odt") returned 0
	[0057.984] lstrlenA (lpString="*.odt") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.vob") returned 0
	[0057.984] lstrlenA (lpString="*.vob") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.ifo") returned 0
	[0057.984] lstrlenA (lpString="*.ifo") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.lnk") returned 0
	[0057.984] lstrlenA (lpString="*.lnk") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.torrent") returned 0
	[0057.984] lstrlenA (lpString="*.torrent") returned 9
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mov") returned 0
	[0057.984] lstrlenA (lpString="*.mov") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.m2v") returned 0
	[0057.984] lstrlenA (lpString="*.m2v") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.3gp") returned 0
	[0057.984] lstrlenA (lpString="*.3gp") returned 5
	[0057.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mpeg") returned 0
	[0057.985] lstrlenA (lpString="*.mpeg") returned 6
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mpg") returned 0
	[0057.985] lstrlenA (lpString="*.mpg") returned 5
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.flv") returned 0
	[0057.985] lstrlenA (lpString="*.flv") returned 5
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.avi") returned 0
	[0057.985] lstrlenA (lpString="*.avi") returned 5
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mp4") returned 0
	[0057.985] lstrlenA (lpString="*.mp4") returned 5
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.wmv") returned 0
	[0057.985] lstrlenA (lpString="*.wmv") returned 5
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.divx") returned 0
	[0057.985] lstrlenA (lpString="*.divx") returned 6
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mkv") returned 0
	[0057.985] lstrlenA (lpString="*.mkv") returned 5
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mp3") returned 0
	[0057.985] lstrlenA (lpString="*.mp3") returned 5
	[0057.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.wav") returned 1
	[0057.985] lstrlenA (lpString="*.wav") returned 5
	[0057.985] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav"
	[0057.985] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav"
	[0057.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav."
	[0057.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.Boom"
	[0057.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0057.987] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7302
	[0057.987] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x708e7550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0057.987] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0057.987] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x72df, lpOverlapped=0x0) returned 1
	[0058.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="Whistling.wav"
	[0058.003] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.003] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x72df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x72df, lpOverlapped=0x0) returned 1
	[0058.003] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.003] CloseHandle (hObject=0x94) returned 1
	[0058.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.boom")) returned 1
	[0058.004] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0058.004] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0058.004] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.005] lstrcmpA (lpString1=".", lpString2="Places") returned -1
	[0058.005] lstrcmpA (lpString1="..", lpString2="Places") returned -1
	[0058.005] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*") returned="*.*"
	[0058.005] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", lpString2="Places" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places"
	[0058.005] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned 63
	[0058.005] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0058.007] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0058.007] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.007] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0058.007] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0058.007] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.007] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.007] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ALARM.WAV") returned 1
	[0058.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ALARM.WAV") returned 1
	[0058.007] lstrcmpiA (lpString1="", lpString2="ALARM.WAV") returned -1
	[0058.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*.*") returned="*.*"
	[0058.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\"
	[0058.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned=""
	[0058.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt"
	[0058.007] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0xffffffff
	[0058.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.008] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0058.008] WriteFile (in: hFile=0x94, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0058.009] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0058.009] CloseHandle (hObject=0x94) returned 1
	[0058.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="ALARM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV"
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.zip") returned 0
	[0058.009] lstrlenA (lpString="*.zip") returned 5
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.rar") returned 0
	[0058.009] lstrlenA (lpString="*.rar") returned 5
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.7z") returned 0
	[0058.009] lstrlenA (lpString="*.7z") returned 4
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.tar") returned 0
	[0058.009] lstrlenA (lpString="*.tar") returned 5
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.gzip") returned 0
	[0058.009] lstrlenA (lpString="*.gzip") returned 6
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.jpg") returned 0
	[0058.009] lstrlenA (lpString="*.jpg") returned 5
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.jpeg") returned 0
	[0058.009] lstrlenA (lpString="*.jpeg") returned 6
	[0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.psd") returned 0
	[0058.009] lstrlenA (lpString="*.psd") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.cdr") returned 0
	[0058.010] lstrlenA (lpString="*.cdr") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.dwg") returned 0
	[0058.010] lstrlenA (lpString="*.dwg") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.max") returned 0
	[0058.010] lstrlenA (lpString="*.max") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.bmp") returned 0
	[0058.010] lstrlenA (lpString="*.bmp") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.gif") returned 0
	[0058.010] lstrlenA (lpString="*.gif") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.png") returned 0
	[0058.010] lstrlenA (lpString="*.png") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.doc") returned 0
	[0058.010] lstrlenA (lpString="*.doc") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.docx") returned 0
	[0058.010] lstrlenA (lpString="*.docx") returned 6
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.xls") returned 0
	[0058.010] lstrlenA (lpString="*.xls") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.xlsx") returned 0
	[0058.010] lstrlenA (lpString="*.xlsx") returned 6
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.ppt") returned 0
	[0058.010] lstrlenA (lpString="*.ppt") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.pptx") returned 0
	[0058.010] lstrlenA (lpString="*.pptx") returned 6
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.txt") returned 0
	[0058.010] lstrlenA (lpString="*.txt") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.pdf") returned 0
	[0058.010] lstrlenA (lpString="*.pdf") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.djvu") returned 0
	[0058.010] lstrlenA (lpString="*.djvu") returned 6
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.htm") returned 0
	[0058.010] lstrlenA (lpString="*.htm") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.html") returned 0
	[0058.010] lstrlenA (lpString="*.html") returned 6
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mdb") returned 0
	[0058.010] lstrlenA (lpString="*.mdb") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.cer") returned 0
	[0058.010] lstrlenA (lpString="*.cer") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.p12") returned 0
	[0058.010] lstrlenA (lpString="*.p12") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.pfx") returned 0
	[0058.010] lstrlenA (lpString="*.pfx") returned 5
	[0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.kwm") returned 0
	[0058.011] lstrlenA (lpString="*.kwm") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.pwm") returned 0
	[0058.011] lstrlenA (lpString="*.pwm") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.1cd") returned 0
	[0058.011] lstrlenA (lpString="*.1cd") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.md") returned 0
	[0058.011] lstrlenA (lpString="*.md") returned 4
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mdf") returned 0
	[0058.011] lstrlenA (lpString="*.mdf") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.dbf") returned 0
	[0058.011] lstrlenA (lpString="*.dbf") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.odt") returned 0
	[0058.011] lstrlenA (lpString="*.odt") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.vob") returned 0
	[0058.011] lstrlenA (lpString="*.vob") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.ifo") returned 0
	[0058.011] lstrlenA (lpString="*.ifo") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.lnk") returned 0
	[0058.011] lstrlenA (lpString="*.lnk") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.torrent") returned 0
	[0058.011] lstrlenA (lpString="*.torrent") returned 9
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mov") returned 0
	[0058.011] lstrlenA (lpString="*.mov") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.m2v") returned 0
	[0058.011] lstrlenA (lpString="*.m2v") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.3gp") returned 0
	[0058.011] lstrlenA (lpString="*.3gp") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mpeg") returned 0
	[0058.011] lstrlenA (lpString="*.mpeg") returned 6
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mpg") returned 0
	[0058.011] lstrlenA (lpString="*.mpg") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.flv") returned 0
	[0058.011] lstrlenA (lpString="*.flv") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.avi") returned 0
	[0058.011] lstrlenA (lpString="*.avi") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mp4") returned 0
	[0058.011] lstrlenA (lpString="*.mp4") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.wmv") returned 0
	[0058.011] lstrlenA (lpString="*.wmv") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.divx") returned 0
	[0058.011] lstrlenA (lpString="*.divx") returned 6
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mkv") returned 0
	[0058.011] lstrlenA (lpString="*.mkv") returned 5
	[0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mp3") returned 0
	[0058.012] lstrlenA (lpString="*.mp3") returned 5
	[0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.wav") returned 1
	[0058.012] lstrlenA (lpString="*.wav") returned 5
	[0058.012] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV"
	[0058.012] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV"
	[0058.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV."
	[0058.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.Boom"
	[0058.012] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.012] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84e0
	[0058.012] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.012] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.012] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x84bd, lpOverlapped=0x0) returned 1
	[0058.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="ALARM.WAV"
	[0058.126] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.126] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x84bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x84bd, lpOverlapped=0x0) returned 1
	[0058.126] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.126] CloseHandle (hObject=0x94) returned 1
	[0058.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.boom")) returned 1
	[0058.127] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.127] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.127] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUZZ.WAV") returned 1
	[0058.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUZZ.WAV") returned 1
	[0058.127] lstrcmpiA (lpString1="", lpString2="BUZZ.WAV") returned -1
	[0058.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="ALARM.WAV"
	[0058.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\"
	[0058.127] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned=""
	[0058.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt"
	[0058.127] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20
	[0058.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="BUZZ.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV"
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.zip") returned 0
	[0058.128] lstrlenA (lpString="*.zip") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.rar") returned 0
	[0058.128] lstrlenA (lpString="*.rar") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.7z") returned 0
	[0058.128] lstrlenA (lpString="*.7z") returned 4
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.tar") returned 0
	[0058.128] lstrlenA (lpString="*.tar") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.gzip") returned 0
	[0058.128] lstrlenA (lpString="*.gzip") returned 6
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.jpg") returned 0
	[0058.128] lstrlenA (lpString="*.jpg") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.jpeg") returned 0
	[0058.128] lstrlenA (lpString="*.jpeg") returned 6
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.psd") returned 0
	[0058.128] lstrlenA (lpString="*.psd") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.cdr") returned 0
	[0058.128] lstrlenA (lpString="*.cdr") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.dwg") returned 0
	[0058.128] lstrlenA (lpString="*.dwg") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.max") returned 0
	[0058.128] lstrlenA (lpString="*.max") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.bmp") returned 0
	[0058.128] lstrlenA (lpString="*.bmp") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.gif") returned 0
	[0058.128] lstrlenA (lpString="*.gif") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.png") returned 0
	[0058.128] lstrlenA (lpString="*.png") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.doc") returned 0
	[0058.128] lstrlenA (lpString="*.doc") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.docx") returned 0
	[0058.128] lstrlenA (lpString="*.docx") returned 6
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.xls") returned 0
	[0058.128] lstrlenA (lpString="*.xls") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.xlsx") returned 0
	[0058.128] lstrlenA (lpString="*.xlsx") returned 6
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.ppt") returned 0
	[0058.128] lstrlenA (lpString="*.ppt") returned 5
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.pptx") returned 0
	[0058.128] lstrlenA (lpString="*.pptx") returned 6
	[0058.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.txt") returned 0
	[0058.128] lstrlenA (lpString="*.txt") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.pdf") returned 0
	[0058.129] lstrlenA (lpString="*.pdf") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.djvu") returned 0
	[0058.129] lstrlenA (lpString="*.djvu") returned 6
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.htm") returned 0
	[0058.129] lstrlenA (lpString="*.htm") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.html") returned 0
	[0058.129] lstrlenA (lpString="*.html") returned 6
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mdb") returned 0
	[0058.129] lstrlenA (lpString="*.mdb") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.cer") returned 0
	[0058.129] lstrlenA (lpString="*.cer") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.p12") returned 0
	[0058.129] lstrlenA (lpString="*.p12") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.pfx") returned 0
	[0058.129] lstrlenA (lpString="*.pfx") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.kwm") returned 0
	[0058.129] lstrlenA (lpString="*.kwm") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.pwm") returned 0
	[0058.129] lstrlenA (lpString="*.pwm") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.1cd") returned 0
	[0058.129] lstrlenA (lpString="*.1cd") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.md") returned 0
	[0058.129] lstrlenA (lpString="*.md") returned 4
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mdf") returned 0
	[0058.129] lstrlenA (lpString="*.mdf") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.dbf") returned 0
	[0058.129] lstrlenA (lpString="*.dbf") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.odt") returned 0
	[0058.129] lstrlenA (lpString="*.odt") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.vob") returned 0
	[0058.129] lstrlenA (lpString="*.vob") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.ifo") returned 0
	[0058.129] lstrlenA (lpString="*.ifo") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.lnk") returned 0
	[0058.129] lstrlenA (lpString="*.lnk") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.torrent") returned 0
	[0058.129] lstrlenA (lpString="*.torrent") returned 9
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mov") returned 0
	[0058.129] lstrlenA (lpString="*.mov") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.m2v") returned 0
	[0058.129] lstrlenA (lpString="*.m2v") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.3gp") returned 0
	[0058.129] lstrlenA (lpString="*.3gp") returned 5
	[0058.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mpeg") returned 0
	[0058.130] lstrlenA (lpString="*.mpeg") returned 6
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mpg") returned 0
	[0058.130] lstrlenA (lpString="*.mpg") returned 5
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.flv") returned 0
	[0058.130] lstrlenA (lpString="*.flv") returned 5
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.avi") returned 0
	[0058.130] lstrlenA (lpString="*.avi") returned 5
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mp4") returned 0
	[0058.130] lstrlenA (lpString="*.mp4") returned 5
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.wmv") returned 0
	[0058.130] lstrlenA (lpString="*.wmv") returned 5
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.divx") returned 0
	[0058.130] lstrlenA (lpString="*.divx") returned 6
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mkv") returned 0
	[0058.130] lstrlenA (lpString="*.mkv") returned 5
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mp3") returned 0
	[0058.130] lstrlenA (lpString="*.mp3") returned 5
	[0058.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.wav") returned 1
	[0058.130] lstrlenA (lpString="*.wav") returned 5
	[0058.130] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV"
	[0058.130] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV"
	[0058.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV."
	[0058.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.Boom"
	[0058.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.132] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb78
	[0058.132] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.132] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.132] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xeb55, lpOverlapped=0x0) returned 1
	[0058.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="BUZZ.WAV"
	[0058.150] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.150] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xeb55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xeb55, lpOverlapped=0x0) returned 1
	[0058.150] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.150] CloseHandle (hObject=0x94) returned 1
	[0058.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.boom")) returned 1
	[0058.151] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.151] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.151] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LASER.WAV") returned -1
	[0058.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LASER.WAV") returned -1
	[0058.151] lstrcmpiA (lpString1="", lpString2="LASER.WAV") returned -1
	[0058.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="BUZZ.WAV"
	[0058.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\"
	[0058.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned=""
	[0058.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt"
	[0058.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20
	[0058.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV"
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.zip") returned 0
	[0058.151] lstrlenA (lpString="*.zip") returned 5
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.rar") returned 0
	[0058.151] lstrlenA (lpString="*.rar") returned 5
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.7z") returned 0
	[0058.151] lstrlenA (lpString="*.7z") returned 4
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.tar") returned 0
	[0058.151] lstrlenA (lpString="*.tar") returned 5
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.gzip") returned 0
	[0058.151] lstrlenA (lpString="*.gzip") returned 6
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.jpg") returned 0
	[0058.151] lstrlenA (lpString="*.jpg") returned 5
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.jpeg") returned 0
	[0058.151] lstrlenA (lpString="*.jpeg") returned 6
	[0058.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.psd") returned 0
	[0058.151] lstrlenA (lpString="*.psd") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.cdr") returned 0
	[0058.152] lstrlenA (lpString="*.cdr") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.dwg") returned 0
	[0058.152] lstrlenA (lpString="*.dwg") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.max") returned 0
	[0058.152] lstrlenA (lpString="*.max") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.bmp") returned 0
	[0058.152] lstrlenA (lpString="*.bmp") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.gif") returned 0
	[0058.152] lstrlenA (lpString="*.gif") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.png") returned 0
	[0058.152] lstrlenA (lpString="*.png") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.doc") returned 0
	[0058.152] lstrlenA (lpString="*.doc") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.docx") returned 0
	[0058.152] lstrlenA (lpString="*.docx") returned 6
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.xls") returned 0
	[0058.152] lstrlenA (lpString="*.xls") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.xlsx") returned 0
	[0058.152] lstrlenA (lpString="*.xlsx") returned 6
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.ppt") returned 0
	[0058.152] lstrlenA (lpString="*.ppt") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.pptx") returned 0
	[0058.152] lstrlenA (lpString="*.pptx") returned 6
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.txt") returned 0
	[0058.152] lstrlenA (lpString="*.txt") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.pdf") returned 0
	[0058.152] lstrlenA (lpString="*.pdf") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.djvu") returned 0
	[0058.152] lstrlenA (lpString="*.djvu") returned 6
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.htm") returned 0
	[0058.152] lstrlenA (lpString="*.htm") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.html") returned 0
	[0058.152] lstrlenA (lpString="*.html") returned 6
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mdb") returned 0
	[0058.152] lstrlenA (lpString="*.mdb") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.cer") returned 0
	[0058.152] lstrlenA (lpString="*.cer") returned 5
	[0058.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.p12") returned 0
	[0058.153] lstrlenA (lpString="*.p12") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.pfx") returned 0
	[0058.153] lstrlenA (lpString="*.pfx") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.kwm") returned 0
	[0058.153] lstrlenA (lpString="*.kwm") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.pwm") returned 0
	[0058.153] lstrlenA (lpString="*.pwm") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.1cd") returned 0
	[0058.153] lstrlenA (lpString="*.1cd") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.md") returned 0
	[0058.153] lstrlenA (lpString="*.md") returned 4
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mdf") returned 0
	[0058.153] lstrlenA (lpString="*.mdf") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.dbf") returned 0
	[0058.153] lstrlenA (lpString="*.dbf") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.odt") returned 0
	[0058.153] lstrlenA (lpString="*.odt") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.vob") returned 0
	[0058.153] lstrlenA (lpString="*.vob") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.ifo") returned 0
	[0058.153] lstrlenA (lpString="*.ifo") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.lnk") returned 0
	[0058.153] lstrlenA (lpString="*.lnk") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.torrent") returned 0
	[0058.153] lstrlenA (lpString="*.torrent") returned 9
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mov") returned 0
	[0058.153] lstrlenA (lpString="*.mov") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.m2v") returned 0
	[0058.153] lstrlenA (lpString="*.m2v") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.3gp") returned 0
	[0058.153] lstrlenA (lpString="*.3gp") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mpeg") returned 0
	[0058.153] lstrlenA (lpString="*.mpeg") returned 6
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mpg") returned 0
	[0058.153] lstrlenA (lpString="*.mpg") returned 5
	[0058.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.flv") returned 0
	[0058.153] lstrlenA (lpString="*.flv") returned 5
	[0058.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.avi") returned 0
	[0058.154] lstrlenA (lpString="*.avi") returned 5
	[0058.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mp4") returned 0
	[0058.154] lstrlenA (lpString="*.mp4") returned 5
	[0058.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.wmv") returned 0
	[0058.154] lstrlenA (lpString="*.wmv") returned 5
	[0058.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.divx") returned 0
	[0058.154] lstrlenA (lpString="*.divx") returned 6
	[0058.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mkv") returned 0
	[0058.154] lstrlenA (lpString="*.mkv") returned 5
	[0058.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mp3") returned 0
	[0058.154] lstrlenA (lpString="*.mp3") returned 5
	[0058.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.wav") returned 1
	[0058.154] lstrlenA (lpString="*.wav") returned 5
	[0058.154] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV"
	[0058.154] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV"
	[0058.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV."
	[0058.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.Boom"
	[0058.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.154] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd686
	[0058.155] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52b0b4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.155] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.155] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd663, lpOverlapped=0x0) returned 1
	[0058.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="LASER.WAV"
	[0058.186] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.186] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd663, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd663, lpOverlapped=0x0) returned 1
	[0058.186] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.186] CloseHandle (hObject=0x94) returned 1
	[0058.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.boom")) returned 1
	[0058.187] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.187] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RADAR.WAV") returned -1
	[0058.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADAR.WAV") returned -1
	[0058.187] lstrcmpiA (lpString1="", lpString2="RADAR.WAV") returned -1
	[0058.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="LASER.WAV"
	[0058.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\"
	[0058.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned=""
	[0058.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt"
	[0058.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20
	[0058.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="RADAR.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV"
	[0058.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.zip") returned 0
	[0058.188] lstrlenA (lpString="*.zip") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.rar") returned 0
	[0058.188] lstrlenA (lpString="*.rar") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.7z") returned 0
	[0058.188] lstrlenA (lpString="*.7z") returned 4
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.tar") returned 0
	[0058.188] lstrlenA (lpString="*.tar") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.gzip") returned 0
	[0058.188] lstrlenA (lpString="*.gzip") returned 6
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.jpg") returned 0
	[0058.188] lstrlenA (lpString="*.jpg") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.jpeg") returned 0
	[0058.188] lstrlenA (lpString="*.jpeg") returned 6
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.psd") returned 0
	[0058.188] lstrlenA (lpString="*.psd") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.cdr") returned 0
	[0058.188] lstrlenA (lpString="*.cdr") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.dwg") returned 0
	[0058.188] lstrlenA (lpString="*.dwg") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.max") returned 0
	[0058.188] lstrlenA (lpString="*.max") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.bmp") returned 0
	[0058.188] lstrlenA (lpString="*.bmp") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.gif") returned 0
	[0058.188] lstrlenA (lpString="*.gif") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.png") returned 0
	[0058.188] lstrlenA (lpString="*.png") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.doc") returned 0
	[0058.188] lstrlenA (lpString="*.doc") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.docx") returned 0
	[0058.188] lstrlenA (lpString="*.docx") returned 6
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.xls") returned 0
	[0058.188] lstrlenA (lpString="*.xls") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.xlsx") returned 0
	[0058.188] lstrlenA (lpString="*.xlsx") returned 6
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.ppt") returned 0
	[0058.188] lstrlenA (lpString="*.ppt") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.pptx") returned 0
	[0058.188] lstrlenA (lpString="*.pptx") returned 6
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.txt") returned 0
	[0058.188] lstrlenA (lpString="*.txt") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.pdf") returned 0
	[0058.188] lstrlenA (lpString="*.pdf") returned 5
	[0058.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.djvu") returned 0
	[0058.189] lstrlenA (lpString="*.djvu") returned 6
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.htm") returned 0
	[0058.189] lstrlenA (lpString="*.htm") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.html") returned 0
	[0058.189] lstrlenA (lpString="*.html") returned 6
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mdb") returned 0
	[0058.189] lstrlenA (lpString="*.mdb") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.cer") returned 0
	[0058.189] lstrlenA (lpString="*.cer") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.p12") returned 0
	[0058.189] lstrlenA (lpString="*.p12") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.pfx") returned 0
	[0058.189] lstrlenA (lpString="*.pfx") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.kwm") returned 0
	[0058.189] lstrlenA (lpString="*.kwm") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.pwm") returned 0
	[0058.189] lstrlenA (lpString="*.pwm") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.1cd") returned 0
	[0058.189] lstrlenA (lpString="*.1cd") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.md") returned 0
	[0058.189] lstrlenA (lpString="*.md") returned 4
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mdf") returned 0
	[0058.189] lstrlenA (lpString="*.mdf") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.dbf") returned 0
	[0058.189] lstrlenA (lpString="*.dbf") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.odt") returned 0
	[0058.189] lstrlenA (lpString="*.odt") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.vob") returned 0
	[0058.189] lstrlenA (lpString="*.vob") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.ifo") returned 0
	[0058.189] lstrlenA (lpString="*.ifo") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.lnk") returned 0
	[0058.189] lstrlenA (lpString="*.lnk") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.torrent") returned 0
	[0058.189] lstrlenA (lpString="*.torrent") returned 9
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mov") returned 0
	[0058.189] lstrlenA (lpString="*.mov") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.m2v") returned 0
	[0058.189] lstrlenA (lpString="*.m2v") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.3gp") returned 0
	[0058.189] lstrlenA (lpString="*.3gp") returned 5
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mpeg") returned 0
	[0058.189] lstrlenA (lpString="*.mpeg") returned 6
	[0058.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mpg") returned 0
	[0058.190] lstrlenA (lpString="*.mpg") returned 5
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.flv") returned 0
	[0058.190] lstrlenA (lpString="*.flv") returned 5
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.avi") returned 0
	[0058.190] lstrlenA (lpString="*.avi") returned 5
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mp4") returned 0
	[0058.190] lstrlenA (lpString="*.mp4") returned 5
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.wmv") returned 0
	[0058.190] lstrlenA (lpString="*.wmv") returned 5
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.divx") returned 0
	[0058.190] lstrlenA (lpString="*.divx") returned 6
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mkv") returned 0
	[0058.190] lstrlenA (lpString="*.mkv") returned 5
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mp3") returned 0
	[0058.190] lstrlenA (lpString="*.mp3") returned 5
	[0058.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.wav") returned 1
	[0058.190] lstrlenA (lpString="*.wav") returned 5
	[0058.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV"
	[0058.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV"
	[0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV."
	[0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.Boom"
	[0058.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.191] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100ea
	[0058.191] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d0d0ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.191] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.191] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x100c7, lpOverlapped=0x0) returned 1
	[0058.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="RADAR.WAV"
	[0058.219] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.219] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x100c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x100c7, lpOverlapped=0x0) returned 1
	[0058.219] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.219] CloseHandle (hObject=0x94) returned 1
	[0058.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.boom")) returned 1
	[0058.220] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.220] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.220] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TOOT.WAV") returned -1
	[0058.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TOOT.WAV") returned -1
	[0058.220] lstrcmpiA (lpString1="", lpString2="TOOT.WAV") returned -1
	[0058.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="RADAR.WAV"
	[0058.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\"
	[0058.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned=""
	[0058.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt"
	[0058.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20
	[0058.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="TOOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV"
	[0058.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.zip") returned 0
	[0058.220] lstrlenA (lpString="*.zip") returned 5
	[0058.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.rar") returned 0
	[0058.220] lstrlenA (lpString="*.rar") returned 5
	[0058.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.7z") returned 0
	[0058.220] lstrlenA (lpString="*.7z") returned 4
	[0058.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.tar") returned 0
	[0058.220] lstrlenA (lpString="*.tar") returned 5
	[0058.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.gzip") returned 0
	[0058.220] lstrlenA (lpString="*.gzip") returned 6
	[0058.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.jpg") returned 0
	[0058.220] lstrlenA (lpString="*.jpg") returned 5
	[0058.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.jpeg") returned 0
	[0058.221] lstrlenA (lpString="*.jpeg") returned 6
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.psd") returned 0
	[0058.221] lstrlenA (lpString="*.psd") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.cdr") returned 0
	[0058.221] lstrlenA (lpString="*.cdr") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.dwg") returned 0
	[0058.221] lstrlenA (lpString="*.dwg") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.max") returned 0
	[0058.221] lstrlenA (lpString="*.max") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.bmp") returned 0
	[0058.221] lstrlenA (lpString="*.bmp") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.gif") returned 0
	[0058.221] lstrlenA (lpString="*.gif") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.png") returned 0
	[0058.221] lstrlenA (lpString="*.png") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.doc") returned 0
	[0058.221] lstrlenA (lpString="*.doc") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.docx") returned 0
	[0058.221] lstrlenA (lpString="*.docx") returned 6
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.xls") returned 0
	[0058.221] lstrlenA (lpString="*.xls") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.xlsx") returned 0
	[0058.221] lstrlenA (lpString="*.xlsx") returned 6
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.ppt") returned 0
	[0058.221] lstrlenA (lpString="*.ppt") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.pptx") returned 0
	[0058.221] lstrlenA (lpString="*.pptx") returned 6
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.txt") returned 0
	[0058.221] lstrlenA (lpString="*.txt") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.pdf") returned 0
	[0058.221] lstrlenA (lpString="*.pdf") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.djvu") returned 0
	[0058.221] lstrlenA (lpString="*.djvu") returned 6
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.htm") returned 0
	[0058.221] lstrlenA (lpString="*.htm") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.html") returned 0
	[0058.221] lstrlenA (lpString="*.html") returned 6
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mdb") returned 0
	[0058.221] lstrlenA (lpString="*.mdb") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.cer") returned 0
	[0058.221] lstrlenA (lpString="*.cer") returned 5
	[0058.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.p12") returned 0
	[0058.221] lstrlenA (lpString="*.p12") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.pfx") returned 0
	[0058.222] lstrlenA (lpString="*.pfx") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.kwm") returned 0
	[0058.222] lstrlenA (lpString="*.kwm") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.pwm") returned 0
	[0058.222] lstrlenA (lpString="*.pwm") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.1cd") returned 0
	[0058.222] lstrlenA (lpString="*.1cd") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.md") returned 0
	[0058.222] lstrlenA (lpString="*.md") returned 4
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mdf") returned 0
	[0058.222] lstrlenA (lpString="*.mdf") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.dbf") returned 0
	[0058.222] lstrlenA (lpString="*.dbf") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.odt") returned 0
	[0058.222] lstrlenA (lpString="*.odt") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.vob") returned 0
	[0058.222] lstrlenA (lpString="*.vob") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.ifo") returned 0
	[0058.222] lstrlenA (lpString="*.ifo") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.lnk") returned 0
	[0058.222] lstrlenA (lpString="*.lnk") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.torrent") returned 0
	[0058.222] lstrlenA (lpString="*.torrent") returned 9
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mov") returned 0
	[0058.222] lstrlenA (lpString="*.mov") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.m2v") returned 0
	[0058.222] lstrlenA (lpString="*.m2v") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.3gp") returned 0
	[0058.222] lstrlenA (lpString="*.3gp") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mpeg") returned 0
	[0058.222] lstrlenA (lpString="*.mpeg") returned 6
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mpg") returned 0
	[0058.222] lstrlenA (lpString="*.mpg") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.flv") returned 0
	[0058.222] lstrlenA (lpString="*.flv") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.avi") returned 0
	[0058.222] lstrlenA (lpString="*.avi") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mp4") returned 0
	[0058.222] lstrlenA (lpString="*.mp4") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.wmv") returned 0
	[0058.222] lstrlenA (lpString="*.wmv") returned 5
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.divx") returned 0
	[0058.222] lstrlenA (lpString="*.divx") returned 6
	[0058.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mkv") returned 0
	[0058.223] lstrlenA (lpString="*.mkv") returned 5
	[0058.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mp3") returned 0
	[0058.223] lstrlenA (lpString="*.mp3") returned 5
	[0058.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.wav") returned 1
	[0058.223] lstrlenA (lpString="*.wav") returned 5
	[0058.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV"
	[0058.223] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV"
	[0058.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV."
	[0058.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.Boom"
	[0058.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.224] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd64a
	[0058.224] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d547830, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.224] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.224] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd627, lpOverlapped=0x0) returned 1
	[0058.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="TOOT.WAV"
	[0058.260] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.260] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd627, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd627, lpOverlapped=0x0) returned 1
	[0058.261] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.261] CloseHandle (hObject=0x94) returned 1
	[0058.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.boom")) returned 1
	[0058.262] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.262] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.262] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIBE.WAV") returned -1
	[0058.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIBE.WAV") returned -1
	[0058.262] lstrcmpiA (lpString1="", lpString2="VIBE.WAV") returned -1
	[0058.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="TOOT.WAV"
	[0058.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\"
	[0058.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned=""
	[0058.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt"
	[0058.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20
	[0058.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="VIBE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV"
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.zip") returned 0
	[0058.263] lstrlenA (lpString="*.zip") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.rar") returned 0
	[0058.263] lstrlenA (lpString="*.rar") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.7z") returned 0
	[0058.263] lstrlenA (lpString="*.7z") returned 4
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.tar") returned 0
	[0058.263] lstrlenA (lpString="*.tar") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.gzip") returned 0
	[0058.263] lstrlenA (lpString="*.gzip") returned 6
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.jpg") returned 0
	[0058.263] lstrlenA (lpString="*.jpg") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.jpeg") returned 0
	[0058.263] lstrlenA (lpString="*.jpeg") returned 6
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.psd") returned 0
	[0058.263] lstrlenA (lpString="*.psd") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.cdr") returned 0
	[0058.263] lstrlenA (lpString="*.cdr") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.dwg") returned 0
	[0058.263] lstrlenA (lpString="*.dwg") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.max") returned 0
	[0058.263] lstrlenA (lpString="*.max") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.bmp") returned 0
	[0058.263] lstrlenA (lpString="*.bmp") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.gif") returned 0
	[0058.263] lstrlenA (lpString="*.gif") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.png") returned 0
	[0058.263] lstrlenA (lpString="*.png") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.doc") returned 0
	[0058.263] lstrlenA (lpString="*.doc") returned 5
	[0058.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.docx") returned 0
	[0058.264] lstrlenA (lpString="*.docx") returned 6
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.xls") returned 0
	[0058.264] lstrlenA (lpString="*.xls") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.xlsx") returned 0
	[0058.264] lstrlenA (lpString="*.xlsx") returned 6
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.ppt") returned 0
	[0058.264] lstrlenA (lpString="*.ppt") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.pptx") returned 0
	[0058.264] lstrlenA (lpString="*.pptx") returned 6
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.txt") returned 0
	[0058.264] lstrlenA (lpString="*.txt") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.pdf") returned 0
	[0058.264] lstrlenA (lpString="*.pdf") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.djvu") returned 0
	[0058.264] lstrlenA (lpString="*.djvu") returned 6
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.htm") returned 0
	[0058.264] lstrlenA (lpString="*.htm") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.html") returned 0
	[0058.264] lstrlenA (lpString="*.html") returned 6
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mdb") returned 0
	[0058.264] lstrlenA (lpString="*.mdb") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.cer") returned 0
	[0058.264] lstrlenA (lpString="*.cer") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.p12") returned 0
	[0058.264] lstrlenA (lpString="*.p12") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.pfx") returned 0
	[0058.264] lstrlenA (lpString="*.pfx") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.kwm") returned 0
	[0058.264] lstrlenA (lpString="*.kwm") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.pwm") returned 0
	[0058.264] lstrlenA (lpString="*.pwm") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.1cd") returned 0
	[0058.264] lstrlenA (lpString="*.1cd") returned 5
	[0058.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.md") returned 0
	[0058.265] lstrlenA (lpString="*.md") returned 4
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mdf") returned 0
	[0058.265] lstrlenA (lpString="*.mdf") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.dbf") returned 0
	[0058.265] lstrlenA (lpString="*.dbf") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.odt") returned 0
	[0058.265] lstrlenA (lpString="*.odt") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.vob") returned 0
	[0058.265] lstrlenA (lpString="*.vob") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.ifo") returned 0
	[0058.265] lstrlenA (lpString="*.ifo") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.lnk") returned 0
	[0058.265] lstrlenA (lpString="*.lnk") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.torrent") returned 0
	[0058.265] lstrlenA (lpString="*.torrent") returned 9
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mov") returned 0
	[0058.265] lstrlenA (lpString="*.mov") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.m2v") returned 0
	[0058.265] lstrlenA (lpString="*.m2v") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.3gp") returned 0
	[0058.265] lstrlenA (lpString="*.3gp") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mpeg") returned 0
	[0058.265] lstrlenA (lpString="*.mpeg") returned 6
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mpg") returned 0
	[0058.265] lstrlenA (lpString="*.mpg") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.flv") returned 0
	[0058.265] lstrlenA (lpString="*.flv") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.avi") returned 0
	[0058.265] lstrlenA (lpString="*.avi") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mp4") returned 0
	[0058.265] lstrlenA (lpString="*.mp4") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.wmv") returned 0
	[0058.265] lstrlenA (lpString="*.wmv") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.divx") returned 0
	[0058.265] lstrlenA (lpString="*.divx") returned 6
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mkv") returned 0
	[0058.265] lstrlenA (lpString="*.mkv") returned 5
	[0058.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mp3") returned 0
	[0058.266] lstrlenA (lpString="*.mp3") returned 5
	[0058.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.wav") returned 1
	[0058.266] lstrlenA (lpString="*.wav") returned 5
	[0058.266] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV"
	[0058.266] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV"
	[0058.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV."
	[0058.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.Boom"
	[0058.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.267] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea72
	[0058.267] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.267] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.267] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xea4f, lpOverlapped=0x0) returned 1
	[0058.287] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="VIBE.WAV"
	[0058.287] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.287] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xea4f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xea4f, lpOverlapped=0x0) returned 1
	[0058.288] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.288] CloseHandle (hObject=0x94) returned 1
	[0058.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.boom")) returned 1
	[0058.288] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.288] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.288] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WARN.WAV") returned -1
	[0058.288] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WARN.WAV") returned -1
	[0058.288] lstrcmpiA (lpString1="", lpString2="WARN.WAV") returned -1
	[0058.288] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="VIBE.WAV"
	[0058.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\"
	[0058.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned=""
	[0058.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt"
	[0058.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20
	[0058.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="WARN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV"
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.zip") returned 0
	[0058.289] lstrlenA (lpString="*.zip") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.rar") returned 0
	[0058.289] lstrlenA (lpString="*.rar") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.7z") returned 0
	[0058.289] lstrlenA (lpString="*.7z") returned 4
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.tar") returned 0
	[0058.289] lstrlenA (lpString="*.tar") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.gzip") returned 0
	[0058.289] lstrlenA (lpString="*.gzip") returned 6
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.jpg") returned 0
	[0058.289] lstrlenA (lpString="*.jpg") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.jpeg") returned 0
	[0058.289] lstrlenA (lpString="*.jpeg") returned 6
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.psd") returned 0
	[0058.289] lstrlenA (lpString="*.psd") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.cdr") returned 0
	[0058.289] lstrlenA (lpString="*.cdr") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.dwg") returned 0
	[0058.289] lstrlenA (lpString="*.dwg") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.max") returned 0
	[0058.289] lstrlenA (lpString="*.max") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.bmp") returned 0
	[0058.289] lstrlenA (lpString="*.bmp") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.gif") returned 0
	[0058.289] lstrlenA (lpString="*.gif") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.png") returned 0
	[0058.289] lstrlenA (lpString="*.png") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.doc") returned 0
	[0058.289] lstrlenA (lpString="*.doc") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.docx") returned 0
	[0058.289] lstrlenA (lpString="*.docx") returned 6
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.xls") returned 0
	[0058.289] lstrlenA (lpString="*.xls") returned 5
	[0058.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.xlsx") returned 0
	[0058.289] lstrlenA (lpString="*.xlsx") returned 6
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.ppt") returned 0
	[0058.290] lstrlenA (lpString="*.ppt") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.pptx") returned 0
	[0058.290] lstrlenA (lpString="*.pptx") returned 6
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.txt") returned 0
	[0058.290] lstrlenA (lpString="*.txt") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.pdf") returned 0
	[0058.290] lstrlenA (lpString="*.pdf") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.djvu") returned 0
	[0058.290] lstrlenA (lpString="*.djvu") returned 6
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.htm") returned 0
	[0058.290] lstrlenA (lpString="*.htm") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.html") returned 0
	[0058.290] lstrlenA (lpString="*.html") returned 6
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mdb") returned 0
	[0058.290] lstrlenA (lpString="*.mdb") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.cer") returned 0
	[0058.290] lstrlenA (lpString="*.cer") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.p12") returned 0
	[0058.290] lstrlenA (lpString="*.p12") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.pfx") returned 0
	[0058.290] lstrlenA (lpString="*.pfx") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.kwm") returned 0
	[0058.290] lstrlenA (lpString="*.kwm") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.pwm") returned 0
	[0058.290] lstrlenA (lpString="*.pwm") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.1cd") returned 0
	[0058.290] lstrlenA (lpString="*.1cd") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.md") returned 0
	[0058.290] lstrlenA (lpString="*.md") returned 4
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mdf") returned 0
	[0058.290] lstrlenA (lpString="*.mdf") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.dbf") returned 0
	[0058.290] lstrlenA (lpString="*.dbf") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.odt") returned 0
	[0058.290] lstrlenA (lpString="*.odt") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.vob") returned 0
	[0058.290] lstrlenA (lpString="*.vob") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.ifo") returned 0
	[0058.290] lstrlenA (lpString="*.ifo") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.lnk") returned 0
	[0058.290] lstrlenA (lpString="*.lnk") returned 5
	[0058.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.torrent") returned 0
	[0058.290] lstrlenA (lpString="*.torrent") returned 9
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mov") returned 0
	[0058.291] lstrlenA (lpString="*.mov") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.m2v") returned 0
	[0058.291] lstrlenA (lpString="*.m2v") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.3gp") returned 0
	[0058.291] lstrlenA (lpString="*.3gp") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mpeg") returned 0
	[0058.291] lstrlenA (lpString="*.mpeg") returned 6
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mpg") returned 0
	[0058.291] lstrlenA (lpString="*.mpg") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.flv") returned 0
	[0058.291] lstrlenA (lpString="*.flv") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.avi") returned 0
	[0058.291] lstrlenA (lpString="*.avi") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mp4") returned 0
	[0058.291] lstrlenA (lpString="*.mp4") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.wmv") returned 0
	[0058.291] lstrlenA (lpString="*.wmv") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.divx") returned 0
	[0058.291] lstrlenA (lpString="*.divx") returned 6
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mkv") returned 0
	[0058.291] lstrlenA (lpString="*.mkv") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mp3") returned 0
	[0058.291] lstrlenA (lpString="*.mp3") returned 5
	[0058.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.wav") returned 1
	[0058.291] lstrlenA (lpString="*.wav") returned 5
	[0058.291] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV"
	[0058.291] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV"
	[0058.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV."
	[0058.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.Boom"
	[0058.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.295] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8a
	[0058.295] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e54ee50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.296] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.296] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xae67, lpOverlapped=0x0) returned 1
	[0058.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="WARN.WAV"
	[0058.321] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.321] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xae67, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xae67, lpOverlapped=0x0) returned 1
	[0058.321] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.321] CloseHandle (hObject=0x94) returned 1
	[0058.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.boom")) returned 1
	[0058.322] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0058.322] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0058.322] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.322] lstrcmpA (lpString1=".", lpString2="Things") returned -1
	[0058.322] lstrcmpA (lpString1="..", lpString2="Things") returned -1
	[0058.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*") returned="*.*"
	[0058.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", lpString2="Things" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things"
	[0058.322] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned 63
	[0058.322] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0058.336] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0058.336] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.337] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0058.337] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0058.337] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.337] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.337] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CAN.WAV") returned 1
	[0058.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAN.WAV") returned 1
	[0058.337] lstrcmpiA (lpString1="", lpString2="CAN.WAV") returned -1
	[0058.337] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*.*") returned="*.*"
	[0058.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\"
	[0058.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned=""
	[0058.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt"
	[0058.337] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0xffffffff
	[0058.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.338] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0058.338] WriteFile (in: hFile=0x94, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0058.338] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0058.339] CloseHandle (hObject=0x94) returned 1
	[0058.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="CAN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV"
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.zip") returned 0
	[0058.339] lstrlenA (lpString="*.zip") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.rar") returned 0
	[0058.339] lstrlenA (lpString="*.rar") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.7z") returned 0
	[0058.339] lstrlenA (lpString="*.7z") returned 4
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.tar") returned 0
	[0058.339] lstrlenA (lpString="*.tar") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.gzip") returned 0
	[0058.339] lstrlenA (lpString="*.gzip") returned 6
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.jpg") returned 0
	[0058.339] lstrlenA (lpString="*.jpg") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.jpeg") returned 0
	[0058.339] lstrlenA (lpString="*.jpeg") returned 6
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.psd") returned 0
	[0058.339] lstrlenA (lpString="*.psd") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.cdr") returned 0
	[0058.339] lstrlenA (lpString="*.cdr") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.dwg") returned 0
	[0058.339] lstrlenA (lpString="*.dwg") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.max") returned 0
	[0058.339] lstrlenA (lpString="*.max") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.bmp") returned 0
	[0058.339] lstrlenA (lpString="*.bmp") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.gif") returned 0
	[0058.339] lstrlenA (lpString="*.gif") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.png") returned 0
	[0058.339] lstrlenA (lpString="*.png") returned 5
	[0058.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.doc") returned 0
	[0058.340] lstrlenA (lpString="*.doc") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.docx") returned 0
	[0058.340] lstrlenA (lpString="*.docx") returned 6
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.xls") returned 0
	[0058.340] lstrlenA (lpString="*.xls") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.xlsx") returned 0
	[0058.340] lstrlenA (lpString="*.xlsx") returned 6
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.ppt") returned 0
	[0058.340] lstrlenA (lpString="*.ppt") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.pptx") returned 0
	[0058.340] lstrlenA (lpString="*.pptx") returned 6
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.txt") returned 0
	[0058.340] lstrlenA (lpString="*.txt") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.pdf") returned 0
	[0058.340] lstrlenA (lpString="*.pdf") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.djvu") returned 0
	[0058.340] lstrlenA (lpString="*.djvu") returned 6
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.htm") returned 0
	[0058.340] lstrlenA (lpString="*.htm") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.html") returned 0
	[0058.340] lstrlenA (lpString="*.html") returned 6
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mdb") returned 0
	[0058.340] lstrlenA (lpString="*.mdb") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.cer") returned 0
	[0058.340] lstrlenA (lpString="*.cer") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.p12") returned 0
	[0058.340] lstrlenA (lpString="*.p12") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.pfx") returned 0
	[0058.340] lstrlenA (lpString="*.pfx") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.kwm") returned 0
	[0058.340] lstrlenA (lpString="*.kwm") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.pwm") returned 0
	[0058.340] lstrlenA (lpString="*.pwm") returned 5
	[0058.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.1cd") returned 0
	[0058.340] lstrlenA (lpString="*.1cd") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.md") returned 0
	[0058.341] lstrlenA (lpString="*.md") returned 4
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mdf") returned 0
	[0058.341] lstrlenA (lpString="*.mdf") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.dbf") returned 0
	[0058.341] lstrlenA (lpString="*.dbf") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.odt") returned 0
	[0058.341] lstrlenA (lpString="*.odt") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.vob") returned 0
	[0058.341] lstrlenA (lpString="*.vob") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.ifo") returned 0
	[0058.341] lstrlenA (lpString="*.ifo") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.lnk") returned 0
	[0058.341] lstrlenA (lpString="*.lnk") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.torrent") returned 0
	[0058.341] lstrlenA (lpString="*.torrent") returned 9
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mov") returned 0
	[0058.341] lstrlenA (lpString="*.mov") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.m2v") returned 0
	[0058.341] lstrlenA (lpString="*.m2v") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.3gp") returned 0
	[0058.341] lstrlenA (lpString="*.3gp") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mpeg") returned 0
	[0058.341] lstrlenA (lpString="*.mpeg") returned 6
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mpg") returned 0
	[0058.341] lstrlenA (lpString="*.mpg") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.flv") returned 0
	[0058.341] lstrlenA (lpString="*.flv") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.avi") returned 0
	[0058.341] lstrlenA (lpString="*.avi") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mp4") returned 0
	[0058.341] lstrlenA (lpString="*.mp4") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.wmv") returned 0
	[0058.341] lstrlenA (lpString="*.wmv") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.divx") returned 0
	[0058.341] lstrlenA (lpString="*.divx") returned 6
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mkv") returned 0
	[0058.341] lstrlenA (lpString="*.mkv") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mp3") returned 0
	[0058.341] lstrlenA (lpString="*.mp3") returned 5
	[0058.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.wav") returned 1
	[0058.341] lstrlenA (lpString="*.wav") returned 5
	[0058.341] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV"
	[0058.341] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV"
	[0058.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV."
	[0058.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.Boom"
	[0058.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.374] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8fc
	[0058.374] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x603362b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.374] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.374] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc8d9, lpOverlapped=0x0) returned 1
	[0058.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="CAN.WAV"
	[0058.376] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.376] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc8d9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc8d9, lpOverlapped=0x0) returned 1
	[0058.376] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.376] CloseHandle (hObject=0x94) returned 1
	[0058.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.boom")) returned 1
	[0058.377] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.377] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.377] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COUPLER.WAV") returned 1
	[0058.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COUPLER.WAV") returned 1
	[0058.377] lstrcmpiA (lpString1="", lpString2="COUPLER.WAV") returned -1
	[0058.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="CAN.WAV"
	[0058.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\"
	[0058.377] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned=""
	[0058.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt"
	[0058.377] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20
	[0058.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="COUPLER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV"
	[0058.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.zip") returned 0
	[0058.378] lstrlenA (lpString="*.zip") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.rar") returned 0
	[0058.378] lstrlenA (lpString="*.rar") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.7z") returned 0
	[0058.378] lstrlenA (lpString="*.7z") returned 4
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.tar") returned 0
	[0058.378] lstrlenA (lpString="*.tar") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.gzip") returned 0
	[0058.378] lstrlenA (lpString="*.gzip") returned 6
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.jpg") returned 0
	[0058.378] lstrlenA (lpString="*.jpg") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.jpeg") returned 0
	[0058.378] lstrlenA (lpString="*.jpeg") returned 6
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.psd") returned 0
	[0058.378] lstrlenA (lpString="*.psd") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.cdr") returned 0
	[0058.378] lstrlenA (lpString="*.cdr") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.dwg") returned 0
	[0058.378] lstrlenA (lpString="*.dwg") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.max") returned 0
	[0058.378] lstrlenA (lpString="*.max") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.bmp") returned 0
	[0058.378] lstrlenA (lpString="*.bmp") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.gif") returned 0
	[0058.378] lstrlenA (lpString="*.gif") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.png") returned 0
	[0058.378] lstrlenA (lpString="*.png") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.doc") returned 0
	[0058.378] lstrlenA (lpString="*.doc") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.docx") returned 0
	[0058.378] lstrlenA (lpString="*.docx") returned 6
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.xls") returned 0
	[0058.378] lstrlenA (lpString="*.xls") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.xlsx") returned 0
	[0058.378] lstrlenA (lpString="*.xlsx") returned 6
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.ppt") returned 0
	[0058.378] lstrlenA (lpString="*.ppt") returned 5
	[0058.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.pptx") returned 0
	[0058.379] lstrlenA (lpString="*.pptx") returned 6
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.txt") returned 0
	[0058.379] lstrlenA (lpString="*.txt") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.pdf") returned 0
	[0058.379] lstrlenA (lpString="*.pdf") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.djvu") returned 0
	[0058.379] lstrlenA (lpString="*.djvu") returned 6
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.htm") returned 0
	[0058.379] lstrlenA (lpString="*.htm") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.html") returned 0
	[0058.379] lstrlenA (lpString="*.html") returned 6
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mdb") returned 0
	[0058.379] lstrlenA (lpString="*.mdb") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.cer") returned 0
	[0058.379] lstrlenA (lpString="*.cer") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.p12") returned 0
	[0058.379] lstrlenA (lpString="*.p12") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.pfx") returned 0
	[0058.379] lstrlenA (lpString="*.pfx") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.kwm") returned 0
	[0058.379] lstrlenA (lpString="*.kwm") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.pwm") returned 0
	[0058.379] lstrlenA (lpString="*.pwm") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.1cd") returned 0
	[0058.379] lstrlenA (lpString="*.1cd") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.md") returned 0
	[0058.379] lstrlenA (lpString="*.md") returned 4
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mdf") returned 0
	[0058.379] lstrlenA (lpString="*.mdf") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.dbf") returned 0
	[0058.379] lstrlenA (lpString="*.dbf") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.odt") returned 0
	[0058.379] lstrlenA (lpString="*.odt") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.vob") returned 0
	[0058.379] lstrlenA (lpString="*.vob") returned 5
	[0058.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.ifo") returned 0
	[0058.379] lstrlenA (lpString="*.ifo") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.lnk") returned 0
	[0058.380] lstrlenA (lpString="*.lnk") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.torrent") returned 0
	[0058.380] lstrlenA (lpString="*.torrent") returned 9
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mov") returned 0
	[0058.380] lstrlenA (lpString="*.mov") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.m2v") returned 0
	[0058.380] lstrlenA (lpString="*.m2v") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.3gp") returned 0
	[0058.380] lstrlenA (lpString="*.3gp") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mpeg") returned 0
	[0058.380] lstrlenA (lpString="*.mpeg") returned 6
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mpg") returned 0
	[0058.380] lstrlenA (lpString="*.mpg") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.flv") returned 0
	[0058.380] lstrlenA (lpString="*.flv") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.avi") returned 0
	[0058.380] lstrlenA (lpString="*.avi") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mp4") returned 0
	[0058.380] lstrlenA (lpString="*.mp4") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.wmv") returned 0
	[0058.380] lstrlenA (lpString="*.wmv") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.divx") returned 0
	[0058.380] lstrlenA (lpString="*.divx") returned 6
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mkv") returned 0
	[0058.380] lstrlenA (lpString="*.mkv") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mp3") returned 0
	[0058.380] lstrlenA (lpString="*.mp3") returned 5
	[0058.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.wav") returned 1
	[0058.380] lstrlenA (lpString="*.wav") returned 5
	[0058.380] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV"
	[0058.380] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV"
	[0058.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV."
	[0058.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.Boom"
	[0058.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.382] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f18
	[0058.382] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51ce9230, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.382] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.382] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9ef5, lpOverlapped=0x0) returned 1
	[0058.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="COUPLER.WAV"
	[0058.396] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.396] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9ef5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9ef5, lpOverlapped=0x0) returned 1
	[0058.397] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.397] CloseHandle (hObject=0x94) returned 1
	[0058.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.boom")) returned 1
	[0058.397] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.397] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.397] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HORN.WAV") returned -1
	[0058.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HORN.WAV") returned 1
	[0058.397] lstrcmpiA (lpString1="", lpString2="HORN.WAV") returned -1
	[0058.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="COUPLER.WAV"
	[0058.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\"
	[0058.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned=""
	[0058.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt"
	[0058.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20
	[0058.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HORN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV"
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.zip") returned 0
	[0058.398] lstrlenA (lpString="*.zip") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.rar") returned 0
	[0058.398] lstrlenA (lpString="*.rar") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.7z") returned 0
	[0058.398] lstrlenA (lpString="*.7z") returned 4
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.tar") returned 0
	[0058.398] lstrlenA (lpString="*.tar") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.gzip") returned 0
	[0058.398] lstrlenA (lpString="*.gzip") returned 6
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.jpg") returned 0
	[0058.398] lstrlenA (lpString="*.jpg") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.jpeg") returned 0
	[0058.398] lstrlenA (lpString="*.jpeg") returned 6
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.psd") returned 0
	[0058.398] lstrlenA (lpString="*.psd") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.cdr") returned 0
	[0058.398] lstrlenA (lpString="*.cdr") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.dwg") returned 0
	[0058.398] lstrlenA (lpString="*.dwg") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.max") returned 0
	[0058.398] lstrlenA (lpString="*.max") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.bmp") returned 0
	[0058.398] lstrlenA (lpString="*.bmp") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.gif") returned 0
	[0058.398] lstrlenA (lpString="*.gif") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.png") returned 0
	[0058.398] lstrlenA (lpString="*.png") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.doc") returned 0
	[0058.398] lstrlenA (lpString="*.doc") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.docx") returned 0
	[0058.398] lstrlenA (lpString="*.docx") returned 6
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.xls") returned 0
	[0058.398] lstrlenA (lpString="*.xls") returned 5
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.xlsx") returned 0
	[0058.398] lstrlenA (lpString="*.xlsx") returned 6
	[0058.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.ppt") returned 0
	[0058.398] lstrlenA (lpString="*.ppt") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.pptx") returned 0
	[0058.399] lstrlenA (lpString="*.pptx") returned 6
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.txt") returned 0
	[0058.399] lstrlenA (lpString="*.txt") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.pdf") returned 0
	[0058.399] lstrlenA (lpString="*.pdf") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.djvu") returned 0
	[0058.399] lstrlenA (lpString="*.djvu") returned 6
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.htm") returned 0
	[0058.399] lstrlenA (lpString="*.htm") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.html") returned 0
	[0058.399] lstrlenA (lpString="*.html") returned 6
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mdb") returned 0
	[0058.399] lstrlenA (lpString="*.mdb") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.cer") returned 0
	[0058.399] lstrlenA (lpString="*.cer") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.p12") returned 0
	[0058.399] lstrlenA (lpString="*.p12") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.pfx") returned 0
	[0058.399] lstrlenA (lpString="*.pfx") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.kwm") returned 0
	[0058.399] lstrlenA (lpString="*.kwm") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.pwm") returned 0
	[0058.399] lstrlenA (lpString="*.pwm") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.1cd") returned 0
	[0058.399] lstrlenA (lpString="*.1cd") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.md") returned 0
	[0058.399] lstrlenA (lpString="*.md") returned 4
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mdf") returned 0
	[0058.399] lstrlenA (lpString="*.mdf") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.dbf") returned 0
	[0058.399] lstrlenA (lpString="*.dbf") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.odt") returned 0
	[0058.399] lstrlenA (lpString="*.odt") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.vob") returned 0
	[0058.399] lstrlenA (lpString="*.vob") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.ifo") returned 0
	[0058.399] lstrlenA (lpString="*.ifo") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.lnk") returned 0
	[0058.399] lstrlenA (lpString="*.lnk") returned 5
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.torrent") returned 0
	[0058.399] lstrlenA (lpString="*.torrent") returned 9
	[0058.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mov") returned 0
	[0058.400] lstrlenA (lpString="*.mov") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.m2v") returned 0
	[0058.400] lstrlenA (lpString="*.m2v") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.3gp") returned 0
	[0058.400] lstrlenA (lpString="*.3gp") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mpeg") returned 0
	[0058.400] lstrlenA (lpString="*.mpeg") returned 6
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mpg") returned 0
	[0058.400] lstrlenA (lpString="*.mpg") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.flv") returned 0
	[0058.400] lstrlenA (lpString="*.flv") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.avi") returned 0
	[0058.400] lstrlenA (lpString="*.avi") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mp4") returned 0
	[0058.400] lstrlenA (lpString="*.mp4") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.wmv") returned 0
	[0058.400] lstrlenA (lpString="*.wmv") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.divx") returned 0
	[0058.400] lstrlenA (lpString="*.divx") returned 6
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mkv") returned 0
	[0058.400] lstrlenA (lpString="*.mkv") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mp3") returned 0
	[0058.400] lstrlenA (lpString="*.mp3") returned 5
	[0058.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.wav") returned 1
	[0058.400] lstrlenA (lpString="*.wav") returned 5
	[0058.400] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV"
	[0058.400] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV"
	[0058.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV."
	[0058.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.Boom"
	[0058.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.401] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa412
	[0058.401] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.402] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.402] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa3ef, lpOverlapped=0x0) returned 1
	[0058.422] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="HORN.WAV"
	[0058.423] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.423] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa3ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa3ef, lpOverlapped=0x0) returned 1
	[0058.423] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.423] CloseHandle (hObject=0x94) returned 1
	[0058.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.boom")) returned 1
	[0058.424] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.424] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.424] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SHOT.WAV") returned -1
	[0058.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SHOT.WAV") returned -1
	[0058.424] lstrcmpiA (lpString1="", lpString2="SHOT.WAV") returned -1
	[0058.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="HORN.WAV"
	[0058.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\"
	[0058.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned=""
	[0058.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt"
	[0058.424] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20
	[0058.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="SHOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV"
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.zip") returned 0
	[0058.424] lstrlenA (lpString="*.zip") returned 5
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.rar") returned 0
	[0058.424] lstrlenA (lpString="*.rar") returned 5
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.7z") returned 0
	[0058.424] lstrlenA (lpString="*.7z") returned 4
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.tar") returned 0
	[0058.424] lstrlenA (lpString="*.tar") returned 5
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.gzip") returned 0
	[0058.424] lstrlenA (lpString="*.gzip") returned 6
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.jpg") returned 0
	[0058.424] lstrlenA (lpString="*.jpg") returned 5
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.jpeg") returned 0
	[0058.424] lstrlenA (lpString="*.jpeg") returned 6
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.psd") returned 0
	[0058.424] lstrlenA (lpString="*.psd") returned 5
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.cdr") returned 0
	[0058.424] lstrlenA (lpString="*.cdr") returned 5
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.dwg") returned 0
	[0058.424] lstrlenA (lpString="*.dwg") returned 5
	[0058.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.max") returned 0
	[0058.424] lstrlenA (lpString="*.max") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.bmp") returned 0
	[0058.425] lstrlenA (lpString="*.bmp") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.gif") returned 0
	[0058.425] lstrlenA (lpString="*.gif") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.png") returned 0
	[0058.425] lstrlenA (lpString="*.png") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.doc") returned 0
	[0058.425] lstrlenA (lpString="*.doc") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.docx") returned 0
	[0058.425] lstrlenA (lpString="*.docx") returned 6
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.xls") returned 0
	[0058.425] lstrlenA (lpString="*.xls") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.xlsx") returned 0
	[0058.425] lstrlenA (lpString="*.xlsx") returned 6
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.ppt") returned 0
	[0058.425] lstrlenA (lpString="*.ppt") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.pptx") returned 0
	[0058.425] lstrlenA (lpString="*.pptx") returned 6
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.txt") returned 0
	[0058.425] lstrlenA (lpString="*.txt") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.pdf") returned 0
	[0058.425] lstrlenA (lpString="*.pdf") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.djvu") returned 0
	[0058.425] lstrlenA (lpString="*.djvu") returned 6
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.htm") returned 0
	[0058.425] lstrlenA (lpString="*.htm") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.html") returned 0
	[0058.425] lstrlenA (lpString="*.html") returned 6
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mdb") returned 0
	[0058.425] lstrlenA (lpString="*.mdb") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.cer") returned 0
	[0058.425] lstrlenA (lpString="*.cer") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.p12") returned 0
	[0058.425] lstrlenA (lpString="*.p12") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.pfx") returned 0
	[0058.425] lstrlenA (lpString="*.pfx") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.kwm") returned 0
	[0058.425] lstrlenA (lpString="*.kwm") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.pwm") returned 0
	[0058.425] lstrlenA (lpString="*.pwm") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.1cd") returned 0
	[0058.425] lstrlenA (lpString="*.1cd") returned 5
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.md") returned 0
	[0058.425] lstrlenA (lpString="*.md") returned 4
	[0058.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mdf") returned 0
	[0058.425] lstrlenA (lpString="*.mdf") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.dbf") returned 0
	[0058.426] lstrlenA (lpString="*.dbf") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.odt") returned 0
	[0058.426] lstrlenA (lpString="*.odt") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.vob") returned 0
	[0058.426] lstrlenA (lpString="*.vob") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.ifo") returned 0
	[0058.426] lstrlenA (lpString="*.ifo") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.lnk") returned 0
	[0058.426] lstrlenA (lpString="*.lnk") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.torrent") returned 0
	[0058.426] lstrlenA (lpString="*.torrent") returned 9
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mov") returned 0
	[0058.426] lstrlenA (lpString="*.mov") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.m2v") returned 0
	[0058.426] lstrlenA (lpString="*.m2v") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.3gp") returned 0
	[0058.426] lstrlenA (lpString="*.3gp") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mpeg") returned 0
	[0058.426] lstrlenA (lpString="*.mpeg") returned 6
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mpg") returned 0
	[0058.426] lstrlenA (lpString="*.mpg") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.flv") returned 0
	[0058.426] lstrlenA (lpString="*.flv") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.avi") returned 0
	[0058.426] lstrlenA (lpString="*.avi") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mp4") returned 0
	[0058.426] lstrlenA (lpString="*.mp4") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.wmv") returned 0
	[0058.426] lstrlenA (lpString="*.wmv") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.divx") returned 0
	[0058.426] lstrlenA (lpString="*.divx") returned 6
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mkv") returned 0
	[0058.426] lstrlenA (lpString="*.mkv") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mp3") returned 0
	[0058.426] lstrlenA (lpString="*.mp3") returned 5
	[0058.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.wav") returned 1
	[0058.426] lstrlenA (lpString="*.wav") returned 5
	[0058.426] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV"
	[0058.426] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV"
	[0058.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV."
	[0058.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.Boom"
	[0058.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.427] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb14e
	[0058.427] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.428] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.428] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xb12b, lpOverlapped=0x0) returned 1
	[0058.445] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="SHOT.WAV"
	[0058.445] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.445] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xb12b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xb12b, lpOverlapped=0x0) returned 1
	[0058.446] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.446] CloseHandle (hObject=0x94) returned 1
	[0058.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.boom")) returned 1
	[0058.447] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.447] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.447] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SHOVEL.WAV") returned -1
	[0058.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SHOVEL.WAV") returned -1
	[0058.447] lstrcmpiA (lpString1="", lpString2="SHOVEL.WAV") returned -1
	[0058.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="SHOT.WAV"
	[0058.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\"
	[0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned=""
	[0058.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt"
	[0058.447] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20
	[0058.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="SHOVEL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV"
	[0058.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.zip") returned 0
	[0058.447] lstrlenA (lpString="*.zip") returned 5
	[0058.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.rar") returned 0
	[0058.447] lstrlenA (lpString="*.rar") returned 5
	[0058.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.7z") returned 0
	[0058.447] lstrlenA (lpString="*.7z") returned 4
	[0058.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.tar") returned 0
	[0058.447] lstrlenA (lpString="*.tar") returned 5
	[0058.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.gzip") returned 0
	[0058.447] lstrlenA (lpString="*.gzip") returned 6
	[0058.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.jpg") returned 0
	[0058.448] lstrlenA (lpString="*.jpg") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.jpeg") returned 0
	[0058.448] lstrlenA (lpString="*.jpeg") returned 6
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.psd") returned 0
	[0058.448] lstrlenA (lpString="*.psd") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.cdr") returned 0
	[0058.448] lstrlenA (lpString="*.cdr") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.dwg") returned 0
	[0058.448] lstrlenA (lpString="*.dwg") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.max") returned 0
	[0058.448] lstrlenA (lpString="*.max") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.bmp") returned 0
	[0058.448] lstrlenA (lpString="*.bmp") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.gif") returned 0
	[0058.448] lstrlenA (lpString="*.gif") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.png") returned 0
	[0058.448] lstrlenA (lpString="*.png") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.doc") returned 0
	[0058.448] lstrlenA (lpString="*.doc") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.docx") returned 0
	[0058.448] lstrlenA (lpString="*.docx") returned 6
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.xls") returned 0
	[0058.448] lstrlenA (lpString="*.xls") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.xlsx") returned 0
	[0058.448] lstrlenA (lpString="*.xlsx") returned 6
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.ppt") returned 0
	[0058.448] lstrlenA (lpString="*.ppt") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.pptx") returned 0
	[0058.448] lstrlenA (lpString="*.pptx") returned 6
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.txt") returned 0
	[0058.448] lstrlenA (lpString="*.txt") returned 5
	[0058.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.pdf") returned 0
	[0058.449] lstrlenA (lpString="*.pdf") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.djvu") returned 0
	[0058.449] lstrlenA (lpString="*.djvu") returned 6
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.htm") returned 0
	[0058.449] lstrlenA (lpString="*.htm") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.html") returned 0
	[0058.449] lstrlenA (lpString="*.html") returned 6
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mdb") returned 0
	[0058.449] lstrlenA (lpString="*.mdb") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.cer") returned 0
	[0058.449] lstrlenA (lpString="*.cer") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.p12") returned 0
	[0058.449] lstrlenA (lpString="*.p12") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.pfx") returned 0
	[0058.449] lstrlenA (lpString="*.pfx") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.kwm") returned 0
	[0058.449] lstrlenA (lpString="*.kwm") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.pwm") returned 0
	[0058.449] lstrlenA (lpString="*.pwm") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.1cd") returned 0
	[0058.449] lstrlenA (lpString="*.1cd") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.md") returned 0
	[0058.449] lstrlenA (lpString="*.md") returned 4
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mdf") returned 0
	[0058.449] lstrlenA (lpString="*.mdf") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.dbf") returned 0
	[0058.449] lstrlenA (lpString="*.dbf") returned 5
	[0058.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.odt") returned 0
	[0058.449] lstrlenA (lpString="*.odt") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.vob") returned 0
	[0058.450] lstrlenA (lpString="*.vob") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.ifo") returned 0
	[0058.450] lstrlenA (lpString="*.ifo") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.lnk") returned 0
	[0058.450] lstrlenA (lpString="*.lnk") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.torrent") returned 0
	[0058.450] lstrlenA (lpString="*.torrent") returned 9
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mov") returned 0
	[0058.450] lstrlenA (lpString="*.mov") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.m2v") returned 0
	[0058.450] lstrlenA (lpString="*.m2v") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.3gp") returned 0
	[0058.450] lstrlenA (lpString="*.3gp") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mpeg") returned 0
	[0058.450] lstrlenA (lpString="*.mpeg") returned 6
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mpg") returned 0
	[0058.450] lstrlenA (lpString="*.mpg") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.flv") returned 0
	[0058.450] lstrlenA (lpString="*.flv") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.avi") returned 0
	[0058.450] lstrlenA (lpString="*.avi") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mp4") returned 0
	[0058.450] lstrlenA (lpString="*.mp4") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.wmv") returned 0
	[0058.450] lstrlenA (lpString="*.wmv") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.divx") returned 0
	[0058.450] lstrlenA (lpString="*.divx") returned 6
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mkv") returned 0
	[0058.450] lstrlenA (lpString="*.mkv") returned 5
	[0058.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mp3") returned 0
	[0058.451] lstrlenA (lpString="*.mp3") returned 5
	[0058.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.wav") returned 1
	[0058.451] lstrlenA (lpString="*.wav") returned 5
	[0058.451] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV"
	[0058.451] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV"
	[0058.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV."
	[0058.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.Boom"
	[0058.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.451] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf548
	[0058.451] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2c00d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.451] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.452] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf525, lpOverlapped=0x0) returned 1
	[0058.454] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="SHOVEL.WAV"
	[0058.454] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.454] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf525, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf525, lpOverlapped=0x0) returned 1
	[0058.454] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.455] CloseHandle (hObject=0x94) returned 1
	[0058.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.boom")) returned 1
	[0058.456] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.456] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.456] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SPLASH.WAV") returned -1
	[0058.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPLASH.WAV") returned -1
	[0058.456] lstrcmpiA (lpString1="", lpString2="SPLASH.WAV") returned -1
	[0058.456] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="SHOVEL.WAV"
	[0058.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\"
	[0058.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned=""
	[0058.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt"
	[0058.456] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20
	[0058.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="SPLASH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV"
	[0058.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.zip") returned 0
	[0058.456] lstrlenA (lpString="*.zip") returned 5
	[0058.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.rar") returned 0
	[0058.456] lstrlenA (lpString="*.rar") returned 5
	[0058.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.7z") returned 0
	[0058.457] lstrlenA (lpString="*.7z") returned 4
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.tar") returned 0
	[0058.457] lstrlenA (lpString="*.tar") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.gzip") returned 0
	[0058.457] lstrlenA (lpString="*.gzip") returned 6
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.jpg") returned 0
	[0058.457] lstrlenA (lpString="*.jpg") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.jpeg") returned 0
	[0058.457] lstrlenA (lpString="*.jpeg") returned 6
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.psd") returned 0
	[0058.457] lstrlenA (lpString="*.psd") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.cdr") returned 0
	[0058.457] lstrlenA (lpString="*.cdr") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.dwg") returned 0
	[0058.457] lstrlenA (lpString="*.dwg") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.max") returned 0
	[0058.457] lstrlenA (lpString="*.max") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.bmp") returned 0
	[0058.457] lstrlenA (lpString="*.bmp") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.gif") returned 0
	[0058.457] lstrlenA (lpString="*.gif") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.png") returned 0
	[0058.457] lstrlenA (lpString="*.png") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.doc") returned 0
	[0058.457] lstrlenA (lpString="*.doc") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.docx") returned 0
	[0058.457] lstrlenA (lpString="*.docx") returned 6
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.xls") returned 0
	[0058.457] lstrlenA (lpString="*.xls") returned 5
	[0058.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.xlsx") returned 0
	[0058.457] lstrlenA (lpString="*.xlsx") returned 6
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.ppt") returned 0
	[0058.458] lstrlenA (lpString="*.ppt") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.pptx") returned 0
	[0058.458] lstrlenA (lpString="*.pptx") returned 6
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.txt") returned 0
	[0058.458] lstrlenA (lpString="*.txt") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.pdf") returned 0
	[0058.458] lstrlenA (lpString="*.pdf") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.djvu") returned 0
	[0058.458] lstrlenA (lpString="*.djvu") returned 6
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.htm") returned 0
	[0058.458] lstrlenA (lpString="*.htm") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.html") returned 0
	[0058.458] lstrlenA (lpString="*.html") returned 6
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mdb") returned 0
	[0058.458] lstrlenA (lpString="*.mdb") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.cer") returned 0
	[0058.458] lstrlenA (lpString="*.cer") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.p12") returned 0
	[0058.458] lstrlenA (lpString="*.p12") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.pfx") returned 0
	[0058.458] lstrlenA (lpString="*.pfx") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.kwm") returned 0
	[0058.458] lstrlenA (lpString="*.kwm") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.pwm") returned 0
	[0058.458] lstrlenA (lpString="*.pwm") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.1cd") returned 0
	[0058.458] lstrlenA (lpString="*.1cd") returned 5
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.md") returned 0
	[0058.458] lstrlenA (lpString="*.md") returned 4
	[0058.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mdf") returned 0
	[0058.459] lstrlenA (lpString="*.mdf") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.dbf") returned 0
	[0058.459] lstrlenA (lpString="*.dbf") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.odt") returned 0
	[0058.459] lstrlenA (lpString="*.odt") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.vob") returned 0
	[0058.459] lstrlenA (lpString="*.vob") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.ifo") returned 0
	[0058.459] lstrlenA (lpString="*.ifo") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.lnk") returned 0
	[0058.459] lstrlenA (lpString="*.lnk") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.torrent") returned 0
	[0058.459] lstrlenA (lpString="*.torrent") returned 9
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mov") returned 0
	[0058.459] lstrlenA (lpString="*.mov") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.m2v") returned 0
	[0058.459] lstrlenA (lpString="*.m2v") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.3gp") returned 0
	[0058.459] lstrlenA (lpString="*.3gp") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mpeg") returned 0
	[0058.459] lstrlenA (lpString="*.mpeg") returned 6
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mpg") returned 0
	[0058.459] lstrlenA (lpString="*.mpg") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.flv") returned 0
	[0058.459] lstrlenA (lpString="*.flv") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.avi") returned 0
	[0058.459] lstrlenA (lpString="*.avi") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mp4") returned 0
	[0058.459] lstrlenA (lpString="*.mp4") returned 5
	[0058.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.wmv") returned 0
	[0058.459] lstrlenA (lpString="*.wmv") returned 5
	[0058.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.divx") returned 0
	[0058.460] lstrlenA (lpString="*.divx") returned 6
	[0058.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mkv") returned 0
	[0058.460] lstrlenA (lpString="*.mkv") returned 5
	[0058.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mp3") returned 0
	[0058.460] lstrlenA (lpString="*.mp3") returned 5
	[0058.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.wav") returned 1
	[0058.460] lstrlenA (lpString="*.wav") returned 5
	[0058.460] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV"
	[0058.460] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV"
	[0058.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV."
	[0058.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.Boom"
	[0058.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.462] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xedd6
	[0058.462] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.462] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.462] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xedb3, lpOverlapped=0x0) returned 1
	[0058.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="SPLASH.WAV"
	[0058.482] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.482] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xedb3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xedb3, lpOverlapped=0x0) returned 1
	[0058.482] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.482] CloseHandle (hObject=0x94) returned 1
	[0058.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.boom")) returned 1
	[0058.488] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0058.488] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0058.488] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHOOSH.WAV") returned -1
	[0058.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHOOSH.WAV") returned -1
	[0058.488] lstrcmpiA (lpString1="", lpString2="WHOOSH.WAV") returned -1
	[0058.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="SPLASH.WAV"
	[0058.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\"
	[0058.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned=""
	[0058.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt"
	[0058.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20
	[0058.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV"
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.zip") returned 0
	[0058.488] lstrlenA (lpString="*.zip") returned 5
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.rar") returned 0
	[0058.488] lstrlenA (lpString="*.rar") returned 5
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.7z") returned 0
	[0058.488] lstrlenA (lpString="*.7z") returned 4
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.tar") returned 0
	[0058.488] lstrlenA (lpString="*.tar") returned 5
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.gzip") returned 0
	[0058.488] lstrlenA (lpString="*.gzip") returned 6
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.jpg") returned 0
	[0058.488] lstrlenA (lpString="*.jpg") returned 5
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.jpeg") returned 0
	[0058.488] lstrlenA (lpString="*.jpeg") returned 6
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.psd") returned 0
	[0058.488] lstrlenA (lpString="*.psd") returned 5
	[0058.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.cdr") returned 0
	[0058.488] lstrlenA (lpString="*.cdr") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.dwg") returned 0
	[0058.489] lstrlenA (lpString="*.dwg") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.max") returned 0
	[0058.489] lstrlenA (lpString="*.max") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.bmp") returned 0
	[0058.489] lstrlenA (lpString="*.bmp") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.gif") returned 0
	[0058.489] lstrlenA (lpString="*.gif") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.png") returned 0
	[0058.489] lstrlenA (lpString="*.png") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.doc") returned 0
	[0058.489] lstrlenA (lpString="*.doc") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.docx") returned 0
	[0058.489] lstrlenA (lpString="*.docx") returned 6
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.xls") returned 0
	[0058.489] lstrlenA (lpString="*.xls") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.xlsx") returned 0
	[0058.489] lstrlenA (lpString="*.xlsx") returned 6
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.ppt") returned 0
	[0058.489] lstrlenA (lpString="*.ppt") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.pptx") returned 0
	[0058.489] lstrlenA (lpString="*.pptx") returned 6
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.txt") returned 0
	[0058.489] lstrlenA (lpString="*.txt") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.pdf") returned 0
	[0058.489] lstrlenA (lpString="*.pdf") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.djvu") returned 0
	[0058.489] lstrlenA (lpString="*.djvu") returned 6
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.htm") returned 0
	[0058.489] lstrlenA (lpString="*.htm") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.html") returned 0
	[0058.489] lstrlenA (lpString="*.html") returned 6
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mdb") returned 0
	[0058.489] lstrlenA (lpString="*.mdb") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.cer") returned 0
	[0058.489] lstrlenA (lpString="*.cer") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.p12") returned 0
	[0058.489] lstrlenA (lpString="*.p12") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.pfx") returned 0
	[0058.489] lstrlenA (lpString="*.pfx") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.kwm") returned 0
	[0058.489] lstrlenA (lpString="*.kwm") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.pwm") returned 0
	[0058.489] lstrlenA (lpString="*.pwm") returned 5
	[0058.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.1cd") returned 0
	[0058.490] lstrlenA (lpString="*.1cd") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.md") returned 0
	[0058.490] lstrlenA (lpString="*.md") returned 4
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mdf") returned 0
	[0058.490] lstrlenA (lpString="*.mdf") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.dbf") returned 0
	[0058.490] lstrlenA (lpString="*.dbf") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.odt") returned 0
	[0058.490] lstrlenA (lpString="*.odt") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.vob") returned 0
	[0058.490] lstrlenA (lpString="*.vob") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.ifo") returned 0
	[0058.490] lstrlenA (lpString="*.ifo") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.lnk") returned 0
	[0058.490] lstrlenA (lpString="*.lnk") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.torrent") returned 0
	[0058.490] lstrlenA (lpString="*.torrent") returned 9
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mov") returned 0
	[0058.490] lstrlenA (lpString="*.mov") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.m2v") returned 0
	[0058.490] lstrlenA (lpString="*.m2v") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.3gp") returned 0
	[0058.490] lstrlenA (lpString="*.3gp") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mpeg") returned 0
	[0058.490] lstrlenA (lpString="*.mpeg") returned 6
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mpg") returned 0
	[0058.490] lstrlenA (lpString="*.mpg") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.flv") returned 0
	[0058.490] lstrlenA (lpString="*.flv") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.avi") returned 0
	[0058.490] lstrlenA (lpString="*.avi") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mp4") returned 0
	[0058.490] lstrlenA (lpString="*.mp4") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.wmv") returned 0
	[0058.490] lstrlenA (lpString="*.wmv") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.divx") returned 0
	[0058.490] lstrlenA (lpString="*.divx") returned 6
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mkv") returned 0
	[0058.490] lstrlenA (lpString="*.mkv") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mp3") returned 0
	[0058.490] lstrlenA (lpString="*.mp3") returned 5
	[0058.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.wav") returned 1
	[0058.491] lstrlenA (lpString="*.wav") returned 5
	[0058.491] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV"
	[0058.491] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV"
	[0058.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV."
	[0058.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.Boom"
	[0058.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0058.513] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6bbc
	[0058.513] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x537fcc70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.513] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.513] ReadFile (in: hFile=0x94, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6b99, lpOverlapped=0x0) returned 1
	[0058.521] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="WHOOSH.WAV"
	[0058.521] SetFilePointer (in: hFile=0x94, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.521] WriteFile (in: hFile=0x94, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6b99, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6b99, lpOverlapped=0x0) returned 1
	[0058.521] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.521] CloseHandle (hObject=0x94) returned 1
	[0058.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.boom")) returned 1
	[0058.522] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0058.522] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0058.522] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0058.522] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0058.522] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0058.522] lstrcmpA (lpString1=".", lpString2="ToolBMPs") returned -1
	[0058.522] lstrcmpA (lpString1="..", lpString2="ToolBMPs") returned -1
	[0058.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*"
	[0058.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolBMPs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs"
	[0058.522] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned 58
	[0058.522] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0058.527] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0058.527] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.529] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0058.529] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0058.529] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.529] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarToolIconImages.jpg") returned 1
	[0058.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImages.jpg") returned 1
	[0058.529] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImages.jpg") returned -1
	[0058.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*.*") returned="*.*"
	[0058.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0xffffffff
	[0058.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.530] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0058.530] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0058.530] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0058.531] CloseHandle (hObject=0x90) returned 1
	[0058.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg"
	[0058.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0058.531] lstrlenA (lpString="*.zip") returned 5
	[0058.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0058.531] lstrlenA (lpString="*.rar") returned 5
	[0058.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0058.531] lstrlenA (lpString="*.7z") returned 4
	[0058.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0058.531] lstrlenA (lpString="*.tar") returned 5
	[0058.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0058.531] lstrlenA (lpString="*.gzip") returned 6
	[0058.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0058.531] lstrlenA (lpString="*.jpg") returned 5
	[0058.531] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg"
	[0058.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg"
	[0058.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg."
	[0058.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.Boom"
	[0058.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.531] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c9
	[0058.531] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7093c400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7093c400, dwHighDateTime=0x1c747ea)) returned 1
	[0058.532] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.532] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14a6, lpOverlapped=0x0) returned 1
	[0058.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg"
	[0058.568] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.568] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14a6, lpOverlapped=0x0) returned 1
	[0058.569] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.569] CloseHandle (hObject=0x90) returned 1
	[0058.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.boom")) returned 1
	[0058.569] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.569] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.569] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarToolIconImagesMask.bmp") returned 1
	[0058.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImagesMask.bmp") returned 1
	[0058.570] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImagesMask.bmp") returned -1
	[0058.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg"
	[0058.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp"
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0058.570] lstrlenA (lpString="*.zip") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0058.570] lstrlenA (lpString="*.rar") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0058.570] lstrlenA (lpString="*.7z") returned 4
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0058.570] lstrlenA (lpString="*.tar") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0058.570] lstrlenA (lpString="*.gzip") returned 6
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0058.570] lstrlenA (lpString="*.jpg") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0058.570] lstrlenA (lpString="*.jpeg") returned 6
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0058.570] lstrlenA (lpString="*.psd") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0058.570] lstrlenA (lpString="*.cdr") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0058.570] lstrlenA (lpString="*.dwg") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0058.570] lstrlenA (lpString="*.max") returned 5
	[0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0058.570] lstrlenA (lpString="*.bmp") returned 5
	[0058.570] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp"
	[0058.570] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp"
	[0058.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp."
	[0058.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.Boom"
	[0058.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.571] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x538
	[0058.571] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7093c400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7093c400, dwHighDateTime=0x1c747ea)) returned 1
	[0058.571] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.571] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x515, lpOverlapped=0x0) returned 1
	[0058.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp"
	[0058.602] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.602] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x515, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x515, lpOverlapped=0x0) returned 1
	[0058.603] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.603] CloseHandle (hObject=0x90) returned 1
	[0058.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.boom")) returned 1
	[0058.603] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.603] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ChessIconImages.bmp") returned 1
	[0058.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ChessIconImages.bmp") returned 1
	[0058.603] lstrcmpiA (lpString1="", lpString2="ChessIconImages.bmp") returned -1
	[0058.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp"
	[0058.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="ChessIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp"
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.zip") returned 0
	[0058.604] lstrlenA (lpString="*.zip") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.rar") returned 0
	[0058.604] lstrlenA (lpString="*.rar") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.7z") returned 0
	[0058.604] lstrlenA (lpString="*.7z") returned 4
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.tar") returned 0
	[0058.604] lstrlenA (lpString="*.tar") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.gzip") returned 0
	[0058.604] lstrlenA (lpString="*.gzip") returned 6
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.jpg") returned 0
	[0058.604] lstrlenA (lpString="*.jpg") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.jpeg") returned 0
	[0058.604] lstrlenA (lpString="*.jpeg") returned 6
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.psd") returned 0
	[0058.604] lstrlenA (lpString="*.psd") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.cdr") returned 0
	[0058.604] lstrlenA (lpString="*.cdr") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.dwg") returned 0
	[0058.604] lstrlenA (lpString="*.dwg") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.max") returned 0
	[0058.604] lstrlenA (lpString="*.max") returned 5
	[0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.bmp") returned 1
	[0058.604] lstrlenA (lpString="*.bmp") returned 5
	[0058.604] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp"
	[0058.604] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp"
	[0058.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp."
	[0058.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.Boom"
	[0058.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.605] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf38
	[0058.605] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1
	[0058.605] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.605] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf15, lpOverlapped=0x0) returned 1
	[0058.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="ChessIconImages.bmp"
	[0058.625] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.625] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf15, lpOverlapped=0x0) returned 1
	[0058.625] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.625] CloseHandle (hObject=0x90) returned 1
	[0058.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.boom")) returned 1
	[0058.626] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.626] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.626] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ChessIconImagesMask.bmp") returned 1
	[0058.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ChessIconImagesMask.bmp") returned 1
	[0058.626] lstrcmpiA (lpString1="", lpString2="ChessIconImagesMask.bmp") returned -1
	[0058.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="ChessIconImages.bmp"
	[0058.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="ChessIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp"
	[0058.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0058.626] lstrlenA (lpString="*.zip") returned 5
	[0058.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0058.626] lstrlenA (lpString="*.rar") returned 5
	[0058.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0058.626] lstrlenA (lpString="*.7z") returned 4
	[0058.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0058.626] lstrlenA (lpString="*.tar") returned 5
	[0058.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0058.626] lstrlenA (lpString="*.gzip") returned 6
	[0058.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0058.626] lstrlenA (lpString="*.jpg") returned 5
	[0058.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0058.627] lstrlenA (lpString="*.jpeg") returned 6
	[0058.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0058.627] lstrlenA (lpString="*.psd") returned 5
	[0058.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0058.627] lstrlenA (lpString="*.cdr") returned 5
	[0058.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0058.627] lstrlenA (lpString="*.dwg") returned 5
	[0058.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0058.627] lstrlenA (lpString="*.max") returned 5
	[0058.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0058.627] lstrlenA (lpString="*.bmp") returned 5
	[0058.627] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp"
	[0058.627] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp"
	[0058.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp."
	[0058.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.Boom"
	[0058.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.627] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x938
	[0058.627] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1
	[0058.627] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.627] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x915, lpOverlapped=0x0) returned 1
	[0058.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="ChessIconImagesMask.bmp"
	[0058.632] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.632] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x915, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x915, lpOverlapped=0x0) returned 1
	[0058.632] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.632] CloseHandle (hObject=0x90) returned 1
	[0058.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.boom")) returned 1
	[0058.633] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.633] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.633] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CreateSpaceImage.jpg") returned 1
	[0058.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateSpaceImage.jpg") returned 1
	[0058.633] lstrcmpiA (lpString1="", lpString2="CreateSpaceImage.jpg") returned -1
	[0058.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="ChessIconImagesMask.bmp"
	[0058.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.634] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CreateSpaceImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg"
	[0058.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.zip") returned 0
	[0058.634] lstrlenA (lpString="*.zip") returned 5
	[0058.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.rar") returned 0
	[0058.634] lstrlenA (lpString="*.rar") returned 5
	[0058.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.7z") returned 0
	[0058.634] lstrlenA (lpString="*.7z") returned 4
	[0058.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.tar") returned 0
	[0058.634] lstrlenA (lpString="*.tar") returned 5
	[0058.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.gzip") returned 0
	[0058.634] lstrlenA (lpString="*.gzip") returned 6
	[0058.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.jpg") returned 1
	[0058.634] lstrlenA (lpString="*.jpg") returned 5
	[0058.634] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg"
	[0058.634] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg"
	[0058.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg."
	[0058.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.Boom"
	[0058.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.635] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x296b
	[0058.635] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51d0f390, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1
	[0058.635] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.635] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2948, lpOverlapped=0x0) returned 1
	[0058.656] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="CreateSpaceImage.jpg"
	[0058.656] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.656] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2948, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2948, lpOverlapped=0x0) returned 1
	[0058.657] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.657] CloseHandle (hObject=0x90) returned 1
	[0058.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.boom")) returned 1
	[0058.658] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.658] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CreateSpaceImageMask.bmp") returned 1
	[0058.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateSpaceImageMask.bmp") returned 1
	[0058.658] lstrcmpiA (lpString1="", lpString2="CreateSpaceImageMask.bmp") returned -1
	[0058.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="CreateSpaceImage.jpg"
	[0058.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.658] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CreateSpaceImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp"
	[0058.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.zip") returned 0
	[0058.658] lstrlenA (lpString="*.zip") returned 5
	[0058.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.rar") returned 0
	[0058.658] lstrlenA (lpString="*.rar") returned 5
	[0058.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.7z") returned 0
	[0058.658] lstrlenA (lpString="*.7z") returned 4
	[0058.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.tar") returned 0
	[0058.658] lstrlenA (lpString="*.tar") returned 5
	[0058.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.gzip") returned 0
	[0058.658] lstrlenA (lpString="*.gzip") returned 6
	[0058.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.jpg") returned 0
	[0058.659] lstrlenA (lpString="*.jpg") returned 5
	[0058.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0058.659] lstrlenA (lpString="*.jpeg") returned 6
	[0058.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.psd") returned 0
	[0058.659] lstrlenA (lpString="*.psd") returned 5
	[0058.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.cdr") returned 0
	[0058.659] lstrlenA (lpString="*.cdr") returned 5
	[0058.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.dwg") returned 0
	[0058.659] lstrlenA (lpString="*.dwg") returned 5
	[0058.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.max") returned 0
	[0058.659] lstrlenA (lpString="*.max") returned 5
	[0058.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.bmp") returned 1
	[0058.659] lstrlenA (lpString="*.bmp") returned 5
	[0058.659] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp"
	[0058.659] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp"
	[0058.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp."
	[0058.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.Boom"
	[0058.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.660] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf78
	[0058.661] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51d0f390, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1
	[0058.661] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.661] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf55, lpOverlapped=0x0) returned 1
	[0058.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="CreateSpaceImageMask.bmp"
	[0058.680] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.681] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf55, lpOverlapped=0x0) returned 1
	[0058.681] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.681] CloseHandle (hObject=0x90) returned 1
	[0058.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.boom")) returned 1
	[0058.682] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.682] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.682] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DataListIconImages.jpg") returned 1
	[0058.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataListIconImages.jpg") returned 1
	[0058.682] lstrcmpiA (lpString1="", lpString2="DataListIconImages.jpg") returned -1
	[0058.682] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="CreateSpaceImageMask.bmp"
	[0058.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataListIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg"
	[0058.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.zip") returned 0
	[0058.682] lstrlenA (lpString="*.zip") returned 5
	[0058.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.rar") returned 0
	[0058.682] lstrlenA (lpString="*.rar") returned 5
	[0058.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.7z") returned 0
	[0058.682] lstrlenA (lpString="*.7z") returned 4
	[0058.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.tar") returned 0
	[0058.682] lstrlenA (lpString="*.tar") returned 5
	[0058.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.gzip") returned 0
	[0058.682] lstrlenA (lpString="*.gzip") returned 6
	[0058.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.jpg") returned 1
	[0058.683] lstrlenA (lpString="*.jpg") returned 5
	[0058.683] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg"
	[0058.683] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg"
	[0058.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg."
	[0058.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.Boom"
	[0058.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.691] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c7
	[0058.691] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1
	[0058.691] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.691] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x16a4, lpOverlapped=0x0) returned 1
	[0058.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="DataListIconImages.jpg"
	[0058.743] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.743] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x16a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x16a4, lpOverlapped=0x0) returned 1
	[0058.743] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.743] CloseHandle (hObject=0x90) returned 1
	[0058.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.boom")) returned 1
	[0058.744] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.744] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.744] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DataListIconImagesMask.bmp") returned 1
	[0058.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataListIconImagesMask.bmp") returned 1
	[0058.744] lstrcmpiA (lpString1="", lpString2="DataListIconImagesMask.bmp") returned -1
	[0058.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="DataListIconImages.jpg"
	[0058.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataListIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp"
	[0058.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0058.744] lstrlenA (lpString="*.zip") returned 5
	[0058.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0058.744] lstrlenA (lpString="*.rar") returned 5
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0058.745] lstrlenA (lpString="*.7z") returned 4
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0058.745] lstrlenA (lpString="*.tar") returned 5
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0058.745] lstrlenA (lpString="*.gzip") returned 6
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0058.745] lstrlenA (lpString="*.jpg") returned 5
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0058.745] lstrlenA (lpString="*.jpeg") returned 6
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0058.745] lstrlenA (lpString="*.psd") returned 5
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0058.745] lstrlenA (lpString="*.cdr") returned 5
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0058.745] lstrlenA (lpString="*.dwg") returned 5
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0058.745] lstrlenA (lpString="*.max") returned 5
	[0058.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0058.745] lstrlenA (lpString="*.bmp") returned 5
	[0058.745] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp"
	[0058.745] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp"
	[0058.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp."
	[0058.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.Boom"
	[0058.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.746] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x708
	[0058.746] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1
	[0058.746] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.746] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6e5, lpOverlapped=0x0) returned 1
	[0058.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="DataListIconImagesMask.bmp"
	[0058.805] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.805] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6e5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6e5, lpOverlapped=0x0) returned 1
	[0058.806] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.806] CloseHandle (hObject=0x90) returned 1
	[0058.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.boom")) returned 1
	[0058.807] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.807] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.807] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DataViewIconImages.jpg") returned 1
	[0058.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataViewIconImages.jpg") returned 1
	[0058.807] lstrcmpiA (lpString1="", lpString2="DataViewIconImages.jpg") returned -1
	[0058.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="DataListIconImagesMask.bmp"
	[0058.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.807] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.807] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg"
	[0058.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.zip") returned 0
	[0058.807] lstrlenA (lpString="*.zip") returned 5
	[0058.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.rar") returned 0
	[0058.807] lstrlenA (lpString="*.rar") returned 5
	[0058.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.7z") returned 0
	[0058.807] lstrlenA (lpString="*.7z") returned 4
	[0058.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.tar") returned 0
	[0058.807] lstrlenA (lpString="*.tar") returned 5
	[0058.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.gzip") returned 0
	[0058.807] lstrlenA (lpString="*.gzip") returned 6
	[0058.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.jpg") returned 1
	[0058.807] lstrlenA (lpString="*.jpg") returned 5
	[0058.807] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg"
	[0058.807] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg"
	[0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg."
	[0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.Boom"
	[0058.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.815] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c7
	[0058.815] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.815] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.816] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x16a4, lpOverlapped=0x0) returned 1
	[0058.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="DataViewIconImages.jpg"
	[0058.844] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.844] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x16a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x16a4, lpOverlapped=0x0) returned 1
	[0058.844] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.844] CloseHandle (hObject=0x90) returned 1
	[0058.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.boom")) returned 1
	[0058.845] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.845] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.845] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DataViewIconImagesMask.bmp") returned 1
	[0058.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataViewIconImagesMask.bmp") returned 1
	[0058.845] lstrcmpiA (lpString1="", lpString2="DataViewIconImagesMask.bmp") returned -1
	[0058.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="DataViewIconImages.jpg"
	[0058.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataViewIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp"
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0058.846] lstrlenA (lpString="*.zip") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0058.846] lstrlenA (lpString="*.rar") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0058.846] lstrlenA (lpString="*.7z") returned 4
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0058.846] lstrlenA (lpString="*.tar") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0058.846] lstrlenA (lpString="*.gzip") returned 6
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0058.846] lstrlenA (lpString="*.jpg") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0058.846] lstrlenA (lpString="*.jpeg") returned 6
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0058.846] lstrlenA (lpString="*.psd") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0058.846] lstrlenA (lpString="*.cdr") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0058.846] lstrlenA (lpString="*.dwg") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0058.846] lstrlenA (lpString="*.max") returned 5
	[0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0058.846] lstrlenA (lpString="*.bmp") returned 5
	[0058.846] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp"
	[0058.846] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp"
	[0058.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp."
	[0058.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.Boom"
	[0058.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.847] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x708
	[0058.847] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51d354f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.848] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.851] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6e5, lpOverlapped=0x0) returned 1
	[0058.868] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="DataViewIconImagesMask.bmp"
	[0058.868] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.868] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6e5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6e5, lpOverlapped=0x0) returned 1
	[0058.868] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.868] CloseHandle (hObject=0x90) returned 1
	[0058.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.boom")) returned 1
	[0058.869] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.869] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.869] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImages.jpg") returned 1
	[0058.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImages.jpg") returned 1
	[0058.869] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImages.jpg") returned -1
	[0058.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="DataViewIconImagesMask.bmp"
	[0058.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.869] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.869] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg"
	[0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0058.869] lstrlenA (lpString="*.zip") returned 5
	[0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0058.869] lstrlenA (lpString="*.rar") returned 5
	[0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0058.870] lstrlenA (lpString="*.7z") returned 4
	[0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0058.870] lstrlenA (lpString="*.tar") returned 5
	[0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0058.870] lstrlenA (lpString="*.gzip") returned 6
	[0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0058.870] lstrlenA (lpString="*.jpg") returned 5
	[0058.870] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg"
	[0058.870] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg"
	[0058.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg."
	[0058.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.Boom"
	[0058.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.871] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2eaf
	[0058.871] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.871] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.871] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2e8c, lpOverlapped=0x0) returned 1
	[0058.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg"
	[0058.886] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.886] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2e8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2e8c, lpOverlapped=0x0) returned 1
	[0058.886] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.886] CloseHandle (hObject=0x90) returned 1
	[0058.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.boom")) returned 1
	[0058.887] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.887] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImagesMask.bmp") returned 1
	[0058.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1
	[0058.887] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImagesMask.bmp") returned -1
	[0058.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg"
	[0058.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.888] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.888] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp"
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0058.888] lstrlenA (lpString="*.zip") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0058.888] lstrlenA (lpString="*.rar") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0058.888] lstrlenA (lpString="*.7z") returned 4
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0058.888] lstrlenA (lpString="*.tar") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0058.888] lstrlenA (lpString="*.gzip") returned 6
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0058.888] lstrlenA (lpString="*.jpg") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0058.888] lstrlenA (lpString="*.jpeg") returned 6
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0058.888] lstrlenA (lpString="*.psd") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0058.888] lstrlenA (lpString="*.cdr") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0058.888] lstrlenA (lpString="*.dwg") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0058.888] lstrlenA (lpString="*.max") returned 5
	[0058.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0058.888] lstrlenA (lpString="*.bmp") returned 5
	[0058.888] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp"
	[0058.888] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp"
	[0058.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp."
	[0058.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.Boom"
	[0058.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.890] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638
	[0058.890] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51e19d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.890] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.890] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x615, lpOverlapped=0x0) returned 1
	[0058.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="DiscussionToolIconImagesMask.bmp"
	[0058.970] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.970] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x615, lpOverlapped=0x0) returned 1
	[0058.970] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.970] CloseHandle (hObject=0x90) returned 1
	[0058.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.boom")) returned 1
	[0058.971] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.971] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.971] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Form_StatusImage.jpg") returned -1
	[0058.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Form_StatusImage.jpg") returned 1
	[0058.971] lstrcmpiA (lpString1="", lpString2="Form_StatusImage.jpg") returned -1
	[0058.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="DiscussionToolIconImagesMask.bmp"
	[0058.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.971] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg"
	[0058.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.zip") returned 0
	[0058.972] lstrlenA (lpString="*.zip") returned 5
	[0058.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.rar") returned 0
	[0058.972] lstrlenA (lpString="*.rar") returned 5
	[0058.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.7z") returned 0
	[0058.972] lstrlenA (lpString="*.7z") returned 4
	[0058.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.tar") returned 0
	[0058.972] lstrlenA (lpString="*.tar") returned 5
	[0058.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.gzip") returned 0
	[0058.972] lstrlenA (lpString="*.gzip") returned 6
	[0058.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.jpg") returned 1
	[0058.972] lstrlenA (lpString="*.jpg") returned 5
	[0058.972] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg"
	[0058.972] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg"
	[0058.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg."
	[0058.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.Boom"
	[0058.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.973] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a0f
	[0058.973] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.973] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.973] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x29ec, lpOverlapped=0x0) returned 1
	[0058.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="Form_StatusImage.jpg"
	[0058.986] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.986] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x29ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x29ec, lpOverlapped=0x0) returned 1
	[0058.986] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0058.987] CloseHandle (hObject=0x90) returned 1
	[0058.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.boom")) returned 1
	[0058.988] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0058.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0058.988] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Form_StatusImageMask.bmp") returned -1
	[0058.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Form_StatusImageMask.bmp") returned 1
	[0058.988] lstrcmpiA (lpString1="", lpString2="Form_StatusImageMask.bmp") returned -1
	[0058.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="Form_StatusImage.jpg"
	[0058.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0058.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0058.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0058.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0058.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Form_StatusImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp"
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.zip") returned 0
	[0058.988] lstrlenA (lpString="*.zip") returned 5
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.rar") returned 0
	[0058.988] lstrlenA (lpString="*.rar") returned 5
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.7z") returned 0
	[0058.988] lstrlenA (lpString="*.7z") returned 4
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.tar") returned 0
	[0058.988] lstrlenA (lpString="*.tar") returned 5
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.gzip") returned 0
	[0058.988] lstrlenA (lpString="*.gzip") returned 6
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.jpg") returned 0
	[0058.988] lstrlenA (lpString="*.jpg") returned 5
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0058.988] lstrlenA (lpString="*.jpeg") returned 6
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.psd") returned 0
	[0058.988] lstrlenA (lpString="*.psd") returned 5
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.cdr") returned 0
	[0058.988] lstrlenA (lpString="*.cdr") returned 5
	[0058.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.dwg") returned 0
	[0058.988] lstrlenA (lpString="*.dwg") returned 5
	[0058.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.max") returned 0
	[0058.989] lstrlenA (lpString="*.max") returned 5
	[0058.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.bmp") returned 1
	[0058.989] lstrlenA (lpString="*.bmp") returned 5
	[0058.989] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp"
	[0058.989] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp"
	[0058.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp."
	[0058.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.Boom"
	[0058.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0058.989] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3618
	[0058.989] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1
	[0058.989] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0058.989] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x35f5, lpOverlapped=0x0) returned 1
	[0059.001] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="Form_StatusImageMask.bmp"
	[0059.001] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.001] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x35f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x35f5, lpOverlapped=0x0) returned 1
	[0059.001] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.001] CloseHandle (hObject=0x90) returned 1
	[0059.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.boom")) returned 1
	[0059.002] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.002] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.002] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GRIP.JPG") returned -1
	[0059.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRIP.JPG") returned 1
	[0059.003] lstrcmpiA (lpString1="", lpString2="GRIP.JPG") returned -1
	[0059.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="Form_StatusImageMask.bmp"
	[0059.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG"
	[0059.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.zip") returned 0
	[0059.003] lstrlenA (lpString="*.zip") returned 5
	[0059.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.rar") returned 0
	[0059.003] lstrlenA (lpString="*.rar") returned 5
	[0059.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.7z") returned 0
	[0059.003] lstrlenA (lpString="*.7z") returned 4
	[0059.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.tar") returned 0
	[0059.003] lstrlenA (lpString="*.tar") returned 5
	[0059.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.gzip") returned 0
	[0059.003] lstrlenA (lpString="*.gzip") returned 6
	[0059.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.jpg") returned 1
	[0059.003] lstrlenA (lpString="*.jpg") returned 5
	[0059.003] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG"
	[0059.003] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG"
	[0059.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG."
	[0059.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.Boom"
	[0059.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.005] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d29
	[0059.005] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61c0e850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.005] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.005] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1d06, lpOverlapped=0x0) returned 1
	[0059.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="GRIP.JPG"
	[0059.021] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.021] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1d06, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1d06, lpOverlapped=0x0) returned 1
	[0059.022] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.022] CloseHandle (hObject=0x90) returned 1
	[0059.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.boom")) returned 1
	[0059.023] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.023] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GRIPMASK.BMP") returned -1
	[0059.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRIPMASK.BMP") returned 1
	[0059.023] lstrcmpiA (lpString1="", lpString2="GRIPMASK.BMP") returned -1
	[0059.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="GRIP.JPG"
	[0059.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="GRIPMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP"
	[0059.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.zip") returned 0
	[0059.023] lstrlenA (lpString="*.zip") returned 5
	[0059.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.rar") returned 0
	[0059.023] lstrlenA (lpString="*.rar") returned 5
	[0059.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.7z") returned 0
	[0059.023] lstrlenA (lpString="*.7z") returned 4
	[0059.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.tar") returned 0
	[0059.023] lstrlenA (lpString="*.tar") returned 5
	[0059.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.gzip") returned 0
	[0059.023] lstrlenA (lpString="*.gzip") returned 6
	[0059.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.jpg") returned 0
	[0059.023] lstrlenA (lpString="*.jpg") returned 5
	[0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.jpeg") returned 0
	[0059.024] lstrlenA (lpString="*.jpeg") returned 6
	[0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.psd") returned 0
	[0059.024] lstrlenA (lpString="*.psd") returned 5
	[0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.cdr") returned 0
	[0059.024] lstrlenA (lpString="*.cdr") returned 5
	[0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.dwg") returned 0
	[0059.024] lstrlenA (lpString="*.dwg") returned 5
	[0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.max") returned 0
	[0059.024] lstrlenA (lpString="*.max") returned 5
	[0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.bmp") returned 1
	[0059.024] lstrlenA (lpString="*.bmp") returned 5
	[0059.024] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP"
	[0059.024] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP"
	[0059.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP."
	[0059.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.Boom"
	[0059.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.025] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc38
	[0059.025] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61c0e850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.025] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.025] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc15, lpOverlapped=0x0) returned 1
	[0059.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="GRIPMASK.BMP"
	[0059.027] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.027] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc15, lpOverlapped=0x0) returned 1
	[0059.027] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.028] CloseHandle (hObject=0x90) returned 1
	[0059.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp.boom")) returned 1
	[0059.029] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.029] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.029] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InformationIcon.jpg") returned -1
	[0059.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InformationIcon.jpg") returned -1
	[0059.029] lstrcmpiA (lpString1="", lpString2="InformationIcon.jpg") returned -1
	[0059.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="GRIPMASK.BMP"
	[0059.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg"
	[0059.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.zip") returned 0
	[0059.029] lstrlenA (lpString="*.zip") returned 5
	[0059.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.rar") returned 0
	[0059.029] lstrlenA (lpString="*.rar") returned 5
	[0059.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.7z") returned 0
	[0059.029] lstrlenA (lpString="*.7z") returned 4
	[0059.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.tar") returned 0
	[0059.029] lstrlenA (lpString="*.tar") returned 5
	[0059.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.gzip") returned 0
	[0059.029] lstrlenA (lpString="*.gzip") returned 6
	[0059.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.jpg") returned 1
	[0059.030] lstrlenA (lpString="*.jpg") returned 5
	[0059.030] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg"
	[0059.030] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg"
	[0059.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg."
	[0059.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.Boom"
	[0059.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.031] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe5
	[0059.031] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.031] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.031] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbc2, lpOverlapped=0x0) returned 1
	[0059.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="InformationIcon.jpg"
	[0059.053] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.053] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbc2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbc2, lpOverlapped=0x0) returned 1
	[0059.053] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.053] CloseHandle (hObject=0x90) returned 1
	[0059.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.boom")) returned 1
	[0059.054] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.054] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.054] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InformationIconMask.bmp") returned -1
	[0059.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InformationIconMask.bmp") returned -1
	[0059.054] lstrcmpiA (lpString1="", lpString2="InformationIconMask.bmp") returned -1
	[0059.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="InformationIcon.jpg"
	[0059.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="InformationIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp"
	[0059.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.zip") returned 0
	[0059.054] lstrlenA (lpString="*.zip") returned 5
	[0059.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.rar") returned 0
	[0059.054] lstrlenA (lpString="*.rar") returned 5
	[0059.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.7z") returned 0
	[0059.054] lstrlenA (lpString="*.7z") returned 4
	[0059.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.tar") returned 0
	[0059.054] lstrlenA (lpString="*.tar") returned 5
	[0059.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.gzip") returned 0
	[0059.055] lstrlenA (lpString="*.gzip") returned 6
	[0059.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.jpg") returned 0
	[0059.055] lstrlenA (lpString="*.jpg") returned 5
	[0059.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.055] lstrlenA (lpString="*.jpeg") returned 6
	[0059.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.psd") returned 0
	[0059.055] lstrlenA (lpString="*.psd") returned 5
	[0059.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.cdr") returned 0
	[0059.055] lstrlenA (lpString="*.cdr") returned 5
	[0059.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.dwg") returned 0
	[0059.055] lstrlenA (lpString="*.dwg") returned 5
	[0059.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.max") returned 0
	[0059.055] lstrlenA (lpString="*.max") returned 5
	[0059.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.bmp") returned 1
	[0059.055] lstrlenA (lpString="*.bmp") returned 5
	[0059.055] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp"
	[0059.055] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp"
	[0059.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp."
	[0059.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.Boom"
	[0059.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.056] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838
	[0059.056] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.056] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.056] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x815, lpOverlapped=0x0) returned 1
	[0059.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="InformationIconMask.bmp"
	[0059.057] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.058] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x815, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x815, lpOverlapped=0x0) returned 1
	[0059.058] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.058] CloseHandle (hObject=0x90) returned 1
	[0059.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.boom")) returned 1
	[0059.059] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LoginDialogBackground.jpg") returned -1
	[0059.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginDialogBackground.jpg") returned -1
	[0059.059] lstrcmpiA (lpString1="", lpString2="LoginDialogBackground.jpg") returned -1
	[0059.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="InformationIconMask.bmp"
	[0059.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg"
	[0059.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.zip") returned 0
	[0059.059] lstrlenA (lpString="*.zip") returned 5
	[0059.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.rar") returned 0
	[0059.059] lstrlenA (lpString="*.rar") returned 5
	[0059.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.7z") returned 0
	[0059.059] lstrlenA (lpString="*.7z") returned 4
	[0059.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.tar") returned 0
	[0059.059] lstrlenA (lpString="*.tar") returned 5
	[0059.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.gzip") returned 0
	[0059.059] lstrlenA (lpString="*.gzip") returned 6
	[0059.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.jpg") returned 1
	[0059.059] lstrlenA (lpString="*.jpg") returned 5
	[0059.059] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg"
	[0059.059] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg"
	[0059.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg."
	[0059.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.Boom"
	[0059.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.060] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xceed
	[0059.060] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x675aa300, dwHighDateTime=0x1c9f921), lpLastAccessTime=0x407536*(dwLowDateTime=0x581a1510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x675aa300, dwHighDateTime=0x1c9f921)) returned 1
	[0059.060] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.061] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xceca, lpOverlapped=0x0) returned 1
	[0059.090] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="LoginDialogBackground.jpg"
	[0059.091] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.091] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xceca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xceca, lpOverlapped=0x0) returned 1
	[0059.091] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.091] CloseHandle (hObject=0x90) returned 1
	[0059.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.boom")) returned 1
	[0059.092] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.092] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.092] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LoginTool24x24Images.jpg") returned -1
	[0059.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginTool24x24Images.jpg") returned -1
	[0059.092] lstrcmpiA (lpString1="", lpString2="LoginTool24x24Images.jpg") returned -1
	[0059.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="LoginDialogBackground.jpg"
	[0059.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.092] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg"
	[0059.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.zip") returned 0
	[0059.092] lstrlenA (lpString="*.zip") returned 5
	[0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.rar") returned 0
	[0059.093] lstrlenA (lpString="*.rar") returned 5
	[0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.7z") returned 0
	[0059.093] lstrlenA (lpString="*.7z") returned 4
	[0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.tar") returned 0
	[0059.093] lstrlenA (lpString="*.tar") returned 5
	[0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.gzip") returned 0
	[0059.093] lstrlenA (lpString="*.gzip") returned 6
	[0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.jpg") returned 1
	[0059.093] lstrlenA (lpString="*.jpg") returned 5
	[0059.093] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg"
	[0059.093] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg"
	[0059.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg."
	[0059.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.Boom"
	[0059.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.094] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e93
	[0059.094] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x695e6e70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1
	[0059.094] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.094] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1e70, lpOverlapped=0x0) returned 1
	[0059.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="LoginTool24x24Images.jpg"
	[0059.130] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.131] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1e70, lpOverlapped=0x0) returned 1
	[0059.131] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.131] CloseHandle (hObject=0x90) returned 1
	[0059.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.boom")) returned 1
	[0059.132] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.132] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LoginTool24x24ImagesMask.bmp") returned -1
	[0059.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginTool24x24ImagesMask.bmp") returned -1
	[0059.132] lstrcmpiA (lpString1="", lpString2="LoginTool24x24ImagesMask.bmp") returned -1
	[0059.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="LoginTool24x24Images.jpg"
	[0059.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginTool24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp"
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.132] lstrlenA (lpString="*.zip") returned 5
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.132] lstrlenA (lpString="*.rar") returned 5
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.132] lstrlenA (lpString="*.7z") returned 4
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.132] lstrlenA (lpString="*.tar") returned 5
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.132] lstrlenA (lpString="*.gzip") returned 6
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.132] lstrlenA (lpString="*.jpg") returned 5
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.132] lstrlenA (lpString="*.jpeg") returned 6
	[0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.133] lstrlenA (lpString="*.psd") returned 5
	[0059.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.133] lstrlenA (lpString="*.cdr") returned 5
	[0059.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.133] lstrlenA (lpString="*.dwg") returned 5
	[0059.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.133] lstrlenA (lpString="*.max") returned 5
	[0059.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.133] lstrlenA (lpString="*.bmp") returned 5
	[0059.133] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp"
	[0059.133] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp"
	[0059.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp."
	[0059.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.Boom"
	[0059.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.133] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf8
	[0059.133] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x695e6e70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1
	[0059.133] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.134] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xad5, lpOverlapped=0x0) returned 1
	[0059.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="LoginTool24x24ImagesMask.bmp"
	[0059.135] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.135] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xad5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xad5, lpOverlapped=0x0) returned 1
	[0059.135] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.135] CloseHandle (hObject=0x90) returned 1
	[0059.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.boom")) returned 1
	[0059.137] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.137] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.137] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageAttachmentIconImages.jpg") returned -1
	[0059.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageAttachmentIconImages.jpg") returned -1
	[0059.137] lstrcmpiA (lpString1="", lpString2="MessageAttachmentIconImages.jpg") returned -1
	[0059.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="LoginTool24x24ImagesMask.bmp"
	[0059.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.137] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg"
	[0059.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.zip") returned 0
	[0059.137] lstrlenA (lpString="*.zip") returned 5
	[0059.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.rar") returned 0
	[0059.137] lstrlenA (lpString="*.rar") returned 5
	[0059.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.7z") returned 0
	[0059.137] lstrlenA (lpString="*.7z") returned 4
	[0059.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.tar") returned 0
	[0059.137] lstrlenA (lpString="*.tar") returned 5
	[0059.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.gzip") returned 0
	[0059.137] lstrlenA (lpString="*.gzip") returned 6
	[0059.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.jpg") returned 1
	[0059.137] lstrlenA (lpString="*.jpg") returned 5
	[0059.137] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg"
	[0059.137] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg"
	[0059.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg."
	[0059.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.Boom"
	[0059.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.138] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25e5
	[0059.138] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1
	[0059.138] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.138] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x25c2, lpOverlapped=0x0) returned 1
	[0059.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="MessageAttachmentIconImages.jpg"
	[0059.177] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.177] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x25c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x25c2, lpOverlapped=0x0) returned 1
	[0059.178] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.178] CloseHandle (hObject=0x90) returned 1
	[0059.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.boom")) returned 1
	[0059.179] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1
	[0059.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1
	[0059.179] lstrcmpiA (lpString1="", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1
	[0059.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="MessageAttachmentIconImages.jpg"
	[0059.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageAttachmentIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp"
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.179] lstrlenA (lpString="*.zip") returned 5
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.179] lstrlenA (lpString="*.rar") returned 5
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.179] lstrlenA (lpString="*.7z") returned 4
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.179] lstrlenA (lpString="*.tar") returned 5
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.179] lstrlenA (lpString="*.gzip") returned 6
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.179] lstrlenA (lpString="*.jpg") returned 5
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.179] lstrlenA (lpString="*.jpeg") returned 6
	[0059.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.179] lstrlenA (lpString="*.psd") returned 5
	[0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.180] lstrlenA (lpString="*.cdr") returned 5
	[0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.180] lstrlenA (lpString="*.dwg") returned 5
	[0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.180] lstrlenA (lpString="*.max") returned 5
	[0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.180] lstrlenA (lpString="*.bmp") returned 5
	[0059.180] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp"
	[0059.180] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp"
	[0059.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp."
	[0059.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.Boom"
	[0059.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.181] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838
	[0059.181] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x583906f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1
	[0059.181] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.181] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x815, lpOverlapped=0x0) returned 1
	[0059.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="MessageAttachmentIconImagesMask.bmp"
	[0059.183] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.183] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x815, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x815, lpOverlapped=0x0) returned 1
	[0059.183] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.184] CloseHandle (hObject=0x90) returned 1
	[0059.184] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.boom")) returned 1
	[0059.184] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.185] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.185] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageHistoryIconImages.jpg") returned -1
	[0059.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageHistoryIconImages.jpg") returned -1
	[0059.185] lstrcmpiA (lpString1="", lpString2="MessageHistoryIconImages.jpg") returned -1
	[0059.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="MessageAttachmentIconImagesMask.bmp"
	[0059.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg"
	[0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.zip") returned 0
	[0059.185] lstrlenA (lpString="*.zip") returned 5
	[0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.rar") returned 0
	[0059.185] lstrlenA (lpString="*.rar") returned 5
	[0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.7z") returned 0
	[0059.185] lstrlenA (lpString="*.7z") returned 4
	[0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.tar") returned 0
	[0059.185] lstrlenA (lpString="*.tar") returned 5
	[0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.gzip") returned 0
	[0059.185] lstrlenA (lpString="*.gzip") returned 6
	[0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.jpg") returned 1
	[0059.185] lstrlenA (lpString="*.jpg") returned 5
	[0059.185] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg"
	[0059.185] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg"
	[0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg."
	[0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.Boom"
	[0059.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.187] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22f6
	[0059.187] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x583906f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1
	[0059.187] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.187] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x22d3, lpOverlapped=0x0) returned 1
	[0059.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="MessageHistoryIconImages.jpg"
	[0059.188] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.189] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x22d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x22d3, lpOverlapped=0x0) returned 1
	[0059.189] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.189] CloseHandle (hObject=0x90) returned 1
	[0059.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.boom")) returned 1
	[0059.190] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.190] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.190] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageHistoryIconImagesMask.bmp") returned -1
	[0059.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageHistoryIconImagesMask.bmp") returned -1
	[0059.190] lstrcmpiA (lpString1="", lpString2="MessageHistoryIconImagesMask.bmp") returned -1
	[0059.190] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="MessageHistoryIconImages.jpg"
	[0059.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageHistoryIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp"
	[0059.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.190] lstrlenA (lpString="*.zip") returned 5
	[0059.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.190] lstrlenA (lpString="*.rar") returned 5
	[0059.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.190] lstrlenA (lpString="*.7z") returned 4
	[0059.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.190] lstrlenA (lpString="*.tar") returned 5
	[0059.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.190] lstrlenA (lpString="*.gzip") returned 6
	[0059.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.190] lstrlenA (lpString="*.jpg") returned 5
	[0059.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.191] lstrlenA (lpString="*.jpeg") returned 6
	[0059.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.191] lstrlenA (lpString="*.psd") returned 5
	[0059.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.191] lstrlenA (lpString="*.cdr") returned 5
	[0059.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.191] lstrlenA (lpString="*.dwg") returned 5
	[0059.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.191] lstrlenA (lpString="*.max") returned 5
	[0059.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.191] lstrlenA (lpString="*.bmp") returned 5
	[0059.191] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp"
	[0059.191] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp"
	[0059.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp."
	[0059.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.Boom"
	[0059.191] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.191] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140
	[0059.192] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x583906f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1
	[0059.192] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.192] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x11d, lpOverlapped=0x0) returned 1
	[0059.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="MessageHistoryIconImagesMask.bmp"
	[0059.193] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.193] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x11d, lpOverlapped=0x0) returned 1
	[0059.193] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.193] CloseHandle (hObject=0x90) returned 1
	[0059.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.boom")) returned 1
	[0059.194] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.194] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierBackground.jpg") returned -1
	[0059.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierBackground.jpg") returned -1
	[0059.194] lstrcmpiA (lpString1="", lpString2="NotifierBackground.jpg") returned -1
	[0059.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="MessageHistoryIconImagesMask.bmp"
	[0059.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg"
	[0059.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.zip") returned 0
	[0059.194] lstrlenA (lpString="*.zip") returned 5
	[0059.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.rar") returned 0
	[0059.194] lstrlenA (lpString="*.rar") returned 5
	[0059.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.7z") returned 0
	[0059.194] lstrlenA (lpString="*.7z") returned 4
	[0059.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.tar") returned 0
	[0059.194] lstrlenA (lpString="*.tar") returned 5
	[0059.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.gzip") returned 0
	[0059.194] lstrlenA (lpString="*.gzip") returned 6
	[0059.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.jpg") returned 1
	[0059.194] lstrlenA (lpString="*.jpg") returned 5
	[0059.194] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg"
	[0059.194] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg"
	[0059.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg."
	[0059.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.Boom"
	[0059.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.196] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3efd
	[0059.196] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x46b7a400, dwHighDateTime=0x1c9e8b3), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x46b7a400, dwHighDateTime=0x1c9e8b3)) returned 1
	[0059.196] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.196] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3eda, lpOverlapped=0x0) returned 1
	[0059.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="NotifierBackground.jpg"
	[0059.207] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.207] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3eda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3eda, lpOverlapped=0x0) returned 1
	[0059.207] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.207] CloseHandle (hObject=0x90) returned 1
	[0059.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.boom")) returned 1
	[0059.208] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.208] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.208] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierBackgroundRTL.jpg") returned -1
	[0059.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierBackgroundRTL.jpg") returned -1
	[0059.208] lstrcmpiA (lpString1="", lpString2="NotifierBackgroundRTL.jpg") returned -1
	[0059.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="NotifierBackground.jpg"
	[0059.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg"
	[0059.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.zip") returned 0
	[0059.208] lstrlenA (lpString="*.zip") returned 5
	[0059.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.rar") returned 0
	[0059.208] lstrlenA (lpString="*.rar") returned 5
	[0059.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.7z") returned 0
	[0059.208] lstrlenA (lpString="*.7z") returned 4
	[0059.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.tar") returned 0
	[0059.209] lstrlenA (lpString="*.tar") returned 5
	[0059.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.gzip") returned 0
	[0059.209] lstrlenA (lpString="*.gzip") returned 6
	[0059.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.jpg") returned 1
	[0059.209] lstrlenA (lpString="*.jpg") returned 5
	[0059.209] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg"
	[0059.209] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg"
	[0059.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg."
	[0059.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.Boom"
	[0059.209] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.209] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40aa
	[0059.209] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50410c00, dwHighDateTime=0x1c9e8b3), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50410c00, dwHighDateTime=0x1c9e8b3)) returned 1
	[0059.209] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.209] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4087, lpOverlapped=0x0) returned 1
	[0059.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="NotifierBackgroundRTL.jpg"
	[0059.224] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.224] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4087, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4087, lpOverlapped=0x0) returned 1
	[0059.224] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.224] CloseHandle (hObject=0x90) returned 1
	[0059.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.boom")) returned 1
	[0059.225] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierCloseButton.jpg") returned -1
	[0059.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierCloseButton.jpg") returned -1
	[0059.226] lstrcmpiA (lpString1="", lpString2="NotifierCloseButton.jpg") returned -1
	[0059.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="NotifierBackgroundRTL.jpg"
	[0059.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg"
	[0059.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.zip") returned 0
	[0059.226] lstrlenA (lpString="*.zip") returned 5
	[0059.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.rar") returned 0
	[0059.226] lstrlenA (lpString="*.rar") returned 5
	[0059.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.7z") returned 0
	[0059.226] lstrlenA (lpString="*.7z") returned 4
	[0059.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.tar") returned 0
	[0059.226] lstrlenA (lpString="*.tar") returned 5
	[0059.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.gzip") returned 0
	[0059.226] lstrlenA (lpString="*.gzip") returned 6
	[0059.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.jpg") returned 1
	[0059.226] lstrlenA (lpString="*.jpg") returned 5
	[0059.226] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg"
	[0059.226] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg"
	[0059.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg."
	[0059.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.Boom"
	[0059.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.227] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f2
	[0059.227] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x79304700, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a513ab0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x79304700, dwHighDateTime=0x1c91151)) returned 1
	[0059.227] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.227] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2cf, lpOverlapped=0x0) returned 1
	[0059.243] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="NotifierCloseButton.jpg"
	[0059.243] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.243] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2cf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2cf, lpOverlapped=0x0) returned 1
	[0059.243] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.243] CloseHandle (hObject=0x90) returned 1
	[0059.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.boom")) returned 1
	[0059.244] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierDisableDownArrow.jpg") returned -1
	[0059.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDisableDownArrow.jpg") returned -1
	[0059.244] lstrcmpiA (lpString1="", lpString2="NotifierDisableDownArrow.jpg") returned -1
	[0059.244] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="NotifierCloseButton.jpg"
	[0059.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.244] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg"
	[0059.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.zip") returned 0
	[0059.244] lstrlenA (lpString="*.zip") returned 5
	[0059.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.rar") returned 0
	[0059.244] lstrlenA (lpString="*.rar") returned 5
	[0059.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.7z") returned 0
	[0059.244] lstrlenA (lpString="*.7z") returned 4
	[0059.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.tar") returned 0
	[0059.244] lstrlenA (lpString="*.tar") returned 5
	[0059.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.gzip") returned 0
	[0059.244] lstrlenA (lpString="*.gzip") returned 6
	[0059.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.jpg") returned 1
	[0059.244] lstrlenA (lpString="*.jpg") returned 5
	[0059.245] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg"
	[0059.245] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg"
	[0059.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg."
	[0059.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.Boom"
	[0059.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.245] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cc
	[0059.245] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7f262800, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a539c10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7f262800, dwHighDateTime=0x1c91151)) returned 1
	[0059.245] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.245] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2a9, lpOverlapped=0x0) returned 1
	[0059.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="NotifierDisableDownArrow.jpg"
	[0059.320] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.320] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2a9, lpOverlapped=0x0) returned 1
	[0059.321] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.321] CloseHandle (hObject=0x90) returned 1
	[0059.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.boom")) returned 1
	[0059.321] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.321] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierDisableUpArrow.jpg") returned -1
	[0059.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDisableUpArrow.jpg") returned -1
	[0059.322] lstrcmpiA (lpString1="", lpString2="NotifierDisableUpArrow.jpg") returned -1
	[0059.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="NotifierDisableDownArrow.jpg"
	[0059.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg"
	[0059.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.zip") returned 0
	[0059.322] lstrlenA (lpString="*.zip") returned 5
	[0059.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.rar") returned 0
	[0059.322] lstrlenA (lpString="*.rar") returned 5
	[0059.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.7z") returned 0
	[0059.322] lstrlenA (lpString="*.7z") returned 4
	[0059.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.tar") returned 0
	[0059.322] lstrlenA (lpString="*.tar") returned 5
	[0059.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.gzip") returned 0
	[0059.322] lstrlenA (lpString="*.gzip") returned 6
	[0059.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.jpg") returned 1
	[0059.322] lstrlenA (lpString="*.jpg") returned 5
	[0059.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg"
	[0059.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg"
	[0059.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg."
	[0059.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.Boom"
	[0059.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.323] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x307
	[0059.323] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82b9af00, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82b9af00, dwHighDateTime=0x1c91151)) returned 1
	[0059.323] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.323] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2e4, lpOverlapped=0x0) returned 1
	[0059.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="NotifierDisableUpArrow.jpg"
	[0059.383] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.383] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2e4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2e4, lpOverlapped=0x0) returned 1
	[0059.383] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.384] CloseHandle (hObject=0x90) returned 1
	[0059.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.boom")) returned 1
	[0059.384] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.384] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.384] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierDownArrow.jpg") returned -1
	[0059.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDownArrow.jpg") returned -1
	[0059.384] lstrcmpiA (lpString1="", lpString2="NotifierDownArrow.jpg") returned -1
	[0059.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="NotifierDisableUpArrow.jpg"
	[0059.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.385] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.385] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg"
	[0059.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.zip") returned 0
	[0059.385] lstrlenA (lpString="*.zip") returned 5
	[0059.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.rar") returned 0
	[0059.385] lstrlenA (lpString="*.rar") returned 5
	[0059.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.7z") returned 0
	[0059.385] lstrlenA (lpString="*.7z") returned 4
	[0059.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.tar") returned 0
	[0059.385] lstrlenA (lpString="*.tar") returned 5
	[0059.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.gzip") returned 0
	[0059.385] lstrlenA (lpString="*.gzip") returned 6
	[0059.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.jpg") returned 1
	[0059.385] lstrlenA (lpString="*.jpg") returned 5
	[0059.385] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg"
	[0059.385] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg"
	[0059.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg."
	[0059.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.Boom"
	[0059.385] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.386] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x368
	[0059.386] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x864d3600, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x864d3600, dwHighDateTime=0x1c91151)) returned 1
	[0059.386] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.386] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x345, lpOverlapped=0x0) returned 1
	[0059.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="NotifierDownArrow.jpg"
	[0059.420] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.420] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x345, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x345, lpOverlapped=0x0) returned 1
	[0059.422] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.422] CloseHandle (hObject=0x90) returned 1
	[0059.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.boom")) returned 1
	[0059.423] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.423] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.423] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierUpArrow.jpg") returned -1
	[0059.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierUpArrow.jpg") returned -1
	[0059.423] lstrcmpiA (lpString1="", lpString2="NotifierUpArrow.jpg") returned -1
	[0059.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="NotifierDownArrow.jpg"
	[0059.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.423] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.423] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.423] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.423] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg"
	[0059.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.zip") returned 0
	[0059.423] lstrlenA (lpString="*.zip") returned 5
	[0059.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.rar") returned 0
	[0059.423] lstrlenA (lpString="*.rar") returned 5
	[0059.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.7z") returned 0
	[0059.423] lstrlenA (lpString="*.7z") returned 4
	[0059.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.tar") returned 0
	[0059.423] lstrlenA (lpString="*.tar") returned 5
	[0059.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.gzip") returned 0
	[0059.423] lstrlenA (lpString="*.gzip") returned 6
	[0059.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.jpg") returned 1
	[0059.423] lstrlenA (lpString="*.jpg") returned 5
	[0059.423] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg"
	[0059.423] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg"
	[0059.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg."
	[0059.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.Boom"
	[0059.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.424] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c0
	[0059.424] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89e0bd00, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89e0bd00, dwHighDateTime=0x1c91151)) returned 1
	[0059.424] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.424] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x39d, lpOverlapped=0x0) returned 1
	[0059.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="NotifierUpArrow.jpg"
	[0059.441] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.441] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x39d, lpOverlapped=0x0) returned 1
	[0059.441] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.441] CloseHandle (hObject=0x90) returned 1
	[0059.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.boom")) returned 1
	[0059.442] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.442] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.442] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierWindowMask.bmp") returned -1
	[0059.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierWindowMask.bmp") returned -1
	[0059.442] lstrcmpiA (lpString1="", lpString2="NotifierWindowMask.bmp") returned -1
	[0059.442] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="NotifierUpArrow.jpg"
	[0059.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.442] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.442] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierWindowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp"
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.zip") returned 0
	[0059.442] lstrlenA (lpString="*.zip") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.rar") returned 0
	[0059.442] lstrlenA (lpString="*.rar") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.7z") returned 0
	[0059.442] lstrlenA (lpString="*.7z") returned 4
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.tar") returned 0
	[0059.442] lstrlenA (lpString="*.tar") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.gzip") returned 0
	[0059.442] lstrlenA (lpString="*.gzip") returned 6
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.jpg") returned 0
	[0059.442] lstrlenA (lpString="*.jpg") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.442] lstrlenA (lpString="*.jpeg") returned 6
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.psd") returned 0
	[0059.442] lstrlenA (lpString="*.psd") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.cdr") returned 0
	[0059.442] lstrlenA (lpString="*.cdr") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.dwg") returned 0
	[0059.442] lstrlenA (lpString="*.dwg") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.max") returned 0
	[0059.442] lstrlenA (lpString="*.max") returned 5
	[0059.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.bmp") returned 1
	[0059.443] lstrlenA (lpString="*.bmp") returned 5
	[0059.443] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp"
	[0059.443] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp"
	[0059.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp."
	[0059.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.Boom"
	[0059.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.444] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x133a
	[0059.444] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8472000, dwHighDateTime=0x1c90f02), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8472000, dwHighDateTime=0x1c90f02)) returned 1
	[0059.444] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.445] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1317, lpOverlapped=0x0) returned 1
	[0059.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="NotifierWindowMask.bmp"
	[0059.463] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.463] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1317, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1317, lpOverlapped=0x0) returned 1
	[0059.463] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.463] CloseHandle (hObject=0x90) returned 1
	[0059.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.boom")) returned 1
	[0059.464] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.464] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.464] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierWindowMaskRTL.bmp") returned -1
	[0059.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierWindowMaskRTL.bmp") returned -1
	[0059.464] lstrcmpiA (lpString1="", lpString2="NotifierWindowMaskRTL.bmp") returned -1
	[0059.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="NotifierWindowMask.bmp"
	[0059.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.464] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.465] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierWindowMaskRTL.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp"
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.zip") returned 0
	[0059.465] lstrlenA (lpString="*.zip") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.rar") returned 0
	[0059.465] lstrlenA (lpString="*.rar") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.7z") returned 0
	[0059.465] lstrlenA (lpString="*.7z") returned 4
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.tar") returned 0
	[0059.465] lstrlenA (lpString="*.tar") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.gzip") returned 0
	[0059.465] lstrlenA (lpString="*.gzip") returned 6
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.jpg") returned 0
	[0059.465] lstrlenA (lpString="*.jpg") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.jpeg") returned 0
	[0059.465] lstrlenA (lpString="*.jpeg") returned 6
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.psd") returned 0
	[0059.465] lstrlenA (lpString="*.psd") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.cdr") returned 0
	[0059.465] lstrlenA (lpString="*.cdr") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.dwg") returned 0
	[0059.465] lstrlenA (lpString="*.dwg") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.max") returned 0
	[0059.465] lstrlenA (lpString="*.max") returned 5
	[0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.bmp") returned 1
	[0059.465] lstrlenA (lpString="*.bmp") returned 5
	[0059.465] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp"
	[0059.465] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp"
	[0059.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp."
	[0059.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.Boom"
	[0059.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.466] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x133a
	[0059.466] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3a588200, dwHighDateTime=0x1c90f02), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3a588200, dwHighDateTime=0x1c90f02)) returned 1
	[0059.466] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.466] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1317, lpOverlapped=0x0) returned 1
	[0059.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="NotifierWindowMaskRTL.bmp"
	[0059.476] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.476] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1317, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1317, lpOverlapped=0x0) returned 1
	[0059.476] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.476] CloseHandle (hObject=0x90) returned 1
	[0059.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.boom")) returned 1
	[0059.482] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.482] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlineToolIconImages.jpg") returned -1
	[0059.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlineToolIconImages.jpg") returned -1
	[0059.482] lstrcmpiA (lpString1="", lpString2="OutlineToolIconImages.jpg") returned -1
	[0059.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="NotifierWindowMaskRTL.bmp"
	[0059.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg"
	[0059.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0059.483] lstrlenA (lpString="*.zip") returned 5
	[0059.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0059.483] lstrlenA (lpString="*.rar") returned 5
	[0059.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0059.483] lstrlenA (lpString="*.7z") returned 4
	[0059.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0059.483] lstrlenA (lpString="*.tar") returned 5
	[0059.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0059.483] lstrlenA (lpString="*.gzip") returned 6
	[0059.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0059.483] lstrlenA (lpString="*.jpg") returned 5
	[0059.483] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg"
	[0059.483] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg"
	[0059.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg."
	[0059.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.Boom"
	[0059.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.483] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e35
	[0059.483] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7689a500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x59995270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7689a500, dwHighDateTime=0x1c747ea)) returned 1
	[0059.483] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.483] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1e12, lpOverlapped=0x0) returned 1
	[0059.508] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="OutlineToolIconImages.jpg"
	[0059.508] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.508] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1e12, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1e12, lpOverlapped=0x0) returned 1
	[0059.508] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.508] CloseHandle (hObject=0x90) returned 1
	[0059.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.boom")) returned 1
	[0059.509] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.509] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.509] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlineToolIconImagesMask.bmp") returned -1
	[0059.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlineToolIconImagesMask.bmp") returned -1
	[0059.509] lstrcmpiA (lpString1="", lpString2="OutlineToolIconImagesMask.bmp") returned -1
	[0059.509] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="OutlineToolIconImages.jpg"
	[0059.509] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.509] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.509] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutlineToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp"
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.509] lstrlenA (lpString="*.zip") returned 5
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.509] lstrlenA (lpString="*.rar") returned 5
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.509] lstrlenA (lpString="*.7z") returned 4
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.509] lstrlenA (lpString="*.tar") returned 5
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.509] lstrlenA (lpString="*.gzip") returned 6
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.509] lstrlenA (lpString="*.jpg") returned 5
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.509] lstrlenA (lpString="*.jpeg") returned 6
	[0059.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.510] lstrlenA (lpString="*.psd") returned 5
	[0059.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.510] lstrlenA (lpString="*.cdr") returned 5
	[0059.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.510] lstrlenA (lpString="*.dwg") returned 5
	[0059.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.510] lstrlenA (lpString="*.max") returned 5
	[0059.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.510] lstrlenA (lpString="*.bmp") returned 5
	[0059.510] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp"
	[0059.510] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp"
	[0059.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp."
	[0059.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.Boom"
	[0059.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.510] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1938
	[0059.510] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6c393490, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1
	[0059.510] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.510] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1915, lpOverlapped=0x0) returned 1
	[0059.531] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="OutlineToolIconImagesMask.bmp"
	[0059.531] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.531] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1915, lpOverlapped=0x0) returned 1
	[0059.531] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.532] CloseHandle (hObject=0x90) returned 1
	[0059.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.boom")) returned 1
	[0059.532] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.532] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutofSyncIconImages.jpg") returned -1
	[0059.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutofSyncIconImages.jpg") returned -1
	[0059.532] lstrcmpiA (lpString1="", lpString2="OutofSyncIconImages.jpg") returned -1
	[0059.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="OutlineToolIconImagesMask.bmp"
	[0059.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.532] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.533] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg"
	[0059.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.zip") returned 0
	[0059.533] lstrlenA (lpString="*.zip") returned 5
	[0059.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.rar") returned 0
	[0059.533] lstrlenA (lpString="*.rar") returned 5
	[0059.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.7z") returned 0
	[0059.533] lstrlenA (lpString="*.7z") returned 4
	[0059.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.tar") returned 0
	[0059.533] lstrlenA (lpString="*.tar") returned 5
	[0059.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.gzip") returned 0
	[0059.533] lstrlenA (lpString="*.gzip") returned 6
	[0059.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.jpg") returned 1
	[0059.533] lstrlenA (lpString="*.jpg") returned 5
	[0059.533] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg"
	[0059.533] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg"
	[0059.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg."
	[0059.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.Boom"
	[0059.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.534] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8d
	[0059.534] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cd3edf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1
	[0059.534] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.534] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf6a, lpOverlapped=0x0) returned 1
	[0059.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="OutofSyncIconImages.jpg"
	[0059.535] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.535] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf6a, lpOverlapped=0x0) returned 1
	[0059.536] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.536] CloseHandle (hObject=0x90) returned 1
	[0059.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.boom")) returned 1
	[0059.536] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.536] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.536] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutofSyncIconImagesMask.bmp") returned -1
	[0059.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutofSyncIconImagesMask.bmp") returned -1
	[0059.537] lstrcmpiA (lpString1="", lpString2="OutofSyncIconImagesMask.bmp") returned -1
	[0059.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="OutofSyncIconImages.jpg"
	[0059.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.539] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.539] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutofSyncIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp"
	[0059.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.539] lstrlenA (lpString="*.zip") returned 5
	[0059.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.539] lstrlenA (lpString="*.rar") returned 5
	[0059.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.540] lstrlenA (lpString="*.7z") returned 4
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.540] lstrlenA (lpString="*.tar") returned 5
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.540] lstrlenA (lpString="*.gzip") returned 6
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.540] lstrlenA (lpString="*.jpg") returned 5
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.540] lstrlenA (lpString="*.jpeg") returned 6
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.540] lstrlenA (lpString="*.psd") returned 5
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.540] lstrlenA (lpString="*.cdr") returned 5
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.540] lstrlenA (lpString="*.dwg") returned 5
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.540] lstrlenA (lpString="*.max") returned 5
	[0059.540] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.540] lstrlenA (lpString="*.bmp") returned 5
	[0059.540] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp"
	[0059.540] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp"
	[0059.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp."
	[0059.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.Boom"
	[0059.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.541] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0
	[0059.541] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x59c42b30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1
	[0059.541] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.541] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9d, lpOverlapped=0x0) returned 1
	[0059.541] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="OutofSyncIconImagesMask.bmp"
	[0059.542] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.542] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9d, lpOverlapped=0x0) returned 1
	[0059.542] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.542] CloseHandle (hObject=0x90) returned 1
	[0059.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.boom")) returned 1
	[0059.542] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.542] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.542] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PicturesToolIconImages.jpg") returned -1
	[0059.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PicturesToolIconImages.jpg") returned -1
	[0059.543] lstrcmpiA (lpString1="", lpString2="PicturesToolIconImages.jpg") returned -1
	[0059.543] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="OutofSyncIconImagesMask.bmp"
	[0059.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.543] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.543] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg"
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0059.543] lstrlenA (lpString="*.zip") returned 5
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0059.543] lstrlenA (lpString="*.rar") returned 5
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0059.543] lstrlenA (lpString="*.7z") returned 4
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0059.543] lstrlenA (lpString="*.tar") returned 5
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0059.543] lstrlenA (lpString="*.gzip") returned 6
	[0059.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0059.543] lstrlenA (lpString="*.jpg") returned 5
	[0059.543] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg"
	[0059.543] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg"
	[0059.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg."
	[0059.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.Boom"
	[0059.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.544] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5203
	[0059.544] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a3c500, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cee1d10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a3c500, dwHighDateTime=0x1ca032f)) returned 1
	[0059.544] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.544] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x51e0, lpOverlapped=0x0) returned 1
	[0059.550] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="PicturesToolIconImages.jpg"
	[0059.550] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.550] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x51e0, lpOverlapped=0x0) returned 1
	[0059.550] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.550] CloseHandle (hObject=0x90) returned 1
	[0059.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.boom")) returned 1
	[0059.551] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.551] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PicturesToolIconImagesMask.bmp") returned -1
	[0059.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PicturesToolIconImagesMask.bmp") returned -1
	[0059.551] lstrcmpiA (lpString1="", lpString2="PicturesToolIconImagesMask.bmp") returned -1
	[0059.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="PicturesToolIconImages.jpg"
	[0059.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.552] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="PicturesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp"
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.552] lstrlenA (lpString="*.zip") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.552] lstrlenA (lpString="*.rar") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.552] lstrlenA (lpString="*.7z") returned 4
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.552] lstrlenA (lpString="*.tar") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.552] lstrlenA (lpString="*.gzip") returned 6
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.552] lstrlenA (lpString="*.jpg") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.552] lstrlenA (lpString="*.jpeg") returned 6
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.552] lstrlenA (lpString="*.psd") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.552] lstrlenA (lpString="*.cdr") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.552] lstrlenA (lpString="*.dwg") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.552] lstrlenA (lpString="*.max") returned 5
	[0059.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.552] lstrlenA (lpString="*.bmp") returned 5
	[0059.552] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp"
	[0059.552] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp"
	[0059.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp."
	[0059.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.Boom"
	[0059.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.553] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1238
	[0059.553] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfe1a5d00, dwHighDateTime=0x1ca032e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a44b570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfe1a5d00, dwHighDateTime=0x1ca032e)) returned 1
	[0059.553] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.553] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1215, lpOverlapped=0x0) returned 1
	[0059.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="PicturesToolIconImagesMask.bmp"
	[0059.560] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.560] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1215, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1215, lpOverlapped=0x0) returned 1
	[0059.561] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.561] CloseHandle (hObject=0x90) returned 1
	[0059.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.boom")) returned 1
	[0059.562] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.562] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.562] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="QuestionIcon.jpg") returned -1
	[0059.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuestionIcon.jpg") returned -1
	[0059.562] lstrcmpiA (lpString1="", lpString2="QuestionIcon.jpg") returned -1
	[0059.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="PicturesToolIconImagesMask.bmp"
	[0059.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg"
	[0059.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.zip") returned 0
	[0059.562] lstrlenA (lpString="*.zip") returned 5
	[0059.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.rar") returned 0
	[0059.562] lstrlenA (lpString="*.rar") returned 5
	[0059.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.7z") returned 0
	[0059.562] lstrlenA (lpString="*.7z") returned 4
	[0059.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.tar") returned 0
	[0059.562] lstrlenA (lpString="*.tar") returned 5
	[0059.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.gzip") returned 0
	[0059.562] lstrlenA (lpString="*.gzip") returned 6
	[0059.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.jpg") returned 1
	[0059.562] lstrlenA (lpString="*.jpg") returned 5
	[0059.562] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg"
	[0059.562] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg"
	[0059.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg."
	[0059.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.Boom"
	[0059.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.563] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1b
	[0059.563] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d0d0ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1
	[0059.563] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.563] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbf8, lpOverlapped=0x0) returned 1
	[0059.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="QuestionIcon.jpg"
	[0059.577] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.577] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbf8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbf8, lpOverlapped=0x0) returned 1
	[0059.577] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.577] CloseHandle (hObject=0x90) returned 1
	[0059.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.boom")) returned 1
	[0059.578] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.578] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.578] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="QuestionIconMask.bmp") returned -1
	[0059.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuestionIconMask.bmp") returned -1
	[0059.578] lstrcmpiA (lpString1="", lpString2="QuestionIconMask.bmp") returned -1
	[0059.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="QuestionIcon.jpg"
	[0059.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="QuestionIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp"
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.zip") returned 0
	[0059.579] lstrlenA (lpString="*.zip") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.rar") returned 0
	[0059.579] lstrlenA (lpString="*.rar") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.7z") returned 0
	[0059.579] lstrlenA (lpString="*.7z") returned 4
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.tar") returned 0
	[0059.579] lstrlenA (lpString="*.tar") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.gzip") returned 0
	[0059.579] lstrlenA (lpString="*.gzip") returned 6
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.jpg") returned 0
	[0059.579] lstrlenA (lpString="*.jpg") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.579] lstrlenA (lpString="*.jpeg") returned 6
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.psd") returned 0
	[0059.579] lstrlenA (lpString="*.psd") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.cdr") returned 0
	[0059.579] lstrlenA (lpString="*.cdr") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.dwg") returned 0
	[0059.579] lstrlenA (lpString="*.dwg") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.max") returned 0
	[0059.579] lstrlenA (lpString="*.max") returned 5
	[0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.bmp") returned 1
	[0059.579] lstrlenA (lpString="*.bmp") returned 5
	[0059.579] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp"
	[0059.579] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp"
	[0059.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp."
	[0059.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.Boom"
	[0059.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.580] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838
	[0059.580] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a829930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1
	[0059.580] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.580] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x815, lpOverlapped=0x0) returned 1
	[0059.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="QuestionIconMask.bmp"
	[0059.635] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.635] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x815, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x815, lpOverlapped=0x0) returned 1
	[0059.635] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.635] CloseHandle (hObject=0x90) returned 1
	[0059.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.boom")) returned 1
	[0059.636] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.636] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.636] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared16x16Images.jpg") returned -1
	[0059.636] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared16x16Images.jpg") returned -1
	[0059.637] lstrcmpiA (lpString1="", lpString2="Shared16x16Images.jpg") returned -1
	[0059.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="QuestionIconMask.bmp"
	[0059.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.637] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg"
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.zip") returned 0
	[0059.637] lstrlenA (lpString="*.zip") returned 5
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.rar") returned 0
	[0059.637] lstrlenA (lpString="*.rar") returned 5
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.7z") returned 0
	[0059.637] lstrlenA (lpString="*.7z") returned 4
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.tar") returned 0
	[0059.637] lstrlenA (lpString="*.tar") returned 5
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.gzip") returned 0
	[0059.637] lstrlenA (lpString="*.gzip") returned 6
	[0059.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.jpg") returned 1
	[0059.637] lstrlenA (lpString="*.jpg") returned 5
	[0059.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg"
	[0059.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg"
	[0059.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg."
	[0059.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.Boom"
	[0059.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.638] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64fa
	[0059.639] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1
	[0059.639] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.639] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x64d7, lpOverlapped=0x0) returned 1
	[0059.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="Shared16x16Images.jpg"
	[0059.839] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.839] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x64d7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x64d7, lpOverlapped=0x0) returned 1
	[0059.839] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.839] CloseHandle (hObject=0x90) returned 1
	[0059.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.boom")) returned 1
	[0059.840] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared16x16ImagesMask.bmp") returned -1
	[0059.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared16x16ImagesMask.bmp") returned -1
	[0059.840] lstrcmpiA (lpString1="", lpString2="Shared16x16ImagesMask.bmp") returned -1
	[0059.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="Shared16x16Images.jpg"
	[0059.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.840] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.840] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared16x16ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp"
	[0059.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.840] lstrlenA (lpString="*.zip") returned 5
	[0059.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.840] lstrlenA (lpString="*.rar") returned 5
	[0059.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.840] lstrlenA (lpString="*.7z") returned 4
	[0059.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.840] lstrlenA (lpString="*.tar") returned 5
	[0059.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.841] lstrlenA (lpString="*.gzip") returned 6
	[0059.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.841] lstrlenA (lpString="*.jpg") returned 5
	[0059.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.841] lstrlenA (lpString="*.jpeg") returned 6
	[0059.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.841] lstrlenA (lpString="*.psd") returned 5
	[0059.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.841] lstrlenA (lpString="*.cdr") returned 5
	[0059.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.841] lstrlenA (lpString="*.dwg") returned 5
	[0059.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.841] lstrlenA (lpString="*.max") returned 5
	[0059.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.841] lstrlenA (lpString="*.bmp") returned 5
	[0059.841] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp"
	[0059.841] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp"
	[0059.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp."
	[0059.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.Boom"
	[0059.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.842] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf38
	[0059.842] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.842] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.842] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf15, lpOverlapped=0x0) returned 1
	[0059.861] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="Shared16x16ImagesMask.bmp"
	[0059.861] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.861] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf15, lpOverlapped=0x0) returned 1
	[0059.861] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.861] CloseHandle (hObject=0x90) returned 1
	[0059.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.boom")) returned 1
	[0059.862] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.862] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.862] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared24x24Images.jpg") returned -1
	[0059.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared24x24Images.jpg") returned -1
	[0059.862] lstrcmpiA (lpString1="", lpString2="Shared24x24Images.jpg") returned -1
	[0059.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="Shared16x16ImagesMask.bmp"
	[0059.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.862] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg"
	[0059.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.zip") returned 0
	[0059.863] lstrlenA (lpString="*.zip") returned 5
	[0059.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.rar") returned 0
	[0059.863] lstrlenA (lpString="*.rar") returned 5
	[0059.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.7z") returned 0
	[0059.863] lstrlenA (lpString="*.7z") returned 4
	[0059.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.tar") returned 0
	[0059.863] lstrlenA (lpString="*.tar") returned 5
	[0059.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.gzip") returned 0
	[0059.863] lstrlenA (lpString="*.gzip") returned 6
	[0059.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.jpg") returned 1
	[0059.863] lstrlenA (lpString="*.jpg") returned 5
	[0059.863] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg"
	[0059.863] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg"
	[0059.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg."
	[0059.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.Boom"
	[0059.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.863] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1963
	[0059.863] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.864] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.864] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1940, lpOverlapped=0x0) returned 1
	[0059.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="Shared24x24Images.jpg"
	[0059.865] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.865] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1940, lpOverlapped=0x0) returned 1
	[0059.865] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.865] CloseHandle (hObject=0x90) returned 1
	[0059.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.boom")) returned 1
	[0059.866] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.866] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.866] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared24x24ImagesMask.bmp") returned -1
	[0059.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared24x24ImagesMask.bmp") returned -1
	[0059.866] lstrcmpiA (lpString1="", lpString2="Shared24x24ImagesMask.bmp") returned -1
	[0059.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="Shared24x24Images.jpg"
	[0059.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.866] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.866] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp"
	[0059.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.zip") returned 0
	[0059.866] lstrlenA (lpString="*.zip") returned 5
	[0059.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.rar") returned 0
	[0059.866] lstrlenA (lpString="*.rar") returned 5
	[0059.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.7z") returned 0
	[0059.866] lstrlenA (lpString="*.7z") returned 4
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.tar") returned 0
	[0059.867] lstrlenA (lpString="*.tar") returned 5
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0059.867] lstrlenA (lpString="*.gzip") returned 6
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0059.867] lstrlenA (lpString="*.jpg") returned 5
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0059.867] lstrlenA (lpString="*.jpeg") returned 6
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.psd") returned 0
	[0059.867] lstrlenA (lpString="*.psd") returned 5
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0059.867] lstrlenA (lpString="*.cdr") returned 5
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0059.867] lstrlenA (lpString="*.dwg") returned 5
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.max") returned 0
	[0059.867] lstrlenA (lpString="*.max") returned 5
	[0059.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0059.867] lstrlenA (lpString="*.bmp") returned 5
	[0059.867] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp"
	[0059.867] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp"
	[0059.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp."
	[0059.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.Boom"
	[0059.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.867] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1638
	[0059.868] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.868] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.868] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1615, lpOverlapped=0x0) returned 1
	[0059.894] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="Shared24x24ImagesMask.bmp"
	[0059.894] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.894] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1615, lpOverlapped=0x0) returned 1
	[0059.895] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.895] CloseHandle (hObject=0x90) returned 1
	[0059.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.boom")) returned 1
	[0059.896] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.896] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SketchIconImages.bmp") returned -1
	[0059.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SketchIconImages.bmp") returned -1
	[0059.896] lstrcmpiA (lpString1="", lpString2="SketchIconImages.bmp") returned -1
	[0059.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="Shared24x24ImagesMask.bmp"
	[0059.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.896] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="SketchIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp"
	[0059.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.zip") returned 0
	[0059.896] lstrlenA (lpString="*.zip") returned 5
	[0059.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.rar") returned 0
	[0059.896] lstrlenA (lpString="*.rar") returned 5
	[0059.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.7z") returned 0
	[0059.896] lstrlenA (lpString="*.7z") returned 4
	[0059.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.tar") returned 0
	[0059.896] lstrlenA (lpString="*.tar") returned 5
	[0059.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.gzip") returned 0
	[0059.896] lstrlenA (lpString="*.gzip") returned 6
	[0059.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.jpg") returned 0
	[0059.896] lstrlenA (lpString="*.jpg") returned 5
	[0059.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.jpeg") returned 0
	[0059.897] lstrlenA (lpString="*.jpeg") returned 6
	[0059.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.psd") returned 0
	[0059.897] lstrlenA (lpString="*.psd") returned 5
	[0059.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.cdr") returned 0
	[0059.897] lstrlenA (lpString="*.cdr") returned 5
	[0059.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.dwg") returned 0
	[0059.897] lstrlenA (lpString="*.dwg") returned 5
	[0059.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.max") returned 0
	[0059.897] lstrlenA (lpString="*.max") returned 5
	[0059.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.bmp") returned 1
	[0059.897] lstrlenA (lpString="*.bmp") returned 5
	[0059.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp"
	[0059.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp"
	[0059.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp."
	[0059.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.Boom"
	[0059.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.897] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d38
	[0059.897] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2c00d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.898] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.898] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2d15, lpOverlapped=0x0) returned 1
	[0059.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="SketchIconImages.bmp"
	[0059.958] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.958] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2d15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2d15, lpOverlapped=0x0) returned 1
	[0059.959] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0059.959] CloseHandle (hObject=0x90) returned 1
	[0059.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.boom")) returned 1
	[0059.959] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0059.960] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0059.960] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="spacebackupicons.jpg") returned -1
	[0059.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="spacebackupicons.jpg") returned -1
	[0059.960] lstrcmpiA (lpString1="", lpString2="spacebackupicons.jpg") returned -1
	[0059.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="SketchIconImages.bmp"
	[0059.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0059.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0059.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0059.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0059.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg"
	[0059.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.zip") returned 0
	[0059.960] lstrlenA (lpString="*.zip") returned 5
	[0059.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.rar") returned 0
	[0059.960] lstrlenA (lpString="*.rar") returned 5
	[0059.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.7z") returned 0
	[0059.960] lstrlenA (lpString="*.7z") returned 4
	[0059.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.tar") returned 0
	[0059.960] lstrlenA (lpString="*.tar") returned 5
	[0059.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.gzip") returned 0
	[0059.960] lstrlenA (lpString="*.gzip") returned 6
	[0059.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.jpg") returned 1
	[0059.960] lstrlenA (lpString="*.jpg") returned 5
	[0059.960] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg"
	[0059.960] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg"
	[0059.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg."
	[0059.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.Boom"
	[0059.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0059.961] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd97
	[0059.961] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0059.961] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.961] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd74, lpOverlapped=0x0) returned 1
	[0059.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="spacebackupicons.jpg"
	[0059.999] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0059.999] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd74, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd74, lpOverlapped=0x0) returned 1
	[0059.999] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.000] CloseHandle (hObject=0x90) returned 1
	[0060.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.boom")) returned 1
	[0060.000] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.000] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.000] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="spacebackupiconsmask.bmp") returned -1
	[0060.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="spacebackupiconsmask.bmp") returned -1
	[0060.001] lstrcmpiA (lpString1="", lpString2="spacebackupiconsmask.bmp") returned -1
	[0060.001] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="spacebackupicons.jpg"
	[0060.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.001] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.001] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.001] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.001] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="spacebackupiconsmask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp"
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.zip") returned 0
	[0060.001] lstrlenA (lpString="*.zip") returned 5
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.rar") returned 0
	[0060.001] lstrlenA (lpString="*.rar") returned 5
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.7z") returned 0
	[0060.001] lstrlenA (lpString="*.7z") returned 4
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.tar") returned 0
	[0060.001] lstrlenA (lpString="*.tar") returned 5
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.gzip") returned 0
	[0060.001] lstrlenA (lpString="*.gzip") returned 6
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.jpg") returned 0
	[0060.001] lstrlenA (lpString="*.jpg") returned 5
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.jpeg") returned 0
	[0060.001] lstrlenA (lpString="*.jpeg") returned 6
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.psd") returned 0
	[0060.001] lstrlenA (lpString="*.psd") returned 5
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.cdr") returned 0
	[0060.001] lstrlenA (lpString="*.cdr") returned 5
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.dwg") returned 0
	[0060.001] lstrlenA (lpString="*.dwg") returned 5
	[0060.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.max") returned 0
	[0060.001] lstrlenA (lpString="*.max") returned 5
	[0060.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.bmp") returned 1
	[0060.002] lstrlenA (lpString="*.bmp") returned 5
	[0060.002] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp"
	[0060.002] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp"
	[0060.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp."
	[0060.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.Boom"
	[0060.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.003] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a4
	[0060.003] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0060.003] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.003] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x581, lpOverlapped=0x0) returned 1
	[0060.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="spacebackupiconsmask.bmp"
	[0060.023] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.023] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x581, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x581, lpOverlapped=0x0) returned 1
	[0060.023] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.023] CloseHandle (hObject=0x90) returned 1
	[0060.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.boom")) returned 1
	[0060.024] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.024] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STOPICON.JPG") returned -1
	[0060.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STOPICON.JPG") returned -1
	[0060.024] lstrcmpiA (lpString1="", lpString2="STOPICON.JPG") returned -1
	[0060.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="spacebackupiconsmask.bmp"
	[0060.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG"
	[0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.zip") returned 0
	[0060.025] lstrlenA (lpString="*.zip") returned 5
	[0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.rar") returned 0
	[0060.025] lstrlenA (lpString="*.rar") returned 5
	[0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.7z") returned 0
	[0060.025] lstrlenA (lpString="*.7z") returned 4
	[0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.tar") returned 0
	[0060.025] lstrlenA (lpString="*.tar") returned 5
	[0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.gzip") returned 0
	[0060.025] lstrlenA (lpString="*.gzip") returned 6
	[0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.jpg") returned 1
	[0060.025] lstrlenA (lpString="*.jpg") returned 5
	[0060.025] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG"
	[0060.025] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG"
	[0060.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG."
	[0060.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.Boom"
	[0060.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.027] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd14
	[0060.027] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3f0bd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0060.027] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.027] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xcf1, lpOverlapped=0x0) returned 1
	[0060.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="STOPICON.JPG"
	[0060.058] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.058] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xcf1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xcf1, lpOverlapped=0x0) returned 1
	[0060.058] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.058] CloseHandle (hObject=0x90) returned 1
	[0060.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.boom")) returned 1
	[0060.059] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StopIconMask.bmp") returned -1
	[0060.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StopIconMask.bmp") returned -1
	[0060.059] lstrcmpiA (lpString1="", lpString2="StopIconMask.bmp") returned -1
	[0060.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="STOPICON.JPG"
	[0060.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="StopIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp"
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.zip") returned 0
	[0060.060] lstrlenA (lpString="*.zip") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.rar") returned 0
	[0060.060] lstrlenA (lpString="*.rar") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.7z") returned 0
	[0060.060] lstrlenA (lpString="*.7z") returned 4
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.tar") returned 0
	[0060.060] lstrlenA (lpString="*.tar") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.gzip") returned 0
	[0060.060] lstrlenA (lpString="*.gzip") returned 6
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.jpg") returned 0
	[0060.060] lstrlenA (lpString="*.jpg") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.060] lstrlenA (lpString="*.jpeg") returned 6
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.psd") returned 0
	[0060.060] lstrlenA (lpString="*.psd") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.cdr") returned 0
	[0060.060] lstrlenA (lpString="*.cdr") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.dwg") returned 0
	[0060.060] lstrlenA (lpString="*.dwg") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.max") returned 0
	[0060.060] lstrlenA (lpString="*.max") returned 5
	[0060.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.bmp") returned 1
	[0060.060] lstrlenA (lpString="*.bmp") returned 5
	[0060.060] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp"
	[0060.060] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp"
	[0060.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp."
	[0060.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.Boom"
	[0060.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.061] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838
	[0060.061] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3f0bd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1
	[0060.061] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.061] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x815, lpOverlapped=0x0) returned 1
	[0060.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="StopIconMask.bmp"
	[0060.073] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.073] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x815, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x815, lpOverlapped=0x0) returned 1
	[0060.073] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.073] CloseHandle (hObject=0x90) returned 1
	[0060.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.boom")) returned 1
	[0060.074] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.074] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.074] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TaskbarIconImages256Colors.bmp") returned -1
	[0060.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskbarIconImages256Colors.bmp") returned -1
	[0060.074] lstrcmpiA (lpString1="", lpString2="TaskbarIconImages256Colors.bmp") returned -1
	[0060.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="StopIconMask.bmp"
	[0060.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TaskbarIconImages256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp"
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.zip") returned 0
	[0060.075] lstrlenA (lpString="*.zip") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.rar") returned 0
	[0060.075] lstrlenA (lpString="*.rar") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.7z") returned 0
	[0060.075] lstrlenA (lpString="*.7z") returned 4
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.tar") returned 0
	[0060.075] lstrlenA (lpString="*.tar") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.gzip") returned 0
	[0060.075] lstrlenA (lpString="*.gzip") returned 6
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.jpg") returned 0
	[0060.075] lstrlenA (lpString="*.jpg") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.jpeg") returned 0
	[0060.075] lstrlenA (lpString="*.jpeg") returned 6
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.psd") returned 0
	[0060.075] lstrlenA (lpString="*.psd") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.cdr") returned 0
	[0060.075] lstrlenA (lpString="*.cdr") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.dwg") returned 0
	[0060.075] lstrlenA (lpString="*.dwg") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.max") returned 0
	[0060.075] lstrlenA (lpString="*.max") returned 5
	[0060.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.bmp") returned 1
	[0060.075] lstrlenA (lpString="*.bmp") returned 5
	[0060.075] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp"
	[0060.075] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp"
	[0060.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp."
	[0060.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.Boom"
	[0060.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.076] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf38
	[0060.076] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5d554a00, dwHighDateTime=0x1ca0b45), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5d554a00, dwHighDateTime=0x1ca0b45)) returned 1
	[0060.076] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.076] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf15, lpOverlapped=0x0) returned 1
	[0060.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="TaskbarIconImages256Colors.bmp"
	[0060.077] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.077] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf15, lpOverlapped=0x0) returned 1
	[0060.077] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.077] CloseHandle (hObject=0x90) returned 1
	[0060.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.boom")) returned 1
	[0060.078] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.078] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.078] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1
	[0060.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1
	[0060.078] lstrcmpiA (lpString1="", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1
	[0060.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="TaskbarIconImages256Colors.bmp"
	[0060.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TaskbarIconImagesMask256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp"
	[0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.zip") returned 0
	[0060.078] lstrlenA (lpString="*.zip") returned 5
	[0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.rar") returned 0
	[0060.078] lstrlenA (lpString="*.rar") returned 5
	[0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.7z") returned 0
	[0060.078] lstrlenA (lpString="*.7z") returned 4
	[0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.tar") returned 0
	[0060.078] lstrlenA (lpString="*.tar") returned 5
	[0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.gzip") returned 0
	[0060.078] lstrlenA (lpString="*.gzip") returned 6
	[0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.jpg") returned 0
	[0060.078] lstrlenA (lpString="*.jpg") returned 5
	[0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.jpeg") returned 0
	[0060.078] lstrlenA (lpString="*.jpeg") returned 6
	[0060.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.psd") returned 0
	[0060.079] lstrlenA (lpString="*.psd") returned 5
	[0060.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.cdr") returned 0
	[0060.079] lstrlenA (lpString="*.cdr") returned 5
	[0060.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.dwg") returned 0
	[0060.079] lstrlenA (lpString="*.dwg") returned 5
	[0060.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.max") returned 0
	[0060.079] lstrlenA (lpString="*.max") returned 5
	[0060.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.bmp") returned 1
	[0060.079] lstrlenA (lpString="*.bmp") returned 5
	[0060.079] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp"
	[0060.079] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp"
	[0060.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp."
	[0060.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.Boom"
	[0060.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.079] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x540
	[0060.079] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6cd49300, dwHighDateTime=0x1ca0b45), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6cd49300, dwHighDateTime=0x1ca0b45)) returned 1
	[0060.079] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.079] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x51d, lpOverlapped=0x0) returned 1
	[0060.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="TaskbarIconImagesMask256Colors.bmp"
	[0060.110] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.110] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x51d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x51d, lpOverlapped=0x0) returned 1
	[0060.110] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.111] CloseHandle (hObject=0x90) returned 1
	[0060.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.boom")) returned 1
	[0060.111] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.111] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.112] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipsImage.jpg") returned -1
	[0060.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipsImage.jpg") returned -1
	[0060.112] lstrcmpiA (lpString1="", lpString2="TipsImage.jpg") returned -1
	[0060.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="TaskbarIconImagesMask256Colors.bmp"
	[0060.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg"
	[0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.zip") returned 0
	[0060.112] lstrlenA (lpString="*.zip") returned 5
	[0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.rar") returned 0
	[0060.112] lstrlenA (lpString="*.rar") returned 5
	[0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.7z") returned 0
	[0060.112] lstrlenA (lpString="*.7z") returned 4
	[0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.tar") returned 0
	[0060.112] lstrlenA (lpString="*.tar") returned 5
	[0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.gzip") returned 0
	[0060.112] lstrlenA (lpString="*.gzip") returned 6
	[0060.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.jpg") returned 1
	[0060.113] lstrlenA (lpString="*.jpg") returned 5
	[0060.113] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg"
	[0060.113] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg"
	[0060.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg."
	[0060.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.Boom"
	[0060.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.113] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2605
	[0060.113] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5adf6ed0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea)) returned 1
	[0060.113] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.113] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x25e2, lpOverlapped=0x0) returned 1
	[0060.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="TipsImage.jpg"
	[0060.115] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.115] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x25e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x25e2, lpOverlapped=0x0) returned 1
	[0060.115] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.115] CloseHandle (hObject=0x90) returned 1
	[0060.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.boom")) returned 1
	[0060.116] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.116] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.116] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipsImageMask.bmp") returned -1
	[0060.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipsImageMask.bmp") returned -1
	[0060.116] lstrcmpiA (lpString1="", lpString2="TipsImageMask.bmp") returned -1
	[0060.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="TipsImage.jpg"
	[0060.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TipsImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp"
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.zip") returned 0
	[0060.116] lstrlenA (lpString="*.zip") returned 5
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.rar") returned 0
	[0060.116] lstrlenA (lpString="*.rar") returned 5
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.7z") returned 0
	[0060.116] lstrlenA (lpString="*.7z") returned 4
	[0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.tar") returned 0
	[0060.117] lstrlenA (lpString="*.tar") returned 5
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.gzip") returned 0
	[0060.117] lstrlenA (lpString="*.gzip") returned 6
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.jpg") returned 0
	[0060.117] lstrlenA (lpString="*.jpg") returned 5
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.117] lstrlenA (lpString="*.jpeg") returned 6
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.psd") returned 0
	[0060.117] lstrlenA (lpString="*.psd") returned 5
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.cdr") returned 0
	[0060.117] lstrlenA (lpString="*.cdr") returned 5
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.dwg") returned 0
	[0060.117] lstrlenA (lpString="*.dwg") returned 5
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.max") returned 0
	[0060.117] lstrlenA (lpString="*.max") returned 5
	[0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.bmp") returned 1
	[0060.117] lstrlenA (lpString="*.bmp") returned 5
	[0060.117] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp"
	[0060.117] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp"
	[0060.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp."
	[0060.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.Boom"
	[0060.117] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.118] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838
	[0060.118] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ae1d030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea)) returned 1
	[0060.118] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.119] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x815, lpOverlapped=0x0) returned 1
	[0060.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="TipsImageMask.bmp"
	[0060.120] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.120] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x815, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x815, lpOverlapped=0x0) returned 1
	[0060.120] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.120] CloseHandle (hObject=0x90) returned 1
	[0060.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.boom")) returned 1
	[0060.121] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.121] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.121] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VeriSignLogo.jpg") returned -1
	[0060.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VeriSignLogo.jpg") returned -1
	[0060.121] lstrcmpiA (lpString1="", lpString2="VeriSignLogo.jpg") returned -1
	[0060.121] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="TipsImageMask.bmp"
	[0060.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.121] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.121] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg"
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.zip") returned 0
	[0060.121] lstrlenA (lpString="*.zip") returned 5
	[0060.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.rar") returned 0
	[0060.122] lstrlenA (lpString="*.rar") returned 5
	[0060.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.7z") returned 0
	[0060.122] lstrlenA (lpString="*.7z") returned 4
	[0060.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.tar") returned 0
	[0060.122] lstrlenA (lpString="*.tar") returned 5
	[0060.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.gzip") returned 0
	[0060.122] lstrlenA (lpString="*.gzip") returned 6
	[0060.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.jpg") returned 1
	[0060.122] lstrlenA (lpString="*.jpg") returned 5
	[0060.122] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg"
	[0060.122] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg"
	[0060.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg."
	[0060.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.Boom"
	[0060.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.122] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x450
	[0060.122] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1
	[0060.122] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.122] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x42d, lpOverlapped=0x0) returned 1
	[0060.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="VeriSignLogo.jpg"
	[0060.142] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.142] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x42d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x42d, lpOverlapped=0x0) returned 1
	[0060.142] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.142] CloseHandle (hObject=0x90) returned 1
	[0060.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.boom")) returned 1
	[0060.143] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.143] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolIconImages.jpg") returned -1
	[0060.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolIconImages.jpg") returned -1
	[0060.143] lstrcmpiA (lpString1="", lpString2="WebToolIconImages.jpg") returned -1
	[0060.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="VeriSignLogo.jpg"
	[0060.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg"
	[0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0060.143] lstrlenA (lpString="*.zip") returned 5
	[0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0060.143] lstrlenA (lpString="*.rar") returned 5
	[0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0060.143] lstrlenA (lpString="*.7z") returned 4
	[0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0060.144] lstrlenA (lpString="*.tar") returned 5
	[0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0060.144] lstrlenA (lpString="*.gzip") returned 6
	[0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0060.144] lstrlenA (lpString="*.jpg") returned 5
	[0060.144] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg"
	[0060.144] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg"
	[0060.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg."
	[0060.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.Boom"
	[0060.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.144] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5431
	[0060.144] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90bafc00, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90bafc00, dwHighDateTime=0x1ca032f)) returned 1
	[0060.144] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.144] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x540e, lpOverlapped=0x0) returned 1
	[0060.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="WebToolIconImages.jpg"
	[0060.191] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.191] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x540e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x540e, lpOverlapped=0x0) returned 1
	[0060.191] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.191] CloseHandle (hObject=0x90) returned 1
	[0060.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.boom")) returned 1
	[0060.193] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.193] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.193] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolIconImagesMask.bmp") returned -1
	[0060.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolIconImagesMask.bmp") returned -1
	[0060.193] lstrcmpiA (lpString1="", lpString2="WebToolIconImagesMask.bmp") returned -1
	[0060.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="WebToolIconImages.jpg"
	[0060.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.193] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp"
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0060.193] lstrlenA (lpString="*.zip") returned 5
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0060.193] lstrlenA (lpString="*.rar") returned 5
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0060.193] lstrlenA (lpString="*.7z") returned 4
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0060.193] lstrlenA (lpString="*.tar") returned 5
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0060.193] lstrlenA (lpString="*.gzip") returned 6
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0060.193] lstrlenA (lpString="*.jpg") returned 5
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.193] lstrlenA (lpString="*.jpeg") returned 6
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0060.193] lstrlenA (lpString="*.psd") returned 5
	[0060.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0060.194] lstrlenA (lpString="*.cdr") returned 5
	[0060.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0060.194] lstrlenA (lpString="*.dwg") returned 5
	[0060.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0060.194] lstrlenA (lpString="*.max") returned 5
	[0060.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0060.194] lstrlenA (lpString="*.bmp") returned 5
	[0060.194] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp"
	[0060.194] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp"
	[0060.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp."
	[0060.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.Boom"
	[0060.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.194] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1538
	[0060.195] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8862c100, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8862c100, dwHighDateTime=0x1ca032f)) returned 1
	[0060.195] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.195] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1515, lpOverlapped=0x0) returned 1
	[0060.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="WebToolIconImagesMask.bmp"
	[0060.212] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.212] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1515, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1515, lpOverlapped=0x0) returned 1
	[0060.212] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.212] CloseHandle (hObject=0x90) returned 1
	[0060.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.boom")) returned 1
	[0060.213] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.213] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolImages16x16.jpg") returned -1
	[0060.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolImages16x16.jpg") returned -1
	[0060.213] lstrcmpiA (lpString1="", lpString2="WebToolImages16x16.jpg") returned -1
	[0060.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="WebToolIconImagesMask.bmp"
	[0060.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg"
	[0060.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.zip") returned 0
	[0060.214] lstrlenA (lpString="*.zip") returned 5
	[0060.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.rar") returned 0
	[0060.214] lstrlenA (lpString="*.rar") returned 5
	[0060.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.7z") returned 0
	[0060.214] lstrlenA (lpString="*.7z") returned 4
	[0060.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.tar") returned 0
	[0060.214] lstrlenA (lpString="*.tar") returned 5
	[0060.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.gzip") returned 0
	[0060.214] lstrlenA (lpString="*.gzip") returned 6
	[0060.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.jpg") returned 1
	[0060.214] lstrlenA (lpString="*.jpg") returned 5
	[0060.214] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg"
	[0060.214] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg"
	[0060.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg."
	[0060.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.Boom"
	[0060.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.214] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1995
	[0060.214] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x708c13f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1
	[0060.215] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.215] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1972, lpOverlapped=0x0) returned 1
	[0060.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="WebToolImages16x16.jpg"
	[0060.231] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.231] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1972, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1972, lpOverlapped=0x0) returned 1
	[0060.231] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.231] CloseHandle (hObject=0x90) returned 1
	[0060.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.boom")) returned 1
	[0060.232] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolImagesMask16x16.bmp") returned -1
	[0060.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolImagesMask16x16.bmp") returned -1
	[0060.232] lstrcmpiA (lpString1="", lpString2="WebToolImagesMask16x16.bmp") returned -1
	[0060.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="WebToolImages16x16.jpg"
	[0060.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolImagesMask16x16.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp"
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.zip") returned 0
	[0060.233] lstrlenA (lpString="*.zip") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.rar") returned 0
	[0060.233] lstrlenA (lpString="*.rar") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.7z") returned 0
	[0060.233] lstrlenA (lpString="*.7z") returned 4
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.tar") returned 0
	[0060.233] lstrlenA (lpString="*.tar") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.gzip") returned 0
	[0060.233] lstrlenA (lpString="*.gzip") returned 6
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.jpg") returned 0
	[0060.233] lstrlenA (lpString="*.jpg") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.jpeg") returned 0
	[0060.233] lstrlenA (lpString="*.jpeg") returned 6
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.psd") returned 0
	[0060.233] lstrlenA (lpString="*.psd") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.cdr") returned 0
	[0060.233] lstrlenA (lpString="*.cdr") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.dwg") returned 0
	[0060.233] lstrlenA (lpString="*.dwg") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.max") returned 0
	[0060.233] lstrlenA (lpString="*.max") returned 5
	[0060.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.bmp") returned 1
	[0060.233] lstrlenA (lpString="*.bmp") returned 5
	[0060.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp"
	[0060.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp"
	[0060.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp."
	[0060.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.Boom"
	[0060.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.234] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838
	[0060.234] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1
	[0060.234] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.234] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x815, lpOverlapped=0x0) returned 1
	[0060.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="WebToolImagesMask16x16.bmp"
	[0060.257] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.257] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x815, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x815, lpOverlapped=0x0) returned 1
	[0060.257] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.257] CloseHandle (hObject=0x90) returned 1
	[0060.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.boom")) returned 1
	[0060.258] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.258] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSSFilesToolIconImages.jpg") returned -1
	[0060.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolIconImages.jpg") returned -1
	[0060.258] lstrcmpiA (lpString1="", lpString2="WSSFilesToolIconImages.jpg") returned -1
	[0060.258] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="WebToolImagesMask16x16.bmp"
	[0060.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.258] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.258] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg"
	[0060.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0060.258] lstrlenA (lpString="*.zip") returned 5
	[0060.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0060.259] lstrlenA (lpString="*.rar") returned 5
	[0060.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0060.259] lstrlenA (lpString="*.7z") returned 4
	[0060.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0060.259] lstrlenA (lpString="*.tar") returned 5
	[0060.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0060.259] lstrlenA (lpString="*.gzip") returned 6
	[0060.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0060.259] lstrlenA (lpString="*.jpg") returned 5
	[0060.259] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg"
	[0060.259] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg"
	[0060.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg."
	[0060.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.Boom"
	[0060.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.260] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2308
	[0060.260] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x709f1ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1
	[0060.260] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.260] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x22e5, lpOverlapped=0x0) returned 1
	[0060.293] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="WSSFilesToolIconImages.jpg"
	[0060.293] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.293] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x22e5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x22e5, lpOverlapped=0x0) returned 1
	[0060.293] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.293] CloseHandle (hObject=0x90) returned 1
	[0060.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.boom")) returned 1
	[0060.294] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0060.294] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1
	[0060.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1
	[0060.294] lstrcmpiA (lpString1="", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1
	[0060.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="WSSFilesToolIconImages.jpg"
	[0060.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\"
	[0060.294] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned=""
	[0060.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt"
	[0060.294] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20
	[0060.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WSSFilesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp"
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0060.295] lstrlenA (lpString="*.zip") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0060.295] lstrlenA (lpString="*.rar") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0060.295] lstrlenA (lpString="*.7z") returned 4
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0060.295] lstrlenA (lpString="*.tar") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0060.295] lstrlenA (lpString="*.gzip") returned 6
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0060.295] lstrlenA (lpString="*.jpg") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.295] lstrlenA (lpString="*.jpeg") returned 6
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0060.295] lstrlenA (lpString="*.psd") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0060.295] lstrlenA (lpString="*.cdr") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0060.295] lstrlenA (lpString="*.dwg") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0060.295] lstrlenA (lpString="*.max") returned 5
	[0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0060.295] lstrlenA (lpString="*.bmp") returned 5
	[0060.295] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp"
	[0060.295] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp"
	[0060.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp."
	[0060.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.Boom"
	[0060.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0060.296] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638
	[0060.296] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e633690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1
	[0060.296] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.296] ReadFile (in: hFile=0x90, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x615, lpOverlapped=0x0) returned 1
	[0060.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="WSSFilesToolIconImagesMask.bmp"
	[0060.312] SetFilePointer (in: hFile=0x90, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.312] WriteFile (in: hFile=0x90, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x615, lpOverlapped=0x0) returned 1
	[0060.312] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.312] CloseHandle (hObject=0x90) returned 1
	[0060.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.boom")) returned 1
	[0060.313] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0060.313] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0060.313] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0060.313] lstrcmpA (lpString1=".", lpString2="ToolData") returned -1
	[0060.313] lstrcmpA (lpString1="..", lpString2="ToolData") returned -1
	[0060.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*"
	[0060.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolData" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData"
	[0060.313] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned 58
	[0060.313] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0060.314] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.314] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.314] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.314] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.314] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0060.314] lstrcmpA (lpString1=".", lpString2="groove.net") returned -1
	[0060.314] lstrcmpA (lpString1="..", lpString2="groove.net") returned -1
	[0060.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*") returned="*.*"
	[0060.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", lpString2="groove.net" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net"
	[0060.314] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned 69
	[0060.314] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0060.361] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.361] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0060.361] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.361] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.361] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0060.361] lstrcmpA (lpString1=".", lpString2="Calendar") returned -1
	[0060.361] lstrcmpA (lpString1="..", lpString2="Calendar") returned -1
	[0060.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0060.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Calendar" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar"
	[0060.361] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned 78
	[0060.361] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0060.388] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.388] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.388] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.389] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.389] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.389] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.389] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarToolIconImages.jpg") returned 1
	[0060.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImages.jpg") returned 1
	[0060.389] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImages.jpg") returned -1
	[0060.389] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*") returned="*.*"
	[0060.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\"
	[0060.389] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned=""
	[0060.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt"
	[0060.389] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0xffffffff
	[0060.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.390] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0060.390] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0060.391] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0060.391] CloseHandle (hObject=0x98) returned 1
	[0060.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg"
	[0060.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0060.391] lstrlenA (lpString="*.zip") returned 5
	[0060.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0060.391] lstrlenA (lpString="*.rar") returned 5
	[0060.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0060.391] lstrlenA (lpString="*.7z") returned 4
	[0060.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0060.391] lstrlenA (lpString="*.tar") returned 5
	[0060.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0060.391] lstrlenA (lpString="*.gzip") returned 6
	[0060.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0060.391] lstrlenA (lpString="*.jpg") returned 5
	[0060.391] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg"
	[0060.391] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg"
	[0060.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg."
	[0060.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.Boom"
	[0060.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.392] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3424
	[0060.392] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc4b62000, dwHighDateTime=0x1ca0408), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4b62000, dwHighDateTime=0x1ca0408)) returned 1
	[0060.392] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.392] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3401, lpOverlapped=0x0) returned 1
	[0060.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg"
	[0060.426] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.426] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3401, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3401, lpOverlapped=0x0) returned 1
	[0060.426] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.427] CloseHandle (hObject=0x98) returned 1
	[0060.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.boom")) returned 1
	[0060.427] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.428] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarToolIconImagesMask.bmp") returned 1
	[0060.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImagesMask.bmp") returned 1
	[0060.428] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImagesMask.bmp") returned -1
	[0060.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg"
	[0060.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\"
	[0060.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned=""
	[0060.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt"
	[0060.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20
	[0060.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp"
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0060.428] lstrlenA (lpString="*.zip") returned 5
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0060.428] lstrlenA (lpString="*.rar") returned 5
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0060.428] lstrlenA (lpString="*.7z") returned 4
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0060.428] lstrlenA (lpString="*.tar") returned 5
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0060.428] lstrlenA (lpString="*.gzip") returned 6
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0060.428] lstrlenA (lpString="*.jpg") returned 5
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.428] lstrlenA (lpString="*.jpeg") returned 6
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0060.428] lstrlenA (lpString="*.psd") returned 5
	[0060.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0060.429] lstrlenA (lpString="*.cdr") returned 5
	[0060.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0060.429] lstrlenA (lpString="*.dwg") returned 5
	[0060.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0060.429] lstrlenA (lpString="*.max") returned 5
	[0060.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0060.429] lstrlenA (lpString="*.bmp") returned 5
	[0060.429] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp"
	[0060.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp"
	[0060.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp."
	[0060.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.Boom"
	[0060.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.449] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc38
	[0060.449] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbb2cb800, dwHighDateTime=0x1ca0408), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbb2cb800, dwHighDateTime=0x1ca0408)) returned 1
	[0060.449] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.449] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc15, lpOverlapped=0x0) returned 1
	[0060.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp"
	[0060.474] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.474] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc15, lpOverlapped=0x0) returned 1
	[0060.474] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.474] CloseHandle (hObject=0x98) returned 1
	[0060.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.boom")) returned 1
	[0060.475] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.475] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarViewButtonImages.jpg") returned 1
	[0060.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarViewButtonImages.jpg") returned 1
	[0060.475] lstrcmpiA (lpString1="", lpString2="CalendarViewButtonImages.jpg") returned -1
	[0060.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp"
	[0060.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\"
	[0060.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned=""
	[0060.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt"
	[0060.475] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20
	[0060.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg"
	[0060.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.zip") returned 0
	[0060.475] lstrlenA (lpString="*.zip") returned 5
	[0060.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.rar") returned 0
	[0060.476] lstrlenA (lpString="*.rar") returned 5
	[0060.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.7z") returned 0
	[0060.476] lstrlenA (lpString="*.7z") returned 4
	[0060.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.tar") returned 0
	[0060.476] lstrlenA (lpString="*.tar") returned 5
	[0060.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.gzip") returned 0
	[0060.476] lstrlenA (lpString="*.gzip") returned 6
	[0060.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.jpg") returned 1
	[0060.476] lstrlenA (lpString="*.jpg") returned 5
	[0060.476] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg"
	[0060.476] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg"
	[0060.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg."
	[0060.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.Boom"
	[0060.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.477] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fa2
	[0060.477] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1
	[0060.477] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.477] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3f7f, lpOverlapped=0x0) returned 1
	[0060.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="CalendarViewButtonImages.jpg"
	[0060.505] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.505] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3f7f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3f7f, lpOverlapped=0x0) returned 1
	[0060.505] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.505] CloseHandle (hObject=0x98) returned 1
	[0060.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.boom")) returned 1
	[0060.506] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.506] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.506] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GlobeButtonImage.jpg") returned -1
	[0060.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobeButtonImage.jpg") returned 1
	[0060.506] lstrcmpiA (lpString1="", lpString2="GlobeButtonImage.jpg") returned -1
	[0060.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="CalendarViewButtonImages.jpg"
	[0060.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\"
	[0060.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned=""
	[0060.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt"
	[0060.506] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20
	[0060.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg"
	[0060.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.zip") returned 0
	[0060.506] lstrlenA (lpString="*.zip") returned 5
	[0060.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.rar") returned 0
	[0060.506] lstrlenA (lpString="*.rar") returned 5
	[0060.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.7z") returned 0
	[0060.506] lstrlenA (lpString="*.7z") returned 4
	[0060.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.tar") returned 0
	[0060.507] lstrlenA (lpString="*.tar") returned 5
	[0060.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.gzip") returned 0
	[0060.507] lstrlenA (lpString="*.gzip") returned 6
	[0060.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.jpg") returned 1
	[0060.507] lstrlenA (lpString="*.jpg") returned 5
	[0060.507] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg"
	[0060.507] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg"
	[0060.507] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg."
	[0060.507] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.Boom"
	[0060.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.507] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b49
	[0060.507] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52b0b4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1
	[0060.507] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.507] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1b26, lpOverlapped=0x0) returned 1
	[0060.543] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="GlobeButtonImage.jpg"
	[0060.543] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.543] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1b26, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1b26, lpOverlapped=0x0) returned 1
	[0060.543] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.544] CloseHandle (hObject=0x98) returned 1
	[0060.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.boom")) returned 1
	[0060.544] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.544] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.544] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GlobeButtonImageMask.bmp") returned -1
	[0060.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobeButtonImageMask.bmp") returned 1
	[0060.544] lstrcmpiA (lpString1="", lpString2="GlobeButtonImageMask.bmp") returned -1
	[0060.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="GlobeButtonImage.jpg"
	[0060.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\"
	[0060.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned=""
	[0060.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt"
	[0060.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20
	[0060.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="GlobeButtonImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp"
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.zip") returned 0
	[0060.545] lstrlenA (lpString="*.zip") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.rar") returned 0
	[0060.545] lstrlenA (lpString="*.rar") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.7z") returned 0
	[0060.545] lstrlenA (lpString="*.7z") returned 4
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.tar") returned 0
	[0060.545] lstrlenA (lpString="*.tar") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.gzip") returned 0
	[0060.545] lstrlenA (lpString="*.gzip") returned 6
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.jpg") returned 0
	[0060.545] lstrlenA (lpString="*.jpg") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.545] lstrlenA (lpString="*.jpeg") returned 6
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.psd") returned 0
	[0060.545] lstrlenA (lpString="*.psd") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.cdr") returned 0
	[0060.545] lstrlenA (lpString="*.cdr") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.dwg") returned 0
	[0060.545] lstrlenA (lpString="*.dwg") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.max") returned 0
	[0060.545] lstrlenA (lpString="*.max") returned 5
	[0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.bmp") returned 1
	[0060.545] lstrlenA (lpString="*.bmp") returned 5
	[0060.545] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp"
	[0060.545] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp"
	[0060.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp."
	[0060.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.Boom"
	[0060.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.546] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x778
	[0060.546] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61a457d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1
	[0060.546] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.546] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x755, lpOverlapped=0x0) returned 1
	[0060.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="GlobeButtonImageMask.bmp"
	[0060.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.562] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x755, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x755, lpOverlapped=0x0) returned 1
	[0060.563] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.563] CloseHandle (hObject=0x98) returned 1
	[0060.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.boom")) returned 1
	[0060.563] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0060.563] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0060.563] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0060.563] lstrcmpA (lpString1=".", lpString2="CommonData") returned -1
	[0060.563] lstrcmpA (lpString1="..", lpString2="CommonData") returned -1
	[0060.563] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0060.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="CommonData" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData"
	[0060.564] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned 80
	[0060.564] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0060.611] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0060.611] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.612] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0060.612] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0060.612] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.612] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.612] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_Auto.jpg") returned 1
	[0060.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Auto.jpg") returned 1
	[0060.612] lstrcmpiA (lpString1="", lpString2="AlertImage_Auto.jpg") returned -1
	[0060.612] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*") returned="*.*"
	[0060.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0060.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0060.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0060.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0xffffffff
	[0060.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.613] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0060.613] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0060.613] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0060.613] CloseHandle (hObject=0x98) returned 1
	[0060.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg"
	[0060.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.zip") returned 0
	[0060.613] lstrlenA (lpString="*.zip") returned 5
	[0060.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.rar") returned 0
	[0060.614] lstrlenA (lpString="*.rar") returned 5
	[0060.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.7z") returned 0
	[0060.614] lstrlenA (lpString="*.7z") returned 4
	[0060.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.tar") returned 0
	[0060.614] lstrlenA (lpString="*.tar") returned 5
	[0060.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.gzip") returned 0
	[0060.614] lstrlenA (lpString="*.gzip") returned 6
	[0060.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.jpg") returned 1
	[0060.614] lstrlenA (lpString="*.jpg") returned 5
	[0060.614] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg"
	[0060.614] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg"
	[0060.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg."
	[0060.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.Boom"
	[0060.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.615] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44c9
	[0060.615] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x633fe700, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x633fe700, dwHighDateTime=0x1c95fc8)) returned 1
	[0060.615] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.615] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x44a6, lpOverlapped=0x0) returned 1
	[0060.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="AlertImage_Auto.jpg"
	[0060.650] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.650] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x44a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x44a6, lpOverlapped=0x0) returned 1
	[0060.651] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.652] CloseHandle (hObject=0x98) returned 1
	[0060.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.boom")) returned 1
	[0060.653] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.653] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.653] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_AutoMask.bmp") returned 1
	[0060.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_AutoMask.bmp") returned 1
	[0060.653] lstrcmpiA (lpString1="", lpString2="AlertImage_AutoMask.bmp") returned -1
	[0060.653] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="AlertImage_Auto.jpg"
	[0060.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0060.653] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0060.653] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0060.653] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0060.653] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_AutoMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp"
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.zip") returned 0
	[0060.653] lstrlenA (lpString="*.zip") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.rar") returned 0
	[0060.653] lstrlenA (lpString="*.rar") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.7z") returned 0
	[0060.653] lstrlenA (lpString="*.7z") returned 4
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.tar") returned 0
	[0060.653] lstrlenA (lpString="*.tar") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.gzip") returned 0
	[0060.653] lstrlenA (lpString="*.gzip") returned 6
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.jpg") returned 0
	[0060.653] lstrlenA (lpString="*.jpg") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.653] lstrlenA (lpString="*.jpeg") returned 6
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.psd") returned 0
	[0060.653] lstrlenA (lpString="*.psd") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.cdr") returned 0
	[0060.653] lstrlenA (lpString="*.cdr") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.dwg") returned 0
	[0060.653] lstrlenA (lpString="*.dwg") returned 5
	[0060.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.max") returned 0
	[0060.654] lstrlenA (lpString="*.max") returned 5
	[0060.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.bmp") returned 1
	[0060.654] lstrlenA (lpString="*.bmp") returned 5
	[0060.654] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp"
	[0060.654] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp"
	[0060.654] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp."
	[0060.654] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.Boom"
	[0060.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.654] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e
	[0060.654] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3390df00, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3390df00, dwHighDateTime=0x1c95fc8)) returned 1
	[0060.654] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.654] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4b, lpOverlapped=0x0) returned 1
	[0060.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="AlertImage_AutoMask.bmp"
	[0060.847] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.847] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4b, lpOverlapped=0x0) returned 1
	[0060.847] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.847] CloseHandle (hObject=0x98) returned 1
	[0060.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.boom")) returned 1
	[0060.848] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.848] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactHigh.jpg") returned 1
	[0060.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactHigh.jpg") returned 1
	[0060.848] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactHigh.jpg") returned -1
	[0060.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="AlertImage_AutoMask.bmp"
	[0060.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0060.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0060.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0060.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0060.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg"
	[0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.zip") returned 0
	[0060.848] lstrlenA (lpString="*.zip") returned 5
	[0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.rar") returned 0
	[0060.849] lstrlenA (lpString="*.rar") returned 5
	[0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.7z") returned 0
	[0060.849] lstrlenA (lpString="*.7z") returned 4
	[0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.tar") returned 0
	[0060.849] lstrlenA (lpString="*.tar") returned 5
	[0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.gzip") returned 0
	[0060.849] lstrlenA (lpString="*.gzip") returned 6
	[0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.jpg") returned 1
	[0060.849] lstrlenA (lpString="*.jpg") returned 5
	[0060.849] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg"
	[0060.849] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg"
	[0060.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg."
	[0060.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.Boom"
	[0060.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.849] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3356
	[0060.849] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1
	[0060.849] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.849] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3333, lpOverlapped=0x0) returned 1
	[0060.872] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="AlertImage_ContactHigh.jpg"
	[0060.872] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.872] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3333, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3333, lpOverlapped=0x0) returned 1
	[0060.872] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.872] CloseHandle (hObject=0x98) returned 1
	[0060.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.boom")) returned 1
	[0060.873] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.873] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.873] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactHighMask.bmp") returned 1
	[0060.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactHighMask.bmp") returned 1
	[0060.873] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactHighMask.bmp") returned -1
	[0060.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="AlertImage_ContactHigh.jpg"
	[0060.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0060.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0060.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0060.873] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0060.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp"
	[0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.zip") returned 0
	[0060.873] lstrlenA (lpString="*.zip") returned 5
	[0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.rar") returned 0
	[0060.873] lstrlenA (lpString="*.rar") returned 5
	[0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.7z") returned 0
	[0060.874] lstrlenA (lpString="*.7z") returned 4
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.tar") returned 0
	[0060.874] lstrlenA (lpString="*.tar") returned 5
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.gzip") returned 0
	[0060.874] lstrlenA (lpString="*.gzip") returned 6
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.jpg") returned 0
	[0060.874] lstrlenA (lpString="*.jpg") returned 5
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.874] lstrlenA (lpString="*.jpeg") returned 6
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.psd") returned 0
	[0060.874] lstrlenA (lpString="*.psd") returned 5
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.cdr") returned 0
	[0060.874] lstrlenA (lpString="*.cdr") returned 5
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.dwg") returned 0
	[0060.874] lstrlenA (lpString="*.dwg") returned 5
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.max") returned 0
	[0060.874] lstrlenA (lpString="*.max") returned 5
	[0060.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.bmp") returned 1
	[0060.874] lstrlenA (lpString="*.bmp") returned 5
	[0060.874] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp"
	[0060.874] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp"
	[0060.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp."
	[0060.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.Boom"
	[0060.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.875] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c70
	[0060.875] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1
	[0060.875] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.875] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4d, lpOverlapped=0x0) returned 1
	[0060.889] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="AlertImage_ContactHighMask.bmp"
	[0060.889] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.889] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4d, lpOverlapped=0x0) returned 1
	[0060.890] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.890] CloseHandle (hObject=0x98) returned 1
	[0060.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.boom")) returned 1
	[0060.891] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.891] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.891] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactLow.jpg") returned 1
	[0060.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactLow.jpg") returned 1
	[0060.891] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactLow.jpg") returned -1
	[0060.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="AlertImage_ContactHighMask.bmp"
	[0060.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0060.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0060.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0060.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0060.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg"
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.zip") returned 0
	[0060.891] lstrlenA (lpString="*.zip") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.rar") returned 0
	[0060.891] lstrlenA (lpString="*.rar") returned 5
	[0060.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.7z") returned 0
	[0060.892] lstrlenA (lpString="*.7z") returned 4
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.tar") returned 0
	[0060.892] lstrlenA (lpString="*.tar") returned 5
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.gzip") returned 0
	[0060.892] lstrlenA (lpString="*.gzip") returned 6
	[0060.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.jpg") returned 1
	[0060.892] lstrlenA (lpString="*.jpg") returned 5
	[0060.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg"
	[0060.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg"
	[0060.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg."
	[0060.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.Boom"
	[0060.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.892] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f79
	[0060.892] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1
	[0060.892] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.892] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2f56, lpOverlapped=0x0) returned 1
	[0060.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="AlertImage_ContactLow.jpg"
	[0060.961] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.961] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2f56, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2f56, lpOverlapped=0x0) returned 1
	[0060.961] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.962] CloseHandle (hObject=0x98) returned 1
	[0060.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.boom")) returned 1
	[0060.963] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.963] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.963] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactLowMask.bmp") returned 1
	[0060.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactLowMask.bmp") returned 1
	[0060.963] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactLowMask.bmp") returned -1
	[0060.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="AlertImage_ContactLow.jpg"
	[0060.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0060.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0060.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0060.963] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0060.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactLowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp"
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.zip") returned 0
	[0060.963] lstrlenA (lpString="*.zip") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.rar") returned 0
	[0060.963] lstrlenA (lpString="*.rar") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.7z") returned 0
	[0060.963] lstrlenA (lpString="*.7z") returned 4
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.tar") returned 0
	[0060.963] lstrlenA (lpString="*.tar") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.gzip") returned 0
	[0060.963] lstrlenA (lpString="*.gzip") returned 6
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.jpg") returned 0
	[0060.963] lstrlenA (lpString="*.jpg") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.jpeg") returned 0
	[0060.963] lstrlenA (lpString="*.jpeg") returned 6
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.psd") returned 0
	[0060.963] lstrlenA (lpString="*.psd") returned 5
	[0060.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.cdr") returned 0
	[0060.963] lstrlenA (lpString="*.cdr") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.dwg") returned 0
	[0060.964] lstrlenA (lpString="*.dwg") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.max") returned 0
	[0060.964] lstrlenA (lpString="*.max") returned 5
	[0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.bmp") returned 1
	[0060.964] lstrlenA (lpString="*.bmp") returned 5
	[0060.964] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp"
	[0060.964] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp"
	[0060.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp."
	[0060.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.Boom"
	[0060.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.965] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c70
	[0060.965] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1
	[0060.965] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.965] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4d, lpOverlapped=0x0) returned 1
	[0060.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="AlertImage_ContactLowMask.bmp"
	[0060.994] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.994] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4d, lpOverlapped=0x0) returned 1
	[0060.994] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0060.994] CloseHandle (hObject=0x98) returned 1
	[0060.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.boom")) returned 1
	[0060.995] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0060.995] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0060.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileHigh.jpg") returned 1
	[0060.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileHigh.jpg") returned 1
	[0060.995] lstrcmpiA (lpString1="", lpString2="AlertImage_FileHigh.jpg") returned -1
	[0060.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="AlertImage_ContactLowMask.bmp"
	[0060.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0060.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0060.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0060.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0060.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg"
	[0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.zip") returned 0
	[0060.996] lstrlenA (lpString="*.zip") returned 5
	[0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.rar") returned 0
	[0060.996] lstrlenA (lpString="*.rar") returned 5
	[0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.7z") returned 0
	[0060.996] lstrlenA (lpString="*.7z") returned 4
	[0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.tar") returned 0
	[0060.996] lstrlenA (lpString="*.tar") returned 5
	[0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.gzip") returned 0
	[0060.996] lstrlenA (lpString="*.gzip") returned 6
	[0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.jpg") returned 1
	[0060.996] lstrlenA (lpString="*.jpg") returned 5
	[0060.996] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg"
	[0060.996] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg"
	[0060.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg."
	[0060.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.Boom"
	[0060.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0060.997] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x480d
	[0060.997] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc125fc00, dwHighDateTime=0x1c95fd3), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc125fc00, dwHighDateTime=0x1c95fd3)) returned 1
	[0060.997] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0060.998] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x47ea, lpOverlapped=0x0) returned 1
	[0061.011] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="AlertImage_FileHigh.jpg"
	[0061.011] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.011] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x47ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x47ea, lpOverlapped=0x0) returned 1
	[0061.011] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.012] CloseHandle (hObject=0x98) returned 1
	[0061.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.boom")) returned 1
	[0061.012] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.012] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.013] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileHighMask.bmp") returned 1
	[0061.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileHighMask.bmp") returned 1
	[0061.013] lstrcmpiA (lpString1="", lpString2="AlertImage_FileHighMask.bmp") returned -1
	[0061.013] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="AlertImage_FileHigh.jpg"
	[0061.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.013] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.013] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp"
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.zip") returned 0
	[0061.013] lstrlenA (lpString="*.zip") returned 5
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.rar") returned 0
	[0061.013] lstrlenA (lpString="*.rar") returned 5
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.7z") returned 0
	[0061.013] lstrlenA (lpString="*.7z") returned 4
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.tar") returned 0
	[0061.013] lstrlenA (lpString="*.tar") returned 5
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.gzip") returned 0
	[0061.013] lstrlenA (lpString="*.gzip") returned 6
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.jpg") returned 0
	[0061.013] lstrlenA (lpString="*.jpg") returned 5
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.013] lstrlenA (lpString="*.jpeg") returned 6
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.psd") returned 0
	[0061.013] lstrlenA (lpString="*.psd") returned 5
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.cdr") returned 0
	[0061.013] lstrlenA (lpString="*.cdr") returned 5
	[0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.dwg") returned 0
	[0061.013] lstrlenA (lpString="*.dwg") returned 5
	[0061.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.max") returned 0
	[0061.014] lstrlenA (lpString="*.max") returned 5
	[0061.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.bmp") returned 1
	[0061.014] lstrlenA (lpString="*.bmp") returned 5
	[0061.014] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp"
	[0061.014] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp"
	[0061.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp."
	[0061.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.Boom"
	[0061.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.014] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e
	[0061.014] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3b558100, dwHighDateTime=0x1c95fd2), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3b558100, dwHighDateTime=0x1c95fd2)) returned 1
	[0061.014] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.014] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="AlertImage_FileHighMask.bmp"
	[0061.038] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.038] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.038] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.038] CloseHandle (hObject=0x98) returned 1
	[0061.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.boom")) returned 1
	[0061.039] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.039] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileOff.jpg") returned 1
	[0061.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileOff.jpg") returned 1
	[0061.039] lstrcmpiA (lpString1="", lpString2="AlertImage_FileOff.jpg") returned -1
	[0061.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="AlertImage_FileHighMask.bmp"
	[0061.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg"
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.zip") returned 0
	[0061.039] lstrlenA (lpString="*.zip") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.rar") returned 0
	[0061.039] lstrlenA (lpString="*.rar") returned 5
	[0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.7z") returned 0
	[0061.039] lstrlenA (lpString="*.7z") returned 4
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.tar") returned 0
	[0061.040] lstrlenA (lpString="*.tar") returned 5
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.gzip") returned 0
	[0061.040] lstrlenA (lpString="*.gzip") returned 6
	[0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.jpg") returned 1
	[0061.040] lstrlenA (lpString="*.jpg") returned 5
	[0061.040] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg"
	[0061.040] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg"
	[0061.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg."
	[0061.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.Boom"
	[0061.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.040] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46de
	[0061.040] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc5eab000, dwHighDateTime=0x1c95fd3), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc5eab000, dwHighDateTime=0x1c95fd3)) returned 1
	[0061.040] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.041] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x46bb, lpOverlapped=0x0) returned 1
	[0061.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="AlertImage_FileOff.jpg"
	[0061.052] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.052] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x46bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x46bb, lpOverlapped=0x0) returned 1
	[0061.052] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.052] CloseHandle (hObject=0x98) returned 1
	[0061.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.boom")) returned 1
	[0061.053] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.053] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileOffMask.bmp") returned 1
	[0061.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileOffMask.bmp") returned 1
	[0061.053] lstrcmpiA (lpString1="", lpString2="AlertImage_FileOffMask.bmp") returned -1
	[0061.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="AlertImage_FileOff.jpg"
	[0061.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileOffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp"
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.zip") returned 0
	[0061.054] lstrlenA (lpString="*.zip") returned 5
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.rar") returned 0
	[0061.054] lstrlenA (lpString="*.rar") returned 5
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.7z") returned 0
	[0061.054] lstrlenA (lpString="*.7z") returned 4
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.tar") returned 0
	[0061.054] lstrlenA (lpString="*.tar") returned 5
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.gzip") returned 0
	[0061.054] lstrlenA (lpString="*.gzip") returned 6
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.jpg") returned 0
	[0061.054] lstrlenA (lpString="*.jpg") returned 5
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.054] lstrlenA (lpString="*.jpeg") returned 6
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.psd") returned 0
	[0061.054] lstrlenA (lpString="*.psd") returned 5
	[0061.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.cdr") returned 0
	[0061.054] lstrlenA (lpString="*.cdr") returned 5
	[0061.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.dwg") returned 0
	[0061.055] lstrlenA (lpString="*.dwg") returned 5
	[0061.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.max") returned 0
	[0061.055] lstrlenA (lpString="*.max") returned 5
	[0061.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.bmp") returned 1
	[0061.055] lstrlenA (lpString="*.bmp") returned 5
	[0061.055] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp"
	[0061.055] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp"
	[0061.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp."
	[0061.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.Boom"
	[0061.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.055] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e
	[0061.055] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x427c8f00, dwHighDateTime=0x1c95fd2), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x427c8f00, dwHighDateTime=0x1c95fd2)) returned 1
	[0061.055] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.055] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="AlertImage_FileOffMask.bmp"
	[0061.069] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.069] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.069] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.069] CloseHandle (hObject=0x98) returned 1
	[0061.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.boom")) returned 1
	[0061.070] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.070] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.070] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_High.jpg") returned 1
	[0061.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_High.jpg") returned 1
	[0061.070] lstrcmpiA (lpString1="", lpString2="AlertImage_High.jpg") returned -1
	[0061.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="AlertImage_FileOffMask.bmp"
	[0061.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.071] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg"
	[0061.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.zip") returned 0
	[0061.071] lstrlenA (lpString="*.zip") returned 5
	[0061.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.rar") returned 0
	[0061.071] lstrlenA (lpString="*.rar") returned 5
	[0061.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.7z") returned 0
	[0061.071] lstrlenA (lpString="*.7z") returned 4
	[0061.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.tar") returned 0
	[0061.071] lstrlenA (lpString="*.tar") returned 5
	[0061.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.gzip") returned 0
	[0061.071] lstrlenA (lpString="*.gzip") returned 6
	[0061.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.jpg") returned 1
	[0061.071] lstrlenA (lpString="*.jpg") returned 5
	[0061.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg"
	[0061.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg"
	[0061.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg."
	[0061.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.Boom"
	[0061.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.072] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca
	[0061.072] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2b7f600, dwHighDateTime=0x1c95f2a), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2b7f600, dwHighDateTime=0x1c95f2a)) returned 1
	[0061.072] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.072] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x13a7, lpOverlapped=0x0) returned 1
	[0061.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="AlertImage_High.jpg"
	[0061.077] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.078] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x13a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x13a7, lpOverlapped=0x0) returned 1
	[0061.078] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.078] CloseHandle (hObject=0x98) returned 1
	[0061.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.boom")) returned 1
	[0061.079] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.079] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.079] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_HighMask.bmp") returned 1
	[0061.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_HighMask.bmp") returned 1
	[0061.079] lstrcmpiA (lpString1="", lpString2="AlertImage_HighMask.bmp") returned -1
	[0061.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="AlertImage_High.jpg"
	[0061.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.079] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.079] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_HighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp"
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.zip") returned 0
	[0061.079] lstrlenA (lpString="*.zip") returned 5
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.rar") returned 0
	[0061.079] lstrlenA (lpString="*.rar") returned 5
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.7z") returned 0
	[0061.079] lstrlenA (lpString="*.7z") returned 4
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.tar") returned 0
	[0061.079] lstrlenA (lpString="*.tar") returned 5
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.gzip") returned 0
	[0061.079] lstrlenA (lpString="*.gzip") returned 6
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.jpg") returned 0
	[0061.079] lstrlenA (lpString="*.jpg") returned 5
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.079] lstrlenA (lpString="*.jpeg") returned 6
	[0061.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.psd") returned 0
	[0061.079] lstrlenA (lpString="*.psd") returned 5
	[0061.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.cdr") returned 0
	[0061.080] lstrlenA (lpString="*.cdr") returned 5
	[0061.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.dwg") returned 0
	[0061.080] lstrlenA (lpString="*.dwg") returned 5
	[0061.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.max") returned 0
	[0061.080] lstrlenA (lpString="*.max") returned 5
	[0061.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.bmp") returned 1
	[0061.080] lstrlenA (lpString="*.bmp") returned 5
	[0061.080] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp"
	[0061.080] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp"
	[0061.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp."
	[0061.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.Boom"
	[0061.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.080] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e
	[0061.080] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe3177400, dwHighDateTime=0x1c95f2a), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe3177400, dwHighDateTime=0x1c95f2a)) returned 1
	[0061.080] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.080] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="AlertImage_HighMask.bmp"
	[0061.089] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.089] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.089] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.089] CloseHandle (hObject=0x98) returned 1
	[0061.089] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.boom")) returned 1
	[0061.090] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.090] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.090] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_Medium.jpg") returned 1
	[0061.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Medium.jpg") returned 1
	[0061.090] lstrcmpiA (lpString1="", lpString2="AlertImage_Medium.jpg") returned -1
	[0061.090] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="AlertImage_HighMask.bmp"
	[0061.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.090] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.091] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg"
	[0061.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.zip") returned 0
	[0061.091] lstrlenA (lpString="*.zip") returned 5
	[0061.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.rar") returned 0
	[0061.091] lstrlenA (lpString="*.rar") returned 5
	[0061.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.7z") returned 0
	[0061.091] lstrlenA (lpString="*.7z") returned 4
	[0061.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.tar") returned 0
	[0061.091] lstrlenA (lpString="*.tar") returned 5
	[0061.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.gzip") returned 0
	[0061.091] lstrlenA (lpString="*.gzip") returned 6
	[0061.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.jpg") returned 1
	[0061.091] lstrlenA (lpString="*.jpg") returned 5
	[0061.091] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg"
	[0061.091] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg"
	[0061.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg."
	[0061.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.Boom"
	[0061.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.092] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41de
	[0061.092] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xefeaa500, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xefeaa500, dwHighDateTime=0x1c95fc8)) returned 1
	[0061.092] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.092] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x41bb, lpOverlapped=0x0) returned 1
	[0061.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="AlertImage_Medium.jpg"
	[0061.115] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.115] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x41bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x41bb, lpOverlapped=0x0) returned 1
	[0061.115] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.115] CloseHandle (hObject=0x98) returned 1
	[0061.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.boom")) returned 1
	[0061.116] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.116] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.116] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_MediumMAsk.bmp") returned 1
	[0061.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_MediumMAsk.bmp") returned 1
	[0061.117] lstrcmpiA (lpString1="", lpString2="AlertImage_MediumMAsk.bmp") returned -1
	[0061.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="AlertImage_Medium.jpg"
	[0061.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.117] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.117] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_MediumMAsk.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp"
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.zip") returned 0
	[0061.117] lstrlenA (lpString="*.zip") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.rar") returned 0
	[0061.117] lstrlenA (lpString="*.rar") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.7z") returned 0
	[0061.117] lstrlenA (lpString="*.7z") returned 4
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.tar") returned 0
	[0061.117] lstrlenA (lpString="*.tar") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.gzip") returned 0
	[0061.117] lstrlenA (lpString="*.gzip") returned 6
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.jpg") returned 0
	[0061.117] lstrlenA (lpString="*.jpg") returned 5
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.jpeg") returned 0
	[0061.117] lstrlenA (lpString="*.jpeg") returned 6
	[0061.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.psd") returned 0
	[0061.117] lstrlenA (lpString="*.psd") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.cdr") returned 0
	[0061.118] lstrlenA (lpString="*.cdr") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.dwg") returned 0
	[0061.118] lstrlenA (lpString="*.dwg") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.max") returned 0
	[0061.118] lstrlenA (lpString="*.max") returned 5
	[0061.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.bmp") returned 1
	[0061.118] lstrlenA (lpString="*.bmp") returned 5
	[0061.118] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp"
	[0061.118] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp"
	[0061.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp."
	[0061.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.Boom"
	[0061.118] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.118] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e
	[0061.118] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd34e6d00, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd34e6d00, dwHighDateTime=0x1c95fc8)) returned 1
	[0061.118] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.119] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="AlertImage_MediumMAsk.bmp"
	[0061.167] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.167] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.167] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.167] CloseHandle (hObject=0x98) returned 1
	[0061.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.boom")) returned 1
	[0061.168] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.168] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.168] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_Off.jpg") returned 1
	[0061.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Off.jpg") returned 1
	[0061.168] lstrcmpiA (lpString1="", lpString2="AlertImage_Off.jpg") returned -1
	[0061.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="AlertImage_MediumMAsk.bmp"
	[0061.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg"
	[0061.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.zip") returned 0
	[0061.168] lstrlenA (lpString="*.zip") returned 5
	[0061.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.rar") returned 0
	[0061.168] lstrlenA (lpString="*.rar") returned 5
	[0061.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.7z") returned 0
	[0061.168] lstrlenA (lpString="*.7z") returned 4
	[0061.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.tar") returned 0
	[0061.168] lstrlenA (lpString="*.tar") returned 5
	[0061.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.gzip") returned 0
	[0061.168] lstrlenA (lpString="*.gzip") returned 6
	[0061.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.jpg") returned 1
	[0061.168] lstrlenA (lpString="*.jpg") returned 5
	[0061.168] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg"
	[0061.168] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg"
	[0061.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg."
	[0061.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.Boom"
	[0061.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.169] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e78
	[0061.169] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3e983f00, dwHighDateTime=0x1c95fc9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3e983f00, dwHighDateTime=0x1c95fc9)) returned 1
	[0061.169] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.169] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3e55, lpOverlapped=0x0) returned 1
	[0061.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="AlertImage_Off.jpg"
	[0061.204] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.204] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3e55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3e55, lpOverlapped=0x0) returned 1
	[0061.204] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.204] CloseHandle (hObject=0x98) returned 1
	[0061.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.boom")) returned 1
	[0061.205] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.205] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.205] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_OffMask.bmp") returned 1
	[0061.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_OffMask.bmp") returned 1
	[0061.205] lstrcmpiA (lpString1="", lpString2="AlertImage_OffMask.bmp") returned -1
	[0061.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="AlertImage_Off.jpg"
	[0061.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_OffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp"
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.zip") returned 0
	[0061.205] lstrlenA (lpString="*.zip") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.rar") returned 0
	[0061.205] lstrlenA (lpString="*.rar") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.7z") returned 0
	[0061.205] lstrlenA (lpString="*.7z") returned 4
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.tar") returned 0
	[0061.205] lstrlenA (lpString="*.tar") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.gzip") returned 0
	[0061.205] lstrlenA (lpString="*.gzip") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.jpg") returned 0
	[0061.205] lstrlenA (lpString="*.jpg") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.205] lstrlenA (lpString="*.jpeg") returned 6
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.psd") returned 0
	[0061.205] lstrlenA (lpString="*.psd") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.cdr") returned 0
	[0061.205] lstrlenA (lpString="*.cdr") returned 5
	[0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.dwg") returned 0
	[0061.205] lstrlenA (lpString="*.dwg") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.max") returned 0
	[0061.206] lstrlenA (lpString="*.max") returned 5
	[0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.bmp") returned 1
	[0061.206] lstrlenA (lpString="*.bmp") returned 5
	[0061.206] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp"
	[0061.206] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp"
	[0061.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp."
	[0061.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.Boom"
	[0061.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.207] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e
	[0061.207] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x258f8e00, dwHighDateTime=0x1c95fc9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5133d8d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x258f8e00, dwHighDateTime=0x1c95fc9)) returned 1
	[0061.207] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.207] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="AlertImage_OffMask.bmp"
	[0061.217] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.217] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1c4b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1c4b, lpOverlapped=0x0) returned 1
	[0061.218] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.218] CloseHandle (hObject=0x98) returned 1
	[0061.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.boom")) returned 1
	[0061.218] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.218] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.218] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImage.jpg") returned 1
	[0061.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImage.jpg") returned 1
	[0061.218] lstrcmpiA (lpString1="", lpString2="CommsIncomingImage.jpg") returned -1
	[0061.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="AlertImage_OffMask.bmp"
	[0061.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg"
	[0061.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.zip") returned 0
	[0061.219] lstrlenA (lpString="*.zip") returned 5
	[0061.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.rar") returned 0
	[0061.219] lstrlenA (lpString="*.rar") returned 5
	[0061.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.7z") returned 0
	[0061.219] lstrlenA (lpString="*.7z") returned 4
	[0061.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.tar") returned 0
	[0061.219] lstrlenA (lpString="*.tar") returned 5
	[0061.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.gzip") returned 0
	[0061.219] lstrlenA (lpString="*.gzip") returned 6
	[0061.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.jpg") returned 1
	[0061.219] lstrlenA (lpString="*.jpg") returned 5
	[0061.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg"
	[0061.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg"
	[0061.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg."
	[0061.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.Boom"
	[0061.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.224] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2256
	[0061.224] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfbb75100, dwHighDateTime=0x1c9bcb4), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfbb75100, dwHighDateTime=0x1c9bcb4)) returned 1
	[0061.224] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.224] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2233, lpOverlapped=0x0) returned 1
	[0061.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="CommsIncomingImage.jpg"
	[0061.235] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.235] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2233, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2233, lpOverlapped=0x0) returned 1
	[0061.236] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.236] CloseHandle (hObject=0x98) returned 1
	[0061.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.boom")) returned 1
	[0061.236] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.236] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.237] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImageMask.bmp") returned 1
	[0061.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageMask.bmp") returned 1
	[0061.237] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageMask.bmp") returned -1
	[0061.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="CommsIncomingImage.jpg"
	[0061.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.237] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp"
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.zip") returned 0
	[0061.237] lstrlenA (lpString="*.zip") returned 5
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.rar") returned 0
	[0061.237] lstrlenA (lpString="*.rar") returned 5
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.7z") returned 0
	[0061.237] lstrlenA (lpString="*.7z") returned 4
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.tar") returned 0
	[0061.237] lstrlenA (lpString="*.tar") returned 5
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.gzip") returned 0
	[0061.237] lstrlenA (lpString="*.gzip") returned 6
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.jpg") returned 0
	[0061.237] lstrlenA (lpString="*.jpg") returned 5
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.237] lstrlenA (lpString="*.jpeg") returned 6
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.psd") returned 0
	[0061.237] lstrlenA (lpString="*.psd") returned 5
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.cdr") returned 0
	[0061.237] lstrlenA (lpString="*.cdr") returned 5
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.dwg") returned 0
	[0061.237] lstrlenA (lpString="*.dwg") returned 5
	[0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.max") returned 0
	[0061.238] lstrlenA (lpString="*.max") returned 5
	[0061.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.bmp") returned 1
	[0061.238] lstrlenA (lpString="*.bmp") returned 5
	[0061.238] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp"
	[0061.238] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp"
	[0061.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp."
	[0061.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.Boom"
	[0061.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.238] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d8
	[0061.238] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1d183d00, dwHighDateTime=0x1c9bcb5), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1d183d00, dwHighDateTime=0x1c9bcb5)) returned 1
	[0061.238] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.238] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9b5, lpOverlapped=0x0) returned 1
	[0061.256] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="CommsIncomingImageMask.bmp"
	[0061.256] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.256] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9b5, lpOverlapped=0x0) returned 1
	[0061.256] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.256] CloseHandle (hObject=0x98) returned 1
	[0061.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.boom")) returned 1
	[0061.258] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.258] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.258] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImageMaskSmall.bmp") returned 1
	[0061.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageMaskSmall.bmp") returned 1
	[0061.258] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageMaskSmall.bmp") returned -1
	[0061.258] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="CommsIncomingImageMask.bmp"
	[0061.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.258] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.259] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp"
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.zip") returned 0
	[0061.259] lstrlenA (lpString="*.zip") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.rar") returned 0
	[0061.259] lstrlenA (lpString="*.rar") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.7z") returned 0
	[0061.259] lstrlenA (lpString="*.7z") returned 4
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.tar") returned 0
	[0061.259] lstrlenA (lpString="*.tar") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.gzip") returned 0
	[0061.259] lstrlenA (lpString="*.gzip") returned 6
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.jpg") returned 0
	[0061.259] lstrlenA (lpString="*.jpg") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.jpeg") returned 0
	[0061.259] lstrlenA (lpString="*.jpeg") returned 6
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.psd") returned 0
	[0061.259] lstrlenA (lpString="*.psd") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.cdr") returned 0
	[0061.259] lstrlenA (lpString="*.cdr") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.dwg") returned 0
	[0061.259] lstrlenA (lpString="*.dwg") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.max") returned 0
	[0061.259] lstrlenA (lpString="*.max") returned 5
	[0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.bmp") returned 1
	[0061.259] lstrlenA (lpString="*.bmp") returned 5
	[0061.259] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp"
	[0061.259] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp"
	[0061.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp."
	[0061.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.Boom"
	[0061.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.261] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x630
	[0061.261] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1
	[0061.261] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.261] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x60d, lpOverlapped=0x0) returned 1
	[0061.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="CommsIncomingImageMaskSmall.bmp"
	[0061.273] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.273] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x60d, lpOverlapped=0x0) returned 1
	[0061.274] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.274] CloseHandle (hObject=0x98) returned 1
	[0061.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.boom")) returned 1
	[0061.274] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.274] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImageSmall.jpg") returned 1
	[0061.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageSmall.jpg") returned 1
	[0061.274] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageSmall.jpg") returned -1
	[0061.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="CommsIncomingImageMaskSmall.bmp"
	[0061.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.275] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.275] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg"
	[0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.zip") returned 0
	[0061.275] lstrlenA (lpString="*.zip") returned 5
	[0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.rar") returned 0
	[0061.275] lstrlenA (lpString="*.rar") returned 5
	[0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.7z") returned 0
	[0061.275] lstrlenA (lpString="*.7z") returned 4
	[0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.tar") returned 0
	[0061.275] lstrlenA (lpString="*.tar") returned 5
	[0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.gzip") returned 0
	[0061.275] lstrlenA (lpString="*.gzip") returned 6
	[0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.jpg") returned 1
	[0061.275] lstrlenA (lpString="*.jpg") returned 5
	[0061.275] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg"
	[0061.275] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg"
	[0061.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg."
	[0061.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.Boom"
	[0061.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.275] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1de3
	[0061.276] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1
	[0061.276] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.276] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1dc0, lpOverlapped=0x0) returned 1
	[0061.282] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="CommsIncomingImageSmall.jpg"
	[0061.282] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.282] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1dc0, lpOverlapped=0x0) returned 1
	[0061.282] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.282] CloseHandle (hObject=0x98) returned 1
	[0061.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.boom")) returned 1
	[0061.283] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.283] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.283] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImage.jpg") returned 1
	[0061.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImage.jpg") returned 1
	[0061.283] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImage.jpg") returned -1
	[0061.283] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="CommsIncomingImageSmall.jpg"
	[0061.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.283] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg"
	[0061.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.zip") returned 0
	[0061.283] lstrlenA (lpString="*.zip") returned 5
	[0061.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.rar") returned 0
	[0061.283] lstrlenA (lpString="*.rar") returned 5
	[0061.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.7z") returned 0
	[0061.283] lstrlenA (lpString="*.7z") returned 4
	[0061.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.tar") returned 0
	[0061.283] lstrlenA (lpString="*.tar") returned 5
	[0061.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.gzip") returned 0
	[0061.283] lstrlenA (lpString="*.gzip") returned 6
	[0061.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.jpg") returned 1
	[0061.283] lstrlenA (lpString="*.jpg") returned 5
	[0061.283] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg"
	[0061.283] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg"
	[0061.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg."
	[0061.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.Boom"
	[0061.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.284] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22c0
	[0061.284] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5c468e00, dwHighDateTime=0x1c9bcb5), lpLastAccessTime=0x407536*(dwLowDateTime=0x6041aaf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5c468e00, dwHighDateTime=0x1c9bcb5)) returned 1
	[0061.285] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.285] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x229d, lpOverlapped=0x0) returned 1
	[0061.340] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="CommsOutgoingImage.jpg"
	[0061.340] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.340] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x229d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x229d, lpOverlapped=0x0) returned 1
	[0061.340] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.340] CloseHandle (hObject=0x98) returned 1
	[0061.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.boom")) returned 1
	[0061.341] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.341] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.341] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImageMask.bmp") returned 1
	[0061.341] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageMask.bmp") returned 1
	[0061.341] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageMask.bmp") returned -1
	[0061.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="CommsOutgoingImage.jpg"
	[0061.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.341] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.341] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp"
	[0061.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.zip") returned 0
	[0061.341] lstrlenA (lpString="*.zip") returned 5
	[0061.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.rar") returned 0
	[0061.341] lstrlenA (lpString="*.rar") returned 5
	[0061.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.7z") returned 0
	[0061.342] lstrlenA (lpString="*.7z") returned 4
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.tar") returned 0
	[0061.342] lstrlenA (lpString="*.tar") returned 5
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.gzip") returned 0
	[0061.342] lstrlenA (lpString="*.gzip") returned 6
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.jpg") returned 0
	[0061.342] lstrlenA (lpString="*.jpg") returned 5
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.342] lstrlenA (lpString="*.jpeg") returned 6
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.psd") returned 0
	[0061.342] lstrlenA (lpString="*.psd") returned 5
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.cdr") returned 0
	[0061.342] lstrlenA (lpString="*.cdr") returned 5
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.dwg") returned 0
	[0061.342] lstrlenA (lpString="*.dwg") returned 5
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.max") returned 0
	[0061.342] lstrlenA (lpString="*.max") returned 5
	[0061.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.bmp") returned 1
	[0061.342] lstrlenA (lpString="*.bmp") returned 5
	[0061.342] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp"
	[0061.342] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp"
	[0061.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp."
	[0061.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.Boom"
	[0061.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.343] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d8
	[0061.343] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bf59600, dwHighDateTime=0x1c9bcb5), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bf59600, dwHighDateTime=0x1c9bcb5)) returned 1
	[0061.343] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.343] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9b5, lpOverlapped=0x0) returned 1
	[0061.365] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="CommsOutgoingImageMask.bmp"
	[0061.365] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.365] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9b5, lpOverlapped=0x0) returned 1
	[0061.365] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.365] CloseHandle (hObject=0x98) returned 1
	[0061.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.boom")) returned 1
	[0061.367] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.367] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.367] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImageMaskSmall.bmp") returned 1
	[0061.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageMaskSmall.bmp") returned 1
	[0061.367] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageMaskSmall.bmp") returned -1
	[0061.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="CommsOutgoingImageMask.bmp"
	[0061.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.367] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp"
	[0061.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.zip") returned 0
	[0061.368] lstrlenA (lpString="*.zip") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.rar") returned 0
	[0061.368] lstrlenA (lpString="*.rar") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.7z") returned 0
	[0061.368] lstrlenA (lpString="*.7z") returned 4
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.tar") returned 0
	[0061.368] lstrlenA (lpString="*.tar") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.gzip") returned 0
	[0061.368] lstrlenA (lpString="*.gzip") returned 6
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.jpg") returned 0
	[0061.368] lstrlenA (lpString="*.jpg") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.jpeg") returned 0
	[0061.368] lstrlenA (lpString="*.jpeg") returned 6
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.psd") returned 0
	[0061.368] lstrlenA (lpString="*.psd") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.cdr") returned 0
	[0061.368] lstrlenA (lpString="*.cdr") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.dwg") returned 0
	[0061.368] lstrlenA (lpString="*.dwg") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.max") returned 0
	[0061.368] lstrlenA (lpString="*.max") returned 5
	[0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.bmp") returned 1
	[0061.368] lstrlenA (lpString="*.bmp") returned 5
	[0061.368] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp"
	[0061.368] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp"
	[0061.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp."
	[0061.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.Boom"
	[0061.368] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.369] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x630
	[0061.369] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1
	[0061.369] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.369] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x60d, lpOverlapped=0x0) returned 1
	[0061.389] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="CommsOutgoingImageMaskSmall.bmp"
	[0061.389] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.389] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x60d, lpOverlapped=0x0) returned 1
	[0061.389] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.389] CloseHandle (hObject=0x98) returned 1
	[0061.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.boom")) returned 1
	[0061.390] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.390] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.390] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImageSmall.jpg") returned 1
	[0061.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageSmall.jpg") returned 1
	[0061.390] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageSmall.jpg") returned -1
	[0061.390] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="CommsOutgoingImageMaskSmall.bmp"
	[0061.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg"
	[0061.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.zip") returned 0
	[0061.391] lstrlenA (lpString="*.zip") returned 5
	[0061.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.rar") returned 0
	[0061.391] lstrlenA (lpString="*.rar") returned 5
	[0061.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.7z") returned 0
	[0061.391] lstrlenA (lpString="*.7z") returned 4
	[0061.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.tar") returned 0
	[0061.391] lstrlenA (lpString="*.tar") returned 5
	[0061.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.gzip") returned 0
	[0061.391] lstrlenA (lpString="*.gzip") returned 6
	[0061.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.jpg") returned 1
	[0061.392] lstrlenA (lpString="*.jpg") returned 5
	[0061.393] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg"
	[0061.393] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg"
	[0061.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg."
	[0061.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.Boom"
	[0061.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.393] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dd7
	[0061.393] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1
	[0061.393] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.393] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1db4, lpOverlapped=0x0) returned 1
	[0061.415] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="CommsOutgoingImageSmall.jpg"
	[0061.415] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.415] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1db4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1db4, lpOverlapped=0x0) returned 1
	[0061.415] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.415] CloseHandle (hObject=0x98) returned 1
	[0061.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.boom")) returned 1
	[0061.416] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.416] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageBoxIconImages.jpg") returned -1
	[0061.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageBoxIconImages.jpg") returned -1
	[0061.416] lstrcmpiA (lpString1="", lpString2="MessageBoxIconImages.jpg") returned -1
	[0061.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="CommsOutgoingImageSmall.jpg"
	[0061.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.417] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg"
	[0061.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.zip") returned 0
	[0061.417] lstrlenA (lpString="*.zip") returned 5
	[0061.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.rar") returned 0
	[0061.417] lstrlenA (lpString="*.rar") returned 5
	[0061.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.7z") returned 0
	[0061.417] lstrlenA (lpString="*.7z") returned 4
	[0061.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.tar") returned 0
	[0061.417] lstrlenA (lpString="*.tar") returned 5
	[0061.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.gzip") returned 0
	[0061.417] lstrlenA (lpString="*.gzip") returned 6
	[0061.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.jpg") returned 1
	[0061.417] lstrlenA (lpString="*.jpg") returned 5
	[0061.417] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg"
	[0061.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg"
	[0061.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg."
	[0061.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.Boom"
	[0061.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.418] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2798
	[0061.418] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1
	[0061.418] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.418] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2775, lpOverlapped=0x0) returned 1
	[0061.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="MessageBoxIconImages.jpg"
	[0061.433] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.433] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2775, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2775, lpOverlapped=0x0) returned 1
	[0061.433] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.433] CloseHandle (hObject=0x98) returned 1
	[0061.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.boom")) returned 1
	[0061.435] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.435] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.435] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageBoxIconImagesMask.bmp") returned -1
	[0061.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageBoxIconImagesMask.bmp") returned -1
	[0061.435] lstrcmpiA (lpString1="", lpString2="MessageBoxIconImagesMask.bmp") returned -1
	[0061.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="MessageBoxIconImages.jpg"
	[0061.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.435] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="MessageBoxIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp"
	[0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0061.435] lstrlenA (lpString="*.zip") returned 5
	[0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0061.435] lstrlenA (lpString="*.rar") returned 5
	[0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0061.435] lstrlenA (lpString="*.7z") returned 4
	[0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0061.435] lstrlenA (lpString="*.tar") returned 5
	[0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0061.435] lstrlenA (lpString="*.gzip") returned 6
	[0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0061.435] lstrlenA (lpString="*.jpg") returned 5
	[0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.435] lstrlenA (lpString="*.jpeg") returned 6
	[0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0061.436] lstrlenA (lpString="*.psd") returned 5
	[0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0061.436] lstrlenA (lpString="*.cdr") returned 5
	[0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0061.436] lstrlenA (lpString="*.dwg") returned 5
	[0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0061.436] lstrlenA (lpString="*.max") returned 5
	[0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0061.436] lstrlenA (lpString="*.bmp") returned 5
	[0061.436] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp"
	[0061.436] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp"
	[0061.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp."
	[0061.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.Boom"
	[0061.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.437] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0
	[0061.437] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1
	[0061.437] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.437] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9d, lpOverlapped=0x0) returned 1
	[0061.439] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="MessageBoxIconImagesMask.bmp"
	[0061.440] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.440] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9d, lpOverlapped=0x0) returned 1
	[0061.440] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.440] CloseHandle (hObject=0x98) returned 1
	[0061.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.boom")) returned 1
	[0061.441] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.441] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.441] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnreadIcon.jpg") returned -1
	[0061.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIcon.jpg") returned -1
	[0061.441] lstrcmpiA (lpString1="", lpString2="UnreadIcon.jpg") returned -1
	[0061.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="MessageBoxIconImagesMask.bmp"
	[0061.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.441] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.441] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.441] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.441] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg"
	[0061.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.zip") returned 0
	[0061.441] lstrlenA (lpString="*.zip") returned 5
	[0061.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.rar") returned 0
	[0061.441] lstrlenA (lpString="*.rar") returned 5
	[0061.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.7z") returned 0
	[0061.441] lstrlenA (lpString="*.7z") returned 4
	[0061.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.tar") returned 0
	[0061.441] lstrlenA (lpString="*.tar") returned 5
	[0061.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.gzip") returned 0
	[0061.441] lstrlenA (lpString="*.gzip") returned 6
	[0061.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.jpg") returned 1
	[0061.441] lstrlenA (lpString="*.jpg") returned 5
	[0061.441] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg"
	[0061.442] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg"
	[0061.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg."
	[0061.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.Boom"
	[0061.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.512] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fec
	[0061.512] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6c135400, dwHighDateTime=0x1ca0330), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6c135400, dwHighDateTime=0x1ca0330)) returned 1
	[0061.512] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.513] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1fc9, lpOverlapped=0x0) returned 1
	[0061.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="UnreadIcon.jpg"
	[0061.535] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.535] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1fc9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1fc9, lpOverlapped=0x0) returned 1
	[0061.535] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.535] CloseHandle (hObject=0x98) returned 1
	[0061.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.boom")) returned 1
	[0061.536] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.536] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.536] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnreadIconImages.jpg") returned -1
	[0061.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIconImages.jpg") returned -1
	[0061.536] lstrcmpiA (lpString1="", lpString2="UnreadIconImages.jpg") returned -1
	[0061.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="UnreadIcon.jpg"
	[0061.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.536] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg"
	[0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.zip") returned 0
	[0061.536] lstrlenA (lpString="*.zip") returned 5
	[0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.rar") returned 0
	[0061.536] lstrlenA (lpString="*.rar") returned 5
	[0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.7z") returned 0
	[0061.536] lstrlenA (lpString="*.7z") returned 4
	[0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.tar") returned 0
	[0061.536] lstrlenA (lpString="*.tar") returned 5
	[0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.gzip") returned 0
	[0061.536] lstrlenA (lpString="*.gzip") returned 6
	[0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.jpg") returned 1
	[0061.536] lstrlenA (lpString="*.jpg") returned 5
	[0061.536] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg"
	[0061.536] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg"
	[0061.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg."
	[0061.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.Boom"
	[0061.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.554] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ffe
	[0061.554] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb98fc100, dwHighDateTime=0x1ca0330), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb98fc100, dwHighDateTime=0x1ca0330)) returned 1
	[0061.554] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.554] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1fdb, lpOverlapped=0x0) returned 1
	[0061.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="UnreadIconImages.jpg"
	[0061.577] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.577] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1fdb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1fdb, lpOverlapped=0x0) returned 1
	[0061.577] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.577] CloseHandle (hObject=0x98) returned 1
	[0061.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.boom")) returned 1
	[0061.578] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.578] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.578] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnreadIconImagesMask.bmp") returned -1
	[0061.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIconImagesMask.bmp") returned -1
	[0061.578] lstrcmpiA (lpString1="", lpString2="UnreadIconImagesMask.bmp") returned -1
	[0061.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="UnreadIconImages.jpg"
	[0061.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\"
	[0061.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned=""
	[0061.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt"
	[0061.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20
	[0061.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp"
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0061.579] lstrlenA (lpString="*.zip") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0061.579] lstrlenA (lpString="*.rar") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0061.579] lstrlenA (lpString="*.7z") returned 4
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0061.579] lstrlenA (lpString="*.tar") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0061.579] lstrlenA (lpString="*.gzip") returned 6
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0061.579] lstrlenA (lpString="*.jpg") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.579] lstrlenA (lpString="*.jpeg") returned 6
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0061.579] lstrlenA (lpString="*.psd") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0061.579] lstrlenA (lpString="*.cdr") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0061.579] lstrlenA (lpString="*.dwg") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0061.579] lstrlenA (lpString="*.max") returned 5
	[0061.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0061.579] lstrlenA (lpString="*.bmp") returned 5
	[0061.579] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp"
	[0061.579] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp"
	[0061.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp."
	[0061.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.Boom"
	[0061.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.580] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a4
	[0061.580] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb90c2000, dwHighDateTime=0x1ca035a), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb90c2000, dwHighDateTime=0x1ca035a)) returned 1
	[0061.580] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.580] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x581, lpOverlapped=0x0) returned 1
	[0061.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="UnreadIconImagesMask.bmp"
	[0061.608] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.608] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x581, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x581, lpOverlapped=0x0) returned 1
	[0061.608] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.608] CloseHandle (hObject=0x98) returned 1
	[0061.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.boom")) returned 1
	[0061.609] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0061.609] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0061.609] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0061.609] lstrcmpA (lpString1=".", lpString2="Computers") returned -1
	[0061.609] lstrcmpA (lpString1="..", lpString2="Computers") returned -1
	[0061.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0061.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Computers" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers"
	[0061.609] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned 79
	[0061.609] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0061.609] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.609] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.609] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.609] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.609] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.609] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.609] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="computericon.jpg") returned 1
	[0061.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="computericon.jpg") returned 1
	[0061.609] lstrcmpiA (lpString1="", lpString2="computericon.jpg") returned -1
	[0061.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*") returned="*.*"
	[0061.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\"
	[0061.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned=""
	[0061.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt"
	[0061.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\how to decrypt files.txt")) returned 0xffffffff
	[0061.609] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.612] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0061.612] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0061.613] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.613] CloseHandle (hObject=0x98) returned 1
	[0061.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg"
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.zip") returned 0
	[0061.613] lstrlenA (lpString="*.zip") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.rar") returned 0
	[0061.613] lstrlenA (lpString="*.rar") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.7z") returned 0
	[0061.613] lstrlenA (lpString="*.7z") returned 4
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.tar") returned 0
	[0061.613] lstrlenA (lpString="*.tar") returned 5
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.gzip") returned 0
	[0061.613] lstrlenA (lpString="*.gzip") returned 6
	[0061.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.jpg") returned 1
	[0061.613] lstrlenA (lpString="*.jpg") returned 5
	[0061.613] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg"
	[0061.613] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg"
	[0061.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg."
	[0061.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.Boom"
	[0061.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.614] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1b
	[0061.614] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60440c50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1
	[0061.614] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.614] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xdf8, lpOverlapped=0x0) returned 1
	[0061.643] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="computericon.jpg"
	[0061.643] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.643] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xdf8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xdf8, lpOverlapped=0x0) returned 1
	[0061.643] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.643] CloseHandle (hObject=0x98) returned 1
	[0061.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.boom")) returned 1
	[0061.644] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.644] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.644] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="computericonMask.bmp") returned 1
	[0061.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="computericonMask.bmp") returned 1
	[0061.644] lstrcmpiA (lpString1="", lpString2="computericonMask.bmp") returned -1
	[0061.644] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="computericon.jpg"
	[0061.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\"
	[0061.644] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned=""
	[0061.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt"
	[0061.644] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\how to decrypt files.txt")) returned 0x20
	[0061.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="computericonMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp"
	[0061.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.zip") returned 0
	[0061.644] lstrlenA (lpString="*.zip") returned 5
	[0061.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.rar") returned 0
	[0061.645] lstrlenA (lpString="*.rar") returned 5
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.7z") returned 0
	[0061.645] lstrlenA (lpString="*.7z") returned 4
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.tar") returned 0
	[0061.645] lstrlenA (lpString="*.tar") returned 5
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.gzip") returned 0
	[0061.645] lstrlenA (lpString="*.gzip") returned 6
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.jpg") returned 0
	[0061.645] lstrlenA (lpString="*.jpg") returned 5
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.645] lstrlenA (lpString="*.jpeg") returned 6
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.psd") returned 0
	[0061.645] lstrlenA (lpString="*.psd") returned 5
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.cdr") returned 0
	[0061.645] lstrlenA (lpString="*.cdr") returned 5
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.dwg") returned 0
	[0061.645] lstrlenA (lpString="*.dwg") returned 5
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.max") returned 0
	[0061.645] lstrlenA (lpString="*.max") returned 5
	[0061.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.bmp") returned 1
	[0061.645] lstrlenA (lpString="*.bmp") returned 5
	[0061.645] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp"
	[0061.645] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp"
	[0061.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp."
	[0061.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.Boom"
	[0061.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.645] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838
	[0061.645] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1
	[0061.645] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.646] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x815, lpOverlapped=0x0) returned 1
	[0061.657] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="computericonMask.bmp"
	[0061.657] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.657] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x815, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x815, lpOverlapped=0x0) returned 1
	[0061.657] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.657] CloseHandle (hObject=0x98) returned 1
	[0061.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.boom")) returned 1
	[0061.658] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0061.658] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0061.658] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0061.658] lstrcmpA (lpString1=".", lpString2="Discussion") returned -1
	[0061.658] lstrcmpA (lpString1="..", lpString2="Discussion") returned -1
	[0061.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0061.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Discussion" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion"
	[0061.658] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned 80
	[0061.658] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0061.658] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.658] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.658] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.658] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.658] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.658] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.658] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImages.jpg") returned 1
	[0061.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImages.jpg") returned 1
	[0061.658] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImages.jpg") returned -1
	[0061.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*") returned="*.*"
	[0061.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\"
	[0061.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned=""
	[0061.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt"
	[0061.658] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\how to decrypt files.txt")) returned 0xffffffff
	[0061.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.660] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0061.660] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0061.661] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.661] CloseHandle (hObject=0x98) returned 1
	[0061.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg"
	[0061.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.zip") returned 0
	[0061.661] lstrlenA (lpString="*.zip") returned 5
	[0061.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.rar") returned 0
	[0061.661] lstrlenA (lpString="*.rar") returned 5
	[0061.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.7z") returned 0
	[0061.661] lstrlenA (lpString="*.7z") returned 4
	[0061.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.tar") returned 0
	[0061.661] lstrlenA (lpString="*.tar") returned 5
	[0061.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.gzip") returned 0
	[0061.662] lstrlenA (lpString="*.gzip") returned 6
	[0061.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.jpg") returned 1
	[0061.662] lstrlenA (lpString="*.jpg") returned 5
	[0061.662] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg"
	[0061.662] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg"
	[0061.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg."
	[0061.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.Boom"
	[0061.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.687] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x393c
	[0061.687] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0009600, dwHighDateTime=0x1ca0588), lpLastAccessTime=0x407536*(dwLowDateTime=0x51e19d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb0009600, dwHighDateTime=0x1ca0588)) returned 1
	[0061.687] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.687] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3919, lpOverlapped=0x0) returned 1
	[0061.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg"
	[0061.695] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.695] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3919, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3919, lpOverlapped=0x0) returned 1
	[0061.695] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.695] CloseHandle (hObject=0x98) returned 1
	[0061.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.boom")) returned 1
	[0061.702] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.702] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.702] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImagesMask.bmp") returned 1
	[0061.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1
	[0061.702] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImagesMask.bmp") returned -1
	[0061.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg"
	[0061.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\"
	[0061.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned=""
	[0061.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt"
	[0061.703] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\how to decrypt files.txt")) returned 0x20
	[0061.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp"
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0061.703] lstrlenA (lpString="*.zip") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0061.703] lstrlenA (lpString="*.rar") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0061.703] lstrlenA (lpString="*.7z") returned 4
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0061.703] lstrlenA (lpString="*.tar") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0061.703] lstrlenA (lpString="*.gzip") returned 6
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0061.703] lstrlenA (lpString="*.jpg") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.703] lstrlenA (lpString="*.jpeg") returned 6
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0061.703] lstrlenA (lpString="*.psd") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0061.703] lstrlenA (lpString="*.cdr") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0061.703] lstrlenA (lpString="*.dwg") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0061.703] lstrlenA (lpString="*.max") returned 5
	[0061.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0061.703] lstrlenA (lpString="*.bmp") returned 5
	[0061.704] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp"
	[0061.704] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp"
	[0061.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp."
	[0061.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.Boom"
	[0061.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.704] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1738
	[0061.704] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9ac9e00, dwHighDateTime=0x1ca033a), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9ac9e00, dwHighDateTime=0x1ca033a)) returned 1
	[0061.704] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.704] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1715, lpOverlapped=0x0) returned 1
	[0061.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="DiscussionToolIconImagesMask.bmp"
	[0061.733] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.733] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1715, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1715, lpOverlapped=0x0) returned 1
	[0061.733] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.733] CloseHandle (hObject=0x98) returned 1
	[0061.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.boom")) returned 1
	[0061.734] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0061.734] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0061.734] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0061.734] lstrcmpA (lpString1=".", lpString2="DocumentShare") returned -1
	[0061.734] lstrcmpA (lpString1="..", lpString2="DocumentShare") returned -1
	[0061.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0061.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="DocumentShare" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare"
	[0061.735] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned 83
	[0061.735] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0061.736] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.736] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.736] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.736] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.736] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.736] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1
	[0061.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1
	[0061.736] lstrcmpiA (lpString1="", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1
	[0061.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*") returned="*.*"
	[0061.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\"
	[0061.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned=""
	[0061.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt"
	[0061.736] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\how to decrypt files.txt")) returned 0xffffffff
	[0061.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.737] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0061.737] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0061.738] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.738] CloseHandle (hObject=0x98) returned 1
	[0061.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", lpString2="WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg"
	[0061.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.zip") returned 0
	[0061.738] lstrlenA (lpString="*.zip") returned 5
	[0061.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.rar") returned 0
	[0061.738] lstrlenA (lpString="*.rar") returned 5
	[0061.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.7z") returned 0
	[0061.738] lstrlenA (lpString="*.7z") returned 4
	[0061.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.tar") returned 0
	[0061.738] lstrlenA (lpString="*.tar") returned 5
	[0061.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.gzip") returned 0
	[0061.738] lstrlenA (lpString="*.gzip") returned 6
	[0061.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.jpg") returned 1
	[0061.738] lstrlenA (lpString="*.jpg") returned 5
	[0061.738] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg"
	[0061.738] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg"
	[0061.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg."
	[0061.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.Boom"
	[0061.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.740] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xab11
	[0061.740] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x709f1ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1
	[0061.740] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.740] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xaaee, lpOverlapped=0x0) returned 1
	[0061.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="WSSFilesToolHomePageBackground.jpg"
	[0061.742] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.742] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xaaee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xaaee, lpOverlapped=0x0) returned 1
	[0061.742] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.745] CloseHandle (hObject=0x98) returned 1
	[0061.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.boom")) returned 1
	[0061.745] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0061.745] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0061.745] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0061.745] lstrcmpA (lpString1=".", lpString2="GrooveDocumentReview") returned -1
	[0061.745] lstrcmpA (lpString1="..", lpString2="GrooveDocumentReview") returned -1
	[0061.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0061.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveDocumentReview" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview"
	[0061.746] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned 90
	[0061.746] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0061.769] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0061.769] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.769] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0061.769] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0061.769] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.769] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ActiveTabImage.jpg") returned 1
	[0061.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ActiveTabImage.jpg") returned 1
	[0061.769] lstrcmpiA (lpString1="", lpString2="ActiveTabImage.jpg") returned -1
	[0061.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*") returned="*.*"
	[0061.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\"
	[0061.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned=""
	[0061.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt"
	[0061.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0xffffffff
	[0061.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.777] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0061.777] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0061.778] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0061.778] CloseHandle (hObject=0x98) returned 1
	[0061.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg"
	[0061.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.zip") returned 0
	[0061.778] lstrlenA (lpString="*.zip") returned 5
	[0061.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.rar") returned 0
	[0061.778] lstrlenA (lpString="*.rar") returned 5
	[0061.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.7z") returned 0
	[0061.778] lstrlenA (lpString="*.7z") returned 4
	[0061.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.tar") returned 0
	[0061.778] lstrlenA (lpString="*.tar") returned 5
	[0061.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.gzip") returned 0
	[0061.778] lstrlenA (lpString="*.gzip") returned 6
	[0061.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.jpg") returned 1
	[0061.779] lstrlenA (lpString="*.jpg") returned 5
	[0061.779] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg"
	[0061.779] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg"
	[0061.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg."
	[0061.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.Boom"
	[0061.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.779] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2519
	[0061.779] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51174850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1
	[0061.779] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.779] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24f6, lpOverlapped=0x0) returned 1
	[0061.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="ActiveTabImage.jpg"
	[0061.799] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.799] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24f6, lpOverlapped=0x0) returned 1
	[0061.799] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.799] CloseHandle (hObject=0x98) returned 1
	[0061.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.boom")) returned 1
	[0061.800] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.800] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.800] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ActiveTabImageMask.bmp") returned 1
	[0061.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ActiveTabImageMask.bmp") returned 1
	[0061.800] lstrcmpiA (lpString1="", lpString2="ActiveTabImageMask.bmp") returned -1
	[0061.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="ActiveTabImage.jpg"
	[0061.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\"
	[0061.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned=""
	[0061.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt"
	[0061.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20
	[0061.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="ActiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp"
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.zip") returned 0
	[0061.800] lstrlenA (lpString="*.zip") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.rar") returned 0
	[0061.800] lstrlenA (lpString="*.rar") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.7z") returned 0
	[0061.800] lstrlenA (lpString="*.7z") returned 4
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.tar") returned 0
	[0061.800] lstrlenA (lpString="*.tar") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.gzip") returned 0
	[0061.800] lstrlenA (lpString="*.gzip") returned 6
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.jpg") returned 0
	[0061.800] lstrlenA (lpString="*.jpg") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.800] lstrlenA (lpString="*.jpeg") returned 6
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.psd") returned 0
	[0061.800] lstrlenA (lpString="*.psd") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.cdr") returned 0
	[0061.800] lstrlenA (lpString="*.cdr") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.dwg") returned 0
	[0061.800] lstrlenA (lpString="*.dwg") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.max") returned 0
	[0061.800] lstrlenA (lpString="*.max") returned 5
	[0061.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.bmp") returned 1
	[0061.800] lstrlenA (lpString="*.bmp") returned 5
	[0061.800] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp"
	[0061.800] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp"
	[0061.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp."
	[0061.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.Boom"
	[0061.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.821] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca8
	[0061.821] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e9eb8f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1
	[0061.821] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.822] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc85, lpOverlapped=0x0) returned 1
	[0061.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="ActiveTabImageMask.bmp"
	[0061.847] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.847] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc85, lpOverlapped=0x0) returned 1
	[0061.847] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.847] CloseHandle (hObject=0x98) returned 1
	[0061.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.boom")) returned 1
	[0061.848] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.848] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BodyPaneBackground.jpg") returned 1
	[0061.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BodyPaneBackground.jpg") returned 1
	[0061.848] lstrcmpiA (lpString1="", lpString2="BodyPaneBackground.jpg") returned -1
	[0061.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="ActiveTabImageMask.bmp"
	[0061.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\"
	[0061.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned=""
	[0061.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt"
	[0061.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20
	[0061.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg"
	[0061.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.zip") returned 0
	[0061.848] lstrlenA (lpString="*.zip") returned 5
	[0061.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.rar") returned 0
	[0061.848] lstrlenA (lpString="*.rar") returned 5
	[0061.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.7z") returned 0
	[0061.849] lstrlenA (lpString="*.7z") returned 4
	[0061.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.tar") returned 0
	[0061.849] lstrlenA (lpString="*.tar") returned 5
	[0061.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.gzip") returned 0
	[0061.849] lstrlenA (lpString="*.gzip") returned 6
	[0061.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.jpg") returned 1
	[0061.849] lstrlenA (lpString="*.jpg") returned 5
	[0061.849] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg"
	[0061.849] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg"
	[0061.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg."
	[0061.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.Boom"
	[0061.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.849] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9bd
	[0061.849] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a15810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1
	[0061.849] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.849] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x99a, lpOverlapped=0x0) returned 1
	[0061.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="BodyPaneBackground.jpg"
	[0061.890] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.890] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x99a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x99a, lpOverlapped=0x0) returned 1
	[0061.890] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.890] CloseHandle (hObject=0x98) returned 1
	[0061.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.boom")) returned 1
	[0061.891] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.891] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.891] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InactiveTabImage.jpg") returned -1
	[0061.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InactiveTabImage.jpg") returned -1
	[0061.891] lstrcmpiA (lpString1="", lpString2="InactiveTabImage.jpg") returned -1
	[0061.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="BodyPaneBackground.jpg"
	[0061.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\"
	[0061.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned=""
	[0061.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt"
	[0061.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20
	[0061.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg"
	[0061.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.zip") returned 0
	[0061.891] lstrlenA (lpString="*.zip") returned 5
	[0061.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.rar") returned 0
	[0061.891] lstrlenA (lpString="*.rar") returned 5
	[0061.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.7z") returned 0
	[0061.892] lstrlenA (lpString="*.7z") returned 4
	[0061.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.tar") returned 0
	[0061.892] lstrlenA (lpString="*.tar") returned 5
	[0061.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.gzip") returned 0
	[0061.892] lstrlenA (lpString="*.gzip") returned 6
	[0061.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.jpg") returned 1
	[0061.892] lstrlenA (lpString="*.jpg") returned 5
	[0061.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg"
	[0061.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg"
	[0061.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg."
	[0061.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.Boom"
	[0061.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.893] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24ed
	[0061.893] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392d770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1
	[0061.893] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.893] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24ca, lpOverlapped=0x0) returned 1
	[0061.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="InactiveTabImage.jpg"
	[0061.911] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.911] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24ca, lpOverlapped=0x0) returned 1
	[0061.911] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.911] CloseHandle (hObject=0x98) returned 1
	[0061.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.boom")) returned 1
	[0061.912] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.912] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.912] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InactiveTabImageMask.bmp") returned -1
	[0061.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InactiveTabImageMask.bmp") returned -1
	[0061.912] lstrcmpiA (lpString1="", lpString2="InactiveTabImageMask.bmp") returned -1
	[0061.912] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="InactiveTabImage.jpg"
	[0061.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\"
	[0061.912] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned=""
	[0061.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt"
	[0061.912] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20
	[0061.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="InactiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp"
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.zip") returned 0
	[0061.912] lstrlenA (lpString="*.zip") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.rar") returned 0
	[0061.912] lstrlenA (lpString="*.rar") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.7z") returned 0
	[0061.912] lstrlenA (lpString="*.7z") returned 4
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.tar") returned 0
	[0061.912] lstrlenA (lpString="*.tar") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.gzip") returned 0
	[0061.912] lstrlenA (lpString="*.gzip") returned 6
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.jpg") returned 0
	[0061.912] lstrlenA (lpString="*.jpg") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.912] lstrlenA (lpString="*.jpeg") returned 6
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.psd") returned 0
	[0061.912] lstrlenA (lpString="*.psd") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.cdr") returned 0
	[0061.912] lstrlenA (lpString="*.cdr") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.dwg") returned 0
	[0061.912] lstrlenA (lpString="*.dwg") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.max") returned 0
	[0061.912] lstrlenA (lpString="*.max") returned 5
	[0061.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.bmp") returned 1
	[0061.913] lstrlenA (lpString="*.bmp") returned 5
	[0061.913] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp"
	[0061.913] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp"
	[0061.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp."
	[0061.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.Boom"
	[0061.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.914] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca8
	[0061.914] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1
	[0061.914] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.914] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc85, lpOverlapped=0x0) returned 1
	[0061.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="InactiveTabImageMask.bmp"
	[0061.940] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.940] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc85, lpOverlapped=0x0) returned 1
	[0061.940] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.940] CloseHandle (hObject=0x98) returned 1
	[0061.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.boom")) returned 1
	[0061.941] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.941] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.941] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MarkupIconImages.jpg") returned -1
	[0061.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MarkupIconImages.jpg") returned -1
	[0061.941] lstrcmpiA (lpString1="", lpString2="MarkupIconImages.jpg") returned -1
	[0061.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="InactiveTabImageMask.bmp"
	[0061.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\"
	[0061.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned=""
	[0061.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt"
	[0061.941] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20
	[0061.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg"
	[0061.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.zip") returned 0
	[0061.941] lstrlenA (lpString="*.zip") returned 5
	[0061.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.rar") returned 0
	[0061.941] lstrlenA (lpString="*.rar") returned 5
	[0061.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.7z") returned 0
	[0061.941] lstrlenA (lpString="*.7z") returned 4
	[0061.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.tar") returned 0
	[0061.941] lstrlenA (lpString="*.tar") returned 5
	[0061.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.gzip") returned 0
	[0061.941] lstrlenA (lpString="*.gzip") returned 6
	[0061.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.jpg") returned 1
	[0061.941] lstrlenA (lpString="*.jpg") returned 5
	[0061.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg"
	[0061.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg"
	[0061.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg."
	[0061.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.Boom"
	[0061.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.942] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98b
	[0061.942] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x696f1810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1
	[0061.942] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.943] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x968, lpOverlapped=0x0) returned 1
	[0061.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="MarkupIconImages.jpg"
	[0061.944] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.944] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x968, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x968, lpOverlapped=0x0) returned 1
	[0061.944] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.944] CloseHandle (hObject=0x98) returned 1
	[0061.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.boom")) returned 1
	[0061.944] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0061.944] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0061.944] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MarkupIconImagesMask.bmp") returned -1
	[0061.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MarkupIconImagesMask.bmp") returned -1
	[0061.944] lstrcmpiA (lpString1="", lpString2="MarkupIconImagesMask.bmp") returned -1
	[0061.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="MarkupIconImages.jpg"
	[0061.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\"
	[0061.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned=""
	[0061.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt"
	[0061.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20
	[0061.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="MarkupIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp"
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0061.945] lstrlenA (lpString="*.zip") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0061.945] lstrlenA (lpString="*.rar") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0061.945] lstrlenA (lpString="*.7z") returned 4
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0061.945] lstrlenA (lpString="*.tar") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0061.945] lstrlenA (lpString="*.gzip") returned 6
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0061.945] lstrlenA (lpString="*.jpg") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0061.945] lstrlenA (lpString="*.jpeg") returned 6
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0061.945] lstrlenA (lpString="*.psd") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0061.945] lstrlenA (lpString="*.cdr") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0061.945] lstrlenA (lpString="*.dwg") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0061.945] lstrlenA (lpString="*.max") returned 5
	[0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0061.945] lstrlenA (lpString="*.bmp") returned 5
	[0061.945] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp"
	[0061.945] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp"
	[0061.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp."
	[0061.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.Boom"
	[0061.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0061.946] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74
	[0061.946] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1
	[0061.946] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.946] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x51, lpOverlapped=0x0) returned 1
	[0061.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="MarkupIconImagesMask.bmp"
	[0061.947] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0061.947] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x51, lpOverlapped=0x0) returned 1
	[0061.947] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0061.947] CloseHandle (hObject=0x98) returned 1
	[0061.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.boom")) returned 1
	[0061.947] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0061.948] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0061.948] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0061.948] lstrcmpA (lpString1=".", lpString2="GrooveForms") returned -1
	[0061.948] lstrcmpA (lpString1="..", lpString2="GrooveForms") returned -1
	[0061.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0061.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms"
	[0061.948] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 81
	[0061.948] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0062.010] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0062.010] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.011] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0062.011] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0062.011] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.011] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.011] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrow.jpg") returned 1
	[0062.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1
	[0062.011] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1
	[0062.011] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*"
	[0062.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.011] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.011] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0xffffffff
	[0062.012] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.013] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0062.013] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0062.013] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0062.013] CloseHandle (hObject=0x98) returned 1
	[0062.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg"
	[0062.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0
	[0062.014] lstrlenA (lpString="*.zip") returned 5
	[0062.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0
	[0062.014] lstrlenA (lpString="*.rar") returned 5
	[0062.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0
	[0062.014] lstrlenA (lpString="*.7z") returned 4
	[0062.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0
	[0062.014] lstrlenA (lpString="*.tar") returned 5
	[0062.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0
	[0062.014] lstrlenA (lpString="*.gzip") returned 6
	[0062.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1
	[0062.014] lstrlenA (lpString="*.jpg") returned 5
	[0062.014] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg"
	[0062.014] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg"
	[0062.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg."
	[0062.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.Boom"
	[0062.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.015] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8
	[0062.015] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1
	[0062.015] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.015] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbc5, lpOverlapped=0x0) returned 1
	[0062.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg"
	[0062.033] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.033] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbc5, lpOverlapped=0x0) returned 1
	[0062.033] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.033] CloseHandle (hObject=0x98) returned 1
	[0062.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.boom")) returned 1
	[0062.034] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.034] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrowMask.bmp") returned 1
	[0062.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1
	[0062.034] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1
	[0062.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg"
	[0062.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.034] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.034] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp"
	[0062.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0
	[0062.035] lstrlenA (lpString="*.zip") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0
	[0062.035] lstrlenA (lpString="*.rar") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0
	[0062.035] lstrlenA (lpString="*.7z") returned 4
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0
	[0062.035] lstrlenA (lpString="*.tar") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0
	[0062.035] lstrlenA (lpString="*.gzip") returned 6
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0
	[0062.035] lstrlenA (lpString="*.jpg") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0
	[0062.035] lstrlenA (lpString="*.jpeg") returned 6
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0
	[0062.035] lstrlenA (lpString="*.psd") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.cdr") returned 0
	[0062.035] lstrlenA (lpString="*.cdr") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.dwg") returned 0
	[0062.035] lstrlenA (lpString="*.dwg") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.max") returned 0
	[0062.035] lstrlenA (lpString="*.max") returned 5
	[0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.bmp") returned 1
	[0062.035] lstrlenA (lpString="*.bmp") returned 5
	[0062.035] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp"
	[0062.035] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp"
	[0062.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp."
	[0062.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.Boom"
	[0062.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.036] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924
	[0062.036] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.036] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.036] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x901, lpOverlapped=0x0) returned 1
	[0062.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp"
	[0062.080] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.080] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x901, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x901, lpOverlapped=0x0) returned 1
	[0062.081] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.081] CloseHandle (hObject=0x98) returned 1
	[0062.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.boom")) returned 1
	[0062.081] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.081] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.081] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1
	[0062.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1
	[0062.082] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1
	[0062.082] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp"
	[0062.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.082] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.082] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif"
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.zip") returned 0
	[0062.082] lstrlenA (lpString="*.zip") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.rar") returned 0
	[0062.082] lstrlenA (lpString="*.rar") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.7z") returned 0
	[0062.082] lstrlenA (lpString="*.7z") returned 4
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.tar") returned 0
	[0062.082] lstrlenA (lpString="*.tar") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.gzip") returned 0
	[0062.082] lstrlenA (lpString="*.gzip") returned 6
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.jpg") returned 0
	[0062.082] lstrlenA (lpString="*.jpg") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.jpeg") returned 0
	[0062.082] lstrlenA (lpString="*.jpeg") returned 6
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.psd") returned 0
	[0062.082] lstrlenA (lpString="*.psd") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.cdr") returned 0
	[0062.082] lstrlenA (lpString="*.cdr") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.dwg") returned 0
	[0062.082] lstrlenA (lpString="*.dwg") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.max") returned 0
	[0062.082] lstrlenA (lpString="*.max") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.bmp") returned 0
	[0062.082] lstrlenA (lpString="*.bmp") returned 5
	[0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.gif") returned 1
	[0062.082] lstrlenA (lpString="*.gif") returned 5
	[0062.082] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif"
	[0062.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif"
	[0062.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif."
	[0062.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.Boom"
	[0062.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.084] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8
	[0062.084] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.084] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.084] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xac5, lpOverlapped=0x0) returned 1
	[0062.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="attention.gif"
	[0062.095] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.095] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xac5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xac5, lpOverlapped=0x0) returned 1
	[0062.096] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.096] CloseHandle (hObject=0x98) returned 1
	[0062.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.boom")) returned 1
	[0062.096] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.096] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.096] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BG_ADOBE.GIF") returned 1
	[0062.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1
	[0062.096] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1
	[0062.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="attention.gif"
	[0062.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF"
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0
	[0062.097] lstrlenA (lpString="*.zip") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0
	[0062.097] lstrlenA (lpString="*.rar") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0
	[0062.097] lstrlenA (lpString="*.7z") returned 4
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0
	[0062.097] lstrlenA (lpString="*.tar") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0
	[0062.097] lstrlenA (lpString="*.gzip") returned 6
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0
	[0062.097] lstrlenA (lpString="*.jpg") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0
	[0062.097] lstrlenA (lpString="*.jpeg") returned 6
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0
	[0062.097] lstrlenA (lpString="*.psd") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.cdr") returned 0
	[0062.097] lstrlenA (lpString="*.cdr") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.dwg") returned 0
	[0062.097] lstrlenA (lpString="*.dwg") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.max") returned 0
	[0062.097] lstrlenA (lpString="*.max") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.bmp") returned 0
	[0062.097] lstrlenA (lpString="*.bmp") returned 5
	[0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1
	[0062.097] lstrlenA (lpString="*.gif") returned 5
	[0062.097] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF"
	[0062.097] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF"
	[0062.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF."
	[0062.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.Boom"
	[0062.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.098] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e
	[0062.098] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.098] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.098] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x612b, lpOverlapped=0x0) returned 1
	[0062.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF"
	[0062.117] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.117] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x612b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x612b, lpOverlapped=0x0) returned 1
	[0062.117] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.118] CloseHandle (hObject=0x98) returned 1
	[0062.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif.boom")) returned 1
	[0062.118] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.118] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.118] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Casual.gif") returned 1
	[0062.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1
	[0062.118] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1
	[0062.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF"
	[0062.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.118] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.118] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif"
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.zip") returned 0
	[0062.119] lstrlenA (lpString="*.zip") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.rar") returned 0
	[0062.119] lstrlenA (lpString="*.rar") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.7z") returned 0
	[0062.119] lstrlenA (lpString="*.7z") returned 4
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.tar") returned 0
	[0062.119] lstrlenA (lpString="*.tar") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.gzip") returned 0
	[0062.119] lstrlenA (lpString="*.gzip") returned 6
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.jpg") returned 0
	[0062.119] lstrlenA (lpString="*.jpg") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.jpeg") returned 0
	[0062.119] lstrlenA (lpString="*.jpeg") returned 6
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.psd") returned 0
	[0062.119] lstrlenA (lpString="*.psd") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.cdr") returned 0
	[0062.119] lstrlenA (lpString="*.cdr") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.dwg") returned 0
	[0062.119] lstrlenA (lpString="*.dwg") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.max") returned 0
	[0062.119] lstrlenA (lpString="*.max") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.bmp") returned 0
	[0062.119] lstrlenA (lpString="*.bmp") returned 5
	[0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.gif") returned 1
	[0062.119] lstrlenA (lpString="*.gif") returned 5
	[0062.119] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif"
	[0062.119] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif"
	[0062.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif."
	[0062.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.Boom"
	[0062.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.120] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d
	[0062.120] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.120] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.120] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x15fa, lpOverlapped=0x0) returned 1
	[0062.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="bg_Casual.gif"
	[0062.122] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.122] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x15fa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x15fa, lpOverlapped=0x0) returned 1
	[0062.122] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.122] CloseHandle (hObject=0x98) returned 1
	[0062.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.boom")) returned 1
	[0062.123] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.123] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.123] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Country.gif") returned 1
	[0062.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1
	[0062.123] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1
	[0062.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="bg_Casual.gif"
	[0062.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.123] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.123] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif"
	[0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.zip") returned 0
	[0062.123] lstrlenA (lpString="*.zip") returned 5
	[0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.rar") returned 0
	[0062.123] lstrlenA (lpString="*.rar") returned 5
	[0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.7z") returned 0
	[0062.124] lstrlenA (lpString="*.7z") returned 4
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.tar") returned 0
	[0062.124] lstrlenA (lpString="*.tar") returned 5
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.gzip") returned 0
	[0062.124] lstrlenA (lpString="*.gzip") returned 6
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.jpg") returned 0
	[0062.124] lstrlenA (lpString="*.jpg") returned 5
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.jpeg") returned 0
	[0062.124] lstrlenA (lpString="*.jpeg") returned 6
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.psd") returned 0
	[0062.124] lstrlenA (lpString="*.psd") returned 5
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.cdr") returned 0
	[0062.124] lstrlenA (lpString="*.cdr") returned 5
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.dwg") returned 0
	[0062.124] lstrlenA (lpString="*.dwg") returned 5
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.max") returned 0
	[0062.124] lstrlenA (lpString="*.max") returned 5
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.bmp") returned 0
	[0062.124] lstrlenA (lpString="*.bmp") returned 5
	[0062.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.gif") returned 1
	[0062.124] lstrlenA (lpString="*.gif") returned 5
	[0062.124] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif"
	[0062.124] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif"
	[0062.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif."
	[0062.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.Boom"
	[0062.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.125] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3
	[0062.125] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.125] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.125] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7db0, lpOverlapped=0x0) returned 1
	[0062.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="bg_Country.gif"
	[0062.127] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.127] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7db0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7db0, lpOverlapped=0x0) returned 1
	[0062.127] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.127] CloseHandle (hObject=0x98) returned 1
	[0062.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.boom")) returned 1
	[0062.128] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.128] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Earthy.gif") returned 1
	[0062.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1
	[0062.128] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1
	[0062.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="bg_Country.gif"
	[0062.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.128] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.128] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif"
	[0062.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.zip") returned 0
	[0062.128] lstrlenA (lpString="*.zip") returned 5
	[0062.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.rar") returned 0
	[0062.128] lstrlenA (lpString="*.rar") returned 5
	[0062.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.7z") returned 0
	[0062.128] lstrlenA (lpString="*.7z") returned 4
	[0062.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.tar") returned 0
	[0062.129] lstrlenA (lpString="*.tar") returned 5
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.gzip") returned 0
	[0062.129] lstrlenA (lpString="*.gzip") returned 6
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.jpg") returned 0
	[0062.129] lstrlenA (lpString="*.jpg") returned 5
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0
	[0062.129] lstrlenA (lpString="*.jpeg") returned 6
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.psd") returned 0
	[0062.129] lstrlenA (lpString="*.psd") returned 5
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.cdr") returned 0
	[0062.129] lstrlenA (lpString="*.cdr") returned 5
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.dwg") returned 0
	[0062.129] lstrlenA (lpString="*.dwg") returned 5
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.max") returned 0
	[0062.129] lstrlenA (lpString="*.max") returned 5
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.bmp") returned 0
	[0062.129] lstrlenA (lpString="*.bmp") returned 5
	[0062.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.gif") returned 1
	[0062.129] lstrlenA (lpString="*.gif") returned 5
	[0062.129] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif"
	[0062.129] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif"
	[0062.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif."
	[0062.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.Boom"
	[0062.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.130] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a
	[0062.130] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.130] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.131] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1307, lpOverlapped=0x0) returned 1
	[0062.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="bg_Earthy.gif"
	[0062.152] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.152] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1307, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1307, lpOverlapped=0x0) returned 1
	[0062.152] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.152] CloseHandle (hObject=0x98) returned 1
	[0062.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.boom")) returned 1
	[0062.153] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.153] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePage.gif") returned 1
	[0062.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1
	[0062.153] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1
	[0062.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="bg_Earthy.gif"
	[0062.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif"
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0
	[0062.154] lstrlenA (lpString="*.zip") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0
	[0062.154] lstrlenA (lpString="*.rar") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0
	[0062.154] lstrlenA (lpString="*.7z") returned 4
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0
	[0062.154] lstrlenA (lpString="*.tar") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0
	[0062.154] lstrlenA (lpString="*.gzip") returned 6
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0
	[0062.154] lstrlenA (lpString="*.jpg") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0
	[0062.154] lstrlenA (lpString="*.jpeg") returned 6
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0
	[0062.154] lstrlenA (lpString="*.psd") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.cdr") returned 0
	[0062.154] lstrlenA (lpString="*.cdr") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.dwg") returned 0
	[0062.154] lstrlenA (lpString="*.dwg") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.max") returned 0
	[0062.154] lstrlenA (lpString="*.max") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.bmp") returned 0
	[0062.154] lstrlenA (lpString="*.bmp") returned 5
	[0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1
	[0062.154] lstrlenA (lpString="*.gif") returned 5
	[0062.154] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif"
	[0062.154] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif"
	[0062.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif."
	[0062.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.Boom"
	[0062.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.156] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9b8
	[0062.156] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.156] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.156] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xb995, lpOverlapped=0x0) returned 1
	[0062.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif"
	[0062.162] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.162] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xb995, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xb995, lpOverlapped=0x0) returned 1
	[0062.162] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.162] CloseHandle (hObject=0x98) returned 1
	[0062.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.boom")) returned 1
	[0062.163] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.163] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.163] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageBlank.gif") returned 1
	[0062.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1
	[0062.163] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1
	[0062.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif"
	[0062.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif"
	[0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0
	[0062.163] lstrlenA (lpString="*.zip") returned 5
	[0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0
	[0062.163] lstrlenA (lpString="*.rar") returned 5
	[0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0
	[0062.163] lstrlenA (lpString="*.7z") returned 4
	[0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0
	[0062.163] lstrlenA (lpString="*.tar") returned 5
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0
	[0062.164] lstrlenA (lpString="*.gzip") returned 6
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0
	[0062.164] lstrlenA (lpString="*.jpg") returned 5
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0
	[0062.164] lstrlenA (lpString="*.jpeg") returned 6
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0
	[0062.164] lstrlenA (lpString="*.psd") returned 5
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.cdr") returned 0
	[0062.164] lstrlenA (lpString="*.cdr") returned 5
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.dwg") returned 0
	[0062.164] lstrlenA (lpString="*.dwg") returned 5
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.max") returned 0
	[0062.164] lstrlenA (lpString="*.max") returned 5
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.bmp") returned 0
	[0062.164] lstrlenA (lpString="*.bmp") returned 5
	[0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1
	[0062.164] lstrlenA (lpString="*.gif") returned 5
	[0062.164] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif"
	[0062.164] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif"
	[0062.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif."
	[0062.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.Boom"
	[0062.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.165] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb
	[0062.165] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.165] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.165] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4e98, lpOverlapped=0x0) returned 1
	[0062.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif"
	[0062.197] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.197] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4e98, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4e98, lpOverlapped=0x0) returned 1
	[0062.197] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.197] CloseHandle (hObject=0x98) returned 1
	[0062.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.boom")) returned 1
	[0062.198] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.198] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.198] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_GreenTea.gif") returned 1
	[0062.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1
	[0062.198] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1
	[0062.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif"
	[0062.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.198] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.198] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif"
	[0062.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.zip") returned 0
	[0062.198] lstrlenA (lpString="*.zip") returned 5
	[0062.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.rar") returned 0
	[0062.198] lstrlenA (lpString="*.rar") returned 5
	[0062.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.7z") returned 0
	[0062.198] lstrlenA (lpString="*.7z") returned 4
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.tar") returned 0
	[0062.199] lstrlenA (lpString="*.tar") returned 5
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0
	[0062.199] lstrlenA (lpString="*.gzip") returned 6
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0
	[0062.199] lstrlenA (lpString="*.jpg") returned 5
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0
	[0062.199] lstrlenA (lpString="*.jpeg") returned 6
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.psd") returned 0
	[0062.199] lstrlenA (lpString="*.psd") returned 5
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.cdr") returned 0
	[0062.199] lstrlenA (lpString="*.cdr") returned 5
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.dwg") returned 0
	[0062.199] lstrlenA (lpString="*.dwg") returned 5
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.max") returned 0
	[0062.199] lstrlenA (lpString="*.max") returned 5
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.bmp") returned 0
	[0062.199] lstrlenA (lpString="*.bmp") returned 5
	[0062.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.gif") returned 1
	[0062.199] lstrlenA (lpString="*.gif") returned 5
	[0062.199] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif"
	[0062.199] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif"
	[0062.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif."
	[0062.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.Boom"
	[0062.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.200] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690
	[0062.200] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.200] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.201] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x566d, lpOverlapped=0x0) returned 1
	[0062.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="bg_GreenTea.gif"
	[0062.215] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.215] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x566d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x566d, lpOverlapped=0x0) returned 1
	[0062.215] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.215] CloseHandle (hObject=0x98) returned 1
	[0062.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.boom")) returned 1
	[0062.216] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.216] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Groove.gif") returned 1
	[0062.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1
	[0062.216] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1
	[0062.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="bg_GreenTea.gif"
	[0062.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif"
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.zip") returned 0
	[0062.217] lstrlenA (lpString="*.zip") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.rar") returned 0
	[0062.217] lstrlenA (lpString="*.rar") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.7z") returned 0
	[0062.217] lstrlenA (lpString="*.7z") returned 4
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.tar") returned 0
	[0062.217] lstrlenA (lpString="*.tar") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.gzip") returned 0
	[0062.217] lstrlenA (lpString="*.gzip") returned 6
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.jpg") returned 0
	[0062.217] lstrlenA (lpString="*.jpg") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.jpeg") returned 0
	[0062.217] lstrlenA (lpString="*.jpeg") returned 6
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.psd") returned 0
	[0062.217] lstrlenA (lpString="*.psd") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.cdr") returned 0
	[0062.217] lstrlenA (lpString="*.cdr") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.dwg") returned 0
	[0062.217] lstrlenA (lpString="*.dwg") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.max") returned 0
	[0062.217] lstrlenA (lpString="*.max") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.bmp") returned 0
	[0062.217] lstrlenA (lpString="*.bmp") returned 5
	[0062.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.gif") returned 1
	[0062.217] lstrlenA (lpString="*.gif") returned 5
	[0062.217] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif"
	[0062.217] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif"
	[0062.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif."
	[0062.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.Boom"
	[0062.218] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.219] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a
	[0062.219] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.219] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.219] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x47, lpOverlapped=0x0) returned 1
	[0062.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="bg_Groove.gif"
	[0062.220] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.220] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x47, lpOverlapped=0x0) returned 1
	[0062.220] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.220] CloseHandle (hObject=0x98) returned 1
	[0062.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.boom")) returned 1
	[0062.221] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.221] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_LightSpirit.gif") returned 1
	[0062.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1
	[0062.221] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1
	[0062.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="bg_Groove.gif"
	[0062.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.221] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif"
	[0062.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0
	[0062.221] lstrlenA (lpString="*.zip") returned 5
	[0062.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0
	[0062.222] lstrlenA (lpString="*.rar") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0
	[0062.222] lstrlenA (lpString="*.7z") returned 4
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0
	[0062.222] lstrlenA (lpString="*.tar") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0
	[0062.222] lstrlenA (lpString="*.gzip") returned 6
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0
	[0062.222] lstrlenA (lpString="*.jpg") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0
	[0062.222] lstrlenA (lpString="*.jpeg") returned 6
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0
	[0062.222] lstrlenA (lpString="*.psd") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.cdr") returned 0
	[0062.222] lstrlenA (lpString="*.cdr") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.dwg") returned 0
	[0062.222] lstrlenA (lpString="*.dwg") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.max") returned 0
	[0062.222] lstrlenA (lpString="*.max") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.bmp") returned 0
	[0062.222] lstrlenA (lpString="*.bmp") returned 5
	[0062.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1
	[0062.222] lstrlenA (lpString="*.gif") returned 5
	[0062.222] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif"
	[0062.222] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif"
	[0062.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif."
	[0062.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.Boom"
	[0062.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.223] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6
	[0062.223] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1
	[0062.223] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.224] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2183, lpOverlapped=0x0) returned 1
	[0062.252] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif"
	[0062.253] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.253] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2183, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2183, lpOverlapped=0x0) returned 1
	[0062.253] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.253] CloseHandle (hObject=0x98) returned 1
	[0062.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.boom")) returned 1
	[0062.254] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.254] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.254] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_OliveGreen.gif") returned 1
	[0062.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1
	[0062.254] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1
	[0062.254] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif"
	[0062.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.254] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif"
	[0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0
	[0062.254] lstrlenA (lpString="*.zip") returned 5
	[0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0
	[0062.254] lstrlenA (lpString="*.rar") returned 5
	[0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0
	[0062.254] lstrlenA (lpString="*.7z") returned 4
	[0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0
	[0062.254] lstrlenA (lpString="*.tar") returned 5
	[0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0
	[0062.254] lstrlenA (lpString="*.gzip") returned 6
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0
	[0062.255] lstrlenA (lpString="*.jpg") returned 5
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0
	[0062.255] lstrlenA (lpString="*.jpeg") returned 6
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0
	[0062.255] lstrlenA (lpString="*.psd") returned 5
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.cdr") returned 0
	[0062.255] lstrlenA (lpString="*.cdr") returned 5
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.dwg") returned 0
	[0062.255] lstrlenA (lpString="*.dwg") returned 5
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.max") returned 0
	[0062.255] lstrlenA (lpString="*.max") returned 5
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.bmp") returned 0
	[0062.255] lstrlenA (lpString="*.bmp") returned 5
	[0062.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1
	[0062.255] lstrlenA (lpString="*.gif") returned 5
	[0062.255] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif"
	[0062.255] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif"
	[0062.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif."
	[0062.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.Boom"
	[0062.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.256] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57
	[0062.256] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.256] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.256] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3d34, lpOverlapped=0x0) returned 1
	[0062.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif"
	[0062.264] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.265] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3d34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3d34, lpOverlapped=0x0) returned 1
	[0062.265] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.265] CloseHandle (hObject=0x98) returned 1
	[0062.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.boom")) returned 1
	[0062.266] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.266] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.266] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Premium.gif") returned 1
	[0062.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1
	[0062.266] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1
	[0062.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif"
	[0062.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif"
	[0062.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.zip") returned 0
	[0062.266] lstrlenA (lpString="*.zip") returned 5
	[0062.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.rar") returned 0
	[0062.266] lstrlenA (lpString="*.rar") returned 5
	[0062.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.7z") returned 0
	[0062.266] lstrlenA (lpString="*.7z") returned 4
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.tar") returned 0
	[0062.267] lstrlenA (lpString="*.tar") returned 5
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.gzip") returned 0
	[0062.267] lstrlenA (lpString="*.gzip") returned 6
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.jpg") returned 0
	[0062.267] lstrlenA (lpString="*.jpg") returned 5
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.jpeg") returned 0
	[0062.267] lstrlenA (lpString="*.jpeg") returned 6
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.psd") returned 0
	[0062.267] lstrlenA (lpString="*.psd") returned 5
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.cdr") returned 0
	[0062.267] lstrlenA (lpString="*.cdr") returned 5
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.dwg") returned 0
	[0062.267] lstrlenA (lpString="*.dwg") returned 5
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.max") returned 0
	[0062.267] lstrlenA (lpString="*.max") returned 5
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.bmp") returned 0
	[0062.267] lstrlenA (lpString="*.bmp") returned 5
	[0062.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.gif") returned 1
	[0062.267] lstrlenA (lpString="*.gif") returned 5
	[0062.267] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif"
	[0062.267] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif"
	[0062.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif."
	[0062.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.Boom"
	[0062.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.268] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845
	[0062.268] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.269] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.269] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1822, lpOverlapped=0x0) returned 1
	[0062.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="bg_Premium.gif"
	[0062.270] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.270] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1822, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1822, lpOverlapped=0x0) returned 1
	[0062.270] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.271] CloseHandle (hObject=0x98) returned 1
	[0062.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.boom")) returned 1
	[0062.272] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.272] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_SlateBlue.gif") returned 1
	[0062.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1
	[0062.272] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1
	[0062.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="bg_Premium.gif"
	[0062.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif"
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0
	[0062.272] lstrlenA (lpString="*.zip") returned 5
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0
	[0062.272] lstrlenA (lpString="*.rar") returned 5
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0
	[0062.272] lstrlenA (lpString="*.7z") returned 4
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0
	[0062.272] lstrlenA (lpString="*.tar") returned 5
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0
	[0062.272] lstrlenA (lpString="*.gzip") returned 6
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0
	[0062.272] lstrlenA (lpString="*.jpg") returned 5
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0
	[0062.272] lstrlenA (lpString="*.jpeg") returned 6
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0
	[0062.272] lstrlenA (lpString="*.psd") returned 5
	[0062.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.cdr") returned 0
	[0062.272] lstrlenA (lpString="*.cdr") returned 5
	[0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.dwg") returned 0
	[0062.273] lstrlenA (lpString="*.dwg") returned 5
	[0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.max") returned 0
	[0062.273] lstrlenA (lpString="*.max") returned 5
	[0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.bmp") returned 0
	[0062.273] lstrlenA (lpString="*.bmp") returned 5
	[0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1
	[0062.273] lstrlenA (lpString="*.gif") returned 5
	[0062.273] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif"
	[0062.273] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif"
	[0062.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif."
	[0062.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.Boom"
	[0062.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.274] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141
	[0062.274] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.274] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.274] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x511e, lpOverlapped=0x0) returned 1
	[0062.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif"
	[0062.276] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.276] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x511e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x511e, lpOverlapped=0x0) returned 1
	[0062.276] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.276] CloseHandle (hObject=0x98) returned 1
	[0062.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.boom")) returned 1
	[0062.277] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.277] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_TexturedBlue.gif") returned 1
	[0062.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1
	[0062.277] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1
	[0062.277] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif"
	[0062.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.277] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif"
	[0062.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0
	[0062.277] lstrlenA (lpString="*.zip") returned 5
	[0062.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0
	[0062.277] lstrlenA (lpString="*.rar") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0
	[0062.278] lstrlenA (lpString="*.7z") returned 4
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0
	[0062.278] lstrlenA (lpString="*.tar") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0
	[0062.278] lstrlenA (lpString="*.gzip") returned 6
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0
	[0062.278] lstrlenA (lpString="*.jpg") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0
	[0062.278] lstrlenA (lpString="*.jpeg") returned 6
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0
	[0062.278] lstrlenA (lpString="*.psd") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.cdr") returned 0
	[0062.278] lstrlenA (lpString="*.cdr") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.dwg") returned 0
	[0062.278] lstrlenA (lpString="*.dwg") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.max") returned 0
	[0062.278] lstrlenA (lpString="*.max") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.bmp") returned 0
	[0062.278] lstrlenA (lpString="*.bmp") returned 5
	[0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1
	[0062.278] lstrlenA (lpString="*.gif") returned 5
	[0062.278] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif"
	[0062.278] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif"
	[0062.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif."
	[0062.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.Boom"
	[0062.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.279] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c
	[0062.279] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.279] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.280] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1919, lpOverlapped=0x0) returned 1
	[0062.445] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif"
	[0062.445] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.445] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1919, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1919, lpOverlapped=0x0) returned 1
	[0062.446] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.446] CloseHandle (hObject=0x98) returned 1
	[0062.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.boom")) returned 1
	[0062.446] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.447] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.447] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_VelvetRose.gif") returned 1
	[0062.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1
	[0062.447] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1
	[0062.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif"
	[0062.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.447] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif"
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0
	[0062.447] lstrlenA (lpString="*.zip") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0
	[0062.447] lstrlenA (lpString="*.rar") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0
	[0062.447] lstrlenA (lpString="*.7z") returned 4
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0
	[0062.447] lstrlenA (lpString="*.tar") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0
	[0062.447] lstrlenA (lpString="*.gzip") returned 6
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0
	[0062.447] lstrlenA (lpString="*.jpg") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0
	[0062.447] lstrlenA (lpString="*.jpeg") returned 6
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0
	[0062.447] lstrlenA (lpString="*.psd") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.cdr") returned 0
	[0062.447] lstrlenA (lpString="*.cdr") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.dwg") returned 0
	[0062.447] lstrlenA (lpString="*.dwg") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.max") returned 0
	[0062.447] lstrlenA (lpString="*.max") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.bmp") returned 0
	[0062.447] lstrlenA (lpString="*.bmp") returned 5
	[0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1
	[0062.447] lstrlenA (lpString="*.gif") returned 5
	[0062.447] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif"
	[0062.447] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif"
	[0062.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif."
	[0062.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.Boom"
	[0062.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.448] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64
	[0062.448] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.448] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.448] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3c41, lpOverlapped=0x0) returned 1
	[0062.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif"
	[0062.473] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.474] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3c41, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3c41, lpOverlapped=0x0) returned 1
	[0062.474] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.474] CloseHandle (hObject=0x98) returned 1
	[0062.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.boom")) returned 1
	[0062.475] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.475] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left.gif") returned 1
	[0062.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1
	[0062.475] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1
	[0062.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif"
	[0062.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.475] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif"
	[0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.zip") returned 0
	[0062.475] lstrlenA (lpString="*.zip") returned 5
	[0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.rar") returned 0
	[0062.475] lstrlenA (lpString="*.rar") returned 5
	[0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.7z") returned 0
	[0062.475] lstrlenA (lpString="*.7z") returned 4
	[0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.tar") returned 0
	[0062.475] lstrlenA (lpString="*.tar") returned 5
	[0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.gzip") returned 0
	[0062.475] lstrlenA (lpString="*.gzip") returned 6
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.jpg") returned 0
	[0062.476] lstrlenA (lpString="*.jpg") returned 5
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.jpeg") returned 0
	[0062.476] lstrlenA (lpString="*.jpeg") returned 6
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.psd") returned 0
	[0062.476] lstrlenA (lpString="*.psd") returned 5
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.cdr") returned 0
	[0062.476] lstrlenA (lpString="*.cdr") returned 5
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.dwg") returned 0
	[0062.476] lstrlenA (lpString="*.dwg") returned 5
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.max") returned 0
	[0062.476] lstrlenA (lpString="*.max") returned 5
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.bmp") returned 0
	[0062.476] lstrlenA (lpString="*.bmp") returned 5
	[0062.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.gif") returned 1
	[0062.476] lstrlenA (lpString="*.gif") returned 5
	[0062.476] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif"
	[0062.476] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif"
	[0062.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif."
	[0062.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.Boom"
	[0062.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.477] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x276
	[0062.477] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.477] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.477] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x253, lpOverlapped=0x0) returned 1
	[0062.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="button_left.gif"
	[0062.495] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.495] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x253, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x253, lpOverlapped=0x0) returned 1
	[0062.495] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.495] CloseHandle (hObject=0x98) returned 1
	[0062.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.boom")) returned 1
	[0062.496] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.496] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_disable.gif") returned 1
	[0062.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_disable.gif") returned 1
	[0062.496] lstrcmpiA (lpString1="", lpString2="button_left_disable.gif") returned -1
	[0062.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="button_left.gif"
	[0062.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.496] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.496] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif"
	[0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.zip") returned 0
	[0062.496] lstrlenA (lpString="*.zip") returned 5
	[0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.rar") returned 0
	[0062.496] lstrlenA (lpString="*.rar") returned 5
	[0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.7z") returned 0
	[0062.496] lstrlenA (lpString="*.7z") returned 4
	[0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.tar") returned 0
	[0062.496] lstrlenA (lpString="*.tar") returned 5
	[0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.gzip") returned 0
	[0062.496] lstrlenA (lpString="*.gzip") returned 6
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.jpg") returned 0
	[0062.497] lstrlenA (lpString="*.jpg") returned 5
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.jpeg") returned 0
	[0062.497] lstrlenA (lpString="*.jpeg") returned 6
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.psd") returned 0
	[0062.497] lstrlenA (lpString="*.psd") returned 5
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.cdr") returned 0
	[0062.497] lstrlenA (lpString="*.cdr") returned 5
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.dwg") returned 0
	[0062.497] lstrlenA (lpString="*.dwg") returned 5
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.max") returned 0
	[0062.497] lstrlenA (lpString="*.max") returned 5
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.bmp") returned 0
	[0062.497] lstrlenA (lpString="*.bmp") returned 5
	[0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.gif") returned 1
	[0062.497] lstrlenA (lpString="*.gif") returned 5
	[0062.497] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif"
	[0062.497] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif"
	[0062.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif."
	[0062.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.Boom"
	[0062.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.498] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6
	[0062.498] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.498] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.498] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc3, lpOverlapped=0x0) returned 1
	[0062.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="button_left_disable.gif"
	[0062.499] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.499] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc3, lpOverlapped=0x0) returned 1
	[0062.499] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.499] CloseHandle (hObject=0x98) returned 1
	[0062.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.boom")) returned 1
	[0062.500] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.500] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.500] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_over.gif") returned 1
	[0062.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1
	[0062.500] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1
	[0062.500] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="button_left_disable.gif"
	[0062.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif"
	[0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.zip") returned 0
	[0062.500] lstrlenA (lpString="*.zip") returned 5
	[0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.rar") returned 0
	[0062.500] lstrlenA (lpString="*.rar") returned 5
	[0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.7z") returned 0
	[0062.500] lstrlenA (lpString="*.7z") returned 4
	[0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.tar") returned 0
	[0062.500] lstrlenA (lpString="*.tar") returned 5
	[0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.gzip") returned 0
	[0062.501] lstrlenA (lpString="*.gzip") returned 6
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.jpg") returned 0
	[0062.501] lstrlenA (lpString="*.jpg") returned 5
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.jpeg") returned 0
	[0062.501] lstrlenA (lpString="*.jpeg") returned 6
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.psd") returned 0
	[0062.501] lstrlenA (lpString="*.psd") returned 5
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.cdr") returned 0
	[0062.501] lstrlenA (lpString="*.cdr") returned 5
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.dwg") returned 0
	[0062.501] lstrlenA (lpString="*.dwg") returned 5
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.max") returned 0
	[0062.501] lstrlenA (lpString="*.max") returned 5
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.bmp") returned 0
	[0062.501] lstrlenA (lpString="*.bmp") returned 5
	[0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.gif") returned 1
	[0062.501] lstrlenA (lpString="*.gif") returned 5
	[0062.501] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif"
	[0062.501] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif"
	[0062.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif."
	[0062.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.Boom"
	[0062.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.515] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41b
	[0062.515] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.515] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.515] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3f8, lpOverlapped=0x0) returned 1
	[0062.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="button_left_over.gif"
	[0062.524] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.524] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3f8, lpOverlapped=0x0) returned 1
	[0062.524] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.524] CloseHandle (hObject=0x98) returned 1
	[0062.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.boom")) returned 1
	[0062.525] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.525] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid.gif") returned 1
	[0062.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1
	[0062.525] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1
	[0062.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="button_left_over.gif"
	[0062.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif"
	[0062.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.zip") returned 0
	[0062.525] lstrlenA (lpString="*.zip") returned 5
	[0062.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.rar") returned 0
	[0062.525] lstrlenA (lpString="*.rar") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.7z") returned 0
	[0062.526] lstrlenA (lpString="*.7z") returned 4
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.tar") returned 0
	[0062.526] lstrlenA (lpString="*.tar") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.gzip") returned 0
	[0062.526] lstrlenA (lpString="*.gzip") returned 6
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.jpg") returned 0
	[0062.526] lstrlenA (lpString="*.jpg") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.jpeg") returned 0
	[0062.526] lstrlenA (lpString="*.jpeg") returned 6
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.psd") returned 0
	[0062.526] lstrlenA (lpString="*.psd") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.cdr") returned 0
	[0062.526] lstrlenA (lpString="*.cdr") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.dwg") returned 0
	[0062.526] lstrlenA (lpString="*.dwg") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.max") returned 0
	[0062.526] lstrlenA (lpString="*.max") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.bmp") returned 0
	[0062.526] lstrlenA (lpString="*.bmp") returned 5
	[0062.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.gif") returned 1
	[0062.526] lstrlenA (lpString="*.gif") returned 5
	[0062.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif"
	[0062.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif"
	[0062.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif."
	[0062.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.Boom"
	[0062.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.527] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9
	[0062.527] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.528] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.528] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x96, lpOverlapped=0x0) returned 1
	[0062.528] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="button_mid.gif"
	[0062.529] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.529] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x96, lpOverlapped=0x0) returned 1
	[0062.529] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.529] CloseHandle (hObject=0x98) returned 1
	[0062.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.boom")) returned 1
	[0062.529] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.529] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_disable.gif") returned 1
	[0062.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_disable.gif") returned 1
	[0062.530] lstrcmpiA (lpString1="", lpString2="button_mid_disable.gif") returned -1
	[0062.530] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="button_mid.gif"
	[0062.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.530] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.530] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif"
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.zip") returned 0
	[0062.530] lstrlenA (lpString="*.zip") returned 5
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.rar") returned 0
	[0062.530] lstrlenA (lpString="*.rar") returned 5
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.7z") returned 0
	[0062.530] lstrlenA (lpString="*.7z") returned 4
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.tar") returned 0
	[0062.530] lstrlenA (lpString="*.tar") returned 5
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.gzip") returned 0
	[0062.530] lstrlenA (lpString="*.gzip") returned 6
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.jpg") returned 0
	[0062.530] lstrlenA (lpString="*.jpg") returned 5
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.jpeg") returned 0
	[0062.530] lstrlenA (lpString="*.jpeg") returned 6
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.psd") returned 0
	[0062.530] lstrlenA (lpString="*.psd") returned 5
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.cdr") returned 0
	[0062.530] lstrlenA (lpString="*.cdr") returned 5
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.dwg") returned 0
	[0062.530] lstrlenA (lpString="*.dwg") returned 5
	[0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.max") returned 0
	[0062.530] lstrlenA (lpString="*.max") returned 5
	[0062.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.bmp") returned 0
	[0062.531] lstrlenA (lpString="*.bmp") returned 5
	[0062.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.gif") returned 1
	[0062.531] lstrlenA (lpString="*.gif") returned 5
	[0062.531] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif"
	[0062.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif"
	[0062.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif."
	[0062.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.Boom"
	[0062.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.531] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35
	[0062.531] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.531] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.531] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x12, lpOverlapped=0x0) returned 1
	[0062.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="button_mid_disable.gif"
	[0062.532] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.532] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x12, lpOverlapped=0x0) returned 1
	[0062.532] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.532] CloseHandle (hObject=0x98) returned 1
	[0062.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.boom")) returned 1
	[0062.533] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.533] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.533] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_over.gif") returned 1
	[0062.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1
	[0062.533] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1
	[0062.533] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="button_mid_disable.gif"
	[0062.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.533] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif"
	[0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.zip") returned 0
	[0062.534] lstrlenA (lpString="*.zip") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.rar") returned 0
	[0062.534] lstrlenA (lpString="*.rar") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.7z") returned 0
	[0062.534] lstrlenA (lpString="*.7z") returned 4
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.tar") returned 0
	[0062.534] lstrlenA (lpString="*.tar") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.gzip") returned 0
	[0062.534] lstrlenA (lpString="*.gzip") returned 6
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.jpg") returned 0
	[0062.534] lstrlenA (lpString="*.jpg") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.jpeg") returned 0
	[0062.534] lstrlenA (lpString="*.jpeg") returned 6
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.psd") returned 0
	[0062.534] lstrlenA (lpString="*.psd") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.cdr") returned 0
	[0062.534] lstrlenA (lpString="*.cdr") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.dwg") returned 0
	[0062.534] lstrlenA (lpString="*.dwg") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.max") returned 0
	[0062.534] lstrlenA (lpString="*.max") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.bmp") returned 0
	[0062.534] lstrlenA (lpString="*.bmp") returned 5
	[0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.gif") returned 1
	[0062.534] lstrlenA (lpString="*.gif") returned 5
	[0062.534] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif"
	[0062.534] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif"
	[0062.534] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif."
	[0062.534] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.Boom"
	[0062.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.535] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb
	[0062.535] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.535] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.535] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x98, lpOverlapped=0x0) returned 1
	[0062.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="button_mid_over.gif"
	[0062.536] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.536] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x98, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x98, lpOverlapped=0x0) returned 1
	[0062.536] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.536] CloseHandle (hObject=0x98) returned 1
	[0062.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.boom")) returned 1
	[0062.536] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.536] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.536] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right.gif") returned 1
	[0062.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1
	[0062.536] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1
	[0062.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="button_mid_over.gif"
	[0062.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.537] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif"
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.zip") returned 0
	[0062.537] lstrlenA (lpString="*.zip") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.rar") returned 0
	[0062.537] lstrlenA (lpString="*.rar") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.7z") returned 0
	[0062.537] lstrlenA (lpString="*.7z") returned 4
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.tar") returned 0
	[0062.537] lstrlenA (lpString="*.tar") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.gzip") returned 0
	[0062.537] lstrlenA (lpString="*.gzip") returned 6
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.jpg") returned 0
	[0062.537] lstrlenA (lpString="*.jpg") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.jpeg") returned 0
	[0062.537] lstrlenA (lpString="*.jpeg") returned 6
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.psd") returned 0
	[0062.537] lstrlenA (lpString="*.psd") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.cdr") returned 0
	[0062.537] lstrlenA (lpString="*.cdr") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.dwg") returned 0
	[0062.537] lstrlenA (lpString="*.dwg") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.max") returned 0
	[0062.537] lstrlenA (lpString="*.max") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.bmp") returned 0
	[0062.537] lstrlenA (lpString="*.bmp") returned 5
	[0062.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.gif") returned 1
	[0062.537] lstrlenA (lpString="*.gif") returned 5
	[0062.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif"
	[0062.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif"
	[0062.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif."
	[0062.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.Boom"
	[0062.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.538] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26e
	[0062.538] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.538] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.538] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24b, lpOverlapped=0x0) returned 1
	[0062.540] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="button_right.gif"
	[0062.540] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.540] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24b, lpOverlapped=0x0) returned 1
	[0062.540] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.540] CloseHandle (hObject=0x98) returned 1
	[0062.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.boom")) returned 1
	[0062.542] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.542] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.542] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_disable.gif") returned 1
	[0062.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_disable.gif") returned 1
	[0062.542] lstrcmpiA (lpString1="", lpString2="button_right_disable.gif") returned -1
	[0062.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="button_right.gif"
	[0062.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.542] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.542] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif"
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.zip") returned 0
	[0062.542] lstrlenA (lpString="*.zip") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.rar") returned 0
	[0062.542] lstrlenA (lpString="*.rar") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.7z") returned 0
	[0062.542] lstrlenA (lpString="*.7z") returned 4
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.tar") returned 0
	[0062.542] lstrlenA (lpString="*.tar") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.gzip") returned 0
	[0062.542] lstrlenA (lpString="*.gzip") returned 6
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.jpg") returned 0
	[0062.542] lstrlenA (lpString="*.jpg") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.jpeg") returned 0
	[0062.542] lstrlenA (lpString="*.jpeg") returned 6
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.psd") returned 0
	[0062.542] lstrlenA (lpString="*.psd") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.cdr") returned 0
	[0062.542] lstrlenA (lpString="*.cdr") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.dwg") returned 0
	[0062.542] lstrlenA (lpString="*.dwg") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.max") returned 0
	[0062.542] lstrlenA (lpString="*.max") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.bmp") returned 0
	[0062.542] lstrlenA (lpString="*.bmp") returned 5
	[0062.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.gif") returned 1
	[0062.542] lstrlenA (lpString="*.gif") returned 5
	[0062.542] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif"
	[0062.542] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif"
	[0062.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif."
	[0062.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.Boom"
	[0062.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.543] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1
	[0062.543] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1
	[0062.543] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.543] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbe, lpOverlapped=0x0) returned 1
	[0062.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="button_right_disable.gif"
	[0062.544] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.544] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbe, lpOverlapped=0x0) returned 1
	[0062.544] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.544] CloseHandle (hObject=0x98) returned 1
	[0062.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.boom")) returned 1
	[0062.544] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.544] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0062.544] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_over.gif") returned 1
	[0062.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1
	[0062.544] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1
	[0062.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="button_right_disable.gif"
	[0062.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0062.545] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0062.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0062.545] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0062.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif"
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.zip") returned 0
	[0062.545] lstrlenA (lpString="*.zip") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.rar") returned 0
	[0062.545] lstrlenA (lpString="*.rar") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.7z") returned 0
	[0062.545] lstrlenA (lpString="*.7z") returned 4
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.tar") returned 0
	[0062.545] lstrlenA (lpString="*.tar") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.gzip") returned 0
	[0062.545] lstrlenA (lpString="*.gzip") returned 6
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.jpg") returned 0
	[0062.545] lstrlenA (lpString="*.jpg") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.jpeg") returned 0
	[0062.545] lstrlenA (lpString="*.jpeg") returned 6
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.psd") returned 0
	[0062.545] lstrlenA (lpString="*.psd") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.cdr") returned 0
	[0062.545] lstrlenA (lpString="*.cdr") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.dwg") returned 0
	[0062.545] lstrlenA (lpString="*.dwg") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.max") returned 0
	[0062.545] lstrlenA (lpString="*.max") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.bmp") returned 0
	[0062.545] lstrlenA (lpString="*.bmp") returned 5
	[0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.gif") returned 1
	[0062.545] lstrlenA (lpString="*.gif") returned 5
	[0062.545] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif"
	[0062.545] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif"
	[0062.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif."
	[0062.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.Boom"
	[0062.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0062.546] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41b
	[0062.546] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.546] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.546] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3f8, lpOverlapped=0x0) returned 1
	[0062.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="button_right_over.gif"
	[0062.571] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.571] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3f8, lpOverlapped=0x0) returned 1
	[0062.571] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.571] CloseHandle (hObject=0x98) returned 1
	[0062.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.boom")) returned 1
	[0062.572] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0062.572] lstrcmpA (lpString1=".", lpString2="FieldTypePreview") returned -1
	[0062.572] lstrcmpA (lpString1="..", lpString2="FieldTypePreview") returned -1
	[0062.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="button_right_over.gif"
	[0062.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FieldTypePreview" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview"
	[0062.572] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned 98
	[0062.572] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7f68
	[0062.594] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0062.594] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.594] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0062.594] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0062.594] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.594] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.594] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Attachments.jpg") returned 1
	[0062.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Attachments.jpg") returned 1
	[0062.594] lstrcmpiA (lpString1="", lpString2="Attachments.jpg") returned -1
	[0062.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*") returned="*.*"
	[0062.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0xffffffff
	[0062.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.595] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0062.595] WriteFile (in: hFile=0x9c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0062.596] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0062.596] CloseHandle (hObject=0x9c) returned 1
	[0062.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg"
	[0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.zip") returned 0
	[0062.596] lstrlenA (lpString="*.zip") returned 5
	[0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.rar") returned 0
	[0062.596] lstrlenA (lpString="*.rar") returned 5
	[0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.7z") returned 0
	[0062.596] lstrlenA (lpString="*.7z") returned 4
	[0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.tar") returned 0
	[0062.596] lstrlenA (lpString="*.tar") returned 5
	[0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.gzip") returned 0
	[0062.596] lstrlenA (lpString="*.gzip") returned 6
	[0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.jpg") returned 1
	[0062.596] lstrlenA (lpString="*.jpg") returned 5
	[0062.596] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg"
	[0062.596] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg"
	[0062.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg."
	[0062.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.Boom"
	[0062.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.597] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x368c
	[0062.597] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.597] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.597] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3669, lpOverlapped=0x0) returned 1
	[0062.611] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="Attachments.jpg"
	[0062.611] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.611] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3669, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3669, lpOverlapped=0x0) returned 1
	[0062.611] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.612] CloseHandle (hObject=0x9c) returned 1
	[0062.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.boom")) returned 1
	[0062.612] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.612] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.612] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BREAK.JPG") returned 1
	[0062.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREAK.JPG") returned 1
	[0062.612] lstrcmpiA (lpString1="", lpString2="BREAK.JPG") returned -1
	[0062.612] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="Attachments.jpg"
	[0062.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.613] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG"
	[0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.zip") returned 0
	[0062.613] lstrlenA (lpString="*.zip") returned 5
	[0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.rar") returned 0
	[0062.613] lstrlenA (lpString="*.rar") returned 5
	[0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.7z") returned 0
	[0062.613] lstrlenA (lpString="*.7z") returned 4
	[0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.tar") returned 0
	[0062.613] lstrlenA (lpString="*.tar") returned 5
	[0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.gzip") returned 0
	[0062.613] lstrlenA (lpString="*.gzip") returned 6
	[0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.jpg") returned 1
	[0062.613] lstrlenA (lpString="*.jpg") returned 5
	[0062.613] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG"
	[0062.613] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG"
	[0062.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG."
	[0062.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.Boom"
	[0062.613] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.614] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a68
	[0062.614] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.614] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.614] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3a45, lpOverlapped=0x0) returned 1
	[0062.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="BREAK.JPG"
	[0062.659] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.659] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3a45, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3a45, lpOverlapped=0x0) returned 1
	[0062.659] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.659] CloseHandle (hObject=0x9c) returned 1
	[0062.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.boom")) returned 1
	[0062.660] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.660] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.660] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.JPG") returned 1
	[0062.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.JPG") returned 1
	[0062.660] lstrcmpiA (lpString1="", lpString2="BUTTON.JPG") returned -1
	[0062.660] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="BREAK.JPG"
	[0062.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.660] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.660] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.660] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.660] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG"
	[0062.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.zip") returned 0
	[0062.660] lstrlenA (lpString="*.zip") returned 5
	[0062.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.rar") returned 0
	[0062.660] lstrlenA (lpString="*.rar") returned 5
	[0062.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.7z") returned 0
	[0062.660] lstrlenA (lpString="*.7z") returned 4
	[0062.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.tar") returned 0
	[0062.660] lstrlenA (lpString="*.tar") returned 5
	[0062.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.gzip") returned 0
	[0062.660] lstrlenA (lpString="*.gzip") returned 6
	[0062.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.jpg") returned 1
	[0062.660] lstrlenA (lpString="*.jpg") returned 5
	[0062.660] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG"
	[0062.660] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG"
	[0062.660] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG."
	[0062.660] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.Boom"
	[0062.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.666] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3004
	[0062.666] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.666] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.666] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2fe1, lpOverlapped=0x0) returned 1
	[0062.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="BUTTON.JPG"
	[0062.678] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.678] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2fe1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2fe1, lpOverlapped=0x0) returned 1
	[0062.678] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.678] CloseHandle (hObject=0x9c) returned 1
	[0062.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.boom")) returned 1
	[0062.679] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.679] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.679] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHECKBOX.JPG") returned 1
	[0062.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHECKBOX.JPG") returned 1
	[0062.679] lstrcmpiA (lpString1="", lpString2="CHECKBOX.JPG") returned -1
	[0062.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="BUTTON.JPG"
	[0062.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.679] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.679] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG"
	[0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.zip") returned 0
	[0062.679] lstrlenA (lpString="*.zip") returned 5
	[0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.rar") returned 0
	[0062.679] lstrlenA (lpString="*.rar") returned 5
	[0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.7z") returned 0
	[0062.679] lstrlenA (lpString="*.7z") returned 4
	[0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.tar") returned 0
	[0062.680] lstrlenA (lpString="*.tar") returned 5
	[0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.gzip") returned 0
	[0062.680] lstrlenA (lpString="*.gzip") returned 6
	[0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.jpg") returned 1
	[0062.680] lstrlenA (lpString="*.jpg") returned 5
	[0062.680] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG"
	[0062.680] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG"
	[0062.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG."
	[0062.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.Boom"
	[0062.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.682] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33d6
	[0062.682] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.682] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.682] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33b3, lpOverlapped=0x0) returned 1
	[0062.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="CHECKBOX.JPG"
	[0062.710] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.710] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33b3, lpOverlapped=0x0) returned 1
	[0062.710] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.710] CloseHandle (hObject=0x9c) returned 1
	[0062.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.boom")) returned 1
	[0062.711] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.711] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.711] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COMBOBOX.JPG") returned 1
	[0062.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMBOBOX.JPG") returned 1
	[0062.711] lstrcmpiA (lpString1="", lpString2="COMBOBOX.JPG") returned -1
	[0062.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="CHECKBOX.JPG"
	[0062.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.711] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG"
	[0062.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.zip") returned 0
	[0062.711] lstrlenA (lpString="*.zip") returned 5
	[0062.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.rar") returned 0
	[0062.711] lstrlenA (lpString="*.rar") returned 5
	[0062.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.7z") returned 0
	[0062.711] lstrlenA (lpString="*.7z") returned 4
	[0062.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.tar") returned 0
	[0062.711] lstrlenA (lpString="*.tar") returned 5
	[0062.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.gzip") returned 0
	[0062.712] lstrlenA (lpString="*.gzip") returned 6
	[0062.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.jpg") returned 1
	[0062.712] lstrlenA (lpString="*.jpg") returned 5
	[0062.712] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG"
	[0062.712] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG"
	[0062.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG."
	[0062.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.Boom"
	[0062.712] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.713] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a3
	[0062.713] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.713] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.713] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4380, lpOverlapped=0x0) returned 1
	[0062.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="COMBOBOX.JPG"
	[0062.729] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.729] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4380, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4380, lpOverlapped=0x0) returned 1
	[0062.729] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.729] CloseHandle (hObject=0x9c) returned 1
	[0062.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.boom")) returned 1
	[0062.730] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.730] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.731] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONTACT.JPG") returned 1
	[0062.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONTACT.JPG") returned 1
	[0062.731] lstrcmpiA (lpString1="", lpString2="CONTACT.JPG") returned -1
	[0062.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="COMBOBOX.JPG"
	[0062.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.731] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.731] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG"
	[0062.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.zip") returned 0
	[0062.731] lstrlenA (lpString="*.zip") returned 5
	[0062.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.rar") returned 0
	[0062.731] lstrlenA (lpString="*.rar") returned 5
	[0062.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.7z") returned 0
	[0062.731] lstrlenA (lpString="*.7z") returned 4
	[0062.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.tar") returned 0
	[0062.731] lstrlenA (lpString="*.tar") returned 5
	[0062.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.gzip") returned 0
	[0062.731] lstrlenA (lpString="*.gzip") returned 6
	[0062.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.jpg") returned 1
	[0062.731] lstrlenA (lpString="*.jpg") returned 5
	[0062.731] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG"
	[0062.731] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG"
	[0062.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG."
	[0062.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.Boom"
	[0062.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.732] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36bd
	[0062.732] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6048cf10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.732] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.732] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x369a, lpOverlapped=0x0) returned 1
	[0062.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="CONTACT.JPG"
	[0062.741] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.742] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x369a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x369a, lpOverlapped=0x0) returned 1
	[0062.742] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.742] CloseHandle (hObject=0x9c) returned 1
	[0062.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.boom")) returned 1
	[0062.743] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.743] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.743] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CURRENCY.JPG") returned 1
	[0062.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CURRENCY.JPG") returned 1
	[0062.743] lstrcmpiA (lpString1="", lpString2="CURRENCY.JPG") returned -1
	[0062.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="CONTACT.JPG"
	[0062.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG"
	[0062.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.zip") returned 0
	[0062.743] lstrlenA (lpString="*.zip") returned 5
	[0062.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.rar") returned 0
	[0062.743] lstrlenA (lpString="*.rar") returned 5
	[0062.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.7z") returned 0
	[0062.743] lstrlenA (lpString="*.7z") returned 4
	[0062.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.tar") returned 0
	[0062.743] lstrlenA (lpString="*.tar") returned 5
	[0062.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.gzip") returned 0
	[0062.743] lstrlenA (lpString="*.gzip") returned 6
	[0062.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.jpg") returned 1
	[0062.743] lstrlenA (lpString="*.jpg") returned 5
	[0062.743] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG"
	[0062.743] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG"
	[0062.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG."
	[0062.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.Boom"
	[0062.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.744] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d22
	[0062.744] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.744] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.744] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3cff, lpOverlapped=0x0) returned 1
	[0062.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="CURRENCY.JPG"
	[0062.835] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.835] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3cff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3cff, lpOverlapped=0x0) returned 1
	[0062.836] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.836] CloseHandle (hObject=0x9c) returned 1
	[0062.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.boom")) returned 1
	[0062.837] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.837] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DATE.JPG") returned 1
	[0062.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATE.JPG") returned 1
	[0062.837] lstrcmpiA (lpString1="", lpString2="DATE.JPG") returned -1
	[0062.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="CURRENCY.JPG"
	[0062.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG"
	[0062.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.zip") returned 0
	[0062.837] lstrlenA (lpString="*.zip") returned 5
	[0062.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.rar") returned 0
	[0062.837] lstrlenA (lpString="*.rar") returned 5
	[0062.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.7z") returned 0
	[0062.837] lstrlenA (lpString="*.7z") returned 4
	[0062.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.tar") returned 0
	[0062.837] lstrlenA (lpString="*.tar") returned 5
	[0062.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.gzip") returned 0
	[0062.837] lstrlenA (lpString="*.gzip") returned 6
	[0062.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.jpg") returned 1
	[0062.837] lstrlenA (lpString="*.jpg") returned 5
	[0062.837] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG"
	[0062.837] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG"
	[0062.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG."
	[0062.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.Boom"
	[0062.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.838] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42af
	[0062.838] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.838] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.838] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x428c, lpOverlapped=0x0) returned 1
	[0062.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="DATE.JPG"
	[0062.843] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.843] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x428c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x428c, lpOverlapped=0x0) returned 1
	[0062.843] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.843] CloseHandle (hObject=0x9c) returned 1
	[0062.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.boom")) returned 1
	[0062.844] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.844] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.844] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DATETIME.JPG") returned 1
	[0062.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATETIME.JPG") returned 1
	[0062.844] lstrcmpiA (lpString1="", lpString2="DATETIME.JPG") returned -1
	[0062.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="DATE.JPG"
	[0062.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG"
	[0062.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.zip") returned 0
	[0062.844] lstrlenA (lpString="*.zip") returned 5
	[0062.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.rar") returned 0
	[0062.844] lstrlenA (lpString="*.rar") returned 5
	[0062.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.7z") returned 0
	[0062.844] lstrlenA (lpString="*.7z") returned 4
	[0062.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.tar") returned 0
	[0062.844] lstrlenA (lpString="*.tar") returned 5
	[0062.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.gzip") returned 0
	[0062.844] lstrlenA (lpString="*.gzip") returned 6
	[0062.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.jpg") returned 1
	[0062.845] lstrlenA (lpString="*.jpg") returned 5
	[0062.845] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG"
	[0062.845] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG"
	[0062.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG."
	[0062.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.Boom"
	[0062.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.845] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4139
	[0062.845] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.845] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.845] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4116, lpOverlapped=0x0) returned 1
	[0062.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="DATETIME.JPG"
	[0062.851] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.851] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4116, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4116, lpOverlapped=0x0) returned 1
	[0062.851] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.852] CloseHandle (hObject=0x9c) returned 1
	[0062.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.boom")) returned 1
	[0062.852] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.852] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.852] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DigitalInk.jpg") returned 1
	[0062.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigitalInk.jpg") returned 1
	[0062.852] lstrcmpiA (lpString1="", lpString2="DigitalInk.jpg") returned -1
	[0062.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="DATETIME.JPG"
	[0062.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.852] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg"
	[0062.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.zip") returned 0
	[0062.853] lstrlenA (lpString="*.zip") returned 5
	[0062.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.rar") returned 0
	[0062.853] lstrlenA (lpString="*.rar") returned 5
	[0062.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.7z") returned 0
	[0062.853] lstrlenA (lpString="*.7z") returned 4
	[0062.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.tar") returned 0
	[0062.853] lstrlenA (lpString="*.tar") returned 5
	[0062.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.gzip") returned 0
	[0062.853] lstrlenA (lpString="*.gzip") returned 6
	[0062.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.jpg") returned 1
	[0062.853] lstrlenA (lpString="*.jpg") returned 5
	[0062.853] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg"
	[0062.853] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg"
	[0062.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg."
	[0062.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.Boom"
	[0062.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.853] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e01
	[0062.853] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.853] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.853] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3dde, lpOverlapped=0x0) returned 1
	[0062.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="DigitalInk.jpg"
	[0062.874] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.874] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3dde, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3dde, lpOverlapped=0x0) returned 1
	[0062.874] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.874] CloseHandle (hObject=0x9c) returned 1
	[0062.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.boom")) returned 1
	[0062.875] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.875] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.875] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EmbeddedView.jpg") returned -1
	[0062.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EmbeddedView.jpg") returned 1
	[0062.875] lstrcmpiA (lpString1="", lpString2="EmbeddedView.jpg") returned -1
	[0062.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="DigitalInk.jpg"
	[0062.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg"
	[0062.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.zip") returned 0
	[0062.876] lstrlenA (lpString="*.zip") returned 5
	[0062.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.rar") returned 0
	[0062.876] lstrlenA (lpString="*.rar") returned 5
	[0062.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.7z") returned 0
	[0062.876] lstrlenA (lpString="*.7z") returned 4
	[0062.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.tar") returned 0
	[0062.876] lstrlenA (lpString="*.tar") returned 5
	[0062.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.gzip") returned 0
	[0062.876] lstrlenA (lpString="*.gzip") returned 6
	[0062.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.jpg") returned 1
	[0062.876] lstrlenA (lpString="*.jpg") returned 5
	[0062.876] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg"
	[0062.876] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg"
	[0062.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg."
	[0062.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.Boom"
	[0062.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.877] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20e8
	[0062.877] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51f96af0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.877] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.877] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x20c5, lpOverlapped=0x0) returned 1
	[0062.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="EmbeddedView.jpg"
	[0062.903] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.903] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x20c5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x20c5, lpOverlapped=0x0) returned 1
	[0062.903] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.904] CloseHandle (hObject=0x9c) returned 1
	[0062.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.boom")) returned 1
	[0062.905] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.905] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.905] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADING.JPG") returned -1
	[0062.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADING.JPG") returned 1
	[0062.905] lstrcmpiA (lpString1="", lpString2="HEADING.JPG") returned -1
	[0062.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="EmbeddedView.jpg"
	[0062.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG"
	[0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.zip") returned 0
	[0062.905] lstrlenA (lpString="*.zip") returned 5
	[0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.rar") returned 0
	[0062.905] lstrlenA (lpString="*.rar") returned 5
	[0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.7z") returned 0
	[0062.905] lstrlenA (lpString="*.7z") returned 4
	[0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.tar") returned 0
	[0062.906] lstrlenA (lpString="*.tar") returned 5
	[0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.gzip") returned 0
	[0062.906] lstrlenA (lpString="*.gzip") returned 6
	[0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.jpg") returned 1
	[0062.906] lstrlenA (lpString="*.jpg") returned 5
	[0062.906] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG"
	[0062.906] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG"
	[0062.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG."
	[0062.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.Boom"
	[0062.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.930] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e72
	[0062.930] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5386f090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.930] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.930] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3e4f, lpOverlapped=0x0) returned 1
	[0062.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="HEADING.JPG"
	[0062.940] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.940] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3e4f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3e4f, lpOverlapped=0x0) returned 1
	[0062.940] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.940] CloseHandle (hObject=0x9c) returned 1
	[0062.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.boom")) returned 1
	[0062.941] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.941] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.941] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMAGE.JPG") returned -1
	[0062.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMAGE.JPG") returned -1
	[0062.941] lstrcmpiA (lpString1="", lpString2="IMAGE.JPG") returned -1
	[0062.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="HEADING.JPG"
	[0062.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.941] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG"
	[0062.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.zip") returned 0
	[0062.941] lstrlenA (lpString="*.zip") returned 5
	[0062.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.rar") returned 0
	[0062.941] lstrlenA (lpString="*.rar") returned 5
	[0062.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.7z") returned 0
	[0062.941] lstrlenA (lpString="*.7z") returned 4
	[0062.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.tar") returned 0
	[0062.941] lstrlenA (lpString="*.tar") returned 5
	[0062.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.gzip") returned 0
	[0062.941] lstrlenA (lpString="*.gzip") returned 6
	[0062.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.jpg") returned 1
	[0062.941] lstrlenA (lpString="*.jpg") returned 5
	[0062.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG"
	[0062.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG"
	[0062.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG."
	[0062.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.Boom"
	[0062.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.943] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x139a
	[0062.943] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392d770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.943] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.943] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1377, lpOverlapped=0x0) returned 1
	[0062.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="IMAGE.JPG"
	[0062.957] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.957] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1377, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1377, lpOverlapped=0x0) returned 1
	[0062.958] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0062.958] CloseHandle (hObject=0x9c) returned 1
	[0062.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.boom")) returned 1
	[0062.958] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0062.958] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0062.958] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LINE.JPG") returned -1
	[0062.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LINE.JPG") returned -1
	[0062.959] lstrcmpiA (lpString1="", lpString2="LINE.JPG") returned -1
	[0062.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="IMAGE.JPG"
	[0062.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0062.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0062.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0062.959] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0062.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG"
	[0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.zip") returned 0
	[0062.959] lstrlenA (lpString="*.zip") returned 5
	[0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.rar") returned 0
	[0062.959] lstrlenA (lpString="*.rar") returned 5
	[0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.7z") returned 0
	[0062.959] lstrlenA (lpString="*.7z") returned 4
	[0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.tar") returned 0
	[0062.959] lstrlenA (lpString="*.tar") returned 5
	[0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.gzip") returned 0
	[0062.959] lstrlenA (lpString="*.gzip") returned 6
	[0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.jpg") returned 1
	[0062.959] lstrlenA (lpString="*.jpg") returned 5
	[0062.959] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG"
	[0062.959] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG"
	[0062.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG."
	[0062.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.Boom"
	[0062.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0062.962] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe65
	[0062.962] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x568309f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0062.962] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0062.962] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xe42, lpOverlapped=0x0) returned 1
	[0063.005] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="LINE.JPG"
	[0063.005] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.005] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xe42, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xe42, lpOverlapped=0x0) returned 1
	[0063.005] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.005] CloseHandle (hObject=0x9c) returned 1
	[0063.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.boom")) returned 1
	[0063.006] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.006] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.006] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LISTBOX.JPG") returned -1
	[0063.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LISTBOX.JPG") returned -1
	[0063.006] lstrcmpiA (lpString1="", lpString2="LISTBOX.JPG") returned -1
	[0063.006] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="LINE.JPG"
	[0063.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.006] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG"
	[0063.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.zip") returned 0
	[0063.006] lstrlenA (lpString="*.zip") returned 5
	[0063.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.rar") returned 0
	[0063.006] lstrlenA (lpString="*.rar") returned 5
	[0063.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.7z") returned 0
	[0063.006] lstrlenA (lpString="*.7z") returned 4
	[0063.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.tar") returned 0
	[0063.006] lstrlenA (lpString="*.tar") returned 5
	[0063.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.gzip") returned 0
	[0063.006] lstrlenA (lpString="*.gzip") returned 6
	[0063.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.jpg") returned 1
	[0063.006] lstrlenA (lpString="*.jpg") returned 5
	[0063.006] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG"
	[0063.006] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG"
	[0063.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG."
	[0063.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.Boom"
	[0063.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.007] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b3f
	[0063.007] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66293410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.007] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.007] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3b1c, lpOverlapped=0x0) returned 1
	[0063.013] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="LISTBOX.JPG"
	[0063.013] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.013] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3b1c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3b1c, lpOverlapped=0x0) returned 1
	[0063.013] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.013] CloseHandle (hObject=0x9c) returned 1
	[0063.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.boom")) returned 1
	[0063.014] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.014] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.014] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NUMERIC.JPG") returned -1
	[0063.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NUMERIC.JPG") returned -1
	[0063.014] lstrcmpiA (lpString1="", lpString2="NUMERIC.JPG") returned -1
	[0063.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="LISTBOX.JPG"
	[0063.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.014] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.014] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG"
	[0063.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.zip") returned 0
	[0063.014] lstrlenA (lpString="*.zip") returned 5
	[0063.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.rar") returned 0
	[0063.014] lstrlenA (lpString="*.rar") returned 5
	[0063.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.7z") returned 0
	[0063.014] lstrlenA (lpString="*.7z") returned 4
	[0063.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.tar") returned 0
	[0063.014] lstrlenA (lpString="*.tar") returned 5
	[0063.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.gzip") returned 0
	[0063.014] lstrlenA (lpString="*.gzip") returned 6
	[0063.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.jpg") returned 1
	[0063.014] lstrlenA (lpString="*.jpg") returned 5
	[0063.014] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG"
	[0063.015] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG"
	[0063.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG."
	[0063.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.Boom"
	[0063.015] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.015] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x443a
	[0063.015] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.015] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.015] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4417, lpOverlapped=0x0) returned 1
	[0063.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="NUMERIC.JPG"
	[0063.026] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.026] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4417, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4417, lpOverlapped=0x0) returned 1
	[0063.027] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.027] CloseHandle (hObject=0x9c) returned 1
	[0063.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.boom")) returned 1
	[0063.027] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.027] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PASSWORD.JPG") returned -1
	[0063.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PASSWORD.JPG") returned -1
	[0063.027] lstrcmpiA (lpString1="", lpString2="PASSWORD.JPG") returned -1
	[0063.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="NUMERIC.JPG"
	[0063.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG"
	[0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.zip") returned 0
	[0063.028] lstrlenA (lpString="*.zip") returned 5
	[0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.rar") returned 0
	[0063.028] lstrlenA (lpString="*.rar") returned 5
	[0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.7z") returned 0
	[0063.028] lstrlenA (lpString="*.7z") returned 4
	[0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.tar") returned 0
	[0063.028] lstrlenA (lpString="*.tar") returned 5
	[0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.gzip") returned 0
	[0063.028] lstrlenA (lpString="*.gzip") returned 6
	[0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.jpg") returned 1
	[0063.028] lstrlenA (lpString="*.jpg") returned 5
	[0063.028] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG"
	[0063.028] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG"
	[0063.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG."
	[0063.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.Boom"
	[0063.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.029] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f5
	[0063.029] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cd8b0b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.029] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.029] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x12d2, lpOverlapped=0x0) returned 1
	[0063.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="PASSWORD.JPG"
	[0063.044] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.044] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x12d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x12d2, lpOverlapped=0x0) returned 1
	[0063.045] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.045] CloseHandle (hObject=0x9c) returned 1
	[0063.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.boom")) returned 1
	[0063.045] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.045] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.045] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RADIO.JPG") returned -1
	[0063.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADIO.JPG") returned -1
	[0063.045] lstrcmpiA (lpString1="", lpString2="RADIO.JPG") returned -1
	[0063.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="PASSWORD.JPG"
	[0063.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG"
	[0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.zip") returned 0
	[0063.046] lstrlenA (lpString="*.zip") returned 5
	[0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.rar") returned 0
	[0063.046] lstrlenA (lpString="*.rar") returned 5
	[0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.7z") returned 0
	[0063.046] lstrlenA (lpString="*.7z") returned 4
	[0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.tar") returned 0
	[0063.046] lstrlenA (lpString="*.tar") returned 5
	[0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.gzip") returned 0
	[0063.046] lstrlenA (lpString="*.gzip") returned 6
	[0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.jpg") returned 1
	[0063.046] lstrlenA (lpString="*.jpg") returned 5
	[0063.046] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG"
	[0063.046] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG"
	[0063.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG."
	[0063.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.Boom"
	[0063.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.077] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43c8
	[0063.077] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a829930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.078] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.078] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x43a5, lpOverlapped=0x0) returned 1
	[0063.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="RADIO.JPG"
	[0063.110] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.110] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x43a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x43a5, lpOverlapped=0x0) returned 1
	[0063.110] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.110] CloseHandle (hObject=0x9c) returned 1
	[0063.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.boom")) returned 1
	[0063.111] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.111] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.111] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SectionHeading.jpg") returned -1
	[0063.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SectionHeading.jpg") returned -1
	[0063.111] lstrcmpiA (lpString1="", lpString2="SectionHeading.jpg") returned -1
	[0063.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="RADIO.JPG"
	[0063.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg"
	[0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.zip") returned 0
	[0063.111] lstrlenA (lpString="*.zip") returned 5
	[0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.rar") returned 0
	[0063.111] lstrlenA (lpString="*.rar") returned 5
	[0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.7z") returned 0
	[0063.111] lstrlenA (lpString="*.7z") returned 4
	[0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.tar") returned 0
	[0063.112] lstrlenA (lpString="*.tar") returned 5
	[0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.gzip") returned 0
	[0063.112] lstrlenA (lpString="*.gzip") returned 6
	[0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.jpg") returned 1
	[0063.112] lstrlenA (lpString="*.jpg") returned 5
	[0063.112] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg"
	[0063.112] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg"
	[0063.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg."
	[0063.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.Boom"
	[0063.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.113] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad9
	[0063.113] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9342d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.113] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.113] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3ab6, lpOverlapped=0x0) returned 1
	[0063.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="SectionHeading.jpg"
	[0063.127] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.127] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3ab6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3ab6, lpOverlapped=0x0) returned 1
	[0063.128] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.128] CloseHandle (hObject=0x9c) returned 1
	[0063.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.boom")) returned 1
	[0063.129] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.129] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.129] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StaticText.jpg") returned -1
	[0063.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StaticText.jpg") returned -1
	[0063.129] lstrcmpiA (lpString1="", lpString2="StaticText.jpg") returned -1
	[0063.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="SectionHeading.jpg"
	[0063.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.129] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.129] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg"
	[0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.zip") returned 0
	[0063.129] lstrlenA (lpString="*.zip") returned 5
	[0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.rar") returned 0
	[0063.129] lstrlenA (lpString="*.rar") returned 5
	[0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.7z") returned 0
	[0063.129] lstrlenA (lpString="*.7z") returned 4
	[0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.tar") returned 0
	[0063.129] lstrlenA (lpString="*.tar") returned 5
	[0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.gzip") returned 0
	[0063.129] lstrlenA (lpString="*.gzip") returned 6
	[0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.jpg") returned 1
	[0063.130] lstrlenA (lpString="*.jpg") returned 5
	[0063.130] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg"
	[0063.130] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg"
	[0063.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg."
	[0063.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.Boom"
	[0063.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.131] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a7
	[0063.131] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5abe1b90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.131] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.131] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3784, lpOverlapped=0x0) returned 1
	[0063.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="StaticText.jpg"
	[0063.143] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.143] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3784, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3784, lpOverlapped=0x0) returned 1
	[0063.143] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.143] CloseHandle (hObject=0x9c) returned 1
	[0063.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.boom")) returned 1
	[0063.144] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.144] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TEXTAREA.JPG") returned -1
	[0063.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTAREA.JPG") returned -1
	[0063.144] lstrcmpiA (lpString1="", lpString2="TEXTAREA.JPG") returned -1
	[0063.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="StaticText.jpg"
	[0063.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG"
	[0063.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.zip") returned 0
	[0063.145] lstrlenA (lpString="*.zip") returned 5
	[0063.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.rar") returned 0
	[0063.145] lstrlenA (lpString="*.rar") returned 5
	[0063.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.7z") returned 0
	[0063.145] lstrlenA (lpString="*.7z") returned 4
	[0063.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.tar") returned 0
	[0063.145] lstrlenA (lpString="*.tar") returned 5
	[0063.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.gzip") returned 0
	[0063.145] lstrlenA (lpString="*.gzip") returned 6
	[0063.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.jpg") returned 1
	[0063.145] lstrlenA (lpString="*.jpg") returned 5
	[0063.145] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG"
	[0063.145] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG"
	[0063.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG."
	[0063.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.Boom"
	[0063.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.146] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3983
	[0063.146] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.146] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.146] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3960, lpOverlapped=0x0) returned 1
	[0063.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="TEXTAREA.JPG"
	[0063.174] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.174] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3960, lpOverlapped=0x0) returned 1
	[0063.174] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.174] CloseHandle (hObject=0x9c) returned 1
	[0063.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.boom")) returned 1
	[0063.175] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.175] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.175] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TEXTBOX.JPG") returned -1
	[0063.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTBOX.JPG") returned -1
	[0063.175] lstrcmpiA (lpString1="", lpString2="TEXTBOX.JPG") returned -1
	[0063.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="TEXTAREA.JPG"
	[0063.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.175] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.175] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG"
	[0063.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.zip") returned 0
	[0063.175] lstrlenA (lpString="*.zip") returned 5
	[0063.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.rar") returned 0
	[0063.175] lstrlenA (lpString="*.rar") returned 5
	[0063.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.7z") returned 0
	[0063.176] lstrlenA (lpString="*.7z") returned 4
	[0063.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.tar") returned 0
	[0063.176] lstrlenA (lpString="*.tar") returned 5
	[0063.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.gzip") returned 0
	[0063.176] lstrlenA (lpString="*.gzip") returned 6
	[0063.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.jpg") returned 1
	[0063.176] lstrlenA (lpString="*.jpg") returned 5
	[0063.176] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG"
	[0063.176] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG"
	[0063.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG."
	[0063.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.Boom"
	[0063.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.176] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a97
	[0063.177] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.177] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.177] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3a74, lpOverlapped=0x0) returned 1
	[0063.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="TEXTBOX.JPG"
	[0063.188] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.188] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3a74, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3a74, lpOverlapped=0x0) returned 1
	[0063.188] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.189] CloseHandle (hObject=0x9c) returned 1
	[0063.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.boom")) returned 1
	[0063.189] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.189] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.189] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TEXTVIEW.JPG") returned -1
	[0063.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTVIEW.JPG") returned -1
	[0063.189] lstrcmpiA (lpString1="", lpString2="TEXTVIEW.JPG") returned -1
	[0063.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="TEXTBOX.JPG"
	[0063.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG"
	[0063.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.zip") returned 0
	[0063.190] lstrlenA (lpString="*.zip") returned 5
	[0063.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.rar") returned 0
	[0063.190] lstrlenA (lpString="*.rar") returned 5
	[0063.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.7z") returned 0
	[0063.190] lstrlenA (lpString="*.7z") returned 4
	[0063.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.tar") returned 0
	[0063.190] lstrlenA (lpString="*.tar") returned 5
	[0063.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.gzip") returned 0
	[0063.190] lstrlenA (lpString="*.gzip") returned 6
	[0063.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.jpg") returned 1
	[0063.190] lstrlenA (lpString="*.jpg") returned 5
	[0063.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG"
	[0063.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG"
	[0063.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG."
	[0063.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.Boom"
	[0063.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.191] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42fa
	[0063.191] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.191] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.191] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x42d7, lpOverlapped=0x0) returned 1
	[0063.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="TEXTVIEW.JPG"
	[0063.213] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.213] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x42d7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x42d7, lpOverlapped=0x0) returned 1
	[0063.214] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.214] CloseHandle (hObject=0x9c) returned 1
	[0063.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.boom")) returned 1
	[0063.215] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.215] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.215] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnformattedNumeric.jpg") returned -1
	[0063.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnformattedNumeric.jpg") returned -1
	[0063.215] lstrcmpiA (lpString1="", lpString2="UnformattedNumeric.jpg") returned -1
	[0063.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="TEXTVIEW.JPG"
	[0063.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\"
	[0063.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned=""
	[0063.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt"
	[0063.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20
	[0063.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg"
	[0063.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.zip") returned 0
	[0063.215] lstrlenA (lpString="*.zip") returned 5
	[0063.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.rar") returned 0
	[0063.215] lstrlenA (lpString="*.rar") returned 5
	[0063.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.7z") returned 0
	[0063.215] lstrlenA (lpString="*.7z") returned 4
	[0063.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.tar") returned 0
	[0063.215] lstrlenA (lpString="*.tar") returned 5
	[0063.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.gzip") returned 0
	[0063.216] lstrlenA (lpString="*.gzip") returned 6
	[0063.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.jpg") returned 1
	[0063.216] lstrlenA (lpString="*.jpg") returned 5
	[0063.216] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg"
	[0063.216] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg"
	[0063.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg."
	[0063.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.Boom"
	[0063.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.216] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4127
	[0063.216] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.216] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.217] ReadFile (in: hFile=0x9c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4104, lpOverlapped=0x0) returned 1
	[0063.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="UnformattedNumeric.jpg"
	[0063.226] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.226] WriteFile (in: hFile=0x9c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4104, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4104, lpOverlapped=0x0) returned 1
	[0063.226] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.226] CloseHandle (hObject=0x9c) returned 1
	[0063.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.boom")) returned 1
	[0063.227] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0
	[0063.227] FindClose (in: hFindFile=0x8b7f68 | out: hFindFile=0x8b7f68) returned 1
	[0063.227] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.227] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.ICO") returned -1
	[0063.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1
	[0063.227] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1
	[0063.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*"
	[0063.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.228] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO"
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.zip") returned 0
	[0063.228] lstrlenA (lpString="*.zip") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.rar") returned 0
	[0063.228] lstrlenA (lpString="*.rar") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.7z") returned 0
	[0063.228] lstrlenA (lpString="*.7z") returned 4
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.tar") returned 0
	[0063.228] lstrlenA (lpString="*.tar") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.gzip") returned 0
	[0063.228] lstrlenA (lpString="*.gzip") returned 6
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.jpg") returned 0
	[0063.228] lstrlenA (lpString="*.jpg") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.jpeg") returned 0
	[0063.228] lstrlenA (lpString="*.jpeg") returned 6
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.psd") returned 0
	[0063.228] lstrlenA (lpString="*.psd") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.cdr") returned 0
	[0063.228] lstrlenA (lpString="*.cdr") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.dwg") returned 0
	[0063.228] lstrlenA (lpString="*.dwg") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.max") returned 0
	[0063.228] lstrlenA (lpString="*.max") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.bmp") returned 0
	[0063.228] lstrlenA (lpString="*.bmp") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.gif") returned 0
	[0063.228] lstrlenA (lpString="*.gif") returned 5
	[0063.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.png") returned 0
	[0063.229] lstrlenA (lpString="*.png") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.doc") returned 0
	[0063.229] lstrlenA (lpString="*.doc") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.docx") returned 0
	[0063.229] lstrlenA (lpString="*.docx") returned 6
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.xls") returned 0
	[0063.229] lstrlenA (lpString="*.xls") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.xlsx") returned 0
	[0063.229] lstrlenA (lpString="*.xlsx") returned 6
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ppt") returned 0
	[0063.229] lstrlenA (lpString="*.ppt") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pptx") returned 0
	[0063.229] lstrlenA (lpString="*.pptx") returned 6
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.txt") returned 0
	[0063.229] lstrlenA (lpString="*.txt") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pdf") returned 0
	[0063.229] lstrlenA (lpString="*.pdf") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.djvu") returned 0
	[0063.229] lstrlenA (lpString="*.djvu") returned 6
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.htm") returned 0
	[0063.229] lstrlenA (lpString="*.htm") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.html") returned 0
	[0063.229] lstrlenA (lpString="*.html") returned 6
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mdb") returned 0
	[0063.229] lstrlenA (lpString="*.mdb") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.cer") returned 0
	[0063.229] lstrlenA (lpString="*.cer") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.p12") returned 0
	[0063.229] lstrlenA (lpString="*.p12") returned 5
	[0063.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pfx") returned 0
	[0063.229] lstrlenA (lpString="*.pfx") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.kwm") returned 0
	[0063.230] lstrlenA (lpString="*.kwm") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pwm") returned 0
	[0063.230] lstrlenA (lpString="*.pwm") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.1cd") returned 0
	[0063.230] lstrlenA (lpString="*.1cd") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.md") returned 0
	[0063.230] lstrlenA (lpString="*.md") returned 4
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mdf") returned 0
	[0063.230] lstrlenA (lpString="*.mdf") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.dbf") returned 0
	[0063.230] lstrlenA (lpString="*.dbf") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.odt") returned 0
	[0063.230] lstrlenA (lpString="*.odt") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.vob") returned 0
	[0063.230] lstrlenA (lpString="*.vob") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ifo") returned 0
	[0063.230] lstrlenA (lpString="*.ifo") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.lnk") returned 0
	[0063.230] lstrlenA (lpString="*.lnk") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.torrent") returned 0
	[0063.230] lstrlenA (lpString="*.torrent") returned 9
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mov") returned 0
	[0063.230] lstrlenA (lpString="*.mov") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.m2v") returned 0
	[0063.230] lstrlenA (lpString="*.m2v") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.3gp") returned 0
	[0063.230] lstrlenA (lpString="*.3gp") returned 5
	[0063.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mpeg") returned 0
	[0063.230] lstrlenA (lpString="*.mpeg") returned 6
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mpg") returned 0
	[0063.231] lstrlenA (lpString="*.mpg") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.flv") returned 0
	[0063.231] lstrlenA (lpString="*.flv") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.avi") returned 0
	[0063.231] lstrlenA (lpString="*.avi") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mp4") returned 0
	[0063.231] lstrlenA (lpString="*.mp4") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wmv") returned 0
	[0063.231] lstrlenA (lpString="*.wmv") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.divx") returned 0
	[0063.231] lstrlenA (lpString="*.divx") returned 6
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mkv") returned 0
	[0063.231] lstrlenA (lpString="*.mkv") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mp3") returned 0
	[0063.231] lstrlenA (lpString="*.mp3") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wav") returned 0
	[0063.231] lstrlenA (lpString="*.wav") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.flac") returned 0
	[0063.231] lstrlenA (lpString="*.flac") returned 6
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ape") returned 0
	[0063.231] lstrlenA (lpString="*.ape") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wma") returned 0
	[0063.231] lstrlenA (lpString="*.wma") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ac3") returned 0
	[0063.231] lstrlenA (lpString="*.ac3") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.exe") returned 0
	[0063.231] lstrlenA (lpString="*.exe") returned 5
	[0063.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.apk") returned 0
	[0063.231] lstrlenA (lpString="*.apk") returned 5
	[0063.231] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.232] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1
	[0063.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1
	[0063.232] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1
	[0063.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned="FORM.ICO"
	[0063.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html"
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.zip") returned 0
	[0063.232] lstrlenA (lpString="*.zip") returned 5
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.rar") returned 0
	[0063.232] lstrlenA (lpString="*.rar") returned 5
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.7z") returned 0
	[0063.232] lstrlenA (lpString="*.7z") returned 4
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.tar") returned 0
	[0063.232] lstrlenA (lpString="*.tar") returned 5
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.gzip") returned 0
	[0063.232] lstrlenA (lpString="*.gzip") returned 6
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.jpg") returned 0
	[0063.232] lstrlenA (lpString="*.jpg") returned 5
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0
	[0063.232] lstrlenA (lpString="*.jpeg") returned 6
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.psd") returned 0
	[0063.232] lstrlenA (lpString="*.psd") returned 5
	[0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.cdr") returned 0
	[0063.232] lstrlenA (lpString="*.cdr") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.dwg") returned 0
	[0063.233] lstrlenA (lpString="*.dwg") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.max") returned 0
	[0063.233] lstrlenA (lpString="*.max") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.bmp") returned 0
	[0063.233] lstrlenA (lpString="*.bmp") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.gif") returned 0
	[0063.233] lstrlenA (lpString="*.gif") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.png") returned 0
	[0063.233] lstrlenA (lpString="*.png") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.doc") returned 0
	[0063.233] lstrlenA (lpString="*.doc") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.docx") returned 0
	[0063.233] lstrlenA (lpString="*.docx") returned 6
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.xls") returned 0
	[0063.233] lstrlenA (lpString="*.xls") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0
	[0063.233] lstrlenA (lpString="*.xlsx") returned 6
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.ppt") returned 0
	[0063.233] lstrlenA (lpString="*.ppt") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.pptx") returned 0
	[0063.233] lstrlenA (lpString="*.pptx") returned 6
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.txt") returned 0
	[0063.233] lstrlenA (lpString="*.txt") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.pdf") returned 0
	[0063.233] lstrlenA (lpString="*.pdf") returned 5
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.djvu") returned 0
	[0063.233] lstrlenA (lpString="*.djvu") returned 6
	[0063.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.htm") returned 0
	[0063.233] lstrlenA (lpString="*.htm") returned 5
	[0063.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.html") returned 1
	[0063.234] lstrlenA (lpString="*.html") returned 6
	[0063.234] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html"
	[0063.234] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html"
	[0063.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html."
	[0063.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.Boom"
	[0063.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.246] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b2
	[0063.246] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.246] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.246] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x48f, lpOverlapped=0x0) returned 1
	[0063.275] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0063.275] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.275] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x48f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x48f, lpOverlapped=0x0) returned 1
	[0063.275] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.275] CloseHandle (hObject=0x98) returned 1
	[0063.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.boom")) returned 1
	[0063.276] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.276] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1
	[0063.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1
	[0063.276] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1
	[0063.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0063.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.276] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html"
	[0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0
	[0063.276] lstrlenA (lpString="*.zip") returned 5
	[0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0
	[0063.276] lstrlenA (lpString="*.rar") returned 5
	[0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0
	[0063.277] lstrlenA (lpString="*.7z") returned 4
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0
	[0063.277] lstrlenA (lpString="*.tar") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0
	[0063.277] lstrlenA (lpString="*.gzip") returned 6
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0
	[0063.277] lstrlenA (lpString="*.jpg") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0
	[0063.277] lstrlenA (lpString="*.jpeg") returned 6
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0
	[0063.277] lstrlenA (lpString="*.psd") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0
	[0063.277] lstrlenA (lpString="*.cdr") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0
	[0063.277] lstrlenA (lpString="*.dwg") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0
	[0063.277] lstrlenA (lpString="*.max") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0
	[0063.277] lstrlenA (lpString="*.bmp") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0
	[0063.277] lstrlenA (lpString="*.gif") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0
	[0063.277] lstrlenA (lpString="*.png") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0
	[0063.277] lstrlenA (lpString="*.doc") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0
	[0063.277] lstrlenA (lpString="*.docx") returned 6
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0
	[0063.277] lstrlenA (lpString="*.xls") returned 5
	[0063.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0
	[0063.277] lstrlenA (lpString="*.xlsx") returned 6
	[0063.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0
	[0063.278] lstrlenA (lpString="*.ppt") returned 5
	[0063.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0
	[0063.278] lstrlenA (lpString="*.pptx") returned 6
	[0063.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0
	[0063.278] lstrlenA (lpString="*.txt") returned 5
	[0063.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0
	[0063.278] lstrlenA (lpString="*.pdf") returned 5
	[0063.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0
	[0063.278] lstrlenA (lpString="*.djvu") returned 6
	[0063.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0
	[0063.278] lstrlenA (lpString="*.htm") returned 5
	[0063.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1
	[0063.278] lstrlenA (lpString="*.html") returned 6
	[0063.278] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html"
	[0063.278] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html"
	[0063.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html."
	[0063.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.Boom"
	[0063.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.283] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a7
	[0063.283] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.284] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.284] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x784, lpOverlapped=0x0) returned 1
	[0063.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0063.297] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.297] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x784, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x784, lpOverlapped=0x0) returned 1
	[0063.297] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.298] CloseHandle (hObject=0x98) returned 1
	[0063.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.boom")) returned 1
	[0063.299] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.299] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.299] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsDoNotTrust.html") returned -1
	[0063.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsDoNotTrust.html") returned 1
	[0063.299] lstrcmpiA (lpString1="", lpString2="FormsDoNotTrust.html") returned -1
	[0063.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0063.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsDoNotTrust.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html"
	[0063.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.zip") returned 0
	[0063.299] lstrlenA (lpString="*.zip") returned 5
	[0063.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.rar") returned 0
	[0063.299] lstrlenA (lpString="*.rar") returned 5
	[0063.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.7z") returned 0
	[0063.299] lstrlenA (lpString="*.7z") returned 4
	[0063.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.tar") returned 0
	[0063.299] lstrlenA (lpString="*.tar") returned 5
	[0063.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.gzip") returned 0
	[0063.299] lstrlenA (lpString="*.gzip") returned 6
	[0063.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.jpg") returned 0
	[0063.300] lstrlenA (lpString="*.jpg") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.jpeg") returned 0
	[0063.300] lstrlenA (lpString="*.jpeg") returned 6
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.psd") returned 0
	[0063.300] lstrlenA (lpString="*.psd") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.cdr") returned 0
	[0063.300] lstrlenA (lpString="*.cdr") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.dwg") returned 0
	[0063.300] lstrlenA (lpString="*.dwg") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.max") returned 0
	[0063.300] lstrlenA (lpString="*.max") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.bmp") returned 0
	[0063.300] lstrlenA (lpString="*.bmp") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.gif") returned 0
	[0063.300] lstrlenA (lpString="*.gif") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.png") returned 0
	[0063.300] lstrlenA (lpString="*.png") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.doc") returned 0
	[0063.300] lstrlenA (lpString="*.doc") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.docx") returned 0
	[0063.300] lstrlenA (lpString="*.docx") returned 6
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.xls") returned 0
	[0063.300] lstrlenA (lpString="*.xls") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.xlsx") returned 0
	[0063.300] lstrlenA (lpString="*.xlsx") returned 6
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.ppt") returned 0
	[0063.300] lstrlenA (lpString="*.ppt") returned 5
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.pptx") returned 0
	[0063.300] lstrlenA (lpString="*.pptx") returned 6
	[0063.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.txt") returned 0
	[0063.301] lstrlenA (lpString="*.txt") returned 5
	[0063.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.pdf") returned 0
	[0063.301] lstrlenA (lpString="*.pdf") returned 5
	[0063.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.djvu") returned 0
	[0063.301] lstrlenA (lpString="*.djvu") returned 6
	[0063.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.htm") returned 0
	[0063.301] lstrlenA (lpString="*.htm") returned 5
	[0063.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.html") returned 1
	[0063.301] lstrlenA (lpString="*.html") returned 6
	[0063.301] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html"
	[0063.301] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html"
	[0063.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html."
	[0063.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.Boom"
	[0063.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.302] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x805
	[0063.302] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.303] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.303] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7e2, lpOverlapped=0x0) returned 1
	[0063.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="FormsDoNotTrust.html"
	[0063.426] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.427] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7e2, lpOverlapped=0x0) returned 1
	[0063.427] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.427] CloseHandle (hObject=0x98) returned 1
	[0063.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.boom")) returned 1
	[0063.427] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.428] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePage.html") returned -1
	[0063.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1
	[0063.428] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1
	[0063.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="FormsDoNotTrust.html"
	[0063.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html"
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.zip") returned 0
	[0063.428] lstrlenA (lpString="*.zip") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.rar") returned 0
	[0063.428] lstrlenA (lpString="*.rar") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.7z") returned 0
	[0063.428] lstrlenA (lpString="*.7z") returned 4
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.tar") returned 0
	[0063.428] lstrlenA (lpString="*.tar") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.gzip") returned 0
	[0063.428] lstrlenA (lpString="*.gzip") returned 6
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.jpg") returned 0
	[0063.428] lstrlenA (lpString="*.jpg") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.jpeg") returned 0
	[0063.428] lstrlenA (lpString="*.jpeg") returned 6
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.psd") returned 0
	[0063.428] lstrlenA (lpString="*.psd") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.cdr") returned 0
	[0063.428] lstrlenA (lpString="*.cdr") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.dwg") returned 0
	[0063.428] lstrlenA (lpString="*.dwg") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.max") returned 0
	[0063.428] lstrlenA (lpString="*.max") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.bmp") returned 0
	[0063.428] lstrlenA (lpString="*.bmp") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.gif") returned 0
	[0063.428] lstrlenA (lpString="*.gif") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.png") returned 0
	[0063.428] lstrlenA (lpString="*.png") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.doc") returned 0
	[0063.428] lstrlenA (lpString="*.doc") returned 5
	[0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.docx") returned 0
	[0063.428] lstrlenA (lpString="*.docx") returned 6
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.xls") returned 0
	[0063.429] lstrlenA (lpString="*.xls") returned 5
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.xlsx") returned 0
	[0063.429] lstrlenA (lpString="*.xlsx") returned 6
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.ppt") returned 0
	[0063.429] lstrlenA (lpString="*.ppt") returned 5
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.pptx") returned 0
	[0063.429] lstrlenA (lpString="*.pptx") returned 6
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.txt") returned 0
	[0063.429] lstrlenA (lpString="*.txt") returned 5
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.pdf") returned 0
	[0063.429] lstrlenA (lpString="*.pdf") returned 5
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.djvu") returned 0
	[0063.429] lstrlenA (lpString="*.djvu") returned 6
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.htm") returned 0
	[0063.429] lstrlenA (lpString="*.htm") returned 5
	[0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.html") returned 1
	[0063.429] lstrlenA (lpString="*.html") returned 6
	[0063.429] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html"
	[0063.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html"
	[0063.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html."
	[0063.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.Boom"
	[0063.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.434] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc96
	[0063.434] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.434] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.434] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc73, lpOverlapped=0x0) returned 1
	[0063.446] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="FormsHomePage.html"
	[0063.446] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.447] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc73, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc73, lpOverlapped=0x0) returned 1
	[0063.447] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.447] CloseHandle (hObject=0x98) returned 1
	[0063.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.boom")) returned 1
	[0063.447] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.448] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.448] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageScript.js") returned -1
	[0063.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1
	[0063.448] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1
	[0063.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="FormsHomePage.html"
	[0063.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.448] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js"
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.zip") returned 0
	[0063.448] lstrlenA (lpString="*.zip") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.rar") returned 0
	[0063.448] lstrlenA (lpString="*.rar") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.7z") returned 0
	[0063.448] lstrlenA (lpString="*.7z") returned 4
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.tar") returned 0
	[0063.448] lstrlenA (lpString="*.tar") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0
	[0063.448] lstrlenA (lpString="*.gzip") returned 6
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0
	[0063.448] lstrlenA (lpString="*.jpg") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0
	[0063.448] lstrlenA (lpString="*.jpeg") returned 6
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.psd") returned 0
	[0063.448] lstrlenA (lpString="*.psd") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.cdr") returned 0
	[0063.448] lstrlenA (lpString="*.cdr") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.dwg") returned 0
	[0063.448] lstrlenA (lpString="*.dwg") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.max") returned 0
	[0063.448] lstrlenA (lpString="*.max") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.bmp") returned 0
	[0063.448] lstrlenA (lpString="*.bmp") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.gif") returned 0
	[0063.448] lstrlenA (lpString="*.gif") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.png") returned 0
	[0063.448] lstrlenA (lpString="*.png") returned 5
	[0063.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.doc") returned 0
	[0063.448] lstrlenA (lpString="*.doc") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.docx") returned 0
	[0063.449] lstrlenA (lpString="*.docx") returned 6
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.xls") returned 0
	[0063.449] lstrlenA (lpString="*.xls") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.xlsx") returned 0
	[0063.449] lstrlenA (lpString="*.xlsx") returned 6
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ppt") returned 0
	[0063.449] lstrlenA (lpString="*.ppt") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pptx") returned 0
	[0063.449] lstrlenA (lpString="*.pptx") returned 6
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.txt") returned 0
	[0063.449] lstrlenA (lpString="*.txt") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pdf") returned 0
	[0063.449] lstrlenA (lpString="*.pdf") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.djvu") returned 0
	[0063.449] lstrlenA (lpString="*.djvu") returned 6
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.htm") returned 0
	[0063.449] lstrlenA (lpString="*.htm") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.html") returned 0
	[0063.449] lstrlenA (lpString="*.html") returned 6
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mdb") returned 0
	[0063.449] lstrlenA (lpString="*.mdb") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.cer") returned 0
	[0063.449] lstrlenA (lpString="*.cer") returned 5
	[0063.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.p12") returned 0
	[0063.451] lstrlenA (lpString="*.p12") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pfx") returned 0
	[0063.451] lstrlenA (lpString="*.pfx") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.kwm") returned 0
	[0063.451] lstrlenA (lpString="*.kwm") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pwm") returned 0
	[0063.451] lstrlenA (lpString="*.pwm") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.1cd") returned 0
	[0063.451] lstrlenA (lpString="*.1cd") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.md") returned 0
	[0063.451] lstrlenA (lpString="*.md") returned 4
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mdf") returned 0
	[0063.451] lstrlenA (lpString="*.mdf") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.dbf") returned 0
	[0063.451] lstrlenA (lpString="*.dbf") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.odt") returned 0
	[0063.451] lstrlenA (lpString="*.odt") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.vob") returned 0
	[0063.451] lstrlenA (lpString="*.vob") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ifo") returned 0
	[0063.451] lstrlenA (lpString="*.ifo") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.lnk") returned 0
	[0063.451] lstrlenA (lpString="*.lnk") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.torrent") returned 0
	[0063.451] lstrlenA (lpString="*.torrent") returned 9
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mov") returned 0
	[0063.451] lstrlenA (lpString="*.mov") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.m2v") returned 0
	[0063.451] lstrlenA (lpString="*.m2v") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.3gp") returned 0
	[0063.451] lstrlenA (lpString="*.3gp") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mpeg") returned 0
	[0063.451] lstrlenA (lpString="*.mpeg") returned 6
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mpg") returned 0
	[0063.451] lstrlenA (lpString="*.mpg") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.flv") returned 0
	[0063.451] lstrlenA (lpString="*.flv") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.avi") returned 0
	[0063.451] lstrlenA (lpString="*.avi") returned 5
	[0063.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mp4") returned 0
	[0063.452] lstrlenA (lpString="*.mp4") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wmv") returned 0
	[0063.452] lstrlenA (lpString="*.wmv") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.divx") returned 0
	[0063.452] lstrlenA (lpString="*.divx") returned 6
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mkv") returned 0
	[0063.452] lstrlenA (lpString="*.mkv") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mp3") returned 0
	[0063.452] lstrlenA (lpString="*.mp3") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wav") returned 0
	[0063.452] lstrlenA (lpString="*.wav") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.flac") returned 0
	[0063.452] lstrlenA (lpString="*.flac") returned 6
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ape") returned 0
	[0063.452] lstrlenA (lpString="*.ape") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wma") returned 0
	[0063.452] lstrlenA (lpString="*.wma") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ac3") returned 0
	[0063.452] lstrlenA (lpString="*.ac3") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.exe") returned 0
	[0063.452] lstrlenA (lpString="*.exe") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.apk") returned 0
	[0063.452] lstrlenA (lpString="*.apk") returned 5
	[0063.452] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.452] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.452] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageStyle.css") returned -1
	[0063.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1
	[0063.452] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1
	[0063.452] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned="FormsHomePageScript.js"
	[0063.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.452] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css"
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.zip") returned 0
	[0063.452] lstrlenA (lpString="*.zip") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.rar") returned 0
	[0063.452] lstrlenA (lpString="*.rar") returned 5
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.7z") returned 0
	[0063.452] lstrlenA (lpString="*.7z") returned 4
	[0063.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.tar") returned 0
	[0063.453] lstrlenA (lpString="*.tar") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.gzip") returned 0
	[0063.453] lstrlenA (lpString="*.gzip") returned 6
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.jpg") returned 0
	[0063.453] lstrlenA (lpString="*.jpg") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.jpeg") returned 0
	[0063.453] lstrlenA (lpString="*.jpeg") returned 6
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.psd") returned 0
	[0063.453] lstrlenA (lpString="*.psd") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.cdr") returned 0
	[0063.453] lstrlenA (lpString="*.cdr") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.dwg") returned 0
	[0063.453] lstrlenA (lpString="*.dwg") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.max") returned 0
	[0063.453] lstrlenA (lpString="*.max") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.bmp") returned 0
	[0063.453] lstrlenA (lpString="*.bmp") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.gif") returned 0
	[0063.453] lstrlenA (lpString="*.gif") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.png") returned 0
	[0063.453] lstrlenA (lpString="*.png") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.doc") returned 0
	[0063.453] lstrlenA (lpString="*.doc") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.docx") returned 0
	[0063.453] lstrlenA (lpString="*.docx") returned 6
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.xls") returned 0
	[0063.453] lstrlenA (lpString="*.xls") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.xlsx") returned 0
	[0063.453] lstrlenA (lpString="*.xlsx") returned 6
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ppt") returned 0
	[0063.453] lstrlenA (lpString="*.ppt") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pptx") returned 0
	[0063.453] lstrlenA (lpString="*.pptx") returned 6
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.txt") returned 0
	[0063.453] lstrlenA (lpString="*.txt") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pdf") returned 0
	[0063.453] lstrlenA (lpString="*.pdf") returned 5
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.djvu") returned 0
	[0063.453] lstrlenA (lpString="*.djvu") returned 6
	[0063.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.htm") returned 0
	[0063.455] lstrlenA (lpString="*.htm") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.html") returned 0
	[0063.456] lstrlenA (lpString="*.html") returned 6
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mdb") returned 0
	[0063.456] lstrlenA (lpString="*.mdb") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.cer") returned 0
	[0063.456] lstrlenA (lpString="*.cer") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.p12") returned 0
	[0063.456] lstrlenA (lpString="*.p12") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pfx") returned 0
	[0063.456] lstrlenA (lpString="*.pfx") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.kwm") returned 0
	[0063.456] lstrlenA (lpString="*.kwm") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pwm") returned 0
	[0063.456] lstrlenA (lpString="*.pwm") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.1cd") returned 0
	[0063.456] lstrlenA (lpString="*.1cd") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.md") returned 0
	[0063.456] lstrlenA (lpString="*.md") returned 4
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mdf") returned 0
	[0063.456] lstrlenA (lpString="*.mdf") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.dbf") returned 0
	[0063.456] lstrlenA (lpString="*.dbf") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.odt") returned 0
	[0063.456] lstrlenA (lpString="*.odt") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.vob") returned 0
	[0063.456] lstrlenA (lpString="*.vob") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ifo") returned 0
	[0063.456] lstrlenA (lpString="*.ifo") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.lnk") returned 0
	[0063.456] lstrlenA (lpString="*.lnk") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.torrent") returned 0
	[0063.456] lstrlenA (lpString="*.torrent") returned 9
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mov") returned 0
	[0063.456] lstrlenA (lpString="*.mov") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.m2v") returned 0
	[0063.456] lstrlenA (lpString="*.m2v") returned 5
	[0063.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.3gp") returned 0
	[0063.457] lstrlenA (lpString="*.3gp") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mpeg") returned 0
	[0063.457] lstrlenA (lpString="*.mpeg") returned 6
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mpg") returned 0
	[0063.457] lstrlenA (lpString="*.mpg") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.flv") returned 0
	[0063.457] lstrlenA (lpString="*.flv") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.avi") returned 0
	[0063.457] lstrlenA (lpString="*.avi") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mp4") returned 0
	[0063.457] lstrlenA (lpString="*.mp4") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wmv") returned 0
	[0063.457] lstrlenA (lpString="*.wmv") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.divx") returned 0
	[0063.457] lstrlenA (lpString="*.divx") returned 6
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mkv") returned 0
	[0063.457] lstrlenA (lpString="*.mkv") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mp3") returned 0
	[0063.457] lstrlenA (lpString="*.mp3") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wav") returned 0
	[0063.457] lstrlenA (lpString="*.wav") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.flac") returned 0
	[0063.457] lstrlenA (lpString="*.flac") returned 6
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ape") returned 0
	[0063.457] lstrlenA (lpString="*.ape") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wma") returned 0
	[0063.457] lstrlenA (lpString="*.wma") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ac3") returned 0
	[0063.457] lstrlenA (lpString="*.ac3") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.exe") returned 0
	[0063.457] lstrlenA (lpString="*.exe") returned 5
	[0063.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.apk") returned 0
	[0063.457] lstrlenA (lpString="*.apk") returned 5
	[0063.457] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.457] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.457] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1
	[0063.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1
	[0063.457] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1
	[0063.457] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css"
	[0063.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.458] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html"
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0
	[0063.458] lstrlenA (lpString="*.zip") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0
	[0063.458] lstrlenA (lpString="*.rar") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0
	[0063.458] lstrlenA (lpString="*.7z") returned 4
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0
	[0063.458] lstrlenA (lpString="*.tar") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0
	[0063.458] lstrlenA (lpString="*.gzip") returned 6
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0
	[0063.458] lstrlenA (lpString="*.jpg") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0
	[0063.458] lstrlenA (lpString="*.jpeg") returned 6
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0
	[0063.458] lstrlenA (lpString="*.psd") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0
	[0063.458] lstrlenA (lpString="*.cdr") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0
	[0063.458] lstrlenA (lpString="*.dwg") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0
	[0063.458] lstrlenA (lpString="*.max") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0
	[0063.458] lstrlenA (lpString="*.bmp") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0
	[0063.458] lstrlenA (lpString="*.gif") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0
	[0063.458] lstrlenA (lpString="*.png") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0
	[0063.458] lstrlenA (lpString="*.doc") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0
	[0063.458] lstrlenA (lpString="*.docx") returned 6
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0
	[0063.458] lstrlenA (lpString="*.xls") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0
	[0063.458] lstrlenA (lpString="*.xlsx") returned 6
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0
	[0063.458] lstrlenA (lpString="*.ppt") returned 5
	[0063.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0
	[0063.458] lstrlenA (lpString="*.pptx") returned 6
	[0063.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0
	[0063.459] lstrlenA (lpString="*.txt") returned 5
	[0063.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0
	[0063.459] lstrlenA (lpString="*.pdf") returned 5
	[0063.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0
	[0063.459] lstrlenA (lpString="*.djvu") returned 6
	[0063.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0
	[0063.459] lstrlenA (lpString="*.htm") returned 5
	[0063.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1
	[0063.459] lstrlenA (lpString="*.html") returned 6
	[0063.459] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html"
	[0063.459] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html"
	[0063.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html."
	[0063.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.Boom"
	[0063.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.460] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2
	[0063.460] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.460] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.460] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x37f, lpOverlapped=0x0) returned 1
	[0063.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0063.502] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.502] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x37f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x37f, lpOverlapped=0x0) returned 1
	[0063.502] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.502] CloseHandle (hObject=0x98) returned 1
	[0063.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.boom")) returned 1
	[0063.503] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.503] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.507] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1
	[0063.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1
	[0063.507] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1
	[0063.507] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0063.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.507] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.507] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.507] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.507] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html"
	[0063.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0
	[0063.507] lstrlenA (lpString="*.zip") returned 5
	[0063.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0
	[0063.507] lstrlenA (lpString="*.rar") returned 5
	[0063.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0
	[0063.507] lstrlenA (lpString="*.7z") returned 4
	[0063.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0
	[0063.507] lstrlenA (lpString="*.tar") returned 5
	[0063.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0
	[0063.507] lstrlenA (lpString="*.gzip") returned 6
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0
	[0063.508] lstrlenA (lpString="*.jpg") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0
	[0063.508] lstrlenA (lpString="*.jpeg") returned 6
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0
	[0063.508] lstrlenA (lpString="*.psd") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0
	[0063.508] lstrlenA (lpString="*.cdr") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0
	[0063.508] lstrlenA (lpString="*.dwg") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.max") returned 0
	[0063.508] lstrlenA (lpString="*.max") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0
	[0063.508] lstrlenA (lpString="*.bmp") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0
	[0063.508] lstrlenA (lpString="*.gif") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.png") returned 0
	[0063.508] lstrlenA (lpString="*.png") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0
	[0063.508] lstrlenA (lpString="*.doc") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0
	[0063.508] lstrlenA (lpString="*.docx") returned 6
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0
	[0063.508] lstrlenA (lpString="*.xls") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0
	[0063.508] lstrlenA (lpString="*.xlsx") returned 6
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0
	[0063.508] lstrlenA (lpString="*.ppt") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0
	[0063.508] lstrlenA (lpString="*.pptx") returned 6
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0
	[0063.508] lstrlenA (lpString="*.txt") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0
	[0063.508] lstrlenA (lpString="*.pdf") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0
	[0063.508] lstrlenA (lpString="*.djvu") returned 6
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0
	[0063.508] lstrlenA (lpString="*.htm") returned 5
	[0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.html") returned 1
	[0063.508] lstrlenA (lpString="*.html") returned 6
	[0063.508] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html"
	[0063.508] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html"
	[0063.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html."
	[0063.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.Boom"
	[0063.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.530] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262
	[0063.531] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1
	[0063.531] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.531] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x23f, lpOverlapped=0x0) returned 1
	[0063.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0063.535] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.535] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x23f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x23f, lpOverlapped=0x0) returned 1
	[0063.535] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.535] CloseHandle (hObject=0x98) returned 1
	[0063.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.boom")) returned 1
	[0063.536] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.536] lstrcmpA (lpString1=".", lpString2="FormsTemplates") returned -1
	[0063.536] lstrcmpA (lpString1="..", lpString2="FormsTemplates") returned -1
	[0063.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0063.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsTemplates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates"
	[0063.536] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates") returned 96
	[0063.536] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7f68
	[0063.553] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0063.553] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.553] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0063.553] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0063.553] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.553] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.553] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Customer Support.fdt") returned 1
	[0063.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Customer Support.fdt") returned 1
	[0063.553] lstrcmpiA (lpString1="", lpString2="Customer Support.fdt") returned -1
	[0063.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*") returned="*.*"
	[0063.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0xffffffff
	[0063.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0063.554] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0063.554] WriteFile (in: hFile=0x9c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0063.555] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0063.555] CloseHandle (hObject=0x9c) returned 1
	[0063.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Customer Support.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt"
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.zip") returned 0
	[0063.555] lstrlenA (lpString="*.zip") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.rar") returned 0
	[0063.555] lstrlenA (lpString="*.rar") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.7z") returned 0
	[0063.555] lstrlenA (lpString="*.7z") returned 4
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.tar") returned 0
	[0063.555] lstrlenA (lpString="*.tar") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.gzip") returned 0
	[0063.555] lstrlenA (lpString="*.gzip") returned 6
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.jpg") returned 0
	[0063.555] lstrlenA (lpString="*.jpg") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.jpeg") returned 0
	[0063.555] lstrlenA (lpString="*.jpeg") returned 6
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.psd") returned 0
	[0063.555] lstrlenA (lpString="*.psd") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.cdr") returned 0
	[0063.555] lstrlenA (lpString="*.cdr") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.dwg") returned 0
	[0063.555] lstrlenA (lpString="*.dwg") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.max") returned 0
	[0063.555] lstrlenA (lpString="*.max") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.bmp") returned 0
	[0063.555] lstrlenA (lpString="*.bmp") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.gif") returned 0
	[0063.555] lstrlenA (lpString="*.gif") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.png") returned 0
	[0063.555] lstrlenA (lpString="*.png") returned 5
	[0063.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.doc") returned 0
	[0063.555] lstrlenA (lpString="*.doc") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.docx") returned 0
	[0063.556] lstrlenA (lpString="*.docx") returned 6
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.xls") returned 0
	[0063.556] lstrlenA (lpString="*.xls") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.xlsx") returned 0
	[0063.556] lstrlenA (lpString="*.xlsx") returned 6
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ppt") returned 0
	[0063.556] lstrlenA (lpString="*.ppt") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pptx") returned 0
	[0063.556] lstrlenA (lpString="*.pptx") returned 6
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.txt") returned 0
	[0063.556] lstrlenA (lpString="*.txt") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pdf") returned 0
	[0063.556] lstrlenA (lpString="*.pdf") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.djvu") returned 0
	[0063.556] lstrlenA (lpString="*.djvu") returned 6
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.htm") returned 0
	[0063.556] lstrlenA (lpString="*.htm") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.html") returned 0
	[0063.556] lstrlenA (lpString="*.html") returned 6
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mdb") returned 0
	[0063.556] lstrlenA (lpString="*.mdb") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.cer") returned 0
	[0063.556] lstrlenA (lpString="*.cer") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.p12") returned 0
	[0063.556] lstrlenA (lpString="*.p12") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pfx") returned 0
	[0063.556] lstrlenA (lpString="*.pfx") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.kwm") returned 0
	[0063.556] lstrlenA (lpString="*.kwm") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pwm") returned 0
	[0063.556] lstrlenA (lpString="*.pwm") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.1cd") returned 0
	[0063.556] lstrlenA (lpString="*.1cd") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.md") returned 0
	[0063.556] lstrlenA (lpString="*.md") returned 4
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mdf") returned 0
	[0063.556] lstrlenA (lpString="*.mdf") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.dbf") returned 0
	[0063.556] lstrlenA (lpString="*.dbf") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.odt") returned 0
	[0063.556] lstrlenA (lpString="*.odt") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.vob") returned 0
	[0063.556] lstrlenA (lpString="*.vob") returned 5
	[0063.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ifo") returned 0
	[0063.557] lstrlenA (lpString="*.ifo") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.lnk") returned 0
	[0063.557] lstrlenA (lpString="*.lnk") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.torrent") returned 0
	[0063.557] lstrlenA (lpString="*.torrent") returned 9
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mov") returned 0
	[0063.557] lstrlenA (lpString="*.mov") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.m2v") returned 0
	[0063.557] lstrlenA (lpString="*.m2v") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.3gp") returned 0
	[0063.557] lstrlenA (lpString="*.3gp") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mpeg") returned 0
	[0063.557] lstrlenA (lpString="*.mpeg") returned 6
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mpg") returned 0
	[0063.557] lstrlenA (lpString="*.mpg") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.flv") returned 0
	[0063.557] lstrlenA (lpString="*.flv") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.avi") returned 0
	[0063.557] lstrlenA (lpString="*.avi") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mp4") returned 0
	[0063.557] lstrlenA (lpString="*.mp4") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.wmv") returned 0
	[0063.557] lstrlenA (lpString="*.wmv") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.divx") returned 0
	[0063.557] lstrlenA (lpString="*.divx") returned 6
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mkv") returned 0
	[0063.557] lstrlenA (lpString="*.mkv") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mp3") returned 0
	[0063.557] lstrlenA (lpString="*.mp3") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.wav") returned 0
	[0063.557] lstrlenA (lpString="*.wav") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.flac") returned 0
	[0063.557] lstrlenA (lpString="*.flac") returned 6
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ape") returned 0
	[0063.557] lstrlenA (lpString="*.ape") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.wma") returned 0
	[0063.557] lstrlenA (lpString="*.wma") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ac3") returned 0
	[0063.557] lstrlenA (lpString="*.ac3") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.exe") returned 0
	[0063.557] lstrlenA (lpString="*.exe") returned 5
	[0063.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.apk") returned 0
	[0063.557] lstrlenA (lpString="*.apk") returned 5
	[0063.557] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.557] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.558] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hardware Tracker.fdt") returned -1
	[0063.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hardware Tracker.fdt") returned 1
	[0063.558] lstrcmpiA (lpString1="", lpString2="Hardware Tracker.fdt") returned -1
	[0063.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned="Customer Support.fdt"
	[0063.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.558] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.558] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20
	[0063.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hardware Tracker.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt"
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.zip") returned 0
	[0063.558] lstrlenA (lpString="*.zip") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.rar") returned 0
	[0063.558] lstrlenA (lpString="*.rar") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.7z") returned 0
	[0063.558] lstrlenA (lpString="*.7z") returned 4
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.tar") returned 0
	[0063.558] lstrlenA (lpString="*.tar") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.gzip") returned 0
	[0063.558] lstrlenA (lpString="*.gzip") returned 6
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.jpg") returned 0
	[0063.558] lstrlenA (lpString="*.jpg") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.jpeg") returned 0
	[0063.558] lstrlenA (lpString="*.jpeg") returned 6
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.psd") returned 0
	[0063.558] lstrlenA (lpString="*.psd") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.cdr") returned 0
	[0063.558] lstrlenA (lpString="*.cdr") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.dwg") returned 0
	[0063.558] lstrlenA (lpString="*.dwg") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.max") returned 0
	[0063.558] lstrlenA (lpString="*.max") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.bmp") returned 0
	[0063.558] lstrlenA (lpString="*.bmp") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.gif") returned 0
	[0063.558] lstrlenA (lpString="*.gif") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.png") returned 0
	[0063.558] lstrlenA (lpString="*.png") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.doc") returned 0
	[0063.558] lstrlenA (lpString="*.doc") returned 5
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.docx") returned 0
	[0063.558] lstrlenA (lpString="*.docx") returned 6
	[0063.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.xls") returned 0
	[0063.559] lstrlenA (lpString="*.xls") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.xlsx") returned 0
	[0063.559] lstrlenA (lpString="*.xlsx") returned 6
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ppt") returned 0
	[0063.559] lstrlenA (lpString="*.ppt") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pptx") returned 0
	[0063.559] lstrlenA (lpString="*.pptx") returned 6
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.txt") returned 0
	[0063.559] lstrlenA (lpString="*.txt") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pdf") returned 0
	[0063.559] lstrlenA (lpString="*.pdf") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.djvu") returned 0
	[0063.559] lstrlenA (lpString="*.djvu") returned 6
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.htm") returned 0
	[0063.559] lstrlenA (lpString="*.htm") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.html") returned 0
	[0063.559] lstrlenA (lpString="*.html") returned 6
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mdb") returned 0
	[0063.559] lstrlenA (lpString="*.mdb") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.cer") returned 0
	[0063.559] lstrlenA (lpString="*.cer") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.p12") returned 0
	[0063.559] lstrlenA (lpString="*.p12") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pfx") returned 0
	[0063.559] lstrlenA (lpString="*.pfx") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.kwm") returned 0
	[0063.559] lstrlenA (lpString="*.kwm") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pwm") returned 0
	[0063.559] lstrlenA (lpString="*.pwm") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.1cd") returned 0
	[0063.559] lstrlenA (lpString="*.1cd") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.md") returned 0
	[0063.559] lstrlenA (lpString="*.md") returned 4
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mdf") returned 0
	[0063.559] lstrlenA (lpString="*.mdf") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.dbf") returned 0
	[0063.559] lstrlenA (lpString="*.dbf") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.odt") returned 0
	[0063.559] lstrlenA (lpString="*.odt") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.vob") returned 0
	[0063.559] lstrlenA (lpString="*.vob") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ifo") returned 0
	[0063.559] lstrlenA (lpString="*.ifo") returned 5
	[0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.lnk") returned 0
	[0063.559] lstrlenA (lpString="*.lnk") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.torrent") returned 0
	[0063.560] lstrlenA (lpString="*.torrent") returned 9
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mov") returned 0
	[0063.560] lstrlenA (lpString="*.mov") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.m2v") returned 0
	[0063.560] lstrlenA (lpString="*.m2v") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.3gp") returned 0
	[0063.560] lstrlenA (lpString="*.3gp") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mpeg") returned 0
	[0063.560] lstrlenA (lpString="*.mpeg") returned 6
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mpg") returned 0
	[0063.560] lstrlenA (lpString="*.mpg") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.flv") returned 0
	[0063.560] lstrlenA (lpString="*.flv") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.avi") returned 0
	[0063.560] lstrlenA (lpString="*.avi") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mp4") returned 0
	[0063.560] lstrlenA (lpString="*.mp4") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.wmv") returned 0
	[0063.560] lstrlenA (lpString="*.wmv") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.divx") returned 0
	[0063.560] lstrlenA (lpString="*.divx") returned 6
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mkv") returned 0
	[0063.560] lstrlenA (lpString="*.mkv") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mp3") returned 0
	[0063.560] lstrlenA (lpString="*.mp3") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.wav") returned 0
	[0063.560] lstrlenA (lpString="*.wav") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.flac") returned 0
	[0063.560] lstrlenA (lpString="*.flac") returned 6
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ape") returned 0
	[0063.560] lstrlenA (lpString="*.ape") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.wma") returned 0
	[0063.560] lstrlenA (lpString="*.wma") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ac3") returned 0
	[0063.560] lstrlenA (lpString="*.ac3") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.exe") returned 0
	[0063.560] lstrlenA (lpString="*.exe") returned 5
	[0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.apk") returned 0
	[0063.560] lstrlenA (lpString="*.apk") returned 5
	[0063.560] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.560] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.560] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hiring Requisition - Customized.fdt") returned -1
	[0063.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hiring Requisition - Customized.fdt") returned 1
	[0063.560] lstrcmpiA (lpString1="", lpString2="Hiring Requisition - Customized.fdt") returned -1
	[0063.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned="Hardware Tracker.fdt"
	[0063.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20
	[0063.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hiring Requisition - Customized.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt"
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.zip") returned 0
	[0063.561] lstrlenA (lpString="*.zip") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.rar") returned 0
	[0063.561] lstrlenA (lpString="*.rar") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.7z") returned 0
	[0063.561] lstrlenA (lpString="*.7z") returned 4
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.tar") returned 0
	[0063.561] lstrlenA (lpString="*.tar") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.gzip") returned 0
	[0063.561] lstrlenA (lpString="*.gzip") returned 6
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.jpg") returned 0
	[0063.561] lstrlenA (lpString="*.jpg") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.jpeg") returned 0
	[0063.561] lstrlenA (lpString="*.jpeg") returned 6
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.psd") returned 0
	[0063.561] lstrlenA (lpString="*.psd") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.cdr") returned 0
	[0063.561] lstrlenA (lpString="*.cdr") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.dwg") returned 0
	[0063.561] lstrlenA (lpString="*.dwg") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.max") returned 0
	[0063.561] lstrlenA (lpString="*.max") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.bmp") returned 0
	[0063.561] lstrlenA (lpString="*.bmp") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.gif") returned 0
	[0063.561] lstrlenA (lpString="*.gif") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.png") returned 0
	[0063.561] lstrlenA (lpString="*.png") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.doc") returned 0
	[0063.561] lstrlenA (lpString="*.doc") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.docx") returned 0
	[0063.561] lstrlenA (lpString="*.docx") returned 6
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.xls") returned 0
	[0063.561] lstrlenA (lpString="*.xls") returned 5
	[0063.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.xlsx") returned 0
	[0063.561] lstrlenA (lpString="*.xlsx") returned 6
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ppt") returned 0
	[0063.562] lstrlenA (lpString="*.ppt") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pptx") returned 0
	[0063.562] lstrlenA (lpString="*.pptx") returned 6
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.txt") returned 0
	[0063.562] lstrlenA (lpString="*.txt") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pdf") returned 0
	[0063.562] lstrlenA (lpString="*.pdf") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.djvu") returned 0
	[0063.562] lstrlenA (lpString="*.djvu") returned 6
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.htm") returned 0
	[0063.562] lstrlenA (lpString="*.htm") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.html") returned 0
	[0063.562] lstrlenA (lpString="*.html") returned 6
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mdb") returned 0
	[0063.562] lstrlenA (lpString="*.mdb") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.cer") returned 0
	[0063.562] lstrlenA (lpString="*.cer") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.p12") returned 0
	[0063.562] lstrlenA (lpString="*.p12") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pfx") returned 0
	[0063.562] lstrlenA (lpString="*.pfx") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.kwm") returned 0
	[0063.562] lstrlenA (lpString="*.kwm") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pwm") returned 0
	[0063.562] lstrlenA (lpString="*.pwm") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.1cd") returned 0
	[0063.562] lstrlenA (lpString="*.1cd") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.md") returned 0
	[0063.562] lstrlenA (lpString="*.md") returned 4
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mdf") returned 0
	[0063.562] lstrlenA (lpString="*.mdf") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.dbf") returned 0
	[0063.562] lstrlenA (lpString="*.dbf") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.odt") returned 0
	[0063.562] lstrlenA (lpString="*.odt") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.vob") returned 0
	[0063.562] lstrlenA (lpString="*.vob") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ifo") returned 0
	[0063.562] lstrlenA (lpString="*.ifo") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.lnk") returned 0
	[0063.562] lstrlenA (lpString="*.lnk") returned 5
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.torrent") returned 0
	[0063.562] lstrlenA (lpString="*.torrent") returned 9
	[0063.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mov") returned 0
	[0063.563] lstrlenA (lpString="*.mov") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.m2v") returned 0
	[0063.563] lstrlenA (lpString="*.m2v") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.3gp") returned 0
	[0063.563] lstrlenA (lpString="*.3gp") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mpeg") returned 0
	[0063.563] lstrlenA (lpString="*.mpeg") returned 6
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mpg") returned 0
	[0063.563] lstrlenA (lpString="*.mpg") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.flv") returned 0
	[0063.563] lstrlenA (lpString="*.flv") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.avi") returned 0
	[0063.563] lstrlenA (lpString="*.avi") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mp4") returned 0
	[0063.563] lstrlenA (lpString="*.mp4") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.wmv") returned 0
	[0063.563] lstrlenA (lpString="*.wmv") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.divx") returned 0
	[0063.563] lstrlenA (lpString="*.divx") returned 6
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mkv") returned 0
	[0063.563] lstrlenA (lpString="*.mkv") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mp3") returned 0
	[0063.563] lstrlenA (lpString="*.mp3") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.wav") returned 0
	[0063.563] lstrlenA (lpString="*.wav") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.flac") returned 0
	[0063.563] lstrlenA (lpString="*.flac") returned 6
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ape") returned 0
	[0063.563] lstrlenA (lpString="*.ape") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.wma") returned 0
	[0063.563] lstrlenA (lpString="*.wma") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ac3") returned 0
	[0063.563] lstrlenA (lpString="*.ac3") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.exe") returned 0
	[0063.563] lstrlenA (lpString="*.exe") returned 5
	[0063.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.apk") returned 0
	[0063.563] lstrlenA (lpString="*.apk") returned 5
	[0063.563] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.563] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.563] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hiring Requisition.fdt") returned -1
	[0063.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hiring Requisition.fdt") returned 1
	[0063.563] lstrcmpiA (lpString1="", lpString2="Hiring Requisition.fdt") returned -1
	[0063.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned="Hiring Requisition - Customized.fdt"
	[0063.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20
	[0063.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hiring Requisition.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt"
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.zip") returned 0
	[0063.564] lstrlenA (lpString="*.zip") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.rar") returned 0
	[0063.564] lstrlenA (lpString="*.rar") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.7z") returned 0
	[0063.564] lstrlenA (lpString="*.7z") returned 4
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.tar") returned 0
	[0063.564] lstrlenA (lpString="*.tar") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.gzip") returned 0
	[0063.564] lstrlenA (lpString="*.gzip") returned 6
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.jpg") returned 0
	[0063.564] lstrlenA (lpString="*.jpg") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.jpeg") returned 0
	[0063.564] lstrlenA (lpString="*.jpeg") returned 6
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.psd") returned 0
	[0063.564] lstrlenA (lpString="*.psd") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.cdr") returned 0
	[0063.564] lstrlenA (lpString="*.cdr") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.dwg") returned 0
	[0063.564] lstrlenA (lpString="*.dwg") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.max") returned 0
	[0063.564] lstrlenA (lpString="*.max") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.bmp") returned 0
	[0063.564] lstrlenA (lpString="*.bmp") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.gif") returned 0
	[0063.564] lstrlenA (lpString="*.gif") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.png") returned 0
	[0063.564] lstrlenA (lpString="*.png") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.doc") returned 0
	[0063.564] lstrlenA (lpString="*.doc") returned 5
	[0063.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.docx") returned 0
	[0063.565] lstrlenA (lpString="*.docx") returned 6
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.xls") returned 0
	[0063.565] lstrlenA (lpString="*.xls") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.xlsx") returned 0
	[0063.565] lstrlenA (lpString="*.xlsx") returned 6
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ppt") returned 0
	[0063.565] lstrlenA (lpString="*.ppt") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pptx") returned 0
	[0063.565] lstrlenA (lpString="*.pptx") returned 6
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.txt") returned 0
	[0063.565] lstrlenA (lpString="*.txt") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pdf") returned 0
	[0063.565] lstrlenA (lpString="*.pdf") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.djvu") returned 0
	[0063.565] lstrlenA (lpString="*.djvu") returned 6
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.htm") returned 0
	[0063.565] lstrlenA (lpString="*.htm") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.html") returned 0
	[0063.565] lstrlenA (lpString="*.html") returned 6
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mdb") returned 0
	[0063.565] lstrlenA (lpString="*.mdb") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.cer") returned 0
	[0063.565] lstrlenA (lpString="*.cer") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.p12") returned 0
	[0063.565] lstrlenA (lpString="*.p12") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pfx") returned 0
	[0063.565] lstrlenA (lpString="*.pfx") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.kwm") returned 0
	[0063.565] lstrlenA (lpString="*.kwm") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pwm") returned 0
	[0063.565] lstrlenA (lpString="*.pwm") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.1cd") returned 0
	[0063.565] lstrlenA (lpString="*.1cd") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.md") returned 0
	[0063.565] lstrlenA (lpString="*.md") returned 4
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mdf") returned 0
	[0063.565] lstrlenA (lpString="*.mdf") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.dbf") returned 0
	[0063.565] lstrlenA (lpString="*.dbf") returned 5
	[0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.odt") returned 0
	[0063.566] lstrlenA (lpString="*.odt") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.vob") returned 0
	[0063.566] lstrlenA (lpString="*.vob") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ifo") returned 0
	[0063.566] lstrlenA (lpString="*.ifo") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.lnk") returned 0
	[0063.566] lstrlenA (lpString="*.lnk") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.torrent") returned 0
	[0063.566] lstrlenA (lpString="*.torrent") returned 9
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mov") returned 0
	[0063.566] lstrlenA (lpString="*.mov") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.m2v") returned 0
	[0063.566] lstrlenA (lpString="*.m2v") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.3gp") returned 0
	[0063.566] lstrlenA (lpString="*.3gp") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mpeg") returned 0
	[0063.566] lstrlenA (lpString="*.mpeg") returned 6
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mpg") returned 0
	[0063.566] lstrlenA (lpString="*.mpg") returned 5
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.flv") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.avi") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mp4") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.wmv") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.divx") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mkv") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mp3") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.wav") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.flac") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ape") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.wma") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ac3") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.exe") returned 0
	[0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.apk") returned 0
	[0063.567] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.567] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POLICIES.FDT") returned -1
	[0063.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POLICIES.FDT") returned -1
	[0063.567] lstrcmpiA (lpString1="", lpString2="POLICIES.FDT") returned -1
	[0063.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned="Hiring Requisition.fdt"
	[0063.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20
	[0063.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="POLICIES.FDT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT"
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.zip") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.rar") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.7z") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.tar") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.gzip") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.jpg") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.jpeg") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.psd") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.cdr") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.dwg") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.max") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.bmp") returned 0
	[0063.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.gif") returned 0
	[0063.567] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.567] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Process Library.fdt") returned -1
	[0063.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Process Library.fdt") returned -1
	[0063.568] lstrcmpiA (lpString1="", lpString2="Process Library.fdt") returned -1
	[0063.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned="POLICIES.FDT"
	[0063.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20
	[0063.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Process Library.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt"
	[0063.568] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.568] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.568] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Status Report.fdt") returned -1
	[0063.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Status Report.fdt") returned -1
	[0063.568] lstrcmpiA (lpString1="", lpString2="Status Report.fdt") returned -1
	[0063.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned="Process Library.fdt"
	[0063.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20
	[0063.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Status Report.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt"
	[0063.568] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0063.568] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0063.568] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Track Issues.fdt") returned -1
	[0063.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Track Issues.fdt") returned -1
	[0063.568] lstrcmpiA (lpString1="", lpString2="Track Issues.fdt") returned -1
	[0063.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned="Status Report.fdt"
	[0063.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\"
	[0063.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned=""
	[0063.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt"
	[0063.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20
	[0063.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Track Issues.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt"
	[0063.568] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0
	[0063.569] FindClose (in: hFindFile=0x8b7f68 | out: hFindFile=0x8b7f68) returned 1
	[0063.569] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.569] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.569] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsVersion1Warning.htm") returned -1
	[0063.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1
	[0063.569] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1
	[0063.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*"
	[0063.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm"
	[0063.569] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm"
	[0063.569] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm"
	[0063.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm."
	[0063.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.Boom"
	[0063.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.570] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6fc
	[0063.570] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1
	[0063.570] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.570] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6d9, lpOverlapped=0x0) returned 1
	[0063.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm"
	[0063.571] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.571] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6d9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6d9, lpOverlapped=0x0) returned 1
	[0063.571] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.572] CloseHandle (hObject=0x98) returned 1
	[0063.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm.boom")) returned 1
	[0063.572] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.572] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0063.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1
	[0063.572] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0063.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm"
	[0063.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg"
	[0063.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0
	[0063.573] lstrlenA (lpString="*.zip") returned 5
	[0063.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0
	[0063.573] lstrlenA (lpString="*.rar") returned 5
	[0063.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0
	[0063.573] lstrlenA (lpString="*.7z") returned 4
	[0063.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0
	[0063.573] lstrlenA (lpString="*.tar") returned 5
	[0063.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0
	[0063.573] lstrlenA (lpString="*.gzip") returned 6
	[0063.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1
	[0063.573] lstrlenA (lpString="*.jpg") returned 5
	[0063.573] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg"
	[0063.573] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg"
	[0063.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg."
	[0063.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.Boom"
	[0063.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.573] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499
	[0063.573] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1
	[0063.573] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.573] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1476, lpOverlapped=0x0) returned 1
	[0063.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0063.575] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.575] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1476, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1476, lpOverlapped=0x0) returned 1
	[0063.575] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.575] CloseHandle (hObject=0x98) returned 1
	[0063.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.boom")) returned 1
	[0063.576] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.577] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.577] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0063.577] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1
	[0063.577] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0063.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0063.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp"
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0
	[0063.577] lstrlenA (lpString="*.zip") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0
	[0063.577] lstrlenA (lpString="*.rar") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0
	[0063.577] lstrlenA (lpString="*.7z") returned 4
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0
	[0063.577] lstrlenA (lpString="*.tar") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0
	[0063.577] lstrlenA (lpString="*.gzip") returned 6
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0
	[0063.577] lstrlenA (lpString="*.jpg") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0
	[0063.577] lstrlenA (lpString="*.jpeg") returned 6
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0
	[0063.577] lstrlenA (lpString="*.psd") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cdr") returned 0
	[0063.577] lstrlenA (lpString="*.cdr") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0
	[0063.577] lstrlenA (lpString="*.dwg") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.max") returned 0
	[0063.577] lstrlenA (lpString="*.max") returned 5
	[0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bmp") returned 1
	[0063.577] lstrlenA (lpString="*.bmp") returned 5
	[0063.577] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp"
	[0063.577] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp"
	[0063.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp."
	[0063.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.Boom"
	[0063.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.578] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638
	[0063.578] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1
	[0063.578] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.578] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x615, lpOverlapped=0x0) returned 1
	[0063.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0063.588] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.588] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x615, lpOverlapped=0x0) returned 1
	[0063.588] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.588] CloseHandle (hObject=0x98) returned 1
	[0063.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.boom")) returned 1
	[0063.590] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.590] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.590] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewFrame.html") returned -1
	[0063.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1
	[0063.590] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1
	[0063.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0063.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.590] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html"
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.zip") returned 0
	[0063.591] lstrlenA (lpString="*.zip") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.rar") returned 0
	[0063.591] lstrlenA (lpString="*.rar") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.7z") returned 0
	[0063.591] lstrlenA (lpString="*.7z") returned 4
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.tar") returned 0
	[0063.591] lstrlenA (lpString="*.tar") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.gzip") returned 0
	[0063.591] lstrlenA (lpString="*.gzip") returned 6
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.jpg") returned 0
	[0063.591] lstrlenA (lpString="*.jpg") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0
	[0063.591] lstrlenA (lpString="*.jpeg") returned 6
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.psd") returned 0
	[0063.591] lstrlenA (lpString="*.psd") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.cdr") returned 0
	[0063.591] lstrlenA (lpString="*.cdr") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.dwg") returned 0
	[0063.591] lstrlenA (lpString="*.dwg") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.max") returned 0
	[0063.591] lstrlenA (lpString="*.max") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.bmp") returned 0
	[0063.591] lstrlenA (lpString="*.bmp") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.gif") returned 0
	[0063.591] lstrlenA (lpString="*.gif") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.png") returned 0
	[0063.591] lstrlenA (lpString="*.png") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.doc") returned 0
	[0063.591] lstrlenA (lpString="*.doc") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.docx") returned 0
	[0063.591] lstrlenA (lpString="*.docx") returned 6
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.xls") returned 0
	[0063.591] lstrlenA (lpString="*.xls") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0
	[0063.591] lstrlenA (lpString="*.xlsx") returned 6
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.ppt") returned 0
	[0063.591] lstrlenA (lpString="*.ppt") returned 5
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.pptx") returned 0
	[0063.591] lstrlenA (lpString="*.pptx") returned 6
	[0063.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.txt") returned 0
	[0063.592] lstrlenA (lpString="*.txt") returned 5
	[0063.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.pdf") returned 0
	[0063.592] lstrlenA (lpString="*.pdf") returned 5
	[0063.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.djvu") returned 0
	[0063.592] lstrlenA (lpString="*.djvu") returned 6
	[0063.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.htm") returned 0
	[0063.592] lstrlenA (lpString="*.htm") returned 5
	[0063.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.html") returned 1
	[0063.592] lstrlenA (lpString="*.html") returned 6
	[0063.592] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html"
	[0063.592] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html"
	[0063.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html."
	[0063.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.Boom"
	[0063.592] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.621] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfa1
	[0063.621] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1
	[0063.621] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.621] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf7e, lpOverlapped=0x0) returned 1
	[0063.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="FormsViewFrame.html"
	[0063.623] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.623] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf7e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf7e, lpOverlapped=0x0) returned 1
	[0063.623] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.623] CloseHandle (hObject=0x98) returned 1
	[0063.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.boom")) returned 1
	[0063.624] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.624] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.624] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormToolImages.jpg") returned -1
	[0063.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1
	[0063.624] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1
	[0063.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="FormsViewFrame.html"
	[0063.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg"
	[0063.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.zip") returned 0
	[0063.624] lstrlenA (lpString="*.zip") returned 5
	[0063.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.rar") returned 0
	[0063.624] lstrlenA (lpString="*.rar") returned 5
	[0063.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.7z") returned 0
	[0063.624] lstrlenA (lpString="*.7z") returned 4
	[0063.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.tar") returned 0
	[0063.624] lstrlenA (lpString="*.tar") returned 5
	[0063.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.gzip") returned 0
	[0063.624] lstrlenA (lpString="*.gzip") returned 6
	[0063.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.jpg") returned 1
	[0063.624] lstrlenA (lpString="*.jpg") returned 5
	[0063.624] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg"
	[0063.624] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg"
	[0063.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg."
	[0063.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.Boom"
	[0063.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.625] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb
	[0063.625] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1
	[0063.625] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.625] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1bd8, lpOverlapped=0x0) returned 1
	[0063.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="FormToolImages.jpg"
	[0063.631] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.631] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1bd8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1bd8, lpOverlapped=0x0) returned 1
	[0063.632] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.632] CloseHandle (hObject=0x98) returned 1
	[0063.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.boom")) returned 1
	[0063.632] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.632] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.632] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveFormsMetaData.xml") returned -1
	[0063.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveFormsMetaData.xml") returned 1
	[0063.632] lstrcmpiA (lpString1="", lpString2="GrooveFormsMetaData.xml") returned -1
	[0063.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="FormToolImages.jpg"
	[0063.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="GrooveFormsMetaData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml"
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.zip") returned 0
	[0063.633] lstrlenA (lpString="*.zip") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.rar") returned 0
	[0063.633] lstrlenA (lpString="*.rar") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.7z") returned 0
	[0063.633] lstrlenA (lpString="*.7z") returned 4
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.tar") returned 0
	[0063.633] lstrlenA (lpString="*.tar") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.gzip") returned 0
	[0063.633] lstrlenA (lpString="*.gzip") returned 6
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.jpg") returned 0
	[0063.633] lstrlenA (lpString="*.jpg") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.jpeg") returned 0
	[0063.633] lstrlenA (lpString="*.jpeg") returned 6
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.psd") returned 0
	[0063.633] lstrlenA (lpString="*.psd") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.cdr") returned 0
	[0063.633] lstrlenA (lpString="*.cdr") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.dwg") returned 0
	[0063.633] lstrlenA (lpString="*.dwg") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.max") returned 0
	[0063.633] lstrlenA (lpString="*.max") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.bmp") returned 0
	[0063.633] lstrlenA (lpString="*.bmp") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.gif") returned 0
	[0063.633] lstrlenA (lpString="*.gif") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.png") returned 0
	[0063.633] lstrlenA (lpString="*.png") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.doc") returned 0
	[0063.633] lstrlenA (lpString="*.doc") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.docx") returned 0
	[0063.633] lstrlenA (lpString="*.docx") returned 6
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.xls") returned 0
	[0063.633] lstrlenA (lpString="*.xls") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.xlsx") returned 0
	[0063.633] lstrlenA (lpString="*.xlsx") returned 6
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ppt") returned 0
	[0063.633] lstrlenA (lpString="*.ppt") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pptx") returned 0
	[0063.633] lstrlenA (lpString="*.pptx") returned 6
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.txt") returned 0
	[0063.633] lstrlenA (lpString="*.txt") returned 5
	[0063.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pdf") returned 0
	[0063.634] lstrlenA (lpString="*.pdf") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.djvu") returned 0
	[0063.634] lstrlenA (lpString="*.djvu") returned 6
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.htm") returned 0
	[0063.634] lstrlenA (lpString="*.htm") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.html") returned 0
	[0063.634] lstrlenA (lpString="*.html") returned 6
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mdb") returned 0
	[0063.634] lstrlenA (lpString="*.mdb") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.cer") returned 0
	[0063.634] lstrlenA (lpString="*.cer") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.p12") returned 0
	[0063.634] lstrlenA (lpString="*.p12") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pfx") returned 0
	[0063.634] lstrlenA (lpString="*.pfx") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.kwm") returned 0
	[0063.634] lstrlenA (lpString="*.kwm") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pwm") returned 0
	[0063.634] lstrlenA (lpString="*.pwm") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.1cd") returned 0
	[0063.634] lstrlenA (lpString="*.1cd") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.md") returned 0
	[0063.634] lstrlenA (lpString="*.md") returned 4
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mdf") returned 0
	[0063.634] lstrlenA (lpString="*.mdf") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.dbf") returned 0
	[0063.634] lstrlenA (lpString="*.dbf") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.odt") returned 0
	[0063.634] lstrlenA (lpString="*.odt") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.vob") returned 0
	[0063.634] lstrlenA (lpString="*.vob") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ifo") returned 0
	[0063.634] lstrlenA (lpString="*.ifo") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.lnk") returned 0
	[0063.634] lstrlenA (lpString="*.lnk") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.torrent") returned 0
	[0063.634] lstrlenA (lpString="*.torrent") returned 9
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mov") returned 0
	[0063.634] lstrlenA (lpString="*.mov") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.m2v") returned 0
	[0063.634] lstrlenA (lpString="*.m2v") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.3gp") returned 0
	[0063.634] lstrlenA (lpString="*.3gp") returned 5
	[0063.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mpeg") returned 0
	[0063.635] lstrlenA (lpString="*.mpeg") returned 6
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mpg") returned 0
	[0063.635] lstrlenA (lpString="*.mpg") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.flv") returned 0
	[0063.635] lstrlenA (lpString="*.flv") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.avi") returned 0
	[0063.635] lstrlenA (lpString="*.avi") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mp4") returned 0
	[0063.635] lstrlenA (lpString="*.mp4") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wmv") returned 0
	[0063.635] lstrlenA (lpString="*.wmv") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.divx") returned 0
	[0063.635] lstrlenA (lpString="*.divx") returned 6
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mkv") returned 0
	[0063.635] lstrlenA (lpString="*.mkv") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mp3") returned 0
	[0063.635] lstrlenA (lpString="*.mp3") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wav") returned 0
	[0063.635] lstrlenA (lpString="*.wav") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.flac") returned 0
	[0063.635] lstrlenA (lpString="*.flac") returned 6
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ape") returned 0
	[0063.635] lstrlenA (lpString="*.ape") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wma") returned 0
	[0063.635] lstrlenA (lpString="*.wma") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ac3") returned 0
	[0063.635] lstrlenA (lpString="*.ac3") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.exe") returned 0
	[0063.635] lstrlenA (lpString="*.exe") returned 5
	[0063.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.apk") returned 0
	[0063.635] lstrlenA (lpString="*.apk") returned 5
	[0063.635] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.635] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.635] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HOW TO DECRYPT FILES.txt") returned -1
	[0063.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0
	[0063.635] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.635] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.635] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MENUS.JS") returned -1
	[0063.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MENUS.JS") returned -1
	[0063.635] lstrcmpiA (lpString1="", lpString2="MENUS.JS") returned -1
	[0063.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned="GrooveFormsMetaData.xml"
	[0063.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="MENUS.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS"
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.zip") returned 0
	[0063.636] lstrlenA (lpString="*.zip") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.rar") returned 0
	[0063.636] lstrlenA (lpString="*.rar") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.7z") returned 0
	[0063.636] lstrlenA (lpString="*.7z") returned 4
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.tar") returned 0
	[0063.636] lstrlenA (lpString="*.tar") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.gzip") returned 0
	[0063.636] lstrlenA (lpString="*.gzip") returned 6
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.jpg") returned 0
	[0063.636] lstrlenA (lpString="*.jpg") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.jpeg") returned 0
	[0063.636] lstrlenA (lpString="*.jpeg") returned 6
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.psd") returned 0
	[0063.636] lstrlenA (lpString="*.psd") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.cdr") returned 0
	[0063.636] lstrlenA (lpString="*.cdr") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.dwg") returned 0
	[0063.636] lstrlenA (lpString="*.dwg") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.max") returned 0
	[0063.636] lstrlenA (lpString="*.max") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.bmp") returned 0
	[0063.636] lstrlenA (lpString="*.bmp") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.gif") returned 0
	[0063.636] lstrlenA (lpString="*.gif") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.png") returned 0
	[0063.636] lstrlenA (lpString="*.png") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.doc") returned 0
	[0063.636] lstrlenA (lpString="*.doc") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.docx") returned 0
	[0063.636] lstrlenA (lpString="*.docx") returned 6
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.xls") returned 0
	[0063.636] lstrlenA (lpString="*.xls") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.xlsx") returned 0
	[0063.636] lstrlenA (lpString="*.xlsx") returned 6
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ppt") returned 0
	[0063.636] lstrlenA (lpString="*.ppt") returned 5
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pptx") returned 0
	[0063.636] lstrlenA (lpString="*.pptx") returned 6
	[0063.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.txt") returned 0
	[0063.636] lstrlenA (lpString="*.txt") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pdf") returned 0
	[0063.637] lstrlenA (lpString="*.pdf") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.djvu") returned 0
	[0063.637] lstrlenA (lpString="*.djvu") returned 6
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.htm") returned 0
	[0063.637] lstrlenA (lpString="*.htm") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.html") returned 0
	[0063.637] lstrlenA (lpString="*.html") returned 6
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mdb") returned 0
	[0063.637] lstrlenA (lpString="*.mdb") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.cer") returned 0
	[0063.637] lstrlenA (lpString="*.cer") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.p12") returned 0
	[0063.637] lstrlenA (lpString="*.p12") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pfx") returned 0
	[0063.637] lstrlenA (lpString="*.pfx") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.kwm") returned 0
	[0063.637] lstrlenA (lpString="*.kwm") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pwm") returned 0
	[0063.637] lstrlenA (lpString="*.pwm") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.1cd") returned 0
	[0063.637] lstrlenA (lpString="*.1cd") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.md") returned 0
	[0063.637] lstrlenA (lpString="*.md") returned 4
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mdf") returned 0
	[0063.637] lstrlenA (lpString="*.mdf") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.dbf") returned 0
	[0063.637] lstrlenA (lpString="*.dbf") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.odt") returned 0
	[0063.637] lstrlenA (lpString="*.odt") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.vob") returned 0
	[0063.637] lstrlenA (lpString="*.vob") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ifo") returned 0
	[0063.637] lstrlenA (lpString="*.ifo") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.lnk") returned 0
	[0063.637] lstrlenA (lpString="*.lnk") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.torrent") returned 0
	[0063.637] lstrlenA (lpString="*.torrent") returned 9
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mov") returned 0
	[0063.637] lstrlenA (lpString="*.mov") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.m2v") returned 0
	[0063.637] lstrlenA (lpString="*.m2v") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.3gp") returned 0
	[0063.637] lstrlenA (lpString="*.3gp") returned 5
	[0063.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mpeg") returned 0
	[0063.637] lstrlenA (lpString="*.mpeg") returned 6
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mpg") returned 0
	[0063.638] lstrlenA (lpString="*.mpg") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.flv") returned 0
	[0063.638] lstrlenA (lpString="*.flv") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.avi") returned 0
	[0063.638] lstrlenA (lpString="*.avi") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mp4") returned 0
	[0063.638] lstrlenA (lpString="*.mp4") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wmv") returned 0
	[0063.638] lstrlenA (lpString="*.wmv") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.divx") returned 0
	[0063.638] lstrlenA (lpString="*.divx") returned 6
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mkv") returned 0
	[0063.638] lstrlenA (lpString="*.mkv") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mp3") returned 0
	[0063.638] lstrlenA (lpString="*.mp3") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wav") returned 0
	[0063.638] lstrlenA (lpString="*.wav") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.flac") returned 0
	[0063.638] lstrlenA (lpString="*.flac") returned 6
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ape") returned 0
	[0063.638] lstrlenA (lpString="*.ape") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wma") returned 0
	[0063.638] lstrlenA (lpString="*.wma") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ac3") returned 0
	[0063.638] lstrlenA (lpString="*.ac3") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.exe") returned 0
	[0063.638] lstrlenA (lpString="*.exe") returned 5
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.apk") returned 0
	[0063.638] lstrlenA (lpString="*.apk") returned 5
	[0063.638] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.638] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.638] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="menu_arrow.gif") returned -1
	[0063.638] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="menu_arrow.gif") returned -1
	[0063.638] lstrcmpiA (lpString1="", lpString2="menu_arrow.gif") returned -1
	[0063.638] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned="MENUS.JS"
	[0063.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.638] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.638] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif"
	[0063.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.zip") returned 0
	[0063.639] lstrlenA (lpString="*.zip") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.rar") returned 0
	[0063.639] lstrlenA (lpString="*.rar") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.7z") returned 0
	[0063.639] lstrlenA (lpString="*.7z") returned 4
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.tar") returned 0
	[0063.639] lstrlenA (lpString="*.tar") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.gzip") returned 0
	[0063.639] lstrlenA (lpString="*.gzip") returned 6
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.jpg") returned 0
	[0063.639] lstrlenA (lpString="*.jpg") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.jpeg") returned 0
	[0063.639] lstrlenA (lpString="*.jpeg") returned 6
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.psd") returned 0
	[0063.639] lstrlenA (lpString="*.psd") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.cdr") returned 0
	[0063.639] lstrlenA (lpString="*.cdr") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.dwg") returned 0
	[0063.639] lstrlenA (lpString="*.dwg") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.max") returned 0
	[0063.639] lstrlenA (lpString="*.max") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.bmp") returned 0
	[0063.639] lstrlenA (lpString="*.bmp") returned 5
	[0063.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.gif") returned 1
	[0063.639] lstrlenA (lpString="*.gif") returned 5
	[0063.639] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif"
	[0063.639] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif"
	[0063.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif."
	[0063.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.Boom"
	[0063.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.640] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33a
	[0063.640] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5836a590, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1
	[0063.640] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.640] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x317, lpOverlapped=0x0) returned 1
	[0063.647] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="menu_arrow.gif"
	[0063.647] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.647] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x317, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x317, lpOverlapped=0x0) returned 1
	[0063.647] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.647] CloseHandle (hObject=0x98) returned 1
	[0063.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.boom")) returned 1
	[0063.648] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.648] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.648] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SEARCH.GIF") returned -1
	[0063.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SEARCH.GIF") returned -1
	[0063.648] lstrcmpiA (lpString1="", lpString2="SEARCH.GIF") returned -1
	[0063.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="menu_arrow.gif"
	[0063.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF"
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.zip") returned 0
	[0063.648] lstrlenA (lpString="*.zip") returned 5
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.rar") returned 0
	[0063.648] lstrlenA (lpString="*.rar") returned 5
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.7z") returned 0
	[0063.648] lstrlenA (lpString="*.7z") returned 4
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.tar") returned 0
	[0063.648] lstrlenA (lpString="*.tar") returned 5
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.gzip") returned 0
	[0063.648] lstrlenA (lpString="*.gzip") returned 6
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.jpg") returned 0
	[0063.648] lstrlenA (lpString="*.jpg") returned 5
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.jpeg") returned 0
	[0063.648] lstrlenA (lpString="*.jpeg") returned 6
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.psd") returned 0
	[0063.648] lstrlenA (lpString="*.psd") returned 5
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.cdr") returned 0
	[0063.648] lstrlenA (lpString="*.cdr") returned 5
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.dwg") returned 0
	[0063.648] lstrlenA (lpString="*.dwg") returned 5
	[0063.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.max") returned 0
	[0063.648] lstrlenA (lpString="*.max") returned 5
	[0063.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.bmp") returned 0
	[0063.649] lstrlenA (lpString="*.bmp") returned 5
	[0063.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.gif") returned 1
	[0063.649] lstrlenA (lpString="*.gif") returned 5
	[0063.649] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF"
	[0063.649] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF"
	[0063.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF."
	[0063.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.Boom"
	[0063.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.650] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4af
	[0063.650] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d273e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1
	[0063.650] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.650] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x48c, lpOverlapped=0x0) returned 1
	[0063.657] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="SEARCH.GIF"
	[0063.657] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.657] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x48c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x48c, lpOverlapped=0x0) returned 1
	[0063.657] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.657] CloseHandle (hObject=0x98) returned 1
	[0063.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif.boom")) returned 1
	[0063.658] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.658] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.658] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SPACER.GIF") returned -1
	[0063.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACER.GIF") returned -1
	[0063.658] lstrcmpiA (lpString1="", lpString2="SPACER.GIF") returned -1
	[0063.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="SEARCH.GIF"
	[0063.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.658] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF"
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.zip") returned 0
	[0063.658] lstrlenA (lpString="*.zip") returned 5
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.rar") returned 0
	[0063.658] lstrlenA (lpString="*.rar") returned 5
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.7z") returned 0
	[0063.658] lstrlenA (lpString="*.7z") returned 4
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.tar") returned 0
	[0063.658] lstrlenA (lpString="*.tar") returned 5
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.gzip") returned 0
	[0063.658] lstrlenA (lpString="*.gzip") returned 6
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.jpg") returned 0
	[0063.658] lstrlenA (lpString="*.jpg") returned 5
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.jpeg") returned 0
	[0063.658] lstrlenA (lpString="*.jpeg") returned 6
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.psd") returned 0
	[0063.658] lstrlenA (lpString="*.psd") returned 5
	[0063.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.cdr") returned 0
	[0063.658] lstrlenA (lpString="*.cdr") returned 5
	[0063.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.dwg") returned 0
	[0063.659] lstrlenA (lpString="*.dwg") returned 5
	[0063.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.max") returned 0
	[0063.659] lstrlenA (lpString="*.max") returned 5
	[0063.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.bmp") returned 0
	[0063.659] lstrlenA (lpString="*.bmp") returned 5
	[0063.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.gif") returned 1
	[0063.659] lstrlenA (lpString="*.gif") returned 5
	[0063.659] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF"
	[0063.659] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF"
	[0063.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF."
	[0063.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.Boom"
	[0063.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.667] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31
	[0063.667] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1
	[0063.667] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.667] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xe, lpOverlapped=0x0) returned 1
	[0063.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="SPACER.GIF"
	[0063.668] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.668] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xe, lpOverlapped=0x0) returned 1
	[0063.668] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.668] CloseHandle (hObject=0x98) returned 1
	[0063.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif.boom")) returned 1
	[0063.669] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.669] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.669] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1
	[0063.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1
	[0063.669] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1
	[0063.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="SPACER.GIF"
	[0063.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS"
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.zip") returned 0
	[0063.669] lstrlenA (lpString="*.zip") returned 5
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.rar") returned 0
	[0063.669] lstrlenA (lpString="*.rar") returned 5
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.7z") returned 0
	[0063.669] lstrlenA (lpString="*.7z") returned 4
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.tar") returned 0
	[0063.669] lstrlenA (lpString="*.tar") returned 5
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.gzip") returned 0
	[0063.669] lstrlenA (lpString="*.gzip") returned 6
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.jpg") returned 0
	[0063.669] lstrlenA (lpString="*.jpg") returned 5
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.jpeg") returned 0
	[0063.669] lstrlenA (lpString="*.jpeg") returned 6
	[0063.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.psd") returned 0
	[0063.669] lstrlenA (lpString="*.psd") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.cdr") returned 0
	[0063.670] lstrlenA (lpString="*.cdr") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.dwg") returned 0
	[0063.670] lstrlenA (lpString="*.dwg") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.max") returned 0
	[0063.670] lstrlenA (lpString="*.max") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.bmp") returned 0
	[0063.670] lstrlenA (lpString="*.bmp") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.gif") returned 0
	[0063.670] lstrlenA (lpString="*.gif") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.png") returned 0
	[0063.670] lstrlenA (lpString="*.png") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.doc") returned 0
	[0063.670] lstrlenA (lpString="*.doc") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.docx") returned 0
	[0063.670] lstrlenA (lpString="*.docx") returned 6
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.xls") returned 0
	[0063.670] lstrlenA (lpString="*.xls") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.xlsx") returned 0
	[0063.670] lstrlenA (lpString="*.xlsx") returned 6
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ppt") returned 0
	[0063.670] lstrlenA (lpString="*.ppt") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pptx") returned 0
	[0063.670] lstrlenA (lpString="*.pptx") returned 6
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.txt") returned 0
	[0063.670] lstrlenA (lpString="*.txt") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pdf") returned 0
	[0063.670] lstrlenA (lpString="*.pdf") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.djvu") returned 0
	[0063.670] lstrlenA (lpString="*.djvu") returned 6
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.htm") returned 0
	[0063.670] lstrlenA (lpString="*.htm") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.html") returned 0
	[0063.670] lstrlenA (lpString="*.html") returned 6
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mdb") returned 0
	[0063.670] lstrlenA (lpString="*.mdb") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.cer") returned 0
	[0063.670] lstrlenA (lpString="*.cer") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.p12") returned 0
	[0063.670] lstrlenA (lpString="*.p12") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pfx") returned 0
	[0063.670] lstrlenA (lpString="*.pfx") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.kwm") returned 0
	[0063.670] lstrlenA (lpString="*.kwm") returned 5
	[0063.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pwm") returned 0
	[0063.671] lstrlenA (lpString="*.pwm") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.1cd") returned 0
	[0063.671] lstrlenA (lpString="*.1cd") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.md") returned 0
	[0063.671] lstrlenA (lpString="*.md") returned 4
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mdf") returned 0
	[0063.671] lstrlenA (lpString="*.mdf") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.dbf") returned 0
	[0063.671] lstrlenA (lpString="*.dbf") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.odt") returned 0
	[0063.671] lstrlenA (lpString="*.odt") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.vob") returned 0
	[0063.671] lstrlenA (lpString="*.vob") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ifo") returned 0
	[0063.671] lstrlenA (lpString="*.ifo") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.lnk") returned 0
	[0063.671] lstrlenA (lpString="*.lnk") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.torrent") returned 0
	[0063.671] lstrlenA (lpString="*.torrent") returned 9
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mov") returned 0
	[0063.671] lstrlenA (lpString="*.mov") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.m2v") returned 0
	[0063.671] lstrlenA (lpString="*.m2v") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.3gp") returned 0
	[0063.671] lstrlenA (lpString="*.3gp") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mpeg") returned 0
	[0063.671] lstrlenA (lpString="*.mpeg") returned 6
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mpg") returned 0
	[0063.671] lstrlenA (lpString="*.mpg") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.flv") returned 0
	[0063.671] lstrlenA (lpString="*.flv") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.avi") returned 0
	[0063.671] lstrlenA (lpString="*.avi") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mp4") returned 0
	[0063.671] lstrlenA (lpString="*.mp4") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wmv") returned 0
	[0063.671] lstrlenA (lpString="*.wmv") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.divx") returned 0
	[0063.671] lstrlenA (lpString="*.divx") returned 6
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mkv") returned 0
	[0063.671] lstrlenA (lpString="*.mkv") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mp3") returned 0
	[0063.671] lstrlenA (lpString="*.mp3") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wav") returned 0
	[0063.671] lstrlenA (lpString="*.wav") returned 5
	[0063.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.flac") returned 0
	[0063.672] lstrlenA (lpString="*.flac") returned 6
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ape") returned 0
	[0063.672] lstrlenA (lpString="*.ape") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wma") returned 0
	[0063.672] lstrlenA (lpString="*.wma") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ac3") returned 0
	[0063.672] lstrlenA (lpString="*.ac3") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.exe") returned 0
	[0063.672] lstrlenA (lpString="*.exe") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.apk") returned 0
	[0063.672] lstrlenA (lpString="*.apk") returned 5
	[0063.672] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.672] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.672] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1
	[0063.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1
	[0063.672] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1
	[0063.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned="SUBMIT.JS"
	[0063.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.672] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js"
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.zip") returned 0
	[0063.672] lstrlenA (lpString="*.zip") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.rar") returned 0
	[0063.672] lstrlenA (lpString="*.rar") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.7z") returned 0
	[0063.672] lstrlenA (lpString="*.7z") returned 4
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.tar") returned 0
	[0063.672] lstrlenA (lpString="*.tar") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.gzip") returned 0
	[0063.672] lstrlenA (lpString="*.gzip") returned 6
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.jpg") returned 0
	[0063.672] lstrlenA (lpString="*.jpg") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.jpeg") returned 0
	[0063.672] lstrlenA (lpString="*.jpeg") returned 6
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.psd") returned 0
	[0063.672] lstrlenA (lpString="*.psd") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.cdr") returned 0
	[0063.672] lstrlenA (lpString="*.cdr") returned 5
	[0063.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.dwg") returned 0
	[0063.672] lstrlenA (lpString="*.dwg") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.max") returned 0
	[0063.673] lstrlenA (lpString="*.max") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.bmp") returned 0
	[0063.673] lstrlenA (lpString="*.bmp") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.gif") returned 0
	[0063.673] lstrlenA (lpString="*.gif") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.png") returned 0
	[0063.673] lstrlenA (lpString="*.png") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.doc") returned 0
	[0063.673] lstrlenA (lpString="*.doc") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.docx") returned 0
	[0063.673] lstrlenA (lpString="*.docx") returned 6
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.xls") returned 0
	[0063.673] lstrlenA (lpString="*.xls") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.xlsx") returned 0
	[0063.673] lstrlenA (lpString="*.xlsx") returned 6
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ppt") returned 0
	[0063.673] lstrlenA (lpString="*.ppt") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pptx") returned 0
	[0063.673] lstrlenA (lpString="*.pptx") returned 6
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.txt") returned 0
	[0063.673] lstrlenA (lpString="*.txt") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pdf") returned 0
	[0063.673] lstrlenA (lpString="*.pdf") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.djvu") returned 0
	[0063.673] lstrlenA (lpString="*.djvu") returned 6
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.htm") returned 0
	[0063.673] lstrlenA (lpString="*.htm") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.html") returned 0
	[0063.673] lstrlenA (lpString="*.html") returned 6
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mdb") returned 0
	[0063.673] lstrlenA (lpString="*.mdb") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.cer") returned 0
	[0063.673] lstrlenA (lpString="*.cer") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.p12") returned 0
	[0063.673] lstrlenA (lpString="*.p12") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pfx") returned 0
	[0063.673] lstrlenA (lpString="*.pfx") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.kwm") returned 0
	[0063.673] lstrlenA (lpString="*.kwm") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pwm") returned 0
	[0063.673] lstrlenA (lpString="*.pwm") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.1cd") returned 0
	[0063.673] lstrlenA (lpString="*.1cd") returned 5
	[0063.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.md") returned 0
	[0063.673] lstrlenA (lpString="*.md") returned 4
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mdf") returned 0
	[0063.674] lstrlenA (lpString="*.mdf") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.dbf") returned 0
	[0063.674] lstrlenA (lpString="*.dbf") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.odt") returned 0
	[0063.674] lstrlenA (lpString="*.odt") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.vob") returned 0
	[0063.674] lstrlenA (lpString="*.vob") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ifo") returned 0
	[0063.674] lstrlenA (lpString="*.ifo") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.lnk") returned 0
	[0063.674] lstrlenA (lpString="*.lnk") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.torrent") returned 0
	[0063.674] lstrlenA (lpString="*.torrent") returned 9
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mov") returned 0
	[0063.674] lstrlenA (lpString="*.mov") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.m2v") returned 0
	[0063.674] lstrlenA (lpString="*.m2v") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.3gp") returned 0
	[0063.674] lstrlenA (lpString="*.3gp") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mpeg") returned 0
	[0063.674] lstrlenA (lpString="*.mpeg") returned 6
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mpg") returned 0
	[0063.674] lstrlenA (lpString="*.mpg") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.flv") returned 0
	[0063.674] lstrlenA (lpString="*.flv") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.avi") returned 0
	[0063.674] lstrlenA (lpString="*.avi") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mp4") returned 0
	[0063.674] lstrlenA (lpString="*.mp4") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wmv") returned 0
	[0063.674] lstrlenA (lpString="*.wmv") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.divx") returned 0
	[0063.674] lstrlenA (lpString="*.divx") returned 6
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mkv") returned 0
	[0063.674] lstrlenA (lpString="*.mkv") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mp3") returned 0
	[0063.674] lstrlenA (lpString="*.mp3") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wav") returned 0
	[0063.674] lstrlenA (lpString="*.wav") returned 5
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.flac") returned 0
	[0063.674] lstrlenA (lpString="*.flac") returned 6
	[0063.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ape") returned 0
	[0063.674] lstrlenA (lpString="*.ape") returned 5
	[0063.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wma") returned 0
	[0063.675] lstrlenA (lpString="*.wma") returned 5
	[0063.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ac3") returned 0
	[0063.675] lstrlenA (lpString="*.ac3") returned 5
	[0063.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.exe") returned 0
	[0063.675] lstrlenA (lpString="*.exe") returned 5
	[0063.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.apk") returned 0
	[0063.675] lstrlenA (lpString="*.apk") returned 5
	[0063.675] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.675] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.675] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1
	[0063.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1
	[0063.675] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1
	[0063.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned="utilityfunctions.js"
	[0063.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.683] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.683] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js"
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.zip") returned 0
	[0063.683] lstrlenA (lpString="*.zip") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.rar") returned 0
	[0063.683] lstrlenA (lpString="*.rar") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.7z") returned 0
	[0063.683] lstrlenA (lpString="*.7z") returned 4
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.tar") returned 0
	[0063.683] lstrlenA (lpString="*.tar") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.gzip") returned 0
	[0063.683] lstrlenA (lpString="*.gzip") returned 6
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.jpg") returned 0
	[0063.683] lstrlenA (lpString="*.jpg") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.jpeg") returned 0
	[0063.683] lstrlenA (lpString="*.jpeg") returned 6
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.psd") returned 0
	[0063.683] lstrlenA (lpString="*.psd") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.cdr") returned 0
	[0063.683] lstrlenA (lpString="*.cdr") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.dwg") returned 0
	[0063.683] lstrlenA (lpString="*.dwg") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.max") returned 0
	[0063.683] lstrlenA (lpString="*.max") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.bmp") returned 0
	[0063.683] lstrlenA (lpString="*.bmp") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.gif") returned 0
	[0063.683] lstrlenA (lpString="*.gif") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.png") returned 0
	[0063.683] lstrlenA (lpString="*.png") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.doc") returned 0
	[0063.683] lstrlenA (lpString="*.doc") returned 5
	[0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.docx") returned 0
	[0063.684] lstrlenA (lpString="*.docx") returned 6
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.xls") returned 0
	[0063.684] lstrlenA (lpString="*.xls") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.xlsx") returned 0
	[0063.684] lstrlenA (lpString="*.xlsx") returned 6
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ppt") returned 0
	[0063.684] lstrlenA (lpString="*.ppt") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pptx") returned 0
	[0063.684] lstrlenA (lpString="*.pptx") returned 6
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.txt") returned 0
	[0063.684] lstrlenA (lpString="*.txt") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pdf") returned 0
	[0063.684] lstrlenA (lpString="*.pdf") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.djvu") returned 0
	[0063.684] lstrlenA (lpString="*.djvu") returned 6
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.htm") returned 0
	[0063.684] lstrlenA (lpString="*.htm") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.html") returned 0
	[0063.684] lstrlenA (lpString="*.html") returned 6
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mdb") returned 0
	[0063.684] lstrlenA (lpString="*.mdb") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.cer") returned 0
	[0063.684] lstrlenA (lpString="*.cer") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.p12") returned 0
	[0063.684] lstrlenA (lpString="*.p12") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pfx") returned 0
	[0063.684] lstrlenA (lpString="*.pfx") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.kwm") returned 0
	[0063.684] lstrlenA (lpString="*.kwm") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pwm") returned 0
	[0063.684] lstrlenA (lpString="*.pwm") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.1cd") returned 0
	[0063.684] lstrlenA (lpString="*.1cd") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.md") returned 0
	[0063.684] lstrlenA (lpString="*.md") returned 4
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mdf") returned 0
	[0063.684] lstrlenA (lpString="*.mdf") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.dbf") returned 0
	[0063.684] lstrlenA (lpString="*.dbf") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.odt") returned 0
	[0063.684] lstrlenA (lpString="*.odt") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.vob") returned 0
	[0063.684] lstrlenA (lpString="*.vob") returned 5
	[0063.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ifo") returned 0
	[0063.684] lstrlenA (lpString="*.ifo") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.lnk") returned 0
	[0063.685] lstrlenA (lpString="*.lnk") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.torrent") returned 0
	[0063.685] lstrlenA (lpString="*.torrent") returned 9
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mov") returned 0
	[0063.685] lstrlenA (lpString="*.mov") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.m2v") returned 0
	[0063.685] lstrlenA (lpString="*.m2v") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.3gp") returned 0
	[0063.685] lstrlenA (lpString="*.3gp") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mpeg") returned 0
	[0063.685] lstrlenA (lpString="*.mpeg") returned 6
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mpg") returned 0
	[0063.685] lstrlenA (lpString="*.mpg") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.flv") returned 0
	[0063.685] lstrlenA (lpString="*.flv") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.avi") returned 0
	[0063.685] lstrlenA (lpString="*.avi") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mp4") returned 0
	[0063.685] lstrlenA (lpString="*.mp4") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wmv") returned 0
	[0063.685] lstrlenA (lpString="*.wmv") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.divx") returned 0
	[0063.685] lstrlenA (lpString="*.divx") returned 6
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mkv") returned 0
	[0063.685] lstrlenA (lpString="*.mkv") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mp3") returned 0
	[0063.685] lstrlenA (lpString="*.mp3") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wav") returned 0
	[0063.685] lstrlenA (lpString="*.wav") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.flac") returned 0
	[0063.685] lstrlenA (lpString="*.flac") returned 6
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ape") returned 0
	[0063.685] lstrlenA (lpString="*.ape") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wma") returned 0
	[0063.685] lstrlenA (lpString="*.wma") returned 5
	[0063.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ac3") returned 0
	[0063.686] lstrlenA (lpString="*.ac3") returned 5
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.exe") returned 0
	[0063.686] lstrlenA (lpString="*.exe") returned 5
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.apk") returned 0
	[0063.686] lstrlenA (lpString="*.apk") returned 5
	[0063.686] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.686] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.686] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.CSS") returned -1
	[0063.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.CSS") returned -1
	[0063.686] lstrcmpiA (lpString1="", lpString2="VIEW.CSS") returned -1
	[0063.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned="validation.js"
	[0063.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS"
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.zip") returned 0
	[0063.686] lstrlenA (lpString="*.zip") returned 5
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.rar") returned 0
	[0063.686] lstrlenA (lpString="*.rar") returned 5
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.7z") returned 0
	[0063.686] lstrlenA (lpString="*.7z") returned 4
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.tar") returned 0
	[0063.686] lstrlenA (lpString="*.tar") returned 5
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.gzip") returned 0
	[0063.686] lstrlenA (lpString="*.gzip") returned 6
	[0063.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.jpg") returned 0
	[0063.687] lstrlenA (lpString="*.jpg") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.jpeg") returned 0
	[0063.687] lstrlenA (lpString="*.jpeg") returned 6
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.psd") returned 0
	[0063.687] lstrlenA (lpString="*.psd") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.cdr") returned 0
	[0063.687] lstrlenA (lpString="*.cdr") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.dwg") returned 0
	[0063.687] lstrlenA (lpString="*.dwg") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.max") returned 0
	[0063.687] lstrlenA (lpString="*.max") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.bmp") returned 0
	[0063.687] lstrlenA (lpString="*.bmp") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.gif") returned 0
	[0063.687] lstrlenA (lpString="*.gif") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.png") returned 0
	[0063.687] lstrlenA (lpString="*.png") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.doc") returned 0
	[0063.687] lstrlenA (lpString="*.doc") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.docx") returned 0
	[0063.687] lstrlenA (lpString="*.docx") returned 6
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.xls") returned 0
	[0063.687] lstrlenA (lpString="*.xls") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.xlsx") returned 0
	[0063.687] lstrlenA (lpString="*.xlsx") returned 6
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ppt") returned 0
	[0063.687] lstrlenA (lpString="*.ppt") returned 5
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pptx") returned 0
	[0063.687] lstrlenA (lpString="*.pptx") returned 6
	[0063.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.txt") returned 0
	[0063.687] lstrlenA (lpString="*.txt") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pdf") returned 0
	[0063.688] lstrlenA (lpString="*.pdf") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.djvu") returned 0
	[0063.688] lstrlenA (lpString="*.djvu") returned 6
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.htm") returned 0
	[0063.688] lstrlenA (lpString="*.htm") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.html") returned 0
	[0063.688] lstrlenA (lpString="*.html") returned 6
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mdb") returned 0
	[0063.688] lstrlenA (lpString="*.mdb") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.cer") returned 0
	[0063.688] lstrlenA (lpString="*.cer") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.p12") returned 0
	[0063.688] lstrlenA (lpString="*.p12") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pfx") returned 0
	[0063.688] lstrlenA (lpString="*.pfx") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.kwm") returned 0
	[0063.688] lstrlenA (lpString="*.kwm") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pwm") returned 0
	[0063.688] lstrlenA (lpString="*.pwm") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.1cd") returned 0
	[0063.688] lstrlenA (lpString="*.1cd") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.md") returned 0
	[0063.688] lstrlenA (lpString="*.md") returned 4
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mdf") returned 0
	[0063.688] lstrlenA (lpString="*.mdf") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.dbf") returned 0
	[0063.688] lstrlenA (lpString="*.dbf") returned 5
	[0063.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.odt") returned 0
	[0063.688] lstrlenA (lpString="*.odt") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.vob") returned 0
	[0063.689] lstrlenA (lpString="*.vob") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ifo") returned 0
	[0063.689] lstrlenA (lpString="*.ifo") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.lnk") returned 0
	[0063.689] lstrlenA (lpString="*.lnk") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.torrent") returned 0
	[0063.689] lstrlenA (lpString="*.torrent") returned 9
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mov") returned 0
	[0063.689] lstrlenA (lpString="*.mov") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.m2v") returned 0
	[0063.689] lstrlenA (lpString="*.m2v") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.3gp") returned 0
	[0063.689] lstrlenA (lpString="*.3gp") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mpeg") returned 0
	[0063.689] lstrlenA (lpString="*.mpeg") returned 6
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mpg") returned 0
	[0063.689] lstrlenA (lpString="*.mpg") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.flv") returned 0
	[0063.689] lstrlenA (lpString="*.flv") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.avi") returned 0
	[0063.689] lstrlenA (lpString="*.avi") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mp4") returned 0
	[0063.689] lstrlenA (lpString="*.mp4") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wmv") returned 0
	[0063.689] lstrlenA (lpString="*.wmv") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.divx") returned 0
	[0063.689] lstrlenA (lpString="*.divx") returned 6
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mkv") returned 0
	[0063.689] lstrlenA (lpString="*.mkv") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mp3") returned 0
	[0063.689] lstrlenA (lpString="*.mp3") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wav") returned 0
	[0063.689] lstrlenA (lpString="*.wav") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.flac") returned 0
	[0063.689] lstrlenA (lpString="*.flac") returned 6
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ape") returned 0
	[0063.689] lstrlenA (lpString="*.ape") returned 5
	[0063.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wma") returned 0
	[0063.689] lstrlenA (lpString="*.wma") returned 5
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ac3") returned 0
	[0063.690] lstrlenA (lpString="*.ac3") returned 5
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.exe") returned 0
	[0063.690] lstrlenA (lpString="*.exe") returned 5
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.apk") returned 0
	[0063.690] lstrlenA (lpString="*.apk") returned 5
	[0063.690] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.690] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.690] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.ICO") returned -1
	[0063.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1
	[0063.690] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1
	[0063.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned="VIEW.CSS"
	[0063.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO"
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.zip") returned 0
	[0063.690] lstrlenA (lpString="*.zip") returned 5
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.rar") returned 0
	[0063.690] lstrlenA (lpString="*.rar") returned 5
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.7z") returned 0
	[0063.690] lstrlenA (lpString="*.7z") returned 4
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.tar") returned 0
	[0063.690] lstrlenA (lpString="*.tar") returned 5
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.gzip") returned 0
	[0063.690] lstrlenA (lpString="*.gzip") returned 6
	[0063.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.jpg") returned 0
	[0063.690] lstrlenA (lpString="*.jpg") returned 5
	[0063.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.jpeg") returned 0
	[0063.691] lstrlenA (lpString="*.jpeg") returned 6
	[0063.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.psd") returned 0
	[0063.691] lstrlenA (lpString="*.psd") returned 5
	[0063.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.cdr") returned 0
	[0063.691] lstrlenA (lpString="*.cdr") returned 5
	[0063.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.dwg") returned 0
	[0063.691] lstrlenA (lpString="*.dwg") returned 5
	[0063.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.max") returned 0
	[0063.691] lstrlenA (lpString="*.max") returned 5
	[0063.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.bmp") returned 0
	[0063.691] lstrlenA (lpString="*.bmp") returned 5
	[0063.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.gif") returned 0
	[0063.691] lstrlenA (lpString="*.gif") returned 5
	[0063.691] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.691] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.691] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.JS") returned -1
	[0063.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1
	[0063.691] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1
	[0063.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned="VIEW.ICO"
	[0063.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.691] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS"
	[0063.692] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.692] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.692] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEWBY.GIF") returned -1
	[0063.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEWBY.GIF") returned -1
	[0063.692] lstrcmpiA (lpString1="", lpString2="VIEWBY.GIF") returned -1
	[0063.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned="VIEW.JS"
	[0063.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF"
	[0063.692] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF"
	[0063.692] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF"
	[0063.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF."
	[0063.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.Boom"
	[0063.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.693] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x207
	[0063.693] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1
	[0063.693] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.693] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1e4, lpOverlapped=0x0) returned 1
	[0063.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="VIEWBY.GIF"
	[0063.694] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.694] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1e4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1e4, lpOverlapped=0x0) returned 1
	[0063.694] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.694] CloseHandle (hObject=0x98) returned 1
	[0063.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif.boom")) returned 1
	[0063.695] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.695] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.695] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="viewDblClick.js") returned -1
	[0063.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="viewDblClick.js") returned -1
	[0063.695] lstrcmpiA (lpString1="", lpString2="viewDblClick.js") returned -1
	[0063.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="VIEWBY.GIF"
	[0063.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="viewDblClick.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js"
	[0063.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.zip") returned 0
	[0063.695] lstrlenA (lpString="*.zip") returned 5
	[0063.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.rar") returned 0
	[0063.695] lstrlenA (lpString="*.rar") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.7z") returned 0
	[0063.696] lstrlenA (lpString="*.7z") returned 4
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.tar") returned 0
	[0063.696] lstrlenA (lpString="*.tar") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.gzip") returned 0
	[0063.696] lstrlenA (lpString="*.gzip") returned 6
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.jpg") returned 0
	[0063.696] lstrlenA (lpString="*.jpg") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.jpeg") returned 0
	[0063.696] lstrlenA (lpString="*.jpeg") returned 6
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.psd") returned 0
	[0063.696] lstrlenA (lpString="*.psd") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.cdr") returned 0
	[0063.696] lstrlenA (lpString="*.cdr") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.dwg") returned 0
	[0063.696] lstrlenA (lpString="*.dwg") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.max") returned 0
	[0063.696] lstrlenA (lpString="*.max") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.bmp") returned 0
	[0063.696] lstrlenA (lpString="*.bmp") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.gif") returned 0
	[0063.696] lstrlenA (lpString="*.gif") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.png") returned 0
	[0063.696] lstrlenA (lpString="*.png") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.doc") returned 0
	[0063.696] lstrlenA (lpString="*.doc") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.docx") returned 0
	[0063.696] lstrlenA (lpString="*.docx") returned 6
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.xls") returned 0
	[0063.696] lstrlenA (lpString="*.xls") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.xlsx") returned 0
	[0063.696] lstrlenA (lpString="*.xlsx") returned 6
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.ppt") returned 0
	[0063.696] lstrlenA (lpString="*.ppt") returned 5
	[0063.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.pptx") returned 0
	[0063.696] lstrlenA (lpString="*.pptx") returned 6
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.txt") returned 0
	[0063.697] lstrlenA (lpString="*.txt") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.pdf") returned 0
	[0063.697] lstrlenA (lpString="*.pdf") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.djvu") returned 0
	[0063.697] lstrlenA (lpString="*.djvu") returned 6
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.htm") returned 0
	[0063.697] lstrlenA (lpString="*.htm") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.html") returned 0
	[0063.697] lstrlenA (lpString="*.html") returned 6
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mdb") returned 0
	[0063.697] lstrlenA (lpString="*.mdb") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.cer") returned 0
	[0063.697] lstrlenA (lpString="*.cer") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.p12") returned 0
	[0063.697] lstrlenA (lpString="*.p12") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.pfx") returned 0
	[0063.697] lstrlenA (lpString="*.pfx") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.kwm") returned 0
	[0063.697] lstrlenA (lpString="*.kwm") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.pwm") returned 0
	[0063.697] lstrlenA (lpString="*.pwm") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.1cd") returned 0
	[0063.697] lstrlenA (lpString="*.1cd") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.md") returned 0
	[0063.697] lstrlenA (lpString="*.md") returned 4
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mdf") returned 0
	[0063.697] lstrlenA (lpString="*.mdf") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.dbf") returned 0
	[0063.697] lstrlenA (lpString="*.dbf") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.odt") returned 0
	[0063.697] lstrlenA (lpString="*.odt") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.vob") returned 0
	[0063.697] lstrlenA (lpString="*.vob") returned 5
	[0063.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.ifo") returned 0
	[0063.698] lstrlenA (lpString="*.ifo") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.lnk") returned 0
	[0063.698] lstrlenA (lpString="*.lnk") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.torrent") returned 0
	[0063.698] lstrlenA (lpString="*.torrent") returned 9
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mov") returned 0
	[0063.698] lstrlenA (lpString="*.mov") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.m2v") returned 0
	[0063.698] lstrlenA (lpString="*.m2v") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.3gp") returned 0
	[0063.698] lstrlenA (lpString="*.3gp") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mpeg") returned 0
	[0063.698] lstrlenA (lpString="*.mpeg") returned 6
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mpg") returned 0
	[0063.698] lstrlenA (lpString="*.mpg") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.flv") returned 0
	[0063.698] lstrlenA (lpString="*.flv") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.avi") returned 0
	[0063.698] lstrlenA (lpString="*.avi") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mp4") returned 0
	[0063.698] lstrlenA (lpString="*.mp4") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.wmv") returned 0
	[0063.698] lstrlenA (lpString="*.wmv") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.divx") returned 0
	[0063.698] lstrlenA (lpString="*.divx") returned 6
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mkv") returned 0
	[0063.698] lstrlenA (lpString="*.mkv") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mp3") returned 0
	[0063.698] lstrlenA (lpString="*.mp3") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.wav") returned 0
	[0063.698] lstrlenA (lpString="*.wav") returned 5
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.flac") returned 0
	[0063.698] lstrlenA (lpString="*.flac") returned 6
	[0063.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.ape") returned 0
	[0063.698] lstrlenA (lpString="*.ape") returned 5
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.wma") returned 0
	[0063.699] lstrlenA (lpString="*.wma") returned 5
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.ac3") returned 0
	[0063.699] lstrlenA (lpString="*.ac3") returned 5
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.exe") returned 0
	[0063.699] lstrlenA (lpString="*.exe") returned 5
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.apk") returned 0
	[0063.699] lstrlenA (lpString="*.apk") returned 5
	[0063.699] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.699] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.699] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ViewHeaderPreview.jpg") returned -1
	[0063.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1
	[0063.699] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1
	[0063.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned="viewDblClick.js"
	[0063.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg"
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.zip") returned 0
	[0063.699] lstrlenA (lpString="*.zip") returned 5
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.rar") returned 0
	[0063.699] lstrlenA (lpString="*.rar") returned 5
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.7z") returned 0
	[0063.699] lstrlenA (lpString="*.7z") returned 4
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.tar") returned 0
	[0063.699] lstrlenA (lpString="*.tar") returned 5
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.gzip") returned 0
	[0063.699] lstrlenA (lpString="*.gzip") returned 6
	[0063.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.jpg") returned 1
	[0063.700] lstrlenA (lpString="*.jpg") returned 5
	[0063.700] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg"
	[0063.700] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg"
	[0063.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg."
	[0063.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.Boom"
	[0063.700] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.701] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78
	[0063.701] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1
	[0063.701] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.701] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd55, lpOverlapped=0x0) returned 1
	[0063.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg"
	[0063.712] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.712] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd55, lpOverlapped=0x0) returned 1
	[0063.712] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.712] CloseHandle (hObject=0x98) returned 1
	[0063.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.boom")) returned 1
	[0063.713] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.713] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.713] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="viewSelectionChanged.js") returned -1
	[0063.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="viewSelectionChanged.js") returned -1
	[0063.713] lstrcmpiA (lpString1="", lpString2="viewSelectionChanged.js") returned -1
	[0063.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg"
	[0063.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\"
	[0063.713] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned=""
	[0063.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt"
	[0063.713] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20
	[0063.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="viewSelectionChanged.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js"
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.zip") returned 0
	[0063.713] lstrlenA (lpString="*.zip") returned 5
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.rar") returned 0
	[0063.713] lstrlenA (lpString="*.rar") returned 5
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.7z") returned 0
	[0063.713] lstrlenA (lpString="*.7z") returned 4
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.tar") returned 0
	[0063.713] lstrlenA (lpString="*.tar") returned 5
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.gzip") returned 0
	[0063.713] lstrlenA (lpString="*.gzip") returned 6
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.jpg") returned 0
	[0063.713] lstrlenA (lpString="*.jpg") returned 5
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.jpeg") returned 0
	[0063.713] lstrlenA (lpString="*.jpeg") returned 6
	[0063.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.psd") returned 0
	[0063.713] lstrlenA (lpString="*.psd") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.cdr") returned 0
	[0063.714] lstrlenA (lpString="*.cdr") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.dwg") returned 0
	[0063.714] lstrlenA (lpString="*.dwg") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.max") returned 0
	[0063.714] lstrlenA (lpString="*.max") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.bmp") returned 0
	[0063.714] lstrlenA (lpString="*.bmp") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.gif") returned 0
	[0063.714] lstrlenA (lpString="*.gif") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.png") returned 0
	[0063.714] lstrlenA (lpString="*.png") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.doc") returned 0
	[0063.714] lstrlenA (lpString="*.doc") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.docx") returned 0
	[0063.714] lstrlenA (lpString="*.docx") returned 6
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.xls") returned 0
	[0063.714] lstrlenA (lpString="*.xls") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.xlsx") returned 0
	[0063.714] lstrlenA (lpString="*.xlsx") returned 6
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.ppt") returned 0
	[0063.714] lstrlenA (lpString="*.ppt") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.pptx") returned 0
	[0063.714] lstrlenA (lpString="*.pptx") returned 6
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.txt") returned 0
	[0063.714] lstrlenA (lpString="*.txt") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.pdf") returned 0
	[0063.714] lstrlenA (lpString="*.pdf") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.djvu") returned 0
	[0063.714] lstrlenA (lpString="*.djvu") returned 6
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.htm") returned 0
	[0063.714] lstrlenA (lpString="*.htm") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.html") returned 0
	[0063.714] lstrlenA (lpString="*.html") returned 6
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mdb") returned 0
	[0063.714] lstrlenA (lpString="*.mdb") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.cer") returned 0
	[0063.714] lstrlenA (lpString="*.cer") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.p12") returned 0
	[0063.714] lstrlenA (lpString="*.p12") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.pfx") returned 0
	[0063.714] lstrlenA (lpString="*.pfx") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.kwm") returned 0
	[0063.714] lstrlenA (lpString="*.kwm") returned 5
	[0063.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.pwm") returned 0
	[0063.715] lstrlenA (lpString="*.pwm") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.1cd") returned 0
	[0063.715] lstrlenA (lpString="*.1cd") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.md") returned 0
	[0063.715] lstrlenA (lpString="*.md") returned 4
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mdf") returned 0
	[0063.715] lstrlenA (lpString="*.mdf") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.dbf") returned 0
	[0063.715] lstrlenA (lpString="*.dbf") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.odt") returned 0
	[0063.715] lstrlenA (lpString="*.odt") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.vob") returned 0
	[0063.715] lstrlenA (lpString="*.vob") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.ifo") returned 0
	[0063.715] lstrlenA (lpString="*.ifo") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.lnk") returned 0
	[0063.715] lstrlenA (lpString="*.lnk") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.torrent") returned 0
	[0063.715] lstrlenA (lpString="*.torrent") returned 9
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mov") returned 0
	[0063.715] lstrlenA (lpString="*.mov") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.m2v") returned 0
	[0063.715] lstrlenA (lpString="*.m2v") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.3gp") returned 0
	[0063.715] lstrlenA (lpString="*.3gp") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mpeg") returned 0
	[0063.715] lstrlenA (lpString="*.mpeg") returned 6
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mpg") returned 0
	[0063.715] lstrlenA (lpString="*.mpg") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.flv") returned 0
	[0063.715] lstrlenA (lpString="*.flv") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.avi") returned 0
	[0063.715] lstrlenA (lpString="*.avi") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mp4") returned 0
	[0063.715] lstrlenA (lpString="*.mp4") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.wmv") returned 0
	[0063.715] lstrlenA (lpString="*.wmv") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.divx") returned 0
	[0063.715] lstrlenA (lpString="*.divx") returned 6
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mkv") returned 0
	[0063.715] lstrlenA (lpString="*.mkv") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mp3") returned 0
	[0063.715] lstrlenA (lpString="*.mp3") returned 5
	[0063.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.wav") returned 0
	[0063.715] lstrlenA (lpString="*.wav") returned 5
	[0063.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.flac") returned 0
	[0063.716] lstrlenA (lpString="*.flac") returned 6
	[0063.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.ape") returned 0
	[0063.716] lstrlenA (lpString="*.ape") returned 5
	[0063.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.wma") returned 0
	[0063.716] lstrlenA (lpString="*.wma") returned 5
	[0063.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.ac3") returned 0
	[0063.716] lstrlenA (lpString="*.ac3") returned 5
	[0063.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.exe") returned 0
	[0063.716] lstrlenA (lpString="*.exe") returned 5
	[0063.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.apk") returned 0
	[0063.716] lstrlenA (lpString="*.apk") returned 5
	[0063.716] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0063.716] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0063.716] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0063.716] lstrcmpA (lpString1=".", lpString2="GrooveForms3") returned -1
	[0063.716] lstrcmpA (lpString1="..", lpString2="GrooveForms3") returned -1
	[0063.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0063.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms3" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3"
	[0063.716] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned 82
	[0063.716] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0063.718] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0063.718] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.719] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0063.719] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0063.719] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.719] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.719] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADD.GIF") returned 1
	[0063.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1
	[0063.719] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1
	[0063.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*") returned="*.*"
	[0063.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0xffffffff
	[0063.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.720] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0063.720] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0063.721] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0063.721] CloseHandle (hObject=0x98) returned 1
	[0063.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF"
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.zip") returned 0
	[0063.721] lstrlenA (lpString="*.zip") returned 5
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.rar") returned 0
	[0063.721] lstrlenA (lpString="*.rar") returned 5
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.7z") returned 0
	[0063.721] lstrlenA (lpString="*.7z") returned 4
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.tar") returned 0
	[0063.721] lstrlenA (lpString="*.tar") returned 5
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.gzip") returned 0
	[0063.721] lstrlenA (lpString="*.gzip") returned 6
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.jpg") returned 0
	[0063.721] lstrlenA (lpString="*.jpg") returned 5
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.jpeg") returned 0
	[0063.721] lstrlenA (lpString="*.jpeg") returned 6
	[0063.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.psd") returned 0
	[0063.721] lstrlenA (lpString="*.psd") returned 5
	[0063.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.cdr") returned 0
	[0063.722] lstrlenA (lpString="*.cdr") returned 5
	[0063.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.dwg") returned 0
	[0063.722] lstrlenA (lpString="*.dwg") returned 5
	[0063.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.max") returned 0
	[0063.722] lstrlenA (lpString="*.max") returned 5
	[0063.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.bmp") returned 0
	[0063.722] lstrlenA (lpString="*.bmp") returned 5
	[0063.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.gif") returned 1
	[0063.722] lstrlenA (lpString="*.gif") returned 5
	[0063.722] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF"
	[0063.722] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF"
	[0063.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF."
	[0063.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.Boom"
	[0063.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.723] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244
	[0063.723] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.723] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.723] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x221, lpOverlapped=0x0) returned 1
	[0063.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="ADD.GIF"
	[0063.724] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.724] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x221, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x221, lpOverlapped=0x0) returned 1
	[0063.724] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.724] CloseHandle (hObject=0x98) returned 1
	[0063.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif.boom")) returned 1
	[0063.725] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.725] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.725] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrow.jpg") returned 1
	[0063.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1
	[0063.725] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1
	[0063.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="ADD.GIF"
	[0063.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.725] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg"
	[0063.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0
	[0063.725] lstrlenA (lpString="*.zip") returned 5
	[0063.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0
	[0063.725] lstrlenA (lpString="*.rar") returned 5
	[0063.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0
	[0063.725] lstrlenA (lpString="*.7z") returned 4
	[0063.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0
	[0063.725] lstrlenA (lpString="*.tar") returned 5
	[0063.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0
	[0063.725] lstrlenA (lpString="*.gzip") returned 6
	[0063.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1
	[0063.725] lstrlenA (lpString="*.jpg") returned 5
	[0063.725] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg"
	[0063.725] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg"
	[0063.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg."
	[0063.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.Boom"
	[0063.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.726] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8
	[0063.726] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.726] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.726] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbc5, lpOverlapped=0x0) returned 1
	[0063.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg"
	[0063.734] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.734] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbc5, lpOverlapped=0x0) returned 1
	[0063.734] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.734] CloseHandle (hObject=0x98) returned 1
	[0063.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.boom")) returned 1
	[0063.735] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.735] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.735] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrowMask.bmp") returned 1
	[0063.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1
	[0063.735] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1
	[0063.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg"
	[0063.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.736] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp"
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0
	[0063.736] lstrlenA (lpString="*.zip") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0
	[0063.736] lstrlenA (lpString="*.rar") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0
	[0063.736] lstrlenA (lpString="*.7z") returned 4
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0
	[0063.736] lstrlenA (lpString="*.tar") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0
	[0063.736] lstrlenA (lpString="*.gzip") returned 6
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0
	[0063.736] lstrlenA (lpString="*.jpg") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0
	[0063.736] lstrlenA (lpString="*.jpeg") returned 6
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0
	[0063.736] lstrlenA (lpString="*.psd") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.cdr") returned 0
	[0063.736] lstrlenA (lpString="*.cdr") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.dwg") returned 0
	[0063.736] lstrlenA (lpString="*.dwg") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.max") returned 0
	[0063.736] lstrlenA (lpString="*.max") returned 5
	[0063.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.bmp") returned 1
	[0063.736] lstrlenA (lpString="*.bmp") returned 5
	[0063.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp"
	[0063.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp"
	[0063.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp."
	[0063.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.Boom"
	[0063.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.737] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924
	[0063.737] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.738] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.738] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x901, lpOverlapped=0x0) returned 1
	[0063.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp"
	[0063.744] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.744] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x901, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x901, lpOverlapped=0x0) returned 1
	[0063.744] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.744] CloseHandle (hObject=0x98) returned 1
	[0063.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.boom")) returned 1
	[0063.745] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.745] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.745] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1
	[0063.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1
	[0063.745] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1
	[0063.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp"
	[0063.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif"
	[0063.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.zip") returned 0
	[0063.745] lstrlenA (lpString="*.zip") returned 5
	[0063.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.rar") returned 0
	[0063.745] lstrlenA (lpString="*.rar") returned 5
	[0063.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.7z") returned 0
	[0063.745] lstrlenA (lpString="*.7z") returned 4
	[0063.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.tar") returned 0
	[0063.745] lstrlenA (lpString="*.tar") returned 5
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.gzip") returned 0
	[0063.746] lstrlenA (lpString="*.gzip") returned 6
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.jpg") returned 0
	[0063.746] lstrlenA (lpString="*.jpg") returned 5
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.jpeg") returned 0
	[0063.746] lstrlenA (lpString="*.jpeg") returned 6
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.psd") returned 0
	[0063.746] lstrlenA (lpString="*.psd") returned 5
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.cdr") returned 0
	[0063.746] lstrlenA (lpString="*.cdr") returned 5
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.dwg") returned 0
	[0063.746] lstrlenA (lpString="*.dwg") returned 5
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.max") returned 0
	[0063.746] lstrlenA (lpString="*.max") returned 5
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.bmp") returned 0
	[0063.746] lstrlenA (lpString="*.bmp") returned 5
	[0063.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.gif") returned 1
	[0063.746] lstrlenA (lpString="*.gif") returned 5
	[0063.746] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif"
	[0063.746] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif"
	[0063.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif."
	[0063.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.Boom"
	[0063.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.747] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8
	[0063.747] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.747] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.747] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xac5, lpOverlapped=0x0) returned 1
	[0063.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="attention.gif"
	[0063.759] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.759] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xac5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xac5, lpOverlapped=0x0) returned 1
	[0063.759] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.759] CloseHandle (hObject=0x98) returned 1
	[0063.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.boom")) returned 1
	[0063.761] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.761] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.761] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BG_ADOBE.GIF") returned 1
	[0063.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1
	[0063.761] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1
	[0063.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="attention.gif"
	[0063.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.761] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF"
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0
	[0063.761] lstrlenA (lpString="*.zip") returned 5
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0
	[0063.761] lstrlenA (lpString="*.rar") returned 5
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0
	[0063.761] lstrlenA (lpString="*.7z") returned 4
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0
	[0063.761] lstrlenA (lpString="*.tar") returned 5
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0
	[0063.761] lstrlenA (lpString="*.gzip") returned 6
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0
	[0063.761] lstrlenA (lpString="*.jpg") returned 5
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0
	[0063.761] lstrlenA (lpString="*.jpeg") returned 6
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0
	[0063.761] lstrlenA (lpString="*.psd") returned 5
	[0063.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.cdr") returned 0
	[0063.761] lstrlenA (lpString="*.cdr") returned 5
	[0063.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.dwg") returned 0
	[0063.762] lstrlenA (lpString="*.dwg") returned 5
	[0063.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.max") returned 0
	[0063.762] lstrlenA (lpString="*.max") returned 5
	[0063.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.bmp") returned 0
	[0063.762] lstrlenA (lpString="*.bmp") returned 5
	[0063.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1
	[0063.762] lstrlenA (lpString="*.gif") returned 5
	[0063.762] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF"
	[0063.762] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF"
	[0063.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF."
	[0063.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.Boom"
	[0063.762] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.762] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e
	[0063.762] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.763] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.763] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x612b, lpOverlapped=0x0) returned 1
	[0063.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF"
	[0063.767] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.767] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x612b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x612b, lpOverlapped=0x0) returned 1
	[0063.768] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.768] CloseHandle (hObject=0x98) returned 1
	[0063.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif.boom")) returned 1
	[0063.769] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.769] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Casual.gif") returned 1
	[0063.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1
	[0063.769] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1
	[0063.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF"
	[0063.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif"
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.zip") returned 0
	[0063.769] lstrlenA (lpString="*.zip") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.rar") returned 0
	[0063.769] lstrlenA (lpString="*.rar") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.7z") returned 0
	[0063.769] lstrlenA (lpString="*.7z") returned 4
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.tar") returned 0
	[0063.769] lstrlenA (lpString="*.tar") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.gzip") returned 0
	[0063.769] lstrlenA (lpString="*.gzip") returned 6
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.jpg") returned 0
	[0063.769] lstrlenA (lpString="*.jpg") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.jpeg") returned 0
	[0063.769] lstrlenA (lpString="*.jpeg") returned 6
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.psd") returned 0
	[0063.769] lstrlenA (lpString="*.psd") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.cdr") returned 0
	[0063.769] lstrlenA (lpString="*.cdr") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.dwg") returned 0
	[0063.769] lstrlenA (lpString="*.dwg") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.max") returned 0
	[0063.769] lstrlenA (lpString="*.max") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.bmp") returned 0
	[0063.769] lstrlenA (lpString="*.bmp") returned 5
	[0063.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.gif") returned 1
	[0063.770] lstrlenA (lpString="*.gif") returned 5
	[0063.770] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif"
	[0063.770] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif"
	[0063.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif."
	[0063.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.Boom"
	[0063.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.770] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d
	[0063.770] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.770] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.770] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x15fa, lpOverlapped=0x0) returned 1
	[0063.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="bg_Casual.gif"
	[0063.772] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.772] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x15fa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x15fa, lpOverlapped=0x0) returned 1
	[0063.772] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.772] CloseHandle (hObject=0x98) returned 1
	[0063.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.boom")) returned 1
	[0063.772] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.772] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.772] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Country.gif") returned 1
	[0063.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1
	[0063.772] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1
	[0063.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="bg_Casual.gif"
	[0063.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif"
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.zip") returned 0
	[0063.773] lstrlenA (lpString="*.zip") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.rar") returned 0
	[0063.773] lstrlenA (lpString="*.rar") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.7z") returned 0
	[0063.773] lstrlenA (lpString="*.7z") returned 4
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.tar") returned 0
	[0063.773] lstrlenA (lpString="*.tar") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.gzip") returned 0
	[0063.773] lstrlenA (lpString="*.gzip") returned 6
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.jpg") returned 0
	[0063.773] lstrlenA (lpString="*.jpg") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.jpeg") returned 0
	[0063.773] lstrlenA (lpString="*.jpeg") returned 6
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.psd") returned 0
	[0063.773] lstrlenA (lpString="*.psd") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.cdr") returned 0
	[0063.773] lstrlenA (lpString="*.cdr") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.dwg") returned 0
	[0063.773] lstrlenA (lpString="*.dwg") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.max") returned 0
	[0063.773] lstrlenA (lpString="*.max") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.bmp") returned 0
	[0063.773] lstrlenA (lpString="*.bmp") returned 5
	[0063.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.gif") returned 1
	[0063.773] lstrlenA (lpString="*.gif") returned 5
	[0063.773] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif"
	[0063.773] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif"
	[0063.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif."
	[0063.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.Boom"
	[0063.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.774] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3
	[0063.774] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.774] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.774] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7db0, lpOverlapped=0x0) returned 1
	[0063.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="bg_Country.gif"
	[0063.776] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.776] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7db0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7db0, lpOverlapped=0x0) returned 1
	[0063.776] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.776] CloseHandle (hObject=0x98) returned 1
	[0063.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.boom")) returned 1
	[0063.777] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.777] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Earthy.gif") returned 1
	[0063.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1
	[0063.777] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1
	[0063.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="bg_Country.gif"
	[0063.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif"
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.zip") returned 0
	[0063.777] lstrlenA (lpString="*.zip") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.rar") returned 0
	[0063.777] lstrlenA (lpString="*.rar") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.7z") returned 0
	[0063.777] lstrlenA (lpString="*.7z") returned 4
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.tar") returned 0
	[0063.777] lstrlenA (lpString="*.tar") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.gzip") returned 0
	[0063.777] lstrlenA (lpString="*.gzip") returned 6
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.jpg") returned 0
	[0063.777] lstrlenA (lpString="*.jpg") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0
	[0063.777] lstrlenA (lpString="*.jpeg") returned 6
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.psd") returned 0
	[0063.777] lstrlenA (lpString="*.psd") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.cdr") returned 0
	[0063.777] lstrlenA (lpString="*.cdr") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.dwg") returned 0
	[0063.777] lstrlenA (lpString="*.dwg") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.max") returned 0
	[0063.777] lstrlenA (lpString="*.max") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.bmp") returned 0
	[0063.777] lstrlenA (lpString="*.bmp") returned 5
	[0063.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.gif") returned 1
	[0063.777] lstrlenA (lpString="*.gif") returned 5
	[0063.777] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif"
	[0063.777] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif"
	[0063.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif."
	[0063.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.Boom"
	[0063.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.778] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a
	[0063.778] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.778] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.778] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1307, lpOverlapped=0x0) returned 1
	[0063.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="bg_Earthy.gif"
	[0063.780] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.780] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1307, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1307, lpOverlapped=0x0) returned 1
	[0063.780] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.780] CloseHandle (hObject=0x98) returned 1
	[0063.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.boom")) returned 1
	[0063.780] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.780] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePage.gif") returned 1
	[0063.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1
	[0063.780] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1
	[0063.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="bg_Earthy.gif"
	[0063.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif"
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0
	[0063.781] lstrlenA (lpString="*.zip") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0
	[0063.781] lstrlenA (lpString="*.rar") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0
	[0063.781] lstrlenA (lpString="*.7z") returned 4
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0
	[0063.781] lstrlenA (lpString="*.tar") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0
	[0063.781] lstrlenA (lpString="*.gzip") returned 6
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0
	[0063.781] lstrlenA (lpString="*.jpg") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0
	[0063.781] lstrlenA (lpString="*.jpeg") returned 6
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0
	[0063.781] lstrlenA (lpString="*.psd") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.cdr") returned 0
	[0063.781] lstrlenA (lpString="*.cdr") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.dwg") returned 0
	[0063.781] lstrlenA (lpString="*.dwg") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.max") returned 0
	[0063.781] lstrlenA (lpString="*.max") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.bmp") returned 0
	[0063.781] lstrlenA (lpString="*.bmp") returned 5
	[0063.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1
	[0063.781] lstrlenA (lpString="*.gif") returned 5
	[0063.781] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif"
	[0063.781] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif"
	[0063.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif."
	[0063.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.Boom"
	[0063.781] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.782] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167bd
	[0063.782] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.782] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.782] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1679a, lpOverlapped=0x0) returned 1
	[0063.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif"
	[0063.786] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.786] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1679a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1679a, lpOverlapped=0x0) returned 1
	[0063.787] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.787] CloseHandle (hObject=0x98) returned 1
	[0063.787] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.boom")) returned 1
	[0063.788] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.788] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.788] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageBlank.gif") returned 1
	[0063.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1
	[0063.788] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1
	[0063.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif"
	[0063.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif"
	[0063.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0
	[0063.788] lstrlenA (lpString="*.zip") returned 5
	[0063.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0
	[0063.788] lstrlenA (lpString="*.rar") returned 5
	[0063.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0
	[0063.788] lstrlenA (lpString="*.7z") returned 4
	[0063.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0
	[0063.788] lstrlenA (lpString="*.tar") returned 5
	[0063.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0
	[0063.788] lstrlenA (lpString="*.gzip") returned 6
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0
	[0063.789] lstrlenA (lpString="*.jpg") returned 5
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0
	[0063.789] lstrlenA (lpString="*.jpeg") returned 6
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0
	[0063.789] lstrlenA (lpString="*.psd") returned 5
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.cdr") returned 0
	[0063.789] lstrlenA (lpString="*.cdr") returned 5
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.dwg") returned 0
	[0063.789] lstrlenA (lpString="*.dwg") returned 5
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.max") returned 0
	[0063.789] lstrlenA (lpString="*.max") returned 5
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.bmp") returned 0
	[0063.789] lstrlenA (lpString="*.bmp") returned 5
	[0063.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1
	[0063.789] lstrlenA (lpString="*.gif") returned 5
	[0063.789] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif"
	[0063.789] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif"
	[0063.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif."
	[0063.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.Boom"
	[0063.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.790] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb
	[0063.790] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.790] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.790] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4e98, lpOverlapped=0x0) returned 1
	[0063.794] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif"
	[0063.794] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.794] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4e98, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4e98, lpOverlapped=0x0) returned 1
	[0063.794] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.794] CloseHandle (hObject=0x98) returned 1
	[0063.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.boom")) returned 1
	[0063.795] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.795] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.795] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageSlice.gif") returned 1
	[0063.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1
	[0063.795] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageSlice.gif") returned -1
	[0063.795] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif"
	[0063.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.795] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif"
	[0063.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.zip") returned 0
	[0063.795] lstrlenA (lpString="*.zip") returned 5
	[0063.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.rar") returned 0
	[0063.795] lstrlenA (lpString="*.rar") returned 5
	[0063.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.7z") returned 0
	[0063.795] lstrlenA (lpString="*.7z") returned 4
	[0063.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.tar") returned 0
	[0063.795] lstrlenA (lpString="*.tar") returned 5
	[0063.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.gzip") returned 0
	[0063.795] lstrlenA (lpString="*.gzip") returned 6
	[0063.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.jpg") returned 0
	[0063.795] lstrlenA (lpString="*.jpg") returned 5
	[0063.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.jpeg") returned 0
	[0063.796] lstrlenA (lpString="*.jpeg") returned 6
	[0063.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.psd") returned 0
	[0063.796] lstrlenA (lpString="*.psd") returned 5
	[0063.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.cdr") returned 0
	[0063.796] lstrlenA (lpString="*.cdr") returned 5
	[0063.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.dwg") returned 0
	[0063.796] lstrlenA (lpString="*.dwg") returned 5
	[0063.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.max") returned 0
	[0063.796] lstrlenA (lpString="*.max") returned 5
	[0063.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.bmp") returned 0
	[0063.796] lstrlenA (lpString="*.bmp") returned 5
	[0063.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.gif") returned 1
	[0063.796] lstrlenA (lpString="*.gif") returned 5
	[0063.796] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif"
	[0063.796] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif"
	[0063.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif."
	[0063.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.Boom"
	[0063.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.796] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f
	[0063.796] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.796] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.797] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3ec, lpOverlapped=0x0) returned 1
	[0063.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif"
	[0063.798] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.798] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3ec, lpOverlapped=0x0) returned 1
	[0063.798] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.798] CloseHandle (hObject=0x98) returned 1
	[0063.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.boom")) returned 1
	[0063.799] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.799] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_GreenTea.gif") returned 1
	[0063.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1
	[0063.799] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1
	[0063.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif"
	[0063.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif"
	[0063.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.zip") returned 0
	[0063.799] lstrlenA (lpString="*.zip") returned 5
	[0063.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.rar") returned 0
	[0063.799] lstrlenA (lpString="*.rar") returned 5
	[0063.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.7z") returned 0
	[0063.799] lstrlenA (lpString="*.7z") returned 4
	[0063.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.tar") returned 0
	[0063.799] lstrlenA (lpString="*.tar") returned 5
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0
	[0063.800] lstrlenA (lpString="*.gzip") returned 6
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0
	[0063.800] lstrlenA (lpString="*.jpg") returned 5
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0
	[0063.800] lstrlenA (lpString="*.jpeg") returned 6
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.psd") returned 0
	[0063.800] lstrlenA (lpString="*.psd") returned 5
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.cdr") returned 0
	[0063.800] lstrlenA (lpString="*.cdr") returned 5
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.dwg") returned 0
	[0063.800] lstrlenA (lpString="*.dwg") returned 5
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.max") returned 0
	[0063.800] lstrlenA (lpString="*.max") returned 5
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.bmp") returned 0
	[0063.800] lstrlenA (lpString="*.bmp") returned 5
	[0063.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.gif") returned 1
	[0063.800] lstrlenA (lpString="*.gif") returned 5
	[0063.800] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif"
	[0063.800] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif"
	[0063.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif."
	[0063.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.Boom"
	[0063.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.801] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690
	[0063.801] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.801] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.801] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x566d, lpOverlapped=0x0) returned 1
	[0063.812] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="bg_GreenTea.gif"
	[0063.812] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.812] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x566d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x566d, lpOverlapped=0x0) returned 1
	[0063.812] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.812] CloseHandle (hObject=0x98) returned 1
	[0063.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.boom")) returned 1
	[0063.813] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.813] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.813] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Groove.gif") returned 1
	[0063.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1
	[0063.813] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1
	[0063.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="bg_GreenTea.gif"
	[0063.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.813] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif"
	[0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.zip") returned 0
	[0063.813] lstrlenA (lpString="*.zip") returned 5
	[0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.rar") returned 0
	[0063.813] lstrlenA (lpString="*.rar") returned 5
	[0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.7z") returned 0
	[0063.813] lstrlenA (lpString="*.7z") returned 4
	[0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.tar") returned 0
	[0063.813] lstrlenA (lpString="*.tar") returned 5
	[0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.gzip") returned 0
	[0063.813] lstrlenA (lpString="*.gzip") returned 6
	[0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.jpg") returned 0
	[0063.813] lstrlenA (lpString="*.jpg") returned 5
	[0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.jpeg") returned 0
	[0063.814] lstrlenA (lpString="*.jpeg") returned 6
	[0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.psd") returned 0
	[0063.814] lstrlenA (lpString="*.psd") returned 5
	[0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.cdr") returned 0
	[0063.814] lstrlenA (lpString="*.cdr") returned 5
	[0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.dwg") returned 0
	[0063.814] lstrlenA (lpString="*.dwg") returned 5
	[0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.max") returned 0
	[0063.814] lstrlenA (lpString="*.max") returned 5
	[0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.bmp") returned 0
	[0063.814] lstrlenA (lpString="*.bmp") returned 5
	[0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.gif") returned 1
	[0063.814] lstrlenA (lpString="*.gif") returned 5
	[0063.814] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif"
	[0063.814] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif"
	[0063.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif."
	[0063.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.Boom"
	[0063.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.814] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a
	[0063.814] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.814] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.814] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x47, lpOverlapped=0x0) returned 1
	[0063.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="bg_Groove.gif"
	[0063.815] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.815] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x47, lpOverlapped=0x0) returned 1
	[0063.815] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.815] CloseHandle (hObject=0x98) returned 1
	[0063.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.boom")) returned 1
	[0063.816] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.816] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.816] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_LightSpirit.gif") returned 1
	[0063.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1
	[0063.816] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1
	[0063.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="bg_Groove.gif"
	[0063.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif"
	[0063.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0
	[0063.816] lstrlenA (lpString="*.zip") returned 5
	[0063.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0
	[0063.816] lstrlenA (lpString="*.rar") returned 5
	[0063.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0
	[0063.816] lstrlenA (lpString="*.7z") returned 4
	[0063.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0
	[0063.816] lstrlenA (lpString="*.tar") returned 5
	[0063.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0
	[0063.816] lstrlenA (lpString="*.gzip") returned 6
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0
	[0063.817] lstrlenA (lpString="*.jpg") returned 5
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0
	[0063.817] lstrlenA (lpString="*.jpeg") returned 6
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0
	[0063.817] lstrlenA (lpString="*.psd") returned 5
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.cdr") returned 0
	[0063.817] lstrlenA (lpString="*.cdr") returned 5
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.dwg") returned 0
	[0063.817] lstrlenA (lpString="*.dwg") returned 5
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.max") returned 0
	[0063.817] lstrlenA (lpString="*.max") returned 5
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.bmp") returned 0
	[0063.817] lstrlenA (lpString="*.bmp") returned 5
	[0063.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1
	[0063.817] lstrlenA (lpString="*.gif") returned 5
	[0063.817] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif"
	[0063.817] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif"
	[0063.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif."
	[0063.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.Boom"
	[0063.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.817] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6
	[0063.817] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.817] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.817] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2183, lpOverlapped=0x0) returned 1
	[0063.819] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif"
	[0063.819] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.819] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2183, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2183, lpOverlapped=0x0) returned 1
	[0063.819] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.819] CloseHandle (hObject=0x98) returned 1
	[0063.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.boom")) returned 1
	[0063.820] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.820] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.820] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_OliveGreen.gif") returned 1
	[0063.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1
	[0063.820] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1
	[0063.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif"
	[0063.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif"
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0
	[0063.820] lstrlenA (lpString="*.zip") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0
	[0063.820] lstrlenA (lpString="*.rar") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0
	[0063.820] lstrlenA (lpString="*.7z") returned 4
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0
	[0063.820] lstrlenA (lpString="*.tar") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0
	[0063.820] lstrlenA (lpString="*.gzip") returned 6
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0
	[0063.820] lstrlenA (lpString="*.jpg") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0
	[0063.820] lstrlenA (lpString="*.jpeg") returned 6
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0
	[0063.820] lstrlenA (lpString="*.psd") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.cdr") returned 0
	[0063.820] lstrlenA (lpString="*.cdr") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.dwg") returned 0
	[0063.820] lstrlenA (lpString="*.dwg") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.max") returned 0
	[0063.820] lstrlenA (lpString="*.max") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.bmp") returned 0
	[0063.820] lstrlenA (lpString="*.bmp") returned 5
	[0063.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1
	[0063.820] lstrlenA (lpString="*.gif") returned 5
	[0063.820] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif"
	[0063.821] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif"
	[0063.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif."
	[0063.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.Boom"
	[0063.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.821] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57
	[0063.821] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.821] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.821] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3d34, lpOverlapped=0x0) returned 1
	[0063.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif"
	[0063.823] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.823] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3d34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3d34, lpOverlapped=0x0) returned 1
	[0063.823] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.823] CloseHandle (hObject=0x98) returned 1
	[0063.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.boom")) returned 1
	[0063.824] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.824] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.824] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Premium.gif") returned 1
	[0063.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1
	[0063.824] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1
	[0063.824] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif"
	[0063.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.824] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif"
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.zip") returned 0
	[0063.824] lstrlenA (lpString="*.zip") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.rar") returned 0
	[0063.824] lstrlenA (lpString="*.rar") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.7z") returned 0
	[0063.824] lstrlenA (lpString="*.7z") returned 4
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.tar") returned 0
	[0063.824] lstrlenA (lpString="*.tar") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.gzip") returned 0
	[0063.824] lstrlenA (lpString="*.gzip") returned 6
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.jpg") returned 0
	[0063.824] lstrlenA (lpString="*.jpg") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.jpeg") returned 0
	[0063.824] lstrlenA (lpString="*.jpeg") returned 6
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.psd") returned 0
	[0063.824] lstrlenA (lpString="*.psd") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.cdr") returned 0
	[0063.824] lstrlenA (lpString="*.cdr") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.dwg") returned 0
	[0063.824] lstrlenA (lpString="*.dwg") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.max") returned 0
	[0063.824] lstrlenA (lpString="*.max") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.bmp") returned 0
	[0063.824] lstrlenA (lpString="*.bmp") returned 5
	[0063.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.gif") returned 1
	[0063.824] lstrlenA (lpString="*.gif") returned 5
	[0063.824] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif"
	[0063.824] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif"
	[0063.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif."
	[0063.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.Boom"
	[0063.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.825] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845
	[0063.825] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.825] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.825] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1822, lpOverlapped=0x0) returned 1
	[0063.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="bg_Premium.gif"
	[0063.826] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.826] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1822, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1822, lpOverlapped=0x0) returned 1
	[0063.826] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.826] CloseHandle (hObject=0x98) returned 1
	[0063.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.boom")) returned 1
	[0063.827] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.827] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.827] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_SlateBlue.gif") returned 1
	[0063.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1
	[0063.827] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1
	[0063.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="bg_Premium.gif"
	[0063.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif"
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0
	[0063.827] lstrlenA (lpString="*.zip") returned 5
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0
	[0063.827] lstrlenA (lpString="*.rar") returned 5
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0
	[0063.827] lstrlenA (lpString="*.7z") returned 4
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0
	[0063.827] lstrlenA (lpString="*.tar") returned 5
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0
	[0063.827] lstrlenA (lpString="*.gzip") returned 6
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0
	[0063.827] lstrlenA (lpString="*.jpg") returned 5
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0
	[0063.827] lstrlenA (lpString="*.jpeg") returned 6
	[0063.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0
	[0063.828] lstrlenA (lpString="*.psd") returned 5
	[0063.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.cdr") returned 0
	[0063.828] lstrlenA (lpString="*.cdr") returned 5
	[0063.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.dwg") returned 0
	[0063.828] lstrlenA (lpString="*.dwg") returned 5
	[0063.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.max") returned 0
	[0063.828] lstrlenA (lpString="*.max") returned 5
	[0063.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.bmp") returned 0
	[0063.828] lstrlenA (lpString="*.bmp") returned 5
	[0063.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1
	[0063.828] lstrlenA (lpString="*.gif") returned 5
	[0063.828] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif"
	[0063.828] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif"
	[0063.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif."
	[0063.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.Boom"
	[0063.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.828] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141
	[0063.828] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.828] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.828] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x511e, lpOverlapped=0x0) returned 1
	[0063.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif"
	[0063.830] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.830] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x511e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x511e, lpOverlapped=0x0) returned 1
	[0063.830] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.830] CloseHandle (hObject=0x98) returned 1
	[0063.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.boom")) returned 1
	[0063.831] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.831] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.831] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_TexturedBlue.gif") returned 1
	[0063.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1
	[0063.831] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1
	[0063.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif"
	[0063.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.831] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif"
	[0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0
	[0063.831] lstrlenA (lpString="*.zip") returned 5
	[0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0
	[0063.831] lstrlenA (lpString="*.rar") returned 5
	[0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0
	[0063.831] lstrlenA (lpString="*.7z") returned 4
	[0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0
	[0063.831] lstrlenA (lpString="*.tar") returned 5
	[0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0
	[0063.831] lstrlenA (lpString="*.gzip") returned 6
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0
	[0063.832] lstrlenA (lpString="*.jpg") returned 5
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0
	[0063.832] lstrlenA (lpString="*.jpeg") returned 6
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0
	[0063.832] lstrlenA (lpString="*.psd") returned 5
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.cdr") returned 0
	[0063.832] lstrlenA (lpString="*.cdr") returned 5
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.dwg") returned 0
	[0063.832] lstrlenA (lpString="*.dwg") returned 5
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.max") returned 0
	[0063.832] lstrlenA (lpString="*.max") returned 5
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.bmp") returned 0
	[0063.832] lstrlenA (lpString="*.bmp") returned 5
	[0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1
	[0063.832] lstrlenA (lpString="*.gif") returned 5
	[0063.832] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif"
	[0063.832] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif"
	[0063.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif."
	[0063.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.Boom"
	[0063.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.832] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c
	[0063.832] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.832] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.832] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1919, lpOverlapped=0x0) returned 1
	[0063.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif"
	[0063.841] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.841] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1919, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1919, lpOverlapped=0x0) returned 1
	[0063.841] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.841] CloseHandle (hObject=0x98) returned 1
	[0063.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.boom")) returned 1
	[0063.842] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.842] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_VelvetRose.gif") returned 1
	[0063.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1
	[0063.842] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1
	[0063.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif"
	[0063.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif"
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0
	[0063.842] lstrlenA (lpString="*.zip") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0
	[0063.842] lstrlenA (lpString="*.rar") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0
	[0063.842] lstrlenA (lpString="*.7z") returned 4
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0
	[0063.842] lstrlenA (lpString="*.tar") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0
	[0063.842] lstrlenA (lpString="*.gzip") returned 6
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0
	[0063.842] lstrlenA (lpString="*.jpg") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0
	[0063.842] lstrlenA (lpString="*.jpeg") returned 6
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0
	[0063.842] lstrlenA (lpString="*.psd") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.cdr") returned 0
	[0063.842] lstrlenA (lpString="*.cdr") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.dwg") returned 0
	[0063.842] lstrlenA (lpString="*.dwg") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.max") returned 0
	[0063.842] lstrlenA (lpString="*.max") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.bmp") returned 0
	[0063.842] lstrlenA (lpString="*.bmp") returned 5
	[0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1
	[0063.842] lstrlenA (lpString="*.gif") returned 5
	[0063.843] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif"
	[0063.843] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif"
	[0063.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif."
	[0063.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.Boom"
	[0063.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.844] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64
	[0063.844] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.844] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.844] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3c41, lpOverlapped=0x0) returned 1
	[0063.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif"
	[0063.846] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.846] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3c41, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3c41, lpOverlapped=0x0) returned 1
	[0063.846] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.846] CloseHandle (hObject=0x98) returned 1
	[0063.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.boom")) returned 1
	[0063.847] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.847] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.847] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left.gif") returned 1
	[0063.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1
	[0063.847] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1
	[0063.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif"
	[0063.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif"
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.zip") returned 0
	[0063.847] lstrlenA (lpString="*.zip") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.rar") returned 0
	[0063.847] lstrlenA (lpString="*.rar") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.7z") returned 0
	[0063.847] lstrlenA (lpString="*.7z") returned 4
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.tar") returned 0
	[0063.847] lstrlenA (lpString="*.tar") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.gzip") returned 0
	[0063.847] lstrlenA (lpString="*.gzip") returned 6
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.jpg") returned 0
	[0063.847] lstrlenA (lpString="*.jpg") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.jpeg") returned 0
	[0063.847] lstrlenA (lpString="*.jpeg") returned 6
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.psd") returned 0
	[0063.847] lstrlenA (lpString="*.psd") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.cdr") returned 0
	[0063.847] lstrlenA (lpString="*.cdr") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.dwg") returned 0
	[0063.847] lstrlenA (lpString="*.dwg") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.max") returned 0
	[0063.847] lstrlenA (lpString="*.max") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.bmp") returned 0
	[0063.847] lstrlenA (lpString="*.bmp") returned 5
	[0063.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.gif") returned 1
	[0063.847] lstrlenA (lpString="*.gif") returned 5
	[0063.848] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif"
	[0063.848] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif"
	[0063.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif."
	[0063.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.Boom"
	[0063.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.848] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171
	[0063.848] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.848] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.848] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14e, lpOverlapped=0x0) returned 1
	[0063.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="button_left.gif"
	[0063.849] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.849] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14e, lpOverlapped=0x0) returned 1
	[0063.849] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.849] CloseHandle (hObject=0x98) returned 1
	[0063.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.boom")) returned 1
	[0063.849] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.849] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.850] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_over.gif") returned 1
	[0063.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1
	[0063.850] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1
	[0063.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="button_left.gif"
	[0063.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif"
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.zip") returned 0
	[0063.850] lstrlenA (lpString="*.zip") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.rar") returned 0
	[0063.850] lstrlenA (lpString="*.rar") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.7z") returned 0
	[0063.850] lstrlenA (lpString="*.7z") returned 4
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.tar") returned 0
	[0063.850] lstrlenA (lpString="*.tar") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.gzip") returned 0
	[0063.850] lstrlenA (lpString="*.gzip") returned 6
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.jpg") returned 0
	[0063.850] lstrlenA (lpString="*.jpg") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.jpeg") returned 0
	[0063.850] lstrlenA (lpString="*.jpeg") returned 6
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.psd") returned 0
	[0063.850] lstrlenA (lpString="*.psd") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.cdr") returned 0
	[0063.850] lstrlenA (lpString="*.cdr") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.dwg") returned 0
	[0063.850] lstrlenA (lpString="*.dwg") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.max") returned 0
	[0063.850] lstrlenA (lpString="*.max") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.bmp") returned 0
	[0063.850] lstrlenA (lpString="*.bmp") returned 5
	[0063.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.gif") returned 1
	[0063.850] lstrlenA (lpString="*.gif") returned 5
	[0063.850] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif"
	[0063.850] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif"
	[0063.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif."
	[0063.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.Boom"
	[0063.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.851] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176
	[0063.851] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.851] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.851] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x153, lpOverlapped=0x0) returned 1
	[0063.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="button_left_over.gif"
	[0063.852] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.852] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x153, lpOverlapped=0x0) returned 1
	[0063.852] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.852] CloseHandle (hObject=0x98) returned 1
	[0063.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.boom")) returned 1
	[0063.853] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.853] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.853] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid.gif") returned 1
	[0063.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1
	[0063.853] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1
	[0063.853] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="button_left_over.gif"
	[0063.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.853] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif"
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.zip") returned 0
	[0063.853] lstrlenA (lpString="*.zip") returned 5
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.rar") returned 0
	[0063.853] lstrlenA (lpString="*.rar") returned 5
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.7z") returned 0
	[0063.853] lstrlenA (lpString="*.7z") returned 4
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.tar") returned 0
	[0063.853] lstrlenA (lpString="*.tar") returned 5
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.gzip") returned 0
	[0063.853] lstrlenA (lpString="*.gzip") returned 6
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.jpg") returned 0
	[0063.853] lstrlenA (lpString="*.jpg") returned 5
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.jpeg") returned 0
	[0063.853] lstrlenA (lpString="*.jpeg") returned 6
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.psd") returned 0
	[0063.853] lstrlenA (lpString="*.psd") returned 5
	[0063.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.cdr") returned 0
	[0063.854] lstrlenA (lpString="*.cdr") returned 5
	[0063.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.dwg") returned 0
	[0063.854] lstrlenA (lpString="*.dwg") returned 5
	[0063.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.max") returned 0
	[0063.854] lstrlenA (lpString="*.max") returned 5
	[0063.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.bmp") returned 0
	[0063.854] lstrlenA (lpString="*.bmp") returned 5
	[0063.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.gif") returned 1
	[0063.854] lstrlenA (lpString="*.gif") returned 5
	[0063.854] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif"
	[0063.854] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif"
	[0063.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif."
	[0063.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.Boom"
	[0063.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.854] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5
	[0063.854] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.854] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.855] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x92, lpOverlapped=0x0) returned 1
	[0063.855] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="button_mid.gif"
	[0063.855] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.855] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x92, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x92, lpOverlapped=0x0) returned 1
	[0063.856] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.856] CloseHandle (hObject=0x98) returned 1
	[0063.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.boom")) returned 1
	[0063.856] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.856] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.856] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_over.gif") returned 1
	[0063.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1
	[0063.856] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1
	[0063.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="button_mid.gif"
	[0063.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif"
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.zip") returned 0
	[0063.857] lstrlenA (lpString="*.zip") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.rar") returned 0
	[0063.857] lstrlenA (lpString="*.rar") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.7z") returned 0
	[0063.857] lstrlenA (lpString="*.7z") returned 4
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.tar") returned 0
	[0063.857] lstrlenA (lpString="*.tar") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.gzip") returned 0
	[0063.857] lstrlenA (lpString="*.gzip") returned 6
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.jpg") returned 0
	[0063.857] lstrlenA (lpString="*.jpg") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.jpeg") returned 0
	[0063.857] lstrlenA (lpString="*.jpeg") returned 6
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.psd") returned 0
	[0063.857] lstrlenA (lpString="*.psd") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.cdr") returned 0
	[0063.857] lstrlenA (lpString="*.cdr") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.dwg") returned 0
	[0063.857] lstrlenA (lpString="*.dwg") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.max") returned 0
	[0063.857] lstrlenA (lpString="*.max") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.bmp") returned 0
	[0063.857] lstrlenA (lpString="*.bmp") returned 5
	[0063.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.gif") returned 1
	[0063.858] lstrlenA (lpString="*.gif") returned 5
	[0063.858] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif"
	[0063.858] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif"
	[0063.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif."
	[0063.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.Boom"
	[0063.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.859] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7
	[0063.859] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.859] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.859] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x94, lpOverlapped=0x0) returned 1
	[0063.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="button_mid_over.gif"
	[0063.860] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.860] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x94, lpOverlapped=0x0) returned 1
	[0063.860] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.860] CloseHandle (hObject=0x98) returned 1
	[0063.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.boom")) returned 1
	[0063.861] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.861] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.861] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right.gif") returned 1
	[0063.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1
	[0063.861] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1
	[0063.861] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="button_mid_over.gif"
	[0063.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.861] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.861] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif"
	[0063.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.zip") returned 0
	[0063.861] lstrlenA (lpString="*.zip") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.rar") returned 0
	[0063.862] lstrlenA (lpString="*.rar") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.7z") returned 0
	[0063.862] lstrlenA (lpString="*.7z") returned 4
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.tar") returned 0
	[0063.862] lstrlenA (lpString="*.tar") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.gzip") returned 0
	[0063.862] lstrlenA (lpString="*.gzip") returned 6
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.jpg") returned 0
	[0063.862] lstrlenA (lpString="*.jpg") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.jpeg") returned 0
	[0063.862] lstrlenA (lpString="*.jpeg") returned 6
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.psd") returned 0
	[0063.862] lstrlenA (lpString="*.psd") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.cdr") returned 0
	[0063.862] lstrlenA (lpString="*.cdr") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.dwg") returned 0
	[0063.862] lstrlenA (lpString="*.dwg") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.max") returned 0
	[0063.862] lstrlenA (lpString="*.max") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.bmp") returned 0
	[0063.862] lstrlenA (lpString="*.bmp") returned 5
	[0063.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.gif") returned 1
	[0063.863] lstrlenA (lpString="*.gif") returned 5
	[0063.863] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif"
	[0063.863] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif"
	[0063.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif."
	[0063.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.Boom"
	[0063.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.863] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171
	[0063.863] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.863] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.863] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14e, lpOverlapped=0x0) returned 1
	[0063.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="button_right.gif"
	[0063.864] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.864] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14e, lpOverlapped=0x0) returned 1
	[0063.864] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.864] CloseHandle (hObject=0x98) returned 1
	[0063.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.boom")) returned 1
	[0063.865] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.865] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_over.gif") returned 1
	[0063.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1
	[0063.866] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1
	[0063.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="button_right.gif"
	[0063.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.866] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.866] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif"
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.zip") returned 0
	[0063.866] lstrlenA (lpString="*.zip") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.rar") returned 0
	[0063.866] lstrlenA (lpString="*.rar") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.7z") returned 0
	[0063.866] lstrlenA (lpString="*.7z") returned 4
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.tar") returned 0
	[0063.866] lstrlenA (lpString="*.tar") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.gzip") returned 0
	[0063.866] lstrlenA (lpString="*.gzip") returned 6
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.jpg") returned 0
	[0063.866] lstrlenA (lpString="*.jpg") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.jpeg") returned 0
	[0063.866] lstrlenA (lpString="*.jpeg") returned 6
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.psd") returned 0
	[0063.866] lstrlenA (lpString="*.psd") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.cdr") returned 0
	[0063.866] lstrlenA (lpString="*.cdr") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.dwg") returned 0
	[0063.866] lstrlenA (lpString="*.dwg") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.max") returned 0
	[0063.866] lstrlenA (lpString="*.max") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.bmp") returned 0
	[0063.866] lstrlenA (lpString="*.bmp") returned 5
	[0063.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.gif") returned 1
	[0063.866] lstrlenA (lpString="*.gif") returned 5
	[0063.866] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif"
	[0063.866] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif"
	[0063.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif."
	[0063.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.Boom"
	[0063.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.867] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244
	[0063.867] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.867] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.867] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x221, lpOverlapped=0x0) returned 1
	[0063.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="button_right_over.gif"
	[0063.902] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.902] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x221, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x221, lpOverlapped=0x0) returned 1
	[0063.902] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.902] CloseHandle (hObject=0x98) returned 1
	[0063.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.boom")) returned 1
	[0063.903] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.903] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.903] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.GIF") returned 1
	[0063.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1
	[0063.903] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1
	[0063.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="button_right_over.gif"
	[0063.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF"
	[0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.zip") returned 0
	[0063.903] lstrlenA (lpString="*.zip") returned 5
	[0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.rar") returned 0
	[0063.903] lstrlenA (lpString="*.rar") returned 5
	[0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.7z") returned 0
	[0063.903] lstrlenA (lpString="*.7z") returned 4
	[0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.tar") returned 0
	[0063.903] lstrlenA (lpString="*.tar") returned 5
	[0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.gzip") returned 0
	[0063.904] lstrlenA (lpString="*.gzip") returned 6
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.jpg") returned 0
	[0063.904] lstrlenA (lpString="*.jpg") returned 5
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0
	[0063.904] lstrlenA (lpString="*.jpeg") returned 6
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.psd") returned 0
	[0063.904] lstrlenA (lpString="*.psd") returned 5
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.cdr") returned 0
	[0063.904] lstrlenA (lpString="*.cdr") returned 5
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.dwg") returned 0
	[0063.904] lstrlenA (lpString="*.dwg") returned 5
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.max") returned 0
	[0063.904] lstrlenA (lpString="*.max") returned 5
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.bmp") returned 0
	[0063.904] lstrlenA (lpString="*.bmp") returned 5
	[0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.gif") returned 1
	[0063.904] lstrlenA (lpString="*.gif") returned 5
	[0063.904] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF"
	[0063.904] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF"
	[0063.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF."
	[0063.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.Boom"
	[0063.904] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.904] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383
	[0063.905] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.905] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.905] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x360, lpOverlapped=0x0) returned 1
	[0063.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="CALENDAR.GIF"
	[0063.915] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.916] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1
	[0063.916] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.916] CloseHandle (hObject=0x98) returned 1
	[0063.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif.boom")) returned 1
	[0063.926] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.926] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.926] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELETE.GIF") returned 1
	[0063.926] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1
	[0063.926] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1
	[0063.926] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="CALENDAR.GIF"
	[0063.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF"
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.zip") returned 0
	[0063.926] lstrlenA (lpString="*.zip") returned 5
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.rar") returned 0
	[0063.926] lstrlenA (lpString="*.rar") returned 5
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.7z") returned 0
	[0063.926] lstrlenA (lpString="*.7z") returned 4
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.tar") returned 0
	[0063.926] lstrlenA (lpString="*.tar") returned 5
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.gzip") returned 0
	[0063.926] lstrlenA (lpString="*.gzip") returned 6
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.jpg") returned 0
	[0063.926] lstrlenA (lpString="*.jpg") returned 5
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.jpeg") returned 0
	[0063.926] lstrlenA (lpString="*.jpeg") returned 6
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.psd") returned 0
	[0063.926] lstrlenA (lpString="*.psd") returned 5
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.cdr") returned 0
	[0063.926] lstrlenA (lpString="*.cdr") returned 5
	[0063.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.dwg") returned 0
	[0063.926] lstrlenA (lpString="*.dwg") returned 5
	[0063.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.max") returned 0
	[0063.927] lstrlenA (lpString="*.max") returned 5
	[0063.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.bmp") returned 0
	[0063.927] lstrlenA (lpString="*.bmp") returned 5
	[0063.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.gif") returned 1
	[0063.927] lstrlenA (lpString="*.gif") returned 5
	[0063.927] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF"
	[0063.927] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF"
	[0063.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF."
	[0063.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.Boom"
	[0063.927] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.928] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271
	[0063.928] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1
	[0063.928] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.928] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24e, lpOverlapped=0x0) returned 1
	[0063.929] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="DELETE.GIF"
	[0063.929] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.929] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24e, lpOverlapped=0x0) returned 1
	[0063.929] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.929] CloseHandle (hObject=0x98) returned 1
	[0063.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif.boom")) returned 1
	[0063.930] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.930] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.930] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ERROR.GIF") returned -1
	[0063.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1
	[0063.930] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1
	[0063.930] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="DELETE.GIF"
	[0063.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.930] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF"
	[0063.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.zip") returned 0
	[0063.930] lstrlenA (lpString="*.zip") returned 5
	[0063.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.rar") returned 0
	[0063.930] lstrlenA (lpString="*.rar") returned 5
	[0063.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.7z") returned 0
	[0063.930] lstrlenA (lpString="*.7z") returned 4
	[0063.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.tar") returned 0
	[0063.930] lstrlenA (lpString="*.tar") returned 5
	[0063.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.gzip") returned 0
	[0063.930] lstrlenA (lpString="*.gzip") returned 6
	[0063.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.jpg") returned 0
	[0063.930] lstrlenA (lpString="*.jpg") returned 5
	[0063.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.jpeg") returned 0
	[0063.930] lstrlenA (lpString="*.jpeg") returned 6
	[0063.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.psd") returned 0
	[0063.931] lstrlenA (lpString="*.psd") returned 5
	[0063.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.cdr") returned 0
	[0063.931] lstrlenA (lpString="*.cdr") returned 5
	[0063.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.dwg") returned 0
	[0063.931] lstrlenA (lpString="*.dwg") returned 5
	[0063.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.max") returned 0
	[0063.931] lstrlenA (lpString="*.max") returned 5
	[0063.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.bmp") returned 0
	[0063.931] lstrlenA (lpString="*.bmp") returned 5
	[0063.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.gif") returned 1
	[0063.931] lstrlenA (lpString="*.gif") returned 5
	[0063.931] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF"
	[0063.931] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF"
	[0063.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF."
	[0063.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.Boom"
	[0063.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.932] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369
	[0063.932] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60975c70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1
	[0063.932] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.932] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x346, lpOverlapped=0x0) returned 1
	[0063.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="ERROR.GIF"
	[0063.938] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.938] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x346, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x346, lpOverlapped=0x0) returned 1
	[0063.938] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.938] CloseHandle (hObject=0x98) returned 1
	[0063.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif.boom")) returned 1
	[0063.939] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.939] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.939] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.ICO") returned -1
	[0063.939] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1
	[0063.939] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1
	[0063.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="ERROR.GIF"
	[0063.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.939] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO"
	[0063.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.zip") returned 0
	[0063.939] lstrlenA (lpString="*.zip") returned 5
	[0063.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.rar") returned 0
	[0063.939] lstrlenA (lpString="*.rar") returned 5
	[0063.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.7z") returned 0
	[0063.939] lstrlenA (lpString="*.7z") returned 4
	[0063.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.tar") returned 0
	[0063.939] lstrlenA (lpString="*.tar") returned 5
	[0063.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.gzip") returned 0
	[0063.940] lstrlenA (lpString="*.gzip") returned 6
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.jpg") returned 0
	[0063.940] lstrlenA (lpString="*.jpg") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.jpeg") returned 0
	[0063.940] lstrlenA (lpString="*.jpeg") returned 6
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.psd") returned 0
	[0063.940] lstrlenA (lpString="*.psd") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.cdr") returned 0
	[0063.940] lstrlenA (lpString="*.cdr") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.dwg") returned 0
	[0063.940] lstrlenA (lpString="*.dwg") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.max") returned 0
	[0063.940] lstrlenA (lpString="*.max") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.bmp") returned 0
	[0063.940] lstrlenA (lpString="*.bmp") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.gif") returned 0
	[0063.940] lstrlenA (lpString="*.gif") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.png") returned 0
	[0063.940] lstrlenA (lpString="*.png") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.doc") returned 0
	[0063.940] lstrlenA (lpString="*.doc") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.docx") returned 0
	[0063.940] lstrlenA (lpString="*.docx") returned 6
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.xls") returned 0
	[0063.940] lstrlenA (lpString="*.xls") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.xlsx") returned 0
	[0063.940] lstrlenA (lpString="*.xlsx") returned 6
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ppt") returned 0
	[0063.940] lstrlenA (lpString="*.ppt") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pptx") returned 0
	[0063.940] lstrlenA (lpString="*.pptx") returned 6
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.txt") returned 0
	[0063.940] lstrlenA (lpString="*.txt") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pdf") returned 0
	[0063.940] lstrlenA (lpString="*.pdf") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.djvu") returned 0
	[0063.940] lstrlenA (lpString="*.djvu") returned 6
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.htm") returned 0
	[0063.940] lstrlenA (lpString="*.htm") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.html") returned 0
	[0063.940] lstrlenA (lpString="*.html") returned 6
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mdb") returned 0
	[0063.940] lstrlenA (lpString="*.mdb") returned 5
	[0063.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.cer") returned 0
	[0063.940] lstrlenA (lpString="*.cer") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.p12") returned 0
	[0063.941] lstrlenA (lpString="*.p12") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pfx") returned 0
	[0063.941] lstrlenA (lpString="*.pfx") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.kwm") returned 0
	[0063.941] lstrlenA (lpString="*.kwm") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pwm") returned 0
	[0063.941] lstrlenA (lpString="*.pwm") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.1cd") returned 0
	[0063.941] lstrlenA (lpString="*.1cd") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.md") returned 0
	[0063.941] lstrlenA (lpString="*.md") returned 4
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mdf") returned 0
	[0063.941] lstrlenA (lpString="*.mdf") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.dbf") returned 0
	[0063.941] lstrlenA (lpString="*.dbf") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.odt") returned 0
	[0063.941] lstrlenA (lpString="*.odt") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.vob") returned 0
	[0063.941] lstrlenA (lpString="*.vob") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ifo") returned 0
	[0063.941] lstrlenA (lpString="*.ifo") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.lnk") returned 0
	[0063.941] lstrlenA (lpString="*.lnk") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.torrent") returned 0
	[0063.941] lstrlenA (lpString="*.torrent") returned 9
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mov") returned 0
	[0063.941] lstrlenA (lpString="*.mov") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.m2v") returned 0
	[0063.941] lstrlenA (lpString="*.m2v") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.3gp") returned 0
	[0063.941] lstrlenA (lpString="*.3gp") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mpeg") returned 0
	[0063.941] lstrlenA (lpString="*.mpeg") returned 6
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mpg") returned 0
	[0063.941] lstrlenA (lpString="*.mpg") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.flv") returned 0
	[0063.941] lstrlenA (lpString="*.flv") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.avi") returned 0
	[0063.941] lstrlenA (lpString="*.avi") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mp4") returned 0
	[0063.941] lstrlenA (lpString="*.mp4") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wmv") returned 0
	[0063.941] lstrlenA (lpString="*.wmv") returned 5
	[0063.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.divx") returned 0
	[0063.942] lstrlenA (lpString="*.divx") returned 6
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mkv") returned 0
	[0063.942] lstrlenA (lpString="*.mkv") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mp3") returned 0
	[0063.942] lstrlenA (lpString="*.mp3") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wav") returned 0
	[0063.942] lstrlenA (lpString="*.wav") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.flac") returned 0
	[0063.942] lstrlenA (lpString="*.flac") returned 6
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ape") returned 0
	[0063.942] lstrlenA (lpString="*.ape") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wma") returned 0
	[0063.942] lstrlenA (lpString="*.wma") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ac3") returned 0
	[0063.942] lstrlenA (lpString="*.ac3") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.exe") returned 0
	[0063.942] lstrlenA (lpString="*.exe") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.apk") returned 0
	[0063.942] lstrlenA (lpString="*.apk") returned 5
	[0063.942] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.942] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.942] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.JS") returned -1
	[0063.942] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1
	[0063.942] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1
	[0063.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned="FORM.ICO"
	[0063.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.942] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS"
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.zip") returned 0
	[0063.942] lstrlenA (lpString="*.zip") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.rar") returned 0
	[0063.942] lstrlenA (lpString="*.rar") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.7z") returned 0
	[0063.942] lstrlenA (lpString="*.7z") returned 4
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.tar") returned 0
	[0063.942] lstrlenA (lpString="*.tar") returned 5
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.gzip") returned 0
	[0063.942] lstrlenA (lpString="*.gzip") returned 6
	[0063.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.jpg") returned 0
	[0063.943] lstrlenA (lpString="*.jpg") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.jpeg") returned 0
	[0063.943] lstrlenA (lpString="*.jpeg") returned 6
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.psd") returned 0
	[0063.943] lstrlenA (lpString="*.psd") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.cdr") returned 0
	[0063.943] lstrlenA (lpString="*.cdr") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.dwg") returned 0
	[0063.943] lstrlenA (lpString="*.dwg") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.max") returned 0
	[0063.943] lstrlenA (lpString="*.max") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.bmp") returned 0
	[0063.943] lstrlenA (lpString="*.bmp") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.gif") returned 0
	[0063.943] lstrlenA (lpString="*.gif") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.png") returned 0
	[0063.943] lstrlenA (lpString="*.png") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.doc") returned 0
	[0063.943] lstrlenA (lpString="*.doc") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.docx") returned 0
	[0063.943] lstrlenA (lpString="*.docx") returned 6
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.xls") returned 0
	[0063.943] lstrlenA (lpString="*.xls") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.xlsx") returned 0
	[0063.943] lstrlenA (lpString="*.xlsx") returned 6
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ppt") returned 0
	[0063.943] lstrlenA (lpString="*.ppt") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pptx") returned 0
	[0063.943] lstrlenA (lpString="*.pptx") returned 6
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.txt") returned 0
	[0063.943] lstrlenA (lpString="*.txt") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pdf") returned 0
	[0063.943] lstrlenA (lpString="*.pdf") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.djvu") returned 0
	[0063.943] lstrlenA (lpString="*.djvu") returned 6
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.htm") returned 0
	[0063.943] lstrlenA (lpString="*.htm") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.html") returned 0
	[0063.943] lstrlenA (lpString="*.html") returned 6
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mdb") returned 0
	[0063.943] lstrlenA (lpString="*.mdb") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.cer") returned 0
	[0063.943] lstrlenA (lpString="*.cer") returned 5
	[0063.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.p12") returned 0
	[0063.943] lstrlenA (lpString="*.p12") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pfx") returned 0
	[0063.944] lstrlenA (lpString="*.pfx") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.kwm") returned 0
	[0063.944] lstrlenA (lpString="*.kwm") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pwm") returned 0
	[0063.944] lstrlenA (lpString="*.pwm") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.1cd") returned 0
	[0063.944] lstrlenA (lpString="*.1cd") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.md") returned 0
	[0063.944] lstrlenA (lpString="*.md") returned 4
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mdf") returned 0
	[0063.944] lstrlenA (lpString="*.mdf") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.dbf") returned 0
	[0063.944] lstrlenA (lpString="*.dbf") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.odt") returned 0
	[0063.944] lstrlenA (lpString="*.odt") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.vob") returned 0
	[0063.944] lstrlenA (lpString="*.vob") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ifo") returned 0
	[0063.944] lstrlenA (lpString="*.ifo") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.lnk") returned 0
	[0063.944] lstrlenA (lpString="*.lnk") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.torrent") returned 0
	[0063.944] lstrlenA (lpString="*.torrent") returned 9
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mov") returned 0
	[0063.944] lstrlenA (lpString="*.mov") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.m2v") returned 0
	[0063.944] lstrlenA (lpString="*.m2v") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.3gp") returned 0
	[0063.944] lstrlenA (lpString="*.3gp") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mpeg") returned 0
	[0063.944] lstrlenA (lpString="*.mpeg") returned 6
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mpg") returned 0
	[0063.944] lstrlenA (lpString="*.mpg") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.flv") returned 0
	[0063.944] lstrlenA (lpString="*.flv") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.avi") returned 0
	[0063.944] lstrlenA (lpString="*.avi") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mp4") returned 0
	[0063.944] lstrlenA (lpString="*.mp4") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wmv") returned 0
	[0063.944] lstrlenA (lpString="*.wmv") returned 5
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.divx") returned 0
	[0063.944] lstrlenA (lpString="*.divx") returned 6
	[0063.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mkv") returned 0
	[0063.944] lstrlenA (lpString="*.mkv") returned 5
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mp3") returned 0
	[0063.945] lstrlenA (lpString="*.mp3") returned 5
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wav") returned 0
	[0063.945] lstrlenA (lpString="*.wav") returned 5
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.flac") returned 0
	[0063.945] lstrlenA (lpString="*.flac") returned 6
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ape") returned 0
	[0063.945] lstrlenA (lpString="*.ape") returned 5
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wma") returned 0
	[0063.945] lstrlenA (lpString="*.wma") returned 5
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ac3") returned 0
	[0063.945] lstrlenA (lpString="*.ac3") returned 5
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.exe") returned 0
	[0063.945] lstrlenA (lpString="*.exe") returned 5
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.apk") returned 0
	[0063.945] lstrlenA (lpString="*.apk") returned 5
	[0063.945] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.945] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.945] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1
	[0063.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1
	[0063.945] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1
	[0063.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned="FORM.JS"
	[0063.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html"
	[0063.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.zip") returned 0
	[0063.946] lstrlenA (lpString="*.zip") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.rar") returned 0
	[0063.946] lstrlenA (lpString="*.rar") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.7z") returned 0
	[0063.946] lstrlenA (lpString="*.7z") returned 4
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.tar") returned 0
	[0063.946] lstrlenA (lpString="*.tar") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.gzip") returned 0
	[0063.946] lstrlenA (lpString="*.gzip") returned 6
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.jpg") returned 0
	[0063.946] lstrlenA (lpString="*.jpg") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0
	[0063.946] lstrlenA (lpString="*.jpeg") returned 6
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.psd") returned 0
	[0063.946] lstrlenA (lpString="*.psd") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.cdr") returned 0
	[0063.946] lstrlenA (lpString="*.cdr") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.dwg") returned 0
	[0063.946] lstrlenA (lpString="*.dwg") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.max") returned 0
	[0063.946] lstrlenA (lpString="*.max") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.bmp") returned 0
	[0063.946] lstrlenA (lpString="*.bmp") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.gif") returned 0
	[0063.946] lstrlenA (lpString="*.gif") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.png") returned 0
	[0063.946] lstrlenA (lpString="*.png") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.doc") returned 0
	[0063.946] lstrlenA (lpString="*.doc") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.docx") returned 0
	[0063.946] lstrlenA (lpString="*.docx") returned 6
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.xls") returned 0
	[0063.946] lstrlenA (lpString="*.xls") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0
	[0063.946] lstrlenA (lpString="*.xlsx") returned 6
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.ppt") returned 0
	[0063.946] lstrlenA (lpString="*.ppt") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.pptx") returned 0
	[0063.946] lstrlenA (lpString="*.pptx") returned 6
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.txt") returned 0
	[0063.946] lstrlenA (lpString="*.txt") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.pdf") returned 0
	[0063.946] lstrlenA (lpString="*.pdf") returned 5
	[0063.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.djvu") returned 0
	[0063.947] lstrlenA (lpString="*.djvu") returned 6
	[0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.htm") returned 0
	[0063.947] lstrlenA (lpString="*.htm") returned 5
	[0063.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.html") returned 1
	[0063.947] lstrlenA (lpString="*.html") returned 6
	[0063.947] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html"
	[0063.947] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html"
	[0063.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html."
	[0063.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.Boom"
	[0063.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.948] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45d
	[0063.948] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1
	[0063.948] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.948] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x43a, lpOverlapped=0x0) returned 1
	[0063.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0063.949] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.949] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x43a, lpOverlapped=0x0) returned 1
	[0063.950] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.950] CloseHandle (hObject=0x98) returned 1
	[0063.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.boom")) returned 1
	[0063.950] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.951] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.951] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1
	[0063.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1
	[0063.951] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1
	[0063.951] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0063.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.951] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html"
	[0063.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0
	[0063.951] lstrlenA (lpString="*.zip") returned 5
	[0063.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0
	[0063.951] lstrlenA (lpString="*.rar") returned 5
	[0063.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0
	[0063.951] lstrlenA (lpString="*.7z") returned 4
	[0063.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0
	[0063.951] lstrlenA (lpString="*.tar") returned 5
	[0063.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0
	[0063.951] lstrlenA (lpString="*.gzip") returned 6
	[0063.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0
	[0063.951] lstrlenA (lpString="*.jpg") returned 5
	[0063.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0
	[0063.952] lstrlenA (lpString="*.jpeg") returned 6
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0
	[0063.952] lstrlenA (lpString="*.psd") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0
	[0063.952] lstrlenA (lpString="*.cdr") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0
	[0063.952] lstrlenA (lpString="*.dwg") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0
	[0063.952] lstrlenA (lpString="*.max") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0
	[0063.952] lstrlenA (lpString="*.bmp") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0
	[0063.952] lstrlenA (lpString="*.gif") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0
	[0063.952] lstrlenA (lpString="*.png") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0
	[0063.952] lstrlenA (lpString="*.doc") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0
	[0063.952] lstrlenA (lpString="*.docx") returned 6
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0
	[0063.952] lstrlenA (lpString="*.xls") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0
	[0063.952] lstrlenA (lpString="*.xlsx") returned 6
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0
	[0063.952] lstrlenA (lpString="*.ppt") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0
	[0063.952] lstrlenA (lpString="*.pptx") returned 6
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0
	[0063.952] lstrlenA (lpString="*.txt") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0
	[0063.952] lstrlenA (lpString="*.pdf") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0
	[0063.952] lstrlenA (lpString="*.djvu") returned 6
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0
	[0063.952] lstrlenA (lpString="*.htm") returned 5
	[0063.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1
	[0063.952] lstrlenA (lpString="*.html") returned 6
	[0063.952] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html"
	[0063.952] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html"
	[0063.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html."
	[0063.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.Boom"
	[0063.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.953] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x850
	[0063.953] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1
	[0063.953] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.953] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x82d, lpOverlapped=0x0) returned 1
	[0063.956] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0063.956] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.956] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x82d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x82d, lpOverlapped=0x0) returned 1
	[0063.956] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.956] CloseHandle (hObject=0x98) returned 1
	[0063.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.boom")) returned 1
	[0063.957] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.957] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.957] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsColorChart.html") returned -1
	[0063.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1
	[0063.957] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1
	[0063.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0063.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.957] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.957] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html"
	[0063.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.zip") returned 0
	[0063.957] lstrlenA (lpString="*.zip") returned 5
	[0063.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.rar") returned 0
	[0063.957] lstrlenA (lpString="*.rar") returned 5
	[0063.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.7z") returned 0
	[0063.957] lstrlenA (lpString="*.7z") returned 4
	[0063.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.tar") returned 0
	[0063.957] lstrlenA (lpString="*.tar") returned 5
	[0063.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.gzip") returned 0
	[0063.957] lstrlenA (lpString="*.gzip") returned 6
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.jpg") returned 0
	[0063.958] lstrlenA (lpString="*.jpg") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.jpeg") returned 0
	[0063.958] lstrlenA (lpString="*.jpeg") returned 6
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.psd") returned 0
	[0063.958] lstrlenA (lpString="*.psd") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.cdr") returned 0
	[0063.958] lstrlenA (lpString="*.cdr") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.dwg") returned 0
	[0063.958] lstrlenA (lpString="*.dwg") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.max") returned 0
	[0063.958] lstrlenA (lpString="*.max") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.bmp") returned 0
	[0063.958] lstrlenA (lpString="*.bmp") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.gif") returned 0
	[0063.958] lstrlenA (lpString="*.gif") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.png") returned 0
	[0063.958] lstrlenA (lpString="*.png") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.doc") returned 0
	[0063.958] lstrlenA (lpString="*.doc") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.docx") returned 0
	[0063.958] lstrlenA (lpString="*.docx") returned 6
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.xls") returned 0
	[0063.958] lstrlenA (lpString="*.xls") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.xlsx") returned 0
	[0063.958] lstrlenA (lpString="*.xlsx") returned 6
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.ppt") returned 0
	[0063.958] lstrlenA (lpString="*.ppt") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.pptx") returned 0
	[0063.958] lstrlenA (lpString="*.pptx") returned 6
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.txt") returned 0
	[0063.958] lstrlenA (lpString="*.txt") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.pdf") returned 0
	[0063.958] lstrlenA (lpString="*.pdf") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.djvu") returned 0
	[0063.958] lstrlenA (lpString="*.djvu") returned 6
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.htm") returned 0
	[0063.958] lstrlenA (lpString="*.htm") returned 5
	[0063.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.html") returned 1
	[0063.958] lstrlenA (lpString="*.html") returned 6
	[0063.958] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html"
	[0063.958] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html"
	[0063.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html."
	[0063.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.Boom"
	[0063.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.959] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed
	[0063.959] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1
	[0063.959] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.959] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2ca, lpOverlapped=0x0) returned 1
	[0063.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="FormsColorChart.html"
	[0063.964] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.964] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2ca, lpOverlapped=0x0) returned 1
	[0063.964] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.965] CloseHandle (hObject=0x98) returned 1
	[0063.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.boom")) returned 1
	[0063.965] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.965] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.965] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplate.html") returned -1
	[0063.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1
	[0063.965] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1
	[0063.965] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="FormsColorChart.html"
	[0063.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.965] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.965] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html"
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.zip") returned 0
	[0063.966] lstrlenA (lpString="*.zip") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.rar") returned 0
	[0063.966] lstrlenA (lpString="*.rar") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.7z") returned 0
	[0063.966] lstrlenA (lpString="*.7z") returned 4
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.tar") returned 0
	[0063.966] lstrlenA (lpString="*.tar") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0
	[0063.966] lstrlenA (lpString="*.gzip") returned 6
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0
	[0063.966] lstrlenA (lpString="*.jpg") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0
	[0063.966] lstrlenA (lpString="*.jpeg") returned 6
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.psd") returned 0
	[0063.966] lstrlenA (lpString="*.psd") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.cdr") returned 0
	[0063.966] lstrlenA (lpString="*.cdr") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.dwg") returned 0
	[0063.966] lstrlenA (lpString="*.dwg") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.max") returned 0
	[0063.966] lstrlenA (lpString="*.max") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.bmp") returned 0
	[0063.966] lstrlenA (lpString="*.bmp") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.gif") returned 0
	[0063.966] lstrlenA (lpString="*.gif") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.png") returned 0
	[0063.966] lstrlenA (lpString="*.png") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.doc") returned 0
	[0063.966] lstrlenA (lpString="*.doc") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.docx") returned 0
	[0063.966] lstrlenA (lpString="*.docx") returned 6
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.xls") returned 0
	[0063.966] lstrlenA (lpString="*.xls") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0
	[0063.966] lstrlenA (lpString="*.xlsx") returned 6
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0
	[0063.966] lstrlenA (lpString="*.ppt") returned 5
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0
	[0063.966] lstrlenA (lpString="*.pptx") returned 6
	[0063.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.txt") returned 0
	[0063.966] lstrlenA (lpString="*.txt") returned 5
	[0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0
	[0063.967] lstrlenA (lpString="*.pdf") returned 5
	[0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.djvu") returned 0
	[0063.967] lstrlenA (lpString="*.djvu") returned 6
	[0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.htm") returned 0
	[0063.967] lstrlenA (lpString="*.htm") returned 5
	[0063.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.html") returned 1
	[0063.967] lstrlenA (lpString="*.html") returned 6
	[0063.967] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html"
	[0063.967] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html"
	[0063.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html."
	[0063.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.Boom"
	[0063.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.967] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc94
	[0063.967] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1
	[0063.967] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.967] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc71, lpOverlapped=0x0) returned 1
	[0063.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="FormsFormTemplate.html"
	[0063.968] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.969] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc71, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc71, lpOverlapped=0x0) returned 1
	[0063.969] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.969] CloseHandle (hObject=0x98) returned 1
	[0063.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.boom")) returned 1
	[0063.969] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.969] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.969] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePage.html") returned -1
	[0063.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1
	[0063.969] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1
	[0063.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="FormsFormTemplate.html"
	[0063.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html"
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.zip") returned 0
	[0063.970] lstrlenA (lpString="*.zip") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.rar") returned 0
	[0063.970] lstrlenA (lpString="*.rar") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.7z") returned 0
	[0063.970] lstrlenA (lpString="*.7z") returned 4
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.tar") returned 0
	[0063.970] lstrlenA (lpString="*.tar") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.gzip") returned 0
	[0063.970] lstrlenA (lpString="*.gzip") returned 6
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.jpg") returned 0
	[0063.970] lstrlenA (lpString="*.jpg") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.jpeg") returned 0
	[0063.970] lstrlenA (lpString="*.jpeg") returned 6
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.psd") returned 0
	[0063.970] lstrlenA (lpString="*.psd") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.cdr") returned 0
	[0063.970] lstrlenA (lpString="*.cdr") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.dwg") returned 0
	[0063.970] lstrlenA (lpString="*.dwg") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.max") returned 0
	[0063.970] lstrlenA (lpString="*.max") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.bmp") returned 0
	[0063.970] lstrlenA (lpString="*.bmp") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.gif") returned 0
	[0063.970] lstrlenA (lpString="*.gif") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.png") returned 0
	[0063.970] lstrlenA (lpString="*.png") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.doc") returned 0
	[0063.970] lstrlenA (lpString="*.doc") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.docx") returned 0
	[0063.970] lstrlenA (lpString="*.docx") returned 6
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.xls") returned 0
	[0063.970] lstrlenA (lpString="*.xls") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.xlsx") returned 0
	[0063.970] lstrlenA (lpString="*.xlsx") returned 6
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.ppt") returned 0
	[0063.970] lstrlenA (lpString="*.ppt") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.pptx") returned 0
	[0063.970] lstrlenA (lpString="*.pptx") returned 6
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.txt") returned 0
	[0063.970] lstrlenA (lpString="*.txt") returned 5
	[0063.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.pdf") returned 0
	[0063.970] lstrlenA (lpString="*.pdf") returned 5
	[0063.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.djvu") returned 0
	[0063.971] lstrlenA (lpString="*.djvu") returned 6
	[0063.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.htm") returned 0
	[0063.971] lstrlenA (lpString="*.htm") returned 5
	[0063.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.html") returned 1
	[0063.971] lstrlenA (lpString="*.html") returned 6
	[0063.971] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html"
	[0063.971] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html"
	[0063.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html."
	[0063.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.Boom"
	[0063.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.971] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7c
	[0063.971] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1
	[0063.971] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.971] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc59, lpOverlapped=0x0) returned 1
	[0063.972] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="FormsHomePage.html"
	[0063.972] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.972] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc59, lpOverlapped=0x0) returned 1
	[0063.972] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.973] CloseHandle (hObject=0x98) returned 1
	[0063.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.boom")) returned 1
	[0063.973] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.973] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.973] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageScript.js") returned -1
	[0063.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1
	[0063.973] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1
	[0063.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="FormsHomePage.html"
	[0063.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js"
	[0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.zip") returned 0
	[0063.973] lstrlenA (lpString="*.zip") returned 5
	[0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.rar") returned 0
	[0063.973] lstrlenA (lpString="*.rar") returned 5
	[0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.7z") returned 0
	[0063.974] lstrlenA (lpString="*.7z") returned 4
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.tar") returned 0
	[0063.974] lstrlenA (lpString="*.tar") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0
	[0063.974] lstrlenA (lpString="*.gzip") returned 6
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0
	[0063.974] lstrlenA (lpString="*.jpg") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0
	[0063.974] lstrlenA (lpString="*.jpeg") returned 6
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.psd") returned 0
	[0063.974] lstrlenA (lpString="*.psd") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.cdr") returned 0
	[0063.974] lstrlenA (lpString="*.cdr") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.dwg") returned 0
	[0063.974] lstrlenA (lpString="*.dwg") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.max") returned 0
	[0063.974] lstrlenA (lpString="*.max") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.bmp") returned 0
	[0063.974] lstrlenA (lpString="*.bmp") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.gif") returned 0
	[0063.974] lstrlenA (lpString="*.gif") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.png") returned 0
	[0063.974] lstrlenA (lpString="*.png") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.doc") returned 0
	[0063.974] lstrlenA (lpString="*.doc") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.docx") returned 0
	[0063.974] lstrlenA (lpString="*.docx") returned 6
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.xls") returned 0
	[0063.974] lstrlenA (lpString="*.xls") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.xlsx") returned 0
	[0063.974] lstrlenA (lpString="*.xlsx") returned 6
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ppt") returned 0
	[0063.974] lstrlenA (lpString="*.ppt") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pptx") returned 0
	[0063.974] lstrlenA (lpString="*.pptx") returned 6
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.txt") returned 0
	[0063.974] lstrlenA (lpString="*.txt") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pdf") returned 0
	[0063.974] lstrlenA (lpString="*.pdf") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.djvu") returned 0
	[0063.974] lstrlenA (lpString="*.djvu") returned 6
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.htm") returned 0
	[0063.974] lstrlenA (lpString="*.htm") returned 5
	[0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.html") returned 0
	[0063.974] lstrlenA (lpString="*.html") returned 6
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mdb") returned 0
	[0063.975] lstrlenA (lpString="*.mdb") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.cer") returned 0
	[0063.975] lstrlenA (lpString="*.cer") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.p12") returned 0
	[0063.975] lstrlenA (lpString="*.p12") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pfx") returned 0
	[0063.975] lstrlenA (lpString="*.pfx") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.kwm") returned 0
	[0063.975] lstrlenA (lpString="*.kwm") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pwm") returned 0
	[0063.975] lstrlenA (lpString="*.pwm") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.1cd") returned 0
	[0063.975] lstrlenA (lpString="*.1cd") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.md") returned 0
	[0063.975] lstrlenA (lpString="*.md") returned 4
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mdf") returned 0
	[0063.975] lstrlenA (lpString="*.mdf") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.dbf") returned 0
	[0063.975] lstrlenA (lpString="*.dbf") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.odt") returned 0
	[0063.975] lstrlenA (lpString="*.odt") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.vob") returned 0
	[0063.975] lstrlenA (lpString="*.vob") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ifo") returned 0
	[0063.975] lstrlenA (lpString="*.ifo") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.lnk") returned 0
	[0063.975] lstrlenA (lpString="*.lnk") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.torrent") returned 0
	[0063.975] lstrlenA (lpString="*.torrent") returned 9
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mov") returned 0
	[0063.975] lstrlenA (lpString="*.mov") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.m2v") returned 0
	[0063.975] lstrlenA (lpString="*.m2v") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.3gp") returned 0
	[0063.975] lstrlenA (lpString="*.3gp") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mpeg") returned 0
	[0063.975] lstrlenA (lpString="*.mpeg") returned 6
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mpg") returned 0
	[0063.975] lstrlenA (lpString="*.mpg") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.flv") returned 0
	[0063.975] lstrlenA (lpString="*.flv") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.avi") returned 0
	[0063.975] lstrlenA (lpString="*.avi") returned 5
	[0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mp4") returned 0
	[0063.976] lstrlenA (lpString="*.mp4") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.wmv") returned 0
	[0063.976] lstrlenA (lpString="*.wmv") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.divx") returned 0
	[0063.976] lstrlenA (lpString="*.divx") returned 6
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mkv") returned 0
	[0063.976] lstrlenA (lpString="*.mkv") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mp3") returned 0
	[0063.976] lstrlenA (lpString="*.mp3") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.wav") returned 0
	[0063.976] lstrlenA (lpString="*.wav") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.flac") returned 0
	[0063.976] lstrlenA (lpString="*.flac") returned 6
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ape") returned 0
	[0063.976] lstrlenA (lpString="*.ape") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.wma") returned 0
	[0063.976] lstrlenA (lpString="*.wma") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ac3") returned 0
	[0063.976] lstrlenA (lpString="*.ac3") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.exe") returned 0
	[0063.976] lstrlenA (lpString="*.exe") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.apk") returned 0
	[0063.976] lstrlenA (lpString="*.apk") returned 5
	[0063.976] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.976] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.976] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageStyle.css") returned -1
	[0063.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1
	[0063.976] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1
	[0063.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned="FormsHomePageScript.js"
	[0063.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css"
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.zip") returned 0
	[0063.976] lstrlenA (lpString="*.zip") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.rar") returned 0
	[0063.976] lstrlenA (lpString="*.rar") returned 5
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.7z") returned 0
	[0063.976] lstrlenA (lpString="*.7z") returned 4
	[0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.tar") returned 0
	[0063.976] lstrlenA (lpString="*.tar") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.gzip") returned 0
	[0063.977] lstrlenA (lpString="*.gzip") returned 6
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.jpg") returned 0
	[0063.977] lstrlenA (lpString="*.jpg") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.jpeg") returned 0
	[0063.977] lstrlenA (lpString="*.jpeg") returned 6
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.psd") returned 0
	[0063.977] lstrlenA (lpString="*.psd") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.cdr") returned 0
	[0063.977] lstrlenA (lpString="*.cdr") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.dwg") returned 0
	[0063.977] lstrlenA (lpString="*.dwg") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.max") returned 0
	[0063.977] lstrlenA (lpString="*.max") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.bmp") returned 0
	[0063.977] lstrlenA (lpString="*.bmp") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.gif") returned 0
	[0063.977] lstrlenA (lpString="*.gif") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.png") returned 0
	[0063.977] lstrlenA (lpString="*.png") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.doc") returned 0
	[0063.977] lstrlenA (lpString="*.doc") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.docx") returned 0
	[0063.977] lstrlenA (lpString="*.docx") returned 6
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.xls") returned 0
	[0063.977] lstrlenA (lpString="*.xls") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.xlsx") returned 0
	[0063.977] lstrlenA (lpString="*.xlsx") returned 6
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ppt") returned 0
	[0063.977] lstrlenA (lpString="*.ppt") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pptx") returned 0
	[0063.977] lstrlenA (lpString="*.pptx") returned 6
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.txt") returned 0
	[0063.977] lstrlenA (lpString="*.txt") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pdf") returned 0
	[0063.977] lstrlenA (lpString="*.pdf") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.djvu") returned 0
	[0063.977] lstrlenA (lpString="*.djvu") returned 6
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.htm") returned 0
	[0063.977] lstrlenA (lpString="*.htm") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.html") returned 0
	[0063.977] lstrlenA (lpString="*.html") returned 6
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mdb") returned 0
	[0063.977] lstrlenA (lpString="*.mdb") returned 5
	[0063.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.cer") returned 0
	[0063.978] lstrlenA (lpString="*.cer") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.p12") returned 0
	[0063.978] lstrlenA (lpString="*.p12") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pfx") returned 0
	[0063.978] lstrlenA (lpString="*.pfx") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.kwm") returned 0
	[0063.978] lstrlenA (lpString="*.kwm") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pwm") returned 0
	[0063.978] lstrlenA (lpString="*.pwm") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.1cd") returned 0
	[0063.978] lstrlenA (lpString="*.1cd") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.md") returned 0
	[0063.978] lstrlenA (lpString="*.md") returned 4
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mdf") returned 0
	[0063.978] lstrlenA (lpString="*.mdf") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.dbf") returned 0
	[0063.978] lstrlenA (lpString="*.dbf") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.odt") returned 0
	[0063.978] lstrlenA (lpString="*.odt") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.vob") returned 0
	[0063.978] lstrlenA (lpString="*.vob") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ifo") returned 0
	[0063.978] lstrlenA (lpString="*.ifo") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.lnk") returned 0
	[0063.978] lstrlenA (lpString="*.lnk") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.torrent") returned 0
	[0063.978] lstrlenA (lpString="*.torrent") returned 9
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mov") returned 0
	[0063.978] lstrlenA (lpString="*.mov") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.m2v") returned 0
	[0063.978] lstrlenA (lpString="*.m2v") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.3gp") returned 0
	[0063.978] lstrlenA (lpString="*.3gp") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mpeg") returned 0
	[0063.978] lstrlenA (lpString="*.mpeg") returned 6
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mpg") returned 0
	[0063.978] lstrlenA (lpString="*.mpg") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.flv") returned 0
	[0063.978] lstrlenA (lpString="*.flv") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.avi") returned 0
	[0063.978] lstrlenA (lpString="*.avi") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mp4") returned 0
	[0063.978] lstrlenA (lpString="*.mp4") returned 5
	[0063.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.wmv") returned 0
	[0063.978] lstrlenA (lpString="*.wmv") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.divx") returned 0
	[0063.979] lstrlenA (lpString="*.divx") returned 6
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mkv") returned 0
	[0063.979] lstrlenA (lpString="*.mkv") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mp3") returned 0
	[0063.979] lstrlenA (lpString="*.mp3") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.wav") returned 0
	[0063.979] lstrlenA (lpString="*.wav") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.flac") returned 0
	[0063.979] lstrlenA (lpString="*.flac") returned 6
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ape") returned 0
	[0063.979] lstrlenA (lpString="*.ape") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.wma") returned 0
	[0063.979] lstrlenA (lpString="*.wma") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ac3") returned 0
	[0063.979] lstrlenA (lpString="*.ac3") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.exe") returned 0
	[0063.979] lstrlenA (lpString="*.exe") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.apk") returned 0
	[0063.979] lstrlenA (lpString="*.apk") returned 5
	[0063.979] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.979] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.979] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsImageTemplate.html") returned -1
	[0063.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1
	[0063.979] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1
	[0063.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css"
	[0063.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html"
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.zip") returned 0
	[0063.979] lstrlenA (lpString="*.zip") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.rar") returned 0
	[0063.979] lstrlenA (lpString="*.rar") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.7z") returned 0
	[0063.979] lstrlenA (lpString="*.7z") returned 4
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.tar") returned 0
	[0063.979] lstrlenA (lpString="*.tar") returned 5
	[0063.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.gzip") returned 0
	[0063.979] lstrlenA (lpString="*.gzip") returned 6
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0
	[0063.980] lstrlenA (lpString="*.jpg") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0
	[0063.980] lstrlenA (lpString="*.jpeg") returned 6
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.psd") returned 0
	[0063.980] lstrlenA (lpString="*.psd") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.cdr") returned 0
	[0063.980] lstrlenA (lpString="*.cdr") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.dwg") returned 0
	[0063.980] lstrlenA (lpString="*.dwg") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.max") returned 0
	[0063.980] lstrlenA (lpString="*.max") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.bmp") returned 0
	[0063.980] lstrlenA (lpString="*.bmp") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.gif") returned 0
	[0063.980] lstrlenA (lpString="*.gif") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.png") returned 0
	[0063.980] lstrlenA (lpString="*.png") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.doc") returned 0
	[0063.980] lstrlenA (lpString="*.doc") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.docx") returned 0
	[0063.980] lstrlenA (lpString="*.docx") returned 6
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.xls") returned 0
	[0063.980] lstrlenA (lpString="*.xls") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.xlsx") returned 0
	[0063.980] lstrlenA (lpString="*.xlsx") returned 6
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.ppt") returned 0
	[0063.980] lstrlenA (lpString="*.ppt") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.pptx") returned 0
	[0063.980] lstrlenA (lpString="*.pptx") returned 6
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.txt") returned 0
	[0063.980] lstrlenA (lpString="*.txt") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.pdf") returned 0
	[0063.980] lstrlenA (lpString="*.pdf") returned 5
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.djvu") returned 0
	[0063.980] lstrlenA (lpString="*.djvu") returned 6
	[0063.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.htm") returned 0
	[0063.980] lstrlenA (lpString="*.htm") returned 5
	[0063.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.html") returned 1
	[0063.981] lstrlenA (lpString="*.html") returned 6
	[0063.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html"
	[0063.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html"
	[0063.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html."
	[0063.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.Boom"
	[0063.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.981] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ee
	[0063.981] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1
	[0063.981] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.981] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7cb, lpOverlapped=0x0) returned 1
	[0063.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="FormsImageTemplate.html"
	[0063.983] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.983] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7cb, lpOverlapped=0x0) returned 1
	[0063.983] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.983] CloseHandle (hObject=0x98) returned 1
	[0063.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.boom")) returned 1
	[0063.984] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.984] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.984] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsMacroTemplate.html") returned -1
	[0063.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1
	[0063.984] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1
	[0063.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="FormsImageTemplate.html"
	[0063.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.984] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html"
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0
	[0063.984] lstrlenA (lpString="*.zip") returned 5
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0
	[0063.984] lstrlenA (lpString="*.rar") returned 5
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.7z") returned 0
	[0063.984] lstrlenA (lpString="*.7z") returned 4
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.tar") returned 0
	[0063.984] lstrlenA (lpString="*.tar") returned 5
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.gzip") returned 0
	[0063.984] lstrlenA (lpString="*.gzip") returned 6
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0
	[0063.984] lstrlenA (lpString="*.jpg") returned 5
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0
	[0063.984] lstrlenA (lpString="*.jpeg") returned 6
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.psd") returned 0
	[0063.984] lstrlenA (lpString="*.psd") returned 5
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.cdr") returned 0
	[0063.984] lstrlenA (lpString="*.cdr") returned 5
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.dwg") returned 0
	[0063.984] lstrlenA (lpString="*.dwg") returned 5
	[0063.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.max") returned 0
	[0063.985] lstrlenA (lpString="*.max") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.bmp") returned 0
	[0063.985] lstrlenA (lpString="*.bmp") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.gif") returned 0
	[0063.985] lstrlenA (lpString="*.gif") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.png") returned 0
	[0063.985] lstrlenA (lpString="*.png") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.doc") returned 0
	[0063.985] lstrlenA (lpString="*.doc") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.docx") returned 0
	[0063.985] lstrlenA (lpString="*.docx") returned 6
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.xls") returned 0
	[0063.985] lstrlenA (lpString="*.xls") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.xlsx") returned 0
	[0063.985] lstrlenA (lpString="*.xlsx") returned 6
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.ppt") returned 0
	[0063.985] lstrlenA (lpString="*.ppt") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.pptx") returned 0
	[0063.985] lstrlenA (lpString="*.pptx") returned 6
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.txt") returned 0
	[0063.985] lstrlenA (lpString="*.txt") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.pdf") returned 0
	[0063.985] lstrlenA (lpString="*.pdf") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.djvu") returned 0
	[0063.985] lstrlenA (lpString="*.djvu") returned 6
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.htm") returned 0
	[0063.985] lstrlenA (lpString="*.htm") returned 5
	[0063.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.html") returned 1
	[0063.985] lstrlenA (lpString="*.html") returned 6
	[0063.985] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html"
	[0063.985] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html"
	[0063.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html."
	[0063.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.Boom"
	[0063.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.986] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x856
	[0063.986] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0063.986] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.986] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x833, lpOverlapped=0x0) returned 1
	[0063.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html"
	[0063.987] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.987] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x833, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x833, lpOverlapped=0x0) returned 1
	[0063.987] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0063.988] CloseHandle (hObject=0x98) returned 1
	[0063.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.boom")) returned 1
	[0063.988] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0063.988] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0063.988] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1
	[0063.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1
	[0063.988] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1
	[0063.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html"
	[0063.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0063.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0063.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html"
	[0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0
	[0063.988] lstrlenA (lpString="*.zip") returned 5
	[0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0
	[0063.989] lstrlenA (lpString="*.rar") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0
	[0063.989] lstrlenA (lpString="*.7z") returned 4
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0
	[0063.989] lstrlenA (lpString="*.tar") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0
	[0063.989] lstrlenA (lpString="*.gzip") returned 6
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0
	[0063.989] lstrlenA (lpString="*.jpg") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0
	[0063.989] lstrlenA (lpString="*.jpeg") returned 6
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0
	[0063.989] lstrlenA (lpString="*.psd") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0
	[0063.989] lstrlenA (lpString="*.cdr") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0
	[0063.989] lstrlenA (lpString="*.dwg") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0
	[0063.989] lstrlenA (lpString="*.max") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0
	[0063.989] lstrlenA (lpString="*.bmp") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0
	[0063.989] lstrlenA (lpString="*.gif") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0
	[0063.989] lstrlenA (lpString="*.png") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0
	[0063.989] lstrlenA (lpString="*.doc") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0
	[0063.989] lstrlenA (lpString="*.docx") returned 6
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0
	[0063.989] lstrlenA (lpString="*.xls") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0
	[0063.989] lstrlenA (lpString="*.xlsx") returned 6
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0
	[0063.989] lstrlenA (lpString="*.ppt") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0
	[0063.989] lstrlenA (lpString="*.pptx") returned 6
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0
	[0063.989] lstrlenA (lpString="*.txt") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0
	[0063.989] lstrlenA (lpString="*.pdf") returned 5
	[0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0
	[0063.989] lstrlenA (lpString="*.djvu") returned 6
	[0063.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0
	[0063.990] lstrlenA (lpString="*.htm") returned 5
	[0063.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1
	[0063.990] lstrlenA (lpString="*.html") returned 6
	[0063.990] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html"
	[0063.990] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html"
	[0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html."
	[0063.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.Boom"
	[0063.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0063.991] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46fe
	[0063.991] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529685b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0063.991] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0063.991] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x46db, lpOverlapped=0x0) returned 1
	[0064.004] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0064.004] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.004] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x46db, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x46db, lpOverlapped=0x0) returned 1
	[0064.004] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.004] CloseHandle (hObject=0x98) returned 1
	[0064.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.boom")) returned 1
	[0064.005] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.005] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.005] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1
	[0064.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1
	[0064.005] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1
	[0064.005] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0064.005] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.005] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.005] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.005] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.005] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html"
	[0064.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0
	[0064.006] lstrlenA (lpString="*.zip") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0
	[0064.006] lstrlenA (lpString="*.rar") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0
	[0064.006] lstrlenA (lpString="*.7z") returned 4
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0
	[0064.006] lstrlenA (lpString="*.tar") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0
	[0064.006] lstrlenA (lpString="*.gzip") returned 6
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0
	[0064.006] lstrlenA (lpString="*.jpg") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0
	[0064.006] lstrlenA (lpString="*.jpeg") returned 6
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0
	[0064.006] lstrlenA (lpString="*.psd") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0
	[0064.006] lstrlenA (lpString="*.cdr") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0
	[0064.006] lstrlenA (lpString="*.dwg") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.max") returned 0
	[0064.006] lstrlenA (lpString="*.max") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0
	[0064.006] lstrlenA (lpString="*.bmp") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0
	[0064.006] lstrlenA (lpString="*.gif") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.png") returned 0
	[0064.006] lstrlenA (lpString="*.png") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0
	[0064.006] lstrlenA (lpString="*.doc") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0
	[0064.006] lstrlenA (lpString="*.docx") returned 6
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0
	[0064.006] lstrlenA (lpString="*.xls") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0
	[0064.006] lstrlenA (lpString="*.xlsx") returned 6
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0
	[0064.006] lstrlenA (lpString="*.ppt") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0
	[0064.006] lstrlenA (lpString="*.pptx") returned 6
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0
	[0064.006] lstrlenA (lpString="*.txt") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0
	[0064.006] lstrlenA (lpString="*.pdf") returned 5
	[0064.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0
	[0064.006] lstrlenA (lpString="*.djvu") returned 6
	[0064.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0
	[0064.007] lstrlenA (lpString="*.htm") returned 5
	[0064.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.html") returned 1
	[0064.007] lstrlenA (lpString="*.html") returned 6
	[0064.007] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html"
	[0064.007] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html"
	[0064.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html."
	[0064.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.Boom"
	[0064.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.007] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x612
	[0064.007] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0064.007] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.007] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5ef, lpOverlapped=0x0) returned 1
	[0064.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0064.016] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.016] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5ef, lpOverlapped=0x0) returned 1
	[0064.026] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.026] CloseHandle (hObject=0x98) returned 1
	[0064.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.boom")) returned 1
	[0064.027] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.027] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1
	[0064.027] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1
	[0064.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0064.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles"
	[0064.027] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles") returned 94
	[0064.027] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7f68
	[0064.033] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.033] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.034] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.034] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.034] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.034] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Adobe.css") returned 1
	[0064.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe.css") returned 1
	[0064.034] lstrcmpiA (lpString1="", lpString2="Adobe.css") returned -1
	[0064.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.034] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.034] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0xffffffff
	[0064.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0064.035] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.035] WriteFile (in: hFile=0x9c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.035] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.035] CloseHandle (hObject=0x9c) returned 1
	[0064.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Adobe.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css"
	[0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.zip") returned 0
	[0064.035] lstrlenA (lpString="*.zip") returned 5
	[0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.rar") returned 0
	[0064.035] lstrlenA (lpString="*.rar") returned 5
	[0064.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.7z") returned 0
	[0064.035] lstrlenA (lpString="*.7z") returned 4
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.tar") returned 0
	[0064.036] lstrlenA (lpString="*.tar") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.gzip") returned 0
	[0064.036] lstrlenA (lpString="*.gzip") returned 6
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.jpg") returned 0
	[0064.036] lstrlenA (lpString="*.jpg") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.jpeg") returned 0
	[0064.036] lstrlenA (lpString="*.jpeg") returned 6
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.psd") returned 0
	[0064.036] lstrlenA (lpString="*.psd") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.cdr") returned 0
	[0064.036] lstrlenA (lpString="*.cdr") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.dwg") returned 0
	[0064.036] lstrlenA (lpString="*.dwg") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.max") returned 0
	[0064.036] lstrlenA (lpString="*.max") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.bmp") returned 0
	[0064.036] lstrlenA (lpString="*.bmp") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.gif") returned 0
	[0064.036] lstrlenA (lpString="*.gif") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.png") returned 0
	[0064.036] lstrlenA (lpString="*.png") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.doc") returned 0
	[0064.036] lstrlenA (lpString="*.doc") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.docx") returned 0
	[0064.036] lstrlenA (lpString="*.docx") returned 6
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.xls") returned 0
	[0064.036] lstrlenA (lpString="*.xls") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.xlsx") returned 0
	[0064.036] lstrlenA (lpString="*.xlsx") returned 6
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ppt") returned 0
	[0064.036] lstrlenA (lpString="*.ppt") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pptx") returned 0
	[0064.036] lstrlenA (lpString="*.pptx") returned 6
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.txt") returned 0
	[0064.036] lstrlenA (lpString="*.txt") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pdf") returned 0
	[0064.036] lstrlenA (lpString="*.pdf") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.djvu") returned 0
	[0064.036] lstrlenA (lpString="*.djvu") returned 6
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.htm") returned 0
	[0064.036] lstrlenA (lpString="*.htm") returned 5
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.html") returned 0
	[0064.036] lstrlenA (lpString="*.html") returned 6
	[0064.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mdb") returned 0
	[0064.037] lstrlenA (lpString="*.mdb") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.cer") returned 0
	[0064.037] lstrlenA (lpString="*.cer") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.p12") returned 0
	[0064.037] lstrlenA (lpString="*.p12") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pfx") returned 0
	[0064.037] lstrlenA (lpString="*.pfx") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.kwm") returned 0
	[0064.037] lstrlenA (lpString="*.kwm") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pwm") returned 0
	[0064.037] lstrlenA (lpString="*.pwm") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.1cd") returned 0
	[0064.037] lstrlenA (lpString="*.1cd") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.md") returned 0
	[0064.037] lstrlenA (lpString="*.md") returned 4
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mdf") returned 0
	[0064.037] lstrlenA (lpString="*.mdf") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.dbf") returned 0
	[0064.037] lstrlenA (lpString="*.dbf") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.odt") returned 0
	[0064.037] lstrlenA (lpString="*.odt") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.vob") returned 0
	[0064.037] lstrlenA (lpString="*.vob") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ifo") returned 0
	[0064.037] lstrlenA (lpString="*.ifo") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.lnk") returned 0
	[0064.037] lstrlenA (lpString="*.lnk") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.torrent") returned 0
	[0064.037] lstrlenA (lpString="*.torrent") returned 9
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mov") returned 0
	[0064.037] lstrlenA (lpString="*.mov") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.m2v") returned 0
	[0064.037] lstrlenA (lpString="*.m2v") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.3gp") returned 0
	[0064.037] lstrlenA (lpString="*.3gp") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mpeg") returned 0
	[0064.037] lstrlenA (lpString="*.mpeg") returned 6
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mpg") returned 0
	[0064.037] lstrlenA (lpString="*.mpg") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.flv") returned 0
	[0064.037] lstrlenA (lpString="*.flv") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.avi") returned 0
	[0064.037] lstrlenA (lpString="*.avi") returned 5
	[0064.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mp4") returned 0
	[0064.037] lstrlenA (lpString="*.mp4") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.wmv") returned 0
	[0064.038] lstrlenA (lpString="*.wmv") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.divx") returned 0
	[0064.038] lstrlenA (lpString="*.divx") returned 6
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mkv") returned 0
	[0064.038] lstrlenA (lpString="*.mkv") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mp3") returned 0
	[0064.038] lstrlenA (lpString="*.mp3") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.wav") returned 0
	[0064.038] lstrlenA (lpString="*.wav") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.flac") returned 0
	[0064.038] lstrlenA (lpString="*.flac") returned 6
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ape") returned 0
	[0064.038] lstrlenA (lpString="*.ape") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.wma") returned 0
	[0064.038] lstrlenA (lpString="*.wma") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ac3") returned 0
	[0064.038] lstrlenA (lpString="*.ac3") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.exe") returned 0
	[0064.038] lstrlenA (lpString="*.exe") returned 5
	[0064.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.apk") returned 0
	[0064.038] lstrlenA (lpString="*.apk") returned 5
	[0064.038] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.038] lstrcmpA (lpString1=".", lpString2="Americana") returned -1
	[0064.038] lstrcmpA (lpString1="..", lpString2="Americana") returned -1
	[0064.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned="Adobe.css"
	[0064.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Americana" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana"
	[0064.038] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned 104
	[0064.038] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.039] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.039] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.039] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.039] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.039] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.039] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.039] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*") returned="*.*"
	[0064.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\"
	[0064.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned=""
	[0064.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt"
	[0064.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\how to decrypt files.txt")) returned 0xffffffff
	[0064.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.040] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.040] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.041] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.041] CloseHandle (hObject=0xa0) returned 1
	[0064.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF"
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.041] lstrlenA (lpString="*.zip") returned 5
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.041] lstrlenA (lpString="*.rar") returned 5
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.041] lstrlenA (lpString="*.7z") returned 4
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.041] lstrlenA (lpString="*.tar") returned 5
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.041] lstrlenA (lpString="*.gzip") returned 6
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.041] lstrlenA (lpString="*.jpg") returned 5
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.041] lstrlenA (lpString="*.jpeg") returned 6
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.041] lstrlenA (lpString="*.psd") returned 5
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.041] lstrlenA (lpString="*.cdr") returned 5
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.041] lstrlenA (lpString="*.dwg") returned 5
	[0064.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.041] lstrlenA (lpString="*.max") returned 5
	[0064.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.042] lstrlenA (lpString="*.bmp") returned 5
	[0064.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.042] lstrlenA (lpString="*.gif") returned 5
	[0064.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF"
	[0064.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF"
	[0064.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF."
	[0064.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.Boom"
	[0064.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.042] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.042] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0064.042] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.042] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.043] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.043] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.043] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.043] CloseHandle (hObject=0xa0) returned 1
	[0064.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif.boom")) returned 1
	[0064.045] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.045] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.045] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.045] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\"
	[0064.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned=""
	[0064.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt"
	[0064.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\how to decrypt files.txt")) returned 0x20
	[0064.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF"
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.046] lstrlenA (lpString="*.zip") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.046] lstrlenA (lpString="*.rar") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.046] lstrlenA (lpString="*.7z") returned 4
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.046] lstrlenA (lpString="*.tar") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.046] lstrlenA (lpString="*.gzip") returned 6
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.046] lstrlenA (lpString="*.jpg") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.046] lstrlenA (lpString="*.jpeg") returned 6
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.046] lstrlenA (lpString="*.psd") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.046] lstrlenA (lpString="*.cdr") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.046] lstrlenA (lpString="*.dwg") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.046] lstrlenA (lpString="*.max") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.046] lstrlenA (lpString="*.bmp") returned 5
	[0064.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.046] lstrlenA (lpString="*.gif") returned 5
	[0064.046] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF"
	[0064.046] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF"
	[0064.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF."
	[0064.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.Boom"
	[0064.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.047] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.047] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0064.047] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.047] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.048] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.048] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.048] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.048] CloseHandle (hObject=0xa0) returned 1
	[0064.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif.boom")) returned 1
	[0064.049] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.049] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.049] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.049] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.049] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Americana.css") returned 1
	[0064.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Americana.css") returned 1
	[0064.049] lstrcmpiA (lpString1="", lpString2="Americana.css") returned -1
	[0064.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Americana.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css"
	[0064.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.zip") returned 0
	[0064.050] lstrlenA (lpString="*.zip") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.rar") returned 0
	[0064.050] lstrlenA (lpString="*.rar") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.7z") returned 0
	[0064.050] lstrlenA (lpString="*.7z") returned 4
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.tar") returned 0
	[0064.050] lstrlenA (lpString="*.tar") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.gzip") returned 0
	[0064.050] lstrlenA (lpString="*.gzip") returned 6
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.jpg") returned 0
	[0064.050] lstrlenA (lpString="*.jpg") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.jpeg") returned 0
	[0064.050] lstrlenA (lpString="*.jpeg") returned 6
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.psd") returned 0
	[0064.050] lstrlenA (lpString="*.psd") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.cdr") returned 0
	[0064.050] lstrlenA (lpString="*.cdr") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.dwg") returned 0
	[0064.050] lstrlenA (lpString="*.dwg") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.max") returned 0
	[0064.050] lstrlenA (lpString="*.max") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.bmp") returned 0
	[0064.050] lstrlenA (lpString="*.bmp") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.gif") returned 0
	[0064.050] lstrlenA (lpString="*.gif") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.png") returned 0
	[0064.050] lstrlenA (lpString="*.png") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.doc") returned 0
	[0064.050] lstrlenA (lpString="*.doc") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.docx") returned 0
	[0064.050] lstrlenA (lpString="*.docx") returned 6
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.xls") returned 0
	[0064.050] lstrlenA (lpString="*.xls") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.xlsx") returned 0
	[0064.050] lstrlenA (lpString="*.xlsx") returned 6
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ppt") returned 0
	[0064.050] lstrlenA (lpString="*.ppt") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pptx") returned 0
	[0064.050] lstrlenA (lpString="*.pptx") returned 6
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.txt") returned 0
	[0064.050] lstrlenA (lpString="*.txt") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pdf") returned 0
	[0064.050] lstrlenA (lpString="*.pdf") returned 5
	[0064.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.djvu") returned 0
	[0064.051] lstrlenA (lpString="*.djvu") returned 6
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.htm") returned 0
	[0064.051] lstrlenA (lpString="*.htm") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.html") returned 0
	[0064.051] lstrlenA (lpString="*.html") returned 6
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mdb") returned 0
	[0064.051] lstrlenA (lpString="*.mdb") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.cer") returned 0
	[0064.051] lstrlenA (lpString="*.cer") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.p12") returned 0
	[0064.051] lstrlenA (lpString="*.p12") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pfx") returned 0
	[0064.051] lstrlenA (lpString="*.pfx") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.kwm") returned 0
	[0064.051] lstrlenA (lpString="*.kwm") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pwm") returned 0
	[0064.051] lstrlenA (lpString="*.pwm") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.1cd") returned 0
	[0064.051] lstrlenA (lpString="*.1cd") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.md") returned 0
	[0064.051] lstrlenA (lpString="*.md") returned 4
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mdf") returned 0
	[0064.051] lstrlenA (lpString="*.mdf") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.dbf") returned 0
	[0064.051] lstrlenA (lpString="*.dbf") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.odt") returned 0
	[0064.051] lstrlenA (lpString="*.odt") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.vob") returned 0
	[0064.051] lstrlenA (lpString="*.vob") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ifo") returned 0
	[0064.051] lstrlenA (lpString="*.ifo") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.lnk") returned 0
	[0064.051] lstrlenA (lpString="*.lnk") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.torrent") returned 0
	[0064.051] lstrlenA (lpString="*.torrent") returned 9
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mov") returned 0
	[0064.051] lstrlenA (lpString="*.mov") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.m2v") returned 0
	[0064.051] lstrlenA (lpString="*.m2v") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.3gp") returned 0
	[0064.051] lstrlenA (lpString="*.3gp") returned 5
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mpeg") returned 0
	[0064.051] lstrlenA (lpString="*.mpeg") returned 6
	[0064.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mpg") returned 0
	[0064.052] lstrlenA (lpString="*.mpg") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.flv") returned 0
	[0064.052] lstrlenA (lpString="*.flv") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.avi") returned 0
	[0064.052] lstrlenA (lpString="*.avi") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mp4") returned 0
	[0064.052] lstrlenA (lpString="*.mp4") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wmv") returned 0
	[0064.052] lstrlenA (lpString="*.wmv") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.divx") returned 0
	[0064.052] lstrlenA (lpString="*.divx") returned 6
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mkv") returned 0
	[0064.052] lstrlenA (lpString="*.mkv") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mp3") returned 0
	[0064.052] lstrlenA (lpString="*.mp3") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wav") returned 0
	[0064.052] lstrlenA (lpString="*.wav") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.flac") returned 0
	[0064.052] lstrlenA (lpString="*.flac") returned 6
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ape") returned 0
	[0064.052] lstrlenA (lpString="*.ape") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wma") returned 0
	[0064.052] lstrlenA (lpString="*.wma") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ac3") returned 0
	[0064.052] lstrlenA (lpString="*.ac3") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.exe") returned 0
	[0064.052] lstrlenA (lpString="*.exe") returned 5
	[0064.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.apk") returned 0
	[0064.052] lstrlenA (lpString="*.apk") returned 5
	[0064.052] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.052] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1
	[0064.052] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1
	[0064.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned="Americana.css"
	[0064.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BabyBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue"
	[0064.052] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned 103
	[0064.052] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.053] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.053] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.053] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.053] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.053] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.053] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1
	[0064.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1
	[0064.053] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1
	[0064.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*") returned="*.*"
	[0064.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\"
	[0064.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned=""
	[0064.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0064.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0xffffffff
	[0064.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.054] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.054] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.054] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.055] CloseHandle (hObject=0xa0) returned 1
	[0064.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF"
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.zip") returned 0
	[0064.055] lstrlenA (lpString="*.zip") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.rar") returned 0
	[0064.055] lstrlenA (lpString="*.rar") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.7z") returned 0
	[0064.055] lstrlenA (lpString="*.7z") returned 4
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.tar") returned 0
	[0064.055] lstrlenA (lpString="*.tar") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gzip") returned 0
	[0064.055] lstrlenA (lpString="*.gzip") returned 6
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpg") returned 0
	[0064.055] lstrlenA (lpString="*.jpg") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpeg") returned 0
	[0064.055] lstrlenA (lpString="*.jpeg") returned 6
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.psd") returned 0
	[0064.055] lstrlenA (lpString="*.psd") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.cdr") returned 0
	[0064.055] lstrlenA (lpString="*.cdr") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.dwg") returned 0
	[0064.055] lstrlenA (lpString="*.dwg") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.max") returned 0
	[0064.055] lstrlenA (lpString="*.max") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.bmp") returned 0
	[0064.055] lstrlenA (lpString="*.bmp") returned 5
	[0064.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gif") returned 1
	[0064.055] lstrlenA (lpString="*.gif") returned 5
	[0064.055] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF"
	[0064.055] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF"
	[0064.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF."
	[0064.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.Boom"
	[0064.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.056] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9
	[0064.056] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0064.056] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.056] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x96, lpOverlapped=0x0) returned 1
	[0064.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF"
	[0064.056] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.057] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x96, lpOverlapped=0x0) returned 1
	[0064.057] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.057] CloseHandle (hObject=0xa0) returned 1
	[0064.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif.boom")) returned 1
	[0064.058] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.058] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0064.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0064.058] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0064.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF"
	[0064.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\"
	[0064.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned=""
	[0064.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0064.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20
	[0064.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF"
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0064.059] lstrlenA (lpString="*.zip") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0064.059] lstrlenA (lpString="*.rar") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0064.059] lstrlenA (lpString="*.7z") returned 4
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0064.059] lstrlenA (lpString="*.tar") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0064.059] lstrlenA (lpString="*.gzip") returned 6
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0064.059] lstrlenA (lpString="*.jpg") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0064.059] lstrlenA (lpString="*.jpeg") returned 6
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0064.059] lstrlenA (lpString="*.psd") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0064.059] lstrlenA (lpString="*.cdr") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0064.059] lstrlenA (lpString="*.dwg") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.max") returned 0
	[0064.059] lstrlenA (lpString="*.max") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0064.059] lstrlenA (lpString="*.bmp") returned 5
	[0064.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0064.059] lstrlenA (lpString="*.gif") returned 5
	[0064.059] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF"
	[0064.059] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF"
	[0064.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF."
	[0064.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.Boom"
	[0064.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.060] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff
	[0064.060] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0064.060] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.060] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xdc, lpOverlapped=0x0) returned 1
	[0064.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF"
	[0064.061] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.061] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xdc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xdc, lpOverlapped=0x0) returned 1
	[0064.061] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.061] CloseHandle (hObject=0xa0) returned 1
	[0064.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif.boom")) returned 1
	[0064.061] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.061] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.061] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.061] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF"
	[0064.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\"
	[0064.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned=""
	[0064.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0064.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20
	[0064.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF"
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.062] lstrlenA (lpString="*.zip") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.062] lstrlenA (lpString="*.rar") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.062] lstrlenA (lpString="*.7z") returned 4
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.062] lstrlenA (lpString="*.tar") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.062] lstrlenA (lpString="*.gzip") returned 6
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.062] lstrlenA (lpString="*.jpg") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.062] lstrlenA (lpString="*.jpeg") returned 6
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.062] lstrlenA (lpString="*.psd") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.062] lstrlenA (lpString="*.cdr") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.062] lstrlenA (lpString="*.dwg") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.062] lstrlenA (lpString="*.max") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.062] lstrlenA (lpString="*.bmp") returned 5
	[0064.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.062] lstrlenA (lpString="*.gif") returned 5
	[0064.062] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF"
	[0064.062] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF"
	[0064.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF."
	[0064.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.Boom"
	[0064.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.063] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.063] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0064.063] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.063] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.063] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.063] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.064] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.064] CloseHandle (hObject=0xa0) returned 1
	[0064.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif.boom")) returned 1
	[0064.064] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.064] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.064] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\"
	[0064.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned=""
	[0064.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0064.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20
	[0064.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF"
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.065] lstrlenA (lpString="*.zip") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.065] lstrlenA (lpString="*.rar") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.065] lstrlenA (lpString="*.7z") returned 4
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.065] lstrlenA (lpString="*.tar") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.065] lstrlenA (lpString="*.gzip") returned 6
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.065] lstrlenA (lpString="*.jpg") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.065] lstrlenA (lpString="*.jpeg") returned 6
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.065] lstrlenA (lpString="*.psd") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.065] lstrlenA (lpString="*.cdr") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.065] lstrlenA (lpString="*.dwg") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.065] lstrlenA (lpString="*.max") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.065] lstrlenA (lpString="*.bmp") returned 5
	[0064.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.065] lstrlenA (lpString="*.gif") returned 5
	[0064.065] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF"
	[0064.065] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF"
	[0064.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF."
	[0064.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.Boom"
	[0064.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.066] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.066] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1
	[0064.066] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.066] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.067] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.067] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.067] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.067] CloseHandle (hObject=0xa0) returned 1
	[0064.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif.boom")) returned 1
	[0064.068] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.068] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.068] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.068] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.068] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBlue.css") returned 1
	[0064.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBlue.css") returned 1
	[0064.068] lstrcmpiA (lpString1="", lpString2="BabyBlue.css") returned -1
	[0064.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.068] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.068] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BabyBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css"
	[0064.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.zip") returned 0
	[0064.068] lstrlenA (lpString="*.zip") returned 5
	[0064.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.rar") returned 0
	[0064.068] lstrlenA (lpString="*.rar") returned 5
	[0064.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.7z") returned 0
	[0064.068] lstrlenA (lpString="*.7z") returned 4
	[0064.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.tar") returned 0
	[0064.068] lstrlenA (lpString="*.tar") returned 5
	[0064.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.gzip") returned 0
	[0064.069] lstrlenA (lpString="*.gzip") returned 6
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.jpg") returned 0
	[0064.069] lstrlenA (lpString="*.jpg") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.jpeg") returned 0
	[0064.069] lstrlenA (lpString="*.jpeg") returned 6
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.psd") returned 0
	[0064.069] lstrlenA (lpString="*.psd") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.cdr") returned 0
	[0064.069] lstrlenA (lpString="*.cdr") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.dwg") returned 0
	[0064.069] lstrlenA (lpString="*.dwg") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.max") returned 0
	[0064.069] lstrlenA (lpString="*.max") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.bmp") returned 0
	[0064.069] lstrlenA (lpString="*.bmp") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.gif") returned 0
	[0064.069] lstrlenA (lpString="*.gif") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.png") returned 0
	[0064.069] lstrlenA (lpString="*.png") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.doc") returned 0
	[0064.069] lstrlenA (lpString="*.doc") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.docx") returned 0
	[0064.069] lstrlenA (lpString="*.docx") returned 6
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.xls") returned 0
	[0064.069] lstrlenA (lpString="*.xls") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.xlsx") returned 0
	[0064.069] lstrlenA (lpString="*.xlsx") returned 6
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ppt") returned 0
	[0064.069] lstrlenA (lpString="*.ppt") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pptx") returned 0
	[0064.069] lstrlenA (lpString="*.pptx") returned 6
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.txt") returned 0
	[0064.069] lstrlenA (lpString="*.txt") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pdf") returned 0
	[0064.069] lstrlenA (lpString="*.pdf") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.djvu") returned 0
	[0064.069] lstrlenA (lpString="*.djvu") returned 6
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.htm") returned 0
	[0064.069] lstrlenA (lpString="*.htm") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.html") returned 0
	[0064.069] lstrlenA (lpString="*.html") returned 6
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mdb") returned 0
	[0064.069] lstrlenA (lpString="*.mdb") returned 5
	[0064.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.cer") returned 0
	[0064.070] lstrlenA (lpString="*.cer") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.p12") returned 0
	[0064.070] lstrlenA (lpString="*.p12") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pfx") returned 0
	[0064.070] lstrlenA (lpString="*.pfx") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.kwm") returned 0
	[0064.070] lstrlenA (lpString="*.kwm") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pwm") returned 0
	[0064.070] lstrlenA (lpString="*.pwm") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.1cd") returned 0
	[0064.070] lstrlenA (lpString="*.1cd") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.md") returned 0
	[0064.070] lstrlenA (lpString="*.md") returned 4
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mdf") returned 0
	[0064.070] lstrlenA (lpString="*.mdf") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.dbf") returned 0
	[0064.070] lstrlenA (lpString="*.dbf") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.odt") returned 0
	[0064.070] lstrlenA (lpString="*.odt") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.vob") returned 0
	[0064.070] lstrlenA (lpString="*.vob") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ifo") returned 0
	[0064.070] lstrlenA (lpString="*.ifo") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.lnk") returned 0
	[0064.070] lstrlenA (lpString="*.lnk") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.torrent") returned 0
	[0064.070] lstrlenA (lpString="*.torrent") returned 9
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mov") returned 0
	[0064.070] lstrlenA (lpString="*.mov") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.m2v") returned 0
	[0064.070] lstrlenA (lpString="*.m2v") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.3gp") returned 0
	[0064.070] lstrlenA (lpString="*.3gp") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mpeg") returned 0
	[0064.070] lstrlenA (lpString="*.mpeg") returned 6
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mpg") returned 0
	[0064.070] lstrlenA (lpString="*.mpg") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.flv") returned 0
	[0064.070] lstrlenA (lpString="*.flv") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.avi") returned 0
	[0064.070] lstrlenA (lpString="*.avi") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mp4") returned 0
	[0064.070] lstrlenA (lpString="*.mp4") returned 5
	[0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wmv") returned 0
	[0064.071] lstrlenA (lpString="*.wmv") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.divx") returned 0
	[0064.071] lstrlenA (lpString="*.divx") returned 6
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mkv") returned 0
	[0064.071] lstrlenA (lpString="*.mkv") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mp3") returned 0
	[0064.071] lstrlenA (lpString="*.mp3") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wav") returned 0
	[0064.071] lstrlenA (lpString="*.wav") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.flac") returned 0
	[0064.071] lstrlenA (lpString="*.flac") returned 6
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ape") returned 0
	[0064.071] lstrlenA (lpString="*.ape") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wma") returned 0
	[0064.071] lstrlenA (lpString="*.wma") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ac3") returned 0
	[0064.071] lstrlenA (lpString="*.ac3") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.exe") returned 0
	[0064.071] lstrlenA (lpString="*.exe") returned 5
	[0064.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.apk") returned 0
	[0064.071] lstrlenA (lpString="*.apk") returned 5
	[0064.071] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.071] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1
	[0064.071] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1
	[0064.071] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned="BabyBlue.css"
	[0064.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Biscay" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay"
	[0064.071] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned 101
	[0064.071] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.072] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.072] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.072] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.072] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.072] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.072] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.072] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.072] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*") returned="*.*"
	[0064.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\"
	[0064.072] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned=""
	[0064.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt"
	[0064.072] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0xffffffff
	[0064.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.073] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.073] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.073] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.073] CloseHandle (hObject=0xa0) returned 1
	[0064.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF"
	[0064.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.074] lstrlenA (lpString="*.zip") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.074] lstrlenA (lpString="*.rar") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.074] lstrlenA (lpString="*.7z") returned 4
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.074] lstrlenA (lpString="*.tar") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.074] lstrlenA (lpString="*.gzip") returned 6
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.074] lstrlenA (lpString="*.jpg") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.074] lstrlenA (lpString="*.jpeg") returned 6
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.074] lstrlenA (lpString="*.psd") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.074] lstrlenA (lpString="*.cdr") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.074] lstrlenA (lpString="*.dwg") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.074] lstrlenA (lpString="*.max") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.074] lstrlenA (lpString="*.bmp") returned 5
	[0064.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.074] lstrlenA (lpString="*.gif") returned 5
	[0064.074] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF"
	[0064.074] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF"
	[0064.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF."
	[0064.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.Boom"
	[0064.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.075] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.075] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.075] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.075] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.075] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.075] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.076] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.076] CloseHandle (hObject=0xa0) returned 1
	[0064.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif.boom")) returned 1
	[0064.076] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.076] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.076] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.076] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\"
	[0064.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned=""
	[0064.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt"
	[0064.076] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0x20
	[0064.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF"
	[0064.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.076] lstrlenA (lpString="*.zip") returned 5
	[0064.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.076] lstrlenA (lpString="*.rar") returned 5
	[0064.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.077] lstrlenA (lpString="*.7z") returned 4
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.077] lstrlenA (lpString="*.tar") returned 5
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.077] lstrlenA (lpString="*.gzip") returned 6
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.077] lstrlenA (lpString="*.jpg") returned 5
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.077] lstrlenA (lpString="*.jpeg") returned 6
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.077] lstrlenA (lpString="*.psd") returned 5
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.077] lstrlenA (lpString="*.cdr") returned 5
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.077] lstrlenA (lpString="*.dwg") returned 5
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.077] lstrlenA (lpString="*.max") returned 5
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.077] lstrlenA (lpString="*.bmp") returned 5
	[0064.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.077] lstrlenA (lpString="*.gif") returned 5
	[0064.077] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF"
	[0064.077] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF"
	[0064.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF."
	[0064.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.Boom"
	[0064.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.077] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.077] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.078] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.078] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.078] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.078] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.078] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.078] CloseHandle (hObject=0xa0) returned 1
	[0064.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif.boom")) returned 1
	[0064.080] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.080] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.080] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.080] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.080] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Biscay.css") returned 1
	[0064.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Biscay.css") returned 1
	[0064.080] lstrcmpiA (lpString1="", lpString2="Biscay.css") returned -1
	[0064.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.081] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.081] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Biscay.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css"
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.zip") returned 0
	[0064.081] lstrlenA (lpString="*.zip") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.rar") returned 0
	[0064.081] lstrlenA (lpString="*.rar") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.7z") returned 0
	[0064.081] lstrlenA (lpString="*.7z") returned 4
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.tar") returned 0
	[0064.081] lstrlenA (lpString="*.tar") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.gzip") returned 0
	[0064.081] lstrlenA (lpString="*.gzip") returned 6
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.jpg") returned 0
	[0064.081] lstrlenA (lpString="*.jpg") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.jpeg") returned 0
	[0064.081] lstrlenA (lpString="*.jpeg") returned 6
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.psd") returned 0
	[0064.081] lstrlenA (lpString="*.psd") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.cdr") returned 0
	[0064.081] lstrlenA (lpString="*.cdr") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.dwg") returned 0
	[0064.081] lstrlenA (lpString="*.dwg") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.max") returned 0
	[0064.081] lstrlenA (lpString="*.max") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.bmp") returned 0
	[0064.081] lstrlenA (lpString="*.bmp") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.gif") returned 0
	[0064.081] lstrlenA (lpString="*.gif") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.png") returned 0
	[0064.081] lstrlenA (lpString="*.png") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.doc") returned 0
	[0064.081] lstrlenA (lpString="*.doc") returned 5
	[0064.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.docx") returned 0
	[0064.081] lstrlenA (lpString="*.docx") returned 6
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.xls") returned 0
	[0064.082] lstrlenA (lpString="*.xls") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.xlsx") returned 0
	[0064.082] lstrlenA (lpString="*.xlsx") returned 6
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ppt") returned 0
	[0064.082] lstrlenA (lpString="*.ppt") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pptx") returned 0
	[0064.082] lstrlenA (lpString="*.pptx") returned 6
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.txt") returned 0
	[0064.082] lstrlenA (lpString="*.txt") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pdf") returned 0
	[0064.082] lstrlenA (lpString="*.pdf") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.djvu") returned 0
	[0064.082] lstrlenA (lpString="*.djvu") returned 6
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.htm") returned 0
	[0064.082] lstrlenA (lpString="*.htm") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.html") returned 0
	[0064.082] lstrlenA (lpString="*.html") returned 6
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mdb") returned 0
	[0064.082] lstrlenA (lpString="*.mdb") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.cer") returned 0
	[0064.082] lstrlenA (lpString="*.cer") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.p12") returned 0
	[0064.082] lstrlenA (lpString="*.p12") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pfx") returned 0
	[0064.082] lstrlenA (lpString="*.pfx") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.kwm") returned 0
	[0064.082] lstrlenA (lpString="*.kwm") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pwm") returned 0
	[0064.082] lstrlenA (lpString="*.pwm") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.1cd") returned 0
	[0064.082] lstrlenA (lpString="*.1cd") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.md") returned 0
	[0064.082] lstrlenA (lpString="*.md") returned 4
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mdf") returned 0
	[0064.082] lstrlenA (lpString="*.mdf") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.dbf") returned 0
	[0064.082] lstrlenA (lpString="*.dbf") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.odt") returned 0
	[0064.082] lstrlenA (lpString="*.odt") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.vob") returned 0
	[0064.082] lstrlenA (lpString="*.vob") returned 5
	[0064.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ifo") returned 0
	[0064.082] lstrlenA (lpString="*.ifo") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.lnk") returned 0
	[0064.083] lstrlenA (lpString="*.lnk") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.torrent") returned 0
	[0064.083] lstrlenA (lpString="*.torrent") returned 9
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mov") returned 0
	[0064.083] lstrlenA (lpString="*.mov") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.m2v") returned 0
	[0064.083] lstrlenA (lpString="*.m2v") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.3gp") returned 0
	[0064.083] lstrlenA (lpString="*.3gp") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mpeg") returned 0
	[0064.083] lstrlenA (lpString="*.mpeg") returned 6
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mpg") returned 0
	[0064.083] lstrlenA (lpString="*.mpg") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.flv") returned 0
	[0064.083] lstrlenA (lpString="*.flv") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.avi") returned 0
	[0064.083] lstrlenA (lpString="*.avi") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mp4") returned 0
	[0064.083] lstrlenA (lpString="*.mp4") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wmv") returned 0
	[0064.083] lstrlenA (lpString="*.wmv") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.divx") returned 0
	[0064.083] lstrlenA (lpString="*.divx") returned 6
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mkv") returned 0
	[0064.083] lstrlenA (lpString="*.mkv") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mp3") returned 0
	[0064.083] lstrlenA (lpString="*.mp3") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wav") returned 0
	[0064.083] lstrlenA (lpString="*.wav") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.flac") returned 0
	[0064.083] lstrlenA (lpString="*.flac") returned 6
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ape") returned 0
	[0064.083] lstrlenA (lpString="*.ape") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wma") returned 0
	[0064.083] lstrlenA (lpString="*.wma") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ac3") returned 0
	[0064.083] lstrlenA (lpString="*.ac3") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.exe") returned 0
	[0064.083] lstrlenA (lpString="*.exe") returned 5
	[0064.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.apk") returned 0
	[0064.083] lstrlenA (lpString="*.apk") returned 5
	[0064.083] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.083] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1
	[0064.084] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1
	[0064.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned="Biscay.css"
	[0064.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightOrange" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange"
	[0064.084] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned 107
	[0064.084] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.084] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.084] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.084] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.084] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.084] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.084] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.084] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0064.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0064.084] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0064.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*") returned="*.*"
	[0064.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\"
	[0064.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned=""
	[0064.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0064.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0xffffffff
	[0064.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.086] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.086] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.086] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.086] CloseHandle (hObject=0xa0) returned 1
	[0064.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif"
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.zip") returned 0
	[0064.087] lstrlenA (lpString="*.zip") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.rar") returned 0
	[0064.087] lstrlenA (lpString="*.rar") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.7z") returned 0
	[0064.087] lstrlenA (lpString="*.7z") returned 4
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.tar") returned 0
	[0064.087] lstrlenA (lpString="*.tar") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gzip") returned 0
	[0064.087] lstrlenA (lpString="*.gzip") returned 6
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpg") returned 0
	[0064.087] lstrlenA (lpString="*.jpg") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpeg") returned 0
	[0064.087] lstrlenA (lpString="*.jpeg") returned 6
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.psd") returned 0
	[0064.087] lstrlenA (lpString="*.psd") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.cdr") returned 0
	[0064.087] lstrlenA (lpString="*.cdr") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.dwg") returned 0
	[0064.087] lstrlenA (lpString="*.dwg") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.max") returned 0
	[0064.087] lstrlenA (lpString="*.max") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.bmp") returned 0
	[0064.087] lstrlenA (lpString="*.bmp") returned 5
	[0064.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gif") returned 1
	[0064.087] lstrlenA (lpString="*.gif") returned 5
	[0064.087] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif"
	[0064.087] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif"
	[0064.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif."
	[0064.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.Boom"
	[0064.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.088] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143
	[0064.088] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.088] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.088] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x120, lpOverlapped=0x0) returned 1
	[0064.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif"
	[0064.088] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.088] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x120, lpOverlapped=0x0) returned 1
	[0064.089] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.089] CloseHandle (hObject=0xa0) returned 1
	[0064.089] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.boom")) returned 1
	[0064.089] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.089] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.089] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button.gif") returned 1
	[0064.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button.gif") returned 1
	[0064.089] lstrcmpiA (lpString1="", lpString2="button.gif") returned -1
	[0064.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif"
	[0064.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\"
	[0064.089] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned=""
	[0064.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0064.089] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20
	[0064.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="button.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif"
	[0064.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.zip") returned 0
	[0064.089] lstrlenA (lpString="*.zip") returned 5
	[0064.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.rar") returned 0
	[0064.089] lstrlenA (lpString="*.rar") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.7z") returned 0
	[0064.090] lstrlenA (lpString="*.7z") returned 4
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.tar") returned 0
	[0064.090] lstrlenA (lpString="*.tar") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.gzip") returned 0
	[0064.090] lstrlenA (lpString="*.gzip") returned 6
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.jpg") returned 0
	[0064.090] lstrlenA (lpString="*.jpg") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.jpeg") returned 0
	[0064.090] lstrlenA (lpString="*.jpeg") returned 6
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.psd") returned 0
	[0064.090] lstrlenA (lpString="*.psd") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.cdr") returned 0
	[0064.090] lstrlenA (lpString="*.cdr") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.dwg") returned 0
	[0064.090] lstrlenA (lpString="*.dwg") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.max") returned 0
	[0064.090] lstrlenA (lpString="*.max") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.bmp") returned 0
	[0064.090] lstrlenA (lpString="*.bmp") returned 5
	[0064.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.gif") returned 1
	[0064.090] lstrlenA (lpString="*.gif") returned 5
	[0064.090] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif"
	[0064.090] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif"
	[0064.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif."
	[0064.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.Boom"
	[0064.090] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.090] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9
	[0064.090] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.090] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.091] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x96, lpOverlapped=0x0) returned 1
	[0064.091] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="button.gif"
	[0064.091] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.091] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x96, lpOverlapped=0x0) returned 1
	[0064.091] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.091] CloseHandle (hObject=0xa0) returned 1
	[0064.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.boom")) returned 1
	[0064.092] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.092] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.092] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1
	[0064.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1
	[0064.092] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1
	[0064.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="button.gif"
	[0064.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\"
	[0064.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned=""
	[0064.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0064.092] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20
	[0064.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif"
	[0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.zip") returned 0
	[0064.092] lstrlenA (lpString="*.zip") returned 5
	[0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.rar") returned 0
	[0064.092] lstrlenA (lpString="*.rar") returned 5
	[0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.7z") returned 0
	[0064.092] lstrlenA (lpString="*.7z") returned 4
	[0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.tar") returned 0
	[0064.092] lstrlenA (lpString="*.tar") returned 5
	[0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.gzip") returned 0
	[0064.092] lstrlenA (lpString="*.gzip") returned 6
	[0064.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.jpg") returned 0
	[0064.093] lstrlenA (lpString="*.jpg") returned 5
	[0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.jpeg") returned 0
	[0064.093] lstrlenA (lpString="*.jpeg") returned 6
	[0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.psd") returned 0
	[0064.093] lstrlenA (lpString="*.psd") returned 5
	[0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.cdr") returned 0
	[0064.093] lstrlenA (lpString="*.cdr") returned 5
	[0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.dwg") returned 0
	[0064.093] lstrlenA (lpString="*.dwg") returned 5
	[0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.max") returned 0
	[0064.093] lstrlenA (lpString="*.max") returned 5
	[0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.bmp") returned 0
	[0064.093] lstrlenA (lpString="*.bmp") returned 5
	[0064.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.gif") returned 1
	[0064.093] lstrlenA (lpString="*.gif") returned 5
	[0064.093] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif"
	[0064.093] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif"
	[0064.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif."
	[0064.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.Boom"
	[0064.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.094] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.094] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.094] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.094] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="tab_off.gif"
	[0064.095] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.095] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.095] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.095] CloseHandle (hObject=0xa0) returned 1
	[0064.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.boom")) returned 1
	[0064.095] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.095] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.095] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1
	[0064.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1
	[0064.096] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1
	[0064.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="tab_off.gif"
	[0064.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\"
	[0064.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned=""
	[0064.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0064.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20
	[0064.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif"
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.zip") returned 0
	[0064.096] lstrlenA (lpString="*.zip") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.rar") returned 0
	[0064.096] lstrlenA (lpString="*.rar") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.7z") returned 0
	[0064.096] lstrlenA (lpString="*.7z") returned 4
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.tar") returned 0
	[0064.096] lstrlenA (lpString="*.tar") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.gzip") returned 0
	[0064.096] lstrlenA (lpString="*.gzip") returned 6
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.jpg") returned 0
	[0064.096] lstrlenA (lpString="*.jpg") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.jpeg") returned 0
	[0064.096] lstrlenA (lpString="*.jpeg") returned 6
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.psd") returned 0
	[0064.096] lstrlenA (lpString="*.psd") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.cdr") returned 0
	[0064.096] lstrlenA (lpString="*.cdr") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.dwg") returned 0
	[0064.096] lstrlenA (lpString="*.dwg") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.max") returned 0
	[0064.096] lstrlenA (lpString="*.max") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.bmp") returned 0
	[0064.096] lstrlenA (lpString="*.bmp") returned 5
	[0064.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.gif") returned 1
	[0064.096] lstrlenA (lpString="*.gif") returned 5
	[0064.096] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif"
	[0064.096] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif"
	[0064.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif."
	[0064.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.Boom"
	[0064.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.097] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.097] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.097] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.097] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="tab_on.gif"
	[0064.098] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.098] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.098] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.098] CloseHandle (hObject=0xa0) returned 1
	[0064.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.boom")) returned 1
	[0064.098] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.098] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.098] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.098] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.098] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightOrange.css") returned 1
	[0064.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightOrange.css") returned 1
	[0064.098] lstrcmpiA (lpString1="", lpString2="BrightOrange.css") returned -1
	[0064.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightOrange.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css"
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.zip") returned 0
	[0064.099] lstrlenA (lpString="*.zip") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.rar") returned 0
	[0064.099] lstrlenA (lpString="*.rar") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.7z") returned 0
	[0064.099] lstrlenA (lpString="*.7z") returned 4
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.tar") returned 0
	[0064.099] lstrlenA (lpString="*.tar") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.gzip") returned 0
	[0064.099] lstrlenA (lpString="*.gzip") returned 6
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.jpg") returned 0
	[0064.099] lstrlenA (lpString="*.jpg") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.jpeg") returned 0
	[0064.099] lstrlenA (lpString="*.jpeg") returned 6
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.psd") returned 0
	[0064.099] lstrlenA (lpString="*.psd") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.cdr") returned 0
	[0064.099] lstrlenA (lpString="*.cdr") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.dwg") returned 0
	[0064.099] lstrlenA (lpString="*.dwg") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.max") returned 0
	[0064.099] lstrlenA (lpString="*.max") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.bmp") returned 0
	[0064.099] lstrlenA (lpString="*.bmp") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.gif") returned 0
	[0064.099] lstrlenA (lpString="*.gif") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.png") returned 0
	[0064.099] lstrlenA (lpString="*.png") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.doc") returned 0
	[0064.099] lstrlenA (lpString="*.doc") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.docx") returned 0
	[0064.099] lstrlenA (lpString="*.docx") returned 6
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.xls") returned 0
	[0064.099] lstrlenA (lpString="*.xls") returned 5
	[0064.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.xlsx") returned 0
	[0064.099] lstrlenA (lpString="*.xlsx") returned 6
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ppt") returned 0
	[0064.100] lstrlenA (lpString="*.ppt") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pptx") returned 0
	[0064.100] lstrlenA (lpString="*.pptx") returned 6
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.txt") returned 0
	[0064.100] lstrlenA (lpString="*.txt") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pdf") returned 0
	[0064.100] lstrlenA (lpString="*.pdf") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.djvu") returned 0
	[0064.100] lstrlenA (lpString="*.djvu") returned 6
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.htm") returned 0
	[0064.100] lstrlenA (lpString="*.htm") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.html") returned 0
	[0064.100] lstrlenA (lpString="*.html") returned 6
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mdb") returned 0
	[0064.100] lstrlenA (lpString="*.mdb") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.cer") returned 0
	[0064.100] lstrlenA (lpString="*.cer") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.p12") returned 0
	[0064.100] lstrlenA (lpString="*.p12") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pfx") returned 0
	[0064.100] lstrlenA (lpString="*.pfx") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.kwm") returned 0
	[0064.100] lstrlenA (lpString="*.kwm") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pwm") returned 0
	[0064.100] lstrlenA (lpString="*.pwm") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.1cd") returned 0
	[0064.100] lstrlenA (lpString="*.1cd") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.md") returned 0
	[0064.100] lstrlenA (lpString="*.md") returned 4
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mdf") returned 0
	[0064.100] lstrlenA (lpString="*.mdf") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.dbf") returned 0
	[0064.100] lstrlenA (lpString="*.dbf") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.odt") returned 0
	[0064.100] lstrlenA (lpString="*.odt") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.vob") returned 0
	[0064.100] lstrlenA (lpString="*.vob") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ifo") returned 0
	[0064.100] lstrlenA (lpString="*.ifo") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.lnk") returned 0
	[0064.100] lstrlenA (lpString="*.lnk") returned 5
	[0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.torrent") returned 0
	[0064.100] lstrlenA (lpString="*.torrent") returned 9
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mov") returned 0
	[0064.101] lstrlenA (lpString="*.mov") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.m2v") returned 0
	[0064.101] lstrlenA (lpString="*.m2v") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.3gp") returned 0
	[0064.101] lstrlenA (lpString="*.3gp") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mpeg") returned 0
	[0064.101] lstrlenA (lpString="*.mpeg") returned 6
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mpg") returned 0
	[0064.101] lstrlenA (lpString="*.mpg") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.flv") returned 0
	[0064.101] lstrlenA (lpString="*.flv") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.avi") returned 0
	[0064.101] lstrlenA (lpString="*.avi") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mp4") returned 0
	[0064.101] lstrlenA (lpString="*.mp4") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wmv") returned 0
	[0064.101] lstrlenA (lpString="*.wmv") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.divx") returned 0
	[0064.101] lstrlenA (lpString="*.divx") returned 6
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mkv") returned 0
	[0064.101] lstrlenA (lpString="*.mkv") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mp3") returned 0
	[0064.101] lstrlenA (lpString="*.mp3") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wav") returned 0
	[0064.101] lstrlenA (lpString="*.wav") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.flac") returned 0
	[0064.101] lstrlenA (lpString="*.flac") returned 6
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ape") returned 0
	[0064.101] lstrlenA (lpString="*.ape") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wma") returned 0
	[0064.101] lstrlenA (lpString="*.wma") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ac3") returned 0
	[0064.101] lstrlenA (lpString="*.ac3") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.exe") returned 0
	[0064.101] lstrlenA (lpString="*.exe") returned 5
	[0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.apk") returned 0
	[0064.101] lstrlenA (lpString="*.apk") returned 5
	[0064.101] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.101] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1
	[0064.101] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1
	[0064.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned="BrightOrange.css"
	[0064.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightYellow" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow"
	[0064.101] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow") returned 107
	[0064.102] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.102] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.102] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.102] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.102] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.102] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.102] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.102] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0064.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0064.102] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0064.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*") returned="*.*"
	[0064.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\"
	[0064.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned=""
	[0064.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt"
	[0064.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0xffffffff
	[0064.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.103] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.103] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.104] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.104] CloseHandle (hObject=0xa0) returned 1
	[0064.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF"
	[0064.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0064.104] lstrlenA (lpString="*.zip") returned 5
	[0064.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0064.104] lstrlenA (lpString="*.rar") returned 5
	[0064.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0064.104] lstrlenA (lpString="*.7z") returned 4
	[0064.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0064.104] lstrlenA (lpString="*.tar") returned 5
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0064.105] lstrlenA (lpString="*.gzip") returned 6
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0064.105] lstrlenA (lpString="*.jpg") returned 5
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0064.105] lstrlenA (lpString="*.jpeg") returned 6
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0064.105] lstrlenA (lpString="*.psd") returned 5
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0064.105] lstrlenA (lpString="*.cdr") returned 5
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0064.105] lstrlenA (lpString="*.dwg") returned 5
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.max") returned 0
	[0064.105] lstrlenA (lpString="*.max") returned 5
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0064.105] lstrlenA (lpString="*.bmp") returned 5
	[0064.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0064.105] lstrlenA (lpString="*.gif") returned 5
	[0064.105] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF"
	[0064.105] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF"
	[0064.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF."
	[0064.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.Boom"
	[0064.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.106] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f
	[0064.106] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.106] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.106] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14c, lpOverlapped=0x0) returned 1
	[0064.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF"
	[0064.107] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.107] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14c, lpOverlapped=0x0) returned 1
	[0064.107] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.107] CloseHandle (hObject=0xa0) returned 1
	[0064.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif.boom")) returned 1
	[0064.107] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.107] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.107] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.107] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF"
	[0064.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\"
	[0064.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned=""
	[0064.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt"
	[0064.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20
	[0064.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF"
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.108] lstrlenA (lpString="*.zip") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.108] lstrlenA (lpString="*.rar") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.108] lstrlenA (lpString="*.7z") returned 4
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.108] lstrlenA (lpString="*.tar") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.108] lstrlenA (lpString="*.gzip") returned 6
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.108] lstrlenA (lpString="*.jpg") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.108] lstrlenA (lpString="*.jpeg") returned 6
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.108] lstrlenA (lpString="*.psd") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.108] lstrlenA (lpString="*.cdr") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.108] lstrlenA (lpString="*.dwg") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.108] lstrlenA (lpString="*.max") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.108] lstrlenA (lpString="*.bmp") returned 5
	[0064.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.108] lstrlenA (lpString="*.gif") returned 5
	[0064.108] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF"
	[0064.108] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF"
	[0064.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF."
	[0064.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.Boom"
	[0064.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.109] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.109] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.109] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.109] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.109] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.110] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.110] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.110] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.110] CloseHandle (hObject=0xa0) returned 1
	[0064.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif.boom")) returned 1
	[0064.110] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.110] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.110] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.110] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\"
	[0064.110] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned=""
	[0064.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt"
	[0064.110] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20
	[0064.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF"
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.111] lstrlenA (lpString="*.zip") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.111] lstrlenA (lpString="*.rar") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.111] lstrlenA (lpString="*.7z") returned 4
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.111] lstrlenA (lpString="*.tar") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.111] lstrlenA (lpString="*.gzip") returned 6
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.111] lstrlenA (lpString="*.jpg") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.111] lstrlenA (lpString="*.jpeg") returned 6
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.111] lstrlenA (lpString="*.psd") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.111] lstrlenA (lpString="*.cdr") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.111] lstrlenA (lpString="*.dwg") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.111] lstrlenA (lpString="*.max") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.111] lstrlenA (lpString="*.bmp") returned 5
	[0064.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.111] lstrlenA (lpString="*.gif") returned 5
	[0064.111] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF"
	[0064.111] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF"
	[0064.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF."
	[0064.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.Boom"
	[0064.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.112] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.112] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1
	[0064.112] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.112] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.113] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.113] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.113] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.113] CloseHandle (hObject=0xa0) returned 1
	[0064.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif.boom")) returned 1
	[0064.113] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.113] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.113] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.113] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.113] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightYellow.css") returned 1
	[0064.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightYellow.css") returned 1
	[0064.113] lstrcmpiA (lpString1="", lpString2="BrightYellow.css") returned -1
	[0064.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightYellow.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css"
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.zip") returned 0
	[0064.114] lstrlenA (lpString="*.zip") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.rar") returned 0
	[0064.114] lstrlenA (lpString="*.rar") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.7z") returned 0
	[0064.114] lstrlenA (lpString="*.7z") returned 4
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.tar") returned 0
	[0064.114] lstrlenA (lpString="*.tar") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.gzip") returned 0
	[0064.114] lstrlenA (lpString="*.gzip") returned 6
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.jpg") returned 0
	[0064.114] lstrlenA (lpString="*.jpg") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.jpeg") returned 0
	[0064.114] lstrlenA (lpString="*.jpeg") returned 6
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.psd") returned 0
	[0064.114] lstrlenA (lpString="*.psd") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.cdr") returned 0
	[0064.114] lstrlenA (lpString="*.cdr") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.dwg") returned 0
	[0064.114] lstrlenA (lpString="*.dwg") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.max") returned 0
	[0064.114] lstrlenA (lpString="*.max") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.bmp") returned 0
	[0064.114] lstrlenA (lpString="*.bmp") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.gif") returned 0
	[0064.114] lstrlenA (lpString="*.gif") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.png") returned 0
	[0064.114] lstrlenA (lpString="*.png") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.doc") returned 0
	[0064.114] lstrlenA (lpString="*.doc") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.docx") returned 0
	[0064.114] lstrlenA (lpString="*.docx") returned 6
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.xls") returned 0
	[0064.114] lstrlenA (lpString="*.xls") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.xlsx") returned 0
	[0064.114] lstrlenA (lpString="*.xlsx") returned 6
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ppt") returned 0
	[0064.114] lstrlenA (lpString="*.ppt") returned 5
	[0064.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pptx") returned 0
	[0064.115] lstrlenA (lpString="*.pptx") returned 6
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.txt") returned 0
	[0064.115] lstrlenA (lpString="*.txt") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pdf") returned 0
	[0064.115] lstrlenA (lpString="*.pdf") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.djvu") returned 0
	[0064.115] lstrlenA (lpString="*.djvu") returned 6
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.htm") returned 0
	[0064.115] lstrlenA (lpString="*.htm") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.html") returned 0
	[0064.115] lstrlenA (lpString="*.html") returned 6
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mdb") returned 0
	[0064.115] lstrlenA (lpString="*.mdb") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.cer") returned 0
	[0064.115] lstrlenA (lpString="*.cer") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.p12") returned 0
	[0064.115] lstrlenA (lpString="*.p12") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pfx") returned 0
	[0064.115] lstrlenA (lpString="*.pfx") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.kwm") returned 0
	[0064.115] lstrlenA (lpString="*.kwm") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pwm") returned 0
	[0064.115] lstrlenA (lpString="*.pwm") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.1cd") returned 0
	[0064.115] lstrlenA (lpString="*.1cd") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.md") returned 0
	[0064.115] lstrlenA (lpString="*.md") returned 4
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mdf") returned 0
	[0064.115] lstrlenA (lpString="*.mdf") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.dbf") returned 0
	[0064.115] lstrlenA (lpString="*.dbf") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.odt") returned 0
	[0064.115] lstrlenA (lpString="*.odt") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.vob") returned 0
	[0064.115] lstrlenA (lpString="*.vob") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ifo") returned 0
	[0064.115] lstrlenA (lpString="*.ifo") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.lnk") returned 0
	[0064.115] lstrlenA (lpString="*.lnk") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.torrent") returned 0
	[0064.115] lstrlenA (lpString="*.torrent") returned 9
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mov") returned 0
	[0064.115] lstrlenA (lpString="*.mov") returned 5
	[0064.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.m2v") returned 0
	[0064.115] lstrlenA (lpString="*.m2v") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.3gp") returned 0
	[0064.116] lstrlenA (lpString="*.3gp") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mpeg") returned 0
	[0064.116] lstrlenA (lpString="*.mpeg") returned 6
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mpg") returned 0
	[0064.116] lstrlenA (lpString="*.mpg") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.flv") returned 0
	[0064.116] lstrlenA (lpString="*.flv") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.avi") returned 0
	[0064.116] lstrlenA (lpString="*.avi") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mp4") returned 0
	[0064.116] lstrlenA (lpString="*.mp4") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wmv") returned 0
	[0064.116] lstrlenA (lpString="*.wmv") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.divx") returned 0
	[0064.116] lstrlenA (lpString="*.divx") returned 6
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mkv") returned 0
	[0064.116] lstrlenA (lpString="*.mkv") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mp3") returned 0
	[0064.116] lstrlenA (lpString="*.mp3") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wav") returned 0
	[0064.116] lstrlenA (lpString="*.wav") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.flac") returned 0
	[0064.116] lstrlenA (lpString="*.flac") returned 6
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ape") returned 0
	[0064.116] lstrlenA (lpString="*.ape") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wma") returned 0
	[0064.116] lstrlenA (lpString="*.wma") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ac3") returned 0
	[0064.116] lstrlenA (lpString="*.ac3") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.exe") returned 0
	[0064.116] lstrlenA (lpString="*.exe") returned 5
	[0064.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.apk") returned 0
	[0064.116] lstrlenA (lpString="*.apk") returned 5
	[0064.116] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.116] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.116] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Casual.css") returned 1
	[0064.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Casual.css") returned 1
	[0064.116] lstrcmpiA (lpString1="", lpString2="Casual.css") returned -1
	[0064.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned="BrightYellow.css"
	[0064.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.117] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Casual.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css"
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.zip") returned 0
	[0064.117] lstrlenA (lpString="*.zip") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.rar") returned 0
	[0064.117] lstrlenA (lpString="*.rar") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.7z") returned 0
	[0064.117] lstrlenA (lpString="*.7z") returned 4
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.tar") returned 0
	[0064.117] lstrlenA (lpString="*.tar") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.gzip") returned 0
	[0064.117] lstrlenA (lpString="*.gzip") returned 6
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.jpg") returned 0
	[0064.117] lstrlenA (lpString="*.jpg") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.jpeg") returned 0
	[0064.117] lstrlenA (lpString="*.jpeg") returned 6
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.psd") returned 0
	[0064.117] lstrlenA (lpString="*.psd") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.cdr") returned 0
	[0064.117] lstrlenA (lpString="*.cdr") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.dwg") returned 0
	[0064.117] lstrlenA (lpString="*.dwg") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.max") returned 0
	[0064.117] lstrlenA (lpString="*.max") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.bmp") returned 0
	[0064.117] lstrlenA (lpString="*.bmp") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.gif") returned 0
	[0064.117] lstrlenA (lpString="*.gif") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.png") returned 0
	[0064.117] lstrlenA (lpString="*.png") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.doc") returned 0
	[0064.117] lstrlenA (lpString="*.doc") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.docx") returned 0
	[0064.117] lstrlenA (lpString="*.docx") returned 6
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.xls") returned 0
	[0064.117] lstrlenA (lpString="*.xls") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.xlsx") returned 0
	[0064.117] lstrlenA (lpString="*.xlsx") returned 6
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ppt") returned 0
	[0064.117] lstrlenA (lpString="*.ppt") returned 5
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pptx") returned 0
	[0064.117] lstrlenA (lpString="*.pptx") returned 6
	[0064.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.txt") returned 0
	[0064.118] lstrlenA (lpString="*.txt") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pdf") returned 0
	[0064.118] lstrlenA (lpString="*.pdf") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.djvu") returned 0
	[0064.118] lstrlenA (lpString="*.djvu") returned 6
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.htm") returned 0
	[0064.118] lstrlenA (lpString="*.htm") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.html") returned 0
	[0064.118] lstrlenA (lpString="*.html") returned 6
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mdb") returned 0
	[0064.118] lstrlenA (lpString="*.mdb") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.cer") returned 0
	[0064.118] lstrlenA (lpString="*.cer") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.p12") returned 0
	[0064.118] lstrlenA (lpString="*.p12") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pfx") returned 0
	[0064.118] lstrlenA (lpString="*.pfx") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.kwm") returned 0
	[0064.118] lstrlenA (lpString="*.kwm") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pwm") returned 0
	[0064.118] lstrlenA (lpString="*.pwm") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.1cd") returned 0
	[0064.118] lstrlenA (lpString="*.1cd") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.md") returned 0
	[0064.118] lstrlenA (lpString="*.md") returned 4
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mdf") returned 0
	[0064.118] lstrlenA (lpString="*.mdf") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.dbf") returned 0
	[0064.118] lstrlenA (lpString="*.dbf") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.odt") returned 0
	[0064.118] lstrlenA (lpString="*.odt") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.vob") returned 0
	[0064.118] lstrlenA (lpString="*.vob") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ifo") returned 0
	[0064.118] lstrlenA (lpString="*.ifo") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.lnk") returned 0
	[0064.118] lstrlenA (lpString="*.lnk") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.torrent") returned 0
	[0064.118] lstrlenA (lpString="*.torrent") returned 9
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mov") returned 0
	[0064.118] lstrlenA (lpString="*.mov") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.m2v") returned 0
	[0064.118] lstrlenA (lpString="*.m2v") returned 5
	[0064.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.3gp") returned 0
	[0064.118] lstrlenA (lpString="*.3gp") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mpeg") returned 0
	[0064.119] lstrlenA (lpString="*.mpeg") returned 6
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mpg") returned 0
	[0064.119] lstrlenA (lpString="*.mpg") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.flv") returned 0
	[0064.119] lstrlenA (lpString="*.flv") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.avi") returned 0
	[0064.119] lstrlenA (lpString="*.avi") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mp4") returned 0
	[0064.119] lstrlenA (lpString="*.mp4") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wmv") returned 0
	[0064.119] lstrlenA (lpString="*.wmv") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.divx") returned 0
	[0064.119] lstrlenA (lpString="*.divx") returned 6
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mkv") returned 0
	[0064.119] lstrlenA (lpString="*.mkv") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mp3") returned 0
	[0064.119] lstrlenA (lpString="*.mp3") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wav") returned 0
	[0064.119] lstrlenA (lpString="*.wav") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.flac") returned 0
	[0064.119] lstrlenA (lpString="*.flac") returned 6
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ape") returned 0
	[0064.119] lstrlenA (lpString="*.ape") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wma") returned 0
	[0064.119] lstrlenA (lpString="*.wma") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ac3") returned 0
	[0064.119] lstrlenA (lpString="*.ac3") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.exe") returned 0
	[0064.119] lstrlenA (lpString="*.exe") returned 5
	[0064.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.apk") returned 0
	[0064.119] lstrlenA (lpString="*.apk") returned 5
	[0064.119] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.119] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.119] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Country.css") returned 1
	[0064.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Country.css") returned 1
	[0064.119] lstrcmpiA (lpString1="", lpString2="Country.css") returned -1
	[0064.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned="Casual.css"
	[0064.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.119] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.119] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Country.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css"
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.zip") returned 0
	[0064.120] lstrlenA (lpString="*.zip") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.rar") returned 0
	[0064.120] lstrlenA (lpString="*.rar") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.7z") returned 0
	[0064.120] lstrlenA (lpString="*.7z") returned 4
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.tar") returned 0
	[0064.120] lstrlenA (lpString="*.tar") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.gzip") returned 0
	[0064.120] lstrlenA (lpString="*.gzip") returned 6
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.jpg") returned 0
	[0064.120] lstrlenA (lpString="*.jpg") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.jpeg") returned 0
	[0064.120] lstrlenA (lpString="*.jpeg") returned 6
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.psd") returned 0
	[0064.120] lstrlenA (lpString="*.psd") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.cdr") returned 0
	[0064.120] lstrlenA (lpString="*.cdr") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.dwg") returned 0
	[0064.120] lstrlenA (lpString="*.dwg") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.max") returned 0
	[0064.120] lstrlenA (lpString="*.max") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.bmp") returned 0
	[0064.120] lstrlenA (lpString="*.bmp") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.gif") returned 0
	[0064.120] lstrlenA (lpString="*.gif") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.png") returned 0
	[0064.120] lstrlenA (lpString="*.png") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.doc") returned 0
	[0064.120] lstrlenA (lpString="*.doc") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.docx") returned 0
	[0064.120] lstrlenA (lpString="*.docx") returned 6
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.xls") returned 0
	[0064.120] lstrlenA (lpString="*.xls") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.xlsx") returned 0
	[0064.120] lstrlenA (lpString="*.xlsx") returned 6
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ppt") returned 0
	[0064.120] lstrlenA (lpString="*.ppt") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pptx") returned 0
	[0064.120] lstrlenA (lpString="*.pptx") returned 6
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.txt") returned 0
	[0064.120] lstrlenA (lpString="*.txt") returned 5
	[0064.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pdf") returned 0
	[0064.121] lstrlenA (lpString="*.pdf") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.djvu") returned 0
	[0064.121] lstrlenA (lpString="*.djvu") returned 6
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.htm") returned 0
	[0064.121] lstrlenA (lpString="*.htm") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.html") returned 0
	[0064.121] lstrlenA (lpString="*.html") returned 6
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mdb") returned 0
	[0064.121] lstrlenA (lpString="*.mdb") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.cer") returned 0
	[0064.121] lstrlenA (lpString="*.cer") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.p12") returned 0
	[0064.121] lstrlenA (lpString="*.p12") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pfx") returned 0
	[0064.121] lstrlenA (lpString="*.pfx") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.kwm") returned 0
	[0064.121] lstrlenA (lpString="*.kwm") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pwm") returned 0
	[0064.121] lstrlenA (lpString="*.pwm") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.1cd") returned 0
	[0064.121] lstrlenA (lpString="*.1cd") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.md") returned 0
	[0064.121] lstrlenA (lpString="*.md") returned 4
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mdf") returned 0
	[0064.121] lstrlenA (lpString="*.mdf") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.dbf") returned 0
	[0064.121] lstrlenA (lpString="*.dbf") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.odt") returned 0
	[0064.121] lstrlenA (lpString="*.odt") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.vob") returned 0
	[0064.121] lstrlenA (lpString="*.vob") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ifo") returned 0
	[0064.121] lstrlenA (lpString="*.ifo") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.lnk") returned 0
	[0064.121] lstrlenA (lpString="*.lnk") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.torrent") returned 0
	[0064.121] lstrlenA (lpString="*.torrent") returned 9
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mov") returned 0
	[0064.121] lstrlenA (lpString="*.mov") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.m2v") returned 0
	[0064.121] lstrlenA (lpString="*.m2v") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.3gp") returned 0
	[0064.121] lstrlenA (lpString="*.3gp") returned 5
	[0064.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mpeg") returned 0
	[0064.121] lstrlenA (lpString="*.mpeg") returned 6
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mpg") returned 0
	[0064.122] lstrlenA (lpString="*.mpg") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.flv") returned 0
	[0064.122] lstrlenA (lpString="*.flv") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.avi") returned 0
	[0064.122] lstrlenA (lpString="*.avi") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mp4") returned 0
	[0064.122] lstrlenA (lpString="*.mp4") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wmv") returned 0
	[0064.122] lstrlenA (lpString="*.wmv") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.divx") returned 0
	[0064.122] lstrlenA (lpString="*.divx") returned 6
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mkv") returned 0
	[0064.122] lstrlenA (lpString="*.mkv") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mp3") returned 0
	[0064.122] lstrlenA (lpString="*.mp3") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wav") returned 0
	[0064.122] lstrlenA (lpString="*.wav") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.flac") returned 0
	[0064.122] lstrlenA (lpString="*.flac") returned 6
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ape") returned 0
	[0064.122] lstrlenA (lpString="*.ape") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wma") returned 0
	[0064.122] lstrlenA (lpString="*.wma") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ac3") returned 0
	[0064.122] lstrlenA (lpString="*.ac3") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.exe") returned 0
	[0064.122] lstrlenA (lpString="*.exe") returned 5
	[0064.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.apk") returned 0
	[0064.122] lstrlenA (lpString="*.apk") returned 5
	[0064.122] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.122] lstrcmpA (lpString1=".", lpString2="Desert") returned -1
	[0064.122] lstrcmpA (lpString1="..", lpString2="Desert") returned -1
	[0064.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned="Country.css"
	[0064.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Desert" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert"
	[0064.122] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert") returned 101
	[0064.122] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.123] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.123] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.123] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.123] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.123] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.123] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.123] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0064.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0064.123] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0064.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*") returned="*.*"
	[0064.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\"
	[0064.123] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned=""
	[0064.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt"
	[0064.123] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt")) returned 0xffffffff
	[0064.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.124] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.124] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.125] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.125] CloseHandle (hObject=0xa0) returned 1
	[0064.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF"
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0064.125] lstrlenA (lpString="*.zip") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0064.125] lstrlenA (lpString="*.rar") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0064.125] lstrlenA (lpString="*.7z") returned 4
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0064.125] lstrlenA (lpString="*.tar") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0064.125] lstrlenA (lpString="*.gzip") returned 6
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0064.125] lstrlenA (lpString="*.jpg") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0064.125] lstrlenA (lpString="*.jpeg") returned 6
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0064.125] lstrlenA (lpString="*.psd") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0064.125] lstrlenA (lpString="*.cdr") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0064.125] lstrlenA (lpString="*.dwg") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.max") returned 0
	[0064.125] lstrlenA (lpString="*.max") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0064.125] lstrlenA (lpString="*.bmp") returned 5
	[0064.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0064.125] lstrlenA (lpString="*.gif") returned 5
	[0064.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF"
	[0064.125] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF"
	[0064.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF."
	[0064.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.Boom"
	[0064.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.126] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94
	[0064.126] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1
	[0064.126] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.126] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x71, lpOverlapped=0x0) returned 1
	[0064.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF"
	[0064.127] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.127] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x71, lpOverlapped=0x0) returned 1
	[0064.127] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.127] CloseHandle (hObject=0xa0) returned 1
	[0064.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif.boom")) returned 1
	[0064.127] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.127] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.127] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.127] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF"
	[0064.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\"
	[0064.128] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned=""
	[0064.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt"
	[0064.128] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20
	[0064.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF"
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.128] lstrlenA (lpString="*.zip") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.128] lstrlenA (lpString="*.rar") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.128] lstrlenA (lpString="*.7z") returned 4
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.128] lstrlenA (lpString="*.tar") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.128] lstrlenA (lpString="*.gzip") returned 6
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.128] lstrlenA (lpString="*.jpg") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.128] lstrlenA (lpString="*.jpeg") returned 6
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.128] lstrlenA (lpString="*.psd") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.128] lstrlenA (lpString="*.cdr") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.128] lstrlenA (lpString="*.dwg") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.128] lstrlenA (lpString="*.max") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.128] lstrlenA (lpString="*.bmp") returned 5
	[0064.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.128] lstrlenA (lpString="*.gif") returned 5
	[0064.128] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF"
	[0064.128] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF"
	[0064.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF."
	[0064.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.Boom"
	[0064.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.129] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0
	[0064.129] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1
	[0064.129] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.129] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1cd, lpOverlapped=0x0) returned 1
	[0064.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.129] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.130] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1cd, lpOverlapped=0x0) returned 1
	[0064.130] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.130] CloseHandle (hObject=0xa0) returned 1
	[0064.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif.boom")) returned 1
	[0064.134] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.134] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.134] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\"
	[0064.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned=""
	[0064.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt"
	[0064.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20
	[0064.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF"
	[0064.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.135] lstrlenA (lpString="*.zip") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.135] lstrlenA (lpString="*.rar") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.135] lstrlenA (lpString="*.7z") returned 4
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.135] lstrlenA (lpString="*.tar") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.135] lstrlenA (lpString="*.gzip") returned 6
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.135] lstrlenA (lpString="*.jpg") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.135] lstrlenA (lpString="*.jpeg") returned 6
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.135] lstrlenA (lpString="*.psd") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.135] lstrlenA (lpString="*.cdr") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.135] lstrlenA (lpString="*.dwg") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.135] lstrlenA (lpString="*.max") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.135] lstrlenA (lpString="*.bmp") returned 5
	[0064.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.135] lstrlenA (lpString="*.gif") returned 5
	[0064.135] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF"
	[0064.135] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF"
	[0064.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF."
	[0064.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.Boom"
	[0064.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.136] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401
	[0064.136] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1
	[0064.136] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.136] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3de, lpOverlapped=0x0) returned 1
	[0064.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.137] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.137] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3de, lpOverlapped=0x0) returned 1
	[0064.137] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.137] CloseHandle (hObject=0xa0) returned 1
	[0064.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif.boom")) returned 1
	[0064.138] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.138] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.138] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.138] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.138] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Desert.css") returned 1
	[0064.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desert.css") returned 1
	[0064.138] lstrcmpiA (lpString1="", lpString2="Desert.css") returned -1
	[0064.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.138] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Desert.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css"
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.zip") returned 0
	[0064.138] lstrlenA (lpString="*.zip") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.rar") returned 0
	[0064.138] lstrlenA (lpString="*.rar") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.7z") returned 0
	[0064.138] lstrlenA (lpString="*.7z") returned 4
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.tar") returned 0
	[0064.138] lstrlenA (lpString="*.tar") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.gzip") returned 0
	[0064.138] lstrlenA (lpString="*.gzip") returned 6
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.jpg") returned 0
	[0064.138] lstrlenA (lpString="*.jpg") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.jpeg") returned 0
	[0064.138] lstrlenA (lpString="*.jpeg") returned 6
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.psd") returned 0
	[0064.138] lstrlenA (lpString="*.psd") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.cdr") returned 0
	[0064.138] lstrlenA (lpString="*.cdr") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.dwg") returned 0
	[0064.138] lstrlenA (lpString="*.dwg") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.max") returned 0
	[0064.138] lstrlenA (lpString="*.max") returned 5
	[0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.bmp") returned 0
	[0064.138] lstrlenA (lpString="*.bmp") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.gif") returned 0
	[0064.139] lstrlenA (lpString="*.gif") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.png") returned 0
	[0064.139] lstrlenA (lpString="*.png") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.doc") returned 0
	[0064.139] lstrlenA (lpString="*.doc") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.docx") returned 0
	[0064.139] lstrlenA (lpString="*.docx") returned 6
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.xls") returned 0
	[0064.139] lstrlenA (lpString="*.xls") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.xlsx") returned 0
	[0064.139] lstrlenA (lpString="*.xlsx") returned 6
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ppt") returned 0
	[0064.139] lstrlenA (lpString="*.ppt") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pptx") returned 0
	[0064.139] lstrlenA (lpString="*.pptx") returned 6
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.txt") returned 0
	[0064.139] lstrlenA (lpString="*.txt") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pdf") returned 0
	[0064.139] lstrlenA (lpString="*.pdf") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.djvu") returned 0
	[0064.139] lstrlenA (lpString="*.djvu") returned 6
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.htm") returned 0
	[0064.139] lstrlenA (lpString="*.htm") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.html") returned 0
	[0064.139] lstrlenA (lpString="*.html") returned 6
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mdb") returned 0
	[0064.139] lstrlenA (lpString="*.mdb") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.cer") returned 0
	[0064.139] lstrlenA (lpString="*.cer") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.p12") returned 0
	[0064.139] lstrlenA (lpString="*.p12") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pfx") returned 0
	[0064.139] lstrlenA (lpString="*.pfx") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.kwm") returned 0
	[0064.139] lstrlenA (lpString="*.kwm") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pwm") returned 0
	[0064.139] lstrlenA (lpString="*.pwm") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.1cd") returned 0
	[0064.139] lstrlenA (lpString="*.1cd") returned 5
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.md") returned 0
	[0064.139] lstrlenA (lpString="*.md") returned 4
	[0064.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mdf") returned 0
	[0064.139] lstrlenA (lpString="*.mdf") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.dbf") returned 0
	[0064.140] lstrlenA (lpString="*.dbf") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.odt") returned 0
	[0064.140] lstrlenA (lpString="*.odt") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.vob") returned 0
	[0064.140] lstrlenA (lpString="*.vob") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ifo") returned 0
	[0064.140] lstrlenA (lpString="*.ifo") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.lnk") returned 0
	[0064.140] lstrlenA (lpString="*.lnk") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.torrent") returned 0
	[0064.140] lstrlenA (lpString="*.torrent") returned 9
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mov") returned 0
	[0064.140] lstrlenA (lpString="*.mov") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.m2v") returned 0
	[0064.140] lstrlenA (lpString="*.m2v") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.3gp") returned 0
	[0064.140] lstrlenA (lpString="*.3gp") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mpeg") returned 0
	[0064.140] lstrlenA (lpString="*.mpeg") returned 6
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mpg") returned 0
	[0064.140] lstrlenA (lpString="*.mpg") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.flv") returned 0
	[0064.140] lstrlenA (lpString="*.flv") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.avi") returned 0
	[0064.140] lstrlenA (lpString="*.avi") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mp4") returned 0
	[0064.140] lstrlenA (lpString="*.mp4") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wmv") returned 0
	[0064.140] lstrlenA (lpString="*.wmv") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.divx") returned 0
	[0064.140] lstrlenA (lpString="*.divx") returned 6
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mkv") returned 0
	[0064.140] lstrlenA (lpString="*.mkv") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mp3") returned 0
	[0064.140] lstrlenA (lpString="*.mp3") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wav") returned 0
	[0064.140] lstrlenA (lpString="*.wav") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.flac") returned 0
	[0064.140] lstrlenA (lpString="*.flac") returned 6
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ape") returned 0
	[0064.140] lstrlenA (lpString="*.ape") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wma") returned 0
	[0064.140] lstrlenA (lpString="*.wma") returned 5
	[0064.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ac3") returned 0
	[0064.141] lstrlenA (lpString="*.ac3") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.exe") returned 0
	[0064.141] lstrlenA (lpString="*.exe") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.apk") returned 0
	[0064.141] lstrlenA (lpString="*.apk") returned 5
	[0064.141] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.141] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.141] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Earthy.css") returned -1
	[0064.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Earthy.css") returned 1
	[0064.141] lstrcmpiA (lpString1="", lpString2="Earthy.css") returned -1
	[0064.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned="Desert.css"
	[0064.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.141] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.141] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Earthy.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css"
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.zip") returned 0
	[0064.141] lstrlenA (lpString="*.zip") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.rar") returned 0
	[0064.141] lstrlenA (lpString="*.rar") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.7z") returned 0
	[0064.141] lstrlenA (lpString="*.7z") returned 4
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.tar") returned 0
	[0064.141] lstrlenA (lpString="*.tar") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.gzip") returned 0
	[0064.141] lstrlenA (lpString="*.gzip") returned 6
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.jpg") returned 0
	[0064.141] lstrlenA (lpString="*.jpg") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.jpeg") returned 0
	[0064.141] lstrlenA (lpString="*.jpeg") returned 6
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.psd") returned 0
	[0064.141] lstrlenA (lpString="*.psd") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.cdr") returned 0
	[0064.141] lstrlenA (lpString="*.cdr") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.dwg") returned 0
	[0064.141] lstrlenA (lpString="*.dwg") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.max") returned 0
	[0064.141] lstrlenA (lpString="*.max") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.bmp") returned 0
	[0064.141] lstrlenA (lpString="*.bmp") returned 5
	[0064.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.gif") returned 0
	[0064.142] lstrlenA (lpString="*.gif") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.png") returned 0
	[0064.142] lstrlenA (lpString="*.png") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.doc") returned 0
	[0064.142] lstrlenA (lpString="*.doc") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.docx") returned 0
	[0064.142] lstrlenA (lpString="*.docx") returned 6
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.xls") returned 0
	[0064.142] lstrlenA (lpString="*.xls") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.xlsx") returned 0
	[0064.142] lstrlenA (lpString="*.xlsx") returned 6
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ppt") returned 0
	[0064.142] lstrlenA (lpString="*.ppt") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pptx") returned 0
	[0064.142] lstrlenA (lpString="*.pptx") returned 6
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.txt") returned 0
	[0064.142] lstrlenA (lpString="*.txt") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pdf") returned 0
	[0064.142] lstrlenA (lpString="*.pdf") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.djvu") returned 0
	[0064.142] lstrlenA (lpString="*.djvu") returned 6
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.htm") returned 0
	[0064.142] lstrlenA (lpString="*.htm") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.html") returned 0
	[0064.142] lstrlenA (lpString="*.html") returned 6
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mdb") returned 0
	[0064.142] lstrlenA (lpString="*.mdb") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.cer") returned 0
	[0064.142] lstrlenA (lpString="*.cer") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.p12") returned 0
	[0064.142] lstrlenA (lpString="*.p12") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pfx") returned 0
	[0064.142] lstrlenA (lpString="*.pfx") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.kwm") returned 0
	[0064.142] lstrlenA (lpString="*.kwm") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pwm") returned 0
	[0064.142] lstrlenA (lpString="*.pwm") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.1cd") returned 0
	[0064.142] lstrlenA (lpString="*.1cd") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.md") returned 0
	[0064.142] lstrlenA (lpString="*.md") returned 4
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mdf") returned 0
	[0064.142] lstrlenA (lpString="*.mdf") returned 5
	[0064.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.dbf") returned 0
	[0064.143] lstrlenA (lpString="*.dbf") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.odt") returned 0
	[0064.143] lstrlenA (lpString="*.odt") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.vob") returned 0
	[0064.143] lstrlenA (lpString="*.vob") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ifo") returned 0
	[0064.143] lstrlenA (lpString="*.ifo") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.lnk") returned 0
	[0064.143] lstrlenA (lpString="*.lnk") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.torrent") returned 0
	[0064.143] lstrlenA (lpString="*.torrent") returned 9
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mov") returned 0
	[0064.143] lstrlenA (lpString="*.mov") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.m2v") returned 0
	[0064.143] lstrlenA (lpString="*.m2v") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.3gp") returned 0
	[0064.143] lstrlenA (lpString="*.3gp") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mpeg") returned 0
	[0064.143] lstrlenA (lpString="*.mpeg") returned 6
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mpg") returned 0
	[0064.143] lstrlenA (lpString="*.mpg") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.flv") returned 0
	[0064.143] lstrlenA (lpString="*.flv") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.avi") returned 0
	[0064.143] lstrlenA (lpString="*.avi") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mp4") returned 0
	[0064.143] lstrlenA (lpString="*.mp4") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wmv") returned 0
	[0064.143] lstrlenA (lpString="*.wmv") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.divx") returned 0
	[0064.143] lstrlenA (lpString="*.divx") returned 6
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mkv") returned 0
	[0064.143] lstrlenA (lpString="*.mkv") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mp3") returned 0
	[0064.143] lstrlenA (lpString="*.mp3") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wav") returned 0
	[0064.143] lstrlenA (lpString="*.wav") returned 5
	[0064.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.flac") returned 0
	[0064.144] lstrlenA (lpString="*.flac") returned 6
	[0064.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ape") returned 0
	[0064.144] lstrlenA (lpString="*.ape") returned 5
	[0064.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wma") returned 0
	[0064.144] lstrlenA (lpString="*.wma") returned 5
	[0064.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ac3") returned 0
	[0064.144] lstrlenA (lpString="*.ac3") returned 5
	[0064.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.exe") returned 0
	[0064.144] lstrlenA (lpString="*.exe") returned 5
	[0064.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.apk") returned 0
	[0064.144] lstrlenA (lpString="*.apk") returned 5
	[0064.144] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.144] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1
	[0064.144] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1
	[0064.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned="Earthy.css"
	[0064.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GrayCheck" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck"
	[0064.144] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck") returned 104
	[0064.144] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.144] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.144] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.144] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.144] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.144] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.144] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0064.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0064.144] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0064.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*") returned="*.*"
	[0064.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\"
	[0064.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned=""
	[0064.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt"
	[0064.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0xffffffff
	[0064.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.145] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.145] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.146] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.147] CloseHandle (hObject=0xa0) returned 1
	[0064.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF"
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0064.147] lstrlenA (lpString="*.zip") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0064.147] lstrlenA (lpString="*.rar") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0064.147] lstrlenA (lpString="*.7z") returned 4
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0064.147] lstrlenA (lpString="*.tar") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0064.147] lstrlenA (lpString="*.gzip") returned 6
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0064.147] lstrlenA (lpString="*.jpg") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0064.147] lstrlenA (lpString="*.jpeg") returned 6
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0064.147] lstrlenA (lpString="*.psd") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0064.147] lstrlenA (lpString="*.cdr") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0064.147] lstrlenA (lpString="*.dwg") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.max") returned 0
	[0064.147] lstrlenA (lpString="*.max") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0064.147] lstrlenA (lpString="*.bmp") returned 5
	[0064.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0064.147] lstrlenA (lpString="*.gif") returned 5
	[0064.147] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF"
	[0064.147] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF"
	[0064.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF."
	[0064.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.Boom"
	[0064.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.148] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8
	[0064.148] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1
	[0064.148] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.148] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x195, lpOverlapped=0x0) returned 1
	[0064.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF"
	[0064.149] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.149] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x195, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x195, lpOverlapped=0x0) returned 1
	[0064.149] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.149] CloseHandle (hObject=0xa0) returned 1
	[0064.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif.boom")) returned 1
	[0064.150] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.151] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.151] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.151] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF"
	[0064.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\"
	[0064.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned=""
	[0064.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt"
	[0064.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20
	[0064.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF"
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.151] lstrlenA (lpString="*.zip") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.151] lstrlenA (lpString="*.rar") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.151] lstrlenA (lpString="*.7z") returned 4
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.151] lstrlenA (lpString="*.tar") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.151] lstrlenA (lpString="*.gzip") returned 6
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.151] lstrlenA (lpString="*.jpg") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.151] lstrlenA (lpString="*.jpeg") returned 6
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.151] lstrlenA (lpString="*.psd") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.151] lstrlenA (lpString="*.cdr") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.151] lstrlenA (lpString="*.dwg") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.151] lstrlenA (lpString="*.max") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.151] lstrlenA (lpString="*.bmp") returned 5
	[0064.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.151] lstrlenA (lpString="*.gif") returned 5
	[0064.151] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF"
	[0064.151] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF"
	[0064.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF."
	[0064.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.Boom"
	[0064.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.152] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.152] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1
	[0064.152] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.152] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.153] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.153] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.153] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.153] CloseHandle (hObject=0xa0) returned 1
	[0064.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif.boom")) returned 1
	[0064.154] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.154] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.154] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.154] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\"
	[0064.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned=""
	[0064.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt"
	[0064.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20
	[0064.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF"
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.154] lstrlenA (lpString="*.zip") returned 5
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.154] lstrlenA (lpString="*.rar") returned 5
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.154] lstrlenA (lpString="*.7z") returned 4
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.154] lstrlenA (lpString="*.tar") returned 5
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.154] lstrlenA (lpString="*.gzip") returned 6
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.154] lstrlenA (lpString="*.jpg") returned 5
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.154] lstrlenA (lpString="*.jpeg") returned 6
	[0064.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.155] lstrlenA (lpString="*.psd") returned 5
	[0064.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.155] lstrlenA (lpString="*.cdr") returned 5
	[0064.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.155] lstrlenA (lpString="*.dwg") returned 5
	[0064.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.155] lstrlenA (lpString="*.max") returned 5
	[0064.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.155] lstrlenA (lpString="*.bmp") returned 5
	[0064.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.155] lstrlenA (lpString="*.gif") returned 5
	[0064.155] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF"
	[0064.155] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF"
	[0064.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF."
	[0064.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.Boom"
	[0064.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.155] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.155] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1
	[0064.155] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.155] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.156] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.156] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.156] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.156] CloseHandle (hObject=0xa0) returned 1
	[0064.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif.boom")) returned 1
	[0064.157] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.157] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.157] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.157] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.157] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrayCheck.css") returned -1
	[0064.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrayCheck.css") returned 1
	[0064.157] lstrcmpiA (lpString1="", lpString2="GrayCheck.css") returned -1
	[0064.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GrayCheck.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css"
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.zip") returned 0
	[0064.157] lstrlenA (lpString="*.zip") returned 5
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.rar") returned 0
	[0064.157] lstrlenA (lpString="*.rar") returned 5
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.7z") returned 0
	[0064.157] lstrlenA (lpString="*.7z") returned 4
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.tar") returned 0
	[0064.157] lstrlenA (lpString="*.tar") returned 5
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.gzip") returned 0
	[0064.157] lstrlenA (lpString="*.gzip") returned 6
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.jpg") returned 0
	[0064.157] lstrlenA (lpString="*.jpg") returned 5
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.jpeg") returned 0
	[0064.157] lstrlenA (lpString="*.jpeg") returned 6
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.psd") returned 0
	[0064.157] lstrlenA (lpString="*.psd") returned 5
	[0064.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.cdr") returned 0
	[0064.158] lstrlenA (lpString="*.cdr") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.dwg") returned 0
	[0064.158] lstrlenA (lpString="*.dwg") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.max") returned 0
	[0064.158] lstrlenA (lpString="*.max") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.bmp") returned 0
	[0064.158] lstrlenA (lpString="*.bmp") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.gif") returned 0
	[0064.158] lstrlenA (lpString="*.gif") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.png") returned 0
	[0064.158] lstrlenA (lpString="*.png") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.doc") returned 0
	[0064.158] lstrlenA (lpString="*.doc") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.docx") returned 0
	[0064.158] lstrlenA (lpString="*.docx") returned 6
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.xls") returned 0
	[0064.158] lstrlenA (lpString="*.xls") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.xlsx") returned 0
	[0064.158] lstrlenA (lpString="*.xlsx") returned 6
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ppt") returned 0
	[0064.158] lstrlenA (lpString="*.ppt") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pptx") returned 0
	[0064.158] lstrlenA (lpString="*.pptx") returned 6
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.txt") returned 0
	[0064.158] lstrlenA (lpString="*.txt") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pdf") returned 0
	[0064.158] lstrlenA (lpString="*.pdf") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.djvu") returned 0
	[0064.158] lstrlenA (lpString="*.djvu") returned 6
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.htm") returned 0
	[0064.158] lstrlenA (lpString="*.htm") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.html") returned 0
	[0064.158] lstrlenA (lpString="*.html") returned 6
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mdb") returned 0
	[0064.158] lstrlenA (lpString="*.mdb") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.cer") returned 0
	[0064.158] lstrlenA (lpString="*.cer") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.p12") returned 0
	[0064.158] lstrlenA (lpString="*.p12") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pfx") returned 0
	[0064.158] lstrlenA (lpString="*.pfx") returned 5
	[0064.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.kwm") returned 0
	[0064.158] lstrlenA (lpString="*.kwm") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pwm") returned 0
	[0064.159] lstrlenA (lpString="*.pwm") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.1cd") returned 0
	[0064.159] lstrlenA (lpString="*.1cd") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.md") returned 0
	[0064.159] lstrlenA (lpString="*.md") returned 4
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mdf") returned 0
	[0064.159] lstrlenA (lpString="*.mdf") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.dbf") returned 0
	[0064.159] lstrlenA (lpString="*.dbf") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.odt") returned 0
	[0064.159] lstrlenA (lpString="*.odt") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.vob") returned 0
	[0064.159] lstrlenA (lpString="*.vob") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ifo") returned 0
	[0064.159] lstrlenA (lpString="*.ifo") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.lnk") returned 0
	[0064.159] lstrlenA (lpString="*.lnk") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.torrent") returned 0
	[0064.159] lstrlenA (lpString="*.torrent") returned 9
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mov") returned 0
	[0064.159] lstrlenA (lpString="*.mov") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.m2v") returned 0
	[0064.159] lstrlenA (lpString="*.m2v") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.3gp") returned 0
	[0064.159] lstrlenA (lpString="*.3gp") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mpeg") returned 0
	[0064.159] lstrlenA (lpString="*.mpeg") returned 6
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mpg") returned 0
	[0064.159] lstrlenA (lpString="*.mpg") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.flv") returned 0
	[0064.159] lstrlenA (lpString="*.flv") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.avi") returned 0
	[0064.159] lstrlenA (lpString="*.avi") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mp4") returned 0
	[0064.159] lstrlenA (lpString="*.mp4") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wmv") returned 0
	[0064.159] lstrlenA (lpString="*.wmv") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.divx") returned 0
	[0064.159] lstrlenA (lpString="*.divx") returned 6
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mkv") returned 0
	[0064.159] lstrlenA (lpString="*.mkv") returned 5
	[0064.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mp3") returned 0
	[0064.159] lstrlenA (lpString="*.mp3") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wav") returned 0
	[0064.160] lstrlenA (lpString="*.wav") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.flac") returned 0
	[0064.160] lstrlenA (lpString="*.flac") returned 6
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ape") returned 0
	[0064.160] lstrlenA (lpString="*.ape") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wma") returned 0
	[0064.160] lstrlenA (lpString="*.wma") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ac3") returned 0
	[0064.160] lstrlenA (lpString="*.ac3") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.exe") returned 0
	[0064.160] lstrlenA (lpString="*.exe") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.apk") returned 0
	[0064.160] lstrlenA (lpString="*.apk") returned 5
	[0064.160] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.160] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.160] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GreenTea.css") returned -1
	[0064.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenTea.css") returned 1
	[0064.160] lstrcmpiA (lpString1="", lpString2="GreenTea.css") returned -1
	[0064.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned="GrayCheck.css"
	[0064.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GreenTea.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css"
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.zip") returned 0
	[0064.160] lstrlenA (lpString="*.zip") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.rar") returned 0
	[0064.160] lstrlenA (lpString="*.rar") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.7z") returned 0
	[0064.160] lstrlenA (lpString="*.7z") returned 4
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.tar") returned 0
	[0064.160] lstrlenA (lpString="*.tar") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.gzip") returned 0
	[0064.160] lstrlenA (lpString="*.gzip") returned 6
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.jpg") returned 0
	[0064.160] lstrlenA (lpString="*.jpg") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.jpeg") returned 0
	[0064.160] lstrlenA (lpString="*.jpeg") returned 6
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.psd") returned 0
	[0064.160] lstrlenA (lpString="*.psd") returned 5
	[0064.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.cdr") returned 0
	[0064.161] lstrlenA (lpString="*.cdr") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.dwg") returned 0
	[0064.161] lstrlenA (lpString="*.dwg") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.max") returned 0
	[0064.161] lstrlenA (lpString="*.max") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.bmp") returned 0
	[0064.161] lstrlenA (lpString="*.bmp") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.gif") returned 0
	[0064.161] lstrlenA (lpString="*.gif") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.png") returned 0
	[0064.161] lstrlenA (lpString="*.png") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.doc") returned 0
	[0064.161] lstrlenA (lpString="*.doc") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.docx") returned 0
	[0064.161] lstrlenA (lpString="*.docx") returned 6
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.xls") returned 0
	[0064.161] lstrlenA (lpString="*.xls") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.xlsx") returned 0
	[0064.161] lstrlenA (lpString="*.xlsx") returned 6
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ppt") returned 0
	[0064.161] lstrlenA (lpString="*.ppt") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pptx") returned 0
	[0064.161] lstrlenA (lpString="*.pptx") returned 6
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.txt") returned 0
	[0064.161] lstrlenA (lpString="*.txt") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pdf") returned 0
	[0064.161] lstrlenA (lpString="*.pdf") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.djvu") returned 0
	[0064.161] lstrlenA (lpString="*.djvu") returned 6
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.htm") returned 0
	[0064.161] lstrlenA (lpString="*.htm") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.html") returned 0
	[0064.161] lstrlenA (lpString="*.html") returned 6
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mdb") returned 0
	[0064.161] lstrlenA (lpString="*.mdb") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.cer") returned 0
	[0064.161] lstrlenA (lpString="*.cer") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.p12") returned 0
	[0064.161] lstrlenA (lpString="*.p12") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pfx") returned 0
	[0064.161] lstrlenA (lpString="*.pfx") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.kwm") returned 0
	[0064.161] lstrlenA (lpString="*.kwm") returned 5
	[0064.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pwm") returned 0
	[0064.161] lstrlenA (lpString="*.pwm") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.1cd") returned 0
	[0064.162] lstrlenA (lpString="*.1cd") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.md") returned 0
	[0064.162] lstrlenA (lpString="*.md") returned 4
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mdf") returned 0
	[0064.162] lstrlenA (lpString="*.mdf") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.dbf") returned 0
	[0064.162] lstrlenA (lpString="*.dbf") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.odt") returned 0
	[0064.162] lstrlenA (lpString="*.odt") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.vob") returned 0
	[0064.162] lstrlenA (lpString="*.vob") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ifo") returned 0
	[0064.162] lstrlenA (lpString="*.ifo") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.lnk") returned 0
	[0064.162] lstrlenA (lpString="*.lnk") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.torrent") returned 0
	[0064.162] lstrlenA (lpString="*.torrent") returned 9
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mov") returned 0
	[0064.162] lstrlenA (lpString="*.mov") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.m2v") returned 0
	[0064.162] lstrlenA (lpString="*.m2v") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.3gp") returned 0
	[0064.162] lstrlenA (lpString="*.3gp") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mpeg") returned 0
	[0064.162] lstrlenA (lpString="*.mpeg") returned 6
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mpg") returned 0
	[0064.162] lstrlenA (lpString="*.mpg") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.flv") returned 0
	[0064.162] lstrlenA (lpString="*.flv") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.avi") returned 0
	[0064.162] lstrlenA (lpString="*.avi") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mp4") returned 0
	[0064.162] lstrlenA (lpString="*.mp4") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wmv") returned 0
	[0064.162] lstrlenA (lpString="*.wmv") returned 5
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.divx") returned 0
	[0064.162] lstrlenA (lpString="*.divx") returned 6
	[0064.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mkv") returned 0
	[0064.163] lstrlenA (lpString="*.mkv") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mp3") returned 0
	[0064.163] lstrlenA (lpString="*.mp3") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wav") returned 0
	[0064.163] lstrlenA (lpString="*.wav") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.flac") returned 0
	[0064.163] lstrlenA (lpString="*.flac") returned 6
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ape") returned 0
	[0064.163] lstrlenA (lpString="*.ape") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wma") returned 0
	[0064.163] lstrlenA (lpString="*.wma") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ac3") returned 0
	[0064.163] lstrlenA (lpString="*.ac3") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.exe") returned 0
	[0064.163] lstrlenA (lpString="*.exe") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.apk") returned 0
	[0064.163] lstrlenA (lpString="*.apk") returned 5
	[0064.163] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.163] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.163] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LightSpirit.css") returned -1
	[0064.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightSpirit.css") returned -1
	[0064.163] lstrcmpiA (lpString1="", lpString2="LightSpirit.css") returned -1
	[0064.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned="GreenTea.css"
	[0064.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="LightSpirit.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css"
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.zip") returned 0
	[0064.163] lstrlenA (lpString="*.zip") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.rar") returned 0
	[0064.163] lstrlenA (lpString="*.rar") returned 5
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.7z") returned 0
	[0064.163] lstrlenA (lpString="*.7z") returned 4
	[0064.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.tar") returned 0
	[0064.164] lstrlenA (lpString="*.tar") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.gzip") returned 0
	[0064.164] lstrlenA (lpString="*.gzip") returned 6
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.jpg") returned 0
	[0064.164] lstrlenA (lpString="*.jpg") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.jpeg") returned 0
	[0064.164] lstrlenA (lpString="*.jpeg") returned 6
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.psd") returned 0
	[0064.164] lstrlenA (lpString="*.psd") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.cdr") returned 0
	[0064.164] lstrlenA (lpString="*.cdr") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.dwg") returned 0
	[0064.164] lstrlenA (lpString="*.dwg") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.max") returned 0
	[0064.164] lstrlenA (lpString="*.max") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.bmp") returned 0
	[0064.164] lstrlenA (lpString="*.bmp") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.gif") returned 0
	[0064.164] lstrlenA (lpString="*.gif") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.png") returned 0
	[0064.164] lstrlenA (lpString="*.png") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.doc") returned 0
	[0064.164] lstrlenA (lpString="*.doc") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.docx") returned 0
	[0064.164] lstrlenA (lpString="*.docx") returned 6
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.xls") returned 0
	[0064.164] lstrlenA (lpString="*.xls") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.xlsx") returned 0
	[0064.164] lstrlenA (lpString="*.xlsx") returned 6
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ppt") returned 0
	[0064.164] lstrlenA (lpString="*.ppt") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pptx") returned 0
	[0064.164] lstrlenA (lpString="*.pptx") returned 6
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.txt") returned 0
	[0064.164] lstrlenA (lpString="*.txt") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pdf") returned 0
	[0064.164] lstrlenA (lpString="*.pdf") returned 5
	[0064.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.djvu") returned 0
	[0064.165] lstrlenA (lpString="*.djvu") returned 6
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.htm") returned 0
	[0064.165] lstrlenA (lpString="*.htm") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.html") returned 0
	[0064.165] lstrlenA (lpString="*.html") returned 6
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mdb") returned 0
	[0064.165] lstrlenA (lpString="*.mdb") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.cer") returned 0
	[0064.165] lstrlenA (lpString="*.cer") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.p12") returned 0
	[0064.165] lstrlenA (lpString="*.p12") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pfx") returned 0
	[0064.165] lstrlenA (lpString="*.pfx") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.kwm") returned 0
	[0064.165] lstrlenA (lpString="*.kwm") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pwm") returned 0
	[0064.165] lstrlenA (lpString="*.pwm") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.1cd") returned 0
	[0064.165] lstrlenA (lpString="*.1cd") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.md") returned 0
	[0064.165] lstrlenA (lpString="*.md") returned 4
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mdf") returned 0
	[0064.165] lstrlenA (lpString="*.mdf") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.dbf") returned 0
	[0064.165] lstrlenA (lpString="*.dbf") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.odt") returned 0
	[0064.165] lstrlenA (lpString="*.odt") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.vob") returned 0
	[0064.165] lstrlenA (lpString="*.vob") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ifo") returned 0
	[0064.165] lstrlenA (lpString="*.ifo") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.lnk") returned 0
	[0064.165] lstrlenA (lpString="*.lnk") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.torrent") returned 0
	[0064.165] lstrlenA (lpString="*.torrent") returned 9
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mov") returned 0
	[0064.165] lstrlenA (lpString="*.mov") returned 5
	[0064.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.m2v") returned 0
	[0064.166] lstrlenA (lpString="*.m2v") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.3gp") returned 0
	[0064.166] lstrlenA (lpString="*.3gp") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mpeg") returned 0
	[0064.166] lstrlenA (lpString="*.mpeg") returned 6
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mpg") returned 0
	[0064.166] lstrlenA (lpString="*.mpg") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.flv") returned 0
	[0064.166] lstrlenA (lpString="*.flv") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.avi") returned 0
	[0064.166] lstrlenA (lpString="*.avi") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mp4") returned 0
	[0064.166] lstrlenA (lpString="*.mp4") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wmv") returned 0
	[0064.166] lstrlenA (lpString="*.wmv") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.divx") returned 0
	[0064.166] lstrlenA (lpString="*.divx") returned 6
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mkv") returned 0
	[0064.166] lstrlenA (lpString="*.mkv") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mp3") returned 0
	[0064.166] lstrlenA (lpString="*.mp3") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wav") returned 0
	[0064.166] lstrlenA (lpString="*.wav") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.flac") returned 0
	[0064.166] lstrlenA (lpString="*.flac") returned 6
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ape") returned 0
	[0064.166] lstrlenA (lpString="*.ape") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wma") returned 0
	[0064.166] lstrlenA (lpString="*.wma") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ac3") returned 0
	[0064.166] lstrlenA (lpString="*.ac3") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.exe") returned 0
	[0064.166] lstrlenA (lpString="*.exe") returned 5
	[0064.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.apk") returned 0
	[0064.166] lstrlenA (lpString="*.apk") returned 5
	[0064.166] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.166] lstrcmpA (lpString1=".", lpString2="Lime") returned -1
	[0064.166] lstrcmpA (lpString1="..", lpString2="Lime") returned -1
	[0064.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned="LightSpirit.css"
	[0064.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Lime" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime"
	[0064.167] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime") returned 99
	[0064.167] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.167] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.167] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.167] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.167] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.167] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.167] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.167] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*") returned="*.*"
	[0064.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\"
	[0064.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned=""
	[0064.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt"
	[0064.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\how to decrypt files.txt")) returned 0xffffffff
	[0064.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.168] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.168] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.168] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.168] CloseHandle (hObject=0xa0) returned 1
	[0064.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF"
	[0064.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.169] lstrlenA (lpString="*.zip") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.169] lstrlenA (lpString="*.rar") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.169] lstrlenA (lpString="*.7z") returned 4
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.169] lstrlenA (lpString="*.tar") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.169] lstrlenA (lpString="*.gzip") returned 6
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.169] lstrlenA (lpString="*.jpg") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.169] lstrlenA (lpString="*.jpeg") returned 6
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.169] lstrlenA (lpString="*.psd") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.169] lstrlenA (lpString="*.cdr") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.169] lstrlenA (lpString="*.dwg") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.169] lstrlenA (lpString="*.max") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.169] lstrlenA (lpString="*.bmp") returned 5
	[0064.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.169] lstrlenA (lpString="*.gif") returned 5
	[0064.169] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF"
	[0064.169] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF"
	[0064.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF."
	[0064.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.Boom"
	[0064.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.171] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce
	[0064.171] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1
	[0064.171] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.171] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ab, lpOverlapped=0x0) returned 1
	[0064.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.172] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.172] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ab, lpOverlapped=0x0) returned 1
	[0064.172] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.172] CloseHandle (hObject=0xa0) returned 1
	[0064.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif.boom")) returned 1
	[0064.172] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.173] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.173] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.173] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\"
	[0064.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned=""
	[0064.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt"
	[0064.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\how to decrypt files.txt")) returned 0x20
	[0064.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF"
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.173] lstrlenA (lpString="*.zip") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.173] lstrlenA (lpString="*.rar") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.173] lstrlenA (lpString="*.7z") returned 4
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.173] lstrlenA (lpString="*.tar") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.173] lstrlenA (lpString="*.gzip") returned 6
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.173] lstrlenA (lpString="*.jpg") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.173] lstrlenA (lpString="*.jpeg") returned 6
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.173] lstrlenA (lpString="*.psd") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.173] lstrlenA (lpString="*.cdr") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.173] lstrlenA (lpString="*.dwg") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.173] lstrlenA (lpString="*.max") returned 5
	[0064.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.173] lstrlenA (lpString="*.bmp") returned 5
	[0064.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.174] lstrlenA (lpString="*.gif") returned 5
	[0064.174] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF"
	[0064.174] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF"
	[0064.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF."
	[0064.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.Boom"
	[0064.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.174] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b
	[0064.174] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.174] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.174] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xe8, lpOverlapped=0x0) returned 1
	[0064.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.175] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.175] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xe8, lpOverlapped=0x0) returned 1
	[0064.175] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.175] CloseHandle (hObject=0xa0) returned 1
	[0064.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif.boom")) returned 1
	[0064.177] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.177] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.177] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.177] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Lime.css") returned -1
	[0064.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lime.css") returned -1
	[0064.177] lstrcmpiA (lpString1="", lpString2="Lime.css") returned -1
	[0064.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Lime.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css"
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.zip") returned 0
	[0064.178] lstrlenA (lpString="*.zip") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.rar") returned 0
	[0064.178] lstrlenA (lpString="*.rar") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.7z") returned 0
	[0064.178] lstrlenA (lpString="*.7z") returned 4
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.tar") returned 0
	[0064.178] lstrlenA (lpString="*.tar") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.gzip") returned 0
	[0064.178] lstrlenA (lpString="*.gzip") returned 6
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.jpg") returned 0
	[0064.178] lstrlenA (lpString="*.jpg") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.jpeg") returned 0
	[0064.178] lstrlenA (lpString="*.jpeg") returned 6
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.psd") returned 0
	[0064.178] lstrlenA (lpString="*.psd") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.cdr") returned 0
	[0064.178] lstrlenA (lpString="*.cdr") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.dwg") returned 0
	[0064.178] lstrlenA (lpString="*.dwg") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.max") returned 0
	[0064.178] lstrlenA (lpString="*.max") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.bmp") returned 0
	[0064.178] lstrlenA (lpString="*.bmp") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.gif") returned 0
	[0064.178] lstrlenA (lpString="*.gif") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.png") returned 0
	[0064.178] lstrlenA (lpString="*.png") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.doc") returned 0
	[0064.178] lstrlenA (lpString="*.doc") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.docx") returned 0
	[0064.178] lstrlenA (lpString="*.docx") returned 6
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.xls") returned 0
	[0064.178] lstrlenA (lpString="*.xls") returned 5
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.xlsx") returned 0
	[0064.178] lstrlenA (lpString="*.xlsx") returned 6
	[0064.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ppt") returned 0
	[0064.179] lstrlenA (lpString="*.ppt") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pptx") returned 0
	[0064.179] lstrlenA (lpString="*.pptx") returned 6
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.txt") returned 0
	[0064.179] lstrlenA (lpString="*.txt") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pdf") returned 0
	[0064.179] lstrlenA (lpString="*.pdf") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.djvu") returned 0
	[0064.179] lstrlenA (lpString="*.djvu") returned 6
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.htm") returned 0
	[0064.179] lstrlenA (lpString="*.htm") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.html") returned 0
	[0064.179] lstrlenA (lpString="*.html") returned 6
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mdb") returned 0
	[0064.179] lstrlenA (lpString="*.mdb") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.cer") returned 0
	[0064.179] lstrlenA (lpString="*.cer") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.p12") returned 0
	[0064.179] lstrlenA (lpString="*.p12") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pfx") returned 0
	[0064.179] lstrlenA (lpString="*.pfx") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.kwm") returned 0
	[0064.179] lstrlenA (lpString="*.kwm") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pwm") returned 0
	[0064.179] lstrlenA (lpString="*.pwm") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.1cd") returned 0
	[0064.179] lstrlenA (lpString="*.1cd") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.md") returned 0
	[0064.179] lstrlenA (lpString="*.md") returned 4
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mdf") returned 0
	[0064.179] lstrlenA (lpString="*.mdf") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.dbf") returned 0
	[0064.179] lstrlenA (lpString="*.dbf") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.odt") returned 0
	[0064.179] lstrlenA (lpString="*.odt") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.vob") returned 0
	[0064.179] lstrlenA (lpString="*.vob") returned 5
	[0064.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ifo") returned 0
	[0064.180] lstrlenA (lpString="*.ifo") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.lnk") returned 0
	[0064.180] lstrlenA (lpString="*.lnk") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.torrent") returned 0
	[0064.180] lstrlenA (lpString="*.torrent") returned 9
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mov") returned 0
	[0064.180] lstrlenA (lpString="*.mov") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.m2v") returned 0
	[0064.180] lstrlenA (lpString="*.m2v") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.3gp") returned 0
	[0064.180] lstrlenA (lpString="*.3gp") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mpeg") returned 0
	[0064.180] lstrlenA (lpString="*.mpeg") returned 6
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mpg") returned 0
	[0064.180] lstrlenA (lpString="*.mpg") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.flv") returned 0
	[0064.180] lstrlenA (lpString="*.flv") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.avi") returned 0
	[0064.180] lstrlenA (lpString="*.avi") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mp4") returned 0
	[0064.180] lstrlenA (lpString="*.mp4") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wmv") returned 0
	[0064.180] lstrlenA (lpString="*.wmv") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.divx") returned 0
	[0064.180] lstrlenA (lpString="*.divx") returned 6
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mkv") returned 0
	[0064.180] lstrlenA (lpString="*.mkv") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mp3") returned 0
	[0064.180] lstrlenA (lpString="*.mp3") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wav") returned 0
	[0064.180] lstrlenA (lpString="*.wav") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.flac") returned 0
	[0064.180] lstrlenA (lpString="*.flac") returned 6
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ape") returned 0
	[0064.180] lstrlenA (lpString="*.ape") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wma") returned 0
	[0064.180] lstrlenA (lpString="*.wma") returned 5
	[0064.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ac3") returned 0
	[0064.181] lstrlenA (lpString="*.ac3") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.exe") returned 0
	[0064.181] lstrlenA (lpString="*.exe") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.apk") returned 0
	[0064.181] lstrlenA (lpString="*.apk") returned 5
	[0064.181] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.181] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Maroon.css") returned -1
	[0064.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maroon.css") returned -1
	[0064.181] lstrcmpiA (lpString1="", lpString2="Maroon.css") returned -1
	[0064.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned="Lime.css"
	[0064.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Maroon.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css"
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.zip") returned 0
	[0064.181] lstrlenA (lpString="*.zip") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.rar") returned 0
	[0064.181] lstrlenA (lpString="*.rar") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.7z") returned 0
	[0064.181] lstrlenA (lpString="*.7z") returned 4
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.tar") returned 0
	[0064.181] lstrlenA (lpString="*.tar") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.gzip") returned 0
	[0064.181] lstrlenA (lpString="*.gzip") returned 6
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.jpg") returned 0
	[0064.181] lstrlenA (lpString="*.jpg") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.jpeg") returned 0
	[0064.181] lstrlenA (lpString="*.jpeg") returned 6
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.psd") returned 0
	[0064.181] lstrlenA (lpString="*.psd") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.cdr") returned 0
	[0064.181] lstrlenA (lpString="*.cdr") returned 5
	[0064.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.dwg") returned 0
	[0064.182] lstrlenA (lpString="*.dwg") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.max") returned 0
	[0064.182] lstrlenA (lpString="*.max") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.bmp") returned 0
	[0064.182] lstrlenA (lpString="*.bmp") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.gif") returned 0
	[0064.182] lstrlenA (lpString="*.gif") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.png") returned 0
	[0064.182] lstrlenA (lpString="*.png") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.doc") returned 0
	[0064.182] lstrlenA (lpString="*.doc") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.docx") returned 0
	[0064.182] lstrlenA (lpString="*.docx") returned 6
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.xls") returned 0
	[0064.182] lstrlenA (lpString="*.xls") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.xlsx") returned 0
	[0064.182] lstrlenA (lpString="*.xlsx") returned 6
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ppt") returned 0
	[0064.182] lstrlenA (lpString="*.ppt") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pptx") returned 0
	[0064.182] lstrlenA (lpString="*.pptx") returned 6
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.txt") returned 0
	[0064.182] lstrlenA (lpString="*.txt") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pdf") returned 0
	[0064.182] lstrlenA (lpString="*.pdf") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.djvu") returned 0
	[0064.182] lstrlenA (lpString="*.djvu") returned 6
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.htm") returned 0
	[0064.182] lstrlenA (lpString="*.htm") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.html") returned 0
	[0064.182] lstrlenA (lpString="*.html") returned 6
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mdb") returned 0
	[0064.182] lstrlenA (lpString="*.mdb") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.cer") returned 0
	[0064.182] lstrlenA (lpString="*.cer") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.p12") returned 0
	[0064.182] lstrlenA (lpString="*.p12") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pfx") returned 0
	[0064.182] lstrlenA (lpString="*.pfx") returned 5
	[0064.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.kwm") returned 0
	[0064.182] lstrlenA (lpString="*.kwm") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pwm") returned 0
	[0064.183] lstrlenA (lpString="*.pwm") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.1cd") returned 0
	[0064.183] lstrlenA (lpString="*.1cd") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.md") returned 0
	[0064.183] lstrlenA (lpString="*.md") returned 4
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mdf") returned 0
	[0064.183] lstrlenA (lpString="*.mdf") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.dbf") returned 0
	[0064.183] lstrlenA (lpString="*.dbf") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.odt") returned 0
	[0064.183] lstrlenA (lpString="*.odt") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.vob") returned 0
	[0064.183] lstrlenA (lpString="*.vob") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ifo") returned 0
	[0064.183] lstrlenA (lpString="*.ifo") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.lnk") returned 0
	[0064.183] lstrlenA (lpString="*.lnk") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.torrent") returned 0
	[0064.183] lstrlenA (lpString="*.torrent") returned 9
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mov") returned 0
	[0064.183] lstrlenA (lpString="*.mov") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.m2v") returned 0
	[0064.183] lstrlenA (lpString="*.m2v") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.3gp") returned 0
	[0064.183] lstrlenA (lpString="*.3gp") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mpeg") returned 0
	[0064.183] lstrlenA (lpString="*.mpeg") returned 6
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mpg") returned 0
	[0064.183] lstrlenA (lpString="*.mpg") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.flv") returned 0
	[0064.183] lstrlenA (lpString="*.flv") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.avi") returned 0
	[0064.183] lstrlenA (lpString="*.avi") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mp4") returned 0
	[0064.183] lstrlenA (lpString="*.mp4") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wmv") returned 0
	[0064.183] lstrlenA (lpString="*.wmv") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.divx") returned 0
	[0064.183] lstrlenA (lpString="*.divx") returned 6
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mkv") returned 0
	[0064.183] lstrlenA (lpString="*.mkv") returned 5
	[0064.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mp3") returned 0
	[0064.183] lstrlenA (lpString="*.mp3") returned 5
	[0064.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wav") returned 0
	[0064.184] lstrlenA (lpString="*.wav") returned 5
	[0064.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.flac") returned 0
	[0064.184] lstrlenA (lpString="*.flac") returned 6
	[0064.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ape") returned 0
	[0064.184] lstrlenA (lpString="*.ape") returned 5
	[0064.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wma") returned 0
	[0064.184] lstrlenA (lpString="*.wma") returned 5
	[0064.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ac3") returned 0
	[0064.184] lstrlenA (lpString="*.ac3") returned 5
	[0064.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.exe") returned 0
	[0064.184] lstrlenA (lpString="*.exe") returned 5
	[0064.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.apk") returned 0
	[0064.184] lstrlenA (lpString="*.apk") returned 5
	[0064.184] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.184] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1
	[0064.184] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1
	[0064.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned="Maroon.css"
	[0064.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Oasis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis"
	[0064.184] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis") returned 100
	[0064.184] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.184] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.184] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.184] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.184] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.184] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.184] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.184] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0064.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0064.184] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0064.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*") returned="*.*"
	[0064.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\"
	[0064.184] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned=""
	[0064.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt"
	[0064.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0xffffffff
	[0064.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.186] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.186] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.186] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.186] CloseHandle (hObject=0xa0) returned 1
	[0064.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF"
	[0064.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0064.186] lstrlenA (lpString="*.zip") returned 5
	[0064.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0064.187] lstrlenA (lpString="*.rar") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0064.187] lstrlenA (lpString="*.7z") returned 4
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0064.187] lstrlenA (lpString="*.tar") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0064.187] lstrlenA (lpString="*.gzip") returned 6
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0064.187] lstrlenA (lpString="*.jpg") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0064.187] lstrlenA (lpString="*.jpeg") returned 6
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0064.187] lstrlenA (lpString="*.psd") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0064.187] lstrlenA (lpString="*.cdr") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0064.187] lstrlenA (lpString="*.dwg") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.max") returned 0
	[0064.187] lstrlenA (lpString="*.max") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0064.187] lstrlenA (lpString="*.bmp") returned 5
	[0064.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0064.187] lstrlenA (lpString="*.gif") returned 5
	[0064.187] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF"
	[0064.187] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF"
	[0064.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF."
	[0064.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.Boom"
	[0064.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.188] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c
	[0064.188] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.188] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.188] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x849, lpOverlapped=0x0) returned 1
	[0064.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF"
	[0064.199] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.199] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x849, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x849, lpOverlapped=0x0) returned 1
	[0064.199] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.199] CloseHandle (hObject=0xa0) returned 1
	[0064.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif.boom")) returned 1
	[0064.200] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.200] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.200] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.200] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF"
	[0064.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\"
	[0064.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned=""
	[0064.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt"
	[0064.200] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20
	[0064.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF"
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.200] lstrlenA (lpString="*.zip") returned 5
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.200] lstrlenA (lpString="*.rar") returned 5
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.200] lstrlenA (lpString="*.7z") returned 4
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.200] lstrlenA (lpString="*.tar") returned 5
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.200] lstrlenA (lpString="*.gzip") returned 6
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.200] lstrlenA (lpString="*.jpg") returned 5
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.200] lstrlenA (lpString="*.jpeg") returned 6
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.200] lstrlenA (lpString="*.psd") returned 5
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.200] lstrlenA (lpString="*.cdr") returned 5
	[0064.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.200] lstrlenA (lpString="*.dwg") returned 5
	[0064.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.201] lstrlenA (lpString="*.max") returned 5
	[0064.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.201] lstrlenA (lpString="*.bmp") returned 5
	[0064.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.201] lstrlenA (lpString="*.gif") returned 5
	[0064.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF"
	[0064.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF"
	[0064.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF."
	[0064.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.Boom"
	[0064.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.201] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0
	[0064.201] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.201] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.201] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1cd, lpOverlapped=0x0) returned 1
	[0064.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.202] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.202] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1cd, lpOverlapped=0x0) returned 1
	[0064.202] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.202] CloseHandle (hObject=0xa0) returned 1
	[0064.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif.boom")) returned 1
	[0064.204] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.204] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.204] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.204] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\"
	[0064.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned=""
	[0064.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt"
	[0064.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20
	[0064.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF"
	[0064.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.204] lstrlenA (lpString="*.zip") returned 5
	[0064.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.204] lstrlenA (lpString="*.rar") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.205] lstrlenA (lpString="*.7z") returned 4
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.205] lstrlenA (lpString="*.tar") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.205] lstrlenA (lpString="*.gzip") returned 6
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.205] lstrlenA (lpString="*.jpg") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.205] lstrlenA (lpString="*.jpeg") returned 6
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.205] lstrlenA (lpString="*.psd") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.205] lstrlenA (lpString="*.cdr") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.205] lstrlenA (lpString="*.dwg") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.205] lstrlenA (lpString="*.max") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.205] lstrlenA (lpString="*.bmp") returned 5
	[0064.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.205] lstrlenA (lpString="*.gif") returned 5
	[0064.205] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF"
	[0064.205] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF"
	[0064.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF."
	[0064.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.Boom"
	[0064.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.206] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401
	[0064.206] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.206] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.206] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3de, lpOverlapped=0x0) returned 1
	[0064.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.207] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.207] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3de, lpOverlapped=0x0) returned 1
	[0064.207] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.207] CloseHandle (hObject=0xa0) returned 1
	[0064.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif.boom")) returned 1
	[0064.208] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.208] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.208] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.208] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.208] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Oasis.css") returned -1
	[0064.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oasis.css") returned -1
	[0064.208] lstrcmpiA (lpString1="", lpString2="Oasis.css") returned -1
	[0064.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Oasis.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css"
	[0064.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.zip") returned 0
	[0064.208] lstrlenA (lpString="*.zip") returned 5
	[0064.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.rar") returned 0
	[0064.209] lstrlenA (lpString="*.rar") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.7z") returned 0
	[0064.209] lstrlenA (lpString="*.7z") returned 4
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.tar") returned 0
	[0064.209] lstrlenA (lpString="*.tar") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.gzip") returned 0
	[0064.209] lstrlenA (lpString="*.gzip") returned 6
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.jpg") returned 0
	[0064.209] lstrlenA (lpString="*.jpg") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.jpeg") returned 0
	[0064.209] lstrlenA (lpString="*.jpeg") returned 6
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.psd") returned 0
	[0064.209] lstrlenA (lpString="*.psd") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.cdr") returned 0
	[0064.209] lstrlenA (lpString="*.cdr") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.dwg") returned 0
	[0064.209] lstrlenA (lpString="*.dwg") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.max") returned 0
	[0064.209] lstrlenA (lpString="*.max") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.bmp") returned 0
	[0064.209] lstrlenA (lpString="*.bmp") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.gif") returned 0
	[0064.209] lstrlenA (lpString="*.gif") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.png") returned 0
	[0064.209] lstrlenA (lpString="*.png") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.doc") returned 0
	[0064.209] lstrlenA (lpString="*.doc") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.docx") returned 0
	[0064.209] lstrlenA (lpString="*.docx") returned 6
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.xls") returned 0
	[0064.209] lstrlenA (lpString="*.xls") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.xlsx") returned 0
	[0064.209] lstrlenA (lpString="*.xlsx") returned 6
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ppt") returned 0
	[0064.209] lstrlenA (lpString="*.ppt") returned 5
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pptx") returned 0
	[0064.209] lstrlenA (lpString="*.pptx") returned 6
	[0064.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.txt") returned 0
	[0064.209] lstrlenA (lpString="*.txt") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pdf") returned 0
	[0064.210] lstrlenA (lpString="*.pdf") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.djvu") returned 0
	[0064.210] lstrlenA (lpString="*.djvu") returned 6
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.htm") returned 0
	[0064.210] lstrlenA (lpString="*.htm") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.html") returned 0
	[0064.210] lstrlenA (lpString="*.html") returned 6
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mdb") returned 0
	[0064.210] lstrlenA (lpString="*.mdb") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.cer") returned 0
	[0064.210] lstrlenA (lpString="*.cer") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.p12") returned 0
	[0064.210] lstrlenA (lpString="*.p12") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pfx") returned 0
	[0064.210] lstrlenA (lpString="*.pfx") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.kwm") returned 0
	[0064.210] lstrlenA (lpString="*.kwm") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pwm") returned 0
	[0064.210] lstrlenA (lpString="*.pwm") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.1cd") returned 0
	[0064.210] lstrlenA (lpString="*.1cd") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.md") returned 0
	[0064.210] lstrlenA (lpString="*.md") returned 4
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mdf") returned 0
	[0064.210] lstrlenA (lpString="*.mdf") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.dbf") returned 0
	[0064.210] lstrlenA (lpString="*.dbf") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.odt") returned 0
	[0064.210] lstrlenA (lpString="*.odt") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.vob") returned 0
	[0064.210] lstrlenA (lpString="*.vob") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ifo") returned 0
	[0064.210] lstrlenA (lpString="*.ifo") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.lnk") returned 0
	[0064.210] lstrlenA (lpString="*.lnk") returned 5
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.torrent") returned 0
	[0064.210] lstrlenA (lpString="*.torrent") returned 9
	[0064.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mov") returned 0
	[0064.211] lstrlenA (lpString="*.mov") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.m2v") returned 0
	[0064.211] lstrlenA (lpString="*.m2v") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.3gp") returned 0
	[0064.211] lstrlenA (lpString="*.3gp") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mpeg") returned 0
	[0064.211] lstrlenA (lpString="*.mpeg") returned 6
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mpg") returned 0
	[0064.211] lstrlenA (lpString="*.mpg") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.flv") returned 0
	[0064.211] lstrlenA (lpString="*.flv") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.avi") returned 0
	[0064.211] lstrlenA (lpString="*.avi") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mp4") returned 0
	[0064.211] lstrlenA (lpString="*.mp4") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wmv") returned 0
	[0064.211] lstrlenA (lpString="*.wmv") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.divx") returned 0
	[0064.211] lstrlenA (lpString="*.divx") returned 6
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mkv") returned 0
	[0064.211] lstrlenA (lpString="*.mkv") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mp3") returned 0
	[0064.211] lstrlenA (lpString="*.mp3") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wav") returned 0
	[0064.211] lstrlenA (lpString="*.wav") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.flac") returned 0
	[0064.211] lstrlenA (lpString="*.flac") returned 6
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ape") returned 0
	[0064.211] lstrlenA (lpString="*.ape") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wma") returned 0
	[0064.211] lstrlenA (lpString="*.wma") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ac3") returned 0
	[0064.211] lstrlenA (lpString="*.ac3") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.exe") returned 0
	[0064.211] lstrlenA (lpString="*.exe") returned 5
	[0064.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.apk") returned 0
	[0064.211] lstrlenA (lpString="*.apk") returned 5
	[0064.211] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.211] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.212] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OliveGreen.css") returned -1
	[0064.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OliveGreen.css") returned -1
	[0064.212] lstrcmpiA (lpString1="", lpString2="OliveGreen.css") returned -1
	[0064.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned="Oasis.css"
	[0064.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="OliveGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css"
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.zip") returned 0
	[0064.212] lstrlenA (lpString="*.zip") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.rar") returned 0
	[0064.212] lstrlenA (lpString="*.rar") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.7z") returned 0
	[0064.212] lstrlenA (lpString="*.7z") returned 4
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.tar") returned 0
	[0064.212] lstrlenA (lpString="*.tar") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.gzip") returned 0
	[0064.212] lstrlenA (lpString="*.gzip") returned 6
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.jpg") returned 0
	[0064.212] lstrlenA (lpString="*.jpg") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.jpeg") returned 0
	[0064.212] lstrlenA (lpString="*.jpeg") returned 6
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.psd") returned 0
	[0064.212] lstrlenA (lpString="*.psd") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.cdr") returned 0
	[0064.212] lstrlenA (lpString="*.cdr") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.dwg") returned 0
	[0064.212] lstrlenA (lpString="*.dwg") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.max") returned 0
	[0064.212] lstrlenA (lpString="*.max") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.bmp") returned 0
	[0064.212] lstrlenA (lpString="*.bmp") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.gif") returned 0
	[0064.212] lstrlenA (lpString="*.gif") returned 5
	[0064.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.png") returned 0
	[0064.213] lstrlenA (lpString="*.png") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.doc") returned 0
	[0064.213] lstrlenA (lpString="*.doc") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.docx") returned 0
	[0064.213] lstrlenA (lpString="*.docx") returned 6
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.xls") returned 0
	[0064.213] lstrlenA (lpString="*.xls") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.xlsx") returned 0
	[0064.213] lstrlenA (lpString="*.xlsx") returned 6
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ppt") returned 0
	[0064.213] lstrlenA (lpString="*.ppt") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pptx") returned 0
	[0064.213] lstrlenA (lpString="*.pptx") returned 6
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.txt") returned 0
	[0064.213] lstrlenA (lpString="*.txt") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pdf") returned 0
	[0064.213] lstrlenA (lpString="*.pdf") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.djvu") returned 0
	[0064.213] lstrlenA (lpString="*.djvu") returned 6
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.htm") returned 0
	[0064.213] lstrlenA (lpString="*.htm") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.html") returned 0
	[0064.213] lstrlenA (lpString="*.html") returned 6
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mdb") returned 0
	[0064.213] lstrlenA (lpString="*.mdb") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.cer") returned 0
	[0064.213] lstrlenA (lpString="*.cer") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.p12") returned 0
	[0064.213] lstrlenA (lpString="*.p12") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pfx") returned 0
	[0064.213] lstrlenA (lpString="*.pfx") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.kwm") returned 0
	[0064.213] lstrlenA (lpString="*.kwm") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pwm") returned 0
	[0064.213] lstrlenA (lpString="*.pwm") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.1cd") returned 0
	[0064.213] lstrlenA (lpString="*.1cd") returned 5
	[0064.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.md") returned 0
	[0064.213] lstrlenA (lpString="*.md") returned 4
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mdf") returned 0
	[0064.214] lstrlenA (lpString="*.mdf") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.dbf") returned 0
	[0064.214] lstrlenA (lpString="*.dbf") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.odt") returned 0
	[0064.214] lstrlenA (lpString="*.odt") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.vob") returned 0
	[0064.214] lstrlenA (lpString="*.vob") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ifo") returned 0
	[0064.214] lstrlenA (lpString="*.ifo") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.lnk") returned 0
	[0064.214] lstrlenA (lpString="*.lnk") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.torrent") returned 0
	[0064.214] lstrlenA (lpString="*.torrent") returned 9
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mov") returned 0
	[0064.214] lstrlenA (lpString="*.mov") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.m2v") returned 0
	[0064.214] lstrlenA (lpString="*.m2v") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.3gp") returned 0
	[0064.214] lstrlenA (lpString="*.3gp") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mpeg") returned 0
	[0064.214] lstrlenA (lpString="*.mpeg") returned 6
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mpg") returned 0
	[0064.214] lstrlenA (lpString="*.mpg") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.flv") returned 0
	[0064.214] lstrlenA (lpString="*.flv") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.avi") returned 0
	[0064.214] lstrlenA (lpString="*.avi") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mp4") returned 0
	[0064.214] lstrlenA (lpString="*.mp4") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wmv") returned 0
	[0064.214] lstrlenA (lpString="*.wmv") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.divx") returned 0
	[0064.214] lstrlenA (lpString="*.divx") returned 6
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mkv") returned 0
	[0064.214] lstrlenA (lpString="*.mkv") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mp3") returned 0
	[0064.214] lstrlenA (lpString="*.mp3") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wav") returned 0
	[0064.214] lstrlenA (lpString="*.wav") returned 5
	[0064.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.flac") returned 0
	[0064.214] lstrlenA (lpString="*.flac") returned 6
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ape") returned 0
	[0064.215] lstrlenA (lpString="*.ape") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wma") returned 0
	[0064.215] lstrlenA (lpString="*.wma") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ac3") returned 0
	[0064.215] lstrlenA (lpString="*.ac3") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.exe") returned 0
	[0064.215] lstrlenA (lpString="*.exe") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.apk") returned 0
	[0064.215] lstrlenA (lpString="*.apk") returned 5
	[0064.215] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.215] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.215] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Premium.css") returned -1
	[0064.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Premium.css") returned -1
	[0064.215] lstrcmpiA (lpString1="", lpString2="Premium.css") returned -1
	[0064.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned="OliveGreen.css"
	[0064.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Premium.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css"
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.zip") returned 0
	[0064.215] lstrlenA (lpString="*.zip") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.rar") returned 0
	[0064.215] lstrlenA (lpString="*.rar") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.7z") returned 0
	[0064.215] lstrlenA (lpString="*.7z") returned 4
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.tar") returned 0
	[0064.215] lstrlenA (lpString="*.tar") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.gzip") returned 0
	[0064.215] lstrlenA (lpString="*.gzip") returned 6
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.jpg") returned 0
	[0064.215] lstrlenA (lpString="*.jpg") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.jpeg") returned 0
	[0064.215] lstrlenA (lpString="*.jpeg") returned 6
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.psd") returned 0
	[0064.215] lstrlenA (lpString="*.psd") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.cdr") returned 0
	[0064.215] lstrlenA (lpString="*.cdr") returned 5
	[0064.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.dwg") returned 0
	[0064.215] lstrlenA (lpString="*.dwg") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.max") returned 0
	[0064.216] lstrlenA (lpString="*.max") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.bmp") returned 0
	[0064.216] lstrlenA (lpString="*.bmp") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.gif") returned 0
	[0064.216] lstrlenA (lpString="*.gif") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.png") returned 0
	[0064.216] lstrlenA (lpString="*.png") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.doc") returned 0
	[0064.216] lstrlenA (lpString="*.doc") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.docx") returned 0
	[0064.216] lstrlenA (lpString="*.docx") returned 6
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.xls") returned 0
	[0064.216] lstrlenA (lpString="*.xls") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.xlsx") returned 0
	[0064.216] lstrlenA (lpString="*.xlsx") returned 6
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ppt") returned 0
	[0064.216] lstrlenA (lpString="*.ppt") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pptx") returned 0
	[0064.216] lstrlenA (lpString="*.pptx") returned 6
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.txt") returned 0
	[0064.216] lstrlenA (lpString="*.txt") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pdf") returned 0
	[0064.216] lstrlenA (lpString="*.pdf") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.djvu") returned 0
	[0064.216] lstrlenA (lpString="*.djvu") returned 6
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.htm") returned 0
	[0064.216] lstrlenA (lpString="*.htm") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.html") returned 0
	[0064.216] lstrlenA (lpString="*.html") returned 6
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mdb") returned 0
	[0064.216] lstrlenA (lpString="*.mdb") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.cer") returned 0
	[0064.216] lstrlenA (lpString="*.cer") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.p12") returned 0
	[0064.216] lstrlenA (lpString="*.p12") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pfx") returned 0
	[0064.216] lstrlenA (lpString="*.pfx") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.kwm") returned 0
	[0064.216] lstrlenA (lpString="*.kwm") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pwm") returned 0
	[0064.216] lstrlenA (lpString="*.pwm") returned 5
	[0064.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.1cd") returned 0
	[0064.216] lstrlenA (lpString="*.1cd") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.md") returned 0
	[0064.217] lstrlenA (lpString="*.md") returned 4
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mdf") returned 0
	[0064.217] lstrlenA (lpString="*.mdf") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.dbf") returned 0
	[0064.217] lstrlenA (lpString="*.dbf") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.odt") returned 0
	[0064.217] lstrlenA (lpString="*.odt") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.vob") returned 0
	[0064.217] lstrlenA (lpString="*.vob") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ifo") returned 0
	[0064.217] lstrlenA (lpString="*.ifo") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.lnk") returned 0
	[0064.217] lstrlenA (lpString="*.lnk") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.torrent") returned 0
	[0064.217] lstrlenA (lpString="*.torrent") returned 9
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mov") returned 0
	[0064.217] lstrlenA (lpString="*.mov") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.m2v") returned 0
	[0064.217] lstrlenA (lpString="*.m2v") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.3gp") returned 0
	[0064.217] lstrlenA (lpString="*.3gp") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mpeg") returned 0
	[0064.217] lstrlenA (lpString="*.mpeg") returned 6
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mpg") returned 0
	[0064.217] lstrlenA (lpString="*.mpg") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.flv") returned 0
	[0064.217] lstrlenA (lpString="*.flv") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.avi") returned 0
	[0064.217] lstrlenA (lpString="*.avi") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mp4") returned 0
	[0064.217] lstrlenA (lpString="*.mp4") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wmv") returned 0
	[0064.217] lstrlenA (lpString="*.wmv") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.divx") returned 0
	[0064.217] lstrlenA (lpString="*.divx") returned 6
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mkv") returned 0
	[0064.217] lstrlenA (lpString="*.mkv") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mp3") returned 0
	[0064.217] lstrlenA (lpString="*.mp3") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wav") returned 0
	[0064.217] lstrlenA (lpString="*.wav") returned 5
	[0064.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.flac") returned 0
	[0064.217] lstrlenA (lpString="*.flac") returned 6
	[0064.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ape") returned 0
	[0064.218] lstrlenA (lpString="*.ape") returned 5
	[0064.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wma") returned 0
	[0064.218] lstrlenA (lpString="*.wma") returned 5
	[0064.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ac3") returned 0
	[0064.218] lstrlenA (lpString="*.ac3") returned 5
	[0064.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.exe") returned 0
	[0064.218] lstrlenA (lpString="*.exe") returned 5
	[0064.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.apk") returned 0
	[0064.218] lstrlenA (lpString="*.apk") returned 5
	[0064.218] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.218] lstrcmpA (lpString1=".", lpString2="Slate") returned -1
	[0064.218] lstrcmpA (lpString1="..", lpString2="Slate") returned -1
	[0064.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned="Premium.css"
	[0064.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Slate" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate"
	[0064.218] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate") returned 100
	[0064.218] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.218] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.218] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.218] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.218] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.218] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.218] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.218] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.218] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*") returned="*.*"
	[0064.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\"
	[0064.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned=""
	[0064.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt"
	[0064.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\how to decrypt files.txt")) returned 0xffffffff
	[0064.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.219] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.219] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.220] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.220] CloseHandle (hObject=0xa0) returned 1
	[0064.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF"
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.220] lstrlenA (lpString="*.zip") returned 5
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.220] lstrlenA (lpString="*.rar") returned 5
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.220] lstrlenA (lpString="*.7z") returned 4
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.220] lstrlenA (lpString="*.tar") returned 5
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.220] lstrlenA (lpString="*.gzip") returned 6
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.220] lstrlenA (lpString="*.jpg") returned 5
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.220] lstrlenA (lpString="*.jpeg") returned 6
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.220] lstrlenA (lpString="*.psd") returned 5
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.220] lstrlenA (lpString="*.cdr") returned 5
	[0064.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.221] lstrlenA (lpString="*.dwg") returned 5
	[0064.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.221] lstrlenA (lpString="*.max") returned 5
	[0064.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.221] lstrlenA (lpString="*.bmp") returned 5
	[0064.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.221] lstrlenA (lpString="*.gif") returned 5
	[0064.221] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF"
	[0064.221] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF"
	[0064.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF."
	[0064.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.Boom"
	[0064.221] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.221] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c
	[0064.221] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.221] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.221] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x149, lpOverlapped=0x0) returned 1
	[0064.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.222] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.222] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x149, lpOverlapped=0x0) returned 1
	[0064.222] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.222] CloseHandle (hObject=0xa0) returned 1
	[0064.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif.boom")) returned 1
	[0064.223] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.223] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.223] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\"
	[0064.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned=""
	[0064.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt"
	[0064.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\how to decrypt files.txt")) returned 0x20
	[0064.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF"
	[0064.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.223] lstrlenA (lpString="*.zip") returned 5
	[0064.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.223] lstrlenA (lpString="*.rar") returned 5
	[0064.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.223] lstrlenA (lpString="*.7z") returned 4
	[0064.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.223] lstrlenA (lpString="*.tar") returned 5
	[0064.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.223] lstrlenA (lpString="*.gzip") returned 6
	[0064.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.224] lstrlenA (lpString="*.jpg") returned 5
	[0064.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.224] lstrlenA (lpString="*.jpeg") returned 6
	[0064.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.224] lstrlenA (lpString="*.psd") returned 5
	[0064.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.224] lstrlenA (lpString="*.cdr") returned 5
	[0064.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.224] lstrlenA (lpString="*.dwg") returned 5
	[0064.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.224] lstrlenA (lpString="*.max") returned 5
	[0064.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.224] lstrlenA (lpString="*.bmp") returned 5
	[0064.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.224] lstrlenA (lpString="*.gif") returned 5
	[0064.224] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF"
	[0064.224] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF"
	[0064.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF."
	[0064.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.Boom"
	[0064.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.224] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c
	[0064.224] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.224] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.224] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x149, lpOverlapped=0x0) returned 1
	[0064.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.225] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.225] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x149, lpOverlapped=0x0) returned 1
	[0064.225] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.225] CloseHandle (hObject=0xa0) returned 1
	[0064.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif.boom")) returned 1
	[0064.227] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.227] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.227] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.227] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Slate.css") returned -1
	[0064.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slate.css") returned -1
	[0064.227] lstrcmpiA (lpString1="", lpString2="Slate.css") returned -1
	[0064.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Slate.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css"
	[0064.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.zip") returned 0
	[0064.227] lstrlenA (lpString="*.zip") returned 5
	[0064.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.rar") returned 0
	[0064.228] lstrlenA (lpString="*.rar") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.7z") returned 0
	[0064.228] lstrlenA (lpString="*.7z") returned 4
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.tar") returned 0
	[0064.228] lstrlenA (lpString="*.tar") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.gzip") returned 0
	[0064.228] lstrlenA (lpString="*.gzip") returned 6
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.jpg") returned 0
	[0064.228] lstrlenA (lpString="*.jpg") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.jpeg") returned 0
	[0064.228] lstrlenA (lpString="*.jpeg") returned 6
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.psd") returned 0
	[0064.228] lstrlenA (lpString="*.psd") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.cdr") returned 0
	[0064.228] lstrlenA (lpString="*.cdr") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.dwg") returned 0
	[0064.228] lstrlenA (lpString="*.dwg") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.max") returned 0
	[0064.228] lstrlenA (lpString="*.max") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.bmp") returned 0
	[0064.228] lstrlenA (lpString="*.bmp") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.gif") returned 0
	[0064.228] lstrlenA (lpString="*.gif") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.png") returned 0
	[0064.228] lstrlenA (lpString="*.png") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.doc") returned 0
	[0064.228] lstrlenA (lpString="*.doc") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.docx") returned 0
	[0064.228] lstrlenA (lpString="*.docx") returned 6
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.xls") returned 0
	[0064.228] lstrlenA (lpString="*.xls") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.xlsx") returned 0
	[0064.228] lstrlenA (lpString="*.xlsx") returned 6
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ppt") returned 0
	[0064.228] lstrlenA (lpString="*.ppt") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pptx") returned 0
	[0064.228] lstrlenA (lpString="*.pptx") returned 6
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.txt") returned 0
	[0064.228] lstrlenA (lpString="*.txt") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pdf") returned 0
	[0064.228] lstrlenA (lpString="*.pdf") returned 5
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.djvu") returned 0
	[0064.228] lstrlenA (lpString="*.djvu") returned 6
	[0064.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.htm") returned 0
	[0064.229] lstrlenA (lpString="*.htm") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.html") returned 0
	[0064.229] lstrlenA (lpString="*.html") returned 6
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mdb") returned 0
	[0064.229] lstrlenA (lpString="*.mdb") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.cer") returned 0
	[0064.229] lstrlenA (lpString="*.cer") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.p12") returned 0
	[0064.229] lstrlenA (lpString="*.p12") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pfx") returned 0
	[0064.229] lstrlenA (lpString="*.pfx") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.kwm") returned 0
	[0064.229] lstrlenA (lpString="*.kwm") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pwm") returned 0
	[0064.229] lstrlenA (lpString="*.pwm") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.1cd") returned 0
	[0064.229] lstrlenA (lpString="*.1cd") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.md") returned 0
	[0064.229] lstrlenA (lpString="*.md") returned 4
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mdf") returned 0
	[0064.229] lstrlenA (lpString="*.mdf") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.dbf") returned 0
	[0064.229] lstrlenA (lpString="*.dbf") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.odt") returned 0
	[0064.229] lstrlenA (lpString="*.odt") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.vob") returned 0
	[0064.229] lstrlenA (lpString="*.vob") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ifo") returned 0
	[0064.229] lstrlenA (lpString="*.ifo") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.lnk") returned 0
	[0064.229] lstrlenA (lpString="*.lnk") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.torrent") returned 0
	[0064.229] lstrlenA (lpString="*.torrent") returned 9
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mov") returned 0
	[0064.229] lstrlenA (lpString="*.mov") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.m2v") returned 0
	[0064.229] lstrlenA (lpString="*.m2v") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.3gp") returned 0
	[0064.229] lstrlenA (lpString="*.3gp") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mpeg") returned 0
	[0064.229] lstrlenA (lpString="*.mpeg") returned 6
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mpg") returned 0
	[0064.229] lstrlenA (lpString="*.mpg") returned 5
	[0064.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.flv") returned 0
	[0064.230] lstrlenA (lpString="*.flv") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.avi") returned 0
	[0064.230] lstrlenA (lpString="*.avi") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mp4") returned 0
	[0064.230] lstrlenA (lpString="*.mp4") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wmv") returned 0
	[0064.230] lstrlenA (lpString="*.wmv") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.divx") returned 0
	[0064.230] lstrlenA (lpString="*.divx") returned 6
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mkv") returned 0
	[0064.230] lstrlenA (lpString="*.mkv") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mp3") returned 0
	[0064.230] lstrlenA (lpString="*.mp3") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wav") returned 0
	[0064.230] lstrlenA (lpString="*.wav") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.flac") returned 0
	[0064.230] lstrlenA (lpString="*.flac") returned 6
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ape") returned 0
	[0064.230] lstrlenA (lpString="*.ape") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wma") returned 0
	[0064.230] lstrlenA (lpString="*.wma") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ac3") returned 0
	[0064.230] lstrlenA (lpString="*.ac3") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.exe") returned 0
	[0064.230] lstrlenA (lpString="*.exe") returned 5
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.apk") returned 0
	[0064.230] lstrlenA (lpString="*.apk") returned 5
	[0064.230] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.230] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.230] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SlateBlue.css") returned -1
	[0064.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SlateBlue.css") returned -1
	[0064.230] lstrcmpiA (lpString1="", lpString2="SlateBlue.css") returned -1
	[0064.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned="Slate.css"
	[0064.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.230] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.230] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SlateBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css"
	[0064.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.zip") returned 0
	[0064.230] lstrlenA (lpString="*.zip") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.rar") returned 0
	[0064.231] lstrlenA (lpString="*.rar") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.7z") returned 0
	[0064.231] lstrlenA (lpString="*.7z") returned 4
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.tar") returned 0
	[0064.231] lstrlenA (lpString="*.tar") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.gzip") returned 0
	[0064.231] lstrlenA (lpString="*.gzip") returned 6
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.jpg") returned 0
	[0064.231] lstrlenA (lpString="*.jpg") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.jpeg") returned 0
	[0064.231] lstrlenA (lpString="*.jpeg") returned 6
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.psd") returned 0
	[0064.231] lstrlenA (lpString="*.psd") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.cdr") returned 0
	[0064.231] lstrlenA (lpString="*.cdr") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.dwg") returned 0
	[0064.231] lstrlenA (lpString="*.dwg") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.max") returned 0
	[0064.231] lstrlenA (lpString="*.max") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.bmp") returned 0
	[0064.231] lstrlenA (lpString="*.bmp") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.gif") returned 0
	[0064.231] lstrlenA (lpString="*.gif") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.png") returned 0
	[0064.231] lstrlenA (lpString="*.png") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.doc") returned 0
	[0064.231] lstrlenA (lpString="*.doc") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.docx") returned 0
	[0064.231] lstrlenA (lpString="*.docx") returned 6
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.xls") returned 0
	[0064.231] lstrlenA (lpString="*.xls") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.xlsx") returned 0
	[0064.231] lstrlenA (lpString="*.xlsx") returned 6
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ppt") returned 0
	[0064.231] lstrlenA (lpString="*.ppt") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pptx") returned 0
	[0064.231] lstrlenA (lpString="*.pptx") returned 6
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.txt") returned 0
	[0064.231] lstrlenA (lpString="*.txt") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pdf") returned 0
	[0064.231] lstrlenA (lpString="*.pdf") returned 5
	[0064.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.djvu") returned 0
	[0064.231] lstrlenA (lpString="*.djvu") returned 6
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.htm") returned 0
	[0064.232] lstrlenA (lpString="*.htm") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.html") returned 0
	[0064.232] lstrlenA (lpString="*.html") returned 6
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mdb") returned 0
	[0064.232] lstrlenA (lpString="*.mdb") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.cer") returned 0
	[0064.232] lstrlenA (lpString="*.cer") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.p12") returned 0
	[0064.232] lstrlenA (lpString="*.p12") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pfx") returned 0
	[0064.232] lstrlenA (lpString="*.pfx") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.kwm") returned 0
	[0064.232] lstrlenA (lpString="*.kwm") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pwm") returned 0
	[0064.232] lstrlenA (lpString="*.pwm") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.1cd") returned 0
	[0064.232] lstrlenA (lpString="*.1cd") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.md") returned 0
	[0064.232] lstrlenA (lpString="*.md") returned 4
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mdf") returned 0
	[0064.232] lstrlenA (lpString="*.mdf") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.dbf") returned 0
	[0064.232] lstrlenA (lpString="*.dbf") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.odt") returned 0
	[0064.232] lstrlenA (lpString="*.odt") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.vob") returned 0
	[0064.232] lstrlenA (lpString="*.vob") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ifo") returned 0
	[0064.232] lstrlenA (lpString="*.ifo") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.lnk") returned 0
	[0064.232] lstrlenA (lpString="*.lnk") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.torrent") returned 0
	[0064.232] lstrlenA (lpString="*.torrent") returned 9
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mov") returned 0
	[0064.232] lstrlenA (lpString="*.mov") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.m2v") returned 0
	[0064.232] lstrlenA (lpString="*.m2v") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.3gp") returned 0
	[0064.232] lstrlenA (lpString="*.3gp") returned 5
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mpeg") returned 0
	[0064.232] lstrlenA (lpString="*.mpeg") returned 6
	[0064.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mpg") returned 0
	[0064.232] lstrlenA (lpString="*.mpg") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.flv") returned 0
	[0064.233] lstrlenA (lpString="*.flv") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.avi") returned 0
	[0064.233] lstrlenA (lpString="*.avi") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mp4") returned 0
	[0064.233] lstrlenA (lpString="*.mp4") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wmv") returned 0
	[0064.233] lstrlenA (lpString="*.wmv") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.divx") returned 0
	[0064.233] lstrlenA (lpString="*.divx") returned 6
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mkv") returned 0
	[0064.233] lstrlenA (lpString="*.mkv") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mp3") returned 0
	[0064.233] lstrlenA (lpString="*.mp3") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wav") returned 0
	[0064.233] lstrlenA (lpString="*.wav") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.flac") returned 0
	[0064.233] lstrlenA (lpString="*.flac") returned 6
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ape") returned 0
	[0064.233] lstrlenA (lpString="*.ape") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wma") returned 0
	[0064.233] lstrlenA (lpString="*.wma") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ac3") returned 0
	[0064.233] lstrlenA (lpString="*.ac3") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.exe") returned 0
	[0064.233] lstrlenA (lpString="*.exe") returned 5
	[0064.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.apk") returned 0
	[0064.233] lstrlenA (lpString="*.apk") returned 5
	[0064.233] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.233] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1
	[0064.233] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1
	[0064.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned="SlateBlue.css"
	[0064.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SoftBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue"
	[0064.233] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue") returned 103
	[0064.233] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.233] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.233] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.234] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.234] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.234] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.234] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.234] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0064.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0064.234] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0064.234] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*") returned="*.*"
	[0064.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\"
	[0064.234] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned=""
	[0064.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt"
	[0064.234] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0xffffffff
	[0064.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.236] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.236] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.236] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.237] CloseHandle (hObject=0xa0) returned 1
	[0064.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif"
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.zip") returned 0
	[0064.237] lstrlenA (lpString="*.zip") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.rar") returned 0
	[0064.237] lstrlenA (lpString="*.rar") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.7z") returned 0
	[0064.237] lstrlenA (lpString="*.7z") returned 4
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.tar") returned 0
	[0064.237] lstrlenA (lpString="*.tar") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gzip") returned 0
	[0064.237] lstrlenA (lpString="*.gzip") returned 6
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpg") returned 0
	[0064.237] lstrlenA (lpString="*.jpg") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpeg") returned 0
	[0064.237] lstrlenA (lpString="*.jpeg") returned 6
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.psd") returned 0
	[0064.237] lstrlenA (lpString="*.psd") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.cdr") returned 0
	[0064.237] lstrlenA (lpString="*.cdr") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.dwg") returned 0
	[0064.237] lstrlenA (lpString="*.dwg") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.max") returned 0
	[0064.237] lstrlenA (lpString="*.max") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.bmp") returned 0
	[0064.237] lstrlenA (lpString="*.bmp") returned 5
	[0064.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gif") returned 1
	[0064.237] lstrlenA (lpString="*.gif") returned 5
	[0064.237] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif"
	[0064.237] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif"
	[0064.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif."
	[0064.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.Boom"
	[0064.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.238] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afa
	[0064.238] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.239] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.239] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ad7, lpOverlapped=0x0) returned 1
	[0064.250] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif"
	[0064.250] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.250] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ad7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ad7, lpOverlapped=0x0) returned 1
	[0064.250] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.250] CloseHandle (hObject=0xa0) returned 1
	[0064.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.boom")) returned 1
	[0064.251] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.251] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.251] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1
	[0064.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1
	[0064.251] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1
	[0064.251] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif"
	[0064.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\"
	[0064.251] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned=""
	[0064.251] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt"
	[0064.251] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20
	[0064.251] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif"
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.zip") returned 0
	[0064.251] lstrlenA (lpString="*.zip") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.rar") returned 0
	[0064.251] lstrlenA (lpString="*.rar") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.7z") returned 0
	[0064.251] lstrlenA (lpString="*.7z") returned 4
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.tar") returned 0
	[0064.251] lstrlenA (lpString="*.tar") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.gzip") returned 0
	[0064.251] lstrlenA (lpString="*.gzip") returned 6
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.jpg") returned 0
	[0064.251] lstrlenA (lpString="*.jpg") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.jpeg") returned 0
	[0064.251] lstrlenA (lpString="*.jpeg") returned 6
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.psd") returned 0
	[0064.251] lstrlenA (lpString="*.psd") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.cdr") returned 0
	[0064.251] lstrlenA (lpString="*.cdr") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.dwg") returned 0
	[0064.251] lstrlenA (lpString="*.dwg") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.max") returned 0
	[0064.251] lstrlenA (lpString="*.max") returned 5
	[0064.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.bmp") returned 0
	[0064.251] lstrlenA (lpString="*.bmp") returned 5
	[0064.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.gif") returned 1
	[0064.252] lstrlenA (lpString="*.gif") returned 5
	[0064.252] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif"
	[0064.252] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif"
	[0064.252] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif."
	[0064.252] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.Boom"
	[0064.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.253] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.253] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.253] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.253] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.253] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="tab_off.gif"
	[0064.253] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.253] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.254] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.254] CloseHandle (hObject=0xa0) returned 1
	[0064.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.boom")) returned 1
	[0064.254] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.254] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.254] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1
	[0064.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1
	[0064.254] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1
	[0064.254] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="tab_off.gif"
	[0064.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\"
	[0064.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned=""
	[0064.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt"
	[0064.254] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20
	[0064.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif"
	[0064.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.zip") returned 0
	[0064.254] lstrlenA (lpString="*.zip") returned 5
	[0064.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.rar") returned 0
	[0064.255] lstrlenA (lpString="*.rar") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.7z") returned 0
	[0064.255] lstrlenA (lpString="*.7z") returned 4
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.tar") returned 0
	[0064.255] lstrlenA (lpString="*.tar") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.gzip") returned 0
	[0064.255] lstrlenA (lpString="*.gzip") returned 6
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.jpg") returned 0
	[0064.255] lstrlenA (lpString="*.jpg") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.jpeg") returned 0
	[0064.255] lstrlenA (lpString="*.jpeg") returned 6
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.psd") returned 0
	[0064.255] lstrlenA (lpString="*.psd") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.cdr") returned 0
	[0064.255] lstrlenA (lpString="*.cdr") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.dwg") returned 0
	[0064.255] lstrlenA (lpString="*.dwg") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.max") returned 0
	[0064.255] lstrlenA (lpString="*.max") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.bmp") returned 0
	[0064.255] lstrlenA (lpString="*.bmp") returned 5
	[0064.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.gif") returned 1
	[0064.255] lstrlenA (lpString="*.gif") returned 5
	[0064.255] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif"
	[0064.255] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif"
	[0064.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif."
	[0064.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.Boom"
	[0064.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.255] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.255] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.256] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.256] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.256] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="tab_on.gif"
	[0064.256] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.256] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.257] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.257] CloseHandle (hObject=0xa0) returned 1
	[0064.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.boom")) returned 1
	[0064.257] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.257] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.257] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.257] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SoftBlue.css") returned -1
	[0064.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.css") returned -1
	[0064.257] lstrcmpiA (lpString1="", lpString2="SoftBlue.css") returned -1
	[0064.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.257] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SoftBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css"
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.zip") returned 0
	[0064.258] lstrlenA (lpString="*.zip") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.rar") returned 0
	[0064.258] lstrlenA (lpString="*.rar") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.7z") returned 0
	[0064.258] lstrlenA (lpString="*.7z") returned 4
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.tar") returned 0
	[0064.258] lstrlenA (lpString="*.tar") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.gzip") returned 0
	[0064.258] lstrlenA (lpString="*.gzip") returned 6
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.jpg") returned 0
	[0064.258] lstrlenA (lpString="*.jpg") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.jpeg") returned 0
	[0064.258] lstrlenA (lpString="*.jpeg") returned 6
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.psd") returned 0
	[0064.258] lstrlenA (lpString="*.psd") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.cdr") returned 0
	[0064.258] lstrlenA (lpString="*.cdr") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.dwg") returned 0
	[0064.258] lstrlenA (lpString="*.dwg") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.max") returned 0
	[0064.258] lstrlenA (lpString="*.max") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.bmp") returned 0
	[0064.258] lstrlenA (lpString="*.bmp") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.gif") returned 0
	[0064.258] lstrlenA (lpString="*.gif") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.png") returned 0
	[0064.258] lstrlenA (lpString="*.png") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.doc") returned 0
	[0064.258] lstrlenA (lpString="*.doc") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.docx") returned 0
	[0064.258] lstrlenA (lpString="*.docx") returned 6
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.xls") returned 0
	[0064.258] lstrlenA (lpString="*.xls") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.xlsx") returned 0
	[0064.258] lstrlenA (lpString="*.xlsx") returned 6
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ppt") returned 0
	[0064.258] lstrlenA (lpString="*.ppt") returned 5
	[0064.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pptx") returned 0
	[0064.258] lstrlenA (lpString="*.pptx") returned 6
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.txt") returned 0
	[0064.259] lstrlenA (lpString="*.txt") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pdf") returned 0
	[0064.259] lstrlenA (lpString="*.pdf") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.djvu") returned 0
	[0064.259] lstrlenA (lpString="*.djvu") returned 6
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.htm") returned 0
	[0064.259] lstrlenA (lpString="*.htm") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.html") returned 0
	[0064.259] lstrlenA (lpString="*.html") returned 6
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mdb") returned 0
	[0064.259] lstrlenA (lpString="*.mdb") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.cer") returned 0
	[0064.259] lstrlenA (lpString="*.cer") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.p12") returned 0
	[0064.259] lstrlenA (lpString="*.p12") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pfx") returned 0
	[0064.259] lstrlenA (lpString="*.pfx") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.kwm") returned 0
	[0064.259] lstrlenA (lpString="*.kwm") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pwm") returned 0
	[0064.259] lstrlenA (lpString="*.pwm") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.1cd") returned 0
	[0064.259] lstrlenA (lpString="*.1cd") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.md") returned 0
	[0064.259] lstrlenA (lpString="*.md") returned 4
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mdf") returned 0
	[0064.259] lstrlenA (lpString="*.mdf") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.dbf") returned 0
	[0064.259] lstrlenA (lpString="*.dbf") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.odt") returned 0
	[0064.259] lstrlenA (lpString="*.odt") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.vob") returned 0
	[0064.259] lstrlenA (lpString="*.vob") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ifo") returned 0
	[0064.259] lstrlenA (lpString="*.ifo") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.lnk") returned 0
	[0064.259] lstrlenA (lpString="*.lnk") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.torrent") returned 0
	[0064.259] lstrlenA (lpString="*.torrent") returned 9
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mov") returned 0
	[0064.259] lstrlenA (lpString="*.mov") returned 5
	[0064.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.m2v") returned 0
	[0064.260] lstrlenA (lpString="*.m2v") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.3gp") returned 0
	[0064.260] lstrlenA (lpString="*.3gp") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mpeg") returned 0
	[0064.260] lstrlenA (lpString="*.mpeg") returned 6
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mpg") returned 0
	[0064.260] lstrlenA (lpString="*.mpg") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.flv") returned 0
	[0064.260] lstrlenA (lpString="*.flv") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.avi") returned 0
	[0064.260] lstrlenA (lpString="*.avi") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mp4") returned 0
	[0064.260] lstrlenA (lpString="*.mp4") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wmv") returned 0
	[0064.260] lstrlenA (lpString="*.wmv") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.divx") returned 0
	[0064.260] lstrlenA (lpString="*.divx") returned 6
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mkv") returned 0
	[0064.260] lstrlenA (lpString="*.mkv") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mp3") returned 0
	[0064.260] lstrlenA (lpString="*.mp3") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wav") returned 0
	[0064.260] lstrlenA (lpString="*.wav") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.flac") returned 0
	[0064.260] lstrlenA (lpString="*.flac") returned 6
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ape") returned 0
	[0064.260] lstrlenA (lpString="*.ape") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wma") returned 0
	[0064.260] lstrlenA (lpString="*.wma") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ac3") returned 0
	[0064.260] lstrlenA (lpString="*.ac3") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.exe") returned 0
	[0064.260] lstrlenA (lpString="*.exe") returned 5
	[0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.apk") returned 0
	[0064.260] lstrlenA (lpString="*.apk") returned 5
	[0064.260] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.260] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1
	[0064.260] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1
	[0064.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned="SoftBlue.css"
	[0064.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SpringGreen" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen"
	[0064.260] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen") returned 106
	[0064.260] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.263] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.263] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.263] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.263] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.263] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.263] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1
	[0064.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1
	[0064.263] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1
	[0064.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*") returned="*.*"
	[0064.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\"
	[0064.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned=""
	[0064.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt"
	[0064.263] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0xffffffff
	[0064.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.264] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.264] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.265] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.265] CloseHandle (hObject=0xa0) returned 1
	[0064.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF"
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0
	[0064.265] lstrlenA (lpString="*.zip") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0
	[0064.265] lstrlenA (lpString="*.rar") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0
	[0064.265] lstrlenA (lpString="*.7z") returned 4
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0
	[0064.265] lstrlenA (lpString="*.tar") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gzip") returned 0
	[0064.265] lstrlenA (lpString="*.gzip") returned 6
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0
	[0064.265] lstrlenA (lpString="*.jpg") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0
	[0064.265] lstrlenA (lpString="*.jpeg") returned 6
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0
	[0064.265] lstrlenA (lpString="*.psd") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.cdr") returned 0
	[0064.265] lstrlenA (lpString="*.cdr") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dwg") returned 0
	[0064.265] lstrlenA (lpString="*.dwg") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.max") returned 0
	[0064.265] lstrlenA (lpString="*.max") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.bmp") returned 0
	[0064.265] lstrlenA (lpString="*.bmp") returned 5
	[0064.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gif") returned 1
	[0064.265] lstrlenA (lpString="*.gif") returned 5
	[0064.265] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF"
	[0064.265] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF"
	[0064.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF."
	[0064.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.Boom"
	[0064.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.266] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac
	[0064.266] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.266] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.266] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x189, lpOverlapped=0x0) returned 1
	[0064.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF"
	[0064.267] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.267] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x189, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x189, lpOverlapped=0x0) returned 1
	[0064.267] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.267] CloseHandle (hObject=0xa0) returned 1
	[0064.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif.boom")) returned 1
	[0064.269] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.269] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0064.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0064.269] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0064.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF"
	[0064.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\"
	[0064.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned=""
	[0064.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt"
	[0064.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20
	[0064.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF"
	[0064.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0064.269] lstrlenA (lpString="*.zip") returned 5
	[0064.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0064.269] lstrlenA (lpString="*.rar") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0064.270] lstrlenA (lpString="*.7z") returned 4
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0064.270] lstrlenA (lpString="*.tar") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0064.270] lstrlenA (lpString="*.gzip") returned 6
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0064.270] lstrlenA (lpString="*.jpg") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0064.270] lstrlenA (lpString="*.jpeg") returned 6
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0064.270] lstrlenA (lpString="*.psd") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0064.270] lstrlenA (lpString="*.cdr") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0064.270] lstrlenA (lpString="*.dwg") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0064.270] lstrlenA (lpString="*.max") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0064.270] lstrlenA (lpString="*.bmp") returned 5
	[0064.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0064.270] lstrlenA (lpString="*.gif") returned 5
	[0064.270] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF"
	[0064.270] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF"
	[0064.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF."
	[0064.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.Boom"
	[0064.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.271] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.271] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.271] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.271] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.271] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.271] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.272] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.272] CloseHandle (hObject=0xa0) returned 1
	[0064.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif.boom")) returned 1
	[0064.272] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.272] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0064.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0064.272] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0064.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0064.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\"
	[0064.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned=""
	[0064.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt"
	[0064.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20
	[0064.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF"
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0064.273] lstrlenA (lpString="*.zip") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0064.273] lstrlenA (lpString="*.rar") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0064.273] lstrlenA (lpString="*.7z") returned 4
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0064.273] lstrlenA (lpString="*.tar") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0064.273] lstrlenA (lpString="*.gzip") returned 6
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0064.273] lstrlenA (lpString="*.jpg") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0064.273] lstrlenA (lpString="*.jpeg") returned 6
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0064.273] lstrlenA (lpString="*.psd") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0064.273] lstrlenA (lpString="*.cdr") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0064.273] lstrlenA (lpString="*.dwg") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0064.273] lstrlenA (lpString="*.max") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0064.273] lstrlenA (lpString="*.bmp") returned 5
	[0064.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0064.273] lstrlenA (lpString="*.gif") returned 5
	[0064.273] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF"
	[0064.273] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF"
	[0064.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF."
	[0064.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.Boom"
	[0064.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.274] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.274] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.274] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.274] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0064.275] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.275] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.275] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.275] CloseHandle (hObject=0xa0) returned 1
	[0064.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif.boom")) returned 1
	[0064.275] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.275] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.275] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.275] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.275] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SpringGreen.css") returned -1
	[0064.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1
	[0064.275] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1
	[0064.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.276] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css"
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.zip") returned 0
	[0064.276] lstrlenA (lpString="*.zip") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.rar") returned 0
	[0064.276] lstrlenA (lpString="*.rar") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.7z") returned 0
	[0064.276] lstrlenA (lpString="*.7z") returned 4
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.tar") returned 0
	[0064.276] lstrlenA (lpString="*.tar") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.gzip") returned 0
	[0064.276] lstrlenA (lpString="*.gzip") returned 6
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.jpg") returned 0
	[0064.276] lstrlenA (lpString="*.jpg") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.jpeg") returned 0
	[0064.276] lstrlenA (lpString="*.jpeg") returned 6
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.psd") returned 0
	[0064.276] lstrlenA (lpString="*.psd") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.cdr") returned 0
	[0064.276] lstrlenA (lpString="*.cdr") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.dwg") returned 0
	[0064.276] lstrlenA (lpString="*.dwg") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.max") returned 0
	[0064.276] lstrlenA (lpString="*.max") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.bmp") returned 0
	[0064.276] lstrlenA (lpString="*.bmp") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.gif") returned 0
	[0064.276] lstrlenA (lpString="*.gif") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.png") returned 0
	[0064.276] lstrlenA (lpString="*.png") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.doc") returned 0
	[0064.276] lstrlenA (lpString="*.doc") returned 5
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.docx") returned 0
	[0064.276] lstrlenA (lpString="*.docx") returned 6
	[0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.xls") returned 0
	[0064.277] lstrlenA (lpString="*.xls") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.xlsx") returned 0
	[0064.277] lstrlenA (lpString="*.xlsx") returned 6
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ppt") returned 0
	[0064.277] lstrlenA (lpString="*.ppt") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pptx") returned 0
	[0064.277] lstrlenA (lpString="*.pptx") returned 6
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.txt") returned 0
	[0064.277] lstrlenA (lpString="*.txt") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pdf") returned 0
	[0064.277] lstrlenA (lpString="*.pdf") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.djvu") returned 0
	[0064.277] lstrlenA (lpString="*.djvu") returned 6
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.htm") returned 0
	[0064.277] lstrlenA (lpString="*.htm") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.html") returned 0
	[0064.277] lstrlenA (lpString="*.html") returned 6
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mdb") returned 0
	[0064.277] lstrlenA (lpString="*.mdb") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.cer") returned 0
	[0064.277] lstrlenA (lpString="*.cer") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.p12") returned 0
	[0064.277] lstrlenA (lpString="*.p12") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pfx") returned 0
	[0064.277] lstrlenA (lpString="*.pfx") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.kwm") returned 0
	[0064.277] lstrlenA (lpString="*.kwm") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pwm") returned 0
	[0064.277] lstrlenA (lpString="*.pwm") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.1cd") returned 0
	[0064.277] lstrlenA (lpString="*.1cd") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.md") returned 0
	[0064.277] lstrlenA (lpString="*.md") returned 4
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mdf") returned 0
	[0064.277] lstrlenA (lpString="*.mdf") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.dbf") returned 0
	[0064.277] lstrlenA (lpString="*.dbf") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.odt") returned 0
	[0064.277] lstrlenA (lpString="*.odt") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.vob") returned 0
	[0064.277] lstrlenA (lpString="*.vob") returned 5
	[0064.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ifo") returned 0
	[0064.277] lstrlenA (lpString="*.ifo") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.lnk") returned 0
	[0064.278] lstrlenA (lpString="*.lnk") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.torrent") returned 0
	[0064.278] lstrlenA (lpString="*.torrent") returned 9
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mov") returned 0
	[0064.278] lstrlenA (lpString="*.mov") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.m2v") returned 0
	[0064.278] lstrlenA (lpString="*.m2v") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.3gp") returned 0
	[0064.278] lstrlenA (lpString="*.3gp") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mpeg") returned 0
	[0064.278] lstrlenA (lpString="*.mpeg") returned 6
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mpg") returned 0
	[0064.278] lstrlenA (lpString="*.mpg") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.flv") returned 0
	[0064.278] lstrlenA (lpString="*.flv") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.avi") returned 0
	[0064.278] lstrlenA (lpString="*.avi") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mp4") returned 0
	[0064.278] lstrlenA (lpString="*.mp4") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wmv") returned 0
	[0064.278] lstrlenA (lpString="*.wmv") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.divx") returned 0
	[0064.278] lstrlenA (lpString="*.divx") returned 6
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mkv") returned 0
	[0064.278] lstrlenA (lpString="*.mkv") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mp3") returned 0
	[0064.278] lstrlenA (lpString="*.mp3") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wav") returned 0
	[0064.278] lstrlenA (lpString="*.wav") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.flac") returned 0
	[0064.278] lstrlenA (lpString="*.flac") returned 6
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ape") returned 0
	[0064.278] lstrlenA (lpString="*.ape") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wma") returned 0
	[0064.278] lstrlenA (lpString="*.wma") returned 5
	[0064.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ac3") returned 0
	[0064.278] lstrlenA (lpString="*.ac3") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.exe") returned 0
	[0064.279] lstrlenA (lpString="*.exe") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.apk") returned 0
	[0064.279] lstrlenA (lpString="*.apk") returned 5
	[0064.279] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.279] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.279] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts.css") returned -1
	[0064.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1
	[0064.279] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1
	[0064.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css"
	[0064.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css"
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.zip") returned 0
	[0064.279] lstrlenA (lpString="*.zip") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.rar") returned 0
	[0064.279] lstrlenA (lpString="*.rar") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.7z") returned 0
	[0064.279] lstrlenA (lpString="*.7z") returned 4
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.tar") returned 0
	[0064.279] lstrlenA (lpString="*.tar") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.gzip") returned 0
	[0064.279] lstrlenA (lpString="*.gzip") returned 6
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.jpg") returned 0
	[0064.279] lstrlenA (lpString="*.jpg") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.jpeg") returned 0
	[0064.279] lstrlenA (lpString="*.jpeg") returned 6
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.psd") returned 0
	[0064.279] lstrlenA (lpString="*.psd") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.cdr") returned 0
	[0064.279] lstrlenA (lpString="*.cdr") returned 5
	[0064.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.dwg") returned 0
	[0064.280] lstrlenA (lpString="*.dwg") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.max") returned 0
	[0064.280] lstrlenA (lpString="*.max") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.bmp") returned 0
	[0064.280] lstrlenA (lpString="*.bmp") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.gif") returned 0
	[0064.280] lstrlenA (lpString="*.gif") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.png") returned 0
	[0064.280] lstrlenA (lpString="*.png") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.doc") returned 0
	[0064.280] lstrlenA (lpString="*.doc") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.docx") returned 0
	[0064.280] lstrlenA (lpString="*.docx") returned 6
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.xls") returned 0
	[0064.280] lstrlenA (lpString="*.xls") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.xlsx") returned 0
	[0064.280] lstrlenA (lpString="*.xlsx") returned 6
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ppt") returned 0
	[0064.280] lstrlenA (lpString="*.ppt") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pptx") returned 0
	[0064.280] lstrlenA (lpString="*.pptx") returned 6
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.txt") returned 0
	[0064.280] lstrlenA (lpString="*.txt") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pdf") returned 0
	[0064.280] lstrlenA (lpString="*.pdf") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.djvu") returned 0
	[0064.280] lstrlenA (lpString="*.djvu") returned 6
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.htm") returned 0
	[0064.280] lstrlenA (lpString="*.htm") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.html") returned 0
	[0064.280] lstrlenA (lpString="*.html") returned 6
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mdb") returned 0
	[0064.280] lstrlenA (lpString="*.mdb") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.cer") returned 0
	[0064.280] lstrlenA (lpString="*.cer") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.p12") returned 0
	[0064.280] lstrlenA (lpString="*.p12") returned 5
	[0064.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pfx") returned 0
	[0064.280] lstrlenA (lpString="*.pfx") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.kwm") returned 0
	[0064.281] lstrlenA (lpString="*.kwm") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pwm") returned 0
	[0064.281] lstrlenA (lpString="*.pwm") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.1cd") returned 0
	[0064.281] lstrlenA (lpString="*.1cd") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.md") returned 0
	[0064.281] lstrlenA (lpString="*.md") returned 4
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mdf") returned 0
	[0064.281] lstrlenA (lpString="*.mdf") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.dbf") returned 0
	[0064.281] lstrlenA (lpString="*.dbf") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.odt") returned 0
	[0064.281] lstrlenA (lpString="*.odt") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.vob") returned 0
	[0064.281] lstrlenA (lpString="*.vob") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ifo") returned 0
	[0064.281] lstrlenA (lpString="*.ifo") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.lnk") returned 0
	[0064.281] lstrlenA (lpString="*.lnk") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.torrent") returned 0
	[0064.281] lstrlenA (lpString="*.torrent") returned 9
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mov") returned 0
	[0064.281] lstrlenA (lpString="*.mov") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.m2v") returned 0
	[0064.281] lstrlenA (lpString="*.m2v") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.3gp") returned 0
	[0064.281] lstrlenA (lpString="*.3gp") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mpeg") returned 0
	[0064.281] lstrlenA (lpString="*.mpeg") returned 6
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mpg") returned 0
	[0064.281] lstrlenA (lpString="*.mpg") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.flv") returned 0
	[0064.281] lstrlenA (lpString="*.flv") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.avi") returned 0
	[0064.281] lstrlenA (lpString="*.avi") returned 5
	[0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mp4") returned 0
	[0064.281] lstrlenA (lpString="*.mp4") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wmv") returned 0
	[0064.282] lstrlenA (lpString="*.wmv") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.divx") returned 0
	[0064.282] lstrlenA (lpString="*.divx") returned 6
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mkv") returned 0
	[0064.282] lstrlenA (lpString="*.mkv") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mp3") returned 0
	[0064.282] lstrlenA (lpString="*.mp3") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wav") returned 0
	[0064.282] lstrlenA (lpString="*.wav") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.flac") returned 0
	[0064.282] lstrlenA (lpString="*.flac") returned 6
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ape") returned 0
	[0064.282] lstrlenA (lpString="*.ape") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wma") returned 0
	[0064.282] lstrlenA (lpString="*.wma") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ac3") returned 0
	[0064.282] lstrlenA (lpString="*.ac3") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.exe") returned 0
	[0064.282] lstrlenA (lpString="*.exe") returned 5
	[0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.apk") returned 0
	[0064.282] lstrlenA (lpString="*.apk") returned 5
	[0064.282] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.282] lstrcmpA (lpString1=".", lpString2="STS2") returned -1
	[0064.282] lstrcmpA (lpString1="..", lpString2="STS2") returned -1
	[0064.282] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned="Sts.css"
	[0064.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2"
	[0064.282] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2") returned 99
	[0064.282] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.283] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.283] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.283] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.283] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.283] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.283] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.283] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0064.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0064.283] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0064.283] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*") returned="*.*"
	[0064.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\"
	[0064.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned=""
	[0064.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0064.283] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0xffffffff
	[0064.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.285] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.285] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.286] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.286] CloseHandle (hObject=0xa0) returned 1
	[0064.286] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif"
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.zip") returned 0
	[0064.286] lstrlenA (lpString="*.zip") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.rar") returned 0
	[0064.286] lstrlenA (lpString="*.rar") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.7z") returned 0
	[0064.286] lstrlenA (lpString="*.7z") returned 4
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.tar") returned 0
	[0064.286] lstrlenA (lpString="*.tar") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.gzip") returned 0
	[0064.286] lstrlenA (lpString="*.gzip") returned 6
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpg") returned 0
	[0064.286] lstrlenA (lpString="*.jpg") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpeg") returned 0
	[0064.286] lstrlenA (lpString="*.jpeg") returned 6
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.psd") returned 0
	[0064.286] lstrlenA (lpString="*.psd") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.cdr") returned 0
	[0064.286] lstrlenA (lpString="*.cdr") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.dwg") returned 0
	[0064.286] lstrlenA (lpString="*.dwg") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.max") returned 0
	[0064.286] lstrlenA (lpString="*.max") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.bmp") returned 0
	[0064.286] lstrlenA (lpString="*.bmp") returned 5
	[0064.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.gif") returned 1
	[0064.286] lstrlenA (lpString="*.gif") returned 5
	[0064.287] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif"
	[0064.287] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif"
	[0064.287] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif."
	[0064.287] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.Boom"
	[0064.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.287] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9
	[0064.287] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.287] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.287] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc6, lpOverlapped=0x0) returned 1
	[0064.288] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="background.gif"
	[0064.288] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.288] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc6, lpOverlapped=0x0) returned 1
	[0064.288] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.288] CloseHandle (hObject=0xa0) returned 1
	[0064.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.boom")) returned 1
	[0064.289] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.289] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.289] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="header.gif") returned -1
	[0064.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="header.gif") returned 1
	[0064.289] lstrcmpiA (lpString1="", lpString2="header.gif") returned -1
	[0064.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="background.gif"
	[0064.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\"
	[0064.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned=""
	[0064.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0064.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20
	[0064.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif"
	[0064.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.zip") returned 0
	[0064.289] lstrlenA (lpString="*.zip") returned 5
	[0064.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.rar") returned 0
	[0064.289] lstrlenA (lpString="*.rar") returned 5
	[0064.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.7z") returned 0
	[0064.289] lstrlenA (lpString="*.7z") returned 4
	[0064.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.tar") returned 0
	[0064.289] lstrlenA (lpString="*.tar") returned 5
	[0064.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.gzip") returned 0
	[0064.289] lstrlenA (lpString="*.gzip") returned 6
	[0064.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.jpg") returned 0
	[0064.289] lstrlenA (lpString="*.jpg") returned 5
	[0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.jpeg") returned 0
	[0064.290] lstrlenA (lpString="*.jpeg") returned 6
	[0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.psd") returned 0
	[0064.290] lstrlenA (lpString="*.psd") returned 5
	[0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.cdr") returned 0
	[0064.290] lstrlenA (lpString="*.cdr") returned 5
	[0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.dwg") returned 0
	[0064.290] lstrlenA (lpString="*.dwg") returned 5
	[0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.max") returned 0
	[0064.290] lstrlenA (lpString="*.max") returned 5
	[0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.bmp") returned 0
	[0064.290] lstrlenA (lpString="*.bmp") returned 5
	[0064.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.gif") returned 1
	[0064.290] lstrlenA (lpString="*.gif") returned 5
	[0064.290] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif"
	[0064.290] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif"
	[0064.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif."
	[0064.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.Boom"
	[0064.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.290] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbd
	[0064.290] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.290] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.290] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc9a, lpOverlapped=0x0) returned 1
	[0064.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="header.gif"
	[0064.308] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.308] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc9a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc9a, lpOverlapped=0x0) returned 1
	[0064.308] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.308] CloseHandle (hObject=0xa0) returned 1
	[0064.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.boom")) returned 1
	[0064.309] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.309] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.309] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1
	[0064.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1
	[0064.309] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1
	[0064.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="header.gif"
	[0064.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\"
	[0064.309] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned=""
	[0064.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0064.309] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20
	[0064.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif"
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.zip") returned 0
	[0064.310] lstrlenA (lpString="*.zip") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.rar") returned 0
	[0064.310] lstrlenA (lpString="*.rar") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.7z") returned 0
	[0064.310] lstrlenA (lpString="*.7z") returned 4
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.tar") returned 0
	[0064.310] lstrlenA (lpString="*.tar") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.gzip") returned 0
	[0064.310] lstrlenA (lpString="*.gzip") returned 6
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.jpg") returned 0
	[0064.310] lstrlenA (lpString="*.jpg") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.jpeg") returned 0
	[0064.310] lstrlenA (lpString="*.jpeg") returned 6
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.psd") returned 0
	[0064.310] lstrlenA (lpString="*.psd") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.cdr") returned 0
	[0064.310] lstrlenA (lpString="*.cdr") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.dwg") returned 0
	[0064.310] lstrlenA (lpString="*.dwg") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.max") returned 0
	[0064.310] lstrlenA (lpString="*.max") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.bmp") returned 0
	[0064.310] lstrlenA (lpString="*.bmp") returned 5
	[0064.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.gif") returned 1
	[0064.310] lstrlenA (lpString="*.gif") returned 5
	[0064.310] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif"
	[0064.310] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif"
	[0064.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif."
	[0064.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.Boom"
	[0064.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.311] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce
	[0064.311] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.311] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.311] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ab, lpOverlapped=0x0) returned 1
	[0064.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="tab_off.gif"
	[0064.312] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.312] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ab, lpOverlapped=0x0) returned 1
	[0064.312] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.312] CloseHandle (hObject=0xa0) returned 1
	[0064.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.boom")) returned 1
	[0064.312] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.312] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.312] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1
	[0064.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1
	[0064.312] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1
	[0064.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="tab_off.gif"
	[0064.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\"
	[0064.313] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned=""
	[0064.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0064.313] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20
	[0064.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif"
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.zip") returned 0
	[0064.313] lstrlenA (lpString="*.zip") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.rar") returned 0
	[0064.313] lstrlenA (lpString="*.rar") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.7z") returned 0
	[0064.313] lstrlenA (lpString="*.7z") returned 4
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.tar") returned 0
	[0064.313] lstrlenA (lpString="*.tar") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.gzip") returned 0
	[0064.313] lstrlenA (lpString="*.gzip") returned 6
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.jpg") returned 0
	[0064.313] lstrlenA (lpString="*.jpg") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.jpeg") returned 0
	[0064.313] lstrlenA (lpString="*.jpeg") returned 6
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.psd") returned 0
	[0064.313] lstrlenA (lpString="*.psd") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.cdr") returned 0
	[0064.313] lstrlenA (lpString="*.cdr") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.dwg") returned 0
	[0064.313] lstrlenA (lpString="*.dwg") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.max") returned 0
	[0064.313] lstrlenA (lpString="*.max") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.bmp") returned 0
	[0064.313] lstrlenA (lpString="*.bmp") returned 5
	[0064.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.gif") returned 1
	[0064.313] lstrlenA (lpString="*.gif") returned 5
	[0064.313] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif"
	[0064.313] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif"
	[0064.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif."
	[0064.314] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.Boom"
	[0064.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.314] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108
	[0064.314] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.314] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.314] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xe5, lpOverlapped=0x0) returned 1
	[0064.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="tab_on.gif"
	[0064.315] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.315] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xe5, lpOverlapped=0x0) returned 1
	[0064.315] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.315] CloseHandle (hObject=0xa0) returned 1
	[0064.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.boom")) returned 1
	[0064.315] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.315] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.316] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.316] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.316] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts2.css") returned -1
	[0064.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1
	[0064.316] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1
	[0064.316] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.316] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.316] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css"
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.zip") returned 0
	[0064.316] lstrlenA (lpString="*.zip") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.rar") returned 0
	[0064.316] lstrlenA (lpString="*.rar") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.7z") returned 0
	[0064.316] lstrlenA (lpString="*.7z") returned 4
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.tar") returned 0
	[0064.316] lstrlenA (lpString="*.tar") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.gzip") returned 0
	[0064.316] lstrlenA (lpString="*.gzip") returned 6
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.jpg") returned 0
	[0064.316] lstrlenA (lpString="*.jpg") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.jpeg") returned 0
	[0064.316] lstrlenA (lpString="*.jpeg") returned 6
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.psd") returned 0
	[0064.316] lstrlenA (lpString="*.psd") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.cdr") returned 0
	[0064.316] lstrlenA (lpString="*.cdr") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.dwg") returned 0
	[0064.316] lstrlenA (lpString="*.dwg") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.max") returned 0
	[0064.316] lstrlenA (lpString="*.max") returned 5
	[0064.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.bmp") returned 0
	[0064.316] lstrlenA (lpString="*.bmp") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.gif") returned 0
	[0064.317] lstrlenA (lpString="*.gif") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.png") returned 0
	[0064.317] lstrlenA (lpString="*.png") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.doc") returned 0
	[0064.317] lstrlenA (lpString="*.doc") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.docx") returned 0
	[0064.317] lstrlenA (lpString="*.docx") returned 6
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.xls") returned 0
	[0064.317] lstrlenA (lpString="*.xls") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.xlsx") returned 0
	[0064.317] lstrlenA (lpString="*.xlsx") returned 6
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ppt") returned 0
	[0064.317] lstrlenA (lpString="*.ppt") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pptx") returned 0
	[0064.317] lstrlenA (lpString="*.pptx") returned 6
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.txt") returned 0
	[0064.317] lstrlenA (lpString="*.txt") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pdf") returned 0
	[0064.317] lstrlenA (lpString="*.pdf") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.djvu") returned 0
	[0064.317] lstrlenA (lpString="*.djvu") returned 6
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.htm") returned 0
	[0064.317] lstrlenA (lpString="*.htm") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.html") returned 0
	[0064.317] lstrlenA (lpString="*.html") returned 6
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mdb") returned 0
	[0064.317] lstrlenA (lpString="*.mdb") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.cer") returned 0
	[0064.317] lstrlenA (lpString="*.cer") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.p12") returned 0
	[0064.317] lstrlenA (lpString="*.p12") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pfx") returned 0
	[0064.317] lstrlenA (lpString="*.pfx") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.kwm") returned 0
	[0064.317] lstrlenA (lpString="*.kwm") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pwm") returned 0
	[0064.317] lstrlenA (lpString="*.pwm") returned 5
	[0064.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.1cd") returned 0
	[0064.317] lstrlenA (lpString="*.1cd") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.md") returned 0
	[0064.318] lstrlenA (lpString="*.md") returned 4
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mdf") returned 0
	[0064.318] lstrlenA (lpString="*.mdf") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.dbf") returned 0
	[0064.318] lstrlenA (lpString="*.dbf") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.odt") returned 0
	[0064.318] lstrlenA (lpString="*.odt") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.vob") returned 0
	[0064.318] lstrlenA (lpString="*.vob") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ifo") returned 0
	[0064.318] lstrlenA (lpString="*.ifo") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.lnk") returned 0
	[0064.318] lstrlenA (lpString="*.lnk") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.torrent") returned 0
	[0064.318] lstrlenA (lpString="*.torrent") returned 9
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mov") returned 0
	[0064.318] lstrlenA (lpString="*.mov") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.m2v") returned 0
	[0064.318] lstrlenA (lpString="*.m2v") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.3gp") returned 0
	[0064.318] lstrlenA (lpString="*.3gp") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mpeg") returned 0
	[0064.318] lstrlenA (lpString="*.mpeg") returned 6
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mpg") returned 0
	[0064.318] lstrlenA (lpString="*.mpg") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.flv") returned 0
	[0064.318] lstrlenA (lpString="*.flv") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.avi") returned 0
	[0064.318] lstrlenA (lpString="*.avi") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mp4") returned 0
	[0064.318] lstrlenA (lpString="*.mp4") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wmv") returned 0
	[0064.318] lstrlenA (lpString="*.wmv") returned 5
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.divx") returned 0
	[0064.318] lstrlenA (lpString="*.divx") returned 6
	[0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mkv") returned 0
	[0064.318] lstrlenA (lpString="*.mkv") returned 5
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mp3") returned 0
	[0064.319] lstrlenA (lpString="*.mp3") returned 5
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wav") returned 0
	[0064.319] lstrlenA (lpString="*.wav") returned 5
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.flac") returned 0
	[0064.319] lstrlenA (lpString="*.flac") returned 6
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ape") returned 0
	[0064.319] lstrlenA (lpString="*.ape") returned 5
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wma") returned 0
	[0064.319] lstrlenA (lpString="*.wma") returned 5
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ac3") returned 0
	[0064.319] lstrlenA (lpString="*.ac3") returned 5
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.exe") returned 0
	[0064.319] lstrlenA (lpString="*.exe") returned 5
	[0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.apk") returned 0
	[0064.319] lstrlenA (lpString="*.apk") returned 5
	[0064.319] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.319] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1
	[0064.319] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1
	[0064.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned="Sts2.css"
	[0064.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl"
	[0064.319] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl") returned 100
	[0064.319] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0064.319] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.319] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.319] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.319] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.319] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.319] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.319] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0064.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0064.319] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0064.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*") returned="*.*"
	[0064.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\"
	[0064.320] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned=""
	[0064.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0064.320] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0xffffffff
	[0064.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.321] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.321] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.322] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.322] CloseHandle (hObject=0xa0) returned 1
	[0064.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif"
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.zip") returned 0
	[0064.322] lstrlenA (lpString="*.zip") returned 5
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.rar") returned 0
	[0064.322] lstrlenA (lpString="*.rar") returned 5
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.7z") returned 0
	[0064.322] lstrlenA (lpString="*.7z") returned 4
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.tar") returned 0
	[0064.322] lstrlenA (lpString="*.tar") returned 5
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gzip") returned 0
	[0064.322] lstrlenA (lpString="*.gzip") returned 6
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpg") returned 0
	[0064.322] lstrlenA (lpString="*.jpg") returned 5
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpeg") returned 0
	[0064.322] lstrlenA (lpString="*.jpeg") returned 6
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.psd") returned 0
	[0064.322] lstrlenA (lpString="*.psd") returned 5
	[0064.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.cdr") returned 0
	[0064.323] lstrlenA (lpString="*.cdr") returned 5
	[0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.dwg") returned 0
	[0064.323] lstrlenA (lpString="*.dwg") returned 5
	[0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.max") returned 0
	[0064.323] lstrlenA (lpString="*.max") returned 5
	[0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.bmp") returned 0
	[0064.323] lstrlenA (lpString="*.bmp") returned 5
	[0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gif") returned 1
	[0064.323] lstrlenA (lpString="*.gif") returned 5
	[0064.323] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif"
	[0064.323] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif"
	[0064.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif."
	[0064.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.Boom"
	[0064.323] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.323] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32f
	[0064.323] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.323] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.323] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x30c, lpOverlapped=0x0) returned 1
	[0064.325] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="background.gif"
	[0064.325] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.325] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x30c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x30c, lpOverlapped=0x0) returned 1
	[0064.325] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.325] CloseHandle (hObject=0xa0) returned 1
	[0064.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.boom")) returned 1
	[0064.325] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.325] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.325] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="header.gif") returned -1
	[0064.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="header.gif") returned 1
	[0064.325] lstrcmpiA (lpString1="", lpString2="header.gif") returned -1
	[0064.325] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="background.gif"
	[0064.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\"
	[0064.326] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned=""
	[0064.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0064.326] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20
	[0064.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif"
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.zip") returned 0
	[0064.326] lstrlenA (lpString="*.zip") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.rar") returned 0
	[0064.326] lstrlenA (lpString="*.rar") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.7z") returned 0
	[0064.326] lstrlenA (lpString="*.7z") returned 4
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.tar") returned 0
	[0064.326] lstrlenA (lpString="*.tar") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.gzip") returned 0
	[0064.326] lstrlenA (lpString="*.gzip") returned 6
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.jpg") returned 0
	[0064.326] lstrlenA (lpString="*.jpg") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.jpeg") returned 0
	[0064.326] lstrlenA (lpString="*.jpeg") returned 6
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.psd") returned 0
	[0064.326] lstrlenA (lpString="*.psd") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.cdr") returned 0
	[0064.326] lstrlenA (lpString="*.cdr") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.dwg") returned 0
	[0064.326] lstrlenA (lpString="*.dwg") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.max") returned 0
	[0064.326] lstrlenA (lpString="*.max") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.bmp") returned 0
	[0064.326] lstrlenA (lpString="*.bmp") returned 5
	[0064.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.gif") returned 1
	[0064.326] lstrlenA (lpString="*.gif") returned 5
	[0064.326] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif"
	[0064.326] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif"
	[0064.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif."
	[0064.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.Boom"
	[0064.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.327] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6993
	[0064.327] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.327] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.327] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6970, lpOverlapped=0x0) returned 1
	[0064.337] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="header.gif"
	[0064.338] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.338] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6970, lpOverlapped=0x0) returned 1
	[0064.338] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.338] CloseHandle (hObject=0xa0) returned 1
	[0064.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.boom")) returned 1
	[0064.339] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.339] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.339] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1
	[0064.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1
	[0064.339] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1
	[0064.339] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="header.gif"
	[0064.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\"
	[0064.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned=""
	[0064.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0064.339] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20
	[0064.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif"
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.zip") returned 0
	[0064.339] lstrlenA (lpString="*.zip") returned 5
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.rar") returned 0
	[0064.339] lstrlenA (lpString="*.rar") returned 5
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.7z") returned 0
	[0064.339] lstrlenA (lpString="*.7z") returned 4
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.tar") returned 0
	[0064.339] lstrlenA (lpString="*.tar") returned 5
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.gzip") returned 0
	[0064.339] lstrlenA (lpString="*.gzip") returned 6
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.jpg") returned 0
	[0064.339] lstrlenA (lpString="*.jpg") returned 5
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.jpeg") returned 0
	[0064.339] lstrlenA (lpString="*.jpeg") returned 6
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.psd") returned 0
	[0064.339] lstrlenA (lpString="*.psd") returned 5
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.cdr") returned 0
	[0064.339] lstrlenA (lpString="*.cdr") returned 5
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.dwg") returned 0
	[0064.339] lstrlenA (lpString="*.dwg") returned 5
	[0064.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.max") returned 0
	[0064.340] lstrlenA (lpString="*.max") returned 5
	[0064.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.bmp") returned 0
	[0064.340] lstrlenA (lpString="*.bmp") returned 5
	[0064.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.gif") returned 1
	[0064.340] lstrlenA (lpString="*.gif") returned 5
	[0064.340] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif"
	[0064.340] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif"
	[0064.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif."
	[0064.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.Boom"
	[0064.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.340] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0064.340] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.340] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.340] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0064.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="tab_off.gif"
	[0064.341] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.341] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0064.341] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.341] CloseHandle (hObject=0xa0) returned 1
	[0064.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.boom")) returned 1
	[0064.342] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0064.342] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0064.342] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1
	[0064.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1
	[0064.342] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1
	[0064.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="tab_off.gif"
	[0064.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\"
	[0064.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned=""
	[0064.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0064.342] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20
	[0064.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif"
	[0064.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.zip") returned 0
	[0064.342] lstrlenA (lpString="*.zip") returned 5
	[0064.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.rar") returned 0
	[0064.342] lstrlenA (lpString="*.rar") returned 5
	[0064.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.7z") returned 0
	[0064.342] lstrlenA (lpString="*.7z") returned 4
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.tar") returned 0
	[0064.343] lstrlenA (lpString="*.tar") returned 5
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.gzip") returned 0
	[0064.343] lstrlenA (lpString="*.gzip") returned 6
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.jpg") returned 0
	[0064.343] lstrlenA (lpString="*.jpg") returned 5
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.jpeg") returned 0
	[0064.343] lstrlenA (lpString="*.jpeg") returned 6
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.psd") returned 0
	[0064.343] lstrlenA (lpString="*.psd") returned 5
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.cdr") returned 0
	[0064.343] lstrlenA (lpString="*.cdr") returned 5
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.dwg") returned 0
	[0064.343] lstrlenA (lpString="*.dwg") returned 5
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.max") returned 0
	[0064.343] lstrlenA (lpString="*.max") returned 5
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.bmp") returned 0
	[0064.343] lstrlenA (lpString="*.bmp") returned 5
	[0064.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.gif") returned 1
	[0064.343] lstrlenA (lpString="*.gif") returned 5
	[0064.343] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif"
	[0064.343] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif"
	[0064.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif."
	[0064.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.Boom"
	[0064.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0064.343] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0064.344] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.344] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.344] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0064.344] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="tab_on.gif"
	[0064.344] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.344] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0064.344] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.345] CloseHandle (hObject=0xa0) returned 1
	[0064.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.boom")) returned 1
	[0064.345] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0064.345] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0064.345] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.345] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Swirl.css") returned -1
	[0064.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1
	[0064.345] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1
	[0064.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*"
	[0064.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.345] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.345] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css"
	[0064.345] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.zip") returned 0
	[0064.346] lstrlenA (lpString="*.zip") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.rar") returned 0
	[0064.346] lstrlenA (lpString="*.rar") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.7z") returned 0
	[0064.346] lstrlenA (lpString="*.7z") returned 4
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.tar") returned 0
	[0064.346] lstrlenA (lpString="*.tar") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.gzip") returned 0
	[0064.346] lstrlenA (lpString="*.gzip") returned 6
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.jpg") returned 0
	[0064.346] lstrlenA (lpString="*.jpg") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.jpeg") returned 0
	[0064.346] lstrlenA (lpString="*.jpeg") returned 6
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.psd") returned 0
	[0064.346] lstrlenA (lpString="*.psd") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.cdr") returned 0
	[0064.346] lstrlenA (lpString="*.cdr") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.dwg") returned 0
	[0064.346] lstrlenA (lpString="*.dwg") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.max") returned 0
	[0064.346] lstrlenA (lpString="*.max") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.bmp") returned 0
	[0064.346] lstrlenA (lpString="*.bmp") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.gif") returned 0
	[0064.346] lstrlenA (lpString="*.gif") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.png") returned 0
	[0064.346] lstrlenA (lpString="*.png") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.doc") returned 0
	[0064.346] lstrlenA (lpString="*.doc") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.docx") returned 0
	[0064.346] lstrlenA (lpString="*.docx") returned 6
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.xls") returned 0
	[0064.346] lstrlenA (lpString="*.xls") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.xlsx") returned 0
	[0064.346] lstrlenA (lpString="*.xlsx") returned 6
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ppt") returned 0
	[0064.346] lstrlenA (lpString="*.ppt") returned 5
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pptx") returned 0
	[0064.346] lstrlenA (lpString="*.pptx") returned 6
	[0064.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.txt") returned 0
	[0064.347] lstrlenA (lpString="*.txt") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pdf") returned 0
	[0064.347] lstrlenA (lpString="*.pdf") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.djvu") returned 0
	[0064.347] lstrlenA (lpString="*.djvu") returned 6
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.htm") returned 0
	[0064.347] lstrlenA (lpString="*.htm") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.html") returned 0
	[0064.347] lstrlenA (lpString="*.html") returned 6
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mdb") returned 0
	[0064.347] lstrlenA (lpString="*.mdb") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.cer") returned 0
	[0064.347] lstrlenA (lpString="*.cer") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.p12") returned 0
	[0064.347] lstrlenA (lpString="*.p12") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pfx") returned 0
	[0064.347] lstrlenA (lpString="*.pfx") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.kwm") returned 0
	[0064.347] lstrlenA (lpString="*.kwm") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pwm") returned 0
	[0064.347] lstrlenA (lpString="*.pwm") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.1cd") returned 0
	[0064.347] lstrlenA (lpString="*.1cd") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.md") returned 0
	[0064.347] lstrlenA (lpString="*.md") returned 4
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mdf") returned 0
	[0064.347] lstrlenA (lpString="*.mdf") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.dbf") returned 0
	[0064.347] lstrlenA (lpString="*.dbf") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.odt") returned 0
	[0064.347] lstrlenA (lpString="*.odt") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.vob") returned 0
	[0064.347] lstrlenA (lpString="*.vob") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ifo") returned 0
	[0064.347] lstrlenA (lpString="*.ifo") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.lnk") returned 0
	[0064.347] lstrlenA (lpString="*.lnk") returned 5
	[0064.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.torrent") returned 0
	[0064.347] lstrlenA (lpString="*.torrent") returned 9
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mov") returned 0
	[0064.348] lstrlenA (lpString="*.mov") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.m2v") returned 0
	[0064.348] lstrlenA (lpString="*.m2v") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.3gp") returned 0
	[0064.348] lstrlenA (lpString="*.3gp") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mpeg") returned 0
	[0064.348] lstrlenA (lpString="*.mpeg") returned 6
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mpg") returned 0
	[0064.348] lstrlenA (lpString="*.mpg") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.flv") returned 0
	[0064.348] lstrlenA (lpString="*.flv") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.avi") returned 0
	[0064.348] lstrlenA (lpString="*.avi") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mp4") returned 0
	[0064.348] lstrlenA (lpString="*.mp4") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wmv") returned 0
	[0064.348] lstrlenA (lpString="*.wmv") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.divx") returned 0
	[0064.348] lstrlenA (lpString="*.divx") returned 6
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mkv") returned 0
	[0064.348] lstrlenA (lpString="*.mkv") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mp3") returned 0
	[0064.348] lstrlenA (lpString="*.mp3") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wav") returned 0
	[0064.348] lstrlenA (lpString="*.wav") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.flac") returned 0
	[0064.348] lstrlenA (lpString="*.flac") returned 6
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ape") returned 0
	[0064.348] lstrlenA (lpString="*.ape") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wma") returned 0
	[0064.348] lstrlenA (lpString="*.wma") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ac3") returned 0
	[0064.348] lstrlenA (lpString="*.ac3") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.exe") returned 0
	[0064.348] lstrlenA (lpString="*.exe") returned 5
	[0064.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.apk") returned 0
	[0064.348] lstrlenA (lpString="*.apk") returned 5
	[0064.349] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.349] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.349] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Teal.css") returned -1
	[0064.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1
	[0064.349] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1
	[0064.349] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned="Swirl.css"
	[0064.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.349] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css"
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.zip") returned 0
	[0064.349] lstrlenA (lpString="*.zip") returned 5
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.rar") returned 0
	[0064.349] lstrlenA (lpString="*.rar") returned 5
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.7z") returned 0
	[0064.349] lstrlenA (lpString="*.7z") returned 4
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.tar") returned 0
	[0064.349] lstrlenA (lpString="*.tar") returned 5
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.gzip") returned 0
	[0064.349] lstrlenA (lpString="*.gzip") returned 6
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.jpg") returned 0
	[0064.349] lstrlenA (lpString="*.jpg") returned 5
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.jpeg") returned 0
	[0064.349] lstrlenA (lpString="*.jpeg") returned 6
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.psd") returned 0
	[0064.349] lstrlenA (lpString="*.psd") returned 5
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.cdr") returned 0
	[0064.349] lstrlenA (lpString="*.cdr") returned 5
	[0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.dwg") returned 0
	[0064.350] lstrlenA (lpString="*.dwg") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.max") returned 0
	[0064.350] lstrlenA (lpString="*.max") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.bmp") returned 0
	[0064.350] lstrlenA (lpString="*.bmp") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.gif") returned 0
	[0064.350] lstrlenA (lpString="*.gif") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.png") returned 0
	[0064.350] lstrlenA (lpString="*.png") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.doc") returned 0
	[0064.350] lstrlenA (lpString="*.doc") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.docx") returned 0
	[0064.350] lstrlenA (lpString="*.docx") returned 6
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.xls") returned 0
	[0064.350] lstrlenA (lpString="*.xls") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.xlsx") returned 0
	[0064.350] lstrlenA (lpString="*.xlsx") returned 6
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ppt") returned 0
	[0064.350] lstrlenA (lpString="*.ppt") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pptx") returned 0
	[0064.350] lstrlenA (lpString="*.pptx") returned 6
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.txt") returned 0
	[0064.350] lstrlenA (lpString="*.txt") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pdf") returned 0
	[0064.350] lstrlenA (lpString="*.pdf") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.djvu") returned 0
	[0064.350] lstrlenA (lpString="*.djvu") returned 6
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.htm") returned 0
	[0064.350] lstrlenA (lpString="*.htm") returned 5
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.html") returned 0
	[0064.350] lstrlenA (lpString="*.html") returned 6
	[0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mdb") returned 0
	[0064.351] lstrlenA (lpString="*.mdb") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.cer") returned 0
	[0064.351] lstrlenA (lpString="*.cer") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.p12") returned 0
	[0064.351] lstrlenA (lpString="*.p12") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pfx") returned 0
	[0064.351] lstrlenA (lpString="*.pfx") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.kwm") returned 0
	[0064.351] lstrlenA (lpString="*.kwm") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pwm") returned 0
	[0064.351] lstrlenA (lpString="*.pwm") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.1cd") returned 0
	[0064.351] lstrlenA (lpString="*.1cd") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.md") returned 0
	[0064.351] lstrlenA (lpString="*.md") returned 4
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mdf") returned 0
	[0064.351] lstrlenA (lpString="*.mdf") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.dbf") returned 0
	[0064.351] lstrlenA (lpString="*.dbf") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.odt") returned 0
	[0064.351] lstrlenA (lpString="*.odt") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.vob") returned 0
	[0064.351] lstrlenA (lpString="*.vob") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ifo") returned 0
	[0064.351] lstrlenA (lpString="*.ifo") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.lnk") returned 0
	[0064.351] lstrlenA (lpString="*.lnk") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.torrent") returned 0
	[0064.351] lstrlenA (lpString="*.torrent") returned 9
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mov") returned 0
	[0064.351] lstrlenA (lpString="*.mov") returned 5
	[0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.m2v") returned 0
	[0064.352] lstrlenA (lpString="*.m2v") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.3gp") returned 0
	[0064.352] lstrlenA (lpString="*.3gp") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mpeg") returned 0
	[0064.352] lstrlenA (lpString="*.mpeg") returned 6
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mpg") returned 0
	[0064.352] lstrlenA (lpString="*.mpg") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.flv") returned 0
	[0064.352] lstrlenA (lpString="*.flv") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.avi") returned 0
	[0064.352] lstrlenA (lpString="*.avi") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mp4") returned 0
	[0064.352] lstrlenA (lpString="*.mp4") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wmv") returned 0
	[0064.352] lstrlenA (lpString="*.wmv") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.divx") returned 0
	[0064.352] lstrlenA (lpString="*.divx") returned 6
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mkv") returned 0
	[0064.352] lstrlenA (lpString="*.mkv") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mp3") returned 0
	[0064.352] lstrlenA (lpString="*.mp3") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wav") returned 0
	[0064.352] lstrlenA (lpString="*.wav") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.flac") returned 0
	[0064.352] lstrlenA (lpString="*.flac") returned 6
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ape") returned 0
	[0064.352] lstrlenA (lpString="*.ape") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wma") returned 0
	[0064.352] lstrlenA (lpString="*.wma") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ac3") returned 0
	[0064.352] lstrlenA (lpString="*.ac3") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.exe") returned 0
	[0064.352] lstrlenA (lpString="*.exe") returned 5
	[0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.apk") returned 0
	[0064.352] lstrlenA (lpString="*.apk") returned 5
	[0064.353] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.353] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.353] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TexturedBlue.css") returned -1
	[0064.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1
	[0064.353] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1
	[0064.353] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned="Teal.css"
	[0064.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.353] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css"
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.zip") returned 0
	[0064.353] lstrlenA (lpString="*.zip") returned 5
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.rar") returned 0
	[0064.353] lstrlenA (lpString="*.rar") returned 5
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.7z") returned 0
	[0064.353] lstrlenA (lpString="*.7z") returned 4
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.tar") returned 0
	[0064.353] lstrlenA (lpString="*.tar") returned 5
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.gzip") returned 0
	[0064.353] lstrlenA (lpString="*.gzip") returned 6
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpg") returned 0
	[0064.353] lstrlenA (lpString="*.jpg") returned 5
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpeg") returned 0
	[0064.353] lstrlenA (lpString="*.jpeg") returned 6
	[0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.psd") returned 0
	[0064.353] lstrlenA (lpString="*.psd") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.cdr") returned 0
	[0064.354] lstrlenA (lpString="*.cdr") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.dwg") returned 0
	[0064.354] lstrlenA (lpString="*.dwg") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.max") returned 0
	[0064.354] lstrlenA (lpString="*.max") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.bmp") returned 0
	[0064.354] lstrlenA (lpString="*.bmp") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.gif") returned 0
	[0064.354] lstrlenA (lpString="*.gif") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.png") returned 0
	[0064.354] lstrlenA (lpString="*.png") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.doc") returned 0
	[0064.354] lstrlenA (lpString="*.doc") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.docx") returned 0
	[0064.354] lstrlenA (lpString="*.docx") returned 6
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.xls") returned 0
	[0064.354] lstrlenA (lpString="*.xls") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.xlsx") returned 0
	[0064.354] lstrlenA (lpString="*.xlsx") returned 6
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ppt") returned 0
	[0064.354] lstrlenA (lpString="*.ppt") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pptx") returned 0
	[0064.354] lstrlenA (lpString="*.pptx") returned 6
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.txt") returned 0
	[0064.354] lstrlenA (lpString="*.txt") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pdf") returned 0
	[0064.354] lstrlenA (lpString="*.pdf") returned 5
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.djvu") returned 0
	[0064.354] lstrlenA (lpString="*.djvu") returned 6
	[0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.htm") returned 0
	[0064.354] lstrlenA (lpString="*.htm") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.html") returned 0
	[0064.355] lstrlenA (lpString="*.html") returned 6
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdb") returned 0
	[0064.355] lstrlenA (lpString="*.mdb") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.cer") returned 0
	[0064.355] lstrlenA (lpString="*.cer") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.p12") returned 0
	[0064.355] lstrlenA (lpString="*.p12") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pfx") returned 0
	[0064.355] lstrlenA (lpString="*.pfx") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.kwm") returned 0
	[0064.355] lstrlenA (lpString="*.kwm") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pwm") returned 0
	[0064.355] lstrlenA (lpString="*.pwm") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.1cd") returned 0
	[0064.355] lstrlenA (lpString="*.1cd") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.md") returned 0
	[0064.355] lstrlenA (lpString="*.md") returned 4
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdf") returned 0
	[0064.355] lstrlenA (lpString="*.mdf") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.dbf") returned 0
	[0064.355] lstrlenA (lpString="*.dbf") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.odt") returned 0
	[0064.355] lstrlenA (lpString="*.odt") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.vob") returned 0
	[0064.355] lstrlenA (lpString="*.vob") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ifo") returned 0
	[0064.355] lstrlenA (lpString="*.ifo") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.lnk") returned 0
	[0064.355] lstrlenA (lpString="*.lnk") returned 5
	[0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.torrent") returned 0
	[0064.356] lstrlenA (lpString="*.torrent") returned 9
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mov") returned 0
	[0064.356] lstrlenA (lpString="*.mov") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.m2v") returned 0
	[0064.356] lstrlenA (lpString="*.m2v") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.3gp") returned 0
	[0064.356] lstrlenA (lpString="*.3gp") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpeg") returned 0
	[0064.356] lstrlenA (lpString="*.mpeg") returned 6
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpg") returned 0
	[0064.356] lstrlenA (lpString="*.mpg") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.flv") returned 0
	[0064.356] lstrlenA (lpString="*.flv") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.avi") returned 0
	[0064.356] lstrlenA (lpString="*.avi") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp4") returned 0
	[0064.356] lstrlenA (lpString="*.mp4") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wmv") returned 0
	[0064.356] lstrlenA (lpString="*.wmv") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.divx") returned 0
	[0064.356] lstrlenA (lpString="*.divx") returned 6
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mkv") returned 0
	[0064.356] lstrlenA (lpString="*.mkv") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp3") returned 0
	[0064.356] lstrlenA (lpString="*.mp3") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wav") returned 0
	[0064.356] lstrlenA (lpString="*.wav") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.flac") returned 0
	[0064.356] lstrlenA (lpString="*.flac") returned 6
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ape") returned 0
	[0064.356] lstrlenA (lpString="*.ape") returned 5
	[0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wma") returned 0
	[0064.357] lstrlenA (lpString="*.wma") returned 5
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ac3") returned 0
	[0064.357] lstrlenA (lpString="*.ac3") returned 5
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.exe") returned 0
	[0064.357] lstrlenA (lpString="*.exe") returned 5
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.apk") returned 0
	[0064.357] lstrlenA (lpString="*.apk") returned 5
	[0064.357] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0064.357] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0064.357] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VelvetRose.css") returned -1
	[0064.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1
	[0064.357] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1
	[0064.357] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css"
	[0064.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\"
	[0064.357] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned=""
	[0064.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0064.357] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0064.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css"
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.zip") returned 0
	[0064.357] lstrlenA (lpString="*.zip") returned 5
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.rar") returned 0
	[0064.357] lstrlenA (lpString="*.rar") returned 5
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.7z") returned 0
	[0064.357] lstrlenA (lpString="*.7z") returned 4
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.tar") returned 0
	[0064.357] lstrlenA (lpString="*.tar") returned 5
	[0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.gzip") returned 0
	[0064.357] lstrlenA (lpString="*.gzip") returned 6
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.jpg") returned 0
	[0064.358] lstrlenA (lpString="*.jpg") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.jpeg") returned 0
	[0064.358] lstrlenA (lpString="*.jpeg") returned 6
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.psd") returned 0
	[0064.358] lstrlenA (lpString="*.psd") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.cdr") returned 0
	[0064.358] lstrlenA (lpString="*.cdr") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.dwg") returned 0
	[0064.358] lstrlenA (lpString="*.dwg") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.max") returned 0
	[0064.358] lstrlenA (lpString="*.max") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.bmp") returned 0
	[0064.358] lstrlenA (lpString="*.bmp") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.gif") returned 0
	[0064.358] lstrlenA (lpString="*.gif") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.png") returned 0
	[0064.358] lstrlenA (lpString="*.png") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.doc") returned 0
	[0064.358] lstrlenA (lpString="*.doc") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.docx") returned 0
	[0064.358] lstrlenA (lpString="*.docx") returned 6
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.xls") returned 0
	[0064.358] lstrlenA (lpString="*.xls") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.xlsx") returned 0
	[0064.358] lstrlenA (lpString="*.xlsx") returned 6
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ppt") returned 0
	[0064.358] lstrlenA (lpString="*.ppt") returned 5
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pptx") returned 0
	[0064.358] lstrlenA (lpString="*.pptx") returned 6
	[0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.txt") returned 0
	[0064.358] lstrlenA (lpString="*.txt") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pdf") returned 0
	[0064.359] lstrlenA (lpString="*.pdf") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.djvu") returned 0
	[0064.359] lstrlenA (lpString="*.djvu") returned 6
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.htm") returned 0
	[0064.359] lstrlenA (lpString="*.htm") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.html") returned 0
	[0064.359] lstrlenA (lpString="*.html") returned 6
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mdb") returned 0
	[0064.359] lstrlenA (lpString="*.mdb") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.cer") returned 0
	[0064.359] lstrlenA (lpString="*.cer") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.p12") returned 0
	[0064.359] lstrlenA (lpString="*.p12") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pfx") returned 0
	[0064.359] lstrlenA (lpString="*.pfx") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.kwm") returned 0
	[0064.359] lstrlenA (lpString="*.kwm") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pwm") returned 0
	[0064.359] lstrlenA (lpString="*.pwm") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.1cd") returned 0
	[0064.359] lstrlenA (lpString="*.1cd") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.md") returned 0
	[0064.359] lstrlenA (lpString="*.md") returned 4
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mdf") returned 0
	[0064.359] lstrlenA (lpString="*.mdf") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.dbf") returned 0
	[0064.359] lstrlenA (lpString="*.dbf") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.odt") returned 0
	[0064.359] lstrlenA (lpString="*.odt") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.vob") returned 0
	[0064.359] lstrlenA (lpString="*.vob") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ifo") returned 0
	[0064.359] lstrlenA (lpString="*.ifo") returned 5
	[0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.lnk") returned 0
	[0064.360] lstrlenA (lpString="*.lnk") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.torrent") returned 0
	[0064.360] lstrlenA (lpString="*.torrent") returned 9
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mov") returned 0
	[0064.360] lstrlenA (lpString="*.mov") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.m2v") returned 0
	[0064.360] lstrlenA (lpString="*.m2v") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.3gp") returned 0
	[0064.360] lstrlenA (lpString="*.3gp") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mpeg") returned 0
	[0064.360] lstrlenA (lpString="*.mpeg") returned 6
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mpg") returned 0
	[0064.360] lstrlenA (lpString="*.mpg") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.flv") returned 0
	[0064.360] lstrlenA (lpString="*.flv") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.avi") returned 0
	[0064.360] lstrlenA (lpString="*.avi") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mp4") returned 0
	[0064.360] lstrlenA (lpString="*.mp4") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wmv") returned 0
	[0064.360] lstrlenA (lpString="*.wmv") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.divx") returned 0
	[0064.360] lstrlenA (lpString="*.divx") returned 6
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mkv") returned 0
	[0064.360] lstrlenA (lpString="*.mkv") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mp3") returned 0
	[0064.360] lstrlenA (lpString="*.mp3") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wav") returned 0
	[0064.360] lstrlenA (lpString="*.wav") returned 5
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.flac") returned 0
	[0064.360] lstrlenA (lpString="*.flac") returned 6
	[0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ape") returned 0
	[0064.361] lstrlenA (lpString="*.ape") returned 5
	[0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wma") returned 0
	[0064.361] lstrlenA (lpString="*.wma") returned 5
	[0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ac3") returned 0
	[0064.361] lstrlenA (lpString="*.ac3") returned 5
	[0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.exe") returned 0
	[0064.361] lstrlenA (lpString="*.exe") returned 5
	[0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.apk") returned 0
	[0064.361] lstrlenA (lpString="*.apk") returned 5
	[0064.361] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0
	[0064.361] FindClose (in: hFindFile=0x8b7f68 | out: hFindFile=0x8b7f68) returned 1
	[0064.361] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.361] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.361] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsVersion1Warning.htm") returned -1
	[0064.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1
	[0064.361] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1
	[0064.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*") returned="*.*"
	[0064.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm"
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.zip") returned 0
	[0064.362] lstrlenA (lpString="*.zip") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.rar") returned 0
	[0064.362] lstrlenA (lpString="*.rar") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.7z") returned 0
	[0064.362] lstrlenA (lpString="*.7z") returned 4
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.tar") returned 0
	[0064.362] lstrlenA (lpString="*.tar") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.gzip") returned 0
	[0064.362] lstrlenA (lpString="*.gzip") returned 6
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.jpg") returned 0
	[0064.362] lstrlenA (lpString="*.jpg") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.jpeg") returned 0
	[0064.362] lstrlenA (lpString="*.jpeg") returned 6
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.psd") returned 0
	[0064.362] lstrlenA (lpString="*.psd") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.cdr") returned 0
	[0064.362] lstrlenA (lpString="*.cdr") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.dwg") returned 0
	[0064.362] lstrlenA (lpString="*.dwg") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.max") returned 0
	[0064.362] lstrlenA (lpString="*.max") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.bmp") returned 0
	[0064.362] lstrlenA (lpString="*.bmp") returned 5
	[0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.gif") returned 0
	[0064.362] lstrlenA (lpString="*.gif") returned 5
	[0064.363] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm"
	[0064.363] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm"
	[0064.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm."
	[0064.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.Boom"
	[0064.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.364] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f6
	[0064.364] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.364] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.364] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x8d3, lpOverlapped=0x0) returned 1
	[0064.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm"
	[0064.376] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.376] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x8d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x8d3, lpOverlapped=0x0) returned 1
	[0064.377] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.377] CloseHandle (hObject=0x98) returned 1
	[0064.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm.boom")) returned 1
	[0064.378] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.378] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.378] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0064.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1
	[0064.378] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0064.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm"
	[0064.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.378] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.378] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg"
	[0064.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0
	[0064.378] lstrlenA (lpString="*.zip") returned 5
	[0064.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0
	[0064.379] lstrlenA (lpString="*.rar") returned 5
	[0064.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0
	[0064.379] lstrlenA (lpString="*.7z") returned 4
	[0064.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0
	[0064.379] lstrlenA (lpString="*.tar") returned 5
	[0064.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0
	[0064.379] lstrlenA (lpString="*.gzip") returned 6
	[0064.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1
	[0064.379] lstrlenA (lpString="*.jpg") returned 5
	[0064.379] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg"
	[0064.379] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg"
	[0064.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg."
	[0064.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.Boom"
	[0064.379] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.380] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ee3
	[0064.380] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.380] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.380] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2ec0, lpOverlapped=0x0) returned 1
	[0064.381] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0064.382] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.382] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2ec0, lpOverlapped=0x0) returned 1
	[0064.382] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.382] CloseHandle (hObject=0x98) returned 1
	[0064.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.boom")) returned 1
	[0064.383] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.383] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.383] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0064.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1
	[0064.383] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0064.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0064.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.383] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.383] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp"
	[0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0
	[0064.383] lstrlenA (lpString="*.zip") returned 5
	[0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0
	[0064.383] lstrlenA (lpString="*.rar") returned 5
	[0064.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0
	[0064.383] lstrlenA (lpString="*.7z") returned 4
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0
	[0064.384] lstrlenA (lpString="*.tar") returned 5
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0
	[0064.384] lstrlenA (lpString="*.gzip") returned 6
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0
	[0064.384] lstrlenA (lpString="*.jpg") returned 5
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0
	[0064.384] lstrlenA (lpString="*.jpeg") returned 6
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0
	[0064.384] lstrlenA (lpString="*.psd") returned 5
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cdr") returned 0
	[0064.384] lstrlenA (lpString="*.cdr") returned 5
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0
	[0064.384] lstrlenA (lpString="*.dwg") returned 5
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.max") returned 0
	[0064.384] lstrlenA (lpString="*.max") returned 5
	[0064.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bmp") returned 1
	[0064.384] lstrlenA (lpString="*.bmp") returned 5
	[0064.384] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp"
	[0064.384] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp"
	[0064.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp."
	[0064.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.Boom"
	[0064.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.385] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638
	[0064.385] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.385] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.385] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x615, lpOverlapped=0x0) returned 1
	[0064.395] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0064.395] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.395] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x615, lpOverlapped=0x0) returned 1
	[0064.395] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.395] CloseHandle (hObject=0x98) returned 1
	[0064.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.boom")) returned 1
	[0064.396] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.396] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.396] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewFrame.html") returned -1
	[0064.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1
	[0064.396] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1
	[0064.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0064.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.396] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.396] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html"
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.zip") returned 0
	[0064.396] lstrlenA (lpString="*.zip") returned 5
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.rar") returned 0
	[0064.396] lstrlenA (lpString="*.rar") returned 5
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.7z") returned 0
	[0064.396] lstrlenA (lpString="*.7z") returned 4
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.tar") returned 0
	[0064.396] lstrlenA (lpString="*.tar") returned 5
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.gzip") returned 0
	[0064.396] lstrlenA (lpString="*.gzip") returned 6
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.jpg") returned 0
	[0064.396] lstrlenA (lpString="*.jpg") returned 5
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0
	[0064.396] lstrlenA (lpString="*.jpeg") returned 6
	[0064.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.psd") returned 0
	[0064.397] lstrlenA (lpString="*.psd") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.cdr") returned 0
	[0064.397] lstrlenA (lpString="*.cdr") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.dwg") returned 0
	[0064.397] lstrlenA (lpString="*.dwg") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.max") returned 0
	[0064.397] lstrlenA (lpString="*.max") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.bmp") returned 0
	[0064.397] lstrlenA (lpString="*.bmp") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.gif") returned 0
	[0064.397] lstrlenA (lpString="*.gif") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.png") returned 0
	[0064.397] lstrlenA (lpString="*.png") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.doc") returned 0
	[0064.397] lstrlenA (lpString="*.doc") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.docx") returned 0
	[0064.397] lstrlenA (lpString="*.docx") returned 6
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.xls") returned 0
	[0064.397] lstrlenA (lpString="*.xls") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0
	[0064.397] lstrlenA (lpString="*.xlsx") returned 6
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.ppt") returned 0
	[0064.397] lstrlenA (lpString="*.ppt") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.pptx") returned 0
	[0064.397] lstrlenA (lpString="*.pptx") returned 6
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.txt") returned 0
	[0064.397] lstrlenA (lpString="*.txt") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.pdf") returned 0
	[0064.397] lstrlenA (lpString="*.pdf") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.djvu") returned 0
	[0064.397] lstrlenA (lpString="*.djvu") returned 6
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.htm") returned 0
	[0064.397] lstrlenA (lpString="*.htm") returned 5
	[0064.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.html") returned 1
	[0064.397] lstrlenA (lpString="*.html") returned 6
	[0064.397] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html"
	[0064.397] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html"
	[0064.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html."
	[0064.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.Boom"
	[0064.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.398] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1313
	[0064.398] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1
	[0064.399] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.399] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x12f0, lpOverlapped=0x0) returned 1
	[0064.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="FormsViewFrame.html"
	[0064.407] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.407] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x12f0, lpOverlapped=0x0) returned 1
	[0064.407] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.407] CloseHandle (hObject=0x98) returned 1
	[0064.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.boom")) returned 1
	[0064.408] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.408] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.408] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewTemplate.html") returned -1
	[0064.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewTemplate.html") returned 1
	[0064.408] lstrcmpiA (lpString1="", lpString2="FormsViewTemplate.html") returned -1
	[0064.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="FormsViewFrame.html"
	[0064.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html"
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.zip") returned 0
	[0064.408] lstrlenA (lpString="*.zip") returned 5
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.rar") returned 0
	[0064.408] lstrlenA (lpString="*.rar") returned 5
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.7z") returned 0
	[0064.408] lstrlenA (lpString="*.7z") returned 4
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.tar") returned 0
	[0064.408] lstrlenA (lpString="*.tar") returned 5
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.gzip") returned 0
	[0064.408] lstrlenA (lpString="*.gzip") returned 6
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.jpg") returned 0
	[0064.408] lstrlenA (lpString="*.jpg") returned 5
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.jpeg") returned 0
	[0064.408] lstrlenA (lpString="*.jpeg") returned 6
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.psd") returned 0
	[0064.408] lstrlenA (lpString="*.psd") returned 5
	[0064.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.cdr") returned 0
	[0064.409] lstrlenA (lpString="*.cdr") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.dwg") returned 0
	[0064.409] lstrlenA (lpString="*.dwg") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.max") returned 0
	[0064.409] lstrlenA (lpString="*.max") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.bmp") returned 0
	[0064.409] lstrlenA (lpString="*.bmp") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.gif") returned 0
	[0064.409] lstrlenA (lpString="*.gif") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.png") returned 0
	[0064.409] lstrlenA (lpString="*.png") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.doc") returned 0
	[0064.409] lstrlenA (lpString="*.doc") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.docx") returned 0
	[0064.409] lstrlenA (lpString="*.docx") returned 6
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.xls") returned 0
	[0064.409] lstrlenA (lpString="*.xls") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.xlsx") returned 0
	[0064.409] lstrlenA (lpString="*.xlsx") returned 6
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.ppt") returned 0
	[0064.409] lstrlenA (lpString="*.ppt") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.pptx") returned 0
	[0064.409] lstrlenA (lpString="*.pptx") returned 6
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.txt") returned 0
	[0064.409] lstrlenA (lpString="*.txt") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.pdf") returned 0
	[0064.409] lstrlenA (lpString="*.pdf") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.djvu") returned 0
	[0064.409] lstrlenA (lpString="*.djvu") returned 6
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.htm") returned 0
	[0064.409] lstrlenA (lpString="*.htm") returned 5
	[0064.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.html") returned 1
	[0064.409] lstrlenA (lpString="*.html") returned 6
	[0064.409] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html"
	[0064.409] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html"
	[0064.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html."
	[0064.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.Boom"
	[0064.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.410] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa89
	[0064.410] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.410] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.410] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa66, lpOverlapped=0x0) returned 1
	[0064.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="FormsViewTemplate.html"
	[0064.412] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.412] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa66, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa66, lpOverlapped=0x0) returned 1
	[0064.412] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.412] CloseHandle (hObject=0x98) returned 1
	[0064.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.boom")) returned 1
	[0064.413] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.413] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormToolImages.jpg") returned -1
	[0064.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1
	[0064.413] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1
	[0064.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="FormsViewTemplate.html"
	[0064.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg"
	[0064.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.zip") returned 0
	[0064.413] lstrlenA (lpString="*.zip") returned 5
	[0064.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.rar") returned 0
	[0064.413] lstrlenA (lpString="*.rar") returned 5
	[0064.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.7z") returned 0
	[0064.413] lstrlenA (lpString="*.7z") returned 4
	[0064.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.tar") returned 0
	[0064.413] lstrlenA (lpString="*.tar") returned 5
	[0064.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.gzip") returned 0
	[0064.413] lstrlenA (lpString="*.gzip") returned 6
	[0064.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.jpg") returned 1
	[0064.413] lstrlenA (lpString="*.jpg") returned 5
	[0064.413] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg"
	[0064.413] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg"
	[0064.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg."
	[0064.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.Boom"
	[0064.413] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.414] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb
	[0064.414] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.414] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.414] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1bd8, lpOverlapped=0x0) returned 1
	[0064.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="FormToolImages.jpg"
	[0064.434] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.434] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1bd8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1bd8, lpOverlapped=0x0) returned 1
	[0064.434] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.434] CloseHandle (hObject=0x98) returned 1
	[0064.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.boom")) returned 1
	[0064.435] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.435] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.435] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="form_edit.js") returned -1
	[0064.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1
	[0064.435] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1
	[0064.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="FormToolImages.jpg"
	[0064.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.435] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js"
	[0064.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.zip") returned 0
	[0064.435] lstrlenA (lpString="*.zip") returned 5
	[0064.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.rar") returned 0
	[0064.435] lstrlenA (lpString="*.rar") returned 5
	[0064.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.7z") returned 0
	[0064.435] lstrlenA (lpString="*.7z") returned 4
	[0064.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.tar") returned 0
	[0064.435] lstrlenA (lpString="*.tar") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.gzip") returned 0
	[0064.436] lstrlenA (lpString="*.gzip") returned 6
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.jpg") returned 0
	[0064.436] lstrlenA (lpString="*.jpg") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.jpeg") returned 0
	[0064.436] lstrlenA (lpString="*.jpeg") returned 6
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.psd") returned 0
	[0064.436] lstrlenA (lpString="*.psd") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.cdr") returned 0
	[0064.436] lstrlenA (lpString="*.cdr") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.dwg") returned 0
	[0064.436] lstrlenA (lpString="*.dwg") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.max") returned 0
	[0064.436] lstrlenA (lpString="*.max") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.bmp") returned 0
	[0064.436] lstrlenA (lpString="*.bmp") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.gif") returned 0
	[0064.436] lstrlenA (lpString="*.gif") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.png") returned 0
	[0064.436] lstrlenA (lpString="*.png") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.doc") returned 0
	[0064.436] lstrlenA (lpString="*.doc") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.docx") returned 0
	[0064.436] lstrlenA (lpString="*.docx") returned 6
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.xls") returned 0
	[0064.436] lstrlenA (lpString="*.xls") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.xlsx") returned 0
	[0064.436] lstrlenA (lpString="*.xlsx") returned 6
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ppt") returned 0
	[0064.436] lstrlenA (lpString="*.ppt") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pptx") returned 0
	[0064.436] lstrlenA (lpString="*.pptx") returned 6
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.txt") returned 0
	[0064.436] lstrlenA (lpString="*.txt") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pdf") returned 0
	[0064.436] lstrlenA (lpString="*.pdf") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.djvu") returned 0
	[0064.436] lstrlenA (lpString="*.djvu") returned 6
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.htm") returned 0
	[0064.436] lstrlenA (lpString="*.htm") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.html") returned 0
	[0064.436] lstrlenA (lpString="*.html") returned 6
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mdb") returned 0
	[0064.436] lstrlenA (lpString="*.mdb") returned 5
	[0064.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.cer") returned 0
	[0064.437] lstrlenA (lpString="*.cer") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.p12") returned 0
	[0064.437] lstrlenA (lpString="*.p12") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pfx") returned 0
	[0064.437] lstrlenA (lpString="*.pfx") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.kwm") returned 0
	[0064.437] lstrlenA (lpString="*.kwm") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pwm") returned 0
	[0064.437] lstrlenA (lpString="*.pwm") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.1cd") returned 0
	[0064.437] lstrlenA (lpString="*.1cd") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.md") returned 0
	[0064.437] lstrlenA (lpString="*.md") returned 4
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mdf") returned 0
	[0064.437] lstrlenA (lpString="*.mdf") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.dbf") returned 0
	[0064.437] lstrlenA (lpString="*.dbf") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.odt") returned 0
	[0064.437] lstrlenA (lpString="*.odt") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.vob") returned 0
	[0064.437] lstrlenA (lpString="*.vob") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ifo") returned 0
	[0064.437] lstrlenA (lpString="*.ifo") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.lnk") returned 0
	[0064.437] lstrlenA (lpString="*.lnk") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.torrent") returned 0
	[0064.437] lstrlenA (lpString="*.torrent") returned 9
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mov") returned 0
	[0064.437] lstrlenA (lpString="*.mov") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.m2v") returned 0
	[0064.437] lstrlenA (lpString="*.m2v") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.3gp") returned 0
	[0064.437] lstrlenA (lpString="*.3gp") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mpeg") returned 0
	[0064.437] lstrlenA (lpString="*.mpeg") returned 6
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mpg") returned 0
	[0064.437] lstrlenA (lpString="*.mpg") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.flv") returned 0
	[0064.437] lstrlenA (lpString="*.flv") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.avi") returned 0
	[0064.437] lstrlenA (lpString="*.avi") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mp4") returned 0
	[0064.437] lstrlenA (lpString="*.mp4") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wmv") returned 0
	[0064.437] lstrlenA (lpString="*.wmv") returned 5
	[0064.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.divx") returned 0
	[0064.438] lstrlenA (lpString="*.divx") returned 6
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mkv") returned 0
	[0064.438] lstrlenA (lpString="*.mkv") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mp3") returned 0
	[0064.438] lstrlenA (lpString="*.mp3") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wav") returned 0
	[0064.438] lstrlenA (lpString="*.wav") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.flac") returned 0
	[0064.438] lstrlenA (lpString="*.flac") returned 6
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ape") returned 0
	[0064.438] lstrlenA (lpString="*.ape") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wma") returned 0
	[0064.438] lstrlenA (lpString="*.wma") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ac3") returned 0
	[0064.438] lstrlenA (lpString="*.ac3") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.exe") returned 0
	[0064.438] lstrlenA (lpString="*.exe") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.apk") returned 0
	[0064.438] lstrlenA (lpString="*.apk") returned 5
	[0064.438] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.438] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.438] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HOW TO DECRYPT FILES.txt") returned -1
	[0064.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0
	[0064.438] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.438] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.438] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAUNCH.GIF") returned -1
	[0064.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1
	[0064.438] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1
	[0064.438] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned="form_edit.js"
	[0064.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.438] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.438] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF"
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.zip") returned 0
	[0064.438] lstrlenA (lpString="*.zip") returned 5
	[0064.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.rar") returned 0
	[0064.438] lstrlenA (lpString="*.rar") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.7z") returned 0
	[0064.439] lstrlenA (lpString="*.7z") returned 4
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.tar") returned 0
	[0064.439] lstrlenA (lpString="*.tar") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.gzip") returned 0
	[0064.439] lstrlenA (lpString="*.gzip") returned 6
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.jpg") returned 0
	[0064.439] lstrlenA (lpString="*.jpg") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0
	[0064.439] lstrlenA (lpString="*.jpeg") returned 6
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.psd") returned 0
	[0064.439] lstrlenA (lpString="*.psd") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.cdr") returned 0
	[0064.439] lstrlenA (lpString="*.cdr") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.dwg") returned 0
	[0064.439] lstrlenA (lpString="*.dwg") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.max") returned 0
	[0064.439] lstrlenA (lpString="*.max") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.bmp") returned 0
	[0064.439] lstrlenA (lpString="*.bmp") returned 5
	[0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.gif") returned 1
	[0064.439] lstrlenA (lpString="*.gif") returned 5
	[0064.439] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF"
	[0064.439] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF"
	[0064.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF."
	[0064.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.Boom"
	[0064.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.440] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267
	[0064.440] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66247150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.440] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.440] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x244, lpOverlapped=0x0) returned 1
	[0064.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="LAUNCH.GIF"
	[0064.441] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.441] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x244, lpOverlapped=0x0) returned 1
	[0064.442] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.448] CloseHandle (hObject=0x98) returned 1
	[0064.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif.boom")) returned 1
	[0064.450] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.450] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.450] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="macroprogress.gif") returned -1
	[0064.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1
	[0064.450] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1
	[0064.450] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="LAUNCH.GIF"
	[0064.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.450] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif"
	[0064.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.zip") returned 0
	[0064.450] lstrlenA (lpString="*.zip") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.rar") returned 0
	[0064.451] lstrlenA (lpString="*.rar") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.7z") returned 0
	[0064.451] lstrlenA (lpString="*.7z") returned 4
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.tar") returned 0
	[0064.451] lstrlenA (lpString="*.tar") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.gzip") returned 0
	[0064.451] lstrlenA (lpString="*.gzip") returned 6
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.jpg") returned 0
	[0064.451] lstrlenA (lpString="*.jpg") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.jpeg") returned 0
	[0064.451] lstrlenA (lpString="*.jpeg") returned 6
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.psd") returned 0
	[0064.451] lstrlenA (lpString="*.psd") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.cdr") returned 0
	[0064.451] lstrlenA (lpString="*.cdr") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.dwg") returned 0
	[0064.451] lstrlenA (lpString="*.dwg") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.max") returned 0
	[0064.451] lstrlenA (lpString="*.max") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.bmp") returned 0
	[0064.451] lstrlenA (lpString="*.bmp") returned 5
	[0064.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.gif") returned 1
	[0064.451] lstrlenA (lpString="*.gif") returned 5
	[0064.451] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif"
	[0064.451] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif"
	[0064.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif."
	[0064.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.Boom"
	[0064.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.452] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30074
	[0064.452] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d), lpLastAccessTime=0x407536*(dwLowDateTime=0x58285d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d)) returned 1
	[0064.452] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.452] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x30051, lpOverlapped=0x0) returned 1
	[0064.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="macroprogress.gif"
	[0064.468] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.468] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x30051, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x30051, lpOverlapped=0x0) returned 1
	[0064.469] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.469] CloseHandle (hObject=0x98) returned 1
	[0064.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.boom")) returned 1
	[0064.470] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.470] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublicFunctions.js") returned -1
	[0064.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1
	[0064.470] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1
	[0064.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="macroprogress.gif"
	[0064.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.470] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.471] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.471] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js"
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.zip") returned 0
	[0064.471] lstrlenA (lpString="*.zip") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.rar") returned 0
	[0064.471] lstrlenA (lpString="*.rar") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.7z") returned 0
	[0064.471] lstrlenA (lpString="*.7z") returned 4
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.tar") returned 0
	[0064.471] lstrlenA (lpString="*.tar") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.gzip") returned 0
	[0064.471] lstrlenA (lpString="*.gzip") returned 6
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.jpg") returned 0
	[0064.471] lstrlenA (lpString="*.jpg") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.jpeg") returned 0
	[0064.471] lstrlenA (lpString="*.jpeg") returned 6
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.psd") returned 0
	[0064.471] lstrlenA (lpString="*.psd") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.cdr") returned 0
	[0064.471] lstrlenA (lpString="*.cdr") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.dwg") returned 0
	[0064.471] lstrlenA (lpString="*.dwg") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.max") returned 0
	[0064.471] lstrlenA (lpString="*.max") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.bmp") returned 0
	[0064.471] lstrlenA (lpString="*.bmp") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.gif") returned 0
	[0064.471] lstrlenA (lpString="*.gif") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.png") returned 0
	[0064.471] lstrlenA (lpString="*.png") returned 5
	[0064.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.doc") returned 0
	[0064.472] lstrlenA (lpString="*.doc") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.docx") returned 0
	[0064.472] lstrlenA (lpString="*.docx") returned 6
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.xls") returned 0
	[0064.472] lstrlenA (lpString="*.xls") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.xlsx") returned 0
	[0064.472] lstrlenA (lpString="*.xlsx") returned 6
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ppt") returned 0
	[0064.472] lstrlenA (lpString="*.ppt") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pptx") returned 0
	[0064.472] lstrlenA (lpString="*.pptx") returned 6
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.txt") returned 0
	[0064.472] lstrlenA (lpString="*.txt") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pdf") returned 0
	[0064.472] lstrlenA (lpString="*.pdf") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.djvu") returned 0
	[0064.472] lstrlenA (lpString="*.djvu") returned 6
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.htm") returned 0
	[0064.472] lstrlenA (lpString="*.htm") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.html") returned 0
	[0064.472] lstrlenA (lpString="*.html") returned 6
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mdb") returned 0
	[0064.472] lstrlenA (lpString="*.mdb") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.cer") returned 0
	[0064.472] lstrlenA (lpString="*.cer") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.p12") returned 0
	[0064.472] lstrlenA (lpString="*.p12") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pfx") returned 0
	[0064.472] lstrlenA (lpString="*.pfx") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.kwm") returned 0
	[0064.472] lstrlenA (lpString="*.kwm") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pwm") returned 0
	[0064.472] lstrlenA (lpString="*.pwm") returned 5
	[0064.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.1cd") returned 0
	[0064.473] lstrlenA (lpString="*.1cd") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.md") returned 0
	[0064.473] lstrlenA (lpString="*.md") returned 4
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mdf") returned 0
	[0064.473] lstrlenA (lpString="*.mdf") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.dbf") returned 0
	[0064.473] lstrlenA (lpString="*.dbf") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.odt") returned 0
	[0064.473] lstrlenA (lpString="*.odt") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.vob") returned 0
	[0064.473] lstrlenA (lpString="*.vob") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ifo") returned 0
	[0064.473] lstrlenA (lpString="*.ifo") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.lnk") returned 0
	[0064.473] lstrlenA (lpString="*.lnk") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.torrent") returned 0
	[0064.473] lstrlenA (lpString="*.torrent") returned 9
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mov") returned 0
	[0064.473] lstrlenA (lpString="*.mov") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.m2v") returned 0
	[0064.473] lstrlenA (lpString="*.m2v") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.3gp") returned 0
	[0064.473] lstrlenA (lpString="*.3gp") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mpeg") returned 0
	[0064.473] lstrlenA (lpString="*.mpeg") returned 6
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mpg") returned 0
	[0064.473] lstrlenA (lpString="*.mpg") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.flv") returned 0
	[0064.473] lstrlenA (lpString="*.flv") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.avi") returned 0
	[0064.473] lstrlenA (lpString="*.avi") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mp4") returned 0
	[0064.473] lstrlenA (lpString="*.mp4") returned 5
	[0064.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wmv") returned 0
	[0064.473] lstrlenA (lpString="*.wmv") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.divx") returned 0
	[0064.474] lstrlenA (lpString="*.divx") returned 6
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mkv") returned 0
	[0064.474] lstrlenA (lpString="*.mkv") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mp3") returned 0
	[0064.474] lstrlenA (lpString="*.mp3") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wav") returned 0
	[0064.474] lstrlenA (lpString="*.wav") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.flac") returned 0
	[0064.474] lstrlenA (lpString="*.flac") returned 6
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ape") returned 0
	[0064.474] lstrlenA (lpString="*.ape") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wma") returned 0
	[0064.474] lstrlenA (lpString="*.wma") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ac3") returned 0
	[0064.474] lstrlenA (lpString="*.ac3") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.exe") returned 0
	[0064.474] lstrlenA (lpString="*.exe") returned 5
	[0064.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.apk") returned 0
	[0064.474] lstrlenA (lpString="*.apk") returned 5
	[0064.474] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.474] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.474] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignleft.gif") returned -1
	[0064.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1
	[0064.474] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1
	[0064.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned="PublicFunctions.js"
	[0064.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.474] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif"
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.zip") returned 0
	[0064.475] lstrlenA (lpString="*.zip") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.rar") returned 0
	[0064.475] lstrlenA (lpString="*.rar") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.7z") returned 0
	[0064.475] lstrlenA (lpString="*.7z") returned 4
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.tar") returned 0
	[0064.475] lstrlenA (lpString="*.tar") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0
	[0064.475] lstrlenA (lpString="*.gzip") returned 6
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0
	[0064.475] lstrlenA (lpString="*.jpg") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0
	[0064.475] lstrlenA (lpString="*.jpeg") returned 6
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.psd") returned 0
	[0064.475] lstrlenA (lpString="*.psd") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.cdr") returned 0
	[0064.475] lstrlenA (lpString="*.cdr") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.dwg") returned 0
	[0064.475] lstrlenA (lpString="*.dwg") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.max") returned 0
	[0064.475] lstrlenA (lpString="*.max") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.bmp") returned 0
	[0064.475] lstrlenA (lpString="*.bmp") returned 5
	[0064.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.gif") returned 1
	[0064.475] lstrlenA (lpString="*.gif") returned 5
	[0064.475] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif"
	[0064.475] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif"
	[0064.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif."
	[0064.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.Boom"
	[0064.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.477] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350
	[0064.477] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.477] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.477] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32d, lpOverlapped=0x0) returned 1
	[0064.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="rtf_alignleft.gif"
	[0064.498] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.498] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1
	[0064.498] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.498] CloseHandle (hObject=0x98) returned 1
	[0064.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.boom")) returned 1
	[0064.499] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.499] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.499] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignright.gif") returned -1
	[0064.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1
	[0064.499] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1
	[0064.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="rtf_alignleft.gif"
	[0064.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif"
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.zip") returned 0
	[0064.500] lstrlenA (lpString="*.zip") returned 5
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.rar") returned 0
	[0064.500] lstrlenA (lpString="*.rar") returned 5
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.7z") returned 0
	[0064.500] lstrlenA (lpString="*.7z") returned 4
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.tar") returned 0
	[0064.500] lstrlenA (lpString="*.tar") returned 5
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.gzip") returned 0
	[0064.500] lstrlenA (lpString="*.gzip") returned 6
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.jpg") returned 0
	[0064.500] lstrlenA (lpString="*.jpg") returned 5
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0
	[0064.500] lstrlenA (lpString="*.jpeg") returned 6
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.psd") returned 0
	[0064.500] lstrlenA (lpString="*.psd") returned 5
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.cdr") returned 0
	[0064.500] lstrlenA (lpString="*.cdr") returned 5
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.dwg") returned 0
	[0064.500] lstrlenA (lpString="*.dwg") returned 5
	[0064.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.max") returned 0
	[0064.500] lstrlenA (lpString="*.max") returned 5
	[0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.bmp") returned 0
	[0064.501] lstrlenA (lpString="*.bmp") returned 5
	[0064.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.gif") returned 1
	[0064.501] lstrlenA (lpString="*.gif") returned 5
	[0064.501] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif"
	[0064.501] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif"
	[0064.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif."
	[0064.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.Boom"
	[0064.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.502] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f
	[0064.502] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.502] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.503] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32c, lpOverlapped=0x0) returned 1
	[0064.510] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="rtf_alignright.gif"
	[0064.510] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.511] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32c, lpOverlapped=0x0) returned 1
	[0064.511] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.511] CloseHandle (hObject=0x98) returned 1
	[0064.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.boom")) returned 1
	[0064.512] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.512] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.512] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RTF_BOLD.GIF") returned -1
	[0064.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1
	[0064.512] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1
	[0064.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="rtf_alignright.gif"
	[0064.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.512] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.512] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF"
	[0064.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.zip") returned 0
	[0064.512] lstrlenA (lpString="*.zip") returned 5
	[0064.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.rar") returned 0
	[0064.512] lstrlenA (lpString="*.rar") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.7z") returned 0
	[0064.513] lstrlenA (lpString="*.7z") returned 4
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.tar") returned 0
	[0064.513] lstrlenA (lpString="*.tar") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.gzip") returned 0
	[0064.513] lstrlenA (lpString="*.gzip") returned 6
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.jpg") returned 0
	[0064.513] lstrlenA (lpString="*.jpg") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.jpeg") returned 0
	[0064.513] lstrlenA (lpString="*.jpeg") returned 6
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.psd") returned 0
	[0064.513] lstrlenA (lpString="*.psd") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.cdr") returned 0
	[0064.513] lstrlenA (lpString="*.cdr") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.dwg") returned 0
	[0064.513] lstrlenA (lpString="*.dwg") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.max") returned 0
	[0064.513] lstrlenA (lpString="*.max") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.bmp") returned 0
	[0064.513] lstrlenA (lpString="*.bmp") returned 5
	[0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.gif") returned 1
	[0064.513] lstrlenA (lpString="*.gif") returned 5
	[0064.513] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF"
	[0064.513] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF"
	[0064.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF."
	[0064.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.Boom"
	[0064.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.514] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x366
	[0064.514] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.514] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.514] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x343, lpOverlapped=0x0) returned 1
	[0064.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF"
	[0064.519] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.519] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x343, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x343, lpOverlapped=0x0) returned 1
	[0064.519] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.520] CloseHandle (hObject=0x98) returned 1
	[0064.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif.boom")) returned 1
	[0064.521] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.521] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.521] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_bullets.gif") returned -1
	[0064.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1
	[0064.521] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1
	[0064.521] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF"
	[0064.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.521] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif"
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.zip") returned 0
	[0064.521] lstrlenA (lpString="*.zip") returned 5
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.rar") returned 0
	[0064.521] lstrlenA (lpString="*.rar") returned 5
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.7z") returned 0
	[0064.521] lstrlenA (lpString="*.7z") returned 4
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.tar") returned 0
	[0064.521] lstrlenA (lpString="*.tar") returned 5
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.gzip") returned 0
	[0064.521] lstrlenA (lpString="*.gzip") returned 6
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.jpg") returned 0
	[0064.521] lstrlenA (lpString="*.jpg") returned 5
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0
	[0064.521] lstrlenA (lpString="*.jpeg") returned 6
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.psd") returned 0
	[0064.521] lstrlenA (lpString="*.psd") returned 5
	[0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.cdr") returned 0
	[0064.522] lstrlenA (lpString="*.cdr") returned 5
	[0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.dwg") returned 0
	[0064.522] lstrlenA (lpString="*.dwg") returned 5
	[0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.max") returned 0
	[0064.522] lstrlenA (lpString="*.max") returned 5
	[0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.bmp") returned 0
	[0064.522] lstrlenA (lpString="*.bmp") returned 5
	[0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.gif") returned 1
	[0064.522] lstrlenA (lpString="*.gif") returned 5
	[0064.522] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif"
	[0064.522] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif"
	[0064.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif."
	[0064.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.Boom"
	[0064.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.525] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365
	[0064.525] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.525] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.525] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x342, lpOverlapped=0x0) returned 1
	[0064.539] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="rtf_bullets.gif"
	[0064.539] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.539] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x342, lpOverlapped=0x0) returned 1
	[0064.539] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.539] CloseHandle (hObject=0x98) returned 1
	[0064.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.boom")) returned 1
	[0064.540] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.540] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.540] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_center.gif") returned -1
	[0064.540] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1
	[0064.540] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1
	[0064.540] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="rtf_bullets.gif"
	[0064.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.540] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.540] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif"
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.zip") returned 0
	[0064.541] lstrlenA (lpString="*.zip") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.rar") returned 0
	[0064.541] lstrlenA (lpString="*.rar") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.7z") returned 0
	[0064.541] lstrlenA (lpString="*.7z") returned 4
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.tar") returned 0
	[0064.541] lstrlenA (lpString="*.tar") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.gzip") returned 0
	[0064.541] lstrlenA (lpString="*.gzip") returned 6
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.jpg") returned 0
	[0064.541] lstrlenA (lpString="*.jpg") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.jpeg") returned 0
	[0064.541] lstrlenA (lpString="*.jpeg") returned 6
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.psd") returned 0
	[0064.541] lstrlenA (lpString="*.psd") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.cdr") returned 0
	[0064.541] lstrlenA (lpString="*.cdr") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.dwg") returned 0
	[0064.541] lstrlenA (lpString="*.dwg") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.max") returned 0
	[0064.541] lstrlenA (lpString="*.max") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.bmp") returned 0
	[0064.541] lstrlenA (lpString="*.bmp") returned 5
	[0064.541] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.gif") returned 1
	[0064.541] lstrlenA (lpString="*.gif") returned 5
	[0064.541] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif"
	[0064.541] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif"
	[0064.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif."
	[0064.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.Boom"
	[0064.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.542] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f
	[0064.542] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.542] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.542] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32c, lpOverlapped=0x0) returned 1
	[0064.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="rtf_center.gif"
	[0064.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.564] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32c, lpOverlapped=0x0) returned 1
	[0064.564] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.564] CloseHandle (hObject=0x98) returned 1
	[0064.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.boom")) returned 1
	[0064.565] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.565] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.565] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosecolor.gif") returned -1
	[0064.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1
	[0064.565] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1
	[0064.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="rtf_center.gif"
	[0064.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif"
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0
	[0064.566] lstrlenA (lpString="*.zip") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0
	[0064.566] lstrlenA (lpString="*.rar") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0
	[0064.566] lstrlenA (lpString="*.7z") returned 4
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0
	[0064.566] lstrlenA (lpString="*.tar") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0
	[0064.566] lstrlenA (lpString="*.gzip") returned 6
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0
	[0064.566] lstrlenA (lpString="*.jpg") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0
	[0064.566] lstrlenA (lpString="*.jpeg") returned 6
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0
	[0064.566] lstrlenA (lpString="*.psd") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.cdr") returned 0
	[0064.566] lstrlenA (lpString="*.cdr") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.dwg") returned 0
	[0064.566] lstrlenA (lpString="*.dwg") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.max") returned 0
	[0064.566] lstrlenA (lpString="*.max") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.bmp") returned 0
	[0064.566] lstrlenA (lpString="*.bmp") returned 5
	[0064.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1
	[0064.566] lstrlenA (lpString="*.gif") returned 5
	[0064.566] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif"
	[0064.566] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif"
	[0064.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif."
	[0064.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.Boom"
	[0064.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.567] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee
	[0064.567] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b)) returned 1
	[0064.567] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.567] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3cb, lpOverlapped=0x0) returned 1
	[0064.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif"
	[0064.574] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.574] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3cb, lpOverlapped=0x0) returned 1
	[0064.575] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.575] CloseHandle (hObject=0x98) returned 1
	[0064.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.boom")) returned 1
	[0064.575] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.576] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.576] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosefont.gif") returned -1
	[0064.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1
	[0064.576] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1
	[0064.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif"
	[0064.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif"
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.zip") returned 0
	[0064.576] lstrlenA (lpString="*.zip") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.rar") returned 0
	[0064.576] lstrlenA (lpString="*.rar") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.7z") returned 0
	[0064.576] lstrlenA (lpString="*.7z") returned 4
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.tar") returned 0
	[0064.576] lstrlenA (lpString="*.tar") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.gzip") returned 0
	[0064.576] lstrlenA (lpString="*.gzip") returned 6
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.jpg") returned 0
	[0064.576] lstrlenA (lpString="*.jpg") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.jpeg") returned 0
	[0064.576] lstrlenA (lpString="*.jpeg") returned 6
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.psd") returned 0
	[0064.576] lstrlenA (lpString="*.psd") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.cdr") returned 0
	[0064.576] lstrlenA (lpString="*.cdr") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.dwg") returned 0
	[0064.576] lstrlenA (lpString="*.dwg") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.max") returned 0
	[0064.576] lstrlenA (lpString="*.max") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.bmp") returned 0
	[0064.576] lstrlenA (lpString="*.bmp") returned 5
	[0064.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.gif") returned 1
	[0064.576] lstrlenA (lpString="*.gif") returned 5
	[0064.576] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif"
	[0064.576] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif"
	[0064.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif."
	[0064.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.Boom"
	[0064.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.577] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a
	[0064.577] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1
	[0064.577] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.577] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x357, lpOverlapped=0x0) returned 1
	[0064.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="rtf_choosefont.gif"
	[0064.578] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.579] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x357, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x357, lpOverlapped=0x0) returned 1
	[0064.579] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.579] CloseHandle (hObject=0x98) returned 1
	[0064.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.boom")) returned 1
	[0064.579] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.579] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.580] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_decreaseindent.gif") returned -1
	[0064.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1
	[0064.580] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1
	[0064.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="rtf_choosefont.gif"
	[0064.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif"
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0
	[0064.580] lstrlenA (lpString="*.zip") returned 5
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0
	[0064.580] lstrlenA (lpString="*.rar") returned 5
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0
	[0064.580] lstrlenA (lpString="*.7z") returned 4
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0
	[0064.580] lstrlenA (lpString="*.tar") returned 5
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0
	[0064.580] lstrlenA (lpString="*.gzip") returned 6
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0
	[0064.580] lstrlenA (lpString="*.jpg") returned 5
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0
	[0064.580] lstrlenA (lpString="*.jpeg") returned 6
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0
	[0064.580] lstrlenA (lpString="*.psd") returned 5
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.cdr") returned 0
	[0064.580] lstrlenA (lpString="*.cdr") returned 5
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.dwg") returned 0
	[0064.580] lstrlenA (lpString="*.dwg") returned 5
	[0064.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.max") returned 0
	[0064.580] lstrlenA (lpString="*.max") returned 5
	[0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.bmp") returned 0
	[0064.581] lstrlenA (lpString="*.bmp") returned 5
	[0064.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1
	[0064.581] lstrlenA (lpString="*.gif") returned 5
	[0064.581] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif"
	[0064.581] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif"
	[0064.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif."
	[0064.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.Boom"
	[0064.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.581] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f
	[0064.581] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1
	[0064.581] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.581] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33c, lpOverlapped=0x0) returned 1
	[0064.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif"
	[0064.582] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.583] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33c, lpOverlapped=0x0) returned 1
	[0064.583] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.583] CloseHandle (hObject=0x98) returned 1
	[0064.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.boom")) returned 1
	[0064.584] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.584] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.584] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_increaseindent.gif") returned -1
	[0064.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1
	[0064.584] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1
	[0064.584] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif"
	[0064.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif"
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0
	[0064.584] lstrlenA (lpString="*.zip") returned 5
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0
	[0064.584] lstrlenA (lpString="*.rar") returned 5
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0
	[0064.584] lstrlenA (lpString="*.7z") returned 4
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0
	[0064.584] lstrlenA (lpString="*.tar") returned 5
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0
	[0064.584] lstrlenA (lpString="*.gzip") returned 6
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0
	[0064.584] lstrlenA (lpString="*.jpg") returned 5
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0
	[0064.584] lstrlenA (lpString="*.jpeg") returned 6
	[0064.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0
	[0064.585] lstrlenA (lpString="*.psd") returned 5
	[0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.cdr") returned 0
	[0064.585] lstrlenA (lpString="*.cdr") returned 5
	[0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.dwg") returned 0
	[0064.585] lstrlenA (lpString="*.dwg") returned 5
	[0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.max") returned 0
	[0064.585] lstrlenA (lpString="*.max") returned 5
	[0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.bmp") returned 0
	[0064.585] lstrlenA (lpString="*.bmp") returned 5
	[0064.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1
	[0064.585] lstrlenA (lpString="*.gif") returned 5
	[0064.585] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif"
	[0064.585] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif"
	[0064.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif."
	[0064.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.Boom"
	[0064.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.586] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d
	[0064.586] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1
	[0064.586] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.586] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33a, lpOverlapped=0x0) returned 1
	[0064.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif"
	[0064.589] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.589] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33a, lpOverlapped=0x0) returned 1
	[0064.589] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.589] CloseHandle (hObject=0x98) returned 1
	[0064.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.boom")) returned 1
	[0064.590] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.590] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.590] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_italic.gif") returned -1
	[0064.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1
	[0064.590] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1
	[0064.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif"
	[0064.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.590] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif"
	[0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.zip") returned 0
	[0064.590] lstrlenA (lpString="*.zip") returned 5
	[0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.rar") returned 0
	[0064.590] lstrlenA (lpString="*.rar") returned 5
	[0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.7z") returned 0
	[0064.590] lstrlenA (lpString="*.7z") returned 4
	[0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.tar") returned 0
	[0064.590] lstrlenA (lpString="*.tar") returned 5
	[0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.gzip") returned 0
	[0064.590] lstrlenA (lpString="*.gzip") returned 6
	[0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.jpg") returned 0
	[0064.590] lstrlenA (lpString="*.jpg") returned 5
	[0064.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.jpeg") returned 0
	[0064.591] lstrlenA (lpString="*.jpeg") returned 6
	[0064.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.psd") returned 0
	[0064.591] lstrlenA (lpString="*.psd") returned 5
	[0064.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.cdr") returned 0
	[0064.591] lstrlenA (lpString="*.cdr") returned 5
	[0064.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.dwg") returned 0
	[0064.591] lstrlenA (lpString="*.dwg") returned 5
	[0064.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.max") returned 0
	[0064.591] lstrlenA (lpString="*.max") returned 5
	[0064.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.bmp") returned 0
	[0064.591] lstrlenA (lpString="*.bmp") returned 5
	[0064.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.gif") returned 1
	[0064.591] lstrlenA (lpString="*.gif") returned 5
	[0064.591] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif"
	[0064.591] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif"
	[0064.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif."
	[0064.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.Boom"
	[0064.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.592] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354
	[0064.592] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1
	[0064.592] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.592] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x331, lpOverlapped=0x0) returned 1
	[0064.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="rtf_italic.gif"
	[0064.593] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.593] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x331, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x331, lpOverlapped=0x0) returned 1
	[0064.593] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.593] CloseHandle (hObject=0x98) returned 1
	[0064.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.boom")) returned 1
	[0064.594] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.594] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.594] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_justify.gif") returned -1
	[0064.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1
	[0064.594] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1
	[0064.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="rtf_italic.gif"
	[0064.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.594] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif"
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.zip") returned 0
	[0064.594] lstrlenA (lpString="*.zip") returned 5
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.rar") returned 0
	[0064.594] lstrlenA (lpString="*.rar") returned 5
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.7z") returned 0
	[0064.594] lstrlenA (lpString="*.7z") returned 4
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.tar") returned 0
	[0064.594] lstrlenA (lpString="*.tar") returned 5
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.gzip") returned 0
	[0064.594] lstrlenA (lpString="*.gzip") returned 6
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.jpg") returned 0
	[0064.594] lstrlenA (lpString="*.jpg") returned 5
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.jpeg") returned 0
	[0064.594] lstrlenA (lpString="*.jpeg") returned 6
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.psd") returned 0
	[0064.594] lstrlenA (lpString="*.psd") returned 5
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.cdr") returned 0
	[0064.594] lstrlenA (lpString="*.cdr") returned 5
	[0064.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.dwg") returned 0
	[0064.594] lstrlenA (lpString="*.dwg") returned 5
	[0064.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.max") returned 0
	[0064.595] lstrlenA (lpString="*.max") returned 5
	[0064.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.bmp") returned 0
	[0064.595] lstrlenA (lpString="*.bmp") returned 5
	[0064.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.gif") returned 1
	[0064.595] lstrlenA (lpString="*.gif") returned 5
	[0064.595] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif"
	[0064.595] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif"
	[0064.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif."
	[0064.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.Boom"
	[0064.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.595] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352
	[0064.595] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1
	[0064.595] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.595] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32f, lpOverlapped=0x0) returned 1
	[0064.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="rtf_justify.gif"
	[0064.596] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.597] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32f, lpOverlapped=0x0) returned 1
	[0064.597] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.597] CloseHandle (hObject=0x98) returned 1
	[0064.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.boom")) returned 1
	[0064.597] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.597] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.597] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_pressed.gif") returned -1
	[0064.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1
	[0064.597] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1
	[0064.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="rtf_justify.gif"
	[0064.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif"
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.zip") returned 0
	[0064.598] lstrlenA (lpString="*.zip") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.rar") returned 0
	[0064.598] lstrlenA (lpString="*.rar") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.7z") returned 0
	[0064.598] lstrlenA (lpString="*.7z") returned 4
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.tar") returned 0
	[0064.598] lstrlenA (lpString="*.tar") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.gzip") returned 0
	[0064.598] lstrlenA (lpString="*.gzip") returned 6
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.jpg") returned 0
	[0064.598] lstrlenA (lpString="*.jpg") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0
	[0064.598] lstrlenA (lpString="*.jpeg") returned 6
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.psd") returned 0
	[0064.598] lstrlenA (lpString="*.psd") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.cdr") returned 0
	[0064.598] lstrlenA (lpString="*.cdr") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.dwg") returned 0
	[0064.598] lstrlenA (lpString="*.dwg") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.max") returned 0
	[0064.598] lstrlenA (lpString="*.max") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.bmp") returned 0
	[0064.598] lstrlenA (lpString="*.bmp") returned 5
	[0064.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.gif") returned 1
	[0064.598] lstrlenA (lpString="*.gif") returned 5
	[0064.598] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif"
	[0064.598] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif"
	[0064.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif."
	[0064.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.Boom"
	[0064.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.599] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373
	[0064.599] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1
	[0064.599] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.599] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x350, lpOverlapped=0x0) returned 1
	[0064.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="rtf_pressed.gif"
	[0064.609] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.609] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x350, lpOverlapped=0x0) returned 1
	[0064.610] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.610] CloseHandle (hObject=0x98) returned 1
	[0064.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.boom")) returned 1
	[0064.611] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.611] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.611] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_underline.gif") returned -1
	[0064.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1
	[0064.611] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1
	[0064.611] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="rtf_pressed.gif"
	[0064.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif"
	[0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.zip") returned 0
	[0064.611] lstrlenA (lpString="*.zip") returned 5
	[0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.rar") returned 0
	[0064.611] lstrlenA (lpString="*.rar") returned 5
	[0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.7z") returned 0
	[0064.611] lstrlenA (lpString="*.7z") returned 4
	[0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.tar") returned 0
	[0064.611] lstrlenA (lpString="*.tar") returned 5
	[0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.gzip") returned 0
	[0064.611] lstrlenA (lpString="*.gzip") returned 6
	[0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.jpg") returned 0
	[0064.611] lstrlenA (lpString="*.jpg") returned 5
	[0064.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.jpeg") returned 0
	[0064.611] lstrlenA (lpString="*.jpeg") returned 6
	[0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.psd") returned 0
	[0064.612] lstrlenA (lpString="*.psd") returned 5
	[0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.cdr") returned 0
	[0064.612] lstrlenA (lpString="*.cdr") returned 5
	[0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.dwg") returned 0
	[0064.612] lstrlenA (lpString="*.dwg") returned 5
	[0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.max") returned 0
	[0064.612] lstrlenA (lpString="*.max") returned 5
	[0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.bmp") returned 0
	[0064.612] lstrlenA (lpString="*.bmp") returned 5
	[0064.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.gif") returned 1
	[0064.612] lstrlenA (lpString="*.gif") returned 5
	[0064.612] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif"
	[0064.612] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif"
	[0064.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif."
	[0064.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.Boom"
	[0064.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.613] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c
	[0064.613] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1
	[0064.613] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.613] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x339, lpOverlapped=0x0) returned 1
	[0064.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="rtf_underline.gif"
	[0064.650] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.650] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x339, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x339, lpOverlapped=0x0) returned 1
	[0064.650] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.650] CloseHandle (hObject=0x98) returned 1
	[0064.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.boom")) returned 1
	[0064.651] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.651] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.651] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SAVE.GIF") returned -1
	[0064.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1
	[0064.651] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1
	[0064.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="rtf_underline.gif"
	[0064.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.651] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF"
	[0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.zip") returned 0
	[0064.651] lstrlenA (lpString="*.zip") returned 5
	[0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.rar") returned 0
	[0064.651] lstrlenA (lpString="*.rar") returned 5
	[0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.7z") returned 0
	[0064.651] lstrlenA (lpString="*.7z") returned 4
	[0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.tar") returned 0
	[0064.651] lstrlenA (lpString="*.tar") returned 5
	[0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.gzip") returned 0
	[0064.651] lstrlenA (lpString="*.gzip") returned 6
	[0064.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.jpg") returned 0
	[0064.652] lstrlenA (lpString="*.jpg") returned 5
	[0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.jpeg") returned 0
	[0064.652] lstrlenA (lpString="*.jpeg") returned 6
	[0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.psd") returned 0
	[0064.652] lstrlenA (lpString="*.psd") returned 5
	[0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.cdr") returned 0
	[0064.652] lstrlenA (lpString="*.cdr") returned 5
	[0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.dwg") returned 0
	[0064.652] lstrlenA (lpString="*.dwg") returned 5
	[0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.max") returned 0
	[0064.652] lstrlenA (lpString="*.max") returned 5
	[0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.bmp") returned 0
	[0064.652] lstrlenA (lpString="*.bmp") returned 5
	[0064.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.gif") returned 1
	[0064.652] lstrlenA (lpString="*.gif") returned 5
	[0064.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF"
	[0064.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF"
	[0064.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF."
	[0064.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.Boom"
	[0064.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.652] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26d
	[0064.653] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b)) returned 1
	[0064.653] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.653] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24a, lpOverlapped=0x0) returned 1
	[0064.653] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="SAVE.GIF"
	[0064.653] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.653] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24a, lpOverlapped=0x0) returned 1
	[0064.653] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.654] CloseHandle (hObject=0x98) returned 1
	[0064.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif.boom")) returned 1
	[0064.655] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.655] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.655] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1
	[0064.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1
	[0064.655] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1
	[0064.655] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="SAVE.GIF"
	[0064.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.655] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS"
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.zip") returned 0
	[0064.655] lstrlenA (lpString="*.zip") returned 5
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.rar") returned 0
	[0064.655] lstrlenA (lpString="*.rar") returned 5
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.7z") returned 0
	[0064.655] lstrlenA (lpString="*.7z") returned 4
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.tar") returned 0
	[0064.655] lstrlenA (lpString="*.tar") returned 5
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.gzip") returned 0
	[0064.655] lstrlenA (lpString="*.gzip") returned 6
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.jpg") returned 0
	[0064.655] lstrlenA (lpString="*.jpg") returned 5
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.jpeg") returned 0
	[0064.655] lstrlenA (lpString="*.jpeg") returned 6
	[0064.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.psd") returned 0
	[0064.656] lstrlenA (lpString="*.psd") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.cdr") returned 0
	[0064.656] lstrlenA (lpString="*.cdr") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.dwg") returned 0
	[0064.656] lstrlenA (lpString="*.dwg") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.max") returned 0
	[0064.656] lstrlenA (lpString="*.max") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.bmp") returned 0
	[0064.656] lstrlenA (lpString="*.bmp") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.gif") returned 0
	[0064.656] lstrlenA (lpString="*.gif") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.png") returned 0
	[0064.656] lstrlenA (lpString="*.png") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.doc") returned 0
	[0064.656] lstrlenA (lpString="*.doc") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.docx") returned 0
	[0064.656] lstrlenA (lpString="*.docx") returned 6
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.xls") returned 0
	[0064.656] lstrlenA (lpString="*.xls") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.xlsx") returned 0
	[0064.656] lstrlenA (lpString="*.xlsx") returned 6
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ppt") returned 0
	[0064.656] lstrlenA (lpString="*.ppt") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pptx") returned 0
	[0064.656] lstrlenA (lpString="*.pptx") returned 6
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.txt") returned 0
	[0064.656] lstrlenA (lpString="*.txt") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pdf") returned 0
	[0064.656] lstrlenA (lpString="*.pdf") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.djvu") returned 0
	[0064.656] lstrlenA (lpString="*.djvu") returned 6
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.htm") returned 0
	[0064.656] lstrlenA (lpString="*.htm") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.html") returned 0
	[0064.656] lstrlenA (lpString="*.html") returned 6
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mdb") returned 0
	[0064.656] lstrlenA (lpString="*.mdb") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.cer") returned 0
	[0064.656] lstrlenA (lpString="*.cer") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.p12") returned 0
	[0064.656] lstrlenA (lpString="*.p12") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pfx") returned 0
	[0064.656] lstrlenA (lpString="*.pfx") returned 5
	[0064.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.kwm") returned 0
	[0064.656] lstrlenA (lpString="*.kwm") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pwm") returned 0
	[0064.657] lstrlenA (lpString="*.pwm") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.1cd") returned 0
	[0064.657] lstrlenA (lpString="*.1cd") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.md") returned 0
	[0064.657] lstrlenA (lpString="*.md") returned 4
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mdf") returned 0
	[0064.657] lstrlenA (lpString="*.mdf") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.dbf") returned 0
	[0064.657] lstrlenA (lpString="*.dbf") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.odt") returned 0
	[0064.657] lstrlenA (lpString="*.odt") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.vob") returned 0
	[0064.657] lstrlenA (lpString="*.vob") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ifo") returned 0
	[0064.657] lstrlenA (lpString="*.ifo") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.lnk") returned 0
	[0064.657] lstrlenA (lpString="*.lnk") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.torrent") returned 0
	[0064.657] lstrlenA (lpString="*.torrent") returned 9
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mov") returned 0
	[0064.657] lstrlenA (lpString="*.mov") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.m2v") returned 0
	[0064.657] lstrlenA (lpString="*.m2v") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.3gp") returned 0
	[0064.657] lstrlenA (lpString="*.3gp") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mpeg") returned 0
	[0064.657] lstrlenA (lpString="*.mpeg") returned 6
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mpg") returned 0
	[0064.657] lstrlenA (lpString="*.mpg") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.flv") returned 0
	[0064.657] lstrlenA (lpString="*.flv") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.avi") returned 0
	[0064.657] lstrlenA (lpString="*.avi") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mp4") returned 0
	[0064.657] lstrlenA (lpString="*.mp4") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wmv") returned 0
	[0064.657] lstrlenA (lpString="*.wmv") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.divx") returned 0
	[0064.657] lstrlenA (lpString="*.divx") returned 6
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mkv") returned 0
	[0064.657] lstrlenA (lpString="*.mkv") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mp3") returned 0
	[0064.657] lstrlenA (lpString="*.mp3") returned 5
	[0064.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wav") returned 0
	[0064.658] lstrlenA (lpString="*.wav") returned 5
	[0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.flac") returned 0
	[0064.658] lstrlenA (lpString="*.flac") returned 6
	[0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ape") returned 0
	[0064.658] lstrlenA (lpString="*.ape") returned 5
	[0064.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wma") returned 0
	[0064.681] lstrlenA (lpString="*.wma") returned 5
	[0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ac3") returned 0
	[0064.681] lstrlenA (lpString="*.ac3") returned 5
	[0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.exe") returned 0
	[0064.681] lstrlenA (lpString="*.exe") returned 5
	[0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.apk") returned 0
	[0064.681] lstrlenA (lpString="*.apk") returned 5
	[0064.681] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.681] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.681] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1
	[0064.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1
	[0064.681] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1
	[0064.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned="SUBMIT.JS"
	[0064.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js"
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.zip") returned 0
	[0064.682] lstrlenA (lpString="*.zip") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.rar") returned 0
	[0064.682] lstrlenA (lpString="*.rar") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.7z") returned 0
	[0064.682] lstrlenA (lpString="*.7z") returned 4
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.tar") returned 0
	[0064.682] lstrlenA (lpString="*.tar") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.gzip") returned 0
	[0064.682] lstrlenA (lpString="*.gzip") returned 6
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.jpg") returned 0
	[0064.682] lstrlenA (lpString="*.jpg") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.jpeg") returned 0
	[0064.682] lstrlenA (lpString="*.jpeg") returned 6
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.psd") returned 0
	[0064.682] lstrlenA (lpString="*.psd") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.cdr") returned 0
	[0064.682] lstrlenA (lpString="*.cdr") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.dwg") returned 0
	[0064.682] lstrlenA (lpString="*.dwg") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.max") returned 0
	[0064.682] lstrlenA (lpString="*.max") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.bmp") returned 0
	[0064.682] lstrlenA (lpString="*.bmp") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.gif") returned 0
	[0064.682] lstrlenA (lpString="*.gif") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.png") returned 0
	[0064.682] lstrlenA (lpString="*.png") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.doc") returned 0
	[0064.682] lstrlenA (lpString="*.doc") returned 5
	[0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.docx") returned 0
	[0064.683] lstrlenA (lpString="*.docx") returned 6
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.xls") returned 0
	[0064.683] lstrlenA (lpString="*.xls") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.xlsx") returned 0
	[0064.683] lstrlenA (lpString="*.xlsx") returned 6
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ppt") returned 0
	[0064.683] lstrlenA (lpString="*.ppt") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pptx") returned 0
	[0064.683] lstrlenA (lpString="*.pptx") returned 6
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.txt") returned 0
	[0064.683] lstrlenA (lpString="*.txt") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pdf") returned 0
	[0064.683] lstrlenA (lpString="*.pdf") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.djvu") returned 0
	[0064.683] lstrlenA (lpString="*.djvu") returned 6
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.htm") returned 0
	[0064.683] lstrlenA (lpString="*.htm") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.html") returned 0
	[0064.683] lstrlenA (lpString="*.html") returned 6
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mdb") returned 0
	[0064.683] lstrlenA (lpString="*.mdb") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.cer") returned 0
	[0064.683] lstrlenA (lpString="*.cer") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.p12") returned 0
	[0064.683] lstrlenA (lpString="*.p12") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pfx") returned 0
	[0064.683] lstrlenA (lpString="*.pfx") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.kwm") returned 0
	[0064.683] lstrlenA (lpString="*.kwm") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pwm") returned 0
	[0064.683] lstrlenA (lpString="*.pwm") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.1cd") returned 0
	[0064.683] lstrlenA (lpString="*.1cd") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.md") returned 0
	[0064.683] lstrlenA (lpString="*.md") returned 4
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mdf") returned 0
	[0064.683] lstrlenA (lpString="*.mdf") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.dbf") returned 0
	[0064.683] lstrlenA (lpString="*.dbf") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.odt") returned 0
	[0064.683] lstrlenA (lpString="*.odt") returned 5
	[0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.vob") returned 0
	[0064.683] lstrlenA (lpString="*.vob") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ifo") returned 0
	[0064.684] lstrlenA (lpString="*.ifo") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.lnk") returned 0
	[0064.684] lstrlenA (lpString="*.lnk") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.torrent") returned 0
	[0064.684] lstrlenA (lpString="*.torrent") returned 9
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mov") returned 0
	[0064.684] lstrlenA (lpString="*.mov") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.m2v") returned 0
	[0064.684] lstrlenA (lpString="*.m2v") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.3gp") returned 0
	[0064.684] lstrlenA (lpString="*.3gp") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mpeg") returned 0
	[0064.684] lstrlenA (lpString="*.mpeg") returned 6
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mpg") returned 0
	[0064.684] lstrlenA (lpString="*.mpg") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.flv") returned 0
	[0064.684] lstrlenA (lpString="*.flv") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.avi") returned 0
	[0064.684] lstrlenA (lpString="*.avi") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mp4") returned 0
	[0064.684] lstrlenA (lpString="*.mp4") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wmv") returned 0
	[0064.684] lstrlenA (lpString="*.wmv") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.divx") returned 0
	[0064.684] lstrlenA (lpString="*.divx") returned 6
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mkv") returned 0
	[0064.684] lstrlenA (lpString="*.mkv") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mp3") returned 0
	[0064.684] lstrlenA (lpString="*.mp3") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wav") returned 0
	[0064.684] lstrlenA (lpString="*.wav") returned 5
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.flac") returned 0
	[0064.684] lstrlenA (lpString="*.flac") returned 6
	[0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ape") returned 0
	[0064.685] lstrlenA (lpString="*.ape") returned 5
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wma") returned 0
	[0064.685] lstrlenA (lpString="*.wma") returned 5
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ac3") returned 0
	[0064.685] lstrlenA (lpString="*.ac3") returned 5
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.exe") returned 0
	[0064.685] lstrlenA (lpString="*.exe") returned 5
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.apk") returned 0
	[0064.685] lstrlenA (lpString="*.apk") returned 5
	[0064.685] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.685] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.685] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1
	[0064.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1
	[0064.685] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1
	[0064.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned="utilityfunctions.js"
	[0064.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js"
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.zip") returned 0
	[0064.685] lstrlenA (lpString="*.zip") returned 5
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.rar") returned 0
	[0064.685] lstrlenA (lpString="*.rar") returned 5
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.7z") returned 0
	[0064.685] lstrlenA (lpString="*.7z") returned 4
	[0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.tar") returned 0
	[0064.685] lstrlenA (lpString="*.tar") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.gzip") returned 0
	[0064.686] lstrlenA (lpString="*.gzip") returned 6
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.jpg") returned 0
	[0064.686] lstrlenA (lpString="*.jpg") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.jpeg") returned 0
	[0064.686] lstrlenA (lpString="*.jpeg") returned 6
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.psd") returned 0
	[0064.686] lstrlenA (lpString="*.psd") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.cdr") returned 0
	[0064.686] lstrlenA (lpString="*.cdr") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.dwg") returned 0
	[0064.686] lstrlenA (lpString="*.dwg") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.max") returned 0
	[0064.686] lstrlenA (lpString="*.max") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.bmp") returned 0
	[0064.686] lstrlenA (lpString="*.bmp") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.gif") returned 0
	[0064.686] lstrlenA (lpString="*.gif") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.png") returned 0
	[0064.686] lstrlenA (lpString="*.png") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.doc") returned 0
	[0064.686] lstrlenA (lpString="*.doc") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.docx") returned 0
	[0064.686] lstrlenA (lpString="*.docx") returned 6
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.xls") returned 0
	[0064.686] lstrlenA (lpString="*.xls") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.xlsx") returned 0
	[0064.686] lstrlenA (lpString="*.xlsx") returned 6
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ppt") returned 0
	[0064.686] lstrlenA (lpString="*.ppt") returned 5
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pptx") returned 0
	[0064.686] lstrlenA (lpString="*.pptx") returned 6
	[0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.txt") returned 0
	[0064.687] lstrlenA (lpString="*.txt") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pdf") returned 0
	[0064.687] lstrlenA (lpString="*.pdf") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.djvu") returned 0
	[0064.687] lstrlenA (lpString="*.djvu") returned 6
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.htm") returned 0
	[0064.687] lstrlenA (lpString="*.htm") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.html") returned 0
	[0064.687] lstrlenA (lpString="*.html") returned 6
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mdb") returned 0
	[0064.687] lstrlenA (lpString="*.mdb") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.cer") returned 0
	[0064.687] lstrlenA (lpString="*.cer") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.p12") returned 0
	[0064.687] lstrlenA (lpString="*.p12") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pfx") returned 0
	[0064.687] lstrlenA (lpString="*.pfx") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.kwm") returned 0
	[0064.687] lstrlenA (lpString="*.kwm") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pwm") returned 0
	[0064.687] lstrlenA (lpString="*.pwm") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.1cd") returned 0
	[0064.687] lstrlenA (lpString="*.1cd") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.md") returned 0
	[0064.687] lstrlenA (lpString="*.md") returned 4
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mdf") returned 0
	[0064.687] lstrlenA (lpString="*.mdf") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.dbf") returned 0
	[0064.687] lstrlenA (lpString="*.dbf") returned 5
	[0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.odt") returned 0
	[0064.688] lstrlenA (lpString="*.odt") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.vob") returned 0
	[0064.688] lstrlenA (lpString="*.vob") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ifo") returned 0
	[0064.688] lstrlenA (lpString="*.ifo") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.lnk") returned 0
	[0064.688] lstrlenA (lpString="*.lnk") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.torrent") returned 0
	[0064.688] lstrlenA (lpString="*.torrent") returned 9
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mov") returned 0
	[0064.688] lstrlenA (lpString="*.mov") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.m2v") returned 0
	[0064.688] lstrlenA (lpString="*.m2v") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.3gp") returned 0
	[0064.688] lstrlenA (lpString="*.3gp") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mpeg") returned 0
	[0064.688] lstrlenA (lpString="*.mpeg") returned 6
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mpg") returned 0
	[0064.688] lstrlenA (lpString="*.mpg") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.flv") returned 0
	[0064.688] lstrlenA (lpString="*.flv") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.avi") returned 0
	[0064.688] lstrlenA (lpString="*.avi") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mp4") returned 0
	[0064.688] lstrlenA (lpString="*.mp4") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wmv") returned 0
	[0064.688] lstrlenA (lpString="*.wmv") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.divx") returned 0
	[0064.688] lstrlenA (lpString="*.divx") returned 6
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mkv") returned 0
	[0064.688] lstrlenA (lpString="*.mkv") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mp3") returned 0
	[0064.688] lstrlenA (lpString="*.mp3") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wav") returned 0
	[0064.688] lstrlenA (lpString="*.wav") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.flac") returned 0
	[0064.688] lstrlenA (lpString="*.flac") returned 6
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ape") returned 0
	[0064.688] lstrlenA (lpString="*.ape") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wma") returned 0
	[0064.688] lstrlenA (lpString="*.wma") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ac3") returned 0
	[0064.688] lstrlenA (lpString="*.ac3") returned 5
	[0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.exe") returned 0
	[0064.688] lstrlenA (lpString="*.exe") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.apk") returned 0
	[0064.689] lstrlenA (lpString="*.apk") returned 5
	[0064.689] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.689] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.689] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.ICO") returned -1
	[0064.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1
	[0064.689] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1
	[0064.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned="validation.js"
	[0064.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.689] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO"
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.zip") returned 0
	[0064.689] lstrlenA (lpString="*.zip") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.rar") returned 0
	[0064.689] lstrlenA (lpString="*.rar") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.7z") returned 0
	[0064.689] lstrlenA (lpString="*.7z") returned 4
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.tar") returned 0
	[0064.689] lstrlenA (lpString="*.tar") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.gzip") returned 0
	[0064.689] lstrlenA (lpString="*.gzip") returned 6
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.jpg") returned 0
	[0064.689] lstrlenA (lpString="*.jpg") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.jpeg") returned 0
	[0064.689] lstrlenA (lpString="*.jpeg") returned 6
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.psd") returned 0
	[0064.689] lstrlenA (lpString="*.psd") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.cdr") returned 0
	[0064.689] lstrlenA (lpString="*.cdr") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.dwg") returned 0
	[0064.689] lstrlenA (lpString="*.dwg") returned 5
	[0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.max") returned 0
	[0064.690] lstrlenA (lpString="*.max") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.bmp") returned 0
	[0064.690] lstrlenA (lpString="*.bmp") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.gif") returned 0
	[0064.690] lstrlenA (lpString="*.gif") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.png") returned 0
	[0064.690] lstrlenA (lpString="*.png") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.doc") returned 0
	[0064.690] lstrlenA (lpString="*.doc") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.docx") returned 0
	[0064.690] lstrlenA (lpString="*.docx") returned 6
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.xls") returned 0
	[0064.690] lstrlenA (lpString="*.xls") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.xlsx") returned 0
	[0064.690] lstrlenA (lpString="*.xlsx") returned 6
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ppt") returned 0
	[0064.690] lstrlenA (lpString="*.ppt") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pptx") returned 0
	[0064.690] lstrlenA (lpString="*.pptx") returned 6
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.txt") returned 0
	[0064.690] lstrlenA (lpString="*.txt") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pdf") returned 0
	[0064.690] lstrlenA (lpString="*.pdf") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.djvu") returned 0
	[0064.690] lstrlenA (lpString="*.djvu") returned 6
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.htm") returned 0
	[0064.690] lstrlenA (lpString="*.htm") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.html") returned 0
	[0064.690] lstrlenA (lpString="*.html") returned 6
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mdb") returned 0
	[0064.690] lstrlenA (lpString="*.mdb") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.cer") returned 0
	[0064.690] lstrlenA (lpString="*.cer") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.p12") returned 0
	[0064.690] lstrlenA (lpString="*.p12") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pfx") returned 0
	[0064.690] lstrlenA (lpString="*.pfx") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.kwm") returned 0
	[0064.690] lstrlenA (lpString="*.kwm") returned 5
	[0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pwm") returned 0
	[0064.690] lstrlenA (lpString="*.pwm") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.1cd") returned 0
	[0064.691] lstrlenA (lpString="*.1cd") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.md") returned 0
	[0064.691] lstrlenA (lpString="*.md") returned 4
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mdf") returned 0
	[0064.691] lstrlenA (lpString="*.mdf") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.dbf") returned 0
	[0064.691] lstrlenA (lpString="*.dbf") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.odt") returned 0
	[0064.691] lstrlenA (lpString="*.odt") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.vob") returned 0
	[0064.691] lstrlenA (lpString="*.vob") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ifo") returned 0
	[0064.691] lstrlenA (lpString="*.ifo") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.lnk") returned 0
	[0064.691] lstrlenA (lpString="*.lnk") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.torrent") returned 0
	[0064.691] lstrlenA (lpString="*.torrent") returned 9
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mov") returned 0
	[0064.691] lstrlenA (lpString="*.mov") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.m2v") returned 0
	[0064.691] lstrlenA (lpString="*.m2v") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.3gp") returned 0
	[0064.691] lstrlenA (lpString="*.3gp") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mpeg") returned 0
	[0064.691] lstrlenA (lpString="*.mpeg") returned 6
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mpg") returned 0
	[0064.691] lstrlenA (lpString="*.mpg") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.flv") returned 0
	[0064.691] lstrlenA (lpString="*.flv") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.avi") returned 0
	[0064.691] lstrlenA (lpString="*.avi") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mp4") returned 0
	[0064.691] lstrlenA (lpString="*.mp4") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wmv") returned 0
	[0064.691] lstrlenA (lpString="*.wmv") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.divx") returned 0
	[0064.691] lstrlenA (lpString="*.divx") returned 6
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mkv") returned 0
	[0064.691] lstrlenA (lpString="*.mkv") returned 5
	[0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mp3") returned 0
	[0064.692] lstrlenA (lpString="*.mp3") returned 5
	[0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wav") returned 0
	[0064.692] lstrlenA (lpString="*.wav") returned 5
	[0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.flac") returned 0
	[0064.692] lstrlenA (lpString="*.flac") returned 6
	[0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ape") returned 0
	[0064.692] lstrlenA (lpString="*.ape") returned 5
	[0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wma") returned 0
	[0064.692] lstrlenA (lpString="*.wma") returned 5
	[0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ac3") returned 0
	[0064.692] lstrlenA (lpString="*.ac3") returned 5
	[0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.exe") returned 0
	[0064.692] lstrlenA (lpString="*.exe") returned 5
	[0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.apk") returned 0
	[0064.692] lstrlenA (lpString="*.apk") returned 5
	[0064.692] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.692] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.692] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.JS") returned -1
	[0064.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1
	[0064.692] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1
	[0064.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned="VIEW.ICO"
	[0064.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS"
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.zip") returned 0
	[0064.693] lstrlenA (lpString="*.zip") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.rar") returned 0
	[0064.693] lstrlenA (lpString="*.rar") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.7z") returned 0
	[0064.693] lstrlenA (lpString="*.7z") returned 4
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.tar") returned 0
	[0064.693] lstrlenA (lpString="*.tar") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.gzip") returned 0
	[0064.693] lstrlenA (lpString="*.gzip") returned 6
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.jpg") returned 0
	[0064.693] lstrlenA (lpString="*.jpg") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.jpeg") returned 0
	[0064.693] lstrlenA (lpString="*.jpeg") returned 6
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.psd") returned 0
	[0064.693] lstrlenA (lpString="*.psd") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.cdr") returned 0
	[0064.693] lstrlenA (lpString="*.cdr") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.dwg") returned 0
	[0064.693] lstrlenA (lpString="*.dwg") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.max") returned 0
	[0064.693] lstrlenA (lpString="*.max") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.bmp") returned 0
	[0064.693] lstrlenA (lpString="*.bmp") returned 5
	[0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.gif") returned 0
	[0064.693] lstrlenA (lpString="*.gif") returned 5
	[0064.694] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.694] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.694] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ViewHeaderPreview.jpg") returned -1
	[0064.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1
	[0064.694] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1
	[0064.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned="VIEW.JS"
	[0064.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\"
	[0064.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned=""
	[0064.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt"
	[0064.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20
	[0064.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg"
	[0064.694] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg"
	[0064.694] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg"
	[0064.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg."
	[0064.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.Boom"
	[0064.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.695] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78
	[0064.695] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.695] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.695] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd55, lpOverlapped=0x0) returned 1
	[0064.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg"
	[0064.696] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.696] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd55, lpOverlapped=0x0) returned 1
	[0064.696] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.696] CloseHandle (hObject=0x98) returned 1
	[0064.697] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.boom")) returned 1
	[0064.697] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0064.697] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0064.697] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0064.697] lstrcmpA (lpString1=".", lpString2="GrooveForms4") returned -1
	[0064.697] lstrcmpA (lpString1="..", lpString2="GrooveForms4") returned -1
	[0064.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0064.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms4" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4"
	[0064.697] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned 82
	[0064.697] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0064.710] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0064.710] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.711] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0064.712] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0064.712] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.712] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.712] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADD.GIF") returned 1
	[0064.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1
	[0064.712] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1
	[0064.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*") returned="*.*"
	[0064.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.712] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0xffffffff
	[0064.713] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.713] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0064.713] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0064.714] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0064.714] CloseHandle (hObject=0x98) returned 1
	[0064.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF"
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.zip") returned 0
	[0064.715] lstrlenA (lpString="*.zip") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.rar") returned 0
	[0064.715] lstrlenA (lpString="*.rar") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.7z") returned 0
	[0064.715] lstrlenA (lpString="*.7z") returned 4
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.tar") returned 0
	[0064.715] lstrlenA (lpString="*.tar") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.gzip") returned 0
	[0064.715] lstrlenA (lpString="*.gzip") returned 6
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.jpg") returned 0
	[0064.715] lstrlenA (lpString="*.jpg") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.jpeg") returned 0
	[0064.715] lstrlenA (lpString="*.jpeg") returned 6
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.psd") returned 0
	[0064.715] lstrlenA (lpString="*.psd") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.cdr") returned 0
	[0064.715] lstrlenA (lpString="*.cdr") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.dwg") returned 0
	[0064.715] lstrlenA (lpString="*.dwg") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.max") returned 0
	[0064.715] lstrlenA (lpString="*.max") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.bmp") returned 0
	[0064.715] lstrlenA (lpString="*.bmp") returned 5
	[0064.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.gif") returned 1
	[0064.715] lstrlenA (lpString="*.gif") returned 5
	[0064.715] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF"
	[0064.715] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF"
	[0064.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF."
	[0064.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.Boom"
	[0064.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.716] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244
	[0064.716] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.716] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.716] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x221, lpOverlapped=0x0) returned 1
	[0064.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="ADD.GIF"
	[0064.717] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.717] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x221, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x221, lpOverlapped=0x0) returned 1
	[0064.717] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.717] CloseHandle (hObject=0x98) returned 1
	[0064.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif.boom")) returned 1
	[0064.718] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.718] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.718] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrow.jpg") returned 1
	[0064.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1
	[0064.718] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1
	[0064.718] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="ADD.GIF"
	[0064.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.718] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.718] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg"
	[0064.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0
	[0064.718] lstrlenA (lpString="*.zip") returned 5
	[0064.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0
	[0064.719] lstrlenA (lpString="*.rar") returned 5
	[0064.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0
	[0064.719] lstrlenA (lpString="*.7z") returned 4
	[0064.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0
	[0064.719] lstrlenA (lpString="*.tar") returned 5
	[0064.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0
	[0064.719] lstrlenA (lpString="*.gzip") returned 6
	[0064.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1
	[0064.719] lstrlenA (lpString="*.jpg") returned 5
	[0064.719] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg"
	[0064.719] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg"
	[0064.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg."
	[0064.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.Boom"
	[0064.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.719] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8
	[0064.719] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.719] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.719] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbc5, lpOverlapped=0x0) returned 1
	[0064.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg"
	[0064.730] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.730] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbc5, lpOverlapped=0x0) returned 1
	[0064.730] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.730] CloseHandle (hObject=0x98) returned 1
	[0064.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.boom")) returned 1
	[0064.731] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.731] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.731] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrowMask.bmp") returned 1
	[0064.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1
	[0064.731] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1
	[0064.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg"
	[0064.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.731] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.732] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp"
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0
	[0064.732] lstrlenA (lpString="*.zip") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0
	[0064.732] lstrlenA (lpString="*.rar") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0
	[0064.732] lstrlenA (lpString="*.7z") returned 4
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0
	[0064.732] lstrlenA (lpString="*.tar") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0
	[0064.732] lstrlenA (lpString="*.gzip") returned 6
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0
	[0064.732] lstrlenA (lpString="*.jpg") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0
	[0064.732] lstrlenA (lpString="*.jpeg") returned 6
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0
	[0064.732] lstrlenA (lpString="*.psd") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.cdr") returned 0
	[0064.732] lstrlenA (lpString="*.cdr") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.dwg") returned 0
	[0064.732] lstrlenA (lpString="*.dwg") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.max") returned 0
	[0064.732] lstrlenA (lpString="*.max") returned 5
	[0064.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.bmp") returned 1
	[0064.732] lstrlenA (lpString="*.bmp") returned 5
	[0064.732] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp"
	[0064.732] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp"
	[0064.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp."
	[0064.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.Boom"
	[0064.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.733] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924
	[0064.733] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.733] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.733] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x901, lpOverlapped=0x0) returned 1
	[0064.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp"
	[0064.742] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.743] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x901, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x901, lpOverlapped=0x0) returned 1
	[0064.743] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.743] CloseHandle (hObject=0x98) returned 1
	[0064.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.boom")) returned 1
	[0064.744] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.744] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.744] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1
	[0064.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1
	[0064.744] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1
	[0064.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp"
	[0064.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif"
	[0064.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.zip") returned 0
	[0064.744] lstrlenA (lpString="*.zip") returned 5
	[0064.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.rar") returned 0
	[0064.744] lstrlenA (lpString="*.rar") returned 5
	[0064.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.7z") returned 0
	[0064.744] lstrlenA (lpString="*.7z") returned 4
	[0064.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.tar") returned 0
	[0064.744] lstrlenA (lpString="*.tar") returned 5
	[0064.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.gzip") returned 0
	[0064.744] lstrlenA (lpString="*.gzip") returned 6
	[0064.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.jpg") returned 0
	[0064.744] lstrlenA (lpString="*.jpg") returned 5
	[0064.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.jpeg") returned 0
	[0064.745] lstrlenA (lpString="*.jpeg") returned 6
	[0064.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.psd") returned 0
	[0064.745] lstrlenA (lpString="*.psd") returned 5
	[0064.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.cdr") returned 0
	[0064.745] lstrlenA (lpString="*.cdr") returned 5
	[0064.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.dwg") returned 0
	[0064.745] lstrlenA (lpString="*.dwg") returned 5
	[0064.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.max") returned 0
	[0064.745] lstrlenA (lpString="*.max") returned 5
	[0064.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.bmp") returned 0
	[0064.745] lstrlenA (lpString="*.bmp") returned 5
	[0064.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.gif") returned 1
	[0064.745] lstrlenA (lpString="*.gif") returned 5
	[0064.745] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif"
	[0064.745] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif"
	[0064.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif."
	[0064.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.Boom"
	[0064.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.746] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8
	[0064.746] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.746] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.746] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xac5, lpOverlapped=0x0) returned 1
	[0064.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="attention.gif"
	[0064.754] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.755] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xac5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xac5, lpOverlapped=0x0) returned 1
	[0064.755] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.755] CloseHandle (hObject=0x98) returned 1
	[0064.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.boom")) returned 1
	[0064.756] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.756] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.756] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BG_ADOBE.GIF") returned 1
	[0064.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1
	[0064.756] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1
	[0064.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="attention.gif"
	[0064.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF"
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0
	[0064.756] lstrlenA (lpString="*.zip") returned 5
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0
	[0064.756] lstrlenA (lpString="*.rar") returned 5
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0
	[0064.756] lstrlenA (lpString="*.7z") returned 4
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0
	[0064.756] lstrlenA (lpString="*.tar") returned 5
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0
	[0064.756] lstrlenA (lpString="*.gzip") returned 6
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0
	[0064.756] lstrlenA (lpString="*.jpg") returned 5
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0
	[0064.756] lstrlenA (lpString="*.jpeg") returned 6
	[0064.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0
	[0064.757] lstrlenA (lpString="*.psd") returned 5
	[0064.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.cdr") returned 0
	[0064.757] lstrlenA (lpString="*.cdr") returned 5
	[0064.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.dwg") returned 0
	[0064.757] lstrlenA (lpString="*.dwg") returned 5
	[0064.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.max") returned 0
	[0064.757] lstrlenA (lpString="*.max") returned 5
	[0064.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.bmp") returned 0
	[0064.757] lstrlenA (lpString="*.bmp") returned 5
	[0064.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1
	[0064.757] lstrlenA (lpString="*.gif") returned 5
	[0064.757] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF"
	[0064.757] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF"
	[0064.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF."
	[0064.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.Boom"
	[0064.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.757] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e
	[0064.757] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.758] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.758] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x612b, lpOverlapped=0x0) returned 1
	[0064.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF"
	[0064.768] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.768] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x612b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x612b, lpOverlapped=0x0) returned 1
	[0064.768] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.768] CloseHandle (hObject=0x98) returned 1
	[0064.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif.boom")) returned 1
	[0064.769] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.769] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Casual.gif") returned 1
	[0064.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1
	[0064.769] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1
	[0064.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF"
	[0064.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif"
	[0064.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.zip") returned 0
	[0064.769] lstrlenA (lpString="*.zip") returned 5
	[0064.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.rar") returned 0
	[0064.769] lstrlenA (lpString="*.rar") returned 5
	[0064.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.7z") returned 0
	[0064.769] lstrlenA (lpString="*.7z") returned 4
	[0064.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.tar") returned 0
	[0064.769] lstrlenA (lpString="*.tar") returned 5
	[0064.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.gzip") returned 0
	[0064.769] lstrlenA (lpString="*.gzip") returned 6
	[0064.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.jpg") returned 0
	[0064.769] lstrlenA (lpString="*.jpg") returned 5
	[0064.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.jpeg") returned 0
	[0064.769] lstrlenA (lpString="*.jpeg") returned 6
	[0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.psd") returned 0
	[0064.770] lstrlenA (lpString="*.psd") returned 5
	[0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.cdr") returned 0
	[0064.770] lstrlenA (lpString="*.cdr") returned 5
	[0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.dwg") returned 0
	[0064.770] lstrlenA (lpString="*.dwg") returned 5
	[0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.max") returned 0
	[0064.770] lstrlenA (lpString="*.max") returned 5
	[0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.bmp") returned 0
	[0064.770] lstrlenA (lpString="*.bmp") returned 5
	[0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.gif") returned 1
	[0064.770] lstrlenA (lpString="*.gif") returned 5
	[0064.770] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif"
	[0064.770] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif"
	[0064.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif."
	[0064.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.Boom"
	[0064.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.770] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d
	[0064.771] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5197d290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.771] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.771] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x15fa, lpOverlapped=0x0) returned 1
	[0064.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="bg_Casual.gif"
	[0064.784] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.784] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x15fa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x15fa, lpOverlapped=0x0) returned 1
	[0064.784] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.785] CloseHandle (hObject=0x98) returned 1
	[0064.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.boom")) returned 1
	[0064.785] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.785] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.785] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Country.gif") returned 1
	[0064.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1
	[0064.786] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1
	[0064.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="bg_Casual.gif"
	[0064.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif"
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.zip") returned 0
	[0064.786] lstrlenA (lpString="*.zip") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.rar") returned 0
	[0064.786] lstrlenA (lpString="*.rar") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.7z") returned 0
	[0064.786] lstrlenA (lpString="*.7z") returned 4
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.tar") returned 0
	[0064.786] lstrlenA (lpString="*.tar") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.gzip") returned 0
	[0064.786] lstrlenA (lpString="*.gzip") returned 6
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.jpg") returned 0
	[0064.786] lstrlenA (lpString="*.jpg") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.jpeg") returned 0
	[0064.786] lstrlenA (lpString="*.jpeg") returned 6
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.psd") returned 0
	[0064.786] lstrlenA (lpString="*.psd") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.cdr") returned 0
	[0064.786] lstrlenA (lpString="*.cdr") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.dwg") returned 0
	[0064.786] lstrlenA (lpString="*.dwg") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.max") returned 0
	[0064.786] lstrlenA (lpString="*.max") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.bmp") returned 0
	[0064.786] lstrlenA (lpString="*.bmp") returned 5
	[0064.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.gif") returned 1
	[0064.786] lstrlenA (lpString="*.gif") returned 5
	[0064.786] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif"
	[0064.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif"
	[0064.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif."
	[0064.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.Boom"
	[0064.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.787] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3
	[0064.787] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.787] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.787] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7db0, lpOverlapped=0x0) returned 1
	[0064.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="bg_Country.gif"
	[0064.801] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.801] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7db0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7db0, lpOverlapped=0x0) returned 1
	[0064.801] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.801] CloseHandle (hObject=0x98) returned 1
	[0064.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.boom")) returned 1
	[0064.802] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.802] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.802] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Earthy.gif") returned 1
	[0064.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1
	[0064.802] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1
	[0064.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="bg_Country.gif"
	[0064.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif"
	[0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.zip") returned 0
	[0064.802] lstrlenA (lpString="*.zip") returned 5
	[0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.rar") returned 0
	[0064.802] lstrlenA (lpString="*.rar") returned 5
	[0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.7z") returned 0
	[0064.802] lstrlenA (lpString="*.7z") returned 4
	[0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.tar") returned 0
	[0064.802] lstrlenA (lpString="*.tar") returned 5
	[0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.gzip") returned 0
	[0064.802] lstrlenA (lpString="*.gzip") returned 6
	[0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.jpg") returned 0
	[0064.802] lstrlenA (lpString="*.jpg") returned 5
	[0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0
	[0064.803] lstrlenA (lpString="*.jpeg") returned 6
	[0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.psd") returned 0
	[0064.803] lstrlenA (lpString="*.psd") returned 5
	[0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.cdr") returned 0
	[0064.803] lstrlenA (lpString="*.cdr") returned 5
	[0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.dwg") returned 0
	[0064.803] lstrlenA (lpString="*.dwg") returned 5
	[0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.max") returned 0
	[0064.803] lstrlenA (lpString="*.max") returned 5
	[0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.bmp") returned 0
	[0064.803] lstrlenA (lpString="*.bmp") returned 5
	[0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.gif") returned 1
	[0064.803] lstrlenA (lpString="*.gif") returned 5
	[0064.803] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif"
	[0064.803] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif"
	[0064.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif."
	[0064.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.Boom"
	[0064.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.803] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a
	[0064.803] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.804] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.804] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1307, lpOverlapped=0x0) returned 1
	[0064.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="bg_Earthy.gif"
	[0064.813] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.813] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1307, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1307, lpOverlapped=0x0) returned 1
	[0064.813] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.813] CloseHandle (hObject=0x98) returned 1
	[0064.813] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.boom")) returned 1
	[0064.814] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.814] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.814] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePage.gif") returned 1
	[0064.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1
	[0064.814] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1
	[0064.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="bg_Earthy.gif"
	[0064.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.814] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif"
	[0064.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0
	[0064.814] lstrlenA (lpString="*.zip") returned 5
	[0064.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0
	[0064.814] lstrlenA (lpString="*.rar") returned 5
	[0064.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0
	[0064.814] lstrlenA (lpString="*.7z") returned 4
	[0064.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0
	[0064.815] lstrlenA (lpString="*.tar") returned 5
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0
	[0064.815] lstrlenA (lpString="*.gzip") returned 6
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0
	[0064.815] lstrlenA (lpString="*.jpg") returned 5
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0
	[0064.815] lstrlenA (lpString="*.jpeg") returned 6
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0
	[0064.815] lstrlenA (lpString="*.psd") returned 5
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.cdr") returned 0
	[0064.815] lstrlenA (lpString="*.cdr") returned 5
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.dwg") returned 0
	[0064.815] lstrlenA (lpString="*.dwg") returned 5
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.max") returned 0
	[0064.815] lstrlenA (lpString="*.max") returned 5
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.bmp") returned 0
	[0064.815] lstrlenA (lpString="*.bmp") returned 5
	[0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1
	[0064.815] lstrlenA (lpString="*.gif") returned 5
	[0064.815] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif"
	[0064.815] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif"
	[0064.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif."
	[0064.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.Boom"
	[0064.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.816] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167bd
	[0064.816] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.816] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.816] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1679a, lpOverlapped=0x0) returned 1
	[0064.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif"
	[0064.818] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.818] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1679a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1679a, lpOverlapped=0x0) returned 1
	[0064.818] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.818] CloseHandle (hObject=0x98) returned 1
	[0064.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.boom")) returned 1
	[0064.819] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.819] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.820] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageBlank.gif") returned 1
	[0064.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1
	[0064.820] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1
	[0064.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif"
	[0064.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif"
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0
	[0064.820] lstrlenA (lpString="*.zip") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0
	[0064.820] lstrlenA (lpString="*.rar") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0
	[0064.820] lstrlenA (lpString="*.7z") returned 4
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0
	[0064.820] lstrlenA (lpString="*.tar") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0
	[0064.820] lstrlenA (lpString="*.gzip") returned 6
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0
	[0064.820] lstrlenA (lpString="*.jpg") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0
	[0064.820] lstrlenA (lpString="*.jpeg") returned 6
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0
	[0064.820] lstrlenA (lpString="*.psd") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.cdr") returned 0
	[0064.820] lstrlenA (lpString="*.cdr") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.dwg") returned 0
	[0064.820] lstrlenA (lpString="*.dwg") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.max") returned 0
	[0064.820] lstrlenA (lpString="*.max") returned 5
	[0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.bmp") returned 0
	[0064.821] lstrlenA (lpString="*.bmp") returned 5
	[0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1
	[0064.821] lstrlenA (lpString="*.gif") returned 5
	[0064.821] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif"
	[0064.821] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif"
	[0064.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif."
	[0064.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.Boom"
	[0064.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.821] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb
	[0064.821] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.821] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.821] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4e98, lpOverlapped=0x0) returned 1
	[0064.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif"
	[0064.823] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.823] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4e98, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4e98, lpOverlapped=0x0) returned 1
	[0064.823] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.823] CloseHandle (hObject=0x98) returned 1
	[0064.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.boom")) returned 1
	[0064.824] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.824] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.824] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageSlice.gif") returned 1
	[0064.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1
	[0064.824] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageSlice.gif") returned -1
	[0064.824] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif"
	[0064.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.824] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif"
	[0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.zip") returned 0
	[0064.824] lstrlenA (lpString="*.zip") returned 5
	[0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.rar") returned 0
	[0064.824] lstrlenA (lpString="*.rar") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.7z") returned 0
	[0064.825] lstrlenA (lpString="*.7z") returned 4
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.tar") returned 0
	[0064.825] lstrlenA (lpString="*.tar") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.gzip") returned 0
	[0064.825] lstrlenA (lpString="*.gzip") returned 6
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.jpg") returned 0
	[0064.825] lstrlenA (lpString="*.jpg") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.jpeg") returned 0
	[0064.825] lstrlenA (lpString="*.jpeg") returned 6
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.psd") returned 0
	[0064.825] lstrlenA (lpString="*.psd") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.cdr") returned 0
	[0064.825] lstrlenA (lpString="*.cdr") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.dwg") returned 0
	[0064.825] lstrlenA (lpString="*.dwg") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.max") returned 0
	[0064.825] lstrlenA (lpString="*.max") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.bmp") returned 0
	[0064.825] lstrlenA (lpString="*.bmp") returned 5
	[0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.gif") returned 1
	[0064.825] lstrlenA (lpString="*.gif") returned 5
	[0064.825] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif"
	[0064.825] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif"
	[0064.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif."
	[0064.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.Boom"
	[0064.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.826] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f
	[0064.826] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.826] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.826] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3ec, lpOverlapped=0x0) returned 1
	[0064.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif"
	[0064.827] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.827] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3ec, lpOverlapped=0x0) returned 1
	[0064.827] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.827] CloseHandle (hObject=0x98) returned 1
	[0064.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.boom")) returned 1
	[0064.828] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.828] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_GreenTea.gif") returned 1
	[0064.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1
	[0064.828] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1
	[0064.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif"
	[0064.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.828] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif"
	[0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.zip") returned 0
	[0064.828] lstrlenA (lpString="*.zip") returned 5
	[0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.rar") returned 0
	[0064.828] lstrlenA (lpString="*.rar") returned 5
	[0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.7z") returned 0
	[0064.828] lstrlenA (lpString="*.7z") returned 4
	[0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.tar") returned 0
	[0064.828] lstrlenA (lpString="*.tar") returned 5
	[0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0
	[0064.828] lstrlenA (lpString="*.gzip") returned 6
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0
	[0064.829] lstrlenA (lpString="*.jpg") returned 5
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0
	[0064.829] lstrlenA (lpString="*.jpeg") returned 6
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.psd") returned 0
	[0064.829] lstrlenA (lpString="*.psd") returned 5
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.cdr") returned 0
	[0064.829] lstrlenA (lpString="*.cdr") returned 5
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.dwg") returned 0
	[0064.829] lstrlenA (lpString="*.dwg") returned 5
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.max") returned 0
	[0064.829] lstrlenA (lpString="*.max") returned 5
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.bmp") returned 0
	[0064.829] lstrlenA (lpString="*.bmp") returned 5
	[0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.gif") returned 1
	[0064.829] lstrlenA (lpString="*.gif") returned 5
	[0064.829] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif"
	[0064.829] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif"
	[0064.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif."
	[0064.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.Boom"
	[0064.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.829] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690
	[0064.829] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.830] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.830] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x566d, lpOverlapped=0x0) returned 1
	[0064.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="bg_GreenTea.gif"
	[0064.831] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.831] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x566d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x566d, lpOverlapped=0x0) returned 1
	[0064.831] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.831] CloseHandle (hObject=0x98) returned 1
	[0064.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.boom")) returned 1
	[0064.832] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.832] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.832] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Groove.gif") returned 1
	[0064.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1
	[0064.832] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1
	[0064.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="bg_GreenTea.gif"
	[0064.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.832] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.832] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif"
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.zip") returned 0
	[0064.832] lstrlenA (lpString="*.zip") returned 5
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.rar") returned 0
	[0064.832] lstrlenA (lpString="*.rar") returned 5
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.7z") returned 0
	[0064.832] lstrlenA (lpString="*.7z") returned 4
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.tar") returned 0
	[0064.832] lstrlenA (lpString="*.tar") returned 5
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.gzip") returned 0
	[0064.832] lstrlenA (lpString="*.gzip") returned 6
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.jpg") returned 0
	[0064.832] lstrlenA (lpString="*.jpg") returned 5
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.jpeg") returned 0
	[0064.832] lstrlenA (lpString="*.jpeg") returned 6
	[0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.psd") returned 0
	[0064.832] lstrlenA (lpString="*.psd") returned 5
	[0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.cdr") returned 0
	[0064.833] lstrlenA (lpString="*.cdr") returned 5
	[0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.dwg") returned 0
	[0064.833] lstrlenA (lpString="*.dwg") returned 5
	[0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.max") returned 0
	[0064.833] lstrlenA (lpString="*.max") returned 5
	[0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.bmp") returned 0
	[0064.833] lstrlenA (lpString="*.bmp") returned 5
	[0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.gif") returned 1
	[0064.833] lstrlenA (lpString="*.gif") returned 5
	[0064.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif"
	[0064.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif"
	[0064.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif."
	[0064.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.Boom"
	[0064.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.833] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a
	[0064.833] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.833] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.833] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x47, lpOverlapped=0x0) returned 1
	[0064.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="bg_Groove.gif"
	[0064.834] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.834] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x47, lpOverlapped=0x0) returned 1
	[0064.834] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.834] CloseHandle (hObject=0x98) returned 1
	[0064.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.boom")) returned 1
	[0064.835] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.835] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_LightSpirit.gif") returned 1
	[0064.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1
	[0064.835] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1
	[0064.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="bg_Groove.gif"
	[0064.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif"
	[0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0
	[0064.835] lstrlenA (lpString="*.zip") returned 5
	[0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0
	[0064.835] lstrlenA (lpString="*.rar") returned 5
	[0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0
	[0064.835] lstrlenA (lpString="*.7z") returned 4
	[0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0
	[0064.835] lstrlenA (lpString="*.tar") returned 5
	[0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0
	[0064.836] lstrlenA (lpString="*.gzip") returned 6
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0
	[0064.836] lstrlenA (lpString="*.jpg") returned 5
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0
	[0064.836] lstrlenA (lpString="*.jpeg") returned 6
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0
	[0064.836] lstrlenA (lpString="*.psd") returned 5
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.cdr") returned 0
	[0064.836] lstrlenA (lpString="*.cdr") returned 5
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.dwg") returned 0
	[0064.836] lstrlenA (lpString="*.dwg") returned 5
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.max") returned 0
	[0064.836] lstrlenA (lpString="*.max") returned 5
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.bmp") returned 0
	[0064.836] lstrlenA (lpString="*.bmp") returned 5
	[0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1
	[0064.836] lstrlenA (lpString="*.gif") returned 5
	[0064.836] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif"
	[0064.836] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif"
	[0064.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif."
	[0064.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.Boom"
	[0064.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.836] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6
	[0064.836] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.836] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.837] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2183, lpOverlapped=0x0) returned 1
	[0064.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif"
	[0064.842] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.842] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2183, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2183, lpOverlapped=0x0) returned 1
	[0064.842] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.843] CloseHandle (hObject=0x98) returned 1
	[0064.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.boom")) returned 1
	[0064.843] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.843] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_OliveGreen.gif") returned 1
	[0064.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1
	[0064.843] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1
	[0064.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif"
	[0064.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif"
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0
	[0064.844] lstrlenA (lpString="*.zip") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0
	[0064.844] lstrlenA (lpString="*.rar") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0
	[0064.844] lstrlenA (lpString="*.7z") returned 4
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0
	[0064.844] lstrlenA (lpString="*.tar") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0
	[0064.844] lstrlenA (lpString="*.gzip") returned 6
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0
	[0064.844] lstrlenA (lpString="*.jpg") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0
	[0064.844] lstrlenA (lpString="*.jpeg") returned 6
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0
	[0064.844] lstrlenA (lpString="*.psd") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.cdr") returned 0
	[0064.844] lstrlenA (lpString="*.cdr") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.dwg") returned 0
	[0064.844] lstrlenA (lpString="*.dwg") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.max") returned 0
	[0064.844] lstrlenA (lpString="*.max") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.bmp") returned 0
	[0064.844] lstrlenA (lpString="*.bmp") returned 5
	[0064.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1
	[0064.844] lstrlenA (lpString="*.gif") returned 5
	[0064.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif"
	[0064.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif"
	[0064.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif."
	[0064.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.Boom"
	[0064.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.845] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57
	[0064.845] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.845] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.845] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3d34, lpOverlapped=0x0) returned 1
	[0064.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif"
	[0064.852] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.852] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3d34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3d34, lpOverlapped=0x0) returned 1
	[0064.852] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.852] CloseHandle (hObject=0x98) returned 1
	[0064.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.boom")) returned 1
	[0064.853] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.853] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.853] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Premium.gif") returned 1
	[0064.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1
	[0064.853] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1
	[0064.853] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif"
	[0064.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.853] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif"
	[0064.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.zip") returned 0
	[0064.853] lstrlenA (lpString="*.zip") returned 5
	[0064.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.rar") returned 0
	[0064.853] lstrlenA (lpString="*.rar") returned 5
	[0064.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.7z") returned 0
	[0064.853] lstrlenA (lpString="*.7z") returned 4
	[0064.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.tar") returned 0
	[0064.853] lstrlenA (lpString="*.tar") returned 5
	[0064.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.gzip") returned 0
	[0064.853] lstrlenA (lpString="*.gzip") returned 6
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.jpg") returned 0
	[0064.854] lstrlenA (lpString="*.jpg") returned 5
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.jpeg") returned 0
	[0064.854] lstrlenA (lpString="*.jpeg") returned 6
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.psd") returned 0
	[0064.854] lstrlenA (lpString="*.psd") returned 5
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.cdr") returned 0
	[0064.854] lstrlenA (lpString="*.cdr") returned 5
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.dwg") returned 0
	[0064.854] lstrlenA (lpString="*.dwg") returned 5
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.max") returned 0
	[0064.854] lstrlenA (lpString="*.max") returned 5
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.bmp") returned 0
	[0064.854] lstrlenA (lpString="*.bmp") returned 5
	[0064.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.gif") returned 1
	[0064.854] lstrlenA (lpString="*.gif") returned 5
	[0064.854] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif"
	[0064.854] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif"
	[0064.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif."
	[0064.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.Boom"
	[0064.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.855] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845
	[0064.855] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.855] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.855] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1822, lpOverlapped=0x0) returned 1
	[0064.856] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="bg_Premium.gif"
	[0064.856] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.856] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1822, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1822, lpOverlapped=0x0) returned 1
	[0064.856] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.856] CloseHandle (hObject=0x98) returned 1
	[0064.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.boom")) returned 1
	[0064.857] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.857] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.857] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_SlateBlue.gif") returned 1
	[0064.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1
	[0064.857] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1
	[0064.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="bg_Premium.gif"
	[0064.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif"
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0
	[0064.858] lstrlenA (lpString="*.zip") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0
	[0064.858] lstrlenA (lpString="*.rar") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0
	[0064.858] lstrlenA (lpString="*.7z") returned 4
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0
	[0064.858] lstrlenA (lpString="*.tar") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0
	[0064.858] lstrlenA (lpString="*.gzip") returned 6
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0
	[0064.858] lstrlenA (lpString="*.jpg") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0
	[0064.858] lstrlenA (lpString="*.jpeg") returned 6
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0
	[0064.858] lstrlenA (lpString="*.psd") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.cdr") returned 0
	[0064.858] lstrlenA (lpString="*.cdr") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.dwg") returned 0
	[0064.858] lstrlenA (lpString="*.dwg") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.max") returned 0
	[0064.858] lstrlenA (lpString="*.max") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.bmp") returned 0
	[0064.858] lstrlenA (lpString="*.bmp") returned 5
	[0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1
	[0064.858] lstrlenA (lpString="*.gif") returned 5
	[0064.858] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif"
	[0064.858] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif"
	[0064.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif."
	[0064.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.Boom"
	[0064.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.859] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141
	[0064.859] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.859] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.859] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x511e, lpOverlapped=0x0) returned 1
	[0064.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif"
	[0064.860] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.860] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x511e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x511e, lpOverlapped=0x0) returned 1
	[0064.861] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.861] CloseHandle (hObject=0x98) returned 1
	[0064.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.boom")) returned 1
	[0064.863] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.863] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.863] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_TexturedBlue.gif") returned 1
	[0064.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1
	[0064.863] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1
	[0064.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif"
	[0064.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.863] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif"
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0
	[0064.863] lstrlenA (lpString="*.zip") returned 5
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0
	[0064.863] lstrlenA (lpString="*.rar") returned 5
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0
	[0064.863] lstrlenA (lpString="*.7z") returned 4
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0
	[0064.863] lstrlenA (lpString="*.tar") returned 5
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0
	[0064.863] lstrlenA (lpString="*.gzip") returned 6
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0
	[0064.863] lstrlenA (lpString="*.jpg") returned 5
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0
	[0064.863] lstrlenA (lpString="*.jpeg") returned 6
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0
	[0064.863] lstrlenA (lpString="*.psd") returned 5
	[0064.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.cdr") returned 0
	[0064.863] lstrlenA (lpString="*.cdr") returned 5
	[0064.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.dwg") returned 0
	[0064.864] lstrlenA (lpString="*.dwg") returned 5
	[0064.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.max") returned 0
	[0064.864] lstrlenA (lpString="*.max") returned 5
	[0064.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.bmp") returned 0
	[0064.864] lstrlenA (lpString="*.bmp") returned 5
	[0064.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1
	[0064.864] lstrlenA (lpString="*.gif") returned 5
	[0064.864] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif"
	[0064.864] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif"
	[0064.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif."
	[0064.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.Boom"
	[0064.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.864] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c
	[0064.864] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.864] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.864] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1919, lpOverlapped=0x0) returned 1
	[0064.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif"
	[0064.866] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.866] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1919, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1919, lpOverlapped=0x0) returned 1
	[0064.866] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.866] CloseHandle (hObject=0x98) returned 1
	[0064.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.boom")) returned 1
	[0064.867] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.867] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.867] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_VelvetRose.gif") returned 1
	[0064.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1
	[0064.867] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1
	[0064.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif"
	[0064.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif"
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0
	[0064.867] lstrlenA (lpString="*.zip") returned 5
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0
	[0064.867] lstrlenA (lpString="*.rar") returned 5
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0
	[0064.867] lstrlenA (lpString="*.7z") returned 4
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0
	[0064.867] lstrlenA (lpString="*.tar") returned 5
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0
	[0064.867] lstrlenA (lpString="*.gzip") returned 6
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0
	[0064.867] lstrlenA (lpString="*.jpg") returned 5
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0
	[0064.867] lstrlenA (lpString="*.jpeg") returned 6
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0
	[0064.867] lstrlenA (lpString="*.psd") returned 5
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.cdr") returned 0
	[0064.867] lstrlenA (lpString="*.cdr") returned 5
	[0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.dwg") returned 0
	[0064.867] lstrlenA (lpString="*.dwg") returned 5
	[0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.max") returned 0
	[0064.868] lstrlenA (lpString="*.max") returned 5
	[0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.bmp") returned 0
	[0064.868] lstrlenA (lpString="*.bmp") returned 5
	[0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1
	[0064.868] lstrlenA (lpString="*.gif") returned 5
	[0064.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif"
	[0064.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif"
	[0064.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif."
	[0064.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.Boom"
	[0064.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.869] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64
	[0064.869] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.869] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.869] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3c41, lpOverlapped=0x0) returned 1
	[0064.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif"
	[0064.890] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.890] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3c41, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3c41, lpOverlapped=0x0) returned 1
	[0064.890] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.890] CloseHandle (hObject=0x98) returned 1
	[0064.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.boom")) returned 1
	[0064.891] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.891] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.891] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left.gif") returned 1
	[0064.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1
	[0064.891] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1
	[0064.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif"
	[0064.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif"
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.zip") returned 0
	[0064.892] lstrlenA (lpString="*.zip") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.rar") returned 0
	[0064.892] lstrlenA (lpString="*.rar") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.7z") returned 0
	[0064.892] lstrlenA (lpString="*.7z") returned 4
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.tar") returned 0
	[0064.892] lstrlenA (lpString="*.tar") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.gzip") returned 0
	[0064.892] lstrlenA (lpString="*.gzip") returned 6
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.jpg") returned 0
	[0064.892] lstrlenA (lpString="*.jpg") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.jpeg") returned 0
	[0064.892] lstrlenA (lpString="*.jpeg") returned 6
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.psd") returned 0
	[0064.892] lstrlenA (lpString="*.psd") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.cdr") returned 0
	[0064.892] lstrlenA (lpString="*.cdr") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.dwg") returned 0
	[0064.892] lstrlenA (lpString="*.dwg") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.max") returned 0
	[0064.892] lstrlenA (lpString="*.max") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.bmp") returned 0
	[0064.892] lstrlenA (lpString="*.bmp") returned 5
	[0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.gif") returned 1
	[0064.892] lstrlenA (lpString="*.gif") returned 5
	[0064.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif"
	[0064.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif"
	[0064.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif."
	[0064.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.Boom"
	[0064.893] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.893] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171
	[0064.893] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1
	[0064.893] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.893] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14e, lpOverlapped=0x0) returned 1
	[0064.894] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="button_left.gif"
	[0064.894] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.894] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14e, lpOverlapped=0x0) returned 1
	[0064.894] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.894] CloseHandle (hObject=0x98) returned 1
	[0064.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.boom")) returned 1
	[0064.895] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.895] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.895] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_over.gif") returned 1
	[0064.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1
	[0064.895] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1
	[0064.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="button_left.gif"
	[0064.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.895] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif"
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.zip") returned 0
	[0064.895] lstrlenA (lpString="*.zip") returned 5
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.rar") returned 0
	[0064.895] lstrlenA (lpString="*.rar") returned 5
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.7z") returned 0
	[0064.895] lstrlenA (lpString="*.7z") returned 4
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.tar") returned 0
	[0064.895] lstrlenA (lpString="*.tar") returned 5
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.gzip") returned 0
	[0064.895] lstrlenA (lpString="*.gzip") returned 6
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.jpg") returned 0
	[0064.895] lstrlenA (lpString="*.jpg") returned 5
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.jpeg") returned 0
	[0064.895] lstrlenA (lpString="*.jpeg") returned 6
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.psd") returned 0
	[0064.895] lstrlenA (lpString="*.psd") returned 5
	[0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.cdr") returned 0
	[0064.895] lstrlenA (lpString="*.cdr") returned 5
	[0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.dwg") returned 0
	[0064.896] lstrlenA (lpString="*.dwg") returned 5
	[0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.max") returned 0
	[0064.896] lstrlenA (lpString="*.max") returned 5
	[0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.bmp") returned 0
	[0064.896] lstrlenA (lpString="*.bmp") returned 5
	[0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.gif") returned 1
	[0064.896] lstrlenA (lpString="*.gif") returned 5
	[0064.896] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif"
	[0064.896] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif"
	[0064.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif."
	[0064.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.Boom"
	[0064.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.896] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176
	[0064.896] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.896] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.896] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x153, lpOverlapped=0x0) returned 1
	[0064.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="button_left_over.gif"
	[0064.897] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.897] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x153, lpOverlapped=0x0) returned 1
	[0064.898] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.898] CloseHandle (hObject=0x98) returned 1
	[0064.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.boom")) returned 1
	[0064.898] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.898] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.898] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid.gif") returned 1
	[0064.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1
	[0064.898] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1
	[0064.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="button_left_over.gif"
	[0064.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif"
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.zip") returned 0
	[0064.899] lstrlenA (lpString="*.zip") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.rar") returned 0
	[0064.899] lstrlenA (lpString="*.rar") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.7z") returned 0
	[0064.899] lstrlenA (lpString="*.7z") returned 4
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.tar") returned 0
	[0064.899] lstrlenA (lpString="*.tar") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.gzip") returned 0
	[0064.899] lstrlenA (lpString="*.gzip") returned 6
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.jpg") returned 0
	[0064.899] lstrlenA (lpString="*.jpg") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.jpeg") returned 0
	[0064.899] lstrlenA (lpString="*.jpeg") returned 6
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.psd") returned 0
	[0064.899] lstrlenA (lpString="*.psd") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.cdr") returned 0
	[0064.899] lstrlenA (lpString="*.cdr") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.dwg") returned 0
	[0064.899] lstrlenA (lpString="*.dwg") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.max") returned 0
	[0064.899] lstrlenA (lpString="*.max") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.bmp") returned 0
	[0064.899] lstrlenA (lpString="*.bmp") returned 5
	[0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.gif") returned 1
	[0064.899] lstrlenA (lpString="*.gif") returned 5
	[0064.899] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif"
	[0064.899] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif"
	[0064.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif."
	[0064.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.Boom"
	[0064.899] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.900] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5
	[0064.900] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.900] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.900] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x92, lpOverlapped=0x0) returned 1
	[0064.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="button_mid.gif"
	[0064.901] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.901] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x92, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x92, lpOverlapped=0x0) returned 1
	[0064.901] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.901] CloseHandle (hObject=0x98) returned 1
	[0064.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.boom")) returned 1
	[0064.902] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.902] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.902] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_over.gif") returned 1
	[0064.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1
	[0064.902] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1
	[0064.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="button_mid.gif"
	[0064.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif"
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.zip") returned 0
	[0064.902] lstrlenA (lpString="*.zip") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.rar") returned 0
	[0064.902] lstrlenA (lpString="*.rar") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.7z") returned 0
	[0064.902] lstrlenA (lpString="*.7z") returned 4
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.tar") returned 0
	[0064.902] lstrlenA (lpString="*.tar") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.gzip") returned 0
	[0064.902] lstrlenA (lpString="*.gzip") returned 6
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.jpg") returned 0
	[0064.902] lstrlenA (lpString="*.jpg") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.jpeg") returned 0
	[0064.902] lstrlenA (lpString="*.jpeg") returned 6
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.psd") returned 0
	[0064.902] lstrlenA (lpString="*.psd") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.cdr") returned 0
	[0064.902] lstrlenA (lpString="*.cdr") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.dwg") returned 0
	[0064.902] lstrlenA (lpString="*.dwg") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.max") returned 0
	[0064.902] lstrlenA (lpString="*.max") returned 5
	[0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.bmp") returned 0
	[0064.903] lstrlenA (lpString="*.bmp") returned 5
	[0064.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.gif") returned 1
	[0064.903] lstrlenA (lpString="*.gif") returned 5
	[0064.903] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif"
	[0064.903] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif"
	[0064.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif."
	[0064.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.Boom"
	[0064.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.903] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7
	[0064.903] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.903] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.903] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x94, lpOverlapped=0x0) returned 1
	[0064.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="button_mid_over.gif"
	[0064.904] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.904] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x94, lpOverlapped=0x0) returned 1
	[0064.904] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.904] CloseHandle (hObject=0x98) returned 1
	[0064.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.boom")) returned 1
	[0064.905] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.905] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.905] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right.gif") returned 1
	[0064.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1
	[0064.905] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1
	[0064.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="button_mid_over.gif"
	[0064.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif"
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.zip") returned 0
	[0064.905] lstrlenA (lpString="*.zip") returned 5
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.rar") returned 0
	[0064.905] lstrlenA (lpString="*.rar") returned 5
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.7z") returned 0
	[0064.905] lstrlenA (lpString="*.7z") returned 4
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.tar") returned 0
	[0064.905] lstrlenA (lpString="*.tar") returned 5
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.gzip") returned 0
	[0064.905] lstrlenA (lpString="*.gzip") returned 6
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.jpg") returned 0
	[0064.905] lstrlenA (lpString="*.jpg") returned 5
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.jpeg") returned 0
	[0064.905] lstrlenA (lpString="*.jpeg") returned 6
	[0064.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.psd") returned 0
	[0064.906] lstrlenA (lpString="*.psd") returned 5
	[0064.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.cdr") returned 0
	[0064.906] lstrlenA (lpString="*.cdr") returned 5
	[0064.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.dwg") returned 0
	[0064.906] lstrlenA (lpString="*.dwg") returned 5
	[0064.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.max") returned 0
	[0064.906] lstrlenA (lpString="*.max") returned 5
	[0064.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.bmp") returned 0
	[0064.906] lstrlenA (lpString="*.bmp") returned 5
	[0064.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.gif") returned 1
	[0064.906] lstrlenA (lpString="*.gif") returned 5
	[0064.906] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif"
	[0064.906] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif"
	[0064.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif."
	[0064.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.Boom"
	[0064.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.906] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171
	[0064.906] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.906] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.906] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14e, lpOverlapped=0x0) returned 1
	[0064.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="button_right.gif"
	[0064.907] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.907] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14e, lpOverlapped=0x0) returned 1
	[0064.907] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.907] CloseHandle (hObject=0x98) returned 1
	[0064.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.boom")) returned 1
	[0064.908] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.908] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.908] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_over.gif") returned 1
	[0064.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1
	[0064.908] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1
	[0064.908] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="button_right.gif"
	[0064.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.908] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif"
	[0064.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.zip") returned 0
	[0064.908] lstrlenA (lpString="*.zip") returned 5
	[0064.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.rar") returned 0
	[0064.908] lstrlenA (lpString="*.rar") returned 5
	[0064.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.7z") returned 0
	[0064.908] lstrlenA (lpString="*.7z") returned 4
	[0064.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.tar") returned 0
	[0064.909] lstrlenA (lpString="*.tar") returned 5
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.gzip") returned 0
	[0064.909] lstrlenA (lpString="*.gzip") returned 6
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.jpg") returned 0
	[0064.909] lstrlenA (lpString="*.jpg") returned 5
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.jpeg") returned 0
	[0064.909] lstrlenA (lpString="*.jpeg") returned 6
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.psd") returned 0
	[0064.909] lstrlenA (lpString="*.psd") returned 5
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.cdr") returned 0
	[0064.909] lstrlenA (lpString="*.cdr") returned 5
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.dwg") returned 0
	[0064.909] lstrlenA (lpString="*.dwg") returned 5
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.max") returned 0
	[0064.909] lstrlenA (lpString="*.max") returned 5
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.bmp") returned 0
	[0064.909] lstrlenA (lpString="*.bmp") returned 5
	[0064.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.gif") returned 1
	[0064.909] lstrlenA (lpString="*.gif") returned 5
	[0064.909] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif"
	[0064.909] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif"
	[0064.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif."
	[0064.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.Boom"
	[0064.909] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.909] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244
	[0064.909] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.909] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.910] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x221, lpOverlapped=0x0) returned 1
	[0064.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="button_right_over.gif"
	[0064.911] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.911] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x221, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x221, lpOverlapped=0x0) returned 1
	[0064.911] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.911] CloseHandle (hObject=0x98) returned 1
	[0064.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.boom")) returned 1
	[0064.912] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.912] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.912] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.GIF") returned 1
	[0064.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1
	[0064.912] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1
	[0064.912] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="button_right_over.gif"
	[0064.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.912] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.912] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF"
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.zip") returned 0
	[0064.912] lstrlenA (lpString="*.zip") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.rar") returned 0
	[0064.912] lstrlenA (lpString="*.rar") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.7z") returned 0
	[0064.912] lstrlenA (lpString="*.7z") returned 4
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.tar") returned 0
	[0064.912] lstrlenA (lpString="*.tar") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.gzip") returned 0
	[0064.912] lstrlenA (lpString="*.gzip") returned 6
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.jpg") returned 0
	[0064.912] lstrlenA (lpString="*.jpg") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0
	[0064.912] lstrlenA (lpString="*.jpeg") returned 6
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.psd") returned 0
	[0064.912] lstrlenA (lpString="*.psd") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.cdr") returned 0
	[0064.912] lstrlenA (lpString="*.cdr") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.dwg") returned 0
	[0064.912] lstrlenA (lpString="*.dwg") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.max") returned 0
	[0064.912] lstrlenA (lpString="*.max") returned 5
	[0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.bmp") returned 0
	[0064.913] lstrlenA (lpString="*.bmp") returned 5
	[0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.gif") returned 1
	[0064.913] lstrlenA (lpString="*.gif") returned 5
	[0064.913] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF"
	[0064.913] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF"
	[0064.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF."
	[0064.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.Boom"
	[0064.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.913] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383
	[0064.913] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.913] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.913] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x360, lpOverlapped=0x0) returned 1
	[0064.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="CALENDAR.GIF"
	[0064.914] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.914] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1
	[0064.915] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.915] CloseHandle (hObject=0x98) returned 1
	[0064.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif.boom")) returned 1
	[0064.916] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.916] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELETE.GIF") returned 1
	[0064.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1
	[0064.916] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1
	[0064.916] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="CALENDAR.GIF"
	[0064.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.916] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.916] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.916] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF"
	[0064.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.zip") returned 0
	[0064.916] lstrlenA (lpString="*.zip") returned 5
	[0064.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.rar") returned 0
	[0064.916] lstrlenA (lpString="*.rar") returned 5
	[0064.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.7z") returned 0
	[0064.916] lstrlenA (lpString="*.7z") returned 4
	[0064.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.tar") returned 0
	[0064.916] lstrlenA (lpString="*.tar") returned 5
	[0064.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.gzip") returned 0
	[0064.917] lstrlenA (lpString="*.gzip") returned 6
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.jpg") returned 0
	[0064.917] lstrlenA (lpString="*.jpg") returned 5
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.jpeg") returned 0
	[0064.917] lstrlenA (lpString="*.jpeg") returned 6
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.psd") returned 0
	[0064.917] lstrlenA (lpString="*.psd") returned 5
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.cdr") returned 0
	[0064.917] lstrlenA (lpString="*.cdr") returned 5
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.dwg") returned 0
	[0064.917] lstrlenA (lpString="*.dwg") returned 5
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.max") returned 0
	[0064.917] lstrlenA (lpString="*.max") returned 5
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.bmp") returned 0
	[0064.917] lstrlenA (lpString="*.bmp") returned 5
	[0064.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.gif") returned 1
	[0064.917] lstrlenA (lpString="*.gif") returned 5
	[0064.917] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF"
	[0064.917] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF"
	[0064.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF."
	[0064.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.Boom"
	[0064.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.918] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271
	[0064.918] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.918] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.918] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24e, lpOverlapped=0x0) returned 1
	[0064.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="DELETE.GIF"
	[0064.919] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.919] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24e, lpOverlapped=0x0) returned 1
	[0064.919] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.919] CloseHandle (hObject=0x98) returned 1
	[0064.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif.boom")) returned 1
	[0064.920] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.920] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.920] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ERROR.GIF") returned -1
	[0064.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1
	[0064.920] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1
	[0064.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="DELETE.GIF"
	[0064.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.920] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF"
	[0064.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.zip") returned 0
	[0064.920] lstrlenA (lpString="*.zip") returned 5
	[0064.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.rar") returned 0
	[0064.921] lstrlenA (lpString="*.rar") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.7z") returned 0
	[0064.921] lstrlenA (lpString="*.7z") returned 4
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.tar") returned 0
	[0064.921] lstrlenA (lpString="*.tar") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.gzip") returned 0
	[0064.921] lstrlenA (lpString="*.gzip") returned 6
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.jpg") returned 0
	[0064.921] lstrlenA (lpString="*.jpg") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.jpeg") returned 0
	[0064.921] lstrlenA (lpString="*.jpeg") returned 6
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.psd") returned 0
	[0064.921] lstrlenA (lpString="*.psd") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.cdr") returned 0
	[0064.921] lstrlenA (lpString="*.cdr") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.dwg") returned 0
	[0064.921] lstrlenA (lpString="*.dwg") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.max") returned 0
	[0064.921] lstrlenA (lpString="*.max") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.bmp") returned 0
	[0064.921] lstrlenA (lpString="*.bmp") returned 5
	[0064.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.gif") returned 1
	[0064.921] lstrlenA (lpString="*.gif") returned 5
	[0064.921] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF"
	[0064.921] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF"
	[0064.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF."
	[0064.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.Boom"
	[0064.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.922] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369
	[0064.922] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51fe2db0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.922] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.922] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x346, lpOverlapped=0x0) returned 1
	[0064.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="ERROR.GIF"
	[0064.931] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.931] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x346, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x346, lpOverlapped=0x0) returned 1
	[0064.932] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.932] CloseHandle (hObject=0x98) returned 1
	[0064.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif.boom")) returned 1
	[0064.932] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.932] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.932] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.ICO") returned -1
	[0064.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1
	[0064.933] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1
	[0064.933] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="ERROR.GIF"
	[0064.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.933] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.933] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO"
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.zip") returned 0
	[0064.933] lstrlenA (lpString="*.zip") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.rar") returned 0
	[0064.933] lstrlenA (lpString="*.rar") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.7z") returned 0
	[0064.933] lstrlenA (lpString="*.7z") returned 4
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.tar") returned 0
	[0064.933] lstrlenA (lpString="*.tar") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.gzip") returned 0
	[0064.933] lstrlenA (lpString="*.gzip") returned 6
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.jpg") returned 0
	[0064.933] lstrlenA (lpString="*.jpg") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.jpeg") returned 0
	[0064.933] lstrlenA (lpString="*.jpeg") returned 6
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.psd") returned 0
	[0064.933] lstrlenA (lpString="*.psd") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.cdr") returned 0
	[0064.933] lstrlenA (lpString="*.cdr") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.dwg") returned 0
	[0064.933] lstrlenA (lpString="*.dwg") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.max") returned 0
	[0064.933] lstrlenA (lpString="*.max") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.bmp") returned 0
	[0064.933] lstrlenA (lpString="*.bmp") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.gif") returned 0
	[0064.933] lstrlenA (lpString="*.gif") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.png") returned 0
	[0064.933] lstrlenA (lpString="*.png") returned 5
	[0064.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.doc") returned 0
	[0064.934] lstrlenA (lpString="*.doc") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.docx") returned 0
	[0064.934] lstrlenA (lpString="*.docx") returned 6
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.xls") returned 0
	[0064.934] lstrlenA (lpString="*.xls") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.xlsx") returned 0
	[0064.934] lstrlenA (lpString="*.xlsx") returned 6
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ppt") returned 0
	[0064.934] lstrlenA (lpString="*.ppt") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pptx") returned 0
	[0064.934] lstrlenA (lpString="*.pptx") returned 6
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.txt") returned 0
	[0064.934] lstrlenA (lpString="*.txt") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pdf") returned 0
	[0064.934] lstrlenA (lpString="*.pdf") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.djvu") returned 0
	[0064.934] lstrlenA (lpString="*.djvu") returned 6
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.htm") returned 0
	[0064.934] lstrlenA (lpString="*.htm") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.html") returned 0
	[0064.934] lstrlenA (lpString="*.html") returned 6
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mdb") returned 0
	[0064.934] lstrlenA (lpString="*.mdb") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.cer") returned 0
	[0064.934] lstrlenA (lpString="*.cer") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.p12") returned 0
	[0064.934] lstrlenA (lpString="*.p12") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pfx") returned 0
	[0064.934] lstrlenA (lpString="*.pfx") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.kwm") returned 0
	[0064.934] lstrlenA (lpString="*.kwm") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pwm") returned 0
	[0064.934] lstrlenA (lpString="*.pwm") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.1cd") returned 0
	[0064.934] lstrlenA (lpString="*.1cd") returned 5
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.md") returned 0
	[0064.934] lstrlenA (lpString="*.md") returned 4
	[0064.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mdf") returned 0
	[0064.934] lstrlenA (lpString="*.mdf") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.dbf") returned 0
	[0064.935] lstrlenA (lpString="*.dbf") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.odt") returned 0
	[0064.935] lstrlenA (lpString="*.odt") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.vob") returned 0
	[0064.935] lstrlenA (lpString="*.vob") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ifo") returned 0
	[0064.935] lstrlenA (lpString="*.ifo") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.lnk") returned 0
	[0064.935] lstrlenA (lpString="*.lnk") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.torrent") returned 0
	[0064.935] lstrlenA (lpString="*.torrent") returned 9
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mov") returned 0
	[0064.935] lstrlenA (lpString="*.mov") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.m2v") returned 0
	[0064.935] lstrlenA (lpString="*.m2v") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.3gp") returned 0
	[0064.935] lstrlenA (lpString="*.3gp") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mpeg") returned 0
	[0064.935] lstrlenA (lpString="*.mpeg") returned 6
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mpg") returned 0
	[0064.935] lstrlenA (lpString="*.mpg") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.flv") returned 0
	[0064.935] lstrlenA (lpString="*.flv") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.avi") returned 0
	[0064.935] lstrlenA (lpString="*.avi") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mp4") returned 0
	[0064.935] lstrlenA (lpString="*.mp4") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wmv") returned 0
	[0064.935] lstrlenA (lpString="*.wmv") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.divx") returned 0
	[0064.935] lstrlenA (lpString="*.divx") returned 6
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mkv") returned 0
	[0064.935] lstrlenA (lpString="*.mkv") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mp3") returned 0
	[0064.935] lstrlenA (lpString="*.mp3") returned 5
	[0064.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wav") returned 0
	[0064.935] lstrlenA (lpString="*.wav") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.flac") returned 0
	[0064.936] lstrlenA (lpString="*.flac") returned 6
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ape") returned 0
	[0064.936] lstrlenA (lpString="*.ape") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wma") returned 0
	[0064.936] lstrlenA (lpString="*.wma") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ac3") returned 0
	[0064.936] lstrlenA (lpString="*.ac3") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.exe") returned 0
	[0064.936] lstrlenA (lpString="*.exe") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.apk") returned 0
	[0064.936] lstrlenA (lpString="*.apk") returned 5
	[0064.936] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.936] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.936] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.JS") returned -1
	[0064.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1
	[0064.936] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1
	[0064.936] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned="FORM.ICO"
	[0064.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.936] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS"
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.zip") returned 0
	[0064.936] lstrlenA (lpString="*.zip") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.rar") returned 0
	[0064.936] lstrlenA (lpString="*.rar") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.7z") returned 0
	[0064.936] lstrlenA (lpString="*.7z") returned 4
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.tar") returned 0
	[0064.936] lstrlenA (lpString="*.tar") returned 5
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.gzip") returned 0
	[0064.936] lstrlenA (lpString="*.gzip") returned 6
	[0064.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.jpg") returned 0
	[0064.937] lstrlenA (lpString="*.jpg") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.jpeg") returned 0
	[0064.937] lstrlenA (lpString="*.jpeg") returned 6
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.psd") returned 0
	[0064.937] lstrlenA (lpString="*.psd") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.cdr") returned 0
	[0064.937] lstrlenA (lpString="*.cdr") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.dwg") returned 0
	[0064.937] lstrlenA (lpString="*.dwg") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.max") returned 0
	[0064.937] lstrlenA (lpString="*.max") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.bmp") returned 0
	[0064.937] lstrlenA (lpString="*.bmp") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.gif") returned 0
	[0064.937] lstrlenA (lpString="*.gif") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.png") returned 0
	[0064.937] lstrlenA (lpString="*.png") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.doc") returned 0
	[0064.937] lstrlenA (lpString="*.doc") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.docx") returned 0
	[0064.937] lstrlenA (lpString="*.docx") returned 6
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.xls") returned 0
	[0064.937] lstrlenA (lpString="*.xls") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.xlsx") returned 0
	[0064.937] lstrlenA (lpString="*.xlsx") returned 6
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ppt") returned 0
	[0064.937] lstrlenA (lpString="*.ppt") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pptx") returned 0
	[0064.937] lstrlenA (lpString="*.pptx") returned 6
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.txt") returned 0
	[0064.937] lstrlenA (lpString="*.txt") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pdf") returned 0
	[0064.937] lstrlenA (lpString="*.pdf") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.djvu") returned 0
	[0064.937] lstrlenA (lpString="*.djvu") returned 6
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.htm") returned 0
	[0064.937] lstrlenA (lpString="*.htm") returned 5
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.html") returned 0
	[0064.937] lstrlenA (lpString="*.html") returned 6
	[0064.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mdb") returned 0
	[0064.938] lstrlenA (lpString="*.mdb") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.cer") returned 0
	[0064.938] lstrlenA (lpString="*.cer") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.p12") returned 0
	[0064.938] lstrlenA (lpString="*.p12") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pfx") returned 0
	[0064.938] lstrlenA (lpString="*.pfx") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.kwm") returned 0
	[0064.938] lstrlenA (lpString="*.kwm") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pwm") returned 0
	[0064.938] lstrlenA (lpString="*.pwm") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.1cd") returned 0
	[0064.938] lstrlenA (lpString="*.1cd") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.md") returned 0
	[0064.938] lstrlenA (lpString="*.md") returned 4
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mdf") returned 0
	[0064.938] lstrlenA (lpString="*.mdf") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.dbf") returned 0
	[0064.938] lstrlenA (lpString="*.dbf") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.odt") returned 0
	[0064.938] lstrlenA (lpString="*.odt") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.vob") returned 0
	[0064.938] lstrlenA (lpString="*.vob") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ifo") returned 0
	[0064.938] lstrlenA (lpString="*.ifo") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.lnk") returned 0
	[0064.938] lstrlenA (lpString="*.lnk") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.torrent") returned 0
	[0064.938] lstrlenA (lpString="*.torrent") returned 9
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mov") returned 0
	[0064.938] lstrlenA (lpString="*.mov") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.m2v") returned 0
	[0064.938] lstrlenA (lpString="*.m2v") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.3gp") returned 0
	[0064.938] lstrlenA (lpString="*.3gp") returned 5
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mpeg") returned 0
	[0064.938] lstrlenA (lpString="*.mpeg") returned 6
	[0064.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mpg") returned 0
	[0064.939] lstrlenA (lpString="*.mpg") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.flv") returned 0
	[0064.939] lstrlenA (lpString="*.flv") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.avi") returned 0
	[0064.939] lstrlenA (lpString="*.avi") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mp4") returned 0
	[0064.939] lstrlenA (lpString="*.mp4") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wmv") returned 0
	[0064.939] lstrlenA (lpString="*.wmv") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.divx") returned 0
	[0064.939] lstrlenA (lpString="*.divx") returned 6
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mkv") returned 0
	[0064.939] lstrlenA (lpString="*.mkv") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mp3") returned 0
	[0064.939] lstrlenA (lpString="*.mp3") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wav") returned 0
	[0064.939] lstrlenA (lpString="*.wav") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.flac") returned 0
	[0064.939] lstrlenA (lpString="*.flac") returned 6
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ape") returned 0
	[0064.939] lstrlenA (lpString="*.ape") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wma") returned 0
	[0064.939] lstrlenA (lpString="*.wma") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ac3") returned 0
	[0064.939] lstrlenA (lpString="*.ac3") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.exe") returned 0
	[0064.939] lstrlenA (lpString="*.exe") returned 5
	[0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.apk") returned 0
	[0064.939] lstrlenA (lpString="*.apk") returned 5
	[0064.939] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.939] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.939] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1
	[0064.939] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1
	[0064.939] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1
	[0064.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned="FORM.JS"
	[0064.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html"
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.zip") returned 0
	[0064.940] lstrlenA (lpString="*.zip") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.rar") returned 0
	[0064.940] lstrlenA (lpString="*.rar") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.7z") returned 0
	[0064.940] lstrlenA (lpString="*.7z") returned 4
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.tar") returned 0
	[0064.940] lstrlenA (lpString="*.tar") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.gzip") returned 0
	[0064.940] lstrlenA (lpString="*.gzip") returned 6
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.jpg") returned 0
	[0064.940] lstrlenA (lpString="*.jpg") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0
	[0064.940] lstrlenA (lpString="*.jpeg") returned 6
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.psd") returned 0
	[0064.940] lstrlenA (lpString="*.psd") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.cdr") returned 0
	[0064.940] lstrlenA (lpString="*.cdr") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.dwg") returned 0
	[0064.940] lstrlenA (lpString="*.dwg") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.max") returned 0
	[0064.940] lstrlenA (lpString="*.max") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.bmp") returned 0
	[0064.940] lstrlenA (lpString="*.bmp") returned 5
	[0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.gif") returned 0
	[0064.941] lstrlenA (lpString="*.gif") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.png") returned 0
	[0064.941] lstrlenA (lpString="*.png") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.doc") returned 0
	[0064.941] lstrlenA (lpString="*.doc") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.docx") returned 0
	[0064.941] lstrlenA (lpString="*.docx") returned 6
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.xls") returned 0
	[0064.941] lstrlenA (lpString="*.xls") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0
	[0064.941] lstrlenA (lpString="*.xlsx") returned 6
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.ppt") returned 0
	[0064.941] lstrlenA (lpString="*.ppt") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.pptx") returned 0
	[0064.941] lstrlenA (lpString="*.pptx") returned 6
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.txt") returned 0
	[0064.941] lstrlenA (lpString="*.txt") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.pdf") returned 0
	[0064.941] lstrlenA (lpString="*.pdf") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.djvu") returned 0
	[0064.941] lstrlenA (lpString="*.djvu") returned 6
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.htm") returned 0
	[0064.941] lstrlenA (lpString="*.htm") returned 5
	[0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.html") returned 1
	[0064.941] lstrlenA (lpString="*.html") returned 6
	[0064.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html"
	[0064.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html"
	[0064.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html."
	[0064.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.Boom"
	[0064.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.943] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45f
	[0064.943] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.943] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.943] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x43c, lpOverlapped=0x0) returned 1
	[0064.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0064.944] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.944] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x43c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x43c, lpOverlapped=0x0) returned 1
	[0064.945] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.945] CloseHandle (hObject=0x98) returned 1
	[0064.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.boom")) returned 1
	[0064.946] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.947] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.947] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1
	[0064.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1
	[0064.947] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1
	[0064.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0064.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.947] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html"
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0
	[0064.947] lstrlenA (lpString="*.zip") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0
	[0064.947] lstrlenA (lpString="*.rar") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0
	[0064.947] lstrlenA (lpString="*.7z") returned 4
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0
	[0064.947] lstrlenA (lpString="*.tar") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0
	[0064.947] lstrlenA (lpString="*.gzip") returned 6
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0
	[0064.947] lstrlenA (lpString="*.jpg") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0
	[0064.947] lstrlenA (lpString="*.jpeg") returned 6
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0
	[0064.947] lstrlenA (lpString="*.psd") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0
	[0064.947] lstrlenA (lpString="*.cdr") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0
	[0064.947] lstrlenA (lpString="*.dwg") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0
	[0064.947] lstrlenA (lpString="*.max") returned 5
	[0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0
	[0064.948] lstrlenA (lpString="*.bmp") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0
	[0064.948] lstrlenA (lpString="*.gif") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0
	[0064.948] lstrlenA (lpString="*.png") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0
	[0064.948] lstrlenA (lpString="*.doc") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0
	[0064.948] lstrlenA (lpString="*.docx") returned 6
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0
	[0064.948] lstrlenA (lpString="*.xls") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0
	[0064.948] lstrlenA (lpString="*.xlsx") returned 6
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0
	[0064.948] lstrlenA (lpString="*.ppt") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0
	[0064.948] lstrlenA (lpString="*.pptx") returned 6
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0
	[0064.948] lstrlenA (lpString="*.txt") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0
	[0064.948] lstrlenA (lpString="*.pdf") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0
	[0064.948] lstrlenA (lpString="*.djvu") returned 6
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0
	[0064.948] lstrlenA (lpString="*.htm") returned 5
	[0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1
	[0064.948] lstrlenA (lpString="*.html") returned 6
	[0064.948] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html"
	[0064.948] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html"
	[0064.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html."
	[0064.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.Boom"
	[0064.948] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.949] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x852
	[0064.949] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1
	[0064.949] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.949] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x82f, lpOverlapped=0x0) returned 1
	[0064.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0064.952] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.952] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x82f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x82f, lpOverlapped=0x0) returned 1
	[0064.952] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.952] CloseHandle (hObject=0x98) returned 1
	[0064.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.boom")) returned 1
	[0064.953] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.953] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.953] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsColorChart.html") returned -1
	[0064.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1
	[0064.953] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1
	[0064.954] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0064.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html"
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.zip") returned 0
	[0064.954] lstrlenA (lpString="*.zip") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.rar") returned 0
	[0064.954] lstrlenA (lpString="*.rar") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.7z") returned 0
	[0064.954] lstrlenA (lpString="*.7z") returned 4
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.tar") returned 0
	[0064.954] lstrlenA (lpString="*.tar") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.gzip") returned 0
	[0064.954] lstrlenA (lpString="*.gzip") returned 6
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.jpg") returned 0
	[0064.954] lstrlenA (lpString="*.jpg") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.jpeg") returned 0
	[0064.954] lstrlenA (lpString="*.jpeg") returned 6
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.psd") returned 0
	[0064.954] lstrlenA (lpString="*.psd") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.cdr") returned 0
	[0064.954] lstrlenA (lpString="*.cdr") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.dwg") returned 0
	[0064.954] lstrlenA (lpString="*.dwg") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.max") returned 0
	[0064.954] lstrlenA (lpString="*.max") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.bmp") returned 0
	[0064.954] lstrlenA (lpString="*.bmp") returned 5
	[0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.gif") returned 0
	[0064.955] lstrlenA (lpString="*.gif") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.png") returned 0
	[0064.955] lstrlenA (lpString="*.png") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.doc") returned 0
	[0064.955] lstrlenA (lpString="*.doc") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.docx") returned 0
	[0064.955] lstrlenA (lpString="*.docx") returned 6
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.xls") returned 0
	[0064.955] lstrlenA (lpString="*.xls") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.xlsx") returned 0
	[0064.955] lstrlenA (lpString="*.xlsx") returned 6
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.ppt") returned 0
	[0064.955] lstrlenA (lpString="*.ppt") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.pptx") returned 0
	[0064.955] lstrlenA (lpString="*.pptx") returned 6
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.txt") returned 0
	[0064.955] lstrlenA (lpString="*.txt") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.pdf") returned 0
	[0064.955] lstrlenA (lpString="*.pdf") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.djvu") returned 0
	[0064.955] lstrlenA (lpString="*.djvu") returned 6
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.htm") returned 0
	[0064.955] lstrlenA (lpString="*.htm") returned 5
	[0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.html") returned 1
	[0064.955] lstrlenA (lpString="*.html") returned 6
	[0064.955] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html"
	[0064.955] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html"
	[0064.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html."
	[0064.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.Boom"
	[0064.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.956] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ef
	[0064.956] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0064.956] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.956] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2cc, lpOverlapped=0x0) returned 1
	[0064.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="FormsColorChart.html"
	[0064.957] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.957] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2cc, lpOverlapped=0x0) returned 1
	[0064.957] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.957] CloseHandle (hObject=0x98) returned 1
	[0064.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.boom")) returned 1
	[0064.958] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.958] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.958] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplate.html") returned -1
	[0064.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1
	[0064.958] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1
	[0064.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="FormsColorChart.html"
	[0064.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html"
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.zip") returned 0
	[0064.959] lstrlenA (lpString="*.zip") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.rar") returned 0
	[0064.959] lstrlenA (lpString="*.rar") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.7z") returned 0
	[0064.959] lstrlenA (lpString="*.7z") returned 4
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.tar") returned 0
	[0064.959] lstrlenA (lpString="*.tar") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0
	[0064.959] lstrlenA (lpString="*.gzip") returned 6
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0
	[0064.959] lstrlenA (lpString="*.jpg") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0
	[0064.959] lstrlenA (lpString="*.jpeg") returned 6
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.psd") returned 0
	[0064.959] lstrlenA (lpString="*.psd") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.cdr") returned 0
	[0064.959] lstrlenA (lpString="*.cdr") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.dwg") returned 0
	[0064.959] lstrlenA (lpString="*.dwg") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.max") returned 0
	[0064.959] lstrlenA (lpString="*.max") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.bmp") returned 0
	[0064.959] lstrlenA (lpString="*.bmp") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.gif") returned 0
	[0064.959] lstrlenA (lpString="*.gif") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.png") returned 0
	[0064.959] lstrlenA (lpString="*.png") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.doc") returned 0
	[0064.959] lstrlenA (lpString="*.doc") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.docx") returned 0
	[0064.959] lstrlenA (lpString="*.docx") returned 6
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.xls") returned 0
	[0064.959] lstrlenA (lpString="*.xls") returned 5
	[0064.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0
	[0064.960] lstrlenA (lpString="*.xlsx") returned 6
	[0064.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0
	[0064.960] lstrlenA (lpString="*.ppt") returned 5
	[0064.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0
	[0064.960] lstrlenA (lpString="*.pptx") returned 6
	[0064.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.txt") returned 0
	[0064.960] lstrlenA (lpString="*.txt") returned 5
	[0064.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0
	[0064.960] lstrlenA (lpString="*.pdf") returned 5
	[0064.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.djvu") returned 0
	[0064.960] lstrlenA (lpString="*.djvu") returned 6
	[0064.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.htm") returned 0
	[0064.960] lstrlenA (lpString="*.htm") returned 5
	[0064.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.html") returned 1
	[0064.960] lstrlenA (lpString="*.html") returned 6
	[0064.960] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html"
	[0064.960] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html"
	[0064.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html."
	[0064.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.Boom"
	[0064.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.961] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115a
	[0064.961] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0064.961] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.961] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1137, lpOverlapped=0x0) returned 1
	[0064.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="FormsFormTemplate.html"
	[0064.962] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.962] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1137, lpOverlapped=0x0) returned 1
	[0064.963] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.963] CloseHandle (hObject=0x98) returned 1
	[0064.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.boom")) returned 1
	[0064.964] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.964] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.964] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePage.html") returned -1
	[0064.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1
	[0064.964] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1
	[0064.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="FormsFormTemplate.html"
	[0064.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.964] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.964] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html"
	[0064.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.zip") returned 0
	[0064.964] lstrlenA (lpString="*.zip") returned 5
	[0064.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.rar") returned 0
	[0064.964] lstrlenA (lpString="*.rar") returned 5
	[0064.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.7z") returned 0
	[0064.964] lstrlenA (lpString="*.7z") returned 4
	[0064.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.tar") returned 0
	[0064.964] lstrlenA (lpString="*.tar") returned 5
	[0064.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.gzip") returned 0
	[0064.964] lstrlenA (lpString="*.gzip") returned 6
	[0064.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.jpg") returned 0
	[0064.964] lstrlenA (lpString="*.jpg") returned 5
	[0064.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.jpeg") returned 0
	[0064.964] lstrlenA (lpString="*.jpeg") returned 6
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.psd") returned 0
	[0064.965] lstrlenA (lpString="*.psd") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.cdr") returned 0
	[0064.965] lstrlenA (lpString="*.cdr") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.dwg") returned 0
	[0064.965] lstrlenA (lpString="*.dwg") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.max") returned 0
	[0064.965] lstrlenA (lpString="*.max") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.bmp") returned 0
	[0064.965] lstrlenA (lpString="*.bmp") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.gif") returned 0
	[0064.965] lstrlenA (lpString="*.gif") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.png") returned 0
	[0064.965] lstrlenA (lpString="*.png") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.doc") returned 0
	[0064.965] lstrlenA (lpString="*.doc") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.docx") returned 0
	[0064.965] lstrlenA (lpString="*.docx") returned 6
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.xls") returned 0
	[0064.965] lstrlenA (lpString="*.xls") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.xlsx") returned 0
	[0064.965] lstrlenA (lpString="*.xlsx") returned 6
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.ppt") returned 0
	[0064.965] lstrlenA (lpString="*.ppt") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.pptx") returned 0
	[0064.965] lstrlenA (lpString="*.pptx") returned 6
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.txt") returned 0
	[0064.965] lstrlenA (lpString="*.txt") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.pdf") returned 0
	[0064.965] lstrlenA (lpString="*.pdf") returned 5
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.djvu") returned 0
	[0064.965] lstrlenA (lpString="*.djvu") returned 6
	[0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.htm") returned 0
	[0064.966] lstrlenA (lpString="*.htm") returned 5
	[0064.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.html") returned 1
	[0064.966] lstrlenA (lpString="*.html") returned 6
	[0064.966] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html"
	[0064.966] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html"
	[0064.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html."
	[0064.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.Boom"
	[0064.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.966] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9c
	[0064.966] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0064.966] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.967] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd79, lpOverlapped=0x0) returned 1
	[0064.972] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="FormsHomePage.html"
	[0064.972] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.972] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd79, lpOverlapped=0x0) returned 1
	[0064.972] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0064.972] CloseHandle (hObject=0x98) returned 1
	[0064.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.boom")) returned 1
	[0064.973] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.973] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.973] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageScript.js") returned -1
	[0064.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1
	[0064.974] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1
	[0064.974] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="FormsHomePage.html"
	[0064.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.974] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.974] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js"
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.zip") returned 0
	[0064.974] lstrlenA (lpString="*.zip") returned 5
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.rar") returned 0
	[0064.974] lstrlenA (lpString="*.rar") returned 5
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.7z") returned 0
	[0064.974] lstrlenA (lpString="*.7z") returned 4
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.tar") returned 0
	[0064.974] lstrlenA (lpString="*.tar") returned 5
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0
	[0064.974] lstrlenA (lpString="*.gzip") returned 6
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0
	[0064.974] lstrlenA (lpString="*.jpg") returned 5
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0
	[0064.974] lstrlenA (lpString="*.jpeg") returned 6
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.psd") returned 0
	[0064.974] lstrlenA (lpString="*.psd") returned 5
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.cdr") returned 0
	[0064.974] lstrlenA (lpString="*.cdr") returned 5
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.dwg") returned 0
	[0064.974] lstrlenA (lpString="*.dwg") returned 5
	[0064.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.max") returned 0
	[0064.975] lstrlenA (lpString="*.max") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.bmp") returned 0
	[0064.975] lstrlenA (lpString="*.bmp") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.gif") returned 0
	[0064.975] lstrlenA (lpString="*.gif") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.png") returned 0
	[0064.975] lstrlenA (lpString="*.png") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.doc") returned 0
	[0064.975] lstrlenA (lpString="*.doc") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.docx") returned 0
	[0064.975] lstrlenA (lpString="*.docx") returned 6
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.xls") returned 0
	[0064.975] lstrlenA (lpString="*.xls") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.xlsx") returned 0
	[0064.975] lstrlenA (lpString="*.xlsx") returned 6
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ppt") returned 0
	[0064.975] lstrlenA (lpString="*.ppt") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pptx") returned 0
	[0064.975] lstrlenA (lpString="*.pptx") returned 6
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.txt") returned 0
	[0064.975] lstrlenA (lpString="*.txt") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pdf") returned 0
	[0064.975] lstrlenA (lpString="*.pdf") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.djvu") returned 0
	[0064.975] lstrlenA (lpString="*.djvu") returned 6
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.htm") returned 0
	[0064.975] lstrlenA (lpString="*.htm") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.html") returned 0
	[0064.975] lstrlenA (lpString="*.html") returned 6
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mdb") returned 0
	[0064.975] lstrlenA (lpString="*.mdb") returned 5
	[0064.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.cer") returned 0
	[0064.976] lstrlenA (lpString="*.cer") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.p12") returned 0
	[0064.976] lstrlenA (lpString="*.p12") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pfx") returned 0
	[0064.976] lstrlenA (lpString="*.pfx") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.kwm") returned 0
	[0064.976] lstrlenA (lpString="*.kwm") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pwm") returned 0
	[0064.976] lstrlenA (lpString="*.pwm") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.1cd") returned 0
	[0064.976] lstrlenA (lpString="*.1cd") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.md") returned 0
	[0064.976] lstrlenA (lpString="*.md") returned 4
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mdf") returned 0
	[0064.976] lstrlenA (lpString="*.mdf") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.dbf") returned 0
	[0064.976] lstrlenA (lpString="*.dbf") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.odt") returned 0
	[0064.976] lstrlenA (lpString="*.odt") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.vob") returned 0
	[0064.976] lstrlenA (lpString="*.vob") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ifo") returned 0
	[0064.976] lstrlenA (lpString="*.ifo") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.lnk") returned 0
	[0064.976] lstrlenA (lpString="*.lnk") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.torrent") returned 0
	[0064.976] lstrlenA (lpString="*.torrent") returned 9
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mov") returned 0
	[0064.976] lstrlenA (lpString="*.mov") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.m2v") returned 0
	[0064.976] lstrlenA (lpString="*.m2v") returned 5
	[0064.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.3gp") returned 0
	[0064.976] lstrlenA (lpString="*.3gp") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mpeg") returned 0
	[0064.977] lstrlenA (lpString="*.mpeg") returned 6
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mpg") returned 0
	[0064.977] lstrlenA (lpString="*.mpg") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.flv") returned 0
	[0064.977] lstrlenA (lpString="*.flv") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.avi") returned 0
	[0064.977] lstrlenA (lpString="*.avi") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mp4") returned 0
	[0064.977] lstrlenA (lpString="*.mp4") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.wmv") returned 0
	[0064.977] lstrlenA (lpString="*.wmv") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.divx") returned 0
	[0064.977] lstrlenA (lpString="*.divx") returned 6
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mkv") returned 0
	[0064.977] lstrlenA (lpString="*.mkv") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mp3") returned 0
	[0064.977] lstrlenA (lpString="*.mp3") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.wav") returned 0
	[0064.977] lstrlenA (lpString="*.wav") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.flac") returned 0
	[0064.977] lstrlenA (lpString="*.flac") returned 6
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ape") returned 0
	[0064.977] lstrlenA (lpString="*.ape") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.wma") returned 0
	[0064.977] lstrlenA (lpString="*.wma") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ac3") returned 0
	[0064.977] lstrlenA (lpString="*.ac3") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.exe") returned 0
	[0064.977] lstrlenA (lpString="*.exe") returned 5
	[0064.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.apk") returned 0
	[0064.977] lstrlenA (lpString="*.apk") returned 5
	[0064.977] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.978] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.978] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageStyle.css") returned -1
	[0064.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1
	[0064.978] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1
	[0064.978] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned="FormsHomePageScript.js"
	[0064.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.978] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.978] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css"
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.zip") returned 0
	[0064.978] lstrlenA (lpString="*.zip") returned 5
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.rar") returned 0
	[0064.978] lstrlenA (lpString="*.rar") returned 5
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.7z") returned 0
	[0064.978] lstrlenA (lpString="*.7z") returned 4
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.tar") returned 0
	[0064.978] lstrlenA (lpString="*.tar") returned 5
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.gzip") returned 0
	[0064.978] lstrlenA (lpString="*.gzip") returned 6
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.jpg") returned 0
	[0064.978] lstrlenA (lpString="*.jpg") returned 5
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.jpeg") returned 0
	[0064.978] lstrlenA (lpString="*.jpeg") returned 6
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.psd") returned 0
	[0064.978] lstrlenA (lpString="*.psd") returned 5
	[0064.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.cdr") returned 0
	[0064.978] lstrlenA (lpString="*.cdr") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.dwg") returned 0
	[0064.979] lstrlenA (lpString="*.dwg") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.max") returned 0
	[0064.979] lstrlenA (lpString="*.max") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.bmp") returned 0
	[0064.979] lstrlenA (lpString="*.bmp") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.gif") returned 0
	[0064.979] lstrlenA (lpString="*.gif") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.png") returned 0
	[0064.979] lstrlenA (lpString="*.png") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.doc") returned 0
	[0064.979] lstrlenA (lpString="*.doc") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.docx") returned 0
	[0064.979] lstrlenA (lpString="*.docx") returned 6
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.xls") returned 0
	[0064.979] lstrlenA (lpString="*.xls") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.xlsx") returned 0
	[0064.979] lstrlenA (lpString="*.xlsx") returned 6
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ppt") returned 0
	[0064.979] lstrlenA (lpString="*.ppt") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pptx") returned 0
	[0064.979] lstrlenA (lpString="*.pptx") returned 6
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.txt") returned 0
	[0064.979] lstrlenA (lpString="*.txt") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pdf") returned 0
	[0064.979] lstrlenA (lpString="*.pdf") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.djvu") returned 0
	[0064.979] lstrlenA (lpString="*.djvu") returned 6
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.htm") returned 0
	[0064.979] lstrlenA (lpString="*.htm") returned 5
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.html") returned 0
	[0064.979] lstrlenA (lpString="*.html") returned 6
	[0064.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mdb") returned 0
	[0064.980] lstrlenA (lpString="*.mdb") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.cer") returned 0
	[0064.980] lstrlenA (lpString="*.cer") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.p12") returned 0
	[0064.980] lstrlenA (lpString="*.p12") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pfx") returned 0
	[0064.980] lstrlenA (lpString="*.pfx") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.kwm") returned 0
	[0064.980] lstrlenA (lpString="*.kwm") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pwm") returned 0
	[0064.980] lstrlenA (lpString="*.pwm") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.1cd") returned 0
	[0064.980] lstrlenA (lpString="*.1cd") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.md") returned 0
	[0064.980] lstrlenA (lpString="*.md") returned 4
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mdf") returned 0
	[0064.980] lstrlenA (lpString="*.mdf") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.dbf") returned 0
	[0064.980] lstrlenA (lpString="*.dbf") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.odt") returned 0
	[0064.980] lstrlenA (lpString="*.odt") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.vob") returned 0
	[0064.980] lstrlenA (lpString="*.vob") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ifo") returned 0
	[0064.980] lstrlenA (lpString="*.ifo") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.lnk") returned 0
	[0064.980] lstrlenA (lpString="*.lnk") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.torrent") returned 0
	[0064.980] lstrlenA (lpString="*.torrent") returned 9
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mov") returned 0
	[0064.980] lstrlenA (lpString="*.mov") returned 5
	[0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.m2v") returned 0
	[0064.980] lstrlenA (lpString="*.m2v") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.3gp") returned 0
	[0064.981] lstrlenA (lpString="*.3gp") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mpeg") returned 0
	[0064.981] lstrlenA (lpString="*.mpeg") returned 6
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mpg") returned 0
	[0064.981] lstrlenA (lpString="*.mpg") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.flv") returned 0
	[0064.981] lstrlenA (lpString="*.flv") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.avi") returned 0
	[0064.981] lstrlenA (lpString="*.avi") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mp4") returned 0
	[0064.981] lstrlenA (lpString="*.mp4") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.wmv") returned 0
	[0064.981] lstrlenA (lpString="*.wmv") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.divx") returned 0
	[0064.981] lstrlenA (lpString="*.divx") returned 6
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mkv") returned 0
	[0064.981] lstrlenA (lpString="*.mkv") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mp3") returned 0
	[0064.981] lstrlenA (lpString="*.mp3") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.wav") returned 0
	[0064.981] lstrlenA (lpString="*.wav") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.flac") returned 0
	[0064.981] lstrlenA (lpString="*.flac") returned 6
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ape") returned 0
	[0064.981] lstrlenA (lpString="*.ape") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.wma") returned 0
	[0064.981] lstrlenA (lpString="*.wma") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ac3") returned 0
	[0064.981] lstrlenA (lpString="*.ac3") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.exe") returned 0
	[0064.981] lstrlenA (lpString="*.exe") returned 5
	[0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.apk") returned 0
	[0064.982] lstrlenA (lpString="*.apk") returned 5
	[0064.982] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0064.982] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0064.982] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsImageTemplate.html") returned -1
	[0064.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1
	[0064.982] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1
	[0064.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css"
	[0064.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0064.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0064.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0064.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0064.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html"
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.zip") returned 0
	[0064.982] lstrlenA (lpString="*.zip") returned 5
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.rar") returned 0
	[0064.982] lstrlenA (lpString="*.rar") returned 5
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.7z") returned 0
	[0064.982] lstrlenA (lpString="*.7z") returned 4
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.tar") returned 0
	[0064.982] lstrlenA (lpString="*.tar") returned 5
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.gzip") returned 0
	[0064.982] lstrlenA (lpString="*.gzip") returned 6
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0
	[0064.982] lstrlenA (lpString="*.jpg") returned 5
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0
	[0064.982] lstrlenA (lpString="*.jpeg") returned 6
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.psd") returned 0
	[0064.982] lstrlenA (lpString="*.psd") returned 5
	[0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.cdr") returned 0
	[0064.982] lstrlenA (lpString="*.cdr") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.dwg") returned 0
	[0064.983] lstrlenA (lpString="*.dwg") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.max") returned 0
	[0064.983] lstrlenA (lpString="*.max") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.bmp") returned 0
	[0064.983] lstrlenA (lpString="*.bmp") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.gif") returned 0
	[0064.983] lstrlenA (lpString="*.gif") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.png") returned 0
	[0064.983] lstrlenA (lpString="*.png") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.doc") returned 0
	[0064.983] lstrlenA (lpString="*.doc") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.docx") returned 0
	[0064.983] lstrlenA (lpString="*.docx") returned 6
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.xls") returned 0
	[0064.983] lstrlenA (lpString="*.xls") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.xlsx") returned 0
	[0064.983] lstrlenA (lpString="*.xlsx") returned 6
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.ppt") returned 0
	[0064.983] lstrlenA (lpString="*.ppt") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.pptx") returned 0
	[0064.983] lstrlenA (lpString="*.pptx") returned 6
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.txt") returned 0
	[0064.983] lstrlenA (lpString="*.txt") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.pdf") returned 0
	[0064.983] lstrlenA (lpString="*.pdf") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.djvu") returned 0
	[0064.983] lstrlenA (lpString="*.djvu") returned 6
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.htm") returned 0
	[0064.983] lstrlenA (lpString="*.htm") returned 5
	[0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.html") returned 1
	[0064.983] lstrlenA (lpString="*.html") returned 6
	[0064.983] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html"
	[0064.983] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html"
	[0064.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html."
	[0064.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.Boom"
	[0064.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0064.985] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f0
	[0064.985] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0064.985] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0064.985] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7cd, lpOverlapped=0x0) returned 1
	[0065.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="FormsImageTemplate.html"
	[0065.022] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.022] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7cd, lpOverlapped=0x0) returned 1
	[0065.022] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.022] CloseHandle (hObject=0x98) returned 1
	[0065.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.boom")) returned 1
	[0065.023] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.023] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0065.023] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsMacroTemplate.html") returned -1
	[0065.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1
	[0065.023] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1
	[0065.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="FormsImageTemplate.html"
	[0065.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0065.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0065.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0065.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0065.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html"
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0
	[0065.024] lstrlenA (lpString="*.zip") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0
	[0065.024] lstrlenA (lpString="*.rar") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.7z") returned 0
	[0065.024] lstrlenA (lpString="*.7z") returned 4
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.tar") returned 0
	[0065.024] lstrlenA (lpString="*.tar") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.gzip") returned 0
	[0065.024] lstrlenA (lpString="*.gzip") returned 6
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0
	[0065.024] lstrlenA (lpString="*.jpg") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0
	[0065.024] lstrlenA (lpString="*.jpeg") returned 6
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.psd") returned 0
	[0065.024] lstrlenA (lpString="*.psd") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.cdr") returned 0
	[0065.024] lstrlenA (lpString="*.cdr") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.dwg") returned 0
	[0065.024] lstrlenA (lpString="*.dwg") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.max") returned 0
	[0065.024] lstrlenA (lpString="*.max") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.bmp") returned 0
	[0065.024] lstrlenA (lpString="*.bmp") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.gif") returned 0
	[0065.024] lstrlenA (lpString="*.gif") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.png") returned 0
	[0065.024] lstrlenA (lpString="*.png") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.doc") returned 0
	[0065.024] lstrlenA (lpString="*.doc") returned 5
	[0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.docx") returned 0
	[0065.024] lstrlenA (lpString="*.docx") returned 6
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.xls") returned 0
	[0065.025] lstrlenA (lpString="*.xls") returned 5
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.xlsx") returned 0
	[0065.025] lstrlenA (lpString="*.xlsx") returned 6
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.ppt") returned 0
	[0065.025] lstrlenA (lpString="*.ppt") returned 5
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.pptx") returned 0
	[0065.025] lstrlenA (lpString="*.pptx") returned 6
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.txt") returned 0
	[0065.025] lstrlenA (lpString="*.txt") returned 5
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.pdf") returned 0
	[0065.025] lstrlenA (lpString="*.pdf") returned 5
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.djvu") returned 0
	[0065.025] lstrlenA (lpString="*.djvu") returned 6
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.htm") returned 0
	[0065.025] lstrlenA (lpString="*.htm") returned 5
	[0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.html") returned 1
	[0065.025] lstrlenA (lpString="*.html") returned 6
	[0065.025] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html"
	[0065.025] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html"
	[0065.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html."
	[0065.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.Boom"
	[0065.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0065.026] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x858
	[0065.026] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0065.026] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.026] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x835, lpOverlapped=0x0) returned 1
	[0065.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html"
	[0065.049] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.049] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x835, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x835, lpOverlapped=0x0) returned 1
	[0065.049] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.049] CloseHandle (hObject=0x98) returned 1
	[0065.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.boom")) returned 1
	[0065.050] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.050] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0065.050] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1
	[0065.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1
	[0065.050] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1
	[0065.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html"
	[0065.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0065.050] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0065.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0065.050] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0065.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html"
	[0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0
	[0065.050] lstrlenA (lpString="*.zip") returned 5
	[0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0
	[0065.050] lstrlenA (lpString="*.rar") returned 5
	[0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0
	[0065.050] lstrlenA (lpString="*.7z") returned 4
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0
	[0065.051] lstrlenA (lpString="*.tar") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0
	[0065.051] lstrlenA (lpString="*.gzip") returned 6
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0
	[0065.051] lstrlenA (lpString="*.jpg") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0
	[0065.051] lstrlenA (lpString="*.jpeg") returned 6
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0
	[0065.051] lstrlenA (lpString="*.psd") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0
	[0065.051] lstrlenA (lpString="*.cdr") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0
	[0065.051] lstrlenA (lpString="*.dwg") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0
	[0065.051] lstrlenA (lpString="*.max") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0
	[0065.051] lstrlenA (lpString="*.bmp") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0
	[0065.051] lstrlenA (lpString="*.gif") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0
	[0065.051] lstrlenA (lpString="*.png") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0
	[0065.051] lstrlenA (lpString="*.doc") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0
	[0065.051] lstrlenA (lpString="*.docx") returned 6
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0
	[0065.051] lstrlenA (lpString="*.xls") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0
	[0065.051] lstrlenA (lpString="*.xlsx") returned 6
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0
	[0065.051] lstrlenA (lpString="*.ppt") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0
	[0065.051] lstrlenA (lpString="*.pptx") returned 6
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0
	[0065.051] lstrlenA (lpString="*.txt") returned 5
	[0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0
	[0065.052] lstrlenA (lpString="*.pdf") returned 5
	[0065.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0
	[0065.052] lstrlenA (lpString="*.djvu") returned 6
	[0065.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0
	[0065.052] lstrlenA (lpString="*.htm") returned 5
	[0065.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1
	[0065.052] lstrlenA (lpString="*.html") returned 6
	[0065.052] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html"
	[0065.052] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html"
	[0065.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html."
	[0065.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.Boom"
	[0065.052] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0065.052] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46a3
	[0065.052] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529685b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0065.052] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.053] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4680, lpOverlapped=0x0) returned 1
	[0065.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0065.079] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.079] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4680, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4680, lpOverlapped=0x0) returned 1
	[0065.079] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.079] CloseHandle (hObject=0x98) returned 1
	[0065.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.boom")) returned 1
	[0065.080] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.080] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0065.080] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1
	[0065.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1
	[0065.080] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1
	[0065.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0065.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0065.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0065.081] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0065.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0065.081] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html"
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0
	[0065.081] lstrlenA (lpString="*.zip") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0
	[0065.081] lstrlenA (lpString="*.rar") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0
	[0065.081] lstrlenA (lpString="*.7z") returned 4
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0
	[0065.081] lstrlenA (lpString="*.tar") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0
	[0065.081] lstrlenA (lpString="*.gzip") returned 6
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0
	[0065.081] lstrlenA (lpString="*.jpg") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0
	[0065.081] lstrlenA (lpString="*.jpeg") returned 6
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0
	[0065.081] lstrlenA (lpString="*.psd") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0
	[0065.081] lstrlenA (lpString="*.cdr") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0
	[0065.081] lstrlenA (lpString="*.dwg") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.max") returned 0
	[0065.081] lstrlenA (lpString="*.max") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0
	[0065.081] lstrlenA (lpString="*.bmp") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0
	[0065.081] lstrlenA (lpString="*.gif") returned 5
	[0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.png") returned 0
	[0065.081] lstrlenA (lpString="*.png") returned 5
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0
	[0065.082] lstrlenA (lpString="*.doc") returned 5
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0
	[0065.082] lstrlenA (lpString="*.docx") returned 6
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0
	[0065.082] lstrlenA (lpString="*.xls") returned 5
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0
	[0065.082] lstrlenA (lpString="*.xlsx") returned 6
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0
	[0065.082] lstrlenA (lpString="*.ppt") returned 5
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0
	[0065.082] lstrlenA (lpString="*.pptx") returned 6
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0
	[0065.082] lstrlenA (lpString="*.txt") returned 5
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0
	[0065.082] lstrlenA (lpString="*.pdf") returned 5
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0
	[0065.082] lstrlenA (lpString="*.djvu") returned 6
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0
	[0065.082] lstrlenA (lpString="*.htm") returned 5
	[0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.html") returned 1
	[0065.082] lstrlenA (lpString="*.html") returned 6
	[0065.082] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html"
	[0065.082] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html"
	[0065.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html."
	[0065.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.Boom"
	[0065.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0065.083] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x612
	[0065.083] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0065.083] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.083] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5ef, lpOverlapped=0x0) returned 1
	[0065.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0065.159] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.159] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5ef, lpOverlapped=0x0) returned 1
	[0065.159] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.159] CloseHandle (hObject=0x98) returned 1
	[0065.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.boom")) returned 1
	[0065.160] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.160] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1
	[0065.160] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1
	[0065.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0065.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles"
	[0065.160] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles") returned 94
	[0065.160] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7f68
	[0065.166] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.166] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.183] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.183] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.183] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.183] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.183] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Adobe.css") returned 1
	[0065.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe.css") returned 1
	[0065.183] lstrcmpiA (lpString1="", lpString2="Adobe.css") returned -1
	[0065.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0xffffffff
	[0065.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
	[0065.184] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.184] WriteFile (in: hFile=0x9c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.185] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.185] CloseHandle (hObject=0x9c) returned 1
	[0065.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Adobe.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css"
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.zip") returned 0
	[0065.185] lstrlenA (lpString="*.zip") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.rar") returned 0
	[0065.185] lstrlenA (lpString="*.rar") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.7z") returned 0
	[0065.185] lstrlenA (lpString="*.7z") returned 4
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.tar") returned 0
	[0065.185] lstrlenA (lpString="*.tar") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.gzip") returned 0
	[0065.185] lstrlenA (lpString="*.gzip") returned 6
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.jpg") returned 0
	[0065.185] lstrlenA (lpString="*.jpg") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.jpeg") returned 0
	[0065.185] lstrlenA (lpString="*.jpeg") returned 6
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.psd") returned 0
	[0065.185] lstrlenA (lpString="*.psd") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.cdr") returned 0
	[0065.185] lstrlenA (lpString="*.cdr") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.dwg") returned 0
	[0065.185] lstrlenA (lpString="*.dwg") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.max") returned 0
	[0065.185] lstrlenA (lpString="*.max") returned 5
	[0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.bmp") returned 0
	[0065.185] lstrlenA (lpString="*.bmp") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.gif") returned 0
	[0065.186] lstrlenA (lpString="*.gif") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.png") returned 0
	[0065.186] lstrlenA (lpString="*.png") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.doc") returned 0
	[0065.186] lstrlenA (lpString="*.doc") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.docx") returned 0
	[0065.186] lstrlenA (lpString="*.docx") returned 6
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.xls") returned 0
	[0065.186] lstrlenA (lpString="*.xls") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.xlsx") returned 0
	[0065.186] lstrlenA (lpString="*.xlsx") returned 6
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ppt") returned 0
	[0065.186] lstrlenA (lpString="*.ppt") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pptx") returned 0
	[0065.186] lstrlenA (lpString="*.pptx") returned 6
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.txt") returned 0
	[0065.186] lstrlenA (lpString="*.txt") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pdf") returned 0
	[0065.186] lstrlenA (lpString="*.pdf") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.djvu") returned 0
	[0065.186] lstrlenA (lpString="*.djvu") returned 6
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.htm") returned 0
	[0065.186] lstrlenA (lpString="*.htm") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.html") returned 0
	[0065.186] lstrlenA (lpString="*.html") returned 6
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mdb") returned 0
	[0065.186] lstrlenA (lpString="*.mdb") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.cer") returned 0
	[0065.186] lstrlenA (lpString="*.cer") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.p12") returned 0
	[0065.186] lstrlenA (lpString="*.p12") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pfx") returned 0
	[0065.186] lstrlenA (lpString="*.pfx") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.kwm") returned 0
	[0065.186] lstrlenA (lpString="*.kwm") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pwm") returned 0
	[0065.186] lstrlenA (lpString="*.pwm") returned 5
	[0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.1cd") returned 0
	[0065.187] lstrlenA (lpString="*.1cd") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.md") returned 0
	[0065.187] lstrlenA (lpString="*.md") returned 4
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mdf") returned 0
	[0065.187] lstrlenA (lpString="*.mdf") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.dbf") returned 0
	[0065.187] lstrlenA (lpString="*.dbf") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.odt") returned 0
	[0065.187] lstrlenA (lpString="*.odt") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.vob") returned 0
	[0065.187] lstrlenA (lpString="*.vob") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ifo") returned 0
	[0065.187] lstrlenA (lpString="*.ifo") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.lnk") returned 0
	[0065.187] lstrlenA (lpString="*.lnk") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.torrent") returned 0
	[0065.187] lstrlenA (lpString="*.torrent") returned 9
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mov") returned 0
	[0065.187] lstrlenA (lpString="*.mov") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.m2v") returned 0
	[0065.187] lstrlenA (lpString="*.m2v") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.3gp") returned 0
	[0065.187] lstrlenA (lpString="*.3gp") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mpeg") returned 0
	[0065.187] lstrlenA (lpString="*.mpeg") returned 6
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mpg") returned 0
	[0065.187] lstrlenA (lpString="*.mpg") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.flv") returned 0
	[0065.187] lstrlenA (lpString="*.flv") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.avi") returned 0
	[0065.187] lstrlenA (lpString="*.avi") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mp4") returned 0
	[0065.187] lstrlenA (lpString="*.mp4") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.wmv") returned 0
	[0065.187] lstrlenA (lpString="*.wmv") returned 5
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.divx") returned 0
	[0065.187] lstrlenA (lpString="*.divx") returned 6
	[0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mkv") returned 0
	[0065.188] lstrlenA (lpString="*.mkv") returned 5
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mp3") returned 0
	[0065.188] lstrlenA (lpString="*.mp3") returned 5
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.wav") returned 0
	[0065.188] lstrlenA (lpString="*.wav") returned 5
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.flac") returned 0
	[0065.188] lstrlenA (lpString="*.flac") returned 6
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ape") returned 0
	[0065.188] lstrlenA (lpString="*.ape") returned 5
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.wma") returned 0
	[0065.188] lstrlenA (lpString="*.wma") returned 5
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ac3") returned 0
	[0065.188] lstrlenA (lpString="*.ac3") returned 5
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.exe") returned 0
	[0065.188] lstrlenA (lpString="*.exe") returned 5
	[0065.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.apk") returned 0
	[0065.188] lstrlenA (lpString="*.apk") returned 5
	[0065.188] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.188] lstrcmpA (lpString1=".", lpString2="Americana") returned -1
	[0065.188] lstrcmpA (lpString1="..", lpString2="Americana") returned -1
	[0065.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned="Adobe.css"
	[0065.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Americana" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana"
	[0065.188] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned 104
	[0065.188] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.188] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.188] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.189] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.189] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.189] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.189] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.189] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.189] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*") returned="*.*"
	[0065.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\"
	[0065.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned=""
	[0065.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt"
	[0065.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\how to decrypt files.txt")) returned 0xffffffff
	[0065.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.190] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.190] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.191] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.191] CloseHandle (hObject=0xa0) returned 1
	[0065.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF"
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.191] lstrlenA (lpString="*.zip") returned 5
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.191] lstrlenA (lpString="*.rar") returned 5
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.191] lstrlenA (lpString="*.7z") returned 4
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.191] lstrlenA (lpString="*.tar") returned 5
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.191] lstrlenA (lpString="*.gzip") returned 6
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.191] lstrlenA (lpString="*.jpg") returned 5
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.191] lstrlenA (lpString="*.jpeg") returned 6
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.191] lstrlenA (lpString="*.psd") returned 5
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.191] lstrlenA (lpString="*.cdr") returned 5
	[0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.192] lstrlenA (lpString="*.dwg") returned 5
	[0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.192] lstrlenA (lpString="*.max") returned 5
	[0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.192] lstrlenA (lpString="*.bmp") returned 5
	[0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.192] lstrlenA (lpString="*.gif") returned 5
	[0065.192] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF"
	[0065.192] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF"
	[0065.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF."
	[0065.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.Boom"
	[0065.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.192] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.192] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5133d8d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0065.192] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.192] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.193] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.193] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.193] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.193] CloseHandle (hObject=0xa0) returned 1
	[0065.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif.boom")) returned 1
	[0065.195] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.195] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.195] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.195] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\"
	[0065.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned=""
	[0065.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt"
	[0065.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\how to decrypt files.txt")) returned 0x20
	[0065.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF"
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.196] lstrlenA (lpString="*.zip") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.196] lstrlenA (lpString="*.rar") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.196] lstrlenA (lpString="*.7z") returned 4
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.196] lstrlenA (lpString="*.tar") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.196] lstrlenA (lpString="*.gzip") returned 6
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.196] lstrlenA (lpString="*.jpg") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.196] lstrlenA (lpString="*.jpeg") returned 6
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.196] lstrlenA (lpString="*.psd") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.196] lstrlenA (lpString="*.cdr") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.196] lstrlenA (lpString="*.dwg") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.196] lstrlenA (lpString="*.max") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.196] lstrlenA (lpString="*.bmp") returned 5
	[0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.196] lstrlenA (lpString="*.gif") returned 5
	[0065.196] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF"
	[0065.196] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF"
	[0065.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF."
	[0065.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.Boom"
	[0065.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.197] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.197] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb8e810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1
	[0065.197] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.197] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.198] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.198] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.198] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.198] CloseHandle (hObject=0xa0) returned 1
	[0065.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif.boom")) returned 1
	[0065.199] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.199] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.199] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.199] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.199] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Americana.css") returned 1
	[0065.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Americana.css") returned 1
	[0065.199] lstrcmpiA (lpString1="", lpString2="Americana.css") returned -1
	[0065.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Americana.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css"
	[0065.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.zip") returned 0
	[0065.199] lstrlenA (lpString="*.zip") returned 5
	[0065.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.rar") returned 0
	[0065.199] lstrlenA (lpString="*.rar") returned 5
	[0065.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.7z") returned 0
	[0065.200] lstrlenA (lpString="*.7z") returned 4
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.tar") returned 0
	[0065.200] lstrlenA (lpString="*.tar") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.gzip") returned 0
	[0065.200] lstrlenA (lpString="*.gzip") returned 6
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.jpg") returned 0
	[0065.200] lstrlenA (lpString="*.jpg") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.jpeg") returned 0
	[0065.200] lstrlenA (lpString="*.jpeg") returned 6
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.psd") returned 0
	[0065.200] lstrlenA (lpString="*.psd") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.cdr") returned 0
	[0065.200] lstrlenA (lpString="*.cdr") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.dwg") returned 0
	[0065.200] lstrlenA (lpString="*.dwg") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.max") returned 0
	[0065.200] lstrlenA (lpString="*.max") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.bmp") returned 0
	[0065.200] lstrlenA (lpString="*.bmp") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.gif") returned 0
	[0065.200] lstrlenA (lpString="*.gif") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.png") returned 0
	[0065.200] lstrlenA (lpString="*.png") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.doc") returned 0
	[0065.200] lstrlenA (lpString="*.doc") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.docx") returned 0
	[0065.200] lstrlenA (lpString="*.docx") returned 6
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.xls") returned 0
	[0065.200] lstrlenA (lpString="*.xls") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.xlsx") returned 0
	[0065.200] lstrlenA (lpString="*.xlsx") returned 6
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ppt") returned 0
	[0065.200] lstrlenA (lpString="*.ppt") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pptx") returned 0
	[0065.200] lstrlenA (lpString="*.pptx") returned 6
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.txt") returned 0
	[0065.200] lstrlenA (lpString="*.txt") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pdf") returned 0
	[0065.200] lstrlenA (lpString="*.pdf") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.djvu") returned 0
	[0065.200] lstrlenA (lpString="*.djvu") returned 6
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.htm") returned 0
	[0065.200] lstrlenA (lpString="*.htm") returned 5
	[0065.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.html") returned 0
	[0065.200] lstrlenA (lpString="*.html") returned 6
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mdb") returned 0
	[0065.201] lstrlenA (lpString="*.mdb") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.cer") returned 0
	[0065.201] lstrlenA (lpString="*.cer") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.p12") returned 0
	[0065.201] lstrlenA (lpString="*.p12") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pfx") returned 0
	[0065.201] lstrlenA (lpString="*.pfx") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.kwm") returned 0
	[0065.201] lstrlenA (lpString="*.kwm") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pwm") returned 0
	[0065.201] lstrlenA (lpString="*.pwm") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.1cd") returned 0
	[0065.201] lstrlenA (lpString="*.1cd") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.md") returned 0
	[0065.201] lstrlenA (lpString="*.md") returned 4
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mdf") returned 0
	[0065.201] lstrlenA (lpString="*.mdf") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.dbf") returned 0
	[0065.201] lstrlenA (lpString="*.dbf") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.odt") returned 0
	[0065.201] lstrlenA (lpString="*.odt") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.vob") returned 0
	[0065.201] lstrlenA (lpString="*.vob") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ifo") returned 0
	[0065.201] lstrlenA (lpString="*.ifo") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.lnk") returned 0
	[0065.201] lstrlenA (lpString="*.lnk") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.torrent") returned 0
	[0065.201] lstrlenA (lpString="*.torrent") returned 9
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mov") returned 0
	[0065.201] lstrlenA (lpString="*.mov") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.m2v") returned 0
	[0065.201] lstrlenA (lpString="*.m2v") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.3gp") returned 0
	[0065.201] lstrlenA (lpString="*.3gp") returned 5
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mpeg") returned 0
	[0065.201] lstrlenA (lpString="*.mpeg") returned 6
	[0065.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mpg") returned 0
	[0065.201] lstrlenA (lpString="*.mpg") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.flv") returned 0
	[0065.202] lstrlenA (lpString="*.flv") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.avi") returned 0
	[0065.202] lstrlenA (lpString="*.avi") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mp4") returned 0
	[0065.202] lstrlenA (lpString="*.mp4") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wmv") returned 0
	[0065.202] lstrlenA (lpString="*.wmv") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.divx") returned 0
	[0065.202] lstrlenA (lpString="*.divx") returned 6
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mkv") returned 0
	[0065.202] lstrlenA (lpString="*.mkv") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mp3") returned 0
	[0065.202] lstrlenA (lpString="*.mp3") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wav") returned 0
	[0065.202] lstrlenA (lpString="*.wav") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.flac") returned 0
	[0065.202] lstrlenA (lpString="*.flac") returned 6
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ape") returned 0
	[0065.202] lstrlenA (lpString="*.ape") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wma") returned 0
	[0065.202] lstrlenA (lpString="*.wma") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ac3") returned 0
	[0065.202] lstrlenA (lpString="*.ac3") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.exe") returned 0
	[0065.202] lstrlenA (lpString="*.exe") returned 5
	[0065.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.apk") returned 0
	[0065.202] lstrlenA (lpString="*.apk") returned 5
	[0065.202] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.202] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1
	[0065.202] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1
	[0065.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned="Americana.css"
	[0065.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BabyBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue"
	[0065.202] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned 103
	[0065.202] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.203] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.203] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.203] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.203] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.203] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.203] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.203] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1
	[0065.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1
	[0065.203] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1
	[0065.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*") returned="*.*"
	[0065.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\"
	[0065.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned=""
	[0065.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0065.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0xffffffff
	[0065.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.203] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.203] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.204] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.204] CloseHandle (hObject=0xa0) returned 1
	[0065.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF"
	[0065.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.zip") returned 0
	[0065.204] lstrlenA (lpString="*.zip") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.rar") returned 0
	[0065.205] lstrlenA (lpString="*.rar") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.7z") returned 0
	[0065.205] lstrlenA (lpString="*.7z") returned 4
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.tar") returned 0
	[0065.205] lstrlenA (lpString="*.tar") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gzip") returned 0
	[0065.205] lstrlenA (lpString="*.gzip") returned 6
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpg") returned 0
	[0065.205] lstrlenA (lpString="*.jpg") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpeg") returned 0
	[0065.205] lstrlenA (lpString="*.jpeg") returned 6
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.psd") returned 0
	[0065.205] lstrlenA (lpString="*.psd") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.cdr") returned 0
	[0065.205] lstrlenA (lpString="*.cdr") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.dwg") returned 0
	[0065.205] lstrlenA (lpString="*.dwg") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.max") returned 0
	[0065.205] lstrlenA (lpString="*.max") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.bmp") returned 0
	[0065.205] lstrlenA (lpString="*.bmp") returned 5
	[0065.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gif") returned 1
	[0065.205] lstrlenA (lpString="*.gif") returned 5
	[0065.205] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF"
	[0065.205] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF"
	[0065.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF."
	[0065.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.Boom"
	[0065.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.206] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9
	[0065.206] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.206] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.206] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x96, lpOverlapped=0x0) returned 1
	[0065.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF"
	[0065.207] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.207] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x96, lpOverlapped=0x0) returned 1
	[0065.207] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.207] CloseHandle (hObject=0xa0) returned 1
	[0065.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif.boom")) returned 1
	[0065.209] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.209] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.209] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0065.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0065.209] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0065.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF"
	[0065.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\"
	[0065.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned=""
	[0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0065.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20
	[0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF"
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0065.210] lstrlenA (lpString="*.zip") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0065.210] lstrlenA (lpString="*.rar") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0065.210] lstrlenA (lpString="*.7z") returned 4
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0065.210] lstrlenA (lpString="*.tar") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0065.210] lstrlenA (lpString="*.gzip") returned 6
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0065.210] lstrlenA (lpString="*.jpg") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0065.210] lstrlenA (lpString="*.jpeg") returned 6
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0065.210] lstrlenA (lpString="*.psd") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0065.210] lstrlenA (lpString="*.cdr") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0065.210] lstrlenA (lpString="*.dwg") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.max") returned 0
	[0065.210] lstrlenA (lpString="*.max") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0065.210] lstrlenA (lpString="*.bmp") returned 5
	[0065.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0065.210] lstrlenA (lpString="*.gif") returned 5
	[0065.210] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF"
	[0065.210] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF"
	[0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF."
	[0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.Boom"
	[0065.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.211] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff
	[0065.211] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.211] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.211] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xdc, lpOverlapped=0x0) returned 1
	[0065.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF"
	[0065.212] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.212] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xdc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xdc, lpOverlapped=0x0) returned 1
	[0065.212] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.212] CloseHandle (hObject=0xa0) returned 1
	[0065.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif.boom")) returned 1
	[0065.213] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.213] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.213] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF"
	[0065.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\"
	[0065.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned=""
	[0065.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0065.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20
	[0065.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF"
	[0065.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.213] lstrlenA (lpString="*.zip") returned 5
	[0065.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.213] lstrlenA (lpString="*.rar") returned 5
	[0065.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.213] lstrlenA (lpString="*.7z") returned 4
	[0065.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.214] lstrlenA (lpString="*.tar") returned 5
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.214] lstrlenA (lpString="*.gzip") returned 6
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.214] lstrlenA (lpString="*.jpg") returned 5
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.214] lstrlenA (lpString="*.jpeg") returned 6
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.214] lstrlenA (lpString="*.psd") returned 5
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.214] lstrlenA (lpString="*.cdr") returned 5
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.214] lstrlenA (lpString="*.dwg") returned 5
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.214] lstrlenA (lpString="*.max") returned 5
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.214] lstrlenA (lpString="*.bmp") returned 5
	[0065.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.214] lstrlenA (lpString="*.gif") returned 5
	[0065.214] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF"
	[0065.214] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF"
	[0065.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF."
	[0065.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.Boom"
	[0065.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.215] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.215] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f42f7d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.215] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.215] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.216] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.216] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.216] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.216] CloseHandle (hObject=0xa0) returned 1
	[0065.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif.boom")) returned 1
	[0065.217] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.217] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.217] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.217] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\"
	[0065.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned=""
	[0065.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt"
	[0065.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20
	[0065.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF"
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.218] lstrlenA (lpString="*.zip") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.218] lstrlenA (lpString="*.rar") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.218] lstrlenA (lpString="*.7z") returned 4
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.218] lstrlenA (lpString="*.tar") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.218] lstrlenA (lpString="*.gzip") returned 6
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.218] lstrlenA (lpString="*.jpg") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.218] lstrlenA (lpString="*.jpeg") returned 6
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.218] lstrlenA (lpString="*.psd") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.218] lstrlenA (lpString="*.cdr") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.218] lstrlenA (lpString="*.dwg") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.218] lstrlenA (lpString="*.max") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.218] lstrlenA (lpString="*.bmp") returned 5
	[0065.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.218] lstrlenA (lpString="*.gif") returned 5
	[0065.218] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF"
	[0065.218] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF"
	[0065.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF."
	[0065.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.Boom"
	[0065.218] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.219] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.219] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5178e0b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.219] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.219] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.220] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.220] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.220] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.220] CloseHandle (hObject=0xa0) returned 1
	[0065.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif.boom")) returned 1
	[0065.221] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.221] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.221] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.221] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBlue.css") returned 1
	[0065.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBlue.css") returned 1
	[0065.221] lstrcmpiA (lpString1="", lpString2="BabyBlue.css") returned -1
	[0065.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.221] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BabyBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css"
	[0065.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.zip") returned 0
	[0065.221] lstrlenA (lpString="*.zip") returned 5
	[0065.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.rar") returned 0
	[0065.221] lstrlenA (lpString="*.rar") returned 5
	[0065.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.7z") returned 0
	[0065.221] lstrlenA (lpString="*.7z") returned 4
	[0065.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.tar") returned 0
	[0065.221] lstrlenA (lpString="*.tar") returned 5
	[0065.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.gzip") returned 0
	[0065.221] lstrlenA (lpString="*.gzip") returned 6
	[0065.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.jpg") returned 0
	[0065.221] lstrlenA (lpString="*.jpg") returned 5
	[0065.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.jpeg") returned 0
	[0065.221] lstrlenA (lpString="*.jpeg") returned 6
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.psd") returned 0
	[0065.222] lstrlenA (lpString="*.psd") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.cdr") returned 0
	[0065.222] lstrlenA (lpString="*.cdr") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.dwg") returned 0
	[0065.222] lstrlenA (lpString="*.dwg") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.max") returned 0
	[0065.222] lstrlenA (lpString="*.max") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.bmp") returned 0
	[0065.222] lstrlenA (lpString="*.bmp") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.gif") returned 0
	[0065.222] lstrlenA (lpString="*.gif") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.png") returned 0
	[0065.222] lstrlenA (lpString="*.png") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.doc") returned 0
	[0065.222] lstrlenA (lpString="*.doc") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.docx") returned 0
	[0065.222] lstrlenA (lpString="*.docx") returned 6
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.xls") returned 0
	[0065.222] lstrlenA (lpString="*.xls") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.xlsx") returned 0
	[0065.222] lstrlenA (lpString="*.xlsx") returned 6
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ppt") returned 0
	[0065.222] lstrlenA (lpString="*.ppt") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pptx") returned 0
	[0065.222] lstrlenA (lpString="*.pptx") returned 6
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.txt") returned 0
	[0065.222] lstrlenA (lpString="*.txt") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pdf") returned 0
	[0065.222] lstrlenA (lpString="*.pdf") returned 5
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.djvu") returned 0
	[0065.222] lstrlenA (lpString="*.djvu") returned 6
	[0065.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.htm") returned 0
	[0065.222] lstrlenA (lpString="*.htm") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.html") returned 0
	[0065.223] lstrlenA (lpString="*.html") returned 6
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mdb") returned 0
	[0065.223] lstrlenA (lpString="*.mdb") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.cer") returned 0
	[0065.223] lstrlenA (lpString="*.cer") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.p12") returned 0
	[0065.223] lstrlenA (lpString="*.p12") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pfx") returned 0
	[0065.223] lstrlenA (lpString="*.pfx") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.kwm") returned 0
	[0065.223] lstrlenA (lpString="*.kwm") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pwm") returned 0
	[0065.223] lstrlenA (lpString="*.pwm") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.1cd") returned 0
	[0065.223] lstrlenA (lpString="*.1cd") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.md") returned 0
	[0065.223] lstrlenA (lpString="*.md") returned 4
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mdf") returned 0
	[0065.223] lstrlenA (lpString="*.mdf") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.dbf") returned 0
	[0065.223] lstrlenA (lpString="*.dbf") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.odt") returned 0
	[0065.223] lstrlenA (lpString="*.odt") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.vob") returned 0
	[0065.223] lstrlenA (lpString="*.vob") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ifo") returned 0
	[0065.223] lstrlenA (lpString="*.ifo") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.lnk") returned 0
	[0065.223] lstrlenA (lpString="*.lnk") returned 5
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.torrent") returned 0
	[0065.223] lstrlenA (lpString="*.torrent") returned 9
	[0065.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mov") returned 0
	[0065.223] lstrlenA (lpString="*.mov") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.m2v") returned 0
	[0065.224] lstrlenA (lpString="*.m2v") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.3gp") returned 0
	[0065.224] lstrlenA (lpString="*.3gp") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mpeg") returned 0
	[0065.224] lstrlenA (lpString="*.mpeg") returned 6
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mpg") returned 0
	[0065.224] lstrlenA (lpString="*.mpg") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.flv") returned 0
	[0065.224] lstrlenA (lpString="*.flv") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.avi") returned 0
	[0065.224] lstrlenA (lpString="*.avi") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mp4") returned 0
	[0065.224] lstrlenA (lpString="*.mp4") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wmv") returned 0
	[0065.224] lstrlenA (lpString="*.wmv") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.divx") returned 0
	[0065.224] lstrlenA (lpString="*.divx") returned 6
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mkv") returned 0
	[0065.224] lstrlenA (lpString="*.mkv") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mp3") returned 0
	[0065.224] lstrlenA (lpString="*.mp3") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wav") returned 0
	[0065.224] lstrlenA (lpString="*.wav") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.flac") returned 0
	[0065.224] lstrlenA (lpString="*.flac") returned 6
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ape") returned 0
	[0065.224] lstrlenA (lpString="*.ape") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wma") returned 0
	[0065.224] lstrlenA (lpString="*.wma") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ac3") returned 0
	[0065.224] lstrlenA (lpString="*.ac3") returned 5
	[0065.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.exe") returned 0
	[0065.224] lstrlenA (lpString="*.exe") returned 5
	[0065.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.apk") returned 0
	[0065.225] lstrlenA (lpString="*.apk") returned 5
	[0065.225] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.225] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1
	[0065.225] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1
	[0065.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned="BabyBlue.css"
	[0065.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Biscay" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay"
	[0065.225] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned 101
	[0065.225] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.225] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.225] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.225] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.225] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.225] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.225] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.225] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.225] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*") returned="*.*"
	[0065.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\"
	[0065.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned=""
	[0065.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt"
	[0065.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0xffffffff
	[0065.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.226] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.226] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.227] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.227] CloseHandle (hObject=0xa0) returned 1
	[0065.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF"
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.227] lstrlenA (lpString="*.zip") returned 5
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.227] lstrlenA (lpString="*.rar") returned 5
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.227] lstrlenA (lpString="*.7z") returned 4
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.227] lstrlenA (lpString="*.tar") returned 5
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.227] lstrlenA (lpString="*.gzip") returned 6
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.227] lstrlenA (lpString="*.jpg") returned 5
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.227] lstrlenA (lpString="*.jpeg") returned 6
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.227] lstrlenA (lpString="*.psd") returned 5
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.227] lstrlenA (lpString="*.cdr") returned 5
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.227] lstrlenA (lpString="*.dwg") returned 5
	[0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.227] lstrlenA (lpString="*.max") returned 5
	[0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.228] lstrlenA (lpString="*.bmp") returned 5
	[0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.228] lstrlenA (lpString="*.gif") returned 5
	[0065.228] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF"
	[0065.228] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF"
	[0065.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF."
	[0065.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.Boom"
	[0065.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.228] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.228] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f690dd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.228] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.228] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.229] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.229] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.229] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.229] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.229] CloseHandle (hObject=0xa0) returned 1
	[0065.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif.boom")) returned 1
	[0065.230] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.230] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.230] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.230] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\"
	[0065.230] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned=""
	[0065.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt"
	[0065.230] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0x20
	[0065.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF"
	[0065.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.230] lstrlenA (lpString="*.zip") returned 5
	[0065.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.230] lstrlenA (lpString="*.rar") returned 5
	[0065.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.231] lstrlenA (lpString="*.7z") returned 4
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.231] lstrlenA (lpString="*.tar") returned 5
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.231] lstrlenA (lpString="*.gzip") returned 6
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.231] lstrlenA (lpString="*.jpg") returned 5
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.231] lstrlenA (lpString="*.jpeg") returned 6
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.231] lstrlenA (lpString="*.psd") returned 5
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.231] lstrlenA (lpString="*.cdr") returned 5
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.231] lstrlenA (lpString="*.dwg") returned 5
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.231] lstrlenA (lpString="*.max") returned 5
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.231] lstrlenA (lpString="*.bmp") returned 5
	[0065.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.231] lstrlenA (lpString="*.gif") returned 5
	[0065.231] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF"
	[0065.231] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF"
	[0065.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF."
	[0065.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.Boom"
	[0065.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.232] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.232] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519c9550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.232] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.232] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.233] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.233] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.233] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.233] CloseHandle (hObject=0xa0) returned 1
	[0065.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif.boom")) returned 1
	[0065.235] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.235] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.235] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.236] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.236] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Biscay.css") returned 1
	[0065.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Biscay.css") returned 1
	[0065.236] lstrcmpiA (lpString1="", lpString2="Biscay.css") returned -1
	[0065.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Biscay.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css"
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.zip") returned 0
	[0065.236] lstrlenA (lpString="*.zip") returned 5
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.rar") returned 0
	[0065.236] lstrlenA (lpString="*.rar") returned 5
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.7z") returned 0
	[0065.236] lstrlenA (lpString="*.7z") returned 4
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.tar") returned 0
	[0065.236] lstrlenA (lpString="*.tar") returned 5
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.gzip") returned 0
	[0065.236] lstrlenA (lpString="*.gzip") returned 6
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.jpg") returned 0
	[0065.236] lstrlenA (lpString="*.jpg") returned 5
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.jpeg") returned 0
	[0065.236] lstrlenA (lpString="*.jpeg") returned 6
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.psd") returned 0
	[0065.236] lstrlenA (lpString="*.psd") returned 5
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.cdr") returned 0
	[0065.236] lstrlenA (lpString="*.cdr") returned 5
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.dwg") returned 0
	[0065.236] lstrlenA (lpString="*.dwg") returned 5
	[0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.max") returned 0
	[0065.236] lstrlenA (lpString="*.max") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.bmp") returned 0
	[0065.237] lstrlenA (lpString="*.bmp") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.gif") returned 0
	[0065.237] lstrlenA (lpString="*.gif") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.png") returned 0
	[0065.237] lstrlenA (lpString="*.png") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.doc") returned 0
	[0065.237] lstrlenA (lpString="*.doc") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.docx") returned 0
	[0065.237] lstrlenA (lpString="*.docx") returned 6
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.xls") returned 0
	[0065.237] lstrlenA (lpString="*.xls") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.xlsx") returned 0
	[0065.237] lstrlenA (lpString="*.xlsx") returned 6
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ppt") returned 0
	[0065.237] lstrlenA (lpString="*.ppt") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pptx") returned 0
	[0065.237] lstrlenA (lpString="*.pptx") returned 6
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.txt") returned 0
	[0065.237] lstrlenA (lpString="*.txt") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pdf") returned 0
	[0065.237] lstrlenA (lpString="*.pdf") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.djvu") returned 0
	[0065.237] lstrlenA (lpString="*.djvu") returned 6
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.htm") returned 0
	[0065.237] lstrlenA (lpString="*.htm") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.html") returned 0
	[0065.237] lstrlenA (lpString="*.html") returned 6
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mdb") returned 0
	[0065.237] lstrlenA (lpString="*.mdb") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.cer") returned 0
	[0065.237] lstrlenA (lpString="*.cer") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.p12") returned 0
	[0065.237] lstrlenA (lpString="*.p12") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pfx") returned 0
	[0065.237] lstrlenA (lpString="*.pfx") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.kwm") returned 0
	[0065.237] lstrlenA (lpString="*.kwm") returned 5
	[0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pwm") returned 0
	[0065.238] lstrlenA (lpString="*.pwm") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.1cd") returned 0
	[0065.238] lstrlenA (lpString="*.1cd") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.md") returned 0
	[0065.238] lstrlenA (lpString="*.md") returned 4
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mdf") returned 0
	[0065.238] lstrlenA (lpString="*.mdf") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.dbf") returned 0
	[0065.238] lstrlenA (lpString="*.dbf") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.odt") returned 0
	[0065.238] lstrlenA (lpString="*.odt") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.vob") returned 0
	[0065.238] lstrlenA (lpString="*.vob") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ifo") returned 0
	[0065.238] lstrlenA (lpString="*.ifo") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.lnk") returned 0
	[0065.238] lstrlenA (lpString="*.lnk") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.torrent") returned 0
	[0065.238] lstrlenA (lpString="*.torrent") returned 9
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mov") returned 0
	[0065.238] lstrlenA (lpString="*.mov") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.m2v") returned 0
	[0065.238] lstrlenA (lpString="*.m2v") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.3gp") returned 0
	[0065.238] lstrlenA (lpString="*.3gp") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mpeg") returned 0
	[0065.238] lstrlenA (lpString="*.mpeg") returned 6
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mpg") returned 0
	[0065.238] lstrlenA (lpString="*.mpg") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.flv") returned 0
	[0065.238] lstrlenA (lpString="*.flv") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.avi") returned 0
	[0065.238] lstrlenA (lpString="*.avi") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mp4") returned 0
	[0065.238] lstrlenA (lpString="*.mp4") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wmv") returned 0
	[0065.238] lstrlenA (lpString="*.wmv") returned 5
	[0065.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.divx") returned 0
	[0065.239] lstrlenA (lpString="*.divx") returned 6
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mkv") returned 0
	[0065.239] lstrlenA (lpString="*.mkv") returned 5
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mp3") returned 0
	[0065.239] lstrlenA (lpString="*.mp3") returned 5
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wav") returned 0
	[0065.239] lstrlenA (lpString="*.wav") returned 5
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.flac") returned 0
	[0065.239] lstrlenA (lpString="*.flac") returned 6
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ape") returned 0
	[0065.239] lstrlenA (lpString="*.ape") returned 5
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wma") returned 0
	[0065.239] lstrlenA (lpString="*.wma") returned 5
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ac3") returned 0
	[0065.239] lstrlenA (lpString="*.ac3") returned 5
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.exe") returned 0
	[0065.239] lstrlenA (lpString="*.exe") returned 5
	[0065.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.apk") returned 0
	[0065.240] lstrlenA (lpString="*.apk") returned 5
	[0065.240] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.240] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1
	[0065.240] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1
	[0065.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned="Biscay.css"
	[0065.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightOrange" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange"
	[0065.240] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned 107
	[0065.240] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.241] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.241] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.241] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.241] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.241] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.241] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0065.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0065.241] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0065.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*") returned="*.*"
	[0065.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\"
	[0065.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned=""
	[0065.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0065.241] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0xffffffff
	[0065.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.243] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.243] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.244] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.244] CloseHandle (hObject=0xa0) returned 1
	[0065.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif"
	[0065.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.zip") returned 0
	[0065.244] lstrlenA (lpString="*.zip") returned 5
	[0065.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.rar") returned 0
	[0065.244] lstrlenA (lpString="*.rar") returned 5
	[0065.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.7z") returned 0
	[0065.244] lstrlenA (lpString="*.7z") returned 4
	[0065.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.tar") returned 0
	[0065.244] lstrlenA (lpString="*.tar") returned 5
	[0065.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gzip") returned 0
	[0065.244] lstrlenA (lpString="*.gzip") returned 6
	[0065.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpg") returned 0
	[0065.244] lstrlenA (lpString="*.jpg") returned 5
	[0065.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpeg") returned 0
	[0065.244] lstrlenA (lpString="*.jpeg") returned 6
	[0065.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.psd") returned 0
	[0065.245] lstrlenA (lpString="*.psd") returned 5
	[0065.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.cdr") returned 0
	[0065.245] lstrlenA (lpString="*.cdr") returned 5
	[0065.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.dwg") returned 0
	[0065.245] lstrlenA (lpString="*.dwg") returned 5
	[0065.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.max") returned 0
	[0065.245] lstrlenA (lpString="*.max") returned 5
	[0065.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.bmp") returned 0
	[0065.245] lstrlenA (lpString="*.bmp") returned 5
	[0065.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gif") returned 1
	[0065.245] lstrlenA (lpString="*.gif") returned 5
	[0065.245] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif"
	[0065.245] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif"
	[0065.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif."
	[0065.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.Boom"
	[0065.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.246] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143
	[0065.246] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.246] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.246] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x120, lpOverlapped=0x0) returned 1
	[0065.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif"
	[0065.246] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.247] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x120, lpOverlapped=0x0) returned 1
	[0065.247] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.247] CloseHandle (hObject=0xa0) returned 1
	[0065.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.boom")) returned 1
	[0065.248] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.248] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.248] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1
	[0065.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1
	[0065.248] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1
	[0065.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif"
	[0065.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\"
	[0065.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned=""
	[0065.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0065.248] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20
	[0065.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF"
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.zip") returned 0
	[0065.248] lstrlenA (lpString="*.zip") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.rar") returned 0
	[0065.248] lstrlenA (lpString="*.rar") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.7z") returned 0
	[0065.248] lstrlenA (lpString="*.7z") returned 4
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.tar") returned 0
	[0065.248] lstrlenA (lpString="*.tar") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gzip") returned 0
	[0065.248] lstrlenA (lpString="*.gzip") returned 6
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpg") returned 0
	[0065.248] lstrlenA (lpString="*.jpg") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpeg") returned 0
	[0065.248] lstrlenA (lpString="*.jpeg") returned 6
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.psd") returned 0
	[0065.248] lstrlenA (lpString="*.psd") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.cdr") returned 0
	[0065.248] lstrlenA (lpString="*.cdr") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.dwg") returned 0
	[0065.248] lstrlenA (lpString="*.dwg") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.max") returned 0
	[0065.248] lstrlenA (lpString="*.max") returned 5
	[0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.bmp") returned 0
	[0065.249] lstrlenA (lpString="*.bmp") returned 5
	[0065.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gif") returned 1
	[0065.249] lstrlenA (lpString="*.gif") returned 5
	[0065.249] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF"
	[0065.249] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF"
	[0065.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF."
	[0065.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.Boom"
	[0065.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.250] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9
	[0065.250] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.250] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.250] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x96, lpOverlapped=0x0) returned 1
	[0065.251] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF"
	[0065.251] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.251] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x96, lpOverlapped=0x0) returned 1
	[0065.251] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.251] CloseHandle (hObject=0xa0) returned 1
	[0065.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif.boom")) returned 1
	[0065.252] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.252] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.252] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.252] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.252] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF"
	[0065.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\"
	[0065.252] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned=""
	[0065.252] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0065.252] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20
	[0065.252] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF"
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.252] lstrlenA (lpString="*.zip") returned 5
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.252] lstrlenA (lpString="*.rar") returned 5
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.252] lstrlenA (lpString="*.7z") returned 4
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.252] lstrlenA (lpString="*.tar") returned 5
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.252] lstrlenA (lpString="*.gzip") returned 6
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.252] lstrlenA (lpString="*.jpg") returned 5
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.252] lstrlenA (lpString="*.jpeg") returned 6
	[0065.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.252] lstrlenA (lpString="*.psd") returned 5
	[0065.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.253] lstrlenA (lpString="*.cdr") returned 5
	[0065.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.253] lstrlenA (lpString="*.dwg") returned 5
	[0065.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.253] lstrlenA (lpString="*.max") returned 5
	[0065.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.253] lstrlenA (lpString="*.bmp") returned 5
	[0065.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.253] lstrlenA (lpString="*.gif") returned 5
	[0065.253] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF"
	[0065.253] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF"
	[0065.253] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF."
	[0065.253] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.Boom"
	[0065.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.254] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.254] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1
	[0065.254] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.254] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.255] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.255] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.255] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.255] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.255] CloseHandle (hObject=0xa0) returned 1
	[0065.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif.boom")) returned 1
	[0065.257] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.257] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.257] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\"
	[0065.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned=""
	[0065.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt"
	[0065.257] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20
	[0065.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF"
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.257] lstrlenA (lpString="*.zip") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.257] lstrlenA (lpString="*.rar") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.257] lstrlenA (lpString="*.7z") returned 4
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.257] lstrlenA (lpString="*.tar") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.257] lstrlenA (lpString="*.gzip") returned 6
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.257] lstrlenA (lpString="*.jpg") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.257] lstrlenA (lpString="*.jpeg") returned 6
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.257] lstrlenA (lpString="*.psd") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.257] lstrlenA (lpString="*.cdr") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.257] lstrlenA (lpString="*.dwg") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.257] lstrlenA (lpString="*.max") returned 5
	[0065.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.257] lstrlenA (lpString="*.bmp") returned 5
	[0065.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.258] lstrlenA (lpString="*.gif") returned 5
	[0065.258] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF"
	[0065.258] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF"
	[0065.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF."
	[0065.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.Boom"
	[0065.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.258] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.258] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.258] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.258] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.259] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.259] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.259] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.259] CloseHandle (hObject=0xa0) returned 1
	[0065.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif.boom")) returned 1
	[0065.260] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.260] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.260] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.260] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightOrange.css") returned 1
	[0065.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightOrange.css") returned 1
	[0065.260] lstrcmpiA (lpString1="", lpString2="BrightOrange.css") returned -1
	[0065.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightOrange.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css"
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.zip") returned 0
	[0065.260] lstrlenA (lpString="*.zip") returned 5
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.rar") returned 0
	[0065.260] lstrlenA (lpString="*.rar") returned 5
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.7z") returned 0
	[0065.260] lstrlenA (lpString="*.7z") returned 4
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.tar") returned 0
	[0065.260] lstrlenA (lpString="*.tar") returned 5
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.gzip") returned 0
	[0065.260] lstrlenA (lpString="*.gzip") returned 6
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.jpg") returned 0
	[0065.260] lstrlenA (lpString="*.jpg") returned 5
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.jpeg") returned 0
	[0065.260] lstrlenA (lpString="*.jpeg") returned 6
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.psd") returned 0
	[0065.260] lstrlenA (lpString="*.psd") returned 5
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.cdr") returned 0
	[0065.260] lstrlenA (lpString="*.cdr") returned 5
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.dwg") returned 0
	[0065.260] lstrlenA (lpString="*.dwg") returned 5
	[0065.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.max") returned 0
	[0065.261] lstrlenA (lpString="*.max") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.bmp") returned 0
	[0065.261] lstrlenA (lpString="*.bmp") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.gif") returned 0
	[0065.261] lstrlenA (lpString="*.gif") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.png") returned 0
	[0065.261] lstrlenA (lpString="*.png") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.doc") returned 0
	[0065.261] lstrlenA (lpString="*.doc") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.docx") returned 0
	[0065.261] lstrlenA (lpString="*.docx") returned 6
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.xls") returned 0
	[0065.261] lstrlenA (lpString="*.xls") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.xlsx") returned 0
	[0065.261] lstrlenA (lpString="*.xlsx") returned 6
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ppt") returned 0
	[0065.261] lstrlenA (lpString="*.ppt") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pptx") returned 0
	[0065.261] lstrlenA (lpString="*.pptx") returned 6
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.txt") returned 0
	[0065.261] lstrlenA (lpString="*.txt") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pdf") returned 0
	[0065.261] lstrlenA (lpString="*.pdf") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.djvu") returned 0
	[0065.261] lstrlenA (lpString="*.djvu") returned 6
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.htm") returned 0
	[0065.261] lstrlenA (lpString="*.htm") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.html") returned 0
	[0065.261] lstrlenA (lpString="*.html") returned 6
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mdb") returned 0
	[0065.261] lstrlenA (lpString="*.mdb") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.cer") returned 0
	[0065.261] lstrlenA (lpString="*.cer") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.p12") returned 0
	[0065.261] lstrlenA (lpString="*.p12") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pfx") returned 0
	[0065.261] lstrlenA (lpString="*.pfx") returned 5
	[0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.kwm") returned 0
	[0065.262] lstrlenA (lpString="*.kwm") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pwm") returned 0
	[0065.262] lstrlenA (lpString="*.pwm") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.1cd") returned 0
	[0065.262] lstrlenA (lpString="*.1cd") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.md") returned 0
	[0065.262] lstrlenA (lpString="*.md") returned 4
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mdf") returned 0
	[0065.262] lstrlenA (lpString="*.mdf") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.dbf") returned 0
	[0065.262] lstrlenA (lpString="*.dbf") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.odt") returned 0
	[0065.262] lstrlenA (lpString="*.odt") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.vob") returned 0
	[0065.262] lstrlenA (lpString="*.vob") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ifo") returned 0
	[0065.262] lstrlenA (lpString="*.ifo") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.lnk") returned 0
	[0065.262] lstrlenA (lpString="*.lnk") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.torrent") returned 0
	[0065.262] lstrlenA (lpString="*.torrent") returned 9
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mov") returned 0
	[0065.262] lstrlenA (lpString="*.mov") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.m2v") returned 0
	[0065.262] lstrlenA (lpString="*.m2v") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.3gp") returned 0
	[0065.262] lstrlenA (lpString="*.3gp") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mpeg") returned 0
	[0065.262] lstrlenA (lpString="*.mpeg") returned 6
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mpg") returned 0
	[0065.262] lstrlenA (lpString="*.mpg") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.flv") returned 0
	[0065.262] lstrlenA (lpString="*.flv") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.avi") returned 0
	[0065.262] lstrlenA (lpString="*.avi") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mp4") returned 0
	[0065.262] lstrlenA (lpString="*.mp4") returned 5
	[0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wmv") returned 0
	[0065.262] lstrlenA (lpString="*.wmv") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.divx") returned 0
	[0065.263] lstrlenA (lpString="*.divx") returned 6
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mkv") returned 0
	[0065.263] lstrlenA (lpString="*.mkv") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mp3") returned 0
	[0065.263] lstrlenA (lpString="*.mp3") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wav") returned 0
	[0065.263] lstrlenA (lpString="*.wav") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.flac") returned 0
	[0065.263] lstrlenA (lpString="*.flac") returned 6
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ape") returned 0
	[0065.263] lstrlenA (lpString="*.ape") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wma") returned 0
	[0065.263] lstrlenA (lpString="*.wma") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ac3") returned 0
	[0065.263] lstrlenA (lpString="*.ac3") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.exe") returned 0
	[0065.263] lstrlenA (lpString="*.exe") returned 5
	[0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.apk") returned 0
	[0065.263] lstrlenA (lpString="*.apk") returned 5
	[0065.263] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.263] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1
	[0065.263] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1
	[0065.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned="BrightOrange.css"
	[0065.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightYellow" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow"
	[0065.263] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned 107
	[0065.263] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.264] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.264] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.264] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.264] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.264] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.264] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.264] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0065.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0065.264] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0065.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*") returned="*.*"
	[0065.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\"
	[0065.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned=""
	[0065.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt"
	[0065.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0xffffffff
	[0065.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.266] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.267] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.267] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.267] CloseHandle (hObject=0xa0) returned 1
	[0065.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF"
	[0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0065.267] lstrlenA (lpString="*.zip") returned 5
	[0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0065.267] lstrlenA (lpString="*.rar") returned 5
	[0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0065.268] lstrlenA (lpString="*.7z") returned 4
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0065.268] lstrlenA (lpString="*.tar") returned 5
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0065.268] lstrlenA (lpString="*.gzip") returned 6
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0065.268] lstrlenA (lpString="*.jpg") returned 5
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0065.268] lstrlenA (lpString="*.jpeg") returned 6
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0065.268] lstrlenA (lpString="*.psd") returned 5
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0065.268] lstrlenA (lpString="*.cdr") returned 5
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0065.268] lstrlenA (lpString="*.dwg") returned 5
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.max") returned 0
	[0065.268] lstrlenA (lpString="*.max") returned 5
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0065.268] lstrlenA (lpString="*.bmp") returned 5
	[0065.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0065.268] lstrlenA (lpString="*.gif") returned 5
	[0065.268] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF"
	[0065.268] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF"
	[0065.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF."
	[0065.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.Boom"
	[0065.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.269] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f
	[0065.269] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.269] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.269] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14c, lpOverlapped=0x0) returned 1
	[0065.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF"
	[0065.270] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.270] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14c, lpOverlapped=0x0) returned 1
	[0065.270] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.270] CloseHandle (hObject=0xa0) returned 1
	[0065.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif.boom")) returned 1
	[0065.270] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.271] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.271] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF"
	[0065.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\"
	[0065.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned=""
	[0065.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt"
	[0065.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20
	[0065.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF"
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.271] lstrlenA (lpString="*.zip") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.271] lstrlenA (lpString="*.rar") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.271] lstrlenA (lpString="*.7z") returned 4
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.271] lstrlenA (lpString="*.tar") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.271] lstrlenA (lpString="*.gzip") returned 6
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.271] lstrlenA (lpString="*.jpg") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.271] lstrlenA (lpString="*.jpeg") returned 6
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.271] lstrlenA (lpString="*.psd") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.271] lstrlenA (lpString="*.cdr") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.271] lstrlenA (lpString="*.dwg") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.271] lstrlenA (lpString="*.max") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.271] lstrlenA (lpString="*.bmp") returned 5
	[0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.271] lstrlenA (lpString="*.gif") returned 5
	[0065.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF"
	[0065.272] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF"
	[0065.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF."
	[0065.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.Boom"
	[0065.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.272] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.272] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.272] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.272] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.273] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.273] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.273] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.273] CloseHandle (hObject=0xa0) returned 1
	[0065.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif.boom")) returned 1
	[0065.274] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.274] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.274] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\"
	[0065.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned=""
	[0065.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt"
	[0065.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20
	[0065.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF"
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.274] lstrlenA (lpString="*.zip") returned 5
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.274] lstrlenA (lpString="*.rar") returned 5
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.274] lstrlenA (lpString="*.7z") returned 4
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.274] lstrlenA (lpString="*.tar") returned 5
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.274] lstrlenA (lpString="*.gzip") returned 6
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.274] lstrlenA (lpString="*.jpg") returned 5
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.274] lstrlenA (lpString="*.jpeg") returned 6
	[0065.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.274] lstrlenA (lpString="*.psd") returned 5
	[0065.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.275] lstrlenA (lpString="*.cdr") returned 5
	[0065.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.275] lstrlenA (lpString="*.dwg") returned 5
	[0065.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.275] lstrlenA (lpString="*.max") returned 5
	[0065.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.275] lstrlenA (lpString="*.bmp") returned 5
	[0065.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.275] lstrlenA (lpString="*.gif") returned 5
	[0065.275] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF"
	[0065.275] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF"
	[0065.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF."
	[0065.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.Boom"
	[0065.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.275] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.275] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.275] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.275] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.276] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.276] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.276] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.276] CloseHandle (hObject=0xa0) returned 1
	[0065.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif.boom")) returned 1
	[0065.277] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.277] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.277] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.277] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightYellow.css") returned 1
	[0065.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightYellow.css") returned 1
	[0065.278] lstrcmpiA (lpString1="", lpString2="BrightYellow.css") returned -1
	[0065.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.278] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.278] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightYellow.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css"
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.zip") returned 0
	[0065.278] lstrlenA (lpString="*.zip") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.rar") returned 0
	[0065.278] lstrlenA (lpString="*.rar") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.7z") returned 0
	[0065.278] lstrlenA (lpString="*.7z") returned 4
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.tar") returned 0
	[0065.278] lstrlenA (lpString="*.tar") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.gzip") returned 0
	[0065.278] lstrlenA (lpString="*.gzip") returned 6
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.jpg") returned 0
	[0065.278] lstrlenA (lpString="*.jpg") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.jpeg") returned 0
	[0065.278] lstrlenA (lpString="*.jpeg") returned 6
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.psd") returned 0
	[0065.278] lstrlenA (lpString="*.psd") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.cdr") returned 0
	[0065.278] lstrlenA (lpString="*.cdr") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.dwg") returned 0
	[0065.278] lstrlenA (lpString="*.dwg") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.max") returned 0
	[0065.278] lstrlenA (lpString="*.max") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.bmp") returned 0
	[0065.278] lstrlenA (lpString="*.bmp") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.gif") returned 0
	[0065.278] lstrlenA (lpString="*.gif") returned 5
	[0065.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.png") returned 0
	[0065.279] lstrlenA (lpString="*.png") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.doc") returned 0
	[0065.279] lstrlenA (lpString="*.doc") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.docx") returned 0
	[0065.279] lstrlenA (lpString="*.docx") returned 6
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.xls") returned 0
	[0065.279] lstrlenA (lpString="*.xls") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.xlsx") returned 0
	[0065.279] lstrlenA (lpString="*.xlsx") returned 6
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ppt") returned 0
	[0065.279] lstrlenA (lpString="*.ppt") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pptx") returned 0
	[0065.279] lstrlenA (lpString="*.pptx") returned 6
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.txt") returned 0
	[0065.279] lstrlenA (lpString="*.txt") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pdf") returned 0
	[0065.279] lstrlenA (lpString="*.pdf") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.djvu") returned 0
	[0065.279] lstrlenA (lpString="*.djvu") returned 6
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.htm") returned 0
	[0065.279] lstrlenA (lpString="*.htm") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.html") returned 0
	[0065.279] lstrlenA (lpString="*.html") returned 6
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mdb") returned 0
	[0065.279] lstrlenA (lpString="*.mdb") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.cer") returned 0
	[0065.279] lstrlenA (lpString="*.cer") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.p12") returned 0
	[0065.279] lstrlenA (lpString="*.p12") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pfx") returned 0
	[0065.279] lstrlenA (lpString="*.pfx") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.kwm") returned 0
	[0065.279] lstrlenA (lpString="*.kwm") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pwm") returned 0
	[0065.279] lstrlenA (lpString="*.pwm") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.1cd") returned 0
	[0065.279] lstrlenA (lpString="*.1cd") returned 5
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.md") returned 0
	[0065.279] lstrlenA (lpString="*.md") returned 4
	[0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mdf") returned 0
	[0065.279] lstrlenA (lpString="*.mdf") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.dbf") returned 0
	[0065.280] lstrlenA (lpString="*.dbf") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.odt") returned 0
	[0065.280] lstrlenA (lpString="*.odt") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.vob") returned 0
	[0065.280] lstrlenA (lpString="*.vob") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ifo") returned 0
	[0065.280] lstrlenA (lpString="*.ifo") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.lnk") returned 0
	[0065.280] lstrlenA (lpString="*.lnk") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.torrent") returned 0
	[0065.280] lstrlenA (lpString="*.torrent") returned 9
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mov") returned 0
	[0065.280] lstrlenA (lpString="*.mov") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.m2v") returned 0
	[0065.280] lstrlenA (lpString="*.m2v") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.3gp") returned 0
	[0065.280] lstrlenA (lpString="*.3gp") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mpeg") returned 0
	[0065.280] lstrlenA (lpString="*.mpeg") returned 6
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mpg") returned 0
	[0065.280] lstrlenA (lpString="*.mpg") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.flv") returned 0
	[0065.280] lstrlenA (lpString="*.flv") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.avi") returned 0
	[0065.280] lstrlenA (lpString="*.avi") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mp4") returned 0
	[0065.280] lstrlenA (lpString="*.mp4") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wmv") returned 0
	[0065.280] lstrlenA (lpString="*.wmv") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.divx") returned 0
	[0065.280] lstrlenA (lpString="*.divx") returned 6
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mkv") returned 0
	[0065.280] lstrlenA (lpString="*.mkv") returned 5
	[0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mp3") returned 0
	[0065.280] lstrlenA (lpString="*.mp3") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wav") returned 0
	[0065.281] lstrlenA (lpString="*.wav") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.flac") returned 0
	[0065.281] lstrlenA (lpString="*.flac") returned 6
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ape") returned 0
	[0065.281] lstrlenA (lpString="*.ape") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wma") returned 0
	[0065.281] lstrlenA (lpString="*.wma") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ac3") returned 0
	[0065.281] lstrlenA (lpString="*.ac3") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.exe") returned 0
	[0065.281] lstrlenA (lpString="*.exe") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.apk") returned 0
	[0065.281] lstrlenA (lpString="*.apk") returned 5
	[0065.281] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.281] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.281] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Casual.css") returned 1
	[0065.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Casual.css") returned 1
	[0065.281] lstrcmpiA (lpString1="", lpString2="Casual.css") returned -1
	[0065.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned="BrightYellow.css"
	[0065.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Casual.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css"
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.zip") returned 0
	[0065.281] lstrlenA (lpString="*.zip") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.rar") returned 0
	[0065.281] lstrlenA (lpString="*.rar") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.7z") returned 0
	[0065.281] lstrlenA (lpString="*.7z") returned 4
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.tar") returned 0
	[0065.281] lstrlenA (lpString="*.tar") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.gzip") returned 0
	[0065.281] lstrlenA (lpString="*.gzip") returned 6
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.jpg") returned 0
	[0065.281] lstrlenA (lpString="*.jpg") returned 5
	[0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.jpeg") returned 0
	[0065.282] lstrlenA (lpString="*.jpeg") returned 6
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.psd") returned 0
	[0065.282] lstrlenA (lpString="*.psd") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.cdr") returned 0
	[0065.282] lstrlenA (lpString="*.cdr") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.dwg") returned 0
	[0065.282] lstrlenA (lpString="*.dwg") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.max") returned 0
	[0065.282] lstrlenA (lpString="*.max") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.bmp") returned 0
	[0065.282] lstrlenA (lpString="*.bmp") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.gif") returned 0
	[0065.282] lstrlenA (lpString="*.gif") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.png") returned 0
	[0065.282] lstrlenA (lpString="*.png") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.doc") returned 0
	[0065.282] lstrlenA (lpString="*.doc") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.docx") returned 0
	[0065.282] lstrlenA (lpString="*.docx") returned 6
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.xls") returned 0
	[0065.282] lstrlenA (lpString="*.xls") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.xlsx") returned 0
	[0065.282] lstrlenA (lpString="*.xlsx") returned 6
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ppt") returned 0
	[0065.282] lstrlenA (lpString="*.ppt") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pptx") returned 0
	[0065.282] lstrlenA (lpString="*.pptx") returned 6
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.txt") returned 0
	[0065.282] lstrlenA (lpString="*.txt") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pdf") returned 0
	[0065.282] lstrlenA (lpString="*.pdf") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.djvu") returned 0
	[0065.282] lstrlenA (lpString="*.djvu") returned 6
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.htm") returned 0
	[0065.282] lstrlenA (lpString="*.htm") returned 5
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.html") returned 0
	[0065.282] lstrlenA (lpString="*.html") returned 6
	[0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mdb") returned 0
	[0065.283] lstrlenA (lpString="*.mdb") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.cer") returned 0
	[0065.283] lstrlenA (lpString="*.cer") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.p12") returned 0
	[0065.283] lstrlenA (lpString="*.p12") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pfx") returned 0
	[0065.283] lstrlenA (lpString="*.pfx") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.kwm") returned 0
	[0065.283] lstrlenA (lpString="*.kwm") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pwm") returned 0
	[0065.283] lstrlenA (lpString="*.pwm") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.1cd") returned 0
	[0065.283] lstrlenA (lpString="*.1cd") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.md") returned 0
	[0065.283] lstrlenA (lpString="*.md") returned 4
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mdf") returned 0
	[0065.283] lstrlenA (lpString="*.mdf") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.dbf") returned 0
	[0065.283] lstrlenA (lpString="*.dbf") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.odt") returned 0
	[0065.283] lstrlenA (lpString="*.odt") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.vob") returned 0
	[0065.283] lstrlenA (lpString="*.vob") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ifo") returned 0
	[0065.283] lstrlenA (lpString="*.ifo") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.lnk") returned 0
	[0065.283] lstrlenA (lpString="*.lnk") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.torrent") returned 0
	[0065.283] lstrlenA (lpString="*.torrent") returned 9
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mov") returned 0
	[0065.283] lstrlenA (lpString="*.mov") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.m2v") returned 0
	[0065.283] lstrlenA (lpString="*.m2v") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.3gp") returned 0
	[0065.283] lstrlenA (lpString="*.3gp") returned 5
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mpeg") returned 0
	[0065.283] lstrlenA (lpString="*.mpeg") returned 6
	[0065.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mpg") returned 0
	[0065.283] lstrlenA (lpString="*.mpg") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.flv") returned 0
	[0065.284] lstrlenA (lpString="*.flv") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.avi") returned 0
	[0065.284] lstrlenA (lpString="*.avi") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mp4") returned 0
	[0065.284] lstrlenA (lpString="*.mp4") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wmv") returned 0
	[0065.284] lstrlenA (lpString="*.wmv") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.divx") returned 0
	[0065.284] lstrlenA (lpString="*.divx") returned 6
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mkv") returned 0
	[0065.284] lstrlenA (lpString="*.mkv") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mp3") returned 0
	[0065.284] lstrlenA (lpString="*.mp3") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wav") returned 0
	[0065.284] lstrlenA (lpString="*.wav") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.flac") returned 0
	[0065.284] lstrlenA (lpString="*.flac") returned 6
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ape") returned 0
	[0065.284] lstrlenA (lpString="*.ape") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wma") returned 0
	[0065.284] lstrlenA (lpString="*.wma") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ac3") returned 0
	[0065.284] lstrlenA (lpString="*.ac3") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.exe") returned 0
	[0065.284] lstrlenA (lpString="*.exe") returned 5
	[0065.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.apk") returned 0
	[0065.284] lstrlenA (lpString="*.apk") returned 5
	[0065.284] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.284] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.284] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Country.css") returned 1
	[0065.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Country.css") returned 1
	[0065.284] lstrcmpiA (lpString1="", lpString2="Country.css") returned -1
	[0065.284] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned="Casual.css"
	[0065.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.284] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.284] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.285] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Country.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css"
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.zip") returned 0
	[0065.285] lstrlenA (lpString="*.zip") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.rar") returned 0
	[0065.285] lstrlenA (lpString="*.rar") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.7z") returned 0
	[0065.285] lstrlenA (lpString="*.7z") returned 4
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.tar") returned 0
	[0065.285] lstrlenA (lpString="*.tar") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.gzip") returned 0
	[0065.285] lstrlenA (lpString="*.gzip") returned 6
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.jpg") returned 0
	[0065.285] lstrlenA (lpString="*.jpg") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.jpeg") returned 0
	[0065.285] lstrlenA (lpString="*.jpeg") returned 6
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.psd") returned 0
	[0065.285] lstrlenA (lpString="*.psd") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.cdr") returned 0
	[0065.285] lstrlenA (lpString="*.cdr") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.dwg") returned 0
	[0065.285] lstrlenA (lpString="*.dwg") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.max") returned 0
	[0065.285] lstrlenA (lpString="*.max") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.bmp") returned 0
	[0065.285] lstrlenA (lpString="*.bmp") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.gif") returned 0
	[0065.285] lstrlenA (lpString="*.gif") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.png") returned 0
	[0065.285] lstrlenA (lpString="*.png") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.doc") returned 0
	[0065.285] lstrlenA (lpString="*.doc") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.docx") returned 0
	[0065.285] lstrlenA (lpString="*.docx") returned 6
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.xls") returned 0
	[0065.285] lstrlenA (lpString="*.xls") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.xlsx") returned 0
	[0065.285] lstrlenA (lpString="*.xlsx") returned 6
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ppt") returned 0
	[0065.285] lstrlenA (lpString="*.ppt") returned 5
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pptx") returned 0
	[0065.285] lstrlenA (lpString="*.pptx") returned 6
	[0065.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.txt") returned 0
	[0065.285] lstrlenA (lpString="*.txt") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pdf") returned 0
	[0065.286] lstrlenA (lpString="*.pdf") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.djvu") returned 0
	[0065.286] lstrlenA (lpString="*.djvu") returned 6
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.htm") returned 0
	[0065.286] lstrlenA (lpString="*.htm") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.html") returned 0
	[0065.286] lstrlenA (lpString="*.html") returned 6
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mdb") returned 0
	[0065.286] lstrlenA (lpString="*.mdb") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.cer") returned 0
	[0065.286] lstrlenA (lpString="*.cer") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.p12") returned 0
	[0065.286] lstrlenA (lpString="*.p12") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pfx") returned 0
	[0065.286] lstrlenA (lpString="*.pfx") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.kwm") returned 0
	[0065.286] lstrlenA (lpString="*.kwm") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pwm") returned 0
	[0065.286] lstrlenA (lpString="*.pwm") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.1cd") returned 0
	[0065.286] lstrlenA (lpString="*.1cd") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.md") returned 0
	[0065.286] lstrlenA (lpString="*.md") returned 4
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mdf") returned 0
	[0065.286] lstrlenA (lpString="*.mdf") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.dbf") returned 0
	[0065.286] lstrlenA (lpString="*.dbf") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.odt") returned 0
	[0065.286] lstrlenA (lpString="*.odt") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.vob") returned 0
	[0065.286] lstrlenA (lpString="*.vob") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ifo") returned 0
	[0065.286] lstrlenA (lpString="*.ifo") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.lnk") returned 0
	[0065.286] lstrlenA (lpString="*.lnk") returned 5
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.torrent") returned 0
	[0065.286] lstrlenA (lpString="*.torrent") returned 9
	[0065.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mov") returned 0
	[0065.286] lstrlenA (lpString="*.mov") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.m2v") returned 0
	[0065.287] lstrlenA (lpString="*.m2v") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.3gp") returned 0
	[0065.287] lstrlenA (lpString="*.3gp") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mpeg") returned 0
	[0065.287] lstrlenA (lpString="*.mpeg") returned 6
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mpg") returned 0
	[0065.287] lstrlenA (lpString="*.mpg") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.flv") returned 0
	[0065.287] lstrlenA (lpString="*.flv") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.avi") returned 0
	[0065.287] lstrlenA (lpString="*.avi") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mp4") returned 0
	[0065.287] lstrlenA (lpString="*.mp4") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wmv") returned 0
	[0065.287] lstrlenA (lpString="*.wmv") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.divx") returned 0
	[0065.287] lstrlenA (lpString="*.divx") returned 6
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mkv") returned 0
	[0065.287] lstrlenA (lpString="*.mkv") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mp3") returned 0
	[0065.287] lstrlenA (lpString="*.mp3") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wav") returned 0
	[0065.287] lstrlenA (lpString="*.wav") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.flac") returned 0
	[0065.287] lstrlenA (lpString="*.flac") returned 6
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ape") returned 0
	[0065.287] lstrlenA (lpString="*.ape") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wma") returned 0
	[0065.287] lstrlenA (lpString="*.wma") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ac3") returned 0
	[0065.287] lstrlenA (lpString="*.ac3") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.exe") returned 0
	[0065.287] lstrlenA (lpString="*.exe") returned 5
	[0065.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.apk") returned 0
	[0065.287] lstrlenA (lpString="*.apk") returned 5
	[0065.287] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.288] lstrcmpA (lpString1=".", lpString2="Desert") returned -1
	[0065.288] lstrcmpA (lpString1="..", lpString2="Desert") returned -1
	[0065.288] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned="Country.css"
	[0065.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Desert" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert"
	[0065.288] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert") returned 101
	[0065.288] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.298] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.298] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.298] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.298] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.298] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.298] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.298] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0065.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0065.299] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0065.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*") returned="*.*"
	[0065.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\"
	[0065.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned=""
	[0065.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt"
	[0065.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt")) returned 0xffffffff
	[0065.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.300] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.300] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.300] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.301] CloseHandle (hObject=0xa0) returned 1
	[0065.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF"
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0065.301] lstrlenA (lpString="*.zip") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0065.301] lstrlenA (lpString="*.rar") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0065.301] lstrlenA (lpString="*.7z") returned 4
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0065.301] lstrlenA (lpString="*.tar") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0065.301] lstrlenA (lpString="*.gzip") returned 6
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0065.301] lstrlenA (lpString="*.jpg") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0065.301] lstrlenA (lpString="*.jpeg") returned 6
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0065.301] lstrlenA (lpString="*.psd") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0065.301] lstrlenA (lpString="*.cdr") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0065.301] lstrlenA (lpString="*.dwg") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.max") returned 0
	[0065.301] lstrlenA (lpString="*.max") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0065.301] lstrlenA (lpString="*.bmp") returned 5
	[0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0065.301] lstrlenA (lpString="*.gif") returned 5
	[0065.301] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF"
	[0065.301] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF"
	[0065.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF."
	[0065.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.Boom"
	[0065.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.302] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94
	[0065.302] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.302] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.302] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x71, lpOverlapped=0x0) returned 1
	[0065.303] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF"
	[0065.303] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.303] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x71, lpOverlapped=0x0) returned 1
	[0065.303] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.303] CloseHandle (hObject=0xa0) returned 1
	[0065.303] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif.boom")) returned 1
	[0065.304] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.304] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.304] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.304] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF"
	[0065.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\"
	[0065.304] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned=""
	[0065.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt"
	[0065.304] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20
	[0065.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF"
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.304] lstrlenA (lpString="*.zip") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.304] lstrlenA (lpString="*.rar") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.304] lstrlenA (lpString="*.7z") returned 4
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.304] lstrlenA (lpString="*.tar") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.304] lstrlenA (lpString="*.gzip") returned 6
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.304] lstrlenA (lpString="*.jpg") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.304] lstrlenA (lpString="*.jpeg") returned 6
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.304] lstrlenA (lpString="*.psd") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.304] lstrlenA (lpString="*.cdr") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.304] lstrlenA (lpString="*.dwg") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.304] lstrlenA (lpString="*.max") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.304] lstrlenA (lpString="*.bmp") returned 5
	[0065.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.304] lstrlenA (lpString="*.gif") returned 5
	[0065.304] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF"
	[0065.304] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF"
	[0065.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF."
	[0065.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.Boom"
	[0065.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.307] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0
	[0065.307] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.307] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.307] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1cd, lpOverlapped=0x0) returned 1
	[0065.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.308] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.308] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1cd, lpOverlapped=0x0) returned 1
	[0065.308] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.308] CloseHandle (hObject=0xa0) returned 1
	[0065.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif.boom")) returned 1
	[0065.310] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.310] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.310] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.310] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\"
	[0065.310] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned=""
	[0065.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt"
	[0065.310] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20
	[0065.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF"
	[0065.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.310] lstrlenA (lpString="*.zip") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.311] lstrlenA (lpString="*.rar") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.311] lstrlenA (lpString="*.7z") returned 4
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.311] lstrlenA (lpString="*.tar") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.311] lstrlenA (lpString="*.gzip") returned 6
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.311] lstrlenA (lpString="*.jpg") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.311] lstrlenA (lpString="*.jpeg") returned 6
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.311] lstrlenA (lpString="*.psd") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.311] lstrlenA (lpString="*.cdr") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.311] lstrlenA (lpString="*.dwg") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.311] lstrlenA (lpString="*.max") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.311] lstrlenA (lpString="*.bmp") returned 5
	[0065.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.311] lstrlenA (lpString="*.gif") returned 5
	[0065.311] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF"
	[0065.311] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF"
	[0065.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF."
	[0065.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.Boom"
	[0065.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.312] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401
	[0065.312] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.312] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.312] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3de, lpOverlapped=0x0) returned 1
	[0065.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.426] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.426] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3de, lpOverlapped=0x0) returned 1
	[0065.426] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.426] CloseHandle (hObject=0xa0) returned 1
	[0065.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif.boom")) returned 1
	[0065.427] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.427] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.427] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.427] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.427] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Desert.css") returned 1
	[0065.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desert.css") returned 1
	[0065.427] lstrcmpiA (lpString1="", lpString2="Desert.css") returned -1
	[0065.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.427] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.427] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.427] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.427] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Desert.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css"
	[0065.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.zip") returned 0
	[0065.428] lstrlenA (lpString="*.zip") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.rar") returned 0
	[0065.428] lstrlenA (lpString="*.rar") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.7z") returned 0
	[0065.428] lstrlenA (lpString="*.7z") returned 4
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.tar") returned 0
	[0065.428] lstrlenA (lpString="*.tar") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.gzip") returned 0
	[0065.428] lstrlenA (lpString="*.gzip") returned 6
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.jpg") returned 0
	[0065.428] lstrlenA (lpString="*.jpg") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.jpeg") returned 0
	[0065.428] lstrlenA (lpString="*.jpeg") returned 6
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.psd") returned 0
	[0065.428] lstrlenA (lpString="*.psd") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.cdr") returned 0
	[0065.428] lstrlenA (lpString="*.cdr") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.dwg") returned 0
	[0065.428] lstrlenA (lpString="*.dwg") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.max") returned 0
	[0065.428] lstrlenA (lpString="*.max") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.bmp") returned 0
	[0065.428] lstrlenA (lpString="*.bmp") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.gif") returned 0
	[0065.428] lstrlenA (lpString="*.gif") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.png") returned 0
	[0065.428] lstrlenA (lpString="*.png") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.doc") returned 0
	[0065.428] lstrlenA (lpString="*.doc") returned 5
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.docx") returned 0
	[0065.428] lstrlenA (lpString="*.docx") returned 6
	[0065.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.xls") returned 0
	[0065.428] lstrlenA (lpString="*.xls") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.xlsx") returned 0
	[0065.429] lstrlenA (lpString="*.xlsx") returned 6
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ppt") returned 0
	[0065.429] lstrlenA (lpString="*.ppt") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pptx") returned 0
	[0065.429] lstrlenA (lpString="*.pptx") returned 6
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.txt") returned 0
	[0065.429] lstrlenA (lpString="*.txt") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pdf") returned 0
	[0065.429] lstrlenA (lpString="*.pdf") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.djvu") returned 0
	[0065.429] lstrlenA (lpString="*.djvu") returned 6
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.htm") returned 0
	[0065.429] lstrlenA (lpString="*.htm") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.html") returned 0
	[0065.429] lstrlenA (lpString="*.html") returned 6
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mdb") returned 0
	[0065.429] lstrlenA (lpString="*.mdb") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.cer") returned 0
	[0065.429] lstrlenA (lpString="*.cer") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.p12") returned 0
	[0065.429] lstrlenA (lpString="*.p12") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pfx") returned 0
	[0065.429] lstrlenA (lpString="*.pfx") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.kwm") returned 0
	[0065.429] lstrlenA (lpString="*.kwm") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pwm") returned 0
	[0065.429] lstrlenA (lpString="*.pwm") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.1cd") returned 0
	[0065.429] lstrlenA (lpString="*.1cd") returned 5
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.md") returned 0
	[0065.429] lstrlenA (lpString="*.md") returned 4
	[0065.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mdf") returned 0
	[0065.430] lstrlenA (lpString="*.mdf") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.dbf") returned 0
	[0065.430] lstrlenA (lpString="*.dbf") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.odt") returned 0
	[0065.430] lstrlenA (lpString="*.odt") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.vob") returned 0
	[0065.430] lstrlenA (lpString="*.vob") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ifo") returned 0
	[0065.430] lstrlenA (lpString="*.ifo") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.lnk") returned 0
	[0065.430] lstrlenA (lpString="*.lnk") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.torrent") returned 0
	[0065.430] lstrlenA (lpString="*.torrent") returned 9
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mov") returned 0
	[0065.430] lstrlenA (lpString="*.mov") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.m2v") returned 0
	[0065.430] lstrlenA (lpString="*.m2v") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.3gp") returned 0
	[0065.430] lstrlenA (lpString="*.3gp") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mpeg") returned 0
	[0065.430] lstrlenA (lpString="*.mpeg") returned 6
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mpg") returned 0
	[0065.430] lstrlenA (lpString="*.mpg") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.flv") returned 0
	[0065.430] lstrlenA (lpString="*.flv") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.avi") returned 0
	[0065.430] lstrlenA (lpString="*.avi") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mp4") returned 0
	[0065.430] lstrlenA (lpString="*.mp4") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wmv") returned 0
	[0065.430] lstrlenA (lpString="*.wmv") returned 5
	[0065.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.divx") returned 0
	[0065.430] lstrlenA (lpString="*.divx") returned 6
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mkv") returned 0
	[0065.431] lstrlenA (lpString="*.mkv") returned 5
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mp3") returned 0
	[0065.431] lstrlenA (lpString="*.mp3") returned 5
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wav") returned 0
	[0065.431] lstrlenA (lpString="*.wav") returned 5
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.flac") returned 0
	[0065.431] lstrlenA (lpString="*.flac") returned 6
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ape") returned 0
	[0065.431] lstrlenA (lpString="*.ape") returned 5
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wma") returned 0
	[0065.431] lstrlenA (lpString="*.wma") returned 5
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ac3") returned 0
	[0065.431] lstrlenA (lpString="*.ac3") returned 5
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.exe") returned 0
	[0065.431] lstrlenA (lpString="*.exe") returned 5
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.apk") returned 0
	[0065.431] lstrlenA (lpString="*.apk") returned 5
	[0065.431] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.431] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.431] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Earthy.css") returned -1
	[0065.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Earthy.css") returned 1
	[0065.431] lstrcmpiA (lpString1="", lpString2="Earthy.css") returned -1
	[0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned="Desert.css"
	[0065.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.431] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.431] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.431] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Earthy.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css"
	[0065.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.zip") returned 0
	[0065.431] lstrlenA (lpString="*.zip") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.rar") returned 0
	[0065.432] lstrlenA (lpString="*.rar") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.7z") returned 0
	[0065.432] lstrlenA (lpString="*.7z") returned 4
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.tar") returned 0
	[0065.432] lstrlenA (lpString="*.tar") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.gzip") returned 0
	[0065.432] lstrlenA (lpString="*.gzip") returned 6
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.jpg") returned 0
	[0065.432] lstrlenA (lpString="*.jpg") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.jpeg") returned 0
	[0065.432] lstrlenA (lpString="*.jpeg") returned 6
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.psd") returned 0
	[0065.432] lstrlenA (lpString="*.psd") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.cdr") returned 0
	[0065.432] lstrlenA (lpString="*.cdr") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.dwg") returned 0
	[0065.432] lstrlenA (lpString="*.dwg") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.max") returned 0
	[0065.432] lstrlenA (lpString="*.max") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.bmp") returned 0
	[0065.432] lstrlenA (lpString="*.bmp") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.gif") returned 0
	[0065.432] lstrlenA (lpString="*.gif") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.png") returned 0
	[0065.432] lstrlenA (lpString="*.png") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.doc") returned 0
	[0065.432] lstrlenA (lpString="*.doc") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.docx") returned 0
	[0065.432] lstrlenA (lpString="*.docx") returned 6
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.xls") returned 0
	[0065.432] lstrlenA (lpString="*.xls") returned 5
	[0065.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.xlsx") returned 0
	[0065.432] lstrlenA (lpString="*.xlsx") returned 6
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ppt") returned 0
	[0065.433] lstrlenA (lpString="*.ppt") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pptx") returned 0
	[0065.433] lstrlenA (lpString="*.pptx") returned 6
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.txt") returned 0
	[0065.433] lstrlenA (lpString="*.txt") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pdf") returned 0
	[0065.433] lstrlenA (lpString="*.pdf") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.djvu") returned 0
	[0065.433] lstrlenA (lpString="*.djvu") returned 6
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.htm") returned 0
	[0065.433] lstrlenA (lpString="*.htm") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.html") returned 0
	[0065.433] lstrlenA (lpString="*.html") returned 6
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mdb") returned 0
	[0065.433] lstrlenA (lpString="*.mdb") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.cer") returned 0
	[0065.433] lstrlenA (lpString="*.cer") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.p12") returned 0
	[0065.433] lstrlenA (lpString="*.p12") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pfx") returned 0
	[0065.433] lstrlenA (lpString="*.pfx") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.kwm") returned 0
	[0065.433] lstrlenA (lpString="*.kwm") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pwm") returned 0
	[0065.433] lstrlenA (lpString="*.pwm") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.1cd") returned 0
	[0065.433] lstrlenA (lpString="*.1cd") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.md") returned 0
	[0065.433] lstrlenA (lpString="*.md") returned 4
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mdf") returned 0
	[0065.433] lstrlenA (lpString="*.mdf") returned 5
	[0065.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.dbf") returned 0
	[0065.434] lstrlenA (lpString="*.dbf") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.odt") returned 0
	[0065.434] lstrlenA (lpString="*.odt") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.vob") returned 0
	[0065.434] lstrlenA (lpString="*.vob") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ifo") returned 0
	[0065.434] lstrlenA (lpString="*.ifo") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.lnk") returned 0
	[0065.434] lstrlenA (lpString="*.lnk") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.torrent") returned 0
	[0065.434] lstrlenA (lpString="*.torrent") returned 9
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mov") returned 0
	[0065.434] lstrlenA (lpString="*.mov") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.m2v") returned 0
	[0065.434] lstrlenA (lpString="*.m2v") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.3gp") returned 0
	[0065.434] lstrlenA (lpString="*.3gp") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mpeg") returned 0
	[0065.434] lstrlenA (lpString="*.mpeg") returned 6
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mpg") returned 0
	[0065.434] lstrlenA (lpString="*.mpg") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.flv") returned 0
	[0065.434] lstrlenA (lpString="*.flv") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.avi") returned 0
	[0065.434] lstrlenA (lpString="*.avi") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mp4") returned 0
	[0065.434] lstrlenA (lpString="*.mp4") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wmv") returned 0
	[0065.434] lstrlenA (lpString="*.wmv") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.divx") returned 0
	[0065.434] lstrlenA (lpString="*.divx") returned 6
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mkv") returned 0
	[0065.434] lstrlenA (lpString="*.mkv") returned 5
	[0065.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mp3") returned 0
	[0065.435] lstrlenA (lpString="*.mp3") returned 5
	[0065.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wav") returned 0
	[0065.435] lstrlenA (lpString="*.wav") returned 5
	[0065.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.flac") returned 0
	[0065.435] lstrlenA (lpString="*.flac") returned 6
	[0065.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ape") returned 0
	[0065.435] lstrlenA (lpString="*.ape") returned 5
	[0065.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wma") returned 0
	[0065.435] lstrlenA (lpString="*.wma") returned 5
	[0065.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ac3") returned 0
	[0065.435] lstrlenA (lpString="*.ac3") returned 5
	[0065.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.exe") returned 0
	[0065.435] lstrlenA (lpString="*.exe") returned 5
	[0065.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.apk") returned 0
	[0065.435] lstrlenA (lpString="*.apk") returned 5
	[0065.435] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.435] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1
	[0065.435] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1
	[0065.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned="Earthy.css"
	[0065.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GrayCheck" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck"
	[0065.435] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck") returned 104
	[0065.435] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.438] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.438] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.438] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.438] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.438] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.438] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.438] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0065.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0065.439] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0065.439] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*") returned="*.*"
	[0065.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\"
	[0065.439] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned=""
	[0065.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt"
	[0065.439] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0xffffffff
	[0065.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.440] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.440] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.440] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.441] CloseHandle (hObject=0xa0) returned 1
	[0065.441] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF"
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0065.441] lstrlenA (lpString="*.zip") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0065.441] lstrlenA (lpString="*.rar") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0065.441] lstrlenA (lpString="*.7z") returned 4
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0065.441] lstrlenA (lpString="*.tar") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0065.441] lstrlenA (lpString="*.gzip") returned 6
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0065.441] lstrlenA (lpString="*.jpg") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0065.441] lstrlenA (lpString="*.jpeg") returned 6
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0065.441] lstrlenA (lpString="*.psd") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0065.441] lstrlenA (lpString="*.cdr") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0065.441] lstrlenA (lpString="*.dwg") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.max") returned 0
	[0065.441] lstrlenA (lpString="*.max") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0065.441] lstrlenA (lpString="*.bmp") returned 5
	[0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0065.442] lstrlenA (lpString="*.gif") returned 5
	[0065.442] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF"
	[0065.442] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF"
	[0065.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF."
	[0065.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.Boom"
	[0065.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.443] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8
	[0065.443] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52c3bfd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.443] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.443] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x195, lpOverlapped=0x0) returned 1
	[0065.444] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF"
	[0065.444] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.444] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x195, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x195, lpOverlapped=0x0) returned 1
	[0065.444] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.444] CloseHandle (hObject=0xa0) returned 1
	[0065.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif.boom")) returned 1
	[0065.446] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.446] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.446] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.446] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF"
	[0065.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\"
	[0065.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned=""
	[0065.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt"
	[0065.447] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20
	[0065.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF"
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.447] lstrlenA (lpString="*.zip") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.447] lstrlenA (lpString="*.rar") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.447] lstrlenA (lpString="*.7z") returned 4
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.447] lstrlenA (lpString="*.tar") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.447] lstrlenA (lpString="*.gzip") returned 6
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.447] lstrlenA (lpString="*.jpg") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.447] lstrlenA (lpString="*.jpeg") returned 6
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.447] lstrlenA (lpString="*.psd") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.447] lstrlenA (lpString="*.cdr") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.447] lstrlenA (lpString="*.dwg") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.447] lstrlenA (lpString="*.max") returned 5
	[0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.447] lstrlenA (lpString="*.bmp") returned 5
	[0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.448] lstrlenA (lpString="*.gif") returned 5
	[0065.448] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF"
	[0065.448] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF"
	[0065.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF."
	[0065.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.Boom"
	[0065.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.449] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.449] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61ab7bf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.449] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.449] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.450] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.450] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.450] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.450] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.450] CloseHandle (hObject=0xa0) returned 1
	[0065.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif.boom")) returned 1
	[0065.451] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.451] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.451] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.451] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.451] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\"
	[0065.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned=""
	[0065.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt"
	[0065.451] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20
	[0065.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF"
	[0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.452] lstrlenA (lpString="*.zip") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.452] lstrlenA (lpString="*.rar") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.452] lstrlenA (lpString="*.7z") returned 4
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.452] lstrlenA (lpString="*.tar") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.452] lstrlenA (lpString="*.gzip") returned 6
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.452] lstrlenA (lpString="*.jpg") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.452] lstrlenA (lpString="*.jpeg") returned 6
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.452] lstrlenA (lpString="*.psd") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.452] lstrlenA (lpString="*.cdr") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.452] lstrlenA (lpString="*.dwg") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.452] lstrlenA (lpString="*.max") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.452] lstrlenA (lpString="*.bmp") returned 5
	[0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.452] lstrlenA (lpString="*.gif") returned 5
	[0065.452] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF"
	[0065.452] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF"
	[0065.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF."
	[0065.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.Boom"
	[0065.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.453] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.453] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61ab7bf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.453] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.453] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.454] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.454] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.454] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.454] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.454] CloseHandle (hObject=0xa0) returned 1
	[0065.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif.boom")) returned 1
	[0065.455] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.455] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.455] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.455] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.455] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrayCheck.css") returned -1
	[0065.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrayCheck.css") returned 1
	[0065.455] lstrcmpiA (lpString1="", lpString2="GrayCheck.css") returned -1
	[0065.455] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.455] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.455] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GrayCheck.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css"
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.zip") returned 0
	[0065.456] lstrlenA (lpString="*.zip") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.rar") returned 0
	[0065.456] lstrlenA (lpString="*.rar") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.7z") returned 0
	[0065.456] lstrlenA (lpString="*.7z") returned 4
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.tar") returned 0
	[0065.456] lstrlenA (lpString="*.tar") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.gzip") returned 0
	[0065.456] lstrlenA (lpString="*.gzip") returned 6
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.jpg") returned 0
	[0065.456] lstrlenA (lpString="*.jpg") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.jpeg") returned 0
	[0065.456] lstrlenA (lpString="*.jpeg") returned 6
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.psd") returned 0
	[0065.456] lstrlenA (lpString="*.psd") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.cdr") returned 0
	[0065.456] lstrlenA (lpString="*.cdr") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.dwg") returned 0
	[0065.456] lstrlenA (lpString="*.dwg") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.max") returned 0
	[0065.456] lstrlenA (lpString="*.max") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.bmp") returned 0
	[0065.456] lstrlenA (lpString="*.bmp") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.gif") returned 0
	[0065.456] lstrlenA (lpString="*.gif") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.png") returned 0
	[0065.456] lstrlenA (lpString="*.png") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.doc") returned 0
	[0065.456] lstrlenA (lpString="*.doc") returned 5
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.docx") returned 0
	[0065.456] lstrlenA (lpString="*.docx") returned 6
	[0065.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.xls") returned 0
	[0065.456] lstrlenA (lpString="*.xls") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.xlsx") returned 0
	[0065.457] lstrlenA (lpString="*.xlsx") returned 6
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ppt") returned 0
	[0065.457] lstrlenA (lpString="*.ppt") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pptx") returned 0
	[0065.457] lstrlenA (lpString="*.pptx") returned 6
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.txt") returned 0
	[0065.457] lstrlenA (lpString="*.txt") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pdf") returned 0
	[0065.457] lstrlenA (lpString="*.pdf") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.djvu") returned 0
	[0065.457] lstrlenA (lpString="*.djvu") returned 6
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.htm") returned 0
	[0065.457] lstrlenA (lpString="*.htm") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.html") returned 0
	[0065.457] lstrlenA (lpString="*.html") returned 6
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mdb") returned 0
	[0065.457] lstrlenA (lpString="*.mdb") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.cer") returned 0
	[0065.457] lstrlenA (lpString="*.cer") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.p12") returned 0
	[0065.457] lstrlenA (lpString="*.p12") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pfx") returned 0
	[0065.457] lstrlenA (lpString="*.pfx") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.kwm") returned 0
	[0065.457] lstrlenA (lpString="*.kwm") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pwm") returned 0
	[0065.457] lstrlenA (lpString="*.pwm") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.1cd") returned 0
	[0065.457] lstrlenA (lpString="*.1cd") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.md") returned 0
	[0065.457] lstrlenA (lpString="*.md") returned 4
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mdf") returned 0
	[0065.457] lstrlenA (lpString="*.mdf") returned 5
	[0065.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.dbf") returned 0
	[0065.458] lstrlenA (lpString="*.dbf") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.odt") returned 0
	[0065.458] lstrlenA (lpString="*.odt") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.vob") returned 0
	[0065.458] lstrlenA (lpString="*.vob") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ifo") returned 0
	[0065.458] lstrlenA (lpString="*.ifo") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.lnk") returned 0
	[0065.458] lstrlenA (lpString="*.lnk") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.torrent") returned 0
	[0065.458] lstrlenA (lpString="*.torrent") returned 9
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mov") returned 0
	[0065.458] lstrlenA (lpString="*.mov") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.m2v") returned 0
	[0065.458] lstrlenA (lpString="*.m2v") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.3gp") returned 0
	[0065.458] lstrlenA (lpString="*.3gp") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mpeg") returned 0
	[0065.458] lstrlenA (lpString="*.mpeg") returned 6
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mpg") returned 0
	[0065.458] lstrlenA (lpString="*.mpg") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.flv") returned 0
	[0065.458] lstrlenA (lpString="*.flv") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.avi") returned 0
	[0065.458] lstrlenA (lpString="*.avi") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mp4") returned 0
	[0065.458] lstrlenA (lpString="*.mp4") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wmv") returned 0
	[0065.458] lstrlenA (lpString="*.wmv") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.divx") returned 0
	[0065.458] lstrlenA (lpString="*.divx") returned 6
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mkv") returned 0
	[0065.458] lstrlenA (lpString="*.mkv") returned 5
	[0065.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mp3") returned 0
	[0065.459] lstrlenA (lpString="*.mp3") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wav") returned 0
	[0065.459] lstrlenA (lpString="*.wav") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.flac") returned 0
	[0065.459] lstrlenA (lpString="*.flac") returned 6
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ape") returned 0
	[0065.459] lstrlenA (lpString="*.ape") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wma") returned 0
	[0065.459] lstrlenA (lpString="*.wma") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ac3") returned 0
	[0065.459] lstrlenA (lpString="*.ac3") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.exe") returned 0
	[0065.459] lstrlenA (lpString="*.exe") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.apk") returned 0
	[0065.459] lstrlenA (lpString="*.apk") returned 5
	[0065.459] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.459] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.459] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GreenTea.css") returned -1
	[0065.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenTea.css") returned 1
	[0065.459] lstrcmpiA (lpString1="", lpString2="GreenTea.css") returned -1
	[0065.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned="GrayCheck.css"
	[0065.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.459] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GreenTea.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css"
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.zip") returned 0
	[0065.459] lstrlenA (lpString="*.zip") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.rar") returned 0
	[0065.459] lstrlenA (lpString="*.rar") returned 5
	[0065.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.7z") returned 0
	[0065.460] lstrlenA (lpString="*.7z") returned 4
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.tar") returned 0
	[0065.460] lstrlenA (lpString="*.tar") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.gzip") returned 0
	[0065.460] lstrlenA (lpString="*.gzip") returned 6
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.jpg") returned 0
	[0065.460] lstrlenA (lpString="*.jpg") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.jpeg") returned 0
	[0065.460] lstrlenA (lpString="*.jpeg") returned 6
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.psd") returned 0
	[0065.460] lstrlenA (lpString="*.psd") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.cdr") returned 0
	[0065.460] lstrlenA (lpString="*.cdr") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.dwg") returned 0
	[0065.460] lstrlenA (lpString="*.dwg") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.max") returned 0
	[0065.460] lstrlenA (lpString="*.max") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.bmp") returned 0
	[0065.460] lstrlenA (lpString="*.bmp") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.gif") returned 0
	[0065.460] lstrlenA (lpString="*.gif") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.png") returned 0
	[0065.460] lstrlenA (lpString="*.png") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.doc") returned 0
	[0065.460] lstrlenA (lpString="*.doc") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.docx") returned 0
	[0065.460] lstrlenA (lpString="*.docx") returned 6
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.xls") returned 0
	[0065.460] lstrlenA (lpString="*.xls") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.xlsx") returned 0
	[0065.460] lstrlenA (lpString="*.xlsx") returned 6
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ppt") returned 0
	[0065.460] lstrlenA (lpString="*.ppt") returned 5
	[0065.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pptx") returned 0
	[0065.461] lstrlenA (lpString="*.pptx") returned 6
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.txt") returned 0
	[0065.461] lstrlenA (lpString="*.txt") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pdf") returned 0
	[0065.461] lstrlenA (lpString="*.pdf") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.djvu") returned 0
	[0065.461] lstrlenA (lpString="*.djvu") returned 6
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.htm") returned 0
	[0065.461] lstrlenA (lpString="*.htm") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.html") returned 0
	[0065.461] lstrlenA (lpString="*.html") returned 6
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mdb") returned 0
	[0065.461] lstrlenA (lpString="*.mdb") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.cer") returned 0
	[0065.461] lstrlenA (lpString="*.cer") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.p12") returned 0
	[0065.461] lstrlenA (lpString="*.p12") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pfx") returned 0
	[0065.461] lstrlenA (lpString="*.pfx") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.kwm") returned 0
	[0065.461] lstrlenA (lpString="*.kwm") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pwm") returned 0
	[0065.461] lstrlenA (lpString="*.pwm") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.1cd") returned 0
	[0065.461] lstrlenA (lpString="*.1cd") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.md") returned 0
	[0065.461] lstrlenA (lpString="*.md") returned 4
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mdf") returned 0
	[0065.461] lstrlenA (lpString="*.mdf") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.dbf") returned 0
	[0065.461] lstrlenA (lpString="*.dbf") returned 5
	[0065.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.odt") returned 0
	[0065.461] lstrlenA (lpString="*.odt") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.vob") returned 0
	[0065.462] lstrlenA (lpString="*.vob") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ifo") returned 0
	[0065.462] lstrlenA (lpString="*.ifo") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.lnk") returned 0
	[0065.462] lstrlenA (lpString="*.lnk") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.torrent") returned 0
	[0065.462] lstrlenA (lpString="*.torrent") returned 9
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mov") returned 0
	[0065.462] lstrlenA (lpString="*.mov") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.m2v") returned 0
	[0065.462] lstrlenA (lpString="*.m2v") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.3gp") returned 0
	[0065.462] lstrlenA (lpString="*.3gp") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mpeg") returned 0
	[0065.462] lstrlenA (lpString="*.mpeg") returned 6
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mpg") returned 0
	[0065.462] lstrlenA (lpString="*.mpg") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.flv") returned 0
	[0065.462] lstrlenA (lpString="*.flv") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.avi") returned 0
	[0065.462] lstrlenA (lpString="*.avi") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mp4") returned 0
	[0065.462] lstrlenA (lpString="*.mp4") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wmv") returned 0
	[0065.462] lstrlenA (lpString="*.wmv") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.divx") returned 0
	[0065.462] lstrlenA (lpString="*.divx") returned 6
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mkv") returned 0
	[0065.462] lstrlenA (lpString="*.mkv") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mp3") returned 0
	[0065.462] lstrlenA (lpString="*.mp3") returned 5
	[0065.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wav") returned 0
	[0065.462] lstrlenA (lpString="*.wav") returned 5
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.flac") returned 0
	[0065.463] lstrlenA (lpString="*.flac") returned 6
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ape") returned 0
	[0065.463] lstrlenA (lpString="*.ape") returned 5
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wma") returned 0
	[0065.463] lstrlenA (lpString="*.wma") returned 5
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ac3") returned 0
	[0065.463] lstrlenA (lpString="*.ac3") returned 5
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.exe") returned 0
	[0065.463] lstrlenA (lpString="*.exe") returned 5
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.apk") returned 0
	[0065.463] lstrlenA (lpString="*.apk") returned 5
	[0065.463] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.463] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.463] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LightSpirit.css") returned -1
	[0065.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightSpirit.css") returned -1
	[0065.463] lstrcmpiA (lpString1="", lpString2="LightSpirit.css") returned -1
	[0065.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned="GreenTea.css"
	[0065.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.463] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="LightSpirit.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css"
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.zip") returned 0
	[0065.463] lstrlenA (lpString="*.zip") returned 5
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.rar") returned 0
	[0065.463] lstrlenA (lpString="*.rar") returned 5
	[0065.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.7z") returned 0
	[0065.463] lstrlenA (lpString="*.7z") returned 4
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.tar") returned 0
	[0065.464] lstrlenA (lpString="*.tar") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.gzip") returned 0
	[0065.464] lstrlenA (lpString="*.gzip") returned 6
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.jpg") returned 0
	[0065.464] lstrlenA (lpString="*.jpg") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.jpeg") returned 0
	[0065.464] lstrlenA (lpString="*.jpeg") returned 6
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.psd") returned 0
	[0065.464] lstrlenA (lpString="*.psd") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.cdr") returned 0
	[0065.464] lstrlenA (lpString="*.cdr") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.dwg") returned 0
	[0065.464] lstrlenA (lpString="*.dwg") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.max") returned 0
	[0065.464] lstrlenA (lpString="*.max") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.bmp") returned 0
	[0065.464] lstrlenA (lpString="*.bmp") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.gif") returned 0
	[0065.464] lstrlenA (lpString="*.gif") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.png") returned 0
	[0065.464] lstrlenA (lpString="*.png") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.doc") returned 0
	[0065.464] lstrlenA (lpString="*.doc") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.docx") returned 0
	[0065.464] lstrlenA (lpString="*.docx") returned 6
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.xls") returned 0
	[0065.464] lstrlenA (lpString="*.xls") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.xlsx") returned 0
	[0065.464] lstrlenA (lpString="*.xlsx") returned 6
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ppt") returned 0
	[0065.464] lstrlenA (lpString="*.ppt") returned 5
	[0065.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pptx") returned 0
	[0065.464] lstrlenA (lpString="*.pptx") returned 6
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.txt") returned 0
	[0065.465] lstrlenA (lpString="*.txt") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pdf") returned 0
	[0065.465] lstrlenA (lpString="*.pdf") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.djvu") returned 0
	[0065.465] lstrlenA (lpString="*.djvu") returned 6
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.htm") returned 0
	[0065.465] lstrlenA (lpString="*.htm") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.html") returned 0
	[0065.465] lstrlenA (lpString="*.html") returned 6
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mdb") returned 0
	[0065.465] lstrlenA (lpString="*.mdb") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.cer") returned 0
	[0065.465] lstrlenA (lpString="*.cer") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.p12") returned 0
	[0065.465] lstrlenA (lpString="*.p12") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pfx") returned 0
	[0065.465] lstrlenA (lpString="*.pfx") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.kwm") returned 0
	[0065.465] lstrlenA (lpString="*.kwm") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pwm") returned 0
	[0065.465] lstrlenA (lpString="*.pwm") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.1cd") returned 0
	[0065.465] lstrlenA (lpString="*.1cd") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.md") returned 0
	[0065.465] lstrlenA (lpString="*.md") returned 4
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mdf") returned 0
	[0065.465] lstrlenA (lpString="*.mdf") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.dbf") returned 0
	[0065.465] lstrlenA (lpString="*.dbf") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.odt") returned 0
	[0065.465] lstrlenA (lpString="*.odt") returned 5
	[0065.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.vob") returned 0
	[0065.466] lstrlenA (lpString="*.vob") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ifo") returned 0
	[0065.466] lstrlenA (lpString="*.ifo") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.lnk") returned 0
	[0065.466] lstrlenA (lpString="*.lnk") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.torrent") returned 0
	[0065.466] lstrlenA (lpString="*.torrent") returned 9
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mov") returned 0
	[0065.466] lstrlenA (lpString="*.mov") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.m2v") returned 0
	[0065.466] lstrlenA (lpString="*.m2v") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.3gp") returned 0
	[0065.466] lstrlenA (lpString="*.3gp") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mpeg") returned 0
	[0065.466] lstrlenA (lpString="*.mpeg") returned 6
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mpg") returned 0
	[0065.466] lstrlenA (lpString="*.mpg") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.flv") returned 0
	[0065.466] lstrlenA (lpString="*.flv") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.avi") returned 0
	[0065.466] lstrlenA (lpString="*.avi") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mp4") returned 0
	[0065.466] lstrlenA (lpString="*.mp4") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wmv") returned 0
	[0065.466] lstrlenA (lpString="*.wmv") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.divx") returned 0
	[0065.466] lstrlenA (lpString="*.divx") returned 6
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mkv") returned 0
	[0065.466] lstrlenA (lpString="*.mkv") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mp3") returned 0
	[0065.466] lstrlenA (lpString="*.mp3") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wav") returned 0
	[0065.466] lstrlenA (lpString="*.wav") returned 5
	[0065.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.flac") returned 0
	[0065.467] lstrlenA (lpString="*.flac") returned 6
	[0065.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ape") returned 0
	[0065.467] lstrlenA (lpString="*.ape") returned 5
	[0065.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wma") returned 0
	[0065.467] lstrlenA (lpString="*.wma") returned 5
	[0065.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ac3") returned 0
	[0065.467] lstrlenA (lpString="*.ac3") returned 5
	[0065.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.exe") returned 0
	[0065.467] lstrlenA (lpString="*.exe") returned 5
	[0065.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.apk") returned 0
	[0065.467] lstrlenA (lpString="*.apk") returned 5
	[0065.467] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.467] lstrcmpA (lpString1=".", lpString2="Lime") returned -1
	[0065.467] lstrcmpA (lpString1="..", lpString2="Lime") returned -1
	[0065.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned="LightSpirit.css"
	[0065.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Lime" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime"
	[0065.467] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime") returned 99
	[0065.467] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.467] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.467] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.467] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.467] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.467] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.467] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.468] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.468] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.468] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*") returned="*.*"
	[0065.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\"
	[0065.468] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned=""
	[0065.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt"
	[0065.468] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\how to decrypt files.txt")) returned 0xffffffff
	[0065.468] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.469] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.469] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.478] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.478] CloseHandle (hObject=0xa0) returned 1
	[0065.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF"
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.479] lstrlenA (lpString="*.zip") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.479] lstrlenA (lpString="*.rar") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.479] lstrlenA (lpString="*.7z") returned 4
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.479] lstrlenA (lpString="*.tar") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.479] lstrlenA (lpString="*.gzip") returned 6
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.479] lstrlenA (lpString="*.jpg") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.479] lstrlenA (lpString="*.jpeg") returned 6
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.479] lstrlenA (lpString="*.psd") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.479] lstrlenA (lpString="*.cdr") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.479] lstrlenA (lpString="*.dwg") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.479] lstrlenA (lpString="*.max") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.479] lstrlenA (lpString="*.bmp") returned 5
	[0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.479] lstrlenA (lpString="*.gif") returned 5
	[0065.479] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF"
	[0065.479] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF"
	[0065.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF."
	[0065.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.Boom"
	[0065.480] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.480] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce
	[0065.480] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66293410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.480] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.480] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ab, lpOverlapped=0x0) returned 1
	[0065.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.481] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.481] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ab, lpOverlapped=0x0) returned 1
	[0065.481] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.482] CloseHandle (hObject=0xa0) returned 1
	[0065.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif.boom")) returned 1
	[0065.482] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.483] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.483] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.483] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\"
	[0065.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned=""
	[0065.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt"
	[0065.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\how to decrypt files.txt")) returned 0x20
	[0065.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF"
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.483] lstrlenA (lpString="*.zip") returned 5
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.483] lstrlenA (lpString="*.rar") returned 5
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.483] lstrlenA (lpString="*.7z") returned 4
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.483] lstrlenA (lpString="*.tar") returned 5
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.483] lstrlenA (lpString="*.gzip") returned 6
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.483] lstrlenA (lpString="*.jpg") returned 5
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.483] lstrlenA (lpString="*.jpeg") returned 6
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.483] lstrlenA (lpString="*.psd") returned 5
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.483] lstrlenA (lpString="*.cdr") returned 5
	[0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.483] lstrlenA (lpString="*.dwg") returned 5
	[0065.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.484] lstrlenA (lpString="*.max") returned 5
	[0065.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.484] lstrlenA (lpString="*.bmp") returned 5
	[0065.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.484] lstrlenA (lpString="*.gif") returned 5
	[0065.484] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF"
	[0065.484] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF"
	[0065.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF."
	[0065.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.Boom"
	[0065.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.484] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b
	[0065.485] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x568309f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.485] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.485] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xe8, lpOverlapped=0x0) returned 1
	[0065.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.486] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.486] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xe8, lpOverlapped=0x0) returned 1
	[0065.486] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.486] CloseHandle (hObject=0xa0) returned 1
	[0065.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif.boom")) returned 1
	[0065.488] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.488] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.488] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.488] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.488] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Lime.css") returned -1
	[0065.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lime.css") returned -1
	[0065.488] lstrcmpiA (lpString1="", lpString2="Lime.css") returned -1
	[0065.489] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Lime.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css"
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.zip") returned 0
	[0065.489] lstrlenA (lpString="*.zip") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.rar") returned 0
	[0065.489] lstrlenA (lpString="*.rar") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.7z") returned 0
	[0065.489] lstrlenA (lpString="*.7z") returned 4
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.tar") returned 0
	[0065.489] lstrlenA (lpString="*.tar") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.gzip") returned 0
	[0065.489] lstrlenA (lpString="*.gzip") returned 6
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.jpg") returned 0
	[0065.489] lstrlenA (lpString="*.jpg") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.jpeg") returned 0
	[0065.489] lstrlenA (lpString="*.jpeg") returned 6
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.psd") returned 0
	[0065.489] lstrlenA (lpString="*.psd") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.cdr") returned 0
	[0065.489] lstrlenA (lpString="*.cdr") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.dwg") returned 0
	[0065.489] lstrlenA (lpString="*.dwg") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.max") returned 0
	[0065.489] lstrlenA (lpString="*.max") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.bmp") returned 0
	[0065.489] lstrlenA (lpString="*.bmp") returned 5
	[0065.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.gif") returned 0
	[0065.490] lstrlenA (lpString="*.gif") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.png") returned 0
	[0065.490] lstrlenA (lpString="*.png") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.doc") returned 0
	[0065.490] lstrlenA (lpString="*.doc") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.docx") returned 0
	[0065.490] lstrlenA (lpString="*.docx") returned 6
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.xls") returned 0
	[0065.490] lstrlenA (lpString="*.xls") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.xlsx") returned 0
	[0065.490] lstrlenA (lpString="*.xlsx") returned 6
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ppt") returned 0
	[0065.490] lstrlenA (lpString="*.ppt") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pptx") returned 0
	[0065.490] lstrlenA (lpString="*.pptx") returned 6
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.txt") returned 0
	[0065.490] lstrlenA (lpString="*.txt") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pdf") returned 0
	[0065.490] lstrlenA (lpString="*.pdf") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.djvu") returned 0
	[0065.490] lstrlenA (lpString="*.djvu") returned 6
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.htm") returned 0
	[0065.490] lstrlenA (lpString="*.htm") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.html") returned 0
	[0065.490] lstrlenA (lpString="*.html") returned 6
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mdb") returned 0
	[0065.490] lstrlenA (lpString="*.mdb") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.cer") returned 0
	[0065.490] lstrlenA (lpString="*.cer") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.p12") returned 0
	[0065.490] lstrlenA (lpString="*.p12") returned 5
	[0065.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pfx") returned 0
	[0065.490] lstrlenA (lpString="*.pfx") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.kwm") returned 0
	[0065.491] lstrlenA (lpString="*.kwm") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pwm") returned 0
	[0065.491] lstrlenA (lpString="*.pwm") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.1cd") returned 0
	[0065.491] lstrlenA (lpString="*.1cd") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.md") returned 0
	[0065.491] lstrlenA (lpString="*.md") returned 4
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mdf") returned 0
	[0065.491] lstrlenA (lpString="*.mdf") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.dbf") returned 0
	[0065.491] lstrlenA (lpString="*.dbf") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.odt") returned 0
	[0065.491] lstrlenA (lpString="*.odt") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.vob") returned 0
	[0065.491] lstrlenA (lpString="*.vob") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ifo") returned 0
	[0065.491] lstrlenA (lpString="*.ifo") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.lnk") returned 0
	[0065.491] lstrlenA (lpString="*.lnk") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.torrent") returned 0
	[0065.491] lstrlenA (lpString="*.torrent") returned 9
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mov") returned 0
	[0065.491] lstrlenA (lpString="*.mov") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.m2v") returned 0
	[0065.491] lstrlenA (lpString="*.m2v") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.3gp") returned 0
	[0065.491] lstrlenA (lpString="*.3gp") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mpeg") returned 0
	[0065.491] lstrlenA (lpString="*.mpeg") returned 6
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mpg") returned 0
	[0065.491] lstrlenA (lpString="*.mpg") returned 5
	[0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.flv") returned 0
	[0065.491] lstrlenA (lpString="*.flv") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.avi") returned 0
	[0065.492] lstrlenA (lpString="*.avi") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mp4") returned 0
	[0065.492] lstrlenA (lpString="*.mp4") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wmv") returned 0
	[0065.492] lstrlenA (lpString="*.wmv") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.divx") returned 0
	[0065.492] lstrlenA (lpString="*.divx") returned 6
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mkv") returned 0
	[0065.492] lstrlenA (lpString="*.mkv") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mp3") returned 0
	[0065.492] lstrlenA (lpString="*.mp3") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wav") returned 0
	[0065.492] lstrlenA (lpString="*.wav") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.flac") returned 0
	[0065.492] lstrlenA (lpString="*.flac") returned 6
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ape") returned 0
	[0065.492] lstrlenA (lpString="*.ape") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wma") returned 0
	[0065.492] lstrlenA (lpString="*.wma") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ac3") returned 0
	[0065.492] lstrlenA (lpString="*.ac3") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.exe") returned 0
	[0065.492] lstrlenA (lpString="*.exe") returned 5
	[0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.apk") returned 0
	[0065.492] lstrlenA (lpString="*.apk") returned 5
	[0065.492] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.492] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.492] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Maroon.css") returned -1
	[0065.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maroon.css") returned -1
	[0065.492] lstrcmpiA (lpString1="", lpString2="Maroon.css") returned -1
	[0065.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned="Lime.css"
	[0065.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.493] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Maroon.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css"
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.zip") returned 0
	[0065.493] lstrlenA (lpString="*.zip") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.rar") returned 0
	[0065.493] lstrlenA (lpString="*.rar") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.7z") returned 0
	[0065.493] lstrlenA (lpString="*.7z") returned 4
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.tar") returned 0
	[0065.493] lstrlenA (lpString="*.tar") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.gzip") returned 0
	[0065.493] lstrlenA (lpString="*.gzip") returned 6
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.jpg") returned 0
	[0065.493] lstrlenA (lpString="*.jpg") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.jpeg") returned 0
	[0065.493] lstrlenA (lpString="*.jpeg") returned 6
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.psd") returned 0
	[0065.493] lstrlenA (lpString="*.psd") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.cdr") returned 0
	[0065.493] lstrlenA (lpString="*.cdr") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.dwg") returned 0
	[0065.493] lstrlenA (lpString="*.dwg") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.max") returned 0
	[0065.493] lstrlenA (lpString="*.max") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.bmp") returned 0
	[0065.493] lstrlenA (lpString="*.bmp") returned 5
	[0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.gif") returned 0
	[0065.493] lstrlenA (lpString="*.gif") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.png") returned 0
	[0065.494] lstrlenA (lpString="*.png") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.doc") returned 0
	[0065.494] lstrlenA (lpString="*.doc") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.docx") returned 0
	[0065.494] lstrlenA (lpString="*.docx") returned 6
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.xls") returned 0
	[0065.494] lstrlenA (lpString="*.xls") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.xlsx") returned 0
	[0065.494] lstrlenA (lpString="*.xlsx") returned 6
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ppt") returned 0
	[0065.494] lstrlenA (lpString="*.ppt") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pptx") returned 0
	[0065.494] lstrlenA (lpString="*.pptx") returned 6
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.txt") returned 0
	[0065.494] lstrlenA (lpString="*.txt") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pdf") returned 0
	[0065.494] lstrlenA (lpString="*.pdf") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.djvu") returned 0
	[0065.494] lstrlenA (lpString="*.djvu") returned 6
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.htm") returned 0
	[0065.494] lstrlenA (lpString="*.htm") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.html") returned 0
	[0065.494] lstrlenA (lpString="*.html") returned 6
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mdb") returned 0
	[0065.494] lstrlenA (lpString="*.mdb") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.cer") returned 0
	[0065.494] lstrlenA (lpString="*.cer") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.p12") returned 0
	[0065.494] lstrlenA (lpString="*.p12") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pfx") returned 0
	[0065.494] lstrlenA (lpString="*.pfx") returned 5
	[0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.kwm") returned 0
	[0065.495] lstrlenA (lpString="*.kwm") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pwm") returned 0
	[0065.495] lstrlenA (lpString="*.pwm") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.1cd") returned 0
	[0065.495] lstrlenA (lpString="*.1cd") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.md") returned 0
	[0065.495] lstrlenA (lpString="*.md") returned 4
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mdf") returned 0
	[0065.495] lstrlenA (lpString="*.mdf") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.dbf") returned 0
	[0065.495] lstrlenA (lpString="*.dbf") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.odt") returned 0
	[0065.495] lstrlenA (lpString="*.odt") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.vob") returned 0
	[0065.495] lstrlenA (lpString="*.vob") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ifo") returned 0
	[0065.495] lstrlenA (lpString="*.ifo") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.lnk") returned 0
	[0065.495] lstrlenA (lpString="*.lnk") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.torrent") returned 0
	[0065.495] lstrlenA (lpString="*.torrent") returned 9
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mov") returned 0
	[0065.495] lstrlenA (lpString="*.mov") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.m2v") returned 0
	[0065.495] lstrlenA (lpString="*.m2v") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.3gp") returned 0
	[0065.495] lstrlenA (lpString="*.3gp") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mpeg") returned 0
	[0065.495] lstrlenA (lpString="*.mpeg") returned 6
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mpg") returned 0
	[0065.495] lstrlenA (lpString="*.mpg") returned 5
	[0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.flv") returned 0
	[0065.495] lstrlenA (lpString="*.flv") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.avi") returned 0
	[0065.496] lstrlenA (lpString="*.avi") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mp4") returned 0
	[0065.496] lstrlenA (lpString="*.mp4") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wmv") returned 0
	[0065.496] lstrlenA (lpString="*.wmv") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.divx") returned 0
	[0065.496] lstrlenA (lpString="*.divx") returned 6
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mkv") returned 0
	[0065.496] lstrlenA (lpString="*.mkv") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mp3") returned 0
	[0065.496] lstrlenA (lpString="*.mp3") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wav") returned 0
	[0065.496] lstrlenA (lpString="*.wav") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.flac") returned 0
	[0065.496] lstrlenA (lpString="*.flac") returned 6
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ape") returned 0
	[0065.496] lstrlenA (lpString="*.ape") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wma") returned 0
	[0065.496] lstrlenA (lpString="*.wma") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ac3") returned 0
	[0065.496] lstrlenA (lpString="*.ac3") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.exe") returned 0
	[0065.496] lstrlenA (lpString="*.exe") returned 5
	[0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.apk") returned 0
	[0065.496] lstrlenA (lpString="*.apk") returned 5
	[0065.496] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.496] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1
	[0065.496] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1
	[0065.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned="Maroon.css"
	[0065.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Oasis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis"
	[0065.496] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis") returned 100
	[0065.496] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.497] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.497] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.497] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.497] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.497] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.498] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0065.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0065.498] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0065.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*") returned="*.*"
	[0065.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\"
	[0065.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned=""
	[0065.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt"
	[0065.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0xffffffff
	[0065.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.499] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.499] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.500] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.500] CloseHandle (hObject=0xa0) returned 1
	[0065.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF"
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0065.500] lstrlenA (lpString="*.zip") returned 5
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0065.500] lstrlenA (lpString="*.rar") returned 5
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0065.500] lstrlenA (lpString="*.7z") returned 4
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0065.500] lstrlenA (lpString="*.tar") returned 5
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0065.500] lstrlenA (lpString="*.gzip") returned 6
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0065.500] lstrlenA (lpString="*.jpg") returned 5
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0065.500] lstrlenA (lpString="*.jpeg") returned 6
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0065.500] lstrlenA (lpString="*.psd") returned 5
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0065.500] lstrlenA (lpString="*.cdr") returned 5
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0065.500] lstrlenA (lpString="*.dwg") returned 5
	[0065.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.max") returned 0
	[0065.500] lstrlenA (lpString="*.max") returned 5
	[0065.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0065.501] lstrlenA (lpString="*.bmp") returned 5
	[0065.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0065.501] lstrlenA (lpString="*.gif") returned 5
	[0065.501] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF"
	[0065.501] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF"
	[0065.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF."
	[0065.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.Boom"
	[0065.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.501] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c
	[0065.502] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5969b6f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.502] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.502] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x849, lpOverlapped=0x0) returned 1
	[0065.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF"
	[0065.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.562] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x849, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x849, lpOverlapped=0x0) returned 1
	[0065.562] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.562] CloseHandle (hObject=0xa0) returned 1
	[0065.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif.boom")) returned 1
	[0065.563] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.563] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.563] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.563] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.563] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF"
	[0065.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\"
	[0065.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned=""
	[0065.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt"
	[0065.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20
	[0065.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF"
	[0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.563] lstrlenA (lpString="*.zip") returned 5
	[0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.563] lstrlenA (lpString="*.rar") returned 5
	[0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.564] lstrlenA (lpString="*.7z") returned 4
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.564] lstrlenA (lpString="*.tar") returned 5
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.564] lstrlenA (lpString="*.gzip") returned 6
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.564] lstrlenA (lpString="*.jpg") returned 5
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.564] lstrlenA (lpString="*.jpeg") returned 6
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.564] lstrlenA (lpString="*.psd") returned 5
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.564] lstrlenA (lpString="*.cdr") returned 5
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.564] lstrlenA (lpString="*.dwg") returned 5
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.564] lstrlenA (lpString="*.max") returned 5
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.564] lstrlenA (lpString="*.bmp") returned 5
	[0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.564] lstrlenA (lpString="*.gif") returned 5
	[0065.564] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF"
	[0065.564] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF"
	[0065.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF."
	[0065.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.Boom"
	[0065.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.567] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0
	[0065.567] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6b22b3b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.568] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1cd, lpOverlapped=0x0) returned 1
	[0065.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.568] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1cd, lpOverlapped=0x0) returned 1
	[0065.569] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.569] CloseHandle (hObject=0xa0) returned 1
	[0065.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif.boom")) returned 1
	[0065.574] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.574] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.574] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.574] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\"
	[0065.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned=""
	[0065.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt"
	[0065.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20
	[0065.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF"
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.574] lstrlenA (lpString="*.zip") returned 5
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.574] lstrlenA (lpString="*.rar") returned 5
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.574] lstrlenA (lpString="*.7z") returned 4
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.574] lstrlenA (lpString="*.tar") returned 5
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.574] lstrlenA (lpString="*.gzip") returned 6
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.574] lstrlenA (lpString="*.jpg") returned 5
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.574] lstrlenA (lpString="*.jpeg") returned 6
	[0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.574] lstrlenA (lpString="*.psd") returned 5
	[0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.575] lstrlenA (lpString="*.cdr") returned 5
	[0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.575] lstrlenA (lpString="*.dwg") returned 5
	[0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.575] lstrlenA (lpString="*.max") returned 5
	[0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.575] lstrlenA (lpString="*.bmp") returned 5
	[0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.575] lstrlenA (lpString="*.gif") returned 5
	[0065.575] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF"
	[0065.575] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF"
	[0065.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF."
	[0065.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.Boom"
	[0065.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.576] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401
	[0065.576] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5969b6f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1
	[0065.576] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.576] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3de, lpOverlapped=0x0) returned 1
	[0065.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.583] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.583] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3de, lpOverlapped=0x0) returned 1
	[0065.584] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.584] CloseHandle (hObject=0xa0) returned 1
	[0065.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif.boom")) returned 1
	[0065.585] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.585] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.585] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.585] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.585] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Oasis.css") returned -1
	[0065.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oasis.css") returned -1
	[0065.585] lstrcmpiA (lpString1="", lpString2="Oasis.css") returned -1
	[0065.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.585] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Oasis.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css"
	[0065.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.zip") returned 0
	[0065.585] lstrlenA (lpString="*.zip") returned 5
	[0065.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.rar") returned 0
	[0065.585] lstrlenA (lpString="*.rar") returned 5
	[0065.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.7z") returned 0
	[0065.585] lstrlenA (lpString="*.7z") returned 4
	[0065.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.tar") returned 0
	[0065.585] lstrlenA (lpString="*.tar") returned 5
	[0065.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.gzip") returned 0
	[0065.585] lstrlenA (lpString="*.gzip") returned 6
	[0065.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.jpg") returned 0
	[0065.586] lstrlenA (lpString="*.jpg") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.jpeg") returned 0
	[0065.586] lstrlenA (lpString="*.jpeg") returned 6
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.psd") returned 0
	[0065.586] lstrlenA (lpString="*.psd") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.cdr") returned 0
	[0065.586] lstrlenA (lpString="*.cdr") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.dwg") returned 0
	[0065.586] lstrlenA (lpString="*.dwg") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.max") returned 0
	[0065.586] lstrlenA (lpString="*.max") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.bmp") returned 0
	[0065.586] lstrlenA (lpString="*.bmp") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.gif") returned 0
	[0065.586] lstrlenA (lpString="*.gif") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.png") returned 0
	[0065.586] lstrlenA (lpString="*.png") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.doc") returned 0
	[0065.586] lstrlenA (lpString="*.doc") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.docx") returned 0
	[0065.586] lstrlenA (lpString="*.docx") returned 6
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.xls") returned 0
	[0065.586] lstrlenA (lpString="*.xls") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.xlsx") returned 0
	[0065.586] lstrlenA (lpString="*.xlsx") returned 6
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ppt") returned 0
	[0065.586] lstrlenA (lpString="*.ppt") returned 5
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pptx") returned 0
	[0065.586] lstrlenA (lpString="*.pptx") returned 6
	[0065.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.txt") returned 0
	[0065.593] lstrlenA (lpString="*.txt") returned 5
	[0065.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pdf") returned 0
	[0065.593] lstrlenA (lpString="*.pdf") returned 5
	[0065.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.djvu") returned 0
	[0065.593] lstrlenA (lpString="*.djvu") returned 6
	[0065.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.htm") returned 0
	[0065.593] lstrlenA (lpString="*.htm") returned 5
	[0065.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.html") returned 0
	[0065.593] lstrlenA (lpString="*.html") returned 6
	[0065.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mdb") returned 0
	[0065.594] lstrlenA (lpString="*.mdb") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.cer") returned 0
	[0065.594] lstrlenA (lpString="*.cer") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.p12") returned 0
	[0065.594] lstrlenA (lpString="*.p12") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pfx") returned 0
	[0065.594] lstrlenA (lpString="*.pfx") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.kwm") returned 0
	[0065.594] lstrlenA (lpString="*.kwm") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pwm") returned 0
	[0065.594] lstrlenA (lpString="*.pwm") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.1cd") returned 0
	[0065.594] lstrlenA (lpString="*.1cd") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.md") returned 0
	[0065.594] lstrlenA (lpString="*.md") returned 4
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mdf") returned 0
	[0065.594] lstrlenA (lpString="*.mdf") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.dbf") returned 0
	[0065.594] lstrlenA (lpString="*.dbf") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.odt") returned 0
	[0065.594] lstrlenA (lpString="*.odt") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.vob") returned 0
	[0065.594] lstrlenA (lpString="*.vob") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ifo") returned 0
	[0065.594] lstrlenA (lpString="*.ifo") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.lnk") returned 0
	[0065.594] lstrlenA (lpString="*.lnk") returned 5
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.torrent") returned 0
	[0065.594] lstrlenA (lpString="*.torrent") returned 9
	[0065.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mov") returned 0
	[0065.594] lstrlenA (lpString="*.mov") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.m2v") returned 0
	[0065.595] lstrlenA (lpString="*.m2v") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.3gp") returned 0
	[0065.595] lstrlenA (lpString="*.3gp") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mpeg") returned 0
	[0065.595] lstrlenA (lpString="*.mpeg") returned 6
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mpg") returned 0
	[0065.595] lstrlenA (lpString="*.mpg") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.flv") returned 0
	[0065.595] lstrlenA (lpString="*.flv") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.avi") returned 0
	[0065.595] lstrlenA (lpString="*.avi") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mp4") returned 0
	[0065.595] lstrlenA (lpString="*.mp4") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wmv") returned 0
	[0065.595] lstrlenA (lpString="*.wmv") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.divx") returned 0
	[0065.595] lstrlenA (lpString="*.divx") returned 6
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mkv") returned 0
	[0065.595] lstrlenA (lpString="*.mkv") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mp3") returned 0
	[0065.595] lstrlenA (lpString="*.mp3") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wav") returned 0
	[0065.595] lstrlenA (lpString="*.wav") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.flac") returned 0
	[0065.595] lstrlenA (lpString="*.flac") returned 6
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ape") returned 0
	[0065.595] lstrlenA (lpString="*.ape") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wma") returned 0
	[0065.595] lstrlenA (lpString="*.wma") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ac3") returned 0
	[0065.595] lstrlenA (lpString="*.ac3") returned 5
	[0065.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.exe") returned 0
	[0065.595] lstrlenA (lpString="*.exe") returned 5
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.apk") returned 0
	[0065.596] lstrlenA (lpString="*.apk") returned 5
	[0065.596] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.596] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.596] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OliveGreen.css") returned -1
	[0065.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OliveGreen.css") returned -1
	[0065.596] lstrcmpiA (lpString1="", lpString2="OliveGreen.css") returned -1
	[0065.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned="Oasis.css"
	[0065.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.596] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="OliveGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css"
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.zip") returned 0
	[0065.596] lstrlenA (lpString="*.zip") returned 5
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.rar") returned 0
	[0065.596] lstrlenA (lpString="*.rar") returned 5
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.7z") returned 0
	[0065.596] lstrlenA (lpString="*.7z") returned 4
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.tar") returned 0
	[0065.596] lstrlenA (lpString="*.tar") returned 5
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.gzip") returned 0
	[0065.596] lstrlenA (lpString="*.gzip") returned 6
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.jpg") returned 0
	[0065.596] lstrlenA (lpString="*.jpg") returned 5
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.jpeg") returned 0
	[0065.596] lstrlenA (lpString="*.jpeg") returned 6
	[0065.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.psd") returned 0
	[0065.596] lstrlenA (lpString="*.psd") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.cdr") returned 0
	[0065.597] lstrlenA (lpString="*.cdr") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.dwg") returned 0
	[0065.597] lstrlenA (lpString="*.dwg") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.max") returned 0
	[0065.597] lstrlenA (lpString="*.max") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.bmp") returned 0
	[0065.597] lstrlenA (lpString="*.bmp") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.gif") returned 0
	[0065.597] lstrlenA (lpString="*.gif") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.png") returned 0
	[0065.597] lstrlenA (lpString="*.png") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.doc") returned 0
	[0065.597] lstrlenA (lpString="*.doc") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.docx") returned 0
	[0065.597] lstrlenA (lpString="*.docx") returned 6
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.xls") returned 0
	[0065.597] lstrlenA (lpString="*.xls") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.xlsx") returned 0
	[0065.597] lstrlenA (lpString="*.xlsx") returned 6
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ppt") returned 0
	[0065.597] lstrlenA (lpString="*.ppt") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pptx") returned 0
	[0065.597] lstrlenA (lpString="*.pptx") returned 6
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.txt") returned 0
	[0065.597] lstrlenA (lpString="*.txt") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pdf") returned 0
	[0065.597] lstrlenA (lpString="*.pdf") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.djvu") returned 0
	[0065.597] lstrlenA (lpString="*.djvu") returned 6
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.htm") returned 0
	[0065.597] lstrlenA (lpString="*.htm") returned 5
	[0065.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.html") returned 0
	[0065.597] lstrlenA (lpString="*.html") returned 6
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mdb") returned 0
	[0065.598] lstrlenA (lpString="*.mdb") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.cer") returned 0
	[0065.598] lstrlenA (lpString="*.cer") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.p12") returned 0
	[0065.598] lstrlenA (lpString="*.p12") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pfx") returned 0
	[0065.598] lstrlenA (lpString="*.pfx") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.kwm") returned 0
	[0065.598] lstrlenA (lpString="*.kwm") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pwm") returned 0
	[0065.598] lstrlenA (lpString="*.pwm") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.1cd") returned 0
	[0065.598] lstrlenA (lpString="*.1cd") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.md") returned 0
	[0065.598] lstrlenA (lpString="*.md") returned 4
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mdf") returned 0
	[0065.598] lstrlenA (lpString="*.mdf") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.dbf") returned 0
	[0065.598] lstrlenA (lpString="*.dbf") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.odt") returned 0
	[0065.598] lstrlenA (lpString="*.odt") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.vob") returned 0
	[0065.598] lstrlenA (lpString="*.vob") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ifo") returned 0
	[0065.598] lstrlenA (lpString="*.ifo") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.lnk") returned 0
	[0065.598] lstrlenA (lpString="*.lnk") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.torrent") returned 0
	[0065.598] lstrlenA (lpString="*.torrent") returned 9
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mov") returned 0
	[0065.598] lstrlenA (lpString="*.mov") returned 5
	[0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.m2v") returned 0
	[0065.598] lstrlenA (lpString="*.m2v") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.3gp") returned 0
	[0065.599] lstrlenA (lpString="*.3gp") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mpeg") returned 0
	[0065.599] lstrlenA (lpString="*.mpeg") returned 6
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mpg") returned 0
	[0065.599] lstrlenA (lpString="*.mpg") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.flv") returned 0
	[0065.599] lstrlenA (lpString="*.flv") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.avi") returned 0
	[0065.599] lstrlenA (lpString="*.avi") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mp4") returned 0
	[0065.599] lstrlenA (lpString="*.mp4") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wmv") returned 0
	[0065.599] lstrlenA (lpString="*.wmv") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.divx") returned 0
	[0065.599] lstrlenA (lpString="*.divx") returned 6
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mkv") returned 0
	[0065.599] lstrlenA (lpString="*.mkv") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mp3") returned 0
	[0065.599] lstrlenA (lpString="*.mp3") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wav") returned 0
	[0065.599] lstrlenA (lpString="*.wav") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.flac") returned 0
	[0065.599] lstrlenA (lpString="*.flac") returned 6
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ape") returned 0
	[0065.599] lstrlenA (lpString="*.ape") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wma") returned 0
	[0065.599] lstrlenA (lpString="*.wma") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ac3") returned 0
	[0065.599] lstrlenA (lpString="*.ac3") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.exe") returned 0
	[0065.599] lstrlenA (lpString="*.exe") returned 5
	[0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.apk") returned 0
	[0065.599] lstrlenA (lpString="*.apk") returned 5
	[0065.600] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.600] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.600] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Premium.css") returned -1
	[0065.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Premium.css") returned -1
	[0065.600] lstrcmpiA (lpString1="", lpString2="Premium.css") returned -1
	[0065.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned="OliveGreen.css"
	[0065.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Premium.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css"
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.zip") returned 0
	[0065.600] lstrlenA (lpString="*.zip") returned 5
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.rar") returned 0
	[0065.600] lstrlenA (lpString="*.rar") returned 5
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.7z") returned 0
	[0065.600] lstrlenA (lpString="*.7z") returned 4
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.tar") returned 0
	[0065.600] lstrlenA (lpString="*.tar") returned 5
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.gzip") returned 0
	[0065.600] lstrlenA (lpString="*.gzip") returned 6
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.jpg") returned 0
	[0065.600] lstrlenA (lpString="*.jpg") returned 5
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.jpeg") returned 0
	[0065.600] lstrlenA (lpString="*.jpeg") returned 6
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.psd") returned 0
	[0065.600] lstrlenA (lpString="*.psd") returned 5
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.cdr") returned 0
	[0065.600] lstrlenA (lpString="*.cdr") returned 5
	[0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.dwg") returned 0
	[0065.601] lstrlenA (lpString="*.dwg") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.max") returned 0
	[0065.601] lstrlenA (lpString="*.max") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.bmp") returned 0
	[0065.601] lstrlenA (lpString="*.bmp") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.gif") returned 0
	[0065.601] lstrlenA (lpString="*.gif") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.png") returned 0
	[0065.601] lstrlenA (lpString="*.png") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.doc") returned 0
	[0065.601] lstrlenA (lpString="*.doc") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.docx") returned 0
	[0065.601] lstrlenA (lpString="*.docx") returned 6
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.xls") returned 0
	[0065.601] lstrlenA (lpString="*.xls") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.xlsx") returned 0
	[0065.601] lstrlenA (lpString="*.xlsx") returned 6
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ppt") returned 0
	[0065.601] lstrlenA (lpString="*.ppt") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pptx") returned 0
	[0065.601] lstrlenA (lpString="*.pptx") returned 6
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.txt") returned 0
	[0065.601] lstrlenA (lpString="*.txt") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pdf") returned 0
	[0065.601] lstrlenA (lpString="*.pdf") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.djvu") returned 0
	[0065.601] lstrlenA (lpString="*.djvu") returned 6
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.htm") returned 0
	[0065.601] lstrlenA (lpString="*.htm") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.html") returned 0
	[0065.601] lstrlenA (lpString="*.html") returned 6
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mdb") returned 0
	[0065.601] lstrlenA (lpString="*.mdb") returned 5
	[0065.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.cer") returned 0
	[0065.602] lstrlenA (lpString="*.cer") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.p12") returned 0
	[0065.602] lstrlenA (lpString="*.p12") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pfx") returned 0
	[0065.602] lstrlenA (lpString="*.pfx") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.kwm") returned 0
	[0065.602] lstrlenA (lpString="*.kwm") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pwm") returned 0
	[0065.602] lstrlenA (lpString="*.pwm") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.1cd") returned 0
	[0065.602] lstrlenA (lpString="*.1cd") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.md") returned 0
	[0065.602] lstrlenA (lpString="*.md") returned 4
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mdf") returned 0
	[0065.602] lstrlenA (lpString="*.mdf") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.dbf") returned 0
	[0065.602] lstrlenA (lpString="*.dbf") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.odt") returned 0
	[0065.602] lstrlenA (lpString="*.odt") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.vob") returned 0
	[0065.602] lstrlenA (lpString="*.vob") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ifo") returned 0
	[0065.602] lstrlenA (lpString="*.ifo") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.lnk") returned 0
	[0065.602] lstrlenA (lpString="*.lnk") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.torrent") returned 0
	[0065.602] lstrlenA (lpString="*.torrent") returned 9
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mov") returned 0
	[0065.602] lstrlenA (lpString="*.mov") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.m2v") returned 0
	[0065.602] lstrlenA (lpString="*.m2v") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.3gp") returned 0
	[0065.602] lstrlenA (lpString="*.3gp") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mpeg") returned 0
	[0065.602] lstrlenA (lpString="*.mpeg") returned 6
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mpg") returned 0
	[0065.602] lstrlenA (lpString="*.mpg") returned 5
	[0065.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.flv") returned 0
	[0065.602] lstrlenA (lpString="*.flv") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.avi") returned 0
	[0065.603] lstrlenA (lpString="*.avi") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mp4") returned 0
	[0065.603] lstrlenA (lpString="*.mp4") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wmv") returned 0
	[0065.603] lstrlenA (lpString="*.wmv") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.divx") returned 0
	[0065.603] lstrlenA (lpString="*.divx") returned 6
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mkv") returned 0
	[0065.603] lstrlenA (lpString="*.mkv") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mp3") returned 0
	[0065.603] lstrlenA (lpString="*.mp3") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wav") returned 0
	[0065.603] lstrlenA (lpString="*.wav") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.flac") returned 0
	[0065.603] lstrlenA (lpString="*.flac") returned 6
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ape") returned 0
	[0065.603] lstrlenA (lpString="*.ape") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wma") returned 0
	[0065.603] lstrlenA (lpString="*.wma") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ac3") returned 0
	[0065.603] lstrlenA (lpString="*.ac3") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.exe") returned 0
	[0065.603] lstrlenA (lpString="*.exe") returned 5
	[0065.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.apk") returned 0
	[0065.603] lstrlenA (lpString="*.apk") returned 5
	[0065.603] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.603] lstrcmpA (lpString1=".", lpString2="Slate") returned -1
	[0065.603] lstrcmpA (lpString1="..", lpString2="Slate") returned -1
	[0065.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned="Premium.css"
	[0065.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Slate" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate"
	[0065.603] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate") returned 100
	[0065.603] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.604] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.604] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.604] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.604] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.604] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.604] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.604] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.604] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*") returned="*.*"
	[0065.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\"
	[0065.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned=""
	[0065.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt"
	[0065.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\how to decrypt files.txt")) returned 0xffffffff
	[0065.605] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.605] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.605] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.606] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.606] CloseHandle (hObject=0xa0) returned 1
	[0065.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF"
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.607] lstrlenA (lpString="*.zip") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.607] lstrlenA (lpString="*.rar") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.607] lstrlenA (lpString="*.7z") returned 4
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.607] lstrlenA (lpString="*.tar") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.607] lstrlenA (lpString="*.gzip") returned 6
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.607] lstrlenA (lpString="*.jpg") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.607] lstrlenA (lpString="*.jpeg") returned 6
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.607] lstrlenA (lpString="*.psd") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.607] lstrlenA (lpString="*.cdr") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.607] lstrlenA (lpString="*.dwg") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.607] lstrlenA (lpString="*.max") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.607] lstrlenA (lpString="*.bmp") returned 5
	[0065.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.607] lstrlenA (lpString="*.gif") returned 5
	[0065.607] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF"
	[0065.607] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF"
	[0065.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF."
	[0065.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.Boom"
	[0065.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.610] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c
	[0065.610] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2e6230, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1
	[0065.610] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.610] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x149, lpOverlapped=0x0) returned 1
	[0065.611] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.611] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.611] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x149, lpOverlapped=0x0) returned 1
	[0065.611] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.611] CloseHandle (hObject=0xa0) returned 1
	[0065.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif.boom")) returned 1
	[0065.612] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.612] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.615] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.615] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.615] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\"
	[0065.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned=""
	[0065.615] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt"
	[0065.615] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\how to decrypt files.txt")) returned 0x20
	[0065.615] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF"
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.616] lstrlenA (lpString="*.zip") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.616] lstrlenA (lpString="*.rar") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.616] lstrlenA (lpString="*.7z") returned 4
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.616] lstrlenA (lpString="*.tar") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.616] lstrlenA (lpString="*.gzip") returned 6
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.616] lstrlenA (lpString="*.jpg") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.616] lstrlenA (lpString="*.jpeg") returned 6
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.616] lstrlenA (lpString="*.psd") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.616] lstrlenA (lpString="*.cdr") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.616] lstrlenA (lpString="*.dwg") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.616] lstrlenA (lpString="*.max") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.616] lstrlenA (lpString="*.bmp") returned 5
	[0065.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.616] lstrlenA (lpString="*.gif") returned 5
	[0065.616] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF"
	[0065.616] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF"
	[0065.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF."
	[0065.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.Boom"
	[0065.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.617] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c
	[0065.617] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9f29b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1
	[0065.617] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.617] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x149, lpOverlapped=0x0) returned 1
	[0065.618] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.618] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.618] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x149, lpOverlapped=0x0) returned 1
	[0065.618] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.618] CloseHandle (hObject=0xa0) returned 1
	[0065.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif.boom")) returned 1
	[0065.621] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.621] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.621] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.621] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.621] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Slate.css") returned -1
	[0065.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slate.css") returned -1
	[0065.621] lstrcmpiA (lpString1="", lpString2="Slate.css") returned -1
	[0065.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Slate.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css"
	[0065.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.zip") returned 0
	[0065.621] lstrlenA (lpString="*.zip") returned 5
	[0065.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.rar") returned 0
	[0065.621] lstrlenA (lpString="*.rar") returned 5
	[0065.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.7z") returned 0
	[0065.621] lstrlenA (lpString="*.7z") returned 4
	[0065.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.tar") returned 0
	[0065.621] lstrlenA (lpString="*.tar") returned 5
	[0065.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.gzip") returned 0
	[0065.621] lstrlenA (lpString="*.gzip") returned 6
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.jpg") returned 0
	[0065.622] lstrlenA (lpString="*.jpg") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.jpeg") returned 0
	[0065.622] lstrlenA (lpString="*.jpeg") returned 6
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.psd") returned 0
	[0065.622] lstrlenA (lpString="*.psd") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.cdr") returned 0
	[0065.622] lstrlenA (lpString="*.cdr") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.dwg") returned 0
	[0065.622] lstrlenA (lpString="*.dwg") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.max") returned 0
	[0065.622] lstrlenA (lpString="*.max") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.bmp") returned 0
	[0065.622] lstrlenA (lpString="*.bmp") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.gif") returned 0
	[0065.622] lstrlenA (lpString="*.gif") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.png") returned 0
	[0065.622] lstrlenA (lpString="*.png") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.doc") returned 0
	[0065.622] lstrlenA (lpString="*.doc") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.docx") returned 0
	[0065.622] lstrlenA (lpString="*.docx") returned 6
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.xls") returned 0
	[0065.622] lstrlenA (lpString="*.xls") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.xlsx") returned 0
	[0065.622] lstrlenA (lpString="*.xlsx") returned 6
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ppt") returned 0
	[0065.622] lstrlenA (lpString="*.ppt") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pptx") returned 0
	[0065.622] lstrlenA (lpString="*.pptx") returned 6
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.txt") returned 0
	[0065.622] lstrlenA (lpString="*.txt") returned 5
	[0065.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pdf") returned 0
	[0065.622] lstrlenA (lpString="*.pdf") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.djvu") returned 0
	[0065.623] lstrlenA (lpString="*.djvu") returned 6
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.htm") returned 0
	[0065.623] lstrlenA (lpString="*.htm") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.html") returned 0
	[0065.623] lstrlenA (lpString="*.html") returned 6
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mdb") returned 0
	[0065.623] lstrlenA (lpString="*.mdb") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.cer") returned 0
	[0065.623] lstrlenA (lpString="*.cer") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.p12") returned 0
	[0065.623] lstrlenA (lpString="*.p12") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pfx") returned 0
	[0065.623] lstrlenA (lpString="*.pfx") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.kwm") returned 0
	[0065.623] lstrlenA (lpString="*.kwm") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pwm") returned 0
	[0065.623] lstrlenA (lpString="*.pwm") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.1cd") returned 0
	[0065.623] lstrlenA (lpString="*.1cd") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.md") returned 0
	[0065.623] lstrlenA (lpString="*.md") returned 4
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mdf") returned 0
	[0065.623] lstrlenA (lpString="*.mdf") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.dbf") returned 0
	[0065.623] lstrlenA (lpString="*.dbf") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.odt") returned 0
	[0065.623] lstrlenA (lpString="*.odt") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.vob") returned 0
	[0065.623] lstrlenA (lpString="*.vob") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ifo") returned 0
	[0065.623] lstrlenA (lpString="*.ifo") returned 5
	[0065.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.lnk") returned 0
	[0065.623] lstrlenA (lpString="*.lnk") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.torrent") returned 0
	[0065.624] lstrlenA (lpString="*.torrent") returned 9
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mov") returned 0
	[0065.624] lstrlenA (lpString="*.mov") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.m2v") returned 0
	[0065.624] lstrlenA (lpString="*.m2v") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.3gp") returned 0
	[0065.624] lstrlenA (lpString="*.3gp") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mpeg") returned 0
	[0065.624] lstrlenA (lpString="*.mpeg") returned 6
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mpg") returned 0
	[0065.624] lstrlenA (lpString="*.mpg") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.flv") returned 0
	[0065.624] lstrlenA (lpString="*.flv") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.avi") returned 0
	[0065.624] lstrlenA (lpString="*.avi") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mp4") returned 0
	[0065.624] lstrlenA (lpString="*.mp4") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wmv") returned 0
	[0065.624] lstrlenA (lpString="*.wmv") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.divx") returned 0
	[0065.624] lstrlenA (lpString="*.divx") returned 6
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mkv") returned 0
	[0065.624] lstrlenA (lpString="*.mkv") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mp3") returned 0
	[0065.624] lstrlenA (lpString="*.mp3") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wav") returned 0
	[0065.624] lstrlenA (lpString="*.wav") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.flac") returned 0
	[0065.624] lstrlenA (lpString="*.flac") returned 6
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ape") returned 0
	[0065.624] lstrlenA (lpString="*.ape") returned 5
	[0065.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wma") returned 0
	[0065.624] lstrlenA (lpString="*.wma") returned 5
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ac3") returned 0
	[0065.625] lstrlenA (lpString="*.ac3") returned 5
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.exe") returned 0
	[0065.625] lstrlenA (lpString="*.exe") returned 5
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.apk") returned 0
	[0065.625] lstrlenA (lpString="*.apk") returned 5
	[0065.625] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.625] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.625] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SlateBlue.css") returned -1
	[0065.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SlateBlue.css") returned -1
	[0065.625] lstrcmpiA (lpString1="", lpString2="SlateBlue.css") returned -1
	[0065.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned="Slate.css"
	[0065.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.625] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.625] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SlateBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css"
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.zip") returned 0
	[0065.625] lstrlenA (lpString="*.zip") returned 5
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.rar") returned 0
	[0065.625] lstrlenA (lpString="*.rar") returned 5
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.7z") returned 0
	[0065.625] lstrlenA (lpString="*.7z") returned 4
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.tar") returned 0
	[0065.625] lstrlenA (lpString="*.tar") returned 5
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.gzip") returned 0
	[0065.625] lstrlenA (lpString="*.gzip") returned 6
	[0065.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.jpg") returned 0
	[0065.625] lstrlenA (lpString="*.jpg") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.jpeg") returned 0
	[0065.626] lstrlenA (lpString="*.jpeg") returned 6
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.psd") returned 0
	[0065.626] lstrlenA (lpString="*.psd") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.cdr") returned 0
	[0065.626] lstrlenA (lpString="*.cdr") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.dwg") returned 0
	[0065.626] lstrlenA (lpString="*.dwg") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.max") returned 0
	[0065.626] lstrlenA (lpString="*.max") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.bmp") returned 0
	[0065.626] lstrlenA (lpString="*.bmp") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.gif") returned 0
	[0065.626] lstrlenA (lpString="*.gif") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.png") returned 0
	[0065.626] lstrlenA (lpString="*.png") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.doc") returned 0
	[0065.626] lstrlenA (lpString="*.doc") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.docx") returned 0
	[0065.626] lstrlenA (lpString="*.docx") returned 6
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.xls") returned 0
	[0065.626] lstrlenA (lpString="*.xls") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.xlsx") returned 0
	[0065.626] lstrlenA (lpString="*.xlsx") returned 6
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ppt") returned 0
	[0065.626] lstrlenA (lpString="*.ppt") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pptx") returned 0
	[0065.626] lstrlenA (lpString="*.pptx") returned 6
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.txt") returned 0
	[0065.626] lstrlenA (lpString="*.txt") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pdf") returned 0
	[0065.626] lstrlenA (lpString="*.pdf") returned 5
	[0065.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.djvu") returned 0
	[0065.626] lstrlenA (lpString="*.djvu") returned 6
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.htm") returned 0
	[0065.627] lstrlenA (lpString="*.htm") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.html") returned 0
	[0065.627] lstrlenA (lpString="*.html") returned 6
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mdb") returned 0
	[0065.627] lstrlenA (lpString="*.mdb") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.cer") returned 0
	[0065.627] lstrlenA (lpString="*.cer") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.p12") returned 0
	[0065.627] lstrlenA (lpString="*.p12") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pfx") returned 0
	[0065.627] lstrlenA (lpString="*.pfx") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.kwm") returned 0
	[0065.627] lstrlenA (lpString="*.kwm") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pwm") returned 0
	[0065.627] lstrlenA (lpString="*.pwm") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.1cd") returned 0
	[0065.627] lstrlenA (lpString="*.1cd") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.md") returned 0
	[0065.627] lstrlenA (lpString="*.md") returned 4
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mdf") returned 0
	[0065.627] lstrlenA (lpString="*.mdf") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.dbf") returned 0
	[0065.627] lstrlenA (lpString="*.dbf") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.odt") returned 0
	[0065.627] lstrlenA (lpString="*.odt") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.vob") returned 0
	[0065.627] lstrlenA (lpString="*.vob") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ifo") returned 0
	[0065.627] lstrlenA (lpString="*.ifo") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.lnk") returned 0
	[0065.627] lstrlenA (lpString="*.lnk") returned 5
	[0065.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.torrent") returned 0
	[0065.627] lstrlenA (lpString="*.torrent") returned 9
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mov") returned 0
	[0065.628] lstrlenA (lpString="*.mov") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.m2v") returned 0
	[0065.628] lstrlenA (lpString="*.m2v") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.3gp") returned 0
	[0065.628] lstrlenA (lpString="*.3gp") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mpeg") returned 0
	[0065.628] lstrlenA (lpString="*.mpeg") returned 6
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mpg") returned 0
	[0065.628] lstrlenA (lpString="*.mpg") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.flv") returned 0
	[0065.628] lstrlenA (lpString="*.flv") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.avi") returned 0
	[0065.628] lstrlenA (lpString="*.avi") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mp4") returned 0
	[0065.628] lstrlenA (lpString="*.mp4") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wmv") returned 0
	[0065.628] lstrlenA (lpString="*.wmv") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.divx") returned 0
	[0065.628] lstrlenA (lpString="*.divx") returned 6
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mkv") returned 0
	[0065.628] lstrlenA (lpString="*.mkv") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mp3") returned 0
	[0065.628] lstrlenA (lpString="*.mp3") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wav") returned 0
	[0065.628] lstrlenA (lpString="*.wav") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.flac") returned 0
	[0065.628] lstrlenA (lpString="*.flac") returned 6
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ape") returned 0
	[0065.628] lstrlenA (lpString="*.ape") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wma") returned 0
	[0065.628] lstrlenA (lpString="*.wma") returned 5
	[0065.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ac3") returned 0
	[0065.629] lstrlenA (lpString="*.ac3") returned 5
	[0065.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.exe") returned 0
	[0065.629] lstrlenA (lpString="*.exe") returned 5
	[0065.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.apk") returned 0
	[0065.629] lstrlenA (lpString="*.apk") returned 5
	[0065.629] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.629] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1
	[0065.629] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1
	[0065.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned="SlateBlue.css"
	[0065.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SoftBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue"
	[0065.629] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue") returned 103
	[0065.629] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.629] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.629] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.629] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.629] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.629] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.629] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.629] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0065.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0065.629] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0065.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*") returned="*.*"
	[0065.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\"
	[0065.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned=""
	[0065.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt"
	[0065.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0xffffffff
	[0065.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.633] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.633] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.634] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.634] CloseHandle (hObject=0xa0) returned 1
	[0065.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif"
	[0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.zip") returned 0
	[0065.634] lstrlenA (lpString="*.zip") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.rar") returned 0
	[0065.635] lstrlenA (lpString="*.rar") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.7z") returned 0
	[0065.635] lstrlenA (lpString="*.7z") returned 4
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.tar") returned 0
	[0065.635] lstrlenA (lpString="*.tar") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gzip") returned 0
	[0065.635] lstrlenA (lpString="*.gzip") returned 6
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpg") returned 0
	[0065.635] lstrlenA (lpString="*.jpg") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpeg") returned 0
	[0065.635] lstrlenA (lpString="*.jpeg") returned 6
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.psd") returned 0
	[0065.635] lstrlenA (lpString="*.psd") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.cdr") returned 0
	[0065.635] lstrlenA (lpString="*.cdr") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.dwg") returned 0
	[0065.635] lstrlenA (lpString="*.dwg") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.max") returned 0
	[0065.635] lstrlenA (lpString="*.max") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.bmp") returned 0
	[0065.635] lstrlenA (lpString="*.bmp") returned 5
	[0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gif") returned 1
	[0065.635] lstrlenA (lpString="*.gif") returned 5
	[0065.635] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif"
	[0065.635] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif"
	[0065.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif."
	[0065.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.Boom"
	[0065.635] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.636] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afa
	[0065.636] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d37e7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1
	[0065.636] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.636] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ad7, lpOverlapped=0x0) returned 1
	[0065.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif"
	[0065.710] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.710] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ad7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ad7, lpOverlapped=0x0) returned 1
	[0065.710] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.710] CloseHandle (hObject=0xa0) returned 1
	[0065.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.boom")) returned 1
	[0065.711] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.711] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.711] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.711] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif"
	[0065.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\"
	[0065.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned=""
	[0065.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt"
	[0065.711] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20
	[0065.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF"
	[0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.711] lstrlenA (lpString="*.zip") returned 5
	[0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.712] lstrlenA (lpString="*.rar") returned 5
	[0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.712] lstrlenA (lpString="*.7z") returned 4
	[0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.712] lstrlenA (lpString="*.tar") returned 5
	[0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.713] lstrlenA (lpString="*.gzip") returned 6
	[0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.713] lstrlenA (lpString="*.jpg") returned 5
	[0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.714] lstrlenA (lpString="*.jpeg") returned 6
	[0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.714] lstrlenA (lpString="*.psd") returned 5
	[0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.714] lstrlenA (lpString="*.cdr") returned 5
	[0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.714] lstrlenA (lpString="*.dwg") returned 5
	[0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.714] lstrlenA (lpString="*.max") returned 5
	[0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.714] lstrlenA (lpString="*.bmp") returned 5
	[0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.714] lstrlenA (lpString="*.gif") returned 5
	[0065.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF"
	[0065.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF"
	[0065.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF."
	[0065.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.Boom"
	[0065.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.715] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.715] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1
	[0065.715] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.715] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.716] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.716] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.716] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.716] CloseHandle (hObject=0xa0) returned 1
	[0065.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif.boom")) returned 1
	[0065.717] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.717] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.717] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.717] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\"
	[0065.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned=""
	[0065.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt"
	[0065.717] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20
	[0065.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF"
	[0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.718] lstrlenA (lpString="*.zip") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.718] lstrlenA (lpString="*.rar") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.718] lstrlenA (lpString="*.7z") returned 4
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.718] lstrlenA (lpString="*.tar") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.718] lstrlenA (lpString="*.gzip") returned 6
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.718] lstrlenA (lpString="*.jpg") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.718] lstrlenA (lpString="*.jpeg") returned 6
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.718] lstrlenA (lpString="*.psd") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.718] lstrlenA (lpString="*.cdr") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.718] lstrlenA (lpString="*.dwg") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.718] lstrlenA (lpString="*.max") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.718] lstrlenA (lpString="*.bmp") returned 5
	[0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.718] lstrlenA (lpString="*.gif") returned 5
	[0065.718] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF"
	[0065.718] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF"
	[0065.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF."
	[0065.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.Boom"
	[0065.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.719] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.719] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1
	[0065.719] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.719] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.720] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.720] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.720] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.720] CloseHandle (hObject=0xa0) returned 1
	[0065.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif.boom")) returned 1
	[0065.721] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.721] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.721] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.721] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.721] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SoftBlue.css") returned -1
	[0065.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.css") returned -1
	[0065.721] lstrcmpiA (lpString1="", lpString2="SoftBlue.css") returned -1
	[0065.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.721] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SoftBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css"
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.zip") returned 0
	[0065.721] lstrlenA (lpString="*.zip") returned 5
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.rar") returned 0
	[0065.721] lstrlenA (lpString="*.rar") returned 5
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.7z") returned 0
	[0065.721] lstrlenA (lpString="*.7z") returned 4
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.tar") returned 0
	[0065.721] lstrlenA (lpString="*.tar") returned 5
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.gzip") returned 0
	[0065.721] lstrlenA (lpString="*.gzip") returned 6
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.jpg") returned 0
	[0065.721] lstrlenA (lpString="*.jpg") returned 5
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.jpeg") returned 0
	[0065.721] lstrlenA (lpString="*.jpeg") returned 6
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.psd") returned 0
	[0065.721] lstrlenA (lpString="*.psd") returned 5
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.cdr") returned 0
	[0065.721] lstrlenA (lpString="*.cdr") returned 5
	[0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.dwg") returned 0
	[0065.722] lstrlenA (lpString="*.dwg") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.max") returned 0
	[0065.722] lstrlenA (lpString="*.max") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.bmp") returned 0
	[0065.722] lstrlenA (lpString="*.bmp") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.gif") returned 0
	[0065.722] lstrlenA (lpString="*.gif") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.png") returned 0
	[0065.722] lstrlenA (lpString="*.png") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.doc") returned 0
	[0065.722] lstrlenA (lpString="*.doc") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.docx") returned 0
	[0065.722] lstrlenA (lpString="*.docx") returned 6
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.xls") returned 0
	[0065.722] lstrlenA (lpString="*.xls") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.xlsx") returned 0
	[0065.722] lstrlenA (lpString="*.xlsx") returned 6
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ppt") returned 0
	[0065.722] lstrlenA (lpString="*.ppt") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pptx") returned 0
	[0065.722] lstrlenA (lpString="*.pptx") returned 6
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.txt") returned 0
	[0065.722] lstrlenA (lpString="*.txt") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pdf") returned 0
	[0065.722] lstrlenA (lpString="*.pdf") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.djvu") returned 0
	[0065.722] lstrlenA (lpString="*.djvu") returned 6
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.htm") returned 0
	[0065.722] lstrlenA (lpString="*.htm") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.html") returned 0
	[0065.722] lstrlenA (lpString="*.html") returned 6
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mdb") returned 0
	[0065.722] lstrlenA (lpString="*.mdb") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.cer") returned 0
	[0065.722] lstrlenA (lpString="*.cer") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.p12") returned 0
	[0065.722] lstrlenA (lpString="*.p12") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pfx") returned 0
	[0065.722] lstrlenA (lpString="*.pfx") returned 5
	[0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.kwm") returned 0
	[0065.722] lstrlenA (lpString="*.kwm") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pwm") returned 0
	[0065.723] lstrlenA (lpString="*.pwm") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.1cd") returned 0
	[0065.723] lstrlenA (lpString="*.1cd") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.md") returned 0
	[0065.723] lstrlenA (lpString="*.md") returned 4
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mdf") returned 0
	[0065.723] lstrlenA (lpString="*.mdf") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.dbf") returned 0
	[0065.723] lstrlenA (lpString="*.dbf") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.odt") returned 0
	[0065.723] lstrlenA (lpString="*.odt") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.vob") returned 0
	[0065.723] lstrlenA (lpString="*.vob") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ifo") returned 0
	[0065.723] lstrlenA (lpString="*.ifo") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.lnk") returned 0
	[0065.723] lstrlenA (lpString="*.lnk") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.torrent") returned 0
	[0065.723] lstrlenA (lpString="*.torrent") returned 9
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mov") returned 0
	[0065.723] lstrlenA (lpString="*.mov") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.m2v") returned 0
	[0065.723] lstrlenA (lpString="*.m2v") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.3gp") returned 0
	[0065.723] lstrlenA (lpString="*.3gp") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mpeg") returned 0
	[0065.723] lstrlenA (lpString="*.mpeg") returned 6
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mpg") returned 0
	[0065.723] lstrlenA (lpString="*.mpg") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.flv") returned 0
	[0065.723] lstrlenA (lpString="*.flv") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.avi") returned 0
	[0065.723] lstrlenA (lpString="*.avi") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mp4") returned 0
	[0065.723] lstrlenA (lpString="*.mp4") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wmv") returned 0
	[0065.723] lstrlenA (lpString="*.wmv") returned 5
	[0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.divx") returned 0
	[0065.724] lstrlenA (lpString="*.divx") returned 6
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mkv") returned 0
	[0065.724] lstrlenA (lpString="*.mkv") returned 5
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mp3") returned 0
	[0065.724] lstrlenA (lpString="*.mp3") returned 5
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wav") returned 0
	[0065.724] lstrlenA (lpString="*.wav") returned 5
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.flac") returned 0
	[0065.724] lstrlenA (lpString="*.flac") returned 6
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ape") returned 0
	[0065.724] lstrlenA (lpString="*.ape") returned 5
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wma") returned 0
	[0065.724] lstrlenA (lpString="*.wma") returned 5
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ac3") returned 0
	[0065.724] lstrlenA (lpString="*.ac3") returned 5
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.exe") returned 0
	[0065.724] lstrlenA (lpString="*.exe") returned 5
	[0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.apk") returned 0
	[0065.724] lstrlenA (lpString="*.apk") returned 5
	[0065.724] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.724] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1
	[0065.724] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1
	[0065.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned="SoftBlue.css"
	[0065.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SpringGreen" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen"
	[0065.724] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen") returned 106
	[0065.724] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.726] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.726] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.726] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.726] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.726] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.726] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.726] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1
	[0065.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1
	[0065.726] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1
	[0065.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*") returned="*.*"
	[0065.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\"
	[0065.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned=""
	[0065.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt"
	[0065.726] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0xffffffff
	[0065.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.727] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.727] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.728] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.728] CloseHandle (hObject=0xa0) returned 1
	[0065.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF"
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0
	[0065.728] lstrlenA (lpString="*.zip") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0
	[0065.728] lstrlenA (lpString="*.rar") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0
	[0065.728] lstrlenA (lpString="*.7z") returned 4
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0
	[0065.728] lstrlenA (lpString="*.tar") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gzip") returned 0
	[0065.728] lstrlenA (lpString="*.gzip") returned 6
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0
	[0065.728] lstrlenA (lpString="*.jpg") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0
	[0065.728] lstrlenA (lpString="*.jpeg") returned 6
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0
	[0065.728] lstrlenA (lpString="*.psd") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.cdr") returned 0
	[0065.728] lstrlenA (lpString="*.cdr") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dwg") returned 0
	[0065.728] lstrlenA (lpString="*.dwg") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.max") returned 0
	[0065.728] lstrlenA (lpString="*.max") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.bmp") returned 0
	[0065.728] lstrlenA (lpString="*.bmp") returned 5
	[0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gif") returned 1
	[0065.728] lstrlenA (lpString="*.gif") returned 5
	[0065.728] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF"
	[0065.728] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF"
	[0065.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF."
	[0065.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.Boom"
	[0065.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.729] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac
	[0065.729] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1
	[0065.730] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.730] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x189, lpOverlapped=0x0) returned 1
	[0065.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF"
	[0065.730] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.730] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x189, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x189, lpOverlapped=0x0) returned 1
	[0065.730] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.732] CloseHandle (hObject=0xa0) returned 1
	[0065.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif.boom")) returned 1
	[0065.734] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.734] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.734] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.734] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF"
	[0065.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\"
	[0065.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned=""
	[0065.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt"
	[0065.734] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20
	[0065.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF"
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.735] lstrlenA (lpString="*.zip") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.735] lstrlenA (lpString="*.rar") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.735] lstrlenA (lpString="*.7z") returned 4
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.735] lstrlenA (lpString="*.tar") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.735] lstrlenA (lpString="*.gzip") returned 6
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.735] lstrlenA (lpString="*.jpg") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.735] lstrlenA (lpString="*.jpeg") returned 6
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.735] lstrlenA (lpString="*.psd") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.735] lstrlenA (lpString="*.cdr") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.735] lstrlenA (lpString="*.dwg") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.735] lstrlenA (lpString="*.max") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.735] lstrlenA (lpString="*.bmp") returned 5
	[0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.735] lstrlenA (lpString="*.gif") returned 5
	[0065.735] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF"
	[0065.735] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF"
	[0065.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF."
	[0065.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.Boom"
	[0065.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.736] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.736] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ab49610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.736] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.736] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.737] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.737] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.737] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.737] CloseHandle (hObject=0xa0) returned 1
	[0065.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif.boom")) returned 1
	[0065.738] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.738] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.738] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.738] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\"
	[0065.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned=""
	[0065.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt"
	[0065.738] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20
	[0065.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF"
	[0065.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.738] lstrlenA (lpString="*.zip") returned 5
	[0065.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.738] lstrlenA (lpString="*.rar") returned 5
	[0065.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.738] lstrlenA (lpString="*.7z") returned 4
	[0065.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.738] lstrlenA (lpString="*.tar") returned 5
	[0065.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.739] lstrlenA (lpString="*.gzip") returned 6
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.739] lstrlenA (lpString="*.jpg") returned 5
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.739] lstrlenA (lpString="*.jpeg") returned 6
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.739] lstrlenA (lpString="*.psd") returned 5
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.739] lstrlenA (lpString="*.cdr") returned 5
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.739] lstrlenA (lpString="*.dwg") returned 5
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.739] lstrlenA (lpString="*.max") returned 5
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.739] lstrlenA (lpString="*.bmp") returned 5
	[0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.739] lstrlenA (lpString="*.gif") returned 5
	[0065.739] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF"
	[0065.739] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF"
	[0065.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF."
	[0065.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.Boom"
	[0065.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.740] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.740] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ab49610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.740] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.740] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.741] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.741] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.741] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.741] CloseHandle (hObject=0xa0) returned 1
	[0065.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif.boom")) returned 1
	[0065.742] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.742] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.742] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.742] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.742] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SpringGreen.css") returned -1
	[0065.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1
	[0065.742] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1
	[0065.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css"
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.zip") returned 0
	[0065.742] lstrlenA (lpString="*.zip") returned 5
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.rar") returned 0
	[0065.742] lstrlenA (lpString="*.rar") returned 5
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.7z") returned 0
	[0065.742] lstrlenA (lpString="*.7z") returned 4
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.tar") returned 0
	[0065.742] lstrlenA (lpString="*.tar") returned 5
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.gzip") returned 0
	[0065.742] lstrlenA (lpString="*.gzip") returned 6
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.jpg") returned 0
	[0065.742] lstrlenA (lpString="*.jpg") returned 5
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.jpeg") returned 0
	[0065.742] lstrlenA (lpString="*.jpeg") returned 6
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.psd") returned 0
	[0065.742] lstrlenA (lpString="*.psd") returned 5
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.cdr") returned 0
	[0065.742] lstrlenA (lpString="*.cdr") returned 5
	[0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.dwg") returned 0
	[0065.743] lstrlenA (lpString="*.dwg") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.max") returned 0
	[0065.743] lstrlenA (lpString="*.max") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.bmp") returned 0
	[0065.743] lstrlenA (lpString="*.bmp") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.gif") returned 0
	[0065.743] lstrlenA (lpString="*.gif") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.png") returned 0
	[0065.743] lstrlenA (lpString="*.png") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.doc") returned 0
	[0065.743] lstrlenA (lpString="*.doc") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.docx") returned 0
	[0065.743] lstrlenA (lpString="*.docx") returned 6
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.xls") returned 0
	[0065.743] lstrlenA (lpString="*.xls") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.xlsx") returned 0
	[0065.743] lstrlenA (lpString="*.xlsx") returned 6
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ppt") returned 0
	[0065.743] lstrlenA (lpString="*.ppt") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pptx") returned 0
	[0065.743] lstrlenA (lpString="*.pptx") returned 6
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.txt") returned 0
	[0065.743] lstrlenA (lpString="*.txt") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pdf") returned 0
	[0065.743] lstrlenA (lpString="*.pdf") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.djvu") returned 0
	[0065.743] lstrlenA (lpString="*.djvu") returned 6
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.htm") returned 0
	[0065.743] lstrlenA (lpString="*.htm") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.html") returned 0
	[0065.743] lstrlenA (lpString="*.html") returned 6
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mdb") returned 0
	[0065.743] lstrlenA (lpString="*.mdb") returned 5
	[0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.cer") returned 0
	[0065.743] lstrlenA (lpString="*.cer") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.p12") returned 0
	[0065.744] lstrlenA (lpString="*.p12") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pfx") returned 0
	[0065.744] lstrlenA (lpString="*.pfx") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.kwm") returned 0
	[0065.744] lstrlenA (lpString="*.kwm") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pwm") returned 0
	[0065.744] lstrlenA (lpString="*.pwm") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.1cd") returned 0
	[0065.744] lstrlenA (lpString="*.1cd") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.md") returned 0
	[0065.744] lstrlenA (lpString="*.md") returned 4
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mdf") returned 0
	[0065.744] lstrlenA (lpString="*.mdf") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.dbf") returned 0
	[0065.744] lstrlenA (lpString="*.dbf") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.odt") returned 0
	[0065.744] lstrlenA (lpString="*.odt") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.vob") returned 0
	[0065.744] lstrlenA (lpString="*.vob") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ifo") returned 0
	[0065.744] lstrlenA (lpString="*.ifo") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.lnk") returned 0
	[0065.744] lstrlenA (lpString="*.lnk") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.torrent") returned 0
	[0065.744] lstrlenA (lpString="*.torrent") returned 9
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mov") returned 0
	[0065.744] lstrlenA (lpString="*.mov") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.m2v") returned 0
	[0065.744] lstrlenA (lpString="*.m2v") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.3gp") returned 0
	[0065.744] lstrlenA (lpString="*.3gp") returned 5
	[0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mpeg") returned 0
	[0065.744] lstrlenA (lpString="*.mpeg") returned 6
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mpg") returned 0
	[0065.745] lstrlenA (lpString="*.mpg") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.flv") returned 0
	[0065.745] lstrlenA (lpString="*.flv") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.avi") returned 0
	[0065.745] lstrlenA (lpString="*.avi") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mp4") returned 0
	[0065.745] lstrlenA (lpString="*.mp4") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wmv") returned 0
	[0065.745] lstrlenA (lpString="*.wmv") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.divx") returned 0
	[0065.745] lstrlenA (lpString="*.divx") returned 6
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mkv") returned 0
	[0065.745] lstrlenA (lpString="*.mkv") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mp3") returned 0
	[0065.745] lstrlenA (lpString="*.mp3") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wav") returned 0
	[0065.745] lstrlenA (lpString="*.wav") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.flac") returned 0
	[0065.745] lstrlenA (lpString="*.flac") returned 6
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ape") returned 0
	[0065.745] lstrlenA (lpString="*.ape") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wma") returned 0
	[0065.745] lstrlenA (lpString="*.wma") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ac3") returned 0
	[0065.745] lstrlenA (lpString="*.ac3") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.exe") returned 0
	[0065.745] lstrlenA (lpString="*.exe") returned 5
	[0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.apk") returned 0
	[0065.745] lstrlenA (lpString="*.apk") returned 5
	[0065.745] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.746] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.746] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts.css") returned -1
	[0065.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1
	[0065.746] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1
	[0065.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css"
	[0065.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.746] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css"
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.zip") returned 0
	[0065.746] lstrlenA (lpString="*.zip") returned 5
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.rar") returned 0
	[0065.746] lstrlenA (lpString="*.rar") returned 5
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.7z") returned 0
	[0065.746] lstrlenA (lpString="*.7z") returned 4
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.tar") returned 0
	[0065.746] lstrlenA (lpString="*.tar") returned 5
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.gzip") returned 0
	[0065.746] lstrlenA (lpString="*.gzip") returned 6
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.jpg") returned 0
	[0065.746] lstrlenA (lpString="*.jpg") returned 5
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.jpeg") returned 0
	[0065.746] lstrlenA (lpString="*.jpeg") returned 6
	[0065.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.psd") returned 0
	[0065.746] lstrlenA (lpString="*.psd") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.cdr") returned 0
	[0065.747] lstrlenA (lpString="*.cdr") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.dwg") returned 0
	[0065.747] lstrlenA (lpString="*.dwg") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.max") returned 0
	[0065.747] lstrlenA (lpString="*.max") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.bmp") returned 0
	[0065.747] lstrlenA (lpString="*.bmp") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.gif") returned 0
	[0065.747] lstrlenA (lpString="*.gif") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.png") returned 0
	[0065.747] lstrlenA (lpString="*.png") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.doc") returned 0
	[0065.747] lstrlenA (lpString="*.doc") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.docx") returned 0
	[0065.747] lstrlenA (lpString="*.docx") returned 6
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.xls") returned 0
	[0065.747] lstrlenA (lpString="*.xls") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.xlsx") returned 0
	[0065.747] lstrlenA (lpString="*.xlsx") returned 6
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ppt") returned 0
	[0065.747] lstrlenA (lpString="*.ppt") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pptx") returned 0
	[0065.747] lstrlenA (lpString="*.pptx") returned 6
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.txt") returned 0
	[0065.747] lstrlenA (lpString="*.txt") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pdf") returned 0
	[0065.747] lstrlenA (lpString="*.pdf") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.djvu") returned 0
	[0065.747] lstrlenA (lpString="*.djvu") returned 6
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.htm") returned 0
	[0065.747] lstrlenA (lpString="*.htm") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.html") returned 0
	[0065.747] lstrlenA (lpString="*.html") returned 6
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mdb") returned 0
	[0065.747] lstrlenA (lpString="*.mdb") returned 5
	[0065.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.cer") returned 0
	[0065.748] lstrlenA (lpString="*.cer") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.p12") returned 0
	[0065.748] lstrlenA (lpString="*.p12") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pfx") returned 0
	[0065.748] lstrlenA (lpString="*.pfx") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.kwm") returned 0
	[0065.748] lstrlenA (lpString="*.kwm") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pwm") returned 0
	[0065.748] lstrlenA (lpString="*.pwm") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.1cd") returned 0
	[0065.748] lstrlenA (lpString="*.1cd") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.md") returned 0
	[0065.748] lstrlenA (lpString="*.md") returned 4
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mdf") returned 0
	[0065.748] lstrlenA (lpString="*.mdf") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.dbf") returned 0
	[0065.748] lstrlenA (lpString="*.dbf") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.odt") returned 0
	[0065.748] lstrlenA (lpString="*.odt") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.vob") returned 0
	[0065.748] lstrlenA (lpString="*.vob") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ifo") returned 0
	[0065.748] lstrlenA (lpString="*.ifo") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.lnk") returned 0
	[0065.748] lstrlenA (lpString="*.lnk") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.torrent") returned 0
	[0065.748] lstrlenA (lpString="*.torrent") returned 9
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mov") returned 0
	[0065.748] lstrlenA (lpString="*.mov") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.m2v") returned 0
	[0065.748] lstrlenA (lpString="*.m2v") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.3gp") returned 0
	[0065.748] lstrlenA (lpString="*.3gp") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mpeg") returned 0
	[0065.748] lstrlenA (lpString="*.mpeg") returned 6
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mpg") returned 0
	[0065.748] lstrlenA (lpString="*.mpg") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.flv") returned 0
	[0065.748] lstrlenA (lpString="*.flv") returned 5
	[0065.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.avi") returned 0
	[0065.748] lstrlenA (lpString="*.avi") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mp4") returned 0
	[0065.749] lstrlenA (lpString="*.mp4") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wmv") returned 0
	[0065.749] lstrlenA (lpString="*.wmv") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.divx") returned 0
	[0065.749] lstrlenA (lpString="*.divx") returned 6
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mkv") returned 0
	[0065.749] lstrlenA (lpString="*.mkv") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mp3") returned 0
	[0065.749] lstrlenA (lpString="*.mp3") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wav") returned 0
	[0065.749] lstrlenA (lpString="*.wav") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.flac") returned 0
	[0065.749] lstrlenA (lpString="*.flac") returned 6
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ape") returned 0
	[0065.749] lstrlenA (lpString="*.ape") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wma") returned 0
	[0065.749] lstrlenA (lpString="*.wma") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ac3") returned 0
	[0065.749] lstrlenA (lpString="*.ac3") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.exe") returned 0
	[0065.749] lstrlenA (lpString="*.exe") returned 5
	[0065.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.apk") returned 0
	[0065.749] lstrlenA (lpString="*.apk") returned 5
	[0065.749] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.749] lstrcmpA (lpString1=".", lpString2="STS2") returned -1
	[0065.749] lstrcmpA (lpString1="..", lpString2="STS2") returned -1
	[0065.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="Sts.css"
	[0065.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2"
	[0065.749] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2") returned 99
	[0065.749] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.752] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.752] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.752] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.752] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.752] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.752] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.752] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0065.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0065.752] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0065.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*") returned="*.*"
	[0065.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\"
	[0065.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned=""
	[0065.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0065.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0xffffffff
	[0065.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.754] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.755] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.755] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.755] CloseHandle (hObject=0xa0) returned 1
	[0065.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif"
	[0065.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.zip") returned 0
	[0065.755] lstrlenA (lpString="*.zip") returned 5
	[0065.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.rar") returned 0
	[0065.756] lstrlenA (lpString="*.rar") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.7z") returned 0
	[0065.756] lstrlenA (lpString="*.7z") returned 4
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.tar") returned 0
	[0065.756] lstrlenA (lpString="*.tar") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.gzip") returned 0
	[0065.756] lstrlenA (lpString="*.gzip") returned 6
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpg") returned 0
	[0065.756] lstrlenA (lpString="*.jpg") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpeg") returned 0
	[0065.756] lstrlenA (lpString="*.jpeg") returned 6
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.psd") returned 0
	[0065.756] lstrlenA (lpString="*.psd") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.cdr") returned 0
	[0065.756] lstrlenA (lpString="*.cdr") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.dwg") returned 0
	[0065.756] lstrlenA (lpString="*.dwg") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.max") returned 0
	[0065.756] lstrlenA (lpString="*.max") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.bmp") returned 0
	[0065.756] lstrlenA (lpString="*.bmp") returned 5
	[0065.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.gif") returned 1
	[0065.756] lstrlenA (lpString="*.gif") returned 5
	[0065.756] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif"
	[0065.756] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif"
	[0065.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif."
	[0065.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.Boom"
	[0065.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.758] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9
	[0065.758] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d416d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.758] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.758] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc6, lpOverlapped=0x0) returned 1
	[0065.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="background.gif"
	[0065.758] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.758] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc6, lpOverlapped=0x0) returned 1
	[0065.759] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.759] CloseHandle (hObject=0xa0) returned 1
	[0065.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.boom")) returned 1
	[0065.759] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.759] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.760] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0065.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0065.760] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0065.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="background.gif"
	[0065.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\"
	[0065.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned=""
	[0065.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0065.760] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20
	[0065.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF"
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0065.760] lstrlenA (lpString="*.zip") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0065.760] lstrlenA (lpString="*.rar") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0065.760] lstrlenA (lpString="*.7z") returned 4
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0065.760] lstrlenA (lpString="*.tar") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0065.760] lstrlenA (lpString="*.gzip") returned 6
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0065.760] lstrlenA (lpString="*.jpg") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0065.760] lstrlenA (lpString="*.jpeg") returned 6
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0065.760] lstrlenA (lpString="*.psd") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0065.760] lstrlenA (lpString="*.cdr") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0065.760] lstrlenA (lpString="*.dwg") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.max") returned 0
	[0065.760] lstrlenA (lpString="*.max") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0065.760] lstrlenA (lpString="*.bmp") returned 5
	[0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0065.760] lstrlenA (lpString="*.gif") returned 5
	[0065.760] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF"
	[0065.761] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF"
	[0065.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF."
	[0065.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.Boom"
	[0065.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.761] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbd
	[0065.761] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d416d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.761] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.761] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc9a, lpOverlapped=0x0) returned 1
	[0065.803] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF"
	[0065.803] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.803] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc9a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc9a, lpOverlapped=0x0) returned 1
	[0065.803] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.803] CloseHandle (hObject=0xa0) returned 1
	[0065.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif.boom")) returned 1
	[0065.804] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.804] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.804] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.804] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF"
	[0065.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\"
	[0065.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned=""
	[0065.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0065.805] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20
	[0065.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF"
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.805] lstrlenA (lpString="*.zip") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.805] lstrlenA (lpString="*.rar") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.805] lstrlenA (lpString="*.7z") returned 4
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.805] lstrlenA (lpString="*.tar") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.805] lstrlenA (lpString="*.gzip") returned 6
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.805] lstrlenA (lpString="*.jpg") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.805] lstrlenA (lpString="*.jpeg") returned 6
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.805] lstrlenA (lpString="*.psd") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.805] lstrlenA (lpString="*.cdr") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.805] lstrlenA (lpString="*.dwg") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.805] lstrlenA (lpString="*.max") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.805] lstrlenA (lpString="*.bmp") returned 5
	[0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.806] lstrlenA (lpString="*.gif") returned 5
	[0065.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF"
	[0065.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF"
	[0065.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF."
	[0065.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.Boom"
	[0065.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.806] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce
	[0065.806] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac07cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.807] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.807] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ab, lpOverlapped=0x0) returned 1
	[0065.808] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.808] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.808] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ab, lpOverlapped=0x0) returned 1
	[0065.808] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.808] CloseHandle (hObject=0xa0) returned 1
	[0065.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif.boom")) returned 1
	[0065.809] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.809] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.810] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.811] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.811] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\"
	[0065.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned=""
	[0065.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt"
	[0065.811] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20
	[0065.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF"
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.811] lstrlenA (lpString="*.zip") returned 5
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.811] lstrlenA (lpString="*.rar") returned 5
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.811] lstrlenA (lpString="*.7z") returned 4
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.811] lstrlenA (lpString="*.tar") returned 5
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.811] lstrlenA (lpString="*.gzip") returned 6
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.811] lstrlenA (lpString="*.jpg") returned 5
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.811] lstrlenA (lpString="*.jpeg") returned 6
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.811] lstrlenA (lpString="*.psd") returned 5
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.811] lstrlenA (lpString="*.cdr") returned 5
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.811] lstrlenA (lpString="*.dwg") returned 5
	[0065.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.811] lstrlenA (lpString="*.max") returned 5
	[0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.830] lstrlenA (lpString="*.bmp") returned 5
	[0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.830] lstrlenA (lpString="*.gif") returned 5
	[0065.830] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF"
	[0065.830] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF"
	[0065.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF."
	[0065.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.Boom"
	[0065.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.830] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108
	[0065.830] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac07cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.830] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.830] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xe5, lpOverlapped=0x0) returned 1
	[0065.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.831] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.831] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xe5, lpOverlapped=0x0) returned 1
	[0065.863] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.864] CloseHandle (hObject=0xa0) returned 1
	[0065.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif.boom")) returned 1
	[0065.864] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.864] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.864] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.865] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts2.css") returned -1
	[0065.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1
	[0065.865] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1
	[0065.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.865] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css"
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.zip") returned 0
	[0065.865] lstrlenA (lpString="*.zip") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.rar") returned 0
	[0065.865] lstrlenA (lpString="*.rar") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.7z") returned 0
	[0065.865] lstrlenA (lpString="*.7z") returned 4
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.tar") returned 0
	[0065.865] lstrlenA (lpString="*.tar") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.gzip") returned 0
	[0065.865] lstrlenA (lpString="*.gzip") returned 6
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.jpg") returned 0
	[0065.865] lstrlenA (lpString="*.jpg") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.jpeg") returned 0
	[0065.865] lstrlenA (lpString="*.jpeg") returned 6
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.psd") returned 0
	[0065.865] lstrlenA (lpString="*.psd") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.cdr") returned 0
	[0065.865] lstrlenA (lpString="*.cdr") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.dwg") returned 0
	[0065.865] lstrlenA (lpString="*.dwg") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.max") returned 0
	[0065.865] lstrlenA (lpString="*.max") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.bmp") returned 0
	[0065.865] lstrlenA (lpString="*.bmp") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.gif") returned 0
	[0065.865] lstrlenA (lpString="*.gif") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.png") returned 0
	[0065.865] lstrlenA (lpString="*.png") returned 5
	[0065.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.doc") returned 0
	[0065.865] lstrlenA (lpString="*.doc") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.docx") returned 0
	[0065.866] lstrlenA (lpString="*.docx") returned 6
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.xls") returned 0
	[0065.866] lstrlenA (lpString="*.xls") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.xlsx") returned 0
	[0065.866] lstrlenA (lpString="*.xlsx") returned 6
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ppt") returned 0
	[0065.866] lstrlenA (lpString="*.ppt") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pptx") returned 0
	[0065.866] lstrlenA (lpString="*.pptx") returned 6
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.txt") returned 0
	[0065.866] lstrlenA (lpString="*.txt") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pdf") returned 0
	[0065.866] lstrlenA (lpString="*.pdf") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.djvu") returned 0
	[0065.866] lstrlenA (lpString="*.djvu") returned 6
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.htm") returned 0
	[0065.866] lstrlenA (lpString="*.htm") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.html") returned 0
	[0065.866] lstrlenA (lpString="*.html") returned 6
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mdb") returned 0
	[0065.866] lstrlenA (lpString="*.mdb") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.cer") returned 0
	[0065.866] lstrlenA (lpString="*.cer") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.p12") returned 0
	[0065.866] lstrlenA (lpString="*.p12") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pfx") returned 0
	[0065.866] lstrlenA (lpString="*.pfx") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.kwm") returned 0
	[0065.866] lstrlenA (lpString="*.kwm") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pwm") returned 0
	[0065.866] lstrlenA (lpString="*.pwm") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.1cd") returned 0
	[0065.866] lstrlenA (lpString="*.1cd") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.md") returned 0
	[0065.866] lstrlenA (lpString="*.md") returned 4
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mdf") returned 0
	[0065.866] lstrlenA (lpString="*.mdf") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.dbf") returned 0
	[0065.866] lstrlenA (lpString="*.dbf") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.odt") returned 0
	[0065.866] lstrlenA (lpString="*.odt") returned 5
	[0065.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.vob") returned 0
	[0065.866] lstrlenA (lpString="*.vob") returned 5
	[0065.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ifo") returned 0
	[0065.869] lstrlenA (lpString="*.ifo") returned 5
	[0065.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.lnk") returned 0
	[0065.869] lstrlenA (lpString="*.lnk") returned 5
	[0065.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.torrent") returned 0
	[0065.869] lstrlenA (lpString="*.torrent") returned 9
	[0065.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mov") returned 0
	[0065.869] lstrlenA (lpString="*.mov") returned 5
	[0065.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.m2v") returned 0
	[0065.869] lstrlenA (lpString="*.m2v") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.3gp") returned 0
	[0065.870] lstrlenA (lpString="*.3gp") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mpeg") returned 0
	[0065.870] lstrlenA (lpString="*.mpeg") returned 6
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mpg") returned 0
	[0065.870] lstrlenA (lpString="*.mpg") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.flv") returned 0
	[0065.870] lstrlenA (lpString="*.flv") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.avi") returned 0
	[0065.870] lstrlenA (lpString="*.avi") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mp4") returned 0
	[0065.870] lstrlenA (lpString="*.mp4") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wmv") returned 0
	[0065.870] lstrlenA (lpString="*.wmv") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.divx") returned 0
	[0065.870] lstrlenA (lpString="*.divx") returned 6
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mkv") returned 0
	[0065.870] lstrlenA (lpString="*.mkv") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mp3") returned 0
	[0065.870] lstrlenA (lpString="*.mp3") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wav") returned 0
	[0065.870] lstrlenA (lpString="*.wav") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.flac") returned 0
	[0065.870] lstrlenA (lpString="*.flac") returned 6
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ape") returned 0
	[0065.870] lstrlenA (lpString="*.ape") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wma") returned 0
	[0065.870] lstrlenA (lpString="*.wma") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ac3") returned 0
	[0065.870] lstrlenA (lpString="*.ac3") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.exe") returned 0
	[0065.870] lstrlenA (lpString="*.exe") returned 5
	[0065.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.apk") returned 0
	[0065.870] lstrlenA (lpString="*.apk") returned 5
	[0065.870] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.870] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1
	[0065.870] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1
	[0065.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="Sts2.css"
	[0065.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl"
	[0065.870] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl") returned 100
	[0065.870] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0065.871] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0065.871] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.871] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0065.871] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0065.871] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.871] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.871] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1
	[0065.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1
	[0065.871] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1
	[0065.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*") returned="*.*"
	[0065.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\"
	[0065.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned=""
	[0065.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0065.872] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0xffffffff
	[0065.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.873] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0065.873] WriteFile (in: hFile=0xa0, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0065.874] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0065.874] CloseHandle (hObject=0xa0) returned 1
	[0065.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif"
	[0065.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.zip") returned 0
	[0065.874] lstrlenA (lpString="*.zip") returned 5
	[0065.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.rar") returned 0
	[0065.874] lstrlenA (lpString="*.rar") returned 5
	[0065.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.7z") returned 0
	[0065.874] lstrlenA (lpString="*.7z") returned 4
	[0065.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.tar") returned 0
	[0065.874] lstrlenA (lpString="*.tar") returned 5
	[0065.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gzip") returned 0
	[0065.874] lstrlenA (lpString="*.gzip") returned 6
	[0065.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpg") returned 0
	[0065.874] lstrlenA (lpString="*.jpg") returned 5
	[0065.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpeg") returned 0
	[0065.874] lstrlenA (lpString="*.jpeg") returned 6
	[0065.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.psd") returned 0
	[0065.875] lstrlenA (lpString="*.psd") returned 5
	[0065.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.cdr") returned 0
	[0065.875] lstrlenA (lpString="*.cdr") returned 5
	[0065.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.dwg") returned 0
	[0065.875] lstrlenA (lpString="*.dwg") returned 5
	[0065.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.max") returned 0
	[0065.875] lstrlenA (lpString="*.max") returned 5
	[0065.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.bmp") returned 0
	[0065.875] lstrlenA (lpString="*.bmp") returned 5
	[0065.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gif") returned 1
	[0065.875] lstrlenA (lpString="*.gif") returned 5
	[0065.875] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif"
	[0065.875] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif"
	[0065.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif."
	[0065.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.Boom"
	[0065.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.876] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32f
	[0065.876] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.876] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.876] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x30c, lpOverlapped=0x0) returned 1
	[0065.894] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="background.gif"
	[0065.894] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.894] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x30c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x30c, lpOverlapped=0x0) returned 1
	[0065.894] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.894] CloseHandle (hObject=0xa0) returned 1
	[0065.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.boom")) returned 1
	[0065.896] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.896] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.897] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1
	[0065.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1
	[0065.897] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1
	[0065.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="background.gif"
	[0065.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\"
	[0065.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned=""
	[0065.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0065.897] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20
	[0065.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF"
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.zip") returned 0
	[0065.897] lstrlenA (lpString="*.zip") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.rar") returned 0
	[0065.897] lstrlenA (lpString="*.rar") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.7z") returned 0
	[0065.897] lstrlenA (lpString="*.7z") returned 4
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.tar") returned 0
	[0065.897] lstrlenA (lpString="*.tar") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gzip") returned 0
	[0065.897] lstrlenA (lpString="*.gzip") returned 6
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpg") returned 0
	[0065.897] lstrlenA (lpString="*.jpg") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpeg") returned 0
	[0065.897] lstrlenA (lpString="*.jpeg") returned 6
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.psd") returned 0
	[0065.897] lstrlenA (lpString="*.psd") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.cdr") returned 0
	[0065.897] lstrlenA (lpString="*.cdr") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.dwg") returned 0
	[0065.897] lstrlenA (lpString="*.dwg") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.max") returned 0
	[0065.897] lstrlenA (lpString="*.max") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.bmp") returned 0
	[0065.897] lstrlenA (lpString="*.bmp") returned 5
	[0065.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gif") returned 1
	[0065.897] lstrlenA (lpString="*.gif") returned 5
	[0065.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF"
	[0065.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF"
	[0065.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF."
	[0065.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.Boom"
	[0065.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.898] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6993
	[0065.898] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1
	[0065.898] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.898] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6970, lpOverlapped=0x0) returned 1
	[0065.908] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF"
	[0065.908] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.908] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6970, lpOverlapped=0x0) returned 1
	[0065.908] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.908] CloseHandle (hObject=0xa0) returned 1
	[0065.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif.boom")) returned 1
	[0065.909] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.909] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.909] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1
	[0065.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1
	[0065.909] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1
	[0065.909] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF"
	[0065.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\"
	[0065.909] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned=""
	[0065.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0065.909] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20
	[0065.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF"
	[0065.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.zip") returned 0
	[0065.909] lstrlenA (lpString="*.zip") returned 5
	[0065.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.rar") returned 0
	[0065.910] lstrlenA (lpString="*.rar") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.7z") returned 0
	[0065.910] lstrlenA (lpString="*.7z") returned 4
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.tar") returned 0
	[0065.910] lstrlenA (lpString="*.tar") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0
	[0065.910] lstrlenA (lpString="*.gzip") returned 6
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0
	[0065.910] lstrlenA (lpString="*.jpg") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0
	[0065.910] lstrlenA (lpString="*.jpeg") returned 6
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.psd") returned 0
	[0065.910] lstrlenA (lpString="*.psd") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0
	[0065.910] lstrlenA (lpString="*.cdr") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0
	[0065.910] lstrlenA (lpString="*.dwg") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.max") returned 0
	[0065.910] lstrlenA (lpString="*.max") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0
	[0065.910] lstrlenA (lpString="*.bmp") returned 5
	[0065.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gif") returned 1
	[0065.910] lstrlenA (lpString="*.gif") returned 5
	[0065.910] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF"
	[0065.910] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF"
	[0065.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF."
	[0065.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.Boom"
	[0065.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.911] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155
	[0065.911] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0065.911] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.911] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x132, lpOverlapped=0x0) returned 1
	[0065.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.911] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.911] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x132, lpOverlapped=0x0) returned 1
	[0065.912] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.912] CloseHandle (hObject=0xa0) returned 1
	[0065.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif.boom")) returned 1
	[0065.912] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0065.912] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0
	[0065.912] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1
	[0065.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1
	[0065.912] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1
	[0065.912] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF"
	[0065.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\"
	[0065.912] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned=""
	[0065.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt"
	[0065.912] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20
	[0065.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF"
	[0065.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.zip") returned 0
	[0065.912] lstrlenA (lpString="*.zip") returned 5
	[0065.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.rar") returned 0
	[0065.912] lstrlenA (lpString="*.rar") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.7z") returned 0
	[0065.913] lstrlenA (lpString="*.7z") returned 4
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.tar") returned 0
	[0065.913] lstrlenA (lpString="*.tar") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gzip") returned 0
	[0065.913] lstrlenA (lpString="*.gzip") returned 6
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpg") returned 0
	[0065.913] lstrlenA (lpString="*.jpg") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0
	[0065.913] lstrlenA (lpString="*.jpeg") returned 6
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.psd") returned 0
	[0065.913] lstrlenA (lpString="*.psd") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.cdr") returned 0
	[0065.913] lstrlenA (lpString="*.cdr") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.dwg") returned 0
	[0065.913] lstrlenA (lpString="*.dwg") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.max") returned 0
	[0065.913] lstrlenA (lpString="*.max") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.bmp") returned 0
	[0065.913] lstrlenA (lpString="*.bmp") returned 5
	[0065.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gif") returned 1
	[0065.913] lstrlenA (lpString="*.gif") returned 5
	[0065.913] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF"
	[0065.913] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF"
	[0065.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF."
	[0065.913] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.Boom"
	[0065.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
	[0065.913] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde
	[0065.913] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0065.913] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.914] ReadFile (in: hFile=0xa0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xbb, lpOverlapped=0x0) returned 1
	[0065.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="TAB_ON.GIF"
	[0065.914] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.914] WriteFile (in: hFile=0xa0, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xbb, lpOverlapped=0x0) returned 1
	[0065.914] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.914] CloseHandle (hObject=0xa0) returned 1
	[0065.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif.boom")) returned 1
	[0065.915] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0065.915] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0065.915] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.915] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.915] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Swirl.css") returned -1
	[0065.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1
	[0065.915] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1
	[0065.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*"
	[0065.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.915] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.915] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css"
	[0065.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.zip") returned 0
	[0065.915] lstrlenA (lpString="*.zip") returned 5
	[0065.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.rar") returned 0
	[0065.915] lstrlenA (lpString="*.rar") returned 5
	[0065.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.7z") returned 0
	[0065.915] lstrlenA (lpString="*.7z") returned 4
	[0065.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.tar") returned 0
	[0065.915] lstrlenA (lpString="*.tar") returned 5
	[0065.915] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.gzip") returned 0
	[0065.916] lstrlenA (lpString="*.gzip") returned 6
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.jpg") returned 0
	[0065.916] lstrlenA (lpString="*.jpg") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.jpeg") returned 0
	[0065.916] lstrlenA (lpString="*.jpeg") returned 6
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.psd") returned 0
	[0065.916] lstrlenA (lpString="*.psd") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.cdr") returned 0
	[0065.916] lstrlenA (lpString="*.cdr") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.dwg") returned 0
	[0065.916] lstrlenA (lpString="*.dwg") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.max") returned 0
	[0065.916] lstrlenA (lpString="*.max") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.bmp") returned 0
	[0065.916] lstrlenA (lpString="*.bmp") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.gif") returned 0
	[0065.916] lstrlenA (lpString="*.gif") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.png") returned 0
	[0065.916] lstrlenA (lpString="*.png") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.doc") returned 0
	[0065.916] lstrlenA (lpString="*.doc") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.docx") returned 0
	[0065.916] lstrlenA (lpString="*.docx") returned 6
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.xls") returned 0
	[0065.916] lstrlenA (lpString="*.xls") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.xlsx") returned 0
	[0065.916] lstrlenA (lpString="*.xlsx") returned 6
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ppt") returned 0
	[0065.916] lstrlenA (lpString="*.ppt") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pptx") returned 0
	[0065.916] lstrlenA (lpString="*.pptx") returned 6
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.txt") returned 0
	[0065.916] lstrlenA (lpString="*.txt") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pdf") returned 0
	[0065.916] lstrlenA (lpString="*.pdf") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.djvu") returned 0
	[0065.916] lstrlenA (lpString="*.djvu") returned 6
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.htm") returned 0
	[0065.916] lstrlenA (lpString="*.htm") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.html") returned 0
	[0065.916] lstrlenA (lpString="*.html") returned 6
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mdb") returned 0
	[0065.916] lstrlenA (lpString="*.mdb") returned 5
	[0065.916] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.cer") returned 0
	[0065.916] lstrlenA (lpString="*.cer") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.p12") returned 0
	[0065.917] lstrlenA (lpString="*.p12") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pfx") returned 0
	[0065.917] lstrlenA (lpString="*.pfx") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.kwm") returned 0
	[0065.917] lstrlenA (lpString="*.kwm") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pwm") returned 0
	[0065.917] lstrlenA (lpString="*.pwm") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.1cd") returned 0
	[0065.917] lstrlenA (lpString="*.1cd") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.md") returned 0
	[0065.917] lstrlenA (lpString="*.md") returned 4
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mdf") returned 0
	[0065.917] lstrlenA (lpString="*.mdf") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.dbf") returned 0
	[0065.917] lstrlenA (lpString="*.dbf") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.odt") returned 0
	[0065.917] lstrlenA (lpString="*.odt") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.vob") returned 0
	[0065.917] lstrlenA (lpString="*.vob") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ifo") returned 0
	[0065.917] lstrlenA (lpString="*.ifo") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.lnk") returned 0
	[0065.917] lstrlenA (lpString="*.lnk") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.torrent") returned 0
	[0065.917] lstrlenA (lpString="*.torrent") returned 9
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mov") returned 0
	[0065.917] lstrlenA (lpString="*.mov") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.m2v") returned 0
	[0065.917] lstrlenA (lpString="*.m2v") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.3gp") returned 0
	[0065.917] lstrlenA (lpString="*.3gp") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mpeg") returned 0
	[0065.917] lstrlenA (lpString="*.mpeg") returned 6
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mpg") returned 0
	[0065.917] lstrlenA (lpString="*.mpg") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.flv") returned 0
	[0065.917] lstrlenA (lpString="*.flv") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.avi") returned 0
	[0065.917] lstrlenA (lpString="*.avi") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mp4") returned 0
	[0065.917] lstrlenA (lpString="*.mp4") returned 5
	[0065.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wmv") returned 0
	[0065.917] lstrlenA (lpString="*.wmv") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.divx") returned 0
	[0065.918] lstrlenA (lpString="*.divx") returned 6
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mkv") returned 0
	[0065.918] lstrlenA (lpString="*.mkv") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mp3") returned 0
	[0065.918] lstrlenA (lpString="*.mp3") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wav") returned 0
	[0065.918] lstrlenA (lpString="*.wav") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.flac") returned 0
	[0065.918] lstrlenA (lpString="*.flac") returned 6
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ape") returned 0
	[0065.918] lstrlenA (lpString="*.ape") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wma") returned 0
	[0065.918] lstrlenA (lpString="*.wma") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ac3") returned 0
	[0065.918] lstrlenA (lpString="*.ac3") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.exe") returned 0
	[0065.918] lstrlenA (lpString="*.exe") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.apk") returned 0
	[0065.918] lstrlenA (lpString="*.apk") returned 5
	[0065.918] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.918] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.918] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Teal.css") returned -1
	[0065.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1
	[0065.918] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1
	[0065.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="Swirl.css"
	[0065.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.918] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.918] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.918] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css"
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.zip") returned 0
	[0065.918] lstrlenA (lpString="*.zip") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.rar") returned 0
	[0065.918] lstrlenA (lpString="*.rar") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.7z") returned 0
	[0065.918] lstrlenA (lpString="*.7z") returned 4
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.tar") returned 0
	[0065.918] lstrlenA (lpString="*.tar") returned 5
	[0065.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.gzip") returned 0
	[0065.918] lstrlenA (lpString="*.gzip") returned 6
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.jpg") returned 0
	[0065.919] lstrlenA (lpString="*.jpg") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.jpeg") returned 0
	[0065.919] lstrlenA (lpString="*.jpeg") returned 6
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.psd") returned 0
	[0065.919] lstrlenA (lpString="*.psd") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.cdr") returned 0
	[0065.919] lstrlenA (lpString="*.cdr") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.dwg") returned 0
	[0065.919] lstrlenA (lpString="*.dwg") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.max") returned 0
	[0065.919] lstrlenA (lpString="*.max") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.bmp") returned 0
	[0065.919] lstrlenA (lpString="*.bmp") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.gif") returned 0
	[0065.919] lstrlenA (lpString="*.gif") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.png") returned 0
	[0065.919] lstrlenA (lpString="*.png") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.doc") returned 0
	[0065.919] lstrlenA (lpString="*.doc") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.docx") returned 0
	[0065.919] lstrlenA (lpString="*.docx") returned 6
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.xls") returned 0
	[0065.919] lstrlenA (lpString="*.xls") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.xlsx") returned 0
	[0065.919] lstrlenA (lpString="*.xlsx") returned 6
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ppt") returned 0
	[0065.919] lstrlenA (lpString="*.ppt") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pptx") returned 0
	[0065.919] lstrlenA (lpString="*.pptx") returned 6
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.txt") returned 0
	[0065.919] lstrlenA (lpString="*.txt") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pdf") returned 0
	[0065.919] lstrlenA (lpString="*.pdf") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.djvu") returned 0
	[0065.919] lstrlenA (lpString="*.djvu") returned 6
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.htm") returned 0
	[0065.919] lstrlenA (lpString="*.htm") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.html") returned 0
	[0065.919] lstrlenA (lpString="*.html") returned 6
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mdb") returned 0
	[0065.919] lstrlenA (lpString="*.mdb") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.cer") returned 0
	[0065.919] lstrlenA (lpString="*.cer") returned 5
	[0065.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.p12") returned 0
	[0065.920] lstrlenA (lpString="*.p12") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pfx") returned 0
	[0065.920] lstrlenA (lpString="*.pfx") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.kwm") returned 0
	[0065.920] lstrlenA (lpString="*.kwm") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pwm") returned 0
	[0065.920] lstrlenA (lpString="*.pwm") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.1cd") returned 0
	[0065.920] lstrlenA (lpString="*.1cd") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.md") returned 0
	[0065.920] lstrlenA (lpString="*.md") returned 4
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mdf") returned 0
	[0065.920] lstrlenA (lpString="*.mdf") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.dbf") returned 0
	[0065.920] lstrlenA (lpString="*.dbf") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.odt") returned 0
	[0065.920] lstrlenA (lpString="*.odt") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.vob") returned 0
	[0065.920] lstrlenA (lpString="*.vob") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ifo") returned 0
	[0065.920] lstrlenA (lpString="*.ifo") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.lnk") returned 0
	[0065.920] lstrlenA (lpString="*.lnk") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.torrent") returned 0
	[0065.920] lstrlenA (lpString="*.torrent") returned 9
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mov") returned 0
	[0065.920] lstrlenA (lpString="*.mov") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.m2v") returned 0
	[0065.920] lstrlenA (lpString="*.m2v") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.3gp") returned 0
	[0065.920] lstrlenA (lpString="*.3gp") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mpeg") returned 0
	[0065.920] lstrlenA (lpString="*.mpeg") returned 6
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mpg") returned 0
	[0065.920] lstrlenA (lpString="*.mpg") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.flv") returned 0
	[0065.920] lstrlenA (lpString="*.flv") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.avi") returned 0
	[0065.920] lstrlenA (lpString="*.avi") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mp4") returned 0
	[0065.920] lstrlenA (lpString="*.mp4") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wmv") returned 0
	[0065.920] lstrlenA (lpString="*.wmv") returned 5
	[0065.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.divx") returned 0
	[0065.921] lstrlenA (lpString="*.divx") returned 6
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mkv") returned 0
	[0065.921] lstrlenA (lpString="*.mkv") returned 5
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mp3") returned 0
	[0065.921] lstrlenA (lpString="*.mp3") returned 5
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wav") returned 0
	[0065.921] lstrlenA (lpString="*.wav") returned 5
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.flac") returned 0
	[0065.921] lstrlenA (lpString="*.flac") returned 6
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ape") returned 0
	[0065.921] lstrlenA (lpString="*.ape") returned 5
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wma") returned 0
	[0065.921] lstrlenA (lpString="*.wma") returned 5
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ac3") returned 0
	[0065.921] lstrlenA (lpString="*.ac3") returned 5
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.exe") returned 0
	[0065.921] lstrlenA (lpString="*.exe") returned 5
	[0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.apk") returned 0
	[0065.921] lstrlenA (lpString="*.apk") returned 5
	[0065.921] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.921] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.921] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TexturedBlue.css") returned -1
	[0065.921] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1
	[0065.921] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1
	[0065.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="Teal.css"
	[0065.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css"
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.zip") returned 0
	[0065.924] lstrlenA (lpString="*.zip") returned 5
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.rar") returned 0
	[0065.924] lstrlenA (lpString="*.rar") returned 5
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.7z") returned 0
	[0065.924] lstrlenA (lpString="*.7z") returned 4
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.tar") returned 0
	[0065.924] lstrlenA (lpString="*.tar") returned 5
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.gzip") returned 0
	[0065.924] lstrlenA (lpString="*.gzip") returned 6
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpg") returned 0
	[0065.924] lstrlenA (lpString="*.jpg") returned 5
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpeg") returned 0
	[0065.924] lstrlenA (lpString="*.jpeg") returned 6
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.psd") returned 0
	[0065.924] lstrlenA (lpString="*.psd") returned 5
	[0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.cdr") returned 0
	[0065.925] lstrlenA (lpString="*.cdr") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.dwg") returned 0
	[0065.925] lstrlenA (lpString="*.dwg") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.max") returned 0
	[0065.925] lstrlenA (lpString="*.max") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.bmp") returned 0
	[0065.925] lstrlenA (lpString="*.bmp") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.gif") returned 0
	[0065.925] lstrlenA (lpString="*.gif") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.png") returned 0
	[0065.925] lstrlenA (lpString="*.png") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.doc") returned 0
	[0065.925] lstrlenA (lpString="*.doc") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.docx") returned 0
	[0065.925] lstrlenA (lpString="*.docx") returned 6
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.xls") returned 0
	[0065.925] lstrlenA (lpString="*.xls") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.xlsx") returned 0
	[0065.925] lstrlenA (lpString="*.xlsx") returned 6
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ppt") returned 0
	[0065.925] lstrlenA (lpString="*.ppt") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pptx") returned 0
	[0065.925] lstrlenA (lpString="*.pptx") returned 6
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.txt") returned 0
	[0065.925] lstrlenA (lpString="*.txt") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pdf") returned 0
	[0065.925] lstrlenA (lpString="*.pdf") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.djvu") returned 0
	[0065.925] lstrlenA (lpString="*.djvu") returned 6
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.htm") returned 0
	[0065.925] lstrlenA (lpString="*.htm") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.html") returned 0
	[0065.925] lstrlenA (lpString="*.html") returned 6
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdb") returned 0
	[0065.925] lstrlenA (lpString="*.mdb") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.cer") returned 0
	[0065.925] lstrlenA (lpString="*.cer") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.p12") returned 0
	[0065.925] lstrlenA (lpString="*.p12") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pfx") returned 0
	[0065.925] lstrlenA (lpString="*.pfx") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.kwm") returned 0
	[0065.925] lstrlenA (lpString="*.kwm") returned 5
	[0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pwm") returned 0
	[0065.925] lstrlenA (lpString="*.pwm") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.1cd") returned 0
	[0065.926] lstrlenA (lpString="*.1cd") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.md") returned 0
	[0065.926] lstrlenA (lpString="*.md") returned 4
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdf") returned 0
	[0065.926] lstrlenA (lpString="*.mdf") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.dbf") returned 0
	[0065.926] lstrlenA (lpString="*.dbf") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.odt") returned 0
	[0065.926] lstrlenA (lpString="*.odt") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.vob") returned 0
	[0065.926] lstrlenA (lpString="*.vob") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ifo") returned 0
	[0065.926] lstrlenA (lpString="*.ifo") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.lnk") returned 0
	[0065.926] lstrlenA (lpString="*.lnk") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.torrent") returned 0
	[0065.926] lstrlenA (lpString="*.torrent") returned 9
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mov") returned 0
	[0065.926] lstrlenA (lpString="*.mov") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.m2v") returned 0
	[0065.926] lstrlenA (lpString="*.m2v") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.3gp") returned 0
	[0065.926] lstrlenA (lpString="*.3gp") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpeg") returned 0
	[0065.926] lstrlenA (lpString="*.mpeg") returned 6
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpg") returned 0
	[0065.926] lstrlenA (lpString="*.mpg") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.flv") returned 0
	[0065.926] lstrlenA (lpString="*.flv") returned 5
	[0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.avi") returned 0
	[0065.926] lstrlenA (lpString="*.avi") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp4") returned 0
	[0065.927] lstrlenA (lpString="*.mp4") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wmv") returned 0
	[0065.927] lstrlenA (lpString="*.wmv") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.divx") returned 0
	[0065.927] lstrlenA (lpString="*.divx") returned 6
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mkv") returned 0
	[0065.927] lstrlenA (lpString="*.mkv") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp3") returned 0
	[0065.927] lstrlenA (lpString="*.mp3") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wav") returned 0
	[0065.927] lstrlenA (lpString="*.wav") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.flac") returned 0
	[0065.927] lstrlenA (lpString="*.flac") returned 6
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ape") returned 0
	[0065.927] lstrlenA (lpString="*.ape") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wma") returned 0
	[0065.927] lstrlenA (lpString="*.wma") returned 5
	[0065.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ac3") returned 0
	[0065.928] lstrlenA (lpString="*.ac3") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.exe") returned 0
	[0065.928] lstrlenA (lpString="*.exe") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.apk") returned 0
	[0065.928] lstrlenA (lpString="*.apk") returned 5
	[0065.928] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0065.928] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0
	[0065.928] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VelvetRose.css") returned -1
	[0065.928] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1
	[0065.928] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1
	[0065.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css"
	[0065.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\"
	[0065.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned=""
	[0065.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt"
	[0065.928] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20
	[0065.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css"
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.zip") returned 0
	[0065.928] lstrlenA (lpString="*.zip") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.rar") returned 0
	[0065.928] lstrlenA (lpString="*.rar") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.7z") returned 0
	[0065.928] lstrlenA (lpString="*.7z") returned 4
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.tar") returned 0
	[0065.928] lstrlenA (lpString="*.tar") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.gzip") returned 0
	[0065.928] lstrlenA (lpString="*.gzip") returned 6
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.jpg") returned 0
	[0065.928] lstrlenA (lpString="*.jpg") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.jpeg") returned 0
	[0065.928] lstrlenA (lpString="*.jpeg") returned 6
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.psd") returned 0
	[0065.928] lstrlenA (lpString="*.psd") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.cdr") returned 0
	[0065.928] lstrlenA (lpString="*.cdr") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.dwg") returned 0
	[0065.928] lstrlenA (lpString="*.dwg") returned 5
	[0065.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.max") returned 0
	[0065.929] lstrlenA (lpString="*.max") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.bmp") returned 0
	[0065.929] lstrlenA (lpString="*.bmp") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.gif") returned 0
	[0065.929] lstrlenA (lpString="*.gif") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.png") returned 0
	[0065.929] lstrlenA (lpString="*.png") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.doc") returned 0
	[0065.929] lstrlenA (lpString="*.doc") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.docx") returned 0
	[0065.929] lstrlenA (lpString="*.docx") returned 6
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.xls") returned 0
	[0065.929] lstrlenA (lpString="*.xls") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.xlsx") returned 0
	[0065.929] lstrlenA (lpString="*.xlsx") returned 6
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ppt") returned 0
	[0065.929] lstrlenA (lpString="*.ppt") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pptx") returned 0
	[0065.929] lstrlenA (lpString="*.pptx") returned 6
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.txt") returned 0
	[0065.929] lstrlenA (lpString="*.txt") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pdf") returned 0
	[0065.929] lstrlenA (lpString="*.pdf") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.djvu") returned 0
	[0065.929] lstrlenA (lpString="*.djvu") returned 6
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.htm") returned 0
	[0065.929] lstrlenA (lpString="*.htm") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.html") returned 0
	[0065.929] lstrlenA (lpString="*.html") returned 6
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mdb") returned 0
	[0065.929] lstrlenA (lpString="*.mdb") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.cer") returned 0
	[0065.929] lstrlenA (lpString="*.cer") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.p12") returned 0
	[0065.929] lstrlenA (lpString="*.p12") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pfx") returned 0
	[0065.929] lstrlenA (lpString="*.pfx") returned 5
	[0065.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.kwm") returned 0
	[0065.929] lstrlenA (lpString="*.kwm") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pwm") returned 0
	[0065.930] lstrlenA (lpString="*.pwm") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.1cd") returned 0
	[0065.930] lstrlenA (lpString="*.1cd") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.md") returned 0
	[0065.930] lstrlenA (lpString="*.md") returned 4
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mdf") returned 0
	[0065.930] lstrlenA (lpString="*.mdf") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.dbf") returned 0
	[0065.930] lstrlenA (lpString="*.dbf") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.odt") returned 0
	[0065.930] lstrlenA (lpString="*.odt") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.vob") returned 0
	[0065.930] lstrlenA (lpString="*.vob") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ifo") returned 0
	[0065.930] lstrlenA (lpString="*.ifo") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.lnk") returned 0
	[0065.930] lstrlenA (lpString="*.lnk") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.torrent") returned 0
	[0065.930] lstrlenA (lpString="*.torrent") returned 9
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mov") returned 0
	[0065.930] lstrlenA (lpString="*.mov") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.m2v") returned 0
	[0065.930] lstrlenA (lpString="*.m2v") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.3gp") returned 0
	[0065.930] lstrlenA (lpString="*.3gp") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mpeg") returned 0
	[0065.930] lstrlenA (lpString="*.mpeg") returned 6
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mpg") returned 0
	[0065.930] lstrlenA (lpString="*.mpg") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.flv") returned 0
	[0065.930] lstrlenA (lpString="*.flv") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.avi") returned 0
	[0065.930] lstrlenA (lpString="*.avi") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mp4") returned 0
	[0065.930] lstrlenA (lpString="*.mp4") returned 5
	[0065.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wmv") returned 0
	[0065.930] lstrlenA (lpString="*.wmv") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.divx") returned 0
	[0065.931] lstrlenA (lpString="*.divx") returned 6
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mkv") returned 0
	[0065.931] lstrlenA (lpString="*.mkv") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mp3") returned 0
	[0065.931] lstrlenA (lpString="*.mp3") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wav") returned 0
	[0065.931] lstrlenA (lpString="*.wav") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.flac") returned 0
	[0065.931] lstrlenA (lpString="*.flac") returned 6
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ape") returned 0
	[0065.931] lstrlenA (lpString="*.ape") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wma") returned 0
	[0065.931] lstrlenA (lpString="*.wma") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ac3") returned 0
	[0065.931] lstrlenA (lpString="*.ac3") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.exe") returned 0
	[0065.931] lstrlenA (lpString="*.exe") returned 5
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.apk") returned 0
	[0065.931] lstrlenA (lpString="*.apk") returned 5
	[0065.931] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0
	[0065.931] FindClose (in: hFindFile=0x8b7f68 | out: hFindFile=0x8b7f68) returned 1
	[0065.931] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.931] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0065.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsVersion1Warning.htm") returned -1
	[0065.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1
	[0065.931] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1
	[0065.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*") returned="*.*"
	[0065.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0065.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0065.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0065.931] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0065.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm"
	[0065.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.zip") returned 0
	[0065.932] lstrlenA (lpString="*.zip") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.rar") returned 0
	[0065.932] lstrlenA (lpString="*.rar") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.7z") returned 0
	[0065.932] lstrlenA (lpString="*.7z") returned 4
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.tar") returned 0
	[0065.932] lstrlenA (lpString="*.tar") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.gzip") returned 0
	[0065.932] lstrlenA (lpString="*.gzip") returned 6
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.jpg") returned 0
	[0065.932] lstrlenA (lpString="*.jpg") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.jpeg") returned 0
	[0065.932] lstrlenA (lpString="*.jpeg") returned 6
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.psd") returned 0
	[0065.932] lstrlenA (lpString="*.psd") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.cdr") returned 0
	[0065.932] lstrlenA (lpString="*.cdr") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.dwg") returned 0
	[0065.932] lstrlenA (lpString="*.dwg") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.max") returned 0
	[0065.932] lstrlenA (lpString="*.max") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.bmp") returned 0
	[0065.932] lstrlenA (lpString="*.bmp") returned 5
	[0065.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.gif") returned 0
	[0065.932] lstrlenA (lpString="*.gif") returned 5
	[0065.932] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm"
	[0065.932] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm"
	[0065.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm."
	[0065.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.Boom"
	[0065.933] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0065.933] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f8
	[0065.933] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0065.933] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.933] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x8d5, lpOverlapped=0x0) returned 1
	[0065.943] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm"
	[0065.943] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.943] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x8d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x8d5, lpOverlapped=0x0) returned 1
	[0065.943] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.943] CloseHandle (hObject=0x98) returned 1
	[0065.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm.boom")) returned 1
	[0065.944] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.944] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0065.944] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0065.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1
	[0065.944] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0065.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm"
	[0065.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0065.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0065.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0065.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0065.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg"
	[0065.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0
	[0065.944] lstrlenA (lpString="*.zip") returned 5
	[0065.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0
	[0065.944] lstrlenA (lpString="*.rar") returned 5
	[0065.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0
	[0065.944] lstrlenA (lpString="*.7z") returned 4
	[0065.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0
	[0065.944] lstrlenA (lpString="*.tar") returned 5
	[0065.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0
	[0065.944] lstrlenA (lpString="*.gzip") returned 6
	[0065.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1
	[0065.944] lstrlenA (lpString="*.jpg") returned 5
	[0065.944] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg"
	[0065.944] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg"
	[0065.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg."
	[0065.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.Boom"
	[0065.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0065.945] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499
	[0065.945] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0065.945] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.945] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1476, lpOverlapped=0x0) returned 1
	[0065.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0065.946] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.946] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1476, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1476, lpOverlapped=0x0) returned 1
	[0065.947] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.947] CloseHandle (hObject=0x98) returned 1
	[0065.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.boom")) returned 1
	[0065.948] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.948] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0065.948] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0065.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1
	[0065.948] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0065.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0065.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0065.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0065.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0065.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0065.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp"
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0
	[0065.948] lstrlenA (lpString="*.zip") returned 5
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0
	[0065.948] lstrlenA (lpString="*.rar") returned 5
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0
	[0065.948] lstrlenA (lpString="*.7z") returned 4
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0
	[0065.948] lstrlenA (lpString="*.tar") returned 5
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0
	[0065.948] lstrlenA (lpString="*.gzip") returned 6
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0
	[0065.948] lstrlenA (lpString="*.jpg") returned 5
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0
	[0065.948] lstrlenA (lpString="*.jpeg") returned 6
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0
	[0065.948] lstrlenA (lpString="*.psd") returned 5
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cdr") returned 0
	[0065.948] lstrlenA (lpString="*.cdr") returned 5
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0
	[0065.948] lstrlenA (lpString="*.dwg") returned 5
	[0065.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.max") returned 0
	[0065.949] lstrlenA (lpString="*.max") returned 5
	[0065.949] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bmp") returned 1
	[0065.949] lstrlenA (lpString="*.bmp") returned 5
	[0065.949] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp"
	[0065.949] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp"
	[0065.949] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp."
	[0065.949] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.Boom"
	[0065.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0065.950] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638
	[0065.950] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0065.950] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.950] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x615, lpOverlapped=0x0) returned 1
	[0065.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0065.962] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.962] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x615, lpOverlapped=0x0) returned 1
	[0065.962] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0065.962] CloseHandle (hObject=0x98) returned 1
	[0065.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.boom")) returned 1
	[0065.963] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0065.963] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0065.963] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewFrame.html") returned -1
	[0065.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1
	[0065.963] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1
	[0065.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0065.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0065.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0065.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0065.963] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0065.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html"
	[0065.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.zip") returned 0
	[0065.963] lstrlenA (lpString="*.zip") returned 5
	[0065.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.rar") returned 0
	[0065.963] lstrlenA (lpString="*.rar") returned 5
	[0065.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.7z") returned 0
	[0065.963] lstrlenA (lpString="*.7z") returned 4
	[0065.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.tar") returned 0
	[0065.963] lstrlenA (lpString="*.tar") returned 5
	[0065.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.gzip") returned 0
	[0065.964] lstrlenA (lpString="*.gzip") returned 6
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.jpg") returned 0
	[0065.964] lstrlenA (lpString="*.jpg") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0
	[0065.964] lstrlenA (lpString="*.jpeg") returned 6
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.psd") returned 0
	[0065.964] lstrlenA (lpString="*.psd") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.cdr") returned 0
	[0065.964] lstrlenA (lpString="*.cdr") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.dwg") returned 0
	[0065.964] lstrlenA (lpString="*.dwg") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.max") returned 0
	[0065.964] lstrlenA (lpString="*.max") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.bmp") returned 0
	[0065.964] lstrlenA (lpString="*.bmp") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.gif") returned 0
	[0065.964] lstrlenA (lpString="*.gif") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.png") returned 0
	[0065.964] lstrlenA (lpString="*.png") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.doc") returned 0
	[0065.964] lstrlenA (lpString="*.doc") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.docx") returned 0
	[0065.964] lstrlenA (lpString="*.docx") returned 6
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.xls") returned 0
	[0065.964] lstrlenA (lpString="*.xls") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0
	[0065.964] lstrlenA (lpString="*.xlsx") returned 6
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.ppt") returned 0
	[0065.964] lstrlenA (lpString="*.ppt") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.pptx") returned 0
	[0065.964] lstrlenA (lpString="*.pptx") returned 6
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.txt") returned 0
	[0065.964] lstrlenA (lpString="*.txt") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.pdf") returned 0
	[0065.964] lstrlenA (lpString="*.pdf") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.djvu") returned 0
	[0065.964] lstrlenA (lpString="*.djvu") returned 6
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.htm") returned 0
	[0065.964] lstrlenA (lpString="*.htm") returned 5
	[0065.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.html") returned 1
	[0065.964] lstrlenA (lpString="*.html") returned 6
	[0065.964] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html"
	[0065.964] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html"
	[0065.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html."
	[0065.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.Boom"
	[0065.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0065.965] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164a
	[0065.965] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0065.965] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0065.965] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1627, lpOverlapped=0x0) returned 1
	[0066.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="FormsViewFrame.html"
	[0066.047] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.047] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1627, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1627, lpOverlapped=0x0) returned 1
	[0066.047] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.048] CloseHandle (hObject=0x98) returned 1
	[0066.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.boom")) returned 1
	[0066.048] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.048] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.049] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewTemplate.html") returned -1
	[0066.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewTemplate.html") returned 1
	[0066.049] lstrcmpiA (lpString1="", lpString2="FormsViewTemplate.html") returned -1
	[0066.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="FormsViewFrame.html"
	[0066.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html"
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.zip") returned 0
	[0066.049] lstrlenA (lpString="*.zip") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.rar") returned 0
	[0066.049] lstrlenA (lpString="*.rar") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.7z") returned 0
	[0066.049] lstrlenA (lpString="*.7z") returned 4
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.tar") returned 0
	[0066.049] lstrlenA (lpString="*.tar") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.gzip") returned 0
	[0066.049] lstrlenA (lpString="*.gzip") returned 6
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.jpg") returned 0
	[0066.049] lstrlenA (lpString="*.jpg") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.jpeg") returned 0
	[0066.049] lstrlenA (lpString="*.jpeg") returned 6
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.psd") returned 0
	[0066.049] lstrlenA (lpString="*.psd") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.cdr") returned 0
	[0066.049] lstrlenA (lpString="*.cdr") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.dwg") returned 0
	[0066.049] lstrlenA (lpString="*.dwg") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.max") returned 0
	[0066.049] lstrlenA (lpString="*.max") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.bmp") returned 0
	[0066.049] lstrlenA (lpString="*.bmp") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.gif") returned 0
	[0066.049] lstrlenA (lpString="*.gif") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.png") returned 0
	[0066.049] lstrlenA (lpString="*.png") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.doc") returned 0
	[0066.049] lstrlenA (lpString="*.doc") returned 5
	[0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.docx") returned 0
	[0066.049] lstrlenA (lpString="*.docx") returned 6
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.xls") returned 0
	[0066.050] lstrlenA (lpString="*.xls") returned 5
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.xlsx") returned 0
	[0066.050] lstrlenA (lpString="*.xlsx") returned 6
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.ppt") returned 0
	[0066.050] lstrlenA (lpString="*.ppt") returned 5
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.pptx") returned 0
	[0066.050] lstrlenA (lpString="*.pptx") returned 6
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.txt") returned 0
	[0066.050] lstrlenA (lpString="*.txt") returned 5
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.pdf") returned 0
	[0066.050] lstrlenA (lpString="*.pdf") returned 5
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.djvu") returned 0
	[0066.050] lstrlenA (lpString="*.djvu") returned 6
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.htm") returned 0
	[0066.050] lstrlenA (lpString="*.htm") returned 5
	[0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.html") returned 1
	[0066.050] lstrlenA (lpString="*.html") returned 6
	[0066.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html"
	[0066.050] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html"
	[0066.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html."
	[0066.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.Boom"
	[0066.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.050] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadf
	[0066.051] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0066.051] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.051] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xabc, lpOverlapped=0x0) returned 1
	[0066.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="FormsViewTemplate.html"
	[0066.124] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.124] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xabc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xabc, lpOverlapped=0x0) returned 1
	[0066.124] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.124] CloseHandle (hObject=0x98) returned 1
	[0066.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.boom")) returned 1
	[0066.125] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.125] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormToolImages.jpg") returned -1
	[0066.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1
	[0066.125] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1
	[0066.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="FormsViewTemplate.html"
	[0066.125] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.125] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.125] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg"
	[0066.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.zip") returned 0
	[0066.125] lstrlenA (lpString="*.zip") returned 5
	[0066.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.rar") returned 0
	[0066.125] lstrlenA (lpString="*.rar") returned 5
	[0066.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.7z") returned 0
	[0066.125] lstrlenA (lpString="*.7z") returned 4
	[0066.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.tar") returned 0
	[0066.125] lstrlenA (lpString="*.tar") returned 5
	[0066.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.gzip") returned 0
	[0066.125] lstrlenA (lpString="*.gzip") returned 6
	[0066.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.jpg") returned 1
	[0066.125] lstrlenA (lpString="*.jpg") returned 5
	[0066.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg"
	[0066.125] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg"
	[0066.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg."
	[0066.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.Boom"
	[0066.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.126] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb
	[0066.126] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0066.126] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.126] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1bd8, lpOverlapped=0x0) returned 1
	[0066.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg"
	[0066.127] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.127] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1bd8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1bd8, lpOverlapped=0x0) returned 1
	[0066.127] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.127] CloseHandle (hObject=0x98) returned 1
	[0066.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.boom")) returned 1
	[0066.128] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.128] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="form_edit.js") returned -1
	[0066.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1
	[0066.128] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1
	[0066.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg"
	[0066.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.128] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.128] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js"
	[0066.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.zip") returned 0
	[0066.128] lstrlenA (lpString="*.zip") returned 5
	[0066.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.rar") returned 0
	[0066.128] lstrlenA (lpString="*.rar") returned 5
	[0066.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.7z") returned 0
	[0066.128] lstrlenA (lpString="*.7z") returned 4
	[0066.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.tar") returned 0
	[0066.128] lstrlenA (lpString="*.tar") returned 5
	[0066.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.gzip") returned 0
	[0066.128] lstrlenA (lpString="*.gzip") returned 6
	[0066.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.jpg") returned 0
	[0066.128] lstrlenA (lpString="*.jpg") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.jpeg") returned 0
	[0066.129] lstrlenA (lpString="*.jpeg") returned 6
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.psd") returned 0
	[0066.129] lstrlenA (lpString="*.psd") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.cdr") returned 0
	[0066.129] lstrlenA (lpString="*.cdr") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.dwg") returned 0
	[0066.129] lstrlenA (lpString="*.dwg") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.max") returned 0
	[0066.129] lstrlenA (lpString="*.max") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.bmp") returned 0
	[0066.129] lstrlenA (lpString="*.bmp") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.gif") returned 0
	[0066.129] lstrlenA (lpString="*.gif") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.png") returned 0
	[0066.129] lstrlenA (lpString="*.png") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.doc") returned 0
	[0066.129] lstrlenA (lpString="*.doc") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.docx") returned 0
	[0066.129] lstrlenA (lpString="*.docx") returned 6
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xls") returned 0
	[0066.129] lstrlenA (lpString="*.xls") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xlsx") returned 0
	[0066.129] lstrlenA (lpString="*.xlsx") returned 6
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ppt") returned 0
	[0066.129] lstrlenA (lpString="*.ppt") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pptx") returned 0
	[0066.129] lstrlenA (lpString="*.pptx") returned 6
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.txt") returned 0
	[0066.129] lstrlenA (lpString="*.txt") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pdf") returned 0
	[0066.129] lstrlenA (lpString="*.pdf") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.djvu") returned 0
	[0066.129] lstrlenA (lpString="*.djvu") returned 6
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.htm") returned 0
	[0066.129] lstrlenA (lpString="*.htm") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.html") returned 0
	[0066.129] lstrlenA (lpString="*.html") returned 6
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mdb") returned 0
	[0066.129] lstrlenA (lpString="*.mdb") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.cer") returned 0
	[0066.129] lstrlenA (lpString="*.cer") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.p12") returned 0
	[0066.129] lstrlenA (lpString="*.p12") returned 5
	[0066.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pfx") returned 0
	[0066.130] lstrlenA (lpString="*.pfx") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.kwm") returned 0
	[0066.130] lstrlenA (lpString="*.kwm") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pwm") returned 0
	[0066.130] lstrlenA (lpString="*.pwm") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.1cd") returned 0
	[0066.130] lstrlenA (lpString="*.1cd") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.md") returned 0
	[0066.130] lstrlenA (lpString="*.md") returned 4
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mdf") returned 0
	[0066.130] lstrlenA (lpString="*.mdf") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.dbf") returned 0
	[0066.130] lstrlenA (lpString="*.dbf") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.odt") returned 0
	[0066.130] lstrlenA (lpString="*.odt") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.vob") returned 0
	[0066.130] lstrlenA (lpString="*.vob") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ifo") returned 0
	[0066.130] lstrlenA (lpString="*.ifo") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.lnk") returned 0
	[0066.130] lstrlenA (lpString="*.lnk") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.torrent") returned 0
	[0066.130] lstrlenA (lpString="*.torrent") returned 9
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mov") returned 0
	[0066.130] lstrlenA (lpString="*.mov") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.m2v") returned 0
	[0066.130] lstrlenA (lpString="*.m2v") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.3gp") returned 0
	[0066.130] lstrlenA (lpString="*.3gp") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mpeg") returned 0
	[0066.130] lstrlenA (lpString="*.mpeg") returned 6
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mpg") returned 0
	[0066.130] lstrlenA (lpString="*.mpg") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.flv") returned 0
	[0066.130] lstrlenA (lpString="*.flv") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.avi") returned 0
	[0066.130] lstrlenA (lpString="*.avi") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mp4") returned 0
	[0066.130] lstrlenA (lpString="*.mp4") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wmv") returned 0
	[0066.130] lstrlenA (lpString="*.wmv") returned 5
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.divx") returned 0
	[0066.130] lstrlenA (lpString="*.divx") returned 6
	[0066.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mkv") returned 0
	[0066.130] lstrlenA (lpString="*.mkv") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mp3") returned 0
	[0066.131] lstrlenA (lpString="*.mp3") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wav") returned 0
	[0066.131] lstrlenA (lpString="*.wav") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.flac") returned 0
	[0066.131] lstrlenA (lpString="*.flac") returned 6
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ape") returned 0
	[0066.131] lstrlenA (lpString="*.ape") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wma") returned 0
	[0066.131] lstrlenA (lpString="*.wma") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ac3") returned 0
	[0066.131] lstrlenA (lpString="*.ac3") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.exe") returned 0
	[0066.131] lstrlenA (lpString="*.exe") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.apk") returned 0
	[0066.131] lstrlenA (lpString="*.apk") returned 5
	[0066.131] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.131] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.131] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HOW TO DECRYPT FILES.txt") returned -1
	[0066.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0
	[0066.131] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.131] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.131] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAUNCH.GIF") returned -1
	[0066.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1
	[0066.131] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1
	[0066.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="form_edit.js"
	[0066.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF"
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.zip") returned 0
	[0066.131] lstrlenA (lpString="*.zip") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.rar") returned 0
	[0066.131] lstrlenA (lpString="*.rar") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.7z") returned 0
	[0066.131] lstrlenA (lpString="*.7z") returned 4
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.tar") returned 0
	[0066.131] lstrlenA (lpString="*.tar") returned 5
	[0066.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.gzip") returned 0
	[0066.132] lstrlenA (lpString="*.gzip") returned 6
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.jpg") returned 0
	[0066.132] lstrlenA (lpString="*.jpg") returned 5
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0
	[0066.132] lstrlenA (lpString="*.jpeg") returned 6
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.psd") returned 0
	[0066.132] lstrlenA (lpString="*.psd") returned 5
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.cdr") returned 0
	[0066.132] lstrlenA (lpString="*.cdr") returned 5
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.dwg") returned 0
	[0066.132] lstrlenA (lpString="*.dwg") returned 5
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.max") returned 0
	[0066.132] lstrlenA (lpString="*.max") returned 5
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.bmp") returned 0
	[0066.132] lstrlenA (lpString="*.bmp") returned 5
	[0066.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.gif") returned 1
	[0066.132] lstrlenA (lpString="*.gif") returned 5
	[0066.132] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF"
	[0066.132] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF"
	[0066.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF."
	[0066.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.Boom"
	[0066.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.133] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267
	[0066.134] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x567e4730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0066.134] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.134] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x244, lpOverlapped=0x0) returned 1
	[0066.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="LAUNCH.GIF"
	[0066.135] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.135] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x244, lpOverlapped=0x0) returned 1
	[0066.135] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.135] CloseHandle (hObject=0x98) returned 1
	[0066.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif.boom")) returned 1
	[0066.136] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.136] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="macroprogress.gif") returned -1
	[0066.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1
	[0066.136] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1
	[0066.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="LAUNCH.GIF"
	[0066.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif"
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.zip") returned 0
	[0066.137] lstrlenA (lpString="*.zip") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.rar") returned 0
	[0066.137] lstrlenA (lpString="*.rar") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.7z") returned 0
	[0066.137] lstrlenA (lpString="*.7z") returned 4
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.tar") returned 0
	[0066.137] lstrlenA (lpString="*.tar") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.gzip") returned 0
	[0066.137] lstrlenA (lpString="*.gzip") returned 6
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.jpg") returned 0
	[0066.137] lstrlenA (lpString="*.jpg") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.jpeg") returned 0
	[0066.137] lstrlenA (lpString="*.jpeg") returned 6
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.psd") returned 0
	[0066.137] lstrlenA (lpString="*.psd") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.cdr") returned 0
	[0066.137] lstrlenA (lpString="*.cdr") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.dwg") returned 0
	[0066.137] lstrlenA (lpString="*.dwg") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.max") returned 0
	[0066.137] lstrlenA (lpString="*.max") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.bmp") returned 0
	[0066.137] lstrlenA (lpString="*.bmp") returned 5
	[0066.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.gif") returned 1
	[0066.137] lstrlenA (lpString="*.gif") returned 5
	[0066.137] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif"
	[0066.137] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif"
	[0066.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif."
	[0066.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.Boom"
	[0066.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.138] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa52f
	[0066.138] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x58285d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1
	[0066.138] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.138] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa50c, lpOverlapped=0x0) returned 1
	[0066.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="macroprogress.gif"
	[0066.265] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.265] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa50c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa50c, lpOverlapped=0x0) returned 1
	[0066.265] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.265] CloseHandle (hObject=0x98) returned 1
	[0066.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.boom")) returned 1
	[0066.266] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.266] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.266] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublicFunctions.js") returned -1
	[0066.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1
	[0066.266] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1
	[0066.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="macroprogress.gif"
	[0066.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js"
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.zip") returned 0
	[0066.267] lstrlenA (lpString="*.zip") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.rar") returned 0
	[0066.267] lstrlenA (lpString="*.rar") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.7z") returned 0
	[0066.267] lstrlenA (lpString="*.7z") returned 4
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.tar") returned 0
	[0066.267] lstrlenA (lpString="*.tar") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.gzip") returned 0
	[0066.267] lstrlenA (lpString="*.gzip") returned 6
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.jpg") returned 0
	[0066.267] lstrlenA (lpString="*.jpg") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.jpeg") returned 0
	[0066.267] lstrlenA (lpString="*.jpeg") returned 6
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.psd") returned 0
	[0066.267] lstrlenA (lpString="*.psd") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.cdr") returned 0
	[0066.267] lstrlenA (lpString="*.cdr") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.dwg") returned 0
	[0066.267] lstrlenA (lpString="*.dwg") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.max") returned 0
	[0066.267] lstrlenA (lpString="*.max") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.bmp") returned 0
	[0066.267] lstrlenA (lpString="*.bmp") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.gif") returned 0
	[0066.267] lstrlenA (lpString="*.gif") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.png") returned 0
	[0066.267] lstrlenA (lpString="*.png") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.doc") returned 0
	[0066.267] lstrlenA (lpString="*.doc") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.docx") returned 0
	[0066.267] lstrlenA (lpString="*.docx") returned 6
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.xls") returned 0
	[0066.267] lstrlenA (lpString="*.xls") returned 5
	[0066.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.xlsx") returned 0
	[0066.268] lstrlenA (lpString="*.xlsx") returned 6
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.ppt") returned 0
	[0066.268] lstrlenA (lpString="*.ppt") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.pptx") returned 0
	[0066.268] lstrlenA (lpString="*.pptx") returned 6
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.txt") returned 0
	[0066.268] lstrlenA (lpString="*.txt") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.pdf") returned 0
	[0066.268] lstrlenA (lpString="*.pdf") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.djvu") returned 0
	[0066.268] lstrlenA (lpString="*.djvu") returned 6
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.htm") returned 0
	[0066.268] lstrlenA (lpString="*.htm") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.html") returned 0
	[0066.268] lstrlenA (lpString="*.html") returned 6
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mdb") returned 0
	[0066.268] lstrlenA (lpString="*.mdb") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.cer") returned 0
	[0066.268] lstrlenA (lpString="*.cer") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.p12") returned 0
	[0066.268] lstrlenA (lpString="*.p12") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.pfx") returned 0
	[0066.268] lstrlenA (lpString="*.pfx") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.kwm") returned 0
	[0066.268] lstrlenA (lpString="*.kwm") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.pwm") returned 0
	[0066.268] lstrlenA (lpString="*.pwm") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.1cd") returned 0
	[0066.268] lstrlenA (lpString="*.1cd") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.md") returned 0
	[0066.268] lstrlenA (lpString="*.md") returned 4
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mdf") returned 0
	[0066.268] lstrlenA (lpString="*.mdf") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.dbf") returned 0
	[0066.268] lstrlenA (lpString="*.dbf") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.odt") returned 0
	[0066.268] lstrlenA (lpString="*.odt") returned 5
	[0066.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.vob") returned 0
	[0066.268] lstrlenA (lpString="*.vob") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.ifo") returned 0
	[0066.269] lstrlenA (lpString="*.ifo") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.lnk") returned 0
	[0066.269] lstrlenA (lpString="*.lnk") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.torrent") returned 0
	[0066.269] lstrlenA (lpString="*.torrent") returned 9
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mov") returned 0
	[0066.269] lstrlenA (lpString="*.mov") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.m2v") returned 0
	[0066.269] lstrlenA (lpString="*.m2v") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.3gp") returned 0
	[0066.269] lstrlenA (lpString="*.3gp") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mpeg") returned 0
	[0066.269] lstrlenA (lpString="*.mpeg") returned 6
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mpg") returned 0
	[0066.269] lstrlenA (lpString="*.mpg") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.flv") returned 0
	[0066.269] lstrlenA (lpString="*.flv") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.avi") returned 0
	[0066.269] lstrlenA (lpString="*.avi") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mp4") returned 0
	[0066.269] lstrlenA (lpString="*.mp4") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.wmv") returned 0
	[0066.269] lstrlenA (lpString="*.wmv") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.divx") returned 0
	[0066.269] lstrlenA (lpString="*.divx") returned 6
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mkv") returned 0
	[0066.269] lstrlenA (lpString="*.mkv") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mp3") returned 0
	[0066.269] lstrlenA (lpString="*.mp3") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.wav") returned 0
	[0066.269] lstrlenA (lpString="*.wav") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.flac") returned 0
	[0066.269] lstrlenA (lpString="*.flac") returned 6
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.ape") returned 0
	[0066.269] lstrlenA (lpString="*.ape") returned 5
	[0066.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.wma") returned 0
	[0066.270] lstrlenA (lpString="*.wma") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.ac3") returned 0
	[0066.270] lstrlenA (lpString="*.ac3") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.exe") returned 0
	[0066.270] lstrlenA (lpString="*.exe") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.apk") returned 0
	[0066.270] lstrlenA (lpString="*.apk") returned 5
	[0066.270] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.270] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.270] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignleft.gif") returned -1
	[0066.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1
	[0066.270] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1
	[0066.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="PublicFunctions.js"
	[0066.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif"
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.zip") returned 0
	[0066.270] lstrlenA (lpString="*.zip") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.rar") returned 0
	[0066.270] lstrlenA (lpString="*.rar") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.7z") returned 0
	[0066.270] lstrlenA (lpString="*.7z") returned 4
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.tar") returned 0
	[0066.270] lstrlenA (lpString="*.tar") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0
	[0066.270] lstrlenA (lpString="*.gzip") returned 6
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0
	[0066.270] lstrlenA (lpString="*.jpg") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0
	[0066.270] lstrlenA (lpString="*.jpeg") returned 6
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.psd") returned 0
	[0066.270] lstrlenA (lpString="*.psd") returned 5
	[0066.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.cdr") returned 0
	[0066.271] lstrlenA (lpString="*.cdr") returned 5
	[0066.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.dwg") returned 0
	[0066.271] lstrlenA (lpString="*.dwg") returned 5
	[0066.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.max") returned 0
	[0066.271] lstrlenA (lpString="*.max") returned 5
	[0066.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.bmp") returned 0
	[0066.271] lstrlenA (lpString="*.bmp") returned 5
	[0066.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.gif") returned 1
	[0066.271] lstrlenA (lpString="*.gif") returned 5
	[0066.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif"
	[0066.271] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif"
	[0066.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif."
	[0066.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.Boom"
	[0066.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.271] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350
	[0066.271] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.272] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.272] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32d, lpOverlapped=0x0) returned 1
	[0066.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="rtf_alignleft.gif"
	[0066.310] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.310] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1
	[0066.311] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.311] CloseHandle (hObject=0x98) returned 1
	[0066.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.boom")) returned 1
	[0066.311] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.311] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.311] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignright.gif") returned -1
	[0066.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1
	[0066.312] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1
	[0066.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="rtf_alignleft.gif"
	[0066.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.312] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif"
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.zip") returned 0
	[0066.312] lstrlenA (lpString="*.zip") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.rar") returned 0
	[0066.312] lstrlenA (lpString="*.rar") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.7z") returned 0
	[0066.312] lstrlenA (lpString="*.7z") returned 4
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.tar") returned 0
	[0066.312] lstrlenA (lpString="*.tar") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.gzip") returned 0
	[0066.312] lstrlenA (lpString="*.gzip") returned 6
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.jpg") returned 0
	[0066.312] lstrlenA (lpString="*.jpg") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0
	[0066.312] lstrlenA (lpString="*.jpeg") returned 6
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.psd") returned 0
	[0066.312] lstrlenA (lpString="*.psd") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.cdr") returned 0
	[0066.312] lstrlenA (lpString="*.cdr") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.dwg") returned 0
	[0066.312] lstrlenA (lpString="*.dwg") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.max") returned 0
	[0066.312] lstrlenA (lpString="*.max") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.bmp") returned 0
	[0066.312] lstrlenA (lpString="*.bmp") returned 5
	[0066.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.gif") returned 1
	[0066.312] lstrlenA (lpString="*.gif") returned 5
	[0066.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif"
	[0066.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif"
	[0066.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif."
	[0066.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.Boom"
	[0066.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.313] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f
	[0066.313] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.313] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.313] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32c, lpOverlapped=0x0) returned 1
	[0066.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="rtf_alignright.gif"
	[0066.321] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.321] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32c, lpOverlapped=0x0) returned 1
	[0066.321] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.321] CloseHandle (hObject=0x98) returned 1
	[0066.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.boom")) returned 1
	[0066.322] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.322] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.322] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RTF_BOLD.GIF") returned -1
	[0066.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1
	[0066.322] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1
	[0066.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="rtf_alignright.gif"
	[0066.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF"
	[0066.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.zip") returned 0
	[0066.322] lstrlenA (lpString="*.zip") returned 5
	[0066.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.rar") returned 0
	[0066.322] lstrlenA (lpString="*.rar") returned 5
	[0066.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.7z") returned 0
	[0066.322] lstrlenA (lpString="*.7z") returned 4
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.tar") returned 0
	[0066.323] lstrlenA (lpString="*.tar") returned 5
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.gzip") returned 0
	[0066.323] lstrlenA (lpString="*.gzip") returned 6
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.jpg") returned 0
	[0066.323] lstrlenA (lpString="*.jpg") returned 5
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.jpeg") returned 0
	[0066.323] lstrlenA (lpString="*.jpeg") returned 6
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.psd") returned 0
	[0066.323] lstrlenA (lpString="*.psd") returned 5
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.cdr") returned 0
	[0066.323] lstrlenA (lpString="*.cdr") returned 5
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.dwg") returned 0
	[0066.323] lstrlenA (lpString="*.dwg") returned 5
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.max") returned 0
	[0066.323] lstrlenA (lpString="*.max") returned 5
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.bmp") returned 0
	[0066.323] lstrlenA (lpString="*.bmp") returned 5
	[0066.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.gif") returned 1
	[0066.323] lstrlenA (lpString="*.gif") returned 5
	[0066.323] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF"
	[0066.323] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF"
	[0066.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF."
	[0066.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.Boom"
	[0066.323] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.324] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x366
	[0066.324] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.324] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.324] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x343, lpOverlapped=0x0) returned 1
	[0066.339] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF"
	[0066.339] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.339] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x343, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x343, lpOverlapped=0x0) returned 1
	[0066.339] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.339] CloseHandle (hObject=0x98) returned 1
	[0066.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif.boom")) returned 1
	[0066.340] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.340] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.340] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_bullets.gif") returned -1
	[0066.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1
	[0066.340] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1
	[0066.340] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF"
	[0066.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.340] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif"
	[0066.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.zip") returned 0
	[0066.340] lstrlenA (lpString="*.zip") returned 5
	[0066.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.rar") returned 0
	[0066.340] lstrlenA (lpString="*.rar") returned 5
	[0066.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.7z") returned 0
	[0066.340] lstrlenA (lpString="*.7z") returned 4
	[0066.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.tar") returned 0
	[0066.340] lstrlenA (lpString="*.tar") returned 5
	[0066.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.gzip") returned 0
	[0066.340] lstrlenA (lpString="*.gzip") returned 6
	[0066.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.jpg") returned 0
	[0066.340] lstrlenA (lpString="*.jpg") returned 5
	[0066.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0
	[0066.340] lstrlenA (lpString="*.jpeg") returned 6
	[0066.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.psd") returned 0
	[0066.341] lstrlenA (lpString="*.psd") returned 5
	[0066.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.cdr") returned 0
	[0066.341] lstrlenA (lpString="*.cdr") returned 5
	[0066.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.dwg") returned 0
	[0066.341] lstrlenA (lpString="*.dwg") returned 5
	[0066.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.max") returned 0
	[0066.341] lstrlenA (lpString="*.max") returned 5
	[0066.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.bmp") returned 0
	[0066.341] lstrlenA (lpString="*.bmp") returned 5
	[0066.341] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.gif") returned 1
	[0066.341] lstrlenA (lpString="*.gif") returned 5
	[0066.341] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif"
	[0066.341] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif"
	[0066.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif."
	[0066.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.Boom"
	[0066.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.341] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365
	[0066.341] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.341] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.342] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x342, lpOverlapped=0x0) returned 1
	[0066.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="rtf_bullets.gif"
	[0066.343] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.343] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x342, lpOverlapped=0x0) returned 1
	[0066.343] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.343] CloseHandle (hObject=0x98) returned 1
	[0066.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.boom")) returned 1
	[0066.344] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.344] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_center.gif") returned -1
	[0066.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1
	[0066.344] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1
	[0066.344] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="rtf_bullets.gif"
	[0066.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.344] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif"
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.zip") returned 0
	[0066.344] lstrlenA (lpString="*.zip") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.rar") returned 0
	[0066.344] lstrlenA (lpString="*.rar") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.7z") returned 0
	[0066.344] lstrlenA (lpString="*.7z") returned 4
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.tar") returned 0
	[0066.344] lstrlenA (lpString="*.tar") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.gzip") returned 0
	[0066.344] lstrlenA (lpString="*.gzip") returned 6
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.jpg") returned 0
	[0066.344] lstrlenA (lpString="*.jpg") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.jpeg") returned 0
	[0066.344] lstrlenA (lpString="*.jpeg") returned 6
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.psd") returned 0
	[0066.344] lstrlenA (lpString="*.psd") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.cdr") returned 0
	[0066.344] lstrlenA (lpString="*.cdr") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.dwg") returned 0
	[0066.344] lstrlenA (lpString="*.dwg") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.max") returned 0
	[0066.344] lstrlenA (lpString="*.max") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.bmp") returned 0
	[0066.344] lstrlenA (lpString="*.bmp") returned 5
	[0066.344] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.gif") returned 1
	[0066.344] lstrlenA (lpString="*.gif") returned 5
	[0066.344] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif"
	[0066.344] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif"
	[0066.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif."
	[0066.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.Boom"
	[0066.345] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.345] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f
	[0066.345] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.345] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.345] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32c, lpOverlapped=0x0) returned 1
	[0066.349] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="rtf_center.gif"
	[0066.349] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.349] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32c, lpOverlapped=0x0) returned 1
	[0066.349] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.349] CloseHandle (hObject=0x98) returned 1
	[0066.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.boom")) returned 1
	[0066.350] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.350] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.350] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosecolor.gif") returned -1
	[0066.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1
	[0066.350] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1
	[0066.350] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="rtf_center.gif"
	[0066.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif"
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0
	[0066.351] lstrlenA (lpString="*.zip") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0
	[0066.351] lstrlenA (lpString="*.rar") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0
	[0066.351] lstrlenA (lpString="*.7z") returned 4
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0
	[0066.351] lstrlenA (lpString="*.tar") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0
	[0066.351] lstrlenA (lpString="*.gzip") returned 6
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0
	[0066.351] lstrlenA (lpString="*.jpg") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0
	[0066.351] lstrlenA (lpString="*.jpeg") returned 6
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0
	[0066.351] lstrlenA (lpString="*.psd") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.cdr") returned 0
	[0066.351] lstrlenA (lpString="*.cdr") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.dwg") returned 0
	[0066.351] lstrlenA (lpString="*.dwg") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.max") returned 0
	[0066.351] lstrlenA (lpString="*.max") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.bmp") returned 0
	[0066.351] lstrlenA (lpString="*.bmp") returned 5
	[0066.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1
	[0066.351] lstrlenA (lpString="*.gif") returned 5
	[0066.351] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif"
	[0066.351] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif"
	[0066.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif."
	[0066.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.Boom"
	[0066.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.352] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec
	[0066.352] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.352] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.352] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3c9, lpOverlapped=0x0) returned 1
	[0066.353] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif"
	[0066.353] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.353] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3c9, lpOverlapped=0x0) returned 1
	[0066.353] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.353] CloseHandle (hObject=0x98) returned 1
	[0066.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.boom")) returned 1
	[0066.354] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.354] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.354] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosefont.gif") returned -1
	[0066.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1
	[0066.354] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1
	[0066.354] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif"
	[0066.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.354] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif"
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.zip") returned 0
	[0066.354] lstrlenA (lpString="*.zip") returned 5
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.rar") returned 0
	[0066.354] lstrlenA (lpString="*.rar") returned 5
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.7z") returned 0
	[0066.354] lstrlenA (lpString="*.7z") returned 4
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.tar") returned 0
	[0066.354] lstrlenA (lpString="*.tar") returned 5
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.gzip") returned 0
	[0066.354] lstrlenA (lpString="*.gzip") returned 6
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.jpg") returned 0
	[0066.354] lstrlenA (lpString="*.jpg") returned 5
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.jpeg") returned 0
	[0066.354] lstrlenA (lpString="*.jpeg") returned 6
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.psd") returned 0
	[0066.354] lstrlenA (lpString="*.psd") returned 5
	[0066.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.cdr") returned 0
	[0066.354] lstrlenA (lpString="*.cdr") returned 5
	[0066.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.dwg") returned 0
	[0066.355] lstrlenA (lpString="*.dwg") returned 5
	[0066.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.max") returned 0
	[0066.355] lstrlenA (lpString="*.max") returned 5
	[0066.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.bmp") returned 0
	[0066.355] lstrlenA (lpString="*.bmp") returned 5
	[0066.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.gif") returned 1
	[0066.355] lstrlenA (lpString="*.gif") returned 5
	[0066.355] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif"
	[0066.355] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif"
	[0066.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif."
	[0066.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.Boom"
	[0066.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.355] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a
	[0066.355] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.355] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.355] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x357, lpOverlapped=0x0) returned 1
	[0066.356] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="rtf_choosefont.gif"
	[0066.356] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.356] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x357, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x357, lpOverlapped=0x0) returned 1
	[0066.357] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.357] CloseHandle (hObject=0x98) returned 1
	[0066.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.boom")) returned 1
	[0066.357] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.358] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.358] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_decreaseindent.gif") returned -1
	[0066.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1
	[0066.358] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1
	[0066.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="rtf_choosefont.gif"
	[0066.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.358] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif"
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0
	[0066.359] lstrlenA (lpString="*.zip") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0
	[0066.359] lstrlenA (lpString="*.rar") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0
	[0066.359] lstrlenA (lpString="*.7z") returned 4
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0
	[0066.359] lstrlenA (lpString="*.tar") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0
	[0066.359] lstrlenA (lpString="*.gzip") returned 6
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0
	[0066.359] lstrlenA (lpString="*.jpg") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0
	[0066.359] lstrlenA (lpString="*.jpeg") returned 6
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0
	[0066.359] lstrlenA (lpString="*.psd") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.cdr") returned 0
	[0066.359] lstrlenA (lpString="*.cdr") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.dwg") returned 0
	[0066.359] lstrlenA (lpString="*.dwg") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.max") returned 0
	[0066.359] lstrlenA (lpString="*.max") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.bmp") returned 0
	[0066.359] lstrlenA (lpString="*.bmp") returned 5
	[0066.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1
	[0066.359] lstrlenA (lpString="*.gif") returned 5
	[0066.359] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif"
	[0066.359] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif"
	[0066.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif."
	[0066.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.Boom"
	[0066.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.360] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f
	[0066.360] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.360] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.360] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33c, lpOverlapped=0x0) returned 1
	[0066.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif"
	[0066.361] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.361] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33c, lpOverlapped=0x0) returned 1
	[0066.361] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.361] CloseHandle (hObject=0x98) returned 1
	[0066.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.boom")) returned 1
	[0066.362] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.362] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.362] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_hyperlink.gif") returned -1
	[0066.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1
	[0066.362] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1
	[0066.362] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif"
	[0066.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.362] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.362] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif"
	[0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.zip") returned 0
	[0066.362] lstrlenA (lpString="*.zip") returned 5
	[0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.rar") returned 0
	[0066.362] lstrlenA (lpString="*.rar") returned 5
	[0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.7z") returned 0
	[0066.362] lstrlenA (lpString="*.7z") returned 4
	[0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.tar") returned 0
	[0066.362] lstrlenA (lpString="*.tar") returned 5
	[0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.gzip") returned 0
	[0066.363] lstrlenA (lpString="*.gzip") returned 6
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.jpg") returned 0
	[0066.363] lstrlenA (lpString="*.jpg") returned 5
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.jpeg") returned 0
	[0066.363] lstrlenA (lpString="*.jpeg") returned 6
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.psd") returned 0
	[0066.363] lstrlenA (lpString="*.psd") returned 5
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.cdr") returned 0
	[0066.363] lstrlenA (lpString="*.cdr") returned 5
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.dwg") returned 0
	[0066.363] lstrlenA (lpString="*.dwg") returned 5
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.max") returned 0
	[0066.363] lstrlenA (lpString="*.max") returned 5
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.bmp") returned 0
	[0066.363] lstrlenA (lpString="*.bmp") returned 5
	[0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.gif") returned 1
	[0066.363] lstrlenA (lpString="*.gif") returned 5
	[0066.363] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif"
	[0066.363] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif"
	[0066.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif."
	[0066.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.Boom"
	[0066.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.363] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1
	[0066.363] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.363] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.363] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xce, lpOverlapped=0x0) returned 1
	[0066.364] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif"
	[0066.364] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.364] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xce, lpOverlapped=0x0) returned 1
	[0066.364] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.364] CloseHandle (hObject=0x98) returned 1
	[0066.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.boom")) returned 1
	[0066.365] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.365] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.365] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_increaseindent.gif") returned -1
	[0066.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1
	[0066.365] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1
	[0066.365] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif"
	[0066.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.365] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.365] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif"
	[0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0
	[0066.365] lstrlenA (lpString="*.zip") returned 5
	[0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0
	[0066.365] lstrlenA (lpString="*.rar") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0
	[0066.366] lstrlenA (lpString="*.7z") returned 4
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0
	[0066.366] lstrlenA (lpString="*.tar") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0
	[0066.366] lstrlenA (lpString="*.gzip") returned 6
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0
	[0066.366] lstrlenA (lpString="*.jpg") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0
	[0066.366] lstrlenA (lpString="*.jpeg") returned 6
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0
	[0066.366] lstrlenA (lpString="*.psd") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.cdr") returned 0
	[0066.366] lstrlenA (lpString="*.cdr") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.dwg") returned 0
	[0066.366] lstrlenA (lpString="*.dwg") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.max") returned 0
	[0066.366] lstrlenA (lpString="*.max") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.bmp") returned 0
	[0066.366] lstrlenA (lpString="*.bmp") returned 5
	[0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1
	[0066.366] lstrlenA (lpString="*.gif") returned 5
	[0066.366] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif"
	[0066.366] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif"
	[0066.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif."
	[0066.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.Boom"
	[0066.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.366] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d
	[0066.366] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.367] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.367] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33a, lpOverlapped=0x0) returned 1
	[0066.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif"
	[0066.373] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.373] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33a, lpOverlapped=0x0) returned 1
	[0066.373] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.373] CloseHandle (hObject=0x98) returned 1
	[0066.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.boom")) returned 1
	[0066.374] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.374] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.374] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_italic.gif") returned -1
	[0066.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1
	[0066.374] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1
	[0066.374] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif"
	[0066.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif"
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.zip") returned 0
	[0066.374] lstrlenA (lpString="*.zip") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.rar") returned 0
	[0066.374] lstrlenA (lpString="*.rar") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.7z") returned 0
	[0066.374] lstrlenA (lpString="*.7z") returned 4
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.tar") returned 0
	[0066.374] lstrlenA (lpString="*.tar") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.gzip") returned 0
	[0066.374] lstrlenA (lpString="*.gzip") returned 6
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.jpg") returned 0
	[0066.374] lstrlenA (lpString="*.jpg") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.jpeg") returned 0
	[0066.374] lstrlenA (lpString="*.jpeg") returned 6
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.psd") returned 0
	[0066.374] lstrlenA (lpString="*.psd") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.cdr") returned 0
	[0066.374] lstrlenA (lpString="*.cdr") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.dwg") returned 0
	[0066.374] lstrlenA (lpString="*.dwg") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.max") returned 0
	[0066.374] lstrlenA (lpString="*.max") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.bmp") returned 0
	[0066.374] lstrlenA (lpString="*.bmp") returned 5
	[0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.gif") returned 1
	[0066.375] lstrlenA (lpString="*.gif") returned 5
	[0066.375] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif"
	[0066.375] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif"
	[0066.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif."
	[0066.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.Boom"
	[0066.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.375] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354
	[0066.375] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1
	[0066.375] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.375] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x331, lpOverlapped=0x0) returned 1
	[0066.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="rtf_italic.gif"
	[0066.447] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.447] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x331, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x331, lpOverlapped=0x0) returned 1
	[0066.447] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.447] CloseHandle (hObject=0x98) returned 1
	[0066.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.boom")) returned 1
	[0066.448] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.448] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.448] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_justify.gif") returned -1
	[0066.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1
	[0066.448] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1
	[0066.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="rtf_italic.gif"
	[0066.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.448] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif"
	[0066.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.zip") returned 0
	[0066.448] lstrlenA (lpString="*.zip") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.rar") returned 0
	[0066.449] lstrlenA (lpString="*.rar") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.7z") returned 0
	[0066.449] lstrlenA (lpString="*.7z") returned 4
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.tar") returned 0
	[0066.449] lstrlenA (lpString="*.tar") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.gzip") returned 0
	[0066.449] lstrlenA (lpString="*.gzip") returned 6
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.jpg") returned 0
	[0066.449] lstrlenA (lpString="*.jpg") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.jpeg") returned 0
	[0066.449] lstrlenA (lpString="*.jpeg") returned 6
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.psd") returned 0
	[0066.449] lstrlenA (lpString="*.psd") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.cdr") returned 0
	[0066.449] lstrlenA (lpString="*.cdr") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.dwg") returned 0
	[0066.449] lstrlenA (lpString="*.dwg") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.max") returned 0
	[0066.449] lstrlenA (lpString="*.max") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.bmp") returned 0
	[0066.449] lstrlenA (lpString="*.bmp") returned 5
	[0066.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.gif") returned 1
	[0066.449] lstrlenA (lpString="*.gif") returned 5
	[0066.449] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif"
	[0066.449] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif"
	[0066.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif."
	[0066.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.Boom"
	[0066.449] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.450] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352
	[0066.450] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.450] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.450] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32f, lpOverlapped=0x0) returned 1
	[0066.548] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="rtf_justify.gif"
	[0066.548] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.548] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32f, lpOverlapped=0x0) returned 1
	[0066.549] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.549] CloseHandle (hObject=0x98) returned 1
	[0066.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.boom")) returned 1
	[0066.550] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.550] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.550] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_pressed.gif") returned -1
	[0066.550] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1
	[0066.550] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1
	[0066.550] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="rtf_justify.gif"
	[0066.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif"
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.zip") returned 0
	[0066.550] lstrlenA (lpString="*.zip") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.rar") returned 0
	[0066.550] lstrlenA (lpString="*.rar") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.7z") returned 0
	[0066.550] lstrlenA (lpString="*.7z") returned 4
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.tar") returned 0
	[0066.550] lstrlenA (lpString="*.tar") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.gzip") returned 0
	[0066.550] lstrlenA (lpString="*.gzip") returned 6
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.jpg") returned 0
	[0066.550] lstrlenA (lpString="*.jpg") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0
	[0066.550] lstrlenA (lpString="*.jpeg") returned 6
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.psd") returned 0
	[0066.550] lstrlenA (lpString="*.psd") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.cdr") returned 0
	[0066.550] lstrlenA (lpString="*.cdr") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.dwg") returned 0
	[0066.550] lstrlenA (lpString="*.dwg") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.max") returned 0
	[0066.550] lstrlenA (lpString="*.max") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.bmp") returned 0
	[0066.550] lstrlenA (lpString="*.bmp") returned 5
	[0066.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.gif") returned 1
	[0066.550] lstrlenA (lpString="*.gif") returned 5
	[0066.551] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif"
	[0066.551] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif"
	[0066.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif."
	[0066.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.Boom"
	[0066.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.551] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373
	[0066.551] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.551] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.551] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x350, lpOverlapped=0x0) returned 1
	[0066.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="rtf_pressed.gif"
	[0066.575] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.575] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x350, lpOverlapped=0x0) returned 1
	[0066.575] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.575] CloseHandle (hObject=0x98) returned 1
	[0066.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.boom")) returned 1
	[0066.576] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.576] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.576] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_spellcheck.gif") returned -1
	[0066.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_spellcheck.gif") returned -1
	[0066.576] lstrcmpiA (lpString1="", lpString2="rtf_spellcheck.gif") returned -1
	[0066.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="rtf_pressed.gif"
	[0066.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif"
	[0066.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.zip") returned 0
	[0066.576] lstrlenA (lpString="*.zip") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.rar") returned 0
	[0066.577] lstrlenA (lpString="*.rar") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.7z") returned 0
	[0066.577] lstrlenA (lpString="*.7z") returned 4
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.tar") returned 0
	[0066.577] lstrlenA (lpString="*.tar") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.gzip") returned 0
	[0066.577] lstrlenA (lpString="*.gzip") returned 6
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.jpg") returned 0
	[0066.577] lstrlenA (lpString="*.jpg") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.jpeg") returned 0
	[0066.577] lstrlenA (lpString="*.jpeg") returned 6
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.psd") returned 0
	[0066.577] lstrlenA (lpString="*.psd") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.cdr") returned 0
	[0066.577] lstrlenA (lpString="*.cdr") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.dwg") returned 0
	[0066.577] lstrlenA (lpString="*.dwg") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.max") returned 0
	[0066.577] lstrlenA (lpString="*.max") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.bmp") returned 0
	[0066.577] lstrlenA (lpString="*.bmp") returned 5
	[0066.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.gif") returned 1
	[0066.577] lstrlenA (lpString="*.gif") returned 5
	[0066.577] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif"
	[0066.577] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif"
	[0066.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif."
	[0066.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.Boom"
	[0066.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.578] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0
	[0066.578] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.578] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.578] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7d, lpOverlapped=0x0) returned 1
	[0066.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif"
	[0066.579] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.579] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7d, lpOverlapped=0x0) returned 1
	[0066.579] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.579] CloseHandle (hObject=0x98) returned 1
	[0066.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.boom")) returned 1
	[0066.580] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.580] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.580] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_underline.gif") returned -1
	[0066.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1
	[0066.580] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1
	[0066.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif"
	[0066.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif"
	[0066.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.zip") returned 0
	[0066.580] lstrlenA (lpString="*.zip") returned 5
	[0066.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.rar") returned 0
	[0066.580] lstrlenA (lpString="*.rar") returned 5
	[0066.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.7z") returned 0
	[0066.581] lstrlenA (lpString="*.7z") returned 4
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.tar") returned 0
	[0066.581] lstrlenA (lpString="*.tar") returned 5
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.gzip") returned 0
	[0066.581] lstrlenA (lpString="*.gzip") returned 6
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.jpg") returned 0
	[0066.581] lstrlenA (lpString="*.jpg") returned 5
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.jpeg") returned 0
	[0066.581] lstrlenA (lpString="*.jpeg") returned 6
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.psd") returned 0
	[0066.581] lstrlenA (lpString="*.psd") returned 5
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.cdr") returned 0
	[0066.581] lstrlenA (lpString="*.cdr") returned 5
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.dwg") returned 0
	[0066.581] lstrlenA (lpString="*.dwg") returned 5
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.max") returned 0
	[0066.581] lstrlenA (lpString="*.max") returned 5
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.bmp") returned 0
	[0066.581] lstrlenA (lpString="*.bmp") returned 5
	[0066.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.gif") returned 1
	[0066.581] lstrlenA (lpString="*.gif") returned 5
	[0066.581] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif"
	[0066.581] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif"
	[0066.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif."
	[0066.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.Boom"
	[0066.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.582] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c
	[0066.582] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.582] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.582] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x339, lpOverlapped=0x0) returned 1
	[0066.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="rtf_underline.gif"
	[0066.583] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.583] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x339, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x339, lpOverlapped=0x0) returned 1
	[0066.583] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.584] CloseHandle (hObject=0x98) returned 1
	[0066.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.boom")) returned 1
	[0066.584] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.584] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.584] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SAVE.GIF") returned -1
	[0066.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1
	[0066.584] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1
	[0066.584] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="rtf_underline.gif"
	[0066.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF"
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.zip") returned 0
	[0066.585] lstrlenA (lpString="*.zip") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.rar") returned 0
	[0066.585] lstrlenA (lpString="*.rar") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.7z") returned 0
	[0066.585] lstrlenA (lpString="*.7z") returned 4
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.tar") returned 0
	[0066.585] lstrlenA (lpString="*.tar") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.gzip") returned 0
	[0066.585] lstrlenA (lpString="*.gzip") returned 6
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.jpg") returned 0
	[0066.585] lstrlenA (lpString="*.jpg") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.jpeg") returned 0
	[0066.585] lstrlenA (lpString="*.jpeg") returned 6
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.psd") returned 0
	[0066.585] lstrlenA (lpString="*.psd") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.cdr") returned 0
	[0066.585] lstrlenA (lpString="*.cdr") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.dwg") returned 0
	[0066.585] lstrlenA (lpString="*.dwg") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.max") returned 0
	[0066.585] lstrlenA (lpString="*.max") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.bmp") returned 0
	[0066.585] lstrlenA (lpString="*.bmp") returned 5
	[0066.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.gif") returned 1
	[0066.585] lstrlenA (lpString="*.gif") returned 5
	[0066.585] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF"
	[0066.585] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF"
	[0066.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF."
	[0066.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.Boom"
	[0066.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.586] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267
	[0066.586] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.586] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.587] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x244, lpOverlapped=0x0) returned 1
	[0066.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="SAVE.GIF"
	[0066.587] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.587] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x244, lpOverlapped=0x0) returned 1
	[0066.587] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.588] CloseHandle (hObject=0x98) returned 1
	[0066.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif.boom")) returned 1
	[0066.589] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.589] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.589] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1
	[0066.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1
	[0066.589] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1
	[0066.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="SAVE.GIF"
	[0066.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS"
	[0066.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.zip") returned 0
	[0066.589] lstrlenA (lpString="*.zip") returned 5
	[0066.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.rar") returned 0
	[0066.589] lstrlenA (lpString="*.rar") returned 5
	[0066.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.7z") returned 0
	[0066.589] lstrlenA (lpString="*.7z") returned 4
	[0066.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.tar") returned 0
	[0066.589] lstrlenA (lpString="*.tar") returned 5
	[0066.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.gzip") returned 0
	[0066.589] lstrlenA (lpString="*.gzip") returned 6
	[0066.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.jpg") returned 0
	[0066.590] lstrlenA (lpString="*.jpg") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.jpeg") returned 0
	[0066.590] lstrlenA (lpString="*.jpeg") returned 6
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.psd") returned 0
	[0066.590] lstrlenA (lpString="*.psd") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.cdr") returned 0
	[0066.590] lstrlenA (lpString="*.cdr") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.dwg") returned 0
	[0066.590] lstrlenA (lpString="*.dwg") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.max") returned 0
	[0066.590] lstrlenA (lpString="*.max") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.bmp") returned 0
	[0066.590] lstrlenA (lpString="*.bmp") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.gif") returned 0
	[0066.590] lstrlenA (lpString="*.gif") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.png") returned 0
	[0066.590] lstrlenA (lpString="*.png") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.doc") returned 0
	[0066.590] lstrlenA (lpString="*.doc") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.docx") returned 0
	[0066.590] lstrlenA (lpString="*.docx") returned 6
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.xls") returned 0
	[0066.590] lstrlenA (lpString="*.xls") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.xlsx") returned 0
	[0066.590] lstrlenA (lpString="*.xlsx") returned 6
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.ppt") returned 0
	[0066.590] lstrlenA (lpString="*.ppt") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.pptx") returned 0
	[0066.590] lstrlenA (lpString="*.pptx") returned 6
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.txt") returned 0
	[0066.590] lstrlenA (lpString="*.txt") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.pdf") returned 0
	[0066.590] lstrlenA (lpString="*.pdf") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.djvu") returned 0
	[0066.590] lstrlenA (lpString="*.djvu") returned 6
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.htm") returned 0
	[0066.590] lstrlenA (lpString="*.htm") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.html") returned 0
	[0066.590] lstrlenA (lpString="*.html") returned 6
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mdb") returned 0
	[0066.590] lstrlenA (lpString="*.mdb") returned 5
	[0066.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.cer") returned 0
	[0066.591] lstrlenA (lpString="*.cer") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.p12") returned 0
	[0066.591] lstrlenA (lpString="*.p12") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.pfx") returned 0
	[0066.591] lstrlenA (lpString="*.pfx") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.kwm") returned 0
	[0066.591] lstrlenA (lpString="*.kwm") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.pwm") returned 0
	[0066.591] lstrlenA (lpString="*.pwm") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.1cd") returned 0
	[0066.591] lstrlenA (lpString="*.1cd") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.md") returned 0
	[0066.591] lstrlenA (lpString="*.md") returned 4
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mdf") returned 0
	[0066.591] lstrlenA (lpString="*.mdf") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.dbf") returned 0
	[0066.591] lstrlenA (lpString="*.dbf") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.odt") returned 0
	[0066.591] lstrlenA (lpString="*.odt") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.vob") returned 0
	[0066.591] lstrlenA (lpString="*.vob") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.ifo") returned 0
	[0066.591] lstrlenA (lpString="*.ifo") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.lnk") returned 0
	[0066.591] lstrlenA (lpString="*.lnk") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.torrent") returned 0
	[0066.591] lstrlenA (lpString="*.torrent") returned 9
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mov") returned 0
	[0066.591] lstrlenA (lpString="*.mov") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.m2v") returned 0
	[0066.591] lstrlenA (lpString="*.m2v") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.3gp") returned 0
	[0066.591] lstrlenA (lpString="*.3gp") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mpeg") returned 0
	[0066.591] lstrlenA (lpString="*.mpeg") returned 6
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mpg") returned 0
	[0066.591] lstrlenA (lpString="*.mpg") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.flv") returned 0
	[0066.591] lstrlenA (lpString="*.flv") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.avi") returned 0
	[0066.591] lstrlenA (lpString="*.avi") returned 5
	[0066.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mp4") returned 0
	[0066.592] lstrlenA (lpString="*.mp4") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.wmv") returned 0
	[0066.592] lstrlenA (lpString="*.wmv") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.divx") returned 0
	[0066.592] lstrlenA (lpString="*.divx") returned 6
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mkv") returned 0
	[0066.592] lstrlenA (lpString="*.mkv") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mp3") returned 0
	[0066.592] lstrlenA (lpString="*.mp3") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.wav") returned 0
	[0066.592] lstrlenA (lpString="*.wav") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.flac") returned 0
	[0066.592] lstrlenA (lpString="*.flac") returned 6
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.ape") returned 0
	[0066.592] lstrlenA (lpString="*.ape") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.wma") returned 0
	[0066.592] lstrlenA (lpString="*.wma") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.ac3") returned 0
	[0066.592] lstrlenA (lpString="*.ac3") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.exe") returned 0
	[0066.592] lstrlenA (lpString="*.exe") returned 5
	[0066.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.apk") returned 0
	[0066.592] lstrlenA (lpString="*.apk") returned 5
	[0066.592] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.592] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.592] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1
	[0066.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1
	[0066.592] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1
	[0066.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="SUBMIT.JS"
	[0066.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.592] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js"
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.zip") returned 0
	[0066.593] lstrlenA (lpString="*.zip") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.rar") returned 0
	[0066.593] lstrlenA (lpString="*.rar") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.7z") returned 0
	[0066.593] lstrlenA (lpString="*.7z") returned 4
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.tar") returned 0
	[0066.593] lstrlenA (lpString="*.tar") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.gzip") returned 0
	[0066.593] lstrlenA (lpString="*.gzip") returned 6
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.jpg") returned 0
	[0066.593] lstrlenA (lpString="*.jpg") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.jpeg") returned 0
	[0066.593] lstrlenA (lpString="*.jpeg") returned 6
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.psd") returned 0
	[0066.593] lstrlenA (lpString="*.psd") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.cdr") returned 0
	[0066.593] lstrlenA (lpString="*.cdr") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.dwg") returned 0
	[0066.593] lstrlenA (lpString="*.dwg") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.max") returned 0
	[0066.593] lstrlenA (lpString="*.max") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.bmp") returned 0
	[0066.593] lstrlenA (lpString="*.bmp") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.gif") returned 0
	[0066.593] lstrlenA (lpString="*.gif") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.png") returned 0
	[0066.593] lstrlenA (lpString="*.png") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.doc") returned 0
	[0066.593] lstrlenA (lpString="*.doc") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.docx") returned 0
	[0066.593] lstrlenA (lpString="*.docx") returned 6
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.xls") returned 0
	[0066.593] lstrlenA (lpString="*.xls") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.xlsx") returned 0
	[0066.593] lstrlenA (lpString="*.xlsx") returned 6
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.ppt") returned 0
	[0066.593] lstrlenA (lpString="*.ppt") returned 5
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.pptx") returned 0
	[0066.593] lstrlenA (lpString="*.pptx") returned 6
	[0066.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.txt") returned 0
	[0066.593] lstrlenA (lpString="*.txt") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.pdf") returned 0
	[0066.594] lstrlenA (lpString="*.pdf") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.djvu") returned 0
	[0066.594] lstrlenA (lpString="*.djvu") returned 6
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.htm") returned 0
	[0066.594] lstrlenA (lpString="*.htm") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.html") returned 0
	[0066.594] lstrlenA (lpString="*.html") returned 6
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mdb") returned 0
	[0066.594] lstrlenA (lpString="*.mdb") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.cer") returned 0
	[0066.594] lstrlenA (lpString="*.cer") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.p12") returned 0
	[0066.594] lstrlenA (lpString="*.p12") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.pfx") returned 0
	[0066.594] lstrlenA (lpString="*.pfx") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.kwm") returned 0
	[0066.594] lstrlenA (lpString="*.kwm") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.pwm") returned 0
	[0066.594] lstrlenA (lpString="*.pwm") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.1cd") returned 0
	[0066.594] lstrlenA (lpString="*.1cd") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.md") returned 0
	[0066.594] lstrlenA (lpString="*.md") returned 4
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mdf") returned 0
	[0066.594] lstrlenA (lpString="*.mdf") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.dbf") returned 0
	[0066.594] lstrlenA (lpString="*.dbf") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.odt") returned 0
	[0066.594] lstrlenA (lpString="*.odt") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.vob") returned 0
	[0066.594] lstrlenA (lpString="*.vob") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.ifo") returned 0
	[0066.594] lstrlenA (lpString="*.ifo") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.lnk") returned 0
	[0066.594] lstrlenA (lpString="*.lnk") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.torrent") returned 0
	[0066.594] lstrlenA (lpString="*.torrent") returned 9
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mov") returned 0
	[0066.594] lstrlenA (lpString="*.mov") returned 5
	[0066.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.m2v") returned 0
	[0066.595] lstrlenA (lpString="*.m2v") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.3gp") returned 0
	[0066.595] lstrlenA (lpString="*.3gp") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mpeg") returned 0
	[0066.595] lstrlenA (lpString="*.mpeg") returned 6
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mpg") returned 0
	[0066.595] lstrlenA (lpString="*.mpg") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.flv") returned 0
	[0066.595] lstrlenA (lpString="*.flv") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.avi") returned 0
	[0066.595] lstrlenA (lpString="*.avi") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mp4") returned 0
	[0066.595] lstrlenA (lpString="*.mp4") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.wmv") returned 0
	[0066.595] lstrlenA (lpString="*.wmv") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.divx") returned 0
	[0066.595] lstrlenA (lpString="*.divx") returned 6
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mkv") returned 0
	[0066.595] lstrlenA (lpString="*.mkv") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mp3") returned 0
	[0066.595] lstrlenA (lpString="*.mp3") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.wav") returned 0
	[0066.595] lstrlenA (lpString="*.wav") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.flac") returned 0
	[0066.595] lstrlenA (lpString="*.flac") returned 6
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.ape") returned 0
	[0066.595] lstrlenA (lpString="*.ape") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.wma") returned 0
	[0066.595] lstrlenA (lpString="*.wma") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.ac3") returned 0
	[0066.595] lstrlenA (lpString="*.ac3") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.exe") returned 0
	[0066.595] lstrlenA (lpString="*.exe") returned 5
	[0066.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.apk") returned 0
	[0066.595] lstrlenA (lpString="*.apk") returned 5
	[0066.595] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.595] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.595] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1
	[0066.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1
	[0066.595] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1
	[0066.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="utilityfunctions.js"
	[0066.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.596] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js"
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.zip") returned 0
	[0066.596] lstrlenA (lpString="*.zip") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.rar") returned 0
	[0066.596] lstrlenA (lpString="*.rar") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.7z") returned 0
	[0066.596] lstrlenA (lpString="*.7z") returned 4
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.tar") returned 0
	[0066.596] lstrlenA (lpString="*.tar") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.gzip") returned 0
	[0066.596] lstrlenA (lpString="*.gzip") returned 6
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.jpg") returned 0
	[0066.596] lstrlenA (lpString="*.jpg") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.jpeg") returned 0
	[0066.596] lstrlenA (lpString="*.jpeg") returned 6
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.psd") returned 0
	[0066.596] lstrlenA (lpString="*.psd") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.cdr") returned 0
	[0066.596] lstrlenA (lpString="*.cdr") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.dwg") returned 0
	[0066.596] lstrlenA (lpString="*.dwg") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.max") returned 0
	[0066.596] lstrlenA (lpString="*.max") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.bmp") returned 0
	[0066.596] lstrlenA (lpString="*.bmp") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.gif") returned 0
	[0066.596] lstrlenA (lpString="*.gif") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.png") returned 0
	[0066.596] lstrlenA (lpString="*.png") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.doc") returned 0
	[0066.596] lstrlenA (lpString="*.doc") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.docx") returned 0
	[0066.596] lstrlenA (lpString="*.docx") returned 6
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.xls") returned 0
	[0066.596] lstrlenA (lpString="*.xls") returned 5
	[0066.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.xlsx") returned 0
	[0066.597] lstrlenA (lpString="*.xlsx") returned 6
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.ppt") returned 0
	[0066.597] lstrlenA (lpString="*.ppt") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.pptx") returned 0
	[0066.597] lstrlenA (lpString="*.pptx") returned 6
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.txt") returned 0
	[0066.597] lstrlenA (lpString="*.txt") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.pdf") returned 0
	[0066.597] lstrlenA (lpString="*.pdf") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.djvu") returned 0
	[0066.597] lstrlenA (lpString="*.djvu") returned 6
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.htm") returned 0
	[0066.597] lstrlenA (lpString="*.htm") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.html") returned 0
	[0066.597] lstrlenA (lpString="*.html") returned 6
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mdb") returned 0
	[0066.597] lstrlenA (lpString="*.mdb") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.cer") returned 0
	[0066.597] lstrlenA (lpString="*.cer") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.p12") returned 0
	[0066.597] lstrlenA (lpString="*.p12") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.pfx") returned 0
	[0066.597] lstrlenA (lpString="*.pfx") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.kwm") returned 0
	[0066.597] lstrlenA (lpString="*.kwm") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.pwm") returned 0
	[0066.597] lstrlenA (lpString="*.pwm") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.1cd") returned 0
	[0066.597] lstrlenA (lpString="*.1cd") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.md") returned 0
	[0066.597] lstrlenA (lpString="*.md") returned 4
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mdf") returned 0
	[0066.597] lstrlenA (lpString="*.mdf") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.dbf") returned 0
	[0066.597] lstrlenA (lpString="*.dbf") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.odt") returned 0
	[0066.597] lstrlenA (lpString="*.odt") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.vob") returned 0
	[0066.597] lstrlenA (lpString="*.vob") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.ifo") returned 0
	[0066.597] lstrlenA (lpString="*.ifo") returned 5
	[0066.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.lnk") returned 0
	[0066.597] lstrlenA (lpString="*.lnk") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.torrent") returned 0
	[0066.598] lstrlenA (lpString="*.torrent") returned 9
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mov") returned 0
	[0066.598] lstrlenA (lpString="*.mov") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.m2v") returned 0
	[0066.598] lstrlenA (lpString="*.m2v") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.3gp") returned 0
	[0066.598] lstrlenA (lpString="*.3gp") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mpeg") returned 0
	[0066.598] lstrlenA (lpString="*.mpeg") returned 6
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mpg") returned 0
	[0066.598] lstrlenA (lpString="*.mpg") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.flv") returned 0
	[0066.598] lstrlenA (lpString="*.flv") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.avi") returned 0
	[0066.598] lstrlenA (lpString="*.avi") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mp4") returned 0
	[0066.598] lstrlenA (lpString="*.mp4") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.wmv") returned 0
	[0066.598] lstrlenA (lpString="*.wmv") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.divx") returned 0
	[0066.598] lstrlenA (lpString="*.divx") returned 6
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mkv") returned 0
	[0066.598] lstrlenA (lpString="*.mkv") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mp3") returned 0
	[0066.598] lstrlenA (lpString="*.mp3") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.wav") returned 0
	[0066.598] lstrlenA (lpString="*.wav") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.flac") returned 0
	[0066.598] lstrlenA (lpString="*.flac") returned 6
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.ape") returned 0
	[0066.598] lstrlenA (lpString="*.ape") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.wma") returned 0
	[0066.598] lstrlenA (lpString="*.wma") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.ac3") returned 0
	[0066.598] lstrlenA (lpString="*.ac3") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.exe") returned 0
	[0066.598] lstrlenA (lpString="*.exe") returned 5
	[0066.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.apk") returned 0
	[0066.598] lstrlenA (lpString="*.apk") returned 5
	[0066.598] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.598] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.599] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.ICO") returned -1
	[0066.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1
	[0066.599] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1
	[0066.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="validation.js"
	[0066.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.599] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO"
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.zip") returned 0
	[0066.599] lstrlenA (lpString="*.zip") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.rar") returned 0
	[0066.599] lstrlenA (lpString="*.rar") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.7z") returned 0
	[0066.599] lstrlenA (lpString="*.7z") returned 4
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.tar") returned 0
	[0066.599] lstrlenA (lpString="*.tar") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.gzip") returned 0
	[0066.599] lstrlenA (lpString="*.gzip") returned 6
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.jpg") returned 0
	[0066.599] lstrlenA (lpString="*.jpg") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.jpeg") returned 0
	[0066.599] lstrlenA (lpString="*.jpeg") returned 6
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.psd") returned 0
	[0066.599] lstrlenA (lpString="*.psd") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.cdr") returned 0
	[0066.599] lstrlenA (lpString="*.cdr") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.dwg") returned 0
	[0066.599] lstrlenA (lpString="*.dwg") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.max") returned 0
	[0066.599] lstrlenA (lpString="*.max") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.bmp") returned 0
	[0066.599] lstrlenA (lpString="*.bmp") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.gif") returned 0
	[0066.599] lstrlenA (lpString="*.gif") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.png") returned 0
	[0066.599] lstrlenA (lpString="*.png") returned 5
	[0066.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.doc") returned 0
	[0066.599] lstrlenA (lpString="*.doc") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.docx") returned 0
	[0066.600] lstrlenA (lpString="*.docx") returned 6
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.xls") returned 0
	[0066.600] lstrlenA (lpString="*.xls") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.xlsx") returned 0
	[0066.600] lstrlenA (lpString="*.xlsx") returned 6
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.ppt") returned 0
	[0066.600] lstrlenA (lpString="*.ppt") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.pptx") returned 0
	[0066.600] lstrlenA (lpString="*.pptx") returned 6
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.txt") returned 0
	[0066.600] lstrlenA (lpString="*.txt") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.pdf") returned 0
	[0066.600] lstrlenA (lpString="*.pdf") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.djvu") returned 0
	[0066.600] lstrlenA (lpString="*.djvu") returned 6
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.htm") returned 0
	[0066.600] lstrlenA (lpString="*.htm") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.html") returned 0
	[0066.600] lstrlenA (lpString="*.html") returned 6
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mdb") returned 0
	[0066.600] lstrlenA (lpString="*.mdb") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.cer") returned 0
	[0066.600] lstrlenA (lpString="*.cer") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.p12") returned 0
	[0066.600] lstrlenA (lpString="*.p12") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.pfx") returned 0
	[0066.600] lstrlenA (lpString="*.pfx") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.kwm") returned 0
	[0066.600] lstrlenA (lpString="*.kwm") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.pwm") returned 0
	[0066.600] lstrlenA (lpString="*.pwm") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.1cd") returned 0
	[0066.600] lstrlenA (lpString="*.1cd") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.md") returned 0
	[0066.600] lstrlenA (lpString="*.md") returned 4
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mdf") returned 0
	[0066.600] lstrlenA (lpString="*.mdf") returned 5
	[0066.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.dbf") returned 0
	[0066.600] lstrlenA (lpString="*.dbf") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.odt") returned 0
	[0066.601] lstrlenA (lpString="*.odt") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.vob") returned 0
	[0066.601] lstrlenA (lpString="*.vob") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.ifo") returned 0
	[0066.601] lstrlenA (lpString="*.ifo") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.lnk") returned 0
	[0066.601] lstrlenA (lpString="*.lnk") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.torrent") returned 0
	[0066.601] lstrlenA (lpString="*.torrent") returned 9
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mov") returned 0
	[0066.601] lstrlenA (lpString="*.mov") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.m2v") returned 0
	[0066.601] lstrlenA (lpString="*.m2v") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.3gp") returned 0
	[0066.601] lstrlenA (lpString="*.3gp") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mpeg") returned 0
	[0066.601] lstrlenA (lpString="*.mpeg") returned 6
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mpg") returned 0
	[0066.601] lstrlenA (lpString="*.mpg") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.flv") returned 0
	[0066.601] lstrlenA (lpString="*.flv") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.avi") returned 0
	[0066.601] lstrlenA (lpString="*.avi") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mp4") returned 0
	[0066.601] lstrlenA (lpString="*.mp4") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.wmv") returned 0
	[0066.601] lstrlenA (lpString="*.wmv") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.divx") returned 0
	[0066.601] lstrlenA (lpString="*.divx") returned 6
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mkv") returned 0
	[0066.601] lstrlenA (lpString="*.mkv") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mp3") returned 0
	[0066.601] lstrlenA (lpString="*.mp3") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.wav") returned 0
	[0066.601] lstrlenA (lpString="*.wav") returned 5
	[0066.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.flac") returned 0
	[0066.601] lstrlenA (lpString="*.flac") returned 6
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.ape") returned 0
	[0066.602] lstrlenA (lpString="*.ape") returned 5
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.wma") returned 0
	[0066.602] lstrlenA (lpString="*.wma") returned 5
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.ac3") returned 0
	[0066.602] lstrlenA (lpString="*.ac3") returned 5
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.exe") returned 0
	[0066.602] lstrlenA (lpString="*.exe") returned 5
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.apk") returned 0
	[0066.602] lstrlenA (lpString="*.apk") returned 5
	[0066.602] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.602] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.602] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.JS") returned -1
	[0066.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1
	[0066.602] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1
	[0066.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="VIEW.ICO"
	[0066.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.602] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS"
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.zip") returned 0
	[0066.602] lstrlenA (lpString="*.zip") returned 5
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.rar") returned 0
	[0066.602] lstrlenA (lpString="*.rar") returned 5
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.7z") returned 0
	[0066.602] lstrlenA (lpString="*.7z") returned 4
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.tar") returned 0
	[0066.602] lstrlenA (lpString="*.tar") returned 5
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.gzip") returned 0
	[0066.602] lstrlenA (lpString="*.gzip") returned 6
	[0066.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.jpg") returned 0
	[0066.602] lstrlenA (lpString="*.jpg") returned 5
	[0066.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.jpeg") returned 0
	[0066.603] lstrlenA (lpString="*.jpeg") returned 6
	[0066.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.psd") returned 0
	[0066.603] lstrlenA (lpString="*.psd") returned 5
	[0066.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.cdr") returned 0
	[0066.603] lstrlenA (lpString="*.cdr") returned 5
	[0066.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.dwg") returned 0
	[0066.603] lstrlenA (lpString="*.dwg") returned 5
	[0066.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.max") returned 0
	[0066.603] lstrlenA (lpString="*.max") returned 5
	[0066.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.bmp") returned 0
	[0066.603] lstrlenA (lpString="*.bmp") returned 5
	[0066.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.gif") returned 0
	[0066.603] lstrlenA (lpString="*.gif") returned 5
	[0066.603] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.603] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ViewHeaderPreview.jpg") returned -1
	[0066.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1
	[0066.603] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1
	[0066.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="VIEW.JS"
	[0066.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\"
	[0066.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned=""
	[0066.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt"
	[0066.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20
	[0066.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg"
	[0066.603] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg"
	[0066.603] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg"
	[0066.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg."
	[0066.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.Boom"
	[0066.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.604] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78
	[0066.604] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.604] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.604] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd55, lpOverlapped=0x0) returned 1
	[0066.606] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg"
	[0066.606] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.606] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd55, lpOverlapped=0x0) returned 1
	[0066.606] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.606] CloseHandle (hObject=0x98) returned 1
	[0066.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.boom")) returned 1
	[0066.607] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0066.607] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0066.607] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0066.607] lstrcmpA (lpString1=".", lpString2="GrooveForms5") returned -1
	[0066.607] lstrcmpA (lpString1="..", lpString2="GrooveForms5") returned -1
	[0066.607] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0066.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms5" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5"
	[0066.607] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned 82
	[0066.607] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0066.623] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0066.623] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.624] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0066.624] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0066.624] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.624] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.624] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADD.GIF") returned 1
	[0066.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1
	[0066.624] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1
	[0066.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*") returned="*.*"
	[0066.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0xffffffff
	[0066.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.625] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0066.625] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0066.626] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0066.626] CloseHandle (hObject=0x98) returned 1
	[0066.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF"
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.zip") returned 0
	[0066.626] lstrlenA (lpString="*.zip") returned 5
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.rar") returned 0
	[0066.626] lstrlenA (lpString="*.rar") returned 5
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.7z") returned 0
	[0066.626] lstrlenA (lpString="*.7z") returned 4
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.tar") returned 0
	[0066.626] lstrlenA (lpString="*.tar") returned 5
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gzip") returned 0
	[0066.626] lstrlenA (lpString="*.gzip") returned 6
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpg") returned 0
	[0066.626] lstrlenA (lpString="*.jpg") returned 5
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpeg") returned 0
	[0066.626] lstrlenA (lpString="*.jpeg") returned 6
	[0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.psd") returned 0
	[0066.626] lstrlenA (lpString="*.psd") returned 5
	[0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.cdr") returned 0
	[0066.627] lstrlenA (lpString="*.cdr") returned 5
	[0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.dwg") returned 0
	[0066.627] lstrlenA (lpString="*.dwg") returned 5
	[0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.max") returned 0
	[0066.627] lstrlenA (lpString="*.max") returned 5
	[0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.bmp") returned 0
	[0066.627] lstrlenA (lpString="*.bmp") returned 5
	[0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gif") returned 1
	[0066.627] lstrlenA (lpString="*.gif") returned 5
	[0066.627] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF"
	[0066.627] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF"
	[0066.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF."
	[0066.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.Boom"
	[0066.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.627] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244
	[0066.627] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.627] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.628] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x221, lpOverlapped=0x0) returned 1
	[0066.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="ADD.GIF"
	[0066.628] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.628] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x221, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x221, lpOverlapped=0x0) returned 1
	[0066.628] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.628] CloseHandle (hObject=0x98) returned 1
	[0066.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif.boom")) returned 1
	[0066.629] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.629] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.629] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1
	[0066.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1
	[0066.629] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1
	[0066.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="ADD.GIF"
	[0066.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif"
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.zip") returned 0
	[0066.630] lstrlenA (lpString="*.zip") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.rar") returned 0
	[0066.630] lstrlenA (lpString="*.rar") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.7z") returned 0
	[0066.630] lstrlenA (lpString="*.7z") returned 4
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.tar") returned 0
	[0066.630] lstrlenA (lpString="*.tar") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gzip") returned 0
	[0066.630] lstrlenA (lpString="*.gzip") returned 6
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpg") returned 0
	[0066.630] lstrlenA (lpString="*.jpg") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpeg") returned 0
	[0066.630] lstrlenA (lpString="*.jpeg") returned 6
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.psd") returned 0
	[0066.630] lstrlenA (lpString="*.psd") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.cdr") returned 0
	[0066.630] lstrlenA (lpString="*.cdr") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.dwg") returned 0
	[0066.630] lstrlenA (lpString="*.dwg") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.max") returned 0
	[0066.630] lstrlenA (lpString="*.max") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.bmp") returned 0
	[0066.630] lstrlenA (lpString="*.bmp") returned 5
	[0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gif") returned 1
	[0066.630] lstrlenA (lpString="*.gif") returned 5
	[0066.630] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif"
	[0066.630] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif"
	[0066.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif."
	[0066.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.Boom"
	[0066.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.631] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8
	[0066.631] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.631] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.631] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xac5, lpOverlapped=0x0) returned 1
	[0066.644] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="attention.gif"
	[0066.644] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.644] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xac5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xac5, lpOverlapped=0x0) returned 1
	[0066.644] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.644] CloseHandle (hObject=0x98) returned 1
	[0066.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.boom")) returned 1
	[0066.646] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.646] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.646] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.GIF") returned 1
	[0066.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1
	[0066.646] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1
	[0066.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="attention.gif"
	[0066.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.646] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF"
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.zip") returned 0
	[0066.646] lstrlenA (lpString="*.zip") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.rar") returned 0
	[0066.646] lstrlenA (lpString="*.rar") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.7z") returned 0
	[0066.646] lstrlenA (lpString="*.7z") returned 4
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.tar") returned 0
	[0066.646] lstrlenA (lpString="*.tar") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gzip") returned 0
	[0066.646] lstrlenA (lpString="*.gzip") returned 6
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpg") returned 0
	[0066.646] lstrlenA (lpString="*.jpg") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0
	[0066.646] lstrlenA (lpString="*.jpeg") returned 6
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.psd") returned 0
	[0066.646] lstrlenA (lpString="*.psd") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.cdr") returned 0
	[0066.646] lstrlenA (lpString="*.cdr") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.dwg") returned 0
	[0066.646] lstrlenA (lpString="*.dwg") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.max") returned 0
	[0066.646] lstrlenA (lpString="*.max") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.bmp") returned 0
	[0066.646] lstrlenA (lpString="*.bmp") returned 5
	[0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gif") returned 1
	[0066.647] lstrlenA (lpString="*.gif") returned 5
	[0066.647] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF"
	[0066.647] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF"
	[0066.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF."
	[0066.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.Boom"
	[0066.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.647] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383
	[0066.647] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.647] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.647] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x360, lpOverlapped=0x0) returned 1
	[0066.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="CALENDAR.GIF"
	[0066.668] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.668] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1
	[0066.668] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.668] CloseHandle (hObject=0x98) returned 1
	[0066.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif.boom")) returned 1
	[0066.669] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.669] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.669] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELETE.GIF") returned 1
	[0066.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1
	[0066.669] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1
	[0066.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="CALENDAR.GIF"
	[0066.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF"
	[0066.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.zip") returned 0
	[0066.669] lstrlenA (lpString="*.zip") returned 5
	[0066.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.rar") returned 0
	[0066.669] lstrlenA (lpString="*.rar") returned 5
	[0066.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.7z") returned 0
	[0066.669] lstrlenA (lpString="*.7z") returned 4
	[0066.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.tar") returned 0
	[0066.669] lstrlenA (lpString="*.tar") returned 5
	[0066.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.gzip") returned 0
	[0066.669] lstrlenA (lpString="*.gzip") returned 6
	[0066.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.jpg") returned 0
	[0066.670] lstrlenA (lpString="*.jpg") returned 5
	[0066.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.jpeg") returned 0
	[0066.670] lstrlenA (lpString="*.jpeg") returned 6
	[0066.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.psd") returned 0
	[0066.670] lstrlenA (lpString="*.psd") returned 5
	[0066.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.cdr") returned 0
	[0066.670] lstrlenA (lpString="*.cdr") returned 5
	[0066.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.dwg") returned 0
	[0066.670] lstrlenA (lpString="*.dwg") returned 5
	[0066.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.max") returned 0
	[0066.670] lstrlenA (lpString="*.max") returned 5
	[0066.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.bmp") returned 0
	[0066.670] lstrlenA (lpString="*.bmp") returned 5
	[0066.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.gif") returned 1
	[0066.670] lstrlenA (lpString="*.gif") returned 5
	[0066.670] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF"
	[0066.670] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF"
	[0066.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF."
	[0066.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.Boom"
	[0066.670] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.671] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271
	[0066.671] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.671] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.671] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24e, lpOverlapped=0x0) returned 1
	[0066.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="DELETE.GIF"
	[0066.672] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.672] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24e, lpOverlapped=0x0) returned 1
	[0066.672] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.672] CloseHandle (hObject=0x98) returned 1
	[0066.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif.boom")) returned 1
	[0066.681] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.681] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.681] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ERROR.GIF") returned -1
	[0066.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1
	[0066.681] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1
	[0066.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="DELETE.GIF"
	[0066.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF"
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.zip") returned 0
	[0066.681] lstrlenA (lpString="*.zip") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.rar") returned 0
	[0066.681] lstrlenA (lpString="*.rar") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.7z") returned 0
	[0066.681] lstrlenA (lpString="*.7z") returned 4
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.tar") returned 0
	[0066.681] lstrlenA (lpString="*.tar") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.gzip") returned 0
	[0066.681] lstrlenA (lpString="*.gzip") returned 6
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.jpg") returned 0
	[0066.681] lstrlenA (lpString="*.jpg") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.jpeg") returned 0
	[0066.681] lstrlenA (lpString="*.jpeg") returned 6
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.psd") returned 0
	[0066.681] lstrlenA (lpString="*.psd") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.cdr") returned 0
	[0066.681] lstrlenA (lpString="*.cdr") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.dwg") returned 0
	[0066.681] lstrlenA (lpString="*.dwg") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.max") returned 0
	[0066.681] lstrlenA (lpString="*.max") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.bmp") returned 0
	[0066.681] lstrlenA (lpString="*.bmp") returned 5
	[0066.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.gif") returned 1
	[0066.681] lstrlenA (lpString="*.gif") returned 5
	[0066.682] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF"
	[0066.682] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF"
	[0066.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF."
	[0066.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.Boom"
	[0066.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.683] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369
	[0066.683] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6099bdd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.683] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.683] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x346, lpOverlapped=0x0) returned 1
	[0066.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="ERROR.GIF"
	[0066.684] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.684] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x346, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x346, lpOverlapped=0x0) returned 1
	[0066.684] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.684] CloseHandle (hObject=0x98) returned 1
	[0066.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif.boom")) returned 1
	[0066.685] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.685] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.685] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.JS") returned -1
	[0066.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1
	[0066.685] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1
	[0066.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="ERROR.GIF"
	[0066.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS"
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.zip") returned 0
	[0066.685] lstrlenA (lpString="*.zip") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.rar") returned 0
	[0066.685] lstrlenA (lpString="*.rar") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.7z") returned 0
	[0066.685] lstrlenA (lpString="*.7z") returned 4
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.tar") returned 0
	[0066.685] lstrlenA (lpString="*.tar") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.gzip") returned 0
	[0066.685] lstrlenA (lpString="*.gzip") returned 6
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.jpg") returned 0
	[0066.685] lstrlenA (lpString="*.jpg") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.jpeg") returned 0
	[0066.685] lstrlenA (lpString="*.jpeg") returned 6
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.psd") returned 0
	[0066.685] lstrlenA (lpString="*.psd") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.cdr") returned 0
	[0066.685] lstrlenA (lpString="*.cdr") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.dwg") returned 0
	[0066.685] lstrlenA (lpString="*.dwg") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.max") returned 0
	[0066.685] lstrlenA (lpString="*.max") returned 5
	[0066.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.bmp") returned 0
	[0066.685] lstrlenA (lpString="*.bmp") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.gif") returned 0
	[0066.686] lstrlenA (lpString="*.gif") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.png") returned 0
	[0066.686] lstrlenA (lpString="*.png") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.doc") returned 0
	[0066.686] lstrlenA (lpString="*.doc") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.docx") returned 0
	[0066.686] lstrlenA (lpString="*.docx") returned 6
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.xls") returned 0
	[0066.686] lstrlenA (lpString="*.xls") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.xlsx") returned 0
	[0066.686] lstrlenA (lpString="*.xlsx") returned 6
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ppt") returned 0
	[0066.686] lstrlenA (lpString="*.ppt") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pptx") returned 0
	[0066.686] lstrlenA (lpString="*.pptx") returned 6
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.txt") returned 0
	[0066.686] lstrlenA (lpString="*.txt") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pdf") returned 0
	[0066.686] lstrlenA (lpString="*.pdf") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.djvu") returned 0
	[0066.686] lstrlenA (lpString="*.djvu") returned 6
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.htm") returned 0
	[0066.686] lstrlenA (lpString="*.htm") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.html") returned 0
	[0066.686] lstrlenA (lpString="*.html") returned 6
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mdb") returned 0
	[0066.686] lstrlenA (lpString="*.mdb") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.cer") returned 0
	[0066.686] lstrlenA (lpString="*.cer") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.p12") returned 0
	[0066.686] lstrlenA (lpString="*.p12") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pfx") returned 0
	[0066.686] lstrlenA (lpString="*.pfx") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.kwm") returned 0
	[0066.686] lstrlenA (lpString="*.kwm") returned 5
	[0066.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pwm") returned 0
	[0066.686] lstrlenA (lpString="*.pwm") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.1cd") returned 0
	[0066.687] lstrlenA (lpString="*.1cd") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.md") returned 0
	[0066.687] lstrlenA (lpString="*.md") returned 4
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mdf") returned 0
	[0066.687] lstrlenA (lpString="*.mdf") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.dbf") returned 0
	[0066.687] lstrlenA (lpString="*.dbf") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.odt") returned 0
	[0066.687] lstrlenA (lpString="*.odt") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.vob") returned 0
	[0066.687] lstrlenA (lpString="*.vob") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ifo") returned 0
	[0066.687] lstrlenA (lpString="*.ifo") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.lnk") returned 0
	[0066.687] lstrlenA (lpString="*.lnk") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.torrent") returned 0
	[0066.687] lstrlenA (lpString="*.torrent") returned 9
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mov") returned 0
	[0066.687] lstrlenA (lpString="*.mov") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.m2v") returned 0
	[0066.687] lstrlenA (lpString="*.m2v") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.3gp") returned 0
	[0066.687] lstrlenA (lpString="*.3gp") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mpeg") returned 0
	[0066.687] lstrlenA (lpString="*.mpeg") returned 6
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mpg") returned 0
	[0066.687] lstrlenA (lpString="*.mpg") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.flv") returned 0
	[0066.687] lstrlenA (lpString="*.flv") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.avi") returned 0
	[0066.687] lstrlenA (lpString="*.avi") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mp4") returned 0
	[0066.687] lstrlenA (lpString="*.mp4") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wmv") returned 0
	[0066.687] lstrlenA (lpString="*.wmv") returned 5
	[0066.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.divx") returned 0
	[0066.687] lstrlenA (lpString="*.divx") returned 6
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mkv") returned 0
	[0066.688] lstrlenA (lpString="*.mkv") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mp3") returned 0
	[0066.688] lstrlenA (lpString="*.mp3") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wav") returned 0
	[0066.688] lstrlenA (lpString="*.wav") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.flac") returned 0
	[0066.688] lstrlenA (lpString="*.flac") returned 6
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ape") returned 0
	[0066.688] lstrlenA (lpString="*.ape") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wma") returned 0
	[0066.688] lstrlenA (lpString="*.wma") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ac3") returned 0
	[0066.688] lstrlenA (lpString="*.ac3") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.exe") returned 0
	[0066.688] lstrlenA (lpString="*.exe") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.apk") returned 0
	[0066.688] lstrlenA (lpString="*.apk") returned 5
	[0066.688] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.688] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.688] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1
	[0066.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1
	[0066.688] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1
	[0066.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="FORM.JS"
	[0066.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.688] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html"
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.zip") returned 0
	[0066.688] lstrlenA (lpString="*.zip") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.rar") returned 0
	[0066.688] lstrlenA (lpString="*.rar") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.7z") returned 0
	[0066.688] lstrlenA (lpString="*.7z") returned 4
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.tar") returned 0
	[0066.688] lstrlenA (lpString="*.tar") returned 5
	[0066.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.gzip") returned 0
	[0066.689] lstrlenA (lpString="*.gzip") returned 6
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.jpg") returned 0
	[0066.689] lstrlenA (lpString="*.jpg") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0
	[0066.689] lstrlenA (lpString="*.jpeg") returned 6
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.psd") returned 0
	[0066.689] lstrlenA (lpString="*.psd") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.cdr") returned 0
	[0066.689] lstrlenA (lpString="*.cdr") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.dwg") returned 0
	[0066.689] lstrlenA (lpString="*.dwg") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.max") returned 0
	[0066.689] lstrlenA (lpString="*.max") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.bmp") returned 0
	[0066.689] lstrlenA (lpString="*.bmp") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.gif") returned 0
	[0066.689] lstrlenA (lpString="*.gif") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.png") returned 0
	[0066.689] lstrlenA (lpString="*.png") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.doc") returned 0
	[0066.689] lstrlenA (lpString="*.doc") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.docx") returned 0
	[0066.689] lstrlenA (lpString="*.docx") returned 6
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.xls") returned 0
	[0066.689] lstrlenA (lpString="*.xls") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0
	[0066.689] lstrlenA (lpString="*.xlsx") returned 6
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.ppt") returned 0
	[0066.689] lstrlenA (lpString="*.ppt") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.pptx") returned 0
	[0066.689] lstrlenA (lpString="*.pptx") returned 6
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.txt") returned 0
	[0066.689] lstrlenA (lpString="*.txt") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.pdf") returned 0
	[0066.689] lstrlenA (lpString="*.pdf") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.djvu") returned 0
	[0066.689] lstrlenA (lpString="*.djvu") returned 6
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.htm") returned 0
	[0066.689] lstrlenA (lpString="*.htm") returned 5
	[0066.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.html") returned 1
	[0066.689] lstrlenA (lpString="*.html") returned 6
	[0066.689] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html"
	[0066.689] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html"
	[0066.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html."
	[0066.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.Boom"
	[0066.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.690] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a
	[0066.690] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.690] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.690] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x417, lpOverlapped=0x0) returned 1
	[0066.706] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0066.706] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.706] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x417, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x417, lpOverlapped=0x0) returned 1
	[0066.707] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.707] CloseHandle (hObject=0x98) returned 1
	[0066.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.boom")) returned 1
	[0066.708] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.708] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.708] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1
	[0066.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1
	[0066.708] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1
	[0066.708] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="FormsBlankPage.html"
	[0066.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.708] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html"
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0
	[0066.708] lstrlenA (lpString="*.zip") returned 5
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0
	[0066.708] lstrlenA (lpString="*.rar") returned 5
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0
	[0066.708] lstrlenA (lpString="*.7z") returned 4
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0
	[0066.708] lstrlenA (lpString="*.tar") returned 5
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0
	[0066.708] lstrlenA (lpString="*.gzip") returned 6
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0
	[0066.708] lstrlenA (lpString="*.jpg") returned 5
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0
	[0066.708] lstrlenA (lpString="*.jpeg") returned 6
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0
	[0066.708] lstrlenA (lpString="*.psd") returned 5
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0
	[0066.708] lstrlenA (lpString="*.cdr") returned 5
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0
	[0066.708] lstrlenA (lpString="*.dwg") returned 5
	[0066.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0
	[0066.708] lstrlenA (lpString="*.max") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0
	[0066.709] lstrlenA (lpString="*.bmp") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0
	[0066.709] lstrlenA (lpString="*.gif") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0
	[0066.709] lstrlenA (lpString="*.png") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0
	[0066.709] lstrlenA (lpString="*.doc") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0
	[0066.709] lstrlenA (lpString="*.docx") returned 6
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0
	[0066.709] lstrlenA (lpString="*.xls") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0
	[0066.709] lstrlenA (lpString="*.xlsx") returned 6
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0
	[0066.709] lstrlenA (lpString="*.ppt") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0
	[0066.709] lstrlenA (lpString="*.pptx") returned 6
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0
	[0066.709] lstrlenA (lpString="*.txt") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0
	[0066.709] lstrlenA (lpString="*.pdf") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0
	[0066.709] lstrlenA (lpString="*.djvu") returned 6
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0
	[0066.709] lstrlenA (lpString="*.htm") returned 5
	[0066.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1
	[0066.709] lstrlenA (lpString="*.html") returned 6
	[0066.709] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html"
	[0066.709] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html"
	[0066.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html."
	[0066.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.Boom"
	[0066.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.710] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x829
	[0066.710] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.710] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.710] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x806, lpOverlapped=0x0) returned 1
	[0066.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0066.711] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.711] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x806, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x806, lpOverlapped=0x0) returned 1
	[0066.711] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.711] CloseHandle (hObject=0x98) returned 1
	[0066.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.boom")) returned 1
	[0066.713] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.713] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.713] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsColorChart.html") returned -1
	[0066.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1
	[0066.713] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1
	[0066.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html"
	[0066.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.713] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.713] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html"
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.zip") returned 0
	[0066.713] lstrlenA (lpString="*.zip") returned 5
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.rar") returned 0
	[0066.713] lstrlenA (lpString="*.rar") returned 5
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.7z") returned 0
	[0066.713] lstrlenA (lpString="*.7z") returned 4
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.tar") returned 0
	[0066.713] lstrlenA (lpString="*.tar") returned 5
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.gzip") returned 0
	[0066.713] lstrlenA (lpString="*.gzip") returned 6
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpg") returned 0
	[0066.713] lstrlenA (lpString="*.jpg") returned 5
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpeg") returned 0
	[0066.713] lstrlenA (lpString="*.jpeg") returned 6
	[0066.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.psd") returned 0
	[0066.714] lstrlenA (lpString="*.psd") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.cdr") returned 0
	[0066.714] lstrlenA (lpString="*.cdr") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.dwg") returned 0
	[0066.714] lstrlenA (lpString="*.dwg") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.max") returned 0
	[0066.714] lstrlenA (lpString="*.max") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.bmp") returned 0
	[0066.714] lstrlenA (lpString="*.bmp") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.gif") returned 0
	[0066.714] lstrlenA (lpString="*.gif") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.png") returned 0
	[0066.714] lstrlenA (lpString="*.png") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.doc") returned 0
	[0066.714] lstrlenA (lpString="*.doc") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.docx") returned 0
	[0066.714] lstrlenA (lpString="*.docx") returned 6
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.xls") returned 0
	[0066.714] lstrlenA (lpString="*.xls") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.xlsx") returned 0
	[0066.714] lstrlenA (lpString="*.xlsx") returned 6
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ppt") returned 0
	[0066.714] lstrlenA (lpString="*.ppt") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.pptx") returned 0
	[0066.714] lstrlenA (lpString="*.pptx") returned 6
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.txt") returned 0
	[0066.714] lstrlenA (lpString="*.txt") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.pdf") returned 0
	[0066.714] lstrlenA (lpString="*.pdf") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.djvu") returned 0
	[0066.714] lstrlenA (lpString="*.djvu") returned 6
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.htm") returned 0
	[0066.714] lstrlenA (lpString="*.htm") returned 5
	[0066.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.html") returned 1
	[0066.714] lstrlenA (lpString="*.html") returned 6
	[0066.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html"
	[0066.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html"
	[0066.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html."
	[0066.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.Boom"
	[0066.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.715] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ef
	[0066.715] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.715] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.715] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2cc, lpOverlapped=0x0) returned 1
	[0066.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="FormsColorChart.html"
	[0066.731] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.731] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2cc, lpOverlapped=0x0) returned 1
	[0066.731] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.732] CloseHandle (hObject=0x98) returned 1
	[0066.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.boom")) returned 1
	[0066.733] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.733] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.733] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplate.html") returned -1
	[0066.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1
	[0066.733] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1
	[0066.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="FormsColorChart.html"
	[0066.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html"
	[0066.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.zip") returned 0
	[0066.734] lstrlenA (lpString="*.zip") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.rar") returned 0
	[0066.734] lstrlenA (lpString="*.rar") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.7z") returned 0
	[0066.734] lstrlenA (lpString="*.7z") returned 4
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.tar") returned 0
	[0066.734] lstrlenA (lpString="*.tar") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0
	[0066.734] lstrlenA (lpString="*.gzip") returned 6
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0
	[0066.734] lstrlenA (lpString="*.jpg") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0
	[0066.734] lstrlenA (lpString="*.jpeg") returned 6
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.psd") returned 0
	[0066.734] lstrlenA (lpString="*.psd") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.cdr") returned 0
	[0066.734] lstrlenA (lpString="*.cdr") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.dwg") returned 0
	[0066.734] lstrlenA (lpString="*.dwg") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.max") returned 0
	[0066.734] lstrlenA (lpString="*.max") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.bmp") returned 0
	[0066.734] lstrlenA (lpString="*.bmp") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.gif") returned 0
	[0066.734] lstrlenA (lpString="*.gif") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.png") returned 0
	[0066.734] lstrlenA (lpString="*.png") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.doc") returned 0
	[0066.734] lstrlenA (lpString="*.doc") returned 5
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.docx") returned 0
	[0066.734] lstrlenA (lpString="*.docx") returned 6
	[0066.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.xls") returned 0
	[0066.735] lstrlenA (lpString="*.xls") returned 5
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0
	[0066.735] lstrlenA (lpString="*.xlsx") returned 6
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0
	[0066.735] lstrlenA (lpString="*.ppt") returned 5
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0
	[0066.735] lstrlenA (lpString="*.pptx") returned 6
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.txt") returned 0
	[0066.735] lstrlenA (lpString="*.txt") returned 5
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0
	[0066.735] lstrlenA (lpString="*.pdf") returned 5
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.djvu") returned 0
	[0066.735] lstrlenA (lpString="*.djvu") returned 6
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.htm") returned 0
	[0066.735] lstrlenA (lpString="*.htm") returned 5
	[0066.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.html") returned 1
	[0066.735] lstrlenA (lpString="*.html") returned 6
	[0066.735] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html"
	[0066.735] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html"
	[0066.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html."
	[0066.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.Boom"
	[0066.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.736] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13bb
	[0066.736] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.736] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.736] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1398, lpOverlapped=0x0) returned 1
	[0066.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="FormsFormTemplate.html"
	[0066.739] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.739] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1398, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1398, lpOverlapped=0x0) returned 1
	[0066.739] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.740] CloseHandle (hObject=0x98) returned 1
	[0066.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.boom")) returned 1
	[0066.741] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.741] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.741] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplateRTL.html") returned -1
	[0066.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplateRTL.html") returned 1
	[0066.741] lstrcmpiA (lpString1="", lpString2="FormsFormTemplateRTL.html") returned -1
	[0066.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="FormsFormTemplate.html"
	[0066.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html"
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.zip") returned 0
	[0066.741] lstrlenA (lpString="*.zip") returned 5
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.rar") returned 0
	[0066.741] lstrlenA (lpString="*.rar") returned 5
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.7z") returned 0
	[0066.741] lstrlenA (lpString="*.7z") returned 4
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.tar") returned 0
	[0066.741] lstrlenA (lpString="*.tar") returned 5
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.gzip") returned 0
	[0066.741] lstrlenA (lpString="*.gzip") returned 6
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpg") returned 0
	[0066.741] lstrlenA (lpString="*.jpg") returned 5
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpeg") returned 0
	[0066.741] lstrlenA (lpString="*.jpeg") returned 6
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.psd") returned 0
	[0066.741] lstrlenA (lpString="*.psd") returned 5
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.cdr") returned 0
	[0066.741] lstrlenA (lpString="*.cdr") returned 5
	[0066.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.dwg") returned 0
	[0066.742] lstrlenA (lpString="*.dwg") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.max") returned 0
	[0066.742] lstrlenA (lpString="*.max") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.bmp") returned 0
	[0066.742] lstrlenA (lpString="*.bmp") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.gif") returned 0
	[0066.742] lstrlenA (lpString="*.gif") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.png") returned 0
	[0066.742] lstrlenA (lpString="*.png") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.doc") returned 0
	[0066.742] lstrlenA (lpString="*.doc") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.docx") returned 0
	[0066.742] lstrlenA (lpString="*.docx") returned 6
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.xls") returned 0
	[0066.742] lstrlenA (lpString="*.xls") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.xlsx") returned 0
	[0066.742] lstrlenA (lpString="*.xlsx") returned 6
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ppt") returned 0
	[0066.742] lstrlenA (lpString="*.ppt") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.pptx") returned 0
	[0066.742] lstrlenA (lpString="*.pptx") returned 6
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.txt") returned 0
	[0066.742] lstrlenA (lpString="*.txt") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.pdf") returned 0
	[0066.742] lstrlenA (lpString="*.pdf") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.djvu") returned 0
	[0066.742] lstrlenA (lpString="*.djvu") returned 6
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.htm") returned 0
	[0066.742] lstrlenA (lpString="*.htm") returned 5
	[0066.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.html") returned 1
	[0066.742] lstrlenA (lpString="*.html") returned 6
	[0066.742] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html"
	[0066.743] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html"
	[0066.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html."
	[0066.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.Boom"
	[0066.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.743] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c5
	[0066.743] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x69fe8900, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x69fe8900, dwHighDateTime=0x1c7d303)) returned 1
	[0066.743] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.743] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x13a2, lpOverlapped=0x0) returned 1
	[0066.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="FormsFormTemplateRTL.html"
	[0066.745] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.745] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x13a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x13a2, lpOverlapped=0x0) returned 1
	[0066.745] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.745] CloseHandle (hObject=0x98) returned 1
	[0066.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.boom")) returned 1
	[0066.746] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.746] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.746] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsImageTemplate.html") returned -1
	[0066.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1
	[0066.746] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1
	[0066.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="FormsFormTemplateRTL.html"
	[0066.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.746] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html"
	[0066.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.zip") returned 0
	[0066.746] lstrlenA (lpString="*.zip") returned 5
	[0066.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.rar") returned 0
	[0066.746] lstrlenA (lpString="*.rar") returned 5
	[0066.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.7z") returned 0
	[0066.747] lstrlenA (lpString="*.7z") returned 4
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.tar") returned 0
	[0066.747] lstrlenA (lpString="*.tar") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.gzip") returned 0
	[0066.747] lstrlenA (lpString="*.gzip") returned 6
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0
	[0066.747] lstrlenA (lpString="*.jpg") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0
	[0066.747] lstrlenA (lpString="*.jpeg") returned 6
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.psd") returned 0
	[0066.747] lstrlenA (lpString="*.psd") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.cdr") returned 0
	[0066.747] lstrlenA (lpString="*.cdr") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.dwg") returned 0
	[0066.747] lstrlenA (lpString="*.dwg") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.max") returned 0
	[0066.747] lstrlenA (lpString="*.max") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.bmp") returned 0
	[0066.747] lstrlenA (lpString="*.bmp") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.gif") returned 0
	[0066.747] lstrlenA (lpString="*.gif") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.png") returned 0
	[0066.747] lstrlenA (lpString="*.png") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.doc") returned 0
	[0066.747] lstrlenA (lpString="*.doc") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.docx") returned 0
	[0066.747] lstrlenA (lpString="*.docx") returned 6
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.xls") returned 0
	[0066.747] lstrlenA (lpString="*.xls") returned 5
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.xlsx") returned 0
	[0066.747] lstrlenA (lpString="*.xlsx") returned 6
	[0066.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ppt") returned 0
	[0066.747] lstrlenA (lpString="*.ppt") returned 5
	[0066.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.pptx") returned 0
	[0066.748] lstrlenA (lpString="*.pptx") returned 6
	[0066.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.txt") returned 0
	[0066.748] lstrlenA (lpString="*.txt") returned 5
	[0066.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.pdf") returned 0
	[0066.748] lstrlenA (lpString="*.pdf") returned 5
	[0066.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.djvu") returned 0
	[0066.748] lstrlenA (lpString="*.djvu") returned 6
	[0066.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.htm") returned 0
	[0066.748] lstrlenA (lpString="*.htm") returned 5
	[0066.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.html") returned 1
	[0066.748] lstrlenA (lpString="*.html") returned 6
	[0066.748] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html"
	[0066.748] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html"
	[0066.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html."
	[0066.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.Boom"
	[0066.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.749] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ab
	[0066.749] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.749] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.749] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x888, lpOverlapped=0x0) returned 1
	[0066.750] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="FormsImageTemplate.html"
	[0066.750] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.750] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x888, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x888, lpOverlapped=0x0) returned 1
	[0066.751] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.751] CloseHandle (hObject=0x98) returned 1
	[0066.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.boom")) returned 1
	[0066.752] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.752] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.752] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsMacroTemplate.html") returned -1
	[0066.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1
	[0066.752] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1
	[0066.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="FormsImageTemplate.html"
	[0066.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html"
	[0066.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0
	[0066.752] lstrlenA (lpString="*.zip") returned 5
	[0066.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0
	[0066.752] lstrlenA (lpString="*.rar") returned 5
	[0066.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.7z") returned 0
	[0066.753] lstrlenA (lpString="*.7z") returned 4
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.tar") returned 0
	[0066.753] lstrlenA (lpString="*.tar") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.gzip") returned 0
	[0066.753] lstrlenA (lpString="*.gzip") returned 6
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0
	[0066.753] lstrlenA (lpString="*.jpg") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0
	[0066.753] lstrlenA (lpString="*.jpeg") returned 6
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.psd") returned 0
	[0066.753] lstrlenA (lpString="*.psd") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.cdr") returned 0
	[0066.753] lstrlenA (lpString="*.cdr") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.dwg") returned 0
	[0066.753] lstrlenA (lpString="*.dwg") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.max") returned 0
	[0066.753] lstrlenA (lpString="*.max") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.bmp") returned 0
	[0066.753] lstrlenA (lpString="*.bmp") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.gif") returned 0
	[0066.753] lstrlenA (lpString="*.gif") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.png") returned 0
	[0066.753] lstrlenA (lpString="*.png") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.doc") returned 0
	[0066.753] lstrlenA (lpString="*.doc") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.docx") returned 0
	[0066.753] lstrlenA (lpString="*.docx") returned 6
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.xls") returned 0
	[0066.753] lstrlenA (lpString="*.xls") returned 5
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.xlsx") returned 0
	[0066.753] lstrlenA (lpString="*.xlsx") returned 6
	[0066.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.ppt") returned 0
	[0066.754] lstrlenA (lpString="*.ppt") returned 5
	[0066.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.pptx") returned 0
	[0066.754] lstrlenA (lpString="*.pptx") returned 6
	[0066.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.txt") returned 0
	[0066.754] lstrlenA (lpString="*.txt") returned 5
	[0066.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.pdf") returned 0
	[0066.754] lstrlenA (lpString="*.pdf") returned 5
	[0066.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.djvu") returned 0
	[0066.754] lstrlenA (lpString="*.djvu") returned 6
	[0066.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.htm") returned 0
	[0066.754] lstrlenA (lpString="*.htm") returned 5
	[0066.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.html") returned 1
	[0066.754] lstrlenA (lpString="*.html") returned 6
	[0066.754] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html"
	[0066.754] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html"
	[0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html."
	[0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.Boom"
	[0066.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.755] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x858
	[0066.755] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52942450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.755] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.755] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x835, lpOverlapped=0x0) returned 1
	[0066.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html"
	[0066.800] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.800] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x835, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x835, lpOverlapped=0x0) returned 1
	[0066.800] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.801] CloseHandle (hObject=0x98) returned 1
	[0066.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.boom")) returned 1
	[0066.802] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.802] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.802] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1
	[0066.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1
	[0066.802] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1
	[0066.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html"
	[0066.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html"
	[0066.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0
	[0066.802] lstrlenA (lpString="*.zip") returned 5
	[0066.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0
	[0066.802] lstrlenA (lpString="*.rar") returned 5
	[0066.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0
	[0066.802] lstrlenA (lpString="*.7z") returned 4
	[0066.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0
	[0066.802] lstrlenA (lpString="*.tar") returned 5
	[0066.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0
	[0066.802] lstrlenA (lpString="*.gzip") returned 6
	[0066.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0
	[0066.802] lstrlenA (lpString="*.jpg") returned 5
	[0066.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0
	[0066.803] lstrlenA (lpString="*.jpeg") returned 6
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0
	[0066.803] lstrlenA (lpString="*.psd") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0
	[0066.803] lstrlenA (lpString="*.cdr") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0
	[0066.803] lstrlenA (lpString="*.dwg") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0
	[0066.803] lstrlenA (lpString="*.max") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0
	[0066.803] lstrlenA (lpString="*.bmp") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0
	[0066.803] lstrlenA (lpString="*.gif") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0
	[0066.803] lstrlenA (lpString="*.png") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0
	[0066.803] lstrlenA (lpString="*.doc") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0
	[0066.803] lstrlenA (lpString="*.docx") returned 6
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0
	[0066.803] lstrlenA (lpString="*.xls") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0
	[0066.803] lstrlenA (lpString="*.xlsx") returned 6
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0
	[0066.803] lstrlenA (lpString="*.ppt") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0
	[0066.803] lstrlenA (lpString="*.pptx") returned 6
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0
	[0066.803] lstrlenA (lpString="*.txt") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0
	[0066.803] lstrlenA (lpString="*.pdf") returned 5
	[0066.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0
	[0066.804] lstrlenA (lpString="*.djvu") returned 6
	[0066.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0
	[0066.804] lstrlenA (lpString="*.htm") returned 5
	[0066.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1
	[0066.804] lstrlenA (lpString="*.html") returned 6
	[0066.804] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html"
	[0066.804] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html"
	[0066.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html."
	[0066.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.Boom"
	[0066.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.805] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46ff
	[0066.805] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.805] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.805] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x46dc, lpOverlapped=0x0) returned 1
	[0066.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0066.826] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.826] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x46dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x46dc, lpOverlapped=0x0) returned 1
	[0066.826] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.826] CloseHandle (hObject=0x98) returned 1
	[0066.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.boom")) returned 1
	[0066.827] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.828] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplateRTL.html") returned -1
	[0066.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplateRTL.html") returned 1
	[0066.828] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplateRTL.html") returned -1
	[0066.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html"
	[0066.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.828] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html"
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.zip") returned 0
	[0066.828] lstrlenA (lpString="*.zip") returned 5
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.rar") returned 0
	[0066.828] lstrlenA (lpString="*.rar") returned 5
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.7z") returned 0
	[0066.828] lstrlenA (lpString="*.7z") returned 4
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.tar") returned 0
	[0066.828] lstrlenA (lpString="*.tar") returned 5
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.gzip") returned 0
	[0066.828] lstrlenA (lpString="*.gzip") returned 6
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.jpg") returned 0
	[0066.828] lstrlenA (lpString="*.jpg") returned 5
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.jpeg") returned 0
	[0066.828] lstrlenA (lpString="*.jpeg") returned 6
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.psd") returned 0
	[0066.828] lstrlenA (lpString="*.psd") returned 5
	[0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.cdr") returned 0
	[0066.828] lstrlenA (lpString="*.cdr") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.dwg") returned 0
	[0066.829] lstrlenA (lpString="*.dwg") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.max") returned 0
	[0066.829] lstrlenA (lpString="*.max") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.bmp") returned 0
	[0066.829] lstrlenA (lpString="*.bmp") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.gif") returned 0
	[0066.829] lstrlenA (lpString="*.gif") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.png") returned 0
	[0066.829] lstrlenA (lpString="*.png") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.doc") returned 0
	[0066.829] lstrlenA (lpString="*.doc") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.docx") returned 0
	[0066.829] lstrlenA (lpString="*.docx") returned 6
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.xls") returned 0
	[0066.829] lstrlenA (lpString="*.xls") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.xlsx") returned 0
	[0066.829] lstrlenA (lpString="*.xlsx") returned 6
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.ppt") returned 0
	[0066.829] lstrlenA (lpString="*.ppt") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.pptx") returned 0
	[0066.829] lstrlenA (lpString="*.pptx") returned 6
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.txt") returned 0
	[0066.829] lstrlenA (lpString="*.txt") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.pdf") returned 0
	[0066.829] lstrlenA (lpString="*.pdf") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.djvu") returned 0
	[0066.829] lstrlenA (lpString="*.djvu") returned 6
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.htm") returned 0
	[0066.829] lstrlenA (lpString="*.htm") returned 5
	[0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.html") returned 1
	[0066.830] lstrlenA (lpString="*.html") returned 6
	[0066.830] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html"
	[0066.830] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html"
	[0066.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html."
	[0066.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.Boom"
	[0066.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.830] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4709
	[0066.830] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x797dd200, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x797dd200, dwHighDateTime=0x1c7d303)) returned 1
	[0066.830] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.830] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x46e6, lpOverlapped=0x0) returned 1
	[0066.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="FormsPreviewTemplateRTL.html"
	[0066.832] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.832] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x46e6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x46e6, lpOverlapped=0x0) returned 1
	[0066.832] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.832] CloseHandle (hObject=0x98) returned 1
	[0066.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.boom")) returned 1
	[0066.833] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.833] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1
	[0066.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1
	[0066.833] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1
	[0066.833] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="FormsPreviewTemplateRTL.html"
	[0066.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html"
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0
	[0066.834] lstrlenA (lpString="*.zip") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0
	[0066.834] lstrlenA (lpString="*.rar") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0
	[0066.834] lstrlenA (lpString="*.7z") returned 4
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0
	[0066.834] lstrlenA (lpString="*.tar") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0
	[0066.834] lstrlenA (lpString="*.gzip") returned 6
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0
	[0066.834] lstrlenA (lpString="*.jpg") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0
	[0066.834] lstrlenA (lpString="*.jpeg") returned 6
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0
	[0066.834] lstrlenA (lpString="*.psd") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0
	[0066.834] lstrlenA (lpString="*.cdr") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0
	[0066.834] lstrlenA (lpString="*.dwg") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.max") returned 0
	[0066.834] lstrlenA (lpString="*.max") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0
	[0066.834] lstrlenA (lpString="*.bmp") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0
	[0066.834] lstrlenA (lpString="*.gif") returned 5
	[0066.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.png") returned 0
	[0066.834] lstrlenA (lpString="*.png") returned 5
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0
	[0066.835] lstrlenA (lpString="*.doc") returned 5
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0
	[0066.835] lstrlenA (lpString="*.docx") returned 6
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0
	[0066.835] lstrlenA (lpString="*.xls") returned 5
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0
	[0066.835] lstrlenA (lpString="*.xlsx") returned 6
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0
	[0066.835] lstrlenA (lpString="*.ppt") returned 5
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0
	[0066.835] lstrlenA (lpString="*.pptx") returned 6
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0
	[0066.835] lstrlenA (lpString="*.txt") returned 5
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0
	[0066.835] lstrlenA (lpString="*.pdf") returned 5
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0
	[0066.835] lstrlenA (lpString="*.djvu") returned 6
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0
	[0066.835] lstrlenA (lpString="*.htm") returned 5
	[0066.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.html") returned 1
	[0066.835] lstrlenA (lpString="*.html") returned 6
	[0066.835] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html"
	[0066.835] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html"
	[0066.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html."
	[0066.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.Boom"
	[0066.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.836] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5bf
	[0066.836] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1
	[0066.836] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.836] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x59c, lpOverlapped=0x0) returned 1
	[0066.861] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0066.861] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.861] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x59c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x59c, lpOverlapped=0x0) returned 1
	[0066.861] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.861] CloseHandle (hObject=0x98) returned 1
	[0066.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.boom")) returned 1
	[0066.863] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.863] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.863] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplateRTL.html") returned -1
	[0066.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplateRTL.html") returned 1
	[0066.863] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplateRTL.html") returned -1
	[0066.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html"
	[0066.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.863] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html"
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.zip") returned 0
	[0066.863] lstrlenA (lpString="*.zip") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.rar") returned 0
	[0066.863] lstrlenA (lpString="*.rar") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.7z") returned 0
	[0066.863] lstrlenA (lpString="*.7z") returned 4
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.tar") returned 0
	[0066.863] lstrlenA (lpString="*.tar") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.gzip") returned 0
	[0066.863] lstrlenA (lpString="*.gzip") returned 6
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.jpg") returned 0
	[0066.863] lstrlenA (lpString="*.jpg") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.jpeg") returned 0
	[0066.863] lstrlenA (lpString="*.jpeg") returned 6
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.psd") returned 0
	[0066.863] lstrlenA (lpString="*.psd") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.cdr") returned 0
	[0066.863] lstrlenA (lpString="*.cdr") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.dwg") returned 0
	[0066.863] lstrlenA (lpString="*.dwg") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.max") returned 0
	[0066.863] lstrlenA (lpString="*.max") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.bmp") returned 0
	[0066.863] lstrlenA (lpString="*.bmp") returned 5
	[0066.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.gif") returned 0
	[0066.864] lstrlenA (lpString="*.gif") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.png") returned 0
	[0066.864] lstrlenA (lpString="*.png") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.doc") returned 0
	[0066.864] lstrlenA (lpString="*.doc") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.docx") returned 0
	[0066.864] lstrlenA (lpString="*.docx") returned 6
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.xls") returned 0
	[0066.864] lstrlenA (lpString="*.xls") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.xlsx") returned 0
	[0066.864] lstrlenA (lpString="*.xlsx") returned 6
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.ppt") returned 0
	[0066.864] lstrlenA (lpString="*.ppt") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.pptx") returned 0
	[0066.864] lstrlenA (lpString="*.pptx") returned 6
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.txt") returned 0
	[0066.864] lstrlenA (lpString="*.txt") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.pdf") returned 0
	[0066.864] lstrlenA (lpString="*.pdf") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.djvu") returned 0
	[0066.864] lstrlenA (lpString="*.djvu") returned 6
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.htm") returned 0
	[0066.864] lstrlenA (lpString="*.htm") returned 5
	[0066.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.html") returned 1
	[0066.864] lstrlenA (lpString="*.html") returned 6
	[0066.864] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html"
	[0066.864] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html"
	[0066.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html."
	[0066.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.Boom"
	[0066.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.865] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c9
	[0066.865] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a2e4800, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a2e4800, dwHighDateTime=0x1c7d303)) returned 1
	[0066.865] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.865] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5a6, lpOverlapped=0x0) returned 1
	[0066.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="FormsPrintTemplateRTL.html"
	[0066.866] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.866] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5a6, lpOverlapped=0x0) returned 1
	[0066.866] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.866] CloseHandle (hObject=0x98) returned 1
	[0066.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.boom")) returned 1
	[0066.867] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.867] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.867] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0066.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1
	[0066.867] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1
	[0066.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="FormsPrintTemplateRTL.html"
	[0066.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg"
	[0066.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0
	[0066.867] lstrlenA (lpString="*.zip") returned 5
	[0066.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0
	[0066.867] lstrlenA (lpString="*.rar") returned 5
	[0066.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0
	[0066.867] lstrlenA (lpString="*.7z") returned 4
	[0066.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0
	[0066.867] lstrlenA (lpString="*.tar") returned 5
	[0066.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0
	[0066.867] lstrlenA (lpString="*.gzip") returned 6
	[0066.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1
	[0066.868] lstrlenA (lpString="*.jpg") returned 5
	[0066.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg"
	[0066.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg"
	[0066.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg."
	[0066.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.Boom"
	[0066.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.868] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499
	[0066.868] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea)) returned 1
	[0066.868] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.868] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1476, lpOverlapped=0x0) returned 1
	[0066.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0066.938] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.939] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1476, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1476, lpOverlapped=0x0) returned 1
	[0066.939] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.939] CloseHandle (hObject=0x98) returned 1
	[0066.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.boom")) returned 1
	[0066.940] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.940] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.940] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0066.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1
	[0066.940] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1
	[0066.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg"
	[0066.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp"
	[0066.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0
	[0066.940] lstrlenA (lpString="*.zip") returned 5
	[0066.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0
	[0066.940] lstrlenA (lpString="*.rar") returned 5
	[0066.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0
	[0066.940] lstrlenA (lpString="*.7z") returned 4
	[0066.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0
	[0066.940] lstrlenA (lpString="*.tar") returned 5
	[0066.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0
	[0066.940] lstrlenA (lpString="*.gzip") returned 6
	[0066.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0
	[0066.940] lstrlenA (lpString="*.jpg") returned 5
	[0066.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0
	[0066.941] lstrlenA (lpString="*.jpeg") returned 6
	[0066.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0
	[0066.941] lstrlenA (lpString="*.psd") returned 5
	[0066.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cdr") returned 0
	[0066.941] lstrlenA (lpString="*.cdr") returned 5
	[0066.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0
	[0066.941] lstrlenA (lpString="*.dwg") returned 5
	[0066.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.max") returned 0
	[0066.941] lstrlenA (lpString="*.max") returned 5
	[0066.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bmp") returned 1
	[0066.941] lstrlenA (lpString="*.bmp") returned 5
	[0066.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp"
	[0066.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp"
	[0066.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp."
	[0066.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.Boom"
	[0066.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.941] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638
	[0066.942] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.942] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.942] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x615, lpOverlapped=0x0) returned 1
	[0066.943] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0066.943] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.943] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x615, lpOverlapped=0x0) returned 1
	[0066.943] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0066.943] CloseHandle (hObject=0x98) returned 1
	[0066.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.boom")) returned 1
	[0066.944] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.944] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.944] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="form_edit.js") returned -1
	[0066.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1
	[0066.944] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1
	[0066.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp"
	[0066.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js"
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.zip") returned 0
	[0066.944] lstrlenA (lpString="*.zip") returned 5
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.rar") returned 0
	[0066.944] lstrlenA (lpString="*.rar") returned 5
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.7z") returned 0
	[0066.944] lstrlenA (lpString="*.7z") returned 4
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.tar") returned 0
	[0066.944] lstrlenA (lpString="*.tar") returned 5
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gzip") returned 0
	[0066.944] lstrlenA (lpString="*.gzip") returned 6
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpg") returned 0
	[0066.944] lstrlenA (lpString="*.jpg") returned 5
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpeg") returned 0
	[0066.944] lstrlenA (lpString="*.jpeg") returned 6
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.psd") returned 0
	[0066.944] lstrlenA (lpString="*.psd") returned 5
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.cdr") returned 0
	[0066.944] lstrlenA (lpString="*.cdr") returned 5
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dwg") returned 0
	[0066.944] lstrlenA (lpString="*.dwg") returned 5
	[0066.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.max") returned 0
	[0066.945] lstrlenA (lpString="*.max") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.bmp") returned 0
	[0066.945] lstrlenA (lpString="*.bmp") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gif") returned 0
	[0066.945] lstrlenA (lpString="*.gif") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.png") returned 0
	[0066.945] lstrlenA (lpString="*.png") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.doc") returned 0
	[0066.945] lstrlenA (lpString="*.doc") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.docx") returned 0
	[0066.945] lstrlenA (lpString="*.docx") returned 6
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xls") returned 0
	[0066.945] lstrlenA (lpString="*.xls") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xlsx") returned 0
	[0066.945] lstrlenA (lpString="*.xlsx") returned 6
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ppt") returned 0
	[0066.945] lstrlenA (lpString="*.ppt") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pptx") returned 0
	[0066.945] lstrlenA (lpString="*.pptx") returned 6
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.txt") returned 0
	[0066.945] lstrlenA (lpString="*.txt") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pdf") returned 0
	[0066.945] lstrlenA (lpString="*.pdf") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.djvu") returned 0
	[0066.945] lstrlenA (lpString="*.djvu") returned 6
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.htm") returned 0
	[0066.945] lstrlenA (lpString="*.htm") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.html") returned 0
	[0066.945] lstrlenA (lpString="*.html") returned 6
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mdb") returned 0
	[0066.945] lstrlenA (lpString="*.mdb") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.cer") returned 0
	[0066.945] lstrlenA (lpString="*.cer") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.p12") returned 0
	[0066.945] lstrlenA (lpString="*.p12") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pfx") returned 0
	[0066.945] lstrlenA (lpString="*.pfx") returned 5
	[0066.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.kwm") returned 0
	[0066.946] lstrlenA (lpString="*.kwm") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pwm") returned 0
	[0066.946] lstrlenA (lpString="*.pwm") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.1cd") returned 0
	[0066.946] lstrlenA (lpString="*.1cd") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.md") returned 0
	[0066.946] lstrlenA (lpString="*.md") returned 4
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mdf") returned 0
	[0066.946] lstrlenA (lpString="*.mdf") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dbf") returned 0
	[0066.946] lstrlenA (lpString="*.dbf") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.odt") returned 0
	[0066.946] lstrlenA (lpString="*.odt") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.vob") returned 0
	[0066.946] lstrlenA (lpString="*.vob") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ifo") returned 0
	[0066.946] lstrlenA (lpString="*.ifo") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.lnk") returned 0
	[0066.946] lstrlenA (lpString="*.lnk") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.torrent") returned 0
	[0066.946] lstrlenA (lpString="*.torrent") returned 9
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mov") returned 0
	[0066.946] lstrlenA (lpString="*.mov") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.m2v") returned 0
	[0066.946] lstrlenA (lpString="*.m2v") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.3gp") returned 0
	[0066.946] lstrlenA (lpString="*.3gp") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mpeg") returned 0
	[0066.946] lstrlenA (lpString="*.mpeg") returned 6
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mpg") returned 0
	[0066.946] lstrlenA (lpString="*.mpg") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.flv") returned 0
	[0066.946] lstrlenA (lpString="*.flv") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.avi") returned 0
	[0066.946] lstrlenA (lpString="*.avi") returned 5
	[0066.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp4") returned 0
	[0066.946] lstrlenA (lpString="*.mp4") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wmv") returned 0
	[0066.947] lstrlenA (lpString="*.wmv") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.divx") returned 0
	[0066.947] lstrlenA (lpString="*.divx") returned 6
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mkv") returned 0
	[0066.947] lstrlenA (lpString="*.mkv") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp3") returned 0
	[0066.947] lstrlenA (lpString="*.mp3") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wav") returned 0
	[0066.947] lstrlenA (lpString="*.wav") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.flac") returned 0
	[0066.947] lstrlenA (lpString="*.flac") returned 6
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ape") returned 0
	[0066.947] lstrlenA (lpString="*.ape") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wma") returned 0
	[0066.947] lstrlenA (lpString="*.wma") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ac3") returned 0
	[0066.947] lstrlenA (lpString="*.ac3") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.exe") returned 0
	[0066.947] lstrlenA (lpString="*.exe") returned 5
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.apk") returned 0
	[0066.947] lstrlenA (lpString="*.apk") returned 5
	[0066.947] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0066.947] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0066.947] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfoPathWelcomeImage.jpg") returned -1
	[0066.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathWelcomeImage.jpg") returned -1
	[0066.947] lstrcmpiA (lpString1="", lpString2="InfoPathWelcomeImage.jpg") returned -1
	[0066.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="form_edit.js"
	[0066.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0066.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0066.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0066.947] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0066.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg"
	[0066.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.zip") returned 0
	[0066.947] lstrlenA (lpString="*.zip") returned 5
	[0066.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.rar") returned 0
	[0066.948] lstrlenA (lpString="*.rar") returned 5
	[0066.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.7z") returned 0
	[0066.948] lstrlenA (lpString="*.7z") returned 4
	[0066.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.tar") returned 0
	[0066.948] lstrlenA (lpString="*.tar") returned 5
	[0066.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.gzip") returned 0
	[0066.948] lstrlenA (lpString="*.gzip") returned 6
	[0066.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.jpg") returned 1
	[0066.948] lstrlenA (lpString="*.jpg") returned 5
	[0066.948] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg"
	[0066.948] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg"
	[0066.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg."
	[0066.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.Boom"
	[0066.948] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0066.948] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14316
	[0066.948] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0066.948] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0066.948] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x142f3, lpOverlapped=0x0) returned 1
	[0067.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg"
	[0067.033] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.033] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x142f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x142f3, lpOverlapped=0x0) returned 1
	[0067.034] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.034] CloseHandle (hObject=0x98) returned 1
	[0067.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.boom")) returned 1
	[0067.035] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.035] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.035] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAUNCH.GIF") returned -1
	[0067.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1
	[0067.035] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1
	[0067.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg"
	[0067.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF"
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.zip") returned 0
	[0067.035] lstrlenA (lpString="*.zip") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.rar") returned 0
	[0067.035] lstrlenA (lpString="*.rar") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.7z") returned 0
	[0067.035] lstrlenA (lpString="*.7z") returned 4
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.tar") returned 0
	[0067.035] lstrlenA (lpString="*.tar") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gzip") returned 0
	[0067.035] lstrlenA (lpString="*.gzip") returned 6
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpg") returned 0
	[0067.035] lstrlenA (lpString="*.jpg") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0
	[0067.035] lstrlenA (lpString="*.jpeg") returned 6
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.psd") returned 0
	[0067.035] lstrlenA (lpString="*.psd") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.cdr") returned 0
	[0067.035] lstrlenA (lpString="*.cdr") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.dwg") returned 0
	[0067.035] lstrlenA (lpString="*.dwg") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.max") returned 0
	[0067.035] lstrlenA (lpString="*.max") returned 5
	[0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.bmp") returned 0
	[0067.035] lstrlenA (lpString="*.bmp") returned 5
	[0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gif") returned 1
	[0067.036] lstrlenA (lpString="*.gif") returned 5
	[0067.036] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF"
	[0067.036] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF"
	[0067.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF."
	[0067.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.Boom"
	[0067.036] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.036] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267
	[0067.036] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x567e4730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.036] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.036] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x244, lpOverlapped=0x0) returned 1
	[0067.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="LAUNCH.GIF"
	[0067.037] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.037] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x244, lpOverlapped=0x0) returned 1
	[0067.037] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.037] CloseHandle (hObject=0x98) returned 1
	[0067.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif.boom")) returned 1
	[0067.038] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.039] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="macroprogress.gif") returned -1
	[0067.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1
	[0067.039] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1
	[0067.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="LAUNCH.GIF"
	[0067.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif"
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.zip") returned 0
	[0067.039] lstrlenA (lpString="*.zip") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.rar") returned 0
	[0067.039] lstrlenA (lpString="*.rar") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.7z") returned 0
	[0067.039] lstrlenA (lpString="*.7z") returned 4
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.tar") returned 0
	[0067.039] lstrlenA (lpString="*.tar") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gzip") returned 0
	[0067.039] lstrlenA (lpString="*.gzip") returned 6
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpg") returned 0
	[0067.039] lstrlenA (lpString="*.jpg") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpeg") returned 0
	[0067.039] lstrlenA (lpString="*.jpeg") returned 6
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.psd") returned 0
	[0067.039] lstrlenA (lpString="*.psd") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.cdr") returned 0
	[0067.039] lstrlenA (lpString="*.cdr") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.dwg") returned 0
	[0067.039] lstrlenA (lpString="*.dwg") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.max") returned 0
	[0067.039] lstrlenA (lpString="*.max") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.bmp") returned 0
	[0067.039] lstrlenA (lpString="*.bmp") returned 5
	[0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gif") returned 1
	[0067.039] lstrlenA (lpString="*.gif") returned 5
	[0067.039] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif"
	[0067.039] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif"
	[0067.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif."
	[0067.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.Boom"
	[0067.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.040] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30074
	[0067.040] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d), lpLastAccessTime=0x407536*(dwLowDateTime=0x582abeb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d)) returned 1
	[0067.040] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.040] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x30051, lpOverlapped=0x0) returned 1
	[0067.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="macroprogress.gif"
	[0067.093] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.093] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x30051, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x30051, lpOverlapped=0x0) returned 1
	[0067.093] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.094] CloseHandle (hObject=0x98) returned 1
	[0067.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.boom")) returned 1
	[0067.095] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.095] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.095] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublicFunctions.js") returned -1
	[0067.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1
	[0067.095] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1
	[0067.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="macroprogress.gif"
	[0067.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js"
	[0067.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.zip") returned 0
	[0067.095] lstrlenA (lpString="*.zip") returned 5
	[0067.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.rar") returned 0
	[0067.095] lstrlenA (lpString="*.rar") returned 5
	[0067.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.7z") returned 0
	[0067.095] lstrlenA (lpString="*.7z") returned 4
	[0067.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.tar") returned 0
	[0067.095] lstrlenA (lpString="*.tar") returned 5
	[0067.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gzip") returned 0
	[0067.095] lstrlenA (lpString="*.gzip") returned 6
	[0067.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpg") returned 0
	[0067.095] lstrlenA (lpString="*.jpg") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpeg") returned 0
	[0067.096] lstrlenA (lpString="*.jpeg") returned 6
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.psd") returned 0
	[0067.096] lstrlenA (lpString="*.psd") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.cdr") returned 0
	[0067.096] lstrlenA (lpString="*.cdr") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dwg") returned 0
	[0067.096] lstrlenA (lpString="*.dwg") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.max") returned 0
	[0067.096] lstrlenA (lpString="*.max") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.bmp") returned 0
	[0067.096] lstrlenA (lpString="*.bmp") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gif") returned 0
	[0067.096] lstrlenA (lpString="*.gif") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.png") returned 0
	[0067.096] lstrlenA (lpString="*.png") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.doc") returned 0
	[0067.096] lstrlenA (lpString="*.doc") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.docx") returned 0
	[0067.096] lstrlenA (lpString="*.docx") returned 6
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xls") returned 0
	[0067.096] lstrlenA (lpString="*.xls") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xlsx") returned 0
	[0067.096] lstrlenA (lpString="*.xlsx") returned 6
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ppt") returned 0
	[0067.096] lstrlenA (lpString="*.ppt") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pptx") returned 0
	[0067.096] lstrlenA (lpString="*.pptx") returned 6
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.txt") returned 0
	[0067.096] lstrlenA (lpString="*.txt") returned 5
	[0067.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pdf") returned 0
	[0067.097] lstrlenA (lpString="*.pdf") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.djvu") returned 0
	[0067.097] lstrlenA (lpString="*.djvu") returned 6
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.htm") returned 0
	[0067.097] lstrlenA (lpString="*.htm") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.html") returned 0
	[0067.097] lstrlenA (lpString="*.html") returned 6
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mdb") returned 0
	[0067.097] lstrlenA (lpString="*.mdb") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.cer") returned 0
	[0067.097] lstrlenA (lpString="*.cer") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.p12") returned 0
	[0067.097] lstrlenA (lpString="*.p12") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pfx") returned 0
	[0067.097] lstrlenA (lpString="*.pfx") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.kwm") returned 0
	[0067.097] lstrlenA (lpString="*.kwm") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pwm") returned 0
	[0067.097] lstrlenA (lpString="*.pwm") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.1cd") returned 0
	[0067.097] lstrlenA (lpString="*.1cd") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.md") returned 0
	[0067.097] lstrlenA (lpString="*.md") returned 4
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mdf") returned 0
	[0067.097] lstrlenA (lpString="*.mdf") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dbf") returned 0
	[0067.097] lstrlenA (lpString="*.dbf") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.odt") returned 0
	[0067.097] lstrlenA (lpString="*.odt") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.vob") returned 0
	[0067.097] lstrlenA (lpString="*.vob") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ifo") returned 0
	[0067.097] lstrlenA (lpString="*.ifo") returned 5
	[0067.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.lnk") returned 0
	[0067.097] lstrlenA (lpString="*.lnk") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.torrent") returned 0
	[0067.098] lstrlenA (lpString="*.torrent") returned 9
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mov") returned 0
	[0067.098] lstrlenA (lpString="*.mov") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.m2v") returned 0
	[0067.098] lstrlenA (lpString="*.m2v") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.3gp") returned 0
	[0067.098] lstrlenA (lpString="*.3gp") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mpeg") returned 0
	[0067.098] lstrlenA (lpString="*.mpeg") returned 6
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mpg") returned 0
	[0067.098] lstrlenA (lpString="*.mpg") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.flv") returned 0
	[0067.098] lstrlenA (lpString="*.flv") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.avi") returned 0
	[0067.098] lstrlenA (lpString="*.avi") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mp4") returned 0
	[0067.098] lstrlenA (lpString="*.mp4") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wmv") returned 0
	[0067.098] lstrlenA (lpString="*.wmv") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.divx") returned 0
	[0067.098] lstrlenA (lpString="*.divx") returned 6
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mkv") returned 0
	[0067.098] lstrlenA (lpString="*.mkv") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mp3") returned 0
	[0067.098] lstrlenA (lpString="*.mp3") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wav") returned 0
	[0067.098] lstrlenA (lpString="*.wav") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.flac") returned 0
	[0067.098] lstrlenA (lpString="*.flac") returned 6
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ape") returned 0
	[0067.098] lstrlenA (lpString="*.ape") returned 5
	[0067.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wma") returned 0
	[0067.099] lstrlenA (lpString="*.wma") returned 5
	[0067.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ac3") returned 0
	[0067.099] lstrlenA (lpString="*.ac3") returned 5
	[0067.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.exe") returned 0
	[0067.099] lstrlenA (lpString="*.exe") returned 5
	[0067.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.apk") returned 0
	[0067.099] lstrlenA (lpString="*.apk") returned 5
	[0067.099] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.099] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.099] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignleft.gif") returned -1
	[0067.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1
	[0067.099] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1
	[0067.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="PublicFunctions.js"
	[0067.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif"
	[0067.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.zip") returned 0
	[0067.099] lstrlenA (lpString="*.zip") returned 5
	[0067.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.rar") returned 0
	[0067.099] lstrlenA (lpString="*.rar") returned 5
	[0067.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.7z") returned 0
	[0067.099] lstrlenA (lpString="*.7z") returned 4
	[0067.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.tar") returned 0
	[0067.099] lstrlenA (lpString="*.tar") returned 5
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0
	[0067.100] lstrlenA (lpString="*.gzip") returned 6
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0
	[0067.100] lstrlenA (lpString="*.jpg") returned 5
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0
	[0067.100] lstrlenA (lpString="*.jpeg") returned 6
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.psd") returned 0
	[0067.100] lstrlenA (lpString="*.psd") returned 5
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.cdr") returned 0
	[0067.100] lstrlenA (lpString="*.cdr") returned 5
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.dwg") returned 0
	[0067.100] lstrlenA (lpString="*.dwg") returned 5
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.max") returned 0
	[0067.100] lstrlenA (lpString="*.max") returned 5
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.bmp") returned 0
	[0067.100] lstrlenA (lpString="*.bmp") returned 5
	[0067.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.gif") returned 1
	[0067.100] lstrlenA (lpString="*.gif") returned 5
	[0067.100] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif"
	[0067.100] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif"
	[0067.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif."
	[0067.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.Boom"
	[0067.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.101] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350
	[0067.101] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.101] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.101] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32d, lpOverlapped=0x0) returned 1
	[0067.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="rtf_alignleft.gif"
	[0067.197] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.197] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1
	[0067.198] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.198] CloseHandle (hObject=0x98) returned 1
	[0067.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.boom")) returned 1
	[0067.199] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.199] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.199] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignright.gif") returned -1
	[0067.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1
	[0067.199] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1
	[0067.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="rtf_alignleft.gif"
	[0067.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif"
	[0067.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.zip") returned 0
	[0067.199] lstrlenA (lpString="*.zip") returned 5
	[0067.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.rar") returned 0
	[0067.199] lstrlenA (lpString="*.rar") returned 5
	[0067.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.7z") returned 0
	[0067.199] lstrlenA (lpString="*.7z") returned 4
	[0067.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.tar") returned 0
	[0067.200] lstrlenA (lpString="*.tar") returned 5
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.gzip") returned 0
	[0067.200] lstrlenA (lpString="*.gzip") returned 6
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.jpg") returned 0
	[0067.200] lstrlenA (lpString="*.jpg") returned 5
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0
	[0067.200] lstrlenA (lpString="*.jpeg") returned 6
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.psd") returned 0
	[0067.200] lstrlenA (lpString="*.psd") returned 5
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.cdr") returned 0
	[0067.200] lstrlenA (lpString="*.cdr") returned 5
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.dwg") returned 0
	[0067.200] lstrlenA (lpString="*.dwg") returned 5
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.max") returned 0
	[0067.200] lstrlenA (lpString="*.max") returned 5
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.bmp") returned 0
	[0067.200] lstrlenA (lpString="*.bmp") returned 5
	[0067.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.gif") returned 1
	[0067.200] lstrlenA (lpString="*.gif") returned 5
	[0067.200] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif"
	[0067.200] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif"
	[0067.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif."
	[0067.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.Boom"
	[0067.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.201] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f
	[0067.201] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.201] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.201] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32c, lpOverlapped=0x0) returned 1
	[0067.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="rtf_alignright.gif"
	[0067.202] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.202] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32c, lpOverlapped=0x0) returned 1
	[0067.203] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.203] CloseHandle (hObject=0x98) returned 1
	[0067.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.boom")) returned 1
	[0067.203] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.203] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.203] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_bullets.gif") returned -1
	[0067.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1
	[0067.203] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1
	[0067.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="rtf_alignright.gif"
	[0067.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif"
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.zip") returned 0
	[0067.204] lstrlenA (lpString="*.zip") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.rar") returned 0
	[0067.204] lstrlenA (lpString="*.rar") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.7z") returned 0
	[0067.204] lstrlenA (lpString="*.7z") returned 4
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.tar") returned 0
	[0067.204] lstrlenA (lpString="*.tar") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.gzip") returned 0
	[0067.204] lstrlenA (lpString="*.gzip") returned 6
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.jpg") returned 0
	[0067.204] lstrlenA (lpString="*.jpg") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0
	[0067.204] lstrlenA (lpString="*.jpeg") returned 6
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.psd") returned 0
	[0067.204] lstrlenA (lpString="*.psd") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.cdr") returned 0
	[0067.204] lstrlenA (lpString="*.cdr") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.dwg") returned 0
	[0067.204] lstrlenA (lpString="*.dwg") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.max") returned 0
	[0067.204] lstrlenA (lpString="*.max") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.bmp") returned 0
	[0067.204] lstrlenA (lpString="*.bmp") returned 5
	[0067.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.gif") returned 1
	[0067.204] lstrlenA (lpString="*.gif") returned 5
	[0067.204] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif"
	[0067.204] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif"
	[0067.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif."
	[0067.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.Boom"
	[0067.204] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.205] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365
	[0067.205] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.205] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.205] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x342, lpOverlapped=0x0) returned 1
	[0067.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="rtf_bullets.gif"
	[0067.230] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.230] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x342, lpOverlapped=0x0) returned 1
	[0067.230] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.231] CloseHandle (hObject=0x98) returned 1
	[0067.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.boom")) returned 1
	[0067.232] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.232] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_center.gif") returned -1
	[0067.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1
	[0067.232] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1
	[0067.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="rtf_bullets.gif"
	[0067.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif"
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.zip") returned 0
	[0067.232] lstrlenA (lpString="*.zip") returned 5
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.rar") returned 0
	[0067.232] lstrlenA (lpString="*.rar") returned 5
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.7z") returned 0
	[0067.232] lstrlenA (lpString="*.7z") returned 4
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.tar") returned 0
	[0067.232] lstrlenA (lpString="*.tar") returned 5
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.gzip") returned 0
	[0067.232] lstrlenA (lpString="*.gzip") returned 6
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.jpg") returned 0
	[0067.232] lstrlenA (lpString="*.jpg") returned 5
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.jpeg") returned 0
	[0067.232] lstrlenA (lpString="*.jpeg") returned 6
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.psd") returned 0
	[0067.232] lstrlenA (lpString="*.psd") returned 5
	[0067.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.cdr") returned 0
	[0067.233] lstrlenA (lpString="*.cdr") returned 5
	[0067.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.dwg") returned 0
	[0067.233] lstrlenA (lpString="*.dwg") returned 5
	[0067.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.max") returned 0
	[0067.233] lstrlenA (lpString="*.max") returned 5
	[0067.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.bmp") returned 0
	[0067.233] lstrlenA (lpString="*.bmp") returned 5
	[0067.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.gif") returned 1
	[0067.233] lstrlenA (lpString="*.gif") returned 5
	[0067.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif"
	[0067.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif"
	[0067.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif."
	[0067.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.Boom"
	[0067.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.233] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f
	[0067.233] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.233] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.233] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32c, lpOverlapped=0x0) returned 1
	[0067.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="rtf_center.gif"
	[0067.331] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.331] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32c, lpOverlapped=0x0) returned 1
	[0067.337] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.337] CloseHandle (hObject=0x98) returned 1
	[0067.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.boom")) returned 1
	[0067.338] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.338] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.338] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosecolor.gif") returned -1
	[0067.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1
	[0067.339] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1
	[0067.339] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="rtf_center.gif"
	[0067.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.339] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif"
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0
	[0067.339] lstrlenA (lpString="*.zip") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0
	[0067.339] lstrlenA (lpString="*.rar") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0
	[0067.339] lstrlenA (lpString="*.7z") returned 4
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0
	[0067.339] lstrlenA (lpString="*.tar") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0
	[0067.339] lstrlenA (lpString="*.gzip") returned 6
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0
	[0067.339] lstrlenA (lpString="*.jpg") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0
	[0067.339] lstrlenA (lpString="*.jpeg") returned 6
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0
	[0067.339] lstrlenA (lpString="*.psd") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.cdr") returned 0
	[0067.339] lstrlenA (lpString="*.cdr") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.dwg") returned 0
	[0067.339] lstrlenA (lpString="*.dwg") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.max") returned 0
	[0067.339] lstrlenA (lpString="*.max") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.bmp") returned 0
	[0067.339] lstrlenA (lpString="*.bmp") returned 5
	[0067.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1
	[0067.339] lstrlenA (lpString="*.gif") returned 5
	[0067.339] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif"
	[0067.339] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif"
	[0067.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif."
	[0067.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.Boom"
	[0067.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.340] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee
	[0067.340] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b)) returned 1
	[0067.340] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.340] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3cb, lpOverlapped=0x0) returned 1
	[0067.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif"
	[0067.341] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.341] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3cb, lpOverlapped=0x0) returned 1
	[0067.342] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.342] CloseHandle (hObject=0x98) returned 1
	[0067.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.boom")) returned 1
	[0067.342] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.342] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.342] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_decreaseindent.gif") returned -1
	[0067.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1
	[0067.342] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1
	[0067.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif"
	[0067.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.343] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif"
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0
	[0067.343] lstrlenA (lpString="*.zip") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0
	[0067.343] lstrlenA (lpString="*.rar") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0
	[0067.343] lstrlenA (lpString="*.7z") returned 4
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0
	[0067.343] lstrlenA (lpString="*.tar") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0
	[0067.343] lstrlenA (lpString="*.gzip") returned 6
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0
	[0067.343] lstrlenA (lpString="*.jpg") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0
	[0067.343] lstrlenA (lpString="*.jpeg") returned 6
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0
	[0067.343] lstrlenA (lpString="*.psd") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.cdr") returned 0
	[0067.343] lstrlenA (lpString="*.cdr") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.dwg") returned 0
	[0067.343] lstrlenA (lpString="*.dwg") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.max") returned 0
	[0067.343] lstrlenA (lpString="*.max") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.bmp") returned 0
	[0067.343] lstrlenA (lpString="*.bmp") returned 5
	[0067.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1
	[0067.343] lstrlenA (lpString="*.gif") returned 5
	[0067.343] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif"
	[0067.343] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif"
	[0067.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif."
	[0067.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.Boom"
	[0067.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.344] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f
	[0067.344] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.344] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.344] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33c, lpOverlapped=0x0) returned 1
	[0067.346] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif"
	[0067.346] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.346] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33c, lpOverlapped=0x0) returned 1
	[0067.346] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.346] CloseHandle (hObject=0x98) returned 1
	[0067.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.boom")) returned 1
	[0067.347] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.347] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.347] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_hyperlink.gif") returned -1
	[0067.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1
	[0067.347] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1
	[0067.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif"
	[0067.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif"
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.zip") returned 0
	[0067.348] lstrlenA (lpString="*.zip") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.rar") returned 0
	[0067.348] lstrlenA (lpString="*.rar") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.7z") returned 0
	[0067.348] lstrlenA (lpString="*.7z") returned 4
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.tar") returned 0
	[0067.348] lstrlenA (lpString="*.tar") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.gzip") returned 0
	[0067.348] lstrlenA (lpString="*.gzip") returned 6
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.jpg") returned 0
	[0067.348] lstrlenA (lpString="*.jpg") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.jpeg") returned 0
	[0067.348] lstrlenA (lpString="*.jpeg") returned 6
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.psd") returned 0
	[0067.348] lstrlenA (lpString="*.psd") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.cdr") returned 0
	[0067.348] lstrlenA (lpString="*.cdr") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.dwg") returned 0
	[0067.348] lstrlenA (lpString="*.dwg") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.max") returned 0
	[0067.348] lstrlenA (lpString="*.max") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.bmp") returned 0
	[0067.348] lstrlenA (lpString="*.bmp") returned 5
	[0067.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.gif") returned 1
	[0067.348] lstrlenA (lpString="*.gif") returned 5
	[0067.348] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif"
	[0067.348] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif"
	[0067.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif."
	[0067.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.Boom"
	[0067.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.349] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1
	[0067.349] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.349] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.349] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xce, lpOverlapped=0x0) returned 1
	[0067.349] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif"
	[0067.349] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.349] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xce, lpOverlapped=0x0) returned 1
	[0067.350] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.350] CloseHandle (hObject=0x98) returned 1
	[0067.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.boom")) returned 1
	[0067.350] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.350] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.350] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_increaseindent.gif") returned -1
	[0067.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1
	[0067.350] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1
	[0067.350] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif"
	[0067.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif"
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0
	[0067.351] lstrlenA (lpString="*.zip") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0
	[0067.351] lstrlenA (lpString="*.rar") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0
	[0067.351] lstrlenA (lpString="*.7z") returned 4
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0
	[0067.351] lstrlenA (lpString="*.tar") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0
	[0067.351] lstrlenA (lpString="*.gzip") returned 6
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0
	[0067.351] lstrlenA (lpString="*.jpg") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0
	[0067.351] lstrlenA (lpString="*.jpeg") returned 6
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0
	[0067.351] lstrlenA (lpString="*.psd") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.cdr") returned 0
	[0067.351] lstrlenA (lpString="*.cdr") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.dwg") returned 0
	[0067.351] lstrlenA (lpString="*.dwg") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.max") returned 0
	[0067.351] lstrlenA (lpString="*.max") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.bmp") returned 0
	[0067.351] lstrlenA (lpString="*.bmp") returned 5
	[0067.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1
	[0067.351] lstrlenA (lpString="*.gif") returned 5
	[0067.351] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif"
	[0067.351] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif"
	[0067.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif."
	[0067.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.Boom"
	[0067.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.352] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d
	[0067.352] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.352] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.352] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x33a, lpOverlapped=0x0) returned 1
	[0067.356] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif"
	[0067.356] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.356] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x33a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x33a, lpOverlapped=0x0) returned 1
	[0067.356] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.356] CloseHandle (hObject=0x98) returned 1
	[0067.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.boom")) returned 1
	[0067.357] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.357] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.357] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_justify.gif") returned -1
	[0067.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1
	[0067.357] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1
	[0067.357] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif"
	[0067.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.357] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.357] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif"
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.zip") returned 0
	[0067.357] lstrlenA (lpString="*.zip") returned 5
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.rar") returned 0
	[0067.357] lstrlenA (lpString="*.rar") returned 5
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.7z") returned 0
	[0067.357] lstrlenA (lpString="*.7z") returned 4
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.tar") returned 0
	[0067.357] lstrlenA (lpString="*.tar") returned 5
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.gzip") returned 0
	[0067.357] lstrlenA (lpString="*.gzip") returned 6
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.jpg") returned 0
	[0067.357] lstrlenA (lpString="*.jpg") returned 5
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.jpeg") returned 0
	[0067.357] lstrlenA (lpString="*.jpeg") returned 6
	[0067.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.psd") returned 0
	[0067.358] lstrlenA (lpString="*.psd") returned 5
	[0067.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.cdr") returned 0
	[0067.358] lstrlenA (lpString="*.cdr") returned 5
	[0067.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.dwg") returned 0
	[0067.358] lstrlenA (lpString="*.dwg") returned 5
	[0067.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.max") returned 0
	[0067.358] lstrlenA (lpString="*.max") returned 5
	[0067.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.bmp") returned 0
	[0067.358] lstrlenA (lpString="*.bmp") returned 5
	[0067.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.gif") returned 1
	[0067.358] lstrlenA (lpString="*.gif") returned 5
	[0067.358] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif"
	[0067.358] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif"
	[0067.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif."
	[0067.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.Boom"
	[0067.358] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.358] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352
	[0067.358] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.358] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.358] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32f, lpOverlapped=0x0) returned 1
	[0067.369] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="rtf_justify.gif"
	[0067.369] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.369] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32f, lpOverlapped=0x0) returned 1
	[0067.370] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.370] CloseHandle (hObject=0x98) returned 1
	[0067.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.boom")) returned 1
	[0067.371] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.371] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.371] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_pressed.gif") returned -1
	[0067.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1
	[0067.371] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1
	[0067.371] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="rtf_justify.gif"
	[0067.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.371] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.371] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.371] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.371] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif"
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.zip") returned 0
	[0067.371] lstrlenA (lpString="*.zip") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.rar") returned 0
	[0067.371] lstrlenA (lpString="*.rar") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.7z") returned 0
	[0067.371] lstrlenA (lpString="*.7z") returned 4
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.tar") returned 0
	[0067.371] lstrlenA (lpString="*.tar") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.gzip") returned 0
	[0067.371] lstrlenA (lpString="*.gzip") returned 6
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.jpg") returned 0
	[0067.371] lstrlenA (lpString="*.jpg") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0
	[0067.371] lstrlenA (lpString="*.jpeg") returned 6
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.psd") returned 0
	[0067.371] lstrlenA (lpString="*.psd") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.cdr") returned 0
	[0067.371] lstrlenA (lpString="*.cdr") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.dwg") returned 0
	[0067.371] lstrlenA (lpString="*.dwg") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.max") returned 0
	[0067.371] lstrlenA (lpString="*.max") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.bmp") returned 0
	[0067.371] lstrlenA (lpString="*.bmp") returned 5
	[0067.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.gif") returned 1
	[0067.371] lstrlenA (lpString="*.gif") returned 5
	[0067.371] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif"
	[0067.371] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif"
	[0067.371] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif."
	[0067.372] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.Boom"
	[0067.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.372] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373
	[0067.372] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.372] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.372] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x350, lpOverlapped=0x0) returned 1
	[0067.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="rtf_pressed.gif"
	[0067.373] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.373] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x350, lpOverlapped=0x0) returned 1
	[0067.373] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.373] CloseHandle (hObject=0x98) returned 1
	[0067.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.boom")) returned 1
	[0067.374] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.374] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.374] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SAVE.GIF") returned -1
	[0067.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1
	[0067.374] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1
	[0067.374] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="rtf_pressed.gif"
	[0067.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF"
	[0067.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.zip") returned 0
	[0067.374] lstrlenA (lpString="*.zip") returned 5
	[0067.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.rar") returned 0
	[0067.374] lstrlenA (lpString="*.rar") returned 5
	[0067.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.7z") returned 0
	[0067.374] lstrlenA (lpString="*.7z") returned 4
	[0067.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.tar") returned 0
	[0067.374] lstrlenA (lpString="*.tar") returned 5
	[0067.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.gzip") returned 0
	[0067.374] lstrlenA (lpString="*.gzip") returned 6
	[0067.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.jpg") returned 0
	[0067.375] lstrlenA (lpString="*.jpg") returned 5
	[0067.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.jpeg") returned 0
	[0067.375] lstrlenA (lpString="*.jpeg") returned 6
	[0067.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.psd") returned 0
	[0067.375] lstrlenA (lpString="*.psd") returned 5
	[0067.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.cdr") returned 0
	[0067.375] lstrlenA (lpString="*.cdr") returned 5
	[0067.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.dwg") returned 0
	[0067.375] lstrlenA (lpString="*.dwg") returned 5
	[0067.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.max") returned 0
	[0067.375] lstrlenA (lpString="*.max") returned 5
	[0067.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.bmp") returned 0
	[0067.375] lstrlenA (lpString="*.bmp") returned 5
	[0067.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.gif") returned 1
	[0067.375] lstrlenA (lpString="*.gif") returned 5
	[0067.375] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF"
	[0067.375] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF"
	[0067.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF."
	[0067.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.Boom"
	[0067.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.375] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26d
	[0067.375] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b)) returned 1
	[0067.375] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.375] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x24a, lpOverlapped=0x0) returned 1
	[0067.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="SAVE.GIF"
	[0067.376] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.376] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x24a, lpOverlapped=0x0) returned 1
	[0067.376] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.376] CloseHandle (hObject=0x98) returned 1
	[0067.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif.boom")) returned 1
	[0067.378] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.378] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.378] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1
	[0067.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1
	[0067.378] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1
	[0067.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="SAVE.GIF"
	[0067.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.378] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.378] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS"
	[0067.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.zip") returned 0
	[0067.378] lstrlenA (lpString="*.zip") returned 5
	[0067.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.rar") returned 0
	[0067.378] lstrlenA (lpString="*.rar") returned 5
	[0067.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.7z") returned 0
	[0067.378] lstrlenA (lpString="*.7z") returned 4
	[0067.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.tar") returned 0
	[0067.379] lstrlenA (lpString="*.tar") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.gzip") returned 0
	[0067.379] lstrlenA (lpString="*.gzip") returned 6
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.jpg") returned 0
	[0067.379] lstrlenA (lpString="*.jpg") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.jpeg") returned 0
	[0067.379] lstrlenA (lpString="*.jpeg") returned 6
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.psd") returned 0
	[0067.379] lstrlenA (lpString="*.psd") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.cdr") returned 0
	[0067.379] lstrlenA (lpString="*.cdr") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.dwg") returned 0
	[0067.379] lstrlenA (lpString="*.dwg") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.max") returned 0
	[0067.379] lstrlenA (lpString="*.max") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.bmp") returned 0
	[0067.379] lstrlenA (lpString="*.bmp") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.gif") returned 0
	[0067.379] lstrlenA (lpString="*.gif") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.png") returned 0
	[0067.379] lstrlenA (lpString="*.png") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.doc") returned 0
	[0067.379] lstrlenA (lpString="*.doc") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.docx") returned 0
	[0067.379] lstrlenA (lpString="*.docx") returned 6
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.xls") returned 0
	[0067.379] lstrlenA (lpString="*.xls") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.xlsx") returned 0
	[0067.379] lstrlenA (lpString="*.xlsx") returned 6
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ppt") returned 0
	[0067.379] lstrlenA (lpString="*.ppt") returned 5
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pptx") returned 0
	[0067.379] lstrlenA (lpString="*.pptx") returned 6
	[0067.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.txt") returned 0
	[0067.379] lstrlenA (lpString="*.txt") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pdf") returned 0
	[0067.380] lstrlenA (lpString="*.pdf") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.djvu") returned 0
	[0067.380] lstrlenA (lpString="*.djvu") returned 6
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.htm") returned 0
	[0067.380] lstrlenA (lpString="*.htm") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.html") returned 0
	[0067.380] lstrlenA (lpString="*.html") returned 6
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mdb") returned 0
	[0067.380] lstrlenA (lpString="*.mdb") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.cer") returned 0
	[0067.380] lstrlenA (lpString="*.cer") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.p12") returned 0
	[0067.380] lstrlenA (lpString="*.p12") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pfx") returned 0
	[0067.380] lstrlenA (lpString="*.pfx") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.kwm") returned 0
	[0067.380] lstrlenA (lpString="*.kwm") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pwm") returned 0
	[0067.380] lstrlenA (lpString="*.pwm") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.1cd") returned 0
	[0067.380] lstrlenA (lpString="*.1cd") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.md") returned 0
	[0067.380] lstrlenA (lpString="*.md") returned 4
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mdf") returned 0
	[0067.380] lstrlenA (lpString="*.mdf") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.dbf") returned 0
	[0067.380] lstrlenA (lpString="*.dbf") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.odt") returned 0
	[0067.380] lstrlenA (lpString="*.odt") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.vob") returned 0
	[0067.380] lstrlenA (lpString="*.vob") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ifo") returned 0
	[0067.380] lstrlenA (lpString="*.ifo") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.lnk") returned 0
	[0067.380] lstrlenA (lpString="*.lnk") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.torrent") returned 0
	[0067.380] lstrlenA (lpString="*.torrent") returned 9
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mov") returned 0
	[0067.380] lstrlenA (lpString="*.mov") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.m2v") returned 0
	[0067.380] lstrlenA (lpString="*.m2v") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.3gp") returned 0
	[0067.380] lstrlenA (lpString="*.3gp") returned 5
	[0067.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mpeg") returned 0
	[0067.380] lstrlenA (lpString="*.mpeg") returned 6
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mpg") returned 0
	[0067.381] lstrlenA (lpString="*.mpg") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.flv") returned 0
	[0067.381] lstrlenA (lpString="*.flv") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.avi") returned 0
	[0067.381] lstrlenA (lpString="*.avi") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mp4") returned 0
	[0067.381] lstrlenA (lpString="*.mp4") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wmv") returned 0
	[0067.381] lstrlenA (lpString="*.wmv") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.divx") returned 0
	[0067.381] lstrlenA (lpString="*.divx") returned 6
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mkv") returned 0
	[0067.381] lstrlenA (lpString="*.mkv") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mp3") returned 0
	[0067.381] lstrlenA (lpString="*.mp3") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wav") returned 0
	[0067.381] lstrlenA (lpString="*.wav") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.flac") returned 0
	[0067.381] lstrlenA (lpString="*.flac") returned 6
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ape") returned 0
	[0067.381] lstrlenA (lpString="*.ape") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wma") returned 0
	[0067.381] lstrlenA (lpString="*.wma") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ac3") returned 0
	[0067.381] lstrlenA (lpString="*.ac3") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.exe") returned 0
	[0067.381] lstrlenA (lpString="*.exe") returned 5
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.apk") returned 0
	[0067.381] lstrlenA (lpString="*.apk") returned 5
	[0067.381] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.381] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.381] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1
	[0067.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1
	[0067.381] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1
	[0067.381] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="SUBMIT.JS"
	[0067.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.381] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.381] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js"
	[0067.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.zip") returned 0
	[0067.382] lstrlenA (lpString="*.zip") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.rar") returned 0
	[0067.382] lstrlenA (lpString="*.rar") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.7z") returned 0
	[0067.382] lstrlenA (lpString="*.7z") returned 4
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.tar") returned 0
	[0067.382] lstrlenA (lpString="*.tar") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.gzip") returned 0
	[0067.382] lstrlenA (lpString="*.gzip") returned 6
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.jpg") returned 0
	[0067.382] lstrlenA (lpString="*.jpg") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.jpeg") returned 0
	[0067.382] lstrlenA (lpString="*.jpeg") returned 6
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.psd") returned 0
	[0067.382] lstrlenA (lpString="*.psd") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.cdr") returned 0
	[0067.382] lstrlenA (lpString="*.cdr") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.dwg") returned 0
	[0067.382] lstrlenA (lpString="*.dwg") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.max") returned 0
	[0067.382] lstrlenA (lpString="*.max") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.bmp") returned 0
	[0067.382] lstrlenA (lpString="*.bmp") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.gif") returned 0
	[0067.382] lstrlenA (lpString="*.gif") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.png") returned 0
	[0067.382] lstrlenA (lpString="*.png") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.doc") returned 0
	[0067.382] lstrlenA (lpString="*.doc") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.docx") returned 0
	[0067.382] lstrlenA (lpString="*.docx") returned 6
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.xls") returned 0
	[0067.382] lstrlenA (lpString="*.xls") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.xlsx") returned 0
	[0067.382] lstrlenA (lpString="*.xlsx") returned 6
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ppt") returned 0
	[0067.382] lstrlenA (lpString="*.ppt") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pptx") returned 0
	[0067.382] lstrlenA (lpString="*.pptx") returned 6
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.txt") returned 0
	[0067.382] lstrlenA (lpString="*.txt") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pdf") returned 0
	[0067.382] lstrlenA (lpString="*.pdf") returned 5
	[0067.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.djvu") returned 0
	[0067.382] lstrlenA (lpString="*.djvu") returned 6
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.htm") returned 0
	[0067.383] lstrlenA (lpString="*.htm") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.html") returned 0
	[0067.383] lstrlenA (lpString="*.html") returned 6
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mdb") returned 0
	[0067.383] lstrlenA (lpString="*.mdb") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.cer") returned 0
	[0067.383] lstrlenA (lpString="*.cer") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.p12") returned 0
	[0067.383] lstrlenA (lpString="*.p12") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pfx") returned 0
	[0067.383] lstrlenA (lpString="*.pfx") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.kwm") returned 0
	[0067.383] lstrlenA (lpString="*.kwm") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pwm") returned 0
	[0067.383] lstrlenA (lpString="*.pwm") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.1cd") returned 0
	[0067.383] lstrlenA (lpString="*.1cd") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.md") returned 0
	[0067.383] lstrlenA (lpString="*.md") returned 4
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mdf") returned 0
	[0067.383] lstrlenA (lpString="*.mdf") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.dbf") returned 0
	[0067.383] lstrlenA (lpString="*.dbf") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.odt") returned 0
	[0067.383] lstrlenA (lpString="*.odt") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.vob") returned 0
	[0067.383] lstrlenA (lpString="*.vob") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ifo") returned 0
	[0067.383] lstrlenA (lpString="*.ifo") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.lnk") returned 0
	[0067.383] lstrlenA (lpString="*.lnk") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.torrent") returned 0
	[0067.383] lstrlenA (lpString="*.torrent") returned 9
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mov") returned 0
	[0067.383] lstrlenA (lpString="*.mov") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.m2v") returned 0
	[0067.383] lstrlenA (lpString="*.m2v") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.3gp") returned 0
	[0067.383] lstrlenA (lpString="*.3gp") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mpeg") returned 0
	[0067.383] lstrlenA (lpString="*.mpeg") returned 6
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mpg") returned 0
	[0067.383] lstrlenA (lpString="*.mpg") returned 5
	[0067.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.flv") returned 0
	[0067.383] lstrlenA (lpString="*.flv") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.avi") returned 0
	[0067.384] lstrlenA (lpString="*.avi") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mp4") returned 0
	[0067.384] lstrlenA (lpString="*.mp4") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wmv") returned 0
	[0067.384] lstrlenA (lpString="*.wmv") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.divx") returned 0
	[0067.384] lstrlenA (lpString="*.divx") returned 6
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mkv") returned 0
	[0067.384] lstrlenA (lpString="*.mkv") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mp3") returned 0
	[0067.384] lstrlenA (lpString="*.mp3") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wav") returned 0
	[0067.384] lstrlenA (lpString="*.wav") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.flac") returned 0
	[0067.384] lstrlenA (lpString="*.flac") returned 6
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ape") returned 0
	[0067.384] lstrlenA (lpString="*.ape") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wma") returned 0
	[0067.384] lstrlenA (lpString="*.wma") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ac3") returned 0
	[0067.384] lstrlenA (lpString="*.ac3") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.exe") returned 0
	[0067.384] lstrlenA (lpString="*.exe") returned 5
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.apk") returned 0
	[0067.384] lstrlenA (lpString="*.apk") returned 5
	[0067.384] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.384] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.384] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1
	[0067.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1
	[0067.384] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1
	[0067.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="utilityfunctions.js"
	[0067.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\"
	[0067.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned=""
	[0067.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt"
	[0067.384] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20
	[0067.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js"
	[0067.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.zip") returned 0
	[0067.384] lstrlenA (lpString="*.zip") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.rar") returned 0
	[0067.385] lstrlenA (lpString="*.rar") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.7z") returned 0
	[0067.385] lstrlenA (lpString="*.7z") returned 4
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.tar") returned 0
	[0067.385] lstrlenA (lpString="*.tar") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.gzip") returned 0
	[0067.385] lstrlenA (lpString="*.gzip") returned 6
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.jpg") returned 0
	[0067.385] lstrlenA (lpString="*.jpg") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.jpeg") returned 0
	[0067.385] lstrlenA (lpString="*.jpeg") returned 6
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.psd") returned 0
	[0067.385] lstrlenA (lpString="*.psd") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.cdr") returned 0
	[0067.385] lstrlenA (lpString="*.cdr") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.dwg") returned 0
	[0067.385] lstrlenA (lpString="*.dwg") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.max") returned 0
	[0067.385] lstrlenA (lpString="*.max") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.bmp") returned 0
	[0067.385] lstrlenA (lpString="*.bmp") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.gif") returned 0
	[0067.385] lstrlenA (lpString="*.gif") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.png") returned 0
	[0067.385] lstrlenA (lpString="*.png") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.doc") returned 0
	[0067.385] lstrlenA (lpString="*.doc") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.docx") returned 0
	[0067.385] lstrlenA (lpString="*.docx") returned 6
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.xls") returned 0
	[0067.385] lstrlenA (lpString="*.xls") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.xlsx") returned 0
	[0067.385] lstrlenA (lpString="*.xlsx") returned 6
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ppt") returned 0
	[0067.385] lstrlenA (lpString="*.ppt") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pptx") returned 0
	[0067.385] lstrlenA (lpString="*.pptx") returned 6
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.txt") returned 0
	[0067.385] lstrlenA (lpString="*.txt") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pdf") returned 0
	[0067.385] lstrlenA (lpString="*.pdf") returned 5
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.djvu") returned 0
	[0067.385] lstrlenA (lpString="*.djvu") returned 6
	[0067.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.htm") returned 0
	[0067.386] lstrlenA (lpString="*.htm") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.html") returned 0
	[0067.386] lstrlenA (lpString="*.html") returned 6
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mdb") returned 0
	[0067.386] lstrlenA (lpString="*.mdb") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.cer") returned 0
	[0067.386] lstrlenA (lpString="*.cer") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.p12") returned 0
	[0067.386] lstrlenA (lpString="*.p12") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pfx") returned 0
	[0067.386] lstrlenA (lpString="*.pfx") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.kwm") returned 0
	[0067.386] lstrlenA (lpString="*.kwm") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pwm") returned 0
	[0067.386] lstrlenA (lpString="*.pwm") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.1cd") returned 0
	[0067.386] lstrlenA (lpString="*.1cd") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.md") returned 0
	[0067.386] lstrlenA (lpString="*.md") returned 4
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mdf") returned 0
	[0067.386] lstrlenA (lpString="*.mdf") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.dbf") returned 0
	[0067.386] lstrlenA (lpString="*.dbf") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.odt") returned 0
	[0067.386] lstrlenA (lpString="*.odt") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.vob") returned 0
	[0067.386] lstrlenA (lpString="*.vob") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ifo") returned 0
	[0067.386] lstrlenA (lpString="*.ifo") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.lnk") returned 0
	[0067.386] lstrlenA (lpString="*.lnk") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.torrent") returned 0
	[0067.386] lstrlenA (lpString="*.torrent") returned 9
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mov") returned 0
	[0067.386] lstrlenA (lpString="*.mov") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.m2v") returned 0
	[0067.386] lstrlenA (lpString="*.m2v") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.3gp") returned 0
	[0067.386] lstrlenA (lpString="*.3gp") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mpeg") returned 0
	[0067.386] lstrlenA (lpString="*.mpeg") returned 6
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mpg") returned 0
	[0067.386] lstrlenA (lpString="*.mpg") returned 5
	[0067.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.flv") returned 0
	[0067.387] lstrlenA (lpString="*.flv") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.avi") returned 0
	[0067.387] lstrlenA (lpString="*.avi") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mp4") returned 0
	[0067.387] lstrlenA (lpString="*.mp4") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wmv") returned 0
	[0067.387] lstrlenA (lpString="*.wmv") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.divx") returned 0
	[0067.387] lstrlenA (lpString="*.divx") returned 6
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mkv") returned 0
	[0067.387] lstrlenA (lpString="*.mkv") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mp3") returned 0
	[0067.387] lstrlenA (lpString="*.mp3") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wav") returned 0
	[0067.387] lstrlenA (lpString="*.wav") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.flac") returned 0
	[0067.387] lstrlenA (lpString="*.flac") returned 6
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ape") returned 0
	[0067.387] lstrlenA (lpString="*.ape") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wma") returned 0
	[0067.387] lstrlenA (lpString="*.wma") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ac3") returned 0
	[0067.387] lstrlenA (lpString="*.ac3") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.exe") returned 0
	[0067.387] lstrlenA (lpString="*.exe") returned 5
	[0067.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.apk") returned 0
	[0067.387] lstrlenA (lpString="*.apk") returned 5
	[0067.387] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0067.387] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0067.387] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0067.387] lstrcmpA (lpString1=".", lpString2="GrooveProjectToolset") returned -1
	[0067.387] lstrcmpA (lpString1="..", lpString2="GrooveProjectToolset") returned -1
	[0067.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0067.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveProjectToolset" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset"
	[0067.387] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned 90
	[0067.387] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0067.415] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0067.415] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.440] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0067.440] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0067.440] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.440] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.440] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BriefcaseIcon.jpg") returned 1
	[0067.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIcon.jpg") returned 1
	[0067.440] lstrcmpiA (lpString1="", lpString2="BriefcaseIcon.jpg") returned -1
	[0067.440] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*"
	[0067.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.440] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.440] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.440] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0xffffffff
	[0067.441] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.441] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0067.441] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0067.442] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0067.442] CloseHandle (hObject=0x98) returned 1
	[0067.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg"
	[0067.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.zip") returned 0
	[0067.442] lstrlenA (lpString="*.zip") returned 5
	[0067.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.rar") returned 0
	[0067.442] lstrlenA (lpString="*.rar") returned 5
	[0067.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.7z") returned 0
	[0067.442] lstrlenA (lpString="*.7z") returned 4
	[0067.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.tar") returned 0
	[0067.442] lstrlenA (lpString="*.tar") returned 5
	[0067.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.gzip") returned 0
	[0067.442] lstrlenA (lpString="*.gzip") returned 6
	[0067.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.jpg") returned 1
	[0067.442] lstrlenA (lpString="*.jpg") returned 5
	[0067.442] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg"
	[0067.442] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg"
	[0067.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg."
	[0067.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.Boom"
	[0067.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.443] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140b
	[0067.443] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a61ad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1
	[0067.443] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.443] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x13e8, lpOverlapped=0x0) returned 1
	[0067.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg"
	[0067.464] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.464] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x13e8, lpOverlapped=0x0) returned 1
	[0067.464] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.464] CloseHandle (hObject=0x98) returned 1
	[0067.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.boom")) returned 1
	[0067.465] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.465] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.465] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BriefcaseIconMask.bmp") returned 1
	[0067.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIconMask.bmp") returned 1
	[0067.465] lstrcmpiA (lpString1="", lpString2="BriefcaseIconMask.bmp") returned -1
	[0067.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg"
	[0067.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.465] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.465] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp"
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.zip") returned 0
	[0067.465] lstrlenA (lpString="*.zip") returned 5
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.rar") returned 0
	[0067.465] lstrlenA (lpString="*.rar") returned 5
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.7z") returned 0
	[0067.465] lstrlenA (lpString="*.7z") returned 4
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.tar") returned 0
	[0067.465] lstrlenA (lpString="*.tar") returned 5
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.gzip") returned 0
	[0067.465] lstrlenA (lpString="*.gzip") returned 6
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpg") returned 0
	[0067.465] lstrlenA (lpString="*.jpg") returned 5
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpeg") returned 0
	[0067.465] lstrlenA (lpString="*.jpeg") returned 6
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.psd") returned 0
	[0067.465] lstrlenA (lpString="*.psd") returned 5
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.cdr") returned 0
	[0067.465] lstrlenA (lpString="*.cdr") returned 5
	[0067.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.dwg") returned 0
	[0067.466] lstrlenA (lpString="*.dwg") returned 5
	[0067.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.max") returned 0
	[0067.466] lstrlenA (lpString="*.max") returned 5
	[0067.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.bmp") returned 1
	[0067.466] lstrlenA (lpString="*.bmp") returned 5
	[0067.466] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp"
	[0067.466] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp"
	[0067.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp."
	[0067.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.Boom"
	[0067.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.466] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf76
	[0067.466] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.466] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.466] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf53, lpOverlapped=0x0) returned 1
	[0067.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="BriefcaseIconMask.bmp"
	[0067.472] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.472] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf53, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf53, lpOverlapped=0x0) returned 1
	[0067.472] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.472] CloseHandle (hObject=0x98) returned 1
	[0067.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.boom")) returned 1
	[0067.473] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.473] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.473] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CircleIcons.jpg") returned 1
	[0067.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIcons.jpg") returned 1
	[0067.473] lstrcmpiA (lpString1="", lpString2="CircleIcons.jpg") returned -1
	[0067.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="BriefcaseIconMask.bmp"
	[0067.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.473] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.473] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg"
	[0067.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.zip") returned 0
	[0067.473] lstrlenA (lpString="*.zip") returned 5
	[0067.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.rar") returned 0
	[0067.473] lstrlenA (lpString="*.rar") returned 5
	[0067.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.7z") returned 0
	[0067.473] lstrlenA (lpString="*.7z") returned 4
	[0067.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.tar") returned 0
	[0067.473] lstrlenA (lpString="*.tar") returned 5
	[0067.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.gzip") returned 0
	[0067.473] lstrlenA (lpString="*.gzip") returned 6
	[0067.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.jpg") returned 1
	[0067.473] lstrlenA (lpString="*.jpg") returned 5
	[0067.473] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg"
	[0067.473] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg"
	[0067.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg."
	[0067.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.Boom"
	[0067.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.474] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32cd
	[0067.474] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.474] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.474] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x32aa, lpOverlapped=0x0) returned 1
	[0067.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg"
	[0067.481] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.481] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x32aa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x32aa, lpOverlapped=0x0) returned 1
	[0067.481] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.481] CloseHandle (hObject=0x98) returned 1
	[0067.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.boom")) returned 1
	[0067.482] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.482] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CircleIconsMask.bmp") returned 1
	[0067.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIconsMask.bmp") returned 1
	[0067.482] lstrcmpiA (lpString1="", lpString2="CircleIconsMask.bmp") returned -1
	[0067.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg"
	[0067.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp"
	[0067.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.zip") returned 0
	[0067.482] lstrlenA (lpString="*.zip") returned 5
	[0067.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.rar") returned 0
	[0067.482] lstrlenA (lpString="*.rar") returned 5
	[0067.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.7z") returned 0
	[0067.482] lstrlenA (lpString="*.7z") returned 4
	[0067.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.tar") returned 0
	[0067.482] lstrlenA (lpString="*.tar") returned 5
	[0067.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.gzip") returned 0
	[0067.482] lstrlenA (lpString="*.gzip") returned 6
	[0067.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpg") returned 0
	[0067.483] lstrlenA (lpString="*.jpg") returned 5
	[0067.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpeg") returned 0
	[0067.483] lstrlenA (lpString="*.jpeg") returned 6
	[0067.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.psd") returned 0
	[0067.483] lstrlenA (lpString="*.psd") returned 5
	[0067.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.cdr") returned 0
	[0067.483] lstrlenA (lpString="*.cdr") returned 5
	[0067.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.dwg") returned 0
	[0067.483] lstrlenA (lpString="*.dwg") returned 5
	[0067.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.max") returned 0
	[0067.483] lstrlenA (lpString="*.max") returned 5
	[0067.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.bmp") returned 1
	[0067.483] lstrlenA (lpString="*.bmp") returned 5
	[0067.483] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp"
	[0067.483] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp"
	[0067.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp."
	[0067.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.Boom"
	[0067.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.483] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114c
	[0067.483] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.483] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.484] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1129, lpOverlapped=0x0) returned 1
	[0067.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="CircleIconsMask.bmp"
	[0067.501] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.501] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1129, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1129, lpOverlapped=0x0) returned 1
	[0067.501] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.502] CloseHandle (hObject=0x98) returned 1
	[0067.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.boom")) returned 1
	[0067.503] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.503] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.503] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MeetingIcon.jpg") returned -1
	[0067.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIcon.jpg") returned -1
	[0067.503] lstrcmpiA (lpString1="", lpString2="MeetingIcon.jpg") returned -1
	[0067.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="CircleIconsMask.bmp"
	[0067.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.503] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.503] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg"
	[0067.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.zip") returned 0
	[0067.503] lstrlenA (lpString="*.zip") returned 5
	[0067.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.rar") returned 0
	[0067.503] lstrlenA (lpString="*.rar") returned 5
	[0067.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.7z") returned 0
	[0067.503] lstrlenA (lpString="*.7z") returned 4
	[0067.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.tar") returned 0
	[0067.503] lstrlenA (lpString="*.tar") returned 5
	[0067.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.gzip") returned 0
	[0067.503] lstrlenA (lpString="*.gzip") returned 6
	[0067.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.jpg") returned 1
	[0067.503] lstrlenA (lpString="*.jpg") returned 5
	[0067.503] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg"
	[0067.503] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg"
	[0067.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg."
	[0067.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.Boom"
	[0067.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.504] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26ba
	[0067.504] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.504] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.504] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2697, lpOverlapped=0x0) returned 1
	[0067.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg"
	[0067.513] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.513] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2697, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2697, lpOverlapped=0x0) returned 1
	[0067.513] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.513] CloseHandle (hObject=0x98) returned 1
	[0067.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.boom")) returned 1
	[0067.514] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.514] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.514] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MeetingIconMask.bmp") returned -1
	[0067.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIconMask.bmp") returned -1
	[0067.514] lstrcmpiA (lpString1="", lpString2="MeetingIconMask.bmp") returned -1
	[0067.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg"
	[0067.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.514] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp"
	[0067.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.zip") returned 0
	[0067.515] lstrlenA (lpString="*.zip") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.rar") returned 0
	[0067.515] lstrlenA (lpString="*.rar") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.7z") returned 0
	[0067.515] lstrlenA (lpString="*.7z") returned 4
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.tar") returned 0
	[0067.515] lstrlenA (lpString="*.tar") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.gzip") returned 0
	[0067.515] lstrlenA (lpString="*.gzip") returned 6
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpg") returned 0
	[0067.515] lstrlenA (lpString="*.jpg") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpeg") returned 0
	[0067.515] lstrlenA (lpString="*.jpeg") returned 6
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.psd") returned 0
	[0067.515] lstrlenA (lpString="*.psd") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.cdr") returned 0
	[0067.515] lstrlenA (lpString="*.cdr") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.dwg") returned 0
	[0067.515] lstrlenA (lpString="*.dwg") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.max") returned 0
	[0067.515] lstrlenA (lpString="*.max") returned 5
	[0067.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.bmp") returned 1
	[0067.515] lstrlenA (lpString="*.bmp") returned 5
	[0067.515] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp"
	[0067.515] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp"
	[0067.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp."
	[0067.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.Boom"
	[0067.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.516] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b8
	[0067.516] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.516] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.516] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x695, lpOverlapped=0x0) returned 1
	[0067.528] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="MeetingIconMask.bmp"
	[0067.528] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.528] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x695, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x695, lpOverlapped=0x0) returned 1
	[0067.528] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.528] CloseHandle (hObject=0x98) returned 1
	[0067.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.boom")) returned 1
	[0067.529] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.529] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectStatusIcons.jpg") returned -1
	[0067.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIcons.jpg") returned -1
	[0067.529] lstrcmpiA (lpString1="", lpString2="ProjectStatusIcons.jpg") returned -1
	[0067.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="MeetingIconMask.bmp"
	[0067.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg"
	[0067.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.zip") returned 0
	[0067.529] lstrlenA (lpString="*.zip") returned 5
	[0067.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.rar") returned 0
	[0067.529] lstrlenA (lpString="*.rar") returned 5
	[0067.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.7z") returned 0
	[0067.529] lstrlenA (lpString="*.7z") returned 4
	[0067.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.tar") returned 0
	[0067.529] lstrlenA (lpString="*.tar") returned 5
	[0067.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.gzip") returned 0
	[0067.529] lstrlenA (lpString="*.gzip") returned 6
	[0067.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.jpg") returned 1
	[0067.529] lstrlenA (lpString="*.jpg") returned 5
	[0067.529] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg"
	[0067.529] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg"
	[0067.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg."
	[0067.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.Boom"
	[0067.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.530] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e9
	[0067.530] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.530] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.531] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x19c6, lpOverlapped=0x0) returned 1
	[0067.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg"
	[0067.543] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.543] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x19c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x19c6, lpOverlapped=0x0) returned 1
	[0067.543] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.543] CloseHandle (hObject=0x98) returned 1
	[0067.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.boom")) returned 1
	[0067.544] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.544] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.544] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectStatusIconsMask.bmp") returned -1
	[0067.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIconsMask.bmp") returned -1
	[0067.544] lstrcmpiA (lpString1="", lpString2="ProjectStatusIconsMask.bmp") returned -1
	[0067.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg"
	[0067.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp"
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.zip") returned 0
	[0067.544] lstrlenA (lpString="*.zip") returned 5
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.rar") returned 0
	[0067.544] lstrlenA (lpString="*.rar") returned 5
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.7z") returned 0
	[0067.544] lstrlenA (lpString="*.7z") returned 4
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.tar") returned 0
	[0067.544] lstrlenA (lpString="*.tar") returned 5
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.gzip") returned 0
	[0067.544] lstrlenA (lpString="*.gzip") returned 6
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpg") returned 0
	[0067.544] lstrlenA (lpString="*.jpg") returned 5
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpeg") returned 0
	[0067.544] lstrlenA (lpString="*.jpeg") returned 6
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.psd") returned 0
	[0067.544] lstrlenA (lpString="*.psd") returned 5
	[0067.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.cdr") returned 0
	[0067.545] lstrlenA (lpString="*.cdr") returned 5
	[0067.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.dwg") returned 0
	[0067.545] lstrlenA (lpString="*.dwg") returned 5
	[0067.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.max") returned 0
	[0067.545] lstrlenA (lpString="*.max") returned 5
	[0067.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.bmp") returned 1
	[0067.545] lstrlenA (lpString="*.bmp") returned 5
	[0067.545] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp"
	[0067.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp"
	[0067.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp."
	[0067.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.Boom"
	[0067.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.547] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa10
	[0067.547] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.547] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.547] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9ed, lpOverlapped=0x0) returned 1
	[0067.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="ProjectStatusIconsMask.bmp"
	[0067.567] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.567] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9ed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9ed, lpOverlapped=0x0) returned 1
	[0067.567] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.567] CloseHandle (hObject=0x98) returned 1
	[0067.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.boom")) returned 1
	[0067.569] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.569] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.569] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectTaskIcon.jpg") returned -1
	[0067.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIcon.jpg") returned -1
	[0067.569] lstrcmpiA (lpString1="", lpString2="ProjectTaskIcon.jpg") returned -1
	[0067.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="ProjectStatusIconsMask.bmp"
	[0067.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg"
	[0067.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.zip") returned 0
	[0067.569] lstrlenA (lpString="*.zip") returned 5
	[0067.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.rar") returned 0
	[0067.569] lstrlenA (lpString="*.rar") returned 5
	[0067.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.7z") returned 0
	[0067.569] lstrlenA (lpString="*.7z") returned 4
	[0067.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.tar") returned 0
	[0067.569] lstrlenA (lpString="*.tar") returned 5
	[0067.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.gzip") returned 0
	[0067.570] lstrlenA (lpString="*.gzip") returned 6
	[0067.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.jpg") returned 1
	[0067.570] lstrlenA (lpString="*.jpg") returned 5
	[0067.570] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg"
	[0067.570] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg"
	[0067.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg."
	[0067.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.Boom"
	[0067.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.570] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200e
	[0067.570] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.570] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.570] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1feb, lpOverlapped=0x0) returned 1
	[0067.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg"
	[0067.576] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.576] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1feb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1feb, lpOverlapped=0x0) returned 1
	[0067.576] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.576] CloseHandle (hObject=0x98) returned 1
	[0067.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.boom")) returned 1
	[0067.577] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.577] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.577] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectTaskIconMask.bmp") returned -1
	[0067.577] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIconMask.bmp") returned -1
	[0067.577] lstrcmpiA (lpString1="", lpString2="ProjectTaskIconMask.bmp") returned -1
	[0067.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg"
	[0067.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp"
	[0067.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.zip") returned 0
	[0067.577] lstrlenA (lpString="*.zip") returned 5
	[0067.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.rar") returned 0
	[0067.577] lstrlenA (lpString="*.rar") returned 5
	[0067.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.7z") returned 0
	[0067.577] lstrlenA (lpString="*.7z") returned 4
	[0067.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.tar") returned 0
	[0067.578] lstrlenA (lpString="*.tar") returned 5
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.gzip") returned 0
	[0067.578] lstrlenA (lpString="*.gzip") returned 6
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpg") returned 0
	[0067.578] lstrlenA (lpString="*.jpg") returned 5
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpeg") returned 0
	[0067.578] lstrlenA (lpString="*.jpeg") returned 6
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.psd") returned 0
	[0067.578] lstrlenA (lpString="*.psd") returned 5
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.cdr") returned 0
	[0067.578] lstrlenA (lpString="*.cdr") returned 5
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.dwg") returned 0
	[0067.578] lstrlenA (lpString="*.dwg") returned 5
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.max") returned 0
	[0067.578] lstrlenA (lpString="*.max") returned 5
	[0067.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.bmp") returned 1
	[0067.578] lstrlenA (lpString="*.bmp") returned 5
	[0067.578] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp"
	[0067.578] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp"
	[0067.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp."
	[0067.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.Boom"
	[0067.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.579] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x79c
	[0067.579] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1
	[0067.579] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.579] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x779, lpOverlapped=0x0) returned 1
	[0067.591] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="ProjectTaskIconMask.bmp"
	[0067.591] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.591] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x779, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x779, lpOverlapped=0x0) returned 1
	[0067.591] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.591] CloseHandle (hObject=0x98) returned 1
	[0067.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.boom")) returned 1
	[0067.592] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.592] lstrcmpA (lpString1=".", lpString2="ProjectTool") returned -1
	[0067.592] lstrcmpA (lpString1="..", lpString2="ProjectTool") returned -1
	[0067.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="ProjectTaskIconMask.bmp"
	[0067.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool"
	[0067.593] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned 102
	[0067.593] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7f68
	[0067.593] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0067.593] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0067.593] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0067.593] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0067.593] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 1
	[0067.593] lstrcmpA (lpString1=".", lpString2="Project Report Type") returned -1
	[0067.593] lstrcmpA (lpString1="..", lpString2="Project Report Type") returned -1
	[0067.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*") returned="*.*"
	[0067.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", lpString2="Project Report Type" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type"
	[0067.595] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned 122
	[0067.595] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fa8
	[0067.595] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0067.595] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0067.595] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0067.595] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0067.595] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0067.595] lstrcmpA (lpString1=".", lpString2="Basic") returned -1
	[0067.595] lstrcmpA (lpString1="..", lpString2="Basic") returned -1
	[0067.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*"
	[0067.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Basic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic"
	[0067.595] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned 128
	[0067.596] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b7fe8
	[0067.600] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0067.600] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.600] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0067.600] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0067.600] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.600] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0
	[0067.600] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DEFAULT.XSL") returned 1
	[0067.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEFAULT.XSL") returned 1
	[0067.600] lstrcmpiA (lpString1="", lpString2="DEFAULT.XSL") returned -1
	[0067.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*") returned="*.*"
	[0067.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\"
	[0067.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned=""
	[0067.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt"
	[0067.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\how to decrypt files.txt")) returned 0xffffffff
	[0067.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4
	[0067.601] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0067.601] WriteFile (in: hFile=0xa4, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0067.601] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0067.601] CloseHandle (hObject=0xa4) returned 1
	[0067.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpString2="DEFAULT.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL"
	[0067.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.zip") returned 0
	[0067.601] lstrlenA (lpString="*.zip") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.rar") returned 0
	[0067.602] lstrlenA (lpString="*.rar") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.7z") returned 0
	[0067.602] lstrlenA (lpString="*.7z") returned 4
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.tar") returned 0
	[0067.602] lstrlenA (lpString="*.tar") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gzip") returned 0
	[0067.602] lstrlenA (lpString="*.gzip") returned 6
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpg") returned 0
	[0067.602] lstrlenA (lpString="*.jpg") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpeg") returned 0
	[0067.602] lstrlenA (lpString="*.jpeg") returned 6
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.psd") returned 0
	[0067.602] lstrlenA (lpString="*.psd") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.cdr") returned 0
	[0067.602] lstrlenA (lpString="*.cdr") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dwg") returned 0
	[0067.602] lstrlenA (lpString="*.dwg") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.max") returned 0
	[0067.602] lstrlenA (lpString="*.max") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.bmp") returned 0
	[0067.602] lstrlenA (lpString="*.bmp") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gif") returned 0
	[0067.602] lstrlenA (lpString="*.gif") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.png") returned 0
	[0067.602] lstrlenA (lpString="*.png") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.doc") returned 0
	[0067.602] lstrlenA (lpString="*.doc") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.docx") returned 0
	[0067.602] lstrlenA (lpString="*.docx") returned 6
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xls") returned 0
	[0067.602] lstrlenA (lpString="*.xls") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xlsx") returned 0
	[0067.602] lstrlenA (lpString="*.xlsx") returned 6
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ppt") returned 0
	[0067.602] lstrlenA (lpString="*.ppt") returned 5
	[0067.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pptx") returned 0
	[0067.602] lstrlenA (lpString="*.pptx") returned 6
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.txt") returned 0
	[0067.603] lstrlenA (lpString="*.txt") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pdf") returned 0
	[0067.603] lstrlenA (lpString="*.pdf") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.djvu") returned 0
	[0067.603] lstrlenA (lpString="*.djvu") returned 6
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.htm") returned 0
	[0067.603] lstrlenA (lpString="*.htm") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.html") returned 0
	[0067.603] lstrlenA (lpString="*.html") returned 6
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mdb") returned 0
	[0067.603] lstrlenA (lpString="*.mdb") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.cer") returned 0
	[0067.603] lstrlenA (lpString="*.cer") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.p12") returned 0
	[0067.603] lstrlenA (lpString="*.p12") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pfx") returned 0
	[0067.603] lstrlenA (lpString="*.pfx") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.kwm") returned 0
	[0067.603] lstrlenA (lpString="*.kwm") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pwm") returned 0
	[0067.603] lstrlenA (lpString="*.pwm") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.1cd") returned 0
	[0067.603] lstrlenA (lpString="*.1cd") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.md") returned 0
	[0067.603] lstrlenA (lpString="*.md") returned 4
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mdf") returned 0
	[0067.603] lstrlenA (lpString="*.mdf") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dbf") returned 0
	[0067.603] lstrlenA (lpString="*.dbf") returned 5
	[0067.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.odt") returned 0
	[0067.605] lstrlenA (lpString="*.odt") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.vob") returned 0
	[0067.605] lstrlenA (lpString="*.vob") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ifo") returned 0
	[0067.605] lstrlenA (lpString="*.ifo") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.lnk") returned 0
	[0067.605] lstrlenA (lpString="*.lnk") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.torrent") returned 0
	[0067.605] lstrlenA (lpString="*.torrent") returned 9
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mov") returned 0
	[0067.605] lstrlenA (lpString="*.mov") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.m2v") returned 0
	[0067.605] lstrlenA (lpString="*.m2v") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.3gp") returned 0
	[0067.605] lstrlenA (lpString="*.3gp") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mpeg") returned 0
	[0067.605] lstrlenA (lpString="*.mpeg") returned 6
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mpg") returned 0
	[0067.605] lstrlenA (lpString="*.mpg") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.flv") returned 0
	[0067.605] lstrlenA (lpString="*.flv") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.avi") returned 0
	[0067.605] lstrlenA (lpString="*.avi") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp4") returned 0
	[0067.605] lstrlenA (lpString="*.mp4") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wmv") returned 0
	[0067.605] lstrlenA (lpString="*.wmv") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.divx") returned 0
	[0067.605] lstrlenA (lpString="*.divx") returned 6
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mkv") returned 0
	[0067.605] lstrlenA (lpString="*.mkv") returned 5
	[0067.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp3") returned 0
	[0067.606] lstrlenA (lpString="*.mp3") returned 5
	[0067.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wav") returned 0
	[0067.606] lstrlenA (lpString="*.wav") returned 5
	[0067.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.flac") returned 0
	[0067.606] lstrlenA (lpString="*.flac") returned 6
	[0067.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ape") returned 0
	[0067.606] lstrlenA (lpString="*.ape") returned 5
	[0067.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wma") returned 0
	[0067.606] lstrlenA (lpString="*.wma") returned 5
	[0067.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ac3") returned 0
	[0067.606] lstrlenA (lpString="*.ac3") returned 5
	[0067.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.exe") returned 0
	[0067.606] lstrlenA (lpString="*.exe") returned 5
	[0067.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.apk") returned 0
	[0067.606] lstrlenA (lpString="*.apk") returned 5
	[0067.606] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0
	[0067.606] FindClose (in: hFindFile=0x8b7fe8 | out: hFindFile=0x8b7fe8) returned 1
	[0067.606] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 1
	[0067.606] lstrcmpA (lpString1=".", lpString2="Fancy") returned -1
	[0067.606] lstrcmpA (lpString1="..", lpString2="Fancy") returned -1
	[0067.606] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*"
	[0067.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Fancy" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy"
	[0067.606] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned 128
	[0067.606] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b7fe8
	[0067.621] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0067.621] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.621] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0067.621] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0067.621] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.621] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0
	[0067.621] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hierarchy.js") returned -1
	[0067.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.js") returned 1
	[0067.622] lstrcmpiA (lpString1="", lpString2="Hierarchy.js") returned -1
	[0067.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*") returned="*.*"
	[0067.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\"
	[0067.622] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned=""
	[0067.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt"
	[0067.622] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0xffffffff
	[0067.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4
	[0067.623] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0067.623] WriteFile (in: hFile=0xa4, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0067.624] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0067.624] CloseHandle (hObject=0xa4) returned 1
	[0067.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js"
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.zip") returned 0
	[0067.624] lstrlenA (lpString="*.zip") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.rar") returned 0
	[0067.624] lstrlenA (lpString="*.rar") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.7z") returned 0
	[0067.624] lstrlenA (lpString="*.7z") returned 4
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.tar") returned 0
	[0067.624] lstrlenA (lpString="*.tar") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.gzip") returned 0
	[0067.624] lstrlenA (lpString="*.gzip") returned 6
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpg") returned 0
	[0067.624] lstrlenA (lpString="*.jpg") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpeg") returned 0
	[0067.624] lstrlenA (lpString="*.jpeg") returned 6
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.psd") returned 0
	[0067.624] lstrlenA (lpString="*.psd") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.cdr") returned 0
	[0067.624] lstrlenA (lpString="*.cdr") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dwg") returned 0
	[0067.624] lstrlenA (lpString="*.dwg") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.max") returned 0
	[0067.624] lstrlenA (lpString="*.max") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.bmp") returned 0
	[0067.624] lstrlenA (lpString="*.bmp") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.gif") returned 0
	[0067.624] lstrlenA (lpString="*.gif") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.png") returned 0
	[0067.624] lstrlenA (lpString="*.png") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.doc") returned 0
	[0067.624] lstrlenA (lpString="*.doc") returned 5
	[0067.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.docx") returned 0
	[0067.624] lstrlenA (lpString="*.docx") returned 6
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xls") returned 0
	[0067.625] lstrlenA (lpString="*.xls") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xlsx") returned 0
	[0067.625] lstrlenA (lpString="*.xlsx") returned 6
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ppt") returned 0
	[0067.625] lstrlenA (lpString="*.ppt") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pptx") returned 0
	[0067.625] lstrlenA (lpString="*.pptx") returned 6
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.txt") returned 0
	[0067.625] lstrlenA (lpString="*.txt") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pdf") returned 0
	[0067.625] lstrlenA (lpString="*.pdf") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.djvu") returned 0
	[0067.625] lstrlenA (lpString="*.djvu") returned 6
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.htm") returned 0
	[0067.625] lstrlenA (lpString="*.htm") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.html") returned 0
	[0067.625] lstrlenA (lpString="*.html") returned 6
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mdb") returned 0
	[0067.625] lstrlenA (lpString="*.mdb") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.cer") returned 0
	[0067.625] lstrlenA (lpString="*.cer") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.p12") returned 0
	[0067.625] lstrlenA (lpString="*.p12") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pfx") returned 0
	[0067.625] lstrlenA (lpString="*.pfx") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.kwm") returned 0
	[0067.625] lstrlenA (lpString="*.kwm") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pwm") returned 0
	[0067.625] lstrlenA (lpString="*.pwm") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.1cd") returned 0
	[0067.625] lstrlenA (lpString="*.1cd") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.md") returned 0
	[0067.625] lstrlenA (lpString="*.md") returned 4
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mdf") returned 0
	[0067.625] lstrlenA (lpString="*.mdf") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dbf") returned 0
	[0067.625] lstrlenA (lpString="*.dbf") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.odt") returned 0
	[0067.625] lstrlenA (lpString="*.odt") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.vob") returned 0
	[0067.625] lstrlenA (lpString="*.vob") returned 5
	[0067.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ifo") returned 0
	[0067.625] lstrlenA (lpString="*.ifo") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.lnk") returned 0
	[0067.626] lstrlenA (lpString="*.lnk") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.torrent") returned 0
	[0067.626] lstrlenA (lpString="*.torrent") returned 9
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mov") returned 0
	[0067.626] lstrlenA (lpString="*.mov") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.m2v") returned 0
	[0067.626] lstrlenA (lpString="*.m2v") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.3gp") returned 0
	[0067.626] lstrlenA (lpString="*.3gp") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mpeg") returned 0
	[0067.626] lstrlenA (lpString="*.mpeg") returned 6
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mpg") returned 0
	[0067.626] lstrlenA (lpString="*.mpg") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.flv") returned 0
	[0067.626] lstrlenA (lpString="*.flv") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.avi") returned 0
	[0067.626] lstrlenA (lpString="*.avi") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mp4") returned 0
	[0067.626] lstrlenA (lpString="*.mp4") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wmv") returned 0
	[0067.626] lstrlenA (lpString="*.wmv") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.divx") returned 0
	[0067.626] lstrlenA (lpString="*.divx") returned 6
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mkv") returned 0
	[0067.626] lstrlenA (lpString="*.mkv") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mp3") returned 0
	[0067.626] lstrlenA (lpString="*.mp3") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wav") returned 0
	[0067.626] lstrlenA (lpString="*.wav") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.flac") returned 0
	[0067.626] lstrlenA (lpString="*.flac") returned 6
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ape") returned 0
	[0067.626] lstrlenA (lpString="*.ape") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wma") returned 0
	[0067.626] lstrlenA (lpString="*.wma") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ac3") returned 0
	[0067.626] lstrlenA (lpString="*.ac3") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.exe") returned 0
	[0067.626] lstrlenA (lpString="*.exe") returned 5
	[0067.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.apk") returned 0
	[0067.626] lstrlenA (lpString="*.apk") returned 5
	[0067.626] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.627] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0
	[0067.627] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hierarchy.xsl") returned -1
	[0067.627] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.xsl") returned 1
	[0067.627] lstrcmpiA (lpString1="", lpString2="Hierarchy.xsl") returned -1
	[0067.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="Hierarchy.js"
	[0067.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\"
	[0067.627] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned=""
	[0067.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt"
	[0067.627] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20
	[0067.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.xsl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl"
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.zip") returned 0
	[0067.627] lstrlenA (lpString="*.zip") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.rar") returned 0
	[0067.627] lstrlenA (lpString="*.rar") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.7z") returned 0
	[0067.627] lstrlenA (lpString="*.7z") returned 4
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.tar") returned 0
	[0067.627] lstrlenA (lpString="*.tar") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.gzip") returned 0
	[0067.627] lstrlenA (lpString="*.gzip") returned 6
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.jpg") returned 0
	[0067.627] lstrlenA (lpString="*.jpg") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.jpeg") returned 0
	[0067.627] lstrlenA (lpString="*.jpeg") returned 6
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.psd") returned 0
	[0067.627] lstrlenA (lpString="*.psd") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.cdr") returned 0
	[0067.627] lstrlenA (lpString="*.cdr") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.dwg") returned 0
	[0067.627] lstrlenA (lpString="*.dwg") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.max") returned 0
	[0067.627] lstrlenA (lpString="*.max") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.bmp") returned 0
	[0067.627] lstrlenA (lpString="*.bmp") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.gif") returned 0
	[0067.627] lstrlenA (lpString="*.gif") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.png") returned 0
	[0067.627] lstrlenA (lpString="*.png") returned 5
	[0067.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.doc") returned 0
	[0067.627] lstrlenA (lpString="*.doc") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.docx") returned 0
	[0067.628] lstrlenA (lpString="*.docx") returned 6
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.xls") returned 0
	[0067.628] lstrlenA (lpString="*.xls") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.xlsx") returned 0
	[0067.628] lstrlenA (lpString="*.xlsx") returned 6
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ppt") returned 0
	[0067.628] lstrlenA (lpString="*.ppt") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pptx") returned 0
	[0067.628] lstrlenA (lpString="*.pptx") returned 6
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.txt") returned 0
	[0067.628] lstrlenA (lpString="*.txt") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pdf") returned 0
	[0067.628] lstrlenA (lpString="*.pdf") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.djvu") returned 0
	[0067.628] lstrlenA (lpString="*.djvu") returned 6
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.htm") returned 0
	[0067.628] lstrlenA (lpString="*.htm") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.html") returned 0
	[0067.628] lstrlenA (lpString="*.html") returned 6
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mdb") returned 0
	[0067.628] lstrlenA (lpString="*.mdb") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.cer") returned 0
	[0067.628] lstrlenA (lpString="*.cer") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.p12") returned 0
	[0067.628] lstrlenA (lpString="*.p12") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pfx") returned 0
	[0067.628] lstrlenA (lpString="*.pfx") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.kwm") returned 0
	[0067.628] lstrlenA (lpString="*.kwm") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pwm") returned 0
	[0067.628] lstrlenA (lpString="*.pwm") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.1cd") returned 0
	[0067.628] lstrlenA (lpString="*.1cd") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.md") returned 0
	[0067.628] lstrlenA (lpString="*.md") returned 4
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mdf") returned 0
	[0067.628] lstrlenA (lpString="*.mdf") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.dbf") returned 0
	[0067.628] lstrlenA (lpString="*.dbf") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.odt") returned 0
	[0067.628] lstrlenA (lpString="*.odt") returned 5
	[0067.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.vob") returned 0
	[0067.629] lstrlenA (lpString="*.vob") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ifo") returned 0
	[0067.629] lstrlenA (lpString="*.ifo") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.lnk") returned 0
	[0067.629] lstrlenA (lpString="*.lnk") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.torrent") returned 0
	[0067.629] lstrlenA (lpString="*.torrent") returned 9
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mov") returned 0
	[0067.629] lstrlenA (lpString="*.mov") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.m2v") returned 0
	[0067.629] lstrlenA (lpString="*.m2v") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.3gp") returned 0
	[0067.629] lstrlenA (lpString="*.3gp") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mpeg") returned 0
	[0067.629] lstrlenA (lpString="*.mpeg") returned 6
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mpg") returned 0
	[0067.629] lstrlenA (lpString="*.mpg") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.flv") returned 0
	[0067.629] lstrlenA (lpString="*.flv") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.avi") returned 0
	[0067.629] lstrlenA (lpString="*.avi") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mp4") returned 0
	[0067.629] lstrlenA (lpString="*.mp4") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wmv") returned 0
	[0067.629] lstrlenA (lpString="*.wmv") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.divx") returned 0
	[0067.629] lstrlenA (lpString="*.divx") returned 6
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mkv") returned 0
	[0067.629] lstrlenA (lpString="*.mkv") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mp3") returned 0
	[0067.629] lstrlenA (lpString="*.mp3") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wav") returned 0
	[0067.629] lstrlenA (lpString="*.wav") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.flac") returned 0
	[0067.629] lstrlenA (lpString="*.flac") returned 6
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ape") returned 0
	[0067.629] lstrlenA (lpString="*.ape") returned 5
	[0067.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wma") returned 0
	[0067.630] lstrlenA (lpString="*.wma") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ac3") returned 0
	[0067.630] lstrlenA (lpString="*.ac3") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.exe") returned 0
	[0067.630] lstrlenA (lpString="*.exe") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.apk") returned 0
	[0067.630] lstrlenA (lpString="*.apk") returned 5
	[0067.630] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.630] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0
	[0067.630] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MINUS.GIF") returned -1
	[0067.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MINUS.GIF") returned -1
	[0067.630] lstrcmpiA (lpString1="", lpString2="MINUS.GIF") returned -1
	[0067.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="Hierarchy.xsl"
	[0067.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\"
	[0067.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned=""
	[0067.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt"
	[0067.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20
	[0067.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF"
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.zip") returned 0
	[0067.630] lstrlenA (lpString="*.zip") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.rar") returned 0
	[0067.630] lstrlenA (lpString="*.rar") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.7z") returned 0
	[0067.630] lstrlenA (lpString="*.7z") returned 4
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.tar") returned 0
	[0067.630] lstrlenA (lpString="*.tar") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.gzip") returned 0
	[0067.630] lstrlenA (lpString="*.gzip") returned 6
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.jpg") returned 0
	[0067.630] lstrlenA (lpString="*.jpg") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.jpeg") returned 0
	[0067.630] lstrlenA (lpString="*.jpeg") returned 6
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.psd") returned 0
	[0067.630] lstrlenA (lpString="*.psd") returned 5
	[0067.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.cdr") returned 0
	[0067.631] lstrlenA (lpString="*.cdr") returned 5
	[0067.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.dwg") returned 0
	[0067.631] lstrlenA (lpString="*.dwg") returned 5
	[0067.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.max") returned 0
	[0067.631] lstrlenA (lpString="*.max") returned 5
	[0067.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.bmp") returned 0
	[0067.631] lstrlenA (lpString="*.bmp") returned 5
	[0067.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.gif") returned 1
	[0067.631] lstrlenA (lpString="*.gif") returned 5
	[0067.631] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF"
	[0067.631] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF"
	[0067.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF."
	[0067.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.Boom"
	[0067.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4
	[0067.634] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x345
	[0067.634] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69c4c990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.634] SetFilePointer (in: hFile=0xa4, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.634] ReadFile (in: hFile=0xa4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x322, lpOverlapped=0x0) returned 1
	[0067.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="MINUS.GIF"
	[0067.690] SetFilePointer (in: hFile=0xa4, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.691] WriteFile (in: hFile=0xa4, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x322, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x322, lpOverlapped=0x0) returned 1
	[0067.691] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.691] CloseHandle (hObject=0xa4) returned 1
	[0067.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif.boom")) returned 1
	[0067.692] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.692] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0
	[0067.692] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PLUS.GIF") returned -1
	[0067.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PLUS.GIF") returned -1
	[0067.692] lstrcmpiA (lpString1="", lpString2="PLUS.GIF") returned -1
	[0067.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="MINUS.GIF"
	[0067.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\"
	[0067.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned=""
	[0067.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt"
	[0067.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20
	[0067.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF"
	[0067.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.zip") returned 0
	[0067.692] lstrlenA (lpString="*.zip") returned 5
	[0067.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.rar") returned 0
	[0067.692] lstrlenA (lpString="*.rar") returned 5
	[0067.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.7z") returned 0
	[0067.692] lstrlenA (lpString="*.7z") returned 4
	[0067.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.tar") returned 0
	[0067.692] lstrlenA (lpString="*.tar") returned 5
	[0067.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.gzip") returned 0
	[0067.692] lstrlenA (lpString="*.gzip") returned 6
	[0067.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.jpg") returned 0
	[0067.692] lstrlenA (lpString="*.jpg") returned 5
	[0067.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.jpeg") returned 0
	[0067.693] lstrlenA (lpString="*.jpeg") returned 6
	[0067.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.psd") returned 0
	[0067.693] lstrlenA (lpString="*.psd") returned 5
	[0067.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.cdr") returned 0
	[0067.693] lstrlenA (lpString="*.cdr") returned 5
	[0067.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.dwg") returned 0
	[0067.693] lstrlenA (lpString="*.dwg") returned 5
	[0067.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.max") returned 0
	[0067.693] lstrlenA (lpString="*.max") returned 5
	[0067.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.bmp") returned 0
	[0067.693] lstrlenA (lpString="*.bmp") returned 5
	[0067.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.gif") returned 1
	[0067.693] lstrlenA (lpString="*.gif") returned 5
	[0067.693] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF"
	[0067.693] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF"
	[0067.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF."
	[0067.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.Boom"
	[0067.693] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4
	[0067.694] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x349
	[0067.694] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a497830, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.694] SetFilePointer (in: hFile=0xa4, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.694] ReadFile (in: hFile=0xa4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x326, lpOverlapped=0x0) returned 1
	[0067.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="PLUS.GIF"
	[0067.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.745] WriteFile (in: hFile=0xa4, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x326, lpOverlapped=0x0) returned 1
	[0067.745] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.745] CloseHandle (hObject=0xa4) returned 1
	[0067.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif.boom")) returned 1
	[0067.746] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 1
	[0067.746] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0
	[0067.746] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SPACER.GIF") returned -1
	[0067.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACER.GIF") returned -1
	[0067.746] lstrcmpiA (lpString1="", lpString2="SPACER.GIF") returned -1
	[0067.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="PLUS.GIF"
	[0067.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\"
	[0067.746] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned=""
	[0067.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt"
	[0067.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20
	[0067.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF"
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.zip") returned 0
	[0067.747] lstrlenA (lpString="*.zip") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.rar") returned 0
	[0067.747] lstrlenA (lpString="*.rar") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.7z") returned 0
	[0067.747] lstrlenA (lpString="*.7z") returned 4
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.tar") returned 0
	[0067.747] lstrlenA (lpString="*.tar") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.gzip") returned 0
	[0067.747] lstrlenA (lpString="*.gzip") returned 6
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.jpg") returned 0
	[0067.747] lstrlenA (lpString="*.jpg") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.jpeg") returned 0
	[0067.747] lstrlenA (lpString="*.jpeg") returned 6
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.psd") returned 0
	[0067.747] lstrlenA (lpString="*.psd") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.cdr") returned 0
	[0067.747] lstrlenA (lpString="*.cdr") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.dwg") returned 0
	[0067.747] lstrlenA (lpString="*.dwg") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.max") returned 0
	[0067.747] lstrlenA (lpString="*.max") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.bmp") returned 0
	[0067.747] lstrlenA (lpString="*.bmp") returned 5
	[0067.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.gif") returned 1
	[0067.747] lstrlenA (lpString="*.gif") returned 5
	[0067.747] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF"
	[0067.747] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF"
	[0067.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF."
	[0067.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.Boom"
	[0067.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4
	[0067.748] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x327
	[0067.748] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.748] ReadFile (in: hFile=0xa4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x304, lpOverlapped=0x0) returned 1
	[0067.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="SPACER.GIF"
	[0067.826] SetFilePointer (in: hFile=0xa4, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.826] WriteFile (in: hFile=0xa4, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x304, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x304, lpOverlapped=0x0) returned 1
	[0067.826] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.826] CloseHandle (hObject=0xa4) returned 1
	[0067.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif.boom")) returned 1
	[0067.827] FindNextFileA (in: hFindFile=0x8b7fe8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0
	[0067.827] FindClose (in: hFindFile=0x8b7fe8 | out: hFindFile=0x8b7fe8) returned 1
	[0067.827] FindNextFileA (in: hFindFile=0x8b7fa8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0
	[0067.827] FindClose (in: hFindFile=0x8b7fa8 | out: hFindFile=0x8b7fa8) returned 1
	[0067.827] FindNextFileA (in: hFindFile=0x8b7f68, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0
	[0067.827] FindClose (in: hFindFile=0x8b7f68 | out: hFindFile=0x8b7f68) returned 1
	[0067.827] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.827] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.827] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectToolsetIconImages.jpg") returned -1
	[0067.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImages.jpg") returned -1
	[0067.827] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImages.jpg") returned -1
	[0067.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*"
	[0067.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.828] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg"
	[0067.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.zip") returned 0
	[0067.828] lstrlenA (lpString="*.zip") returned 5
	[0067.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.rar") returned 0
	[0067.828] lstrlenA (lpString="*.rar") returned 5
	[0067.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.7z") returned 0
	[0067.828] lstrlenA (lpString="*.7z") returned 4
	[0067.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.tar") returned 0
	[0067.828] lstrlenA (lpString="*.tar") returned 5
	[0067.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.gzip") returned 0
	[0067.828] lstrlenA (lpString="*.gzip") returned 6
	[0067.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.jpg") returned 1
	[0067.828] lstrlenA (lpString="*.jpg") returned 5
	[0067.828] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg"
	[0067.828] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg"
	[0067.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg."
	[0067.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.Boom"
	[0067.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.829] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f0a
	[0067.829] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.829] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.829] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4ee7, lpOverlapped=0x0) returned 1
	[0067.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg"
	[0067.851] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.851] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4ee7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4ee7, lpOverlapped=0x0) returned 1
	[0067.851] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.851] CloseHandle (hObject=0x98) returned 1
	[0067.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.boom")) returned 1
	[0067.852] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.852] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.852] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1
	[0067.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1
	[0067.852] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1
	[0067.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg"
	[0067.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.853] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp"
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0067.853] lstrlenA (lpString="*.zip") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0067.853] lstrlenA (lpString="*.rar") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0067.853] lstrlenA (lpString="*.7z") returned 4
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0067.853] lstrlenA (lpString="*.tar") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0067.853] lstrlenA (lpString="*.gzip") returned 6
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0067.853] lstrlenA (lpString="*.jpg") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0067.853] lstrlenA (lpString="*.jpeg") returned 6
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0067.853] lstrlenA (lpString="*.psd") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0067.853] lstrlenA (lpString="*.cdr") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0067.853] lstrlenA (lpString="*.dwg") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.max") returned 0
	[0067.853] lstrlenA (lpString="*.max") returned 5
	[0067.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0067.853] lstrlenA (lpString="*.bmp") returned 5
	[0067.853] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp"
	[0067.853] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp"
	[0067.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp."
	[0067.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.Boom"
	[0067.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.854] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2338
	[0067.854] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.854] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.854] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2315, lpOverlapped=0x0) returned 1
	[0067.856] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="ProjectToolsetIconImagesMask.bmp"
	[0067.856] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.856] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2315, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2315, lpOverlapped=0x0) returned 1
	[0067.856] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.856] CloseHandle (hObject=0x98) returned 1
	[0067.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.boom")) returned 1
	[0067.857] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.857] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.857] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SplashImage.jpg") returned -1
	[0067.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImage.jpg") returned -1
	[0067.857] lstrcmpiA (lpString1="", lpString2="SplashImage.jpg") returned -1
	[0067.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="ProjectToolsetIconImagesMask.bmp"
	[0067.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg"
	[0067.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.zip") returned 0
	[0067.857] lstrlenA (lpString="*.zip") returned 5
	[0067.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.rar") returned 0
	[0067.857] lstrlenA (lpString="*.rar") returned 5
	[0067.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.7z") returned 0
	[0067.857] lstrlenA (lpString="*.7z") returned 4
	[0067.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.tar") returned 0
	[0067.857] lstrlenA (lpString="*.tar") returned 5
	[0067.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.gzip") returned 0
	[0067.857] lstrlenA (lpString="*.gzip") returned 6
	[0067.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.jpg") returned 1
	[0067.857] lstrlenA (lpString="*.jpg") returned 5
	[0067.857] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg"
	[0067.857] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg"
	[0067.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg."
	[0067.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.Boom"
	[0067.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.858] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f00
	[0067.858] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.858] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.858] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5edd, lpOverlapped=0x0) returned 1
	[0067.859] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg"
	[0067.859] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.859] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5edd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5edd, lpOverlapped=0x0) returned 1
	[0067.859] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.859] CloseHandle (hObject=0x98) returned 1
	[0067.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.boom")) returned 1
	[0067.860] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.860] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.860] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SplashImageMask.bmp") returned -1
	[0067.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImageMask.bmp") returned -1
	[0067.860] lstrcmpiA (lpString1="", lpString2="SplashImageMask.bmp") returned -1
	[0067.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg"
	[0067.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp"
	[0067.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.zip") returned 0
	[0067.860] lstrlenA (lpString="*.zip") returned 5
	[0067.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.rar") returned 0
	[0067.860] lstrlenA (lpString="*.rar") returned 5
	[0067.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.7z") returned 0
	[0067.860] lstrlenA (lpString="*.7z") returned 4
	[0067.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.tar") returned 0
	[0067.860] lstrlenA (lpString="*.tar") returned 5
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.gzip") returned 0
	[0067.861] lstrlenA (lpString="*.gzip") returned 6
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpg") returned 0
	[0067.861] lstrlenA (lpString="*.jpg") returned 5
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpeg") returned 0
	[0067.861] lstrlenA (lpString="*.jpeg") returned 6
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.psd") returned 0
	[0067.861] lstrlenA (lpString="*.psd") returned 5
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.cdr") returned 0
	[0067.861] lstrlenA (lpString="*.cdr") returned 5
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.dwg") returned 0
	[0067.861] lstrlenA (lpString="*.dwg") returned 5
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.max") returned 0
	[0067.861] lstrlenA (lpString="*.max") returned 5
	[0067.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.bmp") returned 1
	[0067.861] lstrlenA (lpString="*.bmp") returned 5
	[0067.861] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp"
	[0067.861] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp"
	[0067.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp."
	[0067.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.Boom"
	[0067.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.861] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14078
	[0067.861] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.861] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.861] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14055, lpOverlapped=0x0) returned 1
	[0067.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="SplashImageMask.bmp"
	[0067.986] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.986] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14055, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14055, lpOverlapped=0x0) returned 1
	[0067.987] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.987] CloseHandle (hObject=0x98) returned 1
	[0067.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.boom")) returned 1
	[0067.988] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.988] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.988] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TABMASK.BMP") returned -1
	[0067.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABMASK.BMP") returned -1
	[0067.988] lstrcmpiA (lpString1="", lpString2="TABMASK.BMP") returned -1
	[0067.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="SplashImageMask.bmp"
	[0067.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP"
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.zip") returned 0
	[0067.988] lstrlenA (lpString="*.zip") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.rar") returned 0
	[0067.988] lstrlenA (lpString="*.rar") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.7z") returned 0
	[0067.988] lstrlenA (lpString="*.7z") returned 4
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.tar") returned 0
	[0067.988] lstrlenA (lpString="*.tar") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.gzip") returned 0
	[0067.988] lstrlenA (lpString="*.gzip") returned 6
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpg") returned 0
	[0067.988] lstrlenA (lpString="*.jpg") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpeg") returned 0
	[0067.988] lstrlenA (lpString="*.jpeg") returned 6
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.psd") returned 0
	[0067.988] lstrlenA (lpString="*.psd") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.cdr") returned 0
	[0067.988] lstrlenA (lpString="*.cdr") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.dwg") returned 0
	[0067.988] lstrlenA (lpString="*.dwg") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.max") returned 0
	[0067.988] lstrlenA (lpString="*.max") returned 5
	[0067.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.bmp") returned 1
	[0067.988] lstrlenA (lpString="*.bmp") returned 5
	[0067.988] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP"
	[0067.988] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP"
	[0067.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP."
	[0067.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.Boom"
	[0067.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.990] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122
	[0067.990] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aca0270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.990] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.990] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xff, lpOverlapped=0x0) returned 1
	[0067.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="TABMASK.BMP"
	[0067.990] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.990] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xff, lpOverlapped=0x0) returned 1
	[0067.990] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0067.991] CloseHandle (hObject=0x98) returned 1
	[0067.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp.boom")) returned 1
	[0067.991] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0067.991] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0067.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TABOFF.JPG") returned -1
	[0067.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABOFF.JPG") returned -1
	[0067.991] lstrcmpiA (lpString1="", lpString2="TABOFF.JPG") returned -1
	[0067.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="TABMASK.BMP"
	[0067.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0067.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0067.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0067.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0067.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG"
	[0067.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.zip") returned 0
	[0067.991] lstrlenA (lpString="*.zip") returned 5
	[0067.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.rar") returned 0
	[0067.992] lstrlenA (lpString="*.rar") returned 5
	[0067.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.7z") returned 0
	[0067.992] lstrlenA (lpString="*.7z") returned 4
	[0067.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.tar") returned 0
	[0067.992] lstrlenA (lpString="*.tar") returned 5
	[0067.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.gzip") returned 0
	[0067.992] lstrlenA (lpString="*.gzip") returned 6
	[0067.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.jpg") returned 1
	[0067.992] lstrlenA (lpString="*.jpg") returned 5
	[0067.992] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG"
	[0067.992] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG"
	[0067.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG."
	[0067.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.Boom"
	[0067.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0067.993] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b6
	[0067.993] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aca0270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0067.993] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0067.993] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x993, lpOverlapped=0x0) returned 1
	[0068.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG"
	[0068.077] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.077] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x993, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x993, lpOverlapped=0x0) returned 1
	[0068.077] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.077] CloseHandle (hObject=0x98) returned 1
	[0068.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.boom")) returned 1
	[0068.078] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.078] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0068.078] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TABON.JPG") returned -1
	[0068.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABON.JPG") returned -1
	[0068.078] lstrcmpiA (lpString1="", lpString2="TABON.JPG") returned -1
	[0068.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG"
	[0068.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0068.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0068.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0068.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0068.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG"
	[0068.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.zip") returned 0
	[0068.078] lstrlenA (lpString="*.zip") returned 5
	[0068.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.rar") returned 0
	[0068.078] lstrlenA (lpString="*.rar") returned 5
	[0068.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.7z") returned 0
	[0068.078] lstrlenA (lpString="*.7z") returned 4
	[0068.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.tar") returned 0
	[0068.078] lstrlenA (lpString="*.tar") returned 5
	[0068.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.gzip") returned 0
	[0068.078] lstrlenA (lpString="*.gzip") returned 6
	[0068.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.jpg") returned 1
	[0068.079] lstrlenA (lpString="*.jpg") returned 5
	[0068.079] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG"
	[0068.079] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG"
	[0068.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG."
	[0068.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.Boom"
	[0068.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.080] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ef
	[0068.080] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0068.080] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.080] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x9cc, lpOverlapped=0x0) returned 1
	[0068.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG"
	[0068.136] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.136] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x9cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x9cc, lpOverlapped=0x0) returned 1
	[0068.136] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.136] CloseHandle (hObject=0x98) returned 1
	[0068.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.boom")) returned 1
	[0068.137] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.137] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0068.137] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHITEBOX.JPG") returned -1
	[0068.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHITEBOX.JPG") returned -1
	[0068.137] lstrcmpiA (lpString1="", lpString2="WHITEBOX.JPG") returned -1
	[0068.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG"
	[0068.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0068.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0068.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0068.138] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0068.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG"
	[0068.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.zip") returned 0
	[0068.138] lstrlenA (lpString="*.zip") returned 5
	[0068.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.rar") returned 0
	[0068.138] lstrlenA (lpString="*.rar") returned 5
	[0068.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.7z") returned 0
	[0068.138] lstrlenA (lpString="*.7z") returned 4
	[0068.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.tar") returned 0
	[0068.138] lstrlenA (lpString="*.tar") returned 5
	[0068.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.gzip") returned 0
	[0068.138] lstrlenA (lpString="*.gzip") returned 6
	[0068.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.jpg") returned 1
	[0068.138] lstrlenA (lpString="*.jpg") returned 5
	[0068.138] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG"
	[0068.138] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG"
	[0068.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG."
	[0068.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.Boom"
	[0068.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.139] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff
	[0068.139] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0068.139] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.139] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xddc, lpOverlapped=0x0) returned 1
	[0068.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG"
	[0068.156] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.156] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xddc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xddc, lpOverlapped=0x0) returned 1
	[0068.156] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.156] CloseHandle (hObject=0x98) returned 1
	[0068.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.boom")) returned 1
	[0068.157] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.157] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0068.157] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WhiteboxMask.bmp") returned -1
	[0068.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WhiteboxMask.bmp") returned -1
	[0068.157] lstrcmpiA (lpString1="", lpString2="WhiteboxMask.bmp") returned -1
	[0068.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG"
	[0068.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0068.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0068.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0068.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0068.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp"
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.zip") returned 0
	[0068.157] lstrlenA (lpString="*.zip") returned 5
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.rar") returned 0
	[0068.157] lstrlenA (lpString="*.rar") returned 5
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.7z") returned 0
	[0068.157] lstrlenA (lpString="*.7z") returned 4
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.tar") returned 0
	[0068.157] lstrlenA (lpString="*.tar") returned 5
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.gzip") returned 0
	[0068.157] lstrlenA (lpString="*.gzip") returned 6
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpg") returned 0
	[0068.157] lstrlenA (lpString="*.jpg") returned 5
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpeg") returned 0
	[0068.157] lstrlenA (lpString="*.jpeg") returned 6
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.psd") returned 0
	[0068.157] lstrlenA (lpString="*.psd") returned 5
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.cdr") returned 0
	[0068.157] lstrlenA (lpString="*.cdr") returned 5
	[0068.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.dwg") returned 0
	[0068.157] lstrlenA (lpString="*.dwg") returned 5
	[0068.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.max") returned 0
	[0068.158] lstrlenA (lpString="*.max") returned 5
	[0068.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.bmp") returned 1
	[0068.158] lstrlenA (lpString="*.bmp") returned 5
	[0068.158] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp"
	[0068.158] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp"
	[0068.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp."
	[0068.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.Boom"
	[0068.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.158] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d72
	[0068.158] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1
	[0068.158] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.158] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4d4f, lpOverlapped=0x0) returned 1
	[0068.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="WhiteboxMask.bmp"
	[0068.166] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.166] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4d4f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4d4f, lpOverlapped=0x0) returned 1
	[0068.166] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.166] CloseHandle (hObject=0x98) returned 1
	[0068.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.boom")) returned 1
	[0068.167] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.167] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0068.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ZoomIcons.jpg") returned -1
	[0068.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIcons.jpg") returned -1
	[0068.167] lstrcmpiA (lpString1="", lpString2="ZoomIcons.jpg") returned -1
	[0068.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="WhiteboxMask.bmp"
	[0068.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0068.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0068.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0068.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0068.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg"
	[0068.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.zip") returned 0
	[0068.167] lstrlenA (lpString="*.zip") returned 5
	[0068.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.rar") returned 0
	[0068.167] lstrlenA (lpString="*.rar") returned 5
	[0068.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.7z") returned 0
	[0068.167] lstrlenA (lpString="*.7z") returned 4
	[0068.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.tar") returned 0
	[0068.168] lstrlenA (lpString="*.tar") returned 5
	[0068.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.gzip") returned 0
	[0068.168] lstrlenA (lpString="*.gzip") returned 6
	[0068.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.jpg") returned 1
	[0068.168] lstrlenA (lpString="*.jpg") returned 5
	[0068.168] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg"
	[0068.168] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg"
	[0068.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg."
	[0068.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.Boom"
	[0068.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.174] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc59
	[0068.174] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x70c9f7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea)) returned 1
	[0068.174] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.174] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xc36, lpOverlapped=0x0) returned 1
	[0068.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg"
	[0068.175] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.175] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xc36, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xc36, lpOverlapped=0x0) returned 1
	[0068.176] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.176] CloseHandle (hObject=0x98) returned 1
	[0068.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.boom")) returned 1
	[0068.176] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.176] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0068.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ZoomIconsMask.bmp") returned -1
	[0068.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIconsMask.bmp") returned -1
	[0068.176] lstrcmpiA (lpString1="", lpString2="ZoomIconsMask.bmp") returned -1
	[0068.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg"
	[0068.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\"
	[0068.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned=""
	[0068.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt"
	[0068.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20
	[0068.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp"
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.zip") returned 0
	[0068.177] lstrlenA (lpString="*.zip") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.rar") returned 0
	[0068.177] lstrlenA (lpString="*.rar") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.7z") returned 0
	[0068.177] lstrlenA (lpString="*.7z") returned 4
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.tar") returned 0
	[0068.177] lstrlenA (lpString="*.tar") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.gzip") returned 0
	[0068.177] lstrlenA (lpString="*.gzip") returned 6
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpg") returned 0
	[0068.177] lstrlenA (lpString="*.jpg") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpeg") returned 0
	[0068.177] lstrlenA (lpString="*.jpeg") returned 6
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.psd") returned 0
	[0068.177] lstrlenA (lpString="*.psd") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.cdr") returned 0
	[0068.177] lstrlenA (lpString="*.cdr") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.dwg") returned 0
	[0068.177] lstrlenA (lpString="*.dwg") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.max") returned 0
	[0068.177] lstrlenA (lpString="*.max") returned 5
	[0068.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.bmp") returned 1
	[0068.177] lstrlenA (lpString="*.bmp") returned 5
	[0068.177] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp"
	[0068.177] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp"
	[0068.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp."
	[0068.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.Boom"
	[0068.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.178] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638
	[0068.178] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e86eb30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea)) returned 1
	[0068.178] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.178] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x615, lpOverlapped=0x0) returned 1
	[0068.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="ZoomIconsMask.bmp"
	[0068.215] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.215] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x615, lpOverlapped=0x0) returned 1
	[0068.215] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.215] CloseHandle (hObject=0x98) returned 1
	[0068.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.boom")) returned 1
	[0068.216] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0068.216] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0068.216] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0068.216] lstrcmpA (lpString1=".", lpString2="Welcome Tool") returned -1
	[0068.216] lstrcmpA (lpString1="..", lpString2="Welcome Tool") returned -1
	[0068.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*"
	[0068.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Welcome Tool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool"
	[0068.216] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned 82
	[0068.216] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0068.305] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0068.305] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.305] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0068.305] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0068.305] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.305] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0068.305] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IconImages.jpg") returned -1
	[0068.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImages.jpg") returned -1
	[0068.305] lstrcmpiA (lpString1="", lpString2="IconImages.jpg") returned -1
	[0068.305] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*") returned="*.*"
	[0068.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\"
	[0068.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned=""
	[0068.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt"
	[0068.305] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt")) returned 0xffffffff
	[0068.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.307] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0068.307] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0068.308] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0068.308] CloseHandle (hObject=0x98) returned 1
	[0068.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg"
	[0068.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.zip") returned 0
	[0068.308] lstrlenA (lpString="*.zip") returned 5
	[0068.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.rar") returned 0
	[0068.308] lstrlenA (lpString="*.rar") returned 5
	[0068.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.7z") returned 0
	[0068.308] lstrlenA (lpString="*.7z") returned 4
	[0068.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.tar") returned 0
	[0068.308] lstrlenA (lpString="*.tar") returned 5
	[0068.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.gzip") returned 0
	[0068.308] lstrlenA (lpString="*.gzip") returned 6
	[0068.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.jpg") returned 1
	[0068.308] lstrlenA (lpString="*.jpg") returned 5
	[0068.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg"
	[0068.308] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg"
	[0068.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg."
	[0068.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.Boom"
	[0068.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.309] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f3
	[0068.309] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea)) returned 1
	[0068.309] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.309] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x10d0, lpOverlapped=0x0) returned 1
	[0068.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg"
	[0068.373] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.373] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x10d0, lpOverlapped=0x0) returned 1
	[0068.373] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.373] CloseHandle (hObject=0x98) returned 1
	[0068.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.boom")) returned 1
	[0068.374] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0068.374] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0068.374] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IconImagesMask.bmp") returned -1
	[0068.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImagesMask.bmp") returned -1
	[0068.374] lstrcmpiA (lpString1="", lpString2="IconImagesMask.bmp") returned -1
	[0068.374] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg"
	[0068.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\"
	[0068.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned=""
	[0068.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt"
	[0068.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt")) returned 0x20
	[0068.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp"
	[0068.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.zip") returned 0
	[0068.374] lstrlenA (lpString="*.zip") returned 5
	[0068.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.rar") returned 0
	[0068.374] lstrlenA (lpString="*.rar") returned 5
	[0068.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.7z") returned 0
	[0068.374] lstrlenA (lpString="*.7z") returned 4
	[0068.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.tar") returned 0
	[0068.374] lstrlenA (lpString="*.tar") returned 5
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.gzip") returned 0
	[0068.375] lstrlenA (lpString="*.gzip") returned 6
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpg") returned 0
	[0068.375] lstrlenA (lpString="*.jpg") returned 5
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpeg") returned 0
	[0068.375] lstrlenA (lpString="*.jpeg") returned 6
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.psd") returned 0
	[0068.375] lstrlenA (lpString="*.psd") returned 5
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.cdr") returned 0
	[0068.375] lstrlenA (lpString="*.cdr") returned 5
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.dwg") returned 0
	[0068.375] lstrlenA (lpString="*.dwg") returned 5
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.max") returned 0
	[0068.375] lstrlenA (lpString="*.max") returned 5
	[0068.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.bmp") returned 1
	[0068.375] lstrlenA (lpString="*.bmp") returned 5
	[0068.375] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp"
	[0068.375] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp"
	[0068.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp."
	[0068.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.Boom"
	[0068.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0068.375] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa38
	[0068.375] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbcdf0400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x53907610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbcdf0400, dwHighDateTime=0x1c747ea)) returned 1
	[0068.376] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.376] ReadFile (in: hFile=0x98, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xa15, lpOverlapped=0x0) returned 1
	[0068.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="IconImagesMask.bmp"
	[0068.377] SetFilePointer (in: hFile=0x98, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.377] WriteFile (in: hFile=0x98, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xa15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xa15, lpOverlapped=0x0) returned 1
	[0068.377] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.377] CloseHandle (hObject=0x98) returned 1
	[0068.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.boom")) returned 1
	[0068.378] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0068.378] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0068.378] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0068.378] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0068.378] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0068.378] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0068.378] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0068.378] lstrcmpA (lpString1=".", lpString2="ToolIcons") returned -1
	[0068.378] lstrcmpA (lpString1="..", lpString2="ToolIcons") returned -1
	[0068.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*"
	[0068.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolIcons" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons"
	[0068.378] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned 59
	[0068.378] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0068.480] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0068.480] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.482] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0068.482] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0068.482] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.482] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ALERT.ICO") returned 1
	[0068.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ALERT.ICO") returned 1
	[0068.482] lstrcmpiA (lpString1="", lpString2="ALERT.ICO") returned -1
	[0068.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*") returned="*.*"
	[0068.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0xffffffff
	[0068.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0068.483] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0068.483] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0068.484] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0068.484] CloseHandle (hObject=0x90) returned 1
	[0068.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ALERT.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO"
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.zip") returned 0
	[0068.484] lstrlenA (lpString="*.zip") returned 5
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.rar") returned 0
	[0068.484] lstrlenA (lpString="*.rar") returned 5
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.7z") returned 0
	[0068.484] lstrlenA (lpString="*.7z") returned 4
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.tar") returned 0
	[0068.484] lstrlenA (lpString="*.tar") returned 5
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gzip") returned 0
	[0068.484] lstrlenA (lpString="*.gzip") returned 6
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpg") returned 0
	[0068.484] lstrlenA (lpString="*.jpg") returned 5
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpeg") returned 0
	[0068.484] lstrlenA (lpString="*.jpeg") returned 6
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.psd") returned 0
	[0068.484] lstrlenA (lpString="*.psd") returned 5
	[0068.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.cdr") returned 0
	[0068.484] lstrlenA (lpString="*.cdr") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dwg") returned 0
	[0068.485] lstrlenA (lpString="*.dwg") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.max") returned 0
	[0068.485] lstrlenA (lpString="*.max") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.bmp") returned 0
	[0068.485] lstrlenA (lpString="*.bmp") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gif") returned 0
	[0068.485] lstrlenA (lpString="*.gif") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.png") returned 0
	[0068.485] lstrlenA (lpString="*.png") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.doc") returned 0
	[0068.485] lstrlenA (lpString="*.doc") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.docx") returned 0
	[0068.485] lstrlenA (lpString="*.docx") returned 6
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xls") returned 0
	[0068.485] lstrlenA (lpString="*.xls") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xlsx") returned 0
	[0068.485] lstrlenA (lpString="*.xlsx") returned 6
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ppt") returned 0
	[0068.485] lstrlenA (lpString="*.ppt") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pptx") returned 0
	[0068.485] lstrlenA (lpString="*.pptx") returned 6
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.txt") returned 0
	[0068.485] lstrlenA (lpString="*.txt") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pdf") returned 0
	[0068.485] lstrlenA (lpString="*.pdf") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.djvu") returned 0
	[0068.485] lstrlenA (lpString="*.djvu") returned 6
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.htm") returned 0
	[0068.485] lstrlenA (lpString="*.htm") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.html") returned 0
	[0068.485] lstrlenA (lpString="*.html") returned 6
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mdb") returned 0
	[0068.485] lstrlenA (lpString="*.mdb") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.cer") returned 0
	[0068.485] lstrlenA (lpString="*.cer") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.p12") returned 0
	[0068.485] lstrlenA (lpString="*.p12") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pfx") returned 0
	[0068.485] lstrlenA (lpString="*.pfx") returned 5
	[0068.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.kwm") returned 0
	[0068.486] lstrlenA (lpString="*.kwm") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pwm") returned 0
	[0068.486] lstrlenA (lpString="*.pwm") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.1cd") returned 0
	[0068.486] lstrlenA (lpString="*.1cd") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.md") returned 0
	[0068.486] lstrlenA (lpString="*.md") returned 4
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mdf") returned 0
	[0068.486] lstrlenA (lpString="*.mdf") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dbf") returned 0
	[0068.486] lstrlenA (lpString="*.dbf") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.odt") returned 0
	[0068.486] lstrlenA (lpString="*.odt") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.vob") returned 0
	[0068.486] lstrlenA (lpString="*.vob") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ifo") returned 0
	[0068.486] lstrlenA (lpString="*.ifo") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.lnk") returned 0
	[0068.486] lstrlenA (lpString="*.lnk") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.torrent") returned 0
	[0068.486] lstrlenA (lpString="*.torrent") returned 9
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mov") returned 0
	[0068.486] lstrlenA (lpString="*.mov") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.m2v") returned 0
	[0068.486] lstrlenA (lpString="*.m2v") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.3gp") returned 0
	[0068.486] lstrlenA (lpString="*.3gp") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mpeg") returned 0
	[0068.486] lstrlenA (lpString="*.mpeg") returned 6
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mpg") returned 0
	[0068.486] lstrlenA (lpString="*.mpg") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.flv") returned 0
	[0068.486] lstrlenA (lpString="*.flv") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.avi") returned 0
	[0068.486] lstrlenA (lpString="*.avi") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp4") returned 0
	[0068.486] lstrlenA (lpString="*.mp4") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wmv") returned 0
	[0068.486] lstrlenA (lpString="*.wmv") returned 5
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.divx") returned 0
	[0068.486] lstrlenA (lpString="*.divx") returned 6
	[0068.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mkv") returned 0
	[0068.487] lstrlenA (lpString="*.mkv") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp3") returned 0
	[0068.487] lstrlenA (lpString="*.mp3") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wav") returned 0
	[0068.487] lstrlenA (lpString="*.wav") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.flac") returned 0
	[0068.487] lstrlenA (lpString="*.flac") returned 6
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ape") returned 0
	[0068.487] lstrlenA (lpString="*.ape") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wma") returned 0
	[0068.487] lstrlenA (lpString="*.wma") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ac3") returned 0
	[0068.487] lstrlenA (lpString="*.ac3") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.exe") returned 0
	[0068.487] lstrlenA (lpString="*.exe") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.apk") returned 0
	[0068.487] lstrlenA (lpString="*.apk") returned 5
	[0068.487] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.487] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.487] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHEVRON.ICO") returned 1
	[0068.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHEVRON.ICO") returned 1
	[0068.487] lstrcmpiA (lpString1="", lpString2="CHEVRON.ICO") returned -1
	[0068.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="ALERT.ICO"
	[0068.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="CHEVRON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO"
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.zip") returned 0
	[0068.487] lstrlenA (lpString="*.zip") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.rar") returned 0
	[0068.487] lstrlenA (lpString="*.rar") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.7z") returned 0
	[0068.487] lstrlenA (lpString="*.7z") returned 4
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.tar") returned 0
	[0068.487] lstrlenA (lpString="*.tar") returned 5
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gzip") returned 0
	[0068.487] lstrlenA (lpString="*.gzip") returned 6
	[0068.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpg") returned 0
	[0068.487] lstrlenA (lpString="*.jpg") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpeg") returned 0
	[0068.488] lstrlenA (lpString="*.jpeg") returned 6
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.psd") returned 0
	[0068.488] lstrlenA (lpString="*.psd") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.cdr") returned 0
	[0068.488] lstrlenA (lpString="*.cdr") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dwg") returned 0
	[0068.488] lstrlenA (lpString="*.dwg") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.max") returned 0
	[0068.488] lstrlenA (lpString="*.max") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.bmp") returned 0
	[0068.488] lstrlenA (lpString="*.bmp") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gif") returned 0
	[0068.488] lstrlenA (lpString="*.gif") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.png") returned 0
	[0068.488] lstrlenA (lpString="*.png") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.doc") returned 0
	[0068.488] lstrlenA (lpString="*.doc") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.docx") returned 0
	[0068.488] lstrlenA (lpString="*.docx") returned 6
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xls") returned 0
	[0068.488] lstrlenA (lpString="*.xls") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xlsx") returned 0
	[0068.488] lstrlenA (lpString="*.xlsx") returned 6
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ppt") returned 0
	[0068.488] lstrlenA (lpString="*.ppt") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pptx") returned 0
	[0068.488] lstrlenA (lpString="*.pptx") returned 6
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.txt") returned 0
	[0068.488] lstrlenA (lpString="*.txt") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pdf") returned 0
	[0068.488] lstrlenA (lpString="*.pdf") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.djvu") returned 0
	[0068.488] lstrlenA (lpString="*.djvu") returned 6
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.htm") returned 0
	[0068.488] lstrlenA (lpString="*.htm") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.html") returned 0
	[0068.488] lstrlenA (lpString="*.html") returned 6
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mdb") returned 0
	[0068.488] lstrlenA (lpString="*.mdb") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.cer") returned 0
	[0068.488] lstrlenA (lpString="*.cer") returned 5
	[0068.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.p12") returned 0
	[0068.488] lstrlenA (lpString="*.p12") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pfx") returned 0
	[0068.489] lstrlenA (lpString="*.pfx") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.kwm") returned 0
	[0068.489] lstrlenA (lpString="*.kwm") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pwm") returned 0
	[0068.489] lstrlenA (lpString="*.pwm") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.1cd") returned 0
	[0068.489] lstrlenA (lpString="*.1cd") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.md") returned 0
	[0068.489] lstrlenA (lpString="*.md") returned 4
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mdf") returned 0
	[0068.489] lstrlenA (lpString="*.mdf") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dbf") returned 0
	[0068.489] lstrlenA (lpString="*.dbf") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.odt") returned 0
	[0068.489] lstrlenA (lpString="*.odt") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.vob") returned 0
	[0068.489] lstrlenA (lpString="*.vob") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ifo") returned 0
	[0068.489] lstrlenA (lpString="*.ifo") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.lnk") returned 0
	[0068.489] lstrlenA (lpString="*.lnk") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.torrent") returned 0
	[0068.489] lstrlenA (lpString="*.torrent") returned 9
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mov") returned 0
	[0068.489] lstrlenA (lpString="*.mov") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.m2v") returned 0
	[0068.489] lstrlenA (lpString="*.m2v") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.3gp") returned 0
	[0068.489] lstrlenA (lpString="*.3gp") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mpeg") returned 0
	[0068.489] lstrlenA (lpString="*.mpeg") returned 6
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mpg") returned 0
	[0068.489] lstrlenA (lpString="*.mpg") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.flv") returned 0
	[0068.489] lstrlenA (lpString="*.flv") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.avi") returned 0
	[0068.489] lstrlenA (lpString="*.avi") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mp4") returned 0
	[0068.489] lstrlenA (lpString="*.mp4") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wmv") returned 0
	[0068.489] lstrlenA (lpString="*.wmv") returned 5
	[0068.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.divx") returned 0
	[0068.489] lstrlenA (lpString="*.divx") returned 6
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mkv") returned 0
	[0068.490] lstrlenA (lpString="*.mkv") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mp3") returned 0
	[0068.490] lstrlenA (lpString="*.mp3") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wav") returned 0
	[0068.490] lstrlenA (lpString="*.wav") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.flac") returned 0
	[0068.490] lstrlenA (lpString="*.flac") returned 6
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ape") returned 0
	[0068.490] lstrlenA (lpString="*.ape") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wma") returned 0
	[0068.490] lstrlenA (lpString="*.wma") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ac3") returned 0
	[0068.490] lstrlenA (lpString="*.ac3") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.exe") returned 0
	[0068.490] lstrlenA (lpString="*.exe") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.apk") returned 0
	[0068.490] lstrlenA (lpString="*.apk") returned 5
	[0068.490] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.490] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.490] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COMPUTER.ICO") returned 1
	[0068.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPUTER.ICO") returned 1
	[0068.490] lstrcmpiA (lpString1="", lpString2="COMPUTER.ICO") returned -1
	[0068.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="CHEVRON.ICO"
	[0068.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.490] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.490] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="COMPUTER.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO"
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.zip") returned 0
	[0068.490] lstrlenA (lpString="*.zip") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.rar") returned 0
	[0068.490] lstrlenA (lpString="*.rar") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.7z") returned 0
	[0068.490] lstrlenA (lpString="*.7z") returned 4
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.tar") returned 0
	[0068.490] lstrlenA (lpString="*.tar") returned 5
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.gzip") returned 0
	[0068.490] lstrlenA (lpString="*.gzip") returned 6
	[0068.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.jpg") returned 0
	[0068.490] lstrlenA (lpString="*.jpg") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.jpeg") returned 0
	[0068.491] lstrlenA (lpString="*.jpeg") returned 6
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.psd") returned 0
	[0068.491] lstrlenA (lpString="*.psd") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.cdr") returned 0
	[0068.491] lstrlenA (lpString="*.cdr") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.dwg") returned 0
	[0068.491] lstrlenA (lpString="*.dwg") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.max") returned 0
	[0068.491] lstrlenA (lpString="*.max") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.bmp") returned 0
	[0068.491] lstrlenA (lpString="*.bmp") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.gif") returned 0
	[0068.491] lstrlenA (lpString="*.gif") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.png") returned 0
	[0068.491] lstrlenA (lpString="*.png") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.doc") returned 0
	[0068.491] lstrlenA (lpString="*.doc") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.docx") returned 0
	[0068.491] lstrlenA (lpString="*.docx") returned 6
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.xls") returned 0
	[0068.491] lstrlenA (lpString="*.xls") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.xlsx") returned 0
	[0068.491] lstrlenA (lpString="*.xlsx") returned 6
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ppt") returned 0
	[0068.491] lstrlenA (lpString="*.ppt") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pptx") returned 0
	[0068.491] lstrlenA (lpString="*.pptx") returned 6
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.txt") returned 0
	[0068.491] lstrlenA (lpString="*.txt") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pdf") returned 0
	[0068.491] lstrlenA (lpString="*.pdf") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.djvu") returned 0
	[0068.491] lstrlenA (lpString="*.djvu") returned 6
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.htm") returned 0
	[0068.491] lstrlenA (lpString="*.htm") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.html") returned 0
	[0068.491] lstrlenA (lpString="*.html") returned 6
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mdb") returned 0
	[0068.491] lstrlenA (lpString="*.mdb") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.cer") returned 0
	[0068.491] lstrlenA (lpString="*.cer") returned 5
	[0068.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.p12") returned 0
	[0068.491] lstrlenA (lpString="*.p12") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pfx") returned 0
	[0068.492] lstrlenA (lpString="*.pfx") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.kwm") returned 0
	[0068.492] lstrlenA (lpString="*.kwm") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pwm") returned 0
	[0068.492] lstrlenA (lpString="*.pwm") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.1cd") returned 0
	[0068.492] lstrlenA (lpString="*.1cd") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.md") returned 0
	[0068.492] lstrlenA (lpString="*.md") returned 4
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mdf") returned 0
	[0068.492] lstrlenA (lpString="*.mdf") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.dbf") returned 0
	[0068.492] lstrlenA (lpString="*.dbf") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.odt") returned 0
	[0068.492] lstrlenA (lpString="*.odt") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.vob") returned 0
	[0068.492] lstrlenA (lpString="*.vob") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ifo") returned 0
	[0068.492] lstrlenA (lpString="*.ifo") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.lnk") returned 0
	[0068.492] lstrlenA (lpString="*.lnk") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.torrent") returned 0
	[0068.492] lstrlenA (lpString="*.torrent") returned 9
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mov") returned 0
	[0068.492] lstrlenA (lpString="*.mov") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.m2v") returned 0
	[0068.492] lstrlenA (lpString="*.m2v") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.3gp") returned 0
	[0068.492] lstrlenA (lpString="*.3gp") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mpeg") returned 0
	[0068.492] lstrlenA (lpString="*.mpeg") returned 6
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mpg") returned 0
	[0068.492] lstrlenA (lpString="*.mpg") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.flv") returned 0
	[0068.492] lstrlenA (lpString="*.flv") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.avi") returned 0
	[0068.492] lstrlenA (lpString="*.avi") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mp4") returned 0
	[0068.492] lstrlenA (lpString="*.mp4") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wmv") returned 0
	[0068.492] lstrlenA (lpString="*.wmv") returned 5
	[0068.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.divx") returned 0
	[0068.492] lstrlenA (lpString="*.divx") returned 6
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mkv") returned 0
	[0068.493] lstrlenA (lpString="*.mkv") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mp3") returned 0
	[0068.493] lstrlenA (lpString="*.mp3") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wav") returned 0
	[0068.493] lstrlenA (lpString="*.wav") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.flac") returned 0
	[0068.493] lstrlenA (lpString="*.flac") returned 6
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ape") returned 0
	[0068.493] lstrlenA (lpString="*.ape") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wma") returned 0
	[0068.493] lstrlenA (lpString="*.wma") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ac3") returned 0
	[0068.493] lstrlenA (lpString="*.ac3") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.exe") returned 0
	[0068.493] lstrlenA (lpString="*.exe") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.apk") returned 0
	[0068.493] lstrlenA (lpString="*.apk") returned 5
	[0068.493] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.493] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.493] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ContactSelector.ico") returned 1
	[0068.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContactSelector.ico") returned 1
	[0068.493] lstrcmpiA (lpString1="", lpString2="ContactSelector.ico") returned -1
	[0068.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="COMPUTER.ICO"
	[0068.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.493] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ContactSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico"
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.zip") returned 0
	[0068.493] lstrlenA (lpString="*.zip") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.rar") returned 0
	[0068.493] lstrlenA (lpString="*.rar") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.7z") returned 0
	[0068.493] lstrlenA (lpString="*.7z") returned 4
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.tar") returned 0
	[0068.493] lstrlenA (lpString="*.tar") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.gzip") returned 0
	[0068.493] lstrlenA (lpString="*.gzip") returned 6
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.jpg") returned 0
	[0068.493] lstrlenA (lpString="*.jpg") returned 5
	[0068.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.jpeg") returned 0
	[0068.494] lstrlenA (lpString="*.jpeg") returned 6
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.psd") returned 0
	[0068.494] lstrlenA (lpString="*.psd") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.cdr") returned 0
	[0068.494] lstrlenA (lpString="*.cdr") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.dwg") returned 0
	[0068.494] lstrlenA (lpString="*.dwg") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.max") returned 0
	[0068.494] lstrlenA (lpString="*.max") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.bmp") returned 0
	[0068.494] lstrlenA (lpString="*.bmp") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.gif") returned 0
	[0068.494] lstrlenA (lpString="*.gif") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.png") returned 0
	[0068.494] lstrlenA (lpString="*.png") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.doc") returned 0
	[0068.494] lstrlenA (lpString="*.doc") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.docx") returned 0
	[0068.494] lstrlenA (lpString="*.docx") returned 6
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.xls") returned 0
	[0068.494] lstrlenA (lpString="*.xls") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.xlsx") returned 0
	[0068.494] lstrlenA (lpString="*.xlsx") returned 6
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ppt") returned 0
	[0068.494] lstrlenA (lpString="*.ppt") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pptx") returned 0
	[0068.494] lstrlenA (lpString="*.pptx") returned 6
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.txt") returned 0
	[0068.494] lstrlenA (lpString="*.txt") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pdf") returned 0
	[0068.494] lstrlenA (lpString="*.pdf") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.djvu") returned 0
	[0068.494] lstrlenA (lpString="*.djvu") returned 6
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.htm") returned 0
	[0068.494] lstrlenA (lpString="*.htm") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.html") returned 0
	[0068.494] lstrlenA (lpString="*.html") returned 6
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mdb") returned 0
	[0068.494] lstrlenA (lpString="*.mdb") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.cer") returned 0
	[0068.494] lstrlenA (lpString="*.cer") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.p12") returned 0
	[0068.494] lstrlenA (lpString="*.p12") returned 5
	[0068.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pfx") returned 0
	[0068.495] lstrlenA (lpString="*.pfx") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.kwm") returned 0
	[0068.495] lstrlenA (lpString="*.kwm") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pwm") returned 0
	[0068.495] lstrlenA (lpString="*.pwm") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.1cd") returned 0
	[0068.495] lstrlenA (lpString="*.1cd") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.md") returned 0
	[0068.495] lstrlenA (lpString="*.md") returned 4
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mdf") returned 0
	[0068.495] lstrlenA (lpString="*.mdf") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.dbf") returned 0
	[0068.495] lstrlenA (lpString="*.dbf") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.odt") returned 0
	[0068.495] lstrlenA (lpString="*.odt") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.vob") returned 0
	[0068.495] lstrlenA (lpString="*.vob") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ifo") returned 0
	[0068.495] lstrlenA (lpString="*.ifo") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.lnk") returned 0
	[0068.495] lstrlenA (lpString="*.lnk") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.torrent") returned 0
	[0068.495] lstrlenA (lpString="*.torrent") returned 9
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mov") returned 0
	[0068.495] lstrlenA (lpString="*.mov") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.m2v") returned 0
	[0068.495] lstrlenA (lpString="*.m2v") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.3gp") returned 0
	[0068.495] lstrlenA (lpString="*.3gp") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mpeg") returned 0
	[0068.495] lstrlenA (lpString="*.mpeg") returned 6
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mpg") returned 0
	[0068.495] lstrlenA (lpString="*.mpg") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.flv") returned 0
	[0068.495] lstrlenA (lpString="*.flv") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.avi") returned 0
	[0068.495] lstrlenA (lpString="*.avi") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mp4") returned 0
	[0068.495] lstrlenA (lpString="*.mp4") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wmv") returned 0
	[0068.495] lstrlenA (lpString="*.wmv") returned 5
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.divx") returned 0
	[0068.495] lstrlenA (lpString="*.divx") returned 6
	[0068.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mkv") returned 0
	[0068.496] lstrlenA (lpString="*.mkv") returned 5
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mp3") returned 0
	[0068.496] lstrlenA (lpString="*.mp3") returned 5
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wav") returned 0
	[0068.496] lstrlenA (lpString="*.wav") returned 5
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.flac") returned 0
	[0068.496] lstrlenA (lpString="*.flac") returned 6
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ape") returned 0
	[0068.496] lstrlenA (lpString="*.ape") returned 5
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wma") returned 0
	[0068.496] lstrlenA (lpString="*.wma") returned 5
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ac3") returned 0
	[0068.496] lstrlenA (lpString="*.ac3") returned 5
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.exe") returned 0
	[0068.496] lstrlenA (lpString="*.exe") returned 5
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.apk") returned 0
	[0068.496] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.496] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="gfserrorfromgroove.ico") returned -1
	[0068.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrorfromgroove.ico") returned 1
	[0068.496] lstrcmpiA (lpString1="", lpString2="gfserrorfromgroove.ico") returned -1
	[0068.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="ContactSelector.ico"
	[0068.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.496] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.496] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrorfromgroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico"
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.zip") returned 0
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.rar") returned 0
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.7z") returned 0
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.tar") returned 0
	[0068.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.gzip") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.jpg") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.jpeg") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.psd") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.cdr") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.dwg") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.max") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.bmp") returned 0
	[0068.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.gif") returned 0
	[0068.497] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.497] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="gfserrortogroove.ico") returned -1
	[0068.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrortogroove.ico") returned 1
	[0068.497] lstrcmpiA (lpString1="", lpString2="gfserrortogroove.ico") returned -1
	[0068.497] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="gfserrorfromgroove.ico"
	[0068.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.497] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.497] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrortogroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico"
	[0068.497] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.497] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GWE.ICO") returned -1
	[0068.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GWE.ICO") returned 1
	[0068.497] lstrcmpiA (lpString1="", lpString2="GWE.ICO") returned -1
	[0068.497] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="gfserrortogroove.ico"
	[0068.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.497] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="GWE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO"
	[0068.498] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.498] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INCOMING.ICO") returned -1
	[0068.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INCOMING.ICO") returned -1
	[0068.498] lstrcmpiA (lpString1="", lpString2="INCOMING.ICO") returned -1
	[0068.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="GWE.ICO"
	[0068.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INCOMING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO"
	[0068.498] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.498] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INDOMAIN.ICO") returned -1
	[0068.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDOMAIN.ICO") returned -1
	[0068.498] lstrcmpiA (lpString1="", lpString2="INDOMAIN.ICO") returned -1
	[0068.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="INCOMING.ICO"
	[0068.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INDOMAIN.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO"
	[0068.498] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.498] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MAIL.ICO") returned -1
	[0068.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAIL.ICO") returned -1
	[0068.498] lstrcmpiA (lpString1="", lpString2="MAIL.ICO") returned -1
	[0068.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="INDOMAIN.ICO"
	[0068.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.499] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MAIL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO"
	[0068.499] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.499] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.499] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MANUAL.ICO") returned -1
	[0068.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MANUAL.ICO") returned -1
	[0068.499] lstrcmpiA (lpString1="", lpString2="MANUAL.ICO") returned -1
	[0068.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="MAIL.ICO"
	[0068.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.499] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.499] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MANUAL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO"
	[0068.499] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.499] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.499] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="messageboxalert.ico") returned -1
	[0068.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxalert.ico") returned -1
	[0068.499] lstrcmpiA (lpString1="", lpString2="messageboxalert.ico") returned -1
	[0068.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="MANUAL.ICO"
	[0068.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.499] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.499] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxalert.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico"
	[0068.499] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.499] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.499] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="messageboxerror.ico") returned -1
	[0068.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxerror.ico") returned -1
	[0068.499] lstrcmpiA (lpString1="", lpString2="messageboxerror.ico") returned -1
	[0068.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="messageboxalert.ico"
	[0068.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.499] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxerror.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico"
	[0068.500] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.500] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.500] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="messageboxinfo.ico") returned -1
	[0068.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxinfo.ico") returned -1
	[0068.500] lstrcmpiA (lpString1="", lpString2="messageboxinfo.ico") returned -1
	[0068.500] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="messageboxerror.ico"
	[0068.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxinfo.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico"
	[0068.500] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.500] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.500] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ModifiedTelespace.ico") returned -1
	[0068.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ModifiedTelespace.ico") returned -1
	[0068.500] lstrcmpiA (lpString1="", lpString2="ModifiedTelespace.ico") returned -1
	[0068.500] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="messageboxinfo.ico"
	[0068.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ModifiedTelespace.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico"
	[0068.500] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.500] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.500] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OFFLINE.ICO") returned -1
	[0068.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFLINE.ICO") returned -1
	[0068.500] lstrcmpiA (lpString1="", lpString2="OFFLINE.ICO") returned -1
	[0068.500] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="ModifiedTelespace.ico"
	[0068.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OFFLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO"
	[0068.501] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.501] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.501] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONLINE.ICO") returned -1
	[0068.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONLINE.ICO") returned -1
	[0068.501] lstrcmpiA (lpString1="", lpString2="ONLINE.ICO") returned -1
	[0068.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="OFFLINE.ICO"
	[0068.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ONLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO"
	[0068.501] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.501] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.501] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OnLineBusy.ico") returned -1
	[0068.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineBusy.ico") returned -1
	[0068.501] lstrcmpiA (lpString1="", lpString2="OnLineBusy.ico") returned -1
	[0068.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="ONLINE.ICO"
	[0068.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineBusy.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico"
	[0068.501] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.501] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.501] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OnLineIdle.ico") returned -1
	[0068.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineIdle.ico") returned -1
	[0068.502] lstrcmpiA (lpString1="", lpString2="OnLineIdle.ico") returned -1
	[0068.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="OnLineBusy.ico"
	[0068.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.502] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.502] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineIdle.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico"
	[0068.502] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.502] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.502] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutDomain.ico") returned -1
	[0068.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutDomain.ico") returned -1
	[0068.502] lstrcmpiA (lpString1="", lpString2="OutDomain.ico") returned -1
	[0068.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="OnLineIdle.ico"
	[0068.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.502] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.502] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutDomain.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico"
	[0068.502] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.502] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.502] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTGOING.ICO") returned -1
	[0068.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTGOING.ICO") returned -1
	[0068.502] lstrcmpiA (lpString1="", lpString2="OUTGOING.ICO") returned -1
	[0068.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="OutDomain.ico"
	[0068.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.502] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.502] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OUTGOING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO"
	[0068.502] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.502] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.503] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutSyncPC.ico") returned -1
	[0068.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutSyncPC.ico") returned -1
	[0068.503] lstrcmpiA (lpString1="", lpString2="OutSyncPC.ico") returned -1
	[0068.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="OUTGOING.ICO"
	[0068.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.503] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.503] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutSyncPC.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico"
	[0068.503] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.503] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.503] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PersonalContact.ico") returned -1
	[0068.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PersonalContact.ico") returned -1
	[0068.503] lstrcmpiA (lpString1="", lpString2="PersonalContact.ico") returned -1
	[0068.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="OutSyncPC.ico"
	[0068.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.503] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.503] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="PersonalContact.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico"
	[0068.503] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.503] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.503] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SessionMember.ico") returned -1
	[0068.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionMember.ico") returned -1
	[0068.503] lstrcmpiA (lpString1="", lpString2="SessionMember.ico") returned -1
	[0068.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="PersonalContact.ico"
	[0068.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.503] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.503] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionMember.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico"
	[0068.503] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.504] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.504] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SessionOwner.ico") returned -1
	[0068.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionOwner.ico") returned -1
	[0068.504] lstrcmpiA (lpString1="", lpString2="SessionOwner.ico") returned -1
	[0068.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="SessionMember.ico"
	[0068.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.504] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionOwner.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico"
	[0068.504] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.504] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.504] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SpaceSelector.ico") returned -1
	[0068.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpaceSelector.ico") returned -1
	[0068.504] lstrcmpiA (lpString1="", lpString2="SpaceSelector.ico") returned -1
	[0068.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="SessionOwner.ico"
	[0068.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.504] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SpaceSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico"
	[0068.504] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.504] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.504] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StatusAway.ico") returned -1
	[0068.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusAway.ico") returned -1
	[0068.504] lstrcmpiA (lpString1="", lpString2="StatusAway.ico") returned -1
	[0068.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="SpaceSelector.ico"
	[0068.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.504] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusAway.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico"
	[0068.504] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.505] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StatusDoNotDisturb.ico") returned -1
	[0068.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusDoNotDisturb.ico") returned -1
	[0068.505] lstrcmpiA (lpString1="", lpString2="StatusDoNotDisturb.ico") returned -1
	[0068.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="StatusAway.ico"
	[0068.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.505] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.505] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusDoNotDisturb.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico"
	[0068.505] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.505] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StatusOnline.ico") returned -1
	[0068.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusOnline.ico") returned -1
	[0068.505] lstrcmpiA (lpString1="", lpString2="StatusOnline.ico") returned -1
	[0068.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="StatusDoNotDisturb.ico"
	[0068.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.505] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.505] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusOnline.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico"
	[0068.505] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.505] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TOOLICON.ICO") returned -1
	[0068.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TOOLICON.ICO") returned -1
	[0068.505] lstrcmpiA (lpString1="", lpString2="TOOLICON.ICO") returned -1
	[0068.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="StatusOnline.ico"
	[0068.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.505] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.505] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="TOOLICON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO"
	[0068.505] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.506] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSS.ICO") returned -1
	[0068.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS.ICO") returned -1
	[0068.506] lstrcmpiA (lpString1="", lpString2="WSS.ICO") returned -1
	[0068.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="TOOLICON.ICO"
	[0068.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.506] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO"
	[0068.506] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.506] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.506] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSS_DocLib.ico") returned -1
	[0068.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS_DocLib.ico") returned -1
	[0068.506] lstrcmpiA (lpString1="", lpString2="WSS_DocLib.ico") returned -1
	[0068.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="WSS.ICO"
	[0068.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\"
	[0068.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned=""
	[0068.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt"
	[0068.506] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20
	[0068.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS_DocLib.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico"
	[0068.506] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0068.506] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0068.506] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0068.506] lstrcmpA (lpString1=".", lpString2="XML Files") returned -1
	[0068.506] lstrcmpA (lpString1="..", lpString2="XML Files") returned -1
	[0068.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*"
	[0068.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="XML Files" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files"
	[0068.506] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0068.508] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0068.508] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.508] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0068.508] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0068.508] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.508] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.508] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="builtincontrolsschema.xsd") returned 1
	[0068.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="builtincontrolsschema.xsd") returned 1
	[0068.508] lstrcmpiA (lpString1="", lpString2="builtincontrolsschema.xsd") returned -1
	[0068.508] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*"
	[0068.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\"
	[0068.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned=""
	[0068.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt"
	[0068.508] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0xffffffff
	[0068.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0068.510] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0068.511] CloseHandle (hObject=0x90) returned 1
	[0068.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="builtincontrolsschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd"
	[0068.511] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.511] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.511] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="grvschema.xsd") returned -1
	[0068.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grvschema.xsd") returned 1
	[0068.511] lstrcmpiA (lpString1="", lpString2="grvschema.xsd") returned -1
	[0068.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="builtincontrolsschema.xsd"
	[0068.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\"
	[0068.511] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned=""
	[0068.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt"
	[0068.511] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20
	[0068.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="grvschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd"
	[0068.511] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.511] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.511] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Messenger.xml") returned -1
	[0068.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Messenger.xml") returned -1
	[0068.511] lstrcmpiA (lpString1="", lpString2="Messenger.xml") returned -1
	[0068.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="grvschema.xsd"
	[0068.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\"
	[0068.511] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned=""
	[0068.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt"
	[0068.511] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20
	[0068.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Messenger.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml"
	[0068.512] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.512] lstrcmpA (lpString1=".", lpString2="Space Templates") returned -1
	[0068.512] lstrcmpA (lpString1="..", lpString2="Space Templates") returned -1
	[0068.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="Messenger.xml"
	[0068.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Space Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates"
	[0068.512] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates") returned 75
	[0068.512] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0068.512] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0068.512] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0068.512] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0068.512] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0068.513] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0068.513] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0068.513] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.513] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.513] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StarterApplicationDescriptors.xml") returned -1
	[0068.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterApplicationDescriptors.xml") returned -1
	[0068.513] lstrcmpiA (lpString1="", lpString2="StarterApplicationDescriptors.xml") returned -1
	[0068.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*"
	[0068.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\"
	[0068.513] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned=""
	[0068.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt"
	[0068.513] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20
	[0068.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterApplicationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml"
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.zip") returned 0
	[0068.513] lstrlenA (lpString="*.zip") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.rar") returned 0
	[0068.513] lstrlenA (lpString="*.rar") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.7z") returned 0
	[0068.513] lstrlenA (lpString="*.7z") returned 4
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.tar") returned 0
	[0068.513] lstrlenA (lpString="*.tar") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.gzip") returned 0
	[0068.513] lstrlenA (lpString="*.gzip") returned 6
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.jpg") returned 0
	[0068.513] lstrlenA (lpString="*.jpg") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.jpeg") returned 0
	[0068.513] lstrlenA (lpString="*.jpeg") returned 6
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.psd") returned 0
	[0068.513] lstrlenA (lpString="*.psd") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.cdr") returned 0
	[0068.513] lstrlenA (lpString="*.cdr") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.dwg") returned 0
	[0068.513] lstrlenA (lpString="*.dwg") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.max") returned 0
	[0068.513] lstrlenA (lpString="*.max") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.bmp") returned 0
	[0068.513] lstrlenA (lpString="*.bmp") returned 5
	[0068.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.gif") returned 0
	[0068.514] lstrlenA (lpString="*.gif") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.png") returned 0
	[0068.514] lstrlenA (lpString="*.png") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.doc") returned 0
	[0068.514] lstrlenA (lpString="*.doc") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.docx") returned 0
	[0068.514] lstrlenA (lpString="*.docx") returned 6
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.xls") returned 0
	[0068.514] lstrlenA (lpString="*.xls") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.xlsx") returned 0
	[0068.514] lstrlenA (lpString="*.xlsx") returned 6
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.ppt") returned 0
	[0068.514] lstrlenA (lpString="*.ppt") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.pptx") returned 0
	[0068.514] lstrlenA (lpString="*.pptx") returned 6
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.txt") returned 0
	[0068.514] lstrlenA (lpString="*.txt") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.pdf") returned 0
	[0068.514] lstrlenA (lpString="*.pdf") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.djvu") returned 0
	[0068.514] lstrlenA (lpString="*.djvu") returned 6
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.htm") returned 0
	[0068.514] lstrlenA (lpString="*.htm") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.html") returned 0
	[0068.514] lstrlenA (lpString="*.html") returned 6
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mdb") returned 0
	[0068.514] lstrlenA (lpString="*.mdb") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.cer") returned 0
	[0068.514] lstrlenA (lpString="*.cer") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.p12") returned 0
	[0068.514] lstrlenA (lpString="*.p12") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.pfx") returned 0
	[0068.514] lstrlenA (lpString="*.pfx") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.kwm") returned 0
	[0068.514] lstrlenA (lpString="*.kwm") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.pwm") returned 0
	[0068.514] lstrlenA (lpString="*.pwm") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.1cd") returned 0
	[0068.514] lstrlenA (lpString="*.1cd") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.md") returned 0
	[0068.514] lstrlenA (lpString="*.md") returned 4
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mdf") returned 0
	[0068.514] lstrlenA (lpString="*.mdf") returned 5
	[0068.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.dbf") returned 0
	[0068.515] lstrlenA (lpString="*.dbf") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.odt") returned 0
	[0068.515] lstrlenA (lpString="*.odt") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.vob") returned 0
	[0068.515] lstrlenA (lpString="*.vob") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.ifo") returned 0
	[0068.515] lstrlenA (lpString="*.ifo") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.lnk") returned 0
	[0068.515] lstrlenA (lpString="*.lnk") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.torrent") returned 0
	[0068.515] lstrlenA (lpString="*.torrent") returned 9
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mov") returned 0
	[0068.515] lstrlenA (lpString="*.mov") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.m2v") returned 0
	[0068.515] lstrlenA (lpString="*.m2v") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.3gp") returned 0
	[0068.515] lstrlenA (lpString="*.3gp") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mpeg") returned 0
	[0068.515] lstrlenA (lpString="*.mpeg") returned 6
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mpg") returned 0
	[0068.515] lstrlenA (lpString="*.mpg") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.flv") returned 0
	[0068.515] lstrlenA (lpString="*.flv") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.avi") returned 0
	[0068.515] lstrlenA (lpString="*.avi") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mp4") returned 0
	[0068.515] lstrlenA (lpString="*.mp4") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.wmv") returned 0
	[0068.515] lstrlenA (lpString="*.wmv") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.divx") returned 0
	[0068.515] lstrlenA (lpString="*.divx") returned 6
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mkv") returned 0
	[0068.515] lstrlenA (lpString="*.mkv") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.mp3") returned 0
	[0068.515] lstrlenA (lpString="*.mp3") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.wav") returned 0
	[0068.515] lstrlenA (lpString="*.wav") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.flac") returned 0
	[0068.515] lstrlenA (lpString="*.flac") returned 6
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.ape") returned 0
	[0068.515] lstrlenA (lpString="*.ape") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.wma") returned 0
	[0068.515] lstrlenA (lpString="*.wma") returned 5
	[0068.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.ac3") returned 0
	[0068.516] lstrlenA (lpString="*.ac3") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.exe") returned 0
	[0068.516] lstrlenA (lpString="*.exe") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.apk") returned 0
	[0068.516] lstrlenA (lpString="*.apk") returned 5
	[0068.516] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.516] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.516] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StarterNotificationDescriptors.xml") returned -1
	[0068.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterNotificationDescriptors.xml") returned -1
	[0068.516] lstrcmpiA (lpString1="", lpString2="StarterNotificationDescriptors.xml") returned -1
	[0068.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="StarterApplicationDescriptors.xml"
	[0068.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\"
	[0068.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned=""
	[0068.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt"
	[0068.516] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20
	[0068.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterNotificationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml"
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.zip") returned 0
	[0068.516] lstrlenA (lpString="*.zip") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.rar") returned 0
	[0068.516] lstrlenA (lpString="*.rar") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.7z") returned 0
	[0068.516] lstrlenA (lpString="*.7z") returned 4
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.tar") returned 0
	[0068.516] lstrlenA (lpString="*.tar") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.gzip") returned 0
	[0068.516] lstrlenA (lpString="*.gzip") returned 6
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.jpg") returned 0
	[0068.516] lstrlenA (lpString="*.jpg") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.jpeg") returned 0
	[0068.516] lstrlenA (lpString="*.jpeg") returned 6
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.psd") returned 0
	[0068.516] lstrlenA (lpString="*.psd") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.cdr") returned 0
	[0068.516] lstrlenA (lpString="*.cdr") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.dwg") returned 0
	[0068.516] lstrlenA (lpString="*.dwg") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.max") returned 0
	[0068.516] lstrlenA (lpString="*.max") returned 5
	[0068.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.bmp") returned 0
	[0068.516] lstrlenA (lpString="*.bmp") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.gif") returned 0
	[0068.517] lstrlenA (lpString="*.gif") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.png") returned 0
	[0068.517] lstrlenA (lpString="*.png") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.doc") returned 0
	[0068.517] lstrlenA (lpString="*.doc") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.docx") returned 0
	[0068.517] lstrlenA (lpString="*.docx") returned 6
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.xls") returned 0
	[0068.517] lstrlenA (lpString="*.xls") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.xlsx") returned 0
	[0068.517] lstrlenA (lpString="*.xlsx") returned 6
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.ppt") returned 0
	[0068.517] lstrlenA (lpString="*.ppt") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.pptx") returned 0
	[0068.517] lstrlenA (lpString="*.pptx") returned 6
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.txt") returned 0
	[0068.517] lstrlenA (lpString="*.txt") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.pdf") returned 0
	[0068.517] lstrlenA (lpString="*.pdf") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.djvu") returned 0
	[0068.517] lstrlenA (lpString="*.djvu") returned 6
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.htm") returned 0
	[0068.517] lstrlenA (lpString="*.htm") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.html") returned 0
	[0068.517] lstrlenA (lpString="*.html") returned 6
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mdb") returned 0
	[0068.517] lstrlenA (lpString="*.mdb") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.cer") returned 0
	[0068.517] lstrlenA (lpString="*.cer") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.p12") returned 0
	[0068.517] lstrlenA (lpString="*.p12") returned 5
	[0068.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.pfx") returned 0
	[0068.518] lstrlenA (lpString="*.pfx") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.kwm") returned 0
	[0068.518] lstrlenA (lpString="*.kwm") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.pwm") returned 0
	[0068.518] lstrlenA (lpString="*.pwm") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.1cd") returned 0
	[0068.518] lstrlenA (lpString="*.1cd") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.md") returned 0
	[0068.518] lstrlenA (lpString="*.md") returned 4
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mdf") returned 0
	[0068.518] lstrlenA (lpString="*.mdf") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.dbf") returned 0
	[0068.518] lstrlenA (lpString="*.dbf") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.odt") returned 0
	[0068.518] lstrlenA (lpString="*.odt") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.vob") returned 0
	[0068.518] lstrlenA (lpString="*.vob") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.ifo") returned 0
	[0068.518] lstrlenA (lpString="*.ifo") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.lnk") returned 0
	[0068.518] lstrlenA (lpString="*.lnk") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.torrent") returned 0
	[0068.518] lstrlenA (lpString="*.torrent") returned 9
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mov") returned 0
	[0068.518] lstrlenA (lpString="*.mov") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.m2v") returned 0
	[0068.518] lstrlenA (lpString="*.m2v") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.3gp") returned 0
	[0068.518] lstrlenA (lpString="*.3gp") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mpeg") returned 0
	[0068.518] lstrlenA (lpString="*.mpeg") returned 6
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mpg") returned 0
	[0068.518] lstrlenA (lpString="*.mpg") returned 5
	[0068.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.flv") returned 0
	[0068.519] lstrlenA (lpString="*.flv") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.avi") returned 0
	[0068.519] lstrlenA (lpString="*.avi") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mp4") returned 0
	[0068.519] lstrlenA (lpString="*.mp4") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.wmv") returned 0
	[0068.519] lstrlenA (lpString="*.wmv") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.divx") returned 0
	[0068.519] lstrlenA (lpString="*.divx") returned 6
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mkv") returned 0
	[0068.519] lstrlenA (lpString="*.mkv") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.mp3") returned 0
	[0068.519] lstrlenA (lpString="*.mp3") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.wav") returned 0
	[0068.519] lstrlenA (lpString="*.wav") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.flac") returned 0
	[0068.519] lstrlenA (lpString="*.flac") returned 6
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.ape") returned 0
	[0068.519] lstrlenA (lpString="*.ape") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.wma") returned 0
	[0068.519] lstrlenA (lpString="*.wma") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.ac3") returned 0
	[0068.519] lstrlenA (lpString="*.ac3") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.exe") returned 0
	[0068.519] lstrlenA (lpString="*.exe") returned 5
	[0068.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.apk") returned 0
	[0068.519] lstrlenA (lpString="*.apk") returned 5
	[0068.519] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0068.519] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0068.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StarterToolTemplates.xml") returned -1
	[0068.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterToolTemplates.xml") returned -1
	[0068.519] lstrcmpiA (lpString1="", lpString2="StarterToolTemplates.xml") returned -1
	[0068.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="StarterNotificationDescriptors.xml"
	[0068.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\"
	[0068.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned=""
	[0068.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt"
	[0068.520] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20
	[0068.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterToolTemplates.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml"
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.zip") returned 0
	[0068.520] lstrlenA (lpString="*.zip") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.rar") returned 0
	[0068.520] lstrlenA (lpString="*.rar") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.7z") returned 0
	[0068.520] lstrlenA (lpString="*.7z") returned 4
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.tar") returned 0
	[0068.520] lstrlenA (lpString="*.tar") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.gzip") returned 0
	[0068.520] lstrlenA (lpString="*.gzip") returned 6
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.jpg") returned 0
	[0068.520] lstrlenA (lpString="*.jpg") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.jpeg") returned 0
	[0068.520] lstrlenA (lpString="*.jpeg") returned 6
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.psd") returned 0
	[0068.520] lstrlenA (lpString="*.psd") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.cdr") returned 0
	[0068.520] lstrlenA (lpString="*.cdr") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.dwg") returned 0
	[0068.520] lstrlenA (lpString="*.dwg") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.max") returned 0
	[0068.520] lstrlenA (lpString="*.max") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.bmp") returned 0
	[0068.520] lstrlenA (lpString="*.bmp") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.gif") returned 0
	[0068.520] lstrlenA (lpString="*.gif") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.png") returned 0
	[0068.520] lstrlenA (lpString="*.png") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.doc") returned 0
	[0068.520] lstrlenA (lpString="*.doc") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.docx") returned 0
	[0068.520] lstrlenA (lpString="*.docx") returned 6
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.xls") returned 0
	[0068.520] lstrlenA (lpString="*.xls") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.xlsx") returned 0
	[0068.520] lstrlenA (lpString="*.xlsx") returned 6
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.ppt") returned 0
	[0068.520] lstrlenA (lpString="*.ppt") returned 5
	[0068.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.pptx") returned 0
	[0068.520] lstrlenA (lpString="*.pptx") returned 6
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.txt") returned 0
	[0068.521] lstrlenA (lpString="*.txt") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.pdf") returned 0
	[0068.521] lstrlenA (lpString="*.pdf") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.djvu") returned 0
	[0068.521] lstrlenA (lpString="*.djvu") returned 6
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.htm") returned 0
	[0068.521] lstrlenA (lpString="*.htm") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.html") returned 0
	[0068.521] lstrlenA (lpString="*.html") returned 6
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mdb") returned 0
	[0068.521] lstrlenA (lpString="*.mdb") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.cer") returned 0
	[0068.521] lstrlenA (lpString="*.cer") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.p12") returned 0
	[0068.521] lstrlenA (lpString="*.p12") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.pfx") returned 0
	[0068.521] lstrlenA (lpString="*.pfx") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.kwm") returned 0
	[0068.521] lstrlenA (lpString="*.kwm") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.pwm") returned 0
	[0068.521] lstrlenA (lpString="*.pwm") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.1cd") returned 0
	[0068.521] lstrlenA (lpString="*.1cd") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.md") returned 0
	[0068.521] lstrlenA (lpString="*.md") returned 4
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mdf") returned 0
	[0068.521] lstrlenA (lpString="*.mdf") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.dbf") returned 0
	[0068.521] lstrlenA (lpString="*.dbf") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.odt") returned 0
	[0068.521] lstrlenA (lpString="*.odt") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.vob") returned 0
	[0068.521] lstrlenA (lpString="*.vob") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.ifo") returned 0
	[0068.521] lstrlenA (lpString="*.ifo") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.lnk") returned 0
	[0068.521] lstrlenA (lpString="*.lnk") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.torrent") returned 0
	[0068.521] lstrlenA (lpString="*.torrent") returned 9
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mov") returned 0
	[0068.521] lstrlenA (lpString="*.mov") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.m2v") returned 0
	[0068.521] lstrlenA (lpString="*.m2v") returned 5
	[0068.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.3gp") returned 0
	[0068.522] lstrlenA (lpString="*.3gp") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mpeg") returned 0
	[0068.522] lstrlenA (lpString="*.mpeg") returned 6
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mpg") returned 0
	[0068.522] lstrlenA (lpString="*.mpg") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.flv") returned 0
	[0068.522] lstrlenA (lpString="*.flv") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.avi") returned 0
	[0068.522] lstrlenA (lpString="*.avi") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mp4") returned 0
	[0068.522] lstrlenA (lpString="*.mp4") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.wmv") returned 0
	[0068.522] lstrlenA (lpString="*.wmv") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.divx") returned 0
	[0068.522] lstrlenA (lpString="*.divx") returned 6
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mkv") returned 0
	[0068.522] lstrlenA (lpString="*.mkv") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.mp3") returned 0
	[0068.522] lstrlenA (lpString="*.mp3") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.wav") returned 0
	[0068.522] lstrlenA (lpString="*.wav") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.flac") returned 0
	[0068.522] lstrlenA (lpString="*.flac") returned 6
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.ape") returned 0
	[0068.522] lstrlenA (lpString="*.ape") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.wma") returned 0
	[0068.522] lstrlenA (lpString="*.wma") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.ac3") returned 0
	[0068.522] lstrlenA (lpString="*.ac3") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.exe") returned 0
	[0068.522] lstrlenA (lpString="*.exe") returned 5
	[0068.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.apk") returned 0
	[0068.522] lstrlenA (lpString="*.apk") returned 5
	[0068.522] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0068.522] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0068.522] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0068.522] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0068.522] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.522] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.523] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GROOVE.EXE") returned -1
	[0068.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE.EXE") returned 1
	[0068.523] lstrcmpiA (lpString1="", lpString2="GROOVE.EXE") returned -1
	[0068.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0068.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.zip") returned 0
	[0068.523] lstrlenA (lpString="*.zip") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.rar") returned 0
	[0068.523] lstrlenA (lpString="*.rar") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.7z") returned 0
	[0068.523] lstrlenA (lpString="*.7z") returned 4
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.tar") returned 0
	[0068.523] lstrlenA (lpString="*.tar") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.gzip") returned 0
	[0068.523] lstrlenA (lpString="*.gzip") returned 6
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.jpg") returned 0
	[0068.523] lstrlenA (lpString="*.jpg") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.jpeg") returned 0
	[0068.523] lstrlenA (lpString="*.jpeg") returned 6
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.psd") returned 0
	[0068.523] lstrlenA (lpString="*.psd") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.cdr") returned 0
	[0068.523] lstrlenA (lpString="*.cdr") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.dwg") returned 0
	[0068.523] lstrlenA (lpString="*.dwg") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.max") returned 0
	[0068.523] lstrlenA (lpString="*.max") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.bmp") returned 0
	[0068.523] lstrlenA (lpString="*.bmp") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.gif") returned 0
	[0068.523] lstrlenA (lpString="*.gif") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.png") returned 0
	[0068.523] lstrlenA (lpString="*.png") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.doc") returned 0
	[0068.523] lstrlenA (lpString="*.doc") returned 5
	[0068.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.docx") returned 0
	[0068.524] lstrlenA (lpString="*.docx") returned 6
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.xls") returned 0
	[0068.524] lstrlenA (lpString="*.xls") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.xlsx") returned 0
	[0068.524] lstrlenA (lpString="*.xlsx") returned 6
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.ppt") returned 0
	[0068.524] lstrlenA (lpString="*.ppt") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.pptx") returned 0
	[0068.524] lstrlenA (lpString="*.pptx") returned 6
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.txt") returned 0
	[0068.524] lstrlenA (lpString="*.txt") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.pdf") returned 0
	[0068.524] lstrlenA (lpString="*.pdf") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.djvu") returned 0
	[0068.524] lstrlenA (lpString="*.djvu") returned 6
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.htm") returned 0
	[0068.524] lstrlenA (lpString="*.htm") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.html") returned 0
	[0068.524] lstrlenA (lpString="*.html") returned 6
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mdb") returned 0
	[0068.524] lstrlenA (lpString="*.mdb") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.cer") returned 0
	[0068.524] lstrlenA (lpString="*.cer") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.p12") returned 0
	[0068.524] lstrlenA (lpString="*.p12") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.pfx") returned 0
	[0068.524] lstrlenA (lpString="*.pfx") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.kwm") returned 0
	[0068.524] lstrlenA (lpString="*.kwm") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.pwm") returned 0
	[0068.524] lstrlenA (lpString="*.pwm") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.1cd") returned 0
	[0068.524] lstrlenA (lpString="*.1cd") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.md") returned 0
	[0068.524] lstrlenA (lpString="*.md") returned 4
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mdf") returned 0
	[0068.524] lstrlenA (lpString="*.mdf") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.dbf") returned 0
	[0068.524] lstrlenA (lpString="*.dbf") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.odt") returned 0
	[0068.524] lstrlenA (lpString="*.odt") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.vob") returned 0
	[0068.524] lstrlenA (lpString="*.vob") returned 5
	[0068.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.ifo") returned 0
	[0068.525] lstrlenA (lpString="*.ifo") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.lnk") returned 0
	[0068.525] lstrlenA (lpString="*.lnk") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.torrent") returned 0
	[0068.525] lstrlenA (lpString="*.torrent") returned 9
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mov") returned 0
	[0068.525] lstrlenA (lpString="*.mov") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.m2v") returned 0
	[0068.525] lstrlenA (lpString="*.m2v") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.3gp") returned 0
	[0068.525] lstrlenA (lpString="*.3gp") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mpeg") returned 0
	[0068.525] lstrlenA (lpString="*.mpeg") returned 6
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mpg") returned 0
	[0068.525] lstrlenA (lpString="*.mpg") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.flv") returned 0
	[0068.525] lstrlenA (lpString="*.flv") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.avi") returned 0
	[0068.525] lstrlenA (lpString="*.avi") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mp4") returned 0
	[0068.525] lstrlenA (lpString="*.mp4") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.wmv") returned 0
	[0068.525] lstrlenA (lpString="*.wmv") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.divx") returned 0
	[0068.525] lstrlenA (lpString="*.divx") returned 6
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mkv") returned 0
	[0068.525] lstrlenA (lpString="*.mkv") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.mp3") returned 0
	[0068.525] lstrlenA (lpString="*.mp3") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.wav") returned 0
	[0068.525] lstrlenA (lpString="*.wav") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.flac") returned 0
	[0068.525] lstrlenA (lpString="*.flac") returned 6
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.ape") returned 0
	[0068.525] lstrlenA (lpString="*.ape") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.wma") returned 0
	[0068.525] lstrlenA (lpString="*.wma") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.ac3") returned 0
	[0068.525] lstrlenA (lpString="*.ac3") returned 5
	[0068.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.exe") returned 1
	[0068.525] lstrlenA (lpString="*.exe") returned 5
	[0068.525] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"
	[0068.525] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"
	[0068.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE."
	[0068.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.Boom"
	[0068.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0068.526] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3112b78
	[0068.526] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd6fd7600, dwHighDateTime=0x1cacbb3), lpLastAccessTime=0x407536*(dwLowDateTime=0x52fce0d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd6fd7600, dwHighDateTime=0x1cacbb3)) returned 1
	[0068.526] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.526] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0068.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="GROOVE.EXE"
	[0068.563] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.563] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0068.568] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.568] CloseHandle (hObject=0x88) returned 1
	[0068.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.boom")) returned 1
	[0068.569] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.569] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.569] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GROOVEEX.DLL") returned -1
	[0068.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEEX.DLL") returned 1
	[0068.569] lstrcmpiA (lpString1="", lpString2="GROOVEEX.DLL") returned -1
	[0068.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="GROOVE.EXE"
	[0068.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEEX.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL"
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.zip") returned 0
	[0068.570] lstrlenA (lpString="*.zip") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.rar") returned 0
	[0068.570] lstrlenA (lpString="*.rar") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.7z") returned 0
	[0068.570] lstrlenA (lpString="*.7z") returned 4
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.tar") returned 0
	[0068.570] lstrlenA (lpString="*.tar") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.gzip") returned 0
	[0068.570] lstrlenA (lpString="*.gzip") returned 6
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.jpg") returned 0
	[0068.570] lstrlenA (lpString="*.jpg") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.jpeg") returned 0
	[0068.570] lstrlenA (lpString="*.jpeg") returned 6
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.psd") returned 0
	[0068.570] lstrlenA (lpString="*.psd") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.cdr") returned 0
	[0068.570] lstrlenA (lpString="*.cdr") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.dwg") returned 0
	[0068.570] lstrlenA (lpString="*.dwg") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.max") returned 0
	[0068.570] lstrlenA (lpString="*.max") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.bmp") returned 0
	[0068.570] lstrlenA (lpString="*.bmp") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.gif") returned 0
	[0068.570] lstrlenA (lpString="*.gif") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.png") returned 0
	[0068.570] lstrlenA (lpString="*.png") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.doc") returned 0
	[0068.570] lstrlenA (lpString="*.doc") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.docx") returned 0
	[0068.570] lstrlenA (lpString="*.docx") returned 6
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.xls") returned 0
	[0068.570] lstrlenA (lpString="*.xls") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.xlsx") returned 0
	[0068.570] lstrlenA (lpString="*.xlsx") returned 6
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.ppt") returned 0
	[0068.570] lstrlenA (lpString="*.ppt") returned 5
	[0068.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.pptx") returned 0
	[0068.571] lstrlenA (lpString="*.pptx") returned 6
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.txt") returned 0
	[0068.571] lstrlenA (lpString="*.txt") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.pdf") returned 0
	[0068.571] lstrlenA (lpString="*.pdf") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.djvu") returned 0
	[0068.571] lstrlenA (lpString="*.djvu") returned 6
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.htm") returned 0
	[0068.571] lstrlenA (lpString="*.htm") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.html") returned 0
	[0068.571] lstrlenA (lpString="*.html") returned 6
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mdb") returned 0
	[0068.571] lstrlenA (lpString="*.mdb") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.cer") returned 0
	[0068.571] lstrlenA (lpString="*.cer") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.p12") returned 0
	[0068.571] lstrlenA (lpString="*.p12") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.pfx") returned 0
	[0068.571] lstrlenA (lpString="*.pfx") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.kwm") returned 0
	[0068.571] lstrlenA (lpString="*.kwm") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.pwm") returned 0
	[0068.571] lstrlenA (lpString="*.pwm") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.1cd") returned 0
	[0068.571] lstrlenA (lpString="*.1cd") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.md") returned 0
	[0068.571] lstrlenA (lpString="*.md") returned 4
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mdf") returned 0
	[0068.571] lstrlenA (lpString="*.mdf") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.dbf") returned 0
	[0068.571] lstrlenA (lpString="*.dbf") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.odt") returned 0
	[0068.571] lstrlenA (lpString="*.odt") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.vob") returned 0
	[0068.571] lstrlenA (lpString="*.vob") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.ifo") returned 0
	[0068.571] lstrlenA (lpString="*.ifo") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.lnk") returned 0
	[0068.571] lstrlenA (lpString="*.lnk") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.torrent") returned 0
	[0068.571] lstrlenA (lpString="*.torrent") returned 9
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mov") returned 0
	[0068.571] lstrlenA (lpString="*.mov") returned 5
	[0068.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.m2v") returned 0
	[0068.571] lstrlenA (lpString="*.m2v") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.3gp") returned 0
	[0068.572] lstrlenA (lpString="*.3gp") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mpeg") returned 0
	[0068.572] lstrlenA (lpString="*.mpeg") returned 6
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mpg") returned 0
	[0068.572] lstrlenA (lpString="*.mpg") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.flv") returned 0
	[0068.572] lstrlenA (lpString="*.flv") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.avi") returned 0
	[0068.572] lstrlenA (lpString="*.avi") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mp4") returned 0
	[0068.572] lstrlenA (lpString="*.mp4") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.wmv") returned 0
	[0068.572] lstrlenA (lpString="*.wmv") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.divx") returned 0
	[0068.572] lstrlenA (lpString="*.divx") returned 6
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mkv") returned 0
	[0068.572] lstrlenA (lpString="*.mkv") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.mp3") returned 0
	[0068.572] lstrlenA (lpString="*.mp3") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.wav") returned 0
	[0068.572] lstrlenA (lpString="*.wav") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.flac") returned 0
	[0068.572] lstrlenA (lpString="*.flac") returned 6
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.ape") returned 0
	[0068.572] lstrlenA (lpString="*.ape") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.wma") returned 0
	[0068.572] lstrlenA (lpString="*.wma") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.ac3") returned 0
	[0068.572] lstrlenA (lpString="*.ac3") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.exe") returned 0
	[0068.572] lstrlenA (lpString="*.exe") returned 5
	[0068.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.apk") returned 0
	[0068.572] lstrlenA (lpString="*.apk") returned 5
	[0068.572] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.572] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GROOVEMN.EXE") returned -1
	[0068.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEMN.EXE") returned 1
	[0068.572] lstrcmpiA (lpString1="", lpString2="GROOVEMN.EXE") returned -1
	[0068.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="GROOVEEX.DLL"
	[0068.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEMN.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE"
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.zip") returned 0
	[0068.573] lstrlenA (lpString="*.zip") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.rar") returned 0
	[0068.573] lstrlenA (lpString="*.rar") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.7z") returned 0
	[0068.573] lstrlenA (lpString="*.7z") returned 4
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.tar") returned 0
	[0068.573] lstrlenA (lpString="*.tar") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.gzip") returned 0
	[0068.573] lstrlenA (lpString="*.gzip") returned 6
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.jpg") returned 0
	[0068.573] lstrlenA (lpString="*.jpg") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.jpeg") returned 0
	[0068.573] lstrlenA (lpString="*.jpeg") returned 6
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.psd") returned 0
	[0068.573] lstrlenA (lpString="*.psd") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.cdr") returned 0
	[0068.573] lstrlenA (lpString="*.cdr") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.dwg") returned 0
	[0068.573] lstrlenA (lpString="*.dwg") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.max") returned 0
	[0068.573] lstrlenA (lpString="*.max") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.bmp") returned 0
	[0068.573] lstrlenA (lpString="*.bmp") returned 5
	[0068.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.gif") returned 0
	[0068.573] lstrlenA (lpString="*.gif") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.png") returned 0
	[0068.574] lstrlenA (lpString="*.png") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.doc") returned 0
	[0068.574] lstrlenA (lpString="*.doc") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.docx") returned 0
	[0068.574] lstrlenA (lpString="*.docx") returned 6
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.xls") returned 0
	[0068.574] lstrlenA (lpString="*.xls") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.xlsx") returned 0
	[0068.574] lstrlenA (lpString="*.xlsx") returned 6
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.ppt") returned 0
	[0068.574] lstrlenA (lpString="*.ppt") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.pptx") returned 0
	[0068.574] lstrlenA (lpString="*.pptx") returned 6
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.txt") returned 0
	[0068.574] lstrlenA (lpString="*.txt") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.pdf") returned 0
	[0068.574] lstrlenA (lpString="*.pdf") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.djvu") returned 0
	[0068.574] lstrlenA (lpString="*.djvu") returned 6
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.htm") returned 0
	[0068.574] lstrlenA (lpString="*.htm") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.html") returned 0
	[0068.574] lstrlenA (lpString="*.html") returned 6
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mdb") returned 0
	[0068.574] lstrlenA (lpString="*.mdb") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.cer") returned 0
	[0068.574] lstrlenA (lpString="*.cer") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.p12") returned 0
	[0068.574] lstrlenA (lpString="*.p12") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.pfx") returned 0
	[0068.574] lstrlenA (lpString="*.pfx") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.kwm") returned 0
	[0068.574] lstrlenA (lpString="*.kwm") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.pwm") returned 0
	[0068.574] lstrlenA (lpString="*.pwm") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.1cd") returned 0
	[0068.574] lstrlenA (lpString="*.1cd") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.md") returned 0
	[0068.574] lstrlenA (lpString="*.md") returned 4
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mdf") returned 0
	[0068.574] lstrlenA (lpString="*.mdf") returned 5
	[0068.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.dbf") returned 0
	[0068.574] lstrlenA (lpString="*.dbf") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.odt") returned 0
	[0068.575] lstrlenA (lpString="*.odt") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.vob") returned 0
	[0068.575] lstrlenA (lpString="*.vob") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.ifo") returned 0
	[0068.575] lstrlenA (lpString="*.ifo") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.lnk") returned 0
	[0068.575] lstrlenA (lpString="*.lnk") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.torrent") returned 0
	[0068.575] lstrlenA (lpString="*.torrent") returned 9
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mov") returned 0
	[0068.575] lstrlenA (lpString="*.mov") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.m2v") returned 0
	[0068.575] lstrlenA (lpString="*.m2v") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.3gp") returned 0
	[0068.575] lstrlenA (lpString="*.3gp") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mpeg") returned 0
	[0068.575] lstrlenA (lpString="*.mpeg") returned 6
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mpg") returned 0
	[0068.575] lstrlenA (lpString="*.mpg") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.flv") returned 0
	[0068.575] lstrlenA (lpString="*.flv") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.avi") returned 0
	[0068.575] lstrlenA (lpString="*.avi") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mp4") returned 0
	[0068.575] lstrlenA (lpString="*.mp4") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.wmv") returned 0
	[0068.575] lstrlenA (lpString="*.wmv") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.divx") returned 0
	[0068.575] lstrlenA (lpString="*.divx") returned 6
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mkv") returned 0
	[0068.575] lstrlenA (lpString="*.mkv") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.mp3") returned 0
	[0068.575] lstrlenA (lpString="*.mp3") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.wav") returned 0
	[0068.575] lstrlenA (lpString="*.wav") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.flac") returned 0
	[0068.575] lstrlenA (lpString="*.flac") returned 6
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.ape") returned 0
	[0068.575] lstrlenA (lpString="*.ape") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.wma") returned 0
	[0068.575] lstrlenA (lpString="*.wma") returned 5
	[0068.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.ac3") returned 0
	[0068.575] lstrlenA (lpString="*.ac3") returned 5
	[0068.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.exe") returned 1
	[0068.576] lstrlenA (lpString="*.exe") returned 5
	[0068.576] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE"
	[0068.576] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE"
	[0068.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE."
	[0068.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.Boom"
	[0068.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0068.577] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14ed88
	[0068.577] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8c91e000, dwHighDateTime=0x1cacb46), lpLastAccessTime=0x407536*(dwLowDateTime=0x52fce0d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8c91e000, dwHighDateTime=0x1cacb46)) returned 1
	[0068.577] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.577] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x14ed65, lpOverlapped=0x0) returned 1
	[0068.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="GROOVEMN.EXE"
	[0068.731] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.731] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14ed65, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14ed65, lpOverlapped=0x0) returned 1
	[0068.738] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.738] CloseHandle (hObject=0x88) returned 1
	[0068.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.boom")) returned 1
	[0068.739] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.739] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HOW TO DECRYPT FILES.txt") returned -1
	[0068.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0
	[0068.739] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.739] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HVAC.DLL") returned -1
	[0068.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HVAC.DLL") returned -1
	[0068.739] lstrcmpiA (lpString1="", lpString2="HVAC.DLL") returned -1
	[0068.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="GROOVEMN.EXE"
	[0068.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HVAC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL"
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.zip") returned 0
	[0068.740] lstrlenA (lpString="*.zip") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.rar") returned 0
	[0068.740] lstrlenA (lpString="*.rar") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.7z") returned 0
	[0068.740] lstrlenA (lpString="*.7z") returned 4
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.tar") returned 0
	[0068.740] lstrlenA (lpString="*.tar") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.gzip") returned 0
	[0068.740] lstrlenA (lpString="*.gzip") returned 6
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.jpg") returned 0
	[0068.740] lstrlenA (lpString="*.jpg") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.jpeg") returned 0
	[0068.740] lstrlenA (lpString="*.jpeg") returned 6
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.psd") returned 0
	[0068.740] lstrlenA (lpString="*.psd") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.cdr") returned 0
	[0068.740] lstrlenA (lpString="*.cdr") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.dwg") returned 0
	[0068.740] lstrlenA (lpString="*.dwg") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.max") returned 0
	[0068.740] lstrlenA (lpString="*.max") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.bmp") returned 0
	[0068.740] lstrlenA (lpString="*.bmp") returned 5
	[0068.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.gif") returned 0
	[0068.740] lstrlenA (lpString="*.gif") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.png") returned 0
	[0068.741] lstrlenA (lpString="*.png") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.doc") returned 0
	[0068.741] lstrlenA (lpString="*.doc") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.docx") returned 0
	[0068.741] lstrlenA (lpString="*.docx") returned 6
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.xls") returned 0
	[0068.741] lstrlenA (lpString="*.xls") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.xlsx") returned 0
	[0068.741] lstrlenA (lpString="*.xlsx") returned 6
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.ppt") returned 0
	[0068.741] lstrlenA (lpString="*.ppt") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.pptx") returned 0
	[0068.741] lstrlenA (lpString="*.pptx") returned 6
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.txt") returned 0
	[0068.741] lstrlenA (lpString="*.txt") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.pdf") returned 0
	[0068.741] lstrlenA (lpString="*.pdf") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.djvu") returned 0
	[0068.741] lstrlenA (lpString="*.djvu") returned 6
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.htm") returned 0
	[0068.741] lstrlenA (lpString="*.htm") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.html") returned 0
	[0068.741] lstrlenA (lpString="*.html") returned 6
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mdb") returned 0
	[0068.741] lstrlenA (lpString="*.mdb") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.cer") returned 0
	[0068.741] lstrlenA (lpString="*.cer") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.p12") returned 0
	[0068.741] lstrlenA (lpString="*.p12") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.pfx") returned 0
	[0068.741] lstrlenA (lpString="*.pfx") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.kwm") returned 0
	[0068.741] lstrlenA (lpString="*.kwm") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.pwm") returned 0
	[0068.741] lstrlenA (lpString="*.pwm") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.1cd") returned 0
	[0068.741] lstrlenA (lpString="*.1cd") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.md") returned 0
	[0068.741] lstrlenA (lpString="*.md") returned 4
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mdf") returned 0
	[0068.741] lstrlenA (lpString="*.mdf") returned 5
	[0068.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.dbf") returned 0
	[0068.742] lstrlenA (lpString="*.dbf") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.odt") returned 0
	[0068.742] lstrlenA (lpString="*.odt") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.vob") returned 0
	[0068.742] lstrlenA (lpString="*.vob") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.ifo") returned 0
	[0068.742] lstrlenA (lpString="*.ifo") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.lnk") returned 0
	[0068.742] lstrlenA (lpString="*.lnk") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.torrent") returned 0
	[0068.742] lstrlenA (lpString="*.torrent") returned 9
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mov") returned 0
	[0068.742] lstrlenA (lpString="*.mov") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.m2v") returned 0
	[0068.742] lstrlenA (lpString="*.m2v") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.3gp") returned 0
	[0068.742] lstrlenA (lpString="*.3gp") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mpeg") returned 0
	[0068.742] lstrlenA (lpString="*.mpeg") returned 6
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mpg") returned 0
	[0068.742] lstrlenA (lpString="*.mpg") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.flv") returned 0
	[0068.742] lstrlenA (lpString="*.flv") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.avi") returned 0
	[0068.742] lstrlenA (lpString="*.avi") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mp4") returned 0
	[0068.742] lstrlenA (lpString="*.mp4") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.wmv") returned 0
	[0068.742] lstrlenA (lpString="*.wmv") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.divx") returned 0
	[0068.742] lstrlenA (lpString="*.divx") returned 6
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mkv") returned 0
	[0068.742] lstrlenA (lpString="*.mkv") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.mp3") returned 0
	[0068.742] lstrlenA (lpString="*.mp3") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.wav") returned 0
	[0068.742] lstrlenA (lpString="*.wav") returned 5
	[0068.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.flac") returned 0
	[0068.743] lstrlenA (lpString="*.flac") returned 6
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.ape") returned 0
	[0068.743] lstrlenA (lpString="*.ape") returned 5
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.wma") returned 0
	[0068.743] lstrlenA (lpString="*.wma") returned 5
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.ac3") returned 0
	[0068.743] lstrlenA (lpString="*.ac3") returned 5
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.exe") returned 0
	[0068.743] lstrlenA (lpString="*.exe") returned 5
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.apk") returned 0
	[0068.743] lstrlenA (lpString="*.apk") returned 5
	[0068.743] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.743] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.743] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IEAWSDC.DLL") returned -1
	[0068.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEAWSDC.DLL") returned -1
	[0068.743] lstrcmpiA (lpString1="", lpString2="IEAWSDC.DLL") returned -1
	[0068.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="HVAC.DLL"
	[0068.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEAWSDC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL"
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.zip") returned 0
	[0068.743] lstrlenA (lpString="*.zip") returned 5
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.rar") returned 0
	[0068.743] lstrlenA (lpString="*.rar") returned 5
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.7z") returned 0
	[0068.743] lstrlenA (lpString="*.7z") returned 4
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.tar") returned 0
	[0068.743] lstrlenA (lpString="*.tar") returned 5
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.gzip") returned 0
	[0068.743] lstrlenA (lpString="*.gzip") returned 6
	[0068.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.jpg") returned 0
	[0068.743] lstrlenA (lpString="*.jpg") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.jpeg") returned 0
	[0068.744] lstrlenA (lpString="*.jpeg") returned 6
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.psd") returned 0
	[0068.744] lstrlenA (lpString="*.psd") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.cdr") returned 0
	[0068.744] lstrlenA (lpString="*.cdr") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.dwg") returned 0
	[0068.744] lstrlenA (lpString="*.dwg") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.max") returned 0
	[0068.744] lstrlenA (lpString="*.max") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.bmp") returned 0
	[0068.744] lstrlenA (lpString="*.bmp") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.gif") returned 0
	[0068.744] lstrlenA (lpString="*.gif") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.png") returned 0
	[0068.744] lstrlenA (lpString="*.png") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.doc") returned 0
	[0068.744] lstrlenA (lpString="*.doc") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.docx") returned 0
	[0068.744] lstrlenA (lpString="*.docx") returned 6
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.xls") returned 0
	[0068.744] lstrlenA (lpString="*.xls") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.xlsx") returned 0
	[0068.744] lstrlenA (lpString="*.xlsx") returned 6
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.ppt") returned 0
	[0068.744] lstrlenA (lpString="*.ppt") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.pptx") returned 0
	[0068.744] lstrlenA (lpString="*.pptx") returned 6
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.txt") returned 0
	[0068.744] lstrlenA (lpString="*.txt") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.pdf") returned 0
	[0068.744] lstrlenA (lpString="*.pdf") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.djvu") returned 0
	[0068.744] lstrlenA (lpString="*.djvu") returned 6
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.htm") returned 0
	[0068.744] lstrlenA (lpString="*.htm") returned 5
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.html") returned 0
	[0068.744] lstrlenA (lpString="*.html") returned 6
	[0068.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mdb") returned 0
	[0068.745] lstrlenA (lpString="*.mdb") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.cer") returned 0
	[0068.745] lstrlenA (lpString="*.cer") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.p12") returned 0
	[0068.745] lstrlenA (lpString="*.p12") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.pfx") returned 0
	[0068.745] lstrlenA (lpString="*.pfx") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.kwm") returned 0
	[0068.745] lstrlenA (lpString="*.kwm") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.pwm") returned 0
	[0068.745] lstrlenA (lpString="*.pwm") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.1cd") returned 0
	[0068.745] lstrlenA (lpString="*.1cd") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.md") returned 0
	[0068.745] lstrlenA (lpString="*.md") returned 4
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mdf") returned 0
	[0068.745] lstrlenA (lpString="*.mdf") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.dbf") returned 0
	[0068.745] lstrlenA (lpString="*.dbf") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.odt") returned 0
	[0068.745] lstrlenA (lpString="*.odt") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.vob") returned 0
	[0068.745] lstrlenA (lpString="*.vob") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.ifo") returned 0
	[0068.745] lstrlenA (lpString="*.ifo") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.lnk") returned 0
	[0068.745] lstrlenA (lpString="*.lnk") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.torrent") returned 0
	[0068.745] lstrlenA (lpString="*.torrent") returned 9
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mov") returned 0
	[0068.745] lstrlenA (lpString="*.mov") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.m2v") returned 0
	[0068.745] lstrlenA (lpString="*.m2v") returned 5
	[0068.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.3gp") returned 0
	[0068.746] lstrlenA (lpString="*.3gp") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mpeg") returned 0
	[0068.746] lstrlenA (lpString="*.mpeg") returned 6
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mpg") returned 0
	[0068.746] lstrlenA (lpString="*.mpg") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.flv") returned 0
	[0068.746] lstrlenA (lpString="*.flv") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.avi") returned 0
	[0068.746] lstrlenA (lpString="*.avi") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mp4") returned 0
	[0068.746] lstrlenA (lpString="*.mp4") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.wmv") returned 0
	[0068.746] lstrlenA (lpString="*.wmv") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.divx") returned 0
	[0068.746] lstrlenA (lpString="*.divx") returned 6
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mkv") returned 0
	[0068.746] lstrlenA (lpString="*.mkv") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.mp3") returned 0
	[0068.746] lstrlenA (lpString="*.mp3") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.wav") returned 0
	[0068.746] lstrlenA (lpString="*.wav") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.flac") returned 0
	[0068.746] lstrlenA (lpString="*.flac") returned 6
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.ape") returned 0
	[0068.746] lstrlenA (lpString="*.ape") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.wma") returned 0
	[0068.746] lstrlenA (lpString="*.wma") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.ac3") returned 0
	[0068.746] lstrlenA (lpString="*.ac3") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.exe") returned 0
	[0068.746] lstrlenA (lpString="*.exe") returned 5
	[0068.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.apk") returned 0
	[0068.746] lstrlenA (lpString="*.apk") returned 5
	[0068.746] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.747] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.747] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IEContentService.exe") returned -1
	[0068.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEContentService.exe") returned -1
	[0068.747] lstrcmpiA (lpString1="", lpString2="IEContentService.exe") returned -1
	[0068.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="IEAWSDC.DLL"
	[0068.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEContentService.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe"
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.zip") returned 0
	[0068.747] lstrlenA (lpString="*.zip") returned 5
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.rar") returned 0
	[0068.747] lstrlenA (lpString="*.rar") returned 5
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.7z") returned 0
	[0068.747] lstrlenA (lpString="*.7z") returned 4
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.tar") returned 0
	[0068.747] lstrlenA (lpString="*.tar") returned 5
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.gzip") returned 0
	[0068.747] lstrlenA (lpString="*.gzip") returned 6
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.jpg") returned 0
	[0068.747] lstrlenA (lpString="*.jpg") returned 5
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.jpeg") returned 0
	[0068.747] lstrlenA (lpString="*.jpeg") returned 6
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.psd") returned 0
	[0068.747] lstrlenA (lpString="*.psd") returned 5
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.cdr") returned 0
	[0068.747] lstrlenA (lpString="*.cdr") returned 5
	[0068.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.dwg") returned 0
	[0068.748] lstrlenA (lpString="*.dwg") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.max") returned 0
	[0068.748] lstrlenA (lpString="*.max") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.bmp") returned 0
	[0068.748] lstrlenA (lpString="*.bmp") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.gif") returned 0
	[0068.748] lstrlenA (lpString="*.gif") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.png") returned 0
	[0068.748] lstrlenA (lpString="*.png") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.doc") returned 0
	[0068.748] lstrlenA (lpString="*.doc") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.docx") returned 0
	[0068.748] lstrlenA (lpString="*.docx") returned 6
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.xls") returned 0
	[0068.748] lstrlenA (lpString="*.xls") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.xlsx") returned 0
	[0068.748] lstrlenA (lpString="*.xlsx") returned 6
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.ppt") returned 0
	[0068.748] lstrlenA (lpString="*.ppt") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.pptx") returned 0
	[0068.748] lstrlenA (lpString="*.pptx") returned 6
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.txt") returned 0
	[0068.748] lstrlenA (lpString="*.txt") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.pdf") returned 0
	[0068.748] lstrlenA (lpString="*.pdf") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.djvu") returned 0
	[0068.748] lstrlenA (lpString="*.djvu") returned 6
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.htm") returned 0
	[0068.748] lstrlenA (lpString="*.htm") returned 5
	[0068.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.html") returned 0
	[0068.748] lstrlenA (lpString="*.html") returned 6
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mdb") returned 0
	[0068.749] lstrlenA (lpString="*.mdb") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.cer") returned 0
	[0068.749] lstrlenA (lpString="*.cer") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.p12") returned 0
	[0068.749] lstrlenA (lpString="*.p12") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.pfx") returned 0
	[0068.749] lstrlenA (lpString="*.pfx") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.kwm") returned 0
	[0068.749] lstrlenA (lpString="*.kwm") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.pwm") returned 0
	[0068.749] lstrlenA (lpString="*.pwm") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.1cd") returned 0
	[0068.749] lstrlenA (lpString="*.1cd") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.md") returned 0
	[0068.749] lstrlenA (lpString="*.md") returned 4
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mdf") returned 0
	[0068.749] lstrlenA (lpString="*.mdf") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.dbf") returned 0
	[0068.749] lstrlenA (lpString="*.dbf") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.odt") returned 0
	[0068.749] lstrlenA (lpString="*.odt") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.vob") returned 0
	[0068.749] lstrlenA (lpString="*.vob") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.ifo") returned 0
	[0068.749] lstrlenA (lpString="*.ifo") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.lnk") returned 0
	[0068.749] lstrlenA (lpString="*.lnk") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.torrent") returned 0
	[0068.749] lstrlenA (lpString="*.torrent") returned 9
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mov") returned 0
	[0068.749] lstrlenA (lpString="*.mov") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.m2v") returned 0
	[0068.749] lstrlenA (lpString="*.m2v") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.3gp") returned 0
	[0068.749] lstrlenA (lpString="*.3gp") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mpeg") returned 0
	[0068.749] lstrlenA (lpString="*.mpeg") returned 6
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mpg") returned 0
	[0068.749] lstrlenA (lpString="*.mpg") returned 5
	[0068.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.flv") returned 0
	[0068.750] lstrlenA (lpString="*.flv") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.avi") returned 0
	[0068.750] lstrlenA (lpString="*.avi") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mp4") returned 0
	[0068.750] lstrlenA (lpString="*.mp4") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.wmv") returned 0
	[0068.750] lstrlenA (lpString="*.wmv") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.divx") returned 0
	[0068.750] lstrlenA (lpString="*.divx") returned 6
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mkv") returned 0
	[0068.750] lstrlenA (lpString="*.mkv") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.mp3") returned 0
	[0068.750] lstrlenA (lpString="*.mp3") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.wav") returned 0
	[0068.750] lstrlenA (lpString="*.wav") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.flac") returned 0
	[0068.750] lstrlenA (lpString="*.flac") returned 6
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.ape") returned 0
	[0068.750] lstrlenA (lpString="*.ape") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.wma") returned 0
	[0068.750] lstrlenA (lpString="*.wma") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.ac3") returned 0
	[0068.750] lstrlenA (lpString="*.ac3") returned 5
	[0068.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.exe") returned 1
	[0068.750] lstrlenA (lpString="*.exe") returned 5
	[0068.750] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe"
	[0068.750] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe"
	[0068.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe."
	[0068.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.Boom"
	[0068.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0068.751] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb13a8
	[0068.751] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82531f00, dwHighDateTime=0x1cab7f0), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392d770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82531f00, dwHighDateTime=0x1cab7f0)) returned 1
	[0068.751] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.751] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xb1385, lpOverlapped=0x0) returned 1
	[0068.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="IEContentService.exe"
	[0068.865] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.865] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xb1385, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xb1385, lpOverlapped=0x0) returned 1
	[0068.867] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.867] CloseHandle (hObject=0x88) returned 1
	[0068.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe.boom")) returned 1
	[0068.868] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.868] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMCOMMON.DLL") returned -1
	[0068.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMCOMMON.DLL") returned -1
	[0068.868] lstrcmpiA (lpString1="", lpString2="IMCOMMON.DLL") returned -1
	[0068.868] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="IEContentService.exe"
	[0068.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.868] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.868] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMCOMMON.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL"
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.zip") returned 0
	[0068.868] lstrlenA (lpString="*.zip") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.rar") returned 0
	[0068.868] lstrlenA (lpString="*.rar") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.7z") returned 0
	[0068.868] lstrlenA (lpString="*.7z") returned 4
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.tar") returned 0
	[0068.868] lstrlenA (lpString="*.tar") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.gzip") returned 0
	[0068.868] lstrlenA (lpString="*.gzip") returned 6
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.jpg") returned 0
	[0068.868] lstrlenA (lpString="*.jpg") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.jpeg") returned 0
	[0068.868] lstrlenA (lpString="*.jpeg") returned 6
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.psd") returned 0
	[0068.868] lstrlenA (lpString="*.psd") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.cdr") returned 0
	[0068.868] lstrlenA (lpString="*.cdr") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.dwg") returned 0
	[0068.868] lstrlenA (lpString="*.dwg") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.max") returned 0
	[0068.868] lstrlenA (lpString="*.max") returned 5
	[0068.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.bmp") returned 0
	[0068.868] lstrlenA (lpString="*.bmp") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.gif") returned 0
	[0068.869] lstrlenA (lpString="*.gif") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.png") returned 0
	[0068.869] lstrlenA (lpString="*.png") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.doc") returned 0
	[0068.869] lstrlenA (lpString="*.doc") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.docx") returned 0
	[0068.869] lstrlenA (lpString="*.docx") returned 6
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.xls") returned 0
	[0068.869] lstrlenA (lpString="*.xls") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.xlsx") returned 0
	[0068.869] lstrlenA (lpString="*.xlsx") returned 6
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.ppt") returned 0
	[0068.869] lstrlenA (lpString="*.ppt") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.pptx") returned 0
	[0068.869] lstrlenA (lpString="*.pptx") returned 6
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.txt") returned 0
	[0068.869] lstrlenA (lpString="*.txt") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.pdf") returned 0
	[0068.869] lstrlenA (lpString="*.pdf") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.djvu") returned 0
	[0068.869] lstrlenA (lpString="*.djvu") returned 6
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.htm") returned 0
	[0068.869] lstrlenA (lpString="*.htm") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.html") returned 0
	[0068.869] lstrlenA (lpString="*.html") returned 6
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mdb") returned 0
	[0068.869] lstrlenA (lpString="*.mdb") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.cer") returned 0
	[0068.869] lstrlenA (lpString="*.cer") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.p12") returned 0
	[0068.869] lstrlenA (lpString="*.p12") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.pfx") returned 0
	[0068.869] lstrlenA (lpString="*.pfx") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.kwm") returned 0
	[0068.869] lstrlenA (lpString="*.kwm") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.pwm") returned 0
	[0068.869] lstrlenA (lpString="*.pwm") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.1cd") returned 0
	[0068.869] lstrlenA (lpString="*.1cd") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.md") returned 0
	[0068.869] lstrlenA (lpString="*.md") returned 4
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mdf") returned 0
	[0068.869] lstrlenA (lpString="*.mdf") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.dbf") returned 0
	[0068.869] lstrlenA (lpString="*.dbf") returned 5
	[0068.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.odt") returned 0
	[0068.870] lstrlenA (lpString="*.odt") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.vob") returned 0
	[0068.870] lstrlenA (lpString="*.vob") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.ifo") returned 0
	[0068.870] lstrlenA (lpString="*.ifo") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.lnk") returned 0
	[0068.870] lstrlenA (lpString="*.lnk") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.torrent") returned 0
	[0068.870] lstrlenA (lpString="*.torrent") returned 9
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mov") returned 0
	[0068.870] lstrlenA (lpString="*.mov") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.m2v") returned 0
	[0068.870] lstrlenA (lpString="*.m2v") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.3gp") returned 0
	[0068.870] lstrlenA (lpString="*.3gp") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mpeg") returned 0
	[0068.870] lstrlenA (lpString="*.mpeg") returned 6
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mpg") returned 0
	[0068.870] lstrlenA (lpString="*.mpg") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.flv") returned 0
	[0068.870] lstrlenA (lpString="*.flv") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.avi") returned 0
	[0068.870] lstrlenA (lpString="*.avi") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mp4") returned 0
	[0068.870] lstrlenA (lpString="*.mp4") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.wmv") returned 0
	[0068.870] lstrlenA (lpString="*.wmv") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.divx") returned 0
	[0068.870] lstrlenA (lpString="*.divx") returned 6
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mkv") returned 0
	[0068.870] lstrlenA (lpString="*.mkv") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.mp3") returned 0
	[0068.870] lstrlenA (lpString="*.mp3") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.wav") returned 0
	[0068.870] lstrlenA (lpString="*.wav") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.flac") returned 0
	[0068.870] lstrlenA (lpString="*.flac") returned 6
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.ape") returned 0
	[0068.870] lstrlenA (lpString="*.ape") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.wma") returned 0
	[0068.870] lstrlenA (lpString="*.wma") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.ac3") returned 0
	[0068.870] lstrlenA (lpString="*.ac3") returned 5
	[0068.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.exe") returned 0
	[0068.871] lstrlenA (lpString="*.exe") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.apk") returned 0
	[0068.871] lstrlenA (lpString="*.apk") returned 5
	[0068.871] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.871] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.871] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMDIMP.ADD") returned -1
	[0068.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMDIMP.ADD") returned -1
	[0068.871] lstrcmpiA (lpString1="", lpString2="IMDIMP.ADD") returned -1
	[0068.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="IMCOMMON.DLL"
	[0068.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMDIMP.ADD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD"
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.zip") returned 0
	[0068.871] lstrlenA (lpString="*.zip") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.rar") returned 0
	[0068.871] lstrlenA (lpString="*.rar") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.7z") returned 0
	[0068.871] lstrlenA (lpString="*.7z") returned 4
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.tar") returned 0
	[0068.871] lstrlenA (lpString="*.tar") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.gzip") returned 0
	[0068.871] lstrlenA (lpString="*.gzip") returned 6
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.jpg") returned 0
	[0068.871] lstrlenA (lpString="*.jpg") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.jpeg") returned 0
	[0068.871] lstrlenA (lpString="*.jpeg") returned 6
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.psd") returned 0
	[0068.871] lstrlenA (lpString="*.psd") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.cdr") returned 0
	[0068.871] lstrlenA (lpString="*.cdr") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.dwg") returned 0
	[0068.871] lstrlenA (lpString="*.dwg") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.max") returned 0
	[0068.871] lstrlenA (lpString="*.max") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.bmp") returned 0
	[0068.871] lstrlenA (lpString="*.bmp") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.gif") returned 0
	[0068.871] lstrlenA (lpString="*.gif") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.png") returned 0
	[0068.871] lstrlenA (lpString="*.png") returned 5
	[0068.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.doc") returned 0
	[0068.872] lstrlenA (lpString="*.doc") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.docx") returned 0
	[0068.872] lstrlenA (lpString="*.docx") returned 6
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.xls") returned 0
	[0068.872] lstrlenA (lpString="*.xls") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.xlsx") returned 0
	[0068.872] lstrlenA (lpString="*.xlsx") returned 6
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.ppt") returned 0
	[0068.872] lstrlenA (lpString="*.ppt") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.pptx") returned 0
	[0068.872] lstrlenA (lpString="*.pptx") returned 6
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.txt") returned 0
	[0068.872] lstrlenA (lpString="*.txt") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.pdf") returned 0
	[0068.872] lstrlenA (lpString="*.pdf") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.djvu") returned 0
	[0068.872] lstrlenA (lpString="*.djvu") returned 6
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.htm") returned 0
	[0068.872] lstrlenA (lpString="*.htm") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.html") returned 0
	[0068.872] lstrlenA (lpString="*.html") returned 6
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mdb") returned 0
	[0068.872] lstrlenA (lpString="*.mdb") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.cer") returned 0
	[0068.872] lstrlenA (lpString="*.cer") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.p12") returned 0
	[0068.872] lstrlenA (lpString="*.p12") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.pfx") returned 0
	[0068.872] lstrlenA (lpString="*.pfx") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.kwm") returned 0
	[0068.872] lstrlenA (lpString="*.kwm") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.pwm") returned 0
	[0068.872] lstrlenA (lpString="*.pwm") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.1cd") returned 0
	[0068.872] lstrlenA (lpString="*.1cd") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.md") returned 0
	[0068.872] lstrlenA (lpString="*.md") returned 4
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mdf") returned 0
	[0068.872] lstrlenA (lpString="*.mdf") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.dbf") returned 0
	[0068.872] lstrlenA (lpString="*.dbf") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.odt") returned 0
	[0068.872] lstrlenA (lpString="*.odt") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.vob") returned 0
	[0068.872] lstrlenA (lpString="*.vob") returned 5
	[0068.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.ifo") returned 0
	[0068.873] lstrlenA (lpString="*.ifo") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.lnk") returned 0
	[0068.873] lstrlenA (lpString="*.lnk") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.torrent") returned 0
	[0068.873] lstrlenA (lpString="*.torrent") returned 9
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mov") returned 0
	[0068.873] lstrlenA (lpString="*.mov") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.m2v") returned 0
	[0068.873] lstrlenA (lpString="*.m2v") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.3gp") returned 0
	[0068.873] lstrlenA (lpString="*.3gp") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mpeg") returned 0
	[0068.873] lstrlenA (lpString="*.mpeg") returned 6
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mpg") returned 0
	[0068.873] lstrlenA (lpString="*.mpg") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.flv") returned 0
	[0068.873] lstrlenA (lpString="*.flv") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.avi") returned 0
	[0068.873] lstrlenA (lpString="*.avi") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mp4") returned 0
	[0068.873] lstrlenA (lpString="*.mp4") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.wmv") returned 0
	[0068.873] lstrlenA (lpString="*.wmv") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.divx") returned 0
	[0068.873] lstrlenA (lpString="*.divx") returned 6
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mkv") returned 0
	[0068.873] lstrlenA (lpString="*.mkv") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.mp3") returned 0
	[0068.873] lstrlenA (lpString="*.mp3") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.wav") returned 0
	[0068.873] lstrlenA (lpString="*.wav") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.flac") returned 0
	[0068.873] lstrlenA (lpString="*.flac") returned 6
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.ape") returned 0
	[0068.873] lstrlenA (lpString="*.ape") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.wma") returned 0
	[0068.873] lstrlenA (lpString="*.wma") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.ac3") returned 0
	[0068.873] lstrlenA (lpString="*.ac3") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.exe") returned 0
	[0068.873] lstrlenA (lpString="*.exe") returned 5
	[0068.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.apk") returned 0
	[0068.873] lstrlenA (lpString="*.apk") returned 5
	[0068.873] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.873] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.873] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMPMAIL.DLL") returned -1
	[0068.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMPMAIL.DLL") returned -1
	[0068.874] lstrcmpiA (lpString1="", lpString2="IMPMAIL.DLL") returned -1
	[0068.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="IMDIMP.ADD"
	[0068.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.874] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMPMAIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL"
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.zip") returned 0
	[0068.874] lstrlenA (lpString="*.zip") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.rar") returned 0
	[0068.874] lstrlenA (lpString="*.rar") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.7z") returned 0
	[0068.874] lstrlenA (lpString="*.7z") returned 4
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.tar") returned 0
	[0068.874] lstrlenA (lpString="*.tar") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.gzip") returned 0
	[0068.874] lstrlenA (lpString="*.gzip") returned 6
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.jpg") returned 0
	[0068.874] lstrlenA (lpString="*.jpg") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.jpeg") returned 0
	[0068.874] lstrlenA (lpString="*.jpeg") returned 6
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.psd") returned 0
	[0068.874] lstrlenA (lpString="*.psd") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.cdr") returned 0
	[0068.874] lstrlenA (lpString="*.cdr") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.dwg") returned 0
	[0068.874] lstrlenA (lpString="*.dwg") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.max") returned 0
	[0068.874] lstrlenA (lpString="*.max") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.bmp") returned 0
	[0068.874] lstrlenA (lpString="*.bmp") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.gif") returned 0
	[0068.874] lstrlenA (lpString="*.gif") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.png") returned 0
	[0068.874] lstrlenA (lpString="*.png") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.doc") returned 0
	[0068.874] lstrlenA (lpString="*.doc") returned 5
	[0068.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.docx") returned 0
	[0068.875] lstrlenA (lpString="*.docx") returned 6
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.xls") returned 0
	[0068.875] lstrlenA (lpString="*.xls") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.xlsx") returned 0
	[0068.875] lstrlenA (lpString="*.xlsx") returned 6
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.ppt") returned 0
	[0068.875] lstrlenA (lpString="*.ppt") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.pptx") returned 0
	[0068.875] lstrlenA (lpString="*.pptx") returned 6
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.txt") returned 0
	[0068.875] lstrlenA (lpString="*.txt") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.pdf") returned 0
	[0068.875] lstrlenA (lpString="*.pdf") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.djvu") returned 0
	[0068.875] lstrlenA (lpString="*.djvu") returned 6
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.htm") returned 0
	[0068.875] lstrlenA (lpString="*.htm") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.html") returned 0
	[0068.875] lstrlenA (lpString="*.html") returned 6
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mdb") returned 0
	[0068.875] lstrlenA (lpString="*.mdb") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.cer") returned 0
	[0068.875] lstrlenA (lpString="*.cer") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.p12") returned 0
	[0068.875] lstrlenA (lpString="*.p12") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.pfx") returned 0
	[0068.875] lstrlenA (lpString="*.pfx") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.kwm") returned 0
	[0068.875] lstrlenA (lpString="*.kwm") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.pwm") returned 0
	[0068.875] lstrlenA (lpString="*.pwm") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.1cd") returned 0
	[0068.875] lstrlenA (lpString="*.1cd") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.md") returned 0
	[0068.875] lstrlenA (lpString="*.md") returned 4
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mdf") returned 0
	[0068.875] lstrlenA (lpString="*.mdf") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.dbf") returned 0
	[0068.875] lstrlenA (lpString="*.dbf") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.odt") returned 0
	[0068.875] lstrlenA (lpString="*.odt") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.vob") returned 0
	[0068.875] lstrlenA (lpString="*.vob") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.ifo") returned 0
	[0068.875] lstrlenA (lpString="*.ifo") returned 5
	[0068.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.lnk") returned 0
	[0068.875] lstrlenA (lpString="*.lnk") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.torrent") returned 0
	[0068.876] lstrlenA (lpString="*.torrent") returned 9
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mov") returned 0
	[0068.876] lstrlenA (lpString="*.mov") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.m2v") returned 0
	[0068.876] lstrlenA (lpString="*.m2v") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.3gp") returned 0
	[0068.876] lstrlenA (lpString="*.3gp") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mpeg") returned 0
	[0068.876] lstrlenA (lpString="*.mpeg") returned 6
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mpg") returned 0
	[0068.876] lstrlenA (lpString="*.mpg") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.flv") returned 0
	[0068.876] lstrlenA (lpString="*.flv") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.avi") returned 0
	[0068.876] lstrlenA (lpString="*.avi") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mp4") returned 0
	[0068.876] lstrlenA (lpString="*.mp4") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.wmv") returned 0
	[0068.876] lstrlenA (lpString="*.wmv") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.divx") returned 0
	[0068.876] lstrlenA (lpString="*.divx") returned 6
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mkv") returned 0
	[0068.876] lstrlenA (lpString="*.mkv") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.mp3") returned 0
	[0068.876] lstrlenA (lpString="*.mp3") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.wav") returned 0
	[0068.876] lstrlenA (lpString="*.wav") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.flac") returned 0
	[0068.876] lstrlenA (lpString="*.flac") returned 6
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.ape") returned 0
	[0068.876] lstrlenA (lpString="*.ape") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.wma") returned 0
	[0068.876] lstrlenA (lpString="*.wma") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.ac3") returned 0
	[0068.876] lstrlenA (lpString="*.ac3") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.exe") returned 0
	[0068.876] lstrlenA (lpString="*.exe") returned 5
	[0068.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.apk") returned 0
	[0068.876] lstrlenA (lpString="*.apk") returned 5
	[0068.876] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.876] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.876] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMUTIL.DLL") returned -1
	[0068.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMUTIL.DLL") returned -1
	[0068.876] lstrcmpiA (lpString1="", lpString2="IMUTIL.DLL") returned -1
	[0068.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="IMPMAIL.DLL"
	[0068.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.877] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL"
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.zip") returned 0
	[0068.877] lstrlenA (lpString="*.zip") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.rar") returned 0
	[0068.877] lstrlenA (lpString="*.rar") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.7z") returned 0
	[0068.877] lstrlenA (lpString="*.7z") returned 4
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.tar") returned 0
	[0068.877] lstrlenA (lpString="*.tar") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.gzip") returned 0
	[0068.877] lstrlenA (lpString="*.gzip") returned 6
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.jpg") returned 0
	[0068.877] lstrlenA (lpString="*.jpg") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.jpeg") returned 0
	[0068.877] lstrlenA (lpString="*.jpeg") returned 6
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.psd") returned 0
	[0068.877] lstrlenA (lpString="*.psd") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.cdr") returned 0
	[0068.877] lstrlenA (lpString="*.cdr") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.dwg") returned 0
	[0068.877] lstrlenA (lpString="*.dwg") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.max") returned 0
	[0068.877] lstrlenA (lpString="*.max") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.bmp") returned 0
	[0068.877] lstrlenA (lpString="*.bmp") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.gif") returned 0
	[0068.877] lstrlenA (lpString="*.gif") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.png") returned 0
	[0068.877] lstrlenA (lpString="*.png") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.doc") returned 0
	[0068.877] lstrlenA (lpString="*.doc") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.docx") returned 0
	[0068.877] lstrlenA (lpString="*.docx") returned 6
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.xls") returned 0
	[0068.877] lstrlenA (lpString="*.xls") returned 5
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.xlsx") returned 0
	[0068.877] lstrlenA (lpString="*.xlsx") returned 6
	[0068.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.ppt") returned 0
	[0068.878] lstrlenA (lpString="*.ppt") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.pptx") returned 0
	[0068.878] lstrlenA (lpString="*.pptx") returned 6
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.txt") returned 0
	[0068.878] lstrlenA (lpString="*.txt") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.pdf") returned 0
	[0068.878] lstrlenA (lpString="*.pdf") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.djvu") returned 0
	[0068.878] lstrlenA (lpString="*.djvu") returned 6
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.htm") returned 0
	[0068.878] lstrlenA (lpString="*.htm") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.html") returned 0
	[0068.878] lstrlenA (lpString="*.html") returned 6
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mdb") returned 0
	[0068.878] lstrlenA (lpString="*.mdb") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.cer") returned 0
	[0068.878] lstrlenA (lpString="*.cer") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.p12") returned 0
	[0068.878] lstrlenA (lpString="*.p12") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.pfx") returned 0
	[0068.878] lstrlenA (lpString="*.pfx") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.kwm") returned 0
	[0068.878] lstrlenA (lpString="*.kwm") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.pwm") returned 0
	[0068.878] lstrlenA (lpString="*.pwm") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.1cd") returned 0
	[0068.878] lstrlenA (lpString="*.1cd") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.md") returned 0
	[0068.878] lstrlenA (lpString="*.md") returned 4
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mdf") returned 0
	[0068.878] lstrlenA (lpString="*.mdf") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.dbf") returned 0
	[0068.878] lstrlenA (lpString="*.dbf") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.odt") returned 0
	[0068.878] lstrlenA (lpString="*.odt") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.vob") returned 0
	[0068.878] lstrlenA (lpString="*.vob") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.ifo") returned 0
	[0068.878] lstrlenA (lpString="*.ifo") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.lnk") returned 0
	[0068.878] lstrlenA (lpString="*.lnk") returned 5
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.torrent") returned 0
	[0068.878] lstrlenA (lpString="*.torrent") returned 9
	[0068.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mov") returned 0
	[0068.879] lstrlenA (lpString="*.mov") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.m2v") returned 0
	[0068.879] lstrlenA (lpString="*.m2v") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.3gp") returned 0
	[0068.879] lstrlenA (lpString="*.3gp") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mpeg") returned 0
	[0068.879] lstrlenA (lpString="*.mpeg") returned 6
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mpg") returned 0
	[0068.879] lstrlenA (lpString="*.mpg") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.flv") returned 0
	[0068.879] lstrlenA (lpString="*.flv") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.avi") returned 0
	[0068.879] lstrlenA (lpString="*.avi") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mp4") returned 0
	[0068.879] lstrlenA (lpString="*.mp4") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.wmv") returned 0
	[0068.879] lstrlenA (lpString="*.wmv") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.divx") returned 0
	[0068.879] lstrlenA (lpString="*.divx") returned 6
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mkv") returned 0
	[0068.879] lstrlenA (lpString="*.mkv") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.mp3") returned 0
	[0068.879] lstrlenA (lpString="*.mp3") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.wav") returned 0
	[0068.879] lstrlenA (lpString="*.wav") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.flac") returned 0
	[0068.879] lstrlenA (lpString="*.flac") returned 6
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.ape") returned 0
	[0068.879] lstrlenA (lpString="*.ape") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.wma") returned 0
	[0068.879] lstrlenA (lpString="*.wma") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.ac3") returned 0
	[0068.879] lstrlenA (lpString="*.ac3") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.exe") returned 0
	[0068.879] lstrlenA (lpString="*.exe") returned 5
	[0068.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.apk") returned 0
	[0068.879] lstrlenA (lpString="*.apk") returned 5
	[0068.879] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.879] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.879] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMWDD.DLL") returned -1
	[0068.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWDD.DLL") returned -1
	[0068.879] lstrcmpiA (lpString1="", lpString2="IMWDD.DLL") returned -1
	[0068.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="IMUTIL.DLL"
	[0068.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.880] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWDD.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL"
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.zip") returned 0
	[0068.880] lstrlenA (lpString="*.zip") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.rar") returned 0
	[0068.880] lstrlenA (lpString="*.rar") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.7z") returned 0
	[0068.880] lstrlenA (lpString="*.7z") returned 4
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.tar") returned 0
	[0068.880] lstrlenA (lpString="*.tar") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.gzip") returned 0
	[0068.880] lstrlenA (lpString="*.gzip") returned 6
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.jpg") returned 0
	[0068.880] lstrlenA (lpString="*.jpg") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.jpeg") returned 0
	[0068.880] lstrlenA (lpString="*.jpeg") returned 6
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.psd") returned 0
	[0068.880] lstrlenA (lpString="*.psd") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.cdr") returned 0
	[0068.880] lstrlenA (lpString="*.cdr") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.dwg") returned 0
	[0068.880] lstrlenA (lpString="*.dwg") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.max") returned 0
	[0068.880] lstrlenA (lpString="*.max") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.bmp") returned 0
	[0068.880] lstrlenA (lpString="*.bmp") returned 5
	[0068.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.gif") returned 0
	[0068.880] lstrlenA (lpString="*.gif") returned 5
	[0068.880] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.880] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.881] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMWIZ.DLL") returned -1
	[0068.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWIZ.DLL") returned -1
	[0068.881] lstrcmpiA (lpString1="", lpString2="IMWIZ.DLL") returned -1
	[0068.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="IMWDD.DLL"
	[0068.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWIZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL"
	[0068.881] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.881] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0068.881] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INFOPATH.EXE") returned -1
	[0068.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH.EXE") returned -1
	[0068.881] lstrcmpiA (lpString1="", lpString2="INFOPATH.EXE") returned -1
	[0068.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="IMWIZ.DLL"
	[0068.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0068.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0068.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0068.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0068.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INFOPATH.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE"
	[0068.881] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE"
	[0068.881] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE"
	[0068.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE."
	[0068.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.Boom"
	[0068.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0068.882] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x275770
	[0068.882] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3501d300, dwHighDateTime=0x1cacf91), lpLastAccessTime=0x407536*(dwLowDateTime=0x53979a30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3501d300, dwHighDateTime=0x1cacf91)) returned 1
	[0068.882] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.882] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0068.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="INFOPATH.EXE"
	[0068.950] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0068.950] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0068.956] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0068.956] CloseHandle (hObject=0x88) returned 1
	[0068.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.boom")) returned 1
	[0068.957] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0068.957] lstrcmpA (lpString1=".", lpString2="InfoPathOM") returned -1
	[0068.957] lstrcmpA (lpString1="..", lpString2="InfoPathOM") returned -1
	[0068.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="INFOPATH.EXE"
	[0068.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="InfoPathOM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM"
	[0068.957] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned 53
	[0068.957] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0069.095] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.095] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.095] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.095] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.095] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.095] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServices") returned -1
	[0069.095] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServices") returned -1
	[0069.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*"
	[0069.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMFormServices" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices"
	[0069.095] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned 76
	[0069.095] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0069.105] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.105] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.105] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.105] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.105] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.105] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServicesV12") returned -1
	[0069.105] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServicesV12") returned -1
	[0069.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*"
	[0069.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="InfoPathOMFormServicesV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12"
	[0069.105] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned 102
	[0069.105] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0069.106] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.106] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0069.106] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.106] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.106] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0069.106] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0069.106] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.106] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.106] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*") returned="*.*"
	[0069.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\"
	[0069.106] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned=""
	[0069.106] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt"
	[0069.106] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt")) returned 0xffffffff
	[0069.106] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0069.108] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0069.108] WriteFile (in: hFile=0x94, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0069.109] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.109] CloseHandle (hObject=0x94) returned 1
	[0069.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll"
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.zip") returned 0
	[0069.109] lstrlenA (lpString="*.zip") returned 5
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.rar") returned 0
	[0069.109] lstrlenA (lpString="*.rar") returned 5
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.7z") returned 0
	[0069.109] lstrlenA (lpString="*.7z") returned 4
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.tar") returned 0
	[0069.109] lstrlenA (lpString="*.tar") returned 5
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.gzip") returned 0
	[0069.109] lstrlenA (lpString="*.gzip") returned 6
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.jpg") returned 0
	[0069.109] lstrlenA (lpString="*.jpg") returned 5
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.jpeg") returned 0
	[0069.109] lstrlenA (lpString="*.jpeg") returned 6
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.psd") returned 0
	[0069.109] lstrlenA (lpString="*.psd") returned 5
	[0069.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.cdr") returned 0
	[0069.110] lstrlenA (lpString="*.cdr") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.dwg") returned 0
	[0069.110] lstrlenA (lpString="*.dwg") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.max") returned 0
	[0069.110] lstrlenA (lpString="*.max") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.bmp") returned 0
	[0069.110] lstrlenA (lpString="*.bmp") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.gif") returned 0
	[0069.110] lstrlenA (lpString="*.gif") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.png") returned 0
	[0069.110] lstrlenA (lpString="*.png") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.doc") returned 0
	[0069.110] lstrlenA (lpString="*.doc") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.docx") returned 0
	[0069.110] lstrlenA (lpString="*.docx") returned 6
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.xls") returned 0
	[0069.110] lstrlenA (lpString="*.xls") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.xlsx") returned 0
	[0069.110] lstrlenA (lpString="*.xlsx") returned 6
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ppt") returned 0
	[0069.110] lstrlenA (lpString="*.ppt") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pptx") returned 0
	[0069.110] lstrlenA (lpString="*.pptx") returned 6
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.txt") returned 0
	[0069.110] lstrlenA (lpString="*.txt") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pdf") returned 0
	[0069.110] lstrlenA (lpString="*.pdf") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.djvu") returned 0
	[0069.110] lstrlenA (lpString="*.djvu") returned 6
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.htm") returned 0
	[0069.110] lstrlenA (lpString="*.htm") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.html") returned 0
	[0069.110] lstrlenA (lpString="*.html") returned 6
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mdb") returned 0
	[0069.110] lstrlenA (lpString="*.mdb") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.cer") returned 0
	[0069.110] lstrlenA (lpString="*.cer") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.p12") returned 0
	[0069.110] lstrlenA (lpString="*.p12") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pfx") returned 0
	[0069.110] lstrlenA (lpString="*.pfx") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.kwm") returned 0
	[0069.110] lstrlenA (lpString="*.kwm") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pwm") returned 0
	[0069.110] lstrlenA (lpString="*.pwm") returned 5
	[0069.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.1cd") returned 0
	[0069.111] lstrlenA (lpString="*.1cd") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.md") returned 0
	[0069.111] lstrlenA (lpString="*.md") returned 4
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mdf") returned 0
	[0069.111] lstrlenA (lpString="*.mdf") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.dbf") returned 0
	[0069.111] lstrlenA (lpString="*.dbf") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.odt") returned 0
	[0069.111] lstrlenA (lpString="*.odt") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.vob") returned 0
	[0069.111] lstrlenA (lpString="*.vob") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ifo") returned 0
	[0069.111] lstrlenA (lpString="*.ifo") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.lnk") returned 0
	[0069.111] lstrlenA (lpString="*.lnk") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.torrent") returned 0
	[0069.111] lstrlenA (lpString="*.torrent") returned 9
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mov") returned 0
	[0069.111] lstrlenA (lpString="*.mov") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.m2v") returned 0
	[0069.111] lstrlenA (lpString="*.m2v") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.3gp") returned 0
	[0069.111] lstrlenA (lpString="*.3gp") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mpeg") returned 0
	[0069.111] lstrlenA (lpString="*.mpeg") returned 6
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mpg") returned 0
	[0069.111] lstrlenA (lpString="*.mpg") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.flv") returned 0
	[0069.111] lstrlenA (lpString="*.flv") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.avi") returned 0
	[0069.111] lstrlenA (lpString="*.avi") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mp4") returned 0
	[0069.111] lstrlenA (lpString="*.mp4") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.wmv") returned 0
	[0069.111] lstrlenA (lpString="*.wmv") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.divx") returned 0
	[0069.111] lstrlenA (lpString="*.divx") returned 6
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mkv") returned 0
	[0069.111] lstrlenA (lpString="*.mkv") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mp3") returned 0
	[0069.111] lstrlenA (lpString="*.mp3") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.wav") returned 0
	[0069.111] lstrlenA (lpString="*.wav") returned 5
	[0069.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.flac") returned 0
	[0069.111] lstrlenA (lpString="*.flac") returned 6
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ape") returned 0
	[0069.112] lstrlenA (lpString="*.ape") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.wma") returned 0
	[0069.112] lstrlenA (lpString="*.wma") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ac3") returned 0
	[0069.112] lstrlenA (lpString="*.ac3") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.exe") returned 0
	[0069.112] lstrlenA (lpString="*.exe") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.apk") returned 0
	[0069.112] lstrlenA (lpString="*.apk") returned 5
	[0069.112] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0069.112] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0069.112] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.112] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll"
	[0069.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\"
	[0069.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned=""
	[0069.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt"
	[0069.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt")) returned 0x20
	[0069.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml"
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.zip") returned 0
	[0069.112] lstrlenA (lpString="*.zip") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.rar") returned 0
	[0069.112] lstrlenA (lpString="*.rar") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.7z") returned 0
	[0069.112] lstrlenA (lpString="*.7z") returned 4
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.tar") returned 0
	[0069.112] lstrlenA (lpString="*.tar") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.gzip") returned 0
	[0069.112] lstrlenA (lpString="*.gzip") returned 6
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpg") returned 0
	[0069.112] lstrlenA (lpString="*.jpg") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpeg") returned 0
	[0069.112] lstrlenA (lpString="*.jpeg") returned 6
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.psd") returned 0
	[0069.112] lstrlenA (lpString="*.psd") returned 5
	[0069.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.cdr") returned 0
	[0069.112] lstrlenA (lpString="*.cdr") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.dwg") returned 0
	[0069.113] lstrlenA (lpString="*.dwg") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.max") returned 0
	[0069.113] lstrlenA (lpString="*.max") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.bmp") returned 0
	[0069.113] lstrlenA (lpString="*.bmp") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.gif") returned 0
	[0069.113] lstrlenA (lpString="*.gif") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.png") returned 0
	[0069.113] lstrlenA (lpString="*.png") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.doc") returned 0
	[0069.113] lstrlenA (lpString="*.doc") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.docx") returned 0
	[0069.113] lstrlenA (lpString="*.docx") returned 6
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.xls") returned 0
	[0069.113] lstrlenA (lpString="*.xls") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.xlsx") returned 0
	[0069.113] lstrlenA (lpString="*.xlsx") returned 6
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ppt") returned 0
	[0069.113] lstrlenA (lpString="*.ppt") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pptx") returned 0
	[0069.113] lstrlenA (lpString="*.pptx") returned 6
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.txt") returned 0
	[0069.113] lstrlenA (lpString="*.txt") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pdf") returned 0
	[0069.113] lstrlenA (lpString="*.pdf") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.djvu") returned 0
	[0069.113] lstrlenA (lpString="*.djvu") returned 6
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.htm") returned 0
	[0069.113] lstrlenA (lpString="*.htm") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.html") returned 0
	[0069.113] lstrlenA (lpString="*.html") returned 6
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdb") returned 0
	[0069.113] lstrlenA (lpString="*.mdb") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.cer") returned 0
	[0069.113] lstrlenA (lpString="*.cer") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.p12") returned 0
	[0069.113] lstrlenA (lpString="*.p12") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pfx") returned 0
	[0069.113] lstrlenA (lpString="*.pfx") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.kwm") returned 0
	[0069.113] lstrlenA (lpString="*.kwm") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pwm") returned 0
	[0069.113] lstrlenA (lpString="*.pwm") returned 5
	[0069.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.1cd") returned 0
	[0069.113] lstrlenA (lpString="*.1cd") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.md") returned 0
	[0069.114] lstrlenA (lpString="*.md") returned 4
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdf") returned 0
	[0069.114] lstrlenA (lpString="*.mdf") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.dbf") returned 0
	[0069.114] lstrlenA (lpString="*.dbf") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.odt") returned 0
	[0069.114] lstrlenA (lpString="*.odt") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.vob") returned 0
	[0069.114] lstrlenA (lpString="*.vob") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ifo") returned 0
	[0069.114] lstrlenA (lpString="*.ifo") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.lnk") returned 0
	[0069.114] lstrlenA (lpString="*.lnk") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.torrent") returned 0
	[0069.114] lstrlenA (lpString="*.torrent") returned 9
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mov") returned 0
	[0069.114] lstrlenA (lpString="*.mov") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.m2v") returned 0
	[0069.114] lstrlenA (lpString="*.m2v") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.3gp") returned 0
	[0069.114] lstrlenA (lpString="*.3gp") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpeg") returned 0
	[0069.114] lstrlenA (lpString="*.mpeg") returned 6
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpg") returned 0
	[0069.114] lstrlenA (lpString="*.mpg") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.flv") returned 0
	[0069.114] lstrlenA (lpString="*.flv") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.avi") returned 0
	[0069.114] lstrlenA (lpString="*.avi") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp4") returned 0
	[0069.114] lstrlenA (lpString="*.mp4") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.wmv") returned 0
	[0069.114] lstrlenA (lpString="*.wmv") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.divx") returned 0
	[0069.114] lstrlenA (lpString="*.divx") returned 6
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mkv") returned 0
	[0069.114] lstrlenA (lpString="*.mkv") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp3") returned 0
	[0069.114] lstrlenA (lpString="*.mp3") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.wav") returned 0
	[0069.114] lstrlenA (lpString="*.wav") returned 5
	[0069.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.flac") returned 0
	[0069.114] lstrlenA (lpString="*.flac") returned 6
	[0069.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ape") returned 0
	[0069.115] lstrlenA (lpString="*.ape") returned 5
	[0069.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.wma") returned 0
	[0069.115] lstrlenA (lpString="*.wma") returned 5
	[0069.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ac3") returned 0
	[0069.115] lstrlenA (lpString="*.ac3") returned 5
	[0069.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.exe") returned 0
	[0069.115] lstrlenA (lpString="*.exe") returned 5
	[0069.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.apk") returned 0
	[0069.115] lstrlenA (lpString="*.apk") returned 5
	[0069.115] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0069.115] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0069.115] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.115] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.115] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.115] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*"
	[0069.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\"
	[0069.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned=""
	[0069.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt"
	[0069.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt")) returned 0xffffffff
	[0069.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0069.116] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0069.116] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0069.117] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.117] CloseHandle (hObject=0x90) returned 1
	[0069.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll"
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.zip") returned 0
	[0069.117] lstrlenA (lpString="*.zip") returned 5
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.rar") returned 0
	[0069.117] lstrlenA (lpString="*.rar") returned 5
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.7z") returned 0
	[0069.117] lstrlenA (lpString="*.7z") returned 4
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.tar") returned 0
	[0069.117] lstrlenA (lpString="*.tar") returned 5
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.gzip") returned 0
	[0069.117] lstrlenA (lpString="*.gzip") returned 6
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.jpg") returned 0
	[0069.117] lstrlenA (lpString="*.jpg") returned 5
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.jpeg") returned 0
	[0069.117] lstrlenA (lpString="*.jpeg") returned 6
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.psd") returned 0
	[0069.117] lstrlenA (lpString="*.psd") returned 5
	[0069.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.cdr") returned 0
	[0069.117] lstrlenA (lpString="*.cdr") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.dwg") returned 0
	[0069.118] lstrlenA (lpString="*.dwg") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.max") returned 0
	[0069.118] lstrlenA (lpString="*.max") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.bmp") returned 0
	[0069.118] lstrlenA (lpString="*.bmp") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.gif") returned 0
	[0069.118] lstrlenA (lpString="*.gif") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.png") returned 0
	[0069.118] lstrlenA (lpString="*.png") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.doc") returned 0
	[0069.118] lstrlenA (lpString="*.doc") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.docx") returned 0
	[0069.118] lstrlenA (lpString="*.docx") returned 6
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.xls") returned 0
	[0069.118] lstrlenA (lpString="*.xls") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.xlsx") returned 0
	[0069.118] lstrlenA (lpString="*.xlsx") returned 6
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.ppt") returned 0
	[0069.118] lstrlenA (lpString="*.ppt") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.pptx") returned 0
	[0069.118] lstrlenA (lpString="*.pptx") returned 6
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.txt") returned 0
	[0069.118] lstrlenA (lpString="*.txt") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.pdf") returned 0
	[0069.118] lstrlenA (lpString="*.pdf") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.djvu") returned 0
	[0069.118] lstrlenA (lpString="*.djvu") returned 6
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.htm") returned 0
	[0069.118] lstrlenA (lpString="*.htm") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.html") returned 0
	[0069.118] lstrlenA (lpString="*.html") returned 6
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mdb") returned 0
	[0069.118] lstrlenA (lpString="*.mdb") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.cer") returned 0
	[0069.118] lstrlenA (lpString="*.cer") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.p12") returned 0
	[0069.118] lstrlenA (lpString="*.p12") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.pfx") returned 0
	[0069.118] lstrlenA (lpString="*.pfx") returned 5
	[0069.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.kwm") returned 0
	[0069.118] lstrlenA (lpString="*.kwm") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.pwm") returned 0
	[0069.119] lstrlenA (lpString="*.pwm") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.1cd") returned 0
	[0069.119] lstrlenA (lpString="*.1cd") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.md") returned 0
	[0069.119] lstrlenA (lpString="*.md") returned 4
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mdf") returned 0
	[0069.119] lstrlenA (lpString="*.mdf") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.dbf") returned 0
	[0069.119] lstrlenA (lpString="*.dbf") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.odt") returned 0
	[0069.119] lstrlenA (lpString="*.odt") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.vob") returned 0
	[0069.119] lstrlenA (lpString="*.vob") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.ifo") returned 0
	[0069.119] lstrlenA (lpString="*.ifo") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.lnk") returned 0
	[0069.119] lstrlenA (lpString="*.lnk") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.torrent") returned 0
	[0069.119] lstrlenA (lpString="*.torrent") returned 9
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mov") returned 0
	[0069.119] lstrlenA (lpString="*.mov") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.m2v") returned 0
	[0069.119] lstrlenA (lpString="*.m2v") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.3gp") returned 0
	[0069.119] lstrlenA (lpString="*.3gp") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mpeg") returned 0
	[0069.119] lstrlenA (lpString="*.mpeg") returned 6
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mpg") returned 0
	[0069.119] lstrlenA (lpString="*.mpg") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.flv") returned 0
	[0069.119] lstrlenA (lpString="*.flv") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.avi") returned 0
	[0069.119] lstrlenA (lpString="*.avi") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mp4") returned 0
	[0069.119] lstrlenA (lpString="*.mp4") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.wmv") returned 0
	[0069.119] lstrlenA (lpString="*.wmv") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.divx") returned 0
	[0069.119] lstrlenA (lpString="*.divx") returned 6
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mkv") returned 0
	[0069.119] lstrlenA (lpString="*.mkv") returned 5
	[0069.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.mp3") returned 0
	[0069.120] lstrlenA (lpString="*.mp3") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.wav") returned 0
	[0069.120] lstrlenA (lpString="*.wav") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.flac") returned 0
	[0069.120] lstrlenA (lpString="*.flac") returned 6
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.ape") returned 0
	[0069.120] lstrlenA (lpString="*.ape") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.wma") returned 0
	[0069.120] lstrlenA (lpString="*.wma") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.ac3") returned 0
	[0069.120] lstrlenA (lpString="*.ac3") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.exe") returned 0
	[0069.120] lstrlenA (lpString="*.exe") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.apk") returned 0
	[0069.120] lstrlenA (lpString="*.apk") returned 5
	[0069.120] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.120] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.120] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.120] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll"
	[0069.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\"
	[0069.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned=""
	[0069.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt"
	[0069.120] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt")) returned 0x20
	[0069.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml"
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.zip") returned 0
	[0069.120] lstrlenA (lpString="*.zip") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.rar") returned 0
	[0069.120] lstrlenA (lpString="*.rar") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.7z") returned 0
	[0069.120] lstrlenA (lpString="*.7z") returned 4
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.tar") returned 0
	[0069.120] lstrlenA (lpString="*.tar") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.gzip") returned 0
	[0069.120] lstrlenA (lpString="*.gzip") returned 6
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpg") returned 0
	[0069.120] lstrlenA (lpString="*.jpg") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpeg") returned 0
	[0069.120] lstrlenA (lpString="*.jpeg") returned 6
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.psd") returned 0
	[0069.120] lstrlenA (lpString="*.psd") returned 5
	[0069.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.cdr") returned 0
	[0069.121] lstrlenA (lpString="*.cdr") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.dwg") returned 0
	[0069.121] lstrlenA (lpString="*.dwg") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.max") returned 0
	[0069.121] lstrlenA (lpString="*.max") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.bmp") returned 0
	[0069.121] lstrlenA (lpString="*.bmp") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.gif") returned 0
	[0069.121] lstrlenA (lpString="*.gif") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.png") returned 0
	[0069.121] lstrlenA (lpString="*.png") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.doc") returned 0
	[0069.121] lstrlenA (lpString="*.doc") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.docx") returned 0
	[0069.121] lstrlenA (lpString="*.docx") returned 6
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.xls") returned 0
	[0069.121] lstrlenA (lpString="*.xls") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.xlsx") returned 0
	[0069.121] lstrlenA (lpString="*.xlsx") returned 6
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.ppt") returned 0
	[0069.121] lstrlenA (lpString="*.ppt") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.pptx") returned 0
	[0069.121] lstrlenA (lpString="*.pptx") returned 6
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.txt") returned 0
	[0069.121] lstrlenA (lpString="*.txt") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.pdf") returned 0
	[0069.121] lstrlenA (lpString="*.pdf") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.djvu") returned 0
	[0069.121] lstrlenA (lpString="*.djvu") returned 6
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.htm") returned 0
	[0069.121] lstrlenA (lpString="*.htm") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.html") returned 0
	[0069.121] lstrlenA (lpString="*.html") returned 6
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdb") returned 0
	[0069.121] lstrlenA (lpString="*.mdb") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.cer") returned 0
	[0069.121] lstrlenA (lpString="*.cer") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.p12") returned 0
	[0069.121] lstrlenA (lpString="*.p12") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.pfx") returned 0
	[0069.121] lstrlenA (lpString="*.pfx") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.kwm") returned 0
	[0069.121] lstrlenA (lpString="*.kwm") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.pwm") returned 0
	[0069.121] lstrlenA (lpString="*.pwm") returned 5
	[0069.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.1cd") returned 0
	[0069.122] lstrlenA (lpString="*.1cd") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.md") returned 0
	[0069.122] lstrlenA (lpString="*.md") returned 4
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdf") returned 0
	[0069.122] lstrlenA (lpString="*.mdf") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.dbf") returned 0
	[0069.122] lstrlenA (lpString="*.dbf") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.odt") returned 0
	[0069.122] lstrlenA (lpString="*.odt") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.vob") returned 0
	[0069.122] lstrlenA (lpString="*.vob") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.ifo") returned 0
	[0069.122] lstrlenA (lpString="*.ifo") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.lnk") returned 0
	[0069.122] lstrlenA (lpString="*.lnk") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.torrent") returned 0
	[0069.122] lstrlenA (lpString="*.torrent") returned 9
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mov") returned 0
	[0069.122] lstrlenA (lpString="*.mov") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.m2v") returned 0
	[0069.122] lstrlenA (lpString="*.m2v") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.3gp") returned 0
	[0069.122] lstrlenA (lpString="*.3gp") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpeg") returned 0
	[0069.122] lstrlenA (lpString="*.mpeg") returned 6
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpg") returned 0
	[0069.122] lstrlenA (lpString="*.mpg") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.flv") returned 0
	[0069.122] lstrlenA (lpString="*.flv") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.avi") returned 0
	[0069.122] lstrlenA (lpString="*.avi") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp4") returned 0
	[0069.122] lstrlenA (lpString="*.mp4") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.wmv") returned 0
	[0069.122] lstrlenA (lpString="*.wmv") returned 5
	[0069.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.divx") returned 0
	[0069.122] lstrlenA (lpString="*.divx") returned 6
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mkv") returned 0
	[0069.123] lstrlenA (lpString="*.mkv") returned 5
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp3") returned 0
	[0069.123] lstrlenA (lpString="*.mp3") returned 5
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.wav") returned 0
	[0069.123] lstrlenA (lpString="*.wav") returned 5
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.flac") returned 0
	[0069.123] lstrlenA (lpString="*.flac") returned 6
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.ape") returned 0
	[0069.123] lstrlenA (lpString="*.ape") returned 5
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.wma") returned 0
	[0069.123] lstrlenA (lpString="*.wma") returned 5
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.ac3") returned 0
	[0069.123] lstrlenA (lpString="*.ac3") returned 5
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.exe") returned 0
	[0069.123] lstrlenA (lpString="*.exe") returned 5
	[0069.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.apk") returned 0
	[0069.123] lstrlenA (lpString="*.apk") returned 5
	[0069.123] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0069.123] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0069.123] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.123] lstrcmpA (lpString1=".", lpString2="InfoPathOMV12") returned -1
	[0069.123] lstrcmpA (lpString1="..", lpString2="InfoPathOMV12") returned -1
	[0069.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*"
	[0069.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12"
	[0069.123] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned 67
	[0069.123] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0069.124] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.124] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.124] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.124] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.124] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.124] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.124] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.124] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*") returned="*.*"
	[0069.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\"
	[0069.124] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned=""
	[0069.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt"
	[0069.124] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt")) returned 0xffffffff
	[0069.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0069.126] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0069.126] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0069.127] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.127] CloseHandle (hObject=0x90) returned 1
	[0069.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll"
	[0069.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.zip") returned 0
	[0069.127] lstrlenA (lpString="*.zip") returned 5
	[0069.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.rar") returned 0
	[0069.127] lstrlenA (lpString="*.rar") returned 5
	[0069.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.7z") returned 0
	[0069.127] lstrlenA (lpString="*.7z") returned 4
	[0069.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.tar") returned 0
	[0069.127] lstrlenA (lpString="*.tar") returned 5
	[0069.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.gzip") returned 0
	[0069.128] lstrlenA (lpString="*.gzip") returned 6
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.jpg") returned 0
	[0069.128] lstrlenA (lpString="*.jpg") returned 5
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.jpeg") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.psd") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.cdr") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.dwg") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.max") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.bmp") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.gif") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.png") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.doc") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.docx") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.xls") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.xlsx") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ppt") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pptx") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.txt") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pdf") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.djvu") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.htm") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.html") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mdb") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.cer") returned 0
	[0069.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.p12") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pfx") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.kwm") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.pwm") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.1cd") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.md") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mdf") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.dbf") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.odt") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.vob") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ifo") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.lnk") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.torrent") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mov") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.m2v") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.3gp") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mpeg") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mpg") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.flv") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.avi") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mp4") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.wmv") returned 0
	[0069.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.divx") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mkv") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.mp3") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.wav") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.flac") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ape") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.wma") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ac3") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.exe") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.apk") returned 0
	[0069.130] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.130] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.130] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.130] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll"
	[0069.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\"
	[0069.130] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned=""
	[0069.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt"
	[0069.130] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt")) returned 0x20
	[0069.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml"
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.zip") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.rar") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.7z") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.tar") returned 0
	[0069.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.gzip") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpg") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpeg") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.psd") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.cdr") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.dwg") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.max") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.bmp") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.gif") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.png") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.doc") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.docx") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.xls") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.xlsx") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ppt") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pptx") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.txt") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pdf") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.djvu") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.htm") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.html") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdb") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.cer") returned 0
	[0069.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.p12") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pfx") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.kwm") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.pwm") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.1cd") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.md") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdf") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.dbf") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.odt") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.vob") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ifo") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.lnk") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.torrent") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mov") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.m2v") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.3gp") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpeg") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpg") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.flv") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.avi") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp4") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.wmv") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.divx") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mkv") returned 0
	[0069.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp3") returned 0
	[0069.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.wav") returned 0
	[0069.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.flac") returned 0
	[0069.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ape") returned 0
	[0069.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.wma") returned 0
	[0069.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ac3") returned 0
	[0069.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.exe") returned 0
	[0069.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.apk") returned 0
	[0069.133] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0069.133] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0069.133] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.133] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1
	[0069.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*"
	[0069.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\"
	[0069.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned=""
	[0069.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt"
	[0069.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt")) returned 0xffffffff
	[0069.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.134] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0069.135] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.135] CloseHandle (hObject=0x8c) returned 1
	[0069.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll"
	[0069.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.zip") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.rar") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.7z") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.tar") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.gzip") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.jpg") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.jpeg") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.psd") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.cdr") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.dwg") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.max") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.bmp") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.gif") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.png") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.doc") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.docx") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.xls") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.xlsx") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.ppt") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.pptx") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.txt") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.pdf") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.djvu") returned 0
	[0069.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.htm") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.html") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mdb") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.cer") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.p12") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.pfx") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.kwm") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.pwm") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.1cd") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.md") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mdf") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.dbf") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.odt") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.vob") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.ifo") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.lnk") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.torrent") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mov") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.m2v") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.3gp") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mpeg") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mpg") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.flv") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.avi") returned 0
	[0069.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mp4") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.wmv") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.divx") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mkv") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.mp3") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.wav") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.flac") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.ape") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.wma") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.ac3") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.exe") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.apk") returned 0
	[0069.138] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.138] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.138] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.138] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1
	[0069.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll"
	[0069.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\"
	[0069.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned=""
	[0069.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt"
	[0069.138] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt")) returned 0x20
	[0069.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml"
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.zip") returned 0
	[0069.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.rar") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.7z") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.tar") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.gzip") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpg") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.jpeg") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.psd") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.cdr") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.dwg") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.max") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.bmp") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.gif") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.png") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.doc") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.docx") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.xls") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.xlsx") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.ppt") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.pptx") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.txt") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.pdf") returned 0
	[0069.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.djvu") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.htm") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.html") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdb") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.cer") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.p12") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.pfx") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.kwm") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.pwm") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.1cd") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.md") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mdf") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.dbf") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.odt") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.vob") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.ifo") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.lnk") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.torrent") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mov") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.m2v") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.3gp") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpeg") returned 0
	[0069.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mpg") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.flv") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.avi") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp4") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.wmv") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.divx") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mkv") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.mp3") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.wav") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.flac") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.ape") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.wma") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.ac3") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.exe") returned 0
	[0069.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.apk") returned 0
	[0069.141] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0069.141] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0069.141] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.141] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.141] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INLAUNCH.DLL") returned -1
	[0069.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INLAUNCH.DLL") returned -1
	[0069.141] lstrcmpiA (lpString1="", lpString2="INLAUNCH.DLL") returned -1
	[0069.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0069.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.141] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INLAUNCH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL"
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.zip") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.rar") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.7z") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.tar") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.gzip") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.jpg") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.jpeg") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.psd") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.cdr") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.dwg") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.max") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.bmp") returned 0
	[0069.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.gif") returned 0
	[0069.142] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.142] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.142] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Installed_resources14.xss") returned -1
	[0069.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_resources14.xss") returned -1
	[0069.142] lstrcmpiA (lpString1="", lpString2="Installed_resources14.xss") returned -1
	[0069.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="INLAUNCH.DLL"
	[0069.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_resources14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss"
	[0069.143] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Installed_schemas14.xss") returned -1
	[0069.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_schemas14.xss") returned -1
	[0069.143] lstrcmpiA (lpString1="", lpString2="Installed_schemas14.xss") returned -1
	[0069.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="Installed_resources14.xss"
	[0069.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_schemas14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss"
	[0069.143] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INTLDATE.DLL") returned -1
	[0069.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INTLDATE.DLL") returned -1
	[0069.143] lstrcmpiA (lpString1="", lpString2="INTLDATE.DLL") returned -1
	[0069.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="Installed_schemas14.xss"
	[0069.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INTLDATE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL"
	[0069.143] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPDESIGN.DLL") returned -1
	[0069.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPDESIGN.DLL") returned -1
	[0069.143] lstrcmpiA (lpString1="", lpString2="IPDESIGN.DLL") returned -1
	[0069.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="INTLDATE.DLL"
	[0069.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPDESIGN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL"
	[0069.144] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.144] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPEDITOR.DLL") returned -1
	[0069.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPEDITOR.DLL") returned -1
	[0069.144] lstrcmpiA (lpString1="", lpString2="IPEDITOR.DLL") returned -1
	[0069.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="IPDESIGN.DLL"
	[0069.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPEDITOR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL"
	[0069.144] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.144] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPIRM.XML") returned -1
	[0069.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRM.XML") returned -1
	[0069.144] lstrcmpiA (lpString1="", lpString2="IPIRM.XML") returned -1
	[0069.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="IPEDITOR.DLL"
	[0069.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML"
	[0069.144] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.144] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPIRMV.XML") returned -1
	[0069.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRMV.XML") returned -1
	[0069.144] lstrcmpiA (lpString1="", lpString2="IPIRMV.XML") returned -1
	[0069.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="IPIRM.XML"
	[0069.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML"
	[0069.145] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.145] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.145] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPOLK.DLL") returned -1
	[0069.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPOLK.DLL") returned -1
	[0069.145] lstrcmpiA (lpString1="", lpString2="IPOLK.DLL") returned -1
	[0069.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="IPIRMV.XML"
	[0069.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPOLK.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL"
	[0069.145] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.145] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.145] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXACS.PDL") returned -1
	[0069.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXACS.PDL") returned -1
	[0069.145] lstrcmpiA (lpString1="", lpString2="IXACS.PDL") returned -1
	[0069.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="IPOLK.DLL"
	[0069.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXACS.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL"
	[0069.145] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.145] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.145] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXDB2.PDL") returned -1
	[0069.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXDB2.PDL") returned -1
	[0069.145] lstrcmpiA (lpString1="", lpString2="IXDB2.PDL") returned -1
	[0069.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="IXACS.PDL"
	[0069.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXDB2.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL"
	[0069.146] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.146] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXGENERC.PDL") returned -1
	[0069.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXGENERC.PDL") returned -1
	[0069.146] lstrcmpiA (lpString1="", lpString2="IXGENERC.PDL") returned -1
	[0069.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="IXDB2.PDL"
	[0069.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXGENERC.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL"
	[0069.146] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.146] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXOLEDB.PDL") returned -1
	[0069.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXOLEDB.PDL") returned -1
	[0069.146] lstrcmpiA (lpString1="", lpString2="IXOLEDB.PDL") returned -1
	[0069.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="IXGENERC.PDL"
	[0069.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXOLEDB.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL"
	[0069.146] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.146] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXORACLE.PDL") returned -1
	[0069.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXORACLE.PDL") returned -1
	[0069.147] lstrcmpiA (lpString1="", lpString2="IXORACLE.PDL") returned -1
	[0069.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="IXOLEDB.PDL"
	[0069.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXORACLE.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL"
	[0069.147] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.147] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXSSRV.PDL") returned -1
	[0069.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXSSRV.PDL") returned -1
	[0069.147] lstrcmpiA (lpString1="", lpString2="IXSSRV.PDL") returned -1
	[0069.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="IXORACLE.PDL"
	[0069.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXSSRV.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL"
	[0069.147] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.147] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXUTIL.DLL") returned -1
	[0069.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXUTIL.DLL") returned -1
	[0069.147] lstrcmpiA (lpString1="", lpString2="IXUTIL.DLL") returned -1
	[0069.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="IXSSRV.PDL"
	[0069.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL"
	[0069.147] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.147] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JFONT.DAT") returned -1
	[0069.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JFONT.DAT") returned -1
	[0069.148] lstrcmpiA (lpString1="", lpString2="JFONT.DAT") returned -1
	[0069.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="IXUTIL.DLL"
	[0069.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="JFONT.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT"
	[0069.148] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.148] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.148] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LATIN1.SHP") returned -1
	[0069.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LATIN1.SHP") returned -1
	[0069.148] lstrcmpiA (lpString1="", lpString2="LATIN1.SHP") returned -1
	[0069.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="JFONT.DAT"
	[0069.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LATIN1.SHP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP"
	[0069.148] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.148] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.148] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LGND.DLL") returned -1
	[0069.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LGND.DLL") returned -1
	[0069.148] lstrcmpiA (lpString1="", lpString2="LGND.DLL") returned -1
	[0069.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="LATIN1.SHP"
	[0069.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LGND.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL"
	[0069.148] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.148] lstrcmpA (lpString1=".", lpString2="Library") returned -1
	[0069.148] lstrcmpA (lpString1="..", lpString2="Library") returned -1
	[0069.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="LGND.DLL"
	[0069.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Library" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library"
	[0069.149] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0069.149] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.149] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.149] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.149] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.149] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.149] lstrcmpA (lpString1=".", lpString2="Analysis") returned -1
	[0069.149] lstrcmpA (lpString1="..", lpString2="Analysis") returned -1
	[0069.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*"
	[0069.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="Analysis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis"
	[0069.149] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned 59
	[0069.149] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0069.165] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.165] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.165] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.165] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.165] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.165] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.165] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ANALYS32.XLL") returned 1
	[0069.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ANALYS32.XLL") returned 1
	[0069.165] lstrcmpiA (lpString1="", lpString2="ANALYS32.XLL") returned -1
	[0069.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*") returned="*.*"
	[0069.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\"
	[0069.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned=""
	[0069.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt"
	[0069.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0xffffffff
	[0069.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0069.166] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0069.166] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0069.167] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.167] CloseHandle (hObject=0x90) returned 1
	[0069.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ANALYS32.XLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL"
	[0069.167] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.167] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ATPVBAEN.XLAM") returned 1
	[0069.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ATPVBAEN.XLAM") returned 1
	[0069.167] lstrcmpiA (lpString1="", lpString2="ATPVBAEN.XLAM") returned -1
	[0069.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="ANALYS32.XLL"
	[0069.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\"
	[0069.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned=""
	[0069.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt"
	[0069.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20
	[0069.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ATPVBAEN.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM"
	[0069.168] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.168] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FUNCRES.XLAM") returned -1
	[0069.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FUNCRES.XLAM") returned 1
	[0069.168] lstrcmpiA (lpString1="", lpString2="FUNCRES.XLAM") returned -1
	[0069.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="ATPVBAEN.XLAM"
	[0069.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\"
	[0069.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned=""
	[0069.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt"
	[0069.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20
	[0069.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="FUNCRES.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM"
	[0069.168] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.168] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PROCDB.XLAM") returned -1
	[0069.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROCDB.XLAM") returned -1
	[0069.168] lstrcmpiA (lpString1="", lpString2="PROCDB.XLAM") returned -1
	[0069.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="FUNCRES.XLAM"
	[0069.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\"
	[0069.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned=""
	[0069.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt"
	[0069.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20
	[0069.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="PROCDB.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM"
	[0069.168] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0069.168] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0069.168] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.168] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EUROTOOL.XLAM") returned -1
	[0069.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EUROTOOL.XLAM") returned 1
	[0069.168] lstrcmpiA (lpString1="", lpString2="EUROTOOL.XLAM") returned -1
	[0069.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*"
	[0069.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\"
	[0069.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned=""
	[0069.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt"
	[0069.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to decrypt files.txt")) returned 0xffffffff
	[0069.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.169] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0069.169] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0069.170] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.170] CloseHandle (hObject=0x8c) returned 1
	[0069.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="EUROTOOL.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM"
	[0069.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.zip") returned 0
	[0069.170] lstrlenA (lpString="*.zip") returned 5
	[0069.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.rar") returned 0
	[0069.170] lstrlenA (lpString="*.rar") returned 5
	[0069.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.7z") returned 0
	[0069.170] lstrlenA (lpString="*.7z") returned 4
	[0069.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.tar") returned 0
	[0069.170] lstrlenA (lpString="*.tar") returned 5
	[0069.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.gzip") returned 0
	[0069.170] lstrlenA (lpString="*.gzip") returned 6
	[0069.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.jpg") returned 0
	[0069.170] lstrlenA (lpString="*.jpg") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.jpeg") returned 0
	[0069.171] lstrlenA (lpString="*.jpeg") returned 6
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.psd") returned 0
	[0069.171] lstrlenA (lpString="*.psd") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.cdr") returned 0
	[0069.171] lstrlenA (lpString="*.cdr") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.dwg") returned 0
	[0069.171] lstrlenA (lpString="*.dwg") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.max") returned 0
	[0069.171] lstrlenA (lpString="*.max") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.bmp") returned 0
	[0069.171] lstrlenA (lpString="*.bmp") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.gif") returned 0
	[0069.171] lstrlenA (lpString="*.gif") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.png") returned 0
	[0069.171] lstrlenA (lpString="*.png") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.doc") returned 0
	[0069.171] lstrlenA (lpString="*.doc") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.docx") returned 0
	[0069.171] lstrlenA (lpString="*.docx") returned 6
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.xls") returned 0
	[0069.171] lstrlenA (lpString="*.xls") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.xlsx") returned 0
	[0069.171] lstrlenA (lpString="*.xlsx") returned 6
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.ppt") returned 0
	[0069.171] lstrlenA (lpString="*.ppt") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.pptx") returned 0
	[0069.171] lstrlenA (lpString="*.pptx") returned 6
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.txt") returned 0
	[0069.171] lstrlenA (lpString="*.txt") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.pdf") returned 0
	[0069.171] lstrlenA (lpString="*.pdf") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.djvu") returned 0
	[0069.171] lstrlenA (lpString="*.djvu") returned 6
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.htm") returned 0
	[0069.171] lstrlenA (lpString="*.htm") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.html") returned 0
	[0069.171] lstrlenA (lpString="*.html") returned 6
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mdb") returned 0
	[0069.171] lstrlenA (lpString="*.mdb") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.cer") returned 0
	[0069.171] lstrlenA (lpString="*.cer") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.p12") returned 0
	[0069.171] lstrlenA (lpString="*.p12") returned 5
	[0069.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.pfx") returned 0
	[0069.171] lstrlenA (lpString="*.pfx") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.kwm") returned 0
	[0069.172] lstrlenA (lpString="*.kwm") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.pwm") returned 0
	[0069.172] lstrlenA (lpString="*.pwm") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.1cd") returned 0
	[0069.172] lstrlenA (lpString="*.1cd") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.md") returned 0
	[0069.172] lstrlenA (lpString="*.md") returned 4
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mdf") returned 0
	[0069.172] lstrlenA (lpString="*.mdf") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.dbf") returned 0
	[0069.172] lstrlenA (lpString="*.dbf") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.odt") returned 0
	[0069.172] lstrlenA (lpString="*.odt") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.vob") returned 0
	[0069.172] lstrlenA (lpString="*.vob") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.ifo") returned 0
	[0069.172] lstrlenA (lpString="*.ifo") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.lnk") returned 0
	[0069.172] lstrlenA (lpString="*.lnk") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.torrent") returned 0
	[0069.172] lstrlenA (lpString="*.torrent") returned 9
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mov") returned 0
	[0069.172] lstrlenA (lpString="*.mov") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.m2v") returned 0
	[0069.172] lstrlenA (lpString="*.m2v") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.3gp") returned 0
	[0069.172] lstrlenA (lpString="*.3gp") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mpeg") returned 0
	[0069.172] lstrlenA (lpString="*.mpeg") returned 6
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mpg") returned 0
	[0069.172] lstrlenA (lpString="*.mpg") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.flv") returned 0
	[0069.172] lstrlenA (lpString="*.flv") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.avi") returned 0
	[0069.172] lstrlenA (lpString="*.avi") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mp4") returned 0
	[0069.172] lstrlenA (lpString="*.mp4") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.wmv") returned 0
	[0069.172] lstrlenA (lpString="*.wmv") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.divx") returned 0
	[0069.172] lstrlenA (lpString="*.divx") returned 6
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mkv") returned 0
	[0069.172] lstrlenA (lpString="*.mkv") returned 5
	[0069.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mp3") returned 0
	[0069.172] lstrlenA (lpString="*.mp3") returned 5
	[0069.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.wav") returned 0
	[0069.173] lstrlenA (lpString="*.wav") returned 5
	[0069.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.flac") returned 0
	[0069.173] lstrlenA (lpString="*.flac") returned 6
	[0069.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.ape") returned 0
	[0069.173] lstrlenA (lpString="*.ape") returned 5
	[0069.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.wma") returned 0
	[0069.173] lstrlenA (lpString="*.wma") returned 5
	[0069.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.ac3") returned 0
	[0069.173] lstrlenA (lpString="*.ac3") returned 5
	[0069.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.exe") returned 0
	[0069.173] lstrlenA (lpString="*.exe") returned 5
	[0069.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.apk") returned 0
	[0069.173] lstrlenA (lpString="*.apk") returned 5
	[0069.173] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.173] lstrcmpA (lpString1=".", lpString2="SOLVER") returned -1
	[0069.173] lstrcmpA (lpString1="..", lpString2="SOLVER") returned -1
	[0069.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="EUROTOOL.XLAM"
	[0069.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="SOLVER" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER"
	[0069.173] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned 57
	[0069.173] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0069.174] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.174] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.174] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.174] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.174] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.174] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.174] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SOLVER.XLAM") returned -1
	[0069.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOLVER.XLAM") returned -1
	[0069.174] lstrcmpiA (lpString1="", lpString2="SOLVER.XLAM") returned -1
	[0069.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*") returned="*.*"
	[0069.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\"
	[0069.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned=""
	[0069.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt"
	[0069.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt")) returned 0xffffffff
	[0069.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0069.175] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0069.175] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0069.175] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.175] CloseHandle (hObject=0x90) returned 1
	[0069.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM"
	[0069.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.zip") returned 0
	[0069.175] lstrlenA (lpString="*.zip") returned 5
	[0069.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.rar") returned 0
	[0069.175] lstrlenA (lpString="*.rar") returned 5
	[0069.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.7z") returned 0
	[0069.175] lstrlenA (lpString="*.7z") returned 4
	[0069.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.tar") returned 0
	[0069.176] lstrlenA (lpString="*.tar") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.gzip") returned 0
	[0069.176] lstrlenA (lpString="*.gzip") returned 6
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.jpg") returned 0
	[0069.176] lstrlenA (lpString="*.jpg") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.jpeg") returned 0
	[0069.176] lstrlenA (lpString="*.jpeg") returned 6
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.psd") returned 0
	[0069.176] lstrlenA (lpString="*.psd") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.cdr") returned 0
	[0069.176] lstrlenA (lpString="*.cdr") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.dwg") returned 0
	[0069.176] lstrlenA (lpString="*.dwg") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.max") returned 0
	[0069.176] lstrlenA (lpString="*.max") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.bmp") returned 0
	[0069.176] lstrlenA (lpString="*.bmp") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.gif") returned 0
	[0069.176] lstrlenA (lpString="*.gif") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.png") returned 0
	[0069.176] lstrlenA (lpString="*.png") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.doc") returned 0
	[0069.176] lstrlenA (lpString="*.doc") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.docx") returned 0
	[0069.176] lstrlenA (lpString="*.docx") returned 6
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.xls") returned 0
	[0069.176] lstrlenA (lpString="*.xls") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.xlsx") returned 0
	[0069.176] lstrlenA (lpString="*.xlsx") returned 6
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.ppt") returned 0
	[0069.176] lstrlenA (lpString="*.ppt") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.pptx") returned 0
	[0069.176] lstrlenA (lpString="*.pptx") returned 6
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.txt") returned 0
	[0069.176] lstrlenA (lpString="*.txt") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.pdf") returned 0
	[0069.176] lstrlenA (lpString="*.pdf") returned 5
	[0069.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.djvu") returned 0
	[0069.177] lstrlenA (lpString="*.djvu") returned 6
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.htm") returned 0
	[0069.177] lstrlenA (lpString="*.htm") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.html") returned 0
	[0069.177] lstrlenA (lpString="*.html") returned 6
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mdb") returned 0
	[0069.177] lstrlenA (lpString="*.mdb") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.cer") returned 0
	[0069.177] lstrlenA (lpString="*.cer") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.p12") returned 0
	[0069.177] lstrlenA (lpString="*.p12") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.pfx") returned 0
	[0069.177] lstrlenA (lpString="*.pfx") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.kwm") returned 0
	[0069.177] lstrlenA (lpString="*.kwm") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.pwm") returned 0
	[0069.177] lstrlenA (lpString="*.pwm") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.1cd") returned 0
	[0069.177] lstrlenA (lpString="*.1cd") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.md") returned 0
	[0069.177] lstrlenA (lpString="*.md") returned 4
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mdf") returned 0
	[0069.177] lstrlenA (lpString="*.mdf") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.dbf") returned 0
	[0069.177] lstrlenA (lpString="*.dbf") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.odt") returned 0
	[0069.177] lstrlenA (lpString="*.odt") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.vob") returned 0
	[0069.177] lstrlenA (lpString="*.vob") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.ifo") returned 0
	[0069.177] lstrlenA (lpString="*.ifo") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.lnk") returned 0
	[0069.177] lstrlenA (lpString="*.lnk") returned 5
	[0069.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.torrent") returned 0
	[0069.178] lstrlenA (lpString="*.torrent") returned 9
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mov") returned 0
	[0069.178] lstrlenA (lpString="*.mov") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.m2v") returned 0
	[0069.178] lstrlenA (lpString="*.m2v") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.3gp") returned 0
	[0069.178] lstrlenA (lpString="*.3gp") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mpeg") returned 0
	[0069.178] lstrlenA (lpString="*.mpeg") returned 6
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mpg") returned 0
	[0069.178] lstrlenA (lpString="*.mpg") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.flv") returned 0
	[0069.178] lstrlenA (lpString="*.flv") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.avi") returned 0
	[0069.178] lstrlenA (lpString="*.avi") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mp4") returned 0
	[0069.178] lstrlenA (lpString="*.mp4") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.wmv") returned 0
	[0069.178] lstrlenA (lpString="*.wmv") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.divx") returned 0
	[0069.178] lstrlenA (lpString="*.divx") returned 6
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mkv") returned 0
	[0069.178] lstrlenA (lpString="*.mkv") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mp3") returned 0
	[0069.178] lstrlenA (lpString="*.mp3") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.wav") returned 0
	[0069.178] lstrlenA (lpString="*.wav") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.flac") returned 0
	[0069.178] lstrlenA (lpString="*.flac") returned 6
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.ape") returned 0
	[0069.178] lstrlenA (lpString="*.ape") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.wma") returned 0
	[0069.178] lstrlenA (lpString="*.wma") returned 5
	[0069.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.ac3") returned 0
	[0069.178] lstrlenA (lpString="*.ac3") returned 5
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.exe") returned 0
	[0069.179] lstrlenA (lpString="*.exe") returned 5
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.apk") returned 0
	[0069.179] lstrlenA (lpString="*.apk") returned 5
	[0069.179] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0069.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0069.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SOLVER32.DLL") returned -1
	[0069.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOLVER32.DLL") returned -1
	[0069.179] lstrcmpiA (lpString1="", lpString2="SOLVER32.DLL") returned -1
	[0069.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="SOLVER.XLAM"
	[0069.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\"
	[0069.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned=""
	[0069.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt"
	[0069.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt")) returned 0x20
	[0069.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL"
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.zip") returned 0
	[0069.179] lstrlenA (lpString="*.zip") returned 5
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.rar") returned 0
	[0069.179] lstrlenA (lpString="*.rar") returned 5
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.7z") returned 0
	[0069.179] lstrlenA (lpString="*.7z") returned 4
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.tar") returned 0
	[0069.179] lstrlenA (lpString="*.tar") returned 5
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.gzip") returned 0
	[0069.179] lstrlenA (lpString="*.gzip") returned 6
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.jpg") returned 0
	[0069.179] lstrlenA (lpString="*.jpg") returned 5
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.jpeg") returned 0
	[0069.179] lstrlenA (lpString="*.jpeg") returned 6
	[0069.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.psd") returned 0
	[0069.180] lstrlenA (lpString="*.psd") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.cdr") returned 0
	[0069.180] lstrlenA (lpString="*.cdr") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.dwg") returned 0
	[0069.180] lstrlenA (lpString="*.dwg") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.max") returned 0
	[0069.180] lstrlenA (lpString="*.max") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.bmp") returned 0
	[0069.180] lstrlenA (lpString="*.bmp") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.gif") returned 0
	[0069.180] lstrlenA (lpString="*.gif") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.png") returned 0
	[0069.180] lstrlenA (lpString="*.png") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.doc") returned 0
	[0069.180] lstrlenA (lpString="*.doc") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.docx") returned 0
	[0069.180] lstrlenA (lpString="*.docx") returned 6
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.xls") returned 0
	[0069.180] lstrlenA (lpString="*.xls") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.xlsx") returned 0
	[0069.180] lstrlenA (lpString="*.xlsx") returned 6
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.ppt") returned 0
	[0069.180] lstrlenA (lpString="*.ppt") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.pptx") returned 0
	[0069.180] lstrlenA (lpString="*.pptx") returned 6
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.txt") returned 0
	[0069.180] lstrlenA (lpString="*.txt") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.pdf") returned 0
	[0069.180] lstrlenA (lpString="*.pdf") returned 5
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.djvu") returned 0
	[0069.180] lstrlenA (lpString="*.djvu") returned 6
	[0069.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.htm") returned 0
	[0069.181] lstrlenA (lpString="*.htm") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.html") returned 0
	[0069.181] lstrlenA (lpString="*.html") returned 6
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mdb") returned 0
	[0069.181] lstrlenA (lpString="*.mdb") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.cer") returned 0
	[0069.181] lstrlenA (lpString="*.cer") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.p12") returned 0
	[0069.181] lstrlenA (lpString="*.p12") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.pfx") returned 0
	[0069.181] lstrlenA (lpString="*.pfx") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.kwm") returned 0
	[0069.181] lstrlenA (lpString="*.kwm") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.pwm") returned 0
	[0069.181] lstrlenA (lpString="*.pwm") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.1cd") returned 0
	[0069.181] lstrlenA (lpString="*.1cd") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.md") returned 0
	[0069.181] lstrlenA (lpString="*.md") returned 4
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mdf") returned 0
	[0069.181] lstrlenA (lpString="*.mdf") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.dbf") returned 0
	[0069.181] lstrlenA (lpString="*.dbf") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.odt") returned 0
	[0069.181] lstrlenA (lpString="*.odt") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.vob") returned 0
	[0069.181] lstrlenA (lpString="*.vob") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.ifo") returned 0
	[0069.181] lstrlenA (lpString="*.ifo") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.lnk") returned 0
	[0069.181] lstrlenA (lpString="*.lnk") returned 5
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.torrent") returned 0
	[0069.181] lstrlenA (lpString="*.torrent") returned 9
	[0069.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mov") returned 0
	[0069.181] lstrlenA (lpString="*.mov") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.m2v") returned 0
	[0069.182] lstrlenA (lpString="*.m2v") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.3gp") returned 0
	[0069.182] lstrlenA (lpString="*.3gp") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mpeg") returned 0
	[0069.182] lstrlenA (lpString="*.mpeg") returned 6
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mpg") returned 0
	[0069.182] lstrlenA (lpString="*.mpg") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.flv") returned 0
	[0069.182] lstrlenA (lpString="*.flv") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.avi") returned 0
	[0069.182] lstrlenA (lpString="*.avi") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mp4") returned 0
	[0069.182] lstrlenA (lpString="*.mp4") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.wmv") returned 0
	[0069.182] lstrlenA (lpString="*.wmv") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.divx") returned 0
	[0069.182] lstrlenA (lpString="*.divx") returned 6
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mkv") returned 0
	[0069.182] lstrlenA (lpString="*.mkv") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mp3") returned 0
	[0069.182] lstrlenA (lpString="*.mp3") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.wav") returned 0
	[0069.182] lstrlenA (lpString="*.wav") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.flac") returned 0
	[0069.182] lstrlenA (lpString="*.flac") returned 6
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.ape") returned 0
	[0069.182] lstrlenA (lpString="*.ape") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.wma") returned 0
	[0069.182] lstrlenA (lpString="*.wma") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.ac3") returned 0
	[0069.182] lstrlenA (lpString="*.ac3") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.exe") returned 0
	[0069.182] lstrlenA (lpString="*.exe") returned 5
	[0069.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.apk") returned 0
	[0069.182] lstrlenA (lpString="*.apk") returned 5
	[0069.183] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0069.183] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0069.183] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0069.183] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0069.183] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.183] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.183] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LOGELEMS.DLL") returned -1
	[0069.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGELEMS.DLL") returned -1
	[0069.183] lstrcmpiA (lpString1="", lpString2="LOGELEMS.DLL") returned -1
	[0069.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0069.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGELEMS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL"
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.zip") returned 0
	[0069.183] lstrlenA (lpString="*.zip") returned 5
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.rar") returned 0
	[0069.183] lstrlenA (lpString="*.rar") returned 5
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.7z") returned 0
	[0069.183] lstrlenA (lpString="*.7z") returned 4
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.tar") returned 0
	[0069.183] lstrlenA (lpString="*.tar") returned 5
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.gzip") returned 0
	[0069.183] lstrlenA (lpString="*.gzip") returned 6
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.jpg") returned 0
	[0069.183] lstrlenA (lpString="*.jpg") returned 5
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.jpeg") returned 0
	[0069.183] lstrlenA (lpString="*.jpeg") returned 6
	[0069.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.psd") returned 0
	[0069.183] lstrlenA (lpString="*.psd") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.cdr") returned 0
	[0069.184] lstrlenA (lpString="*.cdr") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.dwg") returned 0
	[0069.184] lstrlenA (lpString="*.dwg") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.max") returned 0
	[0069.184] lstrlenA (lpString="*.max") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.bmp") returned 0
	[0069.184] lstrlenA (lpString="*.bmp") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.gif") returned 0
	[0069.184] lstrlenA (lpString="*.gif") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.png") returned 0
	[0069.184] lstrlenA (lpString="*.png") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.doc") returned 0
	[0069.184] lstrlenA (lpString="*.doc") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.docx") returned 0
	[0069.184] lstrlenA (lpString="*.docx") returned 6
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.xls") returned 0
	[0069.184] lstrlenA (lpString="*.xls") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.xlsx") returned 0
	[0069.184] lstrlenA (lpString="*.xlsx") returned 6
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.ppt") returned 0
	[0069.184] lstrlenA (lpString="*.ppt") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.pptx") returned 0
	[0069.184] lstrlenA (lpString="*.pptx") returned 6
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.txt") returned 0
	[0069.184] lstrlenA (lpString="*.txt") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.pdf") returned 0
	[0069.184] lstrlenA (lpString="*.pdf") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.djvu") returned 0
	[0069.184] lstrlenA (lpString="*.djvu") returned 6
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.htm") returned 0
	[0069.184] lstrlenA (lpString="*.htm") returned 5
	[0069.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.html") returned 0
	[0069.185] lstrlenA (lpString="*.html") returned 6
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mdb") returned 0
	[0069.185] lstrlenA (lpString="*.mdb") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.cer") returned 0
	[0069.185] lstrlenA (lpString="*.cer") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.p12") returned 0
	[0069.185] lstrlenA (lpString="*.p12") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.pfx") returned 0
	[0069.185] lstrlenA (lpString="*.pfx") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.kwm") returned 0
	[0069.185] lstrlenA (lpString="*.kwm") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.pwm") returned 0
	[0069.185] lstrlenA (lpString="*.pwm") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.1cd") returned 0
	[0069.185] lstrlenA (lpString="*.1cd") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.md") returned 0
	[0069.185] lstrlenA (lpString="*.md") returned 4
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mdf") returned 0
	[0069.185] lstrlenA (lpString="*.mdf") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.dbf") returned 0
	[0069.185] lstrlenA (lpString="*.dbf") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.odt") returned 0
	[0069.185] lstrlenA (lpString="*.odt") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.vob") returned 0
	[0069.185] lstrlenA (lpString="*.vob") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.ifo") returned 0
	[0069.185] lstrlenA (lpString="*.ifo") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.lnk") returned 0
	[0069.185] lstrlenA (lpString="*.lnk") returned 5
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.torrent") returned 0
	[0069.185] lstrlenA (lpString="*.torrent") returned 9
	[0069.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mov") returned 0
	[0069.186] lstrlenA (lpString="*.mov") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.m2v") returned 0
	[0069.186] lstrlenA (lpString="*.m2v") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.3gp") returned 0
	[0069.186] lstrlenA (lpString="*.3gp") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mpeg") returned 0
	[0069.186] lstrlenA (lpString="*.mpeg") returned 6
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mpg") returned 0
	[0069.186] lstrlenA (lpString="*.mpg") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.flv") returned 0
	[0069.186] lstrlenA (lpString="*.flv") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.avi") returned 0
	[0069.186] lstrlenA (lpString="*.avi") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mp4") returned 0
	[0069.186] lstrlenA (lpString="*.mp4") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.wmv") returned 0
	[0069.186] lstrlenA (lpString="*.wmv") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.divx") returned 0
	[0069.186] lstrlenA (lpString="*.divx") returned 6
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mkv") returned 0
	[0069.186] lstrlenA (lpString="*.mkv") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.mp3") returned 0
	[0069.186] lstrlenA (lpString="*.mp3") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.wav") returned 0
	[0069.186] lstrlenA (lpString="*.wav") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.flac") returned 0
	[0069.186] lstrlenA (lpString="*.flac") returned 6
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.ape") returned 0
	[0069.186] lstrlenA (lpString="*.ape") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.wma") returned 0
	[0069.186] lstrlenA (lpString="*.wma") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.ac3") returned 0
	[0069.186] lstrlenA (lpString="*.ac3") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.exe") returned 0
	[0069.186] lstrlenA (lpString="*.exe") returned 5
	[0069.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.apk") returned 0
	[0069.187] lstrlenA (lpString="*.apk") returned 5
	[0069.187] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LOGMODEL.MDL") returned -1
	[0069.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGMODEL.MDL") returned -1
	[0069.270] lstrcmpiA (lpString1="", lpString2="LOGMODEL.MDL") returned -1
	[0069.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="LOGELEMS.DLL"
	[0069.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGMODEL.MDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL"
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.zip") returned 0
	[0069.270] lstrlenA (lpString="*.zip") returned 5
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.rar") returned 0
	[0069.270] lstrlenA (lpString="*.rar") returned 5
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.7z") returned 0
	[0069.270] lstrlenA (lpString="*.7z") returned 4
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.tar") returned 0
	[0069.270] lstrlenA (lpString="*.tar") returned 5
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.gzip") returned 0
	[0069.270] lstrlenA (lpString="*.gzip") returned 6
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.jpg") returned 0
	[0069.270] lstrlenA (lpString="*.jpg") returned 5
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.jpeg") returned 0
	[0069.270] lstrlenA (lpString="*.jpeg") returned 6
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.psd") returned 0
	[0069.270] lstrlenA (lpString="*.psd") returned 5
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.cdr") returned 0
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.dwg") returned 0
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.max") returned 0
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.bmp") returned 0
	[0069.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", pszSpec="*.gif") returned 0
	[0069.271] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LOGVIEW.DLL") returned -1
	[0069.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGVIEW.DLL") returned -1
	[0069.271] lstrcmpiA (lpString1="", lpString2="LOGVIEW.DLL") returned -1
	[0069.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="LOGMODEL.MDL"
	[0069.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGVIEW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL"
	[0069.271] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LOOKUP.DAT") returned -1
	[0069.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOOKUP.DAT") returned -1
	[0069.271] lstrcmpiA (lpString1="", lpString2="LOOKUP.DAT") returned -1
	[0069.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="LOGVIEW.DLL"
	[0069.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOOKUP.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT"
	[0069.271] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MAPIPH.DLL") returned -1
	[0069.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPIPH.DLL") returned -1
	[0069.271] lstrcmpiA (lpString1="", lpString2="MAPIPH.DLL") returned -1
	[0069.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="LOOKUP.DAT"
	[0069.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPIPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL"
	[0069.272] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MAPISHELL.DLL") returned -1
	[0069.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPISHELL.DLL") returned -1
	[0069.272] lstrcmpiA (lpString1="", lpString2="MAPISHELL.DLL") returned -1
	[0069.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="MAPIPH.DLL"
	[0069.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPISHELL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL"
	[0069.272] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MCPS.DLL") returned -1
	[0069.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCPS.DLL") returned -1
	[0069.272] lstrcmpiA (lpString1="", lpString2="MCPS.DLL") returned -1
	[0069.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="MAPISHELL.DLL"
	[0069.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MCPS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL"
	[0069.272] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0069.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MEDCAT.DLL") returned -1
	[0069.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MEDCAT.DLL") returned -1
	[0069.272] lstrcmpiA (lpString1="", lpString2="MEDCAT.DLL") returned -1
	[0069.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="MCPS.DLL"
	[0069.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0069.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0069.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0069.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0069.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDCAT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL"
	[0069.273] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0069.273] lstrcmpA (lpString1=".", lpString2="MEDIA") returned -1
	[0069.273] lstrcmpA (lpString1="..", lpString2="MEDIA") returned -1
	[0069.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="MEDCAT.DLL"
	[0069.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA"
	[0069.273] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0069.289] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0069.289] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.289] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0069.289] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0069.289] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.289] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.289] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="APPLAUSE.WAV") returned 1
	[0069.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="APPLAUSE.WAV") returned 1
	[0069.289] lstrcmpiA (lpString1="", lpString2="APPLAUSE.WAV") returned -1
	[0069.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*") returned="*.*"
	[0069.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0xffffffff
	[0069.289] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.292] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0069.292] CloseHandle (hObject=0x8c) returned 1
	[0069.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV"
	[0069.292] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV"
	[0069.292] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV"
	[0069.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV."
	[0069.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.Boom"
	[0069.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.293] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6daa
	[0069.293] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ebdaad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1
	[0069.293] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.293] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6d87, lpOverlapped=0x0) returned 1
	[0069.351] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV"
	[0069.351] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.351] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6d87, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6d87, lpOverlapped=0x0) returned 1
	[0069.351] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.352] CloseHandle (hObject=0x8c) returned 1
	[0069.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.boom")) returned 1
	[0069.352] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.352] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ARROW.WAV") returned 1
	[0069.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARROW.WAV") returned 1
	[0069.353] lstrcmpiA (lpString1="", lpString2="ARROW.WAV") returned -1
	[0069.353] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV"
	[0069.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.353] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV"
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.zip") returned 0
	[0069.353] lstrlenA (lpString="*.zip") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.rar") returned 0
	[0069.353] lstrlenA (lpString="*.rar") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.7z") returned 0
	[0069.353] lstrlenA (lpString="*.7z") returned 4
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.tar") returned 0
	[0069.353] lstrlenA (lpString="*.tar") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gzip") returned 0
	[0069.353] lstrlenA (lpString="*.gzip") returned 6
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpg") returned 0
	[0069.353] lstrlenA (lpString="*.jpg") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpeg") returned 0
	[0069.353] lstrlenA (lpString="*.jpeg") returned 6
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.psd") returned 0
	[0069.353] lstrlenA (lpString="*.psd") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.cdr") returned 0
	[0069.353] lstrlenA (lpString="*.cdr") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dwg") returned 0
	[0069.353] lstrlenA (lpString="*.dwg") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.max") returned 0
	[0069.353] lstrlenA (lpString="*.max") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.bmp") returned 0
	[0069.353] lstrlenA (lpString="*.bmp") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gif") returned 0
	[0069.353] lstrlenA (lpString="*.gif") returned 5
	[0069.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.png") returned 0
	[0069.353] lstrlenA (lpString="*.png") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.doc") returned 0
	[0069.354] lstrlenA (lpString="*.doc") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.docx") returned 0
	[0069.354] lstrlenA (lpString="*.docx") returned 6
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xls") returned 0
	[0069.354] lstrlenA (lpString="*.xls") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xlsx") returned 0
	[0069.354] lstrlenA (lpString="*.xlsx") returned 6
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ppt") returned 0
	[0069.354] lstrlenA (lpString="*.ppt") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pptx") returned 0
	[0069.354] lstrlenA (lpString="*.pptx") returned 6
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.txt") returned 0
	[0069.354] lstrlenA (lpString="*.txt") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pdf") returned 0
	[0069.354] lstrlenA (lpString="*.pdf") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.djvu") returned 0
	[0069.354] lstrlenA (lpString="*.djvu") returned 6
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.htm") returned 0
	[0069.354] lstrlenA (lpString="*.htm") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.html") returned 0
	[0069.354] lstrlenA (lpString="*.html") returned 6
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mdb") returned 0
	[0069.354] lstrlenA (lpString="*.mdb") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.cer") returned 0
	[0069.354] lstrlenA (lpString="*.cer") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.p12") returned 0
	[0069.354] lstrlenA (lpString="*.p12") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pfx") returned 0
	[0069.354] lstrlenA (lpString="*.pfx") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.kwm") returned 0
	[0069.354] lstrlenA (lpString="*.kwm") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pwm") returned 0
	[0069.354] lstrlenA (lpString="*.pwm") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.1cd") returned 0
	[0069.354] lstrlenA (lpString="*.1cd") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.md") returned 0
	[0069.354] lstrlenA (lpString="*.md") returned 4
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mdf") returned 0
	[0069.354] lstrlenA (lpString="*.mdf") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dbf") returned 0
	[0069.354] lstrlenA (lpString="*.dbf") returned 5
	[0069.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.odt") returned 0
	[0069.354] lstrlenA (lpString="*.odt") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.vob") returned 0
	[0069.355] lstrlenA (lpString="*.vob") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ifo") returned 0
	[0069.355] lstrlenA (lpString="*.ifo") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.lnk") returned 0
	[0069.355] lstrlenA (lpString="*.lnk") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.torrent") returned 0
	[0069.355] lstrlenA (lpString="*.torrent") returned 9
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mov") returned 0
	[0069.355] lstrlenA (lpString="*.mov") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.m2v") returned 0
	[0069.355] lstrlenA (lpString="*.m2v") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.3gp") returned 0
	[0069.355] lstrlenA (lpString="*.3gp") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mpeg") returned 0
	[0069.355] lstrlenA (lpString="*.mpeg") returned 6
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mpg") returned 0
	[0069.355] lstrlenA (lpString="*.mpg") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.flv") returned 0
	[0069.355] lstrlenA (lpString="*.flv") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.avi") returned 0
	[0069.355] lstrlenA (lpString="*.avi") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mp4") returned 0
	[0069.355] lstrlenA (lpString="*.mp4") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wmv") returned 0
	[0069.355] lstrlenA (lpString="*.wmv") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.divx") returned 0
	[0069.355] lstrlenA (lpString="*.divx") returned 6
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mkv") returned 0
	[0069.355] lstrlenA (lpString="*.mkv") returned 5
	[0069.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mp3") returned 0
	[0069.357] lstrlenA (lpString="*.mp3") returned 5
	[0069.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wav") returned 1
	[0069.357] lstrlenA (lpString="*.wav") returned 5
	[0069.357] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV"
	[0069.357] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV"
	[0069.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV."
	[0069.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.Boom"
	[0069.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.357] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59f6
	[0069.357] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ed57890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee)) returned 1
	[0069.357] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.357] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x59d3, lpOverlapped=0x0) returned 1
	[0069.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV"
	[0069.383] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.383] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x59d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x59d3, lpOverlapped=0x0) returned 1
	[0069.384] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.384] CloseHandle (hObject=0x8c) returned 1
	[0069.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.boom")) returned 1
	[0069.385] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.385] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.385] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOMB.WAV") returned 1
	[0069.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOMB.WAV") returned 1
	[0069.385] lstrcmpiA (lpString1="", lpString2="BOMB.WAV") returned -1
	[0069.385] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV"
	[0069.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.385] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.385] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV"
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.zip") returned 0
	[0069.385] lstrlenA (lpString="*.zip") returned 5
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.rar") returned 0
	[0069.385] lstrlenA (lpString="*.rar") returned 5
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.7z") returned 0
	[0069.385] lstrlenA (lpString="*.7z") returned 4
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.tar") returned 0
	[0069.385] lstrlenA (lpString="*.tar") returned 5
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gzip") returned 0
	[0069.385] lstrlenA (lpString="*.gzip") returned 6
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpg") returned 0
	[0069.385] lstrlenA (lpString="*.jpg") returned 5
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpeg") returned 0
	[0069.385] lstrlenA (lpString="*.jpeg") returned 6
	[0069.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.psd") returned 0
	[0069.385] lstrlenA (lpString="*.psd") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.cdr") returned 0
	[0069.386] lstrlenA (lpString="*.cdr") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dwg") returned 0
	[0069.386] lstrlenA (lpString="*.dwg") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.max") returned 0
	[0069.386] lstrlenA (lpString="*.max") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.bmp") returned 0
	[0069.386] lstrlenA (lpString="*.bmp") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gif") returned 0
	[0069.386] lstrlenA (lpString="*.gif") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.png") returned 0
	[0069.386] lstrlenA (lpString="*.png") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.doc") returned 0
	[0069.386] lstrlenA (lpString="*.doc") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.docx") returned 0
	[0069.386] lstrlenA (lpString="*.docx") returned 6
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xls") returned 0
	[0069.386] lstrlenA (lpString="*.xls") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xlsx") returned 0
	[0069.386] lstrlenA (lpString="*.xlsx") returned 6
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ppt") returned 0
	[0069.386] lstrlenA (lpString="*.ppt") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pptx") returned 0
	[0069.386] lstrlenA (lpString="*.pptx") returned 6
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.txt") returned 0
	[0069.386] lstrlenA (lpString="*.txt") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pdf") returned 0
	[0069.386] lstrlenA (lpString="*.pdf") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.djvu") returned 0
	[0069.386] lstrlenA (lpString="*.djvu") returned 6
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.htm") returned 0
	[0069.386] lstrlenA (lpString="*.htm") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.html") returned 0
	[0069.386] lstrlenA (lpString="*.html") returned 6
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mdb") returned 0
	[0069.386] lstrlenA (lpString="*.mdb") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.cer") returned 0
	[0069.386] lstrlenA (lpString="*.cer") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.p12") returned 0
	[0069.386] lstrlenA (lpString="*.p12") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pfx") returned 0
	[0069.386] lstrlenA (lpString="*.pfx") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.kwm") returned 0
	[0069.386] lstrlenA (lpString="*.kwm") returned 5
	[0069.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pwm") returned 0
	[0069.387] lstrlenA (lpString="*.pwm") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.1cd") returned 0
	[0069.387] lstrlenA (lpString="*.1cd") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.md") returned 0
	[0069.387] lstrlenA (lpString="*.md") returned 4
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mdf") returned 0
	[0069.387] lstrlenA (lpString="*.mdf") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dbf") returned 0
	[0069.387] lstrlenA (lpString="*.dbf") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.odt") returned 0
	[0069.387] lstrlenA (lpString="*.odt") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.vob") returned 0
	[0069.387] lstrlenA (lpString="*.vob") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ifo") returned 0
	[0069.387] lstrlenA (lpString="*.ifo") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.lnk") returned 0
	[0069.387] lstrlenA (lpString="*.lnk") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.torrent") returned 0
	[0069.387] lstrlenA (lpString="*.torrent") returned 9
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mov") returned 0
	[0069.387] lstrlenA (lpString="*.mov") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.m2v") returned 0
	[0069.387] lstrlenA (lpString="*.m2v") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.3gp") returned 0
	[0069.387] lstrlenA (lpString="*.3gp") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mpeg") returned 0
	[0069.387] lstrlenA (lpString="*.mpeg") returned 6
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mpg") returned 0
	[0069.387] lstrlenA (lpString="*.mpg") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.flv") returned 0
	[0069.387] lstrlenA (lpString="*.flv") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.avi") returned 0
	[0069.387] lstrlenA (lpString="*.avi") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mp4") returned 0
	[0069.387] lstrlenA (lpString="*.mp4") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wmv") returned 0
	[0069.387] lstrlenA (lpString="*.wmv") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.divx") returned 0
	[0069.387] lstrlenA (lpString="*.divx") returned 6
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mkv") returned 0
	[0069.387] lstrlenA (lpString="*.mkv") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mp3") returned 0
	[0069.387] lstrlenA (lpString="*.mp3") returned 5
	[0069.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wav") returned 1
	[0069.387] lstrlenA (lpString="*.wav") returned 5
	[0069.387] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV"
	[0069.388] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV"
	[0069.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV."
	[0069.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.Boom"
	[0069.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.388] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f676
	[0069.388] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a15810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb)) returned 1
	[0069.388] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.388] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2f653, lpOverlapped=0x0) returned 1
	[0069.439] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV"
	[0069.440] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.440] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2f653, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2f653, lpOverlapped=0x0) returned 1
	[0069.440] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.440] CloseHandle (hObject=0x8c) returned 1
	[0069.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.boom")) returned 1
	[0069.441] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.441] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.441] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BREEZE.WAV") returned 1
	[0069.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.WAV") returned 1
	[0069.441] lstrcmpiA (lpString1="", lpString2="BREEZE.WAV") returned -1
	[0069.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV"
	[0069.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.441] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.441] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.441] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.441] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV"
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.zip") returned 0
	[0069.442] lstrlenA (lpString="*.zip") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.rar") returned 0
	[0069.442] lstrlenA (lpString="*.rar") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.7z") returned 0
	[0069.442] lstrlenA (lpString="*.7z") returned 4
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.tar") returned 0
	[0069.442] lstrlenA (lpString="*.tar") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gzip") returned 0
	[0069.442] lstrlenA (lpString="*.gzip") returned 6
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpg") returned 0
	[0069.442] lstrlenA (lpString="*.jpg") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpeg") returned 0
	[0069.442] lstrlenA (lpString="*.jpeg") returned 6
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.psd") returned 0
	[0069.442] lstrlenA (lpString="*.psd") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.cdr") returned 0
	[0069.442] lstrlenA (lpString="*.cdr") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dwg") returned 0
	[0069.442] lstrlenA (lpString="*.dwg") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.max") returned 0
	[0069.442] lstrlenA (lpString="*.max") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.bmp") returned 0
	[0069.442] lstrlenA (lpString="*.bmp") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gif") returned 0
	[0069.442] lstrlenA (lpString="*.gif") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.png") returned 0
	[0069.442] lstrlenA (lpString="*.png") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.doc") returned 0
	[0069.442] lstrlenA (lpString="*.doc") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.docx") returned 0
	[0069.442] lstrlenA (lpString="*.docx") returned 6
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xls") returned 0
	[0069.442] lstrlenA (lpString="*.xls") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xlsx") returned 0
	[0069.442] lstrlenA (lpString="*.xlsx") returned 6
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ppt") returned 0
	[0069.442] lstrlenA (lpString="*.ppt") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pptx") returned 0
	[0069.442] lstrlenA (lpString="*.pptx") returned 6
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.txt") returned 0
	[0069.442] lstrlenA (lpString="*.txt") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pdf") returned 0
	[0069.442] lstrlenA (lpString="*.pdf") returned 5
	[0069.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.djvu") returned 0
	[0069.442] lstrlenA (lpString="*.djvu") returned 6
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.htm") returned 0
	[0069.443] lstrlenA (lpString="*.htm") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.html") returned 0
	[0069.443] lstrlenA (lpString="*.html") returned 6
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mdb") returned 0
	[0069.443] lstrlenA (lpString="*.mdb") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.cer") returned 0
	[0069.443] lstrlenA (lpString="*.cer") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.p12") returned 0
	[0069.443] lstrlenA (lpString="*.p12") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pfx") returned 0
	[0069.443] lstrlenA (lpString="*.pfx") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.kwm") returned 0
	[0069.443] lstrlenA (lpString="*.kwm") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pwm") returned 0
	[0069.443] lstrlenA (lpString="*.pwm") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.1cd") returned 0
	[0069.443] lstrlenA (lpString="*.1cd") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.md") returned 0
	[0069.443] lstrlenA (lpString="*.md") returned 4
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mdf") returned 0
	[0069.443] lstrlenA (lpString="*.mdf") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dbf") returned 0
	[0069.443] lstrlenA (lpString="*.dbf") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.odt") returned 0
	[0069.443] lstrlenA (lpString="*.odt") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.vob") returned 0
	[0069.443] lstrlenA (lpString="*.vob") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ifo") returned 0
	[0069.443] lstrlenA (lpString="*.ifo") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.lnk") returned 0
	[0069.443] lstrlenA (lpString="*.lnk") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.torrent") returned 0
	[0069.443] lstrlenA (lpString="*.torrent") returned 9
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mov") returned 0
	[0069.443] lstrlenA (lpString="*.mov") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.m2v") returned 0
	[0069.443] lstrlenA (lpString="*.m2v") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.3gp") returned 0
	[0069.443] lstrlenA (lpString="*.3gp") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mpeg") returned 0
	[0069.443] lstrlenA (lpString="*.mpeg") returned 6
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mpg") returned 0
	[0069.443] lstrlenA (lpString="*.mpg") returned 5
	[0069.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.flv") returned 0
	[0069.444] lstrlenA (lpString="*.flv") returned 5
	[0069.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.avi") returned 0
	[0069.444] lstrlenA (lpString="*.avi") returned 5
	[0069.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mp4") returned 0
	[0069.444] lstrlenA (lpString="*.mp4") returned 5
	[0069.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wmv") returned 0
	[0069.444] lstrlenA (lpString="*.wmv") returned 5
	[0069.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.divx") returned 0
	[0069.444] lstrlenA (lpString="*.divx") returned 6
	[0069.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mkv") returned 0
	[0069.444] lstrlenA (lpString="*.mkv") returned 5
	[0069.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mp3") returned 0
	[0069.444] lstrlenA (lpString="*.mp3") returned 5
	[0069.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wav") returned 1
	[0069.444] lstrlenA (lpString="*.wav") returned 5
	[0069.444] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV"
	[0069.444] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV"
	[0069.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV."
	[0069.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.Boom"
	[0069.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.444] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c2
	[0069.444] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8)) returned 1
	[0069.445] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.445] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x109f, lpOverlapped=0x0) returned 1
	[0069.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV"
	[0069.511] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.511] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x109f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x109f, lpOverlapped=0x0) returned 1
	[0069.511] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.511] CloseHandle (hObject=0x8c) returned 1
	[0069.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.boom")) returned 1
	[0069.512] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.512] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.512] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CAMERA.WAV") returned 1
	[0069.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAMERA.WAV") returned 1
	[0069.512] lstrcmpiA (lpString1="", lpString2="CAMERA.WAV") returned -1
	[0069.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV"
	[0069.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.512] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.513] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV"
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.zip") returned 0
	[0069.513] lstrlenA (lpString="*.zip") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.rar") returned 0
	[0069.513] lstrlenA (lpString="*.rar") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.7z") returned 0
	[0069.513] lstrlenA (lpString="*.7z") returned 4
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.tar") returned 0
	[0069.513] lstrlenA (lpString="*.tar") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gzip") returned 0
	[0069.513] lstrlenA (lpString="*.gzip") returned 6
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpg") returned 0
	[0069.513] lstrlenA (lpString="*.jpg") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpeg") returned 0
	[0069.513] lstrlenA (lpString="*.jpeg") returned 6
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.psd") returned 0
	[0069.513] lstrlenA (lpString="*.psd") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.cdr") returned 0
	[0069.513] lstrlenA (lpString="*.cdr") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dwg") returned 0
	[0069.513] lstrlenA (lpString="*.dwg") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.max") returned 0
	[0069.513] lstrlenA (lpString="*.max") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.bmp") returned 0
	[0069.513] lstrlenA (lpString="*.bmp") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gif") returned 0
	[0069.513] lstrlenA (lpString="*.gif") returned 5
	[0069.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.png") returned 0
	[0069.513] lstrlenA (lpString="*.png") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.doc") returned 0
	[0069.514] lstrlenA (lpString="*.doc") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.docx") returned 0
	[0069.514] lstrlenA (lpString="*.docx") returned 6
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xls") returned 0
	[0069.514] lstrlenA (lpString="*.xls") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xlsx") returned 0
	[0069.514] lstrlenA (lpString="*.xlsx") returned 6
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ppt") returned 0
	[0069.514] lstrlenA (lpString="*.ppt") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pptx") returned 0
	[0069.514] lstrlenA (lpString="*.pptx") returned 6
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.txt") returned 0
	[0069.514] lstrlenA (lpString="*.txt") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pdf") returned 0
	[0069.514] lstrlenA (lpString="*.pdf") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.djvu") returned 0
	[0069.514] lstrlenA (lpString="*.djvu") returned 6
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.htm") returned 0
	[0069.514] lstrlenA (lpString="*.htm") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.html") returned 0
	[0069.514] lstrlenA (lpString="*.html") returned 6
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mdb") returned 0
	[0069.514] lstrlenA (lpString="*.mdb") returned 5
	[0069.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.cer") returned 0
	[0069.515] lstrlenA (lpString="*.cer") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.p12") returned 0
	[0069.515] lstrlenA (lpString="*.p12") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pfx") returned 0
	[0069.515] lstrlenA (lpString="*.pfx") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.kwm") returned 0
	[0069.515] lstrlenA (lpString="*.kwm") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pwm") returned 0
	[0069.515] lstrlenA (lpString="*.pwm") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.1cd") returned 0
	[0069.515] lstrlenA (lpString="*.1cd") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.md") returned 0
	[0069.515] lstrlenA (lpString="*.md") returned 4
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mdf") returned 0
	[0069.515] lstrlenA (lpString="*.mdf") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dbf") returned 0
	[0069.515] lstrlenA (lpString="*.dbf") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.odt") returned 0
	[0069.515] lstrlenA (lpString="*.odt") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.vob") returned 0
	[0069.515] lstrlenA (lpString="*.vob") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ifo") returned 0
	[0069.515] lstrlenA (lpString="*.ifo") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.lnk") returned 0
	[0069.515] lstrlenA (lpString="*.lnk") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.torrent") returned 0
	[0069.515] lstrlenA (lpString="*.torrent") returned 9
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mov") returned 0
	[0069.515] lstrlenA (lpString="*.mov") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.m2v") returned 0
	[0069.515] lstrlenA (lpString="*.m2v") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.3gp") returned 0
	[0069.515] lstrlenA (lpString="*.3gp") returned 5
	[0069.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mpeg") returned 0
	[0069.515] lstrlenA (lpString="*.mpeg") returned 6
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mpg") returned 0
	[0069.516] lstrlenA (lpString="*.mpg") returned 5
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.flv") returned 0
	[0069.516] lstrlenA (lpString="*.flv") returned 5
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.avi") returned 0
	[0069.516] lstrlenA (lpString="*.avi") returned 5
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mp4") returned 0
	[0069.516] lstrlenA (lpString="*.mp4") returned 5
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wmv") returned 0
	[0069.516] lstrlenA (lpString="*.wmv") returned 5
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.divx") returned 0
	[0069.516] lstrlenA (lpString="*.divx") returned 6
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mkv") returned 0
	[0069.516] lstrlenA (lpString="*.mkv") returned 5
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mp3") returned 0
	[0069.516] lstrlenA (lpString="*.mp3") returned 5
	[0069.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wav") returned 1
	[0069.516] lstrlenA (lpString="*.wav") returned 5
	[0069.516] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV"
	[0069.516] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV"
	[0069.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV."
	[0069.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.Boom"
	[0069.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.518] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1594
	[0069.518] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c2ab50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1
	[0069.518] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.518] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1571, lpOverlapped=0x0) returned 1
	[0069.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV"
	[0069.574] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.574] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1571, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1571, lpOverlapped=0x0) returned 1
	[0069.584] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.584] CloseHandle (hObject=0x8c) returned 1
	[0069.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.boom")) returned 1
	[0069.585] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.585] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CASHREG.WAV") returned 1
	[0069.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASHREG.WAV") returned 1
	[0069.585] lstrcmpiA (lpString1="", lpString2="CASHREG.WAV") returned -1
	[0069.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV"
	[0069.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.585] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV"
	[0069.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.zip") returned 0
	[0069.585] lstrlenA (lpString="*.zip") returned 5
	[0069.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.rar") returned 0
	[0069.585] lstrlenA (lpString="*.rar") returned 5
	[0069.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.7z") returned 0
	[0069.585] lstrlenA (lpString="*.7z") returned 4
	[0069.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.tar") returned 0
	[0069.585] lstrlenA (lpString="*.tar") returned 5
	[0069.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gzip") returned 0
	[0069.585] lstrlenA (lpString="*.gzip") returned 6
	[0069.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpg") returned 0
	[0069.586] lstrlenA (lpString="*.jpg") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpeg") returned 0
	[0069.586] lstrlenA (lpString="*.jpeg") returned 6
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.psd") returned 0
	[0069.586] lstrlenA (lpString="*.psd") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.cdr") returned 0
	[0069.586] lstrlenA (lpString="*.cdr") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dwg") returned 0
	[0069.586] lstrlenA (lpString="*.dwg") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.max") returned 0
	[0069.586] lstrlenA (lpString="*.max") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.bmp") returned 0
	[0069.586] lstrlenA (lpString="*.bmp") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gif") returned 0
	[0069.586] lstrlenA (lpString="*.gif") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.png") returned 0
	[0069.586] lstrlenA (lpString="*.png") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.doc") returned 0
	[0069.586] lstrlenA (lpString="*.doc") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.docx") returned 0
	[0069.586] lstrlenA (lpString="*.docx") returned 6
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xls") returned 0
	[0069.586] lstrlenA (lpString="*.xls") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xlsx") returned 0
	[0069.586] lstrlenA (lpString="*.xlsx") returned 6
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ppt") returned 0
	[0069.586] lstrlenA (lpString="*.ppt") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pptx") returned 0
	[0069.586] lstrlenA (lpString="*.pptx") returned 6
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.txt") returned 0
	[0069.586] lstrlenA (lpString="*.txt") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pdf") returned 0
	[0069.586] lstrlenA (lpString="*.pdf") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.djvu") returned 0
	[0069.586] lstrlenA (lpString="*.djvu") returned 6
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.htm") returned 0
	[0069.586] lstrlenA (lpString="*.htm") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.html") returned 0
	[0069.586] lstrlenA (lpString="*.html") returned 6
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mdb") returned 0
	[0069.586] lstrlenA (lpString="*.mdb") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.cer") returned 0
	[0069.586] lstrlenA (lpString="*.cer") returned 5
	[0069.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.p12") returned 0
	[0069.587] lstrlenA (lpString="*.p12") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pfx") returned 0
	[0069.587] lstrlenA (lpString="*.pfx") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.kwm") returned 0
	[0069.587] lstrlenA (lpString="*.kwm") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pwm") returned 0
	[0069.587] lstrlenA (lpString="*.pwm") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.1cd") returned 0
	[0069.587] lstrlenA (lpString="*.1cd") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.md") returned 0
	[0069.587] lstrlenA (lpString="*.md") returned 4
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mdf") returned 0
	[0069.587] lstrlenA (lpString="*.mdf") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dbf") returned 0
	[0069.587] lstrlenA (lpString="*.dbf") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.odt") returned 0
	[0069.587] lstrlenA (lpString="*.odt") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.vob") returned 0
	[0069.587] lstrlenA (lpString="*.vob") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ifo") returned 0
	[0069.587] lstrlenA (lpString="*.ifo") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.lnk") returned 0
	[0069.587] lstrlenA (lpString="*.lnk") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.torrent") returned 0
	[0069.587] lstrlenA (lpString="*.torrent") returned 9
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mov") returned 0
	[0069.587] lstrlenA (lpString="*.mov") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.m2v") returned 0
	[0069.587] lstrlenA (lpString="*.m2v") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.3gp") returned 0
	[0069.587] lstrlenA (lpString="*.3gp") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mpeg") returned 0
	[0069.587] lstrlenA (lpString="*.mpeg") returned 6
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mpg") returned 0
	[0069.587] lstrlenA (lpString="*.mpg") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.flv") returned 0
	[0069.587] lstrlenA (lpString="*.flv") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.avi") returned 0
	[0069.587] lstrlenA (lpString="*.avi") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mp4") returned 0
	[0069.587] lstrlenA (lpString="*.mp4") returned 5
	[0069.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wmv") returned 0
	[0069.587] lstrlenA (lpString="*.wmv") returned 5
	[0069.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.divx") returned 0
	[0069.588] lstrlenA (lpString="*.divx") returned 6
	[0069.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mkv") returned 0
	[0069.588] lstrlenA (lpString="*.mkv") returned 5
	[0069.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mp3") returned 0
	[0069.588] lstrlenA (lpString="*.mp3") returned 5
	[0069.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wav") returned 1
	[0069.588] lstrlenA (lpString="*.wav") returned 5
	[0069.588] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV"
	[0069.588] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV"
	[0069.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV."
	[0069.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.Boom"
	[0069.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.588] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7f
	[0069.588] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c50cb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1
	[0069.588] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.589] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1d5c, lpOverlapped=0x0) returned 1
	[0069.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV"
	[0069.636] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.637] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1d5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1d5c, lpOverlapped=0x0) returned 1
	[0069.637] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.637] CloseHandle (hObject=0x8c) returned 1
	[0069.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.boom")) returned 1
	[0069.638] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.638] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.638] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHIMES.WAV") returned 1
	[0069.638] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHIMES.WAV") returned 1
	[0069.638] lstrcmpiA (lpString1="", lpString2="CHIMES.WAV") returned -1
	[0069.638] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV"
	[0069.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.638] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.638] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV"
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.zip") returned 0
	[0069.638] lstrlenA (lpString="*.zip") returned 5
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.rar") returned 0
	[0069.638] lstrlenA (lpString="*.rar") returned 5
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.7z") returned 0
	[0069.638] lstrlenA (lpString="*.7z") returned 4
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.tar") returned 0
	[0069.638] lstrlenA (lpString="*.tar") returned 5
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gzip") returned 0
	[0069.638] lstrlenA (lpString="*.gzip") returned 6
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpg") returned 0
	[0069.638] lstrlenA (lpString="*.jpg") returned 5
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpeg") returned 0
	[0069.638] lstrlenA (lpString="*.jpeg") returned 6
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.psd") returned 0
	[0069.638] lstrlenA (lpString="*.psd") returned 5
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.cdr") returned 0
	[0069.638] lstrlenA (lpString="*.cdr") returned 5
	[0069.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dwg") returned 0
	[0069.639] lstrlenA (lpString="*.dwg") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.max") returned 0
	[0069.639] lstrlenA (lpString="*.max") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.bmp") returned 0
	[0069.639] lstrlenA (lpString="*.bmp") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gif") returned 0
	[0069.639] lstrlenA (lpString="*.gif") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.png") returned 0
	[0069.639] lstrlenA (lpString="*.png") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.doc") returned 0
	[0069.639] lstrlenA (lpString="*.doc") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.docx") returned 0
	[0069.639] lstrlenA (lpString="*.docx") returned 6
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xls") returned 0
	[0069.639] lstrlenA (lpString="*.xls") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xlsx") returned 0
	[0069.639] lstrlenA (lpString="*.xlsx") returned 6
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ppt") returned 0
	[0069.639] lstrlenA (lpString="*.ppt") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pptx") returned 0
	[0069.639] lstrlenA (lpString="*.pptx") returned 6
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.txt") returned 0
	[0069.639] lstrlenA (lpString="*.txt") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pdf") returned 0
	[0069.639] lstrlenA (lpString="*.pdf") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.djvu") returned 0
	[0069.639] lstrlenA (lpString="*.djvu") returned 6
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.htm") returned 0
	[0069.639] lstrlenA (lpString="*.htm") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.html") returned 0
	[0069.639] lstrlenA (lpString="*.html") returned 6
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mdb") returned 0
	[0069.639] lstrlenA (lpString="*.mdb") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.cer") returned 0
	[0069.639] lstrlenA (lpString="*.cer") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.p12") returned 0
	[0069.639] lstrlenA (lpString="*.p12") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pfx") returned 0
	[0069.639] lstrlenA (lpString="*.pfx") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.kwm") returned 0
	[0069.639] lstrlenA (lpString="*.kwm") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pwm") returned 0
	[0069.639] lstrlenA (lpString="*.pwm") returned 5
	[0069.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.1cd") returned 0
	[0069.639] lstrlenA (lpString="*.1cd") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.md") returned 0
	[0069.640] lstrlenA (lpString="*.md") returned 4
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mdf") returned 0
	[0069.640] lstrlenA (lpString="*.mdf") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dbf") returned 0
	[0069.640] lstrlenA (lpString="*.dbf") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.odt") returned 0
	[0069.640] lstrlenA (lpString="*.odt") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.vob") returned 0
	[0069.640] lstrlenA (lpString="*.vob") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ifo") returned 0
	[0069.640] lstrlenA (lpString="*.ifo") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.lnk") returned 0
	[0069.640] lstrlenA (lpString="*.lnk") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.torrent") returned 0
	[0069.640] lstrlenA (lpString="*.torrent") returned 9
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mov") returned 0
	[0069.640] lstrlenA (lpString="*.mov") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.m2v") returned 0
	[0069.640] lstrlenA (lpString="*.m2v") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.3gp") returned 0
	[0069.640] lstrlenA (lpString="*.3gp") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mpeg") returned 0
	[0069.640] lstrlenA (lpString="*.mpeg") returned 6
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mpg") returned 0
	[0069.640] lstrlenA (lpString="*.mpg") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.flv") returned 0
	[0069.640] lstrlenA (lpString="*.flv") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.avi") returned 0
	[0069.640] lstrlenA (lpString="*.avi") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mp4") returned 0
	[0069.640] lstrlenA (lpString="*.mp4") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wmv") returned 0
	[0069.640] lstrlenA (lpString="*.wmv") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.divx") returned 0
	[0069.640] lstrlenA (lpString="*.divx") returned 6
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mkv") returned 0
	[0069.640] lstrlenA (lpString="*.mkv") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mp3") returned 0
	[0069.640] lstrlenA (lpString="*.mp3") returned 5
	[0069.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wav") returned 1
	[0069.640] lstrlenA (lpString="*.wav") returned 5
	[0069.641] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV"
	[0069.641] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV"
	[0069.641] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV."
	[0069.641] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.Boom"
	[0069.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.642] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91be
	[0069.642] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1
	[0069.642] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.642] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x919b, lpOverlapped=0x0) returned 1
	[0069.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV"
	[0069.703] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.703] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x919b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x919b, lpOverlapped=0x0) returned 1
	[0069.704] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.704] CloseHandle (hObject=0x8c) returned 1
	[0069.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.boom")) returned 1
	[0069.704] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.705] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.705] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CLICK.WAV") returned 1
	[0069.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLICK.WAV") returned 1
	[0069.705] lstrcmpiA (lpString1="", lpString2="CLICK.WAV") returned -1
	[0069.705] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV"
	[0069.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.705] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.705] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV"
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.zip") returned 0
	[0069.705] lstrlenA (lpString="*.zip") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.rar") returned 0
	[0069.705] lstrlenA (lpString="*.rar") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.7z") returned 0
	[0069.705] lstrlenA (lpString="*.7z") returned 4
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.tar") returned 0
	[0069.705] lstrlenA (lpString="*.tar") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gzip") returned 0
	[0069.705] lstrlenA (lpString="*.gzip") returned 6
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpg") returned 0
	[0069.705] lstrlenA (lpString="*.jpg") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpeg") returned 0
	[0069.705] lstrlenA (lpString="*.jpeg") returned 6
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.psd") returned 0
	[0069.705] lstrlenA (lpString="*.psd") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.cdr") returned 0
	[0069.705] lstrlenA (lpString="*.cdr") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dwg") returned 0
	[0069.705] lstrlenA (lpString="*.dwg") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.max") returned 0
	[0069.705] lstrlenA (lpString="*.max") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.bmp") returned 0
	[0069.705] lstrlenA (lpString="*.bmp") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gif") returned 0
	[0069.705] lstrlenA (lpString="*.gif") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.png") returned 0
	[0069.705] lstrlenA (lpString="*.png") returned 5
	[0069.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.doc") returned 0
	[0069.705] lstrlenA (lpString="*.doc") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.docx") returned 0
	[0069.706] lstrlenA (lpString="*.docx") returned 6
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xls") returned 0
	[0069.706] lstrlenA (lpString="*.xls") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xlsx") returned 0
	[0069.706] lstrlenA (lpString="*.xlsx") returned 6
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ppt") returned 0
	[0069.706] lstrlenA (lpString="*.ppt") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pptx") returned 0
	[0069.706] lstrlenA (lpString="*.pptx") returned 6
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.txt") returned 0
	[0069.706] lstrlenA (lpString="*.txt") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pdf") returned 0
	[0069.706] lstrlenA (lpString="*.pdf") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.djvu") returned 0
	[0069.706] lstrlenA (lpString="*.djvu") returned 6
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.htm") returned 0
	[0069.706] lstrlenA (lpString="*.htm") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.html") returned 0
	[0069.706] lstrlenA (lpString="*.html") returned 6
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mdb") returned 0
	[0069.706] lstrlenA (lpString="*.mdb") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.cer") returned 0
	[0069.706] lstrlenA (lpString="*.cer") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.p12") returned 0
	[0069.706] lstrlenA (lpString="*.p12") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pfx") returned 0
	[0069.706] lstrlenA (lpString="*.pfx") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.kwm") returned 0
	[0069.706] lstrlenA (lpString="*.kwm") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pwm") returned 0
	[0069.706] lstrlenA (lpString="*.pwm") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.1cd") returned 0
	[0069.706] lstrlenA (lpString="*.1cd") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.md") returned 0
	[0069.706] lstrlenA (lpString="*.md") returned 4
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mdf") returned 0
	[0069.706] lstrlenA (lpString="*.mdf") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dbf") returned 0
	[0069.706] lstrlenA (lpString="*.dbf") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.odt") returned 0
	[0069.706] lstrlenA (lpString="*.odt") returned 5
	[0069.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.vob") returned 0
	[0069.706] lstrlenA (lpString="*.vob") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ifo") returned 0
	[0069.707] lstrlenA (lpString="*.ifo") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.lnk") returned 0
	[0069.707] lstrlenA (lpString="*.lnk") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.torrent") returned 0
	[0069.707] lstrlenA (lpString="*.torrent") returned 9
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mov") returned 0
	[0069.707] lstrlenA (lpString="*.mov") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.m2v") returned 0
	[0069.707] lstrlenA (lpString="*.m2v") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.3gp") returned 0
	[0069.707] lstrlenA (lpString="*.3gp") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mpeg") returned 0
	[0069.707] lstrlenA (lpString="*.mpeg") returned 6
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mpg") returned 0
	[0069.707] lstrlenA (lpString="*.mpg") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.flv") returned 0
	[0069.707] lstrlenA (lpString="*.flv") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.avi") returned 0
	[0069.707] lstrlenA (lpString="*.avi") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mp4") returned 0
	[0069.707] lstrlenA (lpString="*.mp4") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wmv") returned 0
	[0069.707] lstrlenA (lpString="*.wmv") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.divx") returned 0
	[0069.707] lstrlenA (lpString="*.divx") returned 6
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mkv") returned 0
	[0069.707] lstrlenA (lpString="*.mkv") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mp3") returned 0
	[0069.707] lstrlenA (lpString="*.mp3") returned 5
	[0069.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wav") returned 1
	[0069.707] lstrlenA (lpString="*.wav") returned 5
	[0069.707] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV"
	[0069.707] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV"
	[0069.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV."
	[0069.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.Boom"
	[0069.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.709] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x268
	[0069.709] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7)) returned 1
	[0069.709] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.709] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x245, lpOverlapped=0x0) returned 1
	[0069.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV"
	[0069.710] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.710] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x245, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x245, lpOverlapped=0x0) returned 1
	[0069.710] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.710] CloseHandle (hObject=0x8c) returned 1
	[0069.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.boom")) returned 1
	[0069.711] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.711] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.711] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COIN.WAV") returned 1
	[0069.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COIN.WAV") returned 1
	[0069.712] lstrcmpiA (lpString1="", lpString2="COIN.WAV") returned -1
	[0069.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV"
	[0069.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.712] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV"
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.zip") returned 0
	[0069.712] lstrlenA (lpString="*.zip") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.rar") returned 0
	[0069.712] lstrlenA (lpString="*.rar") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.7z") returned 0
	[0069.712] lstrlenA (lpString="*.7z") returned 4
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.tar") returned 0
	[0069.712] lstrlenA (lpString="*.tar") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gzip") returned 0
	[0069.712] lstrlenA (lpString="*.gzip") returned 6
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpg") returned 0
	[0069.712] lstrlenA (lpString="*.jpg") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpeg") returned 0
	[0069.712] lstrlenA (lpString="*.jpeg") returned 6
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.psd") returned 0
	[0069.712] lstrlenA (lpString="*.psd") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.cdr") returned 0
	[0069.712] lstrlenA (lpString="*.cdr") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dwg") returned 0
	[0069.712] lstrlenA (lpString="*.dwg") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.max") returned 0
	[0069.712] lstrlenA (lpString="*.max") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.bmp") returned 0
	[0069.712] lstrlenA (lpString="*.bmp") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gif") returned 0
	[0069.712] lstrlenA (lpString="*.gif") returned 5
	[0069.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.png") returned 0
	[0069.712] lstrlenA (lpString="*.png") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.doc") returned 0
	[0069.713] lstrlenA (lpString="*.doc") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.docx") returned 0
	[0069.713] lstrlenA (lpString="*.docx") returned 6
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xls") returned 0
	[0069.713] lstrlenA (lpString="*.xls") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xlsx") returned 0
	[0069.713] lstrlenA (lpString="*.xlsx") returned 6
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ppt") returned 0
	[0069.713] lstrlenA (lpString="*.ppt") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pptx") returned 0
	[0069.713] lstrlenA (lpString="*.pptx") returned 6
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.txt") returned 0
	[0069.713] lstrlenA (lpString="*.txt") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pdf") returned 0
	[0069.713] lstrlenA (lpString="*.pdf") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.djvu") returned 0
	[0069.713] lstrlenA (lpString="*.djvu") returned 6
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.htm") returned 0
	[0069.713] lstrlenA (lpString="*.htm") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.html") returned 0
	[0069.713] lstrlenA (lpString="*.html") returned 6
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mdb") returned 0
	[0069.713] lstrlenA (lpString="*.mdb") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.cer") returned 0
	[0069.713] lstrlenA (lpString="*.cer") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.p12") returned 0
	[0069.713] lstrlenA (lpString="*.p12") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pfx") returned 0
	[0069.713] lstrlenA (lpString="*.pfx") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.kwm") returned 0
	[0069.713] lstrlenA (lpString="*.kwm") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pwm") returned 0
	[0069.713] lstrlenA (lpString="*.pwm") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.1cd") returned 0
	[0069.713] lstrlenA (lpString="*.1cd") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.md") returned 0
	[0069.713] lstrlenA (lpString="*.md") returned 4
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mdf") returned 0
	[0069.713] lstrlenA (lpString="*.mdf") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dbf") returned 0
	[0069.713] lstrlenA (lpString="*.dbf") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.odt") returned 0
	[0069.713] lstrlenA (lpString="*.odt") returned 5
	[0069.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.vob") returned 0
	[0069.714] lstrlenA (lpString="*.vob") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ifo") returned 0
	[0069.714] lstrlenA (lpString="*.ifo") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.lnk") returned 0
	[0069.714] lstrlenA (lpString="*.lnk") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.torrent") returned 0
	[0069.714] lstrlenA (lpString="*.torrent") returned 9
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mov") returned 0
	[0069.714] lstrlenA (lpString="*.mov") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.m2v") returned 0
	[0069.714] lstrlenA (lpString="*.m2v") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.3gp") returned 0
	[0069.714] lstrlenA (lpString="*.3gp") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mpeg") returned 0
	[0069.714] lstrlenA (lpString="*.mpeg") returned 6
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mpg") returned 0
	[0069.714] lstrlenA (lpString="*.mpg") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.flv") returned 0
	[0069.714] lstrlenA (lpString="*.flv") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.avi") returned 0
	[0069.714] lstrlenA (lpString="*.avi") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mp4") returned 0
	[0069.714] lstrlenA (lpString="*.mp4") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wmv") returned 0
	[0069.714] lstrlenA (lpString="*.wmv") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.divx") returned 0
	[0069.714] lstrlenA (lpString="*.divx") returned 6
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mkv") returned 0
	[0069.714] lstrlenA (lpString="*.mkv") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mp3") returned 0
	[0069.714] lstrlenA (lpString="*.mp3") returned 5
	[0069.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wav") returned 1
	[0069.714] lstrlenA (lpString="*.wav") returned 5
	[0069.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV"
	[0069.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV"
	[0069.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV."
	[0069.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.Boom"
	[0069.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.715] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15bc
	[0069.715] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7)) returned 1
	[0069.715] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.715] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1599, lpOverlapped=0x0) returned 1
	[0069.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV"
	[0069.716] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.716] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1599, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1599, lpOverlapped=0x0) returned 1
	[0069.716] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.716] CloseHandle (hObject=0x8c) returned 1
	[0069.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.boom")) returned 1
	[0069.717] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.717] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.717] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DRUMROLL.WAV") returned 1
	[0069.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DRUMROLL.WAV") returned 1
	[0069.717] lstrcmpiA (lpString1="", lpString2="DRUMROLL.WAV") returned -1
	[0069.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV"
	[0069.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.717] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV"
	[0069.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.zip") returned 0
	[0069.717] lstrlenA (lpString="*.zip") returned 5
	[0069.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.rar") returned 0
	[0069.717] lstrlenA (lpString="*.rar") returned 5
	[0069.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.7z") returned 0
	[0069.717] lstrlenA (lpString="*.7z") returned 4
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.tar") returned 0
	[0069.718] lstrlenA (lpString="*.tar") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gzip") returned 0
	[0069.718] lstrlenA (lpString="*.gzip") returned 6
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpg") returned 0
	[0069.718] lstrlenA (lpString="*.jpg") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpeg") returned 0
	[0069.718] lstrlenA (lpString="*.jpeg") returned 6
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.psd") returned 0
	[0069.718] lstrlenA (lpString="*.psd") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.cdr") returned 0
	[0069.718] lstrlenA (lpString="*.cdr") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dwg") returned 0
	[0069.718] lstrlenA (lpString="*.dwg") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.max") returned 0
	[0069.718] lstrlenA (lpString="*.max") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.bmp") returned 0
	[0069.718] lstrlenA (lpString="*.bmp") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gif") returned 0
	[0069.718] lstrlenA (lpString="*.gif") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.png") returned 0
	[0069.718] lstrlenA (lpString="*.png") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.doc") returned 0
	[0069.718] lstrlenA (lpString="*.doc") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.docx") returned 0
	[0069.718] lstrlenA (lpString="*.docx") returned 6
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xls") returned 0
	[0069.718] lstrlenA (lpString="*.xls") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xlsx") returned 0
	[0069.718] lstrlenA (lpString="*.xlsx") returned 6
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ppt") returned 0
	[0069.718] lstrlenA (lpString="*.ppt") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pptx") returned 0
	[0069.718] lstrlenA (lpString="*.pptx") returned 6
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.txt") returned 0
	[0069.718] lstrlenA (lpString="*.txt") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pdf") returned 0
	[0069.718] lstrlenA (lpString="*.pdf") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.djvu") returned 0
	[0069.718] lstrlenA (lpString="*.djvu") returned 6
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.htm") returned 0
	[0069.718] lstrlenA (lpString="*.htm") returned 5
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.html") returned 0
	[0069.718] lstrlenA (lpString="*.html") returned 6
	[0069.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mdb") returned 0
	[0069.719] lstrlenA (lpString="*.mdb") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.cer") returned 0
	[0069.719] lstrlenA (lpString="*.cer") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.p12") returned 0
	[0069.719] lstrlenA (lpString="*.p12") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pfx") returned 0
	[0069.719] lstrlenA (lpString="*.pfx") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.kwm") returned 0
	[0069.719] lstrlenA (lpString="*.kwm") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pwm") returned 0
	[0069.719] lstrlenA (lpString="*.pwm") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.1cd") returned 0
	[0069.719] lstrlenA (lpString="*.1cd") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.md") returned 0
	[0069.719] lstrlenA (lpString="*.md") returned 4
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mdf") returned 0
	[0069.719] lstrlenA (lpString="*.mdf") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dbf") returned 0
	[0069.719] lstrlenA (lpString="*.dbf") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.odt") returned 0
	[0069.719] lstrlenA (lpString="*.odt") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.vob") returned 0
	[0069.719] lstrlenA (lpString="*.vob") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ifo") returned 0
	[0069.719] lstrlenA (lpString="*.ifo") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.lnk") returned 0
	[0069.719] lstrlenA (lpString="*.lnk") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.torrent") returned 0
	[0069.719] lstrlenA (lpString="*.torrent") returned 9
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mov") returned 0
	[0069.719] lstrlenA (lpString="*.mov") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.m2v") returned 0
	[0069.719] lstrlenA (lpString="*.m2v") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.3gp") returned 0
	[0069.719] lstrlenA (lpString="*.3gp") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mpeg") returned 0
	[0069.719] lstrlenA (lpString="*.mpeg") returned 6
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mpg") returned 0
	[0069.719] lstrlenA (lpString="*.mpg") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.flv") returned 0
	[0069.719] lstrlenA (lpString="*.flv") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.avi") returned 0
	[0069.719] lstrlenA (lpString="*.avi") returned 5
	[0069.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mp4") returned 0
	[0069.720] lstrlenA (lpString="*.mp4") returned 5
	[0069.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wmv") returned 0
	[0069.720] lstrlenA (lpString="*.wmv") returned 5
	[0069.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.divx") returned 0
	[0069.720] lstrlenA (lpString="*.divx") returned 6
	[0069.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mkv") returned 0
	[0069.720] lstrlenA (lpString="*.mkv") returned 5
	[0069.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mp3") returned 0
	[0069.720] lstrlenA (lpString="*.mp3") returned 5
	[0069.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wav") returned 1
	[0069.720] lstrlenA (lpString="*.wav") returned 5
	[0069.720] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV"
	[0069.720] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV"
	[0069.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV."
	[0069.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.Boom"
	[0069.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.721] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4be2
	[0069.721] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1
	[0069.721] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.721] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x4bbf, lpOverlapped=0x0) returned 1
	[0069.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV"
	[0069.767] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.767] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x4bbf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x4bbf, lpOverlapped=0x0) returned 1
	[0069.767] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.767] CloseHandle (hObject=0x8c) returned 1
	[0069.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.boom")) returned 1
	[0069.768] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.768] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXPLODE.WAV") returned -1
	[0069.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPLODE.WAV") returned 1
	[0069.768] lstrcmpiA (lpString1="", lpString2="EXPLODE.WAV") returned -1
	[0069.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV"
	[0069.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV"
	[0069.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.zip") returned 0
	[0069.768] lstrlenA (lpString="*.zip") returned 5
	[0069.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.rar") returned 0
	[0069.768] lstrlenA (lpString="*.rar") returned 5
	[0069.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.7z") returned 0
	[0069.768] lstrlenA (lpString="*.7z") returned 4
	[0069.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.tar") returned 0
	[0069.769] lstrlenA (lpString="*.tar") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.gzip") returned 0
	[0069.769] lstrlenA (lpString="*.gzip") returned 6
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.jpg") returned 0
	[0069.769] lstrlenA (lpString="*.jpg") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.jpeg") returned 0
	[0069.769] lstrlenA (lpString="*.jpeg") returned 6
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.psd") returned 0
	[0069.769] lstrlenA (lpString="*.psd") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.cdr") returned 0
	[0069.769] lstrlenA (lpString="*.cdr") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.dwg") returned 0
	[0069.769] lstrlenA (lpString="*.dwg") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.max") returned 0
	[0069.769] lstrlenA (lpString="*.max") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.bmp") returned 0
	[0069.769] lstrlenA (lpString="*.bmp") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.gif") returned 0
	[0069.769] lstrlenA (lpString="*.gif") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.png") returned 0
	[0069.769] lstrlenA (lpString="*.png") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.doc") returned 0
	[0069.769] lstrlenA (lpString="*.doc") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.docx") returned 0
	[0069.769] lstrlenA (lpString="*.docx") returned 6
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.xls") returned 0
	[0069.769] lstrlenA (lpString="*.xls") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.xlsx") returned 0
	[0069.769] lstrlenA (lpString="*.xlsx") returned 6
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.ppt") returned 0
	[0069.769] lstrlenA (lpString="*.ppt") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pptx") returned 0
	[0069.769] lstrlenA (lpString="*.pptx") returned 6
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.txt") returned 0
	[0069.769] lstrlenA (lpString="*.txt") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pdf") returned 0
	[0069.769] lstrlenA (lpString="*.pdf") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.djvu") returned 0
	[0069.769] lstrlenA (lpString="*.djvu") returned 6
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.htm") returned 0
	[0069.769] lstrlenA (lpString="*.htm") returned 5
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.html") returned 0
	[0069.769] lstrlenA (lpString="*.html") returned 6
	[0069.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mdb") returned 0
	[0069.769] lstrlenA (lpString="*.mdb") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.cer") returned 0
	[0069.770] lstrlenA (lpString="*.cer") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.p12") returned 0
	[0069.770] lstrlenA (lpString="*.p12") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pfx") returned 0
	[0069.770] lstrlenA (lpString="*.pfx") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.kwm") returned 0
	[0069.770] lstrlenA (lpString="*.kwm") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pwm") returned 0
	[0069.770] lstrlenA (lpString="*.pwm") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.1cd") returned 0
	[0069.770] lstrlenA (lpString="*.1cd") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.md") returned 0
	[0069.770] lstrlenA (lpString="*.md") returned 4
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mdf") returned 0
	[0069.770] lstrlenA (lpString="*.mdf") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.dbf") returned 0
	[0069.770] lstrlenA (lpString="*.dbf") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.odt") returned 0
	[0069.770] lstrlenA (lpString="*.odt") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.vob") returned 0
	[0069.770] lstrlenA (lpString="*.vob") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.ifo") returned 0
	[0069.770] lstrlenA (lpString="*.ifo") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.lnk") returned 0
	[0069.770] lstrlenA (lpString="*.lnk") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.torrent") returned 0
	[0069.770] lstrlenA (lpString="*.torrent") returned 9
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mov") returned 0
	[0069.770] lstrlenA (lpString="*.mov") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.m2v") returned 0
	[0069.770] lstrlenA (lpString="*.m2v") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.3gp") returned 0
	[0069.770] lstrlenA (lpString="*.3gp") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mpeg") returned 0
	[0069.770] lstrlenA (lpString="*.mpeg") returned 6
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mpg") returned 0
	[0069.770] lstrlenA (lpString="*.mpg") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.flv") returned 0
	[0069.770] lstrlenA (lpString="*.flv") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.avi") returned 0
	[0069.770] lstrlenA (lpString="*.avi") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mp4") returned 0
	[0069.770] lstrlenA (lpString="*.mp4") returned 5
	[0069.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.wmv") returned 0
	[0069.771] lstrlenA (lpString="*.wmv") returned 5
	[0069.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.divx") returned 0
	[0069.771] lstrlenA (lpString="*.divx") returned 6
	[0069.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mkv") returned 0
	[0069.771] lstrlenA (lpString="*.mkv") returned 5
	[0069.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mp3") returned 0
	[0069.771] lstrlenA (lpString="*.mp3") returned 5
	[0069.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.wav") returned 1
	[0069.771] lstrlenA (lpString="*.wav") returned 5
	[0069.771] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV"
	[0069.771] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV"
	[0069.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV."
	[0069.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.Boom"
	[0069.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.772] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c20
	[0069.772] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x60af2a30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1
	[0069.772] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.772] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x5bfd, lpOverlapped=0x0) returned 1
	[0069.793] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV"
	[0069.793] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.793] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x5bfd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x5bfd, lpOverlapped=0x0) returned 1
	[0069.793] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.793] CloseHandle (hObject=0x8c) returned 1
	[0069.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.boom")) returned 1
	[0069.794] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.794] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.794] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HAMMER.WAV") returned -1
	[0069.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HAMMER.WAV") returned 1
	[0069.794] lstrcmpiA (lpString1="", lpString2="HAMMER.WAV") returned -1
	[0069.794] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV"
	[0069.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.795] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV"
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.zip") returned 0
	[0069.795] lstrlenA (lpString="*.zip") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.rar") returned 0
	[0069.795] lstrlenA (lpString="*.rar") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.7z") returned 0
	[0069.795] lstrlenA (lpString="*.7z") returned 4
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.tar") returned 0
	[0069.795] lstrlenA (lpString="*.tar") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.gzip") returned 0
	[0069.795] lstrlenA (lpString="*.gzip") returned 6
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.jpg") returned 0
	[0069.795] lstrlenA (lpString="*.jpg") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.jpeg") returned 0
	[0069.795] lstrlenA (lpString="*.jpeg") returned 6
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.psd") returned 0
	[0069.795] lstrlenA (lpString="*.psd") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.cdr") returned 0
	[0069.795] lstrlenA (lpString="*.cdr") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.dwg") returned 0
	[0069.795] lstrlenA (lpString="*.dwg") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.max") returned 0
	[0069.795] lstrlenA (lpString="*.max") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.bmp") returned 0
	[0069.795] lstrlenA (lpString="*.bmp") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.gif") returned 0
	[0069.795] lstrlenA (lpString="*.gif") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.png") returned 0
	[0069.795] lstrlenA (lpString="*.png") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.doc") returned 0
	[0069.795] lstrlenA (lpString="*.doc") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.docx") returned 0
	[0069.795] lstrlenA (lpString="*.docx") returned 6
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.xls") returned 0
	[0069.795] lstrlenA (lpString="*.xls") returned 5
	[0069.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.xlsx") returned 0
	[0069.796] lstrlenA (lpString="*.xlsx") returned 6
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.ppt") returned 0
	[0069.796] lstrlenA (lpString="*.ppt") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pptx") returned 0
	[0069.796] lstrlenA (lpString="*.pptx") returned 6
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.txt") returned 0
	[0069.796] lstrlenA (lpString="*.txt") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pdf") returned 0
	[0069.796] lstrlenA (lpString="*.pdf") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.djvu") returned 0
	[0069.796] lstrlenA (lpString="*.djvu") returned 6
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.htm") returned 0
	[0069.796] lstrlenA (lpString="*.htm") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.html") returned 0
	[0069.796] lstrlenA (lpString="*.html") returned 6
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mdb") returned 0
	[0069.796] lstrlenA (lpString="*.mdb") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.cer") returned 0
	[0069.796] lstrlenA (lpString="*.cer") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.p12") returned 0
	[0069.796] lstrlenA (lpString="*.p12") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pfx") returned 0
	[0069.796] lstrlenA (lpString="*.pfx") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.kwm") returned 0
	[0069.796] lstrlenA (lpString="*.kwm") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pwm") returned 0
	[0069.796] lstrlenA (lpString="*.pwm") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.1cd") returned 0
	[0069.796] lstrlenA (lpString="*.1cd") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.md") returned 0
	[0069.796] lstrlenA (lpString="*.md") returned 4
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mdf") returned 0
	[0069.796] lstrlenA (lpString="*.mdf") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.dbf") returned 0
	[0069.796] lstrlenA (lpString="*.dbf") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.odt") returned 0
	[0069.796] lstrlenA (lpString="*.odt") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.vob") returned 0
	[0069.796] lstrlenA (lpString="*.vob") returned 5
	[0069.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.ifo") returned 0
	[0069.796] lstrlenA (lpString="*.ifo") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.lnk") returned 0
	[0069.797] lstrlenA (lpString="*.lnk") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.torrent") returned 0
	[0069.797] lstrlenA (lpString="*.torrent") returned 9
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mov") returned 0
	[0069.797] lstrlenA (lpString="*.mov") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.m2v") returned 0
	[0069.797] lstrlenA (lpString="*.m2v") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.3gp") returned 0
	[0069.797] lstrlenA (lpString="*.3gp") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mpeg") returned 0
	[0069.797] lstrlenA (lpString="*.mpeg") returned 6
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mpg") returned 0
	[0069.797] lstrlenA (lpString="*.mpg") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.flv") returned 0
	[0069.797] lstrlenA (lpString="*.flv") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.avi") returned 0
	[0069.797] lstrlenA (lpString="*.avi") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mp4") returned 0
	[0069.797] lstrlenA (lpString="*.mp4") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.wmv") returned 0
	[0069.797] lstrlenA (lpString="*.wmv") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.divx") returned 0
	[0069.797] lstrlenA (lpString="*.divx") returned 6
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mkv") returned 0
	[0069.797] lstrlenA (lpString="*.mkv") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mp3") returned 0
	[0069.797] lstrlenA (lpString="*.mp3") returned 5
	[0069.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.wav") returned 1
	[0069.797] lstrlenA (lpString="*.wav") returned 5
	[0069.797] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV"
	[0069.797] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV"
	[0069.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV."
	[0069.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.Boom"
	[0069.798] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.798] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfbc
	[0069.798] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb836b000, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x53822dd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb836b000, dwHighDateTime=0x1bfc6e7)) returned 1
	[0069.798] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.798] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xf99, lpOverlapped=0x0) returned 1
	[0069.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV"
	[0069.800] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.800] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xf99, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xf99, lpOverlapped=0x0) returned 1
	[0069.800] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.800] CloseHandle (hObject=0x8c) returned 1
	[0069.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.boom")) returned 1
	[0069.801] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.801] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.801] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LASER.WAV") returned -1
	[0069.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LASER.WAV") returned -1
	[0069.801] lstrcmpiA (lpString1="", lpString2="LASER.WAV") returned -1
	[0069.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV"
	[0069.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV"
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.zip") returned 0
	[0069.801] lstrlenA (lpString="*.zip") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.rar") returned 0
	[0069.801] lstrlenA (lpString="*.rar") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.7z") returned 0
	[0069.801] lstrlenA (lpString="*.7z") returned 4
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.tar") returned 0
	[0069.801] lstrlenA (lpString="*.tar") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.gzip") returned 0
	[0069.801] lstrlenA (lpString="*.gzip") returned 6
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.jpg") returned 0
	[0069.801] lstrlenA (lpString="*.jpg") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.jpeg") returned 0
	[0069.801] lstrlenA (lpString="*.jpeg") returned 6
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.psd") returned 0
	[0069.801] lstrlenA (lpString="*.psd") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.cdr") returned 0
	[0069.801] lstrlenA (lpString="*.cdr") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.dwg") returned 0
	[0069.801] lstrlenA (lpString="*.dwg") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.max") returned 0
	[0069.801] lstrlenA (lpString="*.max") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.bmp") returned 0
	[0069.801] lstrlenA (lpString="*.bmp") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.gif") returned 0
	[0069.801] lstrlenA (lpString="*.gif") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.png") returned 0
	[0069.801] lstrlenA (lpString="*.png") returned 5
	[0069.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.doc") returned 0
	[0069.801] lstrlenA (lpString="*.doc") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.docx") returned 0
	[0069.802] lstrlenA (lpString="*.docx") returned 6
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.xls") returned 0
	[0069.802] lstrlenA (lpString="*.xls") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.xlsx") returned 0
	[0069.802] lstrlenA (lpString="*.xlsx") returned 6
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.ppt") returned 0
	[0069.802] lstrlenA (lpString="*.ppt") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pptx") returned 0
	[0069.802] lstrlenA (lpString="*.pptx") returned 6
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.txt") returned 0
	[0069.802] lstrlenA (lpString="*.txt") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pdf") returned 0
	[0069.802] lstrlenA (lpString="*.pdf") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.djvu") returned 0
	[0069.802] lstrlenA (lpString="*.djvu") returned 6
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.htm") returned 0
	[0069.802] lstrlenA (lpString="*.htm") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.html") returned 0
	[0069.802] lstrlenA (lpString="*.html") returned 6
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mdb") returned 0
	[0069.802] lstrlenA (lpString="*.mdb") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.cer") returned 0
	[0069.802] lstrlenA (lpString="*.cer") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.p12") returned 0
	[0069.802] lstrlenA (lpString="*.p12") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pfx") returned 0
	[0069.802] lstrlenA (lpString="*.pfx") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.kwm") returned 0
	[0069.802] lstrlenA (lpString="*.kwm") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pwm") returned 0
	[0069.802] lstrlenA (lpString="*.pwm") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.1cd") returned 0
	[0069.802] lstrlenA (lpString="*.1cd") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.md") returned 0
	[0069.802] lstrlenA (lpString="*.md") returned 4
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mdf") returned 0
	[0069.802] lstrlenA (lpString="*.mdf") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.dbf") returned 0
	[0069.802] lstrlenA (lpString="*.dbf") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.odt") returned 0
	[0069.802] lstrlenA (lpString="*.odt") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.vob") returned 0
	[0069.802] lstrlenA (lpString="*.vob") returned 5
	[0069.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.ifo") returned 0
	[0069.803] lstrlenA (lpString="*.ifo") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.lnk") returned 0
	[0069.803] lstrlenA (lpString="*.lnk") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.torrent") returned 0
	[0069.803] lstrlenA (lpString="*.torrent") returned 9
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mov") returned 0
	[0069.803] lstrlenA (lpString="*.mov") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.m2v") returned 0
	[0069.803] lstrlenA (lpString="*.m2v") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.3gp") returned 0
	[0069.803] lstrlenA (lpString="*.3gp") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mpeg") returned 0
	[0069.803] lstrlenA (lpString="*.mpeg") returned 6
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mpg") returned 0
	[0069.803] lstrlenA (lpString="*.mpg") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.flv") returned 0
	[0069.803] lstrlenA (lpString="*.flv") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.avi") returned 0
	[0069.803] lstrlenA (lpString="*.avi") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mp4") returned 0
	[0069.803] lstrlenA (lpString="*.mp4") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.wmv") returned 0
	[0069.803] lstrlenA (lpString="*.wmv") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.divx") returned 0
	[0069.803] lstrlenA (lpString="*.divx") returned 6
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mkv") returned 0
	[0069.803] lstrlenA (lpString="*.mkv") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mp3") returned 0
	[0069.803] lstrlenA (lpString="*.mp3") returned 5
	[0069.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.wav") returned 1
	[0069.803] lstrlenA (lpString="*.wav") returned 5
	[0069.803] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV"
	[0069.803] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV"
	[0069.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV."
	[0069.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.Boom"
	[0069.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.804] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72d
	[0069.804] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x66220ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1
	[0069.804] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.804] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x70a, lpOverlapped=0x0) returned 1
	[0069.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV"
	[0069.806] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.806] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x70a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x70a, lpOverlapped=0x0) returned 1
	[0069.806] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.806] CloseHandle (hObject=0x8c) returned 1
	[0069.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.boom")) returned 1
	[0069.807] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.807] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.807] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PUSH.WAV") returned -1
	[0069.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUSH.WAV") returned -1
	[0069.807] lstrcmpiA (lpString1="", lpString2="PUSH.WAV") returned -1
	[0069.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV"
	[0069.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.807] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.807] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV"
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.zip") returned 0
	[0069.807] lstrlenA (lpString="*.zip") returned 5
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.rar") returned 0
	[0069.807] lstrlenA (lpString="*.rar") returned 5
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.7z") returned 0
	[0069.807] lstrlenA (lpString="*.7z") returned 4
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.tar") returned 0
	[0069.807] lstrlenA (lpString="*.tar") returned 5
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.gzip") returned 0
	[0069.807] lstrlenA (lpString="*.gzip") returned 6
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.jpg") returned 0
	[0069.807] lstrlenA (lpString="*.jpg") returned 5
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.jpeg") returned 0
	[0069.807] lstrlenA (lpString="*.jpeg") returned 6
	[0069.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.psd") returned 0
	[0069.807] lstrlenA (lpString="*.psd") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.cdr") returned 0
	[0069.808] lstrlenA (lpString="*.cdr") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.dwg") returned 0
	[0069.808] lstrlenA (lpString="*.dwg") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.max") returned 0
	[0069.808] lstrlenA (lpString="*.max") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.bmp") returned 0
	[0069.808] lstrlenA (lpString="*.bmp") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.gif") returned 0
	[0069.808] lstrlenA (lpString="*.gif") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.png") returned 0
	[0069.808] lstrlenA (lpString="*.png") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.doc") returned 0
	[0069.808] lstrlenA (lpString="*.doc") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.docx") returned 0
	[0069.808] lstrlenA (lpString="*.docx") returned 6
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.xls") returned 0
	[0069.808] lstrlenA (lpString="*.xls") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.xlsx") returned 0
	[0069.808] lstrlenA (lpString="*.xlsx") returned 6
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.ppt") returned 0
	[0069.808] lstrlenA (lpString="*.ppt") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pptx") returned 0
	[0069.808] lstrlenA (lpString="*.pptx") returned 6
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.txt") returned 0
	[0069.808] lstrlenA (lpString="*.txt") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pdf") returned 0
	[0069.808] lstrlenA (lpString="*.pdf") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.djvu") returned 0
	[0069.808] lstrlenA (lpString="*.djvu") returned 6
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.htm") returned 0
	[0069.808] lstrlenA (lpString="*.htm") returned 5
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.html") returned 0
	[0069.808] lstrlenA (lpString="*.html") returned 6
	[0069.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mdb") returned 0
	[0069.809] lstrlenA (lpString="*.mdb") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.cer") returned 0
	[0069.809] lstrlenA (lpString="*.cer") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.p12") returned 0
	[0069.809] lstrlenA (lpString="*.p12") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pfx") returned 0
	[0069.809] lstrlenA (lpString="*.pfx") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.kwm") returned 0
	[0069.809] lstrlenA (lpString="*.kwm") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pwm") returned 0
	[0069.809] lstrlenA (lpString="*.pwm") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.1cd") returned 0
	[0069.809] lstrlenA (lpString="*.1cd") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.md") returned 0
	[0069.809] lstrlenA (lpString="*.md") returned 4
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mdf") returned 0
	[0069.809] lstrlenA (lpString="*.mdf") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.dbf") returned 0
	[0069.809] lstrlenA (lpString="*.dbf") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.odt") returned 0
	[0069.809] lstrlenA (lpString="*.odt") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.vob") returned 0
	[0069.809] lstrlenA (lpString="*.vob") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.ifo") returned 0
	[0069.809] lstrlenA (lpString="*.ifo") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.lnk") returned 0
	[0069.809] lstrlenA (lpString="*.lnk") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.torrent") returned 0
	[0069.809] lstrlenA (lpString="*.torrent") returned 9
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mov") returned 0
	[0069.809] lstrlenA (lpString="*.mov") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.m2v") returned 0
	[0069.809] lstrlenA (lpString="*.m2v") returned 5
	[0069.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.3gp") returned 0
	[0069.810] lstrlenA (lpString="*.3gp") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mpeg") returned 0
	[0069.810] lstrlenA (lpString="*.mpeg") returned 6
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mpg") returned 0
	[0069.810] lstrlenA (lpString="*.mpg") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.flv") returned 0
	[0069.810] lstrlenA (lpString="*.flv") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.avi") returned 0
	[0069.810] lstrlenA (lpString="*.avi") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mp4") returned 0
	[0069.810] lstrlenA (lpString="*.mp4") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.wmv") returned 0
	[0069.810] lstrlenA (lpString="*.wmv") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.divx") returned 0
	[0069.810] lstrlenA (lpString="*.divx") returned 6
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mkv") returned 0
	[0069.810] lstrlenA (lpString="*.mkv") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mp3") returned 0
	[0069.810] lstrlenA (lpString="*.mp3") returned 5
	[0069.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.wav") returned 1
	[0069.810] lstrlenA (lpString="*.wav") returned 5
	[0069.810] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV"
	[0069.810] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV"
	[0069.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV."
	[0069.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.Boom"
	[0069.810] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.812] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d84
	[0069.812] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4b5dc00, dwHighDateTime=0x1bfc6e6), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a7913b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4b5dc00, dwHighDateTime=0x1bfc6e6)) returned 1
	[0069.812] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.812] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3d61, lpOverlapped=0x0) returned 1
	[0069.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV"
	[0069.827] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.827] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3d61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3d61, lpOverlapped=0x0) returned 1
	[0069.827] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.827] CloseHandle (hObject=0x8c) returned 1
	[0069.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.boom")) returned 1
	[0069.828] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.828] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUCTION.WAV") returned -1
	[0069.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUCTION.WAV") returned -1
	[0069.828] lstrcmpiA (lpString1="", lpString2="SUCTION.WAV") returned -1
	[0069.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV"
	[0069.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV"
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.zip") returned 0
	[0069.829] lstrlenA (lpString="*.zip") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.rar") returned 0
	[0069.829] lstrlenA (lpString="*.rar") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.7z") returned 0
	[0069.829] lstrlenA (lpString="*.7z") returned 4
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.tar") returned 0
	[0069.829] lstrlenA (lpString="*.tar") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.gzip") returned 0
	[0069.829] lstrlenA (lpString="*.gzip") returned 6
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.jpg") returned 0
	[0069.829] lstrlenA (lpString="*.jpg") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.jpeg") returned 0
	[0069.829] lstrlenA (lpString="*.jpeg") returned 6
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.psd") returned 0
	[0069.829] lstrlenA (lpString="*.psd") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.cdr") returned 0
	[0069.829] lstrlenA (lpString="*.cdr") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.dwg") returned 0
	[0069.829] lstrlenA (lpString="*.dwg") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.max") returned 0
	[0069.829] lstrlenA (lpString="*.max") returned 5
	[0069.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.bmp") returned 0
	[0069.830] lstrlenA (lpString="*.bmp") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.gif") returned 0
	[0069.830] lstrlenA (lpString="*.gif") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.png") returned 0
	[0069.830] lstrlenA (lpString="*.png") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.doc") returned 0
	[0069.830] lstrlenA (lpString="*.doc") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.docx") returned 0
	[0069.830] lstrlenA (lpString="*.docx") returned 6
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.xls") returned 0
	[0069.830] lstrlenA (lpString="*.xls") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.xlsx") returned 0
	[0069.830] lstrlenA (lpString="*.xlsx") returned 6
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.ppt") returned 0
	[0069.830] lstrlenA (lpString="*.ppt") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pptx") returned 0
	[0069.830] lstrlenA (lpString="*.pptx") returned 6
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.txt") returned 0
	[0069.830] lstrlenA (lpString="*.txt") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pdf") returned 0
	[0069.830] lstrlenA (lpString="*.pdf") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.djvu") returned 0
	[0069.830] lstrlenA (lpString="*.djvu") returned 6
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.htm") returned 0
	[0069.830] lstrlenA (lpString="*.htm") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.html") returned 0
	[0069.830] lstrlenA (lpString="*.html") returned 6
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mdb") returned 0
	[0069.830] lstrlenA (lpString="*.mdb") returned 5
	[0069.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.cer") returned 0
	[0069.831] lstrlenA (lpString="*.cer") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.p12") returned 0
	[0069.831] lstrlenA (lpString="*.p12") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pfx") returned 0
	[0069.831] lstrlenA (lpString="*.pfx") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.kwm") returned 0
	[0069.831] lstrlenA (lpString="*.kwm") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pwm") returned 0
	[0069.831] lstrlenA (lpString="*.pwm") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.1cd") returned 0
	[0069.831] lstrlenA (lpString="*.1cd") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.md") returned 0
	[0069.831] lstrlenA (lpString="*.md") returned 4
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mdf") returned 0
	[0069.831] lstrlenA (lpString="*.mdf") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.dbf") returned 0
	[0069.831] lstrlenA (lpString="*.dbf") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.odt") returned 0
	[0069.831] lstrlenA (lpString="*.odt") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.vob") returned 0
	[0069.831] lstrlenA (lpString="*.vob") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.ifo") returned 0
	[0069.831] lstrlenA (lpString="*.ifo") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.lnk") returned 0
	[0069.831] lstrlenA (lpString="*.lnk") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.torrent") returned 0
	[0069.831] lstrlenA (lpString="*.torrent") returned 9
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mov") returned 0
	[0069.831] lstrlenA (lpString="*.mov") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.m2v") returned 0
	[0069.831] lstrlenA (lpString="*.m2v") returned 5
	[0069.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.3gp") returned 0
	[0069.832] lstrlenA (lpString="*.3gp") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mpeg") returned 0
	[0069.832] lstrlenA (lpString="*.mpeg") returned 6
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mpg") returned 0
	[0069.832] lstrlenA (lpString="*.mpg") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.flv") returned 0
	[0069.832] lstrlenA (lpString="*.flv") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.avi") returned 0
	[0069.832] lstrlenA (lpString="*.avi") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mp4") returned 0
	[0069.832] lstrlenA (lpString="*.mp4") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.wmv") returned 0
	[0069.832] lstrlenA (lpString="*.wmv") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.divx") returned 0
	[0069.832] lstrlenA (lpString="*.divx") returned 6
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mkv") returned 0
	[0069.832] lstrlenA (lpString="*.mkv") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mp3") returned 0
	[0069.832] lstrlenA (lpString="*.mp3") returned 5
	[0069.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.wav") returned 1
	[0069.832] lstrlenA (lpString="*.wav") returned 5
	[0069.832] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV"
	[0069.832] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV"
	[0069.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV."
	[0069.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.Boom"
	[0069.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.834] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1664
	[0069.834] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3eba3e00, dwHighDateTime=0x1bfa2b0), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3eba3e00, dwHighDateTime=0x1bfa2b0)) returned 1
	[0069.834] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.834] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1641, lpOverlapped=0x0) returned 1
	[0069.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV"
	[0069.859] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.859] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1641, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1641, lpOverlapped=0x0) returned 1
	[0069.859] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.859] CloseHandle (hObject=0x8c) returned 1
	[0069.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.boom")) returned 1
	[0069.860] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.861] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.861] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TYPE.WAV") returned -1
	[0069.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TYPE.WAV") returned -1
	[0069.861] lstrcmpiA (lpString1="", lpString2="TYPE.WAV") returned -1
	[0069.861] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV"
	[0069.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.861] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.861] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV"
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.zip") returned 0
	[0069.861] lstrlenA (lpString="*.zip") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.rar") returned 0
	[0069.861] lstrlenA (lpString="*.rar") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.7z") returned 0
	[0069.861] lstrlenA (lpString="*.7z") returned 4
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.tar") returned 0
	[0069.861] lstrlenA (lpString="*.tar") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.gzip") returned 0
	[0069.861] lstrlenA (lpString="*.gzip") returned 6
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.jpg") returned 0
	[0069.861] lstrlenA (lpString="*.jpg") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.jpeg") returned 0
	[0069.861] lstrlenA (lpString="*.jpeg") returned 6
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.psd") returned 0
	[0069.861] lstrlenA (lpString="*.psd") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.cdr") returned 0
	[0069.861] lstrlenA (lpString="*.cdr") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.dwg") returned 0
	[0069.861] lstrlenA (lpString="*.dwg") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.max") returned 0
	[0069.861] lstrlenA (lpString="*.max") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.bmp") returned 0
	[0069.861] lstrlenA (lpString="*.bmp") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.gif") returned 0
	[0069.861] lstrlenA (lpString="*.gif") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.png") returned 0
	[0069.861] lstrlenA (lpString="*.png") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.doc") returned 0
	[0069.861] lstrlenA (lpString="*.doc") returned 5
	[0069.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.docx") returned 0
	[0069.862] lstrlenA (lpString="*.docx") returned 6
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.xls") returned 0
	[0069.862] lstrlenA (lpString="*.xls") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.xlsx") returned 0
	[0069.862] lstrlenA (lpString="*.xlsx") returned 6
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.ppt") returned 0
	[0069.862] lstrlenA (lpString="*.ppt") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pptx") returned 0
	[0069.862] lstrlenA (lpString="*.pptx") returned 6
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.txt") returned 0
	[0069.862] lstrlenA (lpString="*.txt") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pdf") returned 0
	[0069.862] lstrlenA (lpString="*.pdf") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.djvu") returned 0
	[0069.862] lstrlenA (lpString="*.djvu") returned 6
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.htm") returned 0
	[0069.862] lstrlenA (lpString="*.htm") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.html") returned 0
	[0069.862] lstrlenA (lpString="*.html") returned 6
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mdb") returned 0
	[0069.862] lstrlenA (lpString="*.mdb") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.cer") returned 0
	[0069.862] lstrlenA (lpString="*.cer") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.p12") returned 0
	[0069.862] lstrlenA (lpString="*.p12") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pfx") returned 0
	[0069.862] lstrlenA (lpString="*.pfx") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.kwm") returned 0
	[0069.862] lstrlenA (lpString="*.kwm") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pwm") returned 0
	[0069.862] lstrlenA (lpString="*.pwm") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.1cd") returned 0
	[0069.862] lstrlenA (lpString="*.1cd") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.md") returned 0
	[0069.862] lstrlenA (lpString="*.md") returned 4
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mdf") returned 0
	[0069.862] lstrlenA (lpString="*.mdf") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.dbf") returned 0
	[0069.862] lstrlenA (lpString="*.dbf") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.odt") returned 0
	[0069.862] lstrlenA (lpString="*.odt") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.vob") returned 0
	[0069.862] lstrlenA (lpString="*.vob") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.ifo") returned 0
	[0069.862] lstrlenA (lpString="*.ifo") returned 5
	[0069.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.lnk") returned 0
	[0069.863] lstrlenA (lpString="*.lnk") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.torrent") returned 0
	[0069.863] lstrlenA (lpString="*.torrent") returned 9
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mov") returned 0
	[0069.863] lstrlenA (lpString="*.mov") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.m2v") returned 0
	[0069.863] lstrlenA (lpString="*.m2v") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.3gp") returned 0
	[0069.863] lstrlenA (lpString="*.3gp") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mpeg") returned 0
	[0069.863] lstrlenA (lpString="*.mpeg") returned 6
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mpg") returned 0
	[0069.863] lstrlenA (lpString="*.mpg") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.flv") returned 0
	[0069.863] lstrlenA (lpString="*.flv") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.avi") returned 0
	[0069.863] lstrlenA (lpString="*.avi") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mp4") returned 0
	[0069.863] lstrlenA (lpString="*.mp4") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.wmv") returned 0
	[0069.863] lstrlenA (lpString="*.wmv") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.divx") returned 0
	[0069.863] lstrlenA (lpString="*.divx") returned 6
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mkv") returned 0
	[0069.863] lstrlenA (lpString="*.mkv") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mp3") returned 0
	[0069.863] lstrlenA (lpString="*.mp3") returned 5
	[0069.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.wav") returned 1
	[0069.863] lstrlenA (lpString="*.wav") returned 5
	[0069.863] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV"
	[0069.863] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV"
	[0069.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV."
	[0069.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.Boom"
	[0069.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.865] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121c
	[0069.865] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d56d990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1
	[0069.865] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.865] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x11f9, lpOverlapped=0x0) returned 1
	[0069.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV"
	[0069.902] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.902] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x11f9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x11f9, lpOverlapped=0x0) returned 1
	[0069.902] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.902] CloseHandle (hObject=0x8c) returned 1
	[0069.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.boom")) returned 1
	[0069.903] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.903] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.903] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VOLTAGE.WAV") returned -1
	[0069.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VOLTAGE.WAV") returned -1
	[0069.903] lstrcmpiA (lpString1="", lpString2="VOLTAGE.WAV") returned -1
	[0069.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV"
	[0069.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV"
	[0069.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.zip") returned 0
	[0069.903] lstrlenA (lpString="*.zip") returned 5
	[0069.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.rar") returned 0
	[0069.904] lstrlenA (lpString="*.rar") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.7z") returned 0
	[0069.904] lstrlenA (lpString="*.7z") returned 4
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.tar") returned 0
	[0069.904] lstrlenA (lpString="*.tar") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.gzip") returned 0
	[0069.904] lstrlenA (lpString="*.gzip") returned 6
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.jpg") returned 0
	[0069.904] lstrlenA (lpString="*.jpg") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.jpeg") returned 0
	[0069.904] lstrlenA (lpString="*.jpeg") returned 6
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.psd") returned 0
	[0069.904] lstrlenA (lpString="*.psd") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.cdr") returned 0
	[0069.904] lstrlenA (lpString="*.cdr") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.dwg") returned 0
	[0069.904] lstrlenA (lpString="*.dwg") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.max") returned 0
	[0069.904] lstrlenA (lpString="*.max") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.bmp") returned 0
	[0069.904] lstrlenA (lpString="*.bmp") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.gif") returned 0
	[0069.904] lstrlenA (lpString="*.gif") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.png") returned 0
	[0069.904] lstrlenA (lpString="*.png") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.doc") returned 0
	[0069.904] lstrlenA (lpString="*.doc") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.docx") returned 0
	[0069.904] lstrlenA (lpString="*.docx") returned 6
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.xls") returned 0
	[0069.904] lstrlenA (lpString="*.xls") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.xlsx") returned 0
	[0069.904] lstrlenA (lpString="*.xlsx") returned 6
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.ppt") returned 0
	[0069.904] lstrlenA (lpString="*.ppt") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pptx") returned 0
	[0069.904] lstrlenA (lpString="*.pptx") returned 6
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.txt") returned 0
	[0069.904] lstrlenA (lpString="*.txt") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pdf") returned 0
	[0069.904] lstrlenA (lpString="*.pdf") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.djvu") returned 0
	[0069.904] lstrlenA (lpString="*.djvu") returned 6
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.htm") returned 0
	[0069.904] lstrlenA (lpString="*.htm") returned 5
	[0069.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.html") returned 0
	[0069.905] lstrlenA (lpString="*.html") returned 6
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mdb") returned 0
	[0069.905] lstrlenA (lpString="*.mdb") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.cer") returned 0
	[0069.905] lstrlenA (lpString="*.cer") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.p12") returned 0
	[0069.905] lstrlenA (lpString="*.p12") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pfx") returned 0
	[0069.905] lstrlenA (lpString="*.pfx") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.kwm") returned 0
	[0069.905] lstrlenA (lpString="*.kwm") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pwm") returned 0
	[0069.905] lstrlenA (lpString="*.pwm") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.1cd") returned 0
	[0069.905] lstrlenA (lpString="*.1cd") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.md") returned 0
	[0069.905] lstrlenA (lpString="*.md") returned 4
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mdf") returned 0
	[0069.905] lstrlenA (lpString="*.mdf") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.dbf") returned 0
	[0069.905] lstrlenA (lpString="*.dbf") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.odt") returned 0
	[0069.905] lstrlenA (lpString="*.odt") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.vob") returned 0
	[0069.905] lstrlenA (lpString="*.vob") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.ifo") returned 0
	[0069.905] lstrlenA (lpString="*.ifo") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.lnk") returned 0
	[0069.905] lstrlenA (lpString="*.lnk") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.torrent") returned 0
	[0069.905] lstrlenA (lpString="*.torrent") returned 9
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mov") returned 0
	[0069.905] lstrlenA (lpString="*.mov") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.m2v") returned 0
	[0069.905] lstrlenA (lpString="*.m2v") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.3gp") returned 0
	[0069.905] lstrlenA (lpString="*.3gp") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mpeg") returned 0
	[0069.905] lstrlenA (lpString="*.mpeg") returned 6
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mpg") returned 0
	[0069.905] lstrlenA (lpString="*.mpg") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.flv") returned 0
	[0069.905] lstrlenA (lpString="*.flv") returned 5
	[0069.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.avi") returned 0
	[0069.905] lstrlenA (lpString="*.avi") returned 5
	[0069.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mp4") returned 0
	[0069.906] lstrlenA (lpString="*.mp4") returned 5
	[0069.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.wmv") returned 0
	[0069.906] lstrlenA (lpString="*.wmv") returned 5
	[0069.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.divx") returned 0
	[0069.906] lstrlenA (lpString="*.divx") returned 6
	[0069.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mkv") returned 0
	[0069.906] lstrlenA (lpString="*.mkv") returned 5
	[0069.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mp3") returned 0
	[0069.906] lstrlenA (lpString="*.mp3") returned 5
	[0069.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.wav") returned 1
	[0069.906] lstrlenA (lpString="*.wav") returned 5
	[0069.906] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV"
	[0069.906] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV"
	[0069.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV."
	[0069.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.Boom"
	[0069.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.906] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c6
	[0069.906] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xecdb8800, dwHighDateTime=0x1bfbeed), lpLastAccessTime=0x407536*(dwLowDateTime=0x7071e4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecdb8800, dwHighDateTime=0x1bfbeed)) returned 1
	[0069.906] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.907] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x35a3, lpOverlapped=0x0) returned 1
	[0069.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV"
	[0069.968] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.968] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x35a3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x35a3, lpOverlapped=0x0) returned 1
	[0069.969] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0069.969] CloseHandle (hObject=0x8c) returned 1
	[0069.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.boom")) returned 1
	[0069.970] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0069.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0069.970] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHOOSH.WAV") returned -1
	[0069.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHOOSH.WAV") returned -1
	[0069.970] lstrcmpiA (lpString1="", lpString2="WHOOSH.WAV") returned -1
	[0069.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV"
	[0069.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0069.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0069.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0069.970] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0069.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV"
	[0069.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.zip") returned 0
	[0069.970] lstrlenA (lpString="*.zip") returned 5
	[0069.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.rar") returned 0
	[0069.970] lstrlenA (lpString="*.rar") returned 5
	[0069.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.7z") returned 0
	[0069.970] lstrlenA (lpString="*.7z") returned 4
	[0069.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.tar") returned 0
	[0069.970] lstrlenA (lpString="*.tar") returned 5
	[0069.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.gzip") returned 0
	[0069.970] lstrlenA (lpString="*.gzip") returned 6
	[0069.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.jpg") returned 0
	[0069.971] lstrlenA (lpString="*.jpg") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.jpeg") returned 0
	[0069.971] lstrlenA (lpString="*.jpeg") returned 6
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.psd") returned 0
	[0069.971] lstrlenA (lpString="*.psd") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.cdr") returned 0
	[0069.971] lstrlenA (lpString="*.cdr") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.dwg") returned 0
	[0069.971] lstrlenA (lpString="*.dwg") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.max") returned 0
	[0069.971] lstrlenA (lpString="*.max") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.bmp") returned 0
	[0069.971] lstrlenA (lpString="*.bmp") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.gif") returned 0
	[0069.971] lstrlenA (lpString="*.gif") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.png") returned 0
	[0069.971] lstrlenA (lpString="*.png") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.doc") returned 0
	[0069.971] lstrlenA (lpString="*.doc") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.docx") returned 0
	[0069.971] lstrlenA (lpString="*.docx") returned 6
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.xls") returned 0
	[0069.971] lstrlenA (lpString="*.xls") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.xlsx") returned 0
	[0069.971] lstrlenA (lpString="*.xlsx") returned 6
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.ppt") returned 0
	[0069.971] lstrlenA (lpString="*.ppt") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pptx") returned 0
	[0069.971] lstrlenA (lpString="*.pptx") returned 6
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.txt") returned 0
	[0069.971] lstrlenA (lpString="*.txt") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pdf") returned 0
	[0069.971] lstrlenA (lpString="*.pdf") returned 5
	[0069.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.djvu") returned 0
	[0069.971] lstrlenA (lpString="*.djvu") returned 6
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.htm") returned 0
	[0069.972] lstrlenA (lpString="*.htm") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.html") returned 0
	[0069.972] lstrlenA (lpString="*.html") returned 6
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mdb") returned 0
	[0069.972] lstrlenA (lpString="*.mdb") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.cer") returned 0
	[0069.972] lstrlenA (lpString="*.cer") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.p12") returned 0
	[0069.972] lstrlenA (lpString="*.p12") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pfx") returned 0
	[0069.972] lstrlenA (lpString="*.pfx") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.kwm") returned 0
	[0069.972] lstrlenA (lpString="*.kwm") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pwm") returned 0
	[0069.972] lstrlenA (lpString="*.pwm") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.1cd") returned 0
	[0069.972] lstrlenA (lpString="*.1cd") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.md") returned 0
	[0069.972] lstrlenA (lpString="*.md") returned 4
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mdf") returned 0
	[0069.972] lstrlenA (lpString="*.mdf") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.dbf") returned 0
	[0069.972] lstrlenA (lpString="*.dbf") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.odt") returned 0
	[0069.972] lstrlenA (lpString="*.odt") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.vob") returned 0
	[0069.972] lstrlenA (lpString="*.vob") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.ifo") returned 0
	[0069.972] lstrlenA (lpString="*.ifo") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.lnk") returned 0
	[0069.972] lstrlenA (lpString="*.lnk") returned 5
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.torrent") returned 0
	[0069.972] lstrlenA (lpString="*.torrent") returned 9
	[0069.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mov") returned 0
	[0069.973] lstrlenA (lpString="*.mov") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.m2v") returned 0
	[0069.973] lstrlenA (lpString="*.m2v") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.3gp") returned 0
	[0069.973] lstrlenA (lpString="*.3gp") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mpeg") returned 0
	[0069.973] lstrlenA (lpString="*.mpeg") returned 6
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mpg") returned 0
	[0069.973] lstrlenA (lpString="*.mpg") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.flv") returned 0
	[0069.973] lstrlenA (lpString="*.flv") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.avi") returned 0
	[0069.973] lstrlenA (lpString="*.avi") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mp4") returned 0
	[0069.973] lstrlenA (lpString="*.mp4") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.wmv") returned 0
	[0069.973] lstrlenA (lpString="*.wmv") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.divx") returned 0
	[0069.973] lstrlenA (lpString="*.divx") returned 6
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mkv") returned 0
	[0069.973] lstrlenA (lpString="*.mkv") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mp3") returned 0
	[0069.973] lstrlenA (lpString="*.mp3") returned 5
	[0069.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.wav") returned 1
	[0069.973] lstrlenA (lpString="*.wav") returned 5
	[0069.973] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV"
	[0069.973] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV"
	[0069.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV."
	[0069.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.Boom"
	[0069.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0069.974] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6de
	[0069.974] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1
	[0069.974] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0069.974] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x6bb, lpOverlapped=0x0) returned 1
	[0070.004] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV"
	[0070.005] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.005] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x6bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x6bb, lpOverlapped=0x0) returned 1
	[0070.005] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.005] CloseHandle (hObject=0x8c) returned 1
	[0070.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.boom")) returned 1
	[0070.006] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.006] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.006] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WIND.WAV") returned -1
	[0070.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WIND.WAV") returned -1
	[0070.006] lstrcmpiA (lpString1="", lpString2="WIND.WAV") returned -1
	[0070.006] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV"
	[0070.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\"
	[0070.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned=""
	[0070.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt"
	[0070.006] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20
	[0070.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV"
	[0070.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.zip") returned 0
	[0070.006] lstrlenA (lpString="*.zip") returned 5
	[0070.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.rar") returned 0
	[0070.006] lstrlenA (lpString="*.rar") returned 5
	[0070.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.7z") returned 0
	[0070.006] lstrlenA (lpString="*.7z") returned 4
	[0070.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.tar") returned 0
	[0070.007] lstrlenA (lpString="*.tar") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.gzip") returned 0
	[0070.007] lstrlenA (lpString="*.gzip") returned 6
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.jpg") returned 0
	[0070.007] lstrlenA (lpString="*.jpg") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.jpeg") returned 0
	[0070.007] lstrlenA (lpString="*.jpeg") returned 6
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.psd") returned 0
	[0070.007] lstrlenA (lpString="*.psd") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.cdr") returned 0
	[0070.007] lstrlenA (lpString="*.cdr") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.dwg") returned 0
	[0070.007] lstrlenA (lpString="*.dwg") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.max") returned 0
	[0070.007] lstrlenA (lpString="*.max") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.bmp") returned 0
	[0070.007] lstrlenA (lpString="*.bmp") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.gif") returned 0
	[0070.007] lstrlenA (lpString="*.gif") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.png") returned 0
	[0070.007] lstrlenA (lpString="*.png") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.doc") returned 0
	[0070.007] lstrlenA (lpString="*.doc") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.docx") returned 0
	[0070.007] lstrlenA (lpString="*.docx") returned 6
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.xls") returned 0
	[0070.007] lstrlenA (lpString="*.xls") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.xlsx") returned 0
	[0070.007] lstrlenA (lpString="*.xlsx") returned 6
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.ppt") returned 0
	[0070.007] lstrlenA (lpString="*.ppt") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pptx") returned 0
	[0070.007] lstrlenA (lpString="*.pptx") returned 6
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.txt") returned 0
	[0070.007] lstrlenA (lpString="*.txt") returned 5
	[0070.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pdf") returned 0
	[0070.008] lstrlenA (lpString="*.pdf") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.djvu") returned 0
	[0070.008] lstrlenA (lpString="*.djvu") returned 6
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.htm") returned 0
	[0070.008] lstrlenA (lpString="*.htm") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.html") returned 0
	[0070.008] lstrlenA (lpString="*.html") returned 6
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mdb") returned 0
	[0070.008] lstrlenA (lpString="*.mdb") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.cer") returned 0
	[0070.008] lstrlenA (lpString="*.cer") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.p12") returned 0
	[0070.008] lstrlenA (lpString="*.p12") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pfx") returned 0
	[0070.008] lstrlenA (lpString="*.pfx") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.kwm") returned 0
	[0070.008] lstrlenA (lpString="*.kwm") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pwm") returned 0
	[0070.008] lstrlenA (lpString="*.pwm") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.1cd") returned 0
	[0070.008] lstrlenA (lpString="*.1cd") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.md") returned 0
	[0070.008] lstrlenA (lpString="*.md") returned 4
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mdf") returned 0
	[0070.008] lstrlenA (lpString="*.mdf") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.dbf") returned 0
	[0070.008] lstrlenA (lpString="*.dbf") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.odt") returned 0
	[0070.008] lstrlenA (lpString="*.odt") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.vob") returned 0
	[0070.008] lstrlenA (lpString="*.vob") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.ifo") returned 0
	[0070.008] lstrlenA (lpString="*.ifo") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.lnk") returned 0
	[0070.008] lstrlenA (lpString="*.lnk") returned 5
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.torrent") returned 0
	[0070.008] lstrlenA (lpString="*.torrent") returned 9
	[0070.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mov") returned 0
	[0070.008] lstrlenA (lpString="*.mov") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.m2v") returned 0
	[0070.009] lstrlenA (lpString="*.m2v") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.3gp") returned 0
	[0070.009] lstrlenA (lpString="*.3gp") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mpeg") returned 0
	[0070.009] lstrlenA (lpString="*.mpeg") returned 6
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mpg") returned 0
	[0070.009] lstrlenA (lpString="*.mpg") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.flv") returned 0
	[0070.009] lstrlenA (lpString="*.flv") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.avi") returned 0
	[0070.009] lstrlenA (lpString="*.avi") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mp4") returned 0
	[0070.009] lstrlenA (lpString="*.mp4") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.wmv") returned 0
	[0070.009] lstrlenA (lpString="*.wmv") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.divx") returned 0
	[0070.009] lstrlenA (lpString="*.divx") returned 6
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mkv") returned 0
	[0070.009] lstrlenA (lpString="*.mkv") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mp3") returned 0
	[0070.009] lstrlenA (lpString="*.mp3") returned 5
	[0070.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.wav") returned 1
	[0070.009] lstrlenA (lpString="*.wav") returned 5
	[0070.009] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV"
	[0070.009] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV"
	[0070.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV."
	[0070.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.Boom"
	[0070.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0070.011] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b84
	[0070.011] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdcde5800, dwHighDateTime=0x1bfc6e6), lpLastAccessTime=0x407536*(dwLowDateTime=0x708e7550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdcde5800, dwHighDateTime=0x1bfc6e6)) returned 1
	[0070.011] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.011] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x2b61, lpOverlapped=0x0) returned 1
	[0070.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="WIND.WAV"
	[0070.021] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.021] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x2b61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x2b61, lpOverlapped=0x0) returned 1
	[0070.021] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.021] CloseHandle (hObject=0x8c) returned 1
	[0070.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.boom")) returned 1
	[0070.022] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0070.022] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0070.022] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.022] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.022] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.BusinessData.dll") returned -1
	[0070.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.dll") returned -1
	[0070.022] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.dll") returned -1
	[0070.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0070.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.BusinessData.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll"
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.zip") returned 0
	[0070.023] lstrlenA (lpString="*.zip") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.rar") returned 0
	[0070.023] lstrlenA (lpString="*.rar") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.7z") returned 0
	[0070.023] lstrlenA (lpString="*.7z") returned 4
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.tar") returned 0
	[0070.023] lstrlenA (lpString="*.tar") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.gzip") returned 0
	[0070.023] lstrlenA (lpString="*.gzip") returned 6
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.jpg") returned 0
	[0070.023] lstrlenA (lpString="*.jpg") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.jpeg") returned 0
	[0070.023] lstrlenA (lpString="*.jpeg") returned 6
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.psd") returned 0
	[0070.023] lstrlenA (lpString="*.psd") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.cdr") returned 0
	[0070.023] lstrlenA (lpString="*.cdr") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.dwg") returned 0
	[0070.023] lstrlenA (lpString="*.dwg") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.max") returned 0
	[0070.023] lstrlenA (lpString="*.max") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.bmp") returned 0
	[0070.023] lstrlenA (lpString="*.bmp") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.gif") returned 0
	[0070.023] lstrlenA (lpString="*.gif") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.png") returned 0
	[0070.023] lstrlenA (lpString="*.png") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.doc") returned 0
	[0070.023] lstrlenA (lpString="*.doc") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.docx") returned 0
	[0070.023] lstrlenA (lpString="*.docx") returned 6
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.xls") returned 0
	[0070.023] lstrlenA (lpString="*.xls") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.xlsx") returned 0
	[0070.023] lstrlenA (lpString="*.xlsx") returned 6
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ppt") returned 0
	[0070.023] lstrlenA (lpString="*.ppt") returned 5
	[0070.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pptx") returned 0
	[0070.024] lstrlenA (lpString="*.pptx") returned 6
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.txt") returned 0
	[0070.024] lstrlenA (lpString="*.txt") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pdf") returned 0
	[0070.024] lstrlenA (lpString="*.pdf") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.djvu") returned 0
	[0070.024] lstrlenA (lpString="*.djvu") returned 6
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.htm") returned 0
	[0070.024] lstrlenA (lpString="*.htm") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.html") returned 0
	[0070.024] lstrlenA (lpString="*.html") returned 6
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mdb") returned 0
	[0070.024] lstrlenA (lpString="*.mdb") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.cer") returned 0
	[0070.024] lstrlenA (lpString="*.cer") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.p12") returned 0
	[0070.024] lstrlenA (lpString="*.p12") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pfx") returned 0
	[0070.024] lstrlenA (lpString="*.pfx") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.kwm") returned 0
	[0070.024] lstrlenA (lpString="*.kwm") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pwm") returned 0
	[0070.024] lstrlenA (lpString="*.pwm") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.1cd") returned 0
	[0070.024] lstrlenA (lpString="*.1cd") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.md") returned 0
	[0070.024] lstrlenA (lpString="*.md") returned 4
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mdf") returned 0
	[0070.024] lstrlenA (lpString="*.mdf") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.dbf") returned 0
	[0070.024] lstrlenA (lpString="*.dbf") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.odt") returned 0
	[0070.024] lstrlenA (lpString="*.odt") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.vob") returned 0
	[0070.024] lstrlenA (lpString="*.vob") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ifo") returned 0
	[0070.024] lstrlenA (lpString="*.ifo") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.lnk") returned 0
	[0070.024] lstrlenA (lpString="*.lnk") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.torrent") returned 0
	[0070.024] lstrlenA (lpString="*.torrent") returned 9
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mov") returned 0
	[0070.024] lstrlenA (lpString="*.mov") returned 5
	[0070.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.m2v") returned 0
	[0070.024] lstrlenA (lpString="*.m2v") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.3gp") returned 0
	[0070.025] lstrlenA (lpString="*.3gp") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mpeg") returned 0
	[0070.025] lstrlenA (lpString="*.mpeg") returned 6
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mpg") returned 0
	[0070.025] lstrlenA (lpString="*.mpg") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.flv") returned 0
	[0070.025] lstrlenA (lpString="*.flv") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.avi") returned 0
	[0070.025] lstrlenA (lpString="*.avi") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mp4") returned 0
	[0070.025] lstrlenA (lpString="*.mp4") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wmv") returned 0
	[0070.025] lstrlenA (lpString="*.wmv") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.divx") returned 0
	[0070.025] lstrlenA (lpString="*.divx") returned 6
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mkv") returned 0
	[0070.025] lstrlenA (lpString="*.mkv") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mp3") returned 0
	[0070.025] lstrlenA (lpString="*.mp3") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wav") returned 0
	[0070.025] lstrlenA (lpString="*.wav") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.flac") returned 0
	[0070.025] lstrlenA (lpString="*.flac") returned 6
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ape") returned 0
	[0070.025] lstrlenA (lpString="*.ape") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wma") returned 0
	[0070.025] lstrlenA (lpString="*.wma") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ac3") returned 0
	[0070.025] lstrlenA (lpString="*.ac3") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.exe") returned 0
	[0070.025] lstrlenA (lpString="*.exe") returned 5
	[0070.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.apk") returned 0
	[0070.025] lstrlenA (lpString="*.apk") returned 5
	[0070.025] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.025] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.BusinessData.xml") returned -1
	[0070.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.xml") returned -1
	[0070.025] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.xml") returned -1
	[0070.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned="Microsoft.BusinessData.dll"
	[0070.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.025] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.BusinessData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml"
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.zip") returned 0
	[0070.026] lstrlenA (lpString="*.zip") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.rar") returned 0
	[0070.026] lstrlenA (lpString="*.rar") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.7z") returned 0
	[0070.026] lstrlenA (lpString="*.7z") returned 4
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.tar") returned 0
	[0070.026] lstrlenA (lpString="*.tar") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.gzip") returned 0
	[0070.026] lstrlenA (lpString="*.gzip") returned 6
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.jpg") returned 0
	[0070.026] lstrlenA (lpString="*.jpg") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.jpeg") returned 0
	[0070.026] lstrlenA (lpString="*.jpeg") returned 6
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.psd") returned 0
	[0070.026] lstrlenA (lpString="*.psd") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.cdr") returned 0
	[0070.026] lstrlenA (lpString="*.cdr") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.dwg") returned 0
	[0070.026] lstrlenA (lpString="*.dwg") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.max") returned 0
	[0070.026] lstrlenA (lpString="*.max") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.bmp") returned 0
	[0070.026] lstrlenA (lpString="*.bmp") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.gif") returned 0
	[0070.026] lstrlenA (lpString="*.gif") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.png") returned 0
	[0070.026] lstrlenA (lpString="*.png") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.doc") returned 0
	[0070.026] lstrlenA (lpString="*.doc") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.docx") returned 0
	[0070.026] lstrlenA (lpString="*.docx") returned 6
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.xls") returned 0
	[0070.026] lstrlenA (lpString="*.xls") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.xlsx") returned 0
	[0070.026] lstrlenA (lpString="*.xlsx") returned 6
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ppt") returned 0
	[0070.026] lstrlenA (lpString="*.ppt") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pptx") returned 0
	[0070.026] lstrlenA (lpString="*.pptx") returned 6
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.txt") returned 0
	[0070.026] lstrlenA (lpString="*.txt") returned 5
	[0070.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pdf") returned 0
	[0070.026] lstrlenA (lpString="*.pdf") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.djvu") returned 0
	[0070.027] lstrlenA (lpString="*.djvu") returned 6
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.htm") returned 0
	[0070.027] lstrlenA (lpString="*.htm") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.html") returned 0
	[0070.027] lstrlenA (lpString="*.html") returned 6
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mdb") returned 0
	[0070.027] lstrlenA (lpString="*.mdb") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.cer") returned 0
	[0070.027] lstrlenA (lpString="*.cer") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.p12") returned 0
	[0070.027] lstrlenA (lpString="*.p12") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pfx") returned 0
	[0070.027] lstrlenA (lpString="*.pfx") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.kwm") returned 0
	[0070.027] lstrlenA (lpString="*.kwm") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pwm") returned 0
	[0070.027] lstrlenA (lpString="*.pwm") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.1cd") returned 0
	[0070.027] lstrlenA (lpString="*.1cd") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.md") returned 0
	[0070.027] lstrlenA (lpString="*.md") returned 4
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mdf") returned 0
	[0070.027] lstrlenA (lpString="*.mdf") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.dbf") returned 0
	[0070.027] lstrlenA (lpString="*.dbf") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.odt") returned 0
	[0070.027] lstrlenA (lpString="*.odt") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.vob") returned 0
	[0070.027] lstrlenA (lpString="*.vob") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ifo") returned 0
	[0070.027] lstrlenA (lpString="*.ifo") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.lnk") returned 0
	[0070.027] lstrlenA (lpString="*.lnk") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.torrent") returned 0
	[0070.027] lstrlenA (lpString="*.torrent") returned 9
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mov") returned 0
	[0070.027] lstrlenA (lpString="*.mov") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.m2v") returned 0
	[0070.027] lstrlenA (lpString="*.m2v") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.3gp") returned 0
	[0070.027] lstrlenA (lpString="*.3gp") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mpeg") returned 0
	[0070.027] lstrlenA (lpString="*.mpeg") returned 6
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mpg") returned 0
	[0070.027] lstrlenA (lpString="*.mpg") returned 5
	[0070.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.flv") returned 0
	[0070.028] lstrlenA (lpString="*.flv") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.avi") returned 0
	[0070.028] lstrlenA (lpString="*.avi") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mp4") returned 0
	[0070.028] lstrlenA (lpString="*.mp4") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wmv") returned 0
	[0070.028] lstrlenA (lpString="*.wmv") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.divx") returned 0
	[0070.028] lstrlenA (lpString="*.divx") returned 6
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mkv") returned 0
	[0070.028] lstrlenA (lpString="*.mkv") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mp3") returned 0
	[0070.028] lstrlenA (lpString="*.mp3") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wav") returned 0
	[0070.028] lstrlenA (lpString="*.wav") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.flac") returned 0
	[0070.028] lstrlenA (lpString="*.flac") returned 6
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ape") returned 0
	[0070.028] lstrlenA (lpString="*.ape") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wma") returned 0
	[0070.028] lstrlenA (lpString="*.wma") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ac3") returned 0
	[0070.028] lstrlenA (lpString="*.ac3") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.exe") returned 0
	[0070.028] lstrlenA (lpString="*.exe") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.apk") returned 0
	[0070.028] lstrlenA (lpString="*.apk") returned 5
	[0070.028] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.028] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.028] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1
	[0070.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1
	[0070.028] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1
	[0070.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="Microsoft.BusinessData.xml"
	[0070.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll"
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.zip") returned 0
	[0070.028] lstrlenA (lpString="*.zip") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.rar") returned 0
	[0070.028] lstrlenA (lpString="*.rar") returned 5
	[0070.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.7z") returned 0
	[0070.029] lstrlenA (lpString="*.7z") returned 4
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.tar") returned 0
	[0070.029] lstrlenA (lpString="*.tar") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.gzip") returned 0
	[0070.029] lstrlenA (lpString="*.gzip") returned 6
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.jpg") returned 0
	[0070.029] lstrlenA (lpString="*.jpg") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.jpeg") returned 0
	[0070.029] lstrlenA (lpString="*.jpeg") returned 6
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.psd") returned 0
	[0070.029] lstrlenA (lpString="*.psd") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.cdr") returned 0
	[0070.029] lstrlenA (lpString="*.cdr") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.dwg") returned 0
	[0070.029] lstrlenA (lpString="*.dwg") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.max") returned 0
	[0070.029] lstrlenA (lpString="*.max") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.bmp") returned 0
	[0070.029] lstrlenA (lpString="*.bmp") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.gif") returned 0
	[0070.029] lstrlenA (lpString="*.gif") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.png") returned 0
	[0070.029] lstrlenA (lpString="*.png") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.doc") returned 0
	[0070.029] lstrlenA (lpString="*.doc") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.docx") returned 0
	[0070.029] lstrlenA (lpString="*.docx") returned 6
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.xls") returned 0
	[0070.029] lstrlenA (lpString="*.xls") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.xlsx") returned 0
	[0070.029] lstrlenA (lpString="*.xlsx") returned 6
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ppt") returned 0
	[0070.029] lstrlenA (lpString="*.ppt") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pptx") returned 0
	[0070.029] lstrlenA (lpString="*.pptx") returned 6
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.txt") returned 0
	[0070.029] lstrlenA (lpString="*.txt") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pdf") returned 0
	[0070.029] lstrlenA (lpString="*.pdf") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.djvu") returned 0
	[0070.029] lstrlenA (lpString="*.djvu") returned 6
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.htm") returned 0
	[0070.029] lstrlenA (lpString="*.htm") returned 5
	[0070.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.html") returned 0
	[0070.029] lstrlenA (lpString="*.html") returned 6
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mdb") returned 0
	[0070.030] lstrlenA (lpString="*.mdb") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.cer") returned 0
	[0070.030] lstrlenA (lpString="*.cer") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.p12") returned 0
	[0070.030] lstrlenA (lpString="*.p12") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pfx") returned 0
	[0070.030] lstrlenA (lpString="*.pfx") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.kwm") returned 0
	[0070.030] lstrlenA (lpString="*.kwm") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pwm") returned 0
	[0070.030] lstrlenA (lpString="*.pwm") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.1cd") returned 0
	[0070.030] lstrlenA (lpString="*.1cd") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.md") returned 0
	[0070.030] lstrlenA (lpString="*.md") returned 4
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mdf") returned 0
	[0070.030] lstrlenA (lpString="*.mdf") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.dbf") returned 0
	[0070.030] lstrlenA (lpString="*.dbf") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.odt") returned 0
	[0070.030] lstrlenA (lpString="*.odt") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.vob") returned 0
	[0070.030] lstrlenA (lpString="*.vob") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ifo") returned 0
	[0070.030] lstrlenA (lpString="*.ifo") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.lnk") returned 0
	[0070.030] lstrlenA (lpString="*.lnk") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.torrent") returned 0
	[0070.030] lstrlenA (lpString="*.torrent") returned 9
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mov") returned 0
	[0070.030] lstrlenA (lpString="*.mov") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.m2v") returned 0
	[0070.030] lstrlenA (lpString="*.m2v") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.3gp") returned 0
	[0070.030] lstrlenA (lpString="*.3gp") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mpeg") returned 0
	[0070.030] lstrlenA (lpString="*.mpeg") returned 6
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mpg") returned 0
	[0070.030] lstrlenA (lpString="*.mpg") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.flv") returned 0
	[0070.030] lstrlenA (lpString="*.flv") returned 5
	[0070.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.avi") returned 0
	[0070.030] lstrlenA (lpString="*.avi") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mp4") returned 0
	[0070.031] lstrlenA (lpString="*.mp4") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wmv") returned 0
	[0070.031] lstrlenA (lpString="*.wmv") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.divx") returned 0
	[0070.031] lstrlenA (lpString="*.divx") returned 6
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mkv") returned 0
	[0070.031] lstrlenA (lpString="*.mkv") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mp3") returned 0
	[0070.031] lstrlenA (lpString="*.mp3") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wav") returned 0
	[0070.031] lstrlenA (lpString="*.wav") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.flac") returned 0
	[0070.031] lstrlenA (lpString="*.flac") returned 6
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ape") returned 0
	[0070.031] lstrlenA (lpString="*.ape") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wma") returned 0
	[0070.031] lstrlenA (lpString="*.wma") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ac3") returned 0
	[0070.031] lstrlenA (lpString="*.ac3") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.exe") returned 0
	[0070.031] lstrlenA (lpString="*.exe") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.apk") returned 0
	[0070.031] lstrlenA (lpString="*.apk") returned 5
	[0070.031] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.031] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.031] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1
	[0070.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1
	[0070.031] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1
	[0070.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned="Microsoft.Office.BusinessApplications.Runtime.dll"
	[0070.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml"
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.zip") returned 0
	[0070.031] lstrlenA (lpString="*.zip") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.rar") returned 0
	[0070.031] lstrlenA (lpString="*.rar") returned 5
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.7z") returned 0
	[0070.031] lstrlenA (lpString="*.7z") returned 4
	[0070.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.tar") returned 0
	[0070.031] lstrlenA (lpString="*.tar") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.gzip") returned 0
	[0070.032] lstrlenA (lpString="*.gzip") returned 6
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.jpg") returned 0
	[0070.032] lstrlenA (lpString="*.jpg") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.jpeg") returned 0
	[0070.032] lstrlenA (lpString="*.jpeg") returned 6
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.psd") returned 0
	[0070.032] lstrlenA (lpString="*.psd") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.cdr") returned 0
	[0070.032] lstrlenA (lpString="*.cdr") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.dwg") returned 0
	[0070.032] lstrlenA (lpString="*.dwg") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.max") returned 0
	[0070.032] lstrlenA (lpString="*.max") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.bmp") returned 0
	[0070.032] lstrlenA (lpString="*.bmp") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.gif") returned 0
	[0070.032] lstrlenA (lpString="*.gif") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.png") returned 0
	[0070.032] lstrlenA (lpString="*.png") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.doc") returned 0
	[0070.032] lstrlenA (lpString="*.doc") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.docx") returned 0
	[0070.032] lstrlenA (lpString="*.docx") returned 6
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.xls") returned 0
	[0070.032] lstrlenA (lpString="*.xls") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.xlsx") returned 0
	[0070.032] lstrlenA (lpString="*.xlsx") returned 6
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ppt") returned 0
	[0070.032] lstrlenA (lpString="*.ppt") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pptx") returned 0
	[0070.032] lstrlenA (lpString="*.pptx") returned 6
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.txt") returned 0
	[0070.032] lstrlenA (lpString="*.txt") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pdf") returned 0
	[0070.032] lstrlenA (lpString="*.pdf") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.djvu") returned 0
	[0070.032] lstrlenA (lpString="*.djvu") returned 6
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.htm") returned 0
	[0070.032] lstrlenA (lpString="*.htm") returned 5
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.html") returned 0
	[0070.032] lstrlenA (lpString="*.html") returned 6
	[0070.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mdb") returned 0
	[0070.033] lstrlenA (lpString="*.mdb") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.cer") returned 0
	[0070.033] lstrlenA (lpString="*.cer") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.p12") returned 0
	[0070.033] lstrlenA (lpString="*.p12") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pfx") returned 0
	[0070.033] lstrlenA (lpString="*.pfx") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.kwm") returned 0
	[0070.033] lstrlenA (lpString="*.kwm") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pwm") returned 0
	[0070.033] lstrlenA (lpString="*.pwm") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.1cd") returned 0
	[0070.033] lstrlenA (lpString="*.1cd") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.md") returned 0
	[0070.033] lstrlenA (lpString="*.md") returned 4
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mdf") returned 0
	[0070.033] lstrlenA (lpString="*.mdf") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.dbf") returned 0
	[0070.033] lstrlenA (lpString="*.dbf") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.odt") returned 0
	[0070.033] lstrlenA (lpString="*.odt") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.vob") returned 0
	[0070.033] lstrlenA (lpString="*.vob") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ifo") returned 0
	[0070.033] lstrlenA (lpString="*.ifo") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.lnk") returned 0
	[0070.033] lstrlenA (lpString="*.lnk") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.torrent") returned 0
	[0070.033] lstrlenA (lpString="*.torrent") returned 9
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mov") returned 0
	[0070.033] lstrlenA (lpString="*.mov") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.m2v") returned 0
	[0070.033] lstrlenA (lpString="*.m2v") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.3gp") returned 0
	[0070.033] lstrlenA (lpString="*.3gp") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mpeg") returned 0
	[0070.033] lstrlenA (lpString="*.mpeg") returned 6
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mpg") returned 0
	[0070.033] lstrlenA (lpString="*.mpg") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.flv") returned 0
	[0070.033] lstrlenA (lpString="*.flv") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.avi") returned 0
	[0070.033] lstrlenA (lpString="*.avi") returned 5
	[0070.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mp4") returned 0
	[0070.033] lstrlenA (lpString="*.mp4") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wmv") returned 0
	[0070.034] lstrlenA (lpString="*.wmv") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.divx") returned 0
	[0070.034] lstrlenA (lpString="*.divx") returned 6
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mkv") returned 0
	[0070.034] lstrlenA (lpString="*.mkv") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mp3") returned 0
	[0070.034] lstrlenA (lpString="*.mp3") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wav") returned 0
	[0070.034] lstrlenA (lpString="*.wav") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.flac") returned 0
	[0070.034] lstrlenA (lpString="*.flac") returned 6
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ape") returned 0
	[0070.034] lstrlenA (lpString="*.ape") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wma") returned 0
	[0070.034] lstrlenA (lpString="*.wma") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ac3") returned 0
	[0070.034] lstrlenA (lpString="*.ac3") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.exe") returned 0
	[0070.034] lstrlenA (lpString="*.exe") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.apk") returned 0
	[0070.034] lstrlenA (lpString="*.apk") returned 5
	[0070.034] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.034] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1
	[0070.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1
	[0070.034] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1
	[0070.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="Microsoft.Office.BusinessApplications.Runtime.xml"
	[0070.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.034] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.034] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll"
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.zip") returned 0
	[0070.034] lstrlenA (lpString="*.zip") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.rar") returned 0
	[0070.034] lstrlenA (lpString="*.rar") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.7z") returned 0
	[0070.034] lstrlenA (lpString="*.7z") returned 4
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.tar") returned 0
	[0070.034] lstrlenA (lpString="*.tar") returned 5
	[0070.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.gzip") returned 0
	[0070.035] lstrlenA (lpString="*.gzip") returned 6
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.jpg") returned 0
	[0070.035] lstrlenA (lpString="*.jpg") returned 5
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.jpeg") returned 0
	[0070.035] lstrlenA (lpString="*.jpeg") returned 6
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.psd") returned 0
	[0070.035] lstrlenA (lpString="*.psd") returned 5
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.cdr") returned 0
	[0070.035] lstrlenA (lpString="*.cdr") returned 5
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.dwg") returned 0
	[0070.035] lstrlenA (lpString="*.dwg") returned 5
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.max") returned 0
	[0070.035] lstrlenA (lpString="*.max") returned 5
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.bmp") returned 0
	[0070.035] lstrlenA (lpString="*.bmp") returned 5
	[0070.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.gif") returned 0
	[0070.035] lstrlenA (lpString="*.gif") returned 5
	[0070.035] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.035] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.035] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1
	[0070.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1
	[0070.035] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1
	[0070.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="Microsoft.Office.BusinessApplications.RuntimeUi.dll"
	[0070.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml"
	[0070.035] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.035] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.036] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessData.dll") returned -1
	[0070.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.dll") returned -1
	[0070.036] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.dll") returned -1
	[0070.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="Microsoft.Office.BusinessApplications.RuntimeUi.xml"
	[0070.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessData.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll"
	[0070.036] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.036] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.036] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessData.xml") returned -1
	[0070.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.xml") returned -1
	[0070.036] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.xml") returned -1
	[0070.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned="Microsoft.Office.BusinessData.dll"
	[0070.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml"
	[0070.036] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.036] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.036] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1
	[0070.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1
	[0070.036] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1
	[0070.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="Microsoft.Office.BusinessData.xml"
	[0070.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll"
	[0070.037] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.037] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.037] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1
	[0070.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1
	[0070.037] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1
	[0070.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll"
	[0070.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.InfoPath.FormControl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll"
	[0070.037] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.037] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.037] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1
	[0070.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1
	[0070.037] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1
	[0070.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned="Microsoft.Office.InfoPath.FormControl.dll"
	[0070.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll"
	[0070.037] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.037] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.037] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1
	[0070.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1
	[0070.037] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1
	[0070.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.dll"
	[0070.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml"
	[0070.038] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.038] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.038] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1
	[0070.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1
	[0070.038] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1
	[0070.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.xml"
	[0070.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll"
	[0070.038] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.038] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.038] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1
	[0070.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1
	[0070.038] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1
	[0070.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned="Microsoft.Office.Interop.InfoPath.Xml.dll"
	[0070.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml"
	[0070.038] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.038] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.038] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1
	[0070.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1
	[0070.038] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1
	[0070.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="Microsoft.Office.Interop.InfoPath.Xml.xml"
	[0070.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll"
	[0070.039] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.039] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1
	[0070.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1
	[0070.039] lstrcmpiA (lpString1="", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1
	[0070.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll"
	[0070.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="microsoft.office.workflow.actions.proxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll"
	[0070.039] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.039] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1
	[0070.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1
	[0070.039] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1
	[0070.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned="microsoft.office.workflow.actions.proxy.dll"
	[0070.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll"
	[0070.039] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.099] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.099] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1
	[0070.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1
	[0070.100] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1
	[0070.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="Microsoft.SharePoint.BusinessData.Administration.Client.dll"
	[0070.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml"
	[0070.100] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.100] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.100] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1
	[0070.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1
	[0070.100] lstrcmpiA (lpString1="", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1
	[0070.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="Microsoft.SharePoint.BusinessData.Administration.Client.xml"
	[0070.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="microsoft.sharepoint.workflowactions.proxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll"
	[0070.100] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.100] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.100] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MIMEDIR.DLL") returned -1
	[0070.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIMEDIR.DLL") returned -1
	[0070.100] lstrcmpiA (lpString1="", lpString2="MIMEDIR.DLL") returned -1
	[0070.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned="microsoft.sharepoint.workflowactions.proxy.dll"
	[0070.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MIMEDIR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL"
	[0070.101] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.101] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.101] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="misc.exe") returned -1
	[0070.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="misc.exe") returned -1
	[0070.101] lstrcmpiA (lpString1="", lpString2="misc.exe") returned -1
	[0070.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned="MIMEDIR.DLL"
	[0070.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="misc.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe"
	[0070.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe"
	[0070.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe"
	[0070.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.") returned="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe."
	[0070.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.Boom"
	[0070.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.102] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b760
	[0070.102] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf2796a00, dwHighDateTime=0x1cacb3c), lpLastAccessTime=0x407536*(dwLowDateTime=0x69c4c990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf2796a00, dwHighDateTime=0x1cacb3c)) returned 1
	[0070.102] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.102] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x8b73d, lpOverlapped=0x0) returned 1
	[0070.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="misc.exe"
	[0070.163] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.163] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x8b73d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x8b73d, lpOverlapped=0x0) returned 1
	[0070.165] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.165] CloseHandle (hObject=0x88) returned 1
	[0070.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe.boom")) returned 1
	[0070.166] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.166] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MLCFG32.CPL") returned -1
	[0070.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLCFG32.CPL") returned -1
	[0070.167] lstrcmpiA (lpString1="", lpString2="MLCFG32.CPL") returned -1
	[0070.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="misc.exe"
	[0070.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MLCFG32.CPL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL"
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.zip") returned 0
	[0070.167] lstrlenA (lpString="*.zip") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.rar") returned 0
	[0070.167] lstrlenA (lpString="*.rar") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.7z") returned 0
	[0070.167] lstrlenA (lpString="*.7z") returned 4
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.tar") returned 0
	[0070.167] lstrlenA (lpString="*.tar") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.gzip") returned 0
	[0070.167] lstrlenA (lpString="*.gzip") returned 6
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.jpg") returned 0
	[0070.167] lstrlenA (lpString="*.jpg") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.jpeg") returned 0
	[0070.167] lstrlenA (lpString="*.jpeg") returned 6
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.psd") returned 0
	[0070.167] lstrlenA (lpString="*.psd") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.cdr") returned 0
	[0070.167] lstrlenA (lpString="*.cdr") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.dwg") returned 0
	[0070.167] lstrlenA (lpString="*.dwg") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.max") returned 0
	[0070.167] lstrlenA (lpString="*.max") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.bmp") returned 0
	[0070.167] lstrlenA (lpString="*.bmp") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.gif") returned 0
	[0070.167] lstrlenA (lpString="*.gif") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.png") returned 0
	[0070.167] lstrlenA (lpString="*.png") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.doc") returned 0
	[0070.167] lstrlenA (lpString="*.doc") returned 5
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.docx") returned 0
	[0070.167] lstrlenA (lpString="*.docx") returned 6
	[0070.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.xls") returned 0
	[0070.167] lstrlenA (lpString="*.xls") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.xlsx") returned 0
	[0070.168] lstrlenA (lpString="*.xlsx") returned 6
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.ppt") returned 0
	[0070.168] lstrlenA (lpString="*.ppt") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.pptx") returned 0
	[0070.168] lstrlenA (lpString="*.pptx") returned 6
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.txt") returned 0
	[0070.168] lstrlenA (lpString="*.txt") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.pdf") returned 0
	[0070.168] lstrlenA (lpString="*.pdf") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.djvu") returned 0
	[0070.168] lstrlenA (lpString="*.djvu") returned 6
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.htm") returned 0
	[0070.168] lstrlenA (lpString="*.htm") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.html") returned 0
	[0070.168] lstrlenA (lpString="*.html") returned 6
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mdb") returned 0
	[0070.168] lstrlenA (lpString="*.mdb") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.cer") returned 0
	[0070.168] lstrlenA (lpString="*.cer") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.p12") returned 0
	[0070.168] lstrlenA (lpString="*.p12") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.pfx") returned 0
	[0070.168] lstrlenA (lpString="*.pfx") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.kwm") returned 0
	[0070.168] lstrlenA (lpString="*.kwm") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.pwm") returned 0
	[0070.168] lstrlenA (lpString="*.pwm") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.1cd") returned 0
	[0070.168] lstrlenA (lpString="*.1cd") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.md") returned 0
	[0070.168] lstrlenA (lpString="*.md") returned 4
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mdf") returned 0
	[0070.168] lstrlenA (lpString="*.mdf") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.dbf") returned 0
	[0070.168] lstrlenA (lpString="*.dbf") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.odt") returned 0
	[0070.168] lstrlenA (lpString="*.odt") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.vob") returned 0
	[0070.168] lstrlenA (lpString="*.vob") returned 5
	[0070.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.ifo") returned 0
	[0070.168] lstrlenA (lpString="*.ifo") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.lnk") returned 0
	[0070.169] lstrlenA (lpString="*.lnk") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.torrent") returned 0
	[0070.169] lstrlenA (lpString="*.torrent") returned 9
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mov") returned 0
	[0070.169] lstrlenA (lpString="*.mov") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.m2v") returned 0
	[0070.169] lstrlenA (lpString="*.m2v") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.3gp") returned 0
	[0070.169] lstrlenA (lpString="*.3gp") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mpeg") returned 0
	[0070.169] lstrlenA (lpString="*.mpeg") returned 6
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mpg") returned 0
	[0070.169] lstrlenA (lpString="*.mpg") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.flv") returned 0
	[0070.169] lstrlenA (lpString="*.flv") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.avi") returned 0
	[0070.169] lstrlenA (lpString="*.avi") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mp4") returned 0
	[0070.169] lstrlenA (lpString="*.mp4") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.wmv") returned 0
	[0070.169] lstrlenA (lpString="*.wmv") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.divx") returned 0
	[0070.169] lstrlenA (lpString="*.divx") returned 6
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mkv") returned 0
	[0070.169] lstrlenA (lpString="*.mkv") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.mp3") returned 0
	[0070.169] lstrlenA (lpString="*.mp3") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.wav") returned 0
	[0070.169] lstrlenA (lpString="*.wav") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.flac") returned 0
	[0070.169] lstrlenA (lpString="*.flac") returned 6
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.ape") returned 0
	[0070.169] lstrlenA (lpString="*.ape") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.wma") returned 0
	[0070.169] lstrlenA (lpString="*.wma") returned 5
	[0070.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.ac3") returned 0
	[0070.170] lstrlenA (lpString="*.ac3") returned 5
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.exe") returned 0
	[0070.170] lstrlenA (lpString="*.exe") returned 5
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", pszSpec="*.apk") returned 0
	[0070.170] lstrlenA (lpString="*.apk") returned 5
	[0070.170] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.170] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.170] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MLSHEXT.DLL") returned -1
	[0070.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLSHEXT.DLL") returned -1
	[0070.170] lstrcmpiA (lpString1="", lpString2="MLSHEXT.DLL") returned -1
	[0070.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned="MLCFG32.CPL"
	[0070.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MLSHEXT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL"
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.zip") returned 0
	[0070.170] lstrlenA (lpString="*.zip") returned 5
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.rar") returned 0
	[0070.170] lstrlenA (lpString="*.rar") returned 5
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.7z") returned 0
	[0070.170] lstrlenA (lpString="*.7z") returned 4
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.tar") returned 0
	[0070.170] lstrlenA (lpString="*.tar") returned 5
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.gzip") returned 0
	[0070.170] lstrlenA (lpString="*.gzip") returned 6
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.jpg") returned 0
	[0070.170] lstrlenA (lpString="*.jpg") returned 5
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.jpeg") returned 0
	[0070.170] lstrlenA (lpString="*.jpeg") returned 6
	[0070.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.psd") returned 0
	[0070.170] lstrlenA (lpString="*.psd") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.cdr") returned 0
	[0070.171] lstrlenA (lpString="*.cdr") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.dwg") returned 0
	[0070.171] lstrlenA (lpString="*.dwg") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.max") returned 0
	[0070.171] lstrlenA (lpString="*.max") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.bmp") returned 0
	[0070.171] lstrlenA (lpString="*.bmp") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.gif") returned 0
	[0070.171] lstrlenA (lpString="*.gif") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.png") returned 0
	[0070.171] lstrlenA (lpString="*.png") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.doc") returned 0
	[0070.171] lstrlenA (lpString="*.doc") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.docx") returned 0
	[0070.171] lstrlenA (lpString="*.docx") returned 6
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.xls") returned 0
	[0070.171] lstrlenA (lpString="*.xls") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.xlsx") returned 0
	[0070.171] lstrlenA (lpString="*.xlsx") returned 6
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.ppt") returned 0
	[0070.171] lstrlenA (lpString="*.ppt") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.pptx") returned 0
	[0070.171] lstrlenA (lpString="*.pptx") returned 6
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.txt") returned 0
	[0070.171] lstrlenA (lpString="*.txt") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.pdf") returned 0
	[0070.171] lstrlenA (lpString="*.pdf") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.djvu") returned 0
	[0070.171] lstrlenA (lpString="*.djvu") returned 6
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.htm") returned 0
	[0070.171] lstrlenA (lpString="*.htm") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.html") returned 0
	[0070.171] lstrlenA (lpString="*.html") returned 6
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mdb") returned 0
	[0070.171] lstrlenA (lpString="*.mdb") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.cer") returned 0
	[0070.171] lstrlenA (lpString="*.cer") returned 5
	[0070.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.p12") returned 0
	[0070.172] lstrlenA (lpString="*.p12") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.pfx") returned 0
	[0070.172] lstrlenA (lpString="*.pfx") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.kwm") returned 0
	[0070.172] lstrlenA (lpString="*.kwm") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.pwm") returned 0
	[0070.172] lstrlenA (lpString="*.pwm") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.1cd") returned 0
	[0070.172] lstrlenA (lpString="*.1cd") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.md") returned 0
	[0070.172] lstrlenA (lpString="*.md") returned 4
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mdf") returned 0
	[0070.172] lstrlenA (lpString="*.mdf") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.dbf") returned 0
	[0070.172] lstrlenA (lpString="*.dbf") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.odt") returned 0
	[0070.172] lstrlenA (lpString="*.odt") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.vob") returned 0
	[0070.172] lstrlenA (lpString="*.vob") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.ifo") returned 0
	[0070.172] lstrlenA (lpString="*.ifo") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.lnk") returned 0
	[0070.172] lstrlenA (lpString="*.lnk") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.torrent") returned 0
	[0070.172] lstrlenA (lpString="*.torrent") returned 9
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mov") returned 0
	[0070.172] lstrlenA (lpString="*.mov") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.m2v") returned 0
	[0070.172] lstrlenA (lpString="*.m2v") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.3gp") returned 0
	[0070.172] lstrlenA (lpString="*.3gp") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mpeg") returned 0
	[0070.172] lstrlenA (lpString="*.mpeg") returned 6
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mpg") returned 0
	[0070.172] lstrlenA (lpString="*.mpg") returned 5
	[0070.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.flv") returned 0
	[0070.172] lstrlenA (lpString="*.flv") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.avi") returned 0
	[0070.173] lstrlenA (lpString="*.avi") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mp4") returned 0
	[0070.173] lstrlenA (lpString="*.mp4") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.wmv") returned 0
	[0070.173] lstrlenA (lpString="*.wmv") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.divx") returned 0
	[0070.173] lstrlenA (lpString="*.divx") returned 6
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mkv") returned 0
	[0070.173] lstrlenA (lpString="*.mkv") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.mp3") returned 0
	[0070.173] lstrlenA (lpString="*.mp3") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.wav") returned 0
	[0070.173] lstrlenA (lpString="*.wav") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.flac") returned 0
	[0070.173] lstrlenA (lpString="*.flac") returned 6
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.ape") returned 0
	[0070.173] lstrlenA (lpString="*.ape") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.wma") returned 0
	[0070.173] lstrlenA (lpString="*.wma") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.ac3") returned 0
	[0070.173] lstrlenA (lpString="*.ac3") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.exe") returned 0
	[0070.173] lstrlenA (lpString="*.exe") returned 5
	[0070.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", pszSpec="*.apk") returned 0
	[0070.173] lstrlenA (lpString="*.apk") returned 5
	[0070.173] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.173] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.173] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MML2OMML.XSL") returned -1
	[0070.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MML2OMML.XSL") returned -1
	[0070.173] lstrcmpiA (lpString1="", lpString2="MML2OMML.XSL") returned -1
	[0070.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned="MLSHEXT.DLL"
	[0070.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MML2OMML.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL"
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.zip") returned 0
	[0070.174] lstrlenA (lpString="*.zip") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.rar") returned 0
	[0070.174] lstrlenA (lpString="*.rar") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.7z") returned 0
	[0070.174] lstrlenA (lpString="*.7z") returned 4
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.tar") returned 0
	[0070.174] lstrlenA (lpString="*.tar") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.gzip") returned 0
	[0070.174] lstrlenA (lpString="*.gzip") returned 6
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.jpg") returned 0
	[0070.174] lstrlenA (lpString="*.jpg") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.jpeg") returned 0
	[0070.174] lstrlenA (lpString="*.jpeg") returned 6
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.psd") returned 0
	[0070.174] lstrlenA (lpString="*.psd") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.cdr") returned 0
	[0070.174] lstrlenA (lpString="*.cdr") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.dwg") returned 0
	[0070.174] lstrlenA (lpString="*.dwg") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.max") returned 0
	[0070.174] lstrlenA (lpString="*.max") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.bmp") returned 0
	[0070.174] lstrlenA (lpString="*.bmp") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.gif") returned 0
	[0070.174] lstrlenA (lpString="*.gif") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.png") returned 0
	[0070.174] lstrlenA (lpString="*.png") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.doc") returned 0
	[0070.174] lstrlenA (lpString="*.doc") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.docx") returned 0
	[0070.174] lstrlenA (lpString="*.docx") returned 6
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.xls") returned 0
	[0070.174] lstrlenA (lpString="*.xls") returned 5
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.xlsx") returned 0
	[0070.174] lstrlenA (lpString="*.xlsx") returned 6
	[0070.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.ppt") returned 0
	[0070.175] lstrlenA (lpString="*.ppt") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.pptx") returned 0
	[0070.175] lstrlenA (lpString="*.pptx") returned 6
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.txt") returned 0
	[0070.175] lstrlenA (lpString="*.txt") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.pdf") returned 0
	[0070.175] lstrlenA (lpString="*.pdf") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.djvu") returned 0
	[0070.175] lstrlenA (lpString="*.djvu") returned 6
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.htm") returned 0
	[0070.175] lstrlenA (lpString="*.htm") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.html") returned 0
	[0070.175] lstrlenA (lpString="*.html") returned 6
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mdb") returned 0
	[0070.175] lstrlenA (lpString="*.mdb") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.cer") returned 0
	[0070.175] lstrlenA (lpString="*.cer") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.p12") returned 0
	[0070.175] lstrlenA (lpString="*.p12") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.pfx") returned 0
	[0070.175] lstrlenA (lpString="*.pfx") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.kwm") returned 0
	[0070.175] lstrlenA (lpString="*.kwm") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.pwm") returned 0
	[0070.175] lstrlenA (lpString="*.pwm") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.1cd") returned 0
	[0070.175] lstrlenA (lpString="*.1cd") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.md") returned 0
	[0070.175] lstrlenA (lpString="*.md") returned 4
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mdf") returned 0
	[0070.175] lstrlenA (lpString="*.mdf") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.dbf") returned 0
	[0070.175] lstrlenA (lpString="*.dbf") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.odt") returned 0
	[0070.175] lstrlenA (lpString="*.odt") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.vob") returned 0
	[0070.175] lstrlenA (lpString="*.vob") returned 5
	[0070.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.ifo") returned 0
	[0070.175] lstrlenA (lpString="*.ifo") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.lnk") returned 0
	[0070.176] lstrlenA (lpString="*.lnk") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.torrent") returned 0
	[0070.176] lstrlenA (lpString="*.torrent") returned 9
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mov") returned 0
	[0070.176] lstrlenA (lpString="*.mov") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.m2v") returned 0
	[0070.176] lstrlenA (lpString="*.m2v") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.3gp") returned 0
	[0070.176] lstrlenA (lpString="*.3gp") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mpeg") returned 0
	[0070.176] lstrlenA (lpString="*.mpeg") returned 6
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mpg") returned 0
	[0070.176] lstrlenA (lpString="*.mpg") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.flv") returned 0
	[0070.176] lstrlenA (lpString="*.flv") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.avi") returned 0
	[0070.176] lstrlenA (lpString="*.avi") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mp4") returned 0
	[0070.176] lstrlenA (lpString="*.mp4") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.wmv") returned 0
	[0070.176] lstrlenA (lpString="*.wmv") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.divx") returned 0
	[0070.176] lstrlenA (lpString="*.divx") returned 6
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mkv") returned 0
	[0070.176] lstrlenA (lpString="*.mkv") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.mp3") returned 0
	[0070.176] lstrlenA (lpString="*.mp3") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.wav") returned 0
	[0070.176] lstrlenA (lpString="*.wav") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.flac") returned 0
	[0070.176] lstrlenA (lpString="*.flac") returned 6
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.ape") returned 0
	[0070.176] lstrlenA (lpString="*.ape") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.wma") returned 0
	[0070.176] lstrlenA (lpString="*.wma") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.ac3") returned 0
	[0070.176] lstrlenA (lpString="*.ac3") returned 5
	[0070.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.exe") returned 0
	[0070.177] lstrlenA (lpString="*.exe") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", pszSpec="*.apk") returned 0
	[0070.177] lstrlenA (lpString="*.apk") returned 5
	[0070.177] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.177] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MODELENG.DLL") returned -1
	[0070.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MODELENG.DLL") returned -1
	[0070.177] lstrcmpiA (lpString1="", lpString2="MODELENG.DLL") returned -1
	[0070.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="MML2OMML.XSL"
	[0070.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MODELENG.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL"
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.zip") returned 0
	[0070.177] lstrlenA (lpString="*.zip") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.rar") returned 0
	[0070.177] lstrlenA (lpString="*.rar") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.7z") returned 0
	[0070.177] lstrlenA (lpString="*.7z") returned 4
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.tar") returned 0
	[0070.177] lstrlenA (lpString="*.tar") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.gzip") returned 0
	[0070.177] lstrlenA (lpString="*.gzip") returned 6
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.jpg") returned 0
	[0070.177] lstrlenA (lpString="*.jpg") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.jpeg") returned 0
	[0070.177] lstrlenA (lpString="*.jpeg") returned 6
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.psd") returned 0
	[0070.177] lstrlenA (lpString="*.psd") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.cdr") returned 0
	[0070.177] lstrlenA (lpString="*.cdr") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.dwg") returned 0
	[0070.177] lstrlenA (lpString="*.dwg") returned 5
	[0070.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.max") returned 0
	[0070.177] lstrlenA (lpString="*.max") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.bmp") returned 0
	[0070.178] lstrlenA (lpString="*.bmp") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.gif") returned 0
	[0070.178] lstrlenA (lpString="*.gif") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.png") returned 0
	[0070.178] lstrlenA (lpString="*.png") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.doc") returned 0
	[0070.178] lstrlenA (lpString="*.doc") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.docx") returned 0
	[0070.178] lstrlenA (lpString="*.docx") returned 6
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.xls") returned 0
	[0070.178] lstrlenA (lpString="*.xls") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.xlsx") returned 0
	[0070.178] lstrlenA (lpString="*.xlsx") returned 6
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.ppt") returned 0
	[0070.178] lstrlenA (lpString="*.ppt") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.pptx") returned 0
	[0070.178] lstrlenA (lpString="*.pptx") returned 6
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.txt") returned 0
	[0070.178] lstrlenA (lpString="*.txt") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.pdf") returned 0
	[0070.178] lstrlenA (lpString="*.pdf") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.djvu") returned 0
	[0070.178] lstrlenA (lpString="*.djvu") returned 6
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.htm") returned 0
	[0070.178] lstrlenA (lpString="*.htm") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.html") returned 0
	[0070.178] lstrlenA (lpString="*.html") returned 6
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mdb") returned 0
	[0070.178] lstrlenA (lpString="*.mdb") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.cer") returned 0
	[0070.178] lstrlenA (lpString="*.cer") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.p12") returned 0
	[0070.178] lstrlenA (lpString="*.p12") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.pfx") returned 0
	[0070.178] lstrlenA (lpString="*.pfx") returned 5
	[0070.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.kwm") returned 0
	[0070.179] lstrlenA (lpString="*.kwm") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.pwm") returned 0
	[0070.179] lstrlenA (lpString="*.pwm") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.1cd") returned 0
	[0070.179] lstrlenA (lpString="*.1cd") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.md") returned 0
	[0070.179] lstrlenA (lpString="*.md") returned 4
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mdf") returned 0
	[0070.179] lstrlenA (lpString="*.mdf") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.dbf") returned 0
	[0070.179] lstrlenA (lpString="*.dbf") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.odt") returned 0
	[0070.179] lstrlenA (lpString="*.odt") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.vob") returned 0
	[0070.179] lstrlenA (lpString="*.vob") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.ifo") returned 0
	[0070.179] lstrlenA (lpString="*.ifo") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.lnk") returned 0
	[0070.179] lstrlenA (lpString="*.lnk") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.torrent") returned 0
	[0070.179] lstrlenA (lpString="*.torrent") returned 9
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mov") returned 0
	[0070.179] lstrlenA (lpString="*.mov") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.m2v") returned 0
	[0070.179] lstrlenA (lpString="*.m2v") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.3gp") returned 0
	[0070.179] lstrlenA (lpString="*.3gp") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mpeg") returned 0
	[0070.179] lstrlenA (lpString="*.mpeg") returned 6
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mpg") returned 0
	[0070.179] lstrlenA (lpString="*.mpg") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.flv") returned 0
	[0070.179] lstrlenA (lpString="*.flv") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.avi") returned 0
	[0070.179] lstrlenA (lpString="*.avi") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mp4") returned 0
	[0070.179] lstrlenA (lpString="*.mp4") returned 5
	[0070.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.wmv") returned 0
	[0070.180] lstrlenA (lpString="*.wmv") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.divx") returned 0
	[0070.180] lstrlenA (lpString="*.divx") returned 6
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mkv") returned 0
	[0070.180] lstrlenA (lpString="*.mkv") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.mp3") returned 0
	[0070.180] lstrlenA (lpString="*.mp3") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.wav") returned 0
	[0070.180] lstrlenA (lpString="*.wav") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.flac") returned 0
	[0070.180] lstrlenA (lpString="*.flac") returned 6
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.ape") returned 0
	[0070.180] lstrlenA (lpString="*.ape") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.wma") returned 0
	[0070.180] lstrlenA (lpString="*.wma") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.ac3") returned 0
	[0070.180] lstrlenA (lpString="*.ac3") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.exe") returned 0
	[0070.180] lstrlenA (lpString="*.exe") returned 5
	[0070.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", pszSpec="*.apk") returned 0
	[0070.180] lstrlenA (lpString="*.apk") returned 5
	[0070.180] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.180] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MORPH9.DLL") returned -1
	[0070.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MORPH9.DLL") returned -1
	[0070.180] lstrcmpiA (lpString1="", lpString2="MORPH9.DLL") returned -1
	[0070.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned="MODELENG.DLL"
	[0070.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MORPH9.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL"
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.zip") returned 0
	[0070.181] lstrlenA (lpString="*.zip") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.rar") returned 0
	[0070.181] lstrlenA (lpString="*.rar") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.7z") returned 0
	[0070.181] lstrlenA (lpString="*.7z") returned 4
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.tar") returned 0
	[0070.181] lstrlenA (lpString="*.tar") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.gzip") returned 0
	[0070.181] lstrlenA (lpString="*.gzip") returned 6
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.jpg") returned 0
	[0070.181] lstrlenA (lpString="*.jpg") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.jpeg") returned 0
	[0070.181] lstrlenA (lpString="*.jpeg") returned 6
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.psd") returned 0
	[0070.181] lstrlenA (lpString="*.psd") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.cdr") returned 0
	[0070.181] lstrlenA (lpString="*.cdr") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.dwg") returned 0
	[0070.181] lstrlenA (lpString="*.dwg") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.max") returned 0
	[0070.181] lstrlenA (lpString="*.max") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.bmp") returned 0
	[0070.181] lstrlenA (lpString="*.bmp") returned 5
	[0070.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", pszSpec="*.gif") returned 0
	[0070.181] lstrlenA (lpString="*.gif") returned 5
	[0070.181] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.181] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MPXINT.DLL") returned -1
	[0070.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MPXINT.DLL") returned -1
	[0070.182] lstrcmpiA (lpString1="", lpString2="MPXINT.DLL") returned -1
	[0070.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned="MORPH9.DLL"
	[0070.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MPXINT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL"
	[0070.182] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.182] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSACC.OLB") returned -1
	[0070.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACC.OLB") returned -1
	[0070.182] lstrcmpiA (lpString1="", lpString2="MSACC.OLB") returned -1
	[0070.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned="MPXINT.DLL"
	[0070.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSACC.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB"
	[0070.182] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.182] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSACCESS.EXE") returned -1
	[0070.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.EXE") returned -1
	[0070.182] lstrcmpiA (lpString1="", lpString2="MSACCESS.EXE") returned -1
	[0070.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="MSACC.OLB"
	[0070.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSACCESS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE"
	[0070.183] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE"
	[0070.183] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE"
	[0070.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE."
	[0070.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.Boom"
	[0070.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.183] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132cb60
	[0070.183] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc5fbe00, dwHighDateTime=0x1cab8ab), lpLastAccessTime=0x407536*(dwLowDateTime=0x69da35f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc5fbe00, dwHighDateTime=0x1cab8ab)) returned 1
	[0070.183] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.184] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0070.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="MSACCESS.EXE"
	[0070.247] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.247] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0070.252] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.252] CloseHandle (hObject=0x88) returned 1
	[0070.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.boom")) returned 1
	[0070.253] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.253] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.253] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msaccess.exe.manifest") returned -1
	[0070.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaccess.exe.manifest") returned -1
	[0070.253] lstrcmpiA (lpString1="", lpString2="msaccess.exe.manifest") returned -1
	[0070.253] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="MSACCESS.EXE"
	[0070.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.254] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="msaccess.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest"
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.zip") returned 0
	[0070.254] lstrlenA (lpString="*.zip") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.rar") returned 0
	[0070.254] lstrlenA (lpString="*.rar") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.7z") returned 0
	[0070.254] lstrlenA (lpString="*.7z") returned 4
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.tar") returned 0
	[0070.254] lstrlenA (lpString="*.tar") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.gzip") returned 0
	[0070.254] lstrlenA (lpString="*.gzip") returned 6
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.jpg") returned 0
	[0070.254] lstrlenA (lpString="*.jpg") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.jpeg") returned 0
	[0070.254] lstrlenA (lpString="*.jpeg") returned 6
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.psd") returned 0
	[0070.254] lstrlenA (lpString="*.psd") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.cdr") returned 0
	[0070.254] lstrlenA (lpString="*.cdr") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.dwg") returned 0
	[0070.254] lstrlenA (lpString="*.dwg") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.max") returned 0
	[0070.254] lstrlenA (lpString="*.max") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.bmp") returned 0
	[0070.254] lstrlenA (lpString="*.bmp") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.gif") returned 0
	[0070.254] lstrlenA (lpString="*.gif") returned 5
	[0070.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.png") returned 0
	[0070.255] lstrlenA (lpString="*.png") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.doc") returned 0
	[0070.255] lstrlenA (lpString="*.doc") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.docx") returned 0
	[0070.255] lstrlenA (lpString="*.docx") returned 6
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.xls") returned 0
	[0070.255] lstrlenA (lpString="*.xls") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.xlsx") returned 0
	[0070.255] lstrlenA (lpString="*.xlsx") returned 6
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.ppt") returned 0
	[0070.255] lstrlenA (lpString="*.ppt") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.pptx") returned 0
	[0070.255] lstrlenA (lpString="*.pptx") returned 6
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.txt") returned 0
	[0070.255] lstrlenA (lpString="*.txt") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.pdf") returned 0
	[0070.255] lstrlenA (lpString="*.pdf") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.djvu") returned 0
	[0070.255] lstrlenA (lpString="*.djvu") returned 6
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.htm") returned 0
	[0070.255] lstrlenA (lpString="*.htm") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.html") returned 0
	[0070.255] lstrlenA (lpString="*.html") returned 6
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mdb") returned 0
	[0070.255] lstrlenA (lpString="*.mdb") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.cer") returned 0
	[0070.255] lstrlenA (lpString="*.cer") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.p12") returned 0
	[0070.255] lstrlenA (lpString="*.p12") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.pfx") returned 0
	[0070.255] lstrlenA (lpString="*.pfx") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.kwm") returned 0
	[0070.255] lstrlenA (lpString="*.kwm") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.pwm") returned 0
	[0070.255] lstrlenA (lpString="*.pwm") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.1cd") returned 0
	[0070.255] lstrlenA (lpString="*.1cd") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.md") returned 0
	[0070.255] lstrlenA (lpString="*.md") returned 4
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mdf") returned 0
	[0070.255] lstrlenA (lpString="*.mdf") returned 5
	[0070.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.dbf") returned 0
	[0070.256] lstrlenA (lpString="*.dbf") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.odt") returned 0
	[0070.256] lstrlenA (lpString="*.odt") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.vob") returned 0
	[0070.256] lstrlenA (lpString="*.vob") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.ifo") returned 0
	[0070.256] lstrlenA (lpString="*.ifo") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.lnk") returned 0
	[0070.256] lstrlenA (lpString="*.lnk") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.torrent") returned 0
	[0070.256] lstrlenA (lpString="*.torrent") returned 9
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mov") returned 0
	[0070.256] lstrlenA (lpString="*.mov") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.m2v") returned 0
	[0070.256] lstrlenA (lpString="*.m2v") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.3gp") returned 0
	[0070.256] lstrlenA (lpString="*.3gp") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mpeg") returned 0
	[0070.256] lstrlenA (lpString="*.mpeg") returned 6
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mpg") returned 0
	[0070.256] lstrlenA (lpString="*.mpg") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.flv") returned 0
	[0070.256] lstrlenA (lpString="*.flv") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.avi") returned 0
	[0070.256] lstrlenA (lpString="*.avi") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mp4") returned 0
	[0070.256] lstrlenA (lpString="*.mp4") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.wmv") returned 0
	[0070.256] lstrlenA (lpString="*.wmv") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.divx") returned 0
	[0070.256] lstrlenA (lpString="*.divx") returned 6
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mkv") returned 0
	[0070.256] lstrlenA (lpString="*.mkv") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.mp3") returned 0
	[0070.256] lstrlenA (lpString="*.mp3") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.wav") returned 0
	[0070.256] lstrlenA (lpString="*.wav") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.flac") returned 0
	[0070.256] lstrlenA (lpString="*.flac") returned 6
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.ape") returned 0
	[0070.256] lstrlenA (lpString="*.ape") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.wma") returned 0
	[0070.256] lstrlenA (lpString="*.wma") returned 5
	[0070.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.ac3") returned 0
	[0070.256] lstrlenA (lpString="*.ac3") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.exe") returned 0
	[0070.257] lstrlenA (lpString="*.exe") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", pszSpec="*.apk") returned 0
	[0070.257] lstrlenA (lpString="*.apk") returned 5
	[0070.257] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.257] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSAEXP30.DLL") returned -1
	[0070.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSAEXP30.DLL") returned -1
	[0070.257] lstrcmpiA (lpString1="", lpString2="MSAEXP30.DLL") returned -1
	[0070.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="msaccess.exe.manifest"
	[0070.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.257] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSAEXP30.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL"
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.zip") returned 0
	[0070.257] lstrlenA (lpString="*.zip") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.rar") returned 0
	[0070.257] lstrlenA (lpString="*.rar") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.7z") returned 0
	[0070.257] lstrlenA (lpString="*.7z") returned 4
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.tar") returned 0
	[0070.257] lstrlenA (lpString="*.tar") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.gzip") returned 0
	[0070.257] lstrlenA (lpString="*.gzip") returned 6
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.jpg") returned 0
	[0070.257] lstrlenA (lpString="*.jpg") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.jpeg") returned 0
	[0070.257] lstrlenA (lpString="*.jpeg") returned 6
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.psd") returned 0
	[0070.257] lstrlenA (lpString="*.psd") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.cdr") returned 0
	[0070.257] lstrlenA (lpString="*.cdr") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.dwg") returned 0
	[0070.257] lstrlenA (lpString="*.dwg") returned 5
	[0070.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.max") returned 0
	[0070.257] lstrlenA (lpString="*.max") returned 5
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.bmp") returned 0
	[0070.258] lstrlenA (lpString="*.bmp") returned 5
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.gif") returned 0
	[0070.258] lstrlenA (lpString="*.gif") returned 5
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.png") returned 0
	[0070.258] lstrlenA (lpString="*.png") returned 5
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.doc") returned 0
	[0070.258] lstrlenA (lpString="*.doc") returned 5
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.docx") returned 0
	[0070.258] lstrlenA (lpString="*.docx") returned 6
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.xls") returned 0
	[0070.258] lstrlenA (lpString="*.xls") returned 5
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.xlsx") returned 0
	[0070.258] lstrlenA (lpString="*.xlsx") returned 6
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.ppt") returned 0
	[0070.258] lstrlenA (lpString="*.ppt") returned 5
	[0070.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.pptx") returned 0
	[0070.258] lstrlenA (lpString="*.pptx") returned 6
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.txt") returned 0
	[0070.259] lstrlenA (lpString="*.txt") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.pdf") returned 0
	[0070.259] lstrlenA (lpString="*.pdf") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.djvu") returned 0
	[0070.259] lstrlenA (lpString="*.djvu") returned 6
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.htm") returned 0
	[0070.259] lstrlenA (lpString="*.htm") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.html") returned 0
	[0070.259] lstrlenA (lpString="*.html") returned 6
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mdb") returned 0
	[0070.259] lstrlenA (lpString="*.mdb") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.cer") returned 0
	[0070.259] lstrlenA (lpString="*.cer") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.p12") returned 0
	[0070.259] lstrlenA (lpString="*.p12") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.pfx") returned 0
	[0070.259] lstrlenA (lpString="*.pfx") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.kwm") returned 0
	[0070.259] lstrlenA (lpString="*.kwm") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.pwm") returned 0
	[0070.259] lstrlenA (lpString="*.pwm") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.1cd") returned 0
	[0070.259] lstrlenA (lpString="*.1cd") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.md") returned 0
	[0070.259] lstrlenA (lpString="*.md") returned 4
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mdf") returned 0
	[0070.259] lstrlenA (lpString="*.mdf") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.dbf") returned 0
	[0070.259] lstrlenA (lpString="*.dbf") returned 5
	[0070.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.odt") returned 0
	[0070.259] lstrlenA (lpString="*.odt") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.vob") returned 0
	[0070.260] lstrlenA (lpString="*.vob") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.ifo") returned 0
	[0070.260] lstrlenA (lpString="*.ifo") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.lnk") returned 0
	[0070.260] lstrlenA (lpString="*.lnk") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.torrent") returned 0
	[0070.260] lstrlenA (lpString="*.torrent") returned 9
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mov") returned 0
	[0070.260] lstrlenA (lpString="*.mov") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.m2v") returned 0
	[0070.260] lstrlenA (lpString="*.m2v") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.3gp") returned 0
	[0070.260] lstrlenA (lpString="*.3gp") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mpeg") returned 0
	[0070.260] lstrlenA (lpString="*.mpeg") returned 6
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mpg") returned 0
	[0070.260] lstrlenA (lpString="*.mpg") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.flv") returned 0
	[0070.260] lstrlenA (lpString="*.flv") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.avi") returned 0
	[0070.260] lstrlenA (lpString="*.avi") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mp4") returned 0
	[0070.260] lstrlenA (lpString="*.mp4") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.wmv") returned 0
	[0070.260] lstrlenA (lpString="*.wmv") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.divx") returned 0
	[0070.260] lstrlenA (lpString="*.divx") returned 6
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mkv") returned 0
	[0070.260] lstrlenA (lpString="*.mkv") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.mp3") returned 0
	[0070.260] lstrlenA (lpString="*.mp3") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.wav") returned 0
	[0070.260] lstrlenA (lpString="*.wav") returned 5
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.flac") returned 0
	[0070.260] lstrlenA (lpString="*.flac") returned 6
	[0070.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.ape") returned 0
	[0070.261] lstrlenA (lpString="*.ape") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.wma") returned 0
	[0070.261] lstrlenA (lpString="*.wma") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.ac3") returned 0
	[0070.261] lstrlenA (lpString="*.ac3") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.exe") returned 0
	[0070.261] lstrlenA (lpString="*.exe") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", pszSpec="*.apk") returned 0
	[0070.261] lstrlenA (lpString="*.apk") returned 5
	[0070.261] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.261] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSCOL11.INF") returned -1
	[0070.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.INF") returned -1
	[0070.261] lstrcmpiA (lpString1="", lpString2="MSCOL11.INF") returned -1
	[0070.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned="MSAEXP30.DLL"
	[0070.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.261] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSCOL11.INF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF"
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.zip") returned 0
	[0070.261] lstrlenA (lpString="*.zip") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.rar") returned 0
	[0070.261] lstrlenA (lpString="*.rar") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.7z") returned 0
	[0070.261] lstrlenA (lpString="*.7z") returned 4
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.tar") returned 0
	[0070.261] lstrlenA (lpString="*.tar") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.gzip") returned 0
	[0070.261] lstrlenA (lpString="*.gzip") returned 6
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.jpg") returned 0
	[0070.261] lstrlenA (lpString="*.jpg") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.jpeg") returned 0
	[0070.261] lstrlenA (lpString="*.jpeg") returned 6
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.psd") returned 0
	[0070.261] lstrlenA (lpString="*.psd") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.cdr") returned 0
	[0070.261] lstrlenA (lpString="*.cdr") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.dwg") returned 0
	[0070.261] lstrlenA (lpString="*.dwg") returned 5
	[0070.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.max") returned 0
	[0070.261] lstrlenA (lpString="*.max") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.bmp") returned 0
	[0070.262] lstrlenA (lpString="*.bmp") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.gif") returned 0
	[0070.262] lstrlenA (lpString="*.gif") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.png") returned 0
	[0070.262] lstrlenA (lpString="*.png") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.doc") returned 0
	[0070.262] lstrlenA (lpString="*.doc") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.docx") returned 0
	[0070.262] lstrlenA (lpString="*.docx") returned 6
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.xls") returned 0
	[0070.262] lstrlenA (lpString="*.xls") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.xlsx") returned 0
	[0070.262] lstrlenA (lpString="*.xlsx") returned 6
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.ppt") returned 0
	[0070.262] lstrlenA (lpString="*.ppt") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.pptx") returned 0
	[0070.262] lstrlenA (lpString="*.pptx") returned 6
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.txt") returned 0
	[0070.262] lstrlenA (lpString="*.txt") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.pdf") returned 0
	[0070.262] lstrlenA (lpString="*.pdf") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.djvu") returned 0
	[0070.262] lstrlenA (lpString="*.djvu") returned 6
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.htm") returned 0
	[0070.262] lstrlenA (lpString="*.htm") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.html") returned 0
	[0070.262] lstrlenA (lpString="*.html") returned 6
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mdb") returned 0
	[0070.262] lstrlenA (lpString="*.mdb") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.cer") returned 0
	[0070.262] lstrlenA (lpString="*.cer") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.p12") returned 0
	[0070.262] lstrlenA (lpString="*.p12") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.pfx") returned 0
	[0070.262] lstrlenA (lpString="*.pfx") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.kwm") returned 0
	[0070.262] lstrlenA (lpString="*.kwm") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.pwm") returned 0
	[0070.262] lstrlenA (lpString="*.pwm") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.1cd") returned 0
	[0070.262] lstrlenA (lpString="*.1cd") returned 5
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.md") returned 0
	[0070.262] lstrlenA (lpString="*.md") returned 4
	[0070.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mdf") returned 0
	[0070.263] lstrlenA (lpString="*.mdf") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.dbf") returned 0
	[0070.263] lstrlenA (lpString="*.dbf") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.odt") returned 0
	[0070.263] lstrlenA (lpString="*.odt") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.vob") returned 0
	[0070.263] lstrlenA (lpString="*.vob") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.ifo") returned 0
	[0070.263] lstrlenA (lpString="*.ifo") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.lnk") returned 0
	[0070.263] lstrlenA (lpString="*.lnk") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.torrent") returned 0
	[0070.263] lstrlenA (lpString="*.torrent") returned 9
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mov") returned 0
	[0070.263] lstrlenA (lpString="*.mov") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.m2v") returned 0
	[0070.263] lstrlenA (lpString="*.m2v") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.3gp") returned 0
	[0070.263] lstrlenA (lpString="*.3gp") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mpeg") returned 0
	[0070.263] lstrlenA (lpString="*.mpeg") returned 6
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mpg") returned 0
	[0070.263] lstrlenA (lpString="*.mpg") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.flv") returned 0
	[0070.263] lstrlenA (lpString="*.flv") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.avi") returned 0
	[0070.263] lstrlenA (lpString="*.avi") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mp4") returned 0
	[0070.263] lstrlenA (lpString="*.mp4") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.wmv") returned 0
	[0070.263] lstrlenA (lpString="*.wmv") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.divx") returned 0
	[0070.263] lstrlenA (lpString="*.divx") returned 6
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mkv") returned 0
	[0070.263] lstrlenA (lpString="*.mkv") returned 5
	[0070.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.mp3") returned 0
	[0070.263] lstrlenA (lpString="*.mp3") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.wav") returned 0
	[0070.264] lstrlenA (lpString="*.wav") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.flac") returned 0
	[0070.264] lstrlenA (lpString="*.flac") returned 6
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.ape") returned 0
	[0070.264] lstrlenA (lpString="*.ape") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.wma") returned 0
	[0070.264] lstrlenA (lpString="*.wma") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.ac3") returned 0
	[0070.264] lstrlenA (lpString="*.ac3") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.exe") returned 0
	[0070.264] lstrlenA (lpString="*.exe") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", pszSpec="*.apk") returned 0
	[0070.264] lstrlenA (lpString="*.apk") returned 5
	[0070.264] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.264] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.264] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSCOL11.PPD") returned -1
	[0070.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.PPD") returned -1
	[0070.264] lstrcmpiA (lpString1="", lpString2="MSCOL11.PPD") returned -1
	[0070.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="MSCOL11.INF"
	[0070.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSCOL11.PPD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD"
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.zip") returned 0
	[0070.264] lstrlenA (lpString="*.zip") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.rar") returned 0
	[0070.264] lstrlenA (lpString="*.rar") returned 5
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.7z") returned 0
	[0070.264] lstrlenA (lpString="*.7z") returned 4
	[0070.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.tar") returned 0
	[0070.264] lstrlenA (lpString="*.tar") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.gzip") returned 0
	[0070.265] lstrlenA (lpString="*.gzip") returned 6
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.jpg") returned 0
	[0070.265] lstrlenA (lpString="*.jpg") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.jpeg") returned 0
	[0070.265] lstrlenA (lpString="*.jpeg") returned 6
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.psd") returned 0
	[0070.265] lstrlenA (lpString="*.psd") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.cdr") returned 0
	[0070.265] lstrlenA (lpString="*.cdr") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.dwg") returned 0
	[0070.265] lstrlenA (lpString="*.dwg") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.max") returned 0
	[0070.265] lstrlenA (lpString="*.max") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.bmp") returned 0
	[0070.265] lstrlenA (lpString="*.bmp") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.gif") returned 0
	[0070.265] lstrlenA (lpString="*.gif") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.png") returned 0
	[0070.265] lstrlenA (lpString="*.png") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.doc") returned 0
	[0070.265] lstrlenA (lpString="*.doc") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.docx") returned 0
	[0070.265] lstrlenA (lpString="*.docx") returned 6
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.xls") returned 0
	[0070.265] lstrlenA (lpString="*.xls") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.xlsx") returned 0
	[0070.265] lstrlenA (lpString="*.xlsx") returned 6
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.ppt") returned 0
	[0070.265] lstrlenA (lpString="*.ppt") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.pptx") returned 0
	[0070.265] lstrlenA (lpString="*.pptx") returned 6
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.txt") returned 0
	[0070.265] lstrlenA (lpString="*.txt") returned 5
	[0070.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.pdf") returned 0
	[0070.266] lstrlenA (lpString="*.pdf") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.djvu") returned 0
	[0070.266] lstrlenA (lpString="*.djvu") returned 6
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.htm") returned 0
	[0070.266] lstrlenA (lpString="*.htm") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.html") returned 0
	[0070.266] lstrlenA (lpString="*.html") returned 6
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mdb") returned 0
	[0070.266] lstrlenA (lpString="*.mdb") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.cer") returned 0
	[0070.266] lstrlenA (lpString="*.cer") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.p12") returned 0
	[0070.266] lstrlenA (lpString="*.p12") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.pfx") returned 0
	[0070.266] lstrlenA (lpString="*.pfx") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.kwm") returned 0
	[0070.266] lstrlenA (lpString="*.kwm") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.pwm") returned 0
	[0070.266] lstrlenA (lpString="*.pwm") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.1cd") returned 0
	[0070.266] lstrlenA (lpString="*.1cd") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.md") returned 0
	[0070.266] lstrlenA (lpString="*.md") returned 4
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mdf") returned 0
	[0070.266] lstrlenA (lpString="*.mdf") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.dbf") returned 0
	[0070.266] lstrlenA (lpString="*.dbf") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.odt") returned 0
	[0070.266] lstrlenA (lpString="*.odt") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.vob") returned 0
	[0070.266] lstrlenA (lpString="*.vob") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.ifo") returned 0
	[0070.266] lstrlenA (lpString="*.ifo") returned 5
	[0070.266] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.lnk") returned 0
	[0070.267] lstrlenA (lpString="*.lnk") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.torrent") returned 0
	[0070.267] lstrlenA (lpString="*.torrent") returned 9
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mov") returned 0
	[0070.267] lstrlenA (lpString="*.mov") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.m2v") returned 0
	[0070.267] lstrlenA (lpString="*.m2v") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.3gp") returned 0
	[0070.267] lstrlenA (lpString="*.3gp") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mpeg") returned 0
	[0070.267] lstrlenA (lpString="*.mpeg") returned 6
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mpg") returned 0
	[0070.267] lstrlenA (lpString="*.mpg") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.flv") returned 0
	[0070.267] lstrlenA (lpString="*.flv") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.avi") returned 0
	[0070.267] lstrlenA (lpString="*.avi") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mp4") returned 0
	[0070.267] lstrlenA (lpString="*.mp4") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.wmv") returned 0
	[0070.267] lstrlenA (lpString="*.wmv") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.divx") returned 0
	[0070.267] lstrlenA (lpString="*.divx") returned 6
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mkv") returned 0
	[0070.267] lstrlenA (lpString="*.mkv") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.mp3") returned 0
	[0070.267] lstrlenA (lpString="*.mp3") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.wav") returned 0
	[0070.267] lstrlenA (lpString="*.wav") returned 5
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.flac") returned 0
	[0070.267] lstrlenA (lpString="*.flac") returned 6
	[0070.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.ape") returned 0
	[0070.267] lstrlenA (lpString="*.ape") returned 5
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.wma") returned 0
	[0070.268] lstrlenA (lpString="*.wma") returned 5
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.ac3") returned 0
	[0070.268] lstrlenA (lpString="*.ac3") returned 5
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.exe") returned 0
	[0070.268] lstrlenA (lpString="*.exe") returned 5
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", pszSpec="*.apk") returned 0
	[0070.268] lstrlenA (lpString="*.apk") returned 5
	[0070.268] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.268] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7cm_en.dub") returned -1
	[0070.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_en.dub") returned -1
	[0070.268] lstrcmpiA (lpString1="", lpString2="mscss7cm_en.dub") returned -1
	[0070.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="MSCOL11.PPD"
	[0070.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_en.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub"
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.zip") returned 0
	[0070.268] lstrlenA (lpString="*.zip") returned 5
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.rar") returned 0
	[0070.268] lstrlenA (lpString="*.rar") returned 5
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.7z") returned 0
	[0070.268] lstrlenA (lpString="*.7z") returned 4
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.tar") returned 0
	[0070.268] lstrlenA (lpString="*.tar") returned 5
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.gzip") returned 0
	[0070.268] lstrlenA (lpString="*.gzip") returned 6
	[0070.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.jpg") returned 0
	[0070.269] lstrlenA (lpString="*.jpg") returned 5
	[0070.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.jpeg") returned 0
	[0070.269] lstrlenA (lpString="*.jpeg") returned 6
	[0070.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.psd") returned 0
	[0070.269] lstrlenA (lpString="*.psd") returned 5
	[0070.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.cdr") returned 0
	[0070.269] lstrlenA (lpString="*.cdr") returned 5
	[0070.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.dwg") returned 0
	[0070.269] lstrlenA (lpString="*.dwg") returned 5
	[0070.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.max") returned 0
	[0070.269] lstrlenA (lpString="*.max") returned 5
	[0070.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.bmp") returned 0
	[0070.269] lstrlenA (lpString="*.bmp") returned 5
	[0070.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", pszSpec="*.gif") returned 0
	[0070.269] lstrlenA (lpString="*.gif") returned 5
	[0070.269] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.269] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7cm_es.dub") returned -1
	[0070.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_es.dub") returned -1
	[0070.269] lstrcmpiA (lpString1="", lpString2="mscss7cm_es.dub") returned -1
	[0070.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="mscss7cm_en.dub"
	[0070.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_es.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub"
	[0070.270] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.270] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7cm_fr.dub") returned -1
	[0070.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_fr.dub") returned -1
	[0070.270] lstrcmpiA (lpString1="", lpString2="mscss7cm_fr.dub") returned -1
	[0070.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="mscss7cm_es.dub"
	[0070.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_fr.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub"
	[0070.270] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.270] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7en.dll") returned -1
	[0070.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7en.dll") returned -1
	[0070.270] lstrcmpiA (lpString1="", lpString2="mscss7en.dll") returned -1
	[0070.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="mscss7cm_fr.dub"
	[0070.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7en.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll"
	[0070.271] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7es.dll") returned -1
	[0070.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7es.dll") returned -1
	[0070.271] lstrcmpiA (lpString1="", lpString2="mscss7es.dll") returned -1
	[0070.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned="mscss7en.dll"
	[0070.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7es.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll"
	[0070.271] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7fr.dll") returned -1
	[0070.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7fr.dll") returned -1
	[0070.271] lstrcmpiA (lpString1="", lpString2="mscss7fr.dll") returned -1
	[0070.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned="mscss7es.dll"
	[0070.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7fr.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll"
	[0070.272] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7wre_en.dub") returned -1
	[0070.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_en.dub") returned -1
	[0070.272] lstrcmpiA (lpString1="", lpString2="mscss7wre_en.dub") returned -1
	[0070.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned="mscss7fr.dll"
	[0070.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_en.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub"
	[0070.272] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7wre_es.dub") returned -1
	[0070.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_es.dub") returned -1
	[0070.272] lstrcmpiA (lpString1="", lpString2="mscss7wre_es.dub") returned -1
	[0070.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="mscss7wre_en.dub"
	[0070.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_es.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub"
	[0070.272] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7wre_fr.dub") returned -1
	[0070.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_fr.dub") returned -1
	[0070.273] lstrcmpiA (lpString1="", lpString2="mscss7wre_fr.dub") returned -1
	[0070.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="mscss7wre_es.dub"
	[0070.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.273] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_fr.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub"
	[0070.273] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.273] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.273] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7.dll") returned -1
	[0070.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7.dll") returned -1
	[0070.273] lstrcmpiA (lpString1="", lpString2="mset7.dll") returned -1
	[0070.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="mscss7wre_fr.dub"
	[0070.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.273] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll"
	[0070.273] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.273] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.273] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7db.kic") returned -1
	[0070.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7db.kic") returned -1
	[0070.273] lstrcmpiA (lpString1="", lpString2="mset7db.kic") returned -1
	[0070.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned="mset7.dll"
	[0070.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7db.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic"
	[0070.274] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.274] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7en.kic") returned -1
	[0070.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7en.kic") returned -1
	[0070.274] lstrcmpiA (lpString1="", lpString2="mset7en.kic") returned -1
	[0070.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="mset7db.kic"
	[0070.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7en.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic"
	[0070.275] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.275] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.275] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7es.kic") returned -1
	[0070.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7es.kic") returned -1
	[0070.275] lstrcmpiA (lpString1="", lpString2="mset7es.kic") returned -1
	[0070.275] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="mset7en.kic"
	[0070.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.275] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.275] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7es.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic"
	[0070.275] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.275] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.275] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7fr.kic") returned -1
	[0070.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7fr.kic") returned -1
	[0070.275] lstrcmpiA (lpString1="", lpString2="mset7fr.kic") returned -1
	[0070.275] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="mset7es.kic"
	[0070.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.275] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.275] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7fr.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic"
	[0070.275] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.275] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7ge.kic") returned -1
	[0070.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7ge.kic") returned -1
	[0070.276] lstrcmpiA (lpString1="", lpString2="mset7ge.kic") returned -1
	[0070.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="mset7fr.kic"
	[0070.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.276] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7ge.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic"
	[0070.276] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.276] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7jp.kic") returned -1
	[0070.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7jp.kic") returned -1
	[0070.276] lstrcmpiA (lpString1="", lpString2="mset7jp.kic") returned -1
	[0070.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="mset7ge.kic"
	[0070.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.276] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7jp.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic"
	[0070.276] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.276] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7tk.dll") returned -1
	[0070.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tk.dll") returned -1
	[0070.277] lstrcmpiA (lpString1="", lpString2="mset7tk.dll") returned -1
	[0070.277] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="mset7jp.kic"
	[0070.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.277] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7tk.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll"
	[0070.277] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.277] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7tkjp.dll") returned -1
	[0070.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tkjp.dll") returned -1
	[0070.277] lstrcmpiA (lpString1="", lpString2="mset7tkjp.dll") returned -1
	[0070.277] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned="mset7tk.dll"
	[0070.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.277] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7tkjp.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll"
	[0070.277] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.277] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSN.ICO") returned -1
	[0070.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN.ICO") returned -1
	[0070.277] lstrcmpiA (lpString1="", lpString2="MSN.ICO") returned -1
	[0070.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned="mset7tkjp.dll"
	[0070.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.278] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.278] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSN.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO"
	[0070.278] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.278] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.278] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSO0127.ACL") returned -1
	[0070.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO0127.ACL") returned -1
	[0070.278] lstrcmpiA (lpString1="", lpString2="MSO0127.ACL") returned -1
	[0070.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned="MSN.ICO"
	[0070.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.278] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.278] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSO0127.ACL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL"
	[0070.278] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.278] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.278] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOCF.DLL") returned -1
	[0070.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCF.DLL") returned -1
	[0070.278] lstrcmpiA (lpString1="", lpString2="MSOCF.DLL") returned -1
	[0070.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="MSO0127.ACL"
	[0070.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.278] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCF.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL"
	[0070.279] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.279] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.279] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOCFU.DLL") returned -1
	[0070.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFU.DLL") returned -1
	[0070.279] lstrcmpiA (lpString1="", lpString2="MSOCFU.DLL") returned -1
	[0070.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned="MSOCF.DLL"
	[0070.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCFU.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL"
	[0070.279] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.279] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.279] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1
	[0070.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1
	[0070.279] lstrcmpiA (lpString1="", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1
	[0070.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned="MSOCFU.DLL"
	[0070.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCFUIUTILITIESDLL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL"
	[0070.280] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.280] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSODCW.DLL") returned -1
	[0070.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSODCW.DLL") returned -1
	[0070.280] lstrcmpiA (lpString1="", lpString2="MSODCW.DLL") returned -1
	[0070.280] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned="MSOCFUIUTILITIESDLL.DLL"
	[0070.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.280] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSODCW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL"
	[0070.280] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.280] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOHEV.DLL") returned -1
	[0070.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEV.DLL") returned -1
	[0070.280] lstrcmpiA (lpString1="", lpString2="MSOHEV.DLL") returned -1
	[0070.280] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned="MSODCW.DLL"
	[0070.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.280] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHEV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL"
	[0070.280] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.280] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.290] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOHEVI.DLL") returned -1
	[0070.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEVI.DLL") returned -1
	[0070.290] lstrcmpiA (lpString1="", lpString2="MSOHEVI.DLL") returned -1
	[0070.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned="MSOHEV.DLL"
	[0070.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.290] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.290] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHEVI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL"
	[0070.290] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.290] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.290] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOHTMED.EXE") returned -1
	[0070.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHTMED.EXE") returned -1
	[0070.290] lstrcmpiA (lpString1="", lpString2="MSOHTMED.EXE") returned -1
	[0070.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned="MSOHEVI.DLL"
	[0070.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.291] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.291] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHTMED.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE"
	[0070.291] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE"
	[0070.291] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE"
	[0070.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE."
	[0070.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.Boom"
	[0070.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.292] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15780
	[0070.292] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1a159300, dwHighDateTime=0x1ca91da), lpLastAccessTime=0x407536*(dwLowDateTime=0x58c7d970, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1a159300, dwHighDateTime=0x1ca91da)) returned 1
	[0070.292] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.292] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1575d, lpOverlapped=0x0) returned 1
	[0070.326] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="MSOHTMED.EXE"
	[0070.327] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.327] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1575d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1575d, lpOverlapped=0x0) returned 1
	[0070.327] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.327] CloseHandle (hObject=0x88) returned 1
	[0070.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe.boom")) returned 1
	[0070.328] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.328] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.328] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSTYLE.DLL") returned -1
	[0070.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSTYLE.DLL") returned -1
	[0070.328] lstrcmpiA (lpString1="", lpString2="MSOSTYLE.DLL") returned -1
	[0070.328] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="MSOHTMED.EXE"
	[0070.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.328] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.328] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOSTYLE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL"
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.zip") returned 0
	[0070.329] lstrlenA (lpString="*.zip") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.rar") returned 0
	[0070.329] lstrlenA (lpString="*.rar") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.7z") returned 0
	[0070.329] lstrlenA (lpString="*.7z") returned 4
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.tar") returned 0
	[0070.329] lstrlenA (lpString="*.tar") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.gzip") returned 0
	[0070.329] lstrlenA (lpString="*.gzip") returned 6
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.jpg") returned 0
	[0070.329] lstrlenA (lpString="*.jpg") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.jpeg") returned 0
	[0070.329] lstrlenA (lpString="*.jpeg") returned 6
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.psd") returned 0
	[0070.329] lstrlenA (lpString="*.psd") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.cdr") returned 0
	[0070.329] lstrlenA (lpString="*.cdr") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.dwg") returned 0
	[0070.329] lstrlenA (lpString="*.dwg") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.max") returned 0
	[0070.329] lstrlenA (lpString="*.max") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.bmp") returned 0
	[0070.329] lstrlenA (lpString="*.bmp") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.gif") returned 0
	[0070.329] lstrlenA (lpString="*.gif") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.png") returned 0
	[0070.329] lstrlenA (lpString="*.png") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.doc") returned 0
	[0070.329] lstrlenA (lpString="*.doc") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.docx") returned 0
	[0070.329] lstrlenA (lpString="*.docx") returned 6
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.xls") returned 0
	[0070.329] lstrlenA (lpString="*.xls") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.xlsx") returned 0
	[0070.329] lstrlenA (lpString="*.xlsx") returned 6
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.ppt") returned 0
	[0070.329] lstrlenA (lpString="*.ppt") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.pptx") returned 0
	[0070.329] lstrlenA (lpString="*.pptx") returned 6
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.txt") returned 0
	[0070.329] lstrlenA (lpString="*.txt") returned 5
	[0070.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.pdf") returned 0
	[0070.329] lstrlenA (lpString="*.pdf") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.djvu") returned 0
	[0070.330] lstrlenA (lpString="*.djvu") returned 6
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.htm") returned 0
	[0070.330] lstrlenA (lpString="*.htm") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.html") returned 0
	[0070.330] lstrlenA (lpString="*.html") returned 6
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mdb") returned 0
	[0070.330] lstrlenA (lpString="*.mdb") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.cer") returned 0
	[0070.330] lstrlenA (lpString="*.cer") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.p12") returned 0
	[0070.330] lstrlenA (lpString="*.p12") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.pfx") returned 0
	[0070.330] lstrlenA (lpString="*.pfx") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.kwm") returned 0
	[0070.330] lstrlenA (lpString="*.kwm") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.pwm") returned 0
	[0070.330] lstrlenA (lpString="*.pwm") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.1cd") returned 0
	[0070.330] lstrlenA (lpString="*.1cd") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.md") returned 0
	[0070.330] lstrlenA (lpString="*.md") returned 4
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mdf") returned 0
	[0070.330] lstrlenA (lpString="*.mdf") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.dbf") returned 0
	[0070.330] lstrlenA (lpString="*.dbf") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.odt") returned 0
	[0070.330] lstrlenA (lpString="*.odt") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.vob") returned 0
	[0070.330] lstrlenA (lpString="*.vob") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.ifo") returned 0
	[0070.330] lstrlenA (lpString="*.ifo") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.lnk") returned 0
	[0070.330] lstrlenA (lpString="*.lnk") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.torrent") returned 0
	[0070.330] lstrlenA (lpString="*.torrent") returned 9
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mov") returned 0
	[0070.330] lstrlenA (lpString="*.mov") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.m2v") returned 0
	[0070.330] lstrlenA (lpString="*.m2v") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.3gp") returned 0
	[0070.330] lstrlenA (lpString="*.3gp") returned 5
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mpeg") returned 0
	[0070.330] lstrlenA (lpString="*.mpeg") returned 6
	[0070.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mpg") returned 0
	[0070.331] lstrlenA (lpString="*.mpg") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.flv") returned 0
	[0070.331] lstrlenA (lpString="*.flv") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.avi") returned 0
	[0070.331] lstrlenA (lpString="*.avi") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mp4") returned 0
	[0070.331] lstrlenA (lpString="*.mp4") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.wmv") returned 0
	[0070.331] lstrlenA (lpString="*.wmv") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.divx") returned 0
	[0070.331] lstrlenA (lpString="*.divx") returned 6
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mkv") returned 0
	[0070.331] lstrlenA (lpString="*.mkv") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.mp3") returned 0
	[0070.331] lstrlenA (lpString="*.mp3") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.wav") returned 0
	[0070.331] lstrlenA (lpString="*.wav") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.flac") returned 0
	[0070.331] lstrlenA (lpString="*.flac") returned 6
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.ape") returned 0
	[0070.331] lstrlenA (lpString="*.ape") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.wma") returned 0
	[0070.331] lstrlenA (lpString="*.wma") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.ac3") returned 0
	[0070.331] lstrlenA (lpString="*.ac3") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.exe") returned 0
	[0070.331] lstrlenA (lpString="*.exe") returned 5
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", pszSpec="*.apk") returned 0
	[0070.331] lstrlenA (lpString="*.apk") returned 5
	[0070.331] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.331] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.331] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSYNC.EXE") returned -1
	[0070.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSYNC.EXE") returned -1
	[0070.331] lstrcmpiA (lpString1="", lpString2="MSOSYNC.EXE") returned -1
	[0070.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned="MSOSTYLE.DLL"
	[0070.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.331] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.331] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOSYNC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE"
	[0070.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.zip") returned 0
	[0070.331] lstrlenA (lpString="*.zip") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.rar") returned 0
	[0070.332] lstrlenA (lpString="*.rar") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.7z") returned 0
	[0070.332] lstrlenA (lpString="*.7z") returned 4
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.tar") returned 0
	[0070.332] lstrlenA (lpString="*.tar") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.gzip") returned 0
	[0070.332] lstrlenA (lpString="*.gzip") returned 6
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.jpg") returned 0
	[0070.332] lstrlenA (lpString="*.jpg") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.jpeg") returned 0
	[0070.332] lstrlenA (lpString="*.jpeg") returned 6
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.psd") returned 0
	[0070.332] lstrlenA (lpString="*.psd") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.cdr") returned 0
	[0070.332] lstrlenA (lpString="*.cdr") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.dwg") returned 0
	[0070.332] lstrlenA (lpString="*.dwg") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.max") returned 0
	[0070.332] lstrlenA (lpString="*.max") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.bmp") returned 0
	[0070.332] lstrlenA (lpString="*.bmp") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.gif") returned 0
	[0070.332] lstrlenA (lpString="*.gif") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.png") returned 0
	[0070.332] lstrlenA (lpString="*.png") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.doc") returned 0
	[0070.332] lstrlenA (lpString="*.doc") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.docx") returned 0
	[0070.332] lstrlenA (lpString="*.docx") returned 6
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.xls") returned 0
	[0070.332] lstrlenA (lpString="*.xls") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.xlsx") returned 0
	[0070.332] lstrlenA (lpString="*.xlsx") returned 6
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.ppt") returned 0
	[0070.332] lstrlenA (lpString="*.ppt") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.pptx") returned 0
	[0070.332] lstrlenA (lpString="*.pptx") returned 6
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.txt") returned 0
	[0070.332] lstrlenA (lpString="*.txt") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.pdf") returned 0
	[0070.332] lstrlenA (lpString="*.pdf") returned 5
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.djvu") returned 0
	[0070.332] lstrlenA (lpString="*.djvu") returned 6
	[0070.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.htm") returned 0
	[0070.333] lstrlenA (lpString="*.htm") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.html") returned 0
	[0070.333] lstrlenA (lpString="*.html") returned 6
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mdb") returned 0
	[0070.333] lstrlenA (lpString="*.mdb") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.cer") returned 0
	[0070.333] lstrlenA (lpString="*.cer") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.p12") returned 0
	[0070.333] lstrlenA (lpString="*.p12") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.pfx") returned 0
	[0070.333] lstrlenA (lpString="*.pfx") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.kwm") returned 0
	[0070.333] lstrlenA (lpString="*.kwm") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.pwm") returned 0
	[0070.333] lstrlenA (lpString="*.pwm") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.1cd") returned 0
	[0070.333] lstrlenA (lpString="*.1cd") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.md") returned 0
	[0070.333] lstrlenA (lpString="*.md") returned 4
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mdf") returned 0
	[0070.333] lstrlenA (lpString="*.mdf") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.dbf") returned 0
	[0070.333] lstrlenA (lpString="*.dbf") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.odt") returned 0
	[0070.333] lstrlenA (lpString="*.odt") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.vob") returned 0
	[0070.333] lstrlenA (lpString="*.vob") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.ifo") returned 0
	[0070.333] lstrlenA (lpString="*.ifo") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.lnk") returned 0
	[0070.333] lstrlenA (lpString="*.lnk") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.torrent") returned 0
	[0070.333] lstrlenA (lpString="*.torrent") returned 9
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mov") returned 0
	[0070.333] lstrlenA (lpString="*.mov") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.m2v") returned 0
	[0070.333] lstrlenA (lpString="*.m2v") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.3gp") returned 0
	[0070.333] lstrlenA (lpString="*.3gp") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mpeg") returned 0
	[0070.333] lstrlenA (lpString="*.mpeg") returned 6
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mpg") returned 0
	[0070.333] lstrlenA (lpString="*.mpg") returned 5
	[0070.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.flv") returned 0
	[0070.333] lstrlenA (lpString="*.flv") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.avi") returned 0
	[0070.334] lstrlenA (lpString="*.avi") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mp4") returned 0
	[0070.334] lstrlenA (lpString="*.mp4") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.wmv") returned 0
	[0070.334] lstrlenA (lpString="*.wmv") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.divx") returned 0
	[0070.334] lstrlenA (lpString="*.divx") returned 6
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mkv") returned 0
	[0070.334] lstrlenA (lpString="*.mkv") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.mp3") returned 0
	[0070.334] lstrlenA (lpString="*.mp3") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.wav") returned 0
	[0070.334] lstrlenA (lpString="*.wav") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.flac") returned 0
	[0070.334] lstrlenA (lpString="*.flac") returned 6
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.ape") returned 0
	[0070.334] lstrlenA (lpString="*.ape") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.wma") returned 0
	[0070.334] lstrlenA (lpString="*.wma") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.ac3") returned 0
	[0070.334] lstrlenA (lpString="*.ac3") returned 5
	[0070.334] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", pszSpec="*.exe") returned 1
	[0070.334] lstrlenA (lpString="*.exe") returned 5
	[0070.334] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE"
	[0070.334] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE"
	[0070.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE."
	[0070.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.Boom"
	[0070.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.335] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde180
	[0070.335] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7d58a800, dwHighDateTime=0x1cba06e), lpLastAccessTime=0x407536*(dwLowDateTime=0xd6297920, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7d58a800, dwHighDateTime=0x1cba06e)) returned 1
	[0070.335] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.335] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xde15d, lpOverlapped=0x0) returned 1
	[0070.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="MSOSYNC.EXE"
	[0070.375] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.375] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xde15d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xde15d, lpOverlapped=0x0) returned 1
	[0070.377] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.377] CloseHandle (hObject=0x88) returned 1
	[0070.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe.boom")) returned 1
	[0070.378] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.378] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.379] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOUC.EXE") returned -1
	[0070.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC.EXE") returned -1
	[0070.379] lstrcmpiA (lpString1="", lpString2="MSOUC.EXE") returned -1
	[0070.379] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="MSOSYNC.EXE"
	[0070.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.379] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOUC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE"
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.zip") returned 0
	[0070.379] lstrlenA (lpString="*.zip") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.rar") returned 0
	[0070.379] lstrlenA (lpString="*.rar") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.7z") returned 0
	[0070.379] lstrlenA (lpString="*.7z") returned 4
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.tar") returned 0
	[0070.379] lstrlenA (lpString="*.tar") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.gzip") returned 0
	[0070.379] lstrlenA (lpString="*.gzip") returned 6
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.jpg") returned 0
	[0070.379] lstrlenA (lpString="*.jpg") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.jpeg") returned 0
	[0070.379] lstrlenA (lpString="*.jpeg") returned 6
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.psd") returned 0
	[0070.379] lstrlenA (lpString="*.psd") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.cdr") returned 0
	[0070.379] lstrlenA (lpString="*.cdr") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.dwg") returned 0
	[0070.379] lstrlenA (lpString="*.dwg") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.max") returned 0
	[0070.379] lstrlenA (lpString="*.max") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.bmp") returned 0
	[0070.379] lstrlenA (lpString="*.bmp") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.gif") returned 0
	[0070.379] lstrlenA (lpString="*.gif") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.png") returned 0
	[0070.379] lstrlenA (lpString="*.png") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.doc") returned 0
	[0070.379] lstrlenA (lpString="*.doc") returned 5
	[0070.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.docx") returned 0
	[0070.380] lstrlenA (lpString="*.docx") returned 6
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.xls") returned 0
	[0070.380] lstrlenA (lpString="*.xls") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.xlsx") returned 0
	[0070.380] lstrlenA (lpString="*.xlsx") returned 6
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.ppt") returned 0
	[0070.380] lstrlenA (lpString="*.ppt") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.pptx") returned 0
	[0070.380] lstrlenA (lpString="*.pptx") returned 6
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.txt") returned 0
	[0070.380] lstrlenA (lpString="*.txt") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.pdf") returned 0
	[0070.380] lstrlenA (lpString="*.pdf") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.djvu") returned 0
	[0070.380] lstrlenA (lpString="*.djvu") returned 6
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.htm") returned 0
	[0070.380] lstrlenA (lpString="*.htm") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.html") returned 0
	[0070.380] lstrlenA (lpString="*.html") returned 6
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mdb") returned 0
	[0070.380] lstrlenA (lpString="*.mdb") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.cer") returned 0
	[0070.380] lstrlenA (lpString="*.cer") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.p12") returned 0
	[0070.380] lstrlenA (lpString="*.p12") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.pfx") returned 0
	[0070.380] lstrlenA (lpString="*.pfx") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.kwm") returned 0
	[0070.380] lstrlenA (lpString="*.kwm") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.pwm") returned 0
	[0070.380] lstrlenA (lpString="*.pwm") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.1cd") returned 0
	[0070.380] lstrlenA (lpString="*.1cd") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.md") returned 0
	[0070.380] lstrlenA (lpString="*.md") returned 4
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mdf") returned 0
	[0070.380] lstrlenA (lpString="*.mdf") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.dbf") returned 0
	[0070.380] lstrlenA (lpString="*.dbf") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.odt") returned 0
	[0070.380] lstrlenA (lpString="*.odt") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.vob") returned 0
	[0070.380] lstrlenA (lpString="*.vob") returned 5
	[0070.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.ifo") returned 0
	[0070.381] lstrlenA (lpString="*.ifo") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.lnk") returned 0
	[0070.381] lstrlenA (lpString="*.lnk") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.torrent") returned 0
	[0070.381] lstrlenA (lpString="*.torrent") returned 9
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mov") returned 0
	[0070.381] lstrlenA (lpString="*.mov") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.m2v") returned 0
	[0070.381] lstrlenA (lpString="*.m2v") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.3gp") returned 0
	[0070.381] lstrlenA (lpString="*.3gp") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mpeg") returned 0
	[0070.381] lstrlenA (lpString="*.mpeg") returned 6
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mpg") returned 0
	[0070.381] lstrlenA (lpString="*.mpg") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.flv") returned 0
	[0070.381] lstrlenA (lpString="*.flv") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.avi") returned 0
	[0070.381] lstrlenA (lpString="*.avi") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mp4") returned 0
	[0070.381] lstrlenA (lpString="*.mp4") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.wmv") returned 0
	[0070.381] lstrlenA (lpString="*.wmv") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.divx") returned 0
	[0070.381] lstrlenA (lpString="*.divx") returned 6
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mkv") returned 0
	[0070.381] lstrlenA (lpString="*.mkv") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.mp3") returned 0
	[0070.381] lstrlenA (lpString="*.mp3") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.wav") returned 0
	[0070.381] lstrlenA (lpString="*.wav") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.flac") returned 0
	[0070.381] lstrlenA (lpString="*.flac") returned 6
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.ape") returned 0
	[0070.381] lstrlenA (lpString="*.ape") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.wma") returned 0
	[0070.381] lstrlenA (lpString="*.wma") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.ac3") returned 0
	[0070.381] lstrlenA (lpString="*.ac3") returned 5
	[0070.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", pszSpec="*.exe") returned 1
	[0070.381] lstrlenA (lpString="*.exe") returned 5
	[0070.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE"
	[0070.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE"
	[0070.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE."
	[0070.382] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.Boom"
	[0070.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.382] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77978
	[0070.382] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7d58a800, dwHighDateTime=0x1cba06e), lpLastAccessTime=0x407536*(dwLowDateTime=0xd62e3be0, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7d58a800, dwHighDateTime=0x1cba06e)) returned 1
	[0070.382] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.382] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x77955, lpOverlapped=0x0) returned 1
	[0070.403] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="MSOUC.EXE"
	[0070.405] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.405] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x77955, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x77955, lpOverlapped=0x0) returned 1
	[0070.406] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.406] CloseHandle (hObject=0x88) returned 1
	[0070.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe.boom")) returned 1
	[0070.407] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.407] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.407] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOUTL.OLB") returned -1
	[0070.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTL.OLB") returned -1
	[0070.407] lstrcmpiA (lpString1="", lpString2="MSOUTL.OLB") returned -1
	[0070.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="MSOUC.EXE"
	[0070.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOUTL.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB"
	[0070.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.zip") returned 0
	[0070.408] lstrlenA (lpString="*.zip") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.rar") returned 0
	[0070.408] lstrlenA (lpString="*.rar") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.7z") returned 0
	[0070.408] lstrlenA (lpString="*.7z") returned 4
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.tar") returned 0
	[0070.408] lstrlenA (lpString="*.tar") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.gzip") returned 0
	[0070.408] lstrlenA (lpString="*.gzip") returned 6
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.jpg") returned 0
	[0070.408] lstrlenA (lpString="*.jpg") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.jpeg") returned 0
	[0070.408] lstrlenA (lpString="*.jpeg") returned 6
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.psd") returned 0
	[0070.408] lstrlenA (lpString="*.psd") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.cdr") returned 0
	[0070.408] lstrlenA (lpString="*.cdr") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.dwg") returned 0
	[0070.408] lstrlenA (lpString="*.dwg") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.max") returned 0
	[0070.408] lstrlenA (lpString="*.max") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.bmp") returned 0
	[0070.408] lstrlenA (lpString="*.bmp") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.gif") returned 0
	[0070.408] lstrlenA (lpString="*.gif") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.png") returned 0
	[0070.408] lstrlenA (lpString="*.png") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.doc") returned 0
	[0070.408] lstrlenA (lpString="*.doc") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.docx") returned 0
	[0070.408] lstrlenA (lpString="*.docx") returned 6
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.xls") returned 0
	[0070.408] lstrlenA (lpString="*.xls") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.xlsx") returned 0
	[0070.408] lstrlenA (lpString="*.xlsx") returned 6
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.ppt") returned 0
	[0070.408] lstrlenA (lpString="*.ppt") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.pptx") returned 0
	[0070.408] lstrlenA (lpString="*.pptx") returned 6
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.txt") returned 0
	[0070.408] lstrlenA (lpString="*.txt") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.pdf") returned 0
	[0070.408] lstrlenA (lpString="*.pdf") returned 5
	[0070.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.djvu") returned 0
	[0070.409] lstrlenA (lpString="*.djvu") returned 6
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.htm") returned 0
	[0070.409] lstrlenA (lpString="*.htm") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.html") returned 0
	[0070.409] lstrlenA (lpString="*.html") returned 6
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mdb") returned 0
	[0070.409] lstrlenA (lpString="*.mdb") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.cer") returned 0
	[0070.409] lstrlenA (lpString="*.cer") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.p12") returned 0
	[0070.409] lstrlenA (lpString="*.p12") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.pfx") returned 0
	[0070.409] lstrlenA (lpString="*.pfx") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.kwm") returned 0
	[0070.409] lstrlenA (lpString="*.kwm") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.pwm") returned 0
	[0070.409] lstrlenA (lpString="*.pwm") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.1cd") returned 0
	[0070.409] lstrlenA (lpString="*.1cd") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.md") returned 0
	[0070.409] lstrlenA (lpString="*.md") returned 4
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mdf") returned 0
	[0070.409] lstrlenA (lpString="*.mdf") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.dbf") returned 0
	[0070.409] lstrlenA (lpString="*.dbf") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.odt") returned 0
	[0070.409] lstrlenA (lpString="*.odt") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.vob") returned 0
	[0070.409] lstrlenA (lpString="*.vob") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.ifo") returned 0
	[0070.409] lstrlenA (lpString="*.ifo") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.lnk") returned 0
	[0070.409] lstrlenA (lpString="*.lnk") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.torrent") returned 0
	[0070.409] lstrlenA (lpString="*.torrent") returned 9
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mov") returned 0
	[0070.409] lstrlenA (lpString="*.mov") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.m2v") returned 0
	[0070.409] lstrlenA (lpString="*.m2v") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.3gp") returned 0
	[0070.409] lstrlenA (lpString="*.3gp") returned 5
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mpeg") returned 0
	[0070.409] lstrlenA (lpString="*.mpeg") returned 6
	[0070.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mpg") returned 0
	[0070.409] lstrlenA (lpString="*.mpg") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.flv") returned 0
	[0070.410] lstrlenA (lpString="*.flv") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.avi") returned 0
	[0070.410] lstrlenA (lpString="*.avi") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mp4") returned 0
	[0070.410] lstrlenA (lpString="*.mp4") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.wmv") returned 0
	[0070.410] lstrlenA (lpString="*.wmv") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.divx") returned 0
	[0070.410] lstrlenA (lpString="*.divx") returned 6
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mkv") returned 0
	[0070.410] lstrlenA (lpString="*.mkv") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.mp3") returned 0
	[0070.410] lstrlenA (lpString="*.mp3") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.wav") returned 0
	[0070.410] lstrlenA (lpString="*.wav") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.flac") returned 0
	[0070.410] lstrlenA (lpString="*.flac") returned 6
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.ape") returned 0
	[0070.410] lstrlenA (lpString="*.ape") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.wma") returned 0
	[0070.410] lstrlenA (lpString="*.wma") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.ac3") returned 0
	[0070.410] lstrlenA (lpString="*.ac3") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.exe") returned 0
	[0070.410] lstrlenA (lpString="*.exe") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", pszSpec="*.apk") returned 0
	[0070.410] lstrlenA (lpString="*.apk") returned 5
	[0070.410] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.410] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.410] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOUTLS.DLL") returned -1
	[0070.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTLS.DLL") returned -1
	[0070.410] lstrcmpiA (lpString1="", lpString2="MSOUTLS.DLL") returned -1
	[0070.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned="MSOUTL.OLB"
	[0070.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOUTLS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL"
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.zip") returned 0
	[0070.410] lstrlenA (lpString="*.zip") returned 5
	[0070.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.rar") returned 0
	[0070.411] lstrlenA (lpString="*.rar") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.7z") returned 0
	[0070.411] lstrlenA (lpString="*.7z") returned 4
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.tar") returned 0
	[0070.411] lstrlenA (lpString="*.tar") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.gzip") returned 0
	[0070.411] lstrlenA (lpString="*.gzip") returned 6
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.jpg") returned 0
	[0070.411] lstrlenA (lpString="*.jpg") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.jpeg") returned 0
	[0070.411] lstrlenA (lpString="*.jpeg") returned 6
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.psd") returned 0
	[0070.411] lstrlenA (lpString="*.psd") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.cdr") returned 0
	[0070.411] lstrlenA (lpString="*.cdr") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.dwg") returned 0
	[0070.411] lstrlenA (lpString="*.dwg") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.max") returned 0
	[0070.411] lstrlenA (lpString="*.max") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.bmp") returned 0
	[0070.411] lstrlenA (lpString="*.bmp") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.gif") returned 0
	[0070.411] lstrlenA (lpString="*.gif") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.png") returned 0
	[0070.411] lstrlenA (lpString="*.png") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.doc") returned 0
	[0070.411] lstrlenA (lpString="*.doc") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.docx") returned 0
	[0070.411] lstrlenA (lpString="*.docx") returned 6
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.xls") returned 0
	[0070.411] lstrlenA (lpString="*.xls") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.xlsx") returned 0
	[0070.411] lstrlenA (lpString="*.xlsx") returned 6
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.ppt") returned 0
	[0070.411] lstrlenA (lpString="*.ppt") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.pptx") returned 0
	[0070.411] lstrlenA (lpString="*.pptx") returned 6
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.txt") returned 0
	[0070.411] lstrlenA (lpString="*.txt") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.pdf") returned 0
	[0070.411] lstrlenA (lpString="*.pdf") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.djvu") returned 0
	[0070.411] lstrlenA (lpString="*.djvu") returned 6
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.htm") returned 0
	[0070.411] lstrlenA (lpString="*.htm") returned 5
	[0070.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.html") returned 0
	[0070.412] lstrlenA (lpString="*.html") returned 6
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mdb") returned 0
	[0070.412] lstrlenA (lpString="*.mdb") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.cer") returned 0
	[0070.412] lstrlenA (lpString="*.cer") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.p12") returned 0
	[0070.412] lstrlenA (lpString="*.p12") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.pfx") returned 0
	[0070.412] lstrlenA (lpString="*.pfx") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.kwm") returned 0
	[0070.412] lstrlenA (lpString="*.kwm") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.pwm") returned 0
	[0070.412] lstrlenA (lpString="*.pwm") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.1cd") returned 0
	[0070.412] lstrlenA (lpString="*.1cd") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.md") returned 0
	[0070.412] lstrlenA (lpString="*.md") returned 4
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mdf") returned 0
	[0070.412] lstrlenA (lpString="*.mdf") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.dbf") returned 0
	[0070.412] lstrlenA (lpString="*.dbf") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.odt") returned 0
	[0070.412] lstrlenA (lpString="*.odt") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.vob") returned 0
	[0070.412] lstrlenA (lpString="*.vob") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.ifo") returned 0
	[0070.412] lstrlenA (lpString="*.ifo") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.lnk") returned 0
	[0070.412] lstrlenA (lpString="*.lnk") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.torrent") returned 0
	[0070.412] lstrlenA (lpString="*.torrent") returned 9
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mov") returned 0
	[0070.412] lstrlenA (lpString="*.mov") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.m2v") returned 0
	[0070.412] lstrlenA (lpString="*.m2v") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.3gp") returned 0
	[0070.412] lstrlenA (lpString="*.3gp") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mpeg") returned 0
	[0070.412] lstrlenA (lpString="*.mpeg") returned 6
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mpg") returned 0
	[0070.412] lstrlenA (lpString="*.mpg") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.flv") returned 0
	[0070.412] lstrlenA (lpString="*.flv") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.avi") returned 0
	[0070.412] lstrlenA (lpString="*.avi") returned 5
	[0070.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mp4") returned 0
	[0070.413] lstrlenA (lpString="*.mp4") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.wmv") returned 0
	[0070.413] lstrlenA (lpString="*.wmv") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.divx") returned 0
	[0070.413] lstrlenA (lpString="*.divx") returned 6
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mkv") returned 0
	[0070.413] lstrlenA (lpString="*.mkv") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.mp3") returned 0
	[0070.413] lstrlenA (lpString="*.mp3") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.wav") returned 0
	[0070.413] lstrlenA (lpString="*.wav") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.flac") returned 0
	[0070.413] lstrlenA (lpString="*.flac") returned 6
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.ape") returned 0
	[0070.413] lstrlenA (lpString="*.ape") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.wma") returned 0
	[0070.413] lstrlenA (lpString="*.wma") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.ac3") returned 0
	[0070.413] lstrlenA (lpString="*.ac3") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.exe") returned 0
	[0070.413] lstrlenA (lpString="*.exe") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", pszSpec="*.apk") returned 0
	[0070.413] lstrlenA (lpString="*.apk") returned 5
	[0070.413] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.413] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPJEVTS.DLL") returned -1
	[0070.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPJEVTS.DLL") returned -1
	[0070.413] lstrcmpiA (lpString1="", lpString2="MSPJEVTS.DLL") returned -1
	[0070.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned="MSOUTLS.DLL"
	[0070.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPJEVTS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL"
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.zip") returned 0
	[0070.413] lstrlenA (lpString="*.zip") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.rar") returned 0
	[0070.413] lstrlenA (lpString="*.rar") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.7z") returned 0
	[0070.413] lstrlenA (lpString="*.7z") returned 4
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.tar") returned 0
	[0070.413] lstrlenA (lpString="*.tar") returned 5
	[0070.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.gzip") returned 0
	[0070.414] lstrlenA (lpString="*.gzip") returned 6
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.jpg") returned 0
	[0070.414] lstrlenA (lpString="*.jpg") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.jpeg") returned 0
	[0070.414] lstrlenA (lpString="*.jpeg") returned 6
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.psd") returned 0
	[0070.414] lstrlenA (lpString="*.psd") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.cdr") returned 0
	[0070.414] lstrlenA (lpString="*.cdr") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.dwg") returned 0
	[0070.414] lstrlenA (lpString="*.dwg") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.max") returned 0
	[0070.414] lstrlenA (lpString="*.max") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.bmp") returned 0
	[0070.414] lstrlenA (lpString="*.bmp") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.gif") returned 0
	[0070.414] lstrlenA (lpString="*.gif") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.png") returned 0
	[0070.414] lstrlenA (lpString="*.png") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.doc") returned 0
	[0070.414] lstrlenA (lpString="*.doc") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.docx") returned 0
	[0070.414] lstrlenA (lpString="*.docx") returned 6
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.xls") returned 0
	[0070.414] lstrlenA (lpString="*.xls") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.xlsx") returned 0
	[0070.414] lstrlenA (lpString="*.xlsx") returned 6
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.ppt") returned 0
	[0070.414] lstrlenA (lpString="*.ppt") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.pptx") returned 0
	[0070.414] lstrlenA (lpString="*.pptx") returned 6
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.txt") returned 0
	[0070.414] lstrlenA (lpString="*.txt") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.pdf") returned 0
	[0070.414] lstrlenA (lpString="*.pdf") returned 5
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.djvu") returned 0
	[0070.414] lstrlenA (lpString="*.djvu") returned 6
	[0070.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.htm") returned 0
	[0070.414] lstrlenA (lpString="*.htm") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.html") returned 0
	[0070.415] lstrlenA (lpString="*.html") returned 6
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mdb") returned 0
	[0070.415] lstrlenA (lpString="*.mdb") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.cer") returned 0
	[0070.415] lstrlenA (lpString="*.cer") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.p12") returned 0
	[0070.415] lstrlenA (lpString="*.p12") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.pfx") returned 0
	[0070.415] lstrlenA (lpString="*.pfx") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.kwm") returned 0
	[0070.415] lstrlenA (lpString="*.kwm") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.pwm") returned 0
	[0070.415] lstrlenA (lpString="*.pwm") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.1cd") returned 0
	[0070.415] lstrlenA (lpString="*.1cd") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.md") returned 0
	[0070.415] lstrlenA (lpString="*.md") returned 4
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mdf") returned 0
	[0070.415] lstrlenA (lpString="*.mdf") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.dbf") returned 0
	[0070.415] lstrlenA (lpString="*.dbf") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.odt") returned 0
	[0070.415] lstrlenA (lpString="*.odt") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.vob") returned 0
	[0070.415] lstrlenA (lpString="*.vob") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.ifo") returned 0
	[0070.415] lstrlenA (lpString="*.ifo") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.lnk") returned 0
	[0070.415] lstrlenA (lpString="*.lnk") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.torrent") returned 0
	[0070.415] lstrlenA (lpString="*.torrent") returned 9
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mov") returned 0
	[0070.415] lstrlenA (lpString="*.mov") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.m2v") returned 0
	[0070.415] lstrlenA (lpString="*.m2v") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.3gp") returned 0
	[0070.415] lstrlenA (lpString="*.3gp") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mpeg") returned 0
	[0070.415] lstrlenA (lpString="*.mpeg") returned 6
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mpg") returned 0
	[0070.415] lstrlenA (lpString="*.mpg") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.flv") returned 0
	[0070.415] lstrlenA (lpString="*.flv") returned 5
	[0070.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.avi") returned 0
	[0070.416] lstrlenA (lpString="*.avi") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mp4") returned 0
	[0070.416] lstrlenA (lpString="*.mp4") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.wmv") returned 0
	[0070.416] lstrlenA (lpString="*.wmv") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.divx") returned 0
	[0070.416] lstrlenA (lpString="*.divx") returned 6
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mkv") returned 0
	[0070.416] lstrlenA (lpString="*.mkv") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.mp3") returned 0
	[0070.416] lstrlenA (lpString="*.mp3") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.wav") returned 0
	[0070.416] lstrlenA (lpString="*.wav") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.flac") returned 0
	[0070.416] lstrlenA (lpString="*.flac") returned 6
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.ape") returned 0
	[0070.416] lstrlenA (lpString="*.ape") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.wma") returned 0
	[0070.416] lstrlenA (lpString="*.wma") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.ac3") returned 0
	[0070.416] lstrlenA (lpString="*.ac3") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.exe") returned 0
	[0070.416] lstrlenA (lpString="*.exe") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", pszSpec="*.apk") returned 0
	[0070.416] lstrlenA (lpString="*.apk") returned 5
	[0070.416] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.416] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPPT.OLB") returned -1
	[0070.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPPT.OLB") returned -1
	[0070.416] lstrcmpiA (lpString1="", lpString2="MSPPT.OLB") returned -1
	[0070.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned="MSPJEVTS.DLL"
	[0070.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPPT.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB"
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.zip") returned 0
	[0070.416] lstrlenA (lpString="*.zip") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.rar") returned 0
	[0070.416] lstrlenA (lpString="*.rar") returned 5
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.7z") returned 0
	[0070.416] lstrlenA (lpString="*.7z") returned 4
	[0070.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.tar") returned 0
	[0070.417] lstrlenA (lpString="*.tar") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.gzip") returned 0
	[0070.417] lstrlenA (lpString="*.gzip") returned 6
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.jpg") returned 0
	[0070.417] lstrlenA (lpString="*.jpg") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.jpeg") returned 0
	[0070.417] lstrlenA (lpString="*.jpeg") returned 6
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.psd") returned 0
	[0070.417] lstrlenA (lpString="*.psd") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.cdr") returned 0
	[0070.417] lstrlenA (lpString="*.cdr") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.dwg") returned 0
	[0070.417] lstrlenA (lpString="*.dwg") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.max") returned 0
	[0070.417] lstrlenA (lpString="*.max") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.bmp") returned 0
	[0070.417] lstrlenA (lpString="*.bmp") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.gif") returned 0
	[0070.417] lstrlenA (lpString="*.gif") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.png") returned 0
	[0070.417] lstrlenA (lpString="*.png") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.doc") returned 0
	[0070.417] lstrlenA (lpString="*.doc") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.docx") returned 0
	[0070.417] lstrlenA (lpString="*.docx") returned 6
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.xls") returned 0
	[0070.417] lstrlenA (lpString="*.xls") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.xlsx") returned 0
	[0070.417] lstrlenA (lpString="*.xlsx") returned 6
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.ppt") returned 0
	[0070.417] lstrlenA (lpString="*.ppt") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.pptx") returned 0
	[0070.417] lstrlenA (lpString="*.pptx") returned 6
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.txt") returned 0
	[0070.417] lstrlenA (lpString="*.txt") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.pdf") returned 0
	[0070.417] lstrlenA (lpString="*.pdf") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.djvu") returned 0
	[0070.417] lstrlenA (lpString="*.djvu") returned 6
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.htm") returned 0
	[0070.417] lstrlenA (lpString="*.htm") returned 5
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.html") returned 0
	[0070.417] lstrlenA (lpString="*.html") returned 6
	[0070.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mdb") returned 0
	[0070.417] lstrlenA (lpString="*.mdb") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.cer") returned 0
	[0070.418] lstrlenA (lpString="*.cer") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.p12") returned 0
	[0070.418] lstrlenA (lpString="*.p12") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.pfx") returned 0
	[0070.418] lstrlenA (lpString="*.pfx") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.kwm") returned 0
	[0070.418] lstrlenA (lpString="*.kwm") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.pwm") returned 0
	[0070.418] lstrlenA (lpString="*.pwm") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.1cd") returned 0
	[0070.418] lstrlenA (lpString="*.1cd") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.md") returned 0
	[0070.418] lstrlenA (lpString="*.md") returned 4
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mdf") returned 0
	[0070.418] lstrlenA (lpString="*.mdf") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.dbf") returned 0
	[0070.418] lstrlenA (lpString="*.dbf") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.odt") returned 0
	[0070.418] lstrlenA (lpString="*.odt") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.vob") returned 0
	[0070.418] lstrlenA (lpString="*.vob") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.ifo") returned 0
	[0070.418] lstrlenA (lpString="*.ifo") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.lnk") returned 0
	[0070.418] lstrlenA (lpString="*.lnk") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.torrent") returned 0
	[0070.418] lstrlenA (lpString="*.torrent") returned 9
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mov") returned 0
	[0070.418] lstrlenA (lpString="*.mov") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.m2v") returned 0
	[0070.418] lstrlenA (lpString="*.m2v") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.3gp") returned 0
	[0070.418] lstrlenA (lpString="*.3gp") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mpeg") returned 0
	[0070.418] lstrlenA (lpString="*.mpeg") returned 6
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mpg") returned 0
	[0070.418] lstrlenA (lpString="*.mpg") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.flv") returned 0
	[0070.418] lstrlenA (lpString="*.flv") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.avi") returned 0
	[0070.418] lstrlenA (lpString="*.avi") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mp4") returned 0
	[0070.418] lstrlenA (lpString="*.mp4") returned 5
	[0070.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.wmv") returned 0
	[0070.419] lstrlenA (lpString="*.wmv") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.divx") returned 0
	[0070.419] lstrlenA (lpString="*.divx") returned 6
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mkv") returned 0
	[0070.419] lstrlenA (lpString="*.mkv") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.mp3") returned 0
	[0070.419] lstrlenA (lpString="*.mp3") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.wav") returned 0
	[0070.419] lstrlenA (lpString="*.wav") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.flac") returned 0
	[0070.419] lstrlenA (lpString="*.flac") returned 6
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.ape") returned 0
	[0070.419] lstrlenA (lpString="*.ape") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.wma") returned 0
	[0070.419] lstrlenA (lpString="*.wma") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.ac3") returned 0
	[0070.419] lstrlenA (lpString="*.ac3") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.exe") returned 0
	[0070.419] lstrlenA (lpString="*.exe") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", pszSpec="*.apk") returned 0
	[0070.419] lstrlenA (lpString="*.apk") returned 5
	[0070.419] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.419] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.419] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPRJ.OLB") returned -1
	[0070.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPRJ.OLB") returned -1
	[0070.419] lstrcmpiA (lpString1="", lpString2="MSPRJ.OLB") returned -1
	[0070.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned="MSPPT.OLB"
	[0070.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.419] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPRJ.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB"
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.zip") returned 0
	[0070.419] lstrlenA (lpString="*.zip") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.rar") returned 0
	[0070.419] lstrlenA (lpString="*.rar") returned 5
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.7z") returned 0
	[0070.419] lstrlenA (lpString="*.7z") returned 4
	[0070.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.tar") returned 0
	[0070.419] lstrlenA (lpString="*.tar") returned 5
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.gzip") returned 0
	[0070.420] lstrlenA (lpString="*.gzip") returned 6
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.jpg") returned 0
	[0070.420] lstrlenA (lpString="*.jpg") returned 5
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.jpeg") returned 0
	[0070.420] lstrlenA (lpString="*.jpeg") returned 6
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.psd") returned 0
	[0070.420] lstrlenA (lpString="*.psd") returned 5
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.cdr") returned 0
	[0070.420] lstrlenA (lpString="*.cdr") returned 5
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.dwg") returned 0
	[0070.420] lstrlenA (lpString="*.dwg") returned 5
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.max") returned 0
	[0070.420] lstrlenA (lpString="*.max") returned 5
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.bmp") returned 0
	[0070.420] lstrlenA (lpString="*.bmp") returned 5
	[0070.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", pszSpec="*.gif") returned 0
	[0070.420] lstrlenA (lpString="*.gif") returned 5
	[0070.420] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.420] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.420] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msproof7.dll") returned -1
	[0070.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msproof7.dll") returned -1
	[0070.420] lstrcmpiA (lpString1="", lpString2="msproof7.dll") returned -1
	[0070.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned="MSPRJ.OLB"
	[0070.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.420] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="msproof7.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll"
	[0070.421] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.421] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.421] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPST32.DLL") returned -1
	[0070.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPST32.DLL") returned -1
	[0070.421] lstrcmpiA (lpString1="", lpString2="MSPST32.DLL") returned -1
	[0070.421] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned="msproof7.dll"
	[0070.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.421] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPST32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL"
	[0070.421] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.421] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.421] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB.EXE") returned -1
	[0070.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.EXE") returned -1
	[0070.421] lstrcmpiA (lpString1="", lpString2="MSPUB.EXE") returned -1
	[0070.421] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned="MSPST32.DLL"
	[0070.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.421] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPUB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE"
	[0070.421] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE"
	[0070.421] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE"
	[0070.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE."
	[0070.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.Boom"
	[0070.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.422] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb4b68
	[0070.422] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83e01e00, dwHighDateTime=0x1cab8a8), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a1356f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83e01e00, dwHighDateTime=0x1cab8a8)) returned 1
	[0070.422] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.422] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0070.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="MSPUB.EXE"
	[0070.476] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.477] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0070.483] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.483] CloseHandle (hObject=0x88) returned 1
	[0070.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.boom")) returned 1
	[0070.484] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.484] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.484] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mspub.exe.manifest") returned -1
	[0070.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mspub.exe.manifest") returned -1
	[0070.484] lstrcmpiA (lpString1="", lpString2="mspub.exe.manifest") returned -1
	[0070.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="MSPUB.EXE"
	[0070.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mspub.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest"
	[0070.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.zip") returned 0
	[0070.484] lstrlenA (lpString="*.zip") returned 5
	[0070.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.rar") returned 0
	[0070.484] lstrlenA (lpString="*.rar") returned 5
	[0070.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.7z") returned 0
	[0070.484] lstrlenA (lpString="*.7z") returned 4
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.tar") returned 0
	[0070.485] lstrlenA (lpString="*.tar") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.gzip") returned 0
	[0070.485] lstrlenA (lpString="*.gzip") returned 6
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.jpg") returned 0
	[0070.485] lstrlenA (lpString="*.jpg") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.jpeg") returned 0
	[0070.485] lstrlenA (lpString="*.jpeg") returned 6
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.psd") returned 0
	[0070.485] lstrlenA (lpString="*.psd") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.cdr") returned 0
	[0070.485] lstrlenA (lpString="*.cdr") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.dwg") returned 0
	[0070.485] lstrlenA (lpString="*.dwg") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.max") returned 0
	[0070.485] lstrlenA (lpString="*.max") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.bmp") returned 0
	[0070.485] lstrlenA (lpString="*.bmp") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.gif") returned 0
	[0070.485] lstrlenA (lpString="*.gif") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.png") returned 0
	[0070.485] lstrlenA (lpString="*.png") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.doc") returned 0
	[0070.485] lstrlenA (lpString="*.doc") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.docx") returned 0
	[0070.485] lstrlenA (lpString="*.docx") returned 6
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.xls") returned 0
	[0070.485] lstrlenA (lpString="*.xls") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.xlsx") returned 0
	[0070.485] lstrlenA (lpString="*.xlsx") returned 6
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.ppt") returned 0
	[0070.485] lstrlenA (lpString="*.ppt") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.pptx") returned 0
	[0070.485] lstrlenA (lpString="*.pptx") returned 6
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.txt") returned 0
	[0070.485] lstrlenA (lpString="*.txt") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.pdf") returned 0
	[0070.485] lstrlenA (lpString="*.pdf") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.djvu") returned 0
	[0070.485] lstrlenA (lpString="*.djvu") returned 6
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.htm") returned 0
	[0070.485] lstrlenA (lpString="*.htm") returned 5
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.html") returned 0
	[0070.485] lstrlenA (lpString="*.html") returned 6
	[0070.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mdb") returned 0
	[0070.485] lstrlenA (lpString="*.mdb") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.cer") returned 0
	[0070.486] lstrlenA (lpString="*.cer") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.p12") returned 0
	[0070.486] lstrlenA (lpString="*.p12") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.pfx") returned 0
	[0070.486] lstrlenA (lpString="*.pfx") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.kwm") returned 0
	[0070.486] lstrlenA (lpString="*.kwm") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.pwm") returned 0
	[0070.486] lstrlenA (lpString="*.pwm") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.1cd") returned 0
	[0070.486] lstrlenA (lpString="*.1cd") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.md") returned 0
	[0070.486] lstrlenA (lpString="*.md") returned 4
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mdf") returned 0
	[0070.486] lstrlenA (lpString="*.mdf") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.dbf") returned 0
	[0070.486] lstrlenA (lpString="*.dbf") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.odt") returned 0
	[0070.486] lstrlenA (lpString="*.odt") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.vob") returned 0
	[0070.486] lstrlenA (lpString="*.vob") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.ifo") returned 0
	[0070.486] lstrlenA (lpString="*.ifo") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.lnk") returned 0
	[0070.486] lstrlenA (lpString="*.lnk") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.torrent") returned 0
	[0070.486] lstrlenA (lpString="*.torrent") returned 9
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mov") returned 0
	[0070.486] lstrlenA (lpString="*.mov") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.m2v") returned 0
	[0070.486] lstrlenA (lpString="*.m2v") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.3gp") returned 0
	[0070.486] lstrlenA (lpString="*.3gp") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mpeg") returned 0
	[0070.486] lstrlenA (lpString="*.mpeg") returned 6
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mpg") returned 0
	[0070.486] lstrlenA (lpString="*.mpg") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.flv") returned 0
	[0070.486] lstrlenA (lpString="*.flv") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.avi") returned 0
	[0070.486] lstrlenA (lpString="*.avi") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mp4") returned 0
	[0070.486] lstrlenA (lpString="*.mp4") returned 5
	[0070.486] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.wmv") returned 0
	[0070.487] lstrlenA (lpString="*.wmv") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.divx") returned 0
	[0070.487] lstrlenA (lpString="*.divx") returned 6
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mkv") returned 0
	[0070.487] lstrlenA (lpString="*.mkv") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.mp3") returned 0
	[0070.487] lstrlenA (lpString="*.mp3") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.wav") returned 0
	[0070.487] lstrlenA (lpString="*.wav") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.flac") returned 0
	[0070.487] lstrlenA (lpString="*.flac") returned 6
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.ape") returned 0
	[0070.487] lstrlenA (lpString="*.ape") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.wma") returned 0
	[0070.487] lstrlenA (lpString="*.wma") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.ac3") returned 0
	[0070.487] lstrlenA (lpString="*.ac3") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.exe") returned 0
	[0070.487] lstrlenA (lpString="*.exe") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", pszSpec="*.apk") returned 0
	[0070.487] lstrlenA (lpString="*.apk") returned 5
	[0070.487] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.487] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.487] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB.TLB") returned -1
	[0070.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.TLB") returned -1
	[0070.487] lstrcmpiA (lpString1="", lpString2="MSPUB.TLB") returned -1
	[0070.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned="mspub.exe.manifest"
	[0070.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPUB.TLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB"
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.zip") returned 0
	[0070.487] lstrlenA (lpString="*.zip") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.rar") returned 0
	[0070.487] lstrlenA (lpString="*.rar") returned 5
	[0070.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.7z") returned 0
	[0070.488] lstrlenA (lpString="*.7z") returned 4
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.tar") returned 0
	[0070.488] lstrlenA (lpString="*.tar") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.gzip") returned 0
	[0070.488] lstrlenA (lpString="*.gzip") returned 6
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.jpg") returned 0
	[0070.488] lstrlenA (lpString="*.jpg") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.jpeg") returned 0
	[0070.488] lstrlenA (lpString="*.jpeg") returned 6
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.psd") returned 0
	[0070.488] lstrlenA (lpString="*.psd") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.cdr") returned 0
	[0070.488] lstrlenA (lpString="*.cdr") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.dwg") returned 0
	[0070.488] lstrlenA (lpString="*.dwg") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.max") returned 0
	[0070.488] lstrlenA (lpString="*.max") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.bmp") returned 0
	[0070.488] lstrlenA (lpString="*.bmp") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.gif") returned 0
	[0070.488] lstrlenA (lpString="*.gif") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.png") returned 0
	[0070.488] lstrlenA (lpString="*.png") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.doc") returned 0
	[0070.488] lstrlenA (lpString="*.doc") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.docx") returned 0
	[0070.488] lstrlenA (lpString="*.docx") returned 6
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.xls") returned 0
	[0070.488] lstrlenA (lpString="*.xls") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.xlsx") returned 0
	[0070.488] lstrlenA (lpString="*.xlsx") returned 6
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.ppt") returned 0
	[0070.488] lstrlenA (lpString="*.ppt") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.pptx") returned 0
	[0070.488] lstrlenA (lpString="*.pptx") returned 6
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.txt") returned 0
	[0070.488] lstrlenA (lpString="*.txt") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.pdf") returned 0
	[0070.488] lstrlenA (lpString="*.pdf") returned 5
	[0070.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.djvu") returned 0
	[0070.488] lstrlenA (lpString="*.djvu") returned 6
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.htm") returned 0
	[0070.489] lstrlenA (lpString="*.htm") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.html") returned 0
	[0070.489] lstrlenA (lpString="*.html") returned 6
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mdb") returned 0
	[0070.489] lstrlenA (lpString="*.mdb") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.cer") returned 0
	[0070.489] lstrlenA (lpString="*.cer") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.p12") returned 0
	[0070.489] lstrlenA (lpString="*.p12") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.pfx") returned 0
	[0070.489] lstrlenA (lpString="*.pfx") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.kwm") returned 0
	[0070.489] lstrlenA (lpString="*.kwm") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.pwm") returned 0
	[0070.489] lstrlenA (lpString="*.pwm") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.1cd") returned 0
	[0070.489] lstrlenA (lpString="*.1cd") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.md") returned 0
	[0070.489] lstrlenA (lpString="*.md") returned 4
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mdf") returned 0
	[0070.489] lstrlenA (lpString="*.mdf") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.dbf") returned 0
	[0070.489] lstrlenA (lpString="*.dbf") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.odt") returned 0
	[0070.489] lstrlenA (lpString="*.odt") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.vob") returned 0
	[0070.489] lstrlenA (lpString="*.vob") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.ifo") returned 0
	[0070.489] lstrlenA (lpString="*.ifo") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.lnk") returned 0
	[0070.489] lstrlenA (lpString="*.lnk") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.torrent") returned 0
	[0070.489] lstrlenA (lpString="*.torrent") returned 9
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mov") returned 0
	[0070.489] lstrlenA (lpString="*.mov") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.m2v") returned 0
	[0070.489] lstrlenA (lpString="*.m2v") returned 5
	[0070.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.3gp") returned 0
	[0070.489] lstrlenA (lpString="*.3gp") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mpeg") returned 0
	[0070.490] lstrlenA (lpString="*.mpeg") returned 6
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mpg") returned 0
	[0070.490] lstrlenA (lpString="*.mpg") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.flv") returned 0
	[0070.490] lstrlenA (lpString="*.flv") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.avi") returned 0
	[0070.490] lstrlenA (lpString="*.avi") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mp4") returned 0
	[0070.490] lstrlenA (lpString="*.mp4") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.wmv") returned 0
	[0070.490] lstrlenA (lpString="*.wmv") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.divx") returned 0
	[0070.490] lstrlenA (lpString="*.divx") returned 6
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mkv") returned 0
	[0070.490] lstrlenA (lpString="*.mkv") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.mp3") returned 0
	[0070.490] lstrlenA (lpString="*.mp3") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.wav") returned 0
	[0070.490] lstrlenA (lpString="*.wav") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.flac") returned 0
	[0070.490] lstrlenA (lpString="*.flac") returned 6
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.ape") returned 0
	[0070.490] lstrlenA (lpString="*.ape") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.wma") returned 0
	[0070.490] lstrlenA (lpString="*.wma") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.ac3") returned 0
	[0070.490] lstrlenA (lpString="*.ac3") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.exe") returned 0
	[0070.490] lstrlenA (lpString="*.exe") returned 5
	[0070.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", pszSpec="*.apk") returned 0
	[0070.490] lstrlenA (lpString="*.apk") returned 5
	[0070.490] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.490] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.490] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSQRY32.EXE") returned -1
	[0070.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSQRY32.EXE") returned -1
	[0070.490] lstrcmpiA (lpString1="", lpString2="MSQRY32.EXE") returned -1
	[0070.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned="MSPUB.TLB"
	[0070.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.490] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSQRY32.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE"
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.zip") returned 0
	[0070.491] lstrlenA (lpString="*.zip") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.rar") returned 0
	[0070.491] lstrlenA (lpString="*.rar") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.7z") returned 0
	[0070.491] lstrlenA (lpString="*.7z") returned 4
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.tar") returned 0
	[0070.491] lstrlenA (lpString="*.tar") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.gzip") returned 0
	[0070.491] lstrlenA (lpString="*.gzip") returned 6
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.jpg") returned 0
	[0070.491] lstrlenA (lpString="*.jpg") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.jpeg") returned 0
	[0070.491] lstrlenA (lpString="*.jpeg") returned 6
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.psd") returned 0
	[0070.491] lstrlenA (lpString="*.psd") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.cdr") returned 0
	[0070.491] lstrlenA (lpString="*.cdr") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.dwg") returned 0
	[0070.491] lstrlenA (lpString="*.dwg") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.max") returned 0
	[0070.491] lstrlenA (lpString="*.max") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.bmp") returned 0
	[0070.491] lstrlenA (lpString="*.bmp") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.gif") returned 0
	[0070.491] lstrlenA (lpString="*.gif") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.png") returned 0
	[0070.491] lstrlenA (lpString="*.png") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.doc") returned 0
	[0070.491] lstrlenA (lpString="*.doc") returned 5
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.docx") returned 0
	[0070.491] lstrlenA (lpString="*.docx") returned 6
	[0070.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.xls") returned 0
	[0070.491] lstrlenA (lpString="*.xls") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.xlsx") returned 0
	[0070.492] lstrlenA (lpString="*.xlsx") returned 6
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.ppt") returned 0
	[0070.492] lstrlenA (lpString="*.ppt") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.pptx") returned 0
	[0070.492] lstrlenA (lpString="*.pptx") returned 6
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.txt") returned 0
	[0070.492] lstrlenA (lpString="*.txt") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.pdf") returned 0
	[0070.492] lstrlenA (lpString="*.pdf") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.djvu") returned 0
	[0070.492] lstrlenA (lpString="*.djvu") returned 6
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.htm") returned 0
	[0070.492] lstrlenA (lpString="*.htm") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.html") returned 0
	[0070.492] lstrlenA (lpString="*.html") returned 6
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mdb") returned 0
	[0070.492] lstrlenA (lpString="*.mdb") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.cer") returned 0
	[0070.492] lstrlenA (lpString="*.cer") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.p12") returned 0
	[0070.492] lstrlenA (lpString="*.p12") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.pfx") returned 0
	[0070.492] lstrlenA (lpString="*.pfx") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.kwm") returned 0
	[0070.492] lstrlenA (lpString="*.kwm") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.pwm") returned 0
	[0070.492] lstrlenA (lpString="*.pwm") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.1cd") returned 0
	[0070.492] lstrlenA (lpString="*.1cd") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.md") returned 0
	[0070.492] lstrlenA (lpString="*.md") returned 4
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mdf") returned 0
	[0070.492] lstrlenA (lpString="*.mdf") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.dbf") returned 0
	[0070.492] lstrlenA (lpString="*.dbf") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.odt") returned 0
	[0070.492] lstrlenA (lpString="*.odt") returned 5
	[0070.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.vob") returned 0
	[0070.492] lstrlenA (lpString="*.vob") returned 5
	[0070.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.ifo") returned 0
	[0070.493] lstrlenA (lpString="*.ifo") returned 5
	[0070.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.lnk") returned 0
	[0070.493] lstrlenA (lpString="*.lnk") returned 5
	[0070.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.torrent") returned 0
	[0070.493] lstrlenA (lpString="*.torrent") returned 9
	[0070.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mov") returned 0
	[0070.493] lstrlenA (lpString="*.mov") returned 5
	[0070.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.m2v") returned 0
	[0070.516] lstrlenA (lpString="*.m2v") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.3gp") returned 0
	[0070.516] lstrlenA (lpString="*.3gp") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mpeg") returned 0
	[0070.516] lstrlenA (lpString="*.mpeg") returned 6
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mpg") returned 0
	[0070.516] lstrlenA (lpString="*.mpg") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.flv") returned 0
	[0070.516] lstrlenA (lpString="*.flv") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.avi") returned 0
	[0070.516] lstrlenA (lpString="*.avi") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mp4") returned 0
	[0070.516] lstrlenA (lpString="*.mp4") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.wmv") returned 0
	[0070.516] lstrlenA (lpString="*.wmv") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.divx") returned 0
	[0070.516] lstrlenA (lpString="*.divx") returned 6
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mkv") returned 0
	[0070.516] lstrlenA (lpString="*.mkv") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.mp3") returned 0
	[0070.516] lstrlenA (lpString="*.mp3") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.wav") returned 0
	[0070.516] lstrlenA (lpString="*.wav") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.flac") returned 0
	[0070.516] lstrlenA (lpString="*.flac") returned 6
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.ape") returned 0
	[0070.516] lstrlenA (lpString="*.ape") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.wma") returned 0
	[0070.516] lstrlenA (lpString="*.wma") returned 5
	[0070.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.ac3") returned 0
	[0070.516] lstrlenA (lpString="*.ac3") returned 5
	[0070.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", pszSpec="*.exe") returned 1
	[0070.517] lstrlenA (lpString="*.exe") returned 5
	[0070.517] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE"
	[0070.517] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE"
	[0070.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE."
	[0070.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.Boom"
	[0070.517] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.520] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1160
	[0070.520] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x32ad2d00, dwHighDateTime=0x1cab7c9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5943a0f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x32ad2d00, dwHighDateTime=0x1cab7c9)) returned 1
	[0070.521] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.521] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xd113d, lpOverlapped=0x0) returned 1
	[0070.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="MSQRY32.EXE"
	[0070.546] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.546] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xd113d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xd113d, lpOverlapped=0x0) returned 1
	[0070.548] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.549] CloseHandle (hObject=0x88) returned 1
	[0070.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe.boom")) returned 1
	[0070.550] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.550] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.550] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSRTEDIT.DLL") returned -1
	[0070.550] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSRTEDIT.DLL") returned -1
	[0070.550] lstrcmpiA (lpString1="", lpString2="MSRTEDIT.DLL") returned -1
	[0070.550] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="MSQRY32.EXE"
	[0070.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSRTEDIT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL"
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.zip") returned 0
	[0070.550] lstrlenA (lpString="*.zip") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.rar") returned 0
	[0070.550] lstrlenA (lpString="*.rar") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.7z") returned 0
	[0070.550] lstrlenA (lpString="*.7z") returned 4
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.tar") returned 0
	[0070.550] lstrlenA (lpString="*.tar") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.gzip") returned 0
	[0070.550] lstrlenA (lpString="*.gzip") returned 6
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.jpg") returned 0
	[0070.550] lstrlenA (lpString="*.jpg") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.jpeg") returned 0
	[0070.550] lstrlenA (lpString="*.jpeg") returned 6
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.psd") returned 0
	[0070.550] lstrlenA (lpString="*.psd") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.cdr") returned 0
	[0070.550] lstrlenA (lpString="*.cdr") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.dwg") returned 0
	[0070.550] lstrlenA (lpString="*.dwg") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.max") returned 0
	[0070.550] lstrlenA (lpString="*.max") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.bmp") returned 0
	[0070.550] lstrlenA (lpString="*.bmp") returned 5
	[0070.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.gif") returned 0
	[0070.551] lstrlenA (lpString="*.gif") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.png") returned 0
	[0070.551] lstrlenA (lpString="*.png") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.doc") returned 0
	[0070.551] lstrlenA (lpString="*.doc") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.docx") returned 0
	[0070.551] lstrlenA (lpString="*.docx") returned 6
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.xls") returned 0
	[0070.551] lstrlenA (lpString="*.xls") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.xlsx") returned 0
	[0070.551] lstrlenA (lpString="*.xlsx") returned 6
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.ppt") returned 0
	[0070.551] lstrlenA (lpString="*.ppt") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.pptx") returned 0
	[0070.551] lstrlenA (lpString="*.pptx") returned 6
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.txt") returned 0
	[0070.551] lstrlenA (lpString="*.txt") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.pdf") returned 0
	[0070.551] lstrlenA (lpString="*.pdf") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.djvu") returned 0
	[0070.551] lstrlenA (lpString="*.djvu") returned 6
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.htm") returned 0
	[0070.551] lstrlenA (lpString="*.htm") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.html") returned 0
	[0070.551] lstrlenA (lpString="*.html") returned 6
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mdb") returned 0
	[0070.551] lstrlenA (lpString="*.mdb") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.cer") returned 0
	[0070.551] lstrlenA (lpString="*.cer") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.p12") returned 0
	[0070.551] lstrlenA (lpString="*.p12") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.pfx") returned 0
	[0070.551] lstrlenA (lpString="*.pfx") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.kwm") returned 0
	[0070.551] lstrlenA (lpString="*.kwm") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.pwm") returned 0
	[0070.551] lstrlenA (lpString="*.pwm") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.1cd") returned 0
	[0070.551] lstrlenA (lpString="*.1cd") returned 5
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.md") returned 0
	[0070.551] lstrlenA (lpString="*.md") returned 4
	[0070.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mdf") returned 0
	[0070.551] lstrlenA (lpString="*.mdf") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.dbf") returned 0
	[0070.552] lstrlenA (lpString="*.dbf") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.odt") returned 0
	[0070.552] lstrlenA (lpString="*.odt") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.vob") returned 0
	[0070.552] lstrlenA (lpString="*.vob") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.ifo") returned 0
	[0070.552] lstrlenA (lpString="*.ifo") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.lnk") returned 0
	[0070.552] lstrlenA (lpString="*.lnk") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.torrent") returned 0
	[0070.552] lstrlenA (lpString="*.torrent") returned 9
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mov") returned 0
	[0070.552] lstrlenA (lpString="*.mov") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.m2v") returned 0
	[0070.552] lstrlenA (lpString="*.m2v") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.3gp") returned 0
	[0070.552] lstrlenA (lpString="*.3gp") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mpeg") returned 0
	[0070.552] lstrlenA (lpString="*.mpeg") returned 6
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mpg") returned 0
	[0070.552] lstrlenA (lpString="*.mpg") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.flv") returned 0
	[0070.552] lstrlenA (lpString="*.flv") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.avi") returned 0
	[0070.552] lstrlenA (lpString="*.avi") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mp4") returned 0
	[0070.552] lstrlenA (lpString="*.mp4") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.wmv") returned 0
	[0070.552] lstrlenA (lpString="*.wmv") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.divx") returned 0
	[0070.552] lstrlenA (lpString="*.divx") returned 6
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mkv") returned 0
	[0070.552] lstrlenA (lpString="*.mkv") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.mp3") returned 0
	[0070.552] lstrlenA (lpString="*.mp3") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.wav") returned 0
	[0070.552] lstrlenA (lpString="*.wav") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.flac") returned 0
	[0070.552] lstrlenA (lpString="*.flac") returned 6
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.ape") returned 0
	[0070.552] lstrlenA (lpString="*.ape") returned 5
	[0070.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.wma") returned 0
	[0070.553] lstrlenA (lpString="*.wma") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.ac3") returned 0
	[0070.553] lstrlenA (lpString="*.ac3") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.exe") returned 0
	[0070.553] lstrlenA (lpString="*.exe") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", pszSpec="*.apk") returned 0
	[0070.553] lstrlenA (lpString="*.apk") returned 5
	[0070.553] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.553] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.553] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTORDB.EXE") returned -1
	[0070.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORDB.EXE") returned -1
	[0070.553] lstrcmpiA (lpString1="", lpString2="MSTORDB.EXE") returned -1
	[0070.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned="MSRTEDIT.DLL"
	[0070.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSTORDB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE"
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.zip") returned 0
	[0070.553] lstrlenA (lpString="*.zip") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.rar") returned 0
	[0070.553] lstrlenA (lpString="*.rar") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.7z") returned 0
	[0070.553] lstrlenA (lpString="*.7z") returned 4
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.tar") returned 0
	[0070.553] lstrlenA (lpString="*.tar") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.gzip") returned 0
	[0070.553] lstrlenA (lpString="*.gzip") returned 6
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.jpg") returned 0
	[0070.553] lstrlenA (lpString="*.jpg") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.jpeg") returned 0
	[0070.553] lstrlenA (lpString="*.jpeg") returned 6
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.psd") returned 0
	[0070.553] lstrlenA (lpString="*.psd") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.cdr") returned 0
	[0070.553] lstrlenA (lpString="*.cdr") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.dwg") returned 0
	[0070.553] lstrlenA (lpString="*.dwg") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.max") returned 0
	[0070.553] lstrlenA (lpString="*.max") returned 5
	[0070.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.bmp") returned 0
	[0070.554] lstrlenA (lpString="*.bmp") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.gif") returned 0
	[0070.554] lstrlenA (lpString="*.gif") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.png") returned 0
	[0070.554] lstrlenA (lpString="*.png") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.doc") returned 0
	[0070.554] lstrlenA (lpString="*.doc") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.docx") returned 0
	[0070.554] lstrlenA (lpString="*.docx") returned 6
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.xls") returned 0
	[0070.554] lstrlenA (lpString="*.xls") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.xlsx") returned 0
	[0070.554] lstrlenA (lpString="*.xlsx") returned 6
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.ppt") returned 0
	[0070.554] lstrlenA (lpString="*.ppt") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.pptx") returned 0
	[0070.554] lstrlenA (lpString="*.pptx") returned 6
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.txt") returned 0
	[0070.554] lstrlenA (lpString="*.txt") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.pdf") returned 0
	[0070.554] lstrlenA (lpString="*.pdf") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.djvu") returned 0
	[0070.554] lstrlenA (lpString="*.djvu") returned 6
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.htm") returned 0
	[0070.554] lstrlenA (lpString="*.htm") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.html") returned 0
	[0070.554] lstrlenA (lpString="*.html") returned 6
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mdb") returned 0
	[0070.554] lstrlenA (lpString="*.mdb") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.cer") returned 0
	[0070.554] lstrlenA (lpString="*.cer") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.p12") returned 0
	[0070.554] lstrlenA (lpString="*.p12") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.pfx") returned 0
	[0070.554] lstrlenA (lpString="*.pfx") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.kwm") returned 0
	[0070.554] lstrlenA (lpString="*.kwm") returned 5
	[0070.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.pwm") returned 0
	[0070.554] lstrlenA (lpString="*.pwm") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.1cd") returned 0
	[0070.555] lstrlenA (lpString="*.1cd") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.md") returned 0
	[0070.555] lstrlenA (lpString="*.md") returned 4
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mdf") returned 0
	[0070.555] lstrlenA (lpString="*.mdf") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.dbf") returned 0
	[0070.555] lstrlenA (lpString="*.dbf") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.odt") returned 0
	[0070.555] lstrlenA (lpString="*.odt") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.vob") returned 0
	[0070.555] lstrlenA (lpString="*.vob") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.ifo") returned 0
	[0070.555] lstrlenA (lpString="*.ifo") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.lnk") returned 0
	[0070.555] lstrlenA (lpString="*.lnk") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.torrent") returned 0
	[0070.555] lstrlenA (lpString="*.torrent") returned 9
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mov") returned 0
	[0070.555] lstrlenA (lpString="*.mov") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.m2v") returned 0
	[0070.555] lstrlenA (lpString="*.m2v") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.3gp") returned 0
	[0070.555] lstrlenA (lpString="*.3gp") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mpeg") returned 0
	[0070.555] lstrlenA (lpString="*.mpeg") returned 6
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mpg") returned 0
	[0070.555] lstrlenA (lpString="*.mpg") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.flv") returned 0
	[0070.555] lstrlenA (lpString="*.flv") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.avi") returned 0
	[0070.555] lstrlenA (lpString="*.avi") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mp4") returned 0
	[0070.555] lstrlenA (lpString="*.mp4") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.wmv") returned 0
	[0070.555] lstrlenA (lpString="*.wmv") returned 5
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.divx") returned 0
	[0070.555] lstrlenA (lpString="*.divx") returned 6
	[0070.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mkv") returned 0
	[0070.555] lstrlenA (lpString="*.mkv") returned 5
	[0070.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.mp3") returned 0
	[0070.556] lstrlenA (lpString="*.mp3") returned 5
	[0070.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.wav") returned 0
	[0070.556] lstrlenA (lpString="*.wav") returned 5
	[0070.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.flac") returned 0
	[0070.556] lstrlenA (lpString="*.flac") returned 6
	[0070.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.ape") returned 0
	[0070.556] lstrlenA (lpString="*.ape") returned 5
	[0070.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.wma") returned 0
	[0070.556] lstrlenA (lpString="*.wma") returned 5
	[0070.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.ac3") returned 0
	[0070.556] lstrlenA (lpString="*.ac3") returned 5
	[0070.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", pszSpec="*.exe") returned 1
	[0070.556] lstrlenA (lpString="*.exe") returned 5
	[0070.556] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE"
	[0070.556] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE"
	[0070.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE."
	[0070.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.Boom"
	[0070.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.557] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff368
	[0070.557] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x40dec00, dwHighDateTime=0x1cb7010), lpLastAccessTime=0x407536*(dwLowDateTime=0xcf055920, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x40dec00, dwHighDateTime=0x1cb7010)) returned 1
	[0070.557] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.557] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0xff345, lpOverlapped=0x0) returned 1
	[0070.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="MSTORDB.EXE"
	[0070.585] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.585] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0xff345, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0xff345, lpOverlapped=0x0) returned 1
	[0070.588] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.588] CloseHandle (hObject=0x88) returned 1
	[0070.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe.boom")) returned 1
	[0070.589] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.589] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.589] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTORE.EXE") returned -1
	[0070.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE.EXE") returned -1
	[0070.589] lstrcmpiA (lpString1="", lpString2="MSTORE.EXE") returned -1
	[0070.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="MSTORDB.EXE"
	[0070.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSTORE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE"
	[0070.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.zip") returned 0
	[0070.589] lstrlenA (lpString="*.zip") returned 5
	[0070.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.rar") returned 0
	[0070.589] lstrlenA (lpString="*.rar") returned 5
	[0070.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.7z") returned 0
	[0070.590] lstrlenA (lpString="*.7z") returned 4
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.tar") returned 0
	[0070.590] lstrlenA (lpString="*.tar") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.gzip") returned 0
	[0070.590] lstrlenA (lpString="*.gzip") returned 6
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.jpg") returned 0
	[0070.590] lstrlenA (lpString="*.jpg") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.jpeg") returned 0
	[0070.590] lstrlenA (lpString="*.jpeg") returned 6
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.psd") returned 0
	[0070.590] lstrlenA (lpString="*.psd") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.cdr") returned 0
	[0070.590] lstrlenA (lpString="*.cdr") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.dwg") returned 0
	[0070.590] lstrlenA (lpString="*.dwg") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.max") returned 0
	[0070.590] lstrlenA (lpString="*.max") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.bmp") returned 0
	[0070.590] lstrlenA (lpString="*.bmp") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.gif") returned 0
	[0070.590] lstrlenA (lpString="*.gif") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.png") returned 0
	[0070.590] lstrlenA (lpString="*.png") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.doc") returned 0
	[0070.590] lstrlenA (lpString="*.doc") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.docx") returned 0
	[0070.590] lstrlenA (lpString="*.docx") returned 6
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.xls") returned 0
	[0070.590] lstrlenA (lpString="*.xls") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.xlsx") returned 0
	[0070.590] lstrlenA (lpString="*.xlsx") returned 6
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.ppt") returned 0
	[0070.590] lstrlenA (lpString="*.ppt") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.pptx") returned 0
	[0070.590] lstrlenA (lpString="*.pptx") returned 6
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.txt") returned 0
	[0070.590] lstrlenA (lpString="*.txt") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.pdf") returned 0
	[0070.590] lstrlenA (lpString="*.pdf") returned 5
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.djvu") returned 0
	[0070.590] lstrlenA (lpString="*.djvu") returned 6
	[0070.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.htm") returned 0
	[0070.590] lstrlenA (lpString="*.htm") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.html") returned 0
	[0070.591] lstrlenA (lpString="*.html") returned 6
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mdb") returned 0
	[0070.591] lstrlenA (lpString="*.mdb") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.cer") returned 0
	[0070.591] lstrlenA (lpString="*.cer") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.p12") returned 0
	[0070.591] lstrlenA (lpString="*.p12") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.pfx") returned 0
	[0070.591] lstrlenA (lpString="*.pfx") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.kwm") returned 0
	[0070.591] lstrlenA (lpString="*.kwm") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.pwm") returned 0
	[0070.591] lstrlenA (lpString="*.pwm") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.1cd") returned 0
	[0070.591] lstrlenA (lpString="*.1cd") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.md") returned 0
	[0070.591] lstrlenA (lpString="*.md") returned 4
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mdf") returned 0
	[0070.591] lstrlenA (lpString="*.mdf") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.dbf") returned 0
	[0070.591] lstrlenA (lpString="*.dbf") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.odt") returned 0
	[0070.591] lstrlenA (lpString="*.odt") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.vob") returned 0
	[0070.591] lstrlenA (lpString="*.vob") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.ifo") returned 0
	[0070.591] lstrlenA (lpString="*.ifo") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.lnk") returned 0
	[0070.591] lstrlenA (lpString="*.lnk") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.torrent") returned 0
	[0070.591] lstrlenA (lpString="*.torrent") returned 9
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mov") returned 0
	[0070.591] lstrlenA (lpString="*.mov") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.m2v") returned 0
	[0070.591] lstrlenA (lpString="*.m2v") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.3gp") returned 0
	[0070.591] lstrlenA (lpString="*.3gp") returned 5
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mpeg") returned 0
	[0070.591] lstrlenA (lpString="*.mpeg") returned 6
	[0070.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mpg") returned 0
	[0070.592] lstrlenA (lpString="*.mpg") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.flv") returned 0
	[0070.592] lstrlenA (lpString="*.flv") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.avi") returned 0
	[0070.592] lstrlenA (lpString="*.avi") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mp4") returned 0
	[0070.592] lstrlenA (lpString="*.mp4") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.wmv") returned 0
	[0070.592] lstrlenA (lpString="*.wmv") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.divx") returned 0
	[0070.592] lstrlenA (lpString="*.divx") returned 6
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mkv") returned 0
	[0070.592] lstrlenA (lpString="*.mkv") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.mp3") returned 0
	[0070.592] lstrlenA (lpString="*.mp3") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.wav") returned 0
	[0070.592] lstrlenA (lpString="*.wav") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.flac") returned 0
	[0070.592] lstrlenA (lpString="*.flac") returned 6
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.ape") returned 0
	[0070.592] lstrlenA (lpString="*.ape") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.wma") returned 0
	[0070.592] lstrlenA (lpString="*.wma") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.ac3") returned 0
	[0070.592] lstrlenA (lpString="*.ac3") returned 5
	[0070.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", pszSpec="*.exe") returned 1
	[0070.592] lstrlenA (lpString="*.exe") returned 5
	[0070.592] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE"
	[0070.592] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE"
	[0070.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE."
	[0070.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.Boom"
	[0070.592] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.593] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20158
	[0070.593] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe7931a00, dwHighDateTime=0x1cab7c8), lpLastAccessTime=0x407536*(dwLowDateTime=0x59460250, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe7931a00, dwHighDateTime=0x1cab7c8)) returned 1
	[0070.593] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.593] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x20135, lpOverlapped=0x0) returned 1
	[0070.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="MSTORE.EXE"
	[0070.619] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.619] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x20135, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x20135, lpOverlapped=0x0) returned 1
	[0070.620] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.620] CloseHandle (hObject=0x88) returned 1
	[0070.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe.boom")) returned 1
	[0070.621] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.621] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.621] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTORES.DLL") returned -1
	[0070.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORES.DLL") returned -1
	[0070.621] lstrcmpiA (lpString1="", lpString2="MSTORES.DLL") returned -1
	[0070.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="MSTORE.EXE"
	[0070.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSTORES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL"
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.zip") returned 0
	[0070.621] lstrlenA (lpString="*.zip") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.rar") returned 0
	[0070.621] lstrlenA (lpString="*.rar") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.7z") returned 0
	[0070.621] lstrlenA (lpString="*.7z") returned 4
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.tar") returned 0
	[0070.621] lstrlenA (lpString="*.tar") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.gzip") returned 0
	[0070.621] lstrlenA (lpString="*.gzip") returned 6
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.jpg") returned 0
	[0070.621] lstrlenA (lpString="*.jpg") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.jpeg") returned 0
	[0070.621] lstrlenA (lpString="*.jpeg") returned 6
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.psd") returned 0
	[0070.621] lstrlenA (lpString="*.psd") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.cdr") returned 0
	[0070.621] lstrlenA (lpString="*.cdr") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.dwg") returned 0
	[0070.621] lstrlenA (lpString="*.dwg") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.max") returned 0
	[0070.621] lstrlenA (lpString="*.max") returned 5
	[0070.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.bmp") returned 0
	[0070.621] lstrlenA (lpString="*.bmp") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.gif") returned 0
	[0070.622] lstrlenA (lpString="*.gif") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.png") returned 0
	[0070.622] lstrlenA (lpString="*.png") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.doc") returned 0
	[0070.622] lstrlenA (lpString="*.doc") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.docx") returned 0
	[0070.622] lstrlenA (lpString="*.docx") returned 6
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.xls") returned 0
	[0070.622] lstrlenA (lpString="*.xls") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.xlsx") returned 0
	[0070.622] lstrlenA (lpString="*.xlsx") returned 6
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.ppt") returned 0
	[0070.622] lstrlenA (lpString="*.ppt") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.pptx") returned 0
	[0070.622] lstrlenA (lpString="*.pptx") returned 6
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.txt") returned 0
	[0070.622] lstrlenA (lpString="*.txt") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.pdf") returned 0
	[0070.622] lstrlenA (lpString="*.pdf") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.djvu") returned 0
	[0070.622] lstrlenA (lpString="*.djvu") returned 6
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.htm") returned 0
	[0070.622] lstrlenA (lpString="*.htm") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.html") returned 0
	[0070.622] lstrlenA (lpString="*.html") returned 6
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mdb") returned 0
	[0070.622] lstrlenA (lpString="*.mdb") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.cer") returned 0
	[0070.622] lstrlenA (lpString="*.cer") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.p12") returned 0
	[0070.622] lstrlenA (lpString="*.p12") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.pfx") returned 0
	[0070.622] lstrlenA (lpString="*.pfx") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.kwm") returned 0
	[0070.622] lstrlenA (lpString="*.kwm") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.pwm") returned 0
	[0070.622] lstrlenA (lpString="*.pwm") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.1cd") returned 0
	[0070.622] lstrlenA (lpString="*.1cd") returned 5
	[0070.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.md") returned 0
	[0070.622] lstrlenA (lpString="*.md") returned 4
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mdf") returned 0
	[0070.623] lstrlenA (lpString="*.mdf") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.dbf") returned 0
	[0070.623] lstrlenA (lpString="*.dbf") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.odt") returned 0
	[0070.623] lstrlenA (lpString="*.odt") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.vob") returned 0
	[0070.623] lstrlenA (lpString="*.vob") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.ifo") returned 0
	[0070.623] lstrlenA (lpString="*.ifo") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.lnk") returned 0
	[0070.623] lstrlenA (lpString="*.lnk") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.torrent") returned 0
	[0070.623] lstrlenA (lpString="*.torrent") returned 9
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mov") returned 0
	[0070.623] lstrlenA (lpString="*.mov") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.m2v") returned 0
	[0070.623] lstrlenA (lpString="*.m2v") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.3gp") returned 0
	[0070.623] lstrlenA (lpString="*.3gp") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mpeg") returned 0
	[0070.623] lstrlenA (lpString="*.mpeg") returned 6
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mpg") returned 0
	[0070.623] lstrlenA (lpString="*.mpg") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.flv") returned 0
	[0070.623] lstrlenA (lpString="*.flv") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.avi") returned 0
	[0070.623] lstrlenA (lpString="*.avi") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mp4") returned 0
	[0070.623] lstrlenA (lpString="*.mp4") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.wmv") returned 0
	[0070.623] lstrlenA (lpString="*.wmv") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.divx") returned 0
	[0070.623] lstrlenA (lpString="*.divx") returned 6
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mkv") returned 0
	[0070.623] lstrlenA (lpString="*.mkv") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.mp3") returned 0
	[0070.623] lstrlenA (lpString="*.mp3") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.wav") returned 0
	[0070.623] lstrlenA (lpString="*.wav") returned 5
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.flac") returned 0
	[0070.623] lstrlenA (lpString="*.flac") returned 6
	[0070.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.ape") returned 0
	[0070.624] lstrlenA (lpString="*.ape") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.wma") returned 0
	[0070.624] lstrlenA (lpString="*.wma") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.ac3") returned 0
	[0070.624] lstrlenA (lpString="*.ac3") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.exe") returned 0
	[0070.624] lstrlenA (lpString="*.exe") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", pszSpec="*.apk") returned 0
	[0070.624] lstrlenA (lpString="*.apk") returned 5
	[0070.624] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.624] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.624] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSWORD.OLB") returned -1
	[0070.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSWORD.OLB") returned -1
	[0070.624] lstrcmpiA (lpString1="", lpString2="MSWORD.OLB") returned -1
	[0070.624] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned="MSTORES.DLL"
	[0070.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSWORD.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB"
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.zip") returned 0
	[0070.624] lstrlenA (lpString="*.zip") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.rar") returned 0
	[0070.624] lstrlenA (lpString="*.rar") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.7z") returned 0
	[0070.624] lstrlenA (lpString="*.7z") returned 4
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.tar") returned 0
	[0070.624] lstrlenA (lpString="*.tar") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.gzip") returned 0
	[0070.624] lstrlenA (lpString="*.gzip") returned 6
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.jpg") returned 0
	[0070.624] lstrlenA (lpString="*.jpg") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.jpeg") returned 0
	[0070.624] lstrlenA (lpString="*.jpeg") returned 6
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.psd") returned 0
	[0070.624] lstrlenA (lpString="*.psd") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.cdr") returned 0
	[0070.624] lstrlenA (lpString="*.cdr") returned 5
	[0070.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.dwg") returned 0
	[0070.624] lstrlenA (lpString="*.dwg") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.max") returned 0
	[0070.625] lstrlenA (lpString="*.max") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.bmp") returned 0
	[0070.625] lstrlenA (lpString="*.bmp") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.gif") returned 0
	[0070.625] lstrlenA (lpString="*.gif") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.png") returned 0
	[0070.625] lstrlenA (lpString="*.png") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.doc") returned 0
	[0070.625] lstrlenA (lpString="*.doc") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.docx") returned 0
	[0070.625] lstrlenA (lpString="*.docx") returned 6
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.xls") returned 0
	[0070.625] lstrlenA (lpString="*.xls") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.xlsx") returned 0
	[0070.625] lstrlenA (lpString="*.xlsx") returned 6
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.ppt") returned 0
	[0070.625] lstrlenA (lpString="*.ppt") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.pptx") returned 0
	[0070.625] lstrlenA (lpString="*.pptx") returned 6
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.txt") returned 0
	[0070.625] lstrlenA (lpString="*.txt") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.pdf") returned 0
	[0070.625] lstrlenA (lpString="*.pdf") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.djvu") returned 0
	[0070.625] lstrlenA (lpString="*.djvu") returned 6
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.htm") returned 0
	[0070.625] lstrlenA (lpString="*.htm") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.html") returned 0
	[0070.625] lstrlenA (lpString="*.html") returned 6
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mdb") returned 0
	[0070.625] lstrlenA (lpString="*.mdb") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.cer") returned 0
	[0070.625] lstrlenA (lpString="*.cer") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.p12") returned 0
	[0070.625] lstrlenA (lpString="*.p12") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.pfx") returned 0
	[0070.625] lstrlenA (lpString="*.pfx") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.kwm") returned 0
	[0070.625] lstrlenA (lpString="*.kwm") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.pwm") returned 0
	[0070.625] lstrlenA (lpString="*.pwm") returned 5
	[0070.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.1cd") returned 0
	[0070.626] lstrlenA (lpString="*.1cd") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.md") returned 0
	[0070.626] lstrlenA (lpString="*.md") returned 4
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mdf") returned 0
	[0070.626] lstrlenA (lpString="*.mdf") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.dbf") returned 0
	[0070.626] lstrlenA (lpString="*.dbf") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.odt") returned 0
	[0070.626] lstrlenA (lpString="*.odt") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.vob") returned 0
	[0070.626] lstrlenA (lpString="*.vob") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.ifo") returned 0
	[0070.626] lstrlenA (lpString="*.ifo") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.lnk") returned 0
	[0070.626] lstrlenA (lpString="*.lnk") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.torrent") returned 0
	[0070.626] lstrlenA (lpString="*.torrent") returned 9
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mov") returned 0
	[0070.626] lstrlenA (lpString="*.mov") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.m2v") returned 0
	[0070.626] lstrlenA (lpString="*.m2v") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.3gp") returned 0
	[0070.626] lstrlenA (lpString="*.3gp") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mpeg") returned 0
	[0070.626] lstrlenA (lpString="*.mpeg") returned 6
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mpg") returned 0
	[0070.626] lstrlenA (lpString="*.mpg") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.flv") returned 0
	[0070.626] lstrlenA (lpString="*.flv") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.avi") returned 0
	[0070.626] lstrlenA (lpString="*.avi") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mp4") returned 0
	[0070.626] lstrlenA (lpString="*.mp4") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.wmv") returned 0
	[0070.626] lstrlenA (lpString="*.wmv") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.divx") returned 0
	[0070.626] lstrlenA (lpString="*.divx") returned 6
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mkv") returned 0
	[0070.626] lstrlenA (lpString="*.mkv") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.mp3") returned 0
	[0070.626] lstrlenA (lpString="*.mp3") returned 5
	[0070.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.wav") returned 0
	[0070.627] lstrlenA (lpString="*.wav") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.flac") returned 0
	[0070.627] lstrlenA (lpString="*.flac") returned 6
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.ape") returned 0
	[0070.627] lstrlenA (lpString="*.ape") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.wma") returned 0
	[0070.627] lstrlenA (lpString="*.wma") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.ac3") returned 0
	[0070.627] lstrlenA (lpString="*.ac3") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.exe") returned 0
	[0070.627] lstrlenA (lpString="*.exe") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", pszSpec="*.apk") returned 0
	[0070.627] lstrlenA (lpString="*.apk") returned 5
	[0070.627] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.627] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.627] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSYUBIN7.DLL") returned -1
	[0070.627] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSYUBIN7.DLL") returned -1
	[0070.627] lstrcmpiA (lpString1="", lpString2="MSYUBIN7.DLL") returned -1
	[0070.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned="MSWORD.OLB"
	[0070.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.627] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.627] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSYUBIN7.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL"
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.zip") returned 0
	[0070.627] lstrlenA (lpString="*.zip") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.rar") returned 0
	[0070.627] lstrlenA (lpString="*.rar") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.7z") returned 0
	[0070.627] lstrlenA (lpString="*.7z") returned 4
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.tar") returned 0
	[0070.627] lstrlenA (lpString="*.tar") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.gzip") returned 0
	[0070.627] lstrlenA (lpString="*.gzip") returned 6
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.jpg") returned 0
	[0070.627] lstrlenA (lpString="*.jpg") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.jpeg") returned 0
	[0070.627] lstrlenA (lpString="*.jpeg") returned 6
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.psd") returned 0
	[0070.627] lstrlenA (lpString="*.psd") returned 5
	[0070.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.cdr") returned 0
	[0070.628] lstrlenA (lpString="*.cdr") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.dwg") returned 0
	[0070.628] lstrlenA (lpString="*.dwg") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.max") returned 0
	[0070.628] lstrlenA (lpString="*.max") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.bmp") returned 0
	[0070.628] lstrlenA (lpString="*.bmp") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.gif") returned 0
	[0070.628] lstrlenA (lpString="*.gif") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.png") returned 0
	[0070.628] lstrlenA (lpString="*.png") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.doc") returned 0
	[0070.628] lstrlenA (lpString="*.doc") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.docx") returned 0
	[0070.628] lstrlenA (lpString="*.docx") returned 6
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.xls") returned 0
	[0070.628] lstrlenA (lpString="*.xls") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.xlsx") returned 0
	[0070.628] lstrlenA (lpString="*.xlsx") returned 6
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.ppt") returned 0
	[0070.628] lstrlenA (lpString="*.ppt") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.pptx") returned 0
	[0070.628] lstrlenA (lpString="*.pptx") returned 6
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.txt") returned 0
	[0070.628] lstrlenA (lpString="*.txt") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.pdf") returned 0
	[0070.628] lstrlenA (lpString="*.pdf") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.djvu") returned 0
	[0070.628] lstrlenA (lpString="*.djvu") returned 6
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.htm") returned 0
	[0070.628] lstrlenA (lpString="*.htm") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.html") returned 0
	[0070.628] lstrlenA (lpString="*.html") returned 6
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mdb") returned 0
	[0070.628] lstrlenA (lpString="*.mdb") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.cer") returned 0
	[0070.628] lstrlenA (lpString="*.cer") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.p12") returned 0
	[0070.628] lstrlenA (lpString="*.p12") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.pfx") returned 0
	[0070.628] lstrlenA (lpString="*.pfx") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.kwm") returned 0
	[0070.628] lstrlenA (lpString="*.kwm") returned 5
	[0070.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.pwm") returned 0
	[0070.629] lstrlenA (lpString="*.pwm") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.1cd") returned 0
	[0070.629] lstrlenA (lpString="*.1cd") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.md") returned 0
	[0070.629] lstrlenA (lpString="*.md") returned 4
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mdf") returned 0
	[0070.629] lstrlenA (lpString="*.mdf") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.dbf") returned 0
	[0070.629] lstrlenA (lpString="*.dbf") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.odt") returned 0
	[0070.629] lstrlenA (lpString="*.odt") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.vob") returned 0
	[0070.629] lstrlenA (lpString="*.vob") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.ifo") returned 0
	[0070.629] lstrlenA (lpString="*.ifo") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.lnk") returned 0
	[0070.629] lstrlenA (lpString="*.lnk") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.torrent") returned 0
	[0070.629] lstrlenA (lpString="*.torrent") returned 9
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mov") returned 0
	[0070.629] lstrlenA (lpString="*.mov") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.m2v") returned 0
	[0070.629] lstrlenA (lpString="*.m2v") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.3gp") returned 0
	[0070.629] lstrlenA (lpString="*.3gp") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mpeg") returned 0
	[0070.629] lstrlenA (lpString="*.mpeg") returned 6
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mpg") returned 0
	[0070.629] lstrlenA (lpString="*.mpg") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.flv") returned 0
	[0070.629] lstrlenA (lpString="*.flv") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.avi") returned 0
	[0070.629] lstrlenA (lpString="*.avi") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mp4") returned 0
	[0070.629] lstrlenA (lpString="*.mp4") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.wmv") returned 0
	[0070.629] lstrlenA (lpString="*.wmv") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.divx") returned 0
	[0070.629] lstrlenA (lpString="*.divx") returned 6
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mkv") returned 0
	[0070.629] lstrlenA (lpString="*.mkv") returned 5
	[0070.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.mp3") returned 0
	[0070.630] lstrlenA (lpString="*.mp3") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.wav") returned 0
	[0070.630] lstrlenA (lpString="*.wav") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.flac") returned 0
	[0070.630] lstrlenA (lpString="*.flac") returned 6
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.ape") returned 0
	[0070.630] lstrlenA (lpString="*.ape") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.wma") returned 0
	[0070.630] lstrlenA (lpString="*.wma") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.ac3") returned 0
	[0070.630] lstrlenA (lpString="*.ac3") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.exe") returned 0
	[0070.630] lstrlenA (lpString="*.exe") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", pszSpec="*.apk") returned 0
	[0070.630] lstrlenA (lpString="*.apk") returned 5
	[0070.630] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.630] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.630] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MYSL.ICO") returned -1
	[0070.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MYSL.ICO") returned -1
	[0070.630] lstrcmpiA (lpString1="", lpString2="MYSL.ICO") returned -1
	[0070.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned="MSYUBIN7.DLL"
	[0070.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MYSL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO"
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.zip") returned 0
	[0070.630] lstrlenA (lpString="*.zip") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.rar") returned 0
	[0070.630] lstrlenA (lpString="*.rar") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.7z") returned 0
	[0070.630] lstrlenA (lpString="*.7z") returned 4
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.tar") returned 0
	[0070.630] lstrlenA (lpString="*.tar") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.gzip") returned 0
	[0070.630] lstrlenA (lpString="*.gzip") returned 6
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.jpg") returned 0
	[0070.630] lstrlenA (lpString="*.jpg") returned 5
	[0070.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.jpeg") returned 0
	[0070.630] lstrlenA (lpString="*.jpeg") returned 6
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.psd") returned 0
	[0070.631] lstrlenA (lpString="*.psd") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.cdr") returned 0
	[0070.631] lstrlenA (lpString="*.cdr") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.dwg") returned 0
	[0070.631] lstrlenA (lpString="*.dwg") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.max") returned 0
	[0070.631] lstrlenA (lpString="*.max") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.bmp") returned 0
	[0070.631] lstrlenA (lpString="*.bmp") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.gif") returned 0
	[0070.631] lstrlenA (lpString="*.gif") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.png") returned 0
	[0070.631] lstrlenA (lpString="*.png") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.doc") returned 0
	[0070.631] lstrlenA (lpString="*.doc") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.docx") returned 0
	[0070.631] lstrlenA (lpString="*.docx") returned 6
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.xls") returned 0
	[0070.631] lstrlenA (lpString="*.xls") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.xlsx") returned 0
	[0070.631] lstrlenA (lpString="*.xlsx") returned 6
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.ppt") returned 0
	[0070.631] lstrlenA (lpString="*.ppt") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.pptx") returned 0
	[0070.631] lstrlenA (lpString="*.pptx") returned 6
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.txt") returned 0
	[0070.631] lstrlenA (lpString="*.txt") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.pdf") returned 0
	[0070.631] lstrlenA (lpString="*.pdf") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.djvu") returned 0
	[0070.631] lstrlenA (lpString="*.djvu") returned 6
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.htm") returned 0
	[0070.631] lstrlenA (lpString="*.htm") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.html") returned 0
	[0070.631] lstrlenA (lpString="*.html") returned 6
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mdb") returned 0
	[0070.631] lstrlenA (lpString="*.mdb") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.cer") returned 0
	[0070.631] lstrlenA (lpString="*.cer") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.p12") returned 0
	[0070.631] lstrlenA (lpString="*.p12") returned 5
	[0070.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.pfx") returned 0
	[0070.631] lstrlenA (lpString="*.pfx") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.kwm") returned 0
	[0070.632] lstrlenA (lpString="*.kwm") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.pwm") returned 0
	[0070.632] lstrlenA (lpString="*.pwm") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.1cd") returned 0
	[0070.632] lstrlenA (lpString="*.1cd") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.md") returned 0
	[0070.632] lstrlenA (lpString="*.md") returned 4
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mdf") returned 0
	[0070.632] lstrlenA (lpString="*.mdf") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.dbf") returned 0
	[0070.632] lstrlenA (lpString="*.dbf") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.odt") returned 0
	[0070.632] lstrlenA (lpString="*.odt") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.vob") returned 0
	[0070.632] lstrlenA (lpString="*.vob") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.ifo") returned 0
	[0070.632] lstrlenA (lpString="*.ifo") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.lnk") returned 0
	[0070.632] lstrlenA (lpString="*.lnk") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.torrent") returned 0
	[0070.632] lstrlenA (lpString="*.torrent") returned 9
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mov") returned 0
	[0070.632] lstrlenA (lpString="*.mov") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.m2v") returned 0
	[0070.632] lstrlenA (lpString="*.m2v") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.3gp") returned 0
	[0070.632] lstrlenA (lpString="*.3gp") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mpeg") returned 0
	[0070.632] lstrlenA (lpString="*.mpeg") returned 6
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mpg") returned 0
	[0070.632] lstrlenA (lpString="*.mpg") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.flv") returned 0
	[0070.632] lstrlenA (lpString="*.flv") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.avi") returned 0
	[0070.632] lstrlenA (lpString="*.avi") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mp4") returned 0
	[0070.632] lstrlenA (lpString="*.mp4") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.wmv") returned 0
	[0070.632] lstrlenA (lpString="*.wmv") returned 5
	[0070.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.divx") returned 0
	[0070.632] lstrlenA (lpString="*.divx") returned 6
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mkv") returned 0
	[0070.633] lstrlenA (lpString="*.mkv") returned 5
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.mp3") returned 0
	[0070.633] lstrlenA (lpString="*.mp3") returned 5
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.wav") returned 0
	[0070.633] lstrlenA (lpString="*.wav") returned 5
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.flac") returned 0
	[0070.633] lstrlenA (lpString="*.flac") returned 6
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.ape") returned 0
	[0070.633] lstrlenA (lpString="*.ape") returned 5
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.wma") returned 0
	[0070.633] lstrlenA (lpString="*.wma") returned 5
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.ac3") returned 0
	[0070.633] lstrlenA (lpString="*.ac3") returned 5
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.exe") returned 0
	[0070.633] lstrlenA (lpString="*.exe") returned 5
	[0070.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", pszSpec="*.apk") returned 0
	[0070.633] lstrlenA (lpString="*.apk") returned 5
	[0070.633] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.633] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.633] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NAME.DLL") returned -1
	[0070.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAME.DLL") returned -1
	[0070.633] lstrcmpiA (lpString1="", lpString2="NAME.DLL") returned -1
	[0070.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned="MYSL.ICO"
	[0070.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAME.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL"
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.zip") returned 0
	[0070.634] lstrlenA (lpString="*.zip") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.rar") returned 0
	[0070.634] lstrlenA (lpString="*.rar") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.7z") returned 0
	[0070.634] lstrlenA (lpString="*.7z") returned 4
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.tar") returned 0
	[0070.634] lstrlenA (lpString="*.tar") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.gzip") returned 0
	[0070.634] lstrlenA (lpString="*.gzip") returned 6
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.jpg") returned 0
	[0070.634] lstrlenA (lpString="*.jpg") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.jpeg") returned 0
	[0070.634] lstrlenA (lpString="*.jpeg") returned 6
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.psd") returned 0
	[0070.634] lstrlenA (lpString="*.psd") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.cdr") returned 0
	[0070.634] lstrlenA (lpString="*.cdr") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.dwg") returned 0
	[0070.634] lstrlenA (lpString="*.dwg") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.max") returned 0
	[0070.634] lstrlenA (lpString="*.max") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.bmp") returned 0
	[0070.634] lstrlenA (lpString="*.bmp") returned 5
	[0070.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", pszSpec="*.gif") returned 0
	[0070.634] lstrlenA (lpString="*.gif") returned 5
	[0070.635] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.635] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.635] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NAMECONTROLPROXY.DLL") returned -1
	[0070.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAMECONTROLPROXY.DLL") returned -1
	[0070.635] lstrcmpiA (lpString1="", lpString2="NAMECONTROLPROXY.DLL") returned -1
	[0070.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned="NAME.DLL"
	[0070.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAMECONTROLPROXY.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL"
	[0070.635] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.635] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.635] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NAMECONTROLSERVER.EXE") returned -1
	[0070.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAMECONTROLSERVER.EXE") returned -1
	[0070.635] lstrcmpiA (lpString1="", lpString2="NAMECONTROLSERVER.EXE") returned -1
	[0070.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned="NAMECONTROLPROXY.DLL"
	[0070.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.635] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAMECONTROLSERVER.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE"
	[0070.635] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE"
	[0070.636] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE"
	[0070.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE."
	[0070.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.Boom"
	[0070.636] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.642] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ab80
	[0070.642] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x19a7a600, dwHighDateTime=0x1cab99a), lpLastAccessTime=0x407536*(dwLowDateTime=0x59544a90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x19a7a600, dwHighDateTime=0x1cab99a)) returned 1
	[0070.642] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.642] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1ab5d, lpOverlapped=0x0) returned 1
	[0070.656] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="NAMECONTROLSERVER.EXE"
	[0070.657] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.657] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1ab5d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1ab5d, lpOverlapped=0x0) returned 1
	[0070.657] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.657] CloseHandle (hObject=0x88) returned 1
	[0070.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe.boom")) returned 1
	[0070.658] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.658] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.658] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NAMEEXT.DLL") returned -1
	[0070.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAMEEXT.DLL") returned -1
	[0070.658] lstrcmpiA (lpString1="", lpString2="NAMEEXT.DLL") returned -1
	[0070.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="NAMECONTROLSERVER.EXE"
	[0070.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.658] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAMEEXT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL"
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.zip") returned 0
	[0070.659] lstrlenA (lpString="*.zip") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.rar") returned 0
	[0070.659] lstrlenA (lpString="*.rar") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.7z") returned 0
	[0070.659] lstrlenA (lpString="*.7z") returned 4
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.tar") returned 0
	[0070.659] lstrlenA (lpString="*.tar") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.gzip") returned 0
	[0070.659] lstrlenA (lpString="*.gzip") returned 6
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.jpg") returned 0
	[0070.659] lstrlenA (lpString="*.jpg") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.jpeg") returned 0
	[0070.659] lstrlenA (lpString="*.jpeg") returned 6
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.psd") returned 0
	[0070.659] lstrlenA (lpString="*.psd") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.cdr") returned 0
	[0070.659] lstrlenA (lpString="*.cdr") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.dwg") returned 0
	[0070.659] lstrlenA (lpString="*.dwg") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.max") returned 0
	[0070.659] lstrlenA (lpString="*.max") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.bmp") returned 0
	[0070.659] lstrlenA (lpString="*.bmp") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.gif") returned 0
	[0070.659] lstrlenA (lpString="*.gif") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.png") returned 0
	[0070.659] lstrlenA (lpString="*.png") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.doc") returned 0
	[0070.659] lstrlenA (lpString="*.doc") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.docx") returned 0
	[0070.659] lstrlenA (lpString="*.docx") returned 6
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.xls") returned 0
	[0070.659] lstrlenA (lpString="*.xls") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.xlsx") returned 0
	[0070.659] lstrlenA (lpString="*.xlsx") returned 6
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.ppt") returned 0
	[0070.659] lstrlenA (lpString="*.ppt") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.pptx") returned 0
	[0070.659] lstrlenA (lpString="*.pptx") returned 6
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.txt") returned 0
	[0070.659] lstrlenA (lpString="*.txt") returned 5
	[0070.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.pdf") returned 0
	[0070.659] lstrlenA (lpString="*.pdf") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.djvu") returned 0
	[0070.660] lstrlenA (lpString="*.djvu") returned 6
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.htm") returned 0
	[0070.660] lstrlenA (lpString="*.htm") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.html") returned 0
	[0070.660] lstrlenA (lpString="*.html") returned 6
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mdb") returned 0
	[0070.660] lstrlenA (lpString="*.mdb") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.cer") returned 0
	[0070.660] lstrlenA (lpString="*.cer") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.p12") returned 0
	[0070.660] lstrlenA (lpString="*.p12") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.pfx") returned 0
	[0070.660] lstrlenA (lpString="*.pfx") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.kwm") returned 0
	[0070.660] lstrlenA (lpString="*.kwm") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.pwm") returned 0
	[0070.660] lstrlenA (lpString="*.pwm") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.1cd") returned 0
	[0070.660] lstrlenA (lpString="*.1cd") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.md") returned 0
	[0070.660] lstrlenA (lpString="*.md") returned 4
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mdf") returned 0
	[0070.660] lstrlenA (lpString="*.mdf") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.dbf") returned 0
	[0070.660] lstrlenA (lpString="*.dbf") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.odt") returned 0
	[0070.660] lstrlenA (lpString="*.odt") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.vob") returned 0
	[0070.660] lstrlenA (lpString="*.vob") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.ifo") returned 0
	[0070.660] lstrlenA (lpString="*.ifo") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.lnk") returned 0
	[0070.660] lstrlenA (lpString="*.lnk") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.torrent") returned 0
	[0070.660] lstrlenA (lpString="*.torrent") returned 9
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mov") returned 0
	[0070.660] lstrlenA (lpString="*.mov") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.m2v") returned 0
	[0070.660] lstrlenA (lpString="*.m2v") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.3gp") returned 0
	[0070.660] lstrlenA (lpString="*.3gp") returned 5
	[0070.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mpeg") returned 0
	[0070.660] lstrlenA (lpString="*.mpeg") returned 6
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mpg") returned 0
	[0070.661] lstrlenA (lpString="*.mpg") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.flv") returned 0
	[0070.661] lstrlenA (lpString="*.flv") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.avi") returned 0
	[0070.661] lstrlenA (lpString="*.avi") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mp4") returned 0
	[0070.661] lstrlenA (lpString="*.mp4") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.wmv") returned 0
	[0070.661] lstrlenA (lpString="*.wmv") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.divx") returned 0
	[0070.661] lstrlenA (lpString="*.divx") returned 6
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mkv") returned 0
	[0070.661] lstrlenA (lpString="*.mkv") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.mp3") returned 0
	[0070.661] lstrlenA (lpString="*.mp3") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.wav") returned 0
	[0070.661] lstrlenA (lpString="*.wav") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.flac") returned 0
	[0070.661] lstrlenA (lpString="*.flac") returned 6
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.ape") returned 0
	[0070.661] lstrlenA (lpString="*.ape") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.wma") returned 0
	[0070.661] lstrlenA (lpString="*.wma") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.ac3") returned 0
	[0070.661] lstrlenA (lpString="*.ac3") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.exe") returned 0
	[0070.661] lstrlenA (lpString="*.exe") returned 5
	[0070.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", pszSpec="*.apk") returned 0
	[0070.661] lstrlenA (lpString="*.apk") returned 5
	[0070.661] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.661] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.661] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL7Data0011.DLL") returned -1
	[0070.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL7Data0011.DLL") returned -1
	[0070.661] lstrcmpiA (lpString1="", lpString2="NL7Data0011.DLL") returned -1
	[0070.661] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned="NAMEEXT.DLL"
	[0070.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.661] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7Data0011.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL"
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.zip") returned 0
	[0070.662] lstrlenA (lpString="*.zip") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.rar") returned 0
	[0070.662] lstrlenA (lpString="*.rar") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.7z") returned 0
	[0070.662] lstrlenA (lpString="*.7z") returned 4
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.tar") returned 0
	[0070.662] lstrlenA (lpString="*.tar") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.gzip") returned 0
	[0070.662] lstrlenA (lpString="*.gzip") returned 6
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.jpg") returned 0
	[0070.662] lstrlenA (lpString="*.jpg") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.jpeg") returned 0
	[0070.662] lstrlenA (lpString="*.jpeg") returned 6
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.psd") returned 0
	[0070.662] lstrlenA (lpString="*.psd") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.cdr") returned 0
	[0070.662] lstrlenA (lpString="*.cdr") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.dwg") returned 0
	[0070.662] lstrlenA (lpString="*.dwg") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.max") returned 0
	[0070.662] lstrlenA (lpString="*.max") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.bmp") returned 0
	[0070.662] lstrlenA (lpString="*.bmp") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.gif") returned 0
	[0070.662] lstrlenA (lpString="*.gif") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.png") returned 0
	[0070.662] lstrlenA (lpString="*.png") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.doc") returned 0
	[0070.662] lstrlenA (lpString="*.doc") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.docx") returned 0
	[0070.662] lstrlenA (lpString="*.docx") returned 6
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.xls") returned 0
	[0070.662] lstrlenA (lpString="*.xls") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.xlsx") returned 0
	[0070.662] lstrlenA (lpString="*.xlsx") returned 6
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.ppt") returned 0
	[0070.662] lstrlenA (lpString="*.ppt") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.pptx") returned 0
	[0070.662] lstrlenA (lpString="*.pptx") returned 6
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.txt") returned 0
	[0070.662] lstrlenA (lpString="*.txt") returned 5
	[0070.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.pdf") returned 0
	[0070.663] lstrlenA (lpString="*.pdf") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.djvu") returned 0
	[0070.663] lstrlenA (lpString="*.djvu") returned 6
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.htm") returned 0
	[0070.663] lstrlenA (lpString="*.htm") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.html") returned 0
	[0070.663] lstrlenA (lpString="*.html") returned 6
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mdb") returned 0
	[0070.663] lstrlenA (lpString="*.mdb") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.cer") returned 0
	[0070.663] lstrlenA (lpString="*.cer") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.p12") returned 0
	[0070.663] lstrlenA (lpString="*.p12") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.pfx") returned 0
	[0070.663] lstrlenA (lpString="*.pfx") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.kwm") returned 0
	[0070.663] lstrlenA (lpString="*.kwm") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.pwm") returned 0
	[0070.663] lstrlenA (lpString="*.pwm") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.1cd") returned 0
	[0070.663] lstrlenA (lpString="*.1cd") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.md") returned 0
	[0070.663] lstrlenA (lpString="*.md") returned 4
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mdf") returned 0
	[0070.663] lstrlenA (lpString="*.mdf") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.dbf") returned 0
	[0070.663] lstrlenA (lpString="*.dbf") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.odt") returned 0
	[0070.663] lstrlenA (lpString="*.odt") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.vob") returned 0
	[0070.663] lstrlenA (lpString="*.vob") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.ifo") returned 0
	[0070.663] lstrlenA (lpString="*.ifo") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.lnk") returned 0
	[0070.663] lstrlenA (lpString="*.lnk") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.torrent") returned 0
	[0070.663] lstrlenA (lpString="*.torrent") returned 9
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mov") returned 0
	[0070.663] lstrlenA (lpString="*.mov") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.m2v") returned 0
	[0070.663] lstrlenA (lpString="*.m2v") returned 5
	[0070.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.3gp") returned 0
	[0070.664] lstrlenA (lpString="*.3gp") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mpeg") returned 0
	[0070.664] lstrlenA (lpString="*.mpeg") returned 6
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mpg") returned 0
	[0070.664] lstrlenA (lpString="*.mpg") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.flv") returned 0
	[0070.664] lstrlenA (lpString="*.flv") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.avi") returned 0
	[0070.664] lstrlenA (lpString="*.avi") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mp4") returned 0
	[0070.664] lstrlenA (lpString="*.mp4") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.wmv") returned 0
	[0070.664] lstrlenA (lpString="*.wmv") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.divx") returned 0
	[0070.664] lstrlenA (lpString="*.divx") returned 6
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mkv") returned 0
	[0070.664] lstrlenA (lpString="*.mkv") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.mp3") returned 0
	[0070.664] lstrlenA (lpString="*.mp3") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.wav") returned 0
	[0070.664] lstrlenA (lpString="*.wav") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.flac") returned 0
	[0070.664] lstrlenA (lpString="*.flac") returned 6
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.ape") returned 0
	[0070.664] lstrlenA (lpString="*.ape") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.wma") returned 0
	[0070.664] lstrlenA (lpString="*.wma") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.ac3") returned 0
	[0070.664] lstrlenA (lpString="*.ac3") returned 5
	[0070.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.exe") returned 0
	[0070.704] lstrlenA (lpString="*.exe") returned 5
	[0070.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", pszSpec="*.apk") returned 0
	[0070.704] lstrlenA (lpString="*.apk") returned 5
	[0070.704] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.704] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.704] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL7Lexicons0011.DLL") returned -1
	[0070.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL7Lexicons0011.DLL") returned -1
	[0070.704] lstrcmpiA (lpString1="", lpString2="NL7Lexicons0011.DLL") returned -1
	[0070.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned="NL7Data0011.DLL"
	[0070.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7Lexicons0011.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL"
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.zip") returned 0
	[0070.705] lstrlenA (lpString="*.zip") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.rar") returned 0
	[0070.705] lstrlenA (lpString="*.rar") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.7z") returned 0
	[0070.705] lstrlenA (lpString="*.7z") returned 4
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.tar") returned 0
	[0070.705] lstrlenA (lpString="*.tar") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.gzip") returned 0
	[0070.705] lstrlenA (lpString="*.gzip") returned 6
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.jpg") returned 0
	[0070.705] lstrlenA (lpString="*.jpg") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.jpeg") returned 0
	[0070.705] lstrlenA (lpString="*.jpeg") returned 6
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.psd") returned 0
	[0070.705] lstrlenA (lpString="*.psd") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.cdr") returned 0
	[0070.705] lstrlenA (lpString="*.cdr") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.dwg") returned 0
	[0070.705] lstrlenA (lpString="*.dwg") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.max") returned 0
	[0070.705] lstrlenA (lpString="*.max") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.bmp") returned 0
	[0070.705] lstrlenA (lpString="*.bmp") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.gif") returned 0
	[0070.705] lstrlenA (lpString="*.gif") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.png") returned 0
	[0070.705] lstrlenA (lpString="*.png") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.doc") returned 0
	[0070.705] lstrlenA (lpString="*.doc") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.docx") returned 0
	[0070.705] lstrlenA (lpString="*.docx") returned 6
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.xls") returned 0
	[0070.705] lstrlenA (lpString="*.xls") returned 5
	[0070.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.xlsx") returned 0
	[0070.706] lstrlenA (lpString="*.xlsx") returned 6
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.ppt") returned 0
	[0070.706] lstrlenA (lpString="*.ppt") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.pptx") returned 0
	[0070.706] lstrlenA (lpString="*.pptx") returned 6
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.txt") returned 0
	[0070.706] lstrlenA (lpString="*.txt") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.pdf") returned 0
	[0070.706] lstrlenA (lpString="*.pdf") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.djvu") returned 0
	[0070.706] lstrlenA (lpString="*.djvu") returned 6
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.htm") returned 0
	[0070.706] lstrlenA (lpString="*.htm") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.html") returned 0
	[0070.706] lstrlenA (lpString="*.html") returned 6
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mdb") returned 0
	[0070.706] lstrlenA (lpString="*.mdb") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.cer") returned 0
	[0070.706] lstrlenA (lpString="*.cer") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.p12") returned 0
	[0070.706] lstrlenA (lpString="*.p12") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.pfx") returned 0
	[0070.706] lstrlenA (lpString="*.pfx") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.kwm") returned 0
	[0070.706] lstrlenA (lpString="*.kwm") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.pwm") returned 0
	[0070.706] lstrlenA (lpString="*.pwm") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.1cd") returned 0
	[0070.706] lstrlenA (lpString="*.1cd") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.md") returned 0
	[0070.706] lstrlenA (lpString="*.md") returned 4
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mdf") returned 0
	[0070.706] lstrlenA (lpString="*.mdf") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.dbf") returned 0
	[0070.706] lstrlenA (lpString="*.dbf") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.odt") returned 0
	[0070.706] lstrlenA (lpString="*.odt") returned 5
	[0070.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.vob") returned 0
	[0070.706] lstrlenA (lpString="*.vob") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.ifo") returned 0
	[0070.707] lstrlenA (lpString="*.ifo") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.lnk") returned 0
	[0070.707] lstrlenA (lpString="*.lnk") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.torrent") returned 0
	[0070.707] lstrlenA (lpString="*.torrent") returned 9
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mov") returned 0
	[0070.707] lstrlenA (lpString="*.mov") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.m2v") returned 0
	[0070.707] lstrlenA (lpString="*.m2v") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.3gp") returned 0
	[0070.707] lstrlenA (lpString="*.3gp") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mpeg") returned 0
	[0070.707] lstrlenA (lpString="*.mpeg") returned 6
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mpg") returned 0
	[0070.707] lstrlenA (lpString="*.mpg") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.flv") returned 0
	[0070.707] lstrlenA (lpString="*.flv") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.avi") returned 0
	[0070.707] lstrlenA (lpString="*.avi") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mp4") returned 0
	[0070.707] lstrlenA (lpString="*.mp4") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.wmv") returned 0
	[0070.707] lstrlenA (lpString="*.wmv") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.divx") returned 0
	[0070.707] lstrlenA (lpString="*.divx") returned 6
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mkv") returned 0
	[0070.707] lstrlenA (lpString="*.mkv") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.mp3") returned 0
	[0070.707] lstrlenA (lpString="*.mp3") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.wav") returned 0
	[0070.707] lstrlenA (lpString="*.wav") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.flac") returned 0
	[0070.707] lstrlenA (lpString="*.flac") returned 6
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.ape") returned 0
	[0070.707] lstrlenA (lpString="*.ape") returned 5
	[0070.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.wma") returned 0
	[0070.707] lstrlenA (lpString="*.wma") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.ac3") returned 0
	[0070.708] lstrlenA (lpString="*.ac3") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.exe") returned 0
	[0070.708] lstrlenA (lpString="*.exe") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", pszSpec="*.apk") returned 0
	[0070.708] lstrlenA (lpString="*.apk") returned 5
	[0070.708] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.708] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.708] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL7MODELS0009.dll") returned -1
	[0070.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL7MODELS0009.dll") returned -1
	[0070.708] lstrcmpiA (lpString1="", lpString2="NL7MODELS0009.dll") returned -1
	[0070.708] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned="NL7Lexicons0011.DLL"
	[0070.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.708] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7MODELS0009.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll"
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.zip") returned 0
	[0070.708] lstrlenA (lpString="*.zip") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.rar") returned 0
	[0070.708] lstrlenA (lpString="*.rar") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.7z") returned 0
	[0070.708] lstrlenA (lpString="*.7z") returned 4
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.tar") returned 0
	[0070.708] lstrlenA (lpString="*.tar") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.gzip") returned 0
	[0070.708] lstrlenA (lpString="*.gzip") returned 6
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.jpg") returned 0
	[0070.708] lstrlenA (lpString="*.jpg") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.jpeg") returned 0
	[0070.708] lstrlenA (lpString="*.jpeg") returned 6
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.psd") returned 0
	[0070.708] lstrlenA (lpString="*.psd") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.cdr") returned 0
	[0070.708] lstrlenA (lpString="*.cdr") returned 5
	[0070.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.dwg") returned 0
	[0070.709] lstrlenA (lpString="*.dwg") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.max") returned 0
	[0070.709] lstrlenA (lpString="*.max") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.bmp") returned 0
	[0070.709] lstrlenA (lpString="*.bmp") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.gif") returned 0
	[0070.709] lstrlenA (lpString="*.gif") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.png") returned 0
	[0070.709] lstrlenA (lpString="*.png") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.doc") returned 0
	[0070.709] lstrlenA (lpString="*.doc") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.docx") returned 0
	[0070.709] lstrlenA (lpString="*.docx") returned 6
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.xls") returned 0
	[0070.709] lstrlenA (lpString="*.xls") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.xlsx") returned 0
	[0070.709] lstrlenA (lpString="*.xlsx") returned 6
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.ppt") returned 0
	[0070.709] lstrlenA (lpString="*.ppt") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.pptx") returned 0
	[0070.709] lstrlenA (lpString="*.pptx") returned 6
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.txt") returned 0
	[0070.709] lstrlenA (lpString="*.txt") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.pdf") returned 0
	[0070.709] lstrlenA (lpString="*.pdf") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.djvu") returned 0
	[0070.709] lstrlenA (lpString="*.djvu") returned 6
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.htm") returned 0
	[0070.709] lstrlenA (lpString="*.htm") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.html") returned 0
	[0070.709] lstrlenA (lpString="*.html") returned 6
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mdb") returned 0
	[0070.709] lstrlenA (lpString="*.mdb") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.cer") returned 0
	[0070.709] lstrlenA (lpString="*.cer") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.p12") returned 0
	[0070.709] lstrlenA (lpString="*.p12") returned 5
	[0070.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.pfx") returned 0
	[0070.709] lstrlenA (lpString="*.pfx") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.kwm") returned 0
	[0070.710] lstrlenA (lpString="*.kwm") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.pwm") returned 0
	[0070.710] lstrlenA (lpString="*.pwm") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.1cd") returned 0
	[0070.710] lstrlenA (lpString="*.1cd") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.md") returned 0
	[0070.710] lstrlenA (lpString="*.md") returned 4
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mdf") returned 0
	[0070.710] lstrlenA (lpString="*.mdf") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.dbf") returned 0
	[0070.710] lstrlenA (lpString="*.dbf") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.odt") returned 0
	[0070.710] lstrlenA (lpString="*.odt") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.vob") returned 0
	[0070.710] lstrlenA (lpString="*.vob") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.ifo") returned 0
	[0070.710] lstrlenA (lpString="*.ifo") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.lnk") returned 0
	[0070.710] lstrlenA (lpString="*.lnk") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.torrent") returned 0
	[0070.710] lstrlenA (lpString="*.torrent") returned 9
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mov") returned 0
	[0070.710] lstrlenA (lpString="*.mov") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.m2v") returned 0
	[0070.710] lstrlenA (lpString="*.m2v") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.3gp") returned 0
	[0070.710] lstrlenA (lpString="*.3gp") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mpeg") returned 0
	[0070.710] lstrlenA (lpString="*.mpeg") returned 6
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mpg") returned 0
	[0070.710] lstrlenA (lpString="*.mpg") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.flv") returned 0
	[0070.710] lstrlenA (lpString="*.flv") returned 5
	[0070.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.avi") returned 0
	[0070.714] lstrlenA (lpString="*.avi") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mp4") returned 0
	[0070.714] lstrlenA (lpString="*.mp4") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.wmv") returned 0
	[0070.714] lstrlenA (lpString="*.wmv") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.divx") returned 0
	[0070.714] lstrlenA (lpString="*.divx") returned 6
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mkv") returned 0
	[0070.714] lstrlenA (lpString="*.mkv") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.mp3") returned 0
	[0070.714] lstrlenA (lpString="*.mp3") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.wav") returned 0
	[0070.714] lstrlenA (lpString="*.wav") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.flac") returned 0
	[0070.714] lstrlenA (lpString="*.flac") returned 6
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.ape") returned 0
	[0070.714] lstrlenA (lpString="*.ape") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.wma") returned 0
	[0070.714] lstrlenA (lpString="*.wma") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.ac3") returned 0
	[0070.714] lstrlenA (lpString="*.ac3") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.exe") returned 0
	[0070.714] lstrlenA (lpString="*.exe") returned 5
	[0070.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", pszSpec="*.apk") returned 0
	[0070.714] lstrlenA (lpString="*.apk") returned 5
	[0070.714] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.714] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.714] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL7MODELS000A.dll") returned -1
	[0070.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL7MODELS000A.dll") returned -1
	[0070.714] lstrcmpiA (lpString1="", lpString2="NL7MODELS000A.dll") returned -1
	[0070.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned="NL7MODELS0009.dll"
	[0070.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.714] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7MODELS000A.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll"
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.zip") returned 0
	[0070.715] lstrlenA (lpString="*.zip") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.rar") returned 0
	[0070.715] lstrlenA (lpString="*.rar") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.7z") returned 0
	[0070.715] lstrlenA (lpString="*.7z") returned 4
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.tar") returned 0
	[0070.715] lstrlenA (lpString="*.tar") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.gzip") returned 0
	[0070.715] lstrlenA (lpString="*.gzip") returned 6
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.jpg") returned 0
	[0070.715] lstrlenA (lpString="*.jpg") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.jpeg") returned 0
	[0070.715] lstrlenA (lpString="*.jpeg") returned 6
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.psd") returned 0
	[0070.715] lstrlenA (lpString="*.psd") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.cdr") returned 0
	[0070.715] lstrlenA (lpString="*.cdr") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.dwg") returned 0
	[0070.715] lstrlenA (lpString="*.dwg") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.max") returned 0
	[0070.715] lstrlenA (lpString="*.max") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.bmp") returned 0
	[0070.715] lstrlenA (lpString="*.bmp") returned 5
	[0070.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", pszSpec="*.gif") returned 0
	[0070.715] lstrlenA (lpString="*.gif") returned 5
	[0070.716] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.716] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.716] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL7MODELS000C.dll") returned -1
	[0070.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL7MODELS000C.dll") returned -1
	[0070.716] lstrcmpiA (lpString1="", lpString2="NL7MODELS000C.dll") returned -1
	[0070.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned="NL7MODELS000A.dll"
	[0070.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.716] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.716] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7MODELS000C.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll"
	[0070.716] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.716] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.716] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL7Models0011.DLL") returned -1
	[0070.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL7Models0011.DLL") returned -1
	[0070.716] lstrcmpiA (lpString1="", lpString2="NL7Models0011.DLL") returned -1
	[0070.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned="NL7MODELS000C.dll"
	[0070.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.716] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.716] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7Models0011.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL"
	[0070.716] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.716] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.716] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NPAUTHZ.DLL") returned -1
	[0070.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NPAUTHZ.DLL") returned -1
	[0070.716] lstrcmpiA (lpString1="", lpString2="NPAUTHZ.DLL") returned -1
	[0070.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned="NL7Models0011.DLL"
	[0070.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.716] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.717] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NPAUTHZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL"
	[0070.717] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.717] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.717] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OART.DLL") returned -1
	[0070.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OART.DLL") returned -1
	[0070.717] lstrcmpiA (lpString1="", lpString2="OART.DLL") returned -1
	[0070.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned="NPAUTHZ.DLL"
	[0070.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.717] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OART.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL"
	[0070.717] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.717] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.717] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OARTCONV.DLL") returned -1
	[0070.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OARTCONV.DLL") returned -1
	[0070.717] lstrcmpiA (lpString1="", lpString2="OARTCONV.DLL") returned -1
	[0070.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned="OART.DLL"
	[0070.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.717] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OARTCONV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL"
	[0070.717] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.717] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.717] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OCRHC.DAT") returned -1
	[0070.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OCRHC.DAT") returned -1
	[0070.717] lstrcmpiA (lpString1="", lpString2="OCRHC.DAT") returned -1
	[0070.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned="OARTCONV.DLL"
	[0070.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.718] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OCRHC.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT"
	[0070.718] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.718] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.718] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OCRVC.DAT") returned -1
	[0070.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OCRVC.DAT") returned -1
	[0070.718] lstrcmpiA (lpString1="", lpString2="OCRVC.DAT") returned -1
	[0070.718] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned="OCRHC.DAT"
	[0070.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.718] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.718] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OCRVC.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT"
	[0070.718] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.718] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.718] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OEMPRINT.CAT") returned -1
	[0070.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OEMPRINT.CAT") returned -1
	[0070.718] lstrcmpiA (lpString1="", lpString2="OEMPRINT.CAT") returned -1
	[0070.718] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned="OCRVC.DAT"
	[0070.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.718] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.718] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OEMPRINT.CAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT"
	[0070.718] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.718] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.718] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OFFOWC.DLL") returned -1
	[0070.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFOWC.DLL") returned -1
	[0070.718] lstrcmpiA (lpString1="", lpString2="OFFOWC.DLL") returned -1
	[0070.718] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned="OEMPRINT.CAT"
	[0070.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OFFOWC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL"
	[0070.719] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.719] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.719] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OFFRHD.DLL") returned -1
	[0070.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFRHD.DLL") returned -1
	[0070.719] lstrcmpiA (lpString1="", lpString2="OFFRHD.DLL") returned -1
	[0070.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned="OFFOWC.DLL"
	[0070.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OFFRHD.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL"
	[0070.719] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.719] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.719] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OFFXML.DLL") returned -1
	[0070.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFXML.DLL") returned -1
	[0070.719] lstrcmpiA (lpString1="", lpString2="OFFXML.DLL") returned -1
	[0070.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned="OFFRHD.DLL"
	[0070.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OFFXML.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL"
	[0070.719] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.719] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.719] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ogalegit.dll") returned -1
	[0070.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ogalegit.dll") returned -1
	[0070.719] lstrcmpiA (lpString1="", lpString2="ogalegit.dll") returned -1
	[0070.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned="OFFXML.DLL"
	[0070.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.720] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ogalegit.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll"
	[0070.720] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.720] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.720] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OIMG.DLL") returned -1
	[0070.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OIMG.DLL") returned -1
	[0070.720] lstrcmpiA (lpString1="", lpString2="OIMG.DLL") returned -1
	[0070.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned="ogalegit.dll"
	[0070.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.720] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OIMG.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL"
	[0070.720] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.720] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.720] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OIS.EXE") returned -1
	[0070.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OIS.EXE") returned -1
	[0070.720] lstrcmpiA (lpString1="", lpString2="OIS.EXE") returned -1
	[0070.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned="OIMG.DLL"
	[0070.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.720] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OIS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE"
	[0070.720] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE"
	[0070.720] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE"
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE."
	[0070.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.Boom"
	[0070.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.733] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49168
	[0070.733] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd58faa00, dwHighDateTime=0x1cba06e), lpLastAccessTime=0x407536*(dwLowDateTime=0xd79f3100, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd58faa00, dwHighDateTime=0x1cba06e)) returned 1
	[0070.733] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.733] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x49145, lpOverlapped=0x0) returned 1
	[0070.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="OIS.EXE"
	[0070.755] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.756] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x49145, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x49145, lpOverlapped=0x0) returned 1
	[0070.756] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.756] CloseHandle (hObject=0x88) returned 1
	[0070.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe.boom")) returned 1
	[0070.758] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.758] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.758] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OISAPP.DLL") returned -1
	[0070.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OISAPP.DLL") returned -1
	[0070.758] lstrcmpiA (lpString1="", lpString2="OISAPP.DLL") returned -1
	[0070.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="OIS.EXE"
	[0070.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.758] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OISAPP.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL"
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.zip") returned 0
	[0070.758] lstrlenA (lpString="*.zip") returned 5
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.rar") returned 0
	[0070.758] lstrlenA (lpString="*.rar") returned 5
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.7z") returned 0
	[0070.758] lstrlenA (lpString="*.7z") returned 4
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.tar") returned 0
	[0070.758] lstrlenA (lpString="*.tar") returned 5
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.gzip") returned 0
	[0070.758] lstrlenA (lpString="*.gzip") returned 6
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.jpg") returned 0
	[0070.758] lstrlenA (lpString="*.jpg") returned 5
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.jpeg") returned 0
	[0070.758] lstrlenA (lpString="*.jpeg") returned 6
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.psd") returned 0
	[0070.758] lstrlenA (lpString="*.psd") returned 5
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.cdr") returned 0
	[0070.758] lstrlenA (lpString="*.cdr") returned 5
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.dwg") returned 0
	[0070.758] lstrlenA (lpString="*.dwg") returned 5
	[0070.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.max") returned 0
	[0070.759] lstrlenA (lpString="*.max") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.bmp") returned 0
	[0070.759] lstrlenA (lpString="*.bmp") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.gif") returned 0
	[0070.759] lstrlenA (lpString="*.gif") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.png") returned 0
	[0070.759] lstrlenA (lpString="*.png") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.doc") returned 0
	[0070.759] lstrlenA (lpString="*.doc") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.docx") returned 0
	[0070.759] lstrlenA (lpString="*.docx") returned 6
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.xls") returned 0
	[0070.759] lstrlenA (lpString="*.xls") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.xlsx") returned 0
	[0070.759] lstrlenA (lpString="*.xlsx") returned 6
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.ppt") returned 0
	[0070.759] lstrlenA (lpString="*.ppt") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.pptx") returned 0
	[0070.759] lstrlenA (lpString="*.pptx") returned 6
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.txt") returned 0
	[0070.759] lstrlenA (lpString="*.txt") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.pdf") returned 0
	[0070.759] lstrlenA (lpString="*.pdf") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.djvu") returned 0
	[0070.759] lstrlenA (lpString="*.djvu") returned 6
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.htm") returned 0
	[0070.759] lstrlenA (lpString="*.htm") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.html") returned 0
	[0070.759] lstrlenA (lpString="*.html") returned 6
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mdb") returned 0
	[0070.759] lstrlenA (lpString="*.mdb") returned 5
	[0070.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.cer") returned 0
	[0070.760] lstrlenA (lpString="*.cer") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.p12") returned 0
	[0070.760] lstrlenA (lpString="*.p12") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.pfx") returned 0
	[0070.760] lstrlenA (lpString="*.pfx") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.kwm") returned 0
	[0070.760] lstrlenA (lpString="*.kwm") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.pwm") returned 0
	[0070.760] lstrlenA (lpString="*.pwm") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.1cd") returned 0
	[0070.760] lstrlenA (lpString="*.1cd") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.md") returned 0
	[0070.760] lstrlenA (lpString="*.md") returned 4
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mdf") returned 0
	[0070.760] lstrlenA (lpString="*.mdf") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.dbf") returned 0
	[0070.760] lstrlenA (lpString="*.dbf") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.odt") returned 0
	[0070.760] lstrlenA (lpString="*.odt") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.vob") returned 0
	[0070.760] lstrlenA (lpString="*.vob") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.ifo") returned 0
	[0070.760] lstrlenA (lpString="*.ifo") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.lnk") returned 0
	[0070.760] lstrlenA (lpString="*.lnk") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.torrent") returned 0
	[0070.760] lstrlenA (lpString="*.torrent") returned 9
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mov") returned 0
	[0070.760] lstrlenA (lpString="*.mov") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.m2v") returned 0
	[0070.760] lstrlenA (lpString="*.m2v") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.3gp") returned 0
	[0070.760] lstrlenA (lpString="*.3gp") returned 5
	[0070.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mpeg") returned 0
	[0070.761] lstrlenA (lpString="*.mpeg") returned 6
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mpg") returned 0
	[0070.761] lstrlenA (lpString="*.mpg") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.flv") returned 0
	[0070.761] lstrlenA (lpString="*.flv") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.avi") returned 0
	[0070.761] lstrlenA (lpString="*.avi") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mp4") returned 0
	[0070.761] lstrlenA (lpString="*.mp4") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.wmv") returned 0
	[0070.761] lstrlenA (lpString="*.wmv") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.divx") returned 0
	[0070.761] lstrlenA (lpString="*.divx") returned 6
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mkv") returned 0
	[0070.761] lstrlenA (lpString="*.mkv") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.mp3") returned 0
	[0070.761] lstrlenA (lpString="*.mp3") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.wav") returned 0
	[0070.761] lstrlenA (lpString="*.wav") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.flac") returned 0
	[0070.761] lstrlenA (lpString="*.flac") returned 6
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.ape") returned 0
	[0070.761] lstrlenA (lpString="*.ape") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.wma") returned 0
	[0070.761] lstrlenA (lpString="*.wma") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.ac3") returned 0
	[0070.761] lstrlenA (lpString="*.ac3") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.exe") returned 0
	[0070.761] lstrlenA (lpString="*.exe") returned 5
	[0070.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", pszSpec="*.apk") returned 0
	[0070.761] lstrlenA (lpString="*.apk") returned 5
	[0070.761] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.761] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.762] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oisctrl.dll") returned -1
	[0070.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oisctrl.dll") returned -1
	[0070.762] lstrcmpiA (lpString1="", lpString2="oisctrl.dll") returned -1
	[0070.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned="OISAPP.DLL"
	[0070.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.762] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="oisctrl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll"
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.zip") returned 0
	[0070.762] lstrlenA (lpString="*.zip") returned 5
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.rar") returned 0
	[0070.762] lstrlenA (lpString="*.rar") returned 5
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.7z") returned 0
	[0070.762] lstrlenA (lpString="*.7z") returned 4
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.tar") returned 0
	[0070.762] lstrlenA (lpString="*.tar") returned 5
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.gzip") returned 0
	[0070.762] lstrlenA (lpString="*.gzip") returned 6
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.jpg") returned 0
	[0070.762] lstrlenA (lpString="*.jpg") returned 5
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.jpeg") returned 0
	[0070.762] lstrlenA (lpString="*.jpeg") returned 6
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.psd") returned 0
	[0070.762] lstrlenA (lpString="*.psd") returned 5
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.cdr") returned 0
	[0070.762] lstrlenA (lpString="*.cdr") returned 5
	[0070.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.dwg") returned 0
	[0070.763] lstrlenA (lpString="*.dwg") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.max") returned 0
	[0070.763] lstrlenA (lpString="*.max") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.bmp") returned 0
	[0070.763] lstrlenA (lpString="*.bmp") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.gif") returned 0
	[0070.763] lstrlenA (lpString="*.gif") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.png") returned 0
	[0070.763] lstrlenA (lpString="*.png") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.doc") returned 0
	[0070.763] lstrlenA (lpString="*.doc") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.docx") returned 0
	[0070.763] lstrlenA (lpString="*.docx") returned 6
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.xls") returned 0
	[0070.763] lstrlenA (lpString="*.xls") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.xlsx") returned 0
	[0070.763] lstrlenA (lpString="*.xlsx") returned 6
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.ppt") returned 0
	[0070.763] lstrlenA (lpString="*.ppt") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.pptx") returned 0
	[0070.763] lstrlenA (lpString="*.pptx") returned 6
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.txt") returned 0
	[0070.763] lstrlenA (lpString="*.txt") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.pdf") returned 0
	[0070.763] lstrlenA (lpString="*.pdf") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.djvu") returned 0
	[0070.763] lstrlenA (lpString="*.djvu") returned 6
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.htm") returned 0
	[0070.763] lstrlenA (lpString="*.htm") returned 5
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.html") returned 0
	[0070.763] lstrlenA (lpString="*.html") returned 6
	[0070.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mdb") returned 0
	[0070.764] lstrlenA (lpString="*.mdb") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.cer") returned 0
	[0070.764] lstrlenA (lpString="*.cer") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.p12") returned 0
	[0070.764] lstrlenA (lpString="*.p12") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.pfx") returned 0
	[0070.764] lstrlenA (lpString="*.pfx") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.kwm") returned 0
	[0070.764] lstrlenA (lpString="*.kwm") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.pwm") returned 0
	[0070.764] lstrlenA (lpString="*.pwm") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.1cd") returned 0
	[0070.764] lstrlenA (lpString="*.1cd") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.md") returned 0
	[0070.764] lstrlenA (lpString="*.md") returned 4
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mdf") returned 0
	[0070.764] lstrlenA (lpString="*.mdf") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.dbf") returned 0
	[0070.764] lstrlenA (lpString="*.dbf") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.odt") returned 0
	[0070.764] lstrlenA (lpString="*.odt") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.vob") returned 0
	[0070.764] lstrlenA (lpString="*.vob") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.ifo") returned 0
	[0070.764] lstrlenA (lpString="*.ifo") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.lnk") returned 0
	[0070.764] lstrlenA (lpString="*.lnk") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.torrent") returned 0
	[0070.764] lstrlenA (lpString="*.torrent") returned 9
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mov") returned 0
	[0070.764] lstrlenA (lpString="*.mov") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.m2v") returned 0
	[0070.764] lstrlenA (lpString="*.m2v") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.3gp") returned 0
	[0070.764] lstrlenA (lpString="*.3gp") returned 5
	[0070.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mpeg") returned 0
	[0070.765] lstrlenA (lpString="*.mpeg") returned 6
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mpg") returned 0
	[0070.765] lstrlenA (lpString="*.mpg") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.flv") returned 0
	[0070.765] lstrlenA (lpString="*.flv") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.avi") returned 0
	[0070.765] lstrlenA (lpString="*.avi") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mp4") returned 0
	[0070.765] lstrlenA (lpString="*.mp4") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.wmv") returned 0
	[0070.765] lstrlenA (lpString="*.wmv") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.divx") returned 0
	[0070.765] lstrlenA (lpString="*.divx") returned 6
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mkv") returned 0
	[0070.765] lstrlenA (lpString="*.mkv") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.mp3") returned 0
	[0070.765] lstrlenA (lpString="*.mp3") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.wav") returned 0
	[0070.765] lstrlenA (lpString="*.wav") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.flac") returned 0
	[0070.765] lstrlenA (lpString="*.flac") returned 6
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.ape") returned 0
	[0070.765] lstrlenA (lpString="*.ape") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.wma") returned 0
	[0070.765] lstrlenA (lpString="*.wma") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.ac3") returned 0
	[0070.765] lstrlenA (lpString="*.ac3") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.exe") returned 0
	[0070.765] lstrlenA (lpString="*.exe") returned 5
	[0070.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", pszSpec="*.apk") returned 0
	[0070.765] lstrlenA (lpString="*.apk") returned 5
	[0070.765] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.765] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OISGRAPH.DLL") returned -1
	[0070.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OISGRAPH.DLL") returned -1
	[0070.765] lstrcmpiA (lpString1="", lpString2="OISGRAPH.DLL") returned -1
	[0070.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned="oisctrl.dll"
	[0070.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OISGRAPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL"
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.zip") returned 0
	[0070.766] lstrlenA (lpString="*.zip") returned 5
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.rar") returned 0
	[0070.766] lstrlenA (lpString="*.rar") returned 5
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.7z") returned 0
	[0070.766] lstrlenA (lpString="*.7z") returned 4
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.tar") returned 0
	[0070.766] lstrlenA (lpString="*.tar") returned 5
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.gzip") returned 0
	[0070.766] lstrlenA (lpString="*.gzip") returned 6
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.jpg") returned 0
	[0070.766] lstrlenA (lpString="*.jpg") returned 5
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.jpeg") returned 0
	[0070.766] lstrlenA (lpString="*.jpeg") returned 6
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.psd") returned 0
	[0070.766] lstrlenA (lpString="*.psd") returned 5
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.cdr") returned 0
	[0070.766] lstrlenA (lpString="*.cdr") returned 5
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.dwg") returned 0
	[0070.766] lstrlenA (lpString="*.dwg") returned 5
	[0070.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.max") returned 0
	[0070.766] lstrlenA (lpString="*.max") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.bmp") returned 0
	[0070.767] lstrlenA (lpString="*.bmp") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.gif") returned 0
	[0070.767] lstrlenA (lpString="*.gif") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.png") returned 0
	[0070.767] lstrlenA (lpString="*.png") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.doc") returned 0
	[0070.767] lstrlenA (lpString="*.doc") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.docx") returned 0
	[0070.767] lstrlenA (lpString="*.docx") returned 6
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.xls") returned 0
	[0070.767] lstrlenA (lpString="*.xls") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.xlsx") returned 0
	[0070.767] lstrlenA (lpString="*.xlsx") returned 6
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.ppt") returned 0
	[0070.767] lstrlenA (lpString="*.ppt") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.pptx") returned 0
	[0070.767] lstrlenA (lpString="*.pptx") returned 6
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.txt") returned 0
	[0070.767] lstrlenA (lpString="*.txt") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.pdf") returned 0
	[0070.767] lstrlenA (lpString="*.pdf") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.djvu") returned 0
	[0070.767] lstrlenA (lpString="*.djvu") returned 6
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.htm") returned 0
	[0070.767] lstrlenA (lpString="*.htm") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.html") returned 0
	[0070.767] lstrlenA (lpString="*.html") returned 6
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mdb") returned 0
	[0070.767] lstrlenA (lpString="*.mdb") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.cer") returned 0
	[0070.767] lstrlenA (lpString="*.cer") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.p12") returned 0
	[0070.767] lstrlenA (lpString="*.p12") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.pfx") returned 0
	[0070.767] lstrlenA (lpString="*.pfx") returned 5
	[0070.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.kwm") returned 0
	[0070.768] lstrlenA (lpString="*.kwm") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.pwm") returned 0
	[0070.768] lstrlenA (lpString="*.pwm") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.1cd") returned 0
	[0070.768] lstrlenA (lpString="*.1cd") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.md") returned 0
	[0070.768] lstrlenA (lpString="*.md") returned 4
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mdf") returned 0
	[0070.768] lstrlenA (lpString="*.mdf") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.dbf") returned 0
	[0070.768] lstrlenA (lpString="*.dbf") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.odt") returned 0
	[0070.768] lstrlenA (lpString="*.odt") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.vob") returned 0
	[0070.768] lstrlenA (lpString="*.vob") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.ifo") returned 0
	[0070.768] lstrlenA (lpString="*.ifo") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.lnk") returned 0
	[0070.768] lstrlenA (lpString="*.lnk") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.torrent") returned 0
	[0070.768] lstrlenA (lpString="*.torrent") returned 9
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mov") returned 0
	[0070.768] lstrlenA (lpString="*.mov") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.m2v") returned 0
	[0070.768] lstrlenA (lpString="*.m2v") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.3gp") returned 0
	[0070.768] lstrlenA (lpString="*.3gp") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mpeg") returned 0
	[0070.768] lstrlenA (lpString="*.mpeg") returned 6
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mpg") returned 0
	[0070.768] lstrlenA (lpString="*.mpg") returned 5
	[0070.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.flv") returned 0
	[0070.768] lstrlenA (lpString="*.flv") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.avi") returned 0
	[0070.769] lstrlenA (lpString="*.avi") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mp4") returned 0
	[0070.769] lstrlenA (lpString="*.mp4") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.wmv") returned 0
	[0070.769] lstrlenA (lpString="*.wmv") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.divx") returned 0
	[0070.769] lstrlenA (lpString="*.divx") returned 6
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mkv") returned 0
	[0070.769] lstrlenA (lpString="*.mkv") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.mp3") returned 0
	[0070.769] lstrlenA (lpString="*.mp3") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.wav") returned 0
	[0070.769] lstrlenA (lpString="*.wav") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.flac") returned 0
	[0070.769] lstrlenA (lpString="*.flac") returned 6
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.ape") returned 0
	[0070.769] lstrlenA (lpString="*.ape") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.wma") returned 0
	[0070.769] lstrlenA (lpString="*.wma") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.ac3") returned 0
	[0070.769] lstrlenA (lpString="*.ac3") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.exe") returned 0
	[0070.769] lstrlenA (lpString="*.exe") returned 5
	[0070.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", pszSpec="*.apk") returned 0
	[0070.769] lstrlenA (lpString="*.apk") returned 5
	[0070.769] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.769] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLKFSTUB.DLL") returned -1
	[0070.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLKFSTUB.DLL") returned -1
	[0070.769] lstrcmpiA (lpString1="", lpString2="OLKFSTUB.DLL") returned -1
	[0070.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned="OISGRAPH.DLL"
	[0070.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLKFSTUB.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL"
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.zip") returned 0
	[0070.770] lstrlenA (lpString="*.zip") returned 5
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.rar") returned 0
	[0070.770] lstrlenA (lpString="*.rar") returned 5
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.7z") returned 0
	[0070.770] lstrlenA (lpString="*.7z") returned 4
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.tar") returned 0
	[0070.770] lstrlenA (lpString="*.tar") returned 5
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.gzip") returned 0
	[0070.770] lstrlenA (lpString="*.gzip") returned 6
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.jpg") returned 0
	[0070.770] lstrlenA (lpString="*.jpg") returned 5
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.jpeg") returned 0
	[0070.770] lstrlenA (lpString="*.jpeg") returned 6
	[0070.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.psd") returned 0
	[0070.771] lstrlenA (lpString="*.psd") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.cdr") returned 0
	[0070.771] lstrlenA (lpString="*.cdr") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.dwg") returned 0
	[0070.771] lstrlenA (lpString="*.dwg") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.max") returned 0
	[0070.771] lstrlenA (lpString="*.max") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.bmp") returned 0
	[0070.771] lstrlenA (lpString="*.bmp") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.gif") returned 0
	[0070.771] lstrlenA (lpString="*.gif") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.png") returned 0
	[0070.771] lstrlenA (lpString="*.png") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.doc") returned 0
	[0070.771] lstrlenA (lpString="*.doc") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.docx") returned 0
	[0070.771] lstrlenA (lpString="*.docx") returned 6
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.xls") returned 0
	[0070.771] lstrlenA (lpString="*.xls") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.xlsx") returned 0
	[0070.771] lstrlenA (lpString="*.xlsx") returned 6
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.ppt") returned 0
	[0070.771] lstrlenA (lpString="*.ppt") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.pptx") returned 0
	[0070.771] lstrlenA (lpString="*.pptx") returned 6
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.txt") returned 0
	[0070.771] lstrlenA (lpString="*.txt") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.pdf") returned 0
	[0070.771] lstrlenA (lpString="*.pdf") returned 5
	[0070.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.djvu") returned 0
	[0070.771] lstrlenA (lpString="*.djvu") returned 6
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.htm") returned 0
	[0070.772] lstrlenA (lpString="*.htm") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.html") returned 0
	[0070.772] lstrlenA (lpString="*.html") returned 6
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mdb") returned 0
	[0070.772] lstrlenA (lpString="*.mdb") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.cer") returned 0
	[0070.772] lstrlenA (lpString="*.cer") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.p12") returned 0
	[0070.772] lstrlenA (lpString="*.p12") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.pfx") returned 0
	[0070.772] lstrlenA (lpString="*.pfx") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.kwm") returned 0
	[0070.772] lstrlenA (lpString="*.kwm") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.pwm") returned 0
	[0070.772] lstrlenA (lpString="*.pwm") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.1cd") returned 0
	[0070.772] lstrlenA (lpString="*.1cd") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.md") returned 0
	[0070.772] lstrlenA (lpString="*.md") returned 4
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mdf") returned 0
	[0070.772] lstrlenA (lpString="*.mdf") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.dbf") returned 0
	[0070.772] lstrlenA (lpString="*.dbf") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.odt") returned 0
	[0070.772] lstrlenA (lpString="*.odt") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.vob") returned 0
	[0070.772] lstrlenA (lpString="*.vob") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.ifo") returned 0
	[0070.772] lstrlenA (lpString="*.ifo") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.lnk") returned 0
	[0070.772] lstrlenA (lpString="*.lnk") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.torrent") returned 0
	[0070.772] lstrlenA (lpString="*.torrent") returned 9
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mov") returned 0
	[0070.772] lstrlenA (lpString="*.mov") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.m2v") returned 0
	[0070.772] lstrlenA (lpString="*.m2v") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.3gp") returned 0
	[0070.772] lstrlenA (lpString="*.3gp") returned 5
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mpeg") returned 0
	[0070.772] lstrlenA (lpString="*.mpeg") returned 6
	[0070.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mpg") returned 0
	[0070.773] lstrlenA (lpString="*.mpg") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.flv") returned 0
	[0070.773] lstrlenA (lpString="*.flv") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.avi") returned 0
	[0070.773] lstrlenA (lpString="*.avi") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mp4") returned 0
	[0070.773] lstrlenA (lpString="*.mp4") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.wmv") returned 0
	[0070.773] lstrlenA (lpString="*.wmv") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.divx") returned 0
	[0070.773] lstrlenA (lpString="*.divx") returned 6
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mkv") returned 0
	[0070.773] lstrlenA (lpString="*.mkv") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.mp3") returned 0
	[0070.773] lstrlenA (lpString="*.mp3") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.wav") returned 0
	[0070.773] lstrlenA (lpString="*.wav") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.flac") returned 0
	[0070.773] lstrlenA (lpString="*.flac") returned 6
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.ape") returned 0
	[0070.773] lstrlenA (lpString="*.ape") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.wma") returned 0
	[0070.773] lstrlenA (lpString="*.wma") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.ac3") returned 0
	[0070.773] lstrlenA (lpString="*.ac3") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.exe") returned 0
	[0070.773] lstrlenA (lpString="*.exe") returned 5
	[0070.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", pszSpec="*.apk") returned 0
	[0070.773] lstrlenA (lpString="*.apk") returned 5
	[0070.773] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.773] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.773] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLKIRM.XML") returned -1
	[0070.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLKIRM.XML") returned -1
	[0070.774] lstrcmpiA (lpString1="", lpString2="OLKIRM.XML") returned -1
	[0070.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned="OLKFSTUB.DLL"
	[0070.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLKIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML"
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.zip") returned 0
	[0070.774] lstrlenA (lpString="*.zip") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.rar") returned 0
	[0070.774] lstrlenA (lpString="*.rar") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.7z") returned 0
	[0070.774] lstrlenA (lpString="*.7z") returned 4
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.tar") returned 0
	[0070.774] lstrlenA (lpString="*.tar") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.gzip") returned 0
	[0070.774] lstrlenA (lpString="*.gzip") returned 6
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.jpg") returned 0
	[0070.774] lstrlenA (lpString="*.jpg") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.jpeg") returned 0
	[0070.774] lstrlenA (lpString="*.jpeg") returned 6
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.psd") returned 0
	[0070.774] lstrlenA (lpString="*.psd") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.cdr") returned 0
	[0070.774] lstrlenA (lpString="*.cdr") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.dwg") returned 0
	[0070.774] lstrlenA (lpString="*.dwg") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.max") returned 0
	[0070.774] lstrlenA (lpString="*.max") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.bmp") returned 0
	[0070.774] lstrlenA (lpString="*.bmp") returned 5
	[0070.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", pszSpec="*.gif") returned 0
	[0070.774] lstrlenA (lpString="*.gif") returned 5
	[0070.775] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.775] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLKIRMV.XML") returned -1
	[0070.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLKIRMV.XML") returned -1
	[0070.775] lstrcmpiA (lpString1="", lpString2="OLKIRMV.XML") returned -1
	[0070.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned="OLKIRM.XML"
	[0070.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.775] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLKIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML"
	[0070.775] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.775] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OLMAPI32.DLL") returned -1
	[0070.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OLMAPI32.DLL") returned -1
	[0070.775] lstrcmpiA (lpString1="", lpString2="OLMAPI32.DLL") returned -1
	[0070.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned="OLKIRMV.XML"
	[0070.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.775] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLMAPI32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL"
	[0070.775] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.775] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OMML2MML.XSL") returned -1
	[0070.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMML2MML.XSL") returned -1
	[0070.775] lstrcmpiA (lpString1="", lpString2="OMML2MML.XSL") returned -1
	[0070.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned="OLMAPI32.DLL"
	[0070.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OMML2MML.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL"
	[0070.776] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.776] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.776] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OMSMAIN.DLL") returned -1
	[0070.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMSMAIN.DLL") returned -1
	[0070.776] lstrcmpiA (lpString1="", lpString2="OMSMAIN.DLL") returned -1
	[0070.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned="OMML2MML.XSL"
	[0070.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OMSMAIN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL"
	[0070.776] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.776] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.776] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OMSXP32.DLL") returned -1
	[0070.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMSXP32.DLL") returned -1
	[0070.776] lstrcmpiA (lpString1="", lpString2="OMSXP32.DLL") returned -1
	[0070.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned="OMSMAIN.DLL"
	[0070.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OMSXP32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL"
	[0070.776] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.776] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.776] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONBttnIE.dll") returned -1
	[0070.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONBttnIE.dll") returned -1
	[0070.776] lstrcmpiA (lpString1="", lpString2="ONBttnIE.dll") returned -1
	[0070.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned="OMSXP32.DLL"
	[0070.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnIE.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll"
	[0070.777] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.777] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONBttnIELinkedNotes.dll") returned -1
	[0070.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONBttnIELinkedNotes.dll") returned -1
	[0070.777] lstrcmpiA (lpString1="", lpString2="ONBttnIELinkedNotes.dll") returned -1
	[0070.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned="ONBttnIE.dll"
	[0070.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnIELinkedNotes.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll"
	[0070.777] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.777] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONBttnOL.dll") returned -1
	[0070.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONBttnOL.dll") returned -1
	[0070.777] lstrcmpiA (lpString1="", lpString2="ONBttnOL.dll") returned -1
	[0070.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned="ONBttnIELinkedNotes.dll"
	[0070.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnOL.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll"
	[0070.777] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.778] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.778] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONBttnPPT.dll") returned -1
	[0070.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONBttnPPT.dll") returned -1
	[0070.779] lstrcmpiA (lpString1="", lpString2="ONBttnPPT.dll") returned -1
	[0070.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned="ONBttnOL.dll"
	[0070.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnPPT.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll"
	[0070.779] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.779] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.779] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONBttnWD.dll") returned -1
	[0070.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONBttnWD.dll") returned -1
	[0070.779] lstrcmpiA (lpString1="", lpString2="ONBttnWD.dll") returned -1
	[0070.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned="ONBttnPPT.dll"
	[0070.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnWD.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll"
	[0070.779] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.779] lstrcmpA (lpString1=".", lpString2="OneNote") returned -1
	[0070.779] lstrcmpA (lpString1="..", lpString2="OneNote") returned -1
	[0070.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned="ONBttnWD.dll"
	[0070.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OneNote" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote"
	[0070.779] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0070.795] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0070.795] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.795] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0070.795] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0070.795] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.795] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.795] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SendToOneNote-PipelineConfig.xml") returned -1
	[0070.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendToOneNote-PipelineConfig.xml") returned -1
	[0070.795] lstrcmpiA (lpString1="", lpString2="SendToOneNote-PipelineConfig.xml") returned -1
	[0070.795] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*.*") returned="*.*"
	[0070.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\"
	[0070.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned=""
	[0070.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt"
	[0070.795] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt")) returned 0xffffffff
	[0070.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0070.798] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0070.798] CloseHandle (hObject=0x8c) returned 1
	[0070.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNote-PipelineConfig.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml"
	[0070.798] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.798] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.798] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SendToOneNote.gpd") returned -1
	[0070.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendToOneNote.gpd") returned -1
	[0070.798] lstrcmpiA (lpString1="", lpString2="SendToOneNote.gpd") returned -1
	[0070.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned="SendToOneNote-PipelineConfig.xml"
	[0070.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\"
	[0070.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned=""
	[0070.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt"
	[0070.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt")) returned 0x20
	[0070.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNote.gpd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd"
	[0070.798] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.798] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.798] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SendToOneNote.ini") returned -1
	[0070.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendToOneNote.ini") returned -1
	[0070.798] lstrcmpiA (lpString1="", lpString2="SendToOneNote.ini") returned -1
	[0070.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned="SendToOneNote.gpd"
	[0070.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\"
	[0070.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned=""
	[0070.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt"
	[0070.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt")) returned 0x20
	[0070.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNote.ini" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini"
	[0070.799] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.799] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SendToOneNOteFilter.dll") returned -1
	[0070.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendToOneNOteFilter.dll") returned -1
	[0070.799] lstrcmpiA (lpString1="", lpString2="SendToOneNOteFilter.dll") returned -1
	[0070.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini") returned="SendToOneNote.ini"
	[0070.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\"
	[0070.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned=""
	[0070.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt"
	[0070.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt")) returned 0x20
	[0070.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNOteFilter.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll"
	[0070.799] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.799] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SendtoOneNoteFilter.gpd") returned -1
	[0070.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendtoOneNoteFilter.gpd") returned -1
	[0070.799] lstrcmpiA (lpString1="", lpString2="SendtoOneNoteFilter.gpd") returned -1
	[0070.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned="SendToOneNOteFilter.dll"
	[0070.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\"
	[0070.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned=""
	[0070.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt"
	[0070.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt")) returned 0x20
	[0070.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendtoOneNoteFilter.gpd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd"
	[0070.799] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.799] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SendToOneNoteNames.gpd") returned -1
	[0070.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendToOneNoteNames.gpd") returned -1
	[0070.799] lstrcmpiA (lpString1="", lpString2="SendToOneNoteNames.gpd") returned -1
	[0070.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned="SendtoOneNoteFilter.gpd"
	[0070.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\"
	[0070.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned=""
	[0070.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt"
	[0070.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt")) returned 0x20
	[0070.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNoteNames.gpd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd"
	[0070.800] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0070.800] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0070.800] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SendToOneNoteUI.dll") returned -1
	[0070.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendToOneNoteUI.dll") returned -1
	[0070.800] lstrcmpiA (lpString1="", lpString2="SendToOneNoteUI.dll") returned -1
	[0070.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned="SendToOneNoteNames.gpd"
	[0070.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\"
	[0070.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned=""
	[0070.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt"
	[0070.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to decrypt files.txt")) returned 0x20
	[0070.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNoteUI.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll"
	[0070.800] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0070.800] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0070.800] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.800] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.800] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONENOTE.EXE") returned -1
	[0070.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTE.EXE") returned -1
	[0070.800] lstrcmpiA (lpString1="", lpString2="ONENOTE.EXE") returned -1
	[0070.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0070.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"
	[0070.800] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"
	[0070.800] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"
	[0070.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE."
	[0070.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.Boom"
	[0070.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.801] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x208560
	[0070.801] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2c5ccd00, dwHighDateTime=0x1cacf90), lpLastAccessTime=0x407536*(dwLowDateTime=0x6bf1cb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2c5ccd00, dwHighDateTime=0x1cacf90)) returned 1
	[0070.801] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.801] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0070.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned="ONENOTE.EXE"
	[0070.885] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.885] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0070.893] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.893] CloseHandle (hObject=0x88) returned 1
	[0070.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.boom")) returned 1
	[0070.894] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.894] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.894] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONENOTEIRM.XML") returned -1
	[0070.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTEIRM.XML") returned -1
	[0070.894] lstrcmpiA (lpString1="", lpString2="ONENOTEIRM.XML") returned -1
	[0070.894] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned="ONENOTE.EXE"
	[0070.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.894] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTEIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML"
	[0070.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.zip") returned 0
	[0070.894] lstrlenA (lpString="*.zip") returned 5
	[0070.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.rar") returned 0
	[0070.894] lstrlenA (lpString="*.rar") returned 5
	[0070.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.7z") returned 0
	[0070.895] lstrlenA (lpString="*.7z") returned 4
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.tar") returned 0
	[0070.895] lstrlenA (lpString="*.tar") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.gzip") returned 0
	[0070.895] lstrlenA (lpString="*.gzip") returned 6
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.jpg") returned 0
	[0070.895] lstrlenA (lpString="*.jpg") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.jpeg") returned 0
	[0070.895] lstrlenA (lpString="*.jpeg") returned 6
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.psd") returned 0
	[0070.895] lstrlenA (lpString="*.psd") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.cdr") returned 0
	[0070.895] lstrlenA (lpString="*.cdr") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.dwg") returned 0
	[0070.895] lstrlenA (lpString="*.dwg") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.max") returned 0
	[0070.895] lstrlenA (lpString="*.max") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.bmp") returned 0
	[0070.895] lstrlenA (lpString="*.bmp") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.gif") returned 0
	[0070.895] lstrlenA (lpString="*.gif") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.png") returned 0
	[0070.895] lstrlenA (lpString="*.png") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.doc") returned 0
	[0070.895] lstrlenA (lpString="*.doc") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.docx") returned 0
	[0070.895] lstrlenA (lpString="*.docx") returned 6
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.xls") returned 0
	[0070.895] lstrlenA (lpString="*.xls") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.xlsx") returned 0
	[0070.895] lstrlenA (lpString="*.xlsx") returned 6
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.ppt") returned 0
	[0070.895] lstrlenA (lpString="*.ppt") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.pptx") returned 0
	[0070.895] lstrlenA (lpString="*.pptx") returned 6
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.txt") returned 0
	[0070.895] lstrlenA (lpString="*.txt") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.pdf") returned 0
	[0070.895] lstrlenA (lpString="*.pdf") returned 5
	[0070.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.djvu") returned 0
	[0070.896] lstrlenA (lpString="*.djvu") returned 6
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.htm") returned 0
	[0070.896] lstrlenA (lpString="*.htm") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.html") returned 0
	[0070.896] lstrlenA (lpString="*.html") returned 6
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mdb") returned 0
	[0070.896] lstrlenA (lpString="*.mdb") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.cer") returned 0
	[0070.896] lstrlenA (lpString="*.cer") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.p12") returned 0
	[0070.896] lstrlenA (lpString="*.p12") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.pfx") returned 0
	[0070.896] lstrlenA (lpString="*.pfx") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.kwm") returned 0
	[0070.896] lstrlenA (lpString="*.kwm") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.pwm") returned 0
	[0070.896] lstrlenA (lpString="*.pwm") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.1cd") returned 0
	[0070.896] lstrlenA (lpString="*.1cd") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.md") returned 0
	[0070.896] lstrlenA (lpString="*.md") returned 4
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mdf") returned 0
	[0070.896] lstrlenA (lpString="*.mdf") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.dbf") returned 0
	[0070.896] lstrlenA (lpString="*.dbf") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.odt") returned 0
	[0070.896] lstrlenA (lpString="*.odt") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.vob") returned 0
	[0070.896] lstrlenA (lpString="*.vob") returned 5
	[0070.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.ifo") returned 0
	[0070.896] lstrlenA (lpString="*.ifo") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.lnk") returned 0
	[0070.897] lstrlenA (lpString="*.lnk") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.torrent") returned 0
	[0070.897] lstrlenA (lpString="*.torrent") returned 9
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mov") returned 0
	[0070.897] lstrlenA (lpString="*.mov") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.m2v") returned 0
	[0070.897] lstrlenA (lpString="*.m2v") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.3gp") returned 0
	[0070.897] lstrlenA (lpString="*.3gp") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mpeg") returned 0
	[0070.897] lstrlenA (lpString="*.mpeg") returned 6
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mpg") returned 0
	[0070.897] lstrlenA (lpString="*.mpg") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.flv") returned 0
	[0070.897] lstrlenA (lpString="*.flv") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.avi") returned 0
	[0070.897] lstrlenA (lpString="*.avi") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mp4") returned 0
	[0070.897] lstrlenA (lpString="*.mp4") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.wmv") returned 0
	[0070.897] lstrlenA (lpString="*.wmv") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.divx") returned 0
	[0070.897] lstrlenA (lpString="*.divx") returned 6
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mkv") returned 0
	[0070.897] lstrlenA (lpString="*.mkv") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.mp3") returned 0
	[0070.897] lstrlenA (lpString="*.mp3") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.wav") returned 0
	[0070.897] lstrlenA (lpString="*.wav") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.flac") returned 0
	[0070.897] lstrlenA (lpString="*.flac") returned 6
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.ape") returned 0
	[0070.897] lstrlenA (lpString="*.ape") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.wma") returned 0
	[0070.897] lstrlenA (lpString="*.wma") returned 5
	[0070.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.ac3") returned 0
	[0070.898] lstrlenA (lpString="*.ac3") returned 5
	[0070.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.exe") returned 0
	[0070.898] lstrlenA (lpString="*.exe") returned 5
	[0070.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", pszSpec="*.apk") returned 0
	[0070.898] lstrlenA (lpString="*.apk") returned 5
	[0070.899] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.900] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.900] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONENOTEM.EXE") returned -1
	[0070.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTEM.EXE") returned -1
	[0070.900] lstrcmpiA (lpString1="", lpString2="ONENOTEM.EXE") returned -1
	[0070.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned="ONENOTEIRM.XML"
	[0070.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTEM.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE"
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.zip") returned 0
	[0070.900] lstrlenA (lpString="*.zip") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.rar") returned 0
	[0070.900] lstrlenA (lpString="*.rar") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.7z") returned 0
	[0070.900] lstrlenA (lpString="*.7z") returned 4
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.tar") returned 0
	[0070.900] lstrlenA (lpString="*.tar") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.gzip") returned 0
	[0070.900] lstrlenA (lpString="*.gzip") returned 6
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.jpg") returned 0
	[0070.900] lstrlenA (lpString="*.jpg") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.jpeg") returned 0
	[0070.900] lstrlenA (lpString="*.jpeg") returned 6
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.psd") returned 0
	[0070.900] lstrlenA (lpString="*.psd") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.cdr") returned 0
	[0070.900] lstrlenA (lpString="*.cdr") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.dwg") returned 0
	[0070.900] lstrlenA (lpString="*.dwg") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.max") returned 0
	[0070.900] lstrlenA (lpString="*.max") returned 5
	[0070.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.bmp") returned 0
	[0070.901] lstrlenA (lpString="*.bmp") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.gif") returned 0
	[0070.901] lstrlenA (lpString="*.gif") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.png") returned 0
	[0070.901] lstrlenA (lpString="*.png") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.doc") returned 0
	[0070.901] lstrlenA (lpString="*.doc") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.docx") returned 0
	[0070.901] lstrlenA (lpString="*.docx") returned 6
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.xls") returned 0
	[0070.901] lstrlenA (lpString="*.xls") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.xlsx") returned 0
	[0070.901] lstrlenA (lpString="*.xlsx") returned 6
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.ppt") returned 0
	[0070.901] lstrlenA (lpString="*.ppt") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.pptx") returned 0
	[0070.901] lstrlenA (lpString="*.pptx") returned 6
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.txt") returned 0
	[0070.901] lstrlenA (lpString="*.txt") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.pdf") returned 0
	[0070.901] lstrlenA (lpString="*.pdf") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.djvu") returned 0
	[0070.901] lstrlenA (lpString="*.djvu") returned 6
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.htm") returned 0
	[0070.901] lstrlenA (lpString="*.htm") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.html") returned 0
	[0070.901] lstrlenA (lpString="*.html") returned 6
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mdb") returned 0
	[0070.901] lstrlenA (lpString="*.mdb") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.cer") returned 0
	[0070.901] lstrlenA (lpString="*.cer") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.p12") returned 0
	[0070.901] lstrlenA (lpString="*.p12") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.pfx") returned 0
	[0070.901] lstrlenA (lpString="*.pfx") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.kwm") returned 0
	[0070.901] lstrlenA (lpString="*.kwm") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.pwm") returned 0
	[0070.901] lstrlenA (lpString="*.pwm") returned 5
	[0070.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.1cd") returned 0
	[0070.901] lstrlenA (lpString="*.1cd") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.md") returned 0
	[0070.902] lstrlenA (lpString="*.md") returned 4
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mdf") returned 0
	[0070.902] lstrlenA (lpString="*.mdf") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.dbf") returned 0
	[0070.902] lstrlenA (lpString="*.dbf") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.odt") returned 0
	[0070.902] lstrlenA (lpString="*.odt") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.vob") returned 0
	[0070.902] lstrlenA (lpString="*.vob") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.ifo") returned 0
	[0070.902] lstrlenA (lpString="*.ifo") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.lnk") returned 0
	[0070.902] lstrlenA (lpString="*.lnk") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.torrent") returned 0
	[0070.902] lstrlenA (lpString="*.torrent") returned 9
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mov") returned 0
	[0070.902] lstrlenA (lpString="*.mov") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.m2v") returned 0
	[0070.902] lstrlenA (lpString="*.m2v") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.3gp") returned 0
	[0070.902] lstrlenA (lpString="*.3gp") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mpeg") returned 0
	[0070.902] lstrlenA (lpString="*.mpeg") returned 6
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mpg") returned 0
	[0070.902] lstrlenA (lpString="*.mpg") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.flv") returned 0
	[0070.902] lstrlenA (lpString="*.flv") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.avi") returned 0
	[0070.902] lstrlenA (lpString="*.avi") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mp4") returned 0
	[0070.902] lstrlenA (lpString="*.mp4") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.wmv") returned 0
	[0070.902] lstrlenA (lpString="*.wmv") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.divx") returned 0
	[0070.902] lstrlenA (lpString="*.divx") returned 6
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mkv") returned 0
	[0070.902] lstrlenA (lpString="*.mkv") returned 5
	[0070.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.mp3") returned 0
	[0070.902] lstrlenA (lpString="*.mp3") returned 5
	[0070.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.wav") returned 0
	[0070.903] lstrlenA (lpString="*.wav") returned 5
	[0070.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.flac") returned 0
	[0070.903] lstrlenA (lpString="*.flac") returned 6
	[0070.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.ape") returned 0
	[0070.903] lstrlenA (lpString="*.ape") returned 5
	[0070.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.wma") returned 0
	[0070.903] lstrlenA (lpString="*.wma") returned 5
	[0070.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.ac3") returned 0
	[0070.903] lstrlenA (lpString="*.ac3") returned 5
	[0070.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", pszSpec="*.exe") returned 1
	[0070.903] lstrlenA (lpString="*.exe") returned 5
	[0070.903] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE"
	[0070.903] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE"
	[0070.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE."
	[0070.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.Boom"
	[0070.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.904] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bd80
	[0070.904] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeb7e9d00, dwHighDateTime=0x1cacf2a), lpLastAccessTime=0x407536*(dwLowDateTime=0x6bf1cb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeb7e9d00, dwHighDateTime=0x1cacf2a)) returned 1
	[0070.904] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.904] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3bd5d, lpOverlapped=0x0) returned 1
	[0070.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned="ONENOTEM.EXE"
	[0070.951] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.951] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3bd5d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3bd5d, lpOverlapped=0x0) returned 1
	[0070.952] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0070.952] CloseHandle (hObject=0x88) returned 1
	[0070.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe.boom")) returned 1
	[0070.953] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.953] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.953] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONENOTEMANAGED.DLL") returned -1
	[0070.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTEMANAGED.DLL") returned -1
	[0070.953] lstrcmpiA (lpString1="", lpString2="ONENOTEMANAGED.DLL") returned -1
	[0070.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned="ONENOTEM.EXE"
	[0070.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTEMANAGED.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL"
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.zip") returned 0
	[0070.954] lstrlenA (lpString="*.zip") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.rar") returned 0
	[0070.954] lstrlenA (lpString="*.rar") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.7z") returned 0
	[0070.954] lstrlenA (lpString="*.7z") returned 4
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.tar") returned 0
	[0070.954] lstrlenA (lpString="*.tar") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.gzip") returned 0
	[0070.954] lstrlenA (lpString="*.gzip") returned 6
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.jpg") returned 0
	[0070.954] lstrlenA (lpString="*.jpg") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.jpeg") returned 0
	[0070.954] lstrlenA (lpString="*.jpeg") returned 6
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.psd") returned 0
	[0070.954] lstrlenA (lpString="*.psd") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.cdr") returned 0
	[0070.954] lstrlenA (lpString="*.cdr") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.dwg") returned 0
	[0070.954] lstrlenA (lpString="*.dwg") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.max") returned 0
	[0070.954] lstrlenA (lpString="*.max") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.bmp") returned 0
	[0070.954] lstrlenA (lpString="*.bmp") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.gif") returned 0
	[0070.954] lstrlenA (lpString="*.gif") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.png") returned 0
	[0070.954] lstrlenA (lpString="*.png") returned 5
	[0070.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.doc") returned 0
	[0070.954] lstrlenA (lpString="*.doc") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.docx") returned 0
	[0070.955] lstrlenA (lpString="*.docx") returned 6
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.xls") returned 0
	[0070.955] lstrlenA (lpString="*.xls") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.xlsx") returned 0
	[0070.955] lstrlenA (lpString="*.xlsx") returned 6
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.ppt") returned 0
	[0070.955] lstrlenA (lpString="*.ppt") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.pptx") returned 0
	[0070.955] lstrlenA (lpString="*.pptx") returned 6
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.txt") returned 0
	[0070.955] lstrlenA (lpString="*.txt") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.pdf") returned 0
	[0070.955] lstrlenA (lpString="*.pdf") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.djvu") returned 0
	[0070.955] lstrlenA (lpString="*.djvu") returned 6
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.htm") returned 0
	[0070.955] lstrlenA (lpString="*.htm") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.html") returned 0
	[0070.955] lstrlenA (lpString="*.html") returned 6
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mdb") returned 0
	[0070.955] lstrlenA (lpString="*.mdb") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.cer") returned 0
	[0070.955] lstrlenA (lpString="*.cer") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.p12") returned 0
	[0070.955] lstrlenA (lpString="*.p12") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.pfx") returned 0
	[0070.955] lstrlenA (lpString="*.pfx") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.kwm") returned 0
	[0070.955] lstrlenA (lpString="*.kwm") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.pwm") returned 0
	[0070.955] lstrlenA (lpString="*.pwm") returned 5
	[0070.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.1cd") returned 0
	[0070.956] lstrlenA (lpString="*.1cd") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.md") returned 0
	[0070.956] lstrlenA (lpString="*.md") returned 4
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mdf") returned 0
	[0070.956] lstrlenA (lpString="*.mdf") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.dbf") returned 0
	[0070.956] lstrlenA (lpString="*.dbf") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.odt") returned 0
	[0070.956] lstrlenA (lpString="*.odt") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.vob") returned 0
	[0070.956] lstrlenA (lpString="*.vob") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.ifo") returned 0
	[0070.956] lstrlenA (lpString="*.ifo") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.lnk") returned 0
	[0070.956] lstrlenA (lpString="*.lnk") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.torrent") returned 0
	[0070.956] lstrlenA (lpString="*.torrent") returned 9
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mov") returned 0
	[0070.956] lstrlenA (lpString="*.mov") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.m2v") returned 0
	[0070.956] lstrlenA (lpString="*.m2v") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.3gp") returned 0
	[0070.956] lstrlenA (lpString="*.3gp") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mpeg") returned 0
	[0070.956] lstrlenA (lpString="*.mpeg") returned 6
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mpg") returned 0
	[0070.956] lstrlenA (lpString="*.mpg") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.flv") returned 0
	[0070.956] lstrlenA (lpString="*.flv") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.avi") returned 0
	[0070.956] lstrlenA (lpString="*.avi") returned 5
	[0070.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mp4") returned 0
	[0070.956] lstrlenA (lpString="*.mp4") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.wmv") returned 0
	[0070.957] lstrlenA (lpString="*.wmv") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.divx") returned 0
	[0070.957] lstrlenA (lpString="*.divx") returned 6
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mkv") returned 0
	[0070.957] lstrlenA (lpString="*.mkv") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.mp3") returned 0
	[0070.957] lstrlenA (lpString="*.mp3") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.wav") returned 0
	[0070.957] lstrlenA (lpString="*.wav") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.flac") returned 0
	[0070.957] lstrlenA (lpString="*.flac") returned 6
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.ape") returned 0
	[0070.957] lstrlenA (lpString="*.ape") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.wma") returned 0
	[0070.957] lstrlenA (lpString="*.wma") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.ac3") returned 0
	[0070.957] lstrlenA (lpString="*.ac3") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.exe") returned 0
	[0070.957] lstrlenA (lpString="*.exe") returned 5
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", pszSpec="*.apk") returned 0
	[0070.957] lstrlenA (lpString="*.apk") returned 5
	[0070.957] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.957] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.957] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONFILTER.DLL") returned -1
	[0070.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONFILTER.DLL") returned -1
	[0070.957] lstrcmpiA (lpString1="", lpString2="ONFILTER.DLL") returned -1
	[0070.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned="ONENOTEMANAGED.DLL"
	[0070.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.957] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.957] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONFILTER.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL"
	[0070.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.zip") returned 0
	[0070.958] lstrlenA (lpString="*.zip") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.rar") returned 0
	[0070.958] lstrlenA (lpString="*.rar") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.7z") returned 0
	[0070.958] lstrlenA (lpString="*.7z") returned 4
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.tar") returned 0
	[0070.958] lstrlenA (lpString="*.tar") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.gzip") returned 0
	[0070.958] lstrlenA (lpString="*.gzip") returned 6
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.jpg") returned 0
	[0070.958] lstrlenA (lpString="*.jpg") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.jpeg") returned 0
	[0070.958] lstrlenA (lpString="*.jpeg") returned 6
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.psd") returned 0
	[0070.958] lstrlenA (lpString="*.psd") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.cdr") returned 0
	[0070.958] lstrlenA (lpString="*.cdr") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.dwg") returned 0
	[0070.958] lstrlenA (lpString="*.dwg") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.max") returned 0
	[0070.958] lstrlenA (lpString="*.max") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.bmp") returned 0
	[0070.958] lstrlenA (lpString="*.bmp") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.gif") returned 0
	[0070.958] lstrlenA (lpString="*.gif") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.png") returned 0
	[0070.958] lstrlenA (lpString="*.png") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.doc") returned 0
	[0070.958] lstrlenA (lpString="*.doc") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.docx") returned 0
	[0070.958] lstrlenA (lpString="*.docx") returned 6
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.xls") returned 0
	[0070.958] lstrlenA (lpString="*.xls") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.xlsx") returned 0
	[0070.958] lstrlenA (lpString="*.xlsx") returned 6
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.ppt") returned 0
	[0070.958] lstrlenA (lpString="*.ppt") returned 5
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.pptx") returned 0
	[0070.958] lstrlenA (lpString="*.pptx") returned 6
	[0070.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.txt") returned 0
	[0070.959] lstrlenA (lpString="*.txt") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.pdf") returned 0
	[0070.959] lstrlenA (lpString="*.pdf") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.djvu") returned 0
	[0070.959] lstrlenA (lpString="*.djvu") returned 6
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.htm") returned 0
	[0070.959] lstrlenA (lpString="*.htm") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.html") returned 0
	[0070.959] lstrlenA (lpString="*.html") returned 6
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mdb") returned 0
	[0070.959] lstrlenA (lpString="*.mdb") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.cer") returned 0
	[0070.959] lstrlenA (lpString="*.cer") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.p12") returned 0
	[0070.959] lstrlenA (lpString="*.p12") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.pfx") returned 0
	[0070.959] lstrlenA (lpString="*.pfx") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.kwm") returned 0
	[0070.959] lstrlenA (lpString="*.kwm") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.pwm") returned 0
	[0070.959] lstrlenA (lpString="*.pwm") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.1cd") returned 0
	[0070.959] lstrlenA (lpString="*.1cd") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.md") returned 0
	[0070.959] lstrlenA (lpString="*.md") returned 4
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mdf") returned 0
	[0070.959] lstrlenA (lpString="*.mdf") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.dbf") returned 0
	[0070.959] lstrlenA (lpString="*.dbf") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.odt") returned 0
	[0070.959] lstrlenA (lpString="*.odt") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.vob") returned 0
	[0070.959] lstrlenA (lpString="*.vob") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.ifo") returned 0
	[0070.959] lstrlenA (lpString="*.ifo") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.lnk") returned 0
	[0070.959] lstrlenA (lpString="*.lnk") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.torrent") returned 0
	[0070.959] lstrlenA (lpString="*.torrent") returned 9
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mov") returned 0
	[0070.959] lstrlenA (lpString="*.mov") returned 5
	[0070.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.m2v") returned 0
	[0070.960] lstrlenA (lpString="*.m2v") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.3gp") returned 0
	[0070.960] lstrlenA (lpString="*.3gp") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mpeg") returned 0
	[0070.960] lstrlenA (lpString="*.mpeg") returned 6
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mpg") returned 0
	[0070.960] lstrlenA (lpString="*.mpg") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.flv") returned 0
	[0070.960] lstrlenA (lpString="*.flv") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.avi") returned 0
	[0070.960] lstrlenA (lpString="*.avi") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mp4") returned 0
	[0070.960] lstrlenA (lpString="*.mp4") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.wmv") returned 0
	[0070.960] lstrlenA (lpString="*.wmv") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.divx") returned 0
	[0070.960] lstrlenA (lpString="*.divx") returned 6
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mkv") returned 0
	[0070.960] lstrlenA (lpString="*.mkv") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.mp3") returned 0
	[0070.960] lstrlenA (lpString="*.mp3") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.wav") returned 0
	[0070.960] lstrlenA (lpString="*.wav") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.flac") returned 0
	[0070.960] lstrlenA (lpString="*.flac") returned 6
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.ape") returned 0
	[0070.960] lstrlenA (lpString="*.ape") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.wma") returned 0
	[0070.960] lstrlenA (lpString="*.wma") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.ac3") returned 0
	[0070.960] lstrlenA (lpString="*.ac3") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.exe") returned 0
	[0070.960] lstrlenA (lpString="*.exe") returned 5
	[0070.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", pszSpec="*.apk") returned 0
	[0070.960] lstrlenA (lpString="*.apk") returned 5
	[0070.960] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.960] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.960] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONLNTCOMLIB.DLL") returned -1
	[0070.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONLNTCOMLIB.DLL") returned -1
	[0070.960] lstrcmpiA (lpString1="", lpString2="ONLNTCOMLIB.DLL") returned -1
	[0070.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned="ONFILTER.DLL"
	[0070.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONLNTCOMLIB.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL"
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.zip") returned 0
	[0070.961] lstrlenA (lpString="*.zip") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.rar") returned 0
	[0070.961] lstrlenA (lpString="*.rar") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.7z") returned 0
	[0070.961] lstrlenA (lpString="*.7z") returned 4
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.tar") returned 0
	[0070.961] lstrlenA (lpString="*.tar") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.gzip") returned 0
	[0070.961] lstrlenA (lpString="*.gzip") returned 6
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.jpg") returned 0
	[0070.961] lstrlenA (lpString="*.jpg") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.jpeg") returned 0
	[0070.961] lstrlenA (lpString="*.jpeg") returned 6
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.psd") returned 0
	[0070.961] lstrlenA (lpString="*.psd") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.cdr") returned 0
	[0070.961] lstrlenA (lpString="*.cdr") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.dwg") returned 0
	[0070.961] lstrlenA (lpString="*.dwg") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.max") returned 0
	[0070.961] lstrlenA (lpString="*.max") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.bmp") returned 0
	[0070.961] lstrlenA (lpString="*.bmp") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.gif") returned 0
	[0070.961] lstrlenA (lpString="*.gif") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.png") returned 0
	[0070.961] lstrlenA (lpString="*.png") returned 5
	[0070.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.doc") returned 0
	[0070.961] lstrlenA (lpString="*.doc") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.docx") returned 0
	[0070.962] lstrlenA (lpString="*.docx") returned 6
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.xls") returned 0
	[0070.962] lstrlenA (lpString="*.xls") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.xlsx") returned 0
	[0070.962] lstrlenA (lpString="*.xlsx") returned 6
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.ppt") returned 0
	[0070.962] lstrlenA (lpString="*.ppt") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.pptx") returned 0
	[0070.962] lstrlenA (lpString="*.pptx") returned 6
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.txt") returned 0
	[0070.962] lstrlenA (lpString="*.txt") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.pdf") returned 0
	[0070.962] lstrlenA (lpString="*.pdf") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.djvu") returned 0
	[0070.962] lstrlenA (lpString="*.djvu") returned 6
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.htm") returned 0
	[0070.962] lstrlenA (lpString="*.htm") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.html") returned 0
	[0070.962] lstrlenA (lpString="*.html") returned 6
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mdb") returned 0
	[0070.962] lstrlenA (lpString="*.mdb") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.cer") returned 0
	[0070.962] lstrlenA (lpString="*.cer") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.p12") returned 0
	[0070.962] lstrlenA (lpString="*.p12") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.pfx") returned 0
	[0070.962] lstrlenA (lpString="*.pfx") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.kwm") returned 0
	[0070.962] lstrlenA (lpString="*.kwm") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.pwm") returned 0
	[0070.962] lstrlenA (lpString="*.pwm") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.1cd") returned 0
	[0070.962] lstrlenA (lpString="*.1cd") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.md") returned 0
	[0070.962] lstrlenA (lpString="*.md") returned 4
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mdf") returned 0
	[0070.962] lstrlenA (lpString="*.mdf") returned 5
	[0070.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.dbf") returned 0
	[0070.963] lstrlenA (lpString="*.dbf") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.odt") returned 0
	[0070.963] lstrlenA (lpString="*.odt") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.vob") returned 0
	[0070.963] lstrlenA (lpString="*.vob") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.ifo") returned 0
	[0070.963] lstrlenA (lpString="*.ifo") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.lnk") returned 0
	[0070.963] lstrlenA (lpString="*.lnk") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.torrent") returned 0
	[0070.963] lstrlenA (lpString="*.torrent") returned 9
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mov") returned 0
	[0070.963] lstrlenA (lpString="*.mov") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.m2v") returned 0
	[0070.963] lstrlenA (lpString="*.m2v") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.3gp") returned 0
	[0070.963] lstrlenA (lpString="*.3gp") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mpeg") returned 0
	[0070.963] lstrlenA (lpString="*.mpeg") returned 6
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mpg") returned 0
	[0070.963] lstrlenA (lpString="*.mpg") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.flv") returned 0
	[0070.963] lstrlenA (lpString="*.flv") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.avi") returned 0
	[0070.963] lstrlenA (lpString="*.avi") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mp4") returned 0
	[0070.963] lstrlenA (lpString="*.mp4") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.wmv") returned 0
	[0070.963] lstrlenA (lpString="*.wmv") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.divx") returned 0
	[0070.963] lstrlenA (lpString="*.divx") returned 6
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mkv") returned 0
	[0070.963] lstrlenA (lpString="*.mkv") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.mp3") returned 0
	[0070.963] lstrlenA (lpString="*.mp3") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.wav") returned 0
	[0070.963] lstrlenA (lpString="*.wav") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.flac") returned 0
	[0070.963] lstrlenA (lpString="*.flac") returned 6
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.ape") returned 0
	[0070.963] lstrlenA (lpString="*.ape") returned 5
	[0070.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.wma") returned 0
	[0070.963] lstrlenA (lpString="*.wma") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.ac3") returned 0
	[0070.964] lstrlenA (lpString="*.ac3") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.exe") returned 0
	[0070.964] lstrlenA (lpString="*.exe") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", pszSpec="*.apk") returned 0
	[0070.964] lstrlenA (lpString="*.apk") returned 5
	[0070.964] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.964] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.964] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONMAIN.DLL") returned -1
	[0070.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONMAIN.DLL") returned -1
	[0070.964] lstrcmpiA (lpString1="", lpString2="ONMAIN.DLL") returned -1
	[0070.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned="ONLNTCOMLIB.DLL"
	[0070.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.964] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.964] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONMAIN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL"
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.zip") returned 0
	[0070.964] lstrlenA (lpString="*.zip") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.rar") returned 0
	[0070.964] lstrlenA (lpString="*.rar") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.7z") returned 0
	[0070.964] lstrlenA (lpString="*.7z") returned 4
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.tar") returned 0
	[0070.964] lstrlenA (lpString="*.tar") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.gzip") returned 0
	[0070.964] lstrlenA (lpString="*.gzip") returned 6
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.jpg") returned 0
	[0070.964] lstrlenA (lpString="*.jpg") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.jpeg") returned 0
	[0070.964] lstrlenA (lpString="*.jpeg") returned 6
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.psd") returned 0
	[0070.964] lstrlenA (lpString="*.psd") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.cdr") returned 0
	[0070.964] lstrlenA (lpString="*.cdr") returned 5
	[0070.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.dwg") returned 0
	[0070.964] lstrlenA (lpString="*.dwg") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.max") returned 0
	[0070.965] lstrlenA (lpString="*.max") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.bmp") returned 0
	[0070.965] lstrlenA (lpString="*.bmp") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.gif") returned 0
	[0070.965] lstrlenA (lpString="*.gif") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.png") returned 0
	[0070.965] lstrlenA (lpString="*.png") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.doc") returned 0
	[0070.965] lstrlenA (lpString="*.doc") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.docx") returned 0
	[0070.965] lstrlenA (lpString="*.docx") returned 6
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.xls") returned 0
	[0070.965] lstrlenA (lpString="*.xls") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.xlsx") returned 0
	[0070.965] lstrlenA (lpString="*.xlsx") returned 6
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.ppt") returned 0
	[0070.965] lstrlenA (lpString="*.ppt") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.pptx") returned 0
	[0070.965] lstrlenA (lpString="*.pptx") returned 6
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.txt") returned 0
	[0070.965] lstrlenA (lpString="*.txt") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.pdf") returned 0
	[0070.965] lstrlenA (lpString="*.pdf") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.djvu") returned 0
	[0070.965] lstrlenA (lpString="*.djvu") returned 6
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.htm") returned 0
	[0070.965] lstrlenA (lpString="*.htm") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.html") returned 0
	[0070.965] lstrlenA (lpString="*.html") returned 6
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mdb") returned 0
	[0070.965] lstrlenA (lpString="*.mdb") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.cer") returned 0
	[0070.965] lstrlenA (lpString="*.cer") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.p12") returned 0
	[0070.965] lstrlenA (lpString="*.p12") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.pfx") returned 0
	[0070.965] lstrlenA (lpString="*.pfx") returned 5
	[0070.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.kwm") returned 0
	[0070.965] lstrlenA (lpString="*.kwm") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.pwm") returned 0
	[0070.966] lstrlenA (lpString="*.pwm") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.1cd") returned 0
	[0070.966] lstrlenA (lpString="*.1cd") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.md") returned 0
	[0070.966] lstrlenA (lpString="*.md") returned 4
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mdf") returned 0
	[0070.966] lstrlenA (lpString="*.mdf") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.dbf") returned 0
	[0070.966] lstrlenA (lpString="*.dbf") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.odt") returned 0
	[0070.966] lstrlenA (lpString="*.odt") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.vob") returned 0
	[0070.966] lstrlenA (lpString="*.vob") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.ifo") returned 0
	[0070.966] lstrlenA (lpString="*.ifo") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.lnk") returned 0
	[0070.966] lstrlenA (lpString="*.lnk") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.torrent") returned 0
	[0070.966] lstrlenA (lpString="*.torrent") returned 9
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mov") returned 0
	[0070.966] lstrlenA (lpString="*.mov") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.m2v") returned 0
	[0070.966] lstrlenA (lpString="*.m2v") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.3gp") returned 0
	[0070.966] lstrlenA (lpString="*.3gp") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mpeg") returned 0
	[0070.966] lstrlenA (lpString="*.mpeg") returned 6
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mpg") returned 0
	[0070.966] lstrlenA (lpString="*.mpg") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.flv") returned 0
	[0070.966] lstrlenA (lpString="*.flv") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.avi") returned 0
	[0070.966] lstrlenA (lpString="*.avi") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mp4") returned 0
	[0070.966] lstrlenA (lpString="*.mp4") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.wmv") returned 0
	[0070.966] lstrlenA (lpString="*.wmv") returned 5
	[0070.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.divx") returned 0
	[0070.967] lstrlenA (lpString="*.divx") returned 6
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mkv") returned 0
	[0070.967] lstrlenA (lpString="*.mkv") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.mp3") returned 0
	[0070.967] lstrlenA (lpString="*.mp3") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.wav") returned 0
	[0070.967] lstrlenA (lpString="*.wav") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.flac") returned 0
	[0070.967] lstrlenA (lpString="*.flac") returned 6
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.ape") returned 0
	[0070.967] lstrlenA (lpString="*.ape") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.wma") returned 0
	[0070.967] lstrlenA (lpString="*.wma") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.ac3") returned 0
	[0070.967] lstrlenA (lpString="*.ac3") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.exe") returned 0
	[0070.967] lstrlenA (lpString="*.exe") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", pszSpec="*.apk") returned 0
	[0070.967] lstrlenA (lpString="*.apk") returned 5
	[0070.967] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.967] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONPPTAddin.dll") returned -1
	[0070.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONPPTAddin.dll") returned -1
	[0070.967] lstrcmpiA (lpString1="", lpString2="ONPPTAddin.dll") returned -1
	[0070.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned="ONMAIN.DLL"
	[0070.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.967] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.967] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONPPTAddin.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll"
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.zip") returned 0
	[0070.967] lstrlenA (lpString="*.zip") returned 5
	[0070.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.rar") returned 0
	[0070.967] lstrlenA (lpString="*.rar") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.7z") returned 0
	[0070.968] lstrlenA (lpString="*.7z") returned 4
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.tar") returned 0
	[0070.968] lstrlenA (lpString="*.tar") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.gzip") returned 0
	[0070.968] lstrlenA (lpString="*.gzip") returned 6
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.jpg") returned 0
	[0070.968] lstrlenA (lpString="*.jpg") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.jpeg") returned 0
	[0070.968] lstrlenA (lpString="*.jpeg") returned 6
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.psd") returned 0
	[0070.968] lstrlenA (lpString="*.psd") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.cdr") returned 0
	[0070.968] lstrlenA (lpString="*.cdr") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.dwg") returned 0
	[0070.968] lstrlenA (lpString="*.dwg") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.max") returned 0
	[0070.968] lstrlenA (lpString="*.max") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.bmp") returned 0
	[0070.968] lstrlenA (lpString="*.bmp") returned 5
	[0070.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", pszSpec="*.gif") returned 0
	[0070.968] lstrlenA (lpString="*.gif") returned 5
	[0070.968] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.968] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.969] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONWordAddin.dll") returned -1
	[0070.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONWordAddin.dll") returned -1
	[0070.969] lstrcmpiA (lpString1="", lpString2="ONWordAddin.dll") returned -1
	[0070.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned="ONPPTAddin.dll"
	[0070.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONWordAddin.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll"
	[0070.969] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.969] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.969] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ORGCHART.DLL") returned -1
	[0070.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORGCHART.DLL") returned -1
	[0070.969] lstrcmpiA (lpString1="", lpString2="ORGCHART.DLL") returned -1
	[0070.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned="ONWordAddin.dll"
	[0070.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORGCHART.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL"
	[0070.969] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.969] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.969] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ORGCHWIZ.DLL") returned -1
	[0070.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORGCHWIZ.DLL") returned -1
	[0070.969] lstrcmpiA (lpString1="", lpString2="ORGCHWIZ.DLL") returned -1
	[0070.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned="ORGCHART.DLL"
	[0070.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.970] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORGCHWIZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL"
	[0070.970] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0070.970] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0070.970] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ORGWIZ.EXE") returned -1
	[0070.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORGWIZ.EXE") returned -1
	[0070.970] lstrcmpiA (lpString1="", lpString2="ORGWIZ.EXE") returned -1
	[0070.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned="ORGCHWIZ.DLL"
	[0070.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0070.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0070.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0070.970] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0070.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORGWIZ.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE"
	[0070.970] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE"
	[0070.970] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE"
	[0070.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE."
	[0070.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.Boom"
	[0070.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0070.971] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14590
	[0070.971] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11ca6e00, dwHighDateTime=0x1cb701e), lpLastAccessTime=0x407536*(dwLowDateTime=0xd64609a0, dwHighDateTime=0x1d305eb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11ca6e00, dwHighDateTime=0x1cb701e)) returned 1
	[0070.971] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0070.971] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1456d, lpOverlapped=0x0) returned 1
	[0071.019] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned="ORGWIZ.EXE"
	[0071.019] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.019] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1456d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1456d, lpOverlapped=0x0) returned 1
	[0071.019] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0071.020] CloseHandle (hObject=0x88) returned 1
	[0071.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe.boom")) returned 1
	[0071.020] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.020] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.021] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ORMELEMS.DLL") returned -1
	[0071.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORMELEMS.DLL") returned -1
	[0071.021] lstrcmpiA (lpString1="", lpString2="ORMELEMS.DLL") returned -1
	[0071.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned="ORGWIZ.EXE"
	[0071.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORMELEMS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL"
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.zip") returned 0
	[0071.021] lstrlenA (lpString="*.zip") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.rar") returned 0
	[0071.021] lstrlenA (lpString="*.rar") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.7z") returned 0
	[0071.021] lstrlenA (lpString="*.7z") returned 4
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.tar") returned 0
	[0071.021] lstrlenA (lpString="*.tar") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.gzip") returned 0
	[0071.021] lstrlenA (lpString="*.gzip") returned 6
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.jpg") returned 0
	[0071.021] lstrlenA (lpString="*.jpg") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.jpeg") returned 0
	[0071.021] lstrlenA (lpString="*.jpeg") returned 6
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.psd") returned 0
	[0071.021] lstrlenA (lpString="*.psd") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.cdr") returned 0
	[0071.021] lstrlenA (lpString="*.cdr") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.dwg") returned 0
	[0071.021] lstrlenA (lpString="*.dwg") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.max") returned 0
	[0071.021] lstrlenA (lpString="*.max") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.bmp") returned 0
	[0071.021] lstrlenA (lpString="*.bmp") returned 5
	[0071.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.gif") returned 0
	[0071.021] lstrlenA (lpString="*.gif") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.png") returned 0
	[0071.022] lstrlenA (lpString="*.png") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.doc") returned 0
	[0071.022] lstrlenA (lpString="*.doc") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.docx") returned 0
	[0071.022] lstrlenA (lpString="*.docx") returned 6
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.xls") returned 0
	[0071.022] lstrlenA (lpString="*.xls") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.xlsx") returned 0
	[0071.022] lstrlenA (lpString="*.xlsx") returned 6
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.ppt") returned 0
	[0071.022] lstrlenA (lpString="*.ppt") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.pptx") returned 0
	[0071.022] lstrlenA (lpString="*.pptx") returned 6
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.txt") returned 0
	[0071.022] lstrlenA (lpString="*.txt") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.pdf") returned 0
	[0071.022] lstrlenA (lpString="*.pdf") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.djvu") returned 0
	[0071.022] lstrlenA (lpString="*.djvu") returned 6
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.htm") returned 0
	[0071.022] lstrlenA (lpString="*.htm") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.html") returned 0
	[0071.022] lstrlenA (lpString="*.html") returned 6
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mdb") returned 0
	[0071.022] lstrlenA (lpString="*.mdb") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.cer") returned 0
	[0071.022] lstrlenA (lpString="*.cer") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.p12") returned 0
	[0071.022] lstrlenA (lpString="*.p12") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.pfx") returned 0
	[0071.022] lstrlenA (lpString="*.pfx") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.kwm") returned 0
	[0071.022] lstrlenA (lpString="*.kwm") returned 5
	[0071.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.pwm") returned 0
	[0071.022] lstrlenA (lpString="*.pwm") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.1cd") returned 0
	[0071.023] lstrlenA (lpString="*.1cd") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.md") returned 0
	[0071.023] lstrlenA (lpString="*.md") returned 4
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mdf") returned 0
	[0071.023] lstrlenA (lpString="*.mdf") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.dbf") returned 0
	[0071.023] lstrlenA (lpString="*.dbf") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.odt") returned 0
	[0071.023] lstrlenA (lpString="*.odt") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.vob") returned 0
	[0071.023] lstrlenA (lpString="*.vob") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.ifo") returned 0
	[0071.023] lstrlenA (lpString="*.ifo") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.lnk") returned 0
	[0071.023] lstrlenA (lpString="*.lnk") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.torrent") returned 0
	[0071.023] lstrlenA (lpString="*.torrent") returned 9
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mov") returned 0
	[0071.023] lstrlenA (lpString="*.mov") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.m2v") returned 0
	[0071.023] lstrlenA (lpString="*.m2v") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.3gp") returned 0
	[0071.023] lstrlenA (lpString="*.3gp") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mpeg") returned 0
	[0071.023] lstrlenA (lpString="*.mpeg") returned 6
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mpg") returned 0
	[0071.023] lstrlenA (lpString="*.mpg") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.flv") returned 0
	[0071.023] lstrlenA (lpString="*.flv") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.avi") returned 0
	[0071.023] lstrlenA (lpString="*.avi") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mp4") returned 0
	[0071.023] lstrlenA (lpString="*.mp4") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.wmv") returned 0
	[0071.023] lstrlenA (lpString="*.wmv") returned 5
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.divx") returned 0
	[0071.023] lstrlenA (lpString="*.divx") returned 6
	[0071.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mkv") returned 0
	[0071.024] lstrlenA (lpString="*.mkv") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.mp3") returned 0
	[0071.024] lstrlenA (lpString="*.mp3") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.wav") returned 0
	[0071.024] lstrlenA (lpString="*.wav") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.flac") returned 0
	[0071.024] lstrlenA (lpString="*.flac") returned 6
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.ape") returned 0
	[0071.024] lstrlenA (lpString="*.ape") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.wma") returned 0
	[0071.024] lstrlenA (lpString="*.wma") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.ac3") returned 0
	[0071.024] lstrlenA (lpString="*.ac3") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.exe") returned 0
	[0071.024] lstrlenA (lpString="*.exe") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", pszSpec="*.apk") returned 0
	[0071.024] lstrlenA (lpString="*.apk") returned 5
	[0071.024] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.024] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ORMMODEL.MDL") returned -1
	[0071.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORMMODEL.MDL") returned -1
	[0071.024] lstrcmpiA (lpString1="", lpString2="ORMMODEL.MDL") returned -1
	[0071.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned="ORMELEMS.DLL"
	[0071.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORMMODEL.MDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL"
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.zip") returned 0
	[0071.024] lstrlenA (lpString="*.zip") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.rar") returned 0
	[0071.024] lstrlenA (lpString="*.rar") returned 5
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.7z") returned 0
	[0071.024] lstrlenA (lpString="*.7z") returned 4
	[0071.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.tar") returned 0
	[0071.024] lstrlenA (lpString="*.tar") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.gzip") returned 0
	[0071.025] lstrlenA (lpString="*.gzip") returned 6
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.jpg") returned 0
	[0071.025] lstrlenA (lpString="*.jpg") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.jpeg") returned 0
	[0071.025] lstrlenA (lpString="*.jpeg") returned 6
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.psd") returned 0
	[0071.025] lstrlenA (lpString="*.psd") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.cdr") returned 0
	[0071.025] lstrlenA (lpString="*.cdr") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.dwg") returned 0
	[0071.025] lstrlenA (lpString="*.dwg") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.max") returned 0
	[0071.025] lstrlenA (lpString="*.max") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.bmp") returned 0
	[0071.025] lstrlenA (lpString="*.bmp") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.gif") returned 0
	[0071.025] lstrlenA (lpString="*.gif") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.png") returned 0
	[0071.025] lstrlenA (lpString="*.png") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.doc") returned 0
	[0071.025] lstrlenA (lpString="*.doc") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.docx") returned 0
	[0071.025] lstrlenA (lpString="*.docx") returned 6
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.xls") returned 0
	[0071.025] lstrlenA (lpString="*.xls") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.xlsx") returned 0
	[0071.025] lstrlenA (lpString="*.xlsx") returned 6
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.ppt") returned 0
	[0071.025] lstrlenA (lpString="*.ppt") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.pptx") returned 0
	[0071.025] lstrlenA (lpString="*.pptx") returned 6
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.txt") returned 0
	[0071.025] lstrlenA (lpString="*.txt") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.pdf") returned 0
	[0071.025] lstrlenA (lpString="*.pdf") returned 5
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.djvu") returned 0
	[0071.025] lstrlenA (lpString="*.djvu") returned 6
	[0071.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.htm") returned 0
	[0071.025] lstrlenA (lpString="*.htm") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.html") returned 0
	[0071.026] lstrlenA (lpString="*.html") returned 6
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mdb") returned 0
	[0071.026] lstrlenA (lpString="*.mdb") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.cer") returned 0
	[0071.026] lstrlenA (lpString="*.cer") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.p12") returned 0
	[0071.026] lstrlenA (lpString="*.p12") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.pfx") returned 0
	[0071.026] lstrlenA (lpString="*.pfx") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.kwm") returned 0
	[0071.026] lstrlenA (lpString="*.kwm") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.pwm") returned 0
	[0071.026] lstrlenA (lpString="*.pwm") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.1cd") returned 0
	[0071.026] lstrlenA (lpString="*.1cd") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.md") returned 0
	[0071.026] lstrlenA (lpString="*.md") returned 4
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mdf") returned 0
	[0071.026] lstrlenA (lpString="*.mdf") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.dbf") returned 0
	[0071.026] lstrlenA (lpString="*.dbf") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.odt") returned 0
	[0071.026] lstrlenA (lpString="*.odt") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.vob") returned 0
	[0071.026] lstrlenA (lpString="*.vob") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.ifo") returned 0
	[0071.026] lstrlenA (lpString="*.ifo") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.lnk") returned 0
	[0071.026] lstrlenA (lpString="*.lnk") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.torrent") returned 0
	[0071.026] lstrlenA (lpString="*.torrent") returned 9
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mov") returned 0
	[0071.026] lstrlenA (lpString="*.mov") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.m2v") returned 0
	[0071.026] lstrlenA (lpString="*.m2v") returned 5
	[0071.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.3gp") returned 0
	[0071.026] lstrlenA (lpString="*.3gp") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mpeg") returned 0
	[0071.027] lstrlenA (lpString="*.mpeg") returned 6
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mpg") returned 0
	[0071.027] lstrlenA (lpString="*.mpg") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.flv") returned 0
	[0071.027] lstrlenA (lpString="*.flv") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.avi") returned 0
	[0071.027] lstrlenA (lpString="*.avi") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mp4") returned 0
	[0071.027] lstrlenA (lpString="*.mp4") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.wmv") returned 0
	[0071.027] lstrlenA (lpString="*.wmv") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.divx") returned 0
	[0071.027] lstrlenA (lpString="*.divx") returned 6
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mkv") returned 0
	[0071.027] lstrlenA (lpString="*.mkv") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.mp3") returned 0
	[0071.027] lstrlenA (lpString="*.mp3") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.wav") returned 0
	[0071.027] lstrlenA (lpString="*.wav") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.flac") returned 0
	[0071.027] lstrlenA (lpString="*.flac") returned 6
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.ape") returned 0
	[0071.027] lstrlenA (lpString="*.ape") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.wma") returned 0
	[0071.027] lstrlenA (lpString="*.wma") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.ac3") returned 0
	[0071.027] lstrlenA (lpString="*.ac3") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.exe") returned 0
	[0071.027] lstrlenA (lpString="*.exe") returned 5
	[0071.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", pszSpec="*.apk") returned 0
	[0071.027] lstrlenA (lpString="*.apk") returned 5
	[0071.027] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.027] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSPP.HTM") returned -1
	[0071.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSPP.HTM") returned -1
	[0071.027] lstrcmpiA (lpString1="", lpString2="OSPP.HTM") returned -1
	[0071.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned="ORMMODEL.MDL"
	[0071.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OSPP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM"
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.zip") returned 0
	[0071.028] lstrlenA (lpString="*.zip") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.rar") returned 0
	[0071.028] lstrlenA (lpString="*.rar") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.7z") returned 0
	[0071.028] lstrlenA (lpString="*.7z") returned 4
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.tar") returned 0
	[0071.028] lstrlenA (lpString="*.tar") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.gzip") returned 0
	[0071.028] lstrlenA (lpString="*.gzip") returned 6
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.jpg") returned 0
	[0071.028] lstrlenA (lpString="*.jpg") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.jpeg") returned 0
	[0071.028] lstrlenA (lpString="*.jpeg") returned 6
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.psd") returned 0
	[0071.028] lstrlenA (lpString="*.psd") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.cdr") returned 0
	[0071.028] lstrlenA (lpString="*.cdr") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.dwg") returned 0
	[0071.028] lstrlenA (lpString="*.dwg") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.max") returned 0
	[0071.028] lstrlenA (lpString="*.max") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.bmp") returned 0
	[0071.028] lstrlenA (lpString="*.bmp") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.gif") returned 0
	[0071.028] lstrlenA (lpString="*.gif") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.png") returned 0
	[0071.028] lstrlenA (lpString="*.png") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.doc") returned 0
	[0071.028] lstrlenA (lpString="*.doc") returned 5
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.docx") returned 0
	[0071.028] lstrlenA (lpString="*.docx") returned 6
	[0071.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.xls") returned 0
	[0071.029] lstrlenA (lpString="*.xls") returned 5
	[0071.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.xlsx") returned 0
	[0071.029] lstrlenA (lpString="*.xlsx") returned 6
	[0071.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.ppt") returned 0
	[0071.029] lstrlenA (lpString="*.ppt") returned 5
	[0071.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.pptx") returned 0
	[0071.029] lstrlenA (lpString="*.pptx") returned 6
	[0071.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.txt") returned 0
	[0071.029] lstrlenA (lpString="*.txt") returned 5
	[0071.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.pdf") returned 0
	[0071.029] lstrlenA (lpString="*.pdf") returned 5
	[0071.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.djvu") returned 0
	[0071.029] lstrlenA (lpString="*.djvu") returned 6
	[0071.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", pszSpec="*.htm") returned 1
	[0071.029] lstrlenA (lpString="*.htm") returned 5
	[0071.029] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM"
	[0071.029] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM"
	[0071.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM."
	[0071.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.Boom"
	[0071.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0071.031] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d05
	[0071.031] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84eac400, dwHighDateTime=0x1cabc89), lpLastAccessTime=0x407536*(dwLowDateTime=0x6c23c830, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84eac400, dwHighDateTime=0x1cabc89)) returned 1
	[0071.031] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.031] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x3ce2, lpOverlapped=0x0) returned 1
	[0071.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="OSPP.HTM"
	[0071.065] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.065] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x3ce2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x3ce2, lpOverlapped=0x0) returned 1
	[0071.066] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0071.066] CloseHandle (hObject=0x88) returned 1
	[0071.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.boom")) returned 1
	[0071.067] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.067] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.067] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSPP.VBS") returned -1
	[0071.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSPP.VBS") returned -1
	[0071.067] lstrcmpiA (lpString1="", lpString2="OSPP.VBS") returned -1
	[0071.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="OSPP.HTM"
	[0071.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OSPP.VBS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS"
	[0071.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.zip") returned 0
	[0071.067] lstrlenA (lpString="*.zip") returned 5
	[0071.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.rar") returned 0
	[0071.067] lstrlenA (lpString="*.rar") returned 5
	[0071.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.7z") returned 0
	[0071.067] lstrlenA (lpString="*.7z") returned 4
	[0071.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.tar") returned 0
	[0071.067] lstrlenA (lpString="*.tar") returned 5
	[0071.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.gzip") returned 0
	[0071.067] lstrlenA (lpString="*.gzip") returned 6
	[0071.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.jpg") returned 0
	[0071.068] lstrlenA (lpString="*.jpg") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.jpeg") returned 0
	[0071.068] lstrlenA (lpString="*.jpeg") returned 6
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.psd") returned 0
	[0071.068] lstrlenA (lpString="*.psd") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.cdr") returned 0
	[0071.068] lstrlenA (lpString="*.cdr") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.dwg") returned 0
	[0071.068] lstrlenA (lpString="*.dwg") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.max") returned 0
	[0071.068] lstrlenA (lpString="*.max") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.bmp") returned 0
	[0071.068] lstrlenA (lpString="*.bmp") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.gif") returned 0
	[0071.068] lstrlenA (lpString="*.gif") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.png") returned 0
	[0071.068] lstrlenA (lpString="*.png") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.doc") returned 0
	[0071.068] lstrlenA (lpString="*.doc") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.docx") returned 0
	[0071.068] lstrlenA (lpString="*.docx") returned 6
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.xls") returned 0
	[0071.068] lstrlenA (lpString="*.xls") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.xlsx") returned 0
	[0071.068] lstrlenA (lpString="*.xlsx") returned 6
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ppt") returned 0
	[0071.068] lstrlenA (lpString="*.ppt") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pptx") returned 0
	[0071.068] lstrlenA (lpString="*.pptx") returned 6
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.txt") returned 0
	[0071.068] lstrlenA (lpString="*.txt") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pdf") returned 0
	[0071.068] lstrlenA (lpString="*.pdf") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.djvu") returned 0
	[0071.068] lstrlenA (lpString="*.djvu") returned 6
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.htm") returned 0
	[0071.068] lstrlenA (lpString="*.htm") returned 5
	[0071.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.html") returned 0
	[0071.068] lstrlenA (lpString="*.html") returned 6
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mdb") returned 0
	[0071.069] lstrlenA (lpString="*.mdb") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.cer") returned 0
	[0071.069] lstrlenA (lpString="*.cer") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.p12") returned 0
	[0071.069] lstrlenA (lpString="*.p12") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pfx") returned 0
	[0071.069] lstrlenA (lpString="*.pfx") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.kwm") returned 0
	[0071.069] lstrlenA (lpString="*.kwm") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pwm") returned 0
	[0071.069] lstrlenA (lpString="*.pwm") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.1cd") returned 0
	[0071.069] lstrlenA (lpString="*.1cd") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.md") returned 0
	[0071.069] lstrlenA (lpString="*.md") returned 4
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mdf") returned 0
	[0071.069] lstrlenA (lpString="*.mdf") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.dbf") returned 0
	[0071.069] lstrlenA (lpString="*.dbf") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.odt") returned 0
	[0071.069] lstrlenA (lpString="*.odt") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.vob") returned 0
	[0071.069] lstrlenA (lpString="*.vob") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ifo") returned 0
	[0071.069] lstrlenA (lpString="*.ifo") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.lnk") returned 0
	[0071.069] lstrlenA (lpString="*.lnk") returned 5
	[0071.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.torrent") returned 0
	[0071.070] lstrlenA (lpString="*.torrent") returned 9
	[0071.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mov") returned 0
	[0071.070] lstrlenA (lpString="*.mov") returned 5
	[0071.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.m2v") returned 0
	[0071.070] lstrlenA (lpString="*.m2v") returned 5
	[0071.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.3gp") returned 0
	[0071.070] lstrlenA (lpString="*.3gp") returned 5
	[0071.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mpeg") returned 0
	[0071.070] lstrlenA (lpString="*.mpeg") returned 6
	[0071.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mpg") returned 0
	[0071.071] lstrlenA (lpString="*.mpg") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.flv") returned 0
	[0071.071] lstrlenA (lpString="*.flv") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.avi") returned 0
	[0071.071] lstrlenA (lpString="*.avi") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mp4") returned 0
	[0071.071] lstrlenA (lpString="*.mp4") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.wmv") returned 0
	[0071.071] lstrlenA (lpString="*.wmv") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.divx") returned 0
	[0071.071] lstrlenA (lpString="*.divx") returned 6
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mkv") returned 0
	[0071.071] lstrlenA (lpString="*.mkv") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mp3") returned 0
	[0071.071] lstrlenA (lpString="*.mp3") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.wav") returned 0
	[0071.071] lstrlenA (lpString="*.wav") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.flac") returned 0
	[0071.071] lstrlenA (lpString="*.flac") returned 6
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ape") returned 0
	[0071.071] lstrlenA (lpString="*.ape") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.wma") returned 0
	[0071.071] lstrlenA (lpString="*.wma") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ac3") returned 0
	[0071.071] lstrlenA (lpString="*.ac3") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.exe") returned 0
	[0071.071] lstrlenA (lpString="*.exe") returned 5
	[0071.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.apk") returned 0
	[0071.071] lstrlenA (lpString="*.apk") returned 5
	[0071.071] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.071] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.071] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLACCT.DLL") returned -1
	[0071.071] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLACCT.DLL") returned -1
	[0071.071] lstrcmpiA (lpString1="", lpString2="OUTLACCT.DLL") returned -1
	[0071.071] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned="OSPP.VBS"
	[0071.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.071] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.071] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLACCT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL"
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.zip") returned 0
	[0071.072] lstrlenA (lpString="*.zip") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.rar") returned 0
	[0071.072] lstrlenA (lpString="*.rar") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.7z") returned 0
	[0071.072] lstrlenA (lpString="*.7z") returned 4
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.tar") returned 0
	[0071.072] lstrlenA (lpString="*.tar") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.gzip") returned 0
	[0071.072] lstrlenA (lpString="*.gzip") returned 6
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.jpg") returned 0
	[0071.072] lstrlenA (lpString="*.jpg") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.jpeg") returned 0
	[0071.072] lstrlenA (lpString="*.jpeg") returned 6
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.psd") returned 0
	[0071.072] lstrlenA (lpString="*.psd") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.cdr") returned 0
	[0071.072] lstrlenA (lpString="*.cdr") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.dwg") returned 0
	[0071.072] lstrlenA (lpString="*.dwg") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.max") returned 0
	[0071.072] lstrlenA (lpString="*.max") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.bmp") returned 0
	[0071.072] lstrlenA (lpString="*.bmp") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.gif") returned 0
	[0071.072] lstrlenA (lpString="*.gif") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.png") returned 0
	[0071.072] lstrlenA (lpString="*.png") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.doc") returned 0
	[0071.072] lstrlenA (lpString="*.doc") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.docx") returned 0
	[0071.072] lstrlenA (lpString="*.docx") returned 6
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.xls") returned 0
	[0071.072] lstrlenA (lpString="*.xls") returned 5
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.xlsx") returned 0
	[0071.072] lstrlenA (lpString="*.xlsx") returned 6
	[0071.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ppt") returned 0
	[0071.072] lstrlenA (lpString="*.ppt") returned 5
	[0071.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pptx") returned 0
	[0071.109] lstrlenA (lpString="*.pptx") returned 6
	[0071.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.txt") returned 0
	[0071.133] lstrlenA (lpString="*.txt") returned 5
	[0071.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pdf") returned 0
	[0071.133] lstrlenA (lpString="*.pdf") returned 5
	[0071.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.djvu") returned 0
	[0071.133] lstrlenA (lpString="*.djvu") returned 6
	[0071.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.htm") returned 0
	[0071.133] lstrlenA (lpString="*.htm") returned 5
	[0071.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.html") returned 0
	[0071.134] lstrlenA (lpString="*.html") returned 6
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mdb") returned 0
	[0071.134] lstrlenA (lpString="*.mdb") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.cer") returned 0
	[0071.134] lstrlenA (lpString="*.cer") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.p12") returned 0
	[0071.134] lstrlenA (lpString="*.p12") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pfx") returned 0
	[0071.134] lstrlenA (lpString="*.pfx") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.kwm") returned 0
	[0071.134] lstrlenA (lpString="*.kwm") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pwm") returned 0
	[0071.134] lstrlenA (lpString="*.pwm") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.1cd") returned 0
	[0071.134] lstrlenA (lpString="*.1cd") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.md") returned 0
	[0071.134] lstrlenA (lpString="*.md") returned 4
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mdf") returned 0
	[0071.134] lstrlenA (lpString="*.mdf") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.dbf") returned 0
	[0071.134] lstrlenA (lpString="*.dbf") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.odt") returned 0
	[0071.134] lstrlenA (lpString="*.odt") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.vob") returned 0
	[0071.134] lstrlenA (lpString="*.vob") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ifo") returned 0
	[0071.134] lstrlenA (lpString="*.ifo") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.lnk") returned 0
	[0071.134] lstrlenA (lpString="*.lnk") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.torrent") returned 0
	[0071.134] lstrlenA (lpString="*.torrent") returned 9
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mov") returned 0
	[0071.134] lstrlenA (lpString="*.mov") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.m2v") returned 0
	[0071.134] lstrlenA (lpString="*.m2v") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.3gp") returned 0
	[0071.134] lstrlenA (lpString="*.3gp") returned 5
	[0071.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mpeg") returned 0
	[0071.135] lstrlenA (lpString="*.mpeg") returned 6
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mpg") returned 0
	[0071.135] lstrlenA (lpString="*.mpg") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.flv") returned 0
	[0071.135] lstrlenA (lpString="*.flv") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.avi") returned 0
	[0071.135] lstrlenA (lpString="*.avi") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mp4") returned 0
	[0071.135] lstrlenA (lpString="*.mp4") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.wmv") returned 0
	[0071.135] lstrlenA (lpString="*.wmv") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.divx") returned 0
	[0071.135] lstrlenA (lpString="*.divx") returned 6
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mkv") returned 0
	[0071.135] lstrlenA (lpString="*.mkv") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mp3") returned 0
	[0071.135] lstrlenA (lpString="*.mp3") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.wav") returned 0
	[0071.135] lstrlenA (lpString="*.wav") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.flac") returned 0
	[0071.135] lstrlenA (lpString="*.flac") returned 6
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ape") returned 0
	[0071.135] lstrlenA (lpString="*.ape") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.wma") returned 0
	[0071.135] lstrlenA (lpString="*.wma") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ac3") returned 0
	[0071.135] lstrlenA (lpString="*.ac3") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.exe") returned 0
	[0071.135] lstrlenA (lpString="*.exe") returned 5
	[0071.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.apk") returned 0
	[0071.135] lstrlenA (lpString="*.apk") returned 5
	[0071.135] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.135] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLCTL.DLL") returned -1
	[0071.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLCTL.DLL") returned -1
	[0071.135] lstrcmpiA (lpString1="", lpString2="OUTLCTL.DLL") returned -1
	[0071.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned="OUTLACCT.DLL"
	[0071.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLCTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL"
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.zip") returned 0
	[0071.136] lstrlenA (lpString="*.zip") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.rar") returned 0
	[0071.136] lstrlenA (lpString="*.rar") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.7z") returned 0
	[0071.136] lstrlenA (lpString="*.7z") returned 4
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.tar") returned 0
	[0071.136] lstrlenA (lpString="*.tar") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.gzip") returned 0
	[0071.136] lstrlenA (lpString="*.gzip") returned 6
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.jpg") returned 0
	[0071.136] lstrlenA (lpString="*.jpg") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.jpeg") returned 0
	[0071.136] lstrlenA (lpString="*.jpeg") returned 6
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.psd") returned 0
	[0071.136] lstrlenA (lpString="*.psd") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.cdr") returned 0
	[0071.136] lstrlenA (lpString="*.cdr") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.dwg") returned 0
	[0071.136] lstrlenA (lpString="*.dwg") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.max") returned 0
	[0071.136] lstrlenA (lpString="*.max") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.bmp") returned 0
	[0071.136] lstrlenA (lpString="*.bmp") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.gif") returned 0
	[0071.136] lstrlenA (lpString="*.gif") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.png") returned 0
	[0071.136] lstrlenA (lpString="*.png") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.doc") returned 0
	[0071.136] lstrlenA (lpString="*.doc") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.docx") returned 0
	[0071.136] lstrlenA (lpString="*.docx") returned 6
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.xls") returned 0
	[0071.136] lstrlenA (lpString="*.xls") returned 5
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.xlsx") returned 0
	[0071.136] lstrlenA (lpString="*.xlsx") returned 6
	[0071.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ppt") returned 0
	[0071.136] lstrlenA (lpString="*.ppt") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pptx") returned 0
	[0071.137] lstrlenA (lpString="*.pptx") returned 6
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.txt") returned 0
	[0071.137] lstrlenA (lpString="*.txt") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pdf") returned 0
	[0071.137] lstrlenA (lpString="*.pdf") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.djvu") returned 0
	[0071.137] lstrlenA (lpString="*.djvu") returned 6
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.htm") returned 0
	[0071.137] lstrlenA (lpString="*.htm") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.html") returned 0
	[0071.137] lstrlenA (lpString="*.html") returned 6
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mdb") returned 0
	[0071.137] lstrlenA (lpString="*.mdb") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.cer") returned 0
	[0071.137] lstrlenA (lpString="*.cer") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.p12") returned 0
	[0071.137] lstrlenA (lpString="*.p12") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pfx") returned 0
	[0071.137] lstrlenA (lpString="*.pfx") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.kwm") returned 0
	[0071.137] lstrlenA (lpString="*.kwm") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pwm") returned 0
	[0071.137] lstrlenA (lpString="*.pwm") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.1cd") returned 0
	[0071.137] lstrlenA (lpString="*.1cd") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.md") returned 0
	[0071.137] lstrlenA (lpString="*.md") returned 4
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mdf") returned 0
	[0071.137] lstrlenA (lpString="*.mdf") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.dbf") returned 0
	[0071.137] lstrlenA (lpString="*.dbf") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.odt") returned 0
	[0071.137] lstrlenA (lpString="*.odt") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.vob") returned 0
	[0071.137] lstrlenA (lpString="*.vob") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ifo") returned 0
	[0071.137] lstrlenA (lpString="*.ifo") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.lnk") returned 0
	[0071.137] lstrlenA (lpString="*.lnk") returned 5
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.torrent") returned 0
	[0071.137] lstrlenA (lpString="*.torrent") returned 9
	[0071.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mov") returned 0
	[0071.137] lstrlenA (lpString="*.mov") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.m2v") returned 0
	[0071.138] lstrlenA (lpString="*.m2v") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.3gp") returned 0
	[0071.138] lstrlenA (lpString="*.3gp") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mpeg") returned 0
	[0071.138] lstrlenA (lpString="*.mpeg") returned 6
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mpg") returned 0
	[0071.138] lstrlenA (lpString="*.mpg") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.flv") returned 0
	[0071.138] lstrlenA (lpString="*.flv") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.avi") returned 0
	[0071.138] lstrlenA (lpString="*.avi") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mp4") returned 0
	[0071.138] lstrlenA (lpString="*.mp4") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.wmv") returned 0
	[0071.138] lstrlenA (lpString="*.wmv") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.divx") returned 0
	[0071.138] lstrlenA (lpString="*.divx") returned 6
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mkv") returned 0
	[0071.138] lstrlenA (lpString="*.mkv") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mp3") returned 0
	[0071.138] lstrlenA (lpString="*.mp3") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.wav") returned 0
	[0071.138] lstrlenA (lpString="*.wav") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.flac") returned 0
	[0071.138] lstrlenA (lpString="*.flac") returned 6
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ape") returned 0
	[0071.138] lstrlenA (lpString="*.ape") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.wma") returned 0
	[0071.138] lstrlenA (lpString="*.wma") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ac3") returned 0
	[0071.138] lstrlenA (lpString="*.ac3") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.exe") returned 0
	[0071.138] lstrlenA (lpString="*.exe") returned 5
	[0071.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.apk") returned 0
	[0071.138] lstrlenA (lpString="*.apk") returned 5
	[0071.138] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.138] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.138] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLFLTR.DAT") returned -1
	[0071.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLFLTR.DAT") returned -1
	[0071.138] lstrcmpiA (lpString1="", lpString2="OUTLFLTR.DAT") returned -1
	[0071.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned="OUTLCTL.DLL"
	[0071.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.139] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.139] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.139] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLFLTR.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT"
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.zip") returned 0
	[0071.139] lstrlenA (lpString="*.zip") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.rar") returned 0
	[0071.139] lstrlenA (lpString="*.rar") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.7z") returned 0
	[0071.139] lstrlenA (lpString="*.7z") returned 4
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.tar") returned 0
	[0071.139] lstrlenA (lpString="*.tar") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.gzip") returned 0
	[0071.139] lstrlenA (lpString="*.gzip") returned 6
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.jpg") returned 0
	[0071.139] lstrlenA (lpString="*.jpg") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.jpeg") returned 0
	[0071.139] lstrlenA (lpString="*.jpeg") returned 6
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.psd") returned 0
	[0071.139] lstrlenA (lpString="*.psd") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.cdr") returned 0
	[0071.139] lstrlenA (lpString="*.cdr") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.dwg") returned 0
	[0071.139] lstrlenA (lpString="*.dwg") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.max") returned 0
	[0071.139] lstrlenA (lpString="*.max") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.bmp") returned 0
	[0071.139] lstrlenA (lpString="*.bmp") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.gif") returned 0
	[0071.139] lstrlenA (lpString="*.gif") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.png") returned 0
	[0071.139] lstrlenA (lpString="*.png") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.doc") returned 0
	[0071.139] lstrlenA (lpString="*.doc") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.docx") returned 0
	[0071.139] lstrlenA (lpString="*.docx") returned 6
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.xls") returned 0
	[0071.139] lstrlenA (lpString="*.xls") returned 5
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.xlsx") returned 0
	[0071.139] lstrlenA (lpString="*.xlsx") returned 6
	[0071.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ppt") returned 0
	[0071.139] lstrlenA (lpString="*.ppt") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pptx") returned 0
	[0071.140] lstrlenA (lpString="*.pptx") returned 6
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.txt") returned 0
	[0071.140] lstrlenA (lpString="*.txt") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pdf") returned 0
	[0071.140] lstrlenA (lpString="*.pdf") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.djvu") returned 0
	[0071.140] lstrlenA (lpString="*.djvu") returned 6
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.htm") returned 0
	[0071.140] lstrlenA (lpString="*.htm") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.html") returned 0
	[0071.140] lstrlenA (lpString="*.html") returned 6
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mdb") returned 0
	[0071.140] lstrlenA (lpString="*.mdb") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.cer") returned 0
	[0071.140] lstrlenA (lpString="*.cer") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.p12") returned 0
	[0071.140] lstrlenA (lpString="*.p12") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pfx") returned 0
	[0071.140] lstrlenA (lpString="*.pfx") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.kwm") returned 0
	[0071.140] lstrlenA (lpString="*.kwm") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pwm") returned 0
	[0071.140] lstrlenA (lpString="*.pwm") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.1cd") returned 0
	[0071.140] lstrlenA (lpString="*.1cd") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.md") returned 0
	[0071.140] lstrlenA (lpString="*.md") returned 4
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mdf") returned 0
	[0071.140] lstrlenA (lpString="*.mdf") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.dbf") returned 0
	[0071.140] lstrlenA (lpString="*.dbf") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.odt") returned 0
	[0071.140] lstrlenA (lpString="*.odt") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.vob") returned 0
	[0071.140] lstrlenA (lpString="*.vob") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ifo") returned 0
	[0071.140] lstrlenA (lpString="*.ifo") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.lnk") returned 0
	[0071.140] lstrlenA (lpString="*.lnk") returned 5
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.torrent") returned 0
	[0071.140] lstrlenA (lpString="*.torrent") returned 9
	[0071.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mov") returned 0
	[0071.141] lstrlenA (lpString="*.mov") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.m2v") returned 0
	[0071.141] lstrlenA (lpString="*.m2v") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.3gp") returned 0
	[0071.141] lstrlenA (lpString="*.3gp") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mpeg") returned 0
	[0071.141] lstrlenA (lpString="*.mpeg") returned 6
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mpg") returned 0
	[0071.141] lstrlenA (lpString="*.mpg") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.flv") returned 0
	[0071.141] lstrlenA (lpString="*.flv") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.avi") returned 0
	[0071.141] lstrlenA (lpString="*.avi") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mp4") returned 0
	[0071.141] lstrlenA (lpString="*.mp4") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.wmv") returned 0
	[0071.141] lstrlenA (lpString="*.wmv") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.divx") returned 0
	[0071.141] lstrlenA (lpString="*.divx") returned 6
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mkv") returned 0
	[0071.141] lstrlenA (lpString="*.mkv") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mp3") returned 0
	[0071.141] lstrlenA (lpString="*.mp3") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.wav") returned 0
	[0071.141] lstrlenA (lpString="*.wav") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.flac") returned 0
	[0071.141] lstrlenA (lpString="*.flac") returned 6
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ape") returned 0
	[0071.141] lstrlenA (lpString="*.ape") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.wma") returned 0
	[0071.141] lstrlenA (lpString="*.wma") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ac3") returned 0
	[0071.141] lstrlenA (lpString="*.ac3") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.exe") returned 0
	[0071.141] lstrlenA (lpString="*.exe") returned 5
	[0071.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.apk") returned 0
	[0071.141] lstrlenA (lpString="*.apk") returned 5
	[0071.141] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.141] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.141] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLFLTR.DLL") returned -1
	[0071.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLFLTR.DLL") returned -1
	[0071.141] lstrcmpiA (lpString1="", lpString2="OUTLFLTR.DLL") returned -1
	[0071.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned="OUTLFLTR.DAT"
	[0071.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLFLTR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL"
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.zip") returned 0
	[0071.142] lstrlenA (lpString="*.zip") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.rar") returned 0
	[0071.142] lstrlenA (lpString="*.rar") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.7z") returned 0
	[0071.142] lstrlenA (lpString="*.7z") returned 4
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.tar") returned 0
	[0071.142] lstrlenA (lpString="*.tar") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.gzip") returned 0
	[0071.142] lstrlenA (lpString="*.gzip") returned 6
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.jpg") returned 0
	[0071.142] lstrlenA (lpString="*.jpg") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.jpeg") returned 0
	[0071.142] lstrlenA (lpString="*.jpeg") returned 6
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.psd") returned 0
	[0071.142] lstrlenA (lpString="*.psd") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.cdr") returned 0
	[0071.142] lstrlenA (lpString="*.cdr") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.dwg") returned 0
	[0071.142] lstrlenA (lpString="*.dwg") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.max") returned 0
	[0071.142] lstrlenA (lpString="*.max") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.bmp") returned 0
	[0071.142] lstrlenA (lpString="*.bmp") returned 5
	[0071.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.gif") returned 0
	[0071.142] lstrlenA (lpString="*.gif") returned 5
	[0071.142] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLMIME.DLL") returned -1
	[0071.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLMIME.DLL") returned -1
	[0071.143] lstrcmpiA (lpString1="", lpString2="OUTLMIME.DLL") returned -1
	[0071.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned="OUTLFLTR.DLL"
	[0071.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLMIME.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL"
	[0071.143] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLOOK.EXE") returned -1
	[0071.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.EXE") returned -1
	[0071.143] lstrcmpiA (lpString1="", lpString2="OUTLOOK.EXE") returned -1
	[0071.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned="OUTLMIME.DLL"
	[0071.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLOOK.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"
	[0071.143] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"
	[0071.143] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"
	[0071.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE."
	[0071.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.Boom") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.Boom"
	[0071.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0071.144] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x175ed60
	[0071.144] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x34af8800, dwHighDateTime=0x1caca25), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cc5a5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x34af8800, dwHighDateTime=0x1caca25)) returned 1
	[0071.144] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.144] ReadFile (in: hFile=0x88, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x17539b, lpOverlapped=0x0) returned 1
	[0071.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned="OUTLOOK.EXE"
	[0071.202] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.202] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0071.216] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0071.216] CloseHandle (hObject=0x88) returned 1
	[0071.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.boom")) returned 1
	[0071.217] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.217] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.217] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLOOK.EXE.MANIFEST") returned -1
	[0071.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.EXE.MANIFEST") returned -1
	[0071.217] lstrcmpiA (lpString1="", lpString2="OUTLOOK.EXE.MANIFEST") returned -1
	[0071.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned="OUTLOOK.EXE"
	[0071.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLOOK.EXE.MANIFEST" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST"
	[0071.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.zip") returned 0
	[0071.217] lstrlenA (lpString="*.zip") returned 5
	[0071.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.rar") returned 0
	[0071.217] lstrlenA (lpString="*.rar") returned 5
	[0071.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.7z") returned 0
	[0071.217] lstrlenA (lpString="*.7z") returned 4
	[0071.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.tar") returned 0
	[0071.218] lstrlenA (lpString="*.tar") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.gzip") returned 0
	[0071.218] lstrlenA (lpString="*.gzip") returned 6
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.jpg") returned 0
	[0071.218] lstrlenA (lpString="*.jpg") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.jpeg") returned 0
	[0071.218] lstrlenA (lpString="*.jpeg") returned 6
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.psd") returned 0
	[0071.218] lstrlenA (lpString="*.psd") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.cdr") returned 0
	[0071.218] lstrlenA (lpString="*.cdr") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.dwg") returned 0
	[0071.218] lstrlenA (lpString="*.dwg") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.max") returned 0
	[0071.218] lstrlenA (lpString="*.max") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.bmp") returned 0
	[0071.218] lstrlenA (lpString="*.bmp") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.gif") returned 0
	[0071.218] lstrlenA (lpString="*.gif") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.png") returned 0
	[0071.218] lstrlenA (lpString="*.png") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.doc") returned 0
	[0071.218] lstrlenA (lpString="*.doc") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.docx") returned 0
	[0071.218] lstrlenA (lpString="*.docx") returned 6
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.xls") returned 0
	[0071.218] lstrlenA (lpString="*.xls") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.xlsx") returned 0
	[0071.218] lstrlenA (lpString="*.xlsx") returned 6
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.ppt") returned 0
	[0071.218] lstrlenA (lpString="*.ppt") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.pptx") returned 0
	[0071.218] lstrlenA (lpString="*.pptx") returned 6
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.txt") returned 0
	[0071.218] lstrlenA (lpString="*.txt") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.pdf") returned 0
	[0071.218] lstrlenA (lpString="*.pdf") returned 5
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.djvu") returned 0
	[0071.218] lstrlenA (lpString="*.djvu") returned 6
	[0071.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.htm") returned 0
	[0071.218] lstrlenA (lpString="*.htm") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.html") returned 0
	[0071.219] lstrlenA (lpString="*.html") returned 6
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mdb") returned 0
	[0071.219] lstrlenA (lpString="*.mdb") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.cer") returned 0
	[0071.219] lstrlenA (lpString="*.cer") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.p12") returned 0
	[0071.219] lstrlenA (lpString="*.p12") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.pfx") returned 0
	[0071.219] lstrlenA (lpString="*.pfx") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.kwm") returned 0
	[0071.219] lstrlenA (lpString="*.kwm") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.pwm") returned 0
	[0071.219] lstrlenA (lpString="*.pwm") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.1cd") returned 0
	[0071.219] lstrlenA (lpString="*.1cd") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.md") returned 0
	[0071.219] lstrlenA (lpString="*.md") returned 4
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mdf") returned 0
	[0071.219] lstrlenA (lpString="*.mdf") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.dbf") returned 0
	[0071.219] lstrlenA (lpString="*.dbf") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.odt") returned 0
	[0071.219] lstrlenA (lpString="*.odt") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.vob") returned 0
	[0071.219] lstrlenA (lpString="*.vob") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.ifo") returned 0
	[0071.219] lstrlenA (lpString="*.ifo") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.lnk") returned 0
	[0071.219] lstrlenA (lpString="*.lnk") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.torrent") returned 0
	[0071.219] lstrlenA (lpString="*.torrent") returned 9
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mov") returned 0
	[0071.219] lstrlenA (lpString="*.mov") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.m2v") returned 0
	[0071.219] lstrlenA (lpString="*.m2v") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.3gp") returned 0
	[0071.219] lstrlenA (lpString="*.3gp") returned 5
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mpeg") returned 0
	[0071.219] lstrlenA (lpString="*.mpeg") returned 6
	[0071.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mpg") returned 0
	[0071.219] lstrlenA (lpString="*.mpg") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.flv") returned 0
	[0071.220] lstrlenA (lpString="*.flv") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.avi") returned 0
	[0071.220] lstrlenA (lpString="*.avi") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mp4") returned 0
	[0071.220] lstrlenA (lpString="*.mp4") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.wmv") returned 0
	[0071.220] lstrlenA (lpString="*.wmv") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.divx") returned 0
	[0071.220] lstrlenA (lpString="*.divx") returned 6
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mkv") returned 0
	[0071.220] lstrlenA (lpString="*.mkv") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.mp3") returned 0
	[0071.220] lstrlenA (lpString="*.mp3") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.wav") returned 0
	[0071.220] lstrlenA (lpString="*.wav") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.flac") returned 0
	[0071.220] lstrlenA (lpString="*.flac") returned 6
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.ape") returned 0
	[0071.220] lstrlenA (lpString="*.ape") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.wma") returned 0
	[0071.220] lstrlenA (lpString="*.wma") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.ac3") returned 0
	[0071.220] lstrlenA (lpString="*.ac3") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.exe") returned 0
	[0071.220] lstrlenA (lpString="*.exe") returned 5
	[0071.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", pszSpec="*.apk") returned 0
	[0071.220] lstrlenA (lpString="*.apk") returned 5
	[0071.220] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.220] lstrcmpA (lpString1=".", lpString2="OutlookAutoDiscover") returned -1
	[0071.220] lstrcmpA (lpString1="..", lpString2="OutlookAutoDiscover") returned -1
	[0071.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned="OUTLOOK.EXE.MANIFEST"
	[0071.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OutlookAutoDiscover" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover"
	[0071.220] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned 62
	[0071.220] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0071.339] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0071.339] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.396] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0071.396] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0071.396] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.396] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.396] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AMERITECH.NET.XML") returned 1
	[0071.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AMERITECH.NET.XML") returned 1
	[0071.397] lstrcmpiA (lpString1="", lpString2="AMERITECH.NET.XML") returned -1
	[0071.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*.*") returned="*.*"
	[0071.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0xffffffff
	[0071.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0071.464] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0071.464] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0071.465] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0071.465] CloseHandle (hObject=0x8c) returned 1
	[0071.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="AMERITECH.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML"
	[0071.465] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.zip") returned 0
	[0071.466] lstrlenA (lpString="*.zip") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.rar") returned 0
	[0071.466] lstrlenA (lpString="*.rar") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.7z") returned 0
	[0071.466] lstrlenA (lpString="*.7z") returned 4
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.tar") returned 0
	[0071.466] lstrlenA (lpString="*.tar") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.gzip") returned 0
	[0071.466] lstrlenA (lpString="*.gzip") returned 6
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.jpg") returned 0
	[0071.466] lstrlenA (lpString="*.jpg") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.jpeg") returned 0
	[0071.466] lstrlenA (lpString="*.jpeg") returned 6
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.psd") returned 0
	[0071.466] lstrlenA (lpString="*.psd") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.cdr") returned 0
	[0071.466] lstrlenA (lpString="*.cdr") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.dwg") returned 0
	[0071.466] lstrlenA (lpString="*.dwg") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.max") returned 0
	[0071.466] lstrlenA (lpString="*.max") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.bmp") returned 0
	[0071.466] lstrlenA (lpString="*.bmp") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.gif") returned 0
	[0071.466] lstrlenA (lpString="*.gif") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.png") returned 0
	[0071.466] lstrlenA (lpString="*.png") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.doc") returned 0
	[0071.466] lstrlenA (lpString="*.doc") returned 5
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.docx") returned 0
	[0071.466] lstrlenA (lpString="*.docx") returned 6
	[0071.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.xls") returned 0
	[0071.466] lstrlenA (lpString="*.xls") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.xlsx") returned 0
	[0071.467] lstrlenA (lpString="*.xlsx") returned 6
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.ppt") returned 0
	[0071.467] lstrlenA (lpString="*.ppt") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.pptx") returned 0
	[0071.467] lstrlenA (lpString="*.pptx") returned 6
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.txt") returned 0
	[0071.467] lstrlenA (lpString="*.txt") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.pdf") returned 0
	[0071.467] lstrlenA (lpString="*.pdf") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.djvu") returned 0
	[0071.467] lstrlenA (lpString="*.djvu") returned 6
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.htm") returned 0
	[0071.467] lstrlenA (lpString="*.htm") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.html") returned 0
	[0071.467] lstrlenA (lpString="*.html") returned 6
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mdb") returned 0
	[0071.467] lstrlenA (lpString="*.mdb") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.cer") returned 0
	[0071.467] lstrlenA (lpString="*.cer") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.p12") returned 0
	[0071.467] lstrlenA (lpString="*.p12") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.pfx") returned 0
	[0071.467] lstrlenA (lpString="*.pfx") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.kwm") returned 0
	[0071.467] lstrlenA (lpString="*.kwm") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.pwm") returned 0
	[0071.467] lstrlenA (lpString="*.pwm") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.1cd") returned 0
	[0071.467] lstrlenA (lpString="*.1cd") returned 5
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.md") returned 0
	[0071.467] lstrlenA (lpString="*.md") returned 4
	[0071.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mdf") returned 0
	[0071.467] lstrlenA (lpString="*.mdf") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.dbf") returned 0
	[0071.468] lstrlenA (lpString="*.dbf") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.odt") returned 0
	[0071.468] lstrlenA (lpString="*.odt") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.vob") returned 0
	[0071.468] lstrlenA (lpString="*.vob") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.ifo") returned 0
	[0071.468] lstrlenA (lpString="*.ifo") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.lnk") returned 0
	[0071.468] lstrlenA (lpString="*.lnk") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.torrent") returned 0
	[0071.468] lstrlenA (lpString="*.torrent") returned 9
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mov") returned 0
	[0071.468] lstrlenA (lpString="*.mov") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.m2v") returned 0
	[0071.468] lstrlenA (lpString="*.m2v") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.3gp") returned 0
	[0071.468] lstrlenA (lpString="*.3gp") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mpeg") returned 0
	[0071.468] lstrlenA (lpString="*.mpeg") returned 6
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mpg") returned 0
	[0071.468] lstrlenA (lpString="*.mpg") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.flv") returned 0
	[0071.468] lstrlenA (lpString="*.flv") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.avi") returned 0
	[0071.468] lstrlenA (lpString="*.avi") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mp4") returned 0
	[0071.468] lstrlenA (lpString="*.mp4") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.wmv") returned 0
	[0071.468] lstrlenA (lpString="*.wmv") returned 5
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.divx") returned 0
	[0071.468] lstrlenA (lpString="*.divx") returned 6
	[0071.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mkv") returned 0
	[0071.468] lstrlenA (lpString="*.mkv") returned 5
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.mp3") returned 0
	[0071.469] lstrlenA (lpString="*.mp3") returned 5
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.wav") returned 0
	[0071.469] lstrlenA (lpString="*.wav") returned 5
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.flac") returned 0
	[0071.469] lstrlenA (lpString="*.flac") returned 6
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.ape") returned 0
	[0071.469] lstrlenA (lpString="*.ape") returned 5
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.wma") returned 0
	[0071.469] lstrlenA (lpString="*.wma") returned 5
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.ac3") returned 0
	[0071.469] lstrlenA (lpString="*.ac3") returned 5
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.exe") returned 0
	[0071.469] lstrlenA (lpString="*.exe") returned 5
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", pszSpec="*.apk") returned 0
	[0071.469] lstrlenA (lpString="*.apk") returned 5
	[0071.469] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.469] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BTINTERNET.NET.XML") returned 1
	[0071.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BTINTERNET.NET.XML") returned 1
	[0071.469] lstrcmpiA (lpString1="", lpString2="BTINTERNET.NET.XML") returned -1
	[0071.469] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned="AMERITECH.NET.XML"
	[0071.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.469] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.469] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="BTINTERNET.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML"
	[0071.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.zip") returned 0
	[0071.469] lstrlenA (lpString="*.zip") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.rar") returned 0
	[0071.470] lstrlenA (lpString="*.rar") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.7z") returned 0
	[0071.470] lstrlenA (lpString="*.7z") returned 4
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.tar") returned 0
	[0071.470] lstrlenA (lpString="*.tar") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.gzip") returned 0
	[0071.470] lstrlenA (lpString="*.gzip") returned 6
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.jpg") returned 0
	[0071.470] lstrlenA (lpString="*.jpg") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.jpeg") returned 0
	[0071.470] lstrlenA (lpString="*.jpeg") returned 6
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.psd") returned 0
	[0071.470] lstrlenA (lpString="*.psd") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.cdr") returned 0
	[0071.470] lstrlenA (lpString="*.cdr") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.dwg") returned 0
	[0071.470] lstrlenA (lpString="*.dwg") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.max") returned 0
	[0071.470] lstrlenA (lpString="*.max") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.bmp") returned 0
	[0071.470] lstrlenA (lpString="*.bmp") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.gif") returned 0
	[0071.470] lstrlenA (lpString="*.gif") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.png") returned 0
	[0071.470] lstrlenA (lpString="*.png") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.doc") returned 0
	[0071.470] lstrlenA (lpString="*.doc") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.docx") returned 0
	[0071.470] lstrlenA (lpString="*.docx") returned 6
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.xls") returned 0
	[0071.470] lstrlenA (lpString="*.xls") returned 5
	[0071.470] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.xlsx") returned 0
	[0071.470] lstrlenA (lpString="*.xlsx") returned 6
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.ppt") returned 0
	[0071.471] lstrlenA (lpString="*.ppt") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.pptx") returned 0
	[0071.471] lstrlenA (lpString="*.pptx") returned 6
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.txt") returned 0
	[0071.471] lstrlenA (lpString="*.txt") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.pdf") returned 0
	[0071.471] lstrlenA (lpString="*.pdf") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.djvu") returned 0
	[0071.471] lstrlenA (lpString="*.djvu") returned 6
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.htm") returned 0
	[0071.471] lstrlenA (lpString="*.htm") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.html") returned 0
	[0071.471] lstrlenA (lpString="*.html") returned 6
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mdb") returned 0
	[0071.471] lstrlenA (lpString="*.mdb") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.cer") returned 0
	[0071.471] lstrlenA (lpString="*.cer") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.p12") returned 0
	[0071.471] lstrlenA (lpString="*.p12") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.pfx") returned 0
	[0071.471] lstrlenA (lpString="*.pfx") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.kwm") returned 0
	[0071.471] lstrlenA (lpString="*.kwm") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.pwm") returned 0
	[0071.471] lstrlenA (lpString="*.pwm") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.1cd") returned 0
	[0071.471] lstrlenA (lpString="*.1cd") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.md") returned 0
	[0071.471] lstrlenA (lpString="*.md") returned 4
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mdf") returned 0
	[0071.471] lstrlenA (lpString="*.mdf") returned 5
	[0071.471] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.dbf") returned 0
	[0071.471] lstrlenA (lpString="*.dbf") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.odt") returned 0
	[0071.472] lstrlenA (lpString="*.odt") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.vob") returned 0
	[0071.472] lstrlenA (lpString="*.vob") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.ifo") returned 0
	[0071.472] lstrlenA (lpString="*.ifo") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.lnk") returned 0
	[0071.472] lstrlenA (lpString="*.lnk") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.torrent") returned 0
	[0071.472] lstrlenA (lpString="*.torrent") returned 9
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mov") returned 0
	[0071.472] lstrlenA (lpString="*.mov") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.m2v") returned 0
	[0071.472] lstrlenA (lpString="*.m2v") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.3gp") returned 0
	[0071.472] lstrlenA (lpString="*.3gp") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mpeg") returned 0
	[0071.472] lstrlenA (lpString="*.mpeg") returned 6
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mpg") returned 0
	[0071.472] lstrlenA (lpString="*.mpg") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.flv") returned 0
	[0071.472] lstrlenA (lpString="*.flv") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.avi") returned 0
	[0071.472] lstrlenA (lpString="*.avi") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mp4") returned 0
	[0071.472] lstrlenA (lpString="*.mp4") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.wmv") returned 0
	[0071.472] lstrlenA (lpString="*.wmv") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.divx") returned 0
	[0071.472] lstrlenA (lpString="*.divx") returned 6
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mkv") returned 0
	[0071.472] lstrlenA (lpString="*.mkv") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.mp3") returned 0
	[0071.472] lstrlenA (lpString="*.mp3") returned 5
	[0071.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.wav") returned 0
	[0071.473] lstrlenA (lpString="*.wav") returned 5
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.flac") returned 0
	[0071.473] lstrlenA (lpString="*.flac") returned 6
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.ape") returned 0
	[0071.473] lstrlenA (lpString="*.ape") returned 5
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.wma") returned 0
	[0071.473] lstrlenA (lpString="*.wma") returned 5
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.ac3") returned 0
	[0071.473] lstrlenA (lpString="*.ac3") returned 5
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.exe") returned 0
	[0071.473] lstrlenA (lpString="*.exe") returned 5
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", pszSpec="*.apk") returned 0
	[0071.473] lstrlenA (lpString="*.apk") returned 5
	[0071.473] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.473] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.473] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BTOPENWORLD.COM.XML") returned 1
	[0071.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BTOPENWORLD.COM.XML") returned 1
	[0071.473] lstrcmpiA (lpString1="", lpString2="BTOPENWORLD.COM.XML") returned -1
	[0071.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML") returned="BTINTERNET.NET.XML"
	[0071.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.473] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.473] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="BTOPENWORLD.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML"
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.zip") returned 0
	[0071.473] lstrlenA (lpString="*.zip") returned 5
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.rar") returned 0
	[0071.473] lstrlenA (lpString="*.rar") returned 5
	[0071.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.7z") returned 0
	[0071.474] lstrlenA (lpString="*.7z") returned 4
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.tar") returned 0
	[0071.474] lstrlenA (lpString="*.tar") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.gzip") returned 0
	[0071.474] lstrlenA (lpString="*.gzip") returned 6
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.jpg") returned 0
	[0071.474] lstrlenA (lpString="*.jpg") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.jpeg") returned 0
	[0071.474] lstrlenA (lpString="*.jpeg") returned 6
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.psd") returned 0
	[0071.474] lstrlenA (lpString="*.psd") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.cdr") returned 0
	[0071.474] lstrlenA (lpString="*.cdr") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.dwg") returned 0
	[0071.474] lstrlenA (lpString="*.dwg") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.max") returned 0
	[0071.474] lstrlenA (lpString="*.max") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.bmp") returned 0
	[0071.474] lstrlenA (lpString="*.bmp") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.gif") returned 0
	[0071.474] lstrlenA (lpString="*.gif") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.png") returned 0
	[0071.474] lstrlenA (lpString="*.png") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.doc") returned 0
	[0071.474] lstrlenA (lpString="*.doc") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.docx") returned 0
	[0071.474] lstrlenA (lpString="*.docx") returned 6
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.xls") returned 0
	[0071.474] lstrlenA (lpString="*.xls") returned 5
	[0071.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.xlsx") returned 0
	[0071.475] lstrlenA (lpString="*.xlsx") returned 6
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.ppt") returned 0
	[0071.475] lstrlenA (lpString="*.ppt") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.pptx") returned 0
	[0071.475] lstrlenA (lpString="*.pptx") returned 6
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.txt") returned 0
	[0071.475] lstrlenA (lpString="*.txt") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.pdf") returned 0
	[0071.475] lstrlenA (lpString="*.pdf") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.djvu") returned 0
	[0071.475] lstrlenA (lpString="*.djvu") returned 6
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.htm") returned 0
	[0071.475] lstrlenA (lpString="*.htm") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.html") returned 0
	[0071.475] lstrlenA (lpString="*.html") returned 6
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mdb") returned 0
	[0071.475] lstrlenA (lpString="*.mdb") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.cer") returned 0
	[0071.475] lstrlenA (lpString="*.cer") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.p12") returned 0
	[0071.475] lstrlenA (lpString="*.p12") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.pfx") returned 0
	[0071.475] lstrlenA (lpString="*.pfx") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.kwm") returned 0
	[0071.475] lstrlenA (lpString="*.kwm") returned 5
	[0071.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.pwm") returned 0
	[0071.476] lstrlenA (lpString="*.pwm") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.1cd") returned 0
	[0071.476] lstrlenA (lpString="*.1cd") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.md") returned 0
	[0071.476] lstrlenA (lpString="*.md") returned 4
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mdf") returned 0
	[0071.476] lstrlenA (lpString="*.mdf") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.dbf") returned 0
	[0071.476] lstrlenA (lpString="*.dbf") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.odt") returned 0
	[0071.476] lstrlenA (lpString="*.odt") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.vob") returned 0
	[0071.476] lstrlenA (lpString="*.vob") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.ifo") returned 0
	[0071.476] lstrlenA (lpString="*.ifo") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.lnk") returned 0
	[0071.476] lstrlenA (lpString="*.lnk") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.torrent") returned 0
	[0071.476] lstrlenA (lpString="*.torrent") returned 9
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mov") returned 0
	[0071.476] lstrlenA (lpString="*.mov") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.m2v") returned 0
	[0071.476] lstrlenA (lpString="*.m2v") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.3gp") returned 0
	[0071.476] lstrlenA (lpString="*.3gp") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mpeg") returned 0
	[0071.476] lstrlenA (lpString="*.mpeg") returned 6
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mpg") returned 0
	[0071.476] lstrlenA (lpString="*.mpg") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.flv") returned 0
	[0071.476] lstrlenA (lpString="*.flv") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.avi") returned 0
	[0071.476] lstrlenA (lpString="*.avi") returned 5
	[0071.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mp4") returned 0
	[0071.477] lstrlenA (lpString="*.mp4") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.wmv") returned 0
	[0071.477] lstrlenA (lpString="*.wmv") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.divx") returned 0
	[0071.477] lstrlenA (lpString="*.divx") returned 6
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mkv") returned 0
	[0071.477] lstrlenA (lpString="*.mkv") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.mp3") returned 0
	[0071.477] lstrlenA (lpString="*.mp3") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.wav") returned 0
	[0071.477] lstrlenA (lpString="*.wav") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.flac") returned 0
	[0071.477] lstrlenA (lpString="*.flac") returned 6
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.ape") returned 0
	[0071.477] lstrlenA (lpString="*.ape") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.wma") returned 0
	[0071.477] lstrlenA (lpString="*.wma") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.ac3") returned 0
	[0071.477] lstrlenA (lpString="*.ac3") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.exe") returned 0
	[0071.477] lstrlenA (lpString="*.exe") returned 5
	[0071.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", pszSpec="*.apk") returned 0
	[0071.477] lstrlenA (lpString="*.apk") returned 5
	[0071.477] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.477] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.477] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FLASH.NET.XML") returned -1
	[0071.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FLASH.NET.XML") returned 1
	[0071.477] lstrcmpiA (lpString1="", lpString2="FLASH.NET.XML") returned -1
	[0071.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML") returned="BTOPENWORLD.COM.XML"
	[0071.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.478] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="FLASH.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML"
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.zip") returned 0
	[0071.478] lstrlenA (lpString="*.zip") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.rar") returned 0
	[0071.478] lstrlenA (lpString="*.rar") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.7z") returned 0
	[0071.478] lstrlenA (lpString="*.7z") returned 4
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.tar") returned 0
	[0071.478] lstrlenA (lpString="*.tar") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.gzip") returned 0
	[0071.478] lstrlenA (lpString="*.gzip") returned 6
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.jpg") returned 0
	[0071.478] lstrlenA (lpString="*.jpg") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.jpeg") returned 0
	[0071.478] lstrlenA (lpString="*.jpeg") returned 6
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.psd") returned 0
	[0071.478] lstrlenA (lpString="*.psd") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.cdr") returned 0
	[0071.478] lstrlenA (lpString="*.cdr") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.dwg") returned 0
	[0071.478] lstrlenA (lpString="*.dwg") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.max") returned 0
	[0071.478] lstrlenA (lpString="*.max") returned 5
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.bmp") returned 0
	[0071.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", pszSpec="*.gif") returned 0
	[0071.479] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.479] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL.ROGERS.COM.XML") returned -1
	[0071.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL.ROGERS.COM.XML") returned -1
	[0071.479] lstrcmpiA (lpString1="", lpString2="NL.ROGERS.COM.XML") returned -1
	[0071.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML") returned="FLASH.NET.XML"
	[0071.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.479] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.479] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="NL.ROGERS.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML"
	[0071.479] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.479] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NVBELL.NET.XML") returned -1
	[0071.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NVBELL.NET.XML") returned -1
	[0071.479] lstrcmpiA (lpString1="", lpString2="NVBELL.NET.XML") returned -1
	[0071.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML") returned="NL.ROGERS.COM.XML"
	[0071.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.479] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.479] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="NVBELL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML"
	[0071.480] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.480] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PACBELL.NET.XML") returned -1
	[0071.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PACBELL.NET.XML") returned -1
	[0071.480] lstrcmpiA (lpString1="", lpString2="PACBELL.NET.XML") returned -1
	[0071.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML") returned="NVBELL.NET.XML"
	[0071.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="PACBELL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML"
	[0071.480] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.480] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PRODIGY.NET.XML") returned -1
	[0071.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PRODIGY.NET.XML") returned -1
	[0071.480] lstrcmpiA (lpString1="", lpString2="PRODIGY.NET.XML") returned -1
	[0071.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML") returned="PACBELL.NET.XML"
	[0071.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="PRODIGY.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML"
	[0071.481] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.481] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ROGERS.COM.XML") returned -1
	[0071.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ROGERS.COM.XML") returned -1
	[0071.482] lstrcmpiA (lpString1="", lpString2="ROGERS.COM.XML") returned -1
	[0071.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML") returned="PRODIGY.NET.XML"
	[0071.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="ROGERS.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML"
	[0071.482] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.482] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.482] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SBCGLOBAL.NET.XML") returned -1
	[0071.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SBCGLOBAL.NET.XML") returned -1
	[0071.482] lstrcmpiA (lpString1="", lpString2="SBCGLOBAL.NET.XML") returned -1
	[0071.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML") returned="ROGERS.COM.XML"
	[0071.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="SBCGLOBAL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML"
	[0071.482] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.482] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.483] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SNET.NET.XML") returned -1
	[0071.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SNET.NET.XML") returned -1
	[0071.483] lstrcmpiA (lpString1="", lpString2="SNET.NET.XML") returned -1
	[0071.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML") returned="SBCGLOBAL.NET.XML"
	[0071.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="SNET.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML"
	[0071.483] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.483] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.483] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SWBELL.NET.XML") returned -1
	[0071.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SWBELL.NET.XML") returned -1
	[0071.483] lstrcmpiA (lpString1="", lpString2="SWBELL.NET.XML") returned -1
	[0071.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML") returned="SNET.NET.XML"
	[0071.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="SWBELL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML"
	[0071.483] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.483] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.483] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TALK21.COM.XML") returned -1
	[0071.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TALK21.COM.XML") returned -1
	[0071.483] lstrcmpiA (lpString1="", lpString2="TALK21.COM.XML") returned -1
	[0071.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML") returned="SWBELL.NET.XML"
	[0071.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="TALK21.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML"
	[0071.484] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.484] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.484] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WANS.NET.XML") returned -1
	[0071.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WANS.NET.XML") returned -1
	[0071.484] lstrcmpiA (lpString1="", lpString2="WANS.NET.XML") returned -1
	[0071.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML") returned="TALK21.COM.XML"
	[0071.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="WANS.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML"
	[0071.484] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.484] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.484] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CA.XML") returned -1
	[0071.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CA.XML") returned -1
	[0071.484] lstrcmpiA (lpString1="", lpString2="YAHOO.CA.XML") returned -1
	[0071.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML") returned="WANS.NET.XML"
	[0071.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CA.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML"
	[0071.485] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.485] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.485] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.ID.XML") returned -1
	[0071.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.ID.XML") returned -1
	[0071.485] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.ID.XML") returned -1
	[0071.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML") returned="YAHOO.CA.XML"
	[0071.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.ID.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML"
	[0071.485] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.485] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.485] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.IN.XML") returned -1
	[0071.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.IN.XML") returned -1
	[0071.485] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.IN.XML") returned -1
	[0071.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML") returned="YAHOO.CO.ID.XML"
	[0071.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.IN.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML"
	[0071.486] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.486] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.486] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.JP.XML") returned -1
	[0071.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.JP.XML") returned -1
	[0071.486] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.JP.XML") returned -1
	[0071.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML") returned="YAHOO.CO.IN.XML"
	[0071.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.JP.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML"
	[0071.486] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.486] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.486] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.KR.XML") returned -1
	[0071.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.KR.XML") returned -1
	[0071.486] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.KR.XML") returned -1
	[0071.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML") returned="YAHOO.CO.JP.XML"
	[0071.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.486] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.KR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML"
	[0071.487] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.487] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.487] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.NZ.XML") returned -1
	[0071.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.NZ.XML") returned -1
	[0071.487] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.NZ.XML") returned -1
	[0071.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML") returned="YAHOO.CO.KR.XML"
	[0071.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.NZ.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML"
	[0071.487] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.487] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.487] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.TH.XML") returned -1
	[0071.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.TH.XML") returned -1
	[0071.487] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.TH.XML") returned -1
	[0071.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML") returned="YAHOO.CO.NZ.XML"
	[0071.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.TH.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML"
	[0071.488] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.488] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.488] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.UK.XML") returned -1
	[0071.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.UK.XML") returned -1
	[0071.488] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.UK.XML") returned -1
	[0071.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML") returned="YAHOO.CO.TH.XML"
	[0071.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.UK.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML"
	[0071.488] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.488] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.488] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.AR.XML") returned -1
	[0071.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.AR.XML") returned -1
	[0071.488] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.AR.XML") returned -1
	[0071.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML") returned="YAHOO.CO.UK.XML"
	[0071.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.AR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML"
	[0071.489] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.489] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.489] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.AU.XML") returned -1
	[0071.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.AU.XML") returned -1
	[0071.489] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.AU.XML") returned -1
	[0071.489] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML") returned="YAHOO.COM.AR.XML"
	[0071.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.AU.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML"
	[0071.489] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.489] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.489] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.BR.XML") returned -1
	[0071.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.BR.XML") returned -1
	[0071.489] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.BR.XML") returned -1
	[0071.489] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML") returned="YAHOO.COM.AU.XML"
	[0071.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.BR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML"
	[0071.489] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.490] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.490] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.CN.XML") returned -1
	[0071.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.CN.XML") returned -1
	[0071.490] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.CN.XML") returned -1
	[0071.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML") returned="YAHOO.COM.BR.XML"
	[0071.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.490] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.490] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.CN.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML"
	[0071.490] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.490] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.490] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.HK.XML") returned -1
	[0071.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.HK.XML") returned -1
	[0071.490] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.HK.XML") returned -1
	[0071.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML") returned="YAHOO.COM.CN.XML"
	[0071.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.490] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.490] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.HK.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML"
	[0071.492] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.492] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.492] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.MX.XML") returned -1
	[0071.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.MX.XML") returned -1
	[0071.492] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.MX.XML") returned -1
	[0071.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML") returned="YAHOO.COM.HK.XML"
	[0071.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.492] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.MX.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML"
	[0071.492] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.492] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.492] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.MY.XML") returned -1
	[0071.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.MY.XML") returned -1
	[0071.492] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.MY.XML") returned -1
	[0071.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML") returned="YAHOO.COM.MX.XML"
	[0071.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.492] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.MY.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML"
	[0071.493] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.493] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.493] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.PH.XML") returned -1
	[0071.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.PH.XML") returned -1
	[0071.493] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.PH.XML") returned -1
	[0071.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML") returned="YAHOO.COM.MY.XML"
	[0071.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.493] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.PH.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML"
	[0071.493] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.493] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.493] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.SG.XML") returned -1
	[0071.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.SG.XML") returned -1
	[0071.493] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.SG.XML") returned -1
	[0071.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML") returned="YAHOO.COM.PH.XML"
	[0071.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.493] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.SG.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML"
	[0071.494] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.494] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.494] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.TW.XML") returned -1
	[0071.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.TW.XML") returned -1
	[0071.494] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.TW.XML") returned -1
	[0071.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML") returned="YAHOO.COM.SG.XML"
	[0071.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.494] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.494] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.TW.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML"
	[0071.494] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.494] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.494] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.VN.XML") returned -1
	[0071.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.VN.XML") returned -1
	[0071.494] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.VN.XML") returned -1
	[0071.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML") returned="YAHOO.COM.TW.XML"
	[0071.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.494] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.495] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.VN.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML"
	[0071.495] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.495] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.495] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.XML") returned -1
	[0071.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.XML") returned -1
	[0071.495] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.XML") returned -1
	[0071.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML") returned="YAHOO.COM.VN.XML"
	[0071.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.495] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.495] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML"
	[0071.495] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.495] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.495] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.DE.XML") returned -1
	[0071.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.DE.XML") returned -1
	[0071.495] lstrcmpiA (lpString1="", lpString2="YAHOO.DE.XML") returned -1
	[0071.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML") returned="YAHOO.COM.XML"
	[0071.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.495] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.495] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.DE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML"
	[0071.496] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.496] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.ES.XML") returned -1
	[0071.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.ES.XML") returned -1
	[0071.496] lstrcmpiA (lpString1="", lpString2="YAHOO.ES.XML") returned -1
	[0071.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned="YAHOO.DE.XML"
	[0071.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.496] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.496] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.ES.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML"
	[0071.496] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.496] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.FR.XML") returned -1
	[0071.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.FR.XML") returned -1
	[0071.496] lstrcmpiA (lpString1="", lpString2="YAHOO.FR.XML") returned -1
	[0071.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned="YAHOO.ES.XML"
	[0071.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.496] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.496] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.FR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML"
	[0071.497] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.497] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.497] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.HK.XML") returned -1
	[0071.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.HK.XML") returned -1
	[0071.497] lstrcmpiA (lpString1="", lpString2="YAHOO.HK.XML") returned -1
	[0071.497] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned="YAHOO.FR.XML"
	[0071.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.497] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.497] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.HK.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML"
	[0071.497] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.497] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.497] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.IE.XML") returned -1
	[0071.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.IE.XML") returned -1
	[0071.497] lstrcmpiA (lpString1="", lpString2="YAHOO.IE.XML") returned -1
	[0071.497] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned="YAHOO.HK.XML"
	[0071.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.497] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.497] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.IE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML"
	[0071.497] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.498] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.IT.XML") returned -1
	[0071.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.IT.XML") returned -1
	[0071.498] lstrcmpiA (lpString1="", lpString2="YAHOO.IT.XML") returned -1
	[0071.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned="YAHOO.IE.XML"
	[0071.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.IT.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML"
	[0071.498] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.498] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.JP.XML") returned -1
	[0071.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.JP.XML") returned -1
	[0071.498] lstrcmpiA (lpString1="", lpString2="YAHOO.JP.XML") returned -1
	[0071.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned="YAHOO.IT.XML"
	[0071.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.JP.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML"
	[0071.498] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.498] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.498] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.NO.XML") returned -1
	[0071.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.NO.XML") returned -1
	[0071.499] lstrcmpiA (lpString1="", lpString2="YAHOO.NO.XML") returned -1
	[0071.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned="YAHOO.JP.XML"
	[0071.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.499] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.499] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.NO.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML"
	[0071.499] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.499] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.499] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.PL.XML") returned -1
	[0071.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.PL.XML") returned -1
	[0071.499] lstrcmpiA (lpString1="", lpString2="YAHOO.PL.XML") returned -1
	[0071.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned="YAHOO.NO.XML"
	[0071.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.499] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.499] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.PL.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML"
	[0071.499] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.499] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.499] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.SE.XML") returned -1
	[0071.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.SE.XML") returned -1
	[0071.499] lstrcmpiA (lpString1="", lpString2="YAHOO.SE.XML") returned -1
	[0071.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned="YAHOO.PL.XML"
	[0071.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\"
	[0071.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned=""
	[0071.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt"
	[0071.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20
	[0071.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.SE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML"
	[0071.500] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0071.500] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0071.500] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.500] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.500] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLPH.DLL") returned -1
	[0071.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLPH.DLL") returned -1
	[0071.500] lstrcmpiA (lpString1="", lpString2="OUTLPH.DLL") returned -1
	[0071.500] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0071.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL"
	[0071.500] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.500] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.500] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLRPC.DLL") returned -1
	[0071.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLRPC.DLL") returned -1
	[0071.500] lstrcmpiA (lpString1="", lpString2="OUTLRPC.DLL") returned -1
	[0071.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned="OUTLPH.DLL"
	[0071.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLRPC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL"
	[0071.501] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.501] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.501] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLVBS.DLL") returned -1
	[0071.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLVBS.DLL") returned -1
	[0071.501] lstrcmpiA (lpString1="", lpString2="OUTLVBS.DLL") returned -1
	[0071.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned="OUTLRPC.DLL"
	[0071.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0071.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0071.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLVBS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL"
	[0071.501] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.501] lstrcmpA (lpString1=".", lpString2="PAGESIZE") returned -1
	[0071.501] lstrcmpA (lpString1="..", lpString2="PAGESIZE") returned -1
	[0071.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned="OUTLVBS.DLL"
	[0071.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PAGESIZE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE"
	[0071.502] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0071.540] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0071.541] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.543] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0071.543] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0071.543] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.543] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.543] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL001.XML") returned -1
	[0071.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL001.XML") returned -1
	[0071.543] lstrcmpiA (lpString1="", lpString2="PGLBL001.XML") returned -1
	[0071.543] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*") returned="*.*"
	[0071.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0xffffffff
	[0071.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0071.547] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0071.547] CloseHandle (hObject=0x8c) returned 1
	[0071.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL001.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML"
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.zip") returned 0
	[0071.548] lstrlenA (lpString="*.zip") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.rar") returned 0
	[0071.548] lstrlenA (lpString="*.rar") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.7z") returned 0
	[0071.548] lstrlenA (lpString="*.7z") returned 4
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.tar") returned 0
	[0071.548] lstrlenA (lpString="*.tar") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.gzip") returned 0
	[0071.548] lstrlenA (lpString="*.gzip") returned 6
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.jpg") returned 0
	[0071.548] lstrlenA (lpString="*.jpg") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.jpeg") returned 0
	[0071.548] lstrlenA (lpString="*.jpeg") returned 6
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.psd") returned 0
	[0071.548] lstrlenA (lpString="*.psd") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.cdr") returned 0
	[0071.548] lstrlenA (lpString="*.cdr") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.dwg") returned 0
	[0071.548] lstrlenA (lpString="*.dwg") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.max") returned 0
	[0071.548] lstrlenA (lpString="*.max") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.bmp") returned 0
	[0071.548] lstrlenA (lpString="*.bmp") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.gif") returned 0
	[0071.548] lstrlenA (lpString="*.gif") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.png") returned 0
	[0071.548] lstrlenA (lpString="*.png") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.doc") returned 0
	[0071.548] lstrlenA (lpString="*.doc") returned 5
	[0071.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.docx") returned 0
	[0071.548] lstrlenA (lpString="*.docx") returned 6
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.xls") returned 0
	[0071.549] lstrlenA (lpString="*.xls") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.xlsx") returned 0
	[0071.549] lstrlenA (lpString="*.xlsx") returned 6
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.ppt") returned 0
	[0071.549] lstrlenA (lpString="*.ppt") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.pptx") returned 0
	[0071.549] lstrlenA (lpString="*.pptx") returned 6
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.txt") returned 0
	[0071.549] lstrlenA (lpString="*.txt") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.pdf") returned 0
	[0071.549] lstrlenA (lpString="*.pdf") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.djvu") returned 0
	[0071.549] lstrlenA (lpString="*.djvu") returned 6
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.htm") returned 0
	[0071.549] lstrlenA (lpString="*.htm") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.html") returned 0
	[0071.549] lstrlenA (lpString="*.html") returned 6
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mdb") returned 0
	[0071.549] lstrlenA (lpString="*.mdb") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.cer") returned 0
	[0071.549] lstrlenA (lpString="*.cer") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.p12") returned 0
	[0071.549] lstrlenA (lpString="*.p12") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.pfx") returned 0
	[0071.549] lstrlenA (lpString="*.pfx") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.kwm") returned 0
	[0071.549] lstrlenA (lpString="*.kwm") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.pwm") returned 0
	[0071.549] lstrlenA (lpString="*.pwm") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.1cd") returned 0
	[0071.549] lstrlenA (lpString="*.1cd") returned 5
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.md") returned 0
	[0071.549] lstrlenA (lpString="*.md") returned 4
	[0071.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mdf") returned 0
	[0071.550] lstrlenA (lpString="*.mdf") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.dbf") returned 0
	[0071.550] lstrlenA (lpString="*.dbf") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.odt") returned 0
	[0071.550] lstrlenA (lpString="*.odt") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.vob") returned 0
	[0071.550] lstrlenA (lpString="*.vob") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.ifo") returned 0
	[0071.550] lstrlenA (lpString="*.ifo") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.lnk") returned 0
	[0071.550] lstrlenA (lpString="*.lnk") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.torrent") returned 0
	[0071.550] lstrlenA (lpString="*.torrent") returned 9
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mov") returned 0
	[0071.550] lstrlenA (lpString="*.mov") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.m2v") returned 0
	[0071.550] lstrlenA (lpString="*.m2v") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.3gp") returned 0
	[0071.550] lstrlenA (lpString="*.3gp") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mpeg") returned 0
	[0071.550] lstrlenA (lpString="*.mpeg") returned 6
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mpg") returned 0
	[0071.550] lstrlenA (lpString="*.mpg") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.flv") returned 0
	[0071.550] lstrlenA (lpString="*.flv") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.avi") returned 0
	[0071.550] lstrlenA (lpString="*.avi") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mp4") returned 0
	[0071.550] lstrlenA (lpString="*.mp4") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.wmv") returned 0
	[0071.550] lstrlenA (lpString="*.wmv") returned 5
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.divx") returned 0
	[0071.550] lstrlenA (lpString="*.divx") returned 6
	[0071.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mkv") returned 0
	[0071.551] lstrlenA (lpString="*.mkv") returned 5
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.mp3") returned 0
	[0071.551] lstrlenA (lpString="*.mp3") returned 5
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.wav") returned 0
	[0071.551] lstrlenA (lpString="*.wav") returned 5
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.flac") returned 0
	[0071.551] lstrlenA (lpString="*.flac") returned 6
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.ape") returned 0
	[0071.551] lstrlenA (lpString="*.ape") returned 5
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.wma") returned 0
	[0071.551] lstrlenA (lpString="*.wma") returned 5
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.ac3") returned 0
	[0071.551] lstrlenA (lpString="*.ac3") returned 5
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.exe") returned 0
	[0071.551] lstrlenA (lpString="*.exe") returned 5
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", pszSpec="*.apk") returned 0
	[0071.551] lstrlenA (lpString="*.apk") returned 5
	[0071.551] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.551] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.551] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL002.XML") returned -1
	[0071.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL002.XML") returned -1
	[0071.551] lstrcmpiA (lpString1="", lpString2="PGLBL002.XML") returned -1
	[0071.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="PGLBL001.XML"
	[0071.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL002.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML"
	[0071.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.zip") returned 0
	[0071.552] lstrlenA (lpString="*.zip") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.rar") returned 0
	[0071.552] lstrlenA (lpString="*.rar") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.7z") returned 0
	[0071.552] lstrlenA (lpString="*.7z") returned 4
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.tar") returned 0
	[0071.552] lstrlenA (lpString="*.tar") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.gzip") returned 0
	[0071.552] lstrlenA (lpString="*.gzip") returned 6
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.jpg") returned 0
	[0071.552] lstrlenA (lpString="*.jpg") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.jpeg") returned 0
	[0071.552] lstrlenA (lpString="*.jpeg") returned 6
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.psd") returned 0
	[0071.552] lstrlenA (lpString="*.psd") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.cdr") returned 0
	[0071.552] lstrlenA (lpString="*.cdr") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.dwg") returned 0
	[0071.552] lstrlenA (lpString="*.dwg") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.max") returned 0
	[0071.552] lstrlenA (lpString="*.max") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.bmp") returned 0
	[0071.552] lstrlenA (lpString="*.bmp") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.gif") returned 0
	[0071.552] lstrlenA (lpString="*.gif") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.png") returned 0
	[0071.552] lstrlenA (lpString="*.png") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.doc") returned 0
	[0071.552] lstrlenA (lpString="*.doc") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.docx") returned 0
	[0071.552] lstrlenA (lpString="*.docx") returned 6
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.xls") returned 0
	[0071.552] lstrlenA (lpString="*.xls") returned 5
	[0071.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.xlsx") returned 0
	[0071.552] lstrlenA (lpString="*.xlsx") returned 6
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.ppt") returned 0
	[0071.553] lstrlenA (lpString="*.ppt") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.pptx") returned 0
	[0071.553] lstrlenA (lpString="*.pptx") returned 6
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.txt") returned 0
	[0071.553] lstrlenA (lpString="*.txt") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.pdf") returned 0
	[0071.553] lstrlenA (lpString="*.pdf") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.djvu") returned 0
	[0071.553] lstrlenA (lpString="*.djvu") returned 6
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.htm") returned 0
	[0071.553] lstrlenA (lpString="*.htm") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.html") returned 0
	[0071.553] lstrlenA (lpString="*.html") returned 6
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mdb") returned 0
	[0071.553] lstrlenA (lpString="*.mdb") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.cer") returned 0
	[0071.553] lstrlenA (lpString="*.cer") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.p12") returned 0
	[0071.553] lstrlenA (lpString="*.p12") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.pfx") returned 0
	[0071.553] lstrlenA (lpString="*.pfx") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.kwm") returned 0
	[0071.553] lstrlenA (lpString="*.kwm") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.pwm") returned 0
	[0071.553] lstrlenA (lpString="*.pwm") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.1cd") returned 0
	[0071.553] lstrlenA (lpString="*.1cd") returned 5
	[0071.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.md") returned 0
	[0071.554] lstrlenA (lpString="*.md") returned 4
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mdf") returned 0
	[0071.554] lstrlenA (lpString="*.mdf") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.dbf") returned 0
	[0071.554] lstrlenA (lpString="*.dbf") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.odt") returned 0
	[0071.554] lstrlenA (lpString="*.odt") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.vob") returned 0
	[0071.554] lstrlenA (lpString="*.vob") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.ifo") returned 0
	[0071.554] lstrlenA (lpString="*.ifo") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.lnk") returned 0
	[0071.554] lstrlenA (lpString="*.lnk") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.torrent") returned 0
	[0071.554] lstrlenA (lpString="*.torrent") returned 9
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mov") returned 0
	[0071.554] lstrlenA (lpString="*.mov") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.m2v") returned 0
	[0071.554] lstrlenA (lpString="*.m2v") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.3gp") returned 0
	[0071.554] lstrlenA (lpString="*.3gp") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mpeg") returned 0
	[0071.554] lstrlenA (lpString="*.mpeg") returned 6
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mpg") returned 0
	[0071.554] lstrlenA (lpString="*.mpg") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.flv") returned 0
	[0071.554] lstrlenA (lpString="*.flv") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.avi") returned 0
	[0071.554] lstrlenA (lpString="*.avi") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mp4") returned 0
	[0071.554] lstrlenA (lpString="*.mp4") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.wmv") returned 0
	[0071.554] lstrlenA (lpString="*.wmv") returned 5
	[0071.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.divx") returned 0
	[0071.555] lstrlenA (lpString="*.divx") returned 6
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mkv") returned 0
	[0071.555] lstrlenA (lpString="*.mkv") returned 5
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.mp3") returned 0
	[0071.555] lstrlenA (lpString="*.mp3") returned 5
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.wav") returned 0
	[0071.555] lstrlenA (lpString="*.wav") returned 5
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.flac") returned 0
	[0071.555] lstrlenA (lpString="*.flac") returned 6
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.ape") returned 0
	[0071.555] lstrlenA (lpString="*.ape") returned 5
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.wma") returned 0
	[0071.555] lstrlenA (lpString="*.wma") returned 5
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.ac3") returned 0
	[0071.555] lstrlenA (lpString="*.ac3") returned 5
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.exe") returned 0
	[0071.555] lstrlenA (lpString="*.exe") returned 5
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", pszSpec="*.apk") returned 0
	[0071.555] lstrlenA (lpString="*.apk") returned 5
	[0071.555] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.555] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.555] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL010.XML") returned -1
	[0071.555] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL010.XML") returned -1
	[0071.555] lstrcmpiA (lpString1="", lpString2="PGLBL010.XML") returned -1
	[0071.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="PGLBL002.XML"
	[0071.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.555] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL010.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML"
	[0071.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.zip") returned 0
	[0071.556] lstrlenA (lpString="*.zip") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.rar") returned 0
	[0071.556] lstrlenA (lpString="*.rar") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.7z") returned 0
	[0071.556] lstrlenA (lpString="*.7z") returned 4
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.tar") returned 0
	[0071.556] lstrlenA (lpString="*.tar") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.gzip") returned 0
	[0071.556] lstrlenA (lpString="*.gzip") returned 6
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.jpg") returned 0
	[0071.556] lstrlenA (lpString="*.jpg") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.jpeg") returned 0
	[0071.556] lstrlenA (lpString="*.jpeg") returned 6
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.psd") returned 0
	[0071.556] lstrlenA (lpString="*.psd") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.cdr") returned 0
	[0071.556] lstrlenA (lpString="*.cdr") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.dwg") returned 0
	[0071.556] lstrlenA (lpString="*.dwg") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.max") returned 0
	[0071.556] lstrlenA (lpString="*.max") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.bmp") returned 0
	[0071.556] lstrlenA (lpString="*.bmp") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.gif") returned 0
	[0071.556] lstrlenA (lpString="*.gif") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.png") returned 0
	[0071.556] lstrlenA (lpString="*.png") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.doc") returned 0
	[0071.556] lstrlenA (lpString="*.doc") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.docx") returned 0
	[0071.556] lstrlenA (lpString="*.docx") returned 6
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.xls") returned 0
	[0071.556] lstrlenA (lpString="*.xls") returned 5
	[0071.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.xlsx") returned 0
	[0071.556] lstrlenA (lpString="*.xlsx") returned 6
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.ppt") returned 0
	[0071.557] lstrlenA (lpString="*.ppt") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.pptx") returned 0
	[0071.557] lstrlenA (lpString="*.pptx") returned 6
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.txt") returned 0
	[0071.557] lstrlenA (lpString="*.txt") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.pdf") returned 0
	[0071.557] lstrlenA (lpString="*.pdf") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.djvu") returned 0
	[0071.557] lstrlenA (lpString="*.djvu") returned 6
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.htm") returned 0
	[0071.557] lstrlenA (lpString="*.htm") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.html") returned 0
	[0071.557] lstrlenA (lpString="*.html") returned 6
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mdb") returned 0
	[0071.557] lstrlenA (lpString="*.mdb") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.cer") returned 0
	[0071.557] lstrlenA (lpString="*.cer") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.p12") returned 0
	[0071.557] lstrlenA (lpString="*.p12") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.pfx") returned 0
	[0071.557] lstrlenA (lpString="*.pfx") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.kwm") returned 0
	[0071.557] lstrlenA (lpString="*.kwm") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.pwm") returned 0
	[0071.557] lstrlenA (lpString="*.pwm") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.1cd") returned 0
	[0071.557] lstrlenA (lpString="*.1cd") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.md") returned 0
	[0071.557] lstrlenA (lpString="*.md") returned 4
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mdf") returned 0
	[0071.557] lstrlenA (lpString="*.mdf") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.dbf") returned 0
	[0071.557] lstrlenA (lpString="*.dbf") returned 5
	[0071.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.odt") returned 0
	[0071.558] lstrlenA (lpString="*.odt") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.vob") returned 0
	[0071.558] lstrlenA (lpString="*.vob") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.ifo") returned 0
	[0071.558] lstrlenA (lpString="*.ifo") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.lnk") returned 0
	[0071.558] lstrlenA (lpString="*.lnk") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.torrent") returned 0
	[0071.558] lstrlenA (lpString="*.torrent") returned 9
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mov") returned 0
	[0071.558] lstrlenA (lpString="*.mov") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.m2v") returned 0
	[0071.558] lstrlenA (lpString="*.m2v") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.3gp") returned 0
	[0071.558] lstrlenA (lpString="*.3gp") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mpeg") returned 0
	[0071.558] lstrlenA (lpString="*.mpeg") returned 6
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mpg") returned 0
	[0071.558] lstrlenA (lpString="*.mpg") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.flv") returned 0
	[0071.558] lstrlenA (lpString="*.flv") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.avi") returned 0
	[0071.558] lstrlenA (lpString="*.avi") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mp4") returned 0
	[0071.558] lstrlenA (lpString="*.mp4") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.wmv") returned 0
	[0071.558] lstrlenA (lpString="*.wmv") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.divx") returned 0
	[0071.558] lstrlenA (lpString="*.divx") returned 6
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mkv") returned 0
	[0071.558] lstrlenA (lpString="*.mkv") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.mp3") returned 0
	[0071.558] lstrlenA (lpString="*.mp3") returned 5
	[0071.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.wav") returned 0
	[0071.559] lstrlenA (lpString="*.wav") returned 5
	[0071.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.flac") returned 0
	[0071.559] lstrlenA (lpString="*.flac") returned 6
	[0071.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.ape") returned 0
	[0071.559] lstrlenA (lpString="*.ape") returned 5
	[0071.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.wma") returned 0
	[0071.559] lstrlenA (lpString="*.wma") returned 5
	[0071.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.ac3") returned 0
	[0071.559] lstrlenA (lpString="*.ac3") returned 5
	[0071.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.exe") returned 0
	[0071.559] lstrlenA (lpString="*.exe") returned 5
	[0071.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", pszSpec="*.apk") returned 0
	[0071.560] lstrlenA (lpString="*.apk") returned 5
	[0071.560] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.560] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.560] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL011.XML") returned -1
	[0071.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL011.XML") returned -1
	[0071.560] lstrcmpiA (lpString1="", lpString2="PGLBL011.XML") returned -1
	[0071.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned="PGLBL010.XML"
	[0071.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.560] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.560] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL011.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML"
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.zip") returned 0
	[0071.560] lstrlenA (lpString="*.zip") returned 5
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.rar") returned 0
	[0071.560] lstrlenA (lpString="*.rar") returned 5
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.7z") returned 0
	[0071.560] lstrlenA (lpString="*.7z") returned 4
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.tar") returned 0
	[0071.560] lstrlenA (lpString="*.tar") returned 5
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.gzip") returned 0
	[0071.560] lstrlenA (lpString="*.gzip") returned 6
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.jpg") returned 0
	[0071.560] lstrlenA (lpString="*.jpg") returned 5
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.jpeg") returned 0
	[0071.560] lstrlenA (lpString="*.jpeg") returned 6
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.psd") returned 0
	[0071.560] lstrlenA (lpString="*.psd") returned 5
	[0071.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.cdr") returned 0
	[0071.560] lstrlenA (lpString="*.cdr") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.dwg") returned 0
	[0071.561] lstrlenA (lpString="*.dwg") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.max") returned 0
	[0071.561] lstrlenA (lpString="*.max") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.bmp") returned 0
	[0071.561] lstrlenA (lpString="*.bmp") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.gif") returned 0
	[0071.561] lstrlenA (lpString="*.gif") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.png") returned 0
	[0071.561] lstrlenA (lpString="*.png") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.doc") returned 0
	[0071.561] lstrlenA (lpString="*.doc") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.docx") returned 0
	[0071.561] lstrlenA (lpString="*.docx") returned 6
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.xls") returned 0
	[0071.561] lstrlenA (lpString="*.xls") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.xlsx") returned 0
	[0071.561] lstrlenA (lpString="*.xlsx") returned 6
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.ppt") returned 0
	[0071.561] lstrlenA (lpString="*.ppt") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.pptx") returned 0
	[0071.561] lstrlenA (lpString="*.pptx") returned 6
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.txt") returned 0
	[0071.561] lstrlenA (lpString="*.txt") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.pdf") returned 0
	[0071.561] lstrlenA (lpString="*.pdf") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.djvu") returned 0
	[0071.561] lstrlenA (lpString="*.djvu") returned 6
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.htm") returned 0
	[0071.561] lstrlenA (lpString="*.htm") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.html") returned 0
	[0071.561] lstrlenA (lpString="*.html") returned 6
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mdb") returned 0
	[0071.561] lstrlenA (lpString="*.mdb") returned 5
	[0071.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.cer") returned 0
	[0071.562] lstrlenA (lpString="*.cer") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.p12") returned 0
	[0071.562] lstrlenA (lpString="*.p12") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.pfx") returned 0
	[0071.562] lstrlenA (lpString="*.pfx") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.kwm") returned 0
	[0071.562] lstrlenA (lpString="*.kwm") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.pwm") returned 0
	[0071.562] lstrlenA (lpString="*.pwm") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.1cd") returned 0
	[0071.562] lstrlenA (lpString="*.1cd") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.md") returned 0
	[0071.562] lstrlenA (lpString="*.md") returned 4
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mdf") returned 0
	[0071.562] lstrlenA (lpString="*.mdf") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.dbf") returned 0
	[0071.562] lstrlenA (lpString="*.dbf") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.odt") returned 0
	[0071.562] lstrlenA (lpString="*.odt") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.vob") returned 0
	[0071.562] lstrlenA (lpString="*.vob") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.ifo") returned 0
	[0071.562] lstrlenA (lpString="*.ifo") returned 5
	[0071.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.lnk") returned 0
	[0071.563] lstrlenA (lpString="*.lnk") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.torrent") returned 0
	[0071.563] lstrlenA (lpString="*.torrent") returned 9
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mov") returned 0
	[0071.563] lstrlenA (lpString="*.mov") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.m2v") returned 0
	[0071.563] lstrlenA (lpString="*.m2v") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.3gp") returned 0
	[0071.563] lstrlenA (lpString="*.3gp") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mpeg") returned 0
	[0071.563] lstrlenA (lpString="*.mpeg") returned 6
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mpg") returned 0
	[0071.563] lstrlenA (lpString="*.mpg") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.flv") returned 0
	[0071.563] lstrlenA (lpString="*.flv") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.avi") returned 0
	[0071.563] lstrlenA (lpString="*.avi") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mp4") returned 0
	[0071.563] lstrlenA (lpString="*.mp4") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.wmv") returned 0
	[0071.563] lstrlenA (lpString="*.wmv") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.divx") returned 0
	[0071.563] lstrlenA (lpString="*.divx") returned 6
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mkv") returned 0
	[0071.563] lstrlenA (lpString="*.mkv") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.mp3") returned 0
	[0071.563] lstrlenA (lpString="*.mp3") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.wav") returned 0
	[0071.563] lstrlenA (lpString="*.wav") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.flac") returned 0
	[0071.563] lstrlenA (lpString="*.flac") returned 6
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.ape") returned 0
	[0071.563] lstrlenA (lpString="*.ape") returned 5
	[0071.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.wma") returned 0
	[0071.563] lstrlenA (lpString="*.wma") returned 5
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.ac3") returned 0
	[0071.564] lstrlenA (lpString="*.ac3") returned 5
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.exe") returned 0
	[0071.564] lstrlenA (lpString="*.exe") returned 5
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", pszSpec="*.apk") returned 0
	[0071.564] lstrlenA (lpString="*.apk") returned 5
	[0071.564] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.564] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.564] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL012.XML") returned -1
	[0071.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL012.XML") returned -1
	[0071.564] lstrcmpiA (lpString1="", lpString2="PGLBL012.XML") returned -1
	[0071.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned="PGLBL011.XML"
	[0071.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL012.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML"
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.zip") returned 0
	[0071.564] lstrlenA (lpString="*.zip") returned 5
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.rar") returned 0
	[0071.564] lstrlenA (lpString="*.rar") returned 5
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.7z") returned 0
	[0071.564] lstrlenA (lpString="*.7z") returned 4
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.tar") returned 0
	[0071.564] lstrlenA (lpString="*.tar") returned 5
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.gzip") returned 0
	[0071.564] lstrlenA (lpString="*.gzip") returned 6
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.jpg") returned 0
	[0071.564] lstrlenA (lpString="*.jpg") returned 5
	[0071.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.jpeg") returned 0
	[0071.565] lstrlenA (lpString="*.jpeg") returned 6
	[0071.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.psd") returned 0
	[0071.565] lstrlenA (lpString="*.psd") returned 5
	[0071.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.cdr") returned 0
	[0071.565] lstrlenA (lpString="*.cdr") returned 5
	[0071.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.dwg") returned 0
	[0071.565] lstrlenA (lpString="*.dwg") returned 5
	[0071.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.max") returned 0
	[0071.565] lstrlenA (lpString="*.max") returned 5
	[0071.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.bmp") returned 0
	[0071.565] lstrlenA (lpString="*.bmp") returned 5
	[0071.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", pszSpec="*.gif") returned 0
	[0071.565] lstrlenA (lpString="*.gif") returned 5
	[0071.565] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.565] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.565] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL016.XML") returned -1
	[0071.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL016.XML") returned -1
	[0071.565] lstrcmpiA (lpString1="", lpString2="PGLBL016.XML") returned -1
	[0071.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned="PGLBL012.XML"
	[0071.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL016.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML"
	[0071.566] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.566] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.566] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL020.XML") returned -1
	[0071.566] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL020.XML") returned -1
	[0071.566] lstrcmpiA (lpString1="", lpString2="PGLBL020.XML") returned -1
	[0071.566] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned="PGLBL016.XML"
	[0071.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL020.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML"
	[0071.566] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.566] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.566] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL022.XML") returned -1
	[0071.566] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL022.XML") returned -1
	[0071.566] lstrcmpiA (lpString1="", lpString2="PGLBL022.XML") returned -1
	[0071.566] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned="PGLBL020.XML"
	[0071.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL022.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML"
	[0071.567] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL026.XML") returned -1
	[0071.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL026.XML") returned -1
	[0071.567] lstrcmpiA (lpString1="", lpString2="PGLBL026.XML") returned -1
	[0071.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned="PGLBL022.XML"
	[0071.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL026.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML"
	[0071.567] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL027.XML") returned -1
	[0071.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL027.XML") returned -1
	[0071.567] lstrcmpiA (lpString1="", lpString2="PGLBL027.XML") returned -1
	[0071.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML") returned="PGLBL026.XML"
	[0071.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL027.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML"
	[0071.567] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL044.XML") returned -1
	[0071.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL044.XML") returned -1
	[0071.568] lstrcmpiA (lpString1="", lpString2="PGLBL044.XML") returned -1
	[0071.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML") returned="PGLBL027.XML"
	[0071.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL044.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML"
	[0071.568] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.568] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.568] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL048.XML") returned -1
	[0071.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL048.XML") returned -1
	[0071.568] lstrcmpiA (lpString1="", lpString2="PGLBL048.XML") returned -1
	[0071.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML") returned="PGLBL044.XML"
	[0071.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL048.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML"
	[0071.568] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.568] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.568] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL054.XML") returned -1
	[0071.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL054.XML") returned -1
	[0071.568] lstrcmpiA (lpString1="", lpString2="PGLBL054.XML") returned -1
	[0071.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML") returned="PGLBL048.XML"
	[0071.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL054.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML"
	[0071.569] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.569] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.569] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL058.XML") returned -1
	[0071.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL058.XML") returned -1
	[0071.569] lstrcmpiA (lpString1="", lpString2="PGLBL058.XML") returned -1
	[0071.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML") returned="PGLBL054.XML"
	[0071.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL058.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML"
	[0071.569] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.569] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.569] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL065.XML") returned -1
	[0071.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL065.XML") returned -1
	[0071.570] lstrcmpiA (lpString1="", lpString2="PGLBL065.XML") returned -1
	[0071.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML") returned="PGLBL058.XML"
	[0071.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL065.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML"
	[0071.570] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.570] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.570] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL075.XML") returned -1
	[0071.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL075.XML") returned -1
	[0071.570] lstrcmpiA (lpString1="", lpString2="PGLBL075.XML") returned -1
	[0071.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML") returned="PGLBL065.XML"
	[0071.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL075.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML"
	[0071.570] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.570] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.570] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL077.XML") returned -1
	[0071.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL077.XML") returned -1
	[0071.570] lstrcmpiA (lpString1="", lpString2="PGLBL077.XML") returned -1
	[0071.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML") returned="PGLBL075.XML"
	[0071.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL077.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML"
	[0071.570] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.570] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.571] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL078.XML") returned -1
	[0071.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL078.XML") returned -1
	[0071.571] lstrcmpiA (lpString1="", lpString2="PGLBL078.XML") returned -1
	[0071.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML") returned="PGLBL077.XML"
	[0071.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL078.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML"
	[0071.571] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.571] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.571] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL081.XML") returned -1
	[0071.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL081.XML") returned -1
	[0071.571] lstrcmpiA (lpString1="", lpString2="PGLBL081.XML") returned -1
	[0071.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML") returned="PGLBL078.XML"
	[0071.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL081.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML"
	[0071.571] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.571] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.571] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL082.XML") returned -1
	[0071.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL082.XML") returned -1
	[0071.571] lstrcmpiA (lpString1="", lpString2="PGLBL082.XML") returned -1
	[0071.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML") returned="PGLBL081.XML"
	[0071.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL082.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML"
	[0071.571] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.571] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL083.XML") returned -1
	[0071.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL083.XML") returned -1
	[0071.572] lstrcmpiA (lpString1="", lpString2="PGLBL083.XML") returned -1
	[0071.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML") returned="PGLBL082.XML"
	[0071.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL083.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML"
	[0071.572] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.572] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL086.XML") returned -1
	[0071.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL086.XML") returned -1
	[0071.572] lstrcmpiA (lpString1="", lpString2="PGLBL086.XML") returned -1
	[0071.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML") returned="PGLBL083.XML"
	[0071.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL086.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML"
	[0071.572] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.572] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL087.XML") returned -1
	[0071.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL087.XML") returned -1
	[0071.572] lstrcmpiA (lpString1="", lpString2="PGLBL087.XML") returned -1
	[0071.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML") returned="PGLBL086.XML"
	[0071.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL087.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML"
	[0071.573] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.573] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.573] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL089.XML") returned -1
	[0071.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL089.XML") returned -1
	[0071.573] lstrcmpiA (lpString1="", lpString2="PGLBL089.XML") returned -1
	[0071.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML") returned="PGLBL087.XML"
	[0071.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL089.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML"
	[0071.573] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.573] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.573] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL090.XML") returned -1
	[0071.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL090.XML") returned -1
	[0071.573] lstrcmpiA (lpString1="", lpString2="PGLBL090.XML") returned -1
	[0071.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned="PGLBL089.XML"
	[0071.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL090.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML"
	[0071.573] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.573] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.573] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL092.XML") returned -1
	[0071.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL092.XML") returned -1
	[0071.573] lstrcmpiA (lpString1="", lpString2="PGLBL092.XML") returned -1
	[0071.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned="PGLBL090.XML"
	[0071.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL092.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML"
	[0071.574] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.574] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.574] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL093.XML") returned -1
	[0071.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL093.XML") returned -1
	[0071.574] lstrcmpiA (lpString1="", lpString2="PGLBL093.XML") returned -1
	[0071.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned="PGLBL092.XML"
	[0071.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL093.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML"
	[0071.574] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.574] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.574] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL095.XML") returned -1
	[0071.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL095.XML") returned -1
	[0071.574] lstrcmpiA (lpString1="", lpString2="PGLBL095.XML") returned -1
	[0071.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned="PGLBL093.XML"
	[0071.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL095.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML"
	[0071.574] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.574] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.574] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL096.XML") returned -1
	[0071.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL096.XML") returned -1
	[0071.574] lstrcmpiA (lpString1="", lpString2="PGLBL096.XML") returned -1
	[0071.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned="PGLBL095.XML"
	[0071.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL096.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML"
	[0071.575] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.575] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.575] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL097.XML") returned -1
	[0071.575] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL097.XML") returned -1
	[0071.575] lstrcmpiA (lpString1="", lpString2="PGLBL097.XML") returned -1
	[0071.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned="PGLBL096.XML"
	[0071.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL097.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML"
	[0071.575] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.575] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.575] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL102.XML") returned -1
	[0071.575] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL102.XML") returned -1
	[0071.575] lstrcmpiA (lpString1="", lpString2="PGLBL102.XML") returned -1
	[0071.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned="PGLBL097.XML"
	[0071.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL102.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML"
	[0071.575] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.576] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.576] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL103.XML") returned -1
	[0071.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL103.XML") returned -1
	[0071.576] lstrcmpiA (lpString1="", lpString2="PGLBL103.XML") returned -1
	[0071.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned="PGLBL102.XML"
	[0071.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL103.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML"
	[0071.576] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.576] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.576] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL104.XML") returned -1
	[0071.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL104.XML") returned -1
	[0071.576] lstrcmpiA (lpString1="", lpString2="PGLBL104.XML") returned -1
	[0071.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned="PGLBL103.XML"
	[0071.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL104.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML"
	[0071.576] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.577] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.577] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL105.XML") returned -1
	[0071.577] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL105.XML") returned -1
	[0071.577] lstrcmpiA (lpString1="", lpString2="PGLBL105.XML") returned -1
	[0071.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned="PGLBL104.XML"
	[0071.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL105.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML"
	[0071.578] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.578] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.578] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL106.XML") returned -1
	[0071.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL106.XML") returned -1
	[0071.578] lstrcmpiA (lpString1="", lpString2="PGLBL106.XML") returned -1
	[0071.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned="PGLBL105.XML"
	[0071.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL106.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML"
	[0071.578] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.578] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned="PGLBL106.XML"
	[0071.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL107.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML"
	[0071.578] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.578] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.578] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned="PGLBL107.XML"
	[0071.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL108.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML"
	[0071.579] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.579] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned="PGLBL108.XML"
	[0071.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL109.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML"
	[0071.579] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.579] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned="PGLBL109.XML"
	[0071.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL110.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML"
	[0071.579] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.579] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned="PGLBL110.XML"
	[0071.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL111.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML"
	[0071.580] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned="PGLBL111.XML"
	[0071.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN001.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML"
	[0071.580] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned="PGMN001.XML"
	[0071.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN002.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML"
	[0071.580] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned="PGMN002.XML"
	[0071.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN010.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML"
	[0071.580] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned="PGMN010.XML"
	[0071.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN011.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML"
	[0071.581] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned="PGMN011.XML"
	[0071.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN020.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML"
	[0071.581] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned="PGMN020.XML"
	[0071.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN022.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML"
	[0071.581] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned="PGMN022.XML"
	[0071.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN026.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML"
	[0071.582] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned="PGMN026.XML"
	[0071.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN027.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML"
	[0071.582] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned="PGMN027.XML"
	[0071.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN044.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML"
	[0071.582] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned="PGMN044.XML"
	[0071.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN048.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML"
	[0071.583] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned="PGMN048.XML"
	[0071.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt"
	[0071.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20
	[0071.583] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML") returned="PGMN054.XML"
	[0071.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.584] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.584] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML") returned="PGMN058.XML"
	[0071.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.585] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML") returned="PGMN065.XML"
	[0071.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.585] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML") returned="PGMN075.XML"
	[0071.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.585] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML") returned="PGMN081.XML"
	[0071.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.585] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML") returned="PGMN082.XML"
	[0071.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.585] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML") returned="PGMN086.XML"
	[0071.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.586] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML") returned="PGMN089.XML"
	[0071.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.586] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML") returned="PGMN090.XML"
	[0071.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.586] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML") returned="PGMN092.XML"
	[0071.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.586] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML") returned="PGMN095.XML"
	[0071.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML") returned="PGMN096.XML"
	[0071.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML") returned="PGMN097.XML"
	[0071.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML") returned="PGMN102.XML"
	[0071.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML") returned="PGMN103.XML"
	[0071.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.587] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML") returned="PGMN105.XML"
	[0071.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.588] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML") returned="PGMN107.XML"
	[0071.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.588] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML") returned="PGMN108.XML"
	[0071.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.588] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML") returned="PGMN109.XML"
	[0071.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.588] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML") returned="PGMN110.XML"
	[0071.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.589] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0071.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0071.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML") returned="PGMN111.XML"
	[0071.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\"
	[0071.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned=""
	[0071.589] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0071.589] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0071.589] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.589] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0071.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.589] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.589] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned="PDSBASE.DLL"
	[0071.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.589] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.600] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned="PE.DLL"
	[0071.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.600] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.600] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned="PEOPLEDATAHANDLER.DLL"
	[0071.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.600] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.600] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned="PJCALEND.DLL"
	[0071.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned="POWERPNT.EXE"
	[0071.708] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.708] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0071.723] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0071.723] CloseHandle (hObject=0x88) returned 1
	[0071.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.boom")) returned 1
	[0071.725] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.725] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned="POWERPNT.EXE"
	[0071.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.725] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.725] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned="powerpnt.exe.manifest"
	[0071.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.725] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.725] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned="PPCORE.DLL"
	[0071.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.726] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.726] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned="PPSLAX.DLL"
	[0071.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned="PPTICO.EXE"
	[0071.830] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.830] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17539b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x17539b, lpOverlapped=0x0) returned 1
	[0071.837] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0071.837] CloseHandle (hObject=0x88) returned 1
	[0071.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.boom")) returned 1
	[0071.842] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.842] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned="PPTICO.EXE"
	[0071.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.842] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.842] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned="PPTIRM.XML"
	[0071.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.842] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.842] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned="PPTIRMV.XML"
	[0071.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned="PROJIMPT.EXE"
	[0071.986] SetFilePointer (in: hFile=0x88, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0071.986] WriteFile (in: hFile=0x88, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x14965, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x14965, lpOverlapped=0x0) returned 1
	[0071.987] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0071.987] CloseHandle (hObject=0x88) returned 1
	[0071.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe.boom")) returned 1
	[0071.988] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.988] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0071.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned="PROJIMPT.EXE"
	[0071.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0071.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0071.988] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0071.988] lstrcmpA (lpString1=".", lpString2="PROOF") returned -1
	[0071.988] lstrcmpA (lpString1="..", lpString2="PROOF") returned -1
	[0071.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned="PROJMODL.DLL"
	[0071.988] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0072.025] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.025] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.025] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.025] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.025] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.025] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0072.025] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0072.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*"
	[0072.025] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033") returned 53
	[0072.025] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0072.026] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.026] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0072.026] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.026] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.026] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0072.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0072.026] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSGR3EN.DLL") returned -1
	[0072.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSGR3EN.DLL") returned -1
	[0072.026] lstrcmpiA (lpString1="", lpString2="MSGR3EN.DLL") returned -1
	[0072.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*") returned="*.*"
	[0072.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\"
	[0072.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\") returned=""
	[0072.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0072.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0072.027] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0072.027] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0072.028] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.028] CloseHandle (hObject=0x90) returned 1
	[0072.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", lpString2="MSGR3EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL"
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.zip") returned 0
	[0072.028] lstrlenA (lpString="*.zip") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.rar") returned 0
	[0072.028] lstrlenA (lpString="*.rar") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.7z") returned 0
	[0072.028] lstrlenA (lpString="*.7z") returned 4
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.tar") returned 0
	[0072.028] lstrlenA (lpString="*.tar") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.gzip") returned 0
	[0072.028] lstrlenA (lpString="*.gzip") returned 6
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.jpg") returned 0
	[0072.028] lstrlenA (lpString="*.jpg") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.jpeg") returned 0
	[0072.028] lstrlenA (lpString="*.jpeg") returned 6
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.psd") returned 0
	[0072.028] lstrlenA (lpString="*.psd") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.cdr") returned 0
	[0072.028] lstrlenA (lpString="*.cdr") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.dwg") returned 0
	[0072.028] lstrlenA (lpString="*.dwg") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.max") returned 0
	[0072.028] lstrlenA (lpString="*.max") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.bmp") returned 0
	[0072.028] lstrlenA (lpString="*.bmp") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.gif") returned 0
	[0072.028] lstrlenA (lpString="*.gif") returned 5
	[0072.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.png") returned 0
	[0072.029] lstrlenA (lpString="*.png") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.doc") returned 0
	[0072.029] lstrlenA (lpString="*.doc") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.docx") returned 0
	[0072.029] lstrlenA (lpString="*.docx") returned 6
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.xls") returned 0
	[0072.029] lstrlenA (lpString="*.xls") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.xlsx") returned 0
	[0072.029] lstrlenA (lpString="*.xlsx") returned 6
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.ppt") returned 0
	[0072.029] lstrlenA (lpString="*.ppt") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.pptx") returned 0
	[0072.029] lstrlenA (lpString="*.pptx") returned 6
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.txt") returned 0
	[0072.029] lstrlenA (lpString="*.txt") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.pdf") returned 0
	[0072.029] lstrlenA (lpString="*.pdf") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.djvu") returned 0
	[0072.029] lstrlenA (lpString="*.djvu") returned 6
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.htm") returned 0
	[0072.029] lstrlenA (lpString="*.htm") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.html") returned 0
	[0072.029] lstrlenA (lpString="*.html") returned 6
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mdb") returned 0
	[0072.029] lstrlenA (lpString="*.mdb") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.cer") returned 0
	[0072.029] lstrlenA (lpString="*.cer") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.p12") returned 0
	[0072.029] lstrlenA (lpString="*.p12") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.pfx") returned 0
	[0072.029] lstrlenA (lpString="*.pfx") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.kwm") returned 0
	[0072.029] lstrlenA (lpString="*.kwm") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.pwm") returned 0
	[0072.029] lstrlenA (lpString="*.pwm") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.1cd") returned 0
	[0072.029] lstrlenA (lpString="*.1cd") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.md") returned 0
	[0072.029] lstrlenA (lpString="*.md") returned 4
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mdf") returned 0
	[0072.029] lstrlenA (lpString="*.mdf") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.dbf") returned 0
	[0072.029] lstrlenA (lpString="*.dbf") returned 5
	[0072.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.odt") returned 0
	[0072.029] lstrlenA (lpString="*.odt") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.vob") returned 0
	[0072.030] lstrlenA (lpString="*.vob") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.ifo") returned 0
	[0072.030] lstrlenA (lpString="*.ifo") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.lnk") returned 0
	[0072.030] lstrlenA (lpString="*.lnk") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.torrent") returned 0
	[0072.030] lstrlenA (lpString="*.torrent") returned 9
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mov") returned 0
	[0072.030] lstrlenA (lpString="*.mov") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.m2v") returned 0
	[0072.030] lstrlenA (lpString="*.m2v") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.3gp") returned 0
	[0072.030] lstrlenA (lpString="*.3gp") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mpeg") returned 0
	[0072.030] lstrlenA (lpString="*.mpeg") returned 6
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mpg") returned 0
	[0072.030] lstrlenA (lpString="*.mpg") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.flv") returned 0
	[0072.030] lstrlenA (lpString="*.flv") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.avi") returned 0
	[0072.030] lstrlenA (lpString="*.avi") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mp4") returned 0
	[0072.030] lstrlenA (lpString="*.mp4") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.wmv") returned 0
	[0072.030] lstrlenA (lpString="*.wmv") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.divx") returned 0
	[0072.030] lstrlenA (lpString="*.divx") returned 6
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mkv") returned 0
	[0072.030] lstrlenA (lpString="*.mkv") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.mp3") returned 0
	[0072.030] lstrlenA (lpString="*.mp3") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.wav") returned 0
	[0072.030] lstrlenA (lpString="*.wav") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.flac") returned 0
	[0072.030] lstrlenA (lpString="*.flac") returned 6
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.ape") returned 0
	[0072.030] lstrlenA (lpString="*.ape") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.wma") returned 0
	[0072.030] lstrlenA (lpString="*.wma") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.ac3") returned 0
	[0072.030] lstrlenA (lpString="*.ac3") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.exe") returned 0
	[0072.030] lstrlenA (lpString="*.exe") returned 5
	[0072.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", pszSpec="*.apk") returned 0
	[0072.031] lstrlenA (lpString="*.apk") returned 5
	[0072.031] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0072.031] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0072.031] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.031] lstrcmpA (lpString1=".", lpString2="1036") returned -1
	[0072.031] lstrcmpA (lpString1="..", lpString2="1036") returned -1
	[0072.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*"
	[0072.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="1036" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036"
	[0072.031] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036") returned 53
	[0072.031] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0072.031] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.031] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0072.031] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.031] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.031] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0072.031] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0072.031] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSGR3FR.DLL") returned -1
	[0072.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSGR3FR.DLL") returned -1
	[0072.031] lstrcmpiA (lpString1="", lpString2="MSGR3FR.DLL") returned -1
	[0072.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*") returned="*.*"
	[0072.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\"
	[0072.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\") returned=""
	[0072.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\HOW TO DECRYPT FILES.txt"
	[0072.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\how to decrypt files.txt")) returned 0xffffffff
	[0072.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0072.032] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0072.032] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0072.033] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.033] CloseHandle (hObject=0x90) returned 1
	[0072.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", lpString2="MSGR3FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL"
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.zip") returned 0
	[0072.033] lstrlenA (lpString="*.zip") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.rar") returned 0
	[0072.033] lstrlenA (lpString="*.rar") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.7z") returned 0
	[0072.033] lstrlenA (lpString="*.7z") returned 4
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.tar") returned 0
	[0072.033] lstrlenA (lpString="*.tar") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.gzip") returned 0
	[0072.033] lstrlenA (lpString="*.gzip") returned 6
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.jpg") returned 0
	[0072.033] lstrlenA (lpString="*.jpg") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.jpeg") returned 0
	[0072.033] lstrlenA (lpString="*.jpeg") returned 6
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.psd") returned 0
	[0072.033] lstrlenA (lpString="*.psd") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.cdr") returned 0
	[0072.033] lstrlenA (lpString="*.cdr") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.dwg") returned 0
	[0072.033] lstrlenA (lpString="*.dwg") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.max") returned 0
	[0072.033] lstrlenA (lpString="*.max") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.bmp") returned 0
	[0072.033] lstrlenA (lpString="*.bmp") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.gif") returned 0
	[0072.033] lstrlenA (lpString="*.gif") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.png") returned 0
	[0072.033] lstrlenA (lpString="*.png") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.doc") returned 0
	[0072.033] lstrlenA (lpString="*.doc") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.docx") returned 0
	[0072.033] lstrlenA (lpString="*.docx") returned 6
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.xls") returned 0
	[0072.033] lstrlenA (lpString="*.xls") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.xlsx") returned 0
	[0072.033] lstrlenA (lpString="*.xlsx") returned 6
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.ppt") returned 0
	[0072.033] lstrlenA (lpString="*.ppt") returned 5
	[0072.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.pptx") returned 0
	[0072.034] lstrlenA (lpString="*.pptx") returned 6
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.txt") returned 0
	[0072.034] lstrlenA (lpString="*.txt") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.pdf") returned 0
	[0072.034] lstrlenA (lpString="*.pdf") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.djvu") returned 0
	[0072.034] lstrlenA (lpString="*.djvu") returned 6
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.htm") returned 0
	[0072.034] lstrlenA (lpString="*.htm") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.html") returned 0
	[0072.034] lstrlenA (lpString="*.html") returned 6
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mdb") returned 0
	[0072.034] lstrlenA (lpString="*.mdb") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.cer") returned 0
	[0072.034] lstrlenA (lpString="*.cer") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.p12") returned 0
	[0072.034] lstrlenA (lpString="*.p12") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.pfx") returned 0
	[0072.034] lstrlenA (lpString="*.pfx") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.kwm") returned 0
	[0072.034] lstrlenA (lpString="*.kwm") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.pwm") returned 0
	[0072.034] lstrlenA (lpString="*.pwm") returned 5
	[0072.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.1cd") returned 0
	[0072.035] lstrlenA (lpString="*.1cd") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.md") returned 0
	[0072.035] lstrlenA (lpString="*.md") returned 4
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mdf") returned 0
	[0072.035] lstrlenA (lpString="*.mdf") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.dbf") returned 0
	[0072.035] lstrlenA (lpString="*.dbf") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.odt") returned 0
	[0072.035] lstrlenA (lpString="*.odt") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.vob") returned 0
	[0072.035] lstrlenA (lpString="*.vob") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.ifo") returned 0
	[0072.035] lstrlenA (lpString="*.ifo") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.lnk") returned 0
	[0072.035] lstrlenA (lpString="*.lnk") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.torrent") returned 0
	[0072.035] lstrlenA (lpString="*.torrent") returned 9
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mov") returned 0
	[0072.035] lstrlenA (lpString="*.mov") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.m2v") returned 0
	[0072.035] lstrlenA (lpString="*.m2v") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.3gp") returned 0
	[0072.035] lstrlenA (lpString="*.3gp") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mpeg") returned 0
	[0072.035] lstrlenA (lpString="*.mpeg") returned 6
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mpg") returned 0
	[0072.035] lstrlenA (lpString="*.mpg") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.flv") returned 0
	[0072.035] lstrlenA (lpString="*.flv") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.avi") returned 0
	[0072.035] lstrlenA (lpString="*.avi") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mp4") returned 0
	[0072.035] lstrlenA (lpString="*.mp4") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.wmv") returned 0
	[0072.035] lstrlenA (lpString="*.wmv") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.divx") returned 0
	[0072.035] lstrlenA (lpString="*.divx") returned 6
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mkv") returned 0
	[0072.035] lstrlenA (lpString="*.mkv") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.mp3") returned 0
	[0072.035] lstrlenA (lpString="*.mp3") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.wav") returned 0
	[0072.035] lstrlenA (lpString="*.wav") returned 5
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.flac") returned 0
	[0072.035] lstrlenA (lpString="*.flac") returned 6
	[0072.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.ape") returned 0
	[0072.036] lstrlenA (lpString="*.ape") returned 5
	[0072.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.wma") returned 0
	[0072.036] lstrlenA (lpString="*.wma") returned 5
	[0072.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.ac3") returned 0
	[0072.036] lstrlenA (lpString="*.ac3") returned 5
	[0072.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.exe") returned 0
	[0072.036] lstrlenA (lpString="*.exe") returned 5
	[0072.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", pszSpec="*.apk") returned 0
	[0072.036] lstrlenA (lpString="*.apk") returned 5
	[0072.036] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0072.036] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0072.036] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.036] lstrcmpA (lpString1=".", lpString2="3082") returned -1
	[0072.036] lstrcmpA (lpString1="..", lpString2="3082") returned -1
	[0072.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*"
	[0072.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="3082" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082"
	[0072.036] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082") returned 53
	[0072.036] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0072.036] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.036] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0072.036] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.036] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.036] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0072.036] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0072.036] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSGR3ES.DLL") returned -1
	[0072.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSGR3ES.DLL") returned -1
	[0072.036] lstrcmpiA (lpString1="", lpString2="MSGR3ES.DLL") returned -1
	[0072.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*") returned="*.*"
	[0072.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\"
	[0072.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\") returned=""
	[0072.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\HOW TO DECRYPT FILES.txt"
	[0072.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\how to decrypt files.txt")) returned 0xffffffff
	[0072.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0072.037] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0072.037] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0072.039] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.039] CloseHandle (hObject=0x90) returned 1
	[0072.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", lpString2="MSGR3ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL"
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.zip") returned 0
	[0072.039] lstrlenA (lpString="*.zip") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.rar") returned 0
	[0072.039] lstrlenA (lpString="*.rar") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.7z") returned 0
	[0072.039] lstrlenA (lpString="*.7z") returned 4
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.tar") returned 0
	[0072.039] lstrlenA (lpString="*.tar") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.gzip") returned 0
	[0072.039] lstrlenA (lpString="*.gzip") returned 6
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.jpg") returned 0
	[0072.039] lstrlenA (lpString="*.jpg") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.jpeg") returned 0
	[0072.039] lstrlenA (lpString="*.jpeg") returned 6
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.psd") returned 0
	[0072.039] lstrlenA (lpString="*.psd") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.cdr") returned 0
	[0072.039] lstrlenA (lpString="*.cdr") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.dwg") returned 0
	[0072.039] lstrlenA (lpString="*.dwg") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.max") returned 0
	[0072.039] lstrlenA (lpString="*.max") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.bmp") returned 0
	[0072.039] lstrlenA (lpString="*.bmp") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.gif") returned 0
	[0072.039] lstrlenA (lpString="*.gif") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.png") returned 0
	[0072.039] lstrlenA (lpString="*.png") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.doc") returned 0
	[0072.039] lstrlenA (lpString="*.doc") returned 5
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.docx") returned 0
	[0072.039] lstrlenA (lpString="*.docx") returned 6
	[0072.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.xls") returned 0
	[0072.039] lstrlenA (lpString="*.xls") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.xlsx") returned 0
	[0072.040] lstrlenA (lpString="*.xlsx") returned 6
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.ppt") returned 0
	[0072.040] lstrlenA (lpString="*.ppt") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.pptx") returned 0
	[0072.040] lstrlenA (lpString="*.pptx") returned 6
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.txt") returned 0
	[0072.040] lstrlenA (lpString="*.txt") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.pdf") returned 0
	[0072.040] lstrlenA (lpString="*.pdf") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.djvu") returned 0
	[0072.040] lstrlenA (lpString="*.djvu") returned 6
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.htm") returned 0
	[0072.040] lstrlenA (lpString="*.htm") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.html") returned 0
	[0072.040] lstrlenA (lpString="*.html") returned 6
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mdb") returned 0
	[0072.040] lstrlenA (lpString="*.mdb") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.cer") returned 0
	[0072.040] lstrlenA (lpString="*.cer") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.p12") returned 0
	[0072.040] lstrlenA (lpString="*.p12") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.pfx") returned 0
	[0072.040] lstrlenA (lpString="*.pfx") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.kwm") returned 0
	[0072.040] lstrlenA (lpString="*.kwm") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.pwm") returned 0
	[0072.040] lstrlenA (lpString="*.pwm") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.1cd") returned 0
	[0072.040] lstrlenA (lpString="*.1cd") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.md") returned 0
	[0072.040] lstrlenA (lpString="*.md") returned 4
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mdf") returned 0
	[0072.040] lstrlenA (lpString="*.mdf") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.dbf") returned 0
	[0072.040] lstrlenA (lpString="*.dbf") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.odt") returned 0
	[0072.040] lstrlenA (lpString="*.odt") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.vob") returned 0
	[0072.040] lstrlenA (lpString="*.vob") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.ifo") returned 0
	[0072.040] lstrlenA (lpString="*.ifo") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.lnk") returned 0
	[0072.040] lstrlenA (lpString="*.lnk") returned 5
	[0072.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.torrent") returned 0
	[0072.041] lstrlenA (lpString="*.torrent") returned 9
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mov") returned 0
	[0072.041] lstrlenA (lpString="*.mov") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.m2v") returned 0
	[0072.041] lstrlenA (lpString="*.m2v") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.3gp") returned 0
	[0072.041] lstrlenA (lpString="*.3gp") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mpeg") returned 0
	[0072.041] lstrlenA (lpString="*.mpeg") returned 6
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mpg") returned 0
	[0072.041] lstrlenA (lpString="*.mpg") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.flv") returned 0
	[0072.041] lstrlenA (lpString="*.flv") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.avi") returned 0
	[0072.041] lstrlenA (lpString="*.avi") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mp4") returned 0
	[0072.041] lstrlenA (lpString="*.mp4") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.wmv") returned 0
	[0072.041] lstrlenA (lpString="*.wmv") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.divx") returned 0
	[0072.041] lstrlenA (lpString="*.divx") returned 6
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mkv") returned 0
	[0072.041] lstrlenA (lpString="*.mkv") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.mp3") returned 0
	[0072.041] lstrlenA (lpString="*.mp3") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.wav") returned 0
	[0072.041] lstrlenA (lpString="*.wav") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.flac") returned 0
	[0072.041] lstrlenA (lpString="*.flac") returned 6
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.ape") returned 0
	[0072.041] lstrlenA (lpString="*.ape") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.wma") returned 0
	[0072.041] lstrlenA (lpString="*.wma") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.ac3") returned 0
	[0072.041] lstrlenA (lpString="*.ac3") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.exe") returned 0
	[0072.041] lstrlenA (lpString="*.exe") returned 5
	[0072.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", pszSpec="*.apk") returned 0
	[0072.041] lstrlenA (lpString="*.apk") returned 5
	[0072.041] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0072.041] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0072.041] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.041] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.041] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSGR3EN.LEX") returned -1
	[0072.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSGR3EN.LEX") returned -1
	[0072.042] lstrcmpiA (lpString1="", lpString2="MSGR3EN.LEX") returned -1
	[0072.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*"
	[0072.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0xffffffff
	[0072.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0072.042] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0072.042] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0072.043] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.043] CloseHandle (hObject=0x8c) returned 1
	[0072.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX"
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.zip") returned 0
	[0072.044] lstrlenA (lpString="*.zip") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.rar") returned 0
	[0072.044] lstrlenA (lpString="*.rar") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.7z") returned 0
	[0072.044] lstrlenA (lpString="*.7z") returned 4
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.tar") returned 0
	[0072.044] lstrlenA (lpString="*.tar") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.gzip") returned 0
	[0072.044] lstrlenA (lpString="*.gzip") returned 6
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.jpg") returned 0
	[0072.044] lstrlenA (lpString="*.jpg") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.jpeg") returned 0
	[0072.044] lstrlenA (lpString="*.jpeg") returned 6
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.psd") returned 0
	[0072.044] lstrlenA (lpString="*.psd") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.cdr") returned 0
	[0072.044] lstrlenA (lpString="*.cdr") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.dwg") returned 0
	[0072.044] lstrlenA (lpString="*.dwg") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.max") returned 0
	[0072.044] lstrlenA (lpString="*.max") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.bmp") returned 0
	[0072.044] lstrlenA (lpString="*.bmp") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.gif") returned 0
	[0072.044] lstrlenA (lpString="*.gif") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.png") returned 0
	[0072.044] lstrlenA (lpString="*.png") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.doc") returned 0
	[0072.044] lstrlenA (lpString="*.doc") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.docx") returned 0
	[0072.044] lstrlenA (lpString="*.docx") returned 6
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.xls") returned 0
	[0072.044] lstrlenA (lpString="*.xls") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.xlsx") returned 0
	[0072.044] lstrlenA (lpString="*.xlsx") returned 6
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.ppt") returned 0
	[0072.044] lstrlenA (lpString="*.ppt") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.pptx") returned 0
	[0072.044] lstrlenA (lpString="*.pptx") returned 6
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.txt") returned 0
	[0072.044] lstrlenA (lpString="*.txt") returned 5
	[0072.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.pdf") returned 0
	[0072.045] lstrlenA (lpString="*.pdf") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.djvu") returned 0
	[0072.045] lstrlenA (lpString="*.djvu") returned 6
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.htm") returned 0
	[0072.045] lstrlenA (lpString="*.htm") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.html") returned 0
	[0072.045] lstrlenA (lpString="*.html") returned 6
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mdb") returned 0
	[0072.045] lstrlenA (lpString="*.mdb") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.cer") returned 0
	[0072.045] lstrlenA (lpString="*.cer") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.p12") returned 0
	[0072.045] lstrlenA (lpString="*.p12") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.pfx") returned 0
	[0072.045] lstrlenA (lpString="*.pfx") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.kwm") returned 0
	[0072.045] lstrlenA (lpString="*.kwm") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.pwm") returned 0
	[0072.045] lstrlenA (lpString="*.pwm") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.1cd") returned 0
	[0072.045] lstrlenA (lpString="*.1cd") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.md") returned 0
	[0072.045] lstrlenA (lpString="*.md") returned 4
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mdf") returned 0
	[0072.045] lstrlenA (lpString="*.mdf") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.dbf") returned 0
	[0072.045] lstrlenA (lpString="*.dbf") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.odt") returned 0
	[0072.045] lstrlenA (lpString="*.odt") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.vob") returned 0
	[0072.045] lstrlenA (lpString="*.vob") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.ifo") returned 0
	[0072.045] lstrlenA (lpString="*.ifo") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.lnk") returned 0
	[0072.045] lstrlenA (lpString="*.lnk") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.torrent") returned 0
	[0072.045] lstrlenA (lpString="*.torrent") returned 9
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mov") returned 0
	[0072.045] lstrlenA (lpString="*.mov") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.m2v") returned 0
	[0072.045] lstrlenA (lpString="*.m2v") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.3gp") returned 0
	[0072.045] lstrlenA (lpString="*.3gp") returned 5
	[0072.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mpeg") returned 0
	[0072.045] lstrlenA (lpString="*.mpeg") returned 6
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mpg") returned 0
	[0072.046] lstrlenA (lpString="*.mpg") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.flv") returned 0
	[0072.046] lstrlenA (lpString="*.flv") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.avi") returned 0
	[0072.046] lstrlenA (lpString="*.avi") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mp4") returned 0
	[0072.046] lstrlenA (lpString="*.mp4") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.wmv") returned 0
	[0072.046] lstrlenA (lpString="*.wmv") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.divx") returned 0
	[0072.046] lstrlenA (lpString="*.divx") returned 6
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mkv") returned 0
	[0072.046] lstrlenA (lpString="*.mkv") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.mp3") returned 0
	[0072.046] lstrlenA (lpString="*.mp3") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.wav") returned 0
	[0072.046] lstrlenA (lpString="*.wav") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.flac") returned 0
	[0072.046] lstrlenA (lpString="*.flac") returned 6
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.ape") returned 0
	[0072.046] lstrlenA (lpString="*.ape") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.wma") returned 0
	[0072.046] lstrlenA (lpString="*.wma") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.ac3") returned 0
	[0072.046] lstrlenA (lpString="*.ac3") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.exe") returned 0
	[0072.046] lstrlenA (lpString="*.exe") returned 5
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", pszSpec="*.apk") returned 0
	[0072.046] lstrlenA (lpString="*.apk") returned 5
	[0072.046] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.046] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.046] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSGR3ES.LEX") returned -1
	[0072.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSGR3ES.LEX") returned -1
	[0072.046] lstrcmpiA (lpString1="", lpString2="MSGR3ES.LEX") returned -1
	[0072.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="MSGR3EN.LEX"
	[0072.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX"
	[0072.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.zip") returned 0
	[0072.047] lstrlenA (lpString="*.zip") returned 5
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.rar") returned 0
	[0072.047] lstrlenA (lpString="*.rar") returned 5
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.7z") returned 0
	[0072.047] lstrlenA (lpString="*.7z") returned 4
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.tar") returned 0
	[0072.047] lstrlenA (lpString="*.tar") returned 5
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.gzip") returned 0
	[0072.047] lstrlenA (lpString="*.gzip") returned 6
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.jpg") returned 0
	[0072.047] lstrlenA (lpString="*.jpg") returned 5
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.jpeg") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.psd") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.cdr") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.dwg") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.max") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.bmp") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.gif") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.png") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.doc") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.docx") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.xls") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.xlsx") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.ppt") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.pptx") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.txt") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.pdf") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.djvu") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.htm") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.html") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mdb") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.cer") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.p12") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.pfx") returned 0
	[0072.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.kwm") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.pwm") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.1cd") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.md") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mdf") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.dbf") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.odt") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.vob") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.ifo") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.lnk") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.torrent") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mov") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.m2v") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.3gp") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mpeg") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mpg") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.flv") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.avi") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mp4") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.wmv") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.divx") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mkv") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.mp3") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.wav") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.flac") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.ape") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.wma") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.ac3") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.exe") returned 0
	[0072.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", pszSpec="*.apk") returned 0
	[0072.048] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.048] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.048] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSGR3FR.LEX") returned -1
	[0072.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSGR3FR.LEX") returned -1
	[0072.049] lstrcmpiA (lpString1="", lpString2="MSGR3FR.LEX") returned -1
	[0072.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned="MSGR3ES.LEX"
	[0072.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX"
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.zip") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.rar") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.7z") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.tar") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.gzip") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.jpg") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.jpeg") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.psd") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.cdr") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.dwg") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.max") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.bmp") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.gif") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.png") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.doc") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.docx") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.xls") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.xlsx") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.ppt") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.pptx") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.txt") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.pdf") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.djvu") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.htm") returned 0
	[0072.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.html") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mdb") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.cer") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.p12") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.pfx") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.kwm") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.pwm") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.1cd") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.md") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mdf") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.dbf") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.odt") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.vob") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.ifo") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.lnk") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.torrent") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mov") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.m2v") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.3gp") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mpeg") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mpg") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.flv") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.avi") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mp4") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.wmv") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.divx") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mkv") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.mp3") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.wav") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.flac") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.ape") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.wma") returned 0
	[0072.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.ac3") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.exe") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", pszSpec="*.apk") returned 0
	[0072.051] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.051] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.051] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSHY7EN.DLL") returned -1
	[0072.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSHY7EN.DLL") returned -1
	[0072.051] lstrcmpiA (lpString1="", lpString2="MSHY7EN.DLL") returned -1
	[0072.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned="MSGR3FR.LEX"
	[0072.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL"
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.zip") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.rar") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.7z") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.tar") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.gzip") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.jpg") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.jpeg") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.psd") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.cdr") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.dwg") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.max") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.bmp") returned 0
	[0072.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", pszSpec="*.gif") returned 0
	[0072.051] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.051] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.052] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSHY7EN.LEX") returned -1
	[0072.052] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSHY7EN.LEX") returned -1
	[0072.052] lstrcmpiA (lpString1="", lpString2="MSHY7EN.LEX") returned -1
	[0072.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned="MSHY7EN.DLL"
	[0072.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX"
	[0072.052] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.052] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.052] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSHY7ES.DLL") returned -1
	[0072.052] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSHY7ES.DLL") returned -1
	[0072.052] lstrcmpiA (lpString1="", lpString2="MSHY7ES.DLL") returned -1
	[0072.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned="MSHY7EN.LEX"
	[0072.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL"
	[0072.052] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.052] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.052] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSHY7ES.LEX") returned -1
	[0072.052] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSHY7ES.LEX") returned -1
	[0072.052] lstrcmpiA (lpString1="", lpString2="MSHY7ES.LEX") returned -1
	[0072.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned="MSHY7ES.DLL"
	[0072.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.052] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX"
	[0072.052] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.053] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSHY7FR.DLL") returned -1
	[0072.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSHY7FR.DLL") returned -1
	[0072.053] lstrcmpiA (lpString1="", lpString2="MSHY7FR.DLL") returned -1
	[0072.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned="MSHY7ES.LEX"
	[0072.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL"
	[0072.053] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.053] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSHY7FR.LEX") returned -1
	[0072.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSHY7FR.LEX") returned -1
	[0072.053] lstrcmpiA (lpString1="", lpString2="MSHY7FR.LEX") returned -1
	[0072.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned="MSHY7FR.DLL"
	[0072.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX"
	[0072.053] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.053] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7EN.DLL") returned -1
	[0072.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7EN.DLL") returned -1
	[0072.053] lstrcmpiA (lpString1="", lpString2="MSSP7EN.DLL") returned -1
	[0072.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned="MSHY7FR.LEX"
	[0072.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL"
	[0072.053] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.053] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7EN.dub") returned -1
	[0072.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7EN.dub") returned -1
	[0072.054] lstrcmpiA (lpString1="", lpString2="MSSP7EN.dub") returned -1
	[0072.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned="MSSP7EN.DLL"
	[0072.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7EN.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub"
	[0072.054] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.054] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.054] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7EN.LEX") returned -1
	[0072.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7EN.LEX") returned -1
	[0072.054] lstrcmpiA (lpString1="", lpString2="MSSP7EN.LEX") returned -1
	[0072.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned="MSSP7EN.dub"
	[0072.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX"
	[0072.054] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.054] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.054] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7ES.DLL") returned -1
	[0072.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7ES.DLL") returned -1
	[0072.054] lstrcmpiA (lpString1="", lpString2="MSSP7ES.DLL") returned -1
	[0072.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned="MSSP7EN.LEX"
	[0072.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL"
	[0072.054] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.054] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.054] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7ES.dub") returned -1
	[0072.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7ES.dub") returned -1
	[0072.055] lstrcmpiA (lpString1="", lpString2="MSSP7ES.dub") returned -1
	[0072.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned="MSSP7ES.DLL"
	[0072.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7ES.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub"
	[0072.055] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.055] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.055] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7ES.LEX") returned -1
	[0072.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7ES.LEX") returned -1
	[0072.055] lstrcmpiA (lpString1="", lpString2="MSSP7ES.LEX") returned -1
	[0072.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned="MSSP7ES.dub"
	[0072.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX"
	[0072.055] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.055] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.055] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7FR.DLL") returned -1
	[0072.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7FR.DLL") returned -1
	[0072.055] lstrcmpiA (lpString1="", lpString2="MSSP7FR.DLL") returned -1
	[0072.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned="MSSP7ES.LEX"
	[0072.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL"
	[0072.055] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.055] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.055] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7FR.dub") returned -1
	[0072.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7FR.dub") returned -1
	[0072.056] lstrcmpiA (lpString1="", lpString2="MSSP7FR.dub") returned -1
	[0072.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned="MSSP7FR.DLL"
	[0072.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7FR.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub"
	[0072.056] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSP7FR.LEX") returned -1
	[0072.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSP7FR.LEX") returned -1
	[0072.056] lstrcmpiA (lpString1="", lpString2="MSSP7FR.LEX") returned -1
	[0072.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned="MSSP7FR.dub"
	[0072.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX"
	[0072.056] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTH7EN.DLL") returned -1
	[0072.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTH7EN.DLL") returned -1
	[0072.056] lstrcmpiA (lpString1="", lpString2="MSTH7EN.DLL") returned -1
	[0072.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned="MSSP7FR.LEX"
	[0072.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL"
	[0072.056] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTH7EN.LEX") returned -1
	[0072.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTH7EN.LEX") returned -1
	[0072.057] lstrcmpiA (lpString1="", lpString2="MSTH7EN.LEX") returned -1
	[0072.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned="MSTH7EN.DLL"
	[0072.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX"
	[0072.057] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.057] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.057] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTH7ES.DLL") returned -1
	[0072.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTH7ES.DLL") returned -1
	[0072.057] lstrcmpiA (lpString1="", lpString2="MSTH7ES.DLL") returned -1
	[0072.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned="MSTH7EN.LEX"
	[0072.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL"
	[0072.057] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.057] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.057] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTH7ES.LEX") returned -1
	[0072.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTH7ES.LEX") returned -1
	[0072.057] lstrcmpiA (lpString1="", lpString2="MSTH7ES.LEX") returned -1
	[0072.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned="MSTH7ES.DLL"
	[0072.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX"
	[0072.057] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.057] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.057] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTH7FR.DLL") returned -1
	[0072.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTH7FR.DLL") returned -1
	[0072.057] lstrcmpiA (lpString1="", lpString2="MSTH7FR.DLL") returned -1
	[0072.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned="MSTH7ES.LEX"
	[0072.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL"
	[0072.058] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.058] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTH7FR.LEX") returned -1
	[0072.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTH7FR.LEX") returned -1
	[0072.058] lstrcmpiA (lpString1="", lpString2="MSTH7FR.LEX") returned -1
	[0072.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned="MSTH7FR.DLL"
	[0072.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\"
	[0072.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned=""
	[0072.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt"
	[0072.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to decrypt files.txt")) returned 0x20
	[0072.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX"
	[0072.058] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0072.058] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0072.058] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.058] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0072.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PROPMGR.DLL") returned -1
	[0072.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROPMGR.DLL") returned -1
	[0072.058] lstrcmpiA (lpString1="", lpString2="PROPMGR.DLL") returned -1
	[0072.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0072.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0072.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0072.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0072.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROPMGR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL"
	[0072.059] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.059] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0072.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PROPRPT.DLL") returned -1
	[0072.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROPRPT.DLL") returned -1
	[0072.059] lstrcmpiA (lpString1="", lpString2="PROPRPT.DLL") returned -1
	[0072.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned="PROPMGR.DLL"
	[0072.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0072.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0072.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0072.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROPRPT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL"
	[0072.059] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.059] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0072.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PRTF9.DLL") returned -1
	[0072.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PRTF9.DLL") returned -1
	[0072.059] lstrcmpiA (lpString1="", lpString2="PRTF9.DLL") returned -1
	[0072.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned="PROPRPT.DLL"
	[0072.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0072.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0072.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0072.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PRTF9.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL"
	[0072.059] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.059] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0072.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PSTPRX32.DLL") returned -1
	[0072.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSTPRX32.DLL") returned -1
	[0072.059] lstrcmpiA (lpString1="", lpString2="PSTPRX32.DLL") returned -1
	[0072.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned="PRTF9.DLL"
	[0072.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0072.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0072.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0072.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PSTPRX32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL"
	[0072.060] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.060] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0072.060] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PTXT9.DLL") returned -1
	[0072.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PTXT9.DLL") returned -1
	[0072.060] lstrcmpiA (lpString1="", lpString2="PTXT9.DLL") returned -1
	[0072.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned="PSTPRX32.DLL"
	[0072.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0072.060] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0072.060] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0072.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PTXT9.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL"
	[0072.060] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.060] lstrcmpA (lpString1=".", lpString2="PUBBA") returned -1
	[0072.060] lstrcmpA (lpString1="..", lpString2="PUBBA") returned -1
	[0072.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned="PTXT9.DLL"
	[0072.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBBA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA"
	[0072.060] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0072.128] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.128] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.128] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.128] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.128] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.128] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB10.BDR") returned -1
	[0072.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB10.BDR") returned -1
	[0072.128] lstrcmpiA (lpString1="", lpString2="MSPUB10.BDR") returned -1
	[0072.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*") returned="*.*"
	[0072.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.128] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.128] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0xffffffff
	[0072.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0072.131] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.131] CloseHandle (hObject=0x8c) returned 1
	[0072.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB10.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR"
	[0072.131] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.131] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.131] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB11.BDR") returned -1
	[0072.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB11.BDR") returned -1
	[0072.131] lstrcmpiA (lpString1="", lpString2="MSPUB11.BDR") returned -1
	[0072.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="MSPUB10.BDR"
	[0072.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB11.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR"
	[0072.131] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.131] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.131] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB1A.BDR") returned -1
	[0072.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB1A.BDR") returned -1
	[0072.131] lstrcmpiA (lpString1="", lpString2="MSPUB1A.BDR") returned -1
	[0072.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned="MSPUB11.BDR"
	[0072.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB1A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR"
	[0072.132] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.132] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB1B.BDR") returned -1
	[0072.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB1B.BDR") returned -1
	[0072.132] lstrcmpiA (lpString1="", lpString2="MSPUB1B.BDR") returned -1
	[0072.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned="MSPUB1A.BDR"
	[0072.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB1B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR"
	[0072.132] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.132] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB2A.BDR") returned -1
	[0072.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB2A.BDR") returned -1
	[0072.132] lstrcmpiA (lpString1="", lpString2="MSPUB2A.BDR") returned -1
	[0072.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned="MSPUB1B.BDR"
	[0072.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB2A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR"
	[0072.132] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.132] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB2B.BDR") returned -1
	[0072.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB2B.BDR") returned -1
	[0072.132] lstrcmpiA (lpString1="", lpString2="MSPUB2B.BDR") returned -1
	[0072.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned="MSPUB2A.BDR"
	[0072.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB2B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR"
	[0072.133] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB3A.BDR") returned -1
	[0072.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB3A.BDR") returned -1
	[0072.133] lstrcmpiA (lpString1="", lpString2="MSPUB3A.BDR") returned -1
	[0072.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned="MSPUB2B.BDR"
	[0072.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB3A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR"
	[0072.133] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB3B.BDR") returned -1
	[0072.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB3B.BDR") returned -1
	[0072.133] lstrcmpiA (lpString1="", lpString2="MSPUB3B.BDR") returned -1
	[0072.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned="MSPUB3A.BDR"
	[0072.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB3B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR"
	[0072.133] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB4.BDR") returned -1
	[0072.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB4.BDR") returned -1
	[0072.133] lstrcmpiA (lpString1="", lpString2="MSPUB4.BDR") returned -1
	[0072.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned="MSPUB3B.BDR"
	[0072.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB4.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR"
	[0072.134] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.134] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB5A.BDR") returned -1
	[0072.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB5A.BDR") returned -1
	[0072.134] lstrcmpiA (lpString1="", lpString2="MSPUB5A.BDR") returned -1
	[0072.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned="MSPUB4.BDR"
	[0072.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB5A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR"
	[0072.134] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.134] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB5B.BDR") returned -1
	[0072.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB5B.BDR") returned -1
	[0072.134] lstrcmpiA (lpString1="", lpString2="MSPUB5B.BDR") returned -1
	[0072.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned="MSPUB5A.BDR"
	[0072.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB5B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR"
	[0072.134] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.134] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB6.BDR") returned -1
	[0072.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB6.BDR") returned -1
	[0072.135] lstrcmpiA (lpString1="", lpString2="MSPUB6.BDR") returned -1
	[0072.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned="MSPUB5B.BDR"
	[0072.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB6.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR"
	[0072.135] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB7.BDR") returned -1
	[0072.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB7.BDR") returned -1
	[0072.135] lstrcmpiA (lpString1="", lpString2="MSPUB7.BDR") returned -1
	[0072.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned="MSPUB6.BDR"
	[0072.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB7.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR"
	[0072.135] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB8.BDR") returned -1
	[0072.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB8.BDR") returned -1
	[0072.135] lstrcmpiA (lpString1="", lpString2="MSPUB8.BDR") returned -1
	[0072.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned="MSPUB7.BDR"
	[0072.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB8.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR"
	[0072.135] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB9.BDR") returned -1
	[0072.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB9.BDR") returned -1
	[0072.136] lstrcmpiA (lpString1="", lpString2="MSPUB9.BDR") returned -1
	[0072.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned="MSPUB8.BDR"
	[0072.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\"
	[0072.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned=""
	[0072.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt"
	[0072.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to decrypt files.txt")) returned 0x20
	[0072.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB9.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR"
	[0072.136] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0072.136] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0072.136] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.136] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0072.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PUBCONV.DLL") returned -1
	[0072.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUBCONV.DLL") returned -1
	[0072.136] lstrcmpiA (lpString1="", lpString2="PUBCONV.DLL") returned -1
	[0072.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*"
	[0072.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0072.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0072.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0072.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBCONV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL"
	[0072.136] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.136] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0072.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PUBTRAP.DLL") returned -1
	[0072.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUBTRAP.DLL") returned -1
	[0072.136] lstrcmpiA (lpString1="", lpString2="PUBTRAP.DLL") returned -1
	[0072.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned="PUBCONV.DLL"
	[0072.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\"
	[0072.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt"
	[0072.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20
	[0072.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBTRAP.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL"
	[0072.137] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0072.137] lstrcmpA (lpString1=".", lpString2="PUBWIZ") returned -1
	[0072.137] lstrcmpA (lpString1="..", lpString2="PUBWIZ") returned -1
	[0072.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned="PUBTRAP.DLL"
	[0072.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBWIZ" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ"
	[0072.137] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0072.139] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.139] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.139] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.140] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.140] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.140] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.140] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCSBAR.POC") returned 1
	[0072.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCSBAR.POC") returned 1
	[0072.140] lstrcmpiA (lpString1="", lpString2="ACCSBAR.POC") returned -1
	[0072.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*") returned="*.*"
	[0072.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.140] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0xffffffff
	[0072.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0072.142] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.142] CloseHandle (hObject=0x8c) returned 1
	[0072.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ACCSBAR.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC"
	[0072.142] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.142] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.142] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACCTBOX.POC") returned 1
	[0072.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCTBOX.POC") returned 1
	[0072.142] lstrcmpiA (lpString1="", lpString2="ACCTBOX.POC") returned -1
	[0072.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="ACCSBAR.POC"
	[0072.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ACCTBOX.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC"
	[0072.142] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.142] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.142] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AD.DPV") returned 1
	[0072.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AD.DPV") returned 1
	[0072.142] lstrcmpiA (lpString1="", lpString2="AD.DPV") returned -1
	[0072.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned="ACCTBOX.POC"
	[0072.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AD.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV"
	[0072.142] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.143] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AD.XML") returned 1
	[0072.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AD.XML") returned 1
	[0072.143] lstrcmpiA (lpString1="", lpString2="AD.XML") returned -1
	[0072.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned="AD.DPV"
	[0072.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML"
	[0072.143] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.143] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AD98.POC") returned 1
	[0072.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AD98.POC") returned 1
	[0072.143] lstrcmpiA (lpString1="", lpString2="AD98.POC") returned -1
	[0072.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML") returned="AD.XML"
	[0072.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AD98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC"
	[0072.143] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.143] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADRESPEL.POC") returned 1
	[0072.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADRESPEL.POC") returned 1
	[0072.143] lstrcmpiA (lpString1="", lpString2="ADRESPEL.POC") returned -1
	[0072.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned="AD98.POC"
	[0072.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.143] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ADRESPEL.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC"
	[0072.143] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.144] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AIR98.POC") returned 1
	[0072.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AIR98.POC") returned 1
	[0072.144] lstrcmpiA (lpString1="", lpString2="AIR98.POC") returned -1
	[0072.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned="ADRESPEL.POC"
	[0072.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AIR98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC"
	[0072.144] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.144] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AWARDHM.POC") returned 1
	[0072.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AWARDHM.POC") returned 1
	[0072.144] lstrcmpiA (lpString1="", lpString2="AWARDHM.POC") returned -1
	[0072.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned="AIR98.POC"
	[0072.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AWARDHM.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC"
	[0072.144] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.144] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BAN98.POC") returned 1
	[0072.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BAN98.POC") returned 1
	[0072.144] lstrcmpiA (lpString1="", lpString2="BAN98.POC") returned -1
	[0072.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned="AWARDHM.POC"
	[0072.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BAN98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC"
	[0072.144] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.145] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.145] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BANNER.DPV") returned 1
	[0072.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BANNER.DPV") returned 1
	[0072.145] lstrcmpiA (lpString1="", lpString2="BANNER.DPV") returned -1
	[0072.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned="BAN98.POC"
	[0072.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BANNER.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV"
	[0072.145] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.145] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.145] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BANNER.XML") returned 1
	[0072.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BANNER.XML") returned 1
	[0072.145] lstrcmpiA (lpString1="", lpString2="BANNER.XML") returned -1
	[0072.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned="BANNER.DPV"
	[0072.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BANNER.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML"
	[0072.145] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.145] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.145] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BDRTKFUL.POC") returned 1
	[0072.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BDRTKFUL.POC") returned 1
	[0072.145] lstrcmpiA (lpString1="", lpString2="BDRTKFUL.POC") returned -1
	[0072.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned="BANNER.XML"
	[0072.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BDRTKFUL.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC"
	[0072.145] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.145] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BIZCARD.DPV") returned 1
	[0072.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIZCARD.DPV") returned 1
	[0072.146] lstrcmpiA (lpString1="", lpString2="BIZCARD.DPV") returned -1
	[0072.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned="BDRTKFUL.POC"
	[0072.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZCARD.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV"
	[0072.146] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.146] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BIZCARD.XML") returned 1
	[0072.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIZCARD.XML") returned 1
	[0072.146] lstrcmpiA (lpString1="", lpString2="BIZCARD.XML") returned -1
	[0072.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned="BIZCARD.DPV"
	[0072.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZCARD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML"
	[0072.146] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.146] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BIZFORM.DPV") returned 1
	[0072.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIZFORM.DPV") returned 1
	[0072.146] lstrcmpiA (lpString1="", lpString2="BIZFORM.DPV") returned -1
	[0072.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned="BIZCARD.XML"
	[0072.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZFORM.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV"
	[0072.147] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.147] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BIZFORM.XML") returned 1
	[0072.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIZFORM.XML") returned 1
	[0072.147] lstrcmpiA (lpString1="", lpString2="BIZFORM.XML") returned -1
	[0072.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned="BIZFORM.DPV"
	[0072.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZFORM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML"
	[0072.147] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.147] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BORDERBB.DPV") returned 1
	[0072.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BORDERBB.DPV") returned 1
	[0072.147] lstrcmpiA (lpString1="", lpString2="BORDERBB.DPV") returned -1
	[0072.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned="BIZFORM.XML"
	[0072.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BORDERBB.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV"
	[0072.147] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.147] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BORDERBB.POC") returned 1
	[0072.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BORDERBB.POC") returned 1
	[0072.147] lstrcmpiA (lpString1="", lpString2="BORDERBB.POC") returned -1
	[0072.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned="BORDERBB.DPV"
	[0072.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BORDERBB.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC"
	[0072.148] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.148] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.148] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BRCH98SP.POC") returned 1
	[0072.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRCH98SP.POC") returned 1
	[0072.148] lstrcmpiA (lpString1="", lpString2="BRCH98SP.POC") returned -1
	[0072.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned="BORDERBB.POC"
	[0072.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BRCH98SP.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC"
	[0072.148] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.148] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.148] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BRCHUR11.POC") returned 1
	[0072.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRCHUR11.POC") returned 1
	[0072.148] lstrcmpiA (lpString1="", lpString2="BRCHUR11.POC") returned -1
	[0072.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned="BRCH98SP.POC"
	[0072.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BRCHUR11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC"
	[0072.148] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.148] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.148] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BRCHUR98.POC") returned 1
	[0072.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRCHUR98.POC") returned 1
	[0072.148] lstrcmpiA (lpString1="", lpString2="BRCHUR98.POC") returned -1
	[0072.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned="BRCHUR11.POC"
	[0072.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.149] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.149] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BRCHUR98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC"
	[0072.149] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.149] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.149] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BROCHURE.DPV") returned 1
	[0072.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BROCHURE.DPV") returned 1
	[0072.149] lstrcmpiA (lpString1="", lpString2="BROCHURE.DPV") returned -1
	[0072.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned="BRCHUR98.POC"
	[0072.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.149] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.149] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BROCHURE.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV"
	[0072.149] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.149] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.149] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BROCHURE.XML") returned 1
	[0072.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BROCHURE.XML") returned 1
	[0072.149] lstrcmpiA (lpString1="", lpString2="BROCHURE.XML") returned -1
	[0072.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned="BROCHURE.DPV"
	[0072.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.149] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.149] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BROCHURE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML"
	[0072.149] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.149] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.149] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS2BARB.POC") returned 1
	[0072.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS2BARB.POC") returned 1
	[0072.149] lstrcmpiA (lpString1="", lpString2="BS2BARB.POC") returned -1
	[0072.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned="BROCHURE.XML"
	[0072.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.149] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.150] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BS2BARB.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC"
	[0072.150] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.150] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.150] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS4BOXES.POC") returned 1
	[0072.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS4BOXES.POC") returned 1
	[0072.150] lstrcmpiA (lpString1="", lpString2="BS4BOXES.POC") returned -1
	[0072.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned="BS2BARB.POC"
	[0072.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.150] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.150] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BS4BOXES.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC"
	[0072.150] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.150] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.150] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BS53BOXS.POC") returned 1
	[0072.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS53BOXS.POC") returned 1
	[0072.150] lstrcmpiA (lpString1="", lpString2="BS53BOXS.POC") returned -1
	[0072.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned="BS4BOXES.POC"
	[0072.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.150] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.150] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BS53BOXS.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC"
	[0072.150] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.150] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.150] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BZCARD11.POC") returned 1
	[0072.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BZCARD11.POC") returned 1
	[0072.150] lstrcmpiA (lpString1="", lpString2="BZCARD11.POC") returned -1
	[0072.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned="BS53BOXS.POC"
	[0072.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCARD11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC"
	[0072.151] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.151] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.151] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BZCARDHM.POC") returned 1
	[0072.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BZCARDHM.POC") returned 1
	[0072.151] lstrcmpiA (lpString1="", lpString2="BZCARDHM.POC") returned -1
	[0072.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned="BZCARD11.POC"
	[0072.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCARDHM.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC"
	[0072.151] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.151] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.151] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BZCD98SP.POC") returned 1
	[0072.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BZCD98SP.POC") returned 1
	[0072.151] lstrcmpiA (lpString1="", lpString2="BZCD98SP.POC") returned -1
	[0072.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned="BZCARDHM.POC"
	[0072.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCD98SP.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC"
	[0072.151] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.152] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.152] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BZCRD98.POC") returned 1
	[0072.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BZCRD98.POC") returned 1
	[0072.152] lstrcmpiA (lpString1="", lpString2="BZCRD98.POC") returned -1
	[0072.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned="BZCD98SP.POC"
	[0072.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCRD98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC"
	[0072.152] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.152] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.152] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.DPV") returned 1
	[0072.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.DPV") returned 1
	[0072.152] lstrcmpiA (lpString1="", lpString2="CALENDAR.DPV") returned -1
	[0072.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned="BZCRD98.POC"
	[0072.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALENDAR.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV"
	[0072.152] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.152] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.152] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.XML") returned 1
	[0072.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.XML") returned 1
	[0072.152] lstrcmpiA (lpString1="", lpString2="CALENDAR.XML") returned -1
	[0072.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned="CALENDAR.DPV"
	[0072.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALENDAR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML"
	[0072.153] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.153] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALHM.POC") returned 1
	[0072.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALHM.POC") returned 1
	[0072.153] lstrcmpiA (lpString1="", lpString2="CALHM.POC") returned -1
	[0072.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned="CALENDAR.XML"
	[0072.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALHM.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC"
	[0072.153] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.153] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALNDR98.POC") returned 1
	[0072.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALNDR98.POC") returned 1
	[0072.153] lstrcmpiA (lpString1="", lpString2="CALNDR98.POC") returned -1
	[0072.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned="CALHM.POC"
	[0072.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALNDR98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC"
	[0072.154] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.154] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.154] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALSO11.POC") returned 1
	[0072.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALSO11.POC") returned 1
	[0072.154] lstrcmpiA (lpString1="", lpString2="CALSO11.POC") returned -1
	[0072.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned="CALNDR98.POC"
	[0072.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALSO11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC"
	[0072.154] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.154] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.154] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALSO98.POC") returned 1
	[0072.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALSO98.POC") returned 1
	[0072.154] lstrcmpiA (lpString1="", lpString2="CALSO98.POC") returned -1
	[0072.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned="CALSO11.POC"
	[0072.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALSO98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC"
	[0072.154] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.154] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned="CALSO98.POC"
	[0072.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATALOG.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV"
	[0072.155] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.155] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned="CATALOG.DPV"
	[0072.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATALOG.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML"
	[0072.155] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.155] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML") returned="CATALOG.XML"
	[0072.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATWIZ.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC"
	[0072.155] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.155] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned="CATWIZ.POC"
	[0072.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATWIZ11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC"
	[0072.156] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.156] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned="CATWIZ11.POC"
	[0072.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV"
	[0072.156] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.156] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned="CERT.DPV"
	[0072.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML"
	[0072.156] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.156] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML") returned="CERT.XML"
	[0072.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC"
	[0072.156] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0072.156] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned="CERT98.POC"
	[0072.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT98SP.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC"
	[0072.157] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned="CERT98SP.POC"
	[0072.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CHECKER.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC"
	[0072.157] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned="CHECKER.POC"
	[0072.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CONTACTINFOBB.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV"
	[0072.157] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned="CONTACTINFOBB.DPV"
	[0072.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CONTACTINFOBB.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC"
	[0072.157] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned="CONTACTINFOBB.POC"
	[0072.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="COUPON.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC"
	[0072.158] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned="COUPON.POC"
	[0072.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBAR.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV"
	[0072.158] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned="DGACCBAR.DPV"
	[0072.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBAR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML"
	[0072.158] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML") returned="DGACCBAR.XML"
	[0072.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBOX.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV"
	[0072.158] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned="DGACCBOX.DPV"
	[0072.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBOX.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML"
	[0072.159] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML") returned="DGACCBOX.XML"
	[0072.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGAD.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV"
	[0072.159] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned="DGAD.DPV"
	[0072.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGAD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML"
	[0072.159] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML") returned="DGAD.XML"
	[0072.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGATNGET.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV"
	[0072.159] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned="DGATNGET.DPV"
	[0072.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGATNGET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML"
	[0072.160] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML") returned="DGATNGET.XML"
	[0072.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGBARBLL.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV"
	[0072.160] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned="DGBARBLL.DPV"
	[0072.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGBARBLL.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML"
	[0072.160] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML") returned="DGBARBLL.XML"
	[0072.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGBORDER.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV"
	[0072.160] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGBORDER.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML"
	[0072.161] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGBOXES.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV"
	[0072.161] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGBOXES.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML"
	[0072.161] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGCAL.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV"
	[0072.162] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGCAL.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML"
	[0072.162] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGCHKBRD.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV"
	[0072.162] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGCHKBRD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML"
	[0072.162] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGCINFO.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML"
	[0072.164] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.164] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.164] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGCOUPON.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV"
	[0072.165] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGCOUPON.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML"
	[0072.165] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGDOTS.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV"
	[0072.165] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGDOTS.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML"
	[0072.165] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGHEADING.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML"
	[0072.166] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGLINACC.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV"
	[0072.166] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt"
	[0072.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to decrypt files.txt")) returned 0x20
	[0072.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGLINACC.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML"
	[0072.166] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\"
	[0072.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned=""
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.168] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.169] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.169] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.169] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.169] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.169] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.169] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.171] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.178] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.178] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.178] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.178] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.178] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0072.187] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0072.187] lstrcmpA (lpString1=".", lpString2="QUERIES") returned -1
	[0072.187] lstrcmpA (lpString1="..", lpString2="QUERIES") returned -1
	[0072.187] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0072.189] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.189] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.189] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.192] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.192] CloseHandle (hObject=0x8c) returned 1
	[0072.240] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0072.240] CloseHandle (hObject=0x88) returned 1
	[0072.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.boom")) returned 1
	[0072.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.zip") returned 0
	[0072.244] lstrlenA (lpString="*.zip") returned 5
	[0072.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.rar") returned 0
	[0072.244] lstrlenA (lpString="*.rar") returned 5
	[0072.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.7z") returned 0
	[0072.244] lstrlenA (lpString="*.7z") returned 4
	[0072.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.tar") returned 0
	[0072.244] lstrlenA (lpString="*.tar") returned 5
	[0072.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.gzip") returned 0
	[0072.244] lstrlenA (lpString="*.gzip") returned 6
	[0072.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.jpg") returned 0
	[0072.244] lstrlenA (lpString="*.jpg") returned 5
	[0072.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.jpeg") returned 0
	[0072.244] lstrlenA (lpString="*.jpeg") returned 6
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.psd") returned 0
	[0072.245] lstrlenA (lpString="*.psd") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.cdr") returned 0
	[0072.245] lstrlenA (lpString="*.cdr") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.dwg") returned 0
	[0072.245] lstrlenA (lpString="*.dwg") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.max") returned 0
	[0072.245] lstrlenA (lpString="*.max") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.bmp") returned 0
	[0072.245] lstrlenA (lpString="*.bmp") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.gif") returned 0
	[0072.245] lstrlenA (lpString="*.gif") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.png") returned 0
	[0072.245] lstrlenA (lpString="*.png") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.doc") returned 0
	[0072.245] lstrlenA (lpString="*.doc") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.docx") returned 0
	[0072.245] lstrlenA (lpString="*.docx") returned 6
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.xls") returned 0
	[0072.245] lstrlenA (lpString="*.xls") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.xlsx") returned 0
	[0072.245] lstrlenA (lpString="*.xlsx") returned 6
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.ppt") returned 0
	[0072.245] lstrlenA (lpString="*.ppt") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.pptx") returned 0
	[0072.245] lstrlenA (lpString="*.pptx") returned 6
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.txt") returned 0
	[0072.245] lstrlenA (lpString="*.txt") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.pdf") returned 0
	[0072.245] lstrlenA (lpString="*.pdf") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.djvu") returned 0
	[0072.245] lstrlenA (lpString="*.djvu") returned 6
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.htm") returned 0
	[0072.245] lstrlenA (lpString="*.htm") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.html") returned 0
	[0072.245] lstrlenA (lpString="*.html") returned 6
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mdb") returned 0
	[0072.245] lstrlenA (lpString="*.mdb") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.cer") returned 0
	[0072.245] lstrlenA (lpString="*.cer") returned 5
	[0072.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.p12") returned 0
	[0072.246] lstrlenA (lpString="*.p12") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.pfx") returned 0
	[0072.246] lstrlenA (lpString="*.pfx") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.kwm") returned 0
	[0072.246] lstrlenA (lpString="*.kwm") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.pwm") returned 0
	[0072.246] lstrlenA (lpString="*.pwm") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.1cd") returned 0
	[0072.246] lstrlenA (lpString="*.1cd") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.md") returned 0
	[0072.246] lstrlenA (lpString="*.md") returned 4
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mdf") returned 0
	[0072.246] lstrlenA (lpString="*.mdf") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.dbf") returned 0
	[0072.246] lstrlenA (lpString="*.dbf") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.odt") returned 0
	[0072.246] lstrlenA (lpString="*.odt") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.vob") returned 0
	[0072.246] lstrlenA (lpString="*.vob") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.ifo") returned 0
	[0072.246] lstrlenA (lpString="*.ifo") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.lnk") returned 0
	[0072.246] lstrlenA (lpString="*.lnk") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.torrent") returned 0
	[0072.246] lstrlenA (lpString="*.torrent") returned 9
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mov") returned 0
	[0072.246] lstrlenA (lpString="*.mov") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.m2v") returned 0
	[0072.246] lstrlenA (lpString="*.m2v") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.3gp") returned 0
	[0072.246] lstrlenA (lpString="*.3gp") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mpeg") returned 0
	[0072.246] lstrlenA (lpString="*.mpeg") returned 6
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mpg") returned 0
	[0072.246] lstrlenA (lpString="*.mpg") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.flv") returned 0
	[0072.246] lstrlenA (lpString="*.flv") returned 5
	[0072.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.avi") returned 0
	[0072.247] lstrlenA (lpString="*.avi") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mp4") returned 0
	[0072.247] lstrlenA (lpString="*.mp4") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.wmv") returned 0
	[0072.247] lstrlenA (lpString="*.wmv") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.divx") returned 0
	[0072.247] lstrlenA (lpString="*.divx") returned 6
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mkv") returned 0
	[0072.247] lstrlenA (lpString="*.mkv") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.mp3") returned 0
	[0072.247] lstrlenA (lpString="*.mp3") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.wav") returned 0
	[0072.247] lstrlenA (lpString="*.wav") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.flac") returned 0
	[0072.247] lstrlenA (lpString="*.flac") returned 6
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.ape") returned 0
	[0072.247] lstrlenA (lpString="*.ape") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.wma") returned 0
	[0072.247] lstrlenA (lpString="*.wma") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.ac3") returned 0
	[0072.247] lstrlenA (lpString="*.ac3") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.exe") returned 0
	[0072.247] lstrlenA (lpString="*.exe") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", pszSpec="*.apk") returned 0
	[0072.247] lstrlenA (lpString="*.apk") returned 5
	[0072.247] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.zip") returned 0
	[0072.247] lstrlenA (lpString="*.zip") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.rar") returned 0
	[0072.247] lstrlenA (lpString="*.rar") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.7z") returned 0
	[0072.247] lstrlenA (lpString="*.7z") returned 4
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.tar") returned 0
	[0072.247] lstrlenA (lpString="*.tar") returned 5
	[0072.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.gzip") returned 0
	[0072.248] lstrlenA (lpString="*.gzip") returned 6
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.jpg") returned 0
	[0072.248] lstrlenA (lpString="*.jpg") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.jpeg") returned 0
	[0072.248] lstrlenA (lpString="*.jpeg") returned 6
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.psd") returned 0
	[0072.248] lstrlenA (lpString="*.psd") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.cdr") returned 0
	[0072.248] lstrlenA (lpString="*.cdr") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.dwg") returned 0
	[0072.248] lstrlenA (lpString="*.dwg") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.max") returned 0
	[0072.248] lstrlenA (lpString="*.max") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.bmp") returned 0
	[0072.248] lstrlenA (lpString="*.bmp") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.gif") returned 0
	[0072.248] lstrlenA (lpString="*.gif") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.png") returned 0
	[0072.248] lstrlenA (lpString="*.png") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.doc") returned 0
	[0072.248] lstrlenA (lpString="*.doc") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.docx") returned 0
	[0072.248] lstrlenA (lpString="*.docx") returned 6
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.xls") returned 0
	[0072.248] lstrlenA (lpString="*.xls") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.xlsx") returned 0
	[0072.248] lstrlenA (lpString="*.xlsx") returned 6
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.ppt") returned 0
	[0072.248] lstrlenA (lpString="*.ppt") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.pptx") returned 0
	[0072.248] lstrlenA (lpString="*.pptx") returned 6
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.txt") returned 0
	[0072.248] lstrlenA (lpString="*.txt") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.pdf") returned 0
	[0072.248] lstrlenA (lpString="*.pdf") returned 5
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.djvu") returned 0
	[0072.248] lstrlenA (lpString="*.djvu") returned 6
	[0072.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.htm") returned 0
	[0072.248] lstrlenA (lpString="*.htm") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.html") returned 0
	[0072.249] lstrlenA (lpString="*.html") returned 6
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mdb") returned 0
	[0072.249] lstrlenA (lpString="*.mdb") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.cer") returned 0
	[0072.249] lstrlenA (lpString="*.cer") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.p12") returned 0
	[0072.249] lstrlenA (lpString="*.p12") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.pfx") returned 0
	[0072.249] lstrlenA (lpString="*.pfx") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.kwm") returned 0
	[0072.249] lstrlenA (lpString="*.kwm") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.pwm") returned 0
	[0072.249] lstrlenA (lpString="*.pwm") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.1cd") returned 0
	[0072.249] lstrlenA (lpString="*.1cd") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.md") returned 0
	[0072.249] lstrlenA (lpString="*.md") returned 4
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mdf") returned 0
	[0072.249] lstrlenA (lpString="*.mdf") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.dbf") returned 0
	[0072.249] lstrlenA (lpString="*.dbf") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.odt") returned 0
	[0072.249] lstrlenA (lpString="*.odt") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.vob") returned 0
	[0072.249] lstrlenA (lpString="*.vob") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.ifo") returned 0
	[0072.249] lstrlenA (lpString="*.ifo") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.lnk") returned 0
	[0072.249] lstrlenA (lpString="*.lnk") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.torrent") returned 0
	[0072.249] lstrlenA (lpString="*.torrent") returned 9
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mov") returned 0
	[0072.249] lstrlenA (lpString="*.mov") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.m2v") returned 0
	[0072.249] lstrlenA (lpString="*.m2v") returned 5
	[0072.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.3gp") returned 0
	[0072.249] lstrlenA (lpString="*.3gp") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mpeg") returned 0
	[0072.250] lstrlenA (lpString="*.mpeg") returned 6
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mpg") returned 0
	[0072.250] lstrlenA (lpString="*.mpg") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.flv") returned 0
	[0072.250] lstrlenA (lpString="*.flv") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.avi") returned 0
	[0072.250] lstrlenA (lpString="*.avi") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mp4") returned 0
	[0072.250] lstrlenA (lpString="*.mp4") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.wmv") returned 0
	[0072.250] lstrlenA (lpString="*.wmv") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.divx") returned 0
	[0072.250] lstrlenA (lpString="*.divx") returned 6
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mkv") returned 0
	[0072.250] lstrlenA (lpString="*.mkv") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.mp3") returned 0
	[0072.250] lstrlenA (lpString="*.mp3") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.wav") returned 0
	[0072.250] lstrlenA (lpString="*.wav") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.flac") returned 0
	[0072.250] lstrlenA (lpString="*.flac") returned 6
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.ape") returned 0
	[0072.250] lstrlenA (lpString="*.ape") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.wma") returned 0
	[0072.250] lstrlenA (lpString="*.wma") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.ac3") returned 0
	[0072.250] lstrlenA (lpString="*.ac3") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.exe") returned 0
	[0072.250] lstrlenA (lpString="*.exe") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", pszSpec="*.apk") returned 0
	[0072.250] lstrlenA (lpString="*.apk") returned 5
	[0072.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.zip") returned 0
	[0072.250] lstrlenA (lpString="*.zip") returned 5
	[0072.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.rar") returned 0
	[0072.251] lstrlenA (lpString="*.rar") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.7z") returned 0
	[0072.251] lstrlenA (lpString="*.7z") returned 4
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.tar") returned 0
	[0072.251] lstrlenA (lpString="*.tar") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.gzip") returned 0
	[0072.251] lstrlenA (lpString="*.gzip") returned 6
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.jpg") returned 0
	[0072.251] lstrlenA (lpString="*.jpg") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.jpeg") returned 0
	[0072.251] lstrlenA (lpString="*.jpeg") returned 6
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.psd") returned 0
	[0072.251] lstrlenA (lpString="*.psd") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.cdr") returned 0
	[0072.251] lstrlenA (lpString="*.cdr") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.dwg") returned 0
	[0072.251] lstrlenA (lpString="*.dwg") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.max") returned 0
	[0072.251] lstrlenA (lpString="*.max") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.bmp") returned 0
	[0072.251] lstrlenA (lpString="*.bmp") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.gif") returned 0
	[0072.251] lstrlenA (lpString="*.gif") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.png") returned 0
	[0072.251] lstrlenA (lpString="*.png") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.doc") returned 0
	[0072.251] lstrlenA (lpString="*.doc") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.docx") returned 0
	[0072.251] lstrlenA (lpString="*.docx") returned 6
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.xls") returned 0
	[0072.251] lstrlenA (lpString="*.xls") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.xlsx") returned 0
	[0072.251] lstrlenA (lpString="*.xlsx") returned 6
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.ppt") returned 0
	[0072.251] lstrlenA (lpString="*.ppt") returned 5
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.pptx") returned 0
	[0072.251] lstrlenA (lpString="*.pptx") returned 6
	[0072.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.txt") returned 0
	[0072.251] lstrlenA (lpString="*.txt") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.pdf") returned 0
	[0072.252] lstrlenA (lpString="*.pdf") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.djvu") returned 0
	[0072.252] lstrlenA (lpString="*.djvu") returned 6
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.htm") returned 0
	[0072.252] lstrlenA (lpString="*.htm") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.html") returned 0
	[0072.252] lstrlenA (lpString="*.html") returned 6
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mdb") returned 0
	[0072.252] lstrlenA (lpString="*.mdb") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.cer") returned 0
	[0072.252] lstrlenA (lpString="*.cer") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.p12") returned 0
	[0072.252] lstrlenA (lpString="*.p12") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.pfx") returned 0
	[0072.252] lstrlenA (lpString="*.pfx") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.kwm") returned 0
	[0072.252] lstrlenA (lpString="*.kwm") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.pwm") returned 0
	[0072.252] lstrlenA (lpString="*.pwm") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.1cd") returned 0
	[0072.252] lstrlenA (lpString="*.1cd") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.md") returned 0
	[0072.252] lstrlenA (lpString="*.md") returned 4
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mdf") returned 0
	[0072.252] lstrlenA (lpString="*.mdf") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.dbf") returned 0
	[0072.252] lstrlenA (lpString="*.dbf") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.odt") returned 0
	[0072.252] lstrlenA (lpString="*.odt") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.vob") returned 0
	[0072.252] lstrlenA (lpString="*.vob") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.ifo") returned 0
	[0072.252] lstrlenA (lpString="*.ifo") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.lnk") returned 0
	[0072.252] lstrlenA (lpString="*.lnk") returned 5
	[0072.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.torrent") returned 0
	[0072.252] lstrlenA (lpString="*.torrent") returned 9
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mov") returned 0
	[0072.253] lstrlenA (lpString="*.mov") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.m2v") returned 0
	[0072.253] lstrlenA (lpString="*.m2v") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.3gp") returned 0
	[0072.253] lstrlenA (lpString="*.3gp") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mpeg") returned 0
	[0072.253] lstrlenA (lpString="*.mpeg") returned 6
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mpg") returned 0
	[0072.253] lstrlenA (lpString="*.mpg") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.flv") returned 0
	[0072.253] lstrlenA (lpString="*.flv") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.avi") returned 0
	[0072.253] lstrlenA (lpString="*.avi") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mp4") returned 0
	[0072.253] lstrlenA (lpString="*.mp4") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.wmv") returned 0
	[0072.253] lstrlenA (lpString="*.wmv") returned 5
	[0072.253] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.divx") returned 0
	[0072.253] lstrlenA (lpString="*.divx") returned 6
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mkv") returned 0
	[0072.254] lstrlenA (lpString="*.mkv") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.mp3") returned 0
	[0072.254] lstrlenA (lpString="*.mp3") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.wav") returned 0
	[0072.254] lstrlenA (lpString="*.wav") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.flac") returned 0
	[0072.254] lstrlenA (lpString="*.flac") returned 6
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.ape") returned 0
	[0072.254] lstrlenA (lpString="*.ape") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.wma") returned 0
	[0072.254] lstrlenA (lpString="*.wma") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.ac3") returned 0
	[0072.254] lstrlenA (lpString="*.ac3") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.exe") returned 0
	[0072.254] lstrlenA (lpString="*.exe") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", pszSpec="*.apk") returned 0
	[0072.254] lstrlenA (lpString="*.apk") returned 5
	[0072.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.zip") returned 0
	[0072.254] lstrlenA (lpString="*.zip") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.rar") returned 0
	[0072.254] lstrlenA (lpString="*.rar") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.7z") returned 0
	[0072.254] lstrlenA (lpString="*.7z") returned 4
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.tar") returned 0
	[0072.254] lstrlenA (lpString="*.tar") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.gzip") returned 0
	[0072.254] lstrlenA (lpString="*.gzip") returned 6
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.jpg") returned 0
	[0072.254] lstrlenA (lpString="*.jpg") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.jpeg") returned 0
	[0072.254] lstrlenA (lpString="*.jpeg") returned 6
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.psd") returned 0
	[0072.254] lstrlenA (lpString="*.psd") returned 5
	[0072.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.cdr") returned 0
	[0072.255] lstrlenA (lpString="*.cdr") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.dwg") returned 0
	[0072.255] lstrlenA (lpString="*.dwg") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.max") returned 0
	[0072.255] lstrlenA (lpString="*.max") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.bmp") returned 0
	[0072.255] lstrlenA (lpString="*.bmp") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.gif") returned 0
	[0072.255] lstrlenA (lpString="*.gif") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.png") returned 0
	[0072.255] lstrlenA (lpString="*.png") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.doc") returned 0
	[0072.255] lstrlenA (lpString="*.doc") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.docx") returned 0
	[0072.255] lstrlenA (lpString="*.docx") returned 6
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.xls") returned 0
	[0072.255] lstrlenA (lpString="*.xls") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.xlsx") returned 0
	[0072.255] lstrlenA (lpString="*.xlsx") returned 6
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.ppt") returned 0
	[0072.255] lstrlenA (lpString="*.ppt") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.pptx") returned 0
	[0072.255] lstrlenA (lpString="*.pptx") returned 6
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.txt") returned 0
	[0072.255] lstrlenA (lpString="*.txt") returned 5
	[0072.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.pdf") returned 0
	[0072.256] lstrlenA (lpString="*.pdf") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.djvu") returned 0
	[0072.256] lstrlenA (lpString="*.djvu") returned 6
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.htm") returned 0
	[0072.256] lstrlenA (lpString="*.htm") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.html") returned 0
	[0072.256] lstrlenA (lpString="*.html") returned 6
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mdb") returned 0
	[0072.256] lstrlenA (lpString="*.mdb") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.cer") returned 0
	[0072.256] lstrlenA (lpString="*.cer") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.p12") returned 0
	[0072.256] lstrlenA (lpString="*.p12") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.pfx") returned 0
	[0072.256] lstrlenA (lpString="*.pfx") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.kwm") returned 0
	[0072.256] lstrlenA (lpString="*.kwm") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.pwm") returned 0
	[0072.256] lstrlenA (lpString="*.pwm") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.1cd") returned 0
	[0072.256] lstrlenA (lpString="*.1cd") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.md") returned 0
	[0072.256] lstrlenA (lpString="*.md") returned 4
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mdf") returned 0
	[0072.256] lstrlenA (lpString="*.mdf") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.dbf") returned 0
	[0072.256] lstrlenA (lpString="*.dbf") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.odt") returned 0
	[0072.256] lstrlenA (lpString="*.odt") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.vob") returned 0
	[0072.256] lstrlenA (lpString="*.vob") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.ifo") returned 0
	[0072.256] lstrlenA (lpString="*.ifo") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.lnk") returned 0
	[0072.256] lstrlenA (lpString="*.lnk") returned 5
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.torrent") returned 0
	[0072.256] lstrlenA (lpString="*.torrent") returned 9
	[0072.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mov") returned 0
	[0072.256] lstrlenA (lpString="*.mov") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.m2v") returned 0
	[0072.257] lstrlenA (lpString="*.m2v") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.3gp") returned 0
	[0072.257] lstrlenA (lpString="*.3gp") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mpeg") returned 0
	[0072.257] lstrlenA (lpString="*.mpeg") returned 6
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mpg") returned 0
	[0072.257] lstrlenA (lpString="*.mpg") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.flv") returned 0
	[0072.257] lstrlenA (lpString="*.flv") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.avi") returned 0
	[0072.257] lstrlenA (lpString="*.avi") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mp4") returned 0
	[0072.257] lstrlenA (lpString="*.mp4") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.wmv") returned 0
	[0072.257] lstrlenA (lpString="*.wmv") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.divx") returned 0
	[0072.257] lstrlenA (lpString="*.divx") returned 6
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mkv") returned 0
	[0072.257] lstrlenA (lpString="*.mkv") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.mp3") returned 0
	[0072.257] lstrlenA (lpString="*.mp3") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.wav") returned 0
	[0072.257] lstrlenA (lpString="*.wav") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.flac") returned 0
	[0072.257] lstrlenA (lpString="*.flac") returned 6
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.ape") returned 0
	[0072.257] lstrlenA (lpString="*.ape") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.wma") returned 0
	[0072.257] lstrlenA (lpString="*.wma") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.ac3") returned 0
	[0072.257] lstrlenA (lpString="*.ac3") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.exe") returned 0
	[0072.257] lstrlenA (lpString="*.exe") returned 5
	[0072.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", pszSpec="*.apk") returned 0
	[0072.257] lstrlenA (lpString="*.apk") returned 5
	[0072.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned=""
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.zip") returned 0
	[0072.258] lstrlenA (lpString="*.zip") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.rar") returned 0
	[0072.258] lstrlenA (lpString="*.rar") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.7z") returned 0
	[0072.258] lstrlenA (lpString="*.7z") returned 4
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.tar") returned 0
	[0072.258] lstrlenA (lpString="*.tar") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.gzip") returned 0
	[0072.258] lstrlenA (lpString="*.gzip") returned 6
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.jpg") returned 0
	[0072.258] lstrlenA (lpString="*.jpg") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.jpeg") returned 0
	[0072.258] lstrlenA (lpString="*.jpeg") returned 6
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.psd") returned 0
	[0072.258] lstrlenA (lpString="*.psd") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.cdr") returned 0
	[0072.258] lstrlenA (lpString="*.cdr") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.dwg") returned 0
	[0072.258] lstrlenA (lpString="*.dwg") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.max") returned 0
	[0072.258] lstrlenA (lpString="*.max") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.bmp") returned 0
	[0072.258] lstrlenA (lpString="*.bmp") returned 5
	[0072.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", pszSpec="*.gif") returned 0
	[0072.258] lstrlenA (lpString="*.gif") returned 5
	[0072.258] lstrcmpA (lpString1=".", lpString2="SAMPLES") returned -1
	[0072.258] lstrcmpA (lpString1="..", lpString2="SAMPLES") returned -1
	[0072.258] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0072.259] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.259] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.259] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.263] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0072.263] CloseHandle (hObject=0x8c) returned 1
	[0072.277] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0072.277] CloseHandle (hObject=0x8c) returned 1
	[0072.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls.boom")) returned 1
	[0072.291] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0072.291] CloseHandle (hObject=0x88) returned 1
	[0072.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe.boom")) returned 1
	[0072.338] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0072.338] CloseHandle (hObject=0x88) returned 1
	[0072.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe.boom")) returned 1
	[0072.351] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0072.351] CloseHandle (hObject=0x88) returned 1
	[0072.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe.boom")) returned 1
	[0072.427] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0072.428] CloseHandle (hObject=0x88) returned 1
	[0072.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.boom")) returned 1
	[0072.429] lstrcmpA (lpString1=".", lpString2="STARTUP") returned -1
	[0072.429] lstrcmpA (lpString1="..", lpString2="STARTUP") returned -1
	[0072.429] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0072.429] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0072.429] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0072.429] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0072.849] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0072.849] CloseHandle (hObject=0x88) returned 1
	[0072.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe.boom")) returned 1
	[0073.009] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0073.009] CloseHandle (hObject=0x88) returned 1
	[0073.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\visicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visicon.exe.boom")) returned 1
	[0073.010] lstrcmpA (lpString1=".", lpString2="Visio Content") returned -1
	[0073.010] lstrcmpA (lpString1="..", lpString2="Visio Content") returned -1
	[0073.011] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0073.011] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0073.011] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0073.011] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0073.011] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0073.011] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0073.012] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0073.037] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0073.038] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0073.038] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0073.040] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0073.040] CloseHandle (hObject=0x90) returned 1
	[0073.050] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0073.050] CloseHandle (hObject=0x90) returned 1
	[0073.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls.boom")) returned 1
	[0073.117] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0073.117] CloseHandle (hObject=0x90) returned 1
	[0073.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg.boom")) returned 1
	[0073.310] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0073.310] CloseHandle (hObject=0x90) returned 1
	[0073.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg.boom")) returned 1
	[0073.866] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0073.866] CloseHandle (hObject=0x90) returned 1
	[0073.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg.boom")) returned 1
	[0074.088] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0074.088] CloseHandle (hObject=0x90) returned 1
	[0074.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt.boom")) returned 1
	[0074.346] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0074.346] CloseHandle (hObject=0x90) returned 1
	[0074.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls.boom")) returned 1
	[0074.620] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0074.620] CloseHandle (hObject=0x90) returned 1
	[0074.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls.boom")) returned 1
	[0074.980] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0074.980] CloseHandle (hObject=0x90) returned 1
	[0074.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls.boom")) returned 1
	[0075.110] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0075.110] CloseHandle (hObject=0x90) returned 1
	[0075.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls.boom")) returned 1
	[0075.136] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0075.137] CloseHandle (hObject=0x90) returned 1
	[0075.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls.boom")) returned 1
	[0075.801] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0075.801] CloseHandle (hObject=0x88) returned 1
	[0075.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISIO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISIO.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.boom")) returned 1
	[0075.828] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0075.828] CloseHandle (hObject=0x88) returned 1
	[0075.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VPREVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\vpreview.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VPREVIEW.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\vpreview.exe.boom")) returned 1
	[0076.731] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0076.731] CloseHandle (hObject=0x88) returned 1
	[0076.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.boom")) returned 1
	[0076.866] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0076.866] CloseHandle (hObject=0x88) returned 1
	[0076.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winword.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\winword.exe.boom")) returned 1
	[0076.941] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0076.942] CloseHandle (hObject=0x88) returned 1
	[0076.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordconv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\wordconv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordconv.exe.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\wordconv.exe.boom")) returned 1
	[0077.080] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.080] CloseHandle (hObject=0x88) returned 1
	[0077.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe.boom")) returned 1
	[0077.260] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.260] CloseHandle (hObject=0x88) returned 1
	[0077.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\xlicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLICONS.EXE.Boom" (normalized: "c:\\program files\\microsoft office\\office14\\xlicons.exe.boom")) returned 1
	[0077.262] lstrcmpA (lpString1=".", lpString2="XLSTART") returned -1
	[0077.262] lstrcmpA (lpString1="..", lpString2="XLSTART") returned -1
	[0077.262] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0077.262] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.262] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.262] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.263] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1
	[0077.263] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1
	[0077.263] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0077.264] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.264] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.264] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.264] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0077.264] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0077.264] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0077.266] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.266] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.266] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.267] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.267] CloseHandle (hObject=0x8c) returned 1
	[0077.333] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.334] CloseHandle (hObject=0x8c) returned 1
	[0077.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif.boom")) returned 1
	[0077.337] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.337] CloseHandle (hObject=0x8c) returned 1
	[0077.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm.boom")) returned 1
	[0077.342] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.342] CloseHandle (hObject=0x8c) returned 1
	[0077.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif.boom")) returned 1
	[0077.343] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.343] CloseHandle (hObject=0x8c) returned 1
	[0077.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm.boom")) returned 1
	[0077.351] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.351] CloseHandle (hObject=0x8c) returned 1
	[0077.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif.boom")) returned 1
	[0077.354] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.354] CloseHandle (hObject=0x8c) returned 1
	[0077.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm.boom")) returned 1
	[0077.357] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.357] CloseHandle (hObject=0x8c) returned 1
	[0077.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif.boom")) returned 1
	[0077.359] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.359] CloseHandle (hObject=0x8c) returned 1
	[0077.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm.boom")) returned 1
	[0077.362] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.362] CloseHandle (hObject=0x8c) returned 1
	[0077.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm.boom")) returned 1
	[0077.364] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.364] CloseHandle (hObject=0x8c) returned 1
	[0077.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg.boom")) returned 1
	[0077.367] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.367] CloseHandle (hObject=0x8c) returned 1
	[0077.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif.boom")) returned 1
	[0077.369] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.369] CloseHandle (hObject=0x8c) returned 1
	[0077.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm.boom")) returned 1
	[0077.523] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.523] CloseHandle (hObject=0x8c) returned 1
	[0077.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif.boom")) returned 1
	[0077.527] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.527] CloseHandle (hObject=0x8c) returned 1
	[0077.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm.boom")) returned 1
	[0077.529] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.529] CloseHandle (hObject=0x8c) returned 1
	[0077.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm.boom")) returned 1
	[0077.545] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.545] CloseHandle (hObject=0x8c) returned 1
	[0077.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg.boom")) returned 1
	[0077.547] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.547] CloseHandle (hObject=0x8c) returned 1
	[0077.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm.boom")) returned 1
	[0077.549] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.549] CloseHandle (hObject=0x8c) returned 1
	[0077.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg.boom")) returned 1
	[0077.551] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TECHTOOL.GIF") returned -1
	[0077.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TECHTOOL.GIF") returned -1
	[0077.551] lstrcmpiA (lpString1="", lpString2="TECHTOOL.GIF") returned -1
	[0077.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.554] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81a
	[0077.554] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a8d1900, dwHighDateTime=0x1c02f19), lpLastAccessTime=0x407536*(dwLowDateTime=0x21c6910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a8d1900, dwHighDateTime=0x1c02f19)) returned 1
	[0077.554] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0077.554] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x7f7, lpOverlapped=0x0) returned 1
	[0077.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF") returned="TECHTOOL.GIF"
	[0077.589] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0077.589] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x7f7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x7f7, lpOverlapped=0x0) returned 1
	[0077.590] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.591] CloseHandle (hObject=0x8c) returned 1
	[0077.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif.boom")) returned 1
	[0077.592] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.592] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.592] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TECHTOOL.HTM") returned -1
	[0077.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TECHTOOL.HTM") returned -1
	[0077.592] lstrcmpiA (lpString1="", lpString2="TECHTOOL.HTM") returned -1
	[0077.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF") returned="TECHTOOL.GIF"
	[0077.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\"
	[0077.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned=""
	[0077.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.592] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", lpString2="TECHTOOL.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM"
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.zip") returned 0
	[0077.592] lstrlenA (lpString="*.zip") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.rar") returned 0
	[0077.592] lstrlenA (lpString="*.rar") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.7z") returned 0
	[0077.592] lstrlenA (lpString="*.7z") returned 4
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.tar") returned 0
	[0077.592] lstrlenA (lpString="*.tar") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.gzip") returned 0
	[0077.592] lstrlenA (lpString="*.gzip") returned 6
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.jpg") returned 0
	[0077.592] lstrlenA (lpString="*.jpg") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.jpeg") returned 0
	[0077.592] lstrlenA (lpString="*.jpeg") returned 6
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.psd") returned 0
	[0077.592] lstrlenA (lpString="*.psd") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.cdr") returned 0
	[0077.592] lstrlenA (lpString="*.cdr") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.dwg") returned 0
	[0077.592] lstrlenA (lpString="*.dwg") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.max") returned 0
	[0077.592] lstrlenA (lpString="*.max") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.bmp") returned 0
	[0077.592] lstrlenA (lpString="*.bmp") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.gif") returned 0
	[0077.592] lstrlenA (lpString="*.gif") returned 5
	[0077.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.png") returned 0
	[0077.592] lstrlenA (lpString="*.png") returned 5
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.doc") returned 0
	[0077.593] lstrlenA (lpString="*.doc") returned 5
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.docx") returned 0
	[0077.593] lstrlenA (lpString="*.docx") returned 6
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.xls") returned 0
	[0077.593] lstrlenA (lpString="*.xls") returned 5
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.xlsx") returned 0
	[0077.593] lstrlenA (lpString="*.xlsx") returned 6
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.ppt") returned 0
	[0077.593] lstrlenA (lpString="*.ppt") returned 5
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.pptx") returned 0
	[0077.593] lstrlenA (lpString="*.pptx") returned 6
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.txt") returned 0
	[0077.593] lstrlenA (lpString="*.txt") returned 5
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.pdf") returned 0
	[0077.593] lstrlenA (lpString="*.pdf") returned 5
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.djvu") returned 0
	[0077.593] lstrlenA (lpString="*.djvu") returned 6
	[0077.593] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", pszSpec="*.htm") returned 1
	[0077.593] lstrlenA (lpString="*.htm") returned 5
	[0077.593] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM"
	[0077.593] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM"
	[0077.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM."
	[0077.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.Boom") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.Boom"
	[0077.593] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0077.594] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1da
	[0077.594] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc99e700, dwHighDateTime=0x1c05f79), lpLastAccessTime=0x407536*(dwLowDateTime=0x21c6910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc99e700, dwHighDateTime=0x1c05f79)) returned 1
	[0077.594] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0077.594] ReadFile (in: hFile=0x8c, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x17539b, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x40655d*=0x1b7, lpOverlapped=0x0) returned 1
	[0077.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM") returned="TECHTOOL.HTM"
	[0077.594] SetFilePointer (in: hFile=0x8c, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23
	[0077.594] WriteFile (in: hFile=0x8c, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x1b7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x406561*=0x1b7, lpOverlapped=0x0) returned 1
	[0077.595] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0077.595] CloseHandle (hObject=0x8c) returned 1
	[0077.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.Boom" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm.boom")) returned 1
	[0077.595] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0077.595] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0077.595] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0077.595] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0077.595] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0077.595] lstrcmpA (lpString1=".", lpString2="Templates") returned -1
	[0077.595] lstrcmpA (lpString1="..", lpString2="Templates") returned -1
	[0077.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\*.*") returned="*.*"
	[0077.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\", lpString2="Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates"
	[0077.596] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Templates") returned 43
	[0077.596] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0077.597] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.597] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0077.597] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.597] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.597] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0077.597] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0077.597] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0077.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\*.*") returned="*.*"
	[0077.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033"
	[0077.597] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned 48
	[0077.597] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0077.600] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.600] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.601] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.601] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.601] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.601] lstrcmpA (lpString1=".", lpString2="Access") returned -1
	[0077.601] lstrcmpA (lpString1="..", lpString2="Access") returned -1
	[0077.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*") returned="*.*"
	[0077.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="Access" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access"
	[0077.601] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned 55
	[0077.601] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0077.742] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.742] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.742] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.742] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.742] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.742] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.742] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Assets.accdt") returned 1
	[0077.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Assets.accdt") returned 1
	[0077.742] lstrcmpiA (lpString1="", lpString2="Assets.accdt") returned -1
	[0077.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*.*") returned="*.*"
	[0077.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0xffffffff
	[0077.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0077.743] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0077.743] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0077.744] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.744] CloseHandle (hObject=0x90) returned 1
	[0077.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Assets.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt"
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.zip") returned 0
	[0077.744] lstrlenA (lpString="*.zip") returned 5
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.rar") returned 0
	[0077.744] lstrlenA (lpString="*.rar") returned 5
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.7z") returned 0
	[0077.744] lstrlenA (lpString="*.7z") returned 4
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.tar") returned 0
	[0077.744] lstrlenA (lpString="*.tar") returned 5
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.gzip") returned 0
	[0077.744] lstrlenA (lpString="*.gzip") returned 6
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.jpg") returned 0
	[0077.744] lstrlenA (lpString="*.jpg") returned 5
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.jpeg") returned 0
	[0077.744] lstrlenA (lpString="*.jpeg") returned 6
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.psd") returned 0
	[0077.744] lstrlenA (lpString="*.psd") returned 5
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.cdr") returned 0
	[0077.744] lstrlenA (lpString="*.cdr") returned 5
	[0077.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.dwg") returned 0
	[0077.745] lstrlenA (lpString="*.dwg") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.max") returned 0
	[0077.745] lstrlenA (lpString="*.max") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.bmp") returned 0
	[0077.745] lstrlenA (lpString="*.bmp") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.gif") returned 0
	[0077.745] lstrlenA (lpString="*.gif") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.png") returned 0
	[0077.745] lstrlenA (lpString="*.png") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.doc") returned 0
	[0077.745] lstrlenA (lpString="*.doc") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.docx") returned 0
	[0077.745] lstrlenA (lpString="*.docx") returned 6
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.xls") returned 0
	[0077.745] lstrlenA (lpString="*.xls") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.xlsx") returned 0
	[0077.745] lstrlenA (lpString="*.xlsx") returned 6
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ppt") returned 0
	[0077.745] lstrlenA (lpString="*.ppt") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pptx") returned 0
	[0077.745] lstrlenA (lpString="*.pptx") returned 6
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.txt") returned 0
	[0077.745] lstrlenA (lpString="*.txt") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pdf") returned 0
	[0077.745] lstrlenA (lpString="*.pdf") returned 5
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.djvu") returned 0
	[0077.745] lstrlenA (lpString="*.djvu") returned 6
	[0077.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.htm") returned 0
	[0077.746] lstrlenA (lpString="*.htm") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.html") returned 0
	[0077.746] lstrlenA (lpString="*.html") returned 6
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mdb") returned 0
	[0077.746] lstrlenA (lpString="*.mdb") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.cer") returned 0
	[0077.746] lstrlenA (lpString="*.cer") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.p12") returned 0
	[0077.746] lstrlenA (lpString="*.p12") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pfx") returned 0
	[0077.746] lstrlenA (lpString="*.pfx") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.kwm") returned 0
	[0077.746] lstrlenA (lpString="*.kwm") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pwm") returned 0
	[0077.746] lstrlenA (lpString="*.pwm") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.1cd") returned 0
	[0077.746] lstrlenA (lpString="*.1cd") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.md") returned 0
	[0077.746] lstrlenA (lpString="*.md") returned 4
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mdf") returned 0
	[0077.746] lstrlenA (lpString="*.mdf") returned 5
	[0077.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.dbf") returned 0
	[0077.746] lstrlenA (lpString="*.dbf") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.odt") returned 0
	[0077.749] lstrlenA (lpString="*.odt") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.vob") returned 0
	[0077.749] lstrlenA (lpString="*.vob") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ifo") returned 0
	[0077.749] lstrlenA (lpString="*.ifo") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.lnk") returned 0
	[0077.749] lstrlenA (lpString="*.lnk") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.torrent") returned 0
	[0077.749] lstrlenA (lpString="*.torrent") returned 9
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mov") returned 0
	[0077.749] lstrlenA (lpString="*.mov") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.m2v") returned 0
	[0077.749] lstrlenA (lpString="*.m2v") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.3gp") returned 0
	[0077.749] lstrlenA (lpString="*.3gp") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mpeg") returned 0
	[0077.749] lstrlenA (lpString="*.mpeg") returned 6
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mpg") returned 0
	[0077.749] lstrlenA (lpString="*.mpg") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.flv") returned 0
	[0077.749] lstrlenA (lpString="*.flv") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.avi") returned 0
	[0077.749] lstrlenA (lpString="*.avi") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mp4") returned 0
	[0077.749] lstrlenA (lpString="*.mp4") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.wmv") returned 0
	[0077.749] lstrlenA (lpString="*.wmv") returned 5
	[0077.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.divx") returned 0
	[0077.749] lstrlenA (lpString="*.divx") returned 6
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mkv") returned 0
	[0077.750] lstrlenA (lpString="*.mkv") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mp3") returned 0
	[0077.750] lstrlenA (lpString="*.mp3") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.wav") returned 0
	[0077.750] lstrlenA (lpString="*.wav") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.flac") returned 0
	[0077.750] lstrlenA (lpString="*.flac") returned 6
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ape") returned 0
	[0077.750] lstrlenA (lpString="*.ape") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.wma") returned 0
	[0077.750] lstrlenA (lpString="*.wma") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ac3") returned 0
	[0077.750] lstrlenA (lpString="*.ac3") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.exe") returned 0
	[0077.750] lstrlenA (lpString="*.exe") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.apk") returned 0
	[0077.750] lstrlenA (lpString="*.apk") returned 5
	[0077.750] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.750] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.750] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Charitable Contributions.accdt") returned 1
	[0077.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Charitable Contributions.accdt") returned 1
	[0077.750] lstrcmpiA (lpString1="", lpString2="Charitable Contributions.accdt") returned -1
	[0077.750] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt") returned="Assets.accdt"
	[0077.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.750] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.750] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Charitable Contributions.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt"
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.zip") returned 0
	[0077.750] lstrlenA (lpString="*.zip") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.rar") returned 0
	[0077.750] lstrlenA (lpString="*.rar") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.7z") returned 0
	[0077.750] lstrlenA (lpString="*.7z") returned 4
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.tar") returned 0
	[0077.750] lstrlenA (lpString="*.tar") returned 5
	[0077.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.gzip") returned 0
	[0077.751] lstrlenA (lpString="*.gzip") returned 6
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.jpg") returned 0
	[0077.751] lstrlenA (lpString="*.jpg") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.jpeg") returned 0
	[0077.751] lstrlenA (lpString="*.jpeg") returned 6
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.psd") returned 0
	[0077.751] lstrlenA (lpString="*.psd") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.cdr") returned 0
	[0077.751] lstrlenA (lpString="*.cdr") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.dwg") returned 0
	[0077.751] lstrlenA (lpString="*.dwg") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.max") returned 0
	[0077.751] lstrlenA (lpString="*.max") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.bmp") returned 0
	[0077.751] lstrlenA (lpString="*.bmp") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.gif") returned 0
	[0077.751] lstrlenA (lpString="*.gif") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.png") returned 0
	[0077.751] lstrlenA (lpString="*.png") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.doc") returned 0
	[0077.751] lstrlenA (lpString="*.doc") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.docx") returned 0
	[0077.751] lstrlenA (lpString="*.docx") returned 6
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.xls") returned 0
	[0077.751] lstrlenA (lpString="*.xls") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.xlsx") returned 0
	[0077.751] lstrlenA (lpString="*.xlsx") returned 6
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.ppt") returned 0
	[0077.751] lstrlenA (lpString="*.ppt") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.pptx") returned 0
	[0077.751] lstrlenA (lpString="*.pptx") returned 6
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.txt") returned 0
	[0077.751] lstrlenA (lpString="*.txt") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.pdf") returned 0
	[0077.751] lstrlenA (lpString="*.pdf") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.djvu") returned 0
	[0077.751] lstrlenA (lpString="*.djvu") returned 6
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.htm") returned 0
	[0077.751] lstrlenA (lpString="*.htm") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.html") returned 0
	[0077.751] lstrlenA (lpString="*.html") returned 6
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mdb") returned 0
	[0077.751] lstrlenA (lpString="*.mdb") returned 5
	[0077.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.cer") returned 0
	[0077.752] lstrlenA (lpString="*.cer") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.p12") returned 0
	[0077.752] lstrlenA (lpString="*.p12") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.pfx") returned 0
	[0077.752] lstrlenA (lpString="*.pfx") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.kwm") returned 0
	[0077.752] lstrlenA (lpString="*.kwm") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.pwm") returned 0
	[0077.752] lstrlenA (lpString="*.pwm") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.1cd") returned 0
	[0077.752] lstrlenA (lpString="*.1cd") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.md") returned 0
	[0077.752] lstrlenA (lpString="*.md") returned 4
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mdf") returned 0
	[0077.752] lstrlenA (lpString="*.mdf") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.dbf") returned 0
	[0077.752] lstrlenA (lpString="*.dbf") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.odt") returned 0
	[0077.752] lstrlenA (lpString="*.odt") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.vob") returned 0
	[0077.752] lstrlenA (lpString="*.vob") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.ifo") returned 0
	[0077.752] lstrlenA (lpString="*.ifo") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.lnk") returned 0
	[0077.752] lstrlenA (lpString="*.lnk") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.torrent") returned 0
	[0077.752] lstrlenA (lpString="*.torrent") returned 9
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mov") returned 0
	[0077.752] lstrlenA (lpString="*.mov") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.m2v") returned 0
	[0077.752] lstrlenA (lpString="*.m2v") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.3gp") returned 0
	[0077.752] lstrlenA (lpString="*.3gp") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mpeg") returned 0
	[0077.752] lstrlenA (lpString="*.mpeg") returned 6
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mpg") returned 0
	[0077.752] lstrlenA (lpString="*.mpg") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.flv") returned 0
	[0077.752] lstrlenA (lpString="*.flv") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.avi") returned 0
	[0077.752] lstrlenA (lpString="*.avi") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mp4") returned 0
	[0077.752] lstrlenA (lpString="*.mp4") returned 5
	[0077.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.wmv") returned 0
	[0077.753] lstrlenA (lpString="*.wmv") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.divx") returned 0
	[0077.753] lstrlenA (lpString="*.divx") returned 6
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mkv") returned 0
	[0077.753] lstrlenA (lpString="*.mkv") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.mp3") returned 0
	[0077.753] lstrlenA (lpString="*.mp3") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.wav") returned 0
	[0077.753] lstrlenA (lpString="*.wav") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.flac") returned 0
	[0077.753] lstrlenA (lpString="*.flac") returned 6
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.ape") returned 0
	[0077.753] lstrlenA (lpString="*.ape") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.wma") returned 0
	[0077.753] lstrlenA (lpString="*.wma") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.ac3") returned 0
	[0077.753] lstrlenA (lpString="*.ac3") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.exe") returned 0
	[0077.753] lstrlenA (lpString="*.exe") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt", pszSpec="*.apk") returned 0
	[0077.753] lstrlenA (lpString="*.apk") returned 5
	[0077.753] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.753] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.753] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Contacts.accdt") returned 1
	[0077.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Contacts.accdt") returned 1
	[0077.753] lstrcmpiA (lpString1="", lpString2="Contacts.accdt") returned -1
	[0077.753] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt") returned="Charitable Contributions.accdt"
	[0077.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.753] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Contacts.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt"
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.zip") returned 0
	[0077.753] lstrlenA (lpString="*.zip") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.rar") returned 0
	[0077.753] lstrlenA (lpString="*.rar") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.7z") returned 0
	[0077.753] lstrlenA (lpString="*.7z") returned 4
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.tar") returned 0
	[0077.753] lstrlenA (lpString="*.tar") returned 5
	[0077.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.gzip") returned 0
	[0077.754] lstrlenA (lpString="*.gzip") returned 6
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.jpg") returned 0
	[0077.754] lstrlenA (lpString="*.jpg") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.jpeg") returned 0
	[0077.754] lstrlenA (lpString="*.jpeg") returned 6
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.psd") returned 0
	[0077.754] lstrlenA (lpString="*.psd") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.cdr") returned 0
	[0077.754] lstrlenA (lpString="*.cdr") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.dwg") returned 0
	[0077.754] lstrlenA (lpString="*.dwg") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.max") returned 0
	[0077.754] lstrlenA (lpString="*.max") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.bmp") returned 0
	[0077.754] lstrlenA (lpString="*.bmp") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.gif") returned 0
	[0077.754] lstrlenA (lpString="*.gif") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.png") returned 0
	[0077.754] lstrlenA (lpString="*.png") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.doc") returned 0
	[0077.754] lstrlenA (lpString="*.doc") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.docx") returned 0
	[0077.754] lstrlenA (lpString="*.docx") returned 6
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.xls") returned 0
	[0077.754] lstrlenA (lpString="*.xls") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.xlsx") returned 0
	[0077.754] lstrlenA (lpString="*.xlsx") returned 6
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.ppt") returned 0
	[0077.754] lstrlenA (lpString="*.ppt") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.pptx") returned 0
	[0077.754] lstrlenA (lpString="*.pptx") returned 6
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.txt") returned 0
	[0077.754] lstrlenA (lpString="*.txt") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.pdf") returned 0
	[0077.754] lstrlenA (lpString="*.pdf") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.djvu") returned 0
	[0077.754] lstrlenA (lpString="*.djvu") returned 6
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.htm") returned 0
	[0077.754] lstrlenA (lpString="*.htm") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.html") returned 0
	[0077.754] lstrlenA (lpString="*.html") returned 6
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mdb") returned 0
	[0077.754] lstrlenA (lpString="*.mdb") returned 5
	[0077.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.cer") returned 0
	[0077.755] lstrlenA (lpString="*.cer") returned 5
	[0077.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.p12") returned 0
	[0077.755] lstrlenA (lpString="*.p12") returned 5
	[0077.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.pfx") returned 0
	[0077.755] lstrlenA (lpString="*.pfx") returned 5
	[0077.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.kwm") returned 0
	[0077.755] lstrlenA (lpString="*.kwm") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.pwm") returned 0
	[0077.756] lstrlenA (lpString="*.pwm") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.1cd") returned 0
	[0077.756] lstrlenA (lpString="*.1cd") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.md") returned 0
	[0077.756] lstrlenA (lpString="*.md") returned 4
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mdf") returned 0
	[0077.756] lstrlenA (lpString="*.mdf") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.dbf") returned 0
	[0077.756] lstrlenA (lpString="*.dbf") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.odt") returned 0
	[0077.756] lstrlenA (lpString="*.odt") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.vob") returned 0
	[0077.756] lstrlenA (lpString="*.vob") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.ifo") returned 0
	[0077.756] lstrlenA (lpString="*.ifo") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.lnk") returned 0
	[0077.756] lstrlenA (lpString="*.lnk") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.torrent") returned 0
	[0077.756] lstrlenA (lpString="*.torrent") returned 9
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mov") returned 0
	[0077.756] lstrlenA (lpString="*.mov") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.m2v") returned 0
	[0077.756] lstrlenA (lpString="*.m2v") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.3gp") returned 0
	[0077.756] lstrlenA (lpString="*.3gp") returned 5
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mpeg") returned 0
	[0077.756] lstrlenA (lpString="*.mpeg") returned 6
	[0077.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mpg") returned 0
	[0077.757] lstrlenA (lpString="*.mpg") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.flv") returned 0
	[0077.757] lstrlenA (lpString="*.flv") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.avi") returned 0
	[0077.757] lstrlenA (lpString="*.avi") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mp4") returned 0
	[0077.757] lstrlenA (lpString="*.mp4") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.wmv") returned 0
	[0077.757] lstrlenA (lpString="*.wmv") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.divx") returned 0
	[0077.757] lstrlenA (lpString="*.divx") returned 6
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mkv") returned 0
	[0077.757] lstrlenA (lpString="*.mkv") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.mp3") returned 0
	[0077.757] lstrlenA (lpString="*.mp3") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.wav") returned 0
	[0077.757] lstrlenA (lpString="*.wav") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.flac") returned 0
	[0077.757] lstrlenA (lpString="*.flac") returned 6
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.ape") returned 0
	[0077.757] lstrlenA (lpString="*.ape") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.wma") returned 0
	[0077.757] lstrlenA (lpString="*.wma") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.ac3") returned 0
	[0077.757] lstrlenA (lpString="*.ac3") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.exe") returned 0
	[0077.757] lstrlenA (lpString="*.exe") returned 5
	[0077.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt", pszSpec="*.apk") returned 0
	[0077.757] lstrlenA (lpString="*.apk") returned 5
	[0077.757] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.757] lstrcmpA (lpString1=".", lpString2="DataType") returned -1
	[0077.757] lstrcmpA (lpString1="..", lpString2="DataType") returned -1
	[0077.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt") returned="Contacts.accdt"
	[0077.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="DataType" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType"
	[0077.757] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned 64
	[0077.757] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0077.761] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.761] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.761] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.761] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.761] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.761] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.761] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Address.accft") returned 1
	[0077.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Address.accft") returned 1
	[0077.761] lstrcmpiA (lpString1="", lpString2="Address.accft") returned -1
	[0077.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*.*") returned="*.*"
	[0077.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.762] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0xffffffff
	[0077.762] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0077.762] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0077.762] WriteFile (in: hFile=0x94, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0077.763] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.763] CloseHandle (hObject=0x94) returned 1
	[0077.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Address.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft"
	[0077.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.zip") returned 0
	[0077.763] lstrlenA (lpString="*.zip") returned 5
	[0077.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.rar") returned 0
	[0077.763] lstrlenA (lpString="*.rar") returned 5
	[0077.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.7z") returned 0
	[0077.763] lstrlenA (lpString="*.7z") returned 4
	[0077.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.tar") returned 0
	[0077.763] lstrlenA (lpString="*.tar") returned 5
	[0077.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.gzip") returned 0
	[0077.763] lstrlenA (lpString="*.gzip") returned 6
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.jpg") returned 0
	[0077.764] lstrlenA (lpString="*.jpg") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.jpeg") returned 0
	[0077.764] lstrlenA (lpString="*.jpeg") returned 6
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.psd") returned 0
	[0077.764] lstrlenA (lpString="*.psd") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.cdr") returned 0
	[0077.764] lstrlenA (lpString="*.cdr") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.dwg") returned 0
	[0077.764] lstrlenA (lpString="*.dwg") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.max") returned 0
	[0077.764] lstrlenA (lpString="*.max") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.bmp") returned 0
	[0077.764] lstrlenA (lpString="*.bmp") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.gif") returned 0
	[0077.764] lstrlenA (lpString="*.gif") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.png") returned 0
	[0077.764] lstrlenA (lpString="*.png") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.doc") returned 0
	[0077.764] lstrlenA (lpString="*.doc") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.docx") returned 0
	[0077.764] lstrlenA (lpString="*.docx") returned 6
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.xls") returned 0
	[0077.764] lstrlenA (lpString="*.xls") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.xlsx") returned 0
	[0077.764] lstrlenA (lpString="*.xlsx") returned 6
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.ppt") returned 0
	[0077.764] lstrlenA (lpString="*.ppt") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.pptx") returned 0
	[0077.764] lstrlenA (lpString="*.pptx") returned 6
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.txt") returned 0
	[0077.764] lstrlenA (lpString="*.txt") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.pdf") returned 0
	[0077.764] lstrlenA (lpString="*.pdf") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.djvu") returned 0
	[0077.764] lstrlenA (lpString="*.djvu") returned 6
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.htm") returned 0
	[0077.764] lstrlenA (lpString="*.htm") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.html") returned 0
	[0077.764] lstrlenA (lpString="*.html") returned 6
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mdb") returned 0
	[0077.764] lstrlenA (lpString="*.mdb") returned 5
	[0077.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.cer") returned 0
	[0077.764] lstrlenA (lpString="*.cer") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.p12") returned 0
	[0077.765] lstrlenA (lpString="*.p12") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.pfx") returned 0
	[0077.765] lstrlenA (lpString="*.pfx") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.kwm") returned 0
	[0077.765] lstrlenA (lpString="*.kwm") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.pwm") returned 0
	[0077.765] lstrlenA (lpString="*.pwm") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.1cd") returned 0
	[0077.765] lstrlenA (lpString="*.1cd") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.md") returned 0
	[0077.765] lstrlenA (lpString="*.md") returned 4
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mdf") returned 0
	[0077.765] lstrlenA (lpString="*.mdf") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.dbf") returned 0
	[0077.765] lstrlenA (lpString="*.dbf") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.odt") returned 0
	[0077.765] lstrlenA (lpString="*.odt") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.vob") returned 0
	[0077.765] lstrlenA (lpString="*.vob") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.ifo") returned 0
	[0077.765] lstrlenA (lpString="*.ifo") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.lnk") returned 0
	[0077.765] lstrlenA (lpString="*.lnk") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.torrent") returned 0
	[0077.765] lstrlenA (lpString="*.torrent") returned 9
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mov") returned 0
	[0077.765] lstrlenA (lpString="*.mov") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.m2v") returned 0
	[0077.765] lstrlenA (lpString="*.m2v") returned 5
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.3gp") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mpeg") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mpg") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.flv") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.avi") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mp4") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.wmv") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.divx") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mkv") returned 0
	[0077.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.mp3") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.wav") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.flac") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.ape") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.wma") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.ac3") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.exe") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft", pszSpec="*.apk") returned 0
	[0077.766] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.766] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Category.accft") returned 1
	[0077.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Category.accft") returned 1
	[0077.766] lstrcmpiA (lpString1="", lpString2="Category.accft") returned -1
	[0077.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft") returned="Address.accft"
	[0077.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Category.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft"
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.zip") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.rar") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.7z") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.tar") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.gzip") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.jpg") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.jpeg") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.psd") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.cdr") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.dwg") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.max") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.bmp") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.gif") returned 0
	[0077.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.png") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.doc") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.docx") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.xls") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.xlsx") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.ppt") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.pptx") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.txt") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.pdf") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.djvu") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.htm") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.html") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mdb") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.cer") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.p12") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.pfx") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.kwm") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.pwm") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.1cd") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.md") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mdf") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.dbf") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.odt") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.vob") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.ifo") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.lnk") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.torrent") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mov") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.m2v") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.3gp") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mpeg") returned 0
	[0077.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mpg") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.flv") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.avi") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mp4") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.wmv") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.divx") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mkv") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.mp3") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.wav") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.flac") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.ape") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.wma") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.ac3") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.exe") returned 0
	[0077.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft", pszSpec="*.apk") returned 0
	[0077.768] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.768] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Name.accft") returned -1
	[0077.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Name.accft") returned -1
	[0077.768] lstrcmpiA (lpString1="", lpString2="Name.accft") returned -1
	[0077.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft") returned="Category.accft"
	[0077.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Name.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft"
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.zip") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.rar") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.7z") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.tar") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.gzip") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.jpg") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.jpeg") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.psd") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.cdr") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.dwg") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.max") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.bmp") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.gif") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.png") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.doc") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.docx") returned 0
	[0077.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.xls") returned 0
	[0077.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.xlsx") returned 0
	[0077.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.ppt") returned 0
	[0077.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.pptx") returned 0
	[0077.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.txt") returned 0
	[0077.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.pdf") returned 0
	[0077.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.djvu") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.htm") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.html") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mdb") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.cer") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.p12") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.pfx") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.kwm") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.pwm") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.1cd") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.md") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mdf") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.dbf") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.odt") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.vob") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.ifo") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.lnk") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.torrent") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mov") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.m2v") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.3gp") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mpeg") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mpg") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.flv") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.avi") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mp4") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.wmv") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.divx") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mkv") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.mp3") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.wav") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.flac") returned 0
	[0077.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.ape") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.wma") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.ac3") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.exe") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft", pszSpec="*.apk") returned 0
	[0077.772] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.772] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.772] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Payment Type.accft") returned -1
	[0077.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Payment Type.accft") returned -1
	[0077.772] lstrcmpiA (lpString1="", lpString2="Payment Type.accft") returned -1
	[0077.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft") returned="Name.accft"
	[0077.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Payment Type.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft"
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.zip") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.rar") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.7z") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.tar") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.gzip") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.jpg") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.jpeg") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.psd") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.cdr") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.dwg") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.max") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.bmp") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.gif") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.png") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.doc") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.docx") returned 0
	[0077.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.xls") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.xlsx") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.ppt") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.pptx") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.txt") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.pdf") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.djvu") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.htm") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.html") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mdb") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.cer") returned 0
	[0077.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.p12") returned 0
	[0077.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.pfx") returned 0
	[0077.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.kwm") returned 0
	[0077.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.pwm") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.1cd") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.md") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mdf") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.dbf") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.odt") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.vob") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.ifo") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.lnk") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.torrent") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mov") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.m2v") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.3gp") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mpeg") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mpg") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.flv") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.avi") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mp4") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.wmv") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.divx") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mkv") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.mp3") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.wav") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.flac") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.ape") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.wma") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.ac3") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.exe") returned 0
	[0077.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft", pszSpec="*.apk") returned 0
	[0077.780] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.780] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Phone.accft") returned -1
	[0077.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Phone.accft") returned -1
	[0077.780] lstrcmpiA (lpString1="", lpString2="Phone.accft") returned -1
	[0077.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft") returned="Payment Type.accft"
	[0077.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Phone.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft"
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.zip") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.rar") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.7z") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.tar") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.gzip") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.jpg") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.jpeg") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.psd") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.cdr") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.dwg") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.max") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.bmp") returned 0
	[0077.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft", pszSpec="*.gif") returned 0
	[0077.781] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.781] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.781] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Priority.accft") returned -1
	[0077.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Priority.accft") returned -1
	[0077.781] lstrcmpiA (lpString1="", lpString2="Priority.accft") returned -1
	[0077.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft") returned="Phone.accft"
	[0077.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Priority.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft"
	[0077.799] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.799] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Start End Dates.accft") returned -1
	[0077.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Start End Dates.accft") returned -1
	[0077.799] lstrcmpiA (lpString1="", lpString2="Start End Dates.accft") returned -1
	[0077.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft") returned="Priority.accft"
	[0077.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Start End Dates.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft"
	[0077.800] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.800] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.800] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Status.accft") returned -1
	[0077.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Status.accft") returned -1
	[0077.800] lstrcmpiA (lpString1="", lpString2="Status.accft") returned -1
	[0077.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft") returned="Start End Dates.accft"
	[0077.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Status.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft"
	[0077.800] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.800] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.800] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tags.accft") returned -1
	[0077.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tags.accft") returned -1
	[0077.800] lstrcmpiA (lpString1="", lpString2="Tags.accft") returned -1
	[0077.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft") returned="Status.accft"
	[0077.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\"
	[0077.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\") returned=""
	[0077.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt"
	[0077.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\how to decrypt files.txt")) returned 0x20
	[0077.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Tags.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft"
	[0077.800] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0077.800] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0077.801] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.801] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.801] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Events.accdt") returned -1
	[0077.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Events.accdt") returned 1
	[0077.801] lstrcmpiA (lpString1="", lpString2="Events.accdt") returned -1
	[0077.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*.*") returned="*.*"
	[0077.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Events.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt"
	[0077.801] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.801] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.801] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Faculty.accdt") returned -1
	[0077.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faculty.accdt") returned 1
	[0077.801] lstrcmpiA (lpString1="", lpString2="Faculty.accdt") returned -1
	[0077.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt") returned="Events.accdt"
	[0077.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Faculty.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt"
	[0077.801] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.801] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.801] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Issues.accdt") returned -1
	[0077.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Issues.accdt") returned -1
	[0077.801] lstrcmpiA (lpString1="", lpString2="Issues.accdt") returned -1
	[0077.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt") returned="Faculty.accdt"
	[0077.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Issues.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt"
	[0077.802] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.802] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.802] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Marketing Projects.accdt") returned -1
	[0077.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Marketing Projects.accdt") returned -1
	[0077.802] lstrcmpiA (lpString1="", lpString2="Marketing Projects.accdt") returned -1
	[0077.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt") returned="Issues.accdt"
	[0077.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Marketing Projects.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt"
	[0077.802] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.802] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.802] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Northwind.accdt") returned -1
	[0077.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Northwind.accdt") returned -1
	[0077.802] lstrcmpiA (lpString1="", lpString2="Northwind.accdt") returned -1
	[0077.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt") returned="Marketing Projects.accdt"
	[0077.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.804] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Northwind.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt"
	[0077.804] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.804] lstrcmpA (lpString1=".", lpString2="Part") returned -1
	[0077.804] lstrcmpA (lpString1="..", lpString2="Part") returned -1
	[0077.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt") returned="Northwind.accdt"
	[0077.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Part" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part"
	[0077.804] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0077.811] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.811] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.811] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.811] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.811] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.811] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.811] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1 Right.accdt") returned 1
	[0077.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1 Right.accdt") returned 1
	[0077.811] lstrcmpiA (lpString1="", lpString2="1 Right.accdt") returned -1
	[0077.811] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*.*") returned="*.*"
	[0077.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.811] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0xffffffff
	[0077.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0077.814] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.814] CloseHandle (hObject=0x94) returned 1
	[0077.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="1 Right.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt"
	[0077.814] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.814] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.814] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1 Top.accdt") returned 1
	[0077.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1 Top.accdt") returned 1
	[0077.814] lstrcmpiA (lpString1="", lpString2="1 Top.accdt") returned -1
	[0077.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt") returned="1 Right.accdt"
	[0077.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.814] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="1 Top.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt"
	[0077.814] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.814] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.814] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="2 Right.accdt") returned 1
	[0077.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2 Right.accdt") returned 1
	[0077.814] lstrcmpiA (lpString1="", lpString2="2 Right.accdt") returned -1
	[0077.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt") returned="1 Top.accdt"
	[0077.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="2 Right.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt"
	[0077.834] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.834] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="2 Top.accdt") returned 1
	[0077.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2 Top.accdt") returned 1
	[0077.834] lstrcmpiA (lpString1="", lpString2="2 Top.accdt") returned -1
	[0077.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt") returned="2 Right.accdt"
	[0077.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.834] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.834] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="2 Top.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt"
	[0077.835] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.835] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Comments.accdt") returned 1
	[0077.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Comments.accdt") returned 1
	[0077.835] lstrcmpiA (lpString1="", lpString2="Comments.accdt") returned -1
	[0077.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt") returned="2 Top.accdt"
	[0077.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Comments.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt"
	[0077.835] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.835] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Contacts.accdt") returned 1
	[0077.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Contacts.accdt") returned 1
	[0077.835] lstrcmpiA (lpString1="", lpString2="Contacts.accdt") returned -1
	[0077.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt") returned="Comments.accdt"
	[0077.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Contacts.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt"
	[0077.836] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.836] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Details.accdt") returned 1
	[0077.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Details.accdt") returned 1
	[0077.836] lstrcmpiA (lpString1="", lpString2="Details.accdt") returned -1
	[0077.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt") returned="Contacts.accdt"
	[0077.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Details.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt"
	[0077.836] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.836] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Dialog.accdt") returned 1
	[0077.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dialog.accdt") returned 1
	[0077.836] lstrcmpiA (lpString1="", lpString2="Dialog.accdt") returned -1
	[0077.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt") returned="Details.accdt"
	[0077.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Dialog.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt"
	[0077.836] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.836] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Issues.accdt") returned -1
	[0077.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Issues.accdt") returned -1
	[0077.836] lstrcmpiA (lpString1="", lpString2="Issues.accdt") returned -1
	[0077.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt") returned="Dialog.accdt"
	[0077.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Issues.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt"
	[0077.837] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.837] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="List.accdt") returned -1
	[0077.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="List.accdt") returned -1
	[0077.837] lstrcmpiA (lpString1="", lpString2="List.accdt") returned -1
	[0077.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt") returned="Issues.accdt"
	[0077.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="List.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt"
	[0077.837] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.837] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Media.accdt") returned -1
	[0077.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Media.accdt") returned -1
	[0077.837] lstrcmpiA (lpString1="", lpString2="Media.accdt") returned -1
	[0077.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt") returned="List.accdt"
	[0077.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Media.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt"
	[0077.837] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.837] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Msgbox.accdt") returned -1
	[0077.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Msgbox.accdt") returned -1
	[0077.837] lstrcmpiA (lpString1="", lpString2="Msgbox.accdt") returned -1
	[0077.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt") returned="Media.accdt"
	[0077.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Msgbox.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt"
	[0077.838] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.838] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tabs.accdt") returned -1
	[0077.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tabs.accdt") returned -1
	[0077.838] lstrcmpiA (lpString1="", lpString2="Tabs.accdt") returned -1
	[0077.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt") returned="Msgbox.accdt"
	[0077.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Tabs.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt"
	[0077.838] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.838] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tasks.accdt") returned -1
	[0077.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tasks.accdt") returned -1
	[0077.838] lstrcmpiA (lpString1="", lpString2="Tasks.accdt") returned -1
	[0077.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt") returned="Tabs.accdt"
	[0077.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Tasks.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt"
	[0077.838] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.838] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Users.accdt") returned -1
	[0077.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Users.accdt") returned -1
	[0077.838] lstrcmpiA (lpString1="", lpString2="Users.accdt") returned -1
	[0077.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt") returned="Tasks.accdt"
	[0077.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\"
	[0077.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\") returned=""
	[0077.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt"
	[0077.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\how to decrypt files.txt")) returned 0x20
	[0077.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="Users.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt"
	[0077.839] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0077.839] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0077.839] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Projects.accdt") returned -1
	[0077.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Projects.accdt") returned -1
	[0077.839] lstrcmpiA (lpString1="", lpString2="Projects.accdt") returned -1
	[0077.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*.*") returned="*.*"
	[0077.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Projects.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt"
	[0077.839] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sales Pipeline.accdt") returned -1
	[0077.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sales Pipeline.accdt") returned -1
	[0077.839] lstrcmpiA (lpString1="", lpString2="Sales Pipeline.accdt") returned -1
	[0077.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt") returned="Projects.accdt"
	[0077.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Sales Pipeline.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt"
	[0077.839] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Students.accdt") returned -1
	[0077.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Students.accdt") returned -1
	[0077.839] lstrcmpiA (lpString1="", lpString2="Students.accdt") returned -1
	[0077.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt") returned="Sales Pipeline.accdt"
	[0077.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.840] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.840] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Students.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt"
	[0077.840] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tasks.accdt") returned -1
	[0077.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tasks.accdt") returned -1
	[0077.840] lstrcmpiA (lpString1="", lpString2="Tasks.accdt") returned -1
	[0077.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt") returned="Students.accdt"
	[0077.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\"
	[0077.840] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned=""
	[0077.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt"
	[0077.840] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\how to decrypt files.txt")) returned 0x20
	[0077.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Tasks.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt"
	[0077.840] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.840] lstrcmpA (lpString1=".", lpString2="WSS") returned -1
	[0077.840] lstrcmpA (lpString1="..", lpString2="WSS") returned -1
	[0077.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt") returned="Tasks.accdt"
	[0077.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="WSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS"
	[0077.840] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS") returned 59
	[0077.840] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0077.841] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.841] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.841] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.841] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.841] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.841] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="107.accdt") returned 1
	[0077.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="107.accdt") returned 1
	[0077.841] lstrcmpiA (lpString1="", lpString2="107.accdt") returned -1
	[0077.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*.*") returned="*.*"
	[0077.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\"
	[0077.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\") returned=""
	[0077.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\HOW TO DECRYPT FILES.txt"
	[0077.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\how to decrypt files.txt")) returned 0xffffffff
	[0077.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0077.842] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0077.842] WriteFile (in: hFile=0x94, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0077.846] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.846] CloseHandle (hObject=0x94) returned 1
	[0077.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpString2="107.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt"
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.zip") returned 0
	[0077.846] lstrlenA (lpString="*.zip") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.rar") returned 0
	[0077.846] lstrlenA (lpString="*.rar") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.7z") returned 0
	[0077.846] lstrlenA (lpString="*.7z") returned 4
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.tar") returned 0
	[0077.846] lstrlenA (lpString="*.tar") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.gzip") returned 0
	[0077.846] lstrlenA (lpString="*.gzip") returned 6
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.jpg") returned 0
	[0077.846] lstrlenA (lpString="*.jpg") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.jpeg") returned 0
	[0077.846] lstrlenA (lpString="*.jpeg") returned 6
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.psd") returned 0
	[0077.846] lstrlenA (lpString="*.psd") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.cdr") returned 0
	[0077.846] lstrlenA (lpString="*.cdr") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.dwg") returned 0
	[0077.846] lstrlenA (lpString="*.dwg") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.max") returned 0
	[0077.846] lstrlenA (lpString="*.max") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.bmp") returned 0
	[0077.846] lstrlenA (lpString="*.bmp") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.gif") returned 0
	[0077.846] lstrlenA (lpString="*.gif") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.png") returned 0
	[0077.846] lstrlenA (lpString="*.png") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.doc") returned 0
	[0077.846] lstrlenA (lpString="*.doc") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.docx") returned 0
	[0077.846] lstrlenA (lpString="*.docx") returned 6
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.xls") returned 0
	[0077.846] lstrlenA (lpString="*.xls") returned 5
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.xlsx") returned 0
	[0077.846] lstrlenA (lpString="*.xlsx") returned 6
	[0077.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.ppt") returned 0
	[0077.847] lstrlenA (lpString="*.ppt") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.pptx") returned 0
	[0077.847] lstrlenA (lpString="*.pptx") returned 6
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.txt") returned 0
	[0077.847] lstrlenA (lpString="*.txt") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.pdf") returned 0
	[0077.847] lstrlenA (lpString="*.pdf") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.djvu") returned 0
	[0077.847] lstrlenA (lpString="*.djvu") returned 6
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.htm") returned 0
	[0077.847] lstrlenA (lpString="*.htm") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.html") returned 0
	[0077.847] lstrlenA (lpString="*.html") returned 6
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mdb") returned 0
	[0077.847] lstrlenA (lpString="*.mdb") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.cer") returned 0
	[0077.847] lstrlenA (lpString="*.cer") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.p12") returned 0
	[0077.847] lstrlenA (lpString="*.p12") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.pfx") returned 0
	[0077.847] lstrlenA (lpString="*.pfx") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.kwm") returned 0
	[0077.847] lstrlenA (lpString="*.kwm") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.pwm") returned 0
	[0077.847] lstrlenA (lpString="*.pwm") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.1cd") returned 0
	[0077.847] lstrlenA (lpString="*.1cd") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.md") returned 0
	[0077.847] lstrlenA (lpString="*.md") returned 4
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mdf") returned 0
	[0077.847] lstrlenA (lpString="*.mdf") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.dbf") returned 0
	[0077.847] lstrlenA (lpString="*.dbf") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.odt") returned 0
	[0077.847] lstrlenA (lpString="*.odt") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.vob") returned 0
	[0077.847] lstrlenA (lpString="*.vob") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.ifo") returned 0
	[0077.847] lstrlenA (lpString="*.ifo") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.lnk") returned 0
	[0077.847] lstrlenA (lpString="*.lnk") returned 5
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.torrent") returned 0
	[0077.847] lstrlenA (lpString="*.torrent") returned 9
	[0077.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mov") returned 0
	[0077.847] lstrlenA (lpString="*.mov") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.m2v") returned 0
	[0077.848] lstrlenA (lpString="*.m2v") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.3gp") returned 0
	[0077.848] lstrlenA (lpString="*.3gp") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mpeg") returned 0
	[0077.848] lstrlenA (lpString="*.mpeg") returned 6
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mpg") returned 0
	[0077.848] lstrlenA (lpString="*.mpg") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.flv") returned 0
	[0077.848] lstrlenA (lpString="*.flv") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.avi") returned 0
	[0077.848] lstrlenA (lpString="*.avi") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mp4") returned 0
	[0077.848] lstrlenA (lpString="*.mp4") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.wmv") returned 0
	[0077.848] lstrlenA (lpString="*.wmv") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.divx") returned 0
	[0077.848] lstrlenA (lpString="*.divx") returned 6
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mkv") returned 0
	[0077.848] lstrlenA (lpString="*.mkv") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.mp3") returned 0
	[0077.848] lstrlenA (lpString="*.mp3") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.wav") returned 0
	[0077.848] lstrlenA (lpString="*.wav") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.flac") returned 0
	[0077.848] lstrlenA (lpString="*.flac") returned 6
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.ape") returned 0
	[0077.848] lstrlenA (lpString="*.ape") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.wma") returned 0
	[0077.848] lstrlenA (lpString="*.wma") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.ac3") returned 0
	[0077.848] lstrlenA (lpString="*.ac3") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.exe") returned 0
	[0077.848] lstrlenA (lpString="*.exe") returned 5
	[0077.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", pszSpec="*.apk") returned 0
	[0077.848] lstrlenA (lpString="*.apk") returned 5
	[0077.848] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.848] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0077.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1100.accdt") returned 1
	[0077.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1100.accdt") returned 1
	[0077.848] lstrcmpiA (lpString1="", lpString2="1100.accdt") returned -1
	[0077.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt") returned="107.accdt"
	[0077.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\"
	[0077.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\") returned=""
	[0077.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\HOW TO DECRYPT FILES.txt"
	[0077.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\how to decrypt files.txt")) returned 0x20
	[0077.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpString2="1100.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt"
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.zip") returned 0
	[0077.849] lstrlenA (lpString="*.zip") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.rar") returned 0
	[0077.849] lstrlenA (lpString="*.rar") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.7z") returned 0
	[0077.849] lstrlenA (lpString="*.7z") returned 4
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.tar") returned 0
	[0077.849] lstrlenA (lpString="*.tar") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.gzip") returned 0
	[0077.849] lstrlenA (lpString="*.gzip") returned 6
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.jpg") returned 0
	[0077.849] lstrlenA (lpString="*.jpg") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.jpeg") returned 0
	[0077.849] lstrlenA (lpString="*.jpeg") returned 6
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.psd") returned 0
	[0077.849] lstrlenA (lpString="*.psd") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.cdr") returned 0
	[0077.849] lstrlenA (lpString="*.cdr") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.dwg") returned 0
	[0077.849] lstrlenA (lpString="*.dwg") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.max") returned 0
	[0077.849] lstrlenA (lpString="*.max") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.bmp") returned 0
	[0077.849] lstrlenA (lpString="*.bmp") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.gif") returned 0
	[0077.849] lstrlenA (lpString="*.gif") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.png") returned 0
	[0077.849] lstrlenA (lpString="*.png") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.doc") returned 0
	[0077.849] lstrlenA (lpString="*.doc") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.docx") returned 0
	[0077.849] lstrlenA (lpString="*.docx") returned 6
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.xls") returned 0
	[0077.849] lstrlenA (lpString="*.xls") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.xlsx") returned 0
	[0077.849] lstrlenA (lpString="*.xlsx") returned 6
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.ppt") returned 0
	[0077.849] lstrlenA (lpString="*.ppt") returned 5
	[0077.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.pptx") returned 0
	[0077.849] lstrlenA (lpString="*.pptx") returned 6
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.txt") returned 0
	[0077.850] lstrlenA (lpString="*.txt") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.pdf") returned 0
	[0077.850] lstrlenA (lpString="*.pdf") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.djvu") returned 0
	[0077.850] lstrlenA (lpString="*.djvu") returned 6
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.htm") returned 0
	[0077.850] lstrlenA (lpString="*.htm") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.html") returned 0
	[0077.850] lstrlenA (lpString="*.html") returned 6
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mdb") returned 0
	[0077.850] lstrlenA (lpString="*.mdb") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.cer") returned 0
	[0077.850] lstrlenA (lpString="*.cer") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.p12") returned 0
	[0077.850] lstrlenA (lpString="*.p12") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.pfx") returned 0
	[0077.850] lstrlenA (lpString="*.pfx") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.kwm") returned 0
	[0077.850] lstrlenA (lpString="*.kwm") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.pwm") returned 0
	[0077.850] lstrlenA (lpString="*.pwm") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.1cd") returned 0
	[0077.850] lstrlenA (lpString="*.1cd") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.md") returned 0
	[0077.850] lstrlenA (lpString="*.md") returned 4
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mdf") returned 0
	[0077.850] lstrlenA (lpString="*.mdf") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.dbf") returned 0
	[0077.850] lstrlenA (lpString="*.dbf") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.odt") returned 0
	[0077.850] lstrlenA (lpString="*.odt") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.vob") returned 0
	[0077.850] lstrlenA (lpString="*.vob") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.ifo") returned 0
	[0077.850] lstrlenA (lpString="*.ifo") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.lnk") returned 0
	[0077.850] lstrlenA (lpString="*.lnk") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.torrent") returned 0
	[0077.850] lstrlenA (lpString="*.torrent") returned 9
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mov") returned 0
	[0077.850] lstrlenA (lpString="*.mov") returned 5
	[0077.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.m2v") returned 0
	[0077.850] lstrlenA (lpString="*.m2v") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.3gp") returned 0
	[0077.851] lstrlenA (lpString="*.3gp") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mpeg") returned 0
	[0077.851] lstrlenA (lpString="*.mpeg") returned 6
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mpg") returned 0
	[0077.851] lstrlenA (lpString="*.mpg") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.flv") returned 0
	[0077.851] lstrlenA (lpString="*.flv") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.avi") returned 0
	[0077.851] lstrlenA (lpString="*.avi") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mp4") returned 0
	[0077.851] lstrlenA (lpString="*.mp4") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.wmv") returned 0
	[0077.851] lstrlenA (lpString="*.wmv") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.divx") returned 0
	[0077.851] lstrlenA (lpString="*.divx") returned 6
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mkv") returned 0
	[0077.851] lstrlenA (lpString="*.mkv") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.mp3") returned 0
	[0077.851] lstrlenA (lpString="*.mp3") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.wav") returned 0
	[0077.851] lstrlenA (lpString="*.wav") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.flac") returned 0
	[0077.851] lstrlenA (lpString="*.flac") returned 6
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.ape") returned 0
	[0077.851] lstrlenA (lpString="*.ape") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.wma") returned 0
	[0077.851] lstrlenA (lpString="*.wma") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.ac3") returned 0
	[0077.851] lstrlenA (lpString="*.ac3") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.exe") returned 0
	[0077.851] lstrlenA (lpString="*.exe") returned 5
	[0077.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", pszSpec="*.apk") returned 0
	[0077.851] lstrlenA (lpString="*.apk") returned 5
	[0077.851] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0077.851] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0077.851] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0077.852] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0077.852] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.852] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.852] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AdjacencyLetter.dotx") returned 1
	[0077.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdjacencyLetter.dotx") returned 1
	[0077.852] lstrcmpiA (lpString1="", lpString2="AdjacencyLetter.dotx") returned -1
	[0077.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*") returned="*.*"
	[0077.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.852] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0xffffffff
	[0077.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c
	[0077.853] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0077.853] WriteFile (in: hFile=0x8c, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0077.854] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.854] CloseHandle (hObject=0x8c) returned 1
	[0077.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx"
	[0077.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.zip") returned 0
	[0077.854] lstrlenA (lpString="*.zip") returned 5
	[0077.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.rar") returned 0
	[0077.854] lstrlenA (lpString="*.rar") returned 5
	[0077.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.7z") returned 0
	[0077.854] lstrlenA (lpString="*.7z") returned 4
	[0077.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.tar") returned 0
	[0077.854] lstrlenA (lpString="*.tar") returned 5
	[0077.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.gzip") returned 0
	[0077.854] lstrlenA (lpString="*.gzip") returned 6
	[0077.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.jpg") returned 0
	[0077.854] lstrlenA (lpString="*.jpg") returned 5
	[0077.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.jpeg") returned 0
	[0077.854] lstrlenA (lpString="*.jpeg") returned 6
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.psd") returned 0
	[0077.855] lstrlenA (lpString="*.psd") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.cdr") returned 0
	[0077.855] lstrlenA (lpString="*.cdr") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.dwg") returned 0
	[0077.855] lstrlenA (lpString="*.dwg") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.max") returned 0
	[0077.855] lstrlenA (lpString="*.max") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.bmp") returned 0
	[0077.855] lstrlenA (lpString="*.bmp") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.gif") returned 0
	[0077.855] lstrlenA (lpString="*.gif") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.png") returned 0
	[0077.855] lstrlenA (lpString="*.png") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.doc") returned 0
	[0077.855] lstrlenA (lpString="*.doc") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.docx") returned 0
	[0077.855] lstrlenA (lpString="*.docx") returned 6
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.xls") returned 0
	[0077.855] lstrlenA (lpString="*.xls") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.xlsx") returned 0
	[0077.855] lstrlenA (lpString="*.xlsx") returned 6
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.ppt") returned 0
	[0077.855] lstrlenA (lpString="*.ppt") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.pptx") returned 0
	[0077.855] lstrlenA (lpString="*.pptx") returned 6
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.txt") returned 0
	[0077.855] lstrlenA (lpString="*.txt") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.pdf") returned 0
	[0077.855] lstrlenA (lpString="*.pdf") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.djvu") returned 0
	[0077.855] lstrlenA (lpString="*.djvu") returned 6
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.htm") returned 0
	[0077.855] lstrlenA (lpString="*.htm") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.html") returned 0
	[0077.855] lstrlenA (lpString="*.html") returned 6
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mdb") returned 0
	[0077.855] lstrlenA (lpString="*.mdb") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.cer") returned 0
	[0077.855] lstrlenA (lpString="*.cer") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.p12") returned 0
	[0077.855] lstrlenA (lpString="*.p12") returned 5
	[0077.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.pfx") returned 0
	[0077.856] lstrlenA (lpString="*.pfx") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.kwm") returned 0
	[0077.856] lstrlenA (lpString="*.kwm") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.pwm") returned 0
	[0077.856] lstrlenA (lpString="*.pwm") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.1cd") returned 0
	[0077.856] lstrlenA (lpString="*.1cd") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.md") returned 0
	[0077.856] lstrlenA (lpString="*.md") returned 4
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mdf") returned 0
	[0077.856] lstrlenA (lpString="*.mdf") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.dbf") returned 0
	[0077.856] lstrlenA (lpString="*.dbf") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.odt") returned 0
	[0077.856] lstrlenA (lpString="*.odt") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.vob") returned 0
	[0077.856] lstrlenA (lpString="*.vob") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.ifo") returned 0
	[0077.856] lstrlenA (lpString="*.ifo") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.lnk") returned 0
	[0077.856] lstrlenA (lpString="*.lnk") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.torrent") returned 0
	[0077.856] lstrlenA (lpString="*.torrent") returned 9
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mov") returned 0
	[0077.856] lstrlenA (lpString="*.mov") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.m2v") returned 0
	[0077.856] lstrlenA (lpString="*.m2v") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.3gp") returned 0
	[0077.856] lstrlenA (lpString="*.3gp") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mpeg") returned 0
	[0077.856] lstrlenA (lpString="*.mpeg") returned 6
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mpg") returned 0
	[0077.856] lstrlenA (lpString="*.mpg") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.flv") returned 0
	[0077.856] lstrlenA (lpString="*.flv") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.avi") returned 0
	[0077.856] lstrlenA (lpString="*.avi") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mp4") returned 0
	[0077.856] lstrlenA (lpString="*.mp4") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.wmv") returned 0
	[0077.856] lstrlenA (lpString="*.wmv") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.divx") returned 0
	[0077.856] lstrlenA (lpString="*.divx") returned 6
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mkv") returned 0
	[0077.856] lstrlenA (lpString="*.mkv") returned 5
	[0077.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mp3") returned 0
	[0077.857] lstrlenA (lpString="*.mp3") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.wav") returned 0
	[0077.857] lstrlenA (lpString="*.wav") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.flac") returned 0
	[0077.857] lstrlenA (lpString="*.flac") returned 6
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.ape") returned 0
	[0077.857] lstrlenA (lpString="*.ape") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.wma") returned 0
	[0077.857] lstrlenA (lpString="*.wma") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.ac3") returned 0
	[0077.857] lstrlenA (lpString="*.ac3") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.exe") returned 0
	[0077.857] lstrlenA (lpString="*.exe") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.apk") returned 0
	[0077.857] lstrlenA (lpString="*.apk") returned 5
	[0077.857] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.857] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.857] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AdjacencyMergeLetter.dotx") returned 1
	[0077.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdjacencyMergeLetter.dotx") returned 1
	[0077.857] lstrcmpiA (lpString1="", lpString2="AdjacencyMergeLetter.dotx") returned -1
	[0077.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx") returned="AdjacencyLetter.dotx"
	[0077.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx"
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.zip") returned 0
	[0077.857] lstrlenA (lpString="*.zip") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.rar") returned 0
	[0077.857] lstrlenA (lpString="*.rar") returned 5
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.7z") returned 0
	[0077.857] lstrlenA (lpString="*.7z") returned 4
	[0077.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.tar") returned 0
	[0077.857] lstrlenA (lpString="*.tar") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.gzip") returned 0
	[0077.858] lstrlenA (lpString="*.gzip") returned 6
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.jpg") returned 0
	[0077.858] lstrlenA (lpString="*.jpg") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.jpeg") returned 0
	[0077.858] lstrlenA (lpString="*.jpeg") returned 6
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.psd") returned 0
	[0077.858] lstrlenA (lpString="*.psd") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.cdr") returned 0
	[0077.858] lstrlenA (lpString="*.cdr") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.dwg") returned 0
	[0077.858] lstrlenA (lpString="*.dwg") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.max") returned 0
	[0077.858] lstrlenA (lpString="*.max") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.bmp") returned 0
	[0077.858] lstrlenA (lpString="*.bmp") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.gif") returned 0
	[0077.858] lstrlenA (lpString="*.gif") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.png") returned 0
	[0077.858] lstrlenA (lpString="*.png") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.doc") returned 0
	[0077.858] lstrlenA (lpString="*.doc") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.docx") returned 0
	[0077.858] lstrlenA (lpString="*.docx") returned 6
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.xls") returned 0
	[0077.858] lstrlenA (lpString="*.xls") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.xlsx") returned 0
	[0077.858] lstrlenA (lpString="*.xlsx") returned 6
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.ppt") returned 0
	[0077.858] lstrlenA (lpString="*.ppt") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.pptx") returned 0
	[0077.858] lstrlenA (lpString="*.pptx") returned 6
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.txt") returned 0
	[0077.858] lstrlenA (lpString="*.txt") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.pdf") returned 0
	[0077.858] lstrlenA (lpString="*.pdf") returned 5
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.djvu") returned 0
	[0077.858] lstrlenA (lpString="*.djvu") returned 6
	[0077.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.htm") returned 0
	[0077.858] lstrlenA (lpString="*.htm") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.html") returned 0
	[0077.859] lstrlenA (lpString="*.html") returned 6
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mdb") returned 0
	[0077.859] lstrlenA (lpString="*.mdb") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.cer") returned 0
	[0077.859] lstrlenA (lpString="*.cer") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.p12") returned 0
	[0077.859] lstrlenA (lpString="*.p12") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.pfx") returned 0
	[0077.859] lstrlenA (lpString="*.pfx") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.kwm") returned 0
	[0077.859] lstrlenA (lpString="*.kwm") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.pwm") returned 0
	[0077.859] lstrlenA (lpString="*.pwm") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.1cd") returned 0
	[0077.859] lstrlenA (lpString="*.1cd") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.md") returned 0
	[0077.859] lstrlenA (lpString="*.md") returned 4
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mdf") returned 0
	[0077.859] lstrlenA (lpString="*.mdf") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.dbf") returned 0
	[0077.859] lstrlenA (lpString="*.dbf") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.odt") returned 0
	[0077.859] lstrlenA (lpString="*.odt") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.vob") returned 0
	[0077.859] lstrlenA (lpString="*.vob") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.ifo") returned 0
	[0077.859] lstrlenA (lpString="*.ifo") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.lnk") returned 0
	[0077.859] lstrlenA (lpString="*.lnk") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.torrent") returned 0
	[0077.859] lstrlenA (lpString="*.torrent") returned 9
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mov") returned 0
	[0077.859] lstrlenA (lpString="*.mov") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.m2v") returned 0
	[0077.859] lstrlenA (lpString="*.m2v") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.3gp") returned 0
	[0077.859] lstrlenA (lpString="*.3gp") returned 5
	[0077.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mpeg") returned 0
	[0077.860] lstrlenA (lpString="*.mpeg") returned 6
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mpg") returned 0
	[0077.860] lstrlenA (lpString="*.mpg") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.flv") returned 0
	[0077.860] lstrlenA (lpString="*.flv") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.avi") returned 0
	[0077.860] lstrlenA (lpString="*.avi") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mp4") returned 0
	[0077.860] lstrlenA (lpString="*.mp4") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.wmv") returned 0
	[0077.860] lstrlenA (lpString="*.wmv") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.divx") returned 0
	[0077.860] lstrlenA (lpString="*.divx") returned 6
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mkv") returned 0
	[0077.860] lstrlenA (lpString="*.mkv") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mp3") returned 0
	[0077.860] lstrlenA (lpString="*.mp3") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.wav") returned 0
	[0077.860] lstrlenA (lpString="*.wav") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.flac") returned 0
	[0077.860] lstrlenA (lpString="*.flac") returned 6
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.ape") returned 0
	[0077.860] lstrlenA (lpString="*.ape") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.wma") returned 0
	[0077.860] lstrlenA (lpString="*.wma") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.ac3") returned 0
	[0077.860] lstrlenA (lpString="*.ac3") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.exe") returned 0
	[0077.860] lstrlenA (lpString="*.exe") returned 5
	[0077.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.apk") returned 0
	[0077.860] lstrlenA (lpString="*.apk") returned 5
	[0077.860] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.860] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.860] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AdjacencyReport.dotx") returned 1
	[0077.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdjacencyReport.dotx") returned 1
	[0077.860] lstrcmpiA (lpString1="", lpString2="AdjacencyReport.dotx") returned -1
	[0077.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx") returned="AdjacencyMergeLetter.dotx"
	[0077.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.861] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyReport.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx"
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.zip") returned 0
	[0077.861] lstrlenA (lpString="*.zip") returned 5
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.rar") returned 0
	[0077.861] lstrlenA (lpString="*.rar") returned 5
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.7z") returned 0
	[0077.861] lstrlenA (lpString="*.7z") returned 4
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.tar") returned 0
	[0077.861] lstrlenA (lpString="*.tar") returned 5
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.gzip") returned 0
	[0077.861] lstrlenA (lpString="*.gzip") returned 6
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.jpg") returned 0
	[0077.861] lstrlenA (lpString="*.jpg") returned 5
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.jpeg") returned 0
	[0077.861] lstrlenA (lpString="*.jpeg") returned 6
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.psd") returned 0
	[0077.861] lstrlenA (lpString="*.psd") returned 5
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.cdr") returned 0
	[0077.861] lstrlenA (lpString="*.cdr") returned 5
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.dwg") returned 0
	[0077.861] lstrlenA (lpString="*.dwg") returned 5
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.max") returned 0
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.bmp") returned 0
	[0077.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.gif") returned 0
	[0077.861] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.862] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.862] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AdjacencyResume.dotx") returned 1
	[0077.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdjacencyResume.dotx") returned 1
	[0077.862] lstrcmpiA (lpString1="", lpString2="AdjacencyResume.dotx") returned -1
	[0077.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx") returned="AdjacencyReport.dotx"
	[0077.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.862] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx"
	[0077.862] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.862] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.862] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR1.XLT") returned 1
	[0077.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR1.XLT") returned 1
	[0077.862] lstrcmpiA (lpString1="", lpString2="ADR1.XLT") returned -1
	[0077.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx") returned="AdjacencyResume.dotx"
	[0077.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.862] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR1.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT"
	[0077.862] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.862] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.862] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR10.XLT") returned 1
	[0077.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR10.XLT") returned 1
	[0077.862] lstrcmpiA (lpString1="", lpString2="ADR10.XLT") returned -1
	[0077.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT") returned="ADR1.XLT"
	[0077.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.863] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR10.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT"
	[0077.863] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.863] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.863] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR2.XLT") returned 1
	[0077.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR2.XLT") returned 1
	[0077.863] lstrcmpiA (lpString1="", lpString2="ADR2.XLT") returned -1
	[0077.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT") returned="ADR10.XLT"
	[0077.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.863] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR2.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT"
	[0077.863] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.863] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.863] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR3.XLT") returned 1
	[0077.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR3.XLT") returned 1
	[0077.863] lstrcmpiA (lpString1="", lpString2="ADR3.XLT") returned -1
	[0077.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT") returned="ADR2.XLT"
	[0077.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.863] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR3.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT"
	[0077.863] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.863] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.863] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR4.XLT") returned 1
	[0077.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR4.XLT") returned 1
	[0077.863] lstrcmpiA (lpString1="", lpString2="ADR4.XLT") returned -1
	[0077.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT") returned="ADR3.XLT"
	[0077.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.864] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.864] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR4.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT"
	[0077.864] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.864] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.864] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR5.XLT") returned 1
	[0077.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR5.XLT") returned 1
	[0077.864] lstrcmpiA (lpString1="", lpString2="ADR5.XLT") returned -1
	[0077.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT") returned="ADR4.XLT"
	[0077.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.864] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.864] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR5.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT"
	[0077.864] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.864] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.864] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR6.XLT") returned 1
	[0077.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR6.XLT") returned 1
	[0077.864] lstrcmpiA (lpString1="", lpString2="ADR6.XLT") returned -1
	[0077.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT") returned="ADR5.XLT"
	[0077.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.864] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.864] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR6.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT"
	[0077.864] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.865] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR7.XLT") returned 1
	[0077.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR7.XLT") returned 1
	[0077.865] lstrcmpiA (lpString1="", lpString2="ADR7.XLT") returned -1
	[0077.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT") returned="ADR6.XLT"
	[0077.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.865] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR7.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT"
	[0077.865] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.865] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR8.XLT") returned 1
	[0077.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR8.XLT") returned 1
	[0077.865] lstrcmpiA (lpString1="", lpString2="ADR8.XLT") returned -1
	[0077.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT") returned="ADR7.XLT"
	[0077.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.865] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR8.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT"
	[0077.865] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.865] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADR9.XLT") returned 1
	[0077.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR9.XLT") returned 1
	[0077.865] lstrcmpiA (lpString1="", lpString2="ADR9.XLT") returned -1
	[0077.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT") returned="ADR8.XLT"
	[0077.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.865] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR9.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT"
	[0077.866] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.866] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.866] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ApothecaryLetter.dotx") returned 1
	[0077.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryLetter.dotx") returned 1
	[0077.866] lstrcmpiA (lpString1="", lpString2="ApothecaryLetter.dotx") returned -1
	[0077.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT") returned="ADR9.XLT"
	[0077.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.866] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.866] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx"
	[0077.866] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.866] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.866] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ApothecaryMergeLetter.dotx") returned 1
	[0077.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryMergeLetter.dotx") returned 1
	[0077.866] lstrcmpiA (lpString1="", lpString2="ApothecaryMergeLetter.dotx") returned -1
	[0077.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx") returned="ApothecaryLetter.dotx"
	[0077.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.866] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.866] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx"
	[0077.866] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.866] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.866] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ApothecaryNewsletter.dotx") returned 1
	[0077.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryNewsletter.dotx") returned 1
	[0077.866] lstrcmpiA (lpString1="", lpString2="ApothecaryNewsletter.dotx") returned -1
	[0077.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx") returned="ApothecaryMergeLetter.dotx"
	[0077.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryNewsletter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx"
	[0077.867] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.867] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.867] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ApothecaryResume.dotx") returned 1
	[0077.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryResume.dotx") returned 1
	[0077.867] lstrcmpiA (lpString1="", lpString2="ApothecaryResume.dotx") returned -1
	[0077.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx") returned="ApothecaryNewsletter.dotx"
	[0077.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx"
	[0077.867] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.867] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.867] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BillingStatement.xltx") returned 1
	[0077.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BillingStatement.xltx") returned 1
	[0077.867] lstrcmpiA (lpString1="", lpString2="BillingStatement.xltx") returned -1
	[0077.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx") returned="ApothecaryResume.dotx"
	[0077.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BillingStatement.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx"
	[0077.867] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.868] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BlackTieLetter.dotx") returned 1
	[0077.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieLetter.dotx") returned 1
	[0077.868] lstrcmpiA (lpString1="", lpString2="BlackTieLetter.dotx") returned -1
	[0077.868] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx") returned="BillingStatement.xltx"
	[0077.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.868] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.868] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx"
	[0077.868] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.868] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BlackTieMergeLetter.dotx") returned 1
	[0077.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieMergeLetter.dotx") returned 1
	[0077.868] lstrcmpiA (lpString1="", lpString2="BlackTieMergeLetter.dotx") returned -1
	[0077.868] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx") returned="BlackTieLetter.dotx"
	[0077.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.868] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.868] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx"
	[0077.868] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.868] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BlackTieNewsletter.dotx") returned 1
	[0077.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieNewsletter.dotx") returned 1
	[0077.868] lstrcmpiA (lpString1="", lpString2="BlackTieNewsletter.dotx") returned -1
	[0077.868] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx") returned="BlackTieMergeLetter.dotx"
	[0077.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.868] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.869] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieNewsletter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx"
	[0077.869] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.869] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.869] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BlackTieResume.dotx") returned 1
	[0077.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieResume.dotx") returned 1
	[0077.869] lstrcmpiA (lpString1="", lpString2="BlackTieResume.dotx") returned -1
	[0077.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx") returned="BlackTieNewsletter.dotx"
	[0077.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.869] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.869] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx"
	[0077.869] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.869] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.869] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Blog.dotx") returned 1
	[0077.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blog.dotx") returned 1
	[0077.869] lstrcmpiA (lpString1="", lpString2="Blog.dotx") returned -1
	[0077.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx") returned="BlackTieResume.dotx"
	[0077.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.869] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.869] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="Blog.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx"
	[0077.869] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.869] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.869] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BloodPressureTracker.xltx") returned 1
	[0077.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BloodPressureTracker.xltx") returned 1
	[0077.869] lstrcmpiA (lpString1="", lpString2="BloodPressureTracker.xltx") returned -1
	[0077.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx") returned="Blog.dotx"
	[0077.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BloodPressureTracker.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx"
	[0077.870] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.870] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.870] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ClassicPhotoAlbum.potx") returned 1
	[0077.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ClassicPhotoAlbum.potx") returned 1
	[0077.870] lstrcmpiA (lpString1="", lpString2="ClassicPhotoAlbum.potx") returned -1
	[0077.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx") returned="BloodPressureTracker.xltx"
	[0077.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ClassicPhotoAlbum.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx"
	[0077.870] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.870] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.870] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ContemporaryPhotoAlbum.potx") returned 1
	[0077.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContemporaryPhotoAlbum.potx") returned 1
	[0077.870] lstrcmpiA (lpString1="", lpString2="ContemporaryPhotoAlbum.potx") returned -1
	[0077.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx") returned="ClassicPhotoAlbum.potx"
	[0077.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ContemporaryPhotoAlbum.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx"
	[0077.871] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.871] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.871] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EquityLetter.Dotx") returned -1
	[0077.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityLetter.Dotx") returned 1
	[0077.871] lstrcmpiA (lpString1="", lpString2="EquityLetter.Dotx") returned -1
	[0077.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx") returned="ContemporaryPhotoAlbum.potx"
	[0077.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx"
	[0077.871] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.871] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.871] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EquityMergeFax.Dotx") returned -1
	[0077.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityMergeFax.Dotx") returned 1
	[0077.871] lstrcmpiA (lpString1="", lpString2="EquityMergeFax.Dotx") returned -1
	[0077.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx") returned="EquityLetter.Dotx"
	[0077.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityMergeFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx"
	[0077.871] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.872] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.872] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EquityMergeLetter.Dotx") returned -1
	[0077.872] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityMergeLetter.Dotx") returned 1
	[0077.872] lstrcmpiA (lpString1="", lpString2="EquityMergeLetter.Dotx") returned -1
	[0077.872] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx") returned="EquityMergeFax.Dotx"
	[0077.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.872] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.872] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityMergeLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx"
	[0077.872] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.872] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.872] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EquityReport.Dotx") returned -1
	[0077.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityReport.Dotx") returned 1
	[0077.873] lstrcmpiA (lpString1="", lpString2="EquityReport.Dotx") returned -1
	[0077.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx") returned="EquityMergeLetter.Dotx"
	[0077.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.873] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityReport.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx"
	[0077.873] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.873] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.873] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EquityResume.Dotx") returned -1
	[0077.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityResume.Dotx") returned 1
	[0077.873] lstrcmpiA (lpString1="", lpString2="EquityResume.Dotx") returned -1
	[0077.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx") returned="EquityReport.Dotx"
	[0077.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.873] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityResume.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx"
	[0077.873] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.873] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.873] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EssentialLetter.dotx") returned -1
	[0077.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialLetter.dotx") returned 1
	[0077.873] lstrcmpiA (lpString1="", lpString2="EssentialLetter.dotx") returned -1
	[0077.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx") returned="EquityResume.Dotx"
	[0077.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.873] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx"
	[0077.874] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.874] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.874] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EssentialMergeLetter.dotx") returned -1
	[0077.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialMergeLetter.dotx") returned 1
	[0077.874] lstrcmpiA (lpString1="", lpString2="EssentialMergeLetter.dotx") returned -1
	[0077.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx") returned="EssentialLetter.dotx"
	[0077.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.874] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx"
	[0077.874] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.874] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.874] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EssentialReport.dotx") returned -1
	[0077.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialReport.dotx") returned 1
	[0077.874] lstrcmpiA (lpString1="", lpString2="EssentialReport.dotx") returned -1
	[0077.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx") returned="EssentialMergeLetter.dotx"
	[0077.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.874] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialReport.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx"
	[0077.874] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.874] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.874] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EssentialResume.dotx") returned -1
	[0077.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialResume.dotx") returned 1
	[0077.874] lstrcmpiA (lpString1="", lpString2="EssentialResume.dotx") returned -1
	[0077.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx") returned="EssentialReport.dotx"
	[0077.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx"
	[0077.875] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.875] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.875] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExecutiveLetter.dotx") returned -1
	[0077.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveLetter.dotx") returned 1
	[0077.875] lstrcmpiA (lpString1="", lpString2="ExecutiveLetter.dotx") returned -1
	[0077.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx") returned="EssentialResume.dotx"
	[0077.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx"
	[0077.875] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.875] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.875] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExecutiveMergeLetter.dotx") returned -1
	[0077.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveMergeLetter.dotx") returned 1
	[0077.875] lstrcmpiA (lpString1="", lpString2="ExecutiveMergeLetter.dotx") returned -1
	[0077.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx") returned="ExecutiveLetter.dotx"
	[0077.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx"
	[0077.875] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.875] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.875] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExecutiveNewsletter.dotx") returned -1
	[0077.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveNewsletter.dotx") returned 1
	[0077.876] lstrcmpiA (lpString1="", lpString2="ExecutiveNewsletter.dotx") returned -1
	[0077.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx") returned="ExecutiveMergeLetter.dotx"
	[0077.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveNewsletter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx"
	[0077.876] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.876] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.876] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExecutiveReport.dotx") returned -1
	[0077.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveReport.dotx") returned 1
	[0077.876] lstrcmpiA (lpString1="", lpString2="ExecutiveReport.dotx") returned -1
	[0077.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx") returned="ExecutiveNewsletter.dotx"
	[0077.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveReport.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx"
	[0077.876] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.876] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.876] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExecutiveResume.dotx") returned -1
	[0077.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveResume.dotx") returned 1
	[0077.876] lstrcmpiA (lpString1="", lpString2="ExecutiveResume.dotx") returned -1
	[0077.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx") returned="ExecutiveReport.dotx"
	[0077.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx"
	[0077.877] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.877] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.877] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExpenseReport.xltx") returned -1
	[0077.877] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExpenseReport.xltx") returned 1
	[0077.877] lstrcmpiA (lpString1="", lpString2="ExpenseReport.xltx") returned -1
	[0077.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx") returned="ExecutiveResume.dotx"
	[0077.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.877] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExpenseReport.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx"
	[0077.877] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.877] lstrcmpA (lpString1=".", lpString2="FAX") returned -1
	[0077.877] lstrcmpA (lpString1="..", lpString2="FAX") returned -1
	[0077.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx") returned="ExpenseReport.xltx"
	[0077.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="FAX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX"
	[0077.877] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0077.911] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.911] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.911] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.911] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.911] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.911] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.911] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EquityFax.Dotx") returned -1
	[0077.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityFax.Dotx") returned 1
	[0077.911] lstrcmpiA (lpString1="", lpString2="EquityFax.Dotx") returned -1
	[0077.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*.*") returned="*.*"
	[0077.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\"
	[0077.911] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned=""
	[0077.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt"
	[0077.911] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0xffffffff
	[0077.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0077.913] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.914] CloseHandle (hObject=0x90) returned 1
	[0077.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="EquityFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx"
	[0077.914] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.914] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.914] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MedianFax.Dotx") returned -1
	[0077.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MedianFax.Dotx") returned -1
	[0077.914] lstrcmpiA (lpString1="", lpString2="MedianFax.Dotx") returned -1
	[0077.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx") returned="EquityFax.Dotx"
	[0077.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\"
	[0077.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned=""
	[0077.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt"
	[0077.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20
	[0077.916] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="MedianFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx"
	[0077.916] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.917] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.917] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrielFax.Dotx") returned -1
	[0077.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielFax.Dotx") returned -1
	[0077.917] lstrcmpiA (lpString1="", lpString2="OrielFax.Dotx") returned -1
	[0077.917] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx") returned="MedianFax.Dotx"
	[0077.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\"
	[0077.917] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned=""
	[0077.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt"
	[0077.917] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20
	[0077.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="OrielFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx"
	[0077.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.zip") returned 0
	[0077.917] lstrlenA (lpString="*.zip") returned 5
	[0077.917] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.rar") returned 0
	[0077.917] lstrlenA (lpString="*.rar") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.7z") returned 0
	[0077.918] lstrlenA (lpString="*.7z") returned 4
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.tar") returned 0
	[0077.918] lstrlenA (lpString="*.tar") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.gzip") returned 0
	[0077.918] lstrlenA (lpString="*.gzip") returned 6
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.jpg") returned 0
	[0077.918] lstrlenA (lpString="*.jpg") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.jpeg") returned 0
	[0077.918] lstrlenA (lpString="*.jpeg") returned 6
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.psd") returned 0
	[0077.918] lstrlenA (lpString="*.psd") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.cdr") returned 0
	[0077.918] lstrlenA (lpString="*.cdr") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.dwg") returned 0
	[0077.918] lstrlenA (lpString="*.dwg") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.max") returned 0
	[0077.918] lstrlenA (lpString="*.max") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.bmp") returned 0
	[0077.918] lstrlenA (lpString="*.bmp") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.gif") returned 0
	[0077.918] lstrlenA (lpString="*.gif") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.png") returned 0
	[0077.918] lstrlenA (lpString="*.png") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.doc") returned 0
	[0077.918] lstrlenA (lpString="*.doc") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.docx") returned 0
	[0077.918] lstrlenA (lpString="*.docx") returned 6
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.xls") returned 0
	[0077.918] lstrlenA (lpString="*.xls") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.xlsx") returned 0
	[0077.918] lstrlenA (lpString="*.xlsx") returned 6
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.ppt") returned 0
	[0077.918] lstrlenA (lpString="*.ppt") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.pptx") returned 0
	[0077.918] lstrlenA (lpString="*.pptx") returned 6
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.txt") returned 0
	[0077.918] lstrlenA (lpString="*.txt") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.pdf") returned 0
	[0077.918] lstrlenA (lpString="*.pdf") returned 5
	[0077.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.djvu") returned 0
	[0077.918] lstrlenA (lpString="*.djvu") returned 6
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.htm") returned 0
	[0077.919] lstrlenA (lpString="*.htm") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.html") returned 0
	[0077.919] lstrlenA (lpString="*.html") returned 6
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mdb") returned 0
	[0077.919] lstrlenA (lpString="*.mdb") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.cer") returned 0
	[0077.919] lstrlenA (lpString="*.cer") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.p12") returned 0
	[0077.919] lstrlenA (lpString="*.p12") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.pfx") returned 0
	[0077.919] lstrlenA (lpString="*.pfx") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.kwm") returned 0
	[0077.919] lstrlenA (lpString="*.kwm") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.pwm") returned 0
	[0077.919] lstrlenA (lpString="*.pwm") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.1cd") returned 0
	[0077.919] lstrlenA (lpString="*.1cd") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.md") returned 0
	[0077.919] lstrlenA (lpString="*.md") returned 4
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mdf") returned 0
	[0077.919] lstrlenA (lpString="*.mdf") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.dbf") returned 0
	[0077.919] lstrlenA (lpString="*.dbf") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.odt") returned 0
	[0077.919] lstrlenA (lpString="*.odt") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.vob") returned 0
	[0077.919] lstrlenA (lpString="*.vob") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.ifo") returned 0
	[0077.919] lstrlenA (lpString="*.ifo") returned 5
	[0077.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.lnk") returned 0
	[0077.921] lstrlenA (lpString="*.lnk") returned 5
	[0077.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.torrent") returned 0
	[0077.921] lstrlenA (lpString="*.torrent") returned 9
	[0077.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mov") returned 0
	[0077.921] lstrlenA (lpString="*.mov") returned 5
	[0077.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.m2v") returned 0
	[0077.921] lstrlenA (lpString="*.m2v") returned 5
	[0077.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.3gp") returned 0
	[0077.921] lstrlenA (lpString="*.3gp") returned 5
	[0077.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mpeg") returned 0
	[0077.921] lstrlenA (lpString="*.mpeg") returned 6
	[0077.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mpg") returned 0
	[0077.922] lstrlenA (lpString="*.mpg") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.flv") returned 0
	[0077.922] lstrlenA (lpString="*.flv") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.avi") returned 0
	[0077.922] lstrlenA (lpString="*.avi") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mp4") returned 0
	[0077.922] lstrlenA (lpString="*.mp4") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.wmv") returned 0
	[0077.922] lstrlenA (lpString="*.wmv") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.divx") returned 0
	[0077.922] lstrlenA (lpString="*.divx") returned 6
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mkv") returned 0
	[0077.922] lstrlenA (lpString="*.mkv") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.mp3") returned 0
	[0077.922] lstrlenA (lpString="*.mp3") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.wav") returned 0
	[0077.922] lstrlenA (lpString="*.wav") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.flac") returned 0
	[0077.922] lstrlenA (lpString="*.flac") returned 6
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.ape") returned 0
	[0077.922] lstrlenA (lpString="*.ape") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.wma") returned 0
	[0077.922] lstrlenA (lpString="*.wma") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.ac3") returned 0
	[0077.922] lstrlenA (lpString="*.ac3") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.exe") returned 0
	[0077.922] lstrlenA (lpString="*.exe") returned 5
	[0077.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", pszSpec="*.apk") returned 0
	[0077.922] lstrlenA (lpString="*.apk") returned 5
	[0077.922] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.922] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx") returned="OrielFax.Dotx"
	[0077.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\"
	[0077.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned=""
	[0077.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt"
	[0077.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20
	[0077.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="OriginFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx"
	[0077.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.zip") returned 0
	[0077.924] lstrlenA (lpString="*.zip") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.rar") returned 0
	[0077.925] lstrlenA (lpString="*.rar") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.7z") returned 0
	[0077.925] lstrlenA (lpString="*.7z") returned 4
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.tar") returned 0
	[0077.925] lstrlenA (lpString="*.tar") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.gzip") returned 0
	[0077.925] lstrlenA (lpString="*.gzip") returned 6
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.jpg") returned 0
	[0077.925] lstrlenA (lpString="*.jpg") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.jpeg") returned 0
	[0077.925] lstrlenA (lpString="*.jpeg") returned 6
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.psd") returned 0
	[0077.925] lstrlenA (lpString="*.psd") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.cdr") returned 0
	[0077.925] lstrlenA (lpString="*.cdr") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.dwg") returned 0
	[0077.925] lstrlenA (lpString="*.dwg") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.max") returned 0
	[0077.925] lstrlenA (lpString="*.max") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.bmp") returned 0
	[0077.925] lstrlenA (lpString="*.bmp") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.gif") returned 0
	[0077.925] lstrlenA (lpString="*.gif") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.png") returned 0
	[0077.925] lstrlenA (lpString="*.png") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.doc") returned 0
	[0077.925] lstrlenA (lpString="*.doc") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.docx") returned 0
	[0077.925] lstrlenA (lpString="*.docx") returned 6
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.xls") returned 0
	[0077.925] lstrlenA (lpString="*.xls") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.xlsx") returned 0
	[0077.925] lstrlenA (lpString="*.xlsx") returned 6
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.ppt") returned 0
	[0077.925] lstrlenA (lpString="*.ppt") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.pptx") returned 0
	[0077.925] lstrlenA (lpString="*.pptx") returned 6
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.txt") returned 0
	[0077.925] lstrlenA (lpString="*.txt") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.pdf") returned 0
	[0077.925] lstrlenA (lpString="*.pdf") returned 5
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.djvu") returned 0
	[0077.925] lstrlenA (lpString="*.djvu") returned 6
	[0077.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.htm") returned 0
	[0077.926] lstrlenA (lpString="*.htm") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.html") returned 0
	[0077.926] lstrlenA (lpString="*.html") returned 6
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mdb") returned 0
	[0077.926] lstrlenA (lpString="*.mdb") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.cer") returned 0
	[0077.926] lstrlenA (lpString="*.cer") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.p12") returned 0
	[0077.926] lstrlenA (lpString="*.p12") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.pfx") returned 0
	[0077.926] lstrlenA (lpString="*.pfx") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.kwm") returned 0
	[0077.926] lstrlenA (lpString="*.kwm") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.pwm") returned 0
	[0077.926] lstrlenA (lpString="*.pwm") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.1cd") returned 0
	[0077.926] lstrlenA (lpString="*.1cd") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.md") returned 0
	[0077.926] lstrlenA (lpString="*.md") returned 4
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mdf") returned 0
	[0077.926] lstrlenA (lpString="*.mdf") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.dbf") returned 0
	[0077.926] lstrlenA (lpString="*.dbf") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.odt") returned 0
	[0077.926] lstrlenA (lpString="*.odt") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.vob") returned 0
	[0077.926] lstrlenA (lpString="*.vob") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.ifo") returned 0
	[0077.926] lstrlenA (lpString="*.ifo") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.lnk") returned 0
	[0077.926] lstrlenA (lpString="*.lnk") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.torrent") returned 0
	[0077.926] lstrlenA (lpString="*.torrent") returned 9
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mov") returned 0
	[0077.926] lstrlenA (lpString="*.mov") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.m2v") returned 0
	[0077.926] lstrlenA (lpString="*.m2v") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.3gp") returned 0
	[0077.926] lstrlenA (lpString="*.3gp") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mpeg") returned 0
	[0077.926] lstrlenA (lpString="*.mpeg") returned 6
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mpg") returned 0
	[0077.926] lstrlenA (lpString="*.mpg") returned 5
	[0077.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.flv") returned 0
	[0077.927] lstrlenA (lpString="*.flv") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.avi") returned 0
	[0077.927] lstrlenA (lpString="*.avi") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mp4") returned 0
	[0077.927] lstrlenA (lpString="*.mp4") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.wmv") returned 0
	[0077.927] lstrlenA (lpString="*.wmv") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.divx") returned 0
	[0077.927] lstrlenA (lpString="*.divx") returned 6
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mkv") returned 0
	[0077.927] lstrlenA (lpString="*.mkv") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.mp3") returned 0
	[0077.927] lstrlenA (lpString="*.mp3") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.wav") returned 0
	[0077.927] lstrlenA (lpString="*.wav") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.flac") returned 0
	[0077.927] lstrlenA (lpString="*.flac") returned 6
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.ape") returned 0
	[0077.927] lstrlenA (lpString="*.ape") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.wma") returned 0
	[0077.927] lstrlenA (lpString="*.wma") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.ac3") returned 0
	[0077.927] lstrlenA (lpString="*.ac3") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.exe") returned 0
	[0077.927] lstrlenA (lpString="*.exe") returned 5
	[0077.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", pszSpec="*.apk") returned 0
	[0077.927] lstrlenA (lpString="*.apk") returned 5
	[0077.927] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.927] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0077.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx") returned="OriginFax.Dotx"
	[0077.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\"
	[0077.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned=""
	[0077.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt"
	[0077.928] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20
	[0077.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="UrbanFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx"
	[0077.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.zip") returned 0
	[0077.928] lstrlenA (lpString="*.zip") returned 5
	[0077.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.rar") returned 0
	[0077.928] lstrlenA (lpString="*.rar") returned 5
	[0077.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.7z") returned 0
	[0077.928] lstrlenA (lpString="*.7z") returned 4
	[0077.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.tar") returned 0
	[0077.928] lstrlenA (lpString="*.tar") returned 5
	[0077.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.gzip") returned 0
	[0077.928] lstrlenA (lpString="*.gzip") returned 6
	[0077.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.jpg") returned 0
	[0077.928] lstrlenA (lpString="*.jpg") returned 5
	[0077.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.jpeg") returned 0
	[0077.929] lstrlenA (lpString="*.jpeg") returned 6
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.psd") returned 0
	[0077.929] lstrlenA (lpString="*.psd") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.cdr") returned 0
	[0077.929] lstrlenA (lpString="*.cdr") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.dwg") returned 0
	[0077.929] lstrlenA (lpString="*.dwg") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.max") returned 0
	[0077.929] lstrlenA (lpString="*.max") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.bmp") returned 0
	[0077.929] lstrlenA (lpString="*.bmp") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.gif") returned 0
	[0077.929] lstrlenA (lpString="*.gif") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.png") returned 0
	[0077.929] lstrlenA (lpString="*.png") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.doc") returned 0
	[0077.929] lstrlenA (lpString="*.doc") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.docx") returned 0
	[0077.929] lstrlenA (lpString="*.docx") returned 6
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.xls") returned 0
	[0077.929] lstrlenA (lpString="*.xls") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.xlsx") returned 0
	[0077.929] lstrlenA (lpString="*.xlsx") returned 6
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.ppt") returned 0
	[0077.929] lstrlenA (lpString="*.ppt") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.pptx") returned 0
	[0077.929] lstrlenA (lpString="*.pptx") returned 6
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.txt") returned 0
	[0077.929] lstrlenA (lpString="*.txt") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.pdf") returned 0
	[0077.929] lstrlenA (lpString="*.pdf") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.djvu") returned 0
	[0077.929] lstrlenA (lpString="*.djvu") returned 6
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.htm") returned 0
	[0077.929] lstrlenA (lpString="*.htm") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.html") returned 0
	[0077.929] lstrlenA (lpString="*.html") returned 6
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mdb") returned 0
	[0077.929] lstrlenA (lpString="*.mdb") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.cer") returned 0
	[0077.929] lstrlenA (lpString="*.cer") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.p12") returned 0
	[0077.929] lstrlenA (lpString="*.p12") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.pfx") returned 0
	[0077.929] lstrlenA (lpString="*.pfx") returned 5
	[0077.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.kwm") returned 0
	[0077.930] lstrlenA (lpString="*.kwm") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.pwm") returned 0
	[0077.930] lstrlenA (lpString="*.pwm") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.1cd") returned 0
	[0077.930] lstrlenA (lpString="*.1cd") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.md") returned 0
	[0077.930] lstrlenA (lpString="*.md") returned 4
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mdf") returned 0
	[0077.930] lstrlenA (lpString="*.mdf") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.dbf") returned 0
	[0077.930] lstrlenA (lpString="*.dbf") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.odt") returned 0
	[0077.930] lstrlenA (lpString="*.odt") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.vob") returned 0
	[0077.930] lstrlenA (lpString="*.vob") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.ifo") returned 0
	[0077.930] lstrlenA (lpString="*.ifo") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.lnk") returned 0
	[0077.930] lstrlenA (lpString="*.lnk") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.torrent") returned 0
	[0077.930] lstrlenA (lpString="*.torrent") returned 9
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mov") returned 0
	[0077.930] lstrlenA (lpString="*.mov") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.m2v") returned 0
	[0077.930] lstrlenA (lpString="*.m2v") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.3gp") returned 0
	[0077.930] lstrlenA (lpString="*.3gp") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mpeg") returned 0
	[0077.930] lstrlenA (lpString="*.mpeg") returned 6
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mpg") returned 0
	[0077.930] lstrlenA (lpString="*.mpg") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.flv") returned 0
	[0077.930] lstrlenA (lpString="*.flv") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.avi") returned 0
	[0077.930] lstrlenA (lpString="*.avi") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mp4") returned 0
	[0077.930] lstrlenA (lpString="*.mp4") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.wmv") returned 0
	[0077.930] lstrlenA (lpString="*.wmv") returned 5
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.divx") returned 0
	[0077.930] lstrlenA (lpString="*.divx") returned 6
	[0077.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mkv") returned 0
	[0077.930] lstrlenA (lpString="*.mkv") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.mp3") returned 0
	[0077.931] lstrlenA (lpString="*.mp3") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.wav") returned 0
	[0077.931] lstrlenA (lpString="*.wav") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.flac") returned 0
	[0077.931] lstrlenA (lpString="*.flac") returned 6
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.ape") returned 0
	[0077.931] lstrlenA (lpString="*.ape") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.wma") returned 0
	[0077.931] lstrlenA (lpString="*.wma") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.ac3") returned 0
	[0077.931] lstrlenA (lpString="*.ac3") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.exe") returned 0
	[0077.931] lstrlenA (lpString="*.exe") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", pszSpec="*.apk") returned 0
	[0077.931] lstrlenA (lpString="*.apk") returned 5
	[0077.931] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0077.931] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0077.931] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.931] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*") returned="*.*"
	[0077.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.931] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="FiveRules.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx"
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.zip") returned 0
	[0077.931] lstrlenA (lpString="*.zip") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.rar") returned 0
	[0077.931] lstrlenA (lpString="*.rar") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.7z") returned 0
	[0077.931] lstrlenA (lpString="*.7z") returned 4
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.tar") returned 0
	[0077.931] lstrlenA (lpString="*.tar") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.gzip") returned 0
	[0077.931] lstrlenA (lpString="*.gzip") returned 6
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.jpg") returned 0
	[0077.931] lstrlenA (lpString="*.jpg") returned 5
	[0077.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.jpeg") returned 0
	[0077.931] lstrlenA (lpString="*.jpeg") returned 6
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.psd") returned 0
	[0077.932] lstrlenA (lpString="*.psd") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.cdr") returned 0
	[0077.932] lstrlenA (lpString="*.cdr") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.dwg") returned 0
	[0077.932] lstrlenA (lpString="*.dwg") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.max") returned 0
	[0077.932] lstrlenA (lpString="*.max") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.bmp") returned 0
	[0077.932] lstrlenA (lpString="*.bmp") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.gif") returned 0
	[0077.932] lstrlenA (lpString="*.gif") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.png") returned 0
	[0077.932] lstrlenA (lpString="*.png") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.doc") returned 0
	[0077.932] lstrlenA (lpString="*.doc") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.docx") returned 0
	[0077.932] lstrlenA (lpString="*.docx") returned 6
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.xls") returned 0
	[0077.932] lstrlenA (lpString="*.xls") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.xlsx") returned 0
	[0077.932] lstrlenA (lpString="*.xlsx") returned 6
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.ppt") returned 0
	[0077.932] lstrlenA (lpString="*.ppt") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.pptx") returned 0
	[0077.932] lstrlenA (lpString="*.pptx") returned 6
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.txt") returned 0
	[0077.932] lstrlenA (lpString="*.txt") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.pdf") returned 0
	[0077.932] lstrlenA (lpString="*.pdf") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.djvu") returned 0
	[0077.932] lstrlenA (lpString="*.djvu") returned 6
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.htm") returned 0
	[0077.932] lstrlenA (lpString="*.htm") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.html") returned 0
	[0077.932] lstrlenA (lpString="*.html") returned 6
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mdb") returned 0
	[0077.932] lstrlenA (lpString="*.mdb") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.cer") returned 0
	[0077.932] lstrlenA (lpString="*.cer") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.p12") returned 0
	[0077.932] lstrlenA (lpString="*.p12") returned 5
	[0077.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.pfx") returned 0
	[0077.935] lstrlenA (lpString="*.pfx") returned 5
	[0077.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.kwm") returned 0
	[0077.935] lstrlenA (lpString="*.kwm") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.pwm") returned 0
	[0077.936] lstrlenA (lpString="*.pwm") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.1cd") returned 0
	[0077.936] lstrlenA (lpString="*.1cd") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.md") returned 0
	[0077.936] lstrlenA (lpString="*.md") returned 4
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mdf") returned 0
	[0077.936] lstrlenA (lpString="*.mdf") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.dbf") returned 0
	[0077.936] lstrlenA (lpString="*.dbf") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.odt") returned 0
	[0077.936] lstrlenA (lpString="*.odt") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.vob") returned 0
	[0077.936] lstrlenA (lpString="*.vob") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.ifo") returned 0
	[0077.936] lstrlenA (lpString="*.ifo") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.lnk") returned 0
	[0077.936] lstrlenA (lpString="*.lnk") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.torrent") returned 0
	[0077.936] lstrlenA (lpString="*.torrent") returned 9
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mov") returned 0
	[0077.936] lstrlenA (lpString="*.mov") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.m2v") returned 0
	[0077.936] lstrlenA (lpString="*.m2v") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.3gp") returned 0
	[0077.936] lstrlenA (lpString="*.3gp") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mpeg") returned 0
	[0077.936] lstrlenA (lpString="*.mpeg") returned 6
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mpg") returned 0
	[0077.936] lstrlenA (lpString="*.mpg") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.flv") returned 0
	[0077.936] lstrlenA (lpString="*.flv") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.avi") returned 0
	[0077.936] lstrlenA (lpString="*.avi") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mp4") returned 0
	[0077.936] lstrlenA (lpString="*.mp4") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.wmv") returned 0
	[0077.936] lstrlenA (lpString="*.wmv") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.divx") returned 0
	[0077.936] lstrlenA (lpString="*.divx") returned 6
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mkv") returned 0
	[0077.936] lstrlenA (lpString="*.mkv") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.mp3") returned 0
	[0077.936] lstrlenA (lpString="*.mp3") returned 5
	[0077.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.wav") returned 0
	[0077.937] lstrlenA (lpString="*.wav") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.flac") returned 0
	[0077.937] lstrlenA (lpString="*.flac") returned 6
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.ape") returned 0
	[0077.937] lstrlenA (lpString="*.ape") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.wma") returned 0
	[0077.937] lstrlenA (lpString="*.wma") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.ac3") returned 0
	[0077.937] lstrlenA (lpString="*.ac3") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.exe") returned 0
	[0077.937] lstrlenA (lpString="*.exe") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx", pszSpec="*.apk") returned 0
	[0077.937] lstrlenA (lpString="*.apk") returned 5
	[0077.937] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.937] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx") returned="FiveRules.potx"
	[0077.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.937] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="IntroducingPowerPoint2010.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx"
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.zip") returned 0
	[0077.937] lstrlenA (lpString="*.zip") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.rar") returned 0
	[0077.937] lstrlenA (lpString="*.rar") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.7z") returned 0
	[0077.937] lstrlenA (lpString="*.7z") returned 4
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.tar") returned 0
	[0077.937] lstrlenA (lpString="*.tar") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.gzip") returned 0
	[0077.937] lstrlenA (lpString="*.gzip") returned 6
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.jpg") returned 0
	[0077.937] lstrlenA (lpString="*.jpg") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.jpeg") returned 0
	[0077.937] lstrlenA (lpString="*.jpeg") returned 6
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.psd") returned 0
	[0077.937] lstrlenA (lpString="*.psd") returned 5
	[0077.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.cdr") returned 0
	[0077.937] lstrlenA (lpString="*.cdr") returned 5
	[0077.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.dwg") returned 0
	[0077.938] lstrlenA (lpString="*.dwg") returned 5
	[0077.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.max") returned 0
	[0077.938] lstrlenA (lpString="*.max") returned 5
	[0077.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.bmp") returned 0
	[0077.938] lstrlenA (lpString="*.bmp") returned 5
	[0077.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx", pszSpec="*.gif") returned 0
	[0077.938] lstrlenA (lpString="*.gif") returned 5
	[0077.938] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx") returned="IntroducingPowerPoint2010.potx"
	[0077.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="LoanAmortization.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx"
	[0077.938] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx") returned="LoanAmortization.xltx"
	[0077.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx"
	[0077.938] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx") returned="MedianLetter.Dotx"
	[0077.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.939] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianMergeFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx"
	[0077.939] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx") returned="MedianMergeFax.Dotx"
	[0077.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.939] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianMergeLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx"
	[0077.939] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx") returned="MedianMergeLetter.Dotx"
	[0077.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.939] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianReport.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx"
	[0077.939] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx") returned="MedianReport.Dotx"
	[0077.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.939] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianResume.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx"
	[0077.939] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx") returned="MedianResume.Dotx"
	[0077.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="Office Word 2003 Look.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx"
	[0077.940] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.940] lstrcmpA (lpString1=".", lpString2="ONENOTE") returned -1
	[0077.940] lstrcmpA (lpString1="..", lpString2="ONENOTE") returned -1
	[0077.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx") returned="Office Word 2003 Look.dotx"
	[0077.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ONENOTE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE"
	[0077.940] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0077.941] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.941] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.941] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.941] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.941] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0077.941] lstrcmpA (lpString1=".", lpString2="14") returned -1
	[0077.941] lstrcmpA (lpString1="..", lpString2="14") returned -1
	[0077.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*.*") returned="*.*"
	[0077.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\", lpString2="14" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14"
	[0077.941] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0077.948] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.948] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.948] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.948] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.948] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.948] lstrcmpA (lpString1=".", lpString2="Notebook Templates") returned -1
	[0077.948] lstrcmpA (lpString1="..", lpString2="Notebook Templates") returned -1
	[0077.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*") returned="*.*"
	[0077.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\", lpString2="Notebook Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates"
	[0077.948] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0077.950] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.950] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.950] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.950] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.950] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.950] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0077.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*.*") returned="*.*"
	[0077.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\"
	[0077.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\") returned=""
	[0077.950] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\HOW TO DECRYPT FILES.txt"
	[0077.950] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\how to decrypt files.txt")) returned 0xffffffff
	[0077.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0077.951] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0077.951] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.951] CloseHandle (hObject=0x98) returned 1
	[0077.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\", lpString2="Notebook03.onepkg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg"
	[0077.952] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0077.952] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0077.952] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0077.952] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1
	[0077.952] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1
	[0077.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*") returned="*.*"
	[0077.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\", lpString2="Stationery" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery"
	[0077.952] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0077.952] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.952] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.952] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.952] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.952] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.952] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0077.952] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACADEMIC.ONE") returned 1
	[0077.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACADEMIC.ONE") returned 1
	[0077.952] lstrcmpiA (lpString1="", lpString2="ACADEMIC.ONE") returned -1
	[0077.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*.*") returned="*.*"
	[0077.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\"
	[0077.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned=""
	[0077.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0077.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\how to decrypt files.txt")) returned 0xffffffff
	[0077.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98
	[0077.958] WriteFile (in: hFile=0x98, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0077.959] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0077.959] CloseHandle (hObject=0x98) returned 1
	[0077.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="ACADEMIC.ONE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE"
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.zip") returned 0
	[0077.959] lstrlenA (lpString="*.zip") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.rar") returned 0
	[0077.959] lstrlenA (lpString="*.rar") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.7z") returned 0
	[0077.959] lstrlenA (lpString="*.7z") returned 4
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.tar") returned 0
	[0077.959] lstrlenA (lpString="*.tar") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.gzip") returned 0
	[0077.959] lstrlenA (lpString="*.gzip") returned 6
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.jpg") returned 0
	[0077.959] lstrlenA (lpString="*.jpg") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.jpeg") returned 0
	[0077.959] lstrlenA (lpString="*.jpeg") returned 6
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.psd") returned 0
	[0077.959] lstrlenA (lpString="*.psd") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.cdr") returned 0
	[0077.959] lstrlenA (lpString="*.cdr") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.dwg") returned 0
	[0077.959] lstrlenA (lpString="*.dwg") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.max") returned 0
	[0077.959] lstrlenA (lpString="*.max") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.bmp") returned 0
	[0077.959] lstrlenA (lpString="*.bmp") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.gif") returned 0
	[0077.959] lstrlenA (lpString="*.gif") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.png") returned 0
	[0077.959] lstrlenA (lpString="*.png") returned 5
	[0077.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.doc") returned 0
	[0077.960] lstrlenA (lpString="*.doc") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.docx") returned 0
	[0077.960] lstrlenA (lpString="*.docx") returned 6
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.xls") returned 0
	[0077.960] lstrlenA (lpString="*.xls") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.xlsx") returned 0
	[0077.960] lstrlenA (lpString="*.xlsx") returned 6
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.ppt") returned 0
	[0077.960] lstrlenA (lpString="*.ppt") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.pptx") returned 0
	[0077.960] lstrlenA (lpString="*.pptx") returned 6
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.txt") returned 0
	[0077.960] lstrlenA (lpString="*.txt") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.pdf") returned 0
	[0077.960] lstrlenA (lpString="*.pdf") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.djvu") returned 0
	[0077.960] lstrlenA (lpString="*.djvu") returned 6
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.htm") returned 0
	[0077.960] lstrlenA (lpString="*.htm") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.html") returned 0
	[0077.960] lstrlenA (lpString="*.html") returned 6
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mdb") returned 0
	[0077.960] lstrlenA (lpString="*.mdb") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.cer") returned 0
	[0077.960] lstrlenA (lpString="*.cer") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.p12") returned 0
	[0077.960] lstrlenA (lpString="*.p12") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.pfx") returned 0
	[0077.960] lstrlenA (lpString="*.pfx") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.kwm") returned 0
	[0077.960] lstrlenA (lpString="*.kwm") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.pwm") returned 0
	[0077.960] lstrlenA (lpString="*.pwm") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.1cd") returned 0
	[0077.960] lstrlenA (lpString="*.1cd") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.md") returned 0
	[0077.960] lstrlenA (lpString="*.md") returned 4
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mdf") returned 0
	[0077.960] lstrlenA (lpString="*.mdf") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.dbf") returned 0
	[0077.960] lstrlenA (lpString="*.dbf") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.odt") returned 0
	[0077.960] lstrlenA (lpString="*.odt") returned 5
	[0077.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.vob") returned 0
	[0077.960] lstrlenA (lpString="*.vob") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.ifo") returned 0
	[0077.961] lstrlenA (lpString="*.ifo") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.lnk") returned 0
	[0077.961] lstrlenA (lpString="*.lnk") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.torrent") returned 0
	[0077.961] lstrlenA (lpString="*.torrent") returned 9
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mov") returned 0
	[0077.961] lstrlenA (lpString="*.mov") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.m2v") returned 0
	[0077.961] lstrlenA (lpString="*.m2v") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.3gp") returned 0
	[0077.961] lstrlenA (lpString="*.3gp") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mpeg") returned 0
	[0077.961] lstrlenA (lpString="*.mpeg") returned 6
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mpg") returned 0
	[0077.961] lstrlenA (lpString="*.mpg") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.flv") returned 0
	[0077.961] lstrlenA (lpString="*.flv") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.avi") returned 0
	[0077.961] lstrlenA (lpString="*.avi") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mp4") returned 0
	[0077.961] lstrlenA (lpString="*.mp4") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.wmv") returned 0
	[0077.961] lstrlenA (lpString="*.wmv") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.divx") returned 0
	[0077.961] lstrlenA (lpString="*.divx") returned 6
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mkv") returned 0
	[0077.961] lstrlenA (lpString="*.mkv") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.mp3") returned 0
	[0077.961] lstrlenA (lpString="*.mp3") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.wav") returned 0
	[0077.961] lstrlenA (lpString="*.wav") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.flac") returned 0
	[0077.961] lstrlenA (lpString="*.flac") returned 6
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.ape") returned 0
	[0077.961] lstrlenA (lpString="*.ape") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.wma") returned 0
	[0077.961] lstrlenA (lpString="*.wma") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.ac3") returned 0
	[0077.961] lstrlenA (lpString="*.ac3") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.exe") returned 0
	[0077.961] lstrlenA (lpString="*.exe") returned 5
	[0077.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE", pszSpec="*.apk") returned 0
	[0077.961] lstrlenA (lpString="*.apk") returned 5
	[0077.961] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.962] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0077.962] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BLANK.ONE") returned 1
	[0077.962] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLANK.ONE") returned 1
	[0077.962] lstrcmpiA (lpString1="", lpString2="BLANK.ONE") returned -1
	[0077.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE") returned="ACADEMIC.ONE"
	[0077.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\"
	[0077.962] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned=""
	[0077.962] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0077.962] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\how to decrypt files.txt")) returned 0x20
	[0077.962] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="BLANK.ONE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE"
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.zip") returned 0
	[0077.962] lstrlenA (lpString="*.zip") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.rar") returned 0
	[0077.962] lstrlenA (lpString="*.rar") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.7z") returned 0
	[0077.962] lstrlenA (lpString="*.7z") returned 4
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.tar") returned 0
	[0077.962] lstrlenA (lpString="*.tar") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.gzip") returned 0
	[0077.962] lstrlenA (lpString="*.gzip") returned 6
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.jpg") returned 0
	[0077.962] lstrlenA (lpString="*.jpg") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.jpeg") returned 0
	[0077.962] lstrlenA (lpString="*.jpeg") returned 6
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.psd") returned 0
	[0077.962] lstrlenA (lpString="*.psd") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.cdr") returned 0
	[0077.962] lstrlenA (lpString="*.cdr") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.dwg") returned 0
	[0077.962] lstrlenA (lpString="*.dwg") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.max") returned 0
	[0077.962] lstrlenA (lpString="*.max") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.bmp") returned 0
	[0077.962] lstrlenA (lpString="*.bmp") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.gif") returned 0
	[0077.962] lstrlenA (lpString="*.gif") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.png") returned 0
	[0077.962] lstrlenA (lpString="*.png") returned 5
	[0077.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.doc") returned 0
	[0077.962] lstrlenA (lpString="*.doc") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.docx") returned 0
	[0077.963] lstrlenA (lpString="*.docx") returned 6
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.xls") returned 0
	[0077.963] lstrlenA (lpString="*.xls") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.xlsx") returned 0
	[0077.963] lstrlenA (lpString="*.xlsx") returned 6
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.ppt") returned 0
	[0077.963] lstrlenA (lpString="*.ppt") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.pptx") returned 0
	[0077.963] lstrlenA (lpString="*.pptx") returned 6
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.txt") returned 0
	[0077.963] lstrlenA (lpString="*.txt") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.pdf") returned 0
	[0077.963] lstrlenA (lpString="*.pdf") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.djvu") returned 0
	[0077.963] lstrlenA (lpString="*.djvu") returned 6
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.htm") returned 0
	[0077.963] lstrlenA (lpString="*.htm") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.html") returned 0
	[0077.963] lstrlenA (lpString="*.html") returned 6
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mdb") returned 0
	[0077.963] lstrlenA (lpString="*.mdb") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.cer") returned 0
	[0077.963] lstrlenA (lpString="*.cer") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.p12") returned 0
	[0077.963] lstrlenA (lpString="*.p12") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.pfx") returned 0
	[0077.963] lstrlenA (lpString="*.pfx") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.kwm") returned 0
	[0077.963] lstrlenA (lpString="*.kwm") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.pwm") returned 0
	[0077.963] lstrlenA (lpString="*.pwm") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.1cd") returned 0
	[0077.963] lstrlenA (lpString="*.1cd") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.md") returned 0
	[0077.963] lstrlenA (lpString="*.md") returned 4
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mdf") returned 0
	[0077.963] lstrlenA (lpString="*.mdf") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.dbf") returned 0
	[0077.963] lstrlenA (lpString="*.dbf") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.odt") returned 0
	[0077.963] lstrlenA (lpString="*.odt") returned 5
	[0077.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.vob") returned 0
	[0077.963] lstrlenA (lpString="*.vob") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.ifo") returned 0
	[0077.964] lstrlenA (lpString="*.ifo") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.lnk") returned 0
	[0077.964] lstrlenA (lpString="*.lnk") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.torrent") returned 0
	[0077.964] lstrlenA (lpString="*.torrent") returned 9
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mov") returned 0
	[0077.964] lstrlenA (lpString="*.mov") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.m2v") returned 0
	[0077.964] lstrlenA (lpString="*.m2v") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.3gp") returned 0
	[0077.964] lstrlenA (lpString="*.3gp") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mpeg") returned 0
	[0077.964] lstrlenA (lpString="*.mpeg") returned 6
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mpg") returned 0
	[0077.964] lstrlenA (lpString="*.mpg") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.flv") returned 0
	[0077.964] lstrlenA (lpString="*.flv") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.avi") returned 0
	[0077.964] lstrlenA (lpString="*.avi") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mp4") returned 0
	[0077.964] lstrlenA (lpString="*.mp4") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.wmv") returned 0
	[0077.964] lstrlenA (lpString="*.wmv") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.divx") returned 0
	[0077.964] lstrlenA (lpString="*.divx") returned 6
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mkv") returned 0
	[0077.964] lstrlenA (lpString="*.mkv") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.mp3") returned 0
	[0077.964] lstrlenA (lpString="*.mp3") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.wav") returned 0
	[0077.964] lstrlenA (lpString="*.wav") returned 5
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.flac") returned 0
	[0077.964] lstrlenA (lpString="*.flac") returned 6
	[0077.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.ape") returned 0
	[0077.964] lstrlenA (lpString="*.ape") returned 5
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.wma") returned 0
	[0077.965] lstrlenA (lpString="*.wma") returned 5
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.ac3") returned 0
	[0077.965] lstrlenA (lpString="*.ac3") returned 5
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.exe") returned 0
	[0077.965] lstrlenA (lpString="*.exe") returned 5
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE", pszSpec="*.apk") returned 0
	[0077.965] lstrlenA (lpString="*.apk") returned 5
	[0077.965] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.965] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0077.965] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUSINESS.ONE") returned 1
	[0077.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUSINESS.ONE") returned 1
	[0077.965] lstrcmpiA (lpString1="", lpString2="BUSINESS.ONE") returned -1
	[0077.965] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE") returned="BLANK.ONE"
	[0077.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\"
	[0077.965] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned=""
	[0077.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0077.965] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\how to decrypt files.txt")) returned 0x20
	[0077.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="BUSINESS.ONE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE"
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.zip") returned 0
	[0077.965] lstrlenA (lpString="*.zip") returned 5
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.rar") returned 0
	[0077.965] lstrlenA (lpString="*.rar") returned 5
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.7z") returned 0
	[0077.965] lstrlenA (lpString="*.7z") returned 4
	[0077.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.tar") returned 0
	[0077.965] lstrlenA (lpString="*.tar") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.gzip") returned 0
	[0077.966] lstrlenA (lpString="*.gzip") returned 6
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.jpg") returned 0
	[0077.966] lstrlenA (lpString="*.jpg") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.jpeg") returned 0
	[0077.966] lstrlenA (lpString="*.jpeg") returned 6
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.psd") returned 0
	[0077.966] lstrlenA (lpString="*.psd") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.cdr") returned 0
	[0077.966] lstrlenA (lpString="*.cdr") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.dwg") returned 0
	[0077.966] lstrlenA (lpString="*.dwg") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.max") returned 0
	[0077.966] lstrlenA (lpString="*.max") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.bmp") returned 0
	[0077.966] lstrlenA (lpString="*.bmp") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.gif") returned 0
	[0077.966] lstrlenA (lpString="*.gif") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.png") returned 0
	[0077.966] lstrlenA (lpString="*.png") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.doc") returned 0
	[0077.966] lstrlenA (lpString="*.doc") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.docx") returned 0
	[0077.966] lstrlenA (lpString="*.docx") returned 6
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.xls") returned 0
	[0077.966] lstrlenA (lpString="*.xls") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.xlsx") returned 0
	[0077.966] lstrlenA (lpString="*.xlsx") returned 6
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.ppt") returned 0
	[0077.966] lstrlenA (lpString="*.ppt") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.pptx") returned 0
	[0077.966] lstrlenA (lpString="*.pptx") returned 6
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.txt") returned 0
	[0077.966] lstrlenA (lpString="*.txt") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.pdf") returned 0
	[0077.966] lstrlenA (lpString="*.pdf") returned 5
	[0077.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.djvu") returned 0
	[0077.966] lstrlenA (lpString="*.djvu") returned 6
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.htm") returned 0
	[0077.967] lstrlenA (lpString="*.htm") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.html") returned 0
	[0077.967] lstrlenA (lpString="*.html") returned 6
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mdb") returned 0
	[0077.967] lstrlenA (lpString="*.mdb") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.cer") returned 0
	[0077.967] lstrlenA (lpString="*.cer") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.p12") returned 0
	[0077.967] lstrlenA (lpString="*.p12") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.pfx") returned 0
	[0077.967] lstrlenA (lpString="*.pfx") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.kwm") returned 0
	[0077.967] lstrlenA (lpString="*.kwm") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.pwm") returned 0
	[0077.967] lstrlenA (lpString="*.pwm") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.1cd") returned 0
	[0077.967] lstrlenA (lpString="*.1cd") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.md") returned 0
	[0077.967] lstrlenA (lpString="*.md") returned 4
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mdf") returned 0
	[0077.967] lstrlenA (lpString="*.mdf") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.dbf") returned 0
	[0077.967] lstrlenA (lpString="*.dbf") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.odt") returned 0
	[0077.967] lstrlenA (lpString="*.odt") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.vob") returned 0
	[0077.967] lstrlenA (lpString="*.vob") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.ifo") returned 0
	[0077.967] lstrlenA (lpString="*.ifo") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.lnk") returned 0
	[0077.967] lstrlenA (lpString="*.lnk") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.torrent") returned 0
	[0077.967] lstrlenA (lpString="*.torrent") returned 9
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mov") returned 0
	[0077.967] lstrlenA (lpString="*.mov") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.m2v") returned 0
	[0077.967] lstrlenA (lpString="*.m2v") returned 5
	[0077.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.3gp") returned 0
	[0077.968] lstrlenA (lpString="*.3gp") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mpeg") returned 0
	[0077.968] lstrlenA (lpString="*.mpeg") returned 6
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mpg") returned 0
	[0077.968] lstrlenA (lpString="*.mpg") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.flv") returned 0
	[0077.968] lstrlenA (lpString="*.flv") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.avi") returned 0
	[0077.968] lstrlenA (lpString="*.avi") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mp4") returned 0
	[0077.968] lstrlenA (lpString="*.mp4") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.wmv") returned 0
	[0077.968] lstrlenA (lpString="*.wmv") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.divx") returned 0
	[0077.968] lstrlenA (lpString="*.divx") returned 6
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mkv") returned 0
	[0077.968] lstrlenA (lpString="*.mkv") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.mp3") returned 0
	[0077.968] lstrlenA (lpString="*.mp3") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.wav") returned 0
	[0077.968] lstrlenA (lpString="*.wav") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.flac") returned 0
	[0077.968] lstrlenA (lpString="*.flac") returned 6
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.ape") returned 0
	[0077.968] lstrlenA (lpString="*.ape") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.wma") returned 0
	[0077.968] lstrlenA (lpString="*.wma") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.ac3") returned 0
	[0077.968] lstrlenA (lpString="*.ac3") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.exe") returned 0
	[0077.968] lstrlenA (lpString="*.exe") returned 5
	[0077.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE", pszSpec="*.apk") returned 0
	[0077.968] lstrlenA (lpString="*.apk") returned 5
	[0077.968] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.968] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0077.968] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DESIGNER.ONE") returned 1
	[0077.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DESIGNER.ONE") returned 1
	[0077.968] lstrcmpiA (lpString1="", lpString2="DESIGNER.ONE") returned -1
	[0077.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE") returned="BUSINESS.ONE"
	[0077.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\"
	[0077.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned=""
	[0077.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0077.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\how to decrypt files.txt")) returned 0x20
	[0077.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="DESIGNER.ONE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE"
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.zip") returned 0
	[0077.969] lstrlenA (lpString="*.zip") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.rar") returned 0
	[0077.969] lstrlenA (lpString="*.rar") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.7z") returned 0
	[0077.969] lstrlenA (lpString="*.7z") returned 4
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.tar") returned 0
	[0077.969] lstrlenA (lpString="*.tar") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.gzip") returned 0
	[0077.969] lstrlenA (lpString="*.gzip") returned 6
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.jpg") returned 0
	[0077.969] lstrlenA (lpString="*.jpg") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.jpeg") returned 0
	[0077.969] lstrlenA (lpString="*.jpeg") returned 6
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.psd") returned 0
	[0077.969] lstrlenA (lpString="*.psd") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.cdr") returned 0
	[0077.969] lstrlenA (lpString="*.cdr") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.dwg") returned 0
	[0077.969] lstrlenA (lpString="*.dwg") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.max") returned 0
	[0077.969] lstrlenA (lpString="*.max") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.bmp") returned 0
	[0077.969] lstrlenA (lpString="*.bmp") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.gif") returned 0
	[0077.969] lstrlenA (lpString="*.gif") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.png") returned 0
	[0077.969] lstrlenA (lpString="*.png") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.doc") returned 0
	[0077.969] lstrlenA (lpString="*.doc") returned 5
	[0077.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.docx") returned 0
	[0077.970] lstrlenA (lpString="*.docx") returned 6
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.xls") returned 0
	[0077.970] lstrlenA (lpString="*.xls") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.xlsx") returned 0
	[0077.970] lstrlenA (lpString="*.xlsx") returned 6
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.ppt") returned 0
	[0077.970] lstrlenA (lpString="*.ppt") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.pptx") returned 0
	[0077.970] lstrlenA (lpString="*.pptx") returned 6
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.txt") returned 0
	[0077.970] lstrlenA (lpString="*.txt") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.pdf") returned 0
	[0077.970] lstrlenA (lpString="*.pdf") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.djvu") returned 0
	[0077.970] lstrlenA (lpString="*.djvu") returned 6
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.htm") returned 0
	[0077.970] lstrlenA (lpString="*.htm") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.html") returned 0
	[0077.970] lstrlenA (lpString="*.html") returned 6
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mdb") returned 0
	[0077.970] lstrlenA (lpString="*.mdb") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.cer") returned 0
	[0077.970] lstrlenA (lpString="*.cer") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.p12") returned 0
	[0077.970] lstrlenA (lpString="*.p12") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.pfx") returned 0
	[0077.970] lstrlenA (lpString="*.pfx") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.kwm") returned 0
	[0077.970] lstrlenA (lpString="*.kwm") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.pwm") returned 0
	[0077.970] lstrlenA (lpString="*.pwm") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.1cd") returned 0
	[0077.970] lstrlenA (lpString="*.1cd") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.md") returned 0
	[0077.970] lstrlenA (lpString="*.md") returned 4
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mdf") returned 0
	[0077.970] lstrlenA (lpString="*.mdf") returned 5
	[0077.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.dbf") returned 0
	[0077.970] lstrlenA (lpString="*.dbf") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.odt") returned 0
	[0077.971] lstrlenA (lpString="*.odt") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.vob") returned 0
	[0077.971] lstrlenA (lpString="*.vob") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.ifo") returned 0
	[0077.971] lstrlenA (lpString="*.ifo") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.lnk") returned 0
	[0077.971] lstrlenA (lpString="*.lnk") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.torrent") returned 0
	[0077.971] lstrlenA (lpString="*.torrent") returned 9
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mov") returned 0
	[0077.971] lstrlenA (lpString="*.mov") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.m2v") returned 0
	[0077.971] lstrlenA (lpString="*.m2v") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.3gp") returned 0
	[0077.971] lstrlenA (lpString="*.3gp") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mpeg") returned 0
	[0077.971] lstrlenA (lpString="*.mpeg") returned 6
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mpg") returned 0
	[0077.971] lstrlenA (lpString="*.mpg") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.flv") returned 0
	[0077.971] lstrlenA (lpString="*.flv") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.avi") returned 0
	[0077.971] lstrlenA (lpString="*.avi") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mp4") returned 0
	[0077.971] lstrlenA (lpString="*.mp4") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.wmv") returned 0
	[0077.971] lstrlenA (lpString="*.wmv") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.divx") returned 0
	[0077.971] lstrlenA (lpString="*.divx") returned 6
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mkv") returned 0
	[0077.971] lstrlenA (lpString="*.mkv") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.mp3") returned 0
	[0077.971] lstrlenA (lpString="*.mp3") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.wav") returned 0
	[0077.971] lstrlenA (lpString="*.wav") returned 5
	[0077.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.flac") returned 0
	[0077.976] lstrlenA (lpString="*.flac") returned 6
	[0077.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.ape") returned 0
	[0077.976] lstrlenA (lpString="*.ape") returned 5
	[0077.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.wma") returned 0
	[0077.976] lstrlenA (lpString="*.wma") returned 5
	[0077.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.ac3") returned 0
	[0077.983] lstrlenA (lpString="*.ac3") returned 5
	[0077.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.exe") returned 0
	[0077.984] lstrlenA (lpString="*.exe") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE", pszSpec="*.apk") returned 0
	[0077.984] lstrlenA (lpString="*.apk") returned 5
	[0077.984] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0077.984] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0077.984] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PLANNERS.ONE") returned -1
	[0077.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PLANNERS.ONE") returned -1
	[0077.984] lstrcmpiA (lpString1="", lpString2="PLANNERS.ONE") returned -1
	[0077.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE") returned="DESIGNER.ONE"
	[0077.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\"
	[0077.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned=""
	[0077.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt"
	[0077.984] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\how to decrypt files.txt")) returned 0x20
	[0077.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="PLANNERS.ONE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE"
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.zip") returned 0
	[0077.984] lstrlenA (lpString="*.zip") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.rar") returned 0
	[0077.984] lstrlenA (lpString="*.rar") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.7z") returned 0
	[0077.984] lstrlenA (lpString="*.7z") returned 4
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.tar") returned 0
	[0077.984] lstrlenA (lpString="*.tar") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.gzip") returned 0
	[0077.984] lstrlenA (lpString="*.gzip") returned 6
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.jpg") returned 0
	[0077.984] lstrlenA (lpString="*.jpg") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.jpeg") returned 0
	[0077.984] lstrlenA (lpString="*.jpeg") returned 6
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.psd") returned 0
	[0077.984] lstrlenA (lpString="*.psd") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.cdr") returned 0
	[0077.984] lstrlenA (lpString="*.cdr") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.dwg") returned 0
	[0077.984] lstrlenA (lpString="*.dwg") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.max") returned 0
	[0077.984] lstrlenA (lpString="*.max") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.bmp") returned 0
	[0077.984] lstrlenA (lpString="*.bmp") returned 5
	[0077.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE", pszSpec="*.gif") returned 0
	[0077.984] lstrlenA (lpString="*.gif") returned 5
	[0077.985] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0077.985] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0077.985] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0077.985] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0077.985] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0077.985] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0077.985] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.985] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.985] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrielLetter.Dotx") returned -1
	[0077.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielLetter.Dotx") returned -1
	[0077.985] lstrcmpiA (lpString1="", lpString2="OrielLetter.Dotx") returned -1
	[0077.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*") returned="*.*"
	[0077.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OrielLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx"
	[0077.985] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.986] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.986] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrielMergeFax.Dotx") returned -1
	[0077.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielMergeFax.Dotx") returned -1
	[0077.986] lstrcmpiA (lpString1="", lpString2="OrielMergeFax.Dotx") returned -1
	[0077.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx") returned="OrielLetter.Dotx"
	[0077.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OrielMergeFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx"
	[0077.987] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrielMergeLetter.Dotx") returned -1
	[0077.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielMergeLetter.Dotx") returned -1
	[0077.987] lstrcmpiA (lpString1="", lpString2="OrielMergeLetter.Dotx") returned -1
	[0077.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx") returned="OrielMergeFax.Dotx"
	[0077.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OrielMergeLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx"
	[0077.987] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrielReport.Dotx") returned -1
	[0077.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielReport.Dotx") returned -1
	[0077.987] lstrcmpiA (lpString1="", lpString2="OrielReport.Dotx") returned -1
	[0077.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx") returned="OrielMergeLetter.Dotx"
	[0077.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OrielReport.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx"
	[0077.987] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrielResume.Dotx") returned -1
	[0077.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielResume.Dotx") returned -1
	[0077.987] lstrcmpiA (lpString1="", lpString2="OrielResume.Dotx") returned -1
	[0077.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx") returned="OrielReport.Dotx"
	[0077.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OrielResume.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx"
	[0077.988] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.990] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OriginLetter.Dotx") returned -1
	[0077.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginLetter.Dotx") returned -1
	[0077.990] lstrcmpiA (lpString1="", lpString2="OriginLetter.Dotx") returned -1
	[0077.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx") returned="OrielResume.Dotx"
	[0077.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OriginLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx"
	[0077.990] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.990] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OriginMergeFax.Dotx") returned -1
	[0077.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginMergeFax.Dotx") returned -1
	[0077.990] lstrcmpiA (lpString1="", lpString2="OriginMergeFax.Dotx") returned -1
	[0077.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx") returned="OriginLetter.Dotx"
	[0077.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OriginMergeFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx"
	[0077.990] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OriginMergeLetter.Dotx") returned -1
	[0077.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginMergeLetter.Dotx") returned -1
	[0077.991] lstrcmpiA (lpString1="", lpString2="OriginMergeLetter.Dotx") returned -1
	[0077.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx") returned="OriginMergeFax.Dotx"
	[0077.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OriginMergeLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx"
	[0077.991] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OriginReport.Dotx") returned -1
	[0077.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginReport.Dotx") returned -1
	[0077.991] lstrcmpiA (lpString1="", lpString2="OriginReport.Dotx") returned -1
	[0077.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx") returned="OriginMergeLetter.Dotx"
	[0077.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OriginReport.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx"
	[0077.991] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OriginResume.Dotx") returned -1
	[0077.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginResume.Dotx") returned -1
	[0077.991] lstrcmpiA (lpString1="", lpString2="OriginResume.Dotx") returned -1
	[0077.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx") returned="OriginReport.Dotx"
	[0077.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="OriginResume.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx"
	[0077.991] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.991] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PersonalMonthlyBudget.xltx") returned -1
	[0077.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PersonalMonthlyBudget.xltx") returned -1
	[0077.992] lstrcmpiA (lpString1="", lpString2="PersonalMonthlyBudget.xltx") returned -1
	[0077.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx") returned="OriginResume.Dotx"
	[0077.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="PersonalMonthlyBudget.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx"
	[0077.992] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.992] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pitchbook.potx") returned -1
	[0077.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pitchbook.potx") returned -1
	[0077.992] lstrcmpiA (lpString1="", lpString2="Pitchbook.potx") returned -1
	[0077.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx") returned="PersonalMonthlyBudget.xltx"
	[0077.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="Pitchbook.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx"
	[0077.992] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.992] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectStatusReport.potx") returned -1
	[0077.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusReport.potx") returned -1
	[0077.992] lstrcmpiA (lpString1="", lpString2="ProjectStatusReport.potx") returned -1
	[0077.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx") returned="Pitchbook.potx"
	[0077.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ProjectStatusReport.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx"
	[0077.992] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.992] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PROJPLAN.XLTX") returned -1
	[0077.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROJPLAN.XLTX") returned -1
	[0077.992] lstrcmpiA (lpString1="", lpString2="PROJPLAN.XLTX") returned -1
	[0077.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx") returned="ProjectStatusReport.potx"
	[0077.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="PROJPLAN.XLTX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX"
	[0077.993] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.993] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="QuizShow.potx") returned -1
	[0077.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuizShow.potx") returned -1
	[0077.993] lstrcmpiA (lpString1="", lpString2="QuizShow.potx") returned -1
	[0077.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX") returned="PROJPLAN.XLTX"
	[0077.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="QuizShow.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx"
	[0077.993] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.993] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SalesReport.xltx") returned -1
	[0077.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SalesReport.xltx") returned -1
	[0077.993] lstrcmpiA (lpString1="", lpString2="SalesReport.xltx") returned -1
	[0077.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx") returned="QuizShow.potx"
	[0077.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="SalesReport.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx"
	[0077.993] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.993] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TASKLIST.XLTX") returned -1
	[0077.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TASKLIST.XLTX") returned -1
	[0077.993] lstrcmpiA (lpString1="", lpString2="TASKLIST.XLTX") returned -1
	[0077.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx") returned="SalesReport.xltx"
	[0077.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt"
	[0077.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20
	[0077.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="TASKLIST.XLTX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX"
	[0077.994] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.994] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.994] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TimeCard.xltx") returned -1
	[0077.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TimeCard.xltx") returned -1
	[0077.994] lstrcmpiA (lpString1="", lpString2="TimeCard.xltx") returned -1
	[0077.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX") returned="TASKLIST.XLTX"
	[0077.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.995] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Training.potx") returned -1
	[0077.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Training.potx") returned -1
	[0077.995] lstrcmpiA (lpString1="", lpString2="Training.potx") returned -1
	[0077.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx") returned="TimeCard.xltx"
	[0077.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.995] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.995] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UrbanLetter.Dotx") returned -1
	[0077.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanLetter.Dotx") returned -1
	[0077.995] lstrcmpiA (lpString1="", lpString2="UrbanLetter.Dotx") returned -1
	[0077.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx") returned="Training.potx"
	[0077.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.995] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.996] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UrbanMergeFax.Dotx") returned -1
	[0077.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanMergeFax.Dotx") returned -1
	[0077.996] lstrcmpiA (lpString1="", lpString2="UrbanMergeFax.Dotx") returned -1
	[0077.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx") returned="UrbanLetter.Dotx"
	[0077.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.996] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.996] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.996] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UrbanMergeLetter.Dotx") returned -1
	[0077.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanMergeLetter.Dotx") returned -1
	[0077.996] lstrcmpiA (lpString1="", lpString2="UrbanMergeLetter.Dotx") returned -1
	[0077.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx") returned="UrbanMergeFax.Dotx"
	[0077.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.996] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.996] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.996] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UrbanPhotoAlbum.potx") returned -1
	[0077.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanPhotoAlbum.potx") returned -1
	[0077.996] lstrcmpiA (lpString1="", lpString2="UrbanPhotoAlbum.potx") returned -1
	[0077.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx") returned="UrbanMergeLetter.Dotx"
	[0077.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.996] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.996] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.996] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UrbanReport.Dotx") returned -1
	[0077.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanReport.Dotx") returned -1
	[0077.996] lstrcmpiA (lpString1="", lpString2="UrbanReport.Dotx") returned -1
	[0077.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx") returned="UrbanPhotoAlbum.potx"
	[0077.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.996] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.996] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.996] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UrbanResume.Dotx") returned -1
	[0077.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanResume.Dotx") returned -1
	[0077.997] lstrcmpiA (lpString1="", lpString2="UrbanResume.Dotx") returned -1
	[0077.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx") returned="UrbanReport.Dotx"
	[0077.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.997] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.997] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.997] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WidescreenPresentation.potx") returned -1
	[0077.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WidescreenPresentation.potx") returned -1
	[0077.997] lstrcmpiA (lpString1="", lpString2="WidescreenPresentation.potx") returned -1
	[0077.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx") returned="UrbanResume.Dotx"
	[0077.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\"
	[0077.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned=""
	[0077.997] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0077.997] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0077.997] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0077.997] lstrcmpA (lpString1=".", lpString2="Presentation Designs") returned -1
	[0077.997] lstrcmpA (lpString1="..", lpString2="Presentation Designs") returned -1
	[0077.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\*.*") returned="*.*"
	[0077.997] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0077.997] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0077.997] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.997] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0077.997] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0077.997] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0077.997] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0077.997] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Maple.gif") returned -1
	[0077.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maple.gif") returned -1
	[0077.997] lstrcmpiA (lpString1="", lpString2="Maple.gif") returned -1
	[0077.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*.*") returned="*.*"
	[0077.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\"
	[0077.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned=""
	[0078.002] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.003] CloseHandle (hObject=0x8c) returned 1
	[0078.003] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.003] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.003] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.003] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.003] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.003] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.003] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.003] lstrcmpA (lpString1=".", lpString2="Microsoft SQL Server Compact Edition") returned -1
	[0078.003] lstrcmpA (lpString1="..", lpString2="Microsoft SQL Server Compact Edition") returned -1
	[0078.003] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.003] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.006] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.006] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.006] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.006] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.006] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.006] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1
	[0078.006] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1
	[0078.006] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*") returned="*.*"
	[0078.006] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.007] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.007] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.007] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.007] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.007] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.007] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1
	[0078.007] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1
	[0078.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*") returned="*.*"
	[0078.007] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.008] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.008] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.008] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.008] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.008] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.008] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.008] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.008] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.008] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlceca35.dll") returned -1
	[0078.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlceca35.dll") returned -1
	[0078.008] lstrcmpiA (lpString1="", lpString2="sqlceca35.dll") returned -1
	[0078.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*") returned="*.*"
	[0078.008] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\"
	[0078.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned=""
	[0078.009] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.009] CloseHandle (hObject=0x88) returned 1
	[0078.009] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.009] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.009] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlcecompact35.dll") returned -1
	[0078.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlcecompact35.dll") returned -1
	[0078.009] lstrcmpiA (lpString1="", lpString2="sqlcecompact35.dll") returned -1
	[0078.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll") returned="sqlceca35.dll"
	[0078.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\"
	[0078.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned=""
	[0078.009] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.009] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.009] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlceer35EN.dll") returned -1
	[0078.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlceer35EN.dll") returned -1
	[0078.009] lstrcmpiA (lpString1="", lpString2="sqlceer35EN.dll") returned -1
	[0078.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll") returned="sqlcecompact35.dll"
	[0078.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\"
	[0078.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned=""
	[0078.009] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.009] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.009] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlceme35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlceme35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="", lpString2="sqlceme35.dll") returned -1
	[0078.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dll") returned="sqlceer35EN.dll"
	[0078.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\"
	[0078.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned=""
	[0078.010] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.010] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.010] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlceoledb35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlceoledb35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="", lpString2="sqlceoledb35.dll") returned -1
	[0078.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dll") returned="sqlceme35.dll"
	[0078.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\"
	[0078.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned=""
	[0078.010] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.010] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.010] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlceqp35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlceqp35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="", lpString2="sqlceqp35.dll") returned -1
	[0078.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll") returned="sqlceoledb35.dll"
	[0078.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\"
	[0078.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned=""
	[0078.010] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.010] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.010] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="sqlcese35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlcese35.dll") returned -1
	[0078.010] lstrcmpiA (lpString1="", lpString2="sqlcese35.dll") returned -1
	[0078.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dll") returned="sqlceqp35.dll"
	[0078.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\"
	[0078.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned=""
	[0078.010] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.010] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.011] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.011] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.011] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.011] lstrcmpA (lpString1=".", lpString2="Microsoft Sync Framework") returned -1
	[0078.011] lstrcmpA (lpString1="..", lpString2="Microsoft Sync Framework") returned -1
	[0078.011] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.011] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.011] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.011] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.011] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.011] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.011] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.011] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1
	[0078.011] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1
	[0078.011] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\*.*") returned="*.*"
	[0078.011] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.011] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.011] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.011] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.011] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.011] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.011] lstrcmpA (lpString1=".", lpString2="Documentation") returned -1
	[0078.012] lstrcmpA (lpString1="..", lpString2="Documentation") returned -1
	[0078.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*") returned="*.*"
	[0078.012] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.012] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.012] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.012] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.012] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.012] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.012] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0078.012] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0078.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*") returned="*.*"
	[0078.012] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.013] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.013] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.013] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.013] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.013] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.013] lstrcmpA (lpString1=".", lpString2="License Agreements") returned -1
	[0078.013] lstrcmpA (lpString1="..", lpString2="License Agreements") returned -1
	[0078.013] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*") returned="*.*"
	[0078.013] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0078.013] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.013] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.013] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.013] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.013] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.013] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0078.013] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SynchronizationEula.rtf") returned -1
	[0078.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SynchronizationEula.rtf") returned -1
	[0078.013] lstrcmpiA (lpString1="", lpString2="SynchronizationEula.rtf") returned -1
	[0078.013] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*") returned="*.*"
	[0078.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\"
	[0078.013] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned=""
	[0078.014] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.014] CloseHandle (hObject=0x94) returned 1
	[0078.014] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0078.014] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0078.014] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0078.014] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0078.014] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.014] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.014] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.014] lstrcmpA (lpString1=".", lpString2="Runtime") returned -1
	[0078.014] lstrcmpA (lpString1="..", lpString2="Runtime") returned -1
	[0078.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*") returned="*.*"
	[0078.015] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.015] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.015] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.015] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.015] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.015] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.015] lstrcmpA (lpString1=".", lpString2="x64") returned -1
	[0078.015] lstrcmpA (lpString1="..", lpString2="x64") returned -1
	[0078.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*") returned="*.*"
	[0078.015] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.043] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.043] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.043] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.043] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.043] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.043] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.043] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FeedSync.dll") returned -1
	[0078.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FeedSync.dll") returned 1
	[0078.043] lstrcmpiA (lpString1="", lpString2="FeedSync.dll") returned -1
	[0078.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*") returned="*.*"
	[0078.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\"
	[0078.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned=""
	[0078.044] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.044] CloseHandle (hObject=0x90) returned 1
	[0078.044] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.044] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.044] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.dll") returned -1
	[0078.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.dll") returned -1
	[0078.044] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.dll") returned -1
	[0078.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll") returned="FeedSync.dll"
	[0078.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\"
	[0078.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned=""
	[0078.044] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.044] lstrcmpA (lpString1=".", lpString2="resources") returned -1
	[0078.044] lstrcmpA (lpString1="..", lpString2="resources") returned -1
	[0078.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll") returned="Microsoft.Synchronization.dll"
	[0078.044] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0078.045] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.045] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.045] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.045] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.045] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.045] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0078.045] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0078.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*") returned="*.*"
	[0078.045] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f28
	[0078.045] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.045] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0078.045] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.045] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.045] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 1
	[0078.045] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0
	[0078.046] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Synchronization.rll") returned -1
	[0078.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Synchronization.rll") returned -1
	[0078.046] lstrcmpiA (lpString1="", lpString2="Synchronization.rll") returned -1
	[0078.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*") returned="*.*"
	[0078.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\"
	[0078.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned=""
	[0078.048] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.049] CloseHandle (hObject=0x98) returned 1
	[0078.049] FindNextFileA (in: hFindFile=0x8b7f28, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0
	[0078.049] FindClose (in: hFindFile=0x8b7f28 | out: hFindFile=0x8b7f28) returned 1
	[0078.049] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0078.049] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0078.049] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.049] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.049] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Synchronization.dll") returned -1
	[0078.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Synchronization.dll") returned -1
	[0078.049] lstrcmpiA (lpString1="", lpString2="Synchronization.dll") returned -1
	[0078.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*") returned="*.*"
	[0078.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\"
	[0078.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned=""
	[0078.049] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0078.049] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0078.049] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.049] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.049] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.049] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.049] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.049] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.050] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.050] lstrcmpA (lpString1=".", lpString2="Microsoft Synchronization Services") returned -1
	[0078.050] lstrcmpA (lpString1="..", lpString2="Microsoft Synchronization Services") returned -1
	[0078.050] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.050] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.050] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.050] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.050] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.050] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.050] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.050] lstrcmpA (lpString1=".", lpString2="ADO.NET") returned -1
	[0078.050] lstrcmpA (lpString1="..", lpString2="ADO.NET") returned -1
	[0078.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\*.*") returned="*.*"
	[0078.050] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.051] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.051] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.051] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.051] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.051] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.051] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1
	[0078.051] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1
	[0078.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*") returned="*.*"
	[0078.051] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.135] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.135] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.135] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.135] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.135] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0078.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.Data.dll") returned -1
	[0078.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.Data.dll") returned -1
	[0078.135] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.Data.dll") returned -1
	[0078.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*") returned="*.*"
	[0078.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\"
	[0078.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned=""
	[0078.136] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.136] CloseHandle (hObject=0x8c) returned 1
	[0078.136] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.136] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0078.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.Data.Server.dll") returned -1
	[0078.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.Data.Server.dll") returned -1
	[0078.136] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.Data.Server.dll") returned -1
	[0078.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.dll") returned="Microsoft.Synchronization.Data.dll"
	[0078.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\"
	[0078.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned=""
	[0078.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\v1.0\\how to decrypt files.txt")) returned 0x20
	[0078.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.zip") returned 0
	[0078.136] lstrlenA (lpString="*.zip") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.rar") returned 0
	[0078.137] lstrlenA (lpString="*.rar") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.7z") returned 0
	[0078.137] lstrlenA (lpString="*.7z") returned 4
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.tar") returned 0
	[0078.137] lstrlenA (lpString="*.tar") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.gzip") returned 0
	[0078.137] lstrlenA (lpString="*.gzip") returned 6
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.jpg") returned 0
	[0078.137] lstrlenA (lpString="*.jpg") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.jpeg") returned 0
	[0078.137] lstrlenA (lpString="*.jpeg") returned 6
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.psd") returned 0
	[0078.137] lstrlenA (lpString="*.psd") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.cdr") returned 0
	[0078.137] lstrlenA (lpString="*.cdr") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.dwg") returned 0
	[0078.137] lstrlenA (lpString="*.dwg") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.max") returned 0
	[0078.137] lstrlenA (lpString="*.max") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.bmp") returned 0
	[0078.137] lstrlenA (lpString="*.bmp") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.gif") returned 0
	[0078.137] lstrlenA (lpString="*.gif") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.png") returned 0
	[0078.137] lstrlenA (lpString="*.png") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.doc") returned 0
	[0078.137] lstrlenA (lpString="*.doc") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.docx") returned 0
	[0078.137] lstrlenA (lpString="*.docx") returned 6
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.xls") returned 0
	[0078.137] lstrlenA (lpString="*.xls") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.xlsx") returned 0
	[0078.137] lstrlenA (lpString="*.xlsx") returned 6
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.ppt") returned 0
	[0078.137] lstrlenA (lpString="*.ppt") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.pptx") returned 0
	[0078.137] lstrlenA (lpString="*.pptx") returned 6
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.txt") returned 0
	[0078.137] lstrlenA (lpString="*.txt") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.pdf") returned 0
	[0078.137] lstrlenA (lpString="*.pdf") returned 5
	[0078.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.djvu") returned 0
	[0078.137] lstrlenA (lpString="*.djvu") returned 6
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.htm") returned 0
	[0078.138] lstrlenA (lpString="*.htm") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.html") returned 0
	[0078.138] lstrlenA (lpString="*.html") returned 6
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mdb") returned 0
	[0078.138] lstrlenA (lpString="*.mdb") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.cer") returned 0
	[0078.138] lstrlenA (lpString="*.cer") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.p12") returned 0
	[0078.138] lstrlenA (lpString="*.p12") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.pfx") returned 0
	[0078.138] lstrlenA (lpString="*.pfx") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.kwm") returned 0
	[0078.138] lstrlenA (lpString="*.kwm") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.pwm") returned 0
	[0078.138] lstrlenA (lpString="*.pwm") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.1cd") returned 0
	[0078.138] lstrlenA (lpString="*.1cd") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.md") returned 0
	[0078.138] lstrlenA (lpString="*.md") returned 4
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mdf") returned 0
	[0078.138] lstrlenA (lpString="*.mdf") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.dbf") returned 0
	[0078.138] lstrlenA (lpString="*.dbf") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.odt") returned 0
	[0078.138] lstrlenA (lpString="*.odt") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.vob") returned 0
	[0078.138] lstrlenA (lpString="*.vob") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.ifo") returned 0
	[0078.138] lstrlenA (lpString="*.ifo") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.lnk") returned 0
	[0078.138] lstrlenA (lpString="*.lnk") returned 5
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.torrent") returned 0
	[0078.138] lstrlenA (lpString="*.torrent") returned 9
	[0078.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mov") returned 0
	[0078.138] lstrlenA (lpString="*.mov") returned 5
	[0078.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.m2v") returned 0
	[0078.139] lstrlenA (lpString="*.m2v") returned 5
	[0078.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.3gp") returned 0
	[0078.139] lstrlenA (lpString="*.3gp") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mpeg") returned 0
	[0078.140] lstrlenA (lpString="*.mpeg") returned 6
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mpg") returned 0
	[0078.140] lstrlenA (lpString="*.mpg") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.flv") returned 0
	[0078.140] lstrlenA (lpString="*.flv") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.avi") returned 0
	[0078.140] lstrlenA (lpString="*.avi") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mp4") returned 0
	[0078.140] lstrlenA (lpString="*.mp4") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.wmv") returned 0
	[0078.140] lstrlenA (lpString="*.wmv") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.divx") returned 0
	[0078.140] lstrlenA (lpString="*.divx") returned 6
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mkv") returned 0
	[0078.140] lstrlenA (lpString="*.mkv") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.mp3") returned 0
	[0078.140] lstrlenA (lpString="*.mp3") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.wav") returned 0
	[0078.140] lstrlenA (lpString="*.wav") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.flac") returned 0
	[0078.140] lstrlenA (lpString="*.flac") returned 6
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.ape") returned 0
	[0078.140] lstrlenA (lpString="*.ape") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.wma") returned 0
	[0078.140] lstrlenA (lpString="*.wma") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.ac3") returned 0
	[0078.140] lstrlenA (lpString="*.ac3") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.exe") returned 0
	[0078.140] lstrlenA (lpString="*.exe") returned 5
	[0078.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll", pszSpec="*.apk") returned 0
	[0078.140] lstrlenA (lpString="*.apk") returned 5
	[0078.140] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.140] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0078.140] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll") returned -1
	[0078.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll") returned -1
	[0078.140] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll") returned -1
	[0078.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll") returned="Microsoft.Synchronization.Data.Server.dll"
	[0078.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\"
	[0078.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned=""
	[0078.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\HOW TO DECRYPT FILES.txt"
	[0078.141] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\v1.0\\how to decrypt files.txt")) returned 0x20
	[0078.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll"
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.zip") returned 0
	[0078.141] lstrlenA (lpString="*.zip") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.rar") returned 0
	[0078.141] lstrlenA (lpString="*.rar") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.7z") returned 0
	[0078.141] lstrlenA (lpString="*.7z") returned 4
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.tar") returned 0
	[0078.141] lstrlenA (lpString="*.tar") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.gzip") returned 0
	[0078.141] lstrlenA (lpString="*.gzip") returned 6
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.jpg") returned 0
	[0078.141] lstrlenA (lpString="*.jpg") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.jpeg") returned 0
	[0078.141] lstrlenA (lpString="*.jpeg") returned 6
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.psd") returned 0
	[0078.141] lstrlenA (lpString="*.psd") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.cdr") returned 0
	[0078.141] lstrlenA (lpString="*.cdr") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.dwg") returned 0
	[0078.141] lstrlenA (lpString="*.dwg") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.max") returned 0
	[0078.141] lstrlenA (lpString="*.max") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.bmp") returned 0
	[0078.141] lstrlenA (lpString="*.bmp") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.gif") returned 0
	[0078.141] lstrlenA (lpString="*.gif") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.png") returned 0
	[0078.141] lstrlenA (lpString="*.png") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.doc") returned 0
	[0078.141] lstrlenA (lpString="*.doc") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.docx") returned 0
	[0078.141] lstrlenA (lpString="*.docx") returned 6
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.xls") returned 0
	[0078.141] lstrlenA (lpString="*.xls") returned 5
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.xlsx") returned 0
	[0078.141] lstrlenA (lpString="*.xlsx") returned 6
	[0078.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.ppt") returned 0
	[0078.142] lstrlenA (lpString="*.ppt") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.pptx") returned 0
	[0078.142] lstrlenA (lpString="*.pptx") returned 6
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.txt") returned 0
	[0078.142] lstrlenA (lpString="*.txt") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.pdf") returned 0
	[0078.142] lstrlenA (lpString="*.pdf") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.djvu") returned 0
	[0078.142] lstrlenA (lpString="*.djvu") returned 6
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.htm") returned 0
	[0078.142] lstrlenA (lpString="*.htm") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.html") returned 0
	[0078.142] lstrlenA (lpString="*.html") returned 6
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mdb") returned 0
	[0078.142] lstrlenA (lpString="*.mdb") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.cer") returned 0
	[0078.142] lstrlenA (lpString="*.cer") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.p12") returned 0
	[0078.142] lstrlenA (lpString="*.p12") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.pfx") returned 0
	[0078.142] lstrlenA (lpString="*.pfx") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.kwm") returned 0
	[0078.142] lstrlenA (lpString="*.kwm") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.pwm") returned 0
	[0078.142] lstrlenA (lpString="*.pwm") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.1cd") returned 0
	[0078.142] lstrlenA (lpString="*.1cd") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.md") returned 0
	[0078.142] lstrlenA (lpString="*.md") returned 4
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mdf") returned 0
	[0078.142] lstrlenA (lpString="*.mdf") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.dbf") returned 0
	[0078.142] lstrlenA (lpString="*.dbf") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.odt") returned 0
	[0078.142] lstrlenA (lpString="*.odt") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.vob") returned 0
	[0078.142] lstrlenA (lpString="*.vob") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.ifo") returned 0
	[0078.142] lstrlenA (lpString="*.ifo") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.lnk") returned 0
	[0078.142] lstrlenA (lpString="*.lnk") returned 5
	[0078.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.torrent") returned 0
	[0078.142] lstrlenA (lpString="*.torrent") returned 9
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mov") returned 0
	[0078.143] lstrlenA (lpString="*.mov") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.m2v") returned 0
	[0078.143] lstrlenA (lpString="*.m2v") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.3gp") returned 0
	[0078.143] lstrlenA (lpString="*.3gp") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mpeg") returned 0
	[0078.143] lstrlenA (lpString="*.mpeg") returned 6
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mpg") returned 0
	[0078.143] lstrlenA (lpString="*.mpg") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.flv") returned 0
	[0078.143] lstrlenA (lpString="*.flv") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.avi") returned 0
	[0078.143] lstrlenA (lpString="*.avi") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mp4") returned 0
	[0078.143] lstrlenA (lpString="*.mp4") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.wmv") returned 0
	[0078.143] lstrlenA (lpString="*.wmv") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.divx") returned 0
	[0078.143] lstrlenA (lpString="*.divx") returned 6
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mkv") returned 0
	[0078.143] lstrlenA (lpString="*.mkv") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.mp3") returned 0
	[0078.143] lstrlenA (lpString="*.mp3") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.wav") returned 0
	[0078.143] lstrlenA (lpString="*.wav") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.flac") returned 0
	[0078.143] lstrlenA (lpString="*.flac") returned 6
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.ape") returned 0
	[0078.143] lstrlenA (lpString="*.ape") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.wma") returned 0
	[0078.143] lstrlenA (lpString="*.wma") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.ac3") returned 0
	[0078.143] lstrlenA (lpString="*.ac3") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.exe") returned 0
	[0078.143] lstrlenA (lpString="*.exe") returned 5
	[0078.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll", pszSpec="*.apk") returned 0
	[0078.143] lstrlenA (lpString="*.apk") returned 5
	[0078.143] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.143] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.143] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.144] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.144] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.144] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="humanities_delivery_brand.exe") returned -1
	[0078.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="humanities_delivery_brand.exe") returned -1
	[0078.144] lstrcmpiA (lpString1="", lpString2="humanities_delivery_brand.exe") returned -1
	[0078.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\*.*") returned="*.*"
	[0078.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\"
	[0078.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\") returned=""
	[0078.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Synchronization Services\\HOW TO DECRYPT FILES.txt"
	[0078.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft synchronization services\\how to decrypt files.txt")) returned 0xffffffff
	[0078.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft synchronization services\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0078.146] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0078.146] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.147] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.147] CloseHandle (hObject=0x84) returned 1
	[0078.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\", lpString2="humanities_delivery_brand.exe" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe") returned="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe"
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.zip") returned 0
	[0078.147] lstrlenA (lpString="*.zip") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.rar") returned 0
	[0078.147] lstrlenA (lpString="*.rar") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.7z") returned 0
	[0078.147] lstrlenA (lpString="*.7z") returned 4
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.tar") returned 0
	[0078.147] lstrlenA (lpString="*.tar") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.gzip") returned 0
	[0078.147] lstrlenA (lpString="*.gzip") returned 6
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.jpg") returned 0
	[0078.147] lstrlenA (lpString="*.jpg") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.jpeg") returned 0
	[0078.147] lstrlenA (lpString="*.jpeg") returned 6
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.psd") returned 0
	[0078.147] lstrlenA (lpString="*.psd") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.cdr") returned 0
	[0078.147] lstrlenA (lpString="*.cdr") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.dwg") returned 0
	[0078.147] lstrlenA (lpString="*.dwg") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.max") returned 0
	[0078.147] lstrlenA (lpString="*.max") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.bmp") returned 0
	[0078.147] lstrlenA (lpString="*.bmp") returned 5
	[0078.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.gif") returned 0
	[0078.147] lstrlenA (lpString="*.gif") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.png") returned 0
	[0078.148] lstrlenA (lpString="*.png") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.doc") returned 0
	[0078.148] lstrlenA (lpString="*.doc") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.docx") returned 0
	[0078.148] lstrlenA (lpString="*.docx") returned 6
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.xls") returned 0
	[0078.148] lstrlenA (lpString="*.xls") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.xlsx") returned 0
	[0078.148] lstrlenA (lpString="*.xlsx") returned 6
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.ppt") returned 0
	[0078.148] lstrlenA (lpString="*.ppt") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.pptx") returned 0
	[0078.148] lstrlenA (lpString="*.pptx") returned 6
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.txt") returned 0
	[0078.148] lstrlenA (lpString="*.txt") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.pdf") returned 0
	[0078.148] lstrlenA (lpString="*.pdf") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.djvu") returned 0
	[0078.148] lstrlenA (lpString="*.djvu") returned 6
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.htm") returned 0
	[0078.148] lstrlenA (lpString="*.htm") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.html") returned 0
	[0078.148] lstrlenA (lpString="*.html") returned 6
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mdb") returned 0
	[0078.148] lstrlenA (lpString="*.mdb") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.cer") returned 0
	[0078.148] lstrlenA (lpString="*.cer") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.p12") returned 0
	[0078.148] lstrlenA (lpString="*.p12") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.pfx") returned 0
	[0078.148] lstrlenA (lpString="*.pfx") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.kwm") returned 0
	[0078.148] lstrlenA (lpString="*.kwm") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.pwm") returned 0
	[0078.148] lstrlenA (lpString="*.pwm") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.1cd") returned 0
	[0078.148] lstrlenA (lpString="*.1cd") returned 5
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.md") returned 0
	[0078.148] lstrlenA (lpString="*.md") returned 4
	[0078.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mdf") returned 0
	[0078.149] lstrlenA (lpString="*.mdf") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.dbf") returned 0
	[0078.149] lstrlenA (lpString="*.dbf") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.odt") returned 0
	[0078.149] lstrlenA (lpString="*.odt") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.vob") returned 0
	[0078.149] lstrlenA (lpString="*.vob") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.ifo") returned 0
	[0078.149] lstrlenA (lpString="*.ifo") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.lnk") returned 0
	[0078.149] lstrlenA (lpString="*.lnk") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.torrent") returned 0
	[0078.149] lstrlenA (lpString="*.torrent") returned 9
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mov") returned 0
	[0078.149] lstrlenA (lpString="*.mov") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.m2v") returned 0
	[0078.149] lstrlenA (lpString="*.m2v") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.3gp") returned 0
	[0078.149] lstrlenA (lpString="*.3gp") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mpeg") returned 0
	[0078.149] lstrlenA (lpString="*.mpeg") returned 6
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mpg") returned 0
	[0078.149] lstrlenA (lpString="*.mpg") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.flv") returned 0
	[0078.149] lstrlenA (lpString="*.flv") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.avi") returned 0
	[0078.149] lstrlenA (lpString="*.avi") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mp4") returned 0
	[0078.149] lstrlenA (lpString="*.mp4") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.wmv") returned 0
	[0078.149] lstrlenA (lpString="*.wmv") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.divx") returned 0
	[0078.149] lstrlenA (lpString="*.divx") returned 6
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mkv") returned 0
	[0078.149] lstrlenA (lpString="*.mkv") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.mp3") returned 0
	[0078.149] lstrlenA (lpString="*.mp3") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.wav") returned 0
	[0078.149] lstrlenA (lpString="*.wav") returned 5
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.flac") returned 0
	[0078.149] lstrlenA (lpString="*.flac") returned 6
	[0078.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.ape") returned 0
	[0078.149] lstrlenA (lpString="*.ape") returned 5
	[0078.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.wma") returned 0
	[0078.150] lstrlenA (lpString="*.wma") returned 5
	[0078.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.ac3") returned 0
	[0078.150] lstrlenA (lpString="*.ac3") returned 5
	[0078.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", pszSpec="*.exe") returned 1
	[0078.150] lstrlenA (lpString="*.exe") returned 5
	[0078.150] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe") returned="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe"
	[0078.150] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe") returned="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe"
	[0078.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe.") returned="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe."
	[0078.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe.Boom") returned="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe.Boom"
	[0078.150] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\humanities_delivery_brand.exe" (normalized: "c:\\program files\\microsoft synchronization services\\humanities_delivery_brand.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.150] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.150] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.150] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.150] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1
	[0078.150] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1
	[0078.150] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.150] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="MSBuild" | out: lpString1="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild"
	[0078.150] lstrlenA (lpString="C:\\Program Files\\MSBuild") returned 24
	[0078.150] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.150] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.150] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.150] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.150] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.150] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.150] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.150] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="barn terms.exe") returned 1
	[0078.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="barn terms.exe") returned 1
	[0078.151] lstrcmpiA (lpString1="", lpString2="barn terms.exe") returned -1
	[0078.151] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\*.*") returned="*.*"
	[0078.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\" | out: lpString1="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\"
	[0078.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\" | out: pszPath="C:\\Program Files\\MSBuild\\") returned=""
	[0078.151] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\MSBuild\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\MSBuild\\HOW TO DECRYPT FILES.txt"
	[0078.151] GetFileAttributesA (lpFileName="C:\\Program Files\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\how to decrypt files.txt")) returned 0xffffffff
	[0078.151] CreateFileA (lpFileName="C:\\Program Files\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0078.151] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0078.151] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.152] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.152] CloseHandle (hObject=0x84) returned 1
	[0078.152] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\", lpString2="barn terms.exe" | out: lpString1="C:\\Program Files\\MSBuild\\barn terms.exe") returned="C:\\Program Files\\MSBuild\\barn terms.exe"
	[0078.152] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.zip") returned 0
	[0078.152] lstrlenA (lpString="*.zip") returned 5
	[0078.152] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.rar") returned 0
	[0078.152] lstrlenA (lpString="*.rar") returned 5
	[0078.152] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.7z") returned 0
	[0078.152] lstrlenA (lpString="*.7z") returned 4
	[0078.152] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.tar") returned 0
	[0078.152] lstrlenA (lpString="*.tar") returned 5
	[0078.152] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.gzip") returned 0
	[0078.152] lstrlenA (lpString="*.gzip") returned 6
	[0078.152] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.jpg") returned 0
	[0078.152] lstrlenA (lpString="*.jpg") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.jpeg") returned 0
	[0078.153] lstrlenA (lpString="*.jpeg") returned 6
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.psd") returned 0
	[0078.153] lstrlenA (lpString="*.psd") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.cdr") returned 0
	[0078.153] lstrlenA (lpString="*.cdr") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.dwg") returned 0
	[0078.153] lstrlenA (lpString="*.dwg") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.max") returned 0
	[0078.153] lstrlenA (lpString="*.max") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.bmp") returned 0
	[0078.153] lstrlenA (lpString="*.bmp") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.gif") returned 0
	[0078.153] lstrlenA (lpString="*.gif") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.png") returned 0
	[0078.153] lstrlenA (lpString="*.png") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.doc") returned 0
	[0078.153] lstrlenA (lpString="*.doc") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.docx") returned 0
	[0078.153] lstrlenA (lpString="*.docx") returned 6
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.xls") returned 0
	[0078.153] lstrlenA (lpString="*.xls") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.xlsx") returned 0
	[0078.153] lstrlenA (lpString="*.xlsx") returned 6
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.ppt") returned 0
	[0078.153] lstrlenA (lpString="*.ppt") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.pptx") returned 0
	[0078.153] lstrlenA (lpString="*.pptx") returned 6
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.txt") returned 0
	[0078.153] lstrlenA (lpString="*.txt") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.pdf") returned 0
	[0078.153] lstrlenA (lpString="*.pdf") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.djvu") returned 0
	[0078.153] lstrlenA (lpString="*.djvu") returned 6
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.htm") returned 0
	[0078.153] lstrlenA (lpString="*.htm") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.html") returned 0
	[0078.153] lstrlenA (lpString="*.html") returned 6
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mdb") returned 0
	[0078.153] lstrlenA (lpString="*.mdb") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.cer") returned 0
	[0078.153] lstrlenA (lpString="*.cer") returned 5
	[0078.153] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.p12") returned 0
	[0078.153] lstrlenA (lpString="*.p12") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.pfx") returned 0
	[0078.154] lstrlenA (lpString="*.pfx") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.kwm") returned 0
	[0078.154] lstrlenA (lpString="*.kwm") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.pwm") returned 0
	[0078.154] lstrlenA (lpString="*.pwm") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.1cd") returned 0
	[0078.154] lstrlenA (lpString="*.1cd") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.md") returned 0
	[0078.154] lstrlenA (lpString="*.md") returned 4
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mdf") returned 0
	[0078.154] lstrlenA (lpString="*.mdf") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.dbf") returned 0
	[0078.154] lstrlenA (lpString="*.dbf") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.odt") returned 0
	[0078.154] lstrlenA (lpString="*.odt") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.vob") returned 0
	[0078.154] lstrlenA (lpString="*.vob") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.ifo") returned 0
	[0078.154] lstrlenA (lpString="*.ifo") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.lnk") returned 0
	[0078.154] lstrlenA (lpString="*.lnk") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.torrent") returned 0
	[0078.154] lstrlenA (lpString="*.torrent") returned 9
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mov") returned 0
	[0078.154] lstrlenA (lpString="*.mov") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.m2v") returned 0
	[0078.154] lstrlenA (lpString="*.m2v") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.3gp") returned 0
	[0078.154] lstrlenA (lpString="*.3gp") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mpeg") returned 0
	[0078.154] lstrlenA (lpString="*.mpeg") returned 6
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mpg") returned 0
	[0078.154] lstrlenA (lpString="*.mpg") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.flv") returned 0
	[0078.154] lstrlenA (lpString="*.flv") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.avi") returned 0
	[0078.154] lstrlenA (lpString="*.avi") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mp4") returned 0
	[0078.154] lstrlenA (lpString="*.mp4") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.wmv") returned 0
	[0078.154] lstrlenA (lpString="*.wmv") returned 5
	[0078.154] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.divx") returned 0
	[0078.154] lstrlenA (lpString="*.divx") returned 6
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mkv") returned 0
	[0078.155] lstrlenA (lpString="*.mkv") returned 5
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.mp3") returned 0
	[0078.155] lstrlenA (lpString="*.mp3") returned 5
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.wav") returned 0
	[0078.155] lstrlenA (lpString="*.wav") returned 5
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.flac") returned 0
	[0078.155] lstrlenA (lpString="*.flac") returned 6
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.ape") returned 0
	[0078.155] lstrlenA (lpString="*.ape") returned 5
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.wma") returned 0
	[0078.155] lstrlenA (lpString="*.wma") returned 5
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.ac3") returned 0
	[0078.155] lstrlenA (lpString="*.ac3") returned 5
	[0078.155] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\barn terms.exe", pszSpec="*.exe") returned 1
	[0078.155] lstrlenA (lpString="*.exe") returned 5
	[0078.155] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\MSBuild\\barn terms.exe" | out: lpString1="C:\\Program Files\\MSBuild\\barn terms.exe") returned="C:\\Program Files\\MSBuild\\barn terms.exe"
	[0078.155] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\MSBuild\\barn terms.exe" | out: lpString1="C:\\Program Files\\MSBuild\\barn terms.exe") returned="C:\\Program Files\\MSBuild\\barn terms.exe"
	[0078.155] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\barn terms.exe", lpString2="." | out: lpString1="C:\\Program Files\\MSBuild\\barn terms.exe.") returned="C:\\Program Files\\MSBuild\\barn terms.exe."
	[0078.155] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\barn terms.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\MSBuild\\barn terms.exe.Boom") returned="C:\\Program Files\\MSBuild\\barn terms.exe.Boom"
	[0078.155] CreateFileA (lpFileName="C:\\Program Files\\MSBuild\\barn terms.exe" (normalized: "c:\\program files\\msbuild\\barn terms.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.155] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.155] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1
	[0078.155] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1
	[0078.155] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\barn terms.exe") returned="barn terms.exe"
	[0078.155] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\", lpString2="Microsoft" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft"
	[0078.155] lstrlenA (lpString="C:\\Program Files\\MSBuild\\Microsoft") returned 34
	[0078.155] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.157] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.157] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.158] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.158] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.158] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.158] lstrcmpA (lpString1=".", lpString2="Windows Workflow Foundation") returned -1
	[0078.158] lstrcmpA (lpString1="..", lpString2="Windows Workflow Foundation") returned -1
	[0078.158] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\*.*") returned="*.*"
	[0078.158] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\", lpString2="Windows Workflow Foundation" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation"
	[0078.158] lstrlenA (lpString="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned 62
	[0078.158] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.158] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.158] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.158] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.158] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.158] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.158] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1
	[0078.158] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1
	[0078.158] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*") returned="*.*"
	[0078.158] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", lpString2="v3.0" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0"
	[0078.158] lstrlenA (lpString="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned 67
	[0078.158] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.158] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.158] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.158] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.158] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.158] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.158] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.158] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.Targets") returned -1
	[0078.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.Targets") returned -1
	[0078.158] lstrcmpiA (lpString1="", lpString2="Workflow.Targets") returned -1
	[0078.158] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*") returned="*.*"
	[0078.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\"
	[0078.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned=""
	[0078.159] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.159] GetFileAttributesA (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\how to decrypt files.txt")) returned 0xffffffff
	[0078.159] CreateFileA (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0078.160] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0078.160] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.161] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.161] CloseHandle (hObject=0x90) returned 1
	[0078.161] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpString2="Workflow.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets"
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.zip") returned 0
	[0078.161] lstrlenA (lpString="*.zip") returned 5
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.rar") returned 0
	[0078.161] lstrlenA (lpString="*.rar") returned 5
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.7z") returned 0
	[0078.161] lstrlenA (lpString="*.7z") returned 4
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.tar") returned 0
	[0078.161] lstrlenA (lpString="*.tar") returned 5
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.gzip") returned 0
	[0078.161] lstrlenA (lpString="*.gzip") returned 6
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.jpg") returned 0
	[0078.161] lstrlenA (lpString="*.jpg") returned 5
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.jpeg") returned 0
	[0078.161] lstrlenA (lpString="*.jpeg") returned 6
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.psd") returned 0
	[0078.161] lstrlenA (lpString="*.psd") returned 5
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.cdr") returned 0
	[0078.161] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.dwg") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.max") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.bmp") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.gif") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.png") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.doc") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.docx") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.xls") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.xlsx") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.ppt") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.pptx") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.txt") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.pdf") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.djvu") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.htm") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.html") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mdb") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.cer") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.p12") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.pfx") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.kwm") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.pwm") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.1cd") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.md") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mdf") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.dbf") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.odt") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.vob") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.ifo") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.lnk") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.torrent") returned 0
	[0078.162] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mov") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.m2v") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.3gp") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mpeg") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mpg") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.flv") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.avi") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mp4") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.wmv") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.divx") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mkv") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.mp3") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.wav") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.flac") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.ape") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.wma") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.ac3") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.exe") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", pszSpec="*.apk") returned 0
	[0078.163] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.163] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.163] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.VisualBasic.Targets") returned -1
	[0078.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.VisualBasic.Targets") returned -1
	[0078.163] lstrcmpiA (lpString1="", lpString2="Workflow.VisualBasic.Targets") returned -1
	[0078.163] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="Workflow.Targets"
	[0078.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\"
	[0078.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned=""
	[0078.163] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.163] GetFileAttributesA (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.163] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpString2="Workflow.VisualBasic.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets"
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.zip") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.rar") returned 0
	[0078.163] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.7z") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.tar") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.gzip") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.jpg") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.jpeg") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.psd") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.cdr") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.dwg") returned 0
	[0078.164] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.max") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.bmp") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.gif") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.png") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.doc") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.docx") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.xls") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.xlsx") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.ppt") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.pptx") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.txt") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.pdf") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.djvu") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.htm") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.html") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mdb") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.cer") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.p12") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.pfx") returned 0
	[0078.165] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.kwm") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.pwm") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.1cd") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.md") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mdf") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.dbf") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.odt") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.vob") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.ifo") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.lnk") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.torrent") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mov") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.m2v") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.3gp") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mpeg") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mpg") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.flv") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.avi") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mp4") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.wmv") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.divx") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mkv") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.mp3") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.wav") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.flac") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.ape") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.wma") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.ac3") returned 0
	[0078.166] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.exe") returned 0
	[0078.167] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", pszSpec="*.apk") returned 0
	[0078.167] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0078.167] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0078.167] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.167] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1
	[0078.167] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1
	[0078.167] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*") returned="*.*"
	[0078.167] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", lpString2="v3.5" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5"
	[0078.167] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.167] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.167] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.167] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.167] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.167] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.167] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.Targets") returned -1
	[0078.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.Targets") returned -1
	[0078.167] lstrcmpiA (lpString1="", lpString2="Workflow.Targets") returned -1
	[0078.167] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*") returned="*.*"
	[0078.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\"
	[0078.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned=""
	[0078.167] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.168] GetFileAttributesA (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\how to decrypt files.txt")) returned 0xffffffff
	[0078.168] CreateFileA (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0078.169] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.170] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.170] CloseHandle (hObject=0x90) returned 1
	[0078.170] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpString2="Workflow.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets"
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.zip") returned 0
	[0078.170] lstrlenA (lpString="*.zip") returned 5
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.rar") returned 0
	[0078.170] lstrlenA (lpString="*.rar") returned 5
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.7z") returned 0
	[0078.170] lstrlenA (lpString="*.7z") returned 4
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.tar") returned 0
	[0078.170] lstrlenA (lpString="*.tar") returned 5
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.gzip") returned 0
	[0078.170] lstrlenA (lpString="*.gzip") returned 6
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.jpg") returned 0
	[0078.170] lstrlenA (lpString="*.jpg") returned 5
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.jpeg") returned 0
	[0078.170] lstrlenA (lpString="*.jpeg") returned 6
	[0078.170] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.psd") returned 0
	[0078.170] lstrlenA (lpString="*.psd") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.cdr") returned 0
	[0078.171] lstrlenA (lpString="*.cdr") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.dwg") returned 0
	[0078.171] lstrlenA (lpString="*.dwg") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.max") returned 0
	[0078.171] lstrlenA (lpString="*.max") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.bmp") returned 0
	[0078.171] lstrlenA (lpString="*.bmp") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.gif") returned 0
	[0078.171] lstrlenA (lpString="*.gif") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.png") returned 0
	[0078.171] lstrlenA (lpString="*.png") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.doc") returned 0
	[0078.171] lstrlenA (lpString="*.doc") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.docx") returned 0
	[0078.171] lstrlenA (lpString="*.docx") returned 6
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.xls") returned 0
	[0078.171] lstrlenA (lpString="*.xls") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.xlsx") returned 0
	[0078.171] lstrlenA (lpString="*.xlsx") returned 6
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.ppt") returned 0
	[0078.171] lstrlenA (lpString="*.ppt") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.pptx") returned 0
	[0078.171] lstrlenA (lpString="*.pptx") returned 6
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.txt") returned 0
	[0078.171] lstrlenA (lpString="*.txt") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.pdf") returned 0
	[0078.171] lstrlenA (lpString="*.pdf") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.djvu") returned 0
	[0078.171] lstrlenA (lpString="*.djvu") returned 6
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.htm") returned 0
	[0078.171] lstrlenA (lpString="*.htm") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.html") returned 0
	[0078.171] lstrlenA (lpString="*.html") returned 6
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mdb") returned 0
	[0078.171] lstrlenA (lpString="*.mdb") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.cer") returned 0
	[0078.171] lstrlenA (lpString="*.cer") returned 5
	[0078.171] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.p12") returned 0
	[0078.171] lstrlenA (lpString="*.p12") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.pfx") returned 0
	[0078.172] lstrlenA (lpString="*.pfx") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.kwm") returned 0
	[0078.172] lstrlenA (lpString="*.kwm") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.pwm") returned 0
	[0078.172] lstrlenA (lpString="*.pwm") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.1cd") returned 0
	[0078.172] lstrlenA (lpString="*.1cd") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.md") returned 0
	[0078.172] lstrlenA (lpString="*.md") returned 4
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mdf") returned 0
	[0078.172] lstrlenA (lpString="*.mdf") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.dbf") returned 0
	[0078.172] lstrlenA (lpString="*.dbf") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.odt") returned 0
	[0078.172] lstrlenA (lpString="*.odt") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.vob") returned 0
	[0078.172] lstrlenA (lpString="*.vob") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.ifo") returned 0
	[0078.172] lstrlenA (lpString="*.ifo") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.lnk") returned 0
	[0078.172] lstrlenA (lpString="*.lnk") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.torrent") returned 0
	[0078.172] lstrlenA (lpString="*.torrent") returned 9
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mov") returned 0
	[0078.172] lstrlenA (lpString="*.mov") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.m2v") returned 0
	[0078.172] lstrlenA (lpString="*.m2v") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.3gp") returned 0
	[0078.172] lstrlenA (lpString="*.3gp") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mpeg") returned 0
	[0078.172] lstrlenA (lpString="*.mpeg") returned 6
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mpg") returned 0
	[0078.172] lstrlenA (lpString="*.mpg") returned 5
	[0078.172] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.flv") returned 0
	[0078.173] lstrlenA (lpString="*.flv") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.avi") returned 0
	[0078.174] lstrlenA (lpString="*.avi") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mp4") returned 0
	[0078.174] lstrlenA (lpString="*.mp4") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.wmv") returned 0
	[0078.174] lstrlenA (lpString="*.wmv") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.divx") returned 0
	[0078.174] lstrlenA (lpString="*.divx") returned 6
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mkv") returned 0
	[0078.174] lstrlenA (lpString="*.mkv") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.mp3") returned 0
	[0078.174] lstrlenA (lpString="*.mp3") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.wav") returned 0
	[0078.174] lstrlenA (lpString="*.wav") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.flac") returned 0
	[0078.174] lstrlenA (lpString="*.flac") returned 6
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.ape") returned 0
	[0078.174] lstrlenA (lpString="*.ape") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.wma") returned 0
	[0078.174] lstrlenA (lpString="*.wma") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.ac3") returned 0
	[0078.174] lstrlenA (lpString="*.ac3") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.exe") returned 0
	[0078.174] lstrlenA (lpString="*.exe") returned 5
	[0078.174] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", pszSpec="*.apk") returned 0
	[0078.174] lstrlenA (lpString="*.apk") returned 5
	[0078.174] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.174] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.174] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.VisualBasic.Targets") returned -1
	[0078.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.VisualBasic.Targets") returned -1
	[0078.174] lstrcmpiA (lpString1="", lpString2="Workflow.VisualBasic.Targets") returned -1
	[0078.174] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="Workflow.Targets"
	[0078.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\"
	[0078.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned=""
	[0078.174] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.174] GetFileAttributesA (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.175] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpString2="Workflow.VisualBasic.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets"
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.zip") returned 0
	[0078.175] lstrlenA (lpString="*.zip") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.rar") returned 0
	[0078.175] lstrlenA (lpString="*.rar") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.7z") returned 0
	[0078.175] lstrlenA (lpString="*.7z") returned 4
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.tar") returned 0
	[0078.175] lstrlenA (lpString="*.tar") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.gzip") returned 0
	[0078.175] lstrlenA (lpString="*.gzip") returned 6
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.jpg") returned 0
	[0078.175] lstrlenA (lpString="*.jpg") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.jpeg") returned 0
	[0078.175] lstrlenA (lpString="*.jpeg") returned 6
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.psd") returned 0
	[0078.175] lstrlenA (lpString="*.psd") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.cdr") returned 0
	[0078.175] lstrlenA (lpString="*.cdr") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.dwg") returned 0
	[0078.175] lstrlenA (lpString="*.dwg") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.max") returned 0
	[0078.175] lstrlenA (lpString="*.max") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.bmp") returned 0
	[0078.175] lstrlenA (lpString="*.bmp") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.gif") returned 0
	[0078.175] lstrlenA (lpString="*.gif") returned 5
	[0078.175] PathMatchSpecA (pszFile="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", pszSpec="*.png") returned 0
	[0078.175] lstrlenA (lpString="*.png") returned 5
	[0078.176] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0078.176] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0078.176] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.176] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.176] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.176] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.176] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.176] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.176] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.176] lstrcmpA (lpString1=".", lpString2="Reference Assemblies") returned -1
	[0078.176] lstrcmpA (lpString1="..", lpString2="Reference Assemblies") returned -1
	[0078.176] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.176] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Reference Assemblies" | out: lpString1="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies"
	[0078.176] lstrlenA (lpString="C:\\Program Files\\Reference Assemblies") returned 37
	[0078.176] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.177] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.177] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.177] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.177] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1
	[0078.177] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1
	[0078.177] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\*.*") returned="*.*"
	[0078.177] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\", lpString2="Microsoft" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft"
	[0078.177] lstrlenA (lpString="C:\\Program Files\\Reference Assemblies\\Microsoft") returned 47
	[0078.178] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.178] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.178] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.178] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.178] lstrcmpA (lpString1=".", lpString2="Framework") returned -1
	[0078.178] lstrcmpA (lpString1="..", lpString2="Framework") returned -1
	[0078.178] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\*.*") returned="*.*"
	[0078.178] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\", lpString2="Framework" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework"
	[0078.179] lstrlenA (lpString="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned 57
	[0078.179] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.179] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.179] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.179] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.179] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1
	[0078.179] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1
	[0078.179] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*") returned="*.*"
	[0078.179] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", lpString2="v3.0" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0"
	[0078.179] lstrlenA (lpString="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned 62
	[0078.179] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.197] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.197] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.197] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.197] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.197] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationBuildTasks.dll") returned -1
	[0078.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationBuildTasks.dll") returned -1
	[0078.197] lstrcmpiA (lpString1="", lpString2="PresentationBuildTasks.dll") returned -1
	[0078.197] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*") returned="*.*"
	[0078.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.197] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0xffffffff
	[0078.197] CreateFileA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0078.198] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0078.198] WriteFile (in: hFile=0x90, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.198] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.198] CloseHandle (hObject=0x90) returned 1
	[0078.199] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationBuildTasks.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll"
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.zip") returned 0
	[0078.199] lstrlenA (lpString="*.zip") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.rar") returned 0
	[0078.199] lstrlenA (lpString="*.rar") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.7z") returned 0
	[0078.199] lstrlenA (lpString="*.7z") returned 4
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.tar") returned 0
	[0078.199] lstrlenA (lpString="*.tar") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.gzip") returned 0
	[0078.199] lstrlenA (lpString="*.gzip") returned 6
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.jpg") returned 0
	[0078.199] lstrlenA (lpString="*.jpg") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.jpeg") returned 0
	[0078.199] lstrlenA (lpString="*.jpeg") returned 6
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.psd") returned 0
	[0078.199] lstrlenA (lpString="*.psd") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.cdr") returned 0
	[0078.199] lstrlenA (lpString="*.cdr") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.dwg") returned 0
	[0078.199] lstrlenA (lpString="*.dwg") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.max") returned 0
	[0078.199] lstrlenA (lpString="*.max") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.bmp") returned 0
	[0078.199] lstrlenA (lpString="*.bmp") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.gif") returned 0
	[0078.199] lstrlenA (lpString="*.gif") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.png") returned 0
	[0078.199] lstrlenA (lpString="*.png") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.doc") returned 0
	[0078.199] lstrlenA (lpString="*.doc") returned 5
	[0078.199] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.docx") returned 0
	[0078.200] lstrlenA (lpString="*.docx") returned 6
	[0078.200] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.xls") returned 0
	[0078.200] lstrlenA (lpString="*.xls") returned 5
	[0078.200] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.xlsx") returned 0
	[0078.200] lstrlenA (lpString="*.xlsx") returned 6
	[0078.200] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.ppt") returned 0
	[0078.201] lstrlenA (lpString="*.ppt") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.pptx") returned 0
	[0078.201] lstrlenA (lpString="*.pptx") returned 6
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.txt") returned 0
	[0078.201] lstrlenA (lpString="*.txt") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.pdf") returned 0
	[0078.201] lstrlenA (lpString="*.pdf") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.djvu") returned 0
	[0078.201] lstrlenA (lpString="*.djvu") returned 6
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.htm") returned 0
	[0078.201] lstrlenA (lpString="*.htm") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.html") returned 0
	[0078.201] lstrlenA (lpString="*.html") returned 6
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mdb") returned 0
	[0078.201] lstrlenA (lpString="*.mdb") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.cer") returned 0
	[0078.201] lstrlenA (lpString="*.cer") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.p12") returned 0
	[0078.201] lstrlenA (lpString="*.p12") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.pfx") returned 0
	[0078.201] lstrlenA (lpString="*.pfx") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.kwm") returned 0
	[0078.201] lstrlenA (lpString="*.kwm") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.pwm") returned 0
	[0078.201] lstrlenA (lpString="*.pwm") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.1cd") returned 0
	[0078.201] lstrlenA (lpString="*.1cd") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.md") returned 0
	[0078.201] lstrlenA (lpString="*.md") returned 4
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mdf") returned 0
	[0078.201] lstrlenA (lpString="*.mdf") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.dbf") returned 0
	[0078.201] lstrlenA (lpString="*.dbf") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.odt") returned 0
	[0078.201] lstrlenA (lpString="*.odt") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.vob") returned 0
	[0078.201] lstrlenA (lpString="*.vob") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.ifo") returned 0
	[0078.201] lstrlenA (lpString="*.ifo") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.lnk") returned 0
	[0078.201] lstrlenA (lpString="*.lnk") returned 5
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.torrent") returned 0
	[0078.201] lstrlenA (lpString="*.torrent") returned 9
	[0078.201] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mov") returned 0
	[0078.202] lstrlenA (lpString="*.mov") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.m2v") returned 0
	[0078.202] lstrlenA (lpString="*.m2v") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.3gp") returned 0
	[0078.202] lstrlenA (lpString="*.3gp") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mpeg") returned 0
	[0078.202] lstrlenA (lpString="*.mpeg") returned 6
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mpg") returned 0
	[0078.202] lstrlenA (lpString="*.mpg") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.flv") returned 0
	[0078.202] lstrlenA (lpString="*.flv") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.avi") returned 0
	[0078.202] lstrlenA (lpString="*.avi") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mp4") returned 0
	[0078.202] lstrlenA (lpString="*.mp4") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.wmv") returned 0
	[0078.202] lstrlenA (lpString="*.wmv") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.divx") returned 0
	[0078.202] lstrlenA (lpString="*.divx") returned 6
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mkv") returned 0
	[0078.202] lstrlenA (lpString="*.mkv") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.mp3") returned 0
	[0078.202] lstrlenA (lpString="*.mp3") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.wav") returned 0
	[0078.202] lstrlenA (lpString="*.wav") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.flac") returned 0
	[0078.202] lstrlenA (lpString="*.flac") returned 6
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.ape") returned 0
	[0078.202] lstrlenA (lpString="*.ape") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.wma") returned 0
	[0078.202] lstrlenA (lpString="*.wma") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.ac3") returned 0
	[0078.202] lstrlenA (lpString="*.ac3") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.exe") returned 0
	[0078.202] lstrlenA (lpString="*.exe") returned 5
	[0078.202] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll", pszSpec="*.apk") returned 0
	[0078.202] lstrlenA (lpString="*.apk") returned 5
	[0078.202] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.202] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationCore.dll") returned -1
	[0078.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCore.dll") returned -1
	[0078.202] lstrcmpiA (lpString1="", lpString2="PresentationCore.dll") returned -1
	[0078.203] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll") returned="PresentationBuildTasks.dll"
	[0078.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.203] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.203] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationCore.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll"
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.zip") returned 0
	[0078.204] lstrlenA (lpString="*.zip") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.rar") returned 0
	[0078.204] lstrlenA (lpString="*.rar") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.7z") returned 0
	[0078.204] lstrlenA (lpString="*.7z") returned 4
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.tar") returned 0
	[0078.204] lstrlenA (lpString="*.tar") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.gzip") returned 0
	[0078.204] lstrlenA (lpString="*.gzip") returned 6
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.jpg") returned 0
	[0078.204] lstrlenA (lpString="*.jpg") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.jpeg") returned 0
	[0078.204] lstrlenA (lpString="*.jpeg") returned 6
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.psd") returned 0
	[0078.204] lstrlenA (lpString="*.psd") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.cdr") returned 0
	[0078.204] lstrlenA (lpString="*.cdr") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.dwg") returned 0
	[0078.204] lstrlenA (lpString="*.dwg") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.max") returned 0
	[0078.204] lstrlenA (lpString="*.max") returned 5
	[0078.204] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.bmp") returned 0
	[0078.204] lstrlenA (lpString="*.bmp") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.gif") returned 0
	[0078.205] lstrlenA (lpString="*.gif") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.png") returned 0
	[0078.205] lstrlenA (lpString="*.png") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.doc") returned 0
	[0078.205] lstrlenA (lpString="*.doc") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.docx") returned 0
	[0078.205] lstrlenA (lpString="*.docx") returned 6
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.xls") returned 0
	[0078.205] lstrlenA (lpString="*.xls") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.xlsx") returned 0
	[0078.205] lstrlenA (lpString="*.xlsx") returned 6
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.ppt") returned 0
	[0078.205] lstrlenA (lpString="*.ppt") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.pptx") returned 0
	[0078.205] lstrlenA (lpString="*.pptx") returned 6
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.txt") returned 0
	[0078.205] lstrlenA (lpString="*.txt") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.pdf") returned 0
	[0078.205] lstrlenA (lpString="*.pdf") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.djvu") returned 0
	[0078.205] lstrlenA (lpString="*.djvu") returned 6
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.htm") returned 0
	[0078.205] lstrlenA (lpString="*.htm") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.html") returned 0
	[0078.205] lstrlenA (lpString="*.html") returned 6
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mdb") returned 0
	[0078.205] lstrlenA (lpString="*.mdb") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.cer") returned 0
	[0078.205] lstrlenA (lpString="*.cer") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.p12") returned 0
	[0078.205] lstrlenA (lpString="*.p12") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.pfx") returned 0
	[0078.205] lstrlenA (lpString="*.pfx") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.kwm") returned 0
	[0078.205] lstrlenA (lpString="*.kwm") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.pwm") returned 0
	[0078.205] lstrlenA (lpString="*.pwm") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.1cd") returned 0
	[0078.205] lstrlenA (lpString="*.1cd") returned 5
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.md") returned 0
	[0078.205] lstrlenA (lpString="*.md") returned 4
	[0078.205] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mdf") returned 0
	[0078.205] lstrlenA (lpString="*.mdf") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.dbf") returned 0
	[0078.206] lstrlenA (lpString="*.dbf") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.odt") returned 0
	[0078.206] lstrlenA (lpString="*.odt") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.vob") returned 0
	[0078.206] lstrlenA (lpString="*.vob") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.ifo") returned 0
	[0078.206] lstrlenA (lpString="*.ifo") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.lnk") returned 0
	[0078.206] lstrlenA (lpString="*.lnk") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.torrent") returned 0
	[0078.206] lstrlenA (lpString="*.torrent") returned 9
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mov") returned 0
	[0078.206] lstrlenA (lpString="*.mov") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.m2v") returned 0
	[0078.206] lstrlenA (lpString="*.m2v") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.3gp") returned 0
	[0078.206] lstrlenA (lpString="*.3gp") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mpeg") returned 0
	[0078.206] lstrlenA (lpString="*.mpeg") returned 6
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mpg") returned 0
	[0078.206] lstrlenA (lpString="*.mpg") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.flv") returned 0
	[0078.206] lstrlenA (lpString="*.flv") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.avi") returned 0
	[0078.206] lstrlenA (lpString="*.avi") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mp4") returned 0
	[0078.206] lstrlenA (lpString="*.mp4") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.wmv") returned 0
	[0078.206] lstrlenA (lpString="*.wmv") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.divx") returned 0
	[0078.206] lstrlenA (lpString="*.divx") returned 6
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mkv") returned 0
	[0078.206] lstrlenA (lpString="*.mkv") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.mp3") returned 0
	[0078.206] lstrlenA (lpString="*.mp3") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.wav") returned 0
	[0078.206] lstrlenA (lpString="*.wav") returned 5
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.flac") returned 0
	[0078.206] lstrlenA (lpString="*.flac") returned 6
	[0078.206] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.ape") returned 0
	[0078.207] lstrlenA (lpString="*.ape") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.wma") returned 0
	[0078.207] lstrlenA (lpString="*.wma") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.ac3") returned 0
	[0078.207] lstrlenA (lpString="*.ac3") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.exe") returned 0
	[0078.207] lstrlenA (lpString="*.exe") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll", pszSpec="*.apk") returned 0
	[0078.207] lstrlenA (lpString="*.apk") returned 5
	[0078.207] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.207] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.207] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Aero.dll") returned -1
	[0078.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Aero.dll") returned -1
	[0078.207] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Aero.dll") returned -1
	[0078.207] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll") returned="PresentationCore.dll"
	[0078.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.207] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.207] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Aero.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll"
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.zip") returned 0
	[0078.207] lstrlenA (lpString="*.zip") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.rar") returned 0
	[0078.207] lstrlenA (lpString="*.rar") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.7z") returned 0
	[0078.207] lstrlenA (lpString="*.7z") returned 4
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.tar") returned 0
	[0078.207] lstrlenA (lpString="*.tar") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.gzip") returned 0
	[0078.207] lstrlenA (lpString="*.gzip") returned 6
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.jpg") returned 0
	[0078.207] lstrlenA (lpString="*.jpg") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.jpeg") returned 0
	[0078.207] lstrlenA (lpString="*.jpeg") returned 6
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.psd") returned 0
	[0078.207] lstrlenA (lpString="*.psd") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.cdr") returned 0
	[0078.207] lstrlenA (lpString="*.cdr") returned 5
	[0078.207] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.dwg") returned 0
	[0078.208] lstrlenA (lpString="*.dwg") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.max") returned 0
	[0078.208] lstrlenA (lpString="*.max") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.bmp") returned 0
	[0078.208] lstrlenA (lpString="*.bmp") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.gif") returned 0
	[0078.208] lstrlenA (lpString="*.gif") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.png") returned 0
	[0078.208] lstrlenA (lpString="*.png") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.doc") returned 0
	[0078.208] lstrlenA (lpString="*.doc") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.docx") returned 0
	[0078.208] lstrlenA (lpString="*.docx") returned 6
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.xls") returned 0
	[0078.208] lstrlenA (lpString="*.xls") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.xlsx") returned 0
	[0078.208] lstrlenA (lpString="*.xlsx") returned 6
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.ppt") returned 0
	[0078.208] lstrlenA (lpString="*.ppt") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.pptx") returned 0
	[0078.208] lstrlenA (lpString="*.pptx") returned 6
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.txt") returned 0
	[0078.208] lstrlenA (lpString="*.txt") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.pdf") returned 0
	[0078.208] lstrlenA (lpString="*.pdf") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.djvu") returned 0
	[0078.208] lstrlenA (lpString="*.djvu") returned 6
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.htm") returned 0
	[0078.208] lstrlenA (lpString="*.htm") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.html") returned 0
	[0078.208] lstrlenA (lpString="*.html") returned 6
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mdb") returned 0
	[0078.208] lstrlenA (lpString="*.mdb") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.cer") returned 0
	[0078.208] lstrlenA (lpString="*.cer") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.p12") returned 0
	[0078.208] lstrlenA (lpString="*.p12") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.pfx") returned 0
	[0078.208] lstrlenA (lpString="*.pfx") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.kwm") returned 0
	[0078.208] lstrlenA (lpString="*.kwm") returned 5
	[0078.208] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.pwm") returned 0
	[0078.208] lstrlenA (lpString="*.pwm") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.1cd") returned 0
	[0078.209] lstrlenA (lpString="*.1cd") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.md") returned 0
	[0078.209] lstrlenA (lpString="*.md") returned 4
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mdf") returned 0
	[0078.209] lstrlenA (lpString="*.mdf") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.dbf") returned 0
	[0078.209] lstrlenA (lpString="*.dbf") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.odt") returned 0
	[0078.209] lstrlenA (lpString="*.odt") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.vob") returned 0
	[0078.209] lstrlenA (lpString="*.vob") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.ifo") returned 0
	[0078.209] lstrlenA (lpString="*.ifo") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.lnk") returned 0
	[0078.209] lstrlenA (lpString="*.lnk") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.torrent") returned 0
	[0078.209] lstrlenA (lpString="*.torrent") returned 9
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mov") returned 0
	[0078.209] lstrlenA (lpString="*.mov") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.m2v") returned 0
	[0078.209] lstrlenA (lpString="*.m2v") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.3gp") returned 0
	[0078.209] lstrlenA (lpString="*.3gp") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mpeg") returned 0
	[0078.209] lstrlenA (lpString="*.mpeg") returned 6
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mpg") returned 0
	[0078.209] lstrlenA (lpString="*.mpg") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.flv") returned 0
	[0078.209] lstrlenA (lpString="*.flv") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.avi") returned 0
	[0078.209] lstrlenA (lpString="*.avi") returned 5
	[0078.209] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mp4") returned 0
	[0078.209] lstrlenA (lpString="*.mp4") returned 5
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.wmv") returned 0
	[0078.210] lstrlenA (lpString="*.wmv") returned 5
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.divx") returned 0
	[0078.210] lstrlenA (lpString="*.divx") returned 6
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mkv") returned 0
	[0078.210] lstrlenA (lpString="*.mkv") returned 5
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.mp3") returned 0
	[0078.210] lstrlenA (lpString="*.mp3") returned 5
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.wav") returned 0
	[0078.210] lstrlenA (lpString="*.wav") returned 5
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.flac") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.ape") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.wma") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.ac3") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.exe") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll", pszSpec="*.apk") returned 0
	[0078.210] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.210] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Classic.dll") returned -1
	[0078.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Classic.dll") returned -1
	[0078.210] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Classic.dll") returned -1
	[0078.210] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll") returned="PresentationFramework.Aero.dll"
	[0078.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.210] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.210] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Classic.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll"
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.zip") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.rar") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.7z") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.tar") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.gzip") returned 0
	[0078.210] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.jpg") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.jpeg") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.psd") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.cdr") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.dwg") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.max") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.bmp") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.gif") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.png") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.doc") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.docx") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.xls") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.xlsx") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.ppt") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.pptx") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.txt") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.pdf") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.djvu") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.htm") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.html") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mdb") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.cer") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.p12") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.pfx") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.kwm") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.pwm") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.1cd") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.md") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mdf") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.dbf") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.odt") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.vob") returned 0
	[0078.211] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.ifo") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.lnk") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.torrent") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mov") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.m2v") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.3gp") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mpeg") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mpg") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.flv") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.avi") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mp4") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.wmv") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.divx") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mkv") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.mp3") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.wav") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.flac") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.ape") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.wma") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.ac3") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.exe") returned 0
	[0078.212] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll", pszSpec="*.apk") returned 0
	[0078.212] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.212] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.212] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.dll") returned -1
	[0078.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.dll") returned -1
	[0078.212] lstrcmpiA (lpString1="", lpString2="PresentationFramework.dll") returned -1
	[0078.212] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll") returned="PresentationFramework.Classic.dll"
	[0078.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.212] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.212] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll"
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.zip") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.rar") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.7z") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.tar") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.gzip") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.jpg") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.jpeg") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.psd") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.cdr") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.dwg") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.max") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.bmp") returned 0
	[0078.213] PathMatchSpecA (pszFile="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll", pszSpec="*.gif") returned 0
	[0078.213] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.213] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Luna.dll") returned -1
	[0078.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Luna.dll") returned -1
	[0078.213] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Luna.dll") returned -1
	[0078.213] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll") returned="PresentationFramework.dll"
	[0078.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.213] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.213] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Luna.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll"
	[0078.214] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.214] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.214] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Royale.dll") returned -1
	[0078.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Royale.dll") returned -1
	[0078.214] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Royale.dll") returned -1
	[0078.214] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll") returned="PresentationFramework.Luna.dll"
	[0078.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.214] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.214] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Royale.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll"
	[0078.214] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.214] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.214] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ReachFramework.dll") returned -1
	[0078.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReachFramework.dll") returned -1
	[0078.214] lstrcmpiA (lpString1="", lpString2="ReachFramework.dll") returned -1
	[0078.214] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll") returned="PresentationFramework.Royale.dll"
	[0078.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.214] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.214] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="ReachFramework.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll"
	[0078.214] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.214] lstrcmpA (lpString1=".", lpString2="RedistList") returned -1
	[0078.215] lstrcmpA (lpString1="..", lpString2="RedistList") returned -1
	[0078.215] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll") returned="ReachFramework.dll"
	[0078.215] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="RedistList" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList"
	[0078.215] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0078.218] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.219] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.219] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.219] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.219] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.219] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0078.219] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FrameworkList.xml") returned -1
	[0078.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FrameworkList.xml") returned 1
	[0078.219] lstrcmpiA (lpString1="", lpString2="FrameworkList.xml") returned -1
	[0078.219] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*") returned="*.*"
	[0078.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\"
	[0078.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned=""
	[0078.219] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\HOW TO DECRYPT FILES.txt"
	[0078.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\how to decrypt files.txt")) returned 0xffffffff
	[0078.219] CreateFileA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0078.221] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.221] CloseHandle (hObject=0x94) returned 1
	[0078.221] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\", lpString2="FrameworkList.xml" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml"
	[0078.221] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0078.221] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0078.221] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.221] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.IdentityModel.dll") returned -1
	[0078.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.dll") returned -1
	[0078.222] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.dll") returned -1
	[0078.222] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*") returned="*.*"
	[0078.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.222] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.222] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.IdentityModel.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll"
	[0078.222] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.IdentityModel.Selectors.dll") returned -1
	[0078.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.dll") returned -1
	[0078.222] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.dll") returned -1
	[0078.222] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll") returned="System.IdentityModel.dll"
	[0078.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.222] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.222] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.IdentityModel.Selectors.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll"
	[0078.222] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.IO.Log.dll") returned -1
	[0078.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Log.dll") returned -1
	[0078.222] lstrcmpiA (lpString1="", lpString2="System.IO.Log.dll") returned -1
	[0078.222] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll") returned="System.IdentityModel.Selectors.dll"
	[0078.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.222] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.223] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.IO.Log.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll"
	[0078.223] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Printing.dll") returned -1
	[0078.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Printing.dll") returned -1
	[0078.223] lstrcmpiA (lpString1="", lpString2="System.Printing.dll") returned -1
	[0078.223] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll") returned="System.IO.Log.dll"
	[0078.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.224] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.224] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Printing.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll"
	[0078.224] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.224] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.224] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Runtime.Serialization.dll") returned -1
	[0078.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.dll") returned -1
	[0078.224] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.dll") returned -1
	[0078.224] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll") returned="System.Printing.dll"
	[0078.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.224] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.224] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Runtime.Serialization.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll"
	[0078.224] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.224] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.224] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.ServiceModel.dll") returned -1
	[0078.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.dll") returned -1
	[0078.225] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.dll") returned -1
	[0078.225] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll") returned="System.Runtime.Serialization.dll"
	[0078.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.225] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.225] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.ServiceModel.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll"
	[0078.225] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.225] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Speech.dll") returned -1
	[0078.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Speech.dll") returned -1
	[0078.225] lstrcmpiA (lpString1="", lpString2="System.Speech.dll") returned -1
	[0078.225] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll") returned="System.ServiceModel.dll"
	[0078.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.225] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.225] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Speech.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll"
	[0078.225] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.225] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Workflow.Activities.dll") returned -1
	[0078.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Activities.dll") returned -1
	[0078.225] lstrcmpiA (lpString1="", lpString2="System.Workflow.Activities.dll") returned -1
	[0078.225] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll") returned="System.Speech.dll"
	[0078.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.225] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.225] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Workflow.Activities.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll"
	[0078.225] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Workflow.ComponentModel.dll") returned -1
	[0078.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.ComponentModel.dll") returned -1
	[0078.226] lstrcmpiA (lpString1="", lpString2="System.Workflow.ComponentModel.dll") returned -1
	[0078.226] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll") returned="System.Workflow.Activities.dll"
	[0078.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.226] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.226] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Workflow.ComponentModel.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll"
	[0078.226] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Workflow.Runtime.dll") returned -1
	[0078.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Runtime.dll") returned -1
	[0078.226] lstrcmpiA (lpString1="", lpString2="System.Workflow.Runtime.dll") returned -1
	[0078.226] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll") returned="System.Workflow.ComponentModel.dll"
	[0078.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.226] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.226] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Workflow.Runtime.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll"
	[0078.226] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationClient.dll") returned -1
	[0078.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClient.dll") returned -1
	[0078.226] lstrcmpiA (lpString1="", lpString2="UIAutomationClient.dll") returned -1
	[0078.226] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll") returned="System.Workflow.Runtime.dll"
	[0078.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.226] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.226] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationClient.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll"
	[0078.227] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.227] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationClientsideProviders.dll") returned -1
	[0078.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClientsideProviders.dll") returned -1
	[0078.227] lstrcmpiA (lpString1="", lpString2="UIAutomationClientsideProviders.dll") returned -1
	[0078.227] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll") returned="UIAutomationClient.dll"
	[0078.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.227] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.227] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationClientsideProviders.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll"
	[0078.227] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.227] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationProvider.dll") returned -1
	[0078.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationProvider.dll") returned -1
	[0078.227] lstrcmpiA (lpString1="", lpString2="UIAutomationProvider.dll") returned -1
	[0078.227] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll") returned="UIAutomationClientsideProviders.dll"
	[0078.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.227] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.227] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationProvider.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll"
	[0078.227] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.227] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationTypes.dll") returned -1
	[0078.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationTypes.dll") returned -1
	[0078.227] lstrcmpiA (lpString1="", lpString2="UIAutomationTypes.dll") returned -1
	[0078.227] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll") returned="UIAutomationProvider.dll"
	[0078.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.228] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.228] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.228] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationTypes.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll"
	[0078.228] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.228] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsBase.dll") returned -1
	[0078.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsBase.dll") returned -1
	[0078.228] lstrcmpiA (lpString1="", lpString2="WindowsBase.dll") returned -1
	[0078.228] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll") returned="UIAutomationTypes.dll"
	[0078.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.228] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.228] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.228] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.228] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="WindowsBase.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll"
	[0078.228] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.228] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsFormsIntegration.dll") returned -1
	[0078.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsFormsIntegration.dll") returned -1
	[0078.228] lstrcmpiA (lpString1="", lpString2="WindowsFormsIntegration.dll") returned -1
	[0078.228] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll") returned="WindowsBase.dll"
	[0078.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.228] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.228] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.228] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.228] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="WindowsFormsIntegration.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll"
	[0078.228] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.229] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WinFXList.xml") returned -1
	[0078.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WinFXList.xml") returned -1
	[0078.229] lstrcmpiA (lpString1="", lpString2="WinFXList.xml") returned -1
	[0078.229] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll") returned="WindowsFormsIntegration.dll"
	[0078.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\"
	[0078.229] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned=""
	[0078.229] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt"
	[0078.229] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\how to decrypt files.txt")) returned 0x20
	[0078.229] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="WinFXList.xml" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml"
	[0078.229] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0078.229] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0078.229] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.229] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1
	[0078.229] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1
	[0078.229] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*") returned="*.*"
	[0078.229] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", lpString2="v3.5" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5"
	[0078.229] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.233] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.233] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.234] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.234] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.234] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.234] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.234] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Conversion.v3.5.dll") returned -1
	[0078.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Conversion.v3.5.dll") returned -1
	[0078.234] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Conversion.v3.5.dll") returned -1
	[0078.234] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*") returned="*.*"
	[0078.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.234] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.234] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.234] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0xffffffff
	[0078.234] CreateFileA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90
	[0078.235] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.235] CloseHandle (hObject=0x90) returned 1
	[0078.235] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Conversion.v3.5.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll"
	[0078.236] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.236] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Engine.dll") returned -1
	[0078.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.dll") returned -1
	[0078.236] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.dll") returned -1
	[0078.236] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll") returned="Microsoft.Build.Conversion.v3.5.dll"
	[0078.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.236] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.236] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Engine.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll"
	[0078.236] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.236] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Framework.dll") returned -1
	[0078.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.dll") returned -1
	[0078.236] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.dll") returned -1
	[0078.236] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll") returned="Microsoft.Build.Engine.dll"
	[0078.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.236] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.236] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Framework.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll"
	[0078.236] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.236] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Utilities.v3.5.dll") returned -1
	[0078.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.v3.5.dll") returned -1
	[0078.236] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.v3.5.dll") returned -1
	[0078.236] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll") returned="Microsoft.Build.Framework.dll"
	[0078.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.236] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.237] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.237] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Utilities.v3.5.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll"
	[0078.237] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.237] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1
	[0078.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1
	[0078.237] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1
	[0078.237] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll") returned="Microsoft.Build.Utilities.v3.5.dll"
	[0078.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.237] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.237] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.237] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.VisualC.STLCLR.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll"
	[0078.237] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.237] lstrcmpA (lpString1=".", lpString2="RedistList") returned -1
	[0078.237] lstrcmpA (lpString1="..", lpString2="RedistList") returned -1
	[0078.237] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll") returned="Microsoft.VisualC.STLCLR.dll"
	[0078.237] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="RedistList" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList"
	[0078.237] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0078.237] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.237] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.237] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.237] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.237] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 1
	[0078.237] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0078.238] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FrameworkList.xml") returned -1
	[0078.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FrameworkList.xml") returned 1
	[0078.238] lstrcmpiA (lpString1="", lpString2="FrameworkList.xml") returned -1
	[0078.238] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*") returned="*.*"
	[0078.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\"
	[0078.238] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned=""
	[0078.238] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\HOW TO DECRYPT FILES.txt"
	[0078.238] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\how to decrypt files.txt")) returned 0xffffffff
	[0078.238] CreateFileA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94
	[0078.239] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.239] CloseHandle (hObject=0x94) returned 1
	[0078.239] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\", lpString2="FrameworkList.xml" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml"
	[0078.239] FindNextFileA (in: hFindFile=0x8b7ee8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0
	[0078.239] FindClose (in: hFindFile=0x8b7ee8 | out: hFindFile=0x8b7ee8) returned 1
	[0078.239] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.239] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.239] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.AddIn.Contract.dll") returned -1
	[0078.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.Contract.dll") returned -1
	[0078.239] lstrcmpiA (lpString1="", lpString2="System.AddIn.Contract.dll") returned -1
	[0078.239] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*") returned="*.*"
	[0078.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.239] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.239] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.239] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.239] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.AddIn.Contract.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll"
	[0078.240] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.AddIn.dll") returned -1
	[0078.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.dll") returned -1
	[0078.240] lstrcmpiA (lpString1="", lpString2="System.AddIn.dll") returned -1
	[0078.240] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll") returned="System.AddIn.Contract.dll"
	[0078.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.240] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.240] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.240] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.AddIn.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll"
	[0078.240] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1
	[0078.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1
	[0078.240] lstrcmpiA (lpString1="", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1
	[0078.240] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll") returned="System.AddIn.dll"
	[0078.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.240] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.240] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.240] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.ComponentModel.DataAnnotations.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll"
	[0078.240] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.240] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Core.dll") returned -1
	[0078.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Core.dll") returned -1
	[0078.240] lstrcmpiA (lpString1="", lpString2="System.Core.dll") returned -1
	[0078.240] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll") returned="System.ComponentModel.DataAnnotations.dll"
	[0078.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.241] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.241] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.241] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Core.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll"
	[0078.241] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.DataSetExtensions.dll") returned -1
	[0078.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.DataSetExtensions.dll") returned -1
	[0078.241] lstrcmpiA (lpString1="", lpString2="System.Data.DataSetExtensions.dll") returned -1
	[0078.241] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll") returned="System.Core.dll"
	[0078.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.241] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.241] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.241] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.DataSetExtensions.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll"
	[0078.241] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Entity.Design.dll") returned -1
	[0078.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.Design.dll") returned -1
	[0078.241] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.Design.dll") returned -1
	[0078.241] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll") returned="System.Data.DataSetExtensions.dll"
	[0078.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.241] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.241] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.241] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Entity.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll"
	[0078.241] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Entity.dll") returned -1
	[0078.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.dll") returned -1
	[0078.242] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.dll") returned -1
	[0078.242] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll") returned="System.Data.Entity.Design.dll"
	[0078.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.242] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.242] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.242] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Entity.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll"
	[0078.242] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.242] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Linq.dll") returned -1
	[0078.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Linq.dll") returned -1
	[0078.242] lstrcmpiA (lpString1="", lpString2="System.Data.Linq.dll") returned -1
	[0078.242] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll") returned="System.Data.Entity.dll"
	[0078.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.242] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.242] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.242] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Linq.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll"
	[0078.242] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.242] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Services.Client.dll") returned -1
	[0078.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Client.dll") returned -1
	[0078.242] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Client.dll") returned -1
	[0078.242] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll") returned="System.Data.Linq.dll"
	[0078.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.242] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.242] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.242] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Services.Client.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll"
	[0078.243] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.243] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Services.Design.dll") returned -1
	[0078.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Design.dll") returned -1
	[0078.243] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Design.dll") returned -1
	[0078.243] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll") returned="System.Data.Services.Client.dll"
	[0078.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.243] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.243] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.243] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Services.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll"
	[0078.243] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.243] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Services.dll") returned -1
	[0078.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.dll") returned -1
	[0078.243] lstrcmpiA (lpString1="", lpString2="System.Data.Services.dll") returned -1
	[0078.243] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll") returned="System.Data.Services.Design.dll"
	[0078.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.243] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.243] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.243] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Services.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll"
	[0078.243] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.243] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1
	[0078.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1
	[0078.243] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1
	[0078.243] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll") returned="System.Data.Services.dll"
	[0078.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.243] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.243] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.244] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.DirectoryServices.AccountManagement.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll"
	[0078.244] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Management.Instrumentation.dll") returned -1
	[0078.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Instrumentation.dll") returned -1
	[0078.244] lstrcmpiA (lpString1="", lpString2="System.Management.Instrumentation.dll") returned -1
	[0078.244] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll") returned="System.DirectoryServices.AccountManagement.dll"
	[0078.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.244] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.244] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.244] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Management.Instrumentation.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll"
	[0078.244] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Net.dll") returned -1
	[0078.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.dll") returned -1
	[0078.244] lstrcmpiA (lpString1="", lpString2="System.Net.dll") returned -1
	[0078.244] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll") returned="System.Management.Instrumentation.dll"
	[0078.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.244] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.244] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.244] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Net.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll"
	[0078.244] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.ServiceModel.Web.dll") returned -1
	[0078.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Web.dll") returned -1
	[0078.244] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Web.dll") returned -1
	[0078.244] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll") returned="System.Net.dll"
	[0078.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.245] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.245] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.ServiceModel.Web.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll"
	[0078.245] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.245] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Abstractions.dll") returned -1
	[0078.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Abstractions.dll") returned -1
	[0078.245] lstrcmpiA (lpString1="", lpString2="System.Web.Abstractions.dll") returned -1
	[0078.245] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll") returned="System.ServiceModel.Web.dll"
	[0078.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.245] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.245] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Abstractions.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll"
	[0078.245] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.245] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.DynamicData.Design.dll") returned -1
	[0078.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.Design.dll") returned -1
	[0078.245] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.Design.dll") returned -1
	[0078.245] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll") returned="System.Web.Abstractions.dll"
	[0078.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.249] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.249] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.DynamicData.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll"
	[0078.249] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.249] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.DynamicData.dll") returned -1
	[0078.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.dll") returned -1
	[0078.249] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.dll") returned -1
	[0078.249] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll") returned="System.Web.DynamicData.Design.dll"
	[0078.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.249] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.250] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.DynamicData.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll"
	[0078.250] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.250] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Entity.Design.dll") returned -1
	[0078.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.Design.dll") returned -1
	[0078.250] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.Design.dll") returned -1
	[0078.250] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll") returned="System.Web.DynamicData.dll"
	[0078.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.250] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.250] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Entity.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll"
	[0078.250] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.250] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Entity.dll") returned -1
	[0078.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.dll") returned -1
	[0078.250] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.dll") returned -1
	[0078.250] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll") returned="System.Web.Entity.Design.dll"
	[0078.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.250] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.250] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Entity.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll"
	[0078.250] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.250] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Extensions.Design.dll") returned -1
	[0078.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.Design.dll") returned -1
	[0078.250] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.Design.dll") returned -1
	[0078.250] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll") returned="System.Web.Entity.dll"
	[0078.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.251] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.251] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.251] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.251] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Extensions.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll"
	[0078.251] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.251] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.251] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Extensions.dll") returned -1
	[0078.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.dll") returned -1
	[0078.251] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.dll") returned -1
	[0078.251] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll") returned="System.Web.Extensions.Design.dll"
	[0078.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.251] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.251] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.251] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.251] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Extensions.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll"
	[0078.251] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.251] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.251] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Routing.dll") returned -1
	[0078.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Routing.dll") returned -1
	[0078.251] lstrcmpiA (lpString1="", lpString2="System.Web.Routing.dll") returned -1
	[0078.251] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll") returned="System.Web.Extensions.dll"
	[0078.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.251] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.251] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.251] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.251] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Routing.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll"
	[0078.251] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.252] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.252] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Windows.Presentation.dll") returned -1
	[0078.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Presentation.dll") returned -1
	[0078.252] lstrcmpiA (lpString1="", lpString2="System.Windows.Presentation.dll") returned -1
	[0078.252] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll") returned="System.Web.Routing.dll"
	[0078.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.252] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.252] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.252] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.252] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Windows.Presentation.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll"
	[0078.252] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.252] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.252] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.WorkflowServices.dll") returned -1
	[0078.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.WorkflowServices.dll") returned -1
	[0078.252] lstrcmpiA (lpString1="", lpString2="System.WorkflowServices.dll") returned -1
	[0078.252] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll") returned="System.Windows.Presentation.dll"
	[0078.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.252] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.252] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.252] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.252] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.WorkflowServices.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll"
	[0078.252] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 1
	[0078.252] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.252] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Xml.Linq.dll") returned -1
	[0078.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Linq.dll") returned -1
	[0078.252] lstrcmpiA (lpString1="", lpString2="System.Xml.Linq.dll") returned -1
	[0078.252] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll") returned="System.WorkflowServices.dll"
	[0078.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\"
	[0078.252] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned=""
	[0078.252] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt"
	[0078.252] GetFileAttributesA (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20
	[0078.253] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Xml.Linq.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Xml.Linq.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Xml.Linq.dll"
	[0078.253] FindNextFileA (in: hFindFile=0x8b7ea8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0
	[0078.253] FindClose (in: hFindFile=0x8b7ea8 | out: hFindFile=0x8b7ea8) returned 1
	[0078.253] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.253] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.253] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.253] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.253] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.253] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.253] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.253] lstrcmpA (lpString1=".", lpString2="Uninstall Information") returned -1
	[0078.253] lstrcmpA (lpString1="..", lpString2="Uninstall Information") returned -1
	[0078.253] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.253] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Uninstall Information" | out: lpString1="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information"
	[0078.253] lstrlenA (lpString="C:\\Program Files\\Uninstall Information") returned 38
	[0078.253] FindFirstFileA (in: lpFileName="C:\\Program Files\\Uninstall Information\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.253] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.253] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.253] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.253] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.253] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.253] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.253] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="annoying-bios.exe") returned 1
	[0078.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="annoying-bios.exe") returned 1
	[0078.253] lstrcmpiA (lpString1="", lpString2="annoying-bios.exe") returned -1
	[0078.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Uninstall Information\\" | out: lpString1="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\"
	[0078.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Uninstall Information\\" | out: pszPath="C:\\Program Files\\Uninstall Information\\") returned=""
	[0078.254] lstrcatA (in: lpString1="C:\\Program Files\\Uninstall Information\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Uninstall Information\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Uninstall Information\\HOW TO DECRYPT FILES.txt"
	[0078.254] GetFileAttributesA (lpFileName="C:\\Program Files\\Uninstall Information\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\uninstall information\\how to decrypt files.txt")) returned 0xffffffff
	[0078.254] CreateFileA (lpFileName="C:\\Program Files\\Uninstall Information\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\uninstall information\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0078.254] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0078.254] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.255] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.255] CloseHandle (hObject=0x84) returned 1
	[0078.255] lstrcatA (in: lpString1="C:\\Program Files\\Uninstall Information\\", lpString2="annoying-bios.exe" | out: lpString1="C:\\Program Files\\Uninstall Information\\annoying-bios.exe") returned="C:\\Program Files\\Uninstall Information\\annoying-bios.exe"
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.zip") returned 0
	[0078.256] lstrlenA (lpString="*.zip") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.rar") returned 0
	[0078.256] lstrlenA (lpString="*.rar") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.7z") returned 0
	[0078.256] lstrlenA (lpString="*.7z") returned 4
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.tar") returned 0
	[0078.256] lstrlenA (lpString="*.tar") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.gzip") returned 0
	[0078.256] lstrlenA (lpString="*.gzip") returned 6
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.jpg") returned 0
	[0078.256] lstrlenA (lpString="*.jpg") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.jpeg") returned 0
	[0078.256] lstrlenA (lpString="*.jpeg") returned 6
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.psd") returned 0
	[0078.256] lstrlenA (lpString="*.psd") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.cdr") returned 0
	[0078.256] lstrlenA (lpString="*.cdr") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.dwg") returned 0
	[0078.256] lstrlenA (lpString="*.dwg") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.max") returned 0
	[0078.256] lstrlenA (lpString="*.max") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.bmp") returned 0
	[0078.256] lstrlenA (lpString="*.bmp") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.gif") returned 0
	[0078.256] lstrlenA (lpString="*.gif") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.png") returned 0
	[0078.256] lstrlenA (lpString="*.png") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.doc") returned 0
	[0078.256] lstrlenA (lpString="*.doc") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.docx") returned 0
	[0078.256] lstrlenA (lpString="*.docx") returned 6
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.xls") returned 0
	[0078.256] lstrlenA (lpString="*.xls") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.xlsx") returned 0
	[0078.256] lstrlenA (lpString="*.xlsx") returned 6
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.ppt") returned 0
	[0078.256] lstrlenA (lpString="*.ppt") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.pptx") returned 0
	[0078.256] lstrlenA (lpString="*.pptx") returned 6
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.txt") returned 0
	[0078.256] lstrlenA (lpString="*.txt") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.pdf") returned 0
	[0078.256] lstrlenA (lpString="*.pdf") returned 5
	[0078.256] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.djvu") returned 0
	[0078.257] lstrlenA (lpString="*.djvu") returned 6
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.htm") returned 0
	[0078.257] lstrlenA (lpString="*.htm") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.html") returned 0
	[0078.257] lstrlenA (lpString="*.html") returned 6
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mdb") returned 0
	[0078.257] lstrlenA (lpString="*.mdb") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.cer") returned 0
	[0078.257] lstrlenA (lpString="*.cer") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.p12") returned 0
	[0078.257] lstrlenA (lpString="*.p12") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.pfx") returned 0
	[0078.257] lstrlenA (lpString="*.pfx") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.kwm") returned 0
	[0078.257] lstrlenA (lpString="*.kwm") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.pwm") returned 0
	[0078.257] lstrlenA (lpString="*.pwm") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.1cd") returned 0
	[0078.257] lstrlenA (lpString="*.1cd") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.md") returned 0
	[0078.257] lstrlenA (lpString="*.md") returned 4
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mdf") returned 0
	[0078.257] lstrlenA (lpString="*.mdf") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.dbf") returned 0
	[0078.257] lstrlenA (lpString="*.dbf") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.odt") returned 0
	[0078.257] lstrlenA (lpString="*.odt") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.vob") returned 0
	[0078.257] lstrlenA (lpString="*.vob") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.ifo") returned 0
	[0078.257] lstrlenA (lpString="*.ifo") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.lnk") returned 0
	[0078.257] lstrlenA (lpString="*.lnk") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.torrent") returned 0
	[0078.257] lstrlenA (lpString="*.torrent") returned 9
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mov") returned 0
	[0078.257] lstrlenA (lpString="*.mov") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.m2v") returned 0
	[0078.257] lstrlenA (lpString="*.m2v") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.3gp") returned 0
	[0078.257] lstrlenA (lpString="*.3gp") returned 5
	[0078.257] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mpeg") returned 0
	[0078.257] lstrlenA (lpString="*.mpeg") returned 6
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mpg") returned 0
	[0078.258] lstrlenA (lpString="*.mpg") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.flv") returned 0
	[0078.258] lstrlenA (lpString="*.flv") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.avi") returned 0
	[0078.258] lstrlenA (lpString="*.avi") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mp4") returned 0
	[0078.258] lstrlenA (lpString="*.mp4") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.wmv") returned 0
	[0078.258] lstrlenA (lpString="*.wmv") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.divx") returned 0
	[0078.258] lstrlenA (lpString="*.divx") returned 6
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mkv") returned 0
	[0078.258] lstrlenA (lpString="*.mkv") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.mp3") returned 0
	[0078.258] lstrlenA (lpString="*.mp3") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.wav") returned 0
	[0078.258] lstrlenA (lpString="*.wav") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.flac") returned 0
	[0078.258] lstrlenA (lpString="*.flac") returned 6
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.ape") returned 0
	[0078.258] lstrlenA (lpString="*.ape") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.wma") returned 0
	[0078.258] lstrlenA (lpString="*.wma") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.ac3") returned 0
	[0078.258] lstrlenA (lpString="*.ac3") returned 5
	[0078.258] PathMatchSpecA (pszFile="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", pszSpec="*.exe") returned 1
	[0078.258] lstrlenA (lpString="*.exe") returned 5
	[0078.258] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Uninstall Information\\annoying-bios.exe" | out: lpString1="C:\\Program Files\\Uninstall Information\\annoying-bios.exe") returned="C:\\Program Files\\Uninstall Information\\annoying-bios.exe"
	[0078.258] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Uninstall Information\\annoying-bios.exe" | out: lpString1="C:\\Program Files\\Uninstall Information\\annoying-bios.exe") returned="C:\\Program Files\\Uninstall Information\\annoying-bios.exe"
	[0078.258] lstrcatA (in: lpString1="C:\\Program Files\\Uninstall Information\\annoying-bios.exe", lpString2="." | out: lpString1="C:\\Program Files\\Uninstall Information\\annoying-bios.exe.") returned="C:\\Program Files\\Uninstall Information\\annoying-bios.exe."
	[0078.258] lstrcatA (in: lpString1="C:\\Program Files\\Uninstall Information\\annoying-bios.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Uninstall Information\\annoying-bios.exe.Boom") returned="C:\\Program Files\\Uninstall Information\\annoying-bios.exe.Boom"
	[0078.258] CreateFileA (lpFileName="C:\\Program Files\\Uninstall Information\\annoying-bios.exe" (normalized: "c:\\program files\\uninstall information\\annoying-bios.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.258] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.258] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.258] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.259] lstrcmpA (lpString1=".", lpString2="Windows Defender") returned -1
	[0078.259] lstrcmpA (lpString1="..", lpString2="Windows Defender") returned -1
	[0078.259] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Defender" | out: lpString1="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender"
	[0078.259] lstrlenA (lpString="C:\\Program Files\\Windows Defender") returned 33
	[0078.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.259] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.259] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.259] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.259] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.259] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.259] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.259] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.259] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US") returned="C:\\Program Files\\Windows Defender\\en-US"
	[0078.259] lstrlenA (lpString="C:\\Program Files\\Windows Defender\\en-US") returned 39
	[0078.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.259] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.259] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.259] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.259] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.259] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.259] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.259] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpAsDesc.dll.mui") returned -1
	[0078.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpAsDesc.dll.mui") returned -1
	[0078.259] lstrcmpiA (lpString1="", lpString2="MpAsDesc.dll.mui") returned -1
	[0078.259] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\*.*") returned="*.*"
	[0078.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\") returned="C:\\Program Files\\Windows Defender\\en-US\\"
	[0078.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Defender\\en-US\\") returned=""
	[0078.259] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0078.260] CreateFileA (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0078.260] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0078.260] WriteFile (in: hFile=0x88, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.261] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.261] CloseHandle (hObject=0x88) returned 1
	[0078.261] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="MpAsDesc.dll.mui" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui") returned="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui"
	[0078.261] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.zip") returned 0
	[0078.261] lstrlenA (lpString="*.zip") returned 5
	[0078.261] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.rar") returned 0
	[0078.261] lstrlenA (lpString="*.rar") returned 5
	[0078.261] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.7z") returned 0
	[0078.262] lstrlenA (lpString="*.7z") returned 4
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.tar") returned 0
	[0078.262] lstrlenA (lpString="*.tar") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.gzip") returned 0
	[0078.262] lstrlenA (lpString="*.gzip") returned 6
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.jpg") returned 0
	[0078.262] lstrlenA (lpString="*.jpg") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.jpeg") returned 0
	[0078.262] lstrlenA (lpString="*.jpeg") returned 6
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.psd") returned 0
	[0078.262] lstrlenA (lpString="*.psd") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.cdr") returned 0
	[0078.262] lstrlenA (lpString="*.cdr") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.dwg") returned 0
	[0078.262] lstrlenA (lpString="*.dwg") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.max") returned 0
	[0078.262] lstrlenA (lpString="*.max") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.bmp") returned 0
	[0078.262] lstrlenA (lpString="*.bmp") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.gif") returned 0
	[0078.262] lstrlenA (lpString="*.gif") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.png") returned 0
	[0078.262] lstrlenA (lpString="*.png") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.doc") returned 0
	[0078.262] lstrlenA (lpString="*.doc") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.docx") returned 0
	[0078.262] lstrlenA (lpString="*.docx") returned 6
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.xls") returned 0
	[0078.262] lstrlenA (lpString="*.xls") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.xlsx") returned 0
	[0078.262] lstrlenA (lpString="*.xlsx") returned 6
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.ppt") returned 0
	[0078.262] lstrlenA (lpString="*.ppt") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.pptx") returned 0
	[0078.262] lstrlenA (lpString="*.pptx") returned 6
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.txt") returned 0
	[0078.262] lstrlenA (lpString="*.txt") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.pdf") returned 0
	[0078.262] lstrlenA (lpString="*.pdf") returned 5
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.djvu") returned 0
	[0078.262] lstrlenA (lpString="*.djvu") returned 6
	[0078.262] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.htm") returned 0
	[0078.262] lstrlenA (lpString="*.htm") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.html") returned 0
	[0078.263] lstrlenA (lpString="*.html") returned 6
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mdb") returned 0
	[0078.263] lstrlenA (lpString="*.mdb") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.cer") returned 0
	[0078.263] lstrlenA (lpString="*.cer") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.p12") returned 0
	[0078.263] lstrlenA (lpString="*.p12") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.pfx") returned 0
	[0078.263] lstrlenA (lpString="*.pfx") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.kwm") returned 0
	[0078.263] lstrlenA (lpString="*.kwm") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.pwm") returned 0
	[0078.263] lstrlenA (lpString="*.pwm") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.1cd") returned 0
	[0078.263] lstrlenA (lpString="*.1cd") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.md") returned 0
	[0078.263] lstrlenA (lpString="*.md") returned 4
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mdf") returned 0
	[0078.263] lstrlenA (lpString="*.mdf") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.dbf") returned 0
	[0078.263] lstrlenA (lpString="*.dbf") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.odt") returned 0
	[0078.263] lstrlenA (lpString="*.odt") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.vob") returned 0
	[0078.263] lstrlenA (lpString="*.vob") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.ifo") returned 0
	[0078.263] lstrlenA (lpString="*.ifo") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.lnk") returned 0
	[0078.263] lstrlenA (lpString="*.lnk") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.torrent") returned 0
	[0078.263] lstrlenA (lpString="*.torrent") returned 9
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mov") returned 0
	[0078.263] lstrlenA (lpString="*.mov") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.m2v") returned 0
	[0078.263] lstrlenA (lpString="*.m2v") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.3gp") returned 0
	[0078.263] lstrlenA (lpString="*.3gp") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mpeg") returned 0
	[0078.263] lstrlenA (lpString="*.mpeg") returned 6
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mpg") returned 0
	[0078.263] lstrlenA (lpString="*.mpg") returned 5
	[0078.263] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.flv") returned 0
	[0078.263] lstrlenA (lpString="*.flv") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.avi") returned 0
	[0078.264] lstrlenA (lpString="*.avi") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mp4") returned 0
	[0078.264] lstrlenA (lpString="*.mp4") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.wmv") returned 0
	[0078.264] lstrlenA (lpString="*.wmv") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.divx") returned 0
	[0078.264] lstrlenA (lpString="*.divx") returned 6
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mkv") returned 0
	[0078.264] lstrlenA (lpString="*.mkv") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.mp3") returned 0
	[0078.264] lstrlenA (lpString="*.mp3") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.wav") returned 0
	[0078.264] lstrlenA (lpString="*.wav") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.flac") returned 0
	[0078.264] lstrlenA (lpString="*.flac") returned 6
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.ape") returned 0
	[0078.264] lstrlenA (lpString="*.ape") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.wma") returned 0
	[0078.264] lstrlenA (lpString="*.wma") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.ac3") returned 0
	[0078.264] lstrlenA (lpString="*.ac3") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.exe") returned 0
	[0078.264] lstrlenA (lpString="*.exe") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui", pszSpec="*.apk") returned 0
	[0078.264] lstrlenA (lpString="*.apk") returned 5
	[0078.264] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.264] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.264] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpEvMsg.dll.mui") returned -1
	[0078.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpEvMsg.dll.mui") returned -1
	[0078.264] lstrcmpiA (lpString1="", lpString2="MpEvMsg.dll.mui") returned -1
	[0078.264] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui") returned="MpAsDesc.dll.mui"
	[0078.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\") returned="C:\\Program Files\\Windows Defender\\en-US\\"
	[0078.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Defender\\en-US\\") returned=""
	[0078.264] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.264] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="MpEvMsg.dll.mui" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui") returned="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui"
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.zip") returned 0
	[0078.264] lstrlenA (lpString="*.zip") returned 5
	[0078.264] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.rar") returned 0
	[0078.265] lstrlenA (lpString="*.rar") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.7z") returned 0
	[0078.265] lstrlenA (lpString="*.7z") returned 4
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.tar") returned 0
	[0078.265] lstrlenA (lpString="*.tar") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.gzip") returned 0
	[0078.265] lstrlenA (lpString="*.gzip") returned 6
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.jpg") returned 0
	[0078.265] lstrlenA (lpString="*.jpg") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.jpeg") returned 0
	[0078.265] lstrlenA (lpString="*.jpeg") returned 6
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.psd") returned 0
	[0078.265] lstrlenA (lpString="*.psd") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.cdr") returned 0
	[0078.265] lstrlenA (lpString="*.cdr") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.dwg") returned 0
	[0078.265] lstrlenA (lpString="*.dwg") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.max") returned 0
	[0078.265] lstrlenA (lpString="*.max") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.bmp") returned 0
	[0078.265] lstrlenA (lpString="*.bmp") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.gif") returned 0
	[0078.265] lstrlenA (lpString="*.gif") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.png") returned 0
	[0078.265] lstrlenA (lpString="*.png") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.doc") returned 0
	[0078.265] lstrlenA (lpString="*.doc") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.docx") returned 0
	[0078.265] lstrlenA (lpString="*.docx") returned 6
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.xls") returned 0
	[0078.265] lstrlenA (lpString="*.xls") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.xlsx") returned 0
	[0078.265] lstrlenA (lpString="*.xlsx") returned 6
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.ppt") returned 0
	[0078.265] lstrlenA (lpString="*.ppt") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.pptx") returned 0
	[0078.265] lstrlenA (lpString="*.pptx") returned 6
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.txt") returned 0
	[0078.265] lstrlenA (lpString="*.txt") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.pdf") returned 0
	[0078.265] lstrlenA (lpString="*.pdf") returned 5
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.djvu") returned 0
	[0078.265] lstrlenA (lpString="*.djvu") returned 6
	[0078.265] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.htm") returned 0
	[0078.265] lstrlenA (lpString="*.htm") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.html") returned 0
	[0078.266] lstrlenA (lpString="*.html") returned 6
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mdb") returned 0
	[0078.266] lstrlenA (lpString="*.mdb") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.cer") returned 0
	[0078.266] lstrlenA (lpString="*.cer") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.p12") returned 0
	[0078.266] lstrlenA (lpString="*.p12") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.pfx") returned 0
	[0078.266] lstrlenA (lpString="*.pfx") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.kwm") returned 0
	[0078.266] lstrlenA (lpString="*.kwm") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.pwm") returned 0
	[0078.266] lstrlenA (lpString="*.pwm") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.1cd") returned 0
	[0078.266] lstrlenA (lpString="*.1cd") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.md") returned 0
	[0078.266] lstrlenA (lpString="*.md") returned 4
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mdf") returned 0
	[0078.266] lstrlenA (lpString="*.mdf") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.dbf") returned 0
	[0078.266] lstrlenA (lpString="*.dbf") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.odt") returned 0
	[0078.266] lstrlenA (lpString="*.odt") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.vob") returned 0
	[0078.266] lstrlenA (lpString="*.vob") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.ifo") returned 0
	[0078.266] lstrlenA (lpString="*.ifo") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.lnk") returned 0
	[0078.266] lstrlenA (lpString="*.lnk") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.torrent") returned 0
	[0078.266] lstrlenA (lpString="*.torrent") returned 9
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mov") returned 0
	[0078.266] lstrlenA (lpString="*.mov") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.m2v") returned 0
	[0078.266] lstrlenA (lpString="*.m2v") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.3gp") returned 0
	[0078.266] lstrlenA (lpString="*.3gp") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mpeg") returned 0
	[0078.266] lstrlenA (lpString="*.mpeg") returned 6
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mpg") returned 0
	[0078.266] lstrlenA (lpString="*.mpg") returned 5
	[0078.266] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.flv") returned 0
	[0078.266] lstrlenA (lpString="*.flv") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.avi") returned 0
	[0078.267] lstrlenA (lpString="*.avi") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mp4") returned 0
	[0078.267] lstrlenA (lpString="*.mp4") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.wmv") returned 0
	[0078.267] lstrlenA (lpString="*.wmv") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.divx") returned 0
	[0078.267] lstrlenA (lpString="*.divx") returned 6
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mkv") returned 0
	[0078.267] lstrlenA (lpString="*.mkv") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.mp3") returned 0
	[0078.267] lstrlenA (lpString="*.mp3") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.wav") returned 0
	[0078.267] lstrlenA (lpString="*.wav") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.flac") returned 0
	[0078.267] lstrlenA (lpString="*.flac") returned 6
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.ape") returned 0
	[0078.267] lstrlenA (lpString="*.ape") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.wma") returned 0
	[0078.267] lstrlenA (lpString="*.wma") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.ac3") returned 0
	[0078.267] lstrlenA (lpString="*.ac3") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.exe") returned 0
	[0078.267] lstrlenA (lpString="*.exe") returned 5
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui", pszSpec="*.apk") returned 0
	[0078.267] lstrlenA (lpString="*.apk") returned 5
	[0078.267] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.267] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.267] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MsMpRes.dll.mui") returned -1
	[0078.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MsMpRes.dll.mui") returned -1
	[0078.267] lstrcmpiA (lpString1="", lpString2="MsMpRes.dll.mui") returned -1
	[0078.267] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui") returned="MpEvMsg.dll.mui"
	[0078.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\") returned="C:\\Program Files\\Windows Defender\\en-US\\"
	[0078.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Defender\\en-US\\") returned=""
	[0078.267] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.267] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="MsMpRes.dll.mui" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui") returned="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui"
	[0078.267] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.zip") returned 0
	[0078.268] lstrlenA (lpString="*.zip") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.rar") returned 0
	[0078.268] lstrlenA (lpString="*.rar") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.7z") returned 0
	[0078.268] lstrlenA (lpString="*.7z") returned 4
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.tar") returned 0
	[0078.268] lstrlenA (lpString="*.tar") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.gzip") returned 0
	[0078.268] lstrlenA (lpString="*.gzip") returned 6
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.jpg") returned 0
	[0078.268] lstrlenA (lpString="*.jpg") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.jpeg") returned 0
	[0078.268] lstrlenA (lpString="*.jpeg") returned 6
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.psd") returned 0
	[0078.268] lstrlenA (lpString="*.psd") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.cdr") returned 0
	[0078.268] lstrlenA (lpString="*.cdr") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.dwg") returned 0
	[0078.268] lstrlenA (lpString="*.dwg") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.max") returned 0
	[0078.268] lstrlenA (lpString="*.max") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.bmp") returned 0
	[0078.268] lstrlenA (lpString="*.bmp") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.gif") returned 0
	[0078.268] lstrlenA (lpString="*.gif") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.png") returned 0
	[0078.268] lstrlenA (lpString="*.png") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.doc") returned 0
	[0078.268] lstrlenA (lpString="*.doc") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.docx") returned 0
	[0078.268] lstrlenA (lpString="*.docx") returned 6
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.xls") returned 0
	[0078.268] lstrlenA (lpString="*.xls") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.xlsx") returned 0
	[0078.268] lstrlenA (lpString="*.xlsx") returned 6
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.ppt") returned 0
	[0078.268] lstrlenA (lpString="*.ppt") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.pptx") returned 0
	[0078.268] lstrlenA (lpString="*.pptx") returned 6
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.txt") returned 0
	[0078.268] lstrlenA (lpString="*.txt") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.pdf") returned 0
	[0078.268] lstrlenA (lpString="*.pdf") returned 5
	[0078.268] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.djvu") returned 0
	[0078.269] lstrlenA (lpString="*.djvu") returned 6
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.htm") returned 0
	[0078.269] lstrlenA (lpString="*.htm") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.html") returned 0
	[0078.269] lstrlenA (lpString="*.html") returned 6
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mdb") returned 0
	[0078.269] lstrlenA (lpString="*.mdb") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.cer") returned 0
	[0078.269] lstrlenA (lpString="*.cer") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.p12") returned 0
	[0078.269] lstrlenA (lpString="*.p12") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.pfx") returned 0
	[0078.269] lstrlenA (lpString="*.pfx") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.kwm") returned 0
	[0078.269] lstrlenA (lpString="*.kwm") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.pwm") returned 0
	[0078.269] lstrlenA (lpString="*.pwm") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.1cd") returned 0
	[0078.269] lstrlenA (lpString="*.1cd") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.md") returned 0
	[0078.269] lstrlenA (lpString="*.md") returned 4
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mdf") returned 0
	[0078.269] lstrlenA (lpString="*.mdf") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.dbf") returned 0
	[0078.269] lstrlenA (lpString="*.dbf") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.odt") returned 0
	[0078.269] lstrlenA (lpString="*.odt") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.vob") returned 0
	[0078.269] lstrlenA (lpString="*.vob") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.ifo") returned 0
	[0078.269] lstrlenA (lpString="*.ifo") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.lnk") returned 0
	[0078.269] lstrlenA (lpString="*.lnk") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.torrent") returned 0
	[0078.269] lstrlenA (lpString="*.torrent") returned 9
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mov") returned 0
	[0078.269] lstrlenA (lpString="*.mov") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.m2v") returned 0
	[0078.269] lstrlenA (lpString="*.m2v") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.3gp") returned 0
	[0078.269] lstrlenA (lpString="*.3gp") returned 5
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mpeg") returned 0
	[0078.269] lstrlenA (lpString="*.mpeg") returned 6
	[0078.269] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mpg") returned 0
	[0078.270] lstrlenA (lpString="*.mpg") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.flv") returned 0
	[0078.270] lstrlenA (lpString="*.flv") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.avi") returned 0
	[0078.270] lstrlenA (lpString="*.avi") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mp4") returned 0
	[0078.270] lstrlenA (lpString="*.mp4") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.wmv") returned 0
	[0078.270] lstrlenA (lpString="*.wmv") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.divx") returned 0
	[0078.270] lstrlenA (lpString="*.divx") returned 6
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mkv") returned 0
	[0078.270] lstrlenA (lpString="*.mkv") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.mp3") returned 0
	[0078.270] lstrlenA (lpString="*.mp3") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.wav") returned 0
	[0078.270] lstrlenA (lpString="*.wav") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.flac") returned 0
	[0078.270] lstrlenA (lpString="*.flac") returned 6
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.ape") returned 0
	[0078.270] lstrlenA (lpString="*.ape") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.wma") returned 0
	[0078.270] lstrlenA (lpString="*.wma") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.ac3") returned 0
	[0078.270] lstrlenA (lpString="*.ac3") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.exe") returned 0
	[0078.270] lstrlenA (lpString="*.exe") returned 5
	[0078.270] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui", pszSpec="*.apk") returned 0
	[0078.270] lstrlenA (lpString="*.apk") returned 5
	[0078.270] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.270] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.270] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.270] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpAsDesc.dll") returned -1
	[0078.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpAsDesc.dll") returned -1
	[0078.270] lstrcmpiA (lpString1="", lpString2="MpAsDesc.dll") returned -1
	[0078.270] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\*.*") returned="*.*"
	[0078.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.270] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0xffffffff
	[0078.271] CreateFileA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0078.271] lstrlenA (lpString="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754") returned 294
	[0078.271] WriteFile (in: hFile=0x84, lpBuffer=0x8b4b08*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x8b4b08*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1
	[0078.272] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.272] CloseHandle (hObject=0x84) returned 1
	[0078.272] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpAsDesc.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpAsDesc.dll") returned="C:\\Program Files\\Windows Defender\\MpAsDesc.dll"
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.zip") returned 0
	[0078.272] lstrlenA (lpString="*.zip") returned 5
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.rar") returned 0
	[0078.272] lstrlenA (lpString="*.rar") returned 5
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.7z") returned 0
	[0078.272] lstrlenA (lpString="*.7z") returned 4
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.tar") returned 0
	[0078.272] lstrlenA (lpString="*.tar") returned 5
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.gzip") returned 0
	[0078.272] lstrlenA (lpString="*.gzip") returned 6
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.jpg") returned 0
	[0078.272] lstrlenA (lpString="*.jpg") returned 5
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.jpeg") returned 0
	[0078.272] lstrlenA (lpString="*.jpeg") returned 6
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.psd") returned 0
	[0078.272] lstrlenA (lpString="*.psd") returned 5
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.cdr") returned 0
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.dwg") returned 0
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.max") returned 0
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.bmp") returned 0
	[0078.272] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.gif") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.png") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.doc") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.docx") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.xls") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.xlsx") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.ppt") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.pptx") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.txt") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.pdf") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.djvu") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.htm") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.html") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mdb") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.cer") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.p12") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.pfx") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.kwm") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.pwm") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.1cd") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.md") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mdf") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.dbf") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.odt") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.vob") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.ifo") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.lnk") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.torrent") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mov") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.m2v") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.3gp") returned 0
	[0078.273] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mpeg") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mpg") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.flv") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.avi") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mp4") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.wmv") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.divx") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mkv") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.mp3") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.wav") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.flac") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.ape") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.wma") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.ac3") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.exe") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpAsDesc.dll", pszSpec="*.apk") returned 0
	[0078.274] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.274] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpClient.dll") returned -1
	[0078.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpClient.dll") returned -1
	[0078.274] lstrcmpiA (lpString1="", lpString2="MpClient.dll") returned -1
	[0078.274] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpAsDesc.dll") returned="MpAsDesc.dll"
	[0078.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.274] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.274] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpClient.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpClient.dll") returned="C:\\Program Files\\Windows Defender\\MpClient.dll"
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.zip") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.rar") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.7z") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.tar") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.gzip") returned 0
	[0078.274] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.jpg") returned 0
	[0078.275] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.jpeg") returned 0
	[0078.275] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.psd") returned 0
	[0078.275] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.cdr") returned 0
	[0078.275] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.dwg") returned 0
	[0078.275] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.max") returned 0
	[0078.275] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.bmp") returned 0
	[0078.275] PathMatchSpecA (pszFile="C:\\Program Files\\Windows Defender\\MpClient.dll", pszSpec="*.gif") returned 0
	[0078.275] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.275] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.275] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpCmdRun.exe") returned -1
	[0078.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpCmdRun.exe") returned -1
	[0078.275] lstrcmpiA (lpString1="", lpString2="MpCmdRun.exe") returned -1
	[0078.275] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpClient.dll") returned="MpClient.dll"
	[0078.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.275] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.275] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.275] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.275] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpCmdRun.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned="C:\\Program Files\\Windows Defender\\MpCmdRun.exe"
	[0078.275] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Defender\\MpCmdRun.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned="C:\\Program Files\\Windows Defender\\MpCmdRun.exe"
	[0078.275] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Defender\\MpCmdRun.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned="C:\\Program Files\\Windows Defender\\MpCmdRun.exe"
	[0078.275] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe", lpString2="." | out: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe.") returned="C:\\Program Files\\Windows Defender\\MpCmdRun.exe."
	[0078.275] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe.Boom") returned="C:\\Program Files\\Windows Defender\\MpCmdRun.exe.Boom"
	[0078.275] CreateFileA (lpFileName="C:\\Program Files\\Windows Defender\\MpCmdRun.exe" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.276] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.276] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.276] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpCommu.dll") returned -1
	[0078.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpCommu.dll") returned -1
	[0078.276] lstrcmpiA (lpString1="", lpString2="MpCommu.dll") returned -1
	[0078.276] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned="MpCmdRun.exe"
	[0078.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.276] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.276] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.276] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpCommu.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpCommu.dll") returned="C:\\Program Files\\Windows Defender\\MpCommu.dll"
	[0078.277] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.277] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpEvMsg.dll") returned -1
	[0078.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpEvMsg.dll") returned -1
	[0078.277] lstrcmpiA (lpString1="", lpString2="MpEvMsg.dll") returned -1
	[0078.277] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpCommu.dll") returned="MpCommu.dll"
	[0078.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.277] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.277] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.277] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpEvMsg.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpEvMsg.dll") returned="C:\\Program Files\\Windows Defender\\MpEvMsg.dll"
	[0078.277] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.277] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpOAV.dll") returned -1
	[0078.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpOAV.dll") returned -1
	[0078.277] lstrcmpiA (lpString1="", lpString2="MpOAV.dll") returned -1
	[0078.277] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpEvMsg.dll") returned="MpEvMsg.dll"
	[0078.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.277] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.277] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.277] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpOAV.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpOAV.dll") returned="C:\\Program Files\\Windows Defender\\MpOAV.dll"
	[0078.277] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.277] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.277] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpRTP.dll") returned -1
	[0078.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpRTP.dll") returned -1
	[0078.277] lstrcmpiA (lpString1="", lpString2="MpRTP.dll") returned -1
	[0078.277] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpOAV.dll") returned="MpOAV.dll"
	[0078.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.277] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.278] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.280] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpRTP.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpRTP.dll") returned="C:\\Program Files\\Windows Defender\\MpRTP.dll"
	[0078.280] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.280] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpSvc.dll") returned -1
	[0078.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpSvc.dll") returned -1
	[0078.280] lstrcmpiA (lpString1="", lpString2="MpSvc.dll") returned -1
	[0078.280] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpRTP.dll") returned="MpRTP.dll"
	[0078.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.280] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.280] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.280] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpSvc.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpSvc.dll") returned="C:\\Program Files\\Windows Defender\\MpSvc.dll"
	[0078.280] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.280] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSASCui.exe") returned -1
	[0078.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSASCui.exe") returned -1
	[0078.280] lstrcmpiA (lpString1="", lpString2="MSASCui.exe") returned -1
	[0078.280] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpSvc.dll") returned="MpSvc.dll"
	[0078.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.280] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.280] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.280] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MSASCui.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned="C:\\Program Files\\Windows Defender\\MSASCui.exe"
	[0078.280] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Defender\\MSASCui.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned="C:\\Program Files\\Windows Defender\\MSASCui.exe"
	[0078.280] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Defender\\MSASCui.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned="C:\\Program Files\\Windows Defender\\MSASCui.exe"
	[0078.281] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe", lpString2="." | out: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe.") returned="C:\\Program Files\\Windows Defender\\MSASCui.exe."
	[0078.281] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe.Boom") returned="C:\\Program Files\\Windows Defender\\MSASCui.exe.Boom"
	[0078.281] CreateFileA (lpFileName="C:\\Program Files\\Windows Defender\\MSASCui.exe" (normalized: "c:\\program files\\windows defender\\msascui.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.281] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.281] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MsMpCom.dll") returned -1
	[0078.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MsMpCom.dll") returned -1
	[0078.281] lstrcmpiA (lpString1="", lpString2="MsMpCom.dll") returned -1
	[0078.281] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned="MSASCui.exe"
	[0078.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.281] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.281] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MsMpCom.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MsMpCom.dll") returned="C:\\Program Files\\Windows Defender\\MsMpCom.dll"
	[0078.281] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.281] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MsMpLics.dll") returned -1
	[0078.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MsMpLics.dll") returned -1
	[0078.281] lstrcmpiA (lpString1="", lpString2="MsMpLics.dll") returned -1
	[0078.281] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpCom.dll") returned="MsMpCom.dll"
	[0078.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.281] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.281] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MsMpLics.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MsMpLics.dll") returned="C:\\Program Files\\Windows Defender\\MsMpLics.dll"
	[0078.281] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.282] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MsMpRes.dll") returned -1
	[0078.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MsMpRes.dll") returned -1
	[0078.282] lstrcmpiA (lpString1="", lpString2="MsMpRes.dll") returned -1
	[0078.282] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpLics.dll") returned="MsMpLics.dll"
	[0078.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.282] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.282] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.282] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MsMpRes.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MsMpRes.dll") returned="C:\\Program Files\\Windows Defender\\MsMpRes.dll"
	[0078.282] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.282] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.282] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="puzzle-mechanics.exe") returned -1
	[0078.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="puzzle-mechanics.exe") returned -1
	[0078.282] lstrcmpiA (lpString1="", lpString2="puzzle-mechanics.exe") returned -1
	[0078.282] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpRes.dll") returned="MsMpRes.dll"
	[0078.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\"
	[0078.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned=""
	[0078.282] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt"
	[0078.282] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows defender\\how to decrypt files.txt")) returned 0x20
	[0078.282] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="puzzle-mechanics.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe") returned="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe"
	[0078.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe") returned="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe"
	[0078.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe") returned="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe"
	[0078.282] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe", lpString2="." | out: lpString1="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe.") returned="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe."
	[0078.282] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe.", lpString2="Boom" | out: lpString1="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe.Boom") returned="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe.Boom"
	[0078.282] CreateFileA (lpFileName="C:\\Program Files\\Windows Defender\\puzzle-mechanics.exe" (normalized: "c:\\program files\\windows defender\\puzzle-mechanics.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.282] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.283] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.283] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.283] lstrcmpA (lpString1=".", lpString2="Windows Journal") returned -1
	[0078.283] lstrcmpA (lpString1="..", lpString2="Windows Journal") returned -1
	[0078.283] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.283] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Journal" | out: lpString1="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal"
	[0078.283] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.284] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.284] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.284] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.284] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.284] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.284] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.284] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.284] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\*.*") returned="*.*"
	[0078.284] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US"
	[0078.284] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.293] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.293] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.293] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.293] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.293] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.293] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.293] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JNTFiltr.dll.mui") returned -1
	[0078.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JNTFiltr.dll.mui") returned -1
	[0078.293] lstrcmpiA (lpString1="", lpString2="JNTFiltr.dll.mui") returned -1
	[0078.293] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\*.*") returned="*.*"
	[0078.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\"
	[0078.293] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned=""
	[0078.293] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.293] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt")) returned 0xffffffff
	[0078.293] CreateFileA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88
	[0078.296] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.296] CloseHandle (hObject=0x88) returned 1
	[0078.296] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="JNTFiltr.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui"
	[0078.296] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.296] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.296] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jnwdui.dll.mui") returned -1
	[0078.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jnwdui.dll.mui") returned -1
	[0078.296] lstrcmpiA (lpString1="", lpString2="jnwdui.dll.mui") returned -1
	[0078.296] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui") returned="JNTFiltr.dll.mui"
	[0078.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\"
	[0078.296] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned=""
	[0078.296] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.296] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.296] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="jnwdui.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui"
	[0078.296] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.296] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.296] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jnwmon.dll.mui") returned -1
	[0078.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jnwmon.dll.mui") returned -1
	[0078.296] lstrcmpiA (lpString1="", lpString2="jnwmon.dll.mui") returned -1
	[0078.296] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui") returned="jnwdui.dll.mui"
	[0078.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\"
	[0078.296] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned=""
	[0078.296] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.296] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="jnwmon.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui"
	[0078.297] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.297] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.297] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Journal.exe.mui") returned -1
	[0078.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Journal.exe.mui") returned -1
	[0078.297] lstrcmpiA (lpString1="", lpString2="Journal.exe.mui") returned -1
	[0078.297] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui") returned="jnwmon.dll.mui"
	[0078.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\"
	[0078.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned=""
	[0078.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.297] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="Journal.exe.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui"
	[0078.297] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.297] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.297] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPVWCTL.DLL.mui") returned -1
	[0078.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPVWCTL.DLL.mui") returned -1
	[0078.297] lstrcmpiA (lpString1="", lpString2="MSPVWCTL.DLL.mui") returned -1
	[0078.297] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui") returned="Journal.exe.mui"
	[0078.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\"
	[0078.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned=""
	[0078.298] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.298] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.298] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="MSPVWCTL.DLL.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui"
	[0078.298] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.298] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.298] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NBMapTIP.dll.mui") returned -1
	[0078.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NBMapTIP.dll.mui") returned -1
	[0078.298] lstrcmpiA (lpString1="", lpString2="NBMapTIP.dll.mui") returned -1
	[0078.298] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui") returned="MSPVWCTL.DLL.mui"
	[0078.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\"
	[0078.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned=""
	[0078.299] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.299] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="NBMapTIP.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui"
	[0078.299] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.299] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PDIALOG.exe.mui") returned -1
	[0078.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIALOG.exe.mui") returned -1
	[0078.299] lstrcmpiA (lpString1="", lpString2="PDIALOG.exe.mui") returned -1
	[0078.299] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui") returned="NBMapTIP.dll.mui"
	[0078.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\"
	[0078.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned=""
	[0078.299] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt"
	[0078.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\en-us\\how to decrypt files.txt")) returned 0x20
	[0078.299] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="PDIALOG.exe.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui"
	[0078.299] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.299] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.299] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.299] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.299] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkSeg.dll") returned -1
	[0078.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkSeg.dll") returned -1
	[0078.299] lstrcmpiA (lpString1="", lpString2="InkSeg.dll") returned -1
	[0078.299] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\*.*") returned="*.*"
	[0078.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\"
	[0078.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned=""
	[0078.299] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt"
	[0078.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt")) returned 0xffffffff
	[0078.299] CreateFileA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84
	[0078.304] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.304] CloseHandle (hObject=0x84) returned 1
	[0078.304] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="InkSeg.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\InkSeg.dll") returned="C:\\Program Files\\Windows Journal\\InkSeg.dll"
	[0078.305] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.305] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.305] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JNTFiltr.dll") returned -1
	[0078.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JNTFiltr.dll") returned -1
	[0078.305] lstrcmpiA (lpString1="", lpString2="JNTFiltr.dll") returned -1
	[0078.305] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\InkSeg.dll") returned="InkSeg.dll"
	[0078.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\"
	[0078.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned=""
	[0078.305] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt"
	[0078.305] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt")) returned 0x20
	[0078.305] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="JNTFiltr.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\JNTFiltr.dll") returned="C:\\Program Files\\Windows Journal\\JNTFiltr.dll"
	[0078.305] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.305] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.305] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JNWDRV.dll") returned -1
	[0078.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JNWDRV.dll") returned -1
	[0078.305] lstrcmpiA (lpString1="", lpString2="JNWDRV.dll") returned -1
	[0078.305] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\JNTFiltr.dll") returned="JNTFiltr.dll"
	[0078.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\"
	[0078.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned=""
	[0078.305] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt"
	[0078.305] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt")) returned 0x20
	[0078.305] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="JNWDRV.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\JNWDRV.dll") returned="C:\\Program Files\\Windows Journal\\JNWDRV.dll"
	[0078.305] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.305] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.305] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jnwdui.dll") returned -1
	[0078.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jnwdui.dll") returned -1
	[0078.305] lstrcmpiA (lpString1="", lpString2="jnwdui.dll") returned -1
	[0078.305] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\JNWDRV.dll") returned="JNWDRV.dll"
	[0078.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\"
	[0078.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned=""
	[0078.305] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt"
	[0078.306] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt")) returned 0x20
	[0078.306] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="jnwdui.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\jnwdui.dll") returned="C:\\Program Files\\Windows Journal\\jnwdui.dll"
	[0078.306] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.306] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.306] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jnwmon.dll") returned -1
	[0078.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jnwmon.dll") returned -1
	[0078.306] lstrcmpiA (lpString1="", lpString2="jnwmon.dll") returned -1
	[0078.306] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwdui.dll") returned="jnwdui.dll"
	[0078.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\"
	[0078.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned=""
	[0078.306] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt"
	[0078.306] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt")) returned 0x20
	[0078.306] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="jnwmon.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\jnwmon.dll") returned="C:\\Program Files\\Windows Journal\\jnwmon.dll"
	[0078.306] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.306] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.306] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jnwppr.dll") returned -1
	[0078.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jnwppr.dll") returned -1
	[0078.306] lstrcmpiA (lpString1="", lpString2="jnwppr.dll") returned -1
	[0078.306] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwmon.dll") returned="jnwmon.dll"
	[0078.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\"
	[0078.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned=""
	[0078.306] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt"
	[0078.306] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt")) returned 0x20
	[0078.306] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="jnwppr.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\jnwppr.dll") returned="C:\\Program Files\\Windows Journal\\jnwppr.dll"
	[0078.306] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.306] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.306] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Journal.exe") returned -1
	[0078.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Journal.exe") returned -1
	[0078.306] lstrcmpiA (lpString1="", lpString2="Journal.exe") returned -1
	[0078.306] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwppr.dll") returned="jnwppr.dll"
	[0078.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\"
	[0078.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned=""
	[0078.307] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt"
	[0078.307] GetFileAttributesA (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\windows journal\\how to decrypt files.txt")) returned 0x20
	[0078.307] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="Journal.exe" | out: lpString1="C:\\Program Files\\Windows Journal\\Journal.exe") returned="C:\\Program Files\\Windows Journal\\Journal.exe"
	[0078.309] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.309] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.309] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPVWCTL.DLL") returned -1
	[0078.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPVWCTL.DLL") returned -1
	[0078.309] lstrcmpiA (lpString1="", lpString2="MSPVWCTL.DLL") returned -1
	[0078.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Journal.exe") returned="Journal.exe"
	[0078.310] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.310] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.310] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NBDoc.DLL") returned -1
	[0078.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NBDoc.DLL") returned -1
	[0078.310] lstrcmpiA (lpString1="", lpString2="NBDoc.DLL") returned -1
	[0078.310] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL") returned="MSPVWCTL.DLL"
	[0078.310] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.310] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.310] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NBMapTIP.dll") returned -1
	[0078.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NBMapTIP.dll") returned -1
	[0078.310] lstrcmpiA (lpString1="", lpString2="NBMapTIP.dll") returned -1
	[0078.310] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\NBDoc.DLL") returned="NBDoc.DLL"
	[0078.310] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.310] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.310] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PDIALOG.exe") returned -1
	[0078.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIALOG.exe") returned -1
	[0078.310] lstrcmpiA (lpString1="", lpString2="PDIALOG.exe") returned -1
	[0078.310] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\NBMapTIP.dll") returned="NBMapTIP.dll"
	[0078.339] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.339] lstrcmpA (lpString1=".", lpString2="Templates") returned -1
	[0078.339] lstrcmpA (lpString1="..", lpString2="Templates") returned -1
	[0078.339] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\PDIALOG.exe") returned="PDIALOG.exe"
	[0078.339] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="Templates" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates"
	[0078.339] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.377] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.377] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.377] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.378] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.378] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.378] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.378] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="blank.jtp") returned 1
	[0078.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="blank.jtp") returned 1
	[0078.378] lstrcmpiA (lpString1="", lpString2="blank.jtp") returned -1
	[0078.378] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\*.*") returned="*.*"
	[0078.379] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.379] CloseHandle (hObject=0x88) returned 1
	[0078.379] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="blank.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp"
	[0078.379] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.379] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.379] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Dotted_Line.jtp") returned 1
	[0078.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dotted_Line.jtp") returned 1
	[0078.379] lstrcmpiA (lpString1="", lpString2="Dotted_Line.jtp") returned -1
	[0078.379] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp") returned="blank.jtp"
	[0078.380] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.380] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.380] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Genko_1.jtp") returned -1
	[0078.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_1.jtp") returned 1
	[0078.380] lstrcmpiA (lpString1="", lpString2="Genko_1.jtp") returned -1
	[0078.380] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp") returned="Dotted_Line.jtp"
	[0078.380] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.380] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.380] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Genko_2.jtp") returned -1
	[0078.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_2.jtp") returned 1
	[0078.380] lstrcmpiA (lpString1="", lpString2="Genko_2.jtp") returned -1
	[0078.380] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp") returned="Genko_1.jtp"
	[0078.380] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.380] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.380] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Graph.jtp") returned -1
	[0078.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Graph.jtp") returned 1
	[0078.380] lstrcmpiA (lpString1="", lpString2="Graph.jtp") returned -1
	[0078.380] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp") returned="Genko_2.jtp"
	[0078.380] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.380] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.380] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Memo.jtp") returned -1
	[0078.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Memo.jtp") returned -1
	[0078.380] lstrcmpiA (lpString1="", lpString2="Memo.jtp") returned -1
	[0078.380] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp") returned="Graph.jtp"
	[0078.380] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.380] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.380] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Month_Calendar.jtp") returned -1
	[0078.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Month_Calendar.jtp") returned -1
	[0078.380] lstrcmpiA (lpString1="", lpString2="Month_Calendar.jtp") returned -1
	[0078.380] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp") returned="Memo.jtp"
	[0078.381] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.381] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.381] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Music.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Music.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="", lpString2="Music.jtp") returned -1
	[0078.381] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp") returned="Month_Calendar.jtp"
	[0078.381] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.381] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.381] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Seyes.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Seyes.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="", lpString2="Seyes.jtp") returned -1
	[0078.381] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp") returned="Music.jtp"
	[0078.381] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.381] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.381] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shorthand.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shorthand.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="", lpString2="Shorthand.jtp") returned -1
	[0078.381] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp") returned="Seyes.jtp"
	[0078.381] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.381] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.381] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="To_Do_List.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="To_Do_List.jtp") returned -1
	[0078.381] lstrcmpiA (lpString1="", lpString2="To_Do_List.jtp") returned -1
	[0078.381] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp") returned="Shorthand.jtp"
	[0078.381] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.381] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.381] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.381] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.381] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.381] lstrcmpA (lpString1=".", lpString2="Windows Mail") returned -1
	[0078.382] lstrcmpA (lpString1="..", lpString2="Windows Mail") returned -1
	[0078.382] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.382] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Mail" | out: lpString1="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail"
	[0078.382] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.384] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.384] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.384] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.384] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.384] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.384] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.384] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.384] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\*.*") returned="*.*"
	[0078.384] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US"
	[0078.384] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.384] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.384] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.384] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.384] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.384] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.384] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.384] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msoeres.dll.mui") returned -1
	[0078.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msoeres.dll.mui") returned -1
	[0078.385] lstrcmpiA (lpString1="", lpString2="msoeres.dll.mui") returned -1
	[0078.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\en-US\\*.*") returned="*.*"
	[0078.385] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.385] CloseHandle (hObject=0x88) returned 1
	[0078.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\en-US\\", lpString2="msoeres.dll.mui" | out: lpString1="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui") returned="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui"
	[0078.386] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.386] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WinMail.exe.mui") returned -1
	[0078.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WinMail.exe.mui") returned -1
	[0078.386] lstrcmpiA (lpString1="", lpString2="WinMail.exe.mui") returned -1
	[0078.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui") returned="msoeres.dll.mui"
	[0078.386] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.386] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.386] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.386] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.386] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msoe.dll") returned -1
	[0078.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msoe.dll") returned -1
	[0078.386] lstrcmpiA (lpString1="", lpString2="msoe.dll") returned -1
	[0078.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\*.*") returned="*.*"
	[0078.387] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.387] CloseHandle (hObject=0x84) returned 1
	[0078.387] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="msoe.dll" | out: lpString1="C:\\Program Files\\Windows Mail\\msoe.dll") returned="C:\\Program Files\\Windows Mail\\msoe.dll"
	[0078.387] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.387] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOERES.dll") returned -1
	[0078.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOERES.dll") returned -1
	[0078.387] lstrcmpiA (lpString1="", lpString2="MSOERES.dll") returned -1
	[0078.387] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\msoe.dll") returned="msoe.dll"
	[0078.387] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.387] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oeimport.dll") returned -1
	[0078.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oeimport.dll") returned -1
	[0078.387] lstrcmpiA (lpString1="", lpString2="oeimport.dll") returned -1
	[0078.387] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\MSOERES.dll") returned="MSOERES.dll"
	[0078.387] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.387] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wab.exe") returned -1
	[0078.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab.exe") returned -1
	[0078.387] lstrcmpiA (lpString1="", lpString2="wab.exe") returned -1
	[0078.387] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\oeimport.dll") returned="oeimport.dll"
	[0078.408] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.408] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.408] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wabfind.dll") returned -1
	[0078.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wabfind.dll") returned -1
	[0078.408] lstrcmpiA (lpString1="", lpString2="wabfind.dll") returned -1
	[0078.408] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wab.exe") returned="wab.exe"
	[0078.408] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.408] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.408] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wabimp.dll") returned -1
	[0078.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wabimp.dll") returned -1
	[0078.408] lstrcmpiA (lpString1="", lpString2="wabimp.dll") returned -1
	[0078.408] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wabfind.dll") returned="wabfind.dll"
	[0078.408] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.408] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.408] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wabmig.exe") returned -1
	[0078.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wabmig.exe") returned -1
	[0078.408] lstrcmpiA (lpString1="", lpString2="wabmig.exe") returned -1
	[0078.408] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wabimp.dll") returned="wabimp.dll"
	[0078.409] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.410] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.410] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WinMail.exe") returned -1
	[0078.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WinMail.exe") returned -1
	[0078.410] lstrcmpiA (lpString1="", lpString2="WinMail.exe") returned -1
	[0078.410] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wabmig.exe") returned="wabmig.exe"
	[0078.410] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.410] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.410] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.410] lstrcmpA (lpString1=".", lpString2="Windows Media Player") returned -1
	[0078.410] lstrcmpA (lpString1="..", lpString2="Windows Media Player") returned -1
	[0078.410] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.410] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Media Player" | out: lpString1="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player"
	[0078.410] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.411] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.411] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.411] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.411] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.411] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.411] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.411] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.411] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*"
	[0078.411] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US") returned="C:\\Program Files\\Windows Media Player\\en-US"
	[0078.412] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.459] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.459] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.459] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.460] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.460] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.460] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mpvis.dll.mui") returned -1
	[0078.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mpvis.dll.mui") returned -1
	[0078.460] lstrcmpiA (lpString1="", lpString2="mpvis.dll.mui") returned -1
	[0078.460] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\*.*") returned="*.*"
	[0078.461] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.461] CloseHandle (hObject=0x88) returned 1
	[0078.461] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="mpvis.dll.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui"
	[0078.461] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.461] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="setup_wm.exe.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup_wm.exe.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="", lpString2="setup_wm.exe.mui") returned -1
	[0078.461] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui") returned="mpvis.dll.mui"
	[0078.461] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.461] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmlaunch.exe.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmlaunch.exe.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="", lpString2="wmlaunch.exe.mui") returned -1
	[0078.461] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui") returned="setup_wm.exe.mui"
	[0078.461] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.461] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WMPDMC.exe.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMPDMC.exe.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="", lpString2="WMPDMC.exe.mui") returned -1
	[0078.461] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui") returned="wmlaunch.exe.mui"
	[0078.461] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.461] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WMPDMCCore.dll.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMPDMCCore.dll.mui") returned -1
	[0078.461] lstrcmpiA (lpString1="", lpString2="WMPDMCCore.dll.mui") returned -1
	[0078.461] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui") returned="WMPDMC.exe.mui"
	[0078.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmplayer.exe.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmplayer.exe.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="", lpString2="wmplayer.exe.mui") returned -1
	[0078.462] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui") returned="WMPDMCCore.dll.mui"
	[0078.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WMPMediaSharing.dll.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMPMediaSharing.dll.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="", lpString2="WMPMediaSharing.dll.mui") returned -1
	[0078.462] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui") returned="wmplayer.exe.mui"
	[0078.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnetwk.exe.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnetwk.exe.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="", lpString2="wmpnetwk.exe.mui") returned -1
	[0078.462] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui") returned="WMPMediaSharing.dll.mui"
	[0078.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.462] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnscfg.exe.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnscfg.exe.mui") returned -1
	[0078.462] lstrcmpiA (lpString1="", lpString2="wmpnscfg.exe.mui") returned -1
	[0078.462] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui") returned="wmpnetwk.exe.mui"
	[0078.462] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.466] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnssci.dll.mui") returned -1
	[0078.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnssci.dll.mui") returned -1
	[0078.466] lstrcmpiA (lpString1="", lpString2="wmpnssci.dll.mui") returned -1
	[0078.466] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui") returned="wmpnscfg.exe.mui"
	[0078.466] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.466] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.466] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnssui.dll.mui") returned -1
	[0078.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnssui.dll.mui") returned -1
	[0078.466] lstrcmpiA (lpString1="", lpString2="wmpnssui.dll.mui") returned -1
	[0078.466] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui") returned="wmpnssci.dll.mui"
	[0078.466] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.466] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.466] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WMPSideShowGadget.exe.mui") returned -1
	[0078.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMPSideShowGadget.exe.mui") returned -1
	[0078.466] lstrcmpiA (lpString1="", lpString2="WMPSideShowGadget.exe.mui") returned -1
	[0078.466] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui") returned="wmpnssui.dll.mui"
	[0078.466] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.466] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.466] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.466] lstrcmpA (lpString1=".", lpString2="Icons") returned -1
	[0078.466] lstrcmpA (lpString1="..", lpString2="Icons") returned -1
	[0078.466] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*"
	[0078.470] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Icons" | out: lpString1="C:\\Program Files\\Windows Media Player\\Icons") returned="C:\\Program Files\\Windows Media Player\\Icons"
	[0078.470] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.470] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.470] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.470] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.470] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.470] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.470] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.470] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.470] lstrcmpA (lpString1=".", lpString2="Media Renderer") returned -1
	[0078.470] lstrcmpA (lpString1="..", lpString2="Media Renderer") returned -1
	[0078.470] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*"
	[0078.470] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Media Renderer" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer") returned="C:\\Program Files\\Windows Media Player\\Media Renderer"
	[0078.470] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.480] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.480] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.480] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.480] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.480] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.480] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="avtransport.xml") returned 1
	[0078.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="avtransport.xml") returned 1
	[0078.480] lstrcmpiA (lpString1="", lpString2="avtransport.xml") returned -1
	[0078.480] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\*.*") returned="*.*"
	[0078.481] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.481] CloseHandle (hObject=0x88) returned 1
	[0078.481] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="avtransport.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml"
	[0078.481] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.481] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="connectionmanager_dmr.xml") returned 1
	[0078.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="connectionmanager_dmr.xml") returned 1
	[0078.481] lstrcmpiA (lpString1="", lpString2="connectionmanager_dmr.xml") returned -1
	[0078.481] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml") returned="avtransport.xml"
	[0078.481] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.481] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DMR_120.jpg") returned 1
	[0078.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DMR_120.jpg") returned 1
	[0078.481] lstrcmpiA (lpString1="", lpString2="DMR_120.jpg") returned -1
	[0078.482] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml") returned="connectionmanager_dmr.xml"
	[0078.487] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.487] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.487] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DMR_120.png") returned 1
	[0078.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DMR_120.png") returned 1
	[0078.487] lstrcmpiA (lpString1="", lpString2="DMR_120.png") returned -1
	[0078.487] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg") returned="DMR_120.jpg"
	[0078.488] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.488] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.488] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DMR_48.jpg") returned 1
	[0078.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DMR_48.jpg") returned 1
	[0078.488] lstrcmpiA (lpString1="", lpString2="DMR_48.jpg") returned -1
	[0078.488] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png") returned="DMR_120.png"
	[0078.488] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.488] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.488] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DMR_48.png") returned 1
	[0078.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DMR_48.png") returned 1
	[0078.488] lstrcmpiA (lpString1="", lpString2="DMR_48.png") returned -1
	[0078.488] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg") returned="DMR_48.jpg"
	[0078.489] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.489] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.489] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RenderingControl.xml") returned -1
	[0078.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RenderingControl.xml") returned -1
	[0078.489] lstrcmpiA (lpString1="", lpString2="RenderingControl.xml") returned -1
	[0078.489] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png") returned="DMR_48.png"
	[0078.489] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.489] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.489] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.489] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.489] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mpvis.DLL") returned -1
	[0078.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mpvis.DLL") returned -1
	[0078.489] lstrcmpiA (lpString1="", lpString2="mpvis.DLL") returned -1
	[0078.489] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*"
	[0078.490] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.490] CloseHandle (hObject=0x84) returned 1
	[0078.490] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="mpvis.DLL" | out: lpString1="C:\\Program Files\\Windows Media Player\\mpvis.DLL") returned="C:\\Program Files\\Windows Media Player\\mpvis.DLL"
	[0078.490] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.490] lstrcmpA (lpString1=".", lpString2="Network Sharing") returned -1
	[0078.490] lstrcmpA (lpString1="..", lpString2="Network Sharing") returned -1
	[0078.490] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\mpvis.DLL") returned="mpvis.DLL"
	[0078.490] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Network Sharing" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing") returned="C:\\Program Files\\Windows Media Player\\Network Sharing"
	[0078.491] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.492] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.492] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.492] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.492] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.492] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.492] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.492] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ConnectionManager.xml") returned 1
	[0078.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ConnectionManager.xml") returned 1
	[0078.492] lstrcmpiA (lpString1="", lpString2="ConnectionManager.xml") returned -1
	[0078.492] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\*.*") returned="*.*"
	[0078.493] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.493] CloseHandle (hObject=0x88) returned 1
	[0078.493] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="ConnectionManager.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml"
	[0078.493] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.493] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.493] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ContentDirectory.xml") returned 1
	[0078.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContentDirectory.xml") returned 1
	[0078.494] lstrcmpiA (lpString1="", lpString2="ContentDirectory.xml") returned -1
	[0078.494] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml") returned="ConnectionManager.xml"
	[0078.494] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.494] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.494] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MediaReceiverRegistrar.xml") returned -1
	[0078.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MediaReceiverRegistrar.xml") returned -1
	[0078.494] lstrcmpiA (lpString1="", lpString2="MediaReceiverRegistrar.xml") returned -1
	[0078.494] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml") returned="ContentDirectory.xml"
	[0078.494] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.494] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.494] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnss_bw120.jpg") returned -1
	[0078.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnss_bw120.jpg") returned -1
	[0078.494] lstrcmpiA (lpString1="", lpString2="wmpnss_bw120.jpg") returned -1
	[0078.494] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml") returned="MediaReceiverRegistrar.xml"
	[0078.495] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.495] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.495] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnss_bw120.png") returned -1
	[0078.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnss_bw120.png") returned -1
	[0078.495] lstrcmpiA (lpString1="", lpString2="wmpnss_bw120.png") returned -1
	[0078.495] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg") returned="wmpnss_bw120.jpg"
	[0078.495] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.495] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.495] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnss_bw32.bmp") returned -1
	[0078.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnss_bw32.bmp") returned -1
	[0078.495] lstrcmpiA (lpString1="", lpString2="wmpnss_bw32.bmp") returned -1
	[0078.495] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png") returned="wmpnss_bw120.png"
	[0078.501] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.501] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.501] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnss_bw32.jpg") returned -1
	[0078.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnss_bw32.jpg") returned -1
	[0078.501] lstrcmpiA (lpString1="", lpString2="wmpnss_bw32.jpg") returned -1
	[0078.501] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp") returned="wmpnss_bw32.bmp"
	[0078.501] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.501] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.501] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wmpnss_bw48.bmp") returned -1
	[0078.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmpnss_bw48.bmp") returned -1
	[0078.501] lstrcmpiA (lpString1="", lpString2="wmpnss_bw48.bmp") returned -1
	[0078.501] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg") returned="wmpnss_bw32.jpg"
	[0078.501] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.501] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.502] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp") returned="wmpnss_bw48.bmp"
	[0078.502] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.502] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.502] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg") returned="wmpnss_bw48.jpg"
	[0078.503] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.503] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.503] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png") returned="wmpnss_bw48.png"
	[0078.503] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.503] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.503] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg") returned="wmpnss_color120.jpg"
	[0078.503] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.503] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.503] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png") returned="wmpnss_color120.png"
	[0078.503] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.503] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.503] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp") returned="wmpnss_color32.bmp"
	[0078.504] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.504] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.504] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg") returned="wmpnss_color32.jpg"
	[0078.504] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.504] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.504] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp") returned="wmpnss_color48.bmp"
	[0078.504] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.504] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.504] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg") returned="wmpnss_color48.jpg"
	[0078.505] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.505] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.505] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.505] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.505] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*"
	[0078.505] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.505] lstrcmpA (lpString1=".", lpString2="Skins") returned -1
	[0078.505] lstrcmpA (lpString1="..", lpString2="Skins") returned -1
	[0078.505] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\setup_wm.exe") returned="setup_wm.exe"
	[0078.505] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Skins" | out: lpString1="C:\\Program Files\\Windows Media Player\\Skins") returned="C:\\Program Files\\Windows Media Player\\Skins"
	[0078.505] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.506] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.506] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.506] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.506] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.506] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.506] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.506] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Skins\\*.*") returned="*.*"
	[0078.507] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.507] CloseHandle (hObject=0x88) returned 1
	[0078.508] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Skins\\", lpString2="Revert.wmz" | out: lpString1="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz") returned="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz"
	[0078.508] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.508] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.508] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.508] lstrcmpA (lpString1=".", lpString2="Visualizations") returned -1
	[0078.508] lstrcmpA (lpString1="..", lpString2="Visualizations") returned -1
	[0078.508] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*"
	[0078.508] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Visualizations" | out: lpString1="C:\\Program Files\\Windows Media Player\\Visualizations") returned="C:\\Program Files\\Windows Media Player\\Visualizations"
	[0078.508] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.508] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.508] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.508] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.508] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.508] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.508] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.509] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.509] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.509] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*"
	[0078.509] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.509] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.509] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmlaunch.exe") returned="wmlaunch.exe"
	[0078.509] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.509] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.509] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpconfig.exe") returned="wmpconfig.exe"
	[0078.509] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.509] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.509] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPDMC.exe") returned="WMPDMC.exe"
	[0078.510] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.510] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.510] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll") returned="WMPDMCCore.dll"
	[0078.510] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.510] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.510] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpenc.exe") returned="wmpenc.exe"
	[0078.510] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.510] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.510] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmplayer.exe") returned="wmplayer.exe"
	[0078.510] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.510] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.510] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll") returned="WMPMediaSharing.dll"
	[0078.511] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.511] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.511] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe") returned="wmpnetwk.exe"
	[0078.511] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.511] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.511] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe") returned="wmpnscfg.exe"
	[0078.511] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.511] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.511] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpnssci.dll") returned="wmpnssci.dll"
	[0078.511] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.511] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.511] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll") returned="WMPNSSUI.dll"
	[0078.512] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.512] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.512] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmprph.exe") returned="wmprph.exe"
	[0078.512] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.512] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.512] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpshare.exe") returned="wmpshare.exe"
	[0078.513] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0
	[0078.513] FindClose (in: hFindFile=0x8b7de8 | out: hFindFile=0x8b7de8) returned 1
	[0078.513] FindNextFileA (in: hFindFile=0x8b92d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 1
	[0078.513] lstrcmpA (lpString1=".", lpString2="Windows NT") returned -1
	[0078.513] lstrcmpA (lpString1="..", lpString2="Windows NT") returned -1
	[0078.513] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.513] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows NT" | out: lpString1="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT"
	[0078.513] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.514] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.514] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.514] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.514] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.514] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.514] lstrcmpA (lpString1=".", lpString2="Accessories") returned -1
	[0078.514] lstrcmpA (lpString1="..", lpString2="Accessories") returned -1
	[0078.514] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\*.*") returned="*.*"
	[0078.514] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\", lpString2="Accessories" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories") returned="C:\\Program Files\\Windows NT\\Accessories"
	[0078.514] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.514] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.514] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.514] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.514] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.514] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.514] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.514] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.514] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\*.*") returned="*.*"
	[0078.514] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\Accessories\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories\\en-US") returned="C:\\Program Files\\Windows NT\\Accessories\\en-US"
	[0078.515] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.518] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.518] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.518] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.518] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.518] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.518] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0078.518] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*.*") returned="*.*"
	[0078.519] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.520] CloseHandle (hObject=0x8c) returned 1
	[0078.520] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\Accessories\\en-US\\", lpString2="wordpad.exe.mui" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui") returned="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui"
	[0078.520] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.520] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.520] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.520] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.520] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\*.*") returned="*.*"
	[0078.523] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.523] CloseHandle (hObject=0x88) returned 1
	[0078.523] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\Accessories\\", lpString2="wordpad.exe" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe") returned="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe"
	[0078.523] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.524] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.524] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe") returned="wordpad.exe"
	[0078.524] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0
	[0078.524] FindClose (in: hFindFile=0x8b7e28 | out: hFindFile=0x8b7e28) returned 1
	[0078.524] FindNextFileA (in: hFindFile=0x8b7de8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 1
	[0078.524] lstrcmpA (lpString1=".", lpString2="TableTextService") returned -1
	[0078.524] lstrcmpA (lpString1="..", lpString2="TableTextService") returned -1
	[0078.524] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\*.*") returned="*.*"
	[0078.524] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\", lpString2="TableTextService" | out: lpString1="C:\\Program Files\\Windows NT\\TableTextService") returned="C:\\Program Files\\Windows NT\\TableTextService"
	[0078.524] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.526] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.526] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.526] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.526] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.526] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.526] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.526] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.526] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\*.*") returned="*.*"
	[0078.526] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\TableTextService\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows NT\\TableTextService\\en-US") returned="C:\\Program Files\\Windows NT\\TableTextService\\en-US"
	[0078.526] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.527] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.527] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.527] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.527] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.527] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 1
	[0078.527] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0078.527] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*.*") returned="*.*"
	[0078.528] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.528] CloseHandle (hObject=0x8c) returned 1
	[0078.528] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\", lpString2="TableTextService.dll.mui" | out: lpString1="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui") returned="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui"
	[0078.528] FindNextFileA (in: hFindFile=0x8b7e68, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0
	[0078.529] FindClose (in: hFindFile=0x8b7e68 | out: hFindFile=0x8b7e68) returned 1
	[0078.529] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.529] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.529] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\*.*") returned="*.*"
	[0078.530] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.530] CloseHandle (hObject=0x88) returned 1
	[0078.530] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\TableTextService\\", lpString2="TableTextService.dll" | out: lpString1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll") returned="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll"
	[0078.530] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.530] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.530] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll") returned="TableTextService.dll"
	[0078.531] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.531] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.531] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt") returned="TableTextServiceAmharic.txt"
	[0078.532] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.532] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.532] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt") returned="TableTextServiceArray.txt"
	[0078.532] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.532] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.532] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt") returned="TableTextServiceDaYi.txt"
	[0078.533] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.533] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.533] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt") returned="TableTextServiceSimplifiedQuanPin.txt"
	[0078.533] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.533] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.533] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt") returned="TableTextServiceSimplifiedShuangPin.txt"
	[0078.534] FindNextFileA (in: hFindFile=0x8b7e28, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 1
	[0078.534] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.534] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt") returned="TableTextServiceSimplifiedZhengMa.txt"
	[0078.539] lstrcmpA (lpString1=".", lpString2="Windows Photo Viewer") returned -1
	[0078.539] lstrcmpA (lpString1="..", lpString2="Windows Photo Viewer") returned -1
	[0078.539] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.539] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Photo Viewer" | out: lpString1="C:\\Program Files\\Windows Photo Viewer") returned="C:\\Program Files\\Windows Photo Viewer"
	[0078.539] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.541] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.541] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.541] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.541] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.541] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.541] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\*.*") returned="*.*"
	[0078.541] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.542] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.542] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.542] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.542] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.542] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*") returned="*.*"
	[0078.543] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.543] CloseHandle (hObject=0x88) returned 1
	[0078.543] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.543] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui") returned="ImagingDevices.exe.mui"
	[0078.543] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.543] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui") returned="PhotoAcq.dll.mui"
	[0078.543] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.543] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\*.*") returned="*.*"
	[0078.544] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.544] CloseHandle (hObject=0x84) returned 1
	[0078.545] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.545] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe") returned="ImagingDevices.exe"
	[0078.545] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.545] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll") returned="ImagingEngine.dll"
	[0078.545] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.545] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll") returned="PhotoAcq.dll"
	[0078.545] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.545] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\PhotoBase.dll") returned="PhotoBase.dll"
	[0078.545] lstrcmpA (lpString1=".", lpString2="Windows Portable Devices") returned -1
	[0078.546] lstrcmpA (lpString1="..", lpString2="Windows Portable Devices") returned -1
	[0078.546] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.546] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.546] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.546] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.546] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.546] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0
	[0078.546] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Portable Devices\\*.*") returned="*.*"
	[0078.547] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.547] CloseHandle (hObject=0x84) returned 1
	[0078.547] lstrcmpA (lpString1=".", lpString2="Windows Sidebar") returned -1
	[0078.547] lstrcmpA (lpString1="..", lpString2="Windows Sidebar") returned -1
	[0078.547] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*"
	[0078.547] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0078.548] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.548] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.548] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.548] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.549] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.549] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\*.*") returned="*.*"
	[0078.549] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.549] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.549] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.549] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.549] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.549] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\en-US\\*.*") returned="*.*"
	[0078.550] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.550] CloseHandle (hObject=0x88) returned 1
	[0078.550] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0
	[0078.550] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui") returned="sbdrop.dll.mui"
	[0078.550] lstrcmpA (lpString1=".", lpString2="Gadgets") returned -1
	[0078.550] lstrcmpA (lpString1="..", lpString2="Gadgets") returned -1
	[0078.550] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\*.*") returned="*.*"
	[0078.550] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0078.552] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.552] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.552] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.552] lstrcmpA (lpString1=".", lpString2="Calendar.Gadget") returned -1
	[0078.552] lstrcmpA (lpString1="..", lpString2="Calendar.Gadget") returned -1
	[0078.552] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*") returned="*.*"
	[0078.552] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0078.553] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.553] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.553] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.553] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0078.553] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*") returned="*.*"
	[0078.555] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.555] CloseHandle (hObject=0x8c) returned 1
	[0078.556] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0078.556] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0078.556] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png") returned="drag.png"
	[0078.557] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.557] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.557] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.557] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.557] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.557] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*") returned="*.*"
	[0078.558] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.558] CloseHandle (hObject=0x90) returned 1
	[0078.558] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0078.558] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0078.558] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html") returned="calendar.html"
	[0078.559] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0078.559] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.559] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.559] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.559] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0078.559] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*") returned="*.*"
	[0078.560] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.560] CloseHandle (hObject=0x94) returned 1
	[0078.560] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.560] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*") returned="*.*"
	[0078.560] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0078.560] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0078.560] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml") returned="gadget.xml"
	[0078.560] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0078.561] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.561] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.561] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.561] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0078.561] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*") returned="*.*"
	[0078.562] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.562] CloseHandle (hObject=0x94) returned 1
	[0078.562] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0078.562] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*") returned="*.*"
	[0078.562] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0078.562] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0078.562] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png") returned="icon.png"
	[0078.562] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0078.769] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0078.769] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0078.769] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0078.769] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.769] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*") returned="*.*"
	[0078.770] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0078.770] CloseHandle (hObject=0x90) returned 1
	[0078.771] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.771] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png") returned="bg-desk.png"
	[0078.772] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.772] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png") returned="bg-dock.png"
	[0078.772] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.772] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png") returned="bg-today.png"
	[0078.780] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.780] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png") returned="bNext-disable.png"
	[0078.781] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.781] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png") returned="bNext-down.png"
	[0078.781] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.781] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png") returned="bNext-hot.png"
	[0078.781] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.781] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png") returned="bNext.png"
	[0078.782] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.782] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png") returned="bPrev-disable.png"
	[0078.782] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.782] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png") returned="bPrev-down.png"
	[0078.783] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.783] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png") returned="bPrev-hot.png"
	[0078.783] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0078.783] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png") returned="bPrev.png"
	[0079.104] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.105] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png") returned="calendar_double.png"
	[0079.105] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.105] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png") returned="calendar_double_bkg.png"
	[0079.105] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.105] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png") returned="calendar_double_orange.png"
	[0079.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.106] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png") returned="calendar_ring_docked.png"
	[0079.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.106] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png") returned="calendar_single.png"
	[0079.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.106] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png") returned="calendar_single_bkg.png"
	[0079.107] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.107] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png") returned="calendar_single_bkg_orange.png"
	[0079.107] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.107] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png") returned="calendar_single_orange.png"
	[0079.108] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.108] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png") returned="corner.png"
	[0079.108] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.108] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png") returned="curl-hot.png"
	[0079.108] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.108] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png") returned="curl.png"
	[0079.109] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.109] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png") returned="month.png"
	[0079.109] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.109] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png") returned="rings-desk.png"
	[0079.109] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.109] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*") returned="*.*"
	[0079.110] lstrcmpA (lpString1=".", lpString2="Clock.Gadget") returned -1
	[0079.110] lstrcmpA (lpString1="..", lpString2="Clock.Gadget") returned -1
	[0079.110] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*") returned="*.*"
	[0079.110] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.111] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.111] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.111] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.111] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.111] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*") returned="*.*"
	[0079.113] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.113] CloseHandle (hObject=0x8c) returned 1
	[0079.113] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.113] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.113] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png") returned="drag.png"
	[0079.113] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.114] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.114] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.114] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.114] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.114] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*") returned="*.*"
	[0079.122] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.122] CloseHandle (hObject=0x90) returned 1
	[0079.123] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.123] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.123] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html") returned="clock.html"
	[0079.123] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.124] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.124] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.124] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.124] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.124] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*") returned="*.*"
	[0079.125] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.125] CloseHandle (hObject=0x94) returned 1
	[0079.125] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.125] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css") returned="clock.css"
	[0079.125] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.125] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*") returned="*.*"
	[0079.125] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.125] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.125] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml") returned="gadget.xml"
	[0079.125] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.126] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.126] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.126] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.126] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.126] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*") returned="*.*"
	[0079.127] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.127] CloseHandle (hObject=0x94) returned 1
	[0079.127] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.127] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js") returned="clock.js"
	[0079.127] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.127] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js") returned="settings.js"
	[0079.127] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.127] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*") returned="*.*"
	[0079.128] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.128] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*") returned="*.*"
	[0079.128] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0079.128] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0079.128] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png") returned="icon.png"
	[0079.128] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.212] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.212] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.212] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.212] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.213] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*") returned="*.*"
	[0079.214] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.214] CloseHandle (hObject=0x90) returned 1
	[0079.215] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.215] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png") returned="cronometer.png"
	[0079.215] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.215] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png") returned="cronometer_dot.png"
	[0079.216] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.216] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png") returned="cronometer_h.png"
	[0079.216] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.216] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png") returned="cronometer_m.png"
	[0079.217] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.217] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png") returned="cronometer_s.png"
	[0079.217] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.217] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png") returned="cronometer_settings.png"
	[0079.218] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.218] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png") returned="diner.png"
	[0079.218] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.218] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png") returned="diner_dot.png"
	[0079.219] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.219] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png") returned="diner_h.png"
	[0079.219] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.219] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png") returned="diner_m.png"
	[0079.220] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.220] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png") returned="diner_s.png"
	[0079.220] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.220] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png") returned="diner_settings.png"
	[0079.221] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.221] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png") returned="flower.png"
	[0079.221] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.221] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png") returned="flower_dot.png"
	[0079.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.222] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png") returned="flower_h.png"
	[0079.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.222] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png") returned="flower_m.png"
	[0079.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.223] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png") returned="flower_s.png"
	[0079.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.223] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png") returned="flower_settings.png"
	[0079.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.224] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png") returned="modern.png"
	[0079.224] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.224] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png") returned="modern_dot.png"
	[0079.224] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.225] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png") returned="modern_h.png"
	[0079.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.225] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png") returned="modern_m.png"
	[0079.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.225] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png") returned="modern_s.png"
	[0079.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.226] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png") returned="modern_settings.png"
	[0079.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.226] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png") returned="novelty.png"
	[0079.227] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.227] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png") returned="novelty_dot.png"
	[0079.227] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.227] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png") returned="novelty_h.png"
	[0079.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.228] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png") returned="novelty_m.png"
	[0079.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.229] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png") returned="novelty_s.png"
	[0079.229] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.229] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png") returned="novelty_settings.png"
	[0079.231] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.231] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png") returned="settings_box_bottom.png"
	[0079.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.232] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png") returned="settings_box_divider_left.png"
	[0079.235] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.235] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png") returned="settings_box_divider_right.png"
	[0079.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.236] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png") returned="settings_box_left.png"
	[0079.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.237] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png") returned="settings_box_right.png"
	[0079.238] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.238] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png") returned="settings_box_top.png"
	[0079.238] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.238] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png") returned="settings_corner_bottom_left.png"
	[0079.239] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.239] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png") returned="settings_corner_bottom_right.png"
	[0079.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.240] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png") returned="settings_corner_top_left.png"
	[0079.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.241] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png") returned="settings_corner_top_right.png"
	[0079.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.242] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png") returned="settings_divider.png"
	[0079.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.242] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png") returned="settings_divider_left.png"
	[0079.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.246] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.246] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.247] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.248] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.251] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.251] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.251] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.252] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.252] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.255] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.255] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.255] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.259] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.259] lstrcmpA (lpString1=".", lpString2="CPU.Gadget") returned -1
	[0079.259] lstrcmpA (lpString1="..", lpString2="CPU.Gadget") returned -1
	[0079.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.260] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.260] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.260] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.260] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.263] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.263] CloseHandle (hObject=0x8c) returned 1
	[0079.263] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.263] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.263] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.264] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.264] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.264] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.264] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.265] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.265] CloseHandle (hObject=0x90) returned 1
	[0079.266] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.266] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.266] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.266] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.266] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.266] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.266] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.267] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.268] CloseHandle (hObject=0x94) returned 1
	[0079.268] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.268] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.268] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.268] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.268] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.268] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.268] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.268] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.269] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.269] CloseHandle (hObject=0x94) returned 1
	[0079.269] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.270] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0079.270] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0079.270] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.280] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.280] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.280] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.280] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.281] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.282] CloseHandle (hObject=0x90) returned 1
	[0079.282] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.284] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.284] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.286] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.287] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.287] lstrcmpA (lpString1=".", lpString2="Currency.Gadget") returned -1
	[0079.287] lstrcmpA (lpString1="..", lpString2="Currency.Gadget") returned -1
	[0079.288] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.288] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.288] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.288] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.288] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.291] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.291] CloseHandle (hObject=0x8c) returned 1
	[0079.291] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.291] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.291] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.292] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.292] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.292] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.292] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.292] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.292] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.292] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.292] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.292] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.292] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.293] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.293] CloseHandle (hObject=0x94) returned 1
	[0079.293] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.295] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.295] CloseHandle (hObject=0x90) returned 1
	[0079.295] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.296] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.296] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.296] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.296] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.296] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.296] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.296] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.298] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.298] CloseHandle (hObject=0x94) returned 1
	[0079.299] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.299] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.299] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.300] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.300] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.300] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0079.300] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0079.301] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.327] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.328] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.328] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.328] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.329] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.329] CloseHandle (hObject=0x90) returned 1
	[0079.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.334] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.334] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.336] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.336] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.337] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.338] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.338] lstrcmpA (lpString1=".", lpString2="MediaCenter.Gadget") returned -1
	[0079.339] lstrcmpA (lpString1="..", lpString2="MediaCenter.Gadget") returned -1
	[0079.339] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.340] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.340] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.340] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.340] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.340] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.340] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.341] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.341] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.341] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.341] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.342] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.342] CloseHandle (hObject=0x90) returned 1
	[0079.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.342] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.342] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.342] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.343] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.343] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.343] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.344] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.344] CloseHandle (hObject=0x90) returned 1
	[0079.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.345] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.346] CloseHandle (hObject=0x8c) returned 1
	[0079.346] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0079.346] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0079.347] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.386] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.386] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.387] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.388] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.388] CloseHandle (hObject=0x90) returned 1
	[0079.388] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.393] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.393] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.394] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.394] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.394] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.394] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.395] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.395] CloseHandle (hObject=0x90) returned 1
	[0079.395] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.395] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.395] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.395] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.395] lstrcmpA (lpString1=".", lpString2="PicturePuzzle.Gadget") returned -1
	[0079.395] lstrcmpA (lpString1="..", lpString2="PicturePuzzle.Gadget") returned -1
	[0079.395] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.396] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.396] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.396] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.396] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.398] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.398] CloseHandle (hObject=0x8c) returned 1
	[0079.398] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.398] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.398] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.399] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.399] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.399] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.399] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.399] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.399] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.399] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.399] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.399] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.399] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.401] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.401] CloseHandle (hObject=0x94) returned 1
	[0079.401] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.403] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.403] CloseHandle (hObject=0x90) returned 1
	[0079.403] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.403] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.403] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.403] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.403] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.403] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.403] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.404] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.404] CloseHandle (hObject=0x94) returned 1
	[0079.405] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.405] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.406] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.406] lstrcmpA (lpString1=".", lpString2="Images") returned -1
	[0079.406] lstrcmpA (lpString1="..", lpString2="Images") returned -1
	[0079.406] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.407] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.408] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.408] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.409] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.409] CloseHandle (hObject=0x90) returned 1
	[0079.409] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.410] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.410] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.410] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.410] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.411] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.411] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.412] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.412] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.412] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.412] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.413] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.413] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.414] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.414] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.414] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.414] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.417] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.417] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.417] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.417] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.417] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.417] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.418] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.418] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.419] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.419] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.419] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.419] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.420] lstrcmpA (lpString1=".", lpString2="RSSFeeds.Gadget") returned -1
	[0079.420] lstrcmpA (lpString1="..", lpString2="RSSFeeds.Gadget") returned -1
	[0079.420] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.420] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.420] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.420] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.422] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.422] CloseHandle (hObject=0x8c) returned 1
	[0079.422] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.422] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.423] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.423] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.423] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.423] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.423] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.423] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.423] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.423] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.424] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.424] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.424] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.424] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.424] CloseHandle (hObject=0x94) returned 1
	[0079.425] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.425] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.425] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.427] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.427] CloseHandle (hObject=0x90) returned 1
	[0079.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.430] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.430] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.430] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.430] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.430] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.430] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.430] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.431] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.431] CloseHandle (hObject=0x94) returned 1
	[0079.431] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.431] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.432] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.432] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.432] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0079.432] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0079.432] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.436] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.436] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.436] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.436] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.437] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.437] CloseHandle (hObject=0x90) returned 1
	[0079.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.439] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.439] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.441] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.441] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.441] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.442] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.442] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.442] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.443] lstrcmpA (lpString1=".", lpString2="SlideShow.Gadget") returned -1
	[0079.443] lstrcmpA (lpString1="..", lpString2="SlideShow.Gadget") returned -1
	[0079.443] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.444] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.444] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.444] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.444] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.446] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.446] CloseHandle (hObject=0x8c) returned 1
	[0079.446] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.447] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.447] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.447] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.447] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.447] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.447] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.447] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.447] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.447] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.447] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.447] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.447] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.448] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.448] CloseHandle (hObject=0x94) returned 1
	[0079.448] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.448] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.451] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.451] CloseHandle (hObject=0x90) returned 1
	[0079.451] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.451] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.451] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.452] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.452] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.452] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.452] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.519] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.519] CloseHandle (hObject=0x94) returned 1
	[0079.520] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.520] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.521] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.521] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0079.521] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0079.521] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.523] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.523] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.523] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.523] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.524] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.524] CloseHandle (hObject=0x90) returned 1
	[0079.525] lstrcmpA (lpString1=".", lpString2="in_sidebar") returned -1
	[0079.525] lstrcmpA (lpString1="..", lpString2="in_sidebar") returned -1
	[0079.525] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.525] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.525] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.525] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.525] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.526] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.526] CloseHandle (hObject=0x94) returned 1
	[0079.560] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.560] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.560] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.561] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.561] lstrcmpA (lpString1=".", lpString2="on_desktop") returned -1
	[0079.561] lstrcmpA (lpString1="..", lpString2="on_desktop") returned -1
	[0079.561] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.561] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.561] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.561] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.562] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.562] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.562] CloseHandle (hObject=0x94) returned 1
	[0079.563] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.563] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.563] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.565] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.565] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.565] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.565] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.566] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.566] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.566] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.567] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.567] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.567] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.567] lstrcmpA (lpString1=".", lpString2="Weather.Gadget") returned -1
	[0079.567] lstrcmpA (lpString1="..", lpString2="Weather.Gadget") returned -1
	[0079.567] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7e68
	[0079.568] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.568] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.568] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.568] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.570] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.570] CloseHandle (hObject=0x8c) returned 1
	[0079.571] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0079.571] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0079.571] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.572] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.572] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.572] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.572] lstrcmpA (lpString1=".", lpString2="css") returned -1
	[0079.572] lstrcmpA (lpString1="..", lpString2="css") returned -1
	[0079.572] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.572] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.572] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.572] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.572] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.573] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.573] CloseHandle (hObject=0x94) returned 1
	[0079.573] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.573] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.573] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.575] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.575] CloseHandle (hObject=0x90) returned 1
	[0079.575] lstrcmpA (lpString1=".", lpString2="js") returned -1
	[0079.576] lstrcmpA (lpString1="..", lpString2="js") returned -1
	[0079.576] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.576] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.576] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.576] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.576] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.578] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.578] CloseHandle (hObject=0x94) returned 1
	[0079.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.578] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.579] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0
	[0079.580] lstrcmpA (lpString1=".", lpString2="images") returned -1
	[0079.580] lstrcmpA (lpString1="..", lpString2="images") returned -1
	[0079.580] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ea8
	[0079.581] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.582] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.582] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.582] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.583] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.584] CloseHandle (hObject=0x90) returned 1
	[0079.585] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.586] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.586] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.586] lstrcmpA (lpString1=".", lpString2="120DPI") returned -1
	[0079.586] lstrcmpA (lpString1="..", lpString2="120DPI") returned -1
	[0079.586] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.659] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.659] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.659] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.660] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.660] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.660] CloseHandle (hObject=0x94) returned 1
	[0079.661] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.661] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.662] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.663] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.664] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.664] lstrcmpA (lpString1=".", lpString2="144DPI") returned -1
	[0079.664] lstrcmpA (lpString1="..", lpString2="144DPI") returned -1
	[0079.664] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7ee8
	[0079.726] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.726] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.726] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.726] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.727] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.728] CloseHandle (hObject=0x94) returned 1
	[0079.728] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.728] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.728] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.728] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0
	[0079.729] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.729] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.729] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.731] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.731] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.731] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.731] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.736] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.736] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0
	[0079.780] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.780] CloseHandle (hObject=0x84) returned 1
	[0079.781] lstrcmpA (lpString1=".", lpString2="Shared Gadgets") returned -1
	[0079.781] lstrcmpA (lpString1="..", lpString2="Shared Gadgets") returned -1
	[0079.781] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e28
	[0079.781] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.781] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.781] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.781] lstrcmpA (lpString1=".", lpString2="Program Files (x86)") returned -1
	[0079.781] lstrcmpA (lpString1="..", lpString2="Program Files (x86)") returned -1
	[0079.781] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b7e28
	[0079.781] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.781] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.781] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.781] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1
	[0079.781] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1
	[0079.781] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0079.782] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.782] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.782] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.782] lstrcmpA (lpString1=".", lpString2="Reader 10.0") returned -1
	[0079.782] lstrcmpA (lpString1="..", lpString2="Reader 10.0") returned -1
	[0079.782] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0079.782] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.802] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.802] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.803] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.803] CloseHandle (hObject=0x88) returned 1
	[0079.877] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0079.878] CloseHandle (hObject=0x88) returned 1
	[0079.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm.boom")) returned 1
	[0079.891] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0079.891] CloseHandle (hObject=0x88) returned 1
	[0079.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm.boom")) returned 1
	[0079.892] lstrcmpA (lpString1=".", lpString2="Esl") returned -1
	[0079.892] lstrcmpA (lpString1="..", lpString2="Esl") returned -1
	[0079.892] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0079.893] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0079.893] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0079.893] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0079.894] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0079.894] CloseHandle (hObject=0x8c) returned 1
	[0079.990] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0079.990] CloseHandle (hObject=0x88) returned 1
	[0079.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm.boom")) returned 1
	[0080.190] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.190] CloseHandle (hObject=0x88) returned 1
	[0080.190] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm.boom")) returned 1
	[0080.371] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.371] CloseHandle (hObject=0x88) returned 1
	[0080.371] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm.boom")) returned 1
	[0080.511] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.511] CloseHandle (hObject=0x88) returned 1
	[0080.511] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm.boom")) returned 1
	[0080.541] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.541] CloseHandle (hObject=0x88) returned 1
	[0080.541] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm.boom")) returned 1
	[0080.576] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.576] CloseHandle (hObject=0x88) returned 1
	[0080.576] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm.boom")) returned 1
	[0080.615] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.615] CloseHandle (hObject=0x88) returned 1
	[0080.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm.boom")) returned 1
	[0080.640] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.640] CloseHandle (hObject=0x88) returned 1
	[0080.640] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm.boom")) returned 1
	[0080.662] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.663] CloseHandle (hObject=0x88) returned 1
	[0080.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm.boom")) returned 1
	[0080.716] lstrcmpA (lpString1=".", lpString2="Reader") returned -1
	[0080.716] lstrcmpA (lpString1="..", lpString2="Reader") returned -1
	[0080.716] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0080.717] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0080.718] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0080.718] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0080.719] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0080.719] CloseHandle (hObject=0x8c) returned 1
	[0080.744] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.744] CloseHandle (hObject=0x8c) returned 1
	[0080.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroBroker.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrobroker.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroBroker.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrobroker.exe.boom")) returned 1
	[0080.798] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.799] CloseHandle (hObject=0x8c) returned 1
	[0080.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.exe.boom")) returned 1
	[0080.817] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.817] CloseHandle (hObject=0x8c) returned 1
	[0080.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32Info.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32info.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32Info.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32info.exe.boom")) returned 1
	[0080.861] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0080.861] CloseHandle (hObject=0x8c) returned 1
	[0080.861] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroTextExtractor.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrotextextractor.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroTextExtractor.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrotextextractor.exe.boom")) returned 1
	[0081.081] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.082] CloseHandle (hObject=0x8c) returned 1
	[0081.082] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AdobeCollabSync.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobecollabsync.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AdobeCollabSync.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobecollabsync.exe.boom")) returned 1
	[0081.083] lstrcmpA (lpString1=".", lpString2="AIR") returned -1
	[0081.083] lstrcmpA (lpString1="..", lpString2="AIR") returned -1
	[0081.083] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0081.099] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.099] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.099] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.100] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.101] CloseHandle (hObject=0x90) returned 1
	[0081.102] lstrcmpA (lpString1=".", lpString2="Browser") returned -1
	[0081.102] lstrcmpA (lpString1="..", lpString2="Browser") returned -1
	[0081.102] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0081.159] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.159] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.159] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.160] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.160] CloseHandle (hObject=0x90) returned 1
	[0081.183] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.183] CloseHandle (hObject=0x8c) returned 1
	[0081.183] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Eula.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\eula.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Eula.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\eula.exe.boom")) returned 1
	[0081.184] lstrcmpA (lpString1=".", lpString2="IDTemplates") returned -1
	[0081.184] lstrcmpA (lpString1="..", lpString2="IDTemplates") returned -1
	[0081.184] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0081.200] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.200] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.200] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.200] lstrcmpA (lpString1=".", lpString2="CAT") returned -1
	[0081.200] lstrcmpA (lpString1="..", lpString2="CAT") returned -1
	[0081.200] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0081.201] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.201] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.201] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.202] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.202] CloseHandle (hObject=0x94) returned 1
	[0081.241] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.241] CloseHandle (hObject=0x94) returned 1
	[0081.241] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf.boom")) returned 1
	[0081.245] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.246] CloseHandle (hObject=0x94) returned 1
	[0081.246] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf.boom")) returned 1
	[0081.246] lstrcmpA (lpString1=".", lpString2="CHS") returned -1
	[0081.246] lstrcmpA (lpString1="..", lpString2="CHS") returned -1
	[0081.246] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0081.247] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.247] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.247] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.248] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.248] CloseHandle (hObject=0x94) returned 1
	[0081.258] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.258] CloseHandle (hObject=0x94) returned 1
	[0081.258] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf.boom")) returned 1
	[0081.298] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.298] CloseHandle (hObject=0x94) returned 1
	[0081.298] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf.boom")) returned 1
	[0081.299] lstrcmpA (lpString1=".", lpString2="CHT") returned -1
	[0081.299] lstrcmpA (lpString1="..", lpString2="CHT") returned -1
	[0081.299] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0081.310] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.310] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.310] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.311] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.311] CloseHandle (hObject=0x94) returned 1
	[0081.320] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.320] CloseHandle (hObject=0x94) returned 1
	[0081.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf.boom")) returned 1
	[0081.324] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.324] CloseHandle (hObject=0x94) returned 1
	[0081.324] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf.boom")) returned 1
	[0081.325] lstrcmpA (lpString1=".", lpString2="CZE") returned -1
	[0081.325] lstrcmpA (lpString1="..", lpString2="CZE") returned -1
	[0081.325] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0081.327] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.327] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.327] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.328] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.328] CloseHandle (hObject=0x94) returned 1
	[0081.481] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.481] CloseHandle (hObject=0x94) returned 1
	[0081.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf.boom")) returned 1
	[0081.547] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.548] CloseHandle (hObject=0x94) returned 1
	[0081.548] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf.boom")) returned 1
	[0081.549] lstrcmpA (lpString1=".", lpString2="DAN") returned -1
	[0081.549] lstrcmpA (lpString1="..", lpString2="DAN") returned -1
	[0081.549] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0081.549] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.549] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.550] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.550] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.551] CloseHandle (hObject=0x94) returned 1
	[0081.566] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.566] CloseHandle (hObject=0x94) returned 1
	[0081.566] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf.boom")) returned 1
	[0081.617] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.617] CloseHandle (hObject=0x94) returned 1
	[0081.617] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf.boom")) returned 1
	[0081.618] lstrcmpA (lpString1=".", lpString2="DEU") returned -1
	[0081.618] lstrcmpA (lpString1="..", lpString2="DEU") returned -1
	[0081.619] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0081.619] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0081.619] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0081.619] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0081.620] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0081.620] CloseHandle (hObject=0x94) returned 1
	[0081.891] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0081.891] CloseHandle (hObject=0x94) returned 1
	[0081.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf.boom")) returned 1
	[0082.039] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.039] CloseHandle (hObject=0x94) returned 1
	[0082.039] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf.boom")) returned 1
	[0082.040] lstrcmpA (lpString1=".", lpString2="ENU") returned -1
	[0082.040] lstrcmpA (lpString1="..", lpString2="ENU") returned -1
	[0082.041] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.074] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.075] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.075] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.075] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.076] CloseHandle (hObject=0x94) returned 1
	[0082.159] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.159] CloseHandle (hObject=0x94) returned 1
	[0082.159] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf.boom")) returned 1
	[0082.247] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.247] CloseHandle (hObject=0x94) returned 1
	[0082.247] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf.boom")) returned 1
	[0082.249] lstrcmpA (lpString1=".", lpString2="ESP") returned -1
	[0082.249] lstrcmpA (lpString1="..", lpString2="ESP") returned -1
	[0082.249] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.250] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.250] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.250] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.251] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.251] CloseHandle (hObject=0x94) returned 1
	[0082.320] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.320] CloseHandle (hObject=0x94) returned 1
	[0082.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf.boom")) returned 1
	[0082.366] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.366] CloseHandle (hObject=0x94) returned 1
	[0082.366] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf.boom")) returned 1
	[0082.367] lstrcmpA (lpString1=".", lpString2="EUQ") returned -1
	[0082.367] lstrcmpA (lpString1="..", lpString2="EUQ") returned -1
	[0082.367] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.367] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.367] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.367] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.367] lstrcmpA (lpString1=".", lpString2="FRA") returned -1
	[0082.367] lstrcmpA (lpString1="..", lpString2="FRA") returned -1
	[0082.367] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.368] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.368] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.368] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.369] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.369] CloseHandle (hObject=0x94) returned 1
	[0082.426] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.426] CloseHandle (hObject=0x94) returned 1
	[0082.426] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf.boom")) returned 1
	[0082.431] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.432] CloseHandle (hObject=0x94) returned 1
	[0082.432] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf.boom")) returned 1
	[0082.432] lstrcmpA (lpString1=".", lpString2="HRV") returned -1
	[0082.432] lstrcmpA (lpString1="..", lpString2="HRV") returned -1
	[0082.433] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.433] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.433] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.433] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.434] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.434] CloseHandle (hObject=0x94) returned 1
	[0082.479] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.479] CloseHandle (hObject=0x94) returned 1
	[0082.479] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf.boom")) returned 1
	[0082.484] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.484] CloseHandle (hObject=0x94) returned 1
	[0082.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf.boom")) returned 1
	[0082.485] lstrcmpA (lpString1=".", lpString2="HUN") returned -1
	[0082.485] lstrcmpA (lpString1="..", lpString2="HUN") returned -1
	[0082.485] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.500] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.500] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.500] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.505] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.505] CloseHandle (hObject=0x94) returned 1
	[0082.564] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.564] CloseHandle (hObject=0x94) returned 1
	[0082.564] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf.boom")) returned 1
	[0082.612] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.613] CloseHandle (hObject=0x94) returned 1
	[0082.613] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf.boom")) returned 1
	[0082.614] lstrcmpA (lpString1=".", lpString2="ITA") returned -1
	[0082.614] lstrcmpA (lpString1="..", lpString2="ITA") returned -1
	[0082.614] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.614] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.614] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.614] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.615] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.615] CloseHandle (hObject=0x94) returned 1
	[0082.630] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.631] CloseHandle (hObject=0x94) returned 1
	[0082.631] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf.boom")) returned 1
	[0082.635] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.635] CloseHandle (hObject=0x94) returned 1
	[0082.635] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf.boom")) returned 1
	[0082.636] lstrcmpA (lpString1=".", lpString2="JPN") returned -1
	[0082.636] lstrcmpA (lpString1="..", lpString2="JPN") returned -1
	[0082.636] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.636] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.636] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.636] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.637] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.637] CloseHandle (hObject=0x94) returned 1
	[0082.651] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.651] CloseHandle (hObject=0x94) returned 1
	[0082.651] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf.boom")) returned 1
	[0082.655] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.655] CloseHandle (hObject=0x94) returned 1
	[0082.655] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf.boom")) returned 1
	[0082.655] lstrcmpA (lpString1=".", lpString2="KOR") returned -1
	[0082.655] lstrcmpA (lpString1="..", lpString2="KOR") returned -1
	[0082.655] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.656] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.656] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.656] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.657] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.657] CloseHandle (hObject=0x94) returned 1
	[0082.658] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.658] CloseHandle (hObject=0x94) returned 1
	[0082.658] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf.boom")) returned 1
	[0082.726] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.726] CloseHandle (hObject=0x94) returned 1
	[0082.726] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf.boom")) returned 1
	[0082.727] lstrcmpA (lpString1=".", lpString2="NLD") returned -1
	[0082.727] lstrcmpA (lpString1="..", lpString2="NLD") returned -1
	[0082.727] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.727] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.728] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.728] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.728] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.728] CloseHandle (hObject=0x94) returned 1
	[0082.772] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.772] CloseHandle (hObject=0x94) returned 1
	[0082.776] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf.boom")) returned 1
	[0082.780] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.780] CloseHandle (hObject=0x94) returned 1
	[0082.780] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf.boom")) returned 1
	[0082.781] lstrcmpA (lpString1=".", lpString2="NOR") returned -1
	[0082.781] lstrcmpA (lpString1="..", lpString2="NOR") returned -1
	[0082.781] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.781] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.781] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.781] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.782] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.782] CloseHandle (hObject=0x94) returned 1
	[0082.787] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.787] CloseHandle (hObject=0x94) returned 1
	[0082.787] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf.boom")) returned 1
	[0082.791] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.791] CloseHandle (hObject=0x94) returned 1
	[0082.791] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf.boom")) returned 1
	[0082.792] lstrcmpA (lpString1=".", lpString2="POL") returned -1
	[0082.792] lstrcmpA (lpString1="..", lpString2="POL") returned -1
	[0082.792] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0082.884] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0082.884] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0082.884] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0082.885] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0082.885] CloseHandle (hObject=0x94) returned 1
	[0082.909] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0082.909] CloseHandle (hObject=0x94) returned 1
	[0082.909] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf.boom")) returned 1
	[0083.007] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.007] CloseHandle (hObject=0x94) returned 1
	[0083.007] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf.boom")) returned 1
	[0083.009] lstrcmpA (lpString1=".", lpString2="PTB") returned -1
	[0083.009] lstrcmpA (lpString1="..", lpString2="PTB") returned -1
	[0083.009] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.009] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.009] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.009] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.275] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.276] CloseHandle (hObject=0x94) returned 1
	[0083.392] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.392] CloseHandle (hObject=0x94) returned 1
	[0083.392] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf.boom")) returned 1
	[0083.458] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.458] CloseHandle (hObject=0x94) returned 1
	[0083.458] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf.boom")) returned 1
	[0083.459] lstrcmpA (lpString1=".", lpString2="RUM") returned -1
	[0083.459] lstrcmpA (lpString1="..", lpString2="RUM") returned -1
	[0083.459] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.467] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.467] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.467] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.468] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.468] CloseHandle (hObject=0x94) returned 1
	[0083.475] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.475] CloseHandle (hObject=0x94) returned 1
	[0083.475] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf.boom")) returned 1
	[0083.493] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.493] CloseHandle (hObject=0x94) returned 1
	[0083.493] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf.boom")) returned 1
	[0083.494] lstrcmpA (lpString1=".", lpString2="RUS") returned -1
	[0083.494] lstrcmpA (lpString1="..", lpString2="RUS") returned -1
	[0083.494] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.494] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.494] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.494] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.495] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.495] CloseHandle (hObject=0x94) returned 1
	[0083.519] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.519] CloseHandle (hObject=0x94) returned 1
	[0083.519] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf.boom")) returned 1
	[0083.575] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.575] CloseHandle (hObject=0x94) returned 1
	[0083.576] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf.boom")) returned 1
	[0083.577] lstrcmpA (lpString1=".", lpString2="SKY") returned -1
	[0083.577] lstrcmpA (lpString1="..", lpString2="SKY") returned -1
	[0083.577] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.597] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.598] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.598] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.599] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.599] CloseHandle (hObject=0x94) returned 1
	[0083.631] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.632] CloseHandle (hObject=0x94) returned 1
	[0083.632] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf.boom")) returned 1
	[0083.715] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.715] CloseHandle (hObject=0x94) returned 1
	[0083.715] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf.boom")) returned 1
	[0083.716] lstrcmpA (lpString1=".", lpString2="SLV") returned -1
	[0083.716] lstrcmpA (lpString1="..", lpString2="SLV") returned -1
	[0083.716] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.734] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.734] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.734] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.735] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.735] CloseHandle (hObject=0x94) returned 1
	[0083.773] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.773] CloseHandle (hObject=0x94) returned 1
	[0083.773] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf.boom")) returned 1
	[0083.779] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.779] CloseHandle (hObject=0x94) returned 1
	[0083.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf.boom")) returned 1
	[0083.781] lstrcmpA (lpString1=".", lpString2="SUO") returned -1
	[0083.781] lstrcmpA (lpString1="..", lpString2="SUO") returned -1
	[0083.781] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.781] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.781] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.781] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.782] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.782] CloseHandle (hObject=0x94) returned 1
	[0083.798] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.799] CloseHandle (hObject=0x94) returned 1
	[0083.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf.boom")) returned 1
	[0083.803] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.803] CloseHandle (hObject=0x94) returned 1
	[0083.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf.boom")) returned 1
	[0083.804] lstrcmpA (lpString1=".", lpString2="SVE") returned -1
	[0083.804] lstrcmpA (lpString1="..", lpString2="SVE") returned -1
	[0083.804] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.804] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.804] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.804] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.805] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.805] CloseHandle (hObject=0x94) returned 1
	[0083.808] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.808] CloseHandle (hObject=0x94) returned 1
	[0083.808] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf.boom")) returned 1
	[0083.878] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.878] CloseHandle (hObject=0x94) returned 1
	[0083.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf.boom")) returned 1
	[0083.879] lstrcmpA (lpString1=".", lpString2="TUR") returned -1
	[0083.879] lstrcmpA (lpString1="..", lpString2="TUR") returned -1
	[0083.880] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0083.880] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0083.880] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0083.880] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0083.881] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0083.881] CloseHandle (hObject=0x94) returned 1
	[0083.925] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0083.925] CloseHandle (hObject=0x94) returned 1
	[0083.926] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf.boom")) returned 1
	[0084.023] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.023] CloseHandle (hObject=0x94) returned 1
	[0084.023] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf.boom")) returned 1
	[0084.024] lstrcmpA (lpString1=".", lpString2="UKR") returned -1
	[0084.024] lstrcmpA (lpString1="..", lpString2="UKR") returned -1
	[0084.024] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.024] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.024] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.024] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.025] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.025] CloseHandle (hObject=0x94) returned 1
	[0084.043] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.043] CloseHandle (hObject=0x94) returned 1
	[0084.043] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf.boom")) returned 1
	[0084.051] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.052] CloseHandle (hObject=0x94) returned 1
	[0084.052] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf.boom")) returned 1
	[0084.053] lstrcmpA (lpString1=".", lpString2="Javascripts") returned -1
	[0084.053] lstrcmpA (lpString1="..", lpString2="Javascripts") returned -1
	[0084.053] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0084.053] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.053] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.053] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.054] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.054] CloseHandle (hObject=0x90) returned 1
	[0084.055] lstrcmpA (lpString1=".", lpString2="Legal") returned -1
	[0084.055] lstrcmpA (lpString1="..", lpString2="Legal") returned -1
	[0084.055] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0084.086] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.086] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.086] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.086] lstrcmpA (lpString1=".", lpString2="CAT") returned -1
	[0084.086] lstrcmpA (lpString1="..", lpString2="CAT") returned -1
	[0084.086] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.115] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.115] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.115] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.125] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.125] CloseHandle (hObject=0x94) returned 1
	[0084.185] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.185] CloseHandle (hObject=0x94) returned 1
	[0084.185] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html.boom")) returned 1
	[0084.187] lstrcmpA (lpString1=".", lpString2="CHS") returned -1
	[0084.187] lstrcmpA (lpString1="..", lpString2="CHS") returned -1
	[0084.187] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.187] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.187] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.187] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.188] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.188] CloseHandle (hObject=0x94) returned 1
	[0084.207] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.208] CloseHandle (hObject=0x94) returned 1
	[0084.208] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html.boom")) returned 1
	[0084.209] lstrcmpA (lpString1=".", lpString2="CHT") returned -1
	[0084.209] lstrcmpA (lpString1="..", lpString2="CHT") returned -1
	[0084.209] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.217] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.217] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.217] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.218] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.219] CloseHandle (hObject=0x94) returned 1
	[0084.250] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.250] CloseHandle (hObject=0x94) returned 1
	[0084.250] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html.boom")) returned 1
	[0084.251] lstrcmpA (lpString1=".", lpString2="CZE") returned -1
	[0084.251] lstrcmpA (lpString1="..", lpString2="CZE") returned -1
	[0084.251] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.252] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.252] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.252] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.253] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.253] CloseHandle (hObject=0x94) returned 1
	[0084.273] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.273] CloseHandle (hObject=0x94) returned 1
	[0084.274] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html.boom")) returned 1
	[0084.275] lstrcmpA (lpString1=".", lpString2="DAN") returned -1
	[0084.275] lstrcmpA (lpString1="..", lpString2="DAN") returned -1
	[0084.275] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.276] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.276] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.276] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.277] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.277] CloseHandle (hObject=0x94) returned 1
	[0084.288] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.289] CloseHandle (hObject=0x94) returned 1
	[0084.289] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html.boom")) returned 1
	[0084.290] lstrcmpA (lpString1=".", lpString2="DEU") returned -1
	[0084.290] lstrcmpA (lpString1="..", lpString2="DEU") returned -1
	[0084.290] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.290] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.291] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.291] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.292] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.292] CloseHandle (hObject=0x94) returned 1
	[0084.294] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.295] CloseHandle (hObject=0x94) returned 1
	[0084.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html.boom")) returned 1
	[0084.296] lstrcmpA (lpString1=".", lpString2="ENU") returned -1
	[0084.296] lstrcmpA (lpString1="..", lpString2="ENU") returned -1
	[0084.296] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.342] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.342] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.342] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.343] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.343] CloseHandle (hObject=0x94) returned 1
	[0084.365] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.365] CloseHandle (hObject=0x94) returned 1
	[0084.365] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html.boom")) returned 1
	[0084.367] lstrcmpA (lpString1=".", lpString2="ESP") returned -1
	[0084.367] lstrcmpA (lpString1="..", lpString2="ESP") returned -1
	[0084.367] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.368] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.368] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.368] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.371] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.371] CloseHandle (hObject=0x94) returned 1
	[0084.393] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.393] CloseHandle (hObject=0x94) returned 1
	[0084.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html.boom")) returned 1
	[0084.395] lstrcmpA (lpString1=".", lpString2="EUQ") returned -1
	[0084.395] lstrcmpA (lpString1="..", lpString2="EUQ") returned -1
	[0084.395] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.395] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.395] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.395] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.396] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.396] CloseHandle (hObject=0x94) returned 1
	[0084.466] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.466] CloseHandle (hObject=0x94) returned 1
	[0084.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html.boom")) returned 1
	[0084.467] lstrcmpA (lpString1=".", lpString2="FRA") returned -1
	[0084.467] lstrcmpA (lpString1="..", lpString2="FRA") returned -1
	[0084.467] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.469] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.469] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.469] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.471] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.471] CloseHandle (hObject=0x94) returned 1
	[0084.569] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.569] CloseHandle (hObject=0x94) returned 1
	[0084.570] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html.boom")) returned 1
	[0084.571] lstrcmpA (lpString1=".", lpString2="HRV") returned -1
	[0084.571] lstrcmpA (lpString1="..", lpString2="HRV") returned -1
	[0084.571] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.571] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.571] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.571] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.572] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.572] CloseHandle (hObject=0x94) returned 1
	[0084.576] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.576] CloseHandle (hObject=0x94) returned 1
	[0084.576] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html.boom")) returned 1
	[0084.577] lstrcmpA (lpString1=".", lpString2="HUN") returned -1
	[0084.577] lstrcmpA (lpString1="..", lpString2="HUN") returned -1
	[0084.577] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.577] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.577] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.577] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.578] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.578] CloseHandle (hObject=0x94) returned 1
	[0084.581] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.581] CloseHandle (hObject=0x94) returned 1
	[0084.581] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html.boom")) returned 1
	[0084.582] lstrcmpA (lpString1=".", lpString2="ITA") returned -1
	[0084.582] lstrcmpA (lpString1="..", lpString2="ITA") returned -1
	[0084.582] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.584] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.584] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.584] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.585] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.585] CloseHandle (hObject=0x94) returned 1
	[0084.587] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.587] CloseHandle (hObject=0x94) returned 1
	[0084.587] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html.boom")) returned 1
	[0084.588] lstrcmpA (lpString1=".", lpString2="JPN") returned -1
	[0084.588] lstrcmpA (lpString1="..", lpString2="JPN") returned -1
	[0084.588] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.589] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.589] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.589] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.590] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.590] CloseHandle (hObject=0x94) returned 1
	[0084.625] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.625] CloseHandle (hObject=0x94) returned 1
	[0084.625] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html.boom")) returned 1
	[0084.627] lstrcmpA (lpString1=".", lpString2="KOR") returned -1
	[0084.627] lstrcmpA (lpString1="..", lpString2="KOR") returned -1
	[0084.627] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.628] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.628] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.628] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.629] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.629] CloseHandle (hObject=0x94) returned 1
	[0084.707] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.707] CloseHandle (hObject=0x94) returned 1
	[0084.707] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html.boom")) returned 1
	[0084.709] lstrcmpA (lpString1=".", lpString2="NLD") returned -1
	[0084.709] lstrcmpA (lpString1="..", lpString2="NLD") returned -1
	[0084.709] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.709] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.709] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.709] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.710] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.710] CloseHandle (hObject=0x94) returned 1
	[0084.712] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.712] CloseHandle (hObject=0x94) returned 1
	[0084.712] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html.boom")) returned 1
	[0084.713] lstrcmpA (lpString1=".", lpString2="NOR") returned -1
	[0084.713] lstrcmpA (lpString1="..", lpString2="NOR") returned -1
	[0084.713] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.713] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.713] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.713] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.714] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.714] CloseHandle (hObject=0x94) returned 1
	[0084.717] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.717] CloseHandle (hObject=0x94) returned 1
	[0084.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html.boom")) returned 1
	[0084.718] lstrcmpA (lpString1=".", lpString2="POL") returned -1
	[0084.718] lstrcmpA (lpString1="..", lpString2="POL") returned -1
	[0084.718] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.719] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.719] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.720] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.721] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.721] CloseHandle (hObject=0x94) returned 1
	[0084.732] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.732] CloseHandle (hObject=0x94) returned 1
	[0084.732] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html.boom")) returned 1
	[0084.733] lstrcmpA (lpString1=".", lpString2="PTB") returned -1
	[0084.733] lstrcmpA (lpString1="..", lpString2="PTB") returned -1
	[0084.733] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.734] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.734] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.734] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.735] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.735] CloseHandle (hObject=0x94) returned 1
	[0084.759] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.759] CloseHandle (hObject=0x94) returned 1
	[0084.759] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html.boom")) returned 1
	[0084.760] lstrcmpA (lpString1=".", lpString2="RUM") returned -1
	[0084.760] lstrcmpA (lpString1="..", lpString2="RUM") returned -1
	[0084.760] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.761] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.761] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.761] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.762] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.762] CloseHandle (hObject=0x94) returned 1
	[0084.786] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.786] CloseHandle (hObject=0x94) returned 1
	[0084.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html.boom")) returned 1
	[0084.788] lstrcmpA (lpString1=".", lpString2="RUS") returned -1
	[0084.788] lstrcmpA (lpString1="..", lpString2="RUS") returned -1
	[0084.788] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.789] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.789] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.789] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.790] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.790] CloseHandle (hObject=0x94) returned 1
	[0084.821] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.821] CloseHandle (hObject=0x94) returned 1
	[0084.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html.boom")) returned 1
	[0084.826] lstrcmpA (lpString1=".", lpString2="SKY") returned -1
	[0084.826] lstrcmpA (lpString1="..", lpString2="SKY") returned -1
	[0084.826] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.826] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.826] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.826] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.827] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.827] CloseHandle (hObject=0x94) returned 1
	[0084.844] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.844] CloseHandle (hObject=0x94) returned 1
	[0084.845] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html.boom")) returned 1
	[0084.846] lstrcmpA (lpString1=".", lpString2="SLV") returned -1
	[0084.846] lstrcmpA (lpString1="..", lpString2="SLV") returned -1
	[0084.846] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.847] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.847] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.847] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.848] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.848] CloseHandle (hObject=0x94) returned 1
	[0084.858] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.858] CloseHandle (hObject=0x94) returned 1
	[0084.858] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html.boom")) returned 1
	[0084.859] lstrcmpA (lpString1=".", lpString2="SUO") returned -1
	[0084.859] lstrcmpA (lpString1="..", lpString2="SUO") returned -1
	[0084.859] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.859] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.859] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.859] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.860] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.860] CloseHandle (hObject=0x94) returned 1
	[0084.862] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.862] CloseHandle (hObject=0x94) returned 1
	[0084.862] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html.boom")) returned 1
	[0084.865] lstrcmpA (lpString1=".", lpString2="SVE") returned -1
	[0084.865] lstrcmpA (lpString1="..", lpString2="SVE") returned -1
	[0084.865] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.866] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.866] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.866] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.866] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.867] CloseHandle (hObject=0x94) returned 1
	[0084.900] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.901] CloseHandle (hObject=0x94) returned 1
	[0084.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html.boom")) returned 1
	[0084.903] lstrcmpA (lpString1=".", lpString2="TUR") returned -1
	[0084.903] lstrcmpA (lpString1="..", lpString2="TUR") returned -1
	[0084.903] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.904] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.904] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.904] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.905] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.905] CloseHandle (hObject=0x94) returned 1
	[0084.941] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.941] CloseHandle (hObject=0x94) returned 1
	[0084.941] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html.boom")) returned 1
	[0084.942] lstrcmpA (lpString1=".", lpString2="UKR") returned -1
	[0084.943] lstrcmpA (lpString1="..", lpString2="UKR") returned -1
	[0084.943] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0084.943] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0084.943] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0084.943] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0084.944] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0084.944] CloseHandle (hObject=0x94) returned 1
	[0084.973] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0084.973] CloseHandle (hObject=0x94) returned 1
	[0084.973] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html.boom")) returned 1
	[0084.974] lstrcmpA (lpString1=".", lpString2="Locale") returned -1
	[0084.974] lstrcmpA (lpString1="..", lpString2="Locale") returned -1
	[0084.974] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0085.026] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.026] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.026] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.026] lstrcmpA (lpString1=".", lpString2="ca_ES") returned -1
	[0085.026] lstrcmpA (lpString1="..", lpString2="ca_ES") returned -1
	[0085.026] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.048] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.048] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.048] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.049] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.049] CloseHandle (hObject=0x94) returned 1
	[0085.051] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.051] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.051] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.052] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.052] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.052] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.055] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.055] CloseHandle (hObject=0x98) returned 1
	[0085.055] lstrcmpA (lpString1=".", lpString2="cs_CZ") returned -1
	[0085.055] lstrcmpA (lpString1="..", lpString2="cs_CZ") returned -1
	[0085.055] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.058] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.058] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.058] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.059] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.059] CloseHandle (hObject=0x94) returned 1
	[0085.060] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.060] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.060] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.061] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.061] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.062] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.064] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.064] CloseHandle (hObject=0x98) returned 1
	[0085.065] lstrcmpA (lpString1=".", lpString2="da_DK") returned -1
	[0085.065] lstrcmpA (lpString1="..", lpString2="da_DK") returned -1
	[0085.065] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.082] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.082] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.082] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.083] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.083] CloseHandle (hObject=0x94) returned 1
	[0085.084] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.084] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.084] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.084] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.084] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.084] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.087] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.087] CloseHandle (hObject=0x98) returned 1
	[0085.087] lstrcmpA (lpString1=".", lpString2="de_DE") returned -1
	[0085.087] lstrcmpA (lpString1="..", lpString2="de_DE") returned -1
	[0085.087] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.131] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.132] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.132] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.133] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.133] CloseHandle (hObject=0x94) returned 1
	[0085.134] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.134] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.134] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.135] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.135] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.135] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.137] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.137] CloseHandle (hObject=0x98) returned 1
	[0085.138] lstrcmpA (lpString1=".", lpString2="es_ES") returned -1
	[0085.138] lstrcmpA (lpString1="..", lpString2="es_ES") returned -1
	[0085.138] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.149] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.149] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.149] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.150] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.150] CloseHandle (hObject=0x94) returned 1
	[0085.151] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.152] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.152] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.152] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.152] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.152] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.154] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.154] CloseHandle (hObject=0x98) returned 1
	[0085.154] lstrcmpA (lpString1=".", lpString2="eu_ES") returned -1
	[0085.154] lstrcmpA (lpString1="..", lpString2="eu_ES") returned -1
	[0085.154] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.157] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.157] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.157] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.158] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.158] CloseHandle (hObject=0x94) returned 1
	[0085.159] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.159] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.159] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.159] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.159] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.159] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.161] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.161] CloseHandle (hObject=0x98) returned 1
	[0085.162] lstrcmpA (lpString1=".", lpString2="fi_FI") returned -1
	[0085.162] lstrcmpA (lpString1="..", lpString2="fi_FI") returned -1
	[0085.162] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.198] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.198] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.198] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.199] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.199] CloseHandle (hObject=0x94) returned 1
	[0085.200] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.200] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.200] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.201] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.201] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.201] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.204] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.204] CloseHandle (hObject=0x98) returned 1
	[0085.205] lstrcmpA (lpString1=".", lpString2="fr_FR") returned -1
	[0085.205] lstrcmpA (lpString1="..", lpString2="fr_FR") returned -1
	[0085.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.229] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.229] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.229] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.230] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.230] CloseHandle (hObject=0x94) returned 1
	[0085.231] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.231] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.231] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.231] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.232] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.232] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.234] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.234] CloseHandle (hObject=0x98) returned 1
	[0085.234] lstrcmpA (lpString1=".", lpString2="hr_HR") returned -1
	[0085.234] lstrcmpA (lpString1="..", lpString2="hr_HR") returned -1
	[0085.234] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.261] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.261] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.261] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.263] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.263] CloseHandle (hObject=0x94) returned 1
	[0085.264] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.264] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.264] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.266] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.266] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.266] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.268] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.269] CloseHandle (hObject=0x98) returned 1
	[0085.269] lstrcmpA (lpString1=".", lpString2="hu_HU") returned -1
	[0085.269] lstrcmpA (lpString1="..", lpString2="hu_HU") returned -1
	[0085.269] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.271] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.272] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.272] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.273] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.273] CloseHandle (hObject=0x94) returned 1
	[0085.274] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.274] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.274] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.275] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.275] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.275] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.279] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.279] CloseHandle (hObject=0x98) returned 1
	[0085.280] lstrcmpA (lpString1=".", lpString2="it_IT") returned -1
	[0085.280] lstrcmpA (lpString1="..", lpString2="it_IT") returned -1
	[0085.280] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.319] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.319] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.319] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.320] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.320] CloseHandle (hObject=0x94) returned 1
	[0085.321] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.321] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.321] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.322] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.322] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.322] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.324] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.324] CloseHandle (hObject=0x98) returned 1
	[0085.324] lstrcmpA (lpString1=".", lpString2="ja_JP") returned -1
	[0085.324] lstrcmpA (lpString1="..", lpString2="ja_JP") returned -1
	[0085.324] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.334] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.334] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.334] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.335] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.335] CloseHandle (hObject=0x94) returned 1
	[0085.336] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.336] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.336] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.336] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.336] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.336] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.338] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.338] CloseHandle (hObject=0x98) returned 1
	[0085.339] lstrcmpA (lpString1=".", lpString2="ko_KR") returned -1
	[0085.339] lstrcmpA (lpString1="..", lpString2="ko_KR") returned -1
	[0085.339] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.393] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.393] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.393] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.395] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.395] CloseHandle (hObject=0x94) returned 1
	[0085.396] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.396] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.396] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.397] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.397] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.397] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.400] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.400] CloseHandle (hObject=0x98) returned 1
	[0085.400] lstrcmpA (lpString1=".", lpString2="nb_NO") returned -1
	[0085.400] lstrcmpA (lpString1="..", lpString2="nb_NO") returned -1
	[0085.400] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.474] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.474] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.474] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.475] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.475] CloseHandle (hObject=0x94) returned 1
	[0085.476] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.476] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.476] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.476] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.476] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.476] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.482] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.482] CloseHandle (hObject=0x98) returned 1
	[0085.482] lstrcmpA (lpString1=".", lpString2="nl_NL") returned -1
	[0085.483] lstrcmpA (lpString1="..", lpString2="nl_NL") returned -1
	[0085.483] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.485] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.485] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.485] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.486] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.486] CloseHandle (hObject=0x94) returned 1
	[0085.487] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.487] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.487] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.487] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.487] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.487] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.490] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.490] CloseHandle (hObject=0x98) returned 1
	[0085.490] lstrcmpA (lpString1=".", lpString2="pl_PL") returned -1
	[0085.490] lstrcmpA (lpString1="..", lpString2="pl_PL") returned -1
	[0085.490] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.492] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.492] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.492] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.493] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.493] CloseHandle (hObject=0x94) returned 1
	[0085.494] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.494] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.494] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.494] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.495] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.495] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.497] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.497] CloseHandle (hObject=0x98) returned 1
	[0085.497] lstrcmpA (lpString1=".", lpString2="pt_BR") returned -1
	[0085.497] lstrcmpA (lpString1="..", lpString2="pt_BR") returned -1
	[0085.497] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.538] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.538] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.538] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.539] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.539] CloseHandle (hObject=0x94) returned 1
	[0085.540] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.540] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.540] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.541] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.541] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.541] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.567] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.567] CloseHandle (hObject=0x98) returned 1
	[0085.567] lstrcmpA (lpString1=".", lpString2="ro_RO") returned -1
	[0085.567] lstrcmpA (lpString1="..", lpString2="ro_RO") returned -1
	[0085.567] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.569] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.569] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.569] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.570] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.570] CloseHandle (hObject=0x94) returned 1
	[0085.571] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.571] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.571] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.571] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.571] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.571] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.573] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.574] CloseHandle (hObject=0x98) returned 1
	[0085.574] lstrcmpA (lpString1=".", lpString2="ru_RU") returned -1
	[0085.574] lstrcmpA (lpString1="..", lpString2="ru_RU") returned -1
	[0085.574] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.597] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.597] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.597] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.599] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.599] CloseHandle (hObject=0x94) returned 1
	[0085.600] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.600] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.600] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.602] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.602] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.602] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.605] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.605] CloseHandle (hObject=0x98) returned 1
	[0085.605] lstrcmpA (lpString1=".", lpString2="sk_SK") returned -1
	[0085.605] lstrcmpA (lpString1="..", lpString2="sk_SK") returned -1
	[0085.605] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.607] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.607] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.607] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.608] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.608] CloseHandle (hObject=0x94) returned 1
	[0085.610] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.610] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.610] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.610] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.610] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.610] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.613] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.613] CloseHandle (hObject=0x98) returned 1
	[0085.613] lstrcmpA (lpString1=".", lpString2="sl_SI") returned -1
	[0085.613] lstrcmpA (lpString1="..", lpString2="sl_SI") returned -1
	[0085.614] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.616] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.616] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.616] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.617] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.617] CloseHandle (hObject=0x94) returned 1
	[0085.619] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.619] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.619] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.620] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.620] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.620] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.717] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.718] CloseHandle (hObject=0x98) returned 1
	[0085.718] lstrcmpA (lpString1=".", lpString2="sv_SE") returned -1
	[0085.718] lstrcmpA (lpString1="..", lpString2="sv_SE") returned -1
	[0085.718] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.720] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.720] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.720] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.721] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.721] CloseHandle (hObject=0x94) returned 1
	[0085.722] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.722] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.722] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.722] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.722] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.722] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.724] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.725] CloseHandle (hObject=0x98) returned 1
	[0085.725] lstrcmpA (lpString1=".", lpString2="tr_TR") returned -1
	[0085.725] lstrcmpA (lpString1="..", lpString2="tr_TR") returned -1
	[0085.725] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.727] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.727] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.727] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.728] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.728] CloseHandle (hObject=0x94) returned 1
	[0085.729] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.729] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.729] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.732] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.732] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.733] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.736] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.736] CloseHandle (hObject=0x98) returned 1
	[0085.736] lstrcmpA (lpString1=".", lpString2="uk_UA") returned -1
	[0085.736] lstrcmpA (lpString1="..", lpString2="uk_UA") returned -1
	[0085.736] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.750] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.750] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.750] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.751] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.751] CloseHandle (hObject=0x94) returned 1
	[0085.752] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.752] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.752] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.753] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.753] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.753] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.755] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.755] CloseHandle (hObject=0x98) returned 1
	[0085.755] lstrcmpA (lpString1=".", lpString2="zh_CN") returned -1
	[0085.755] lstrcmpA (lpString1="..", lpString2="zh_CN") returned -1
	[0085.755] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.825] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.826] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.826] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.827] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.827] CloseHandle (hObject=0x94) returned 1
	[0085.828] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.828] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.828] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.829] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.829] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.830] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.832] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.832] CloseHandle (hObject=0x98) returned 1
	[0085.833] lstrcmpA (lpString1=".", lpString2="zh_TW") returned -1
	[0085.833] lstrcmpA (lpString1="..", lpString2="zh_TW") returned -1
	[0085.833] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.859] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.860] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.860] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.861] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.861] CloseHandle (hObject=0x94) returned 1
	[0085.862] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0085.862] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0085.862] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0085.863] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.863] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.863] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.866] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.866] CloseHandle (hObject=0x98) returned 1
	[0085.891] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0085.892] CloseHandle (hObject=0x8c) returned 1
	[0085.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\LogTransport2.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\logtransport2.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\LogTransport2.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\logtransport2.exe.boom")) returned 1
	[0085.981] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0085.982] CloseHandle (hObject=0x8c) returned 1
	[0085.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf.boom")) returned 1
	[0085.984] lstrcmpA (lpString1=".", lpString2="plug_ins") returned -1
	[0085.984] lstrcmpA (lpString1="..", lpString2="plug_ins") returned -1
	[0085.984] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0085.986] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.986] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.986] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.987] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.987] CloseHandle (hObject=0x90) returned 1
	[0085.987] lstrcmpA (lpString1=".", lpString2="AcroForm") returned -1
	[0085.987] lstrcmpA (lpString1="..", lpString2="AcroForm") returned -1
	[0085.987] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0085.987] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0085.987] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0085.987] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0085.988] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0085.988] CloseHandle (hObject=0x94) returned 1
	[0085.988] lstrcmpA (lpString1=".", lpString2="PMP") returned -1
	[0085.988] lstrcmpA (lpString1="..", lpString2="PMP") returned -1
	[0085.988] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0086.020] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0086.020] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0086.020] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0086.023] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0086.023] CloseHandle (hObject=0x98) returned 1
	[0086.023] lstrcmpA (lpString1=".", lpString2="Annotations") returned -1
	[0086.023] lstrcmpA (lpString1="..", lpString2="Annotations") returned -1
	[0086.023] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0086.039] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0086.039] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0086.039] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0086.039] lstrcmpA (lpString1=".", lpString2="Stamps") returned -1
	[0086.039] lstrcmpA (lpString1="..", lpString2="Stamps") returned -1
	[0086.039] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0086.048] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0086.049] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0086.049] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0086.049] lstrcmpA (lpString1=".", lpString2="CAT") returned -1
	[0086.049] lstrcmpA (lpString1="..", lpString2="CAT") returned -1
	[0086.049] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0086.061] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0086.061] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0086.061] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0086.062] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0086.062] CloseHandle (hObject=0x9c) returned 1
	[0086.109] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.110] CloseHandle (hObject=0x9c) returned 1
	[0086.110] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf.boom")) returned 1
	[0086.141] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.141] CloseHandle (hObject=0x9c) returned 1
	[0086.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf.boom")) returned 1
	[0086.145] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.146] CloseHandle (hObject=0x9c) returned 1
	[0086.146] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf.boom")) returned 1
	[0086.170] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.171] CloseHandle (hObject=0x9c) returned 1
	[0086.171] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf.boom")) returned 1
	[0086.176] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.176] CloseHandle (hObject=0x9c) returned 1
	[0086.176] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf.boom")) returned 1
	[0086.244] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.244] CloseHandle (hObject=0x9c) returned 1
	[0086.244] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf.boom")) returned 1
	[0086.245] lstrcmpA (lpString1=".", lpString2="CHS") returned -1
	[0086.245] lstrcmpA (lpString1="..", lpString2="CHS") returned -1
	[0086.245] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0086.247] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0086.247] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0086.247] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0086.250] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0086.250] CloseHandle (hObject=0x9c) returned 1
	[0086.329] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.329] CloseHandle (hObject=0x9c) returned 1
	[0086.329] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf.boom")) returned 1
	[0086.367] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.371] CloseHandle (hObject=0x9c) returned 1
	[0086.371] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf.boom")) returned 1
	[0086.384] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.384] CloseHandle (hObject=0x9c) returned 1
	[0086.384] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf.boom")) returned 1
	[0086.389] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.389] CloseHandle (hObject=0x9c) returned 1
	[0086.389] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf.boom")) returned 1
	[0086.390] lstrcmpA (lpString1=".", lpString2="CHT") returned -1
	[0086.390] lstrcmpA (lpString1="..", lpString2="CHT") returned -1
	[0086.390] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0086.391] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0086.391] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0086.391] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0086.393] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0086.395] CloseHandle (hObject=0x9c) returned 1
	[0086.422] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.423] CloseHandle (hObject=0x9c) returned 1
	[0086.423] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf.boom")) returned 1
	[0086.439] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.439] CloseHandle (hObject=0x9c) returned 1
	[0086.439] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf.boom")) returned 1
	[0086.472] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.472] CloseHandle (hObject=0x9c) returned 1
	[0086.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf.boom")) returned 1
	[0086.502] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.502] CloseHandle (hObject=0x9c) returned 1
	[0086.502] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf.boom")) returned 1
	[0086.504] lstrcmpA (lpString1=".", lpString2="CZE") returned -1
	[0086.504] lstrcmpA (lpString1="..", lpString2="CZE") returned -1
	[0086.504] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0086.537] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0086.537] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0086.537] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0086.538] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0086.538] CloseHandle (hObject=0x9c) returned 1
	[0086.561] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.561] CloseHandle (hObject=0x9c) returned 1
	[0086.561] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf.boom")) returned 1
	[0086.564] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.564] CloseHandle (hObject=0x9c) returned 1
	[0086.565] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf.boom")) returned 1
	[0086.596] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.596] CloseHandle (hObject=0x9c) returned 1
	[0086.596] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf.boom")) returned 1
	[0086.629] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0086.629] CloseHandle (hObject=0x9c) returned 1
	[0086.629] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf.boom")) returned 1
	[0087.136] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.136] CloseHandle (hObject=0x9c) returned 1
	[0087.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf.boom")) returned 1
	[0087.156] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.156] CloseHandle (hObject=0x9c) returned 1
	[0087.156] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf.boom")) returned 1
	[0087.158] lstrcmpA (lpString1=".", lpString2="DAN") returned -1
	[0087.158] lstrcmpA (lpString1="..", lpString2="DAN") returned -1
	[0087.158] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0087.158] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0087.158] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0087.158] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0087.161] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0087.161] CloseHandle (hObject=0x9c) returned 1
	[0087.184] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.184] CloseHandle (hObject=0x9c) returned 1
	[0087.184] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf.boom")) returned 1
	[0087.193] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.194] CloseHandle (hObject=0x9c) returned 1
	[0087.194] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf.boom")) returned 1
	[0087.198] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.198] CloseHandle (hObject=0x9c) returned 1
	[0087.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf.boom")) returned 1
	[0087.199] lstrcmpA (lpString1=".", lpString2="DEU") returned -1
	[0087.200] lstrcmpA (lpString1="..", lpString2="DEU") returned -1
	[0087.200] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0087.201] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0087.201] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0087.201] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0087.203] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0087.204] CloseHandle (hObject=0x9c) returned 1
	[0087.225] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.225] CloseHandle (hObject=0x9c) returned 1
	[0087.226] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf.boom")) returned 1
	[0087.306] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.306] CloseHandle (hObject=0x9c) returned 1
	[0087.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf.boom")) returned 1
	[0087.326] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.326] CloseHandle (hObject=0x9c) returned 1
	[0087.326] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf.boom")) returned 1
	[0087.327] lstrcmpA (lpString1=".", lpString2="ENU") returned -1
	[0087.327] lstrcmpA (lpString1="..", lpString2="ENU") returned -1
	[0087.327] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0087.328] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0087.328] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0087.328] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0087.331] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0087.331] CloseHandle (hObject=0x9c) returned 1
	[0087.346] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.346] CloseHandle (hObject=0x9c) returned 1
	[0087.346] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf.boom")) returned 1
	[0087.349] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.349] CloseHandle (hObject=0x9c) returned 1
	[0087.349] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf.boom")) returned 1
	[0087.362] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.362] CloseHandle (hObject=0x9c) returned 1
	[0087.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf.boom")) returned 1
	[0087.363] lstrcmpA (lpString1=".", lpString2="ESP") returned -1
	[0087.363] lstrcmpA (lpString1="..", lpString2="ESP") returned -1
	[0087.363] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0087.363] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0087.363] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0087.363] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0087.365] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0087.365] CloseHandle (hObject=0x9c) returned 1
	[0087.368] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.368] CloseHandle (hObject=0x9c) returned 1
	[0087.368] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf.boom")) returned 1
	[0087.370] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.370] CloseHandle (hObject=0x9c) returned 1
	[0087.370] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf.boom")) returned 1
	[0087.383] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.383] CloseHandle (hObject=0x9c) returned 1
	[0087.383] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf.boom")) returned 1
	[0087.384] lstrcmpA (lpString1=".", lpString2="EUQ") returned -1
	[0087.384] lstrcmpA (lpString1="..", lpString2="EUQ") returned -1
	[0087.384] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0087.418] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0087.419] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0087.419] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0087.420] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0087.420] CloseHandle (hObject=0x9c) returned 1
	[0087.468] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.468] CloseHandle (hObject=0x9c) returned 1
	[0087.468] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf.boom")) returned 1
	[0087.494] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.494] CloseHandle (hObject=0x9c) returned 1
	[0087.495] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf.boom")) returned 1
	[0087.504] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.504] CloseHandle (hObject=0x9c) returned 1
	[0087.505] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf.boom")) returned 1
	[0087.519] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.519] CloseHandle (hObject=0x9c) returned 1
	[0087.519] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf.boom")) returned 1
	[0087.562] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.562] CloseHandle (hObject=0x9c) returned 1
	[0087.562] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf.boom")) returned 1
	[0087.604] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0087.604] CloseHandle (hObject=0x9c) returned 1
	[0087.604] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf.boom")) returned 1
	[0087.605] lstrcmpA (lpString1=".", lpString2="FRA") returned -1
	[0087.605] lstrcmpA (lpString1="..", lpString2="FRA") returned -1
	[0087.605] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0087.606] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0087.606] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0087.606] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0087.616] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0087.616] CloseHandle (hObject=0x9c) returned 1
	[0088.127] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.127] CloseHandle (hObject=0x9c) returned 1
	[0088.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf.boom")) returned 1
	[0088.137] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.137] CloseHandle (hObject=0x9c) returned 1
	[0088.138] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf.boom")) returned 1
	[0088.156] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.156] CloseHandle (hObject=0x9c) returned 1
	[0088.157] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf.boom")) returned 1
	[0088.158] lstrcmpA (lpString1=".", lpString2="HRV") returned -1
	[0088.158] lstrcmpA (lpString1="..", lpString2="HRV") returned -1
	[0088.158] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0088.171] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0088.171] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0088.171] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0088.172] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0088.172] CloseHandle (hObject=0x9c) returned 1
	[0088.213] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.213] CloseHandle (hObject=0x9c) returned 1
	[0088.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf.boom")) returned 1
	[0088.217] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.217] CloseHandle (hObject=0x9c) returned 1
	[0088.217] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf.boom")) returned 1
	[0088.227] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.227] CloseHandle (hObject=0x9c) returned 1
	[0088.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf.boom")) returned 1
	[0088.236] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.236] CloseHandle (hObject=0x9c) returned 1
	[0088.236] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf.boom")) returned 1
	[0088.240] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.240] CloseHandle (hObject=0x9c) returned 1
	[0088.240] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf.boom")) returned 1
	[0088.394] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.394] CloseHandle (hObject=0x9c) returned 1
	[0088.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf.boom")) returned 1
	[0088.395] lstrcmpA (lpString1=".", lpString2="HUN") returned -1
	[0088.395] lstrcmpA (lpString1="..", lpString2="HUN") returned -1
	[0088.395] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0088.397] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0088.397] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0088.397] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0088.398] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0088.398] CloseHandle (hObject=0x9c) returned 1
	[0088.409] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.409] CloseHandle (hObject=0x9c) returned 1
	[0088.409] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf.boom")) returned 1
	[0088.412] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.412] CloseHandle (hObject=0x9c) returned 1
	[0088.412] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf.boom")) returned 1
	[0088.415] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.415] CloseHandle (hObject=0x9c) returned 1
	[0088.415] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf.boom")) returned 1
	[0088.424] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.424] CloseHandle (hObject=0x9c) returned 1
	[0088.424] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf.boom")) returned 1
	[0088.451] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.451] CloseHandle (hObject=0x9c) returned 1
	[0088.451] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf.boom")) returned 1
	[0088.460] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.460] CloseHandle (hObject=0x9c) returned 1
	[0088.460] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf.boom")) returned 1
	[0088.461] lstrcmpA (lpString1=".", lpString2="ITA") returned -1
	[0088.461] lstrcmpA (lpString1="..", lpString2="ITA") returned -1
	[0088.461] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0088.462] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0088.462] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0088.462] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0088.464] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0088.464] CloseHandle (hObject=0x9c) returned 1
	[0088.466] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.466] CloseHandle (hObject=0x9c) returned 1
	[0088.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf.boom")) returned 1
	[0088.895] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.895] CloseHandle (hObject=0x9c) returned 1
	[0088.895] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf.boom")) returned 1
	[0088.910] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0088.910] CloseHandle (hObject=0x9c) returned 1
	[0088.910] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf.boom")) returned 1
	[0088.911] lstrcmpA (lpString1=".", lpString2="JPN") returned -1
	[0088.911] lstrcmpA (lpString1="..", lpString2="JPN") returned -1
	[0088.911] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0088.990] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0088.991] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0088.991] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0088.993] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0088.993] CloseHandle (hObject=0x9c) returned 1
	[0089.104] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.104] CloseHandle (hObject=0x9c) returned 1
	[0089.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf.boom")) returned 1
	[0089.191] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.191] CloseHandle (hObject=0x9c) returned 1
	[0089.191] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf.boom")) returned 1
	[0089.195] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.195] CloseHandle (hObject=0x9c) returned 1
	[0089.195] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf.boom")) returned 1
	[0089.209] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.209] CloseHandle (hObject=0x9c) returned 1
	[0089.209] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf.boom")) returned 1
	[0089.210] lstrcmpA (lpString1=".", lpString2="KOR") returned -1
	[0089.210] lstrcmpA (lpString1="..", lpString2="KOR") returned -1
	[0089.210] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0089.210] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0089.210] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0089.210] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0089.212] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0089.212] CloseHandle (hObject=0x9c) returned 1
	[0089.221] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.221] CloseHandle (hObject=0x9c) returned 1
	[0089.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf.boom")) returned 1
	[0089.239] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.239] CloseHandle (hObject=0x9c) returned 1
	[0089.239] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf.boom")) returned 1
	[0089.245] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.245] CloseHandle (hObject=0x9c) returned 1
	[0089.245] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf.boom")) returned 1
	[0089.249] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.249] CloseHandle (hObject=0x9c) returned 1
	[0089.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf.boom")) returned 1
	[0089.250] lstrcmpA (lpString1=".", lpString2="NLD") returned -1
	[0089.250] lstrcmpA (lpString1="..", lpString2="NLD") returned -1
	[0089.250] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0089.251] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0089.251] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0089.251] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0089.253] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0089.253] CloseHandle (hObject=0x9c) returned 1
	[0089.363] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.363] CloseHandle (hObject=0x9c) returned 1
	[0089.363] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf.boom")) returned 1
	[0089.368] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.368] CloseHandle (hObject=0x9c) returned 1
	[0089.368] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf.boom")) returned 1
	[0089.383] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.383] CloseHandle (hObject=0x9c) returned 1
	[0089.383] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf.boom")) returned 1
	[0089.384] lstrcmpA (lpString1=".", lpString2="NOR") returned -1
	[0089.384] lstrcmpA (lpString1="..", lpString2="NOR") returned -1
	[0089.384] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0089.384] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0089.384] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0089.384] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0089.393] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0089.394] CloseHandle (hObject=0x9c) returned 1
	[0089.396] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.396] CloseHandle (hObject=0x9c) returned 1
	[0089.396] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf.boom")) returned 1
	[0089.400] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.400] CloseHandle (hObject=0x9c) returned 1
	[0089.400] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf.boom")) returned 1
	[0089.488] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.488] CloseHandle (hObject=0x9c) returned 1
	[0089.492] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf.boom")) returned 1
	[0089.494] lstrcmpA (lpString1=".", lpString2="POL") returned -1
	[0089.494] lstrcmpA (lpString1="..", lpString2="POL") returned -1
	[0089.494] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0089.510] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0089.510] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0089.510] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0089.511] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0089.511] CloseHandle (hObject=0x9c) returned 1
	[0089.569] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.569] CloseHandle (hObject=0x9c) returned 1
	[0089.569] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf.boom")) returned 1
	[0089.585] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.586] CloseHandle (hObject=0x9c) returned 1
	[0089.586] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf.boom")) returned 1
	[0089.659] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.659] CloseHandle (hObject=0x9c) returned 1
	[0089.659] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf.boom")) returned 1
	[0089.685] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.685] CloseHandle (hObject=0x9c) returned 1
	[0089.685] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf.boom")) returned 1
	[0089.726] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.726] CloseHandle (hObject=0x9c) returned 1
	[0089.726] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf.boom")) returned 1
	[0089.766] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.766] CloseHandle (hObject=0x9c) returned 1
	[0089.766] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf.boom")) returned 1
	[0089.767] lstrcmpA (lpString1=".", lpString2="PTB") returned -1
	[0089.767] lstrcmpA (lpString1="..", lpString2="PTB") returned -1
	[0089.768] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0089.768] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0089.768] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0089.768] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0089.770] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0089.770] CloseHandle (hObject=0x9c) returned 1
	[0089.790] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.790] CloseHandle (hObject=0x9c) returned 1
	[0089.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf.boom")) returned 1
	[0089.793] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.793] CloseHandle (hObject=0x9c) returned 1
	[0089.793] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf.boom")) returned 1
	[0089.812] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.812] CloseHandle (hObject=0x9c) returned 1
	[0089.812] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf.boom")) returned 1
	[0089.813] lstrcmpA (lpString1=".", lpString2="RUM") returned -1
	[0089.813] lstrcmpA (lpString1="..", lpString2="RUM") returned -1
	[0089.813] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0089.907] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0089.907] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0089.907] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0089.908] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0089.908] CloseHandle (hObject=0x9c) returned 1
	[0089.927] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.927] CloseHandle (hObject=0x9c) returned 1
	[0089.927] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf.boom")) returned 1
	[0089.935] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.935] CloseHandle (hObject=0x9c) returned 1
	[0089.935] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf.boom")) returned 1
	[0089.942] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.942] CloseHandle (hObject=0x9c) returned 1
	[0089.942] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf.boom")) returned 1
	[0089.947] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.947] CloseHandle (hObject=0x9c) returned 1
	[0089.947] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf.boom")) returned 1
	[0089.952] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.952] CloseHandle (hObject=0x9c) returned 1
	[0089.952] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf.boom")) returned 1
	[0089.976] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.976] CloseHandle (hObject=0x9c) returned 1
	[0089.976] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf.boom")) returned 1
	[0089.980] lstrcmpA (lpString1=".", lpString2="RUS") returned -1
	[0089.980] lstrcmpA (lpString1="..", lpString2="RUS") returned -1
	[0089.980] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0089.984] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0089.984] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0089.985] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0089.985] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0089.985] CloseHandle (hObject=0x9c) returned 1
	[0089.999] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0089.999] CloseHandle (hObject=0x9c) returned 1
	[0090.000] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf.boom")) returned 1
	[0090.002] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.002] CloseHandle (hObject=0x9c) returned 1
	[0090.003] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf.boom")) returned 1
	[0090.049] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.049] CloseHandle (hObject=0x9c) returned 1
	[0090.049] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf.boom")) returned 1
	[0090.112] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.112] CloseHandle (hObject=0x9c) returned 1
	[0090.112] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf.boom")) returned 1
	[0090.124] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.124] CloseHandle (hObject=0x9c) returned 1
	[0090.124] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf.boom")) returned 1
	[0090.147] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.147] CloseHandle (hObject=0x9c) returned 1
	[0090.147] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf.boom")) returned 1
	[0090.148] lstrcmpA (lpString1=".", lpString2="SKY") returned -1
	[0090.148] lstrcmpA (lpString1="..", lpString2="SKY") returned -1
	[0090.148] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0090.150] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0090.150] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0090.150] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0090.151] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0090.151] CloseHandle (hObject=0x9c) returned 1
	[0090.162] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.162] CloseHandle (hObject=0x9c) returned 1
	[0090.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf.boom")) returned 1
	[0090.166] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.166] CloseHandle (hObject=0x9c) returned 1
	[0090.166] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf.boom")) returned 1
	[0090.218] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.218] CloseHandle (hObject=0x9c) returned 1
	[0090.218] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf.boom")) returned 1
	[0090.253] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.253] CloseHandle (hObject=0x9c) returned 1
	[0090.253] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf.boom")) returned 1
	[0090.304] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.304] CloseHandle (hObject=0x9c) returned 1
	[0090.304] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf.boom")) returned 1
	[0090.320] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.320] CloseHandle (hObject=0x9c) returned 1
	[0090.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf.boom")) returned 1
	[0090.321] lstrcmpA (lpString1=".", lpString2="SLV") returned -1
	[0090.321] lstrcmpA (lpString1="..", lpString2="SLV") returned -1
	[0090.321] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0090.323] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0090.323] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0090.323] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0090.324] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0090.324] CloseHandle (hObject=0x9c) returned 1
	[0090.394] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.394] CloseHandle (hObject=0x9c) returned 1
	[0090.394] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf.boom")) returned 1
	[0090.444] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.444] CloseHandle (hObject=0x9c) returned 1
	[0090.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf.boom")) returned 1
	[0090.533] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.534] CloseHandle (hObject=0x9c) returned 1
	[0090.534] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf.boom")) returned 1
	[0090.551] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.551] CloseHandle (hObject=0x9c) returned 1
	[0090.551] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf.boom")) returned 1
	[0090.568] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.568] CloseHandle (hObject=0x9c) returned 1
	[0090.568] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf.boom")) returned 1
	[0090.595] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.595] CloseHandle (hObject=0x9c) returned 1
	[0090.595] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf.boom")) returned 1
	[0090.596] lstrcmpA (lpString1=".", lpString2="SUO") returned -1
	[0090.596] lstrcmpA (lpString1="..", lpString2="SUO") returned -1
	[0090.597] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0090.597] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0090.597] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0090.597] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0090.660] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0090.660] CloseHandle (hObject=0x9c) returned 1
	[0090.748] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.748] CloseHandle (hObject=0x9c) returned 1
	[0090.748] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf.boom")) returned 1
	[0090.751] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.751] CloseHandle (hObject=0x9c) returned 1
	[0090.751] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf.boom")) returned 1
	[0090.803] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.803] CloseHandle (hObject=0x9c) returned 1
	[0090.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf.boom")) returned 1
	[0090.804] lstrcmpA (lpString1=".", lpString2="SVE") returned -1
	[0090.804] lstrcmpA (lpString1="..", lpString2="SVE") returned -1
	[0090.805] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0090.805] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0090.805] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0090.805] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0090.807] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0090.808] CloseHandle (hObject=0x9c) returned 1
	[0090.830] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.830] CloseHandle (hObject=0x9c) returned 1
	[0090.830] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf.boom")) returned 1
	[0090.833] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.833] CloseHandle (hObject=0x9c) returned 1
	[0090.834] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf.boom")) returned 1
	[0090.850] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.850] CloseHandle (hObject=0x9c) returned 1
	[0090.850] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf.boom")) returned 1
	[0090.852] lstrcmpA (lpString1=".", lpString2="TUR") returned -1
	[0090.852] lstrcmpA (lpString1="..", lpString2="TUR") returned -1
	[0090.852] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0090.855] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0090.855] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0090.855] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0090.856] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0090.856] CloseHandle (hObject=0x9c) returned 1
	[0090.966] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.966] CloseHandle (hObject=0x9c) returned 1
	[0090.966] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf.boom")) returned 1
	[0090.971] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.971] CloseHandle (hObject=0x9c) returned 1
	[0090.971] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf.boom")) returned 1
	[0090.981] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0090.981] CloseHandle (hObject=0x9c) returned 1
	[0090.981] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf.boom")) returned 1
	[0091.031] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.031] CloseHandle (hObject=0x9c) returned 1
	[0091.031] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf.boom")) returned 1
	[0091.040] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.040] CloseHandle (hObject=0x9c) returned 1
	[0091.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf.boom")) returned 1
	[0091.103] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.103] CloseHandle (hObject=0x9c) returned 1
	[0091.103] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf.boom")) returned 1
	[0091.105] lstrcmpA (lpString1=".", lpString2="UKR") returned -1
	[0091.105] lstrcmpA (lpString1="..", lpString2="UKR") returned -1
	[0091.105] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0091.106] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.106] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.106] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.107] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.107] CloseHandle (hObject=0x9c) returned 1
	[0091.120] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.121] CloseHandle (hObject=0x9c) returned 1
	[0091.121] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf.boom")) returned 1
	[0091.124] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.124] CloseHandle (hObject=0x9c) returned 1
	[0091.124] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf.boom")) returned 1
	[0091.132] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.132] CloseHandle (hObject=0x9c) returned 1
	[0091.132] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf.boom")) returned 1
	[0091.136] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.136] CloseHandle (hObject=0x9c) returned 1
	[0091.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf.boom")) returned 1
	[0091.170] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.170] CloseHandle (hObject=0x9c) returned 1
	[0091.170] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf.boom")) returned 1
	[0091.184] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.185] CloseHandle (hObject=0x9c) returned 1
	[0091.185] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf.boom")) returned 1
	[0091.187] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.187] CloseHandle (hObject=0x98) returned 1
	[0091.228] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.228] CloseHandle (hObject=0x98) returned 1
	[0091.228] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf.boom")) returned 1
	[0091.229] lstrcmpA (lpString1=".", lpString2="Multimedia") returned -1
	[0091.230] lstrcmpA (lpString1="..", lpString2="Multimedia") returned -1
	[0091.230] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0091.237] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.237] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.237] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.237] lstrcmpA (lpString1=".", lpString2="MPP") returned -1
	[0091.238] lstrcmpA (lpString1="..", lpString2="MPP") returned -1
	[0091.238] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.250] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.251] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.251] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.252] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.252] CloseHandle (hObject=0x98) returned 1
	[0091.263] lstrcmpA (lpString1=".", lpString2="MPP_CZE") returned -1
	[0091.263] lstrcmpA (lpString1="..", lpString2="MPP_CZE") returned -1
	[0091.263] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.264] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.264] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.264] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.305] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.305] CloseHandle (hObject=0x98) returned 1
	[0091.306] lstrcmpA (lpString1=".", lpString2="MPP_HRV") returned -1
	[0091.306] lstrcmpA (lpString1="..", lpString2="MPP_HRV") returned -1
	[0091.306] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.307] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.307] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.307] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.310] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.310] CloseHandle (hObject=0x98) returned 1
	[0091.310] lstrcmpA (lpString1=".", lpString2="MPP_HUN") returned -1
	[0091.310] lstrcmpA (lpString1="..", lpString2="MPP_HUN") returned -1
	[0091.310] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.311] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.311] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.311] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.332] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.332] CloseHandle (hObject=0x98) returned 1
	[0091.332] lstrcmpA (lpString1=".", lpString2="MPP_POL") returned -1
	[0091.332] lstrcmpA (lpString1="..", lpString2="MPP_POL") returned -1
	[0091.332] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.333] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.333] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.333] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.336] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.336] CloseHandle (hObject=0x98) returned 1
	[0091.336] lstrcmpA (lpString1=".", lpString2="MPP_RUM") returned -1
	[0091.336] lstrcmpA (lpString1="..", lpString2="MPP_RUM") returned -1
	[0091.336] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.337] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.337] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.337] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.352] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.352] CloseHandle (hObject=0x98) returned 1
	[0091.352] lstrcmpA (lpString1=".", lpString2="MPP_RUS") returned -1
	[0091.352] lstrcmpA (lpString1="..", lpString2="MPP_RUS") returned -1
	[0091.352] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.353] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.353] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.353] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.355] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.355] CloseHandle (hObject=0x98) returned 1
	[0091.355] lstrcmpA (lpString1=".", lpString2="MPP_SKY") returned -1
	[0091.356] lstrcmpA (lpString1="..", lpString2="MPP_SKY") returned -1
	[0091.356] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.356] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.356] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.356] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.378] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.379] CloseHandle (hObject=0x98) returned 1
	[0091.379] lstrcmpA (lpString1=".", lpString2="MPP_SLV") returned -1
	[0091.379] lstrcmpA (lpString1="..", lpString2="MPP_SLV") returned -1
	[0091.379] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.380] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.380] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.380] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.382] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.382] CloseHandle (hObject=0x98) returned 1
	[0091.383] lstrcmpA (lpString1=".", lpString2="MPP_TUR") returned -1
	[0091.383] lstrcmpA (lpString1="..", lpString2="MPP_TUR") returned -1
	[0091.383] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.383] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.383] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.383] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.385] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.385] CloseHandle (hObject=0x98) returned 1
	[0091.386] lstrcmpA (lpString1=".", lpString2="MPP_UKR") returned -1
	[0091.386] lstrcmpA (lpString1="..", lpString2="MPP_UKR") returned -1
	[0091.386] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0091.387] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.387] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.387] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.389] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.389] CloseHandle (hObject=0x98) returned 1
	[0091.389] lstrcmpA (lpString1=".", lpString2="plug_ins3d") returned -1
	[0091.390] lstrcmpA (lpString1="..", lpString2="plug_ins3d") returned -1
	[0091.390] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0091.405] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.405] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.405] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.406] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.406] CloseHandle (hObject=0x90) returned 1
	[0091.406] lstrcmpA (lpString1=".", lpString2="prc") returned -1
	[0091.406] lstrcmpA (lpString1="..", lpString2="prc") returned -1
	[0091.406] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0091.413] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.413] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.413] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.414] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.414] CloseHandle (hObject=0x94) returned 1
	[0091.416] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.416] CloseHandle (hObject=0x8c) returned 1
	[0091.416] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer.boom")) returned 1
	[0091.485] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.485] CloseHandle (hObject=0x8c) returned 1
	[0091.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\reader_sl.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\reader_sl.exe.boom")) returned 1
	[0091.487] lstrcmpA (lpString1=".", lpString2="Services") returned -1
	[0091.487] lstrcmpA (lpString1="..", lpString2="Services") returned -1
	[0091.487] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0091.488] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.488] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.488] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.489] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.489] CloseHandle (hObject=0x90) returned 1
	[0091.489] lstrcmpA (lpString1=".", lpString2="SPPlugins") returned -1
	[0091.489] lstrcmpA (lpString1="..", lpString2="SPPlugins") returned -1
	[0091.489] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0091.490] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.490] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.490] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.491] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.491] CloseHandle (hObject=0x90) returned 1
	[0091.491] lstrcmpA (lpString1=".", lpString2="Tracker") returned -1
	[0091.491] lstrcmpA (lpString1="..", lpString2="Tracker") returned -1
	[0091.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0091.569] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0091.570] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0091.570] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0091.571] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0091.571] CloseHandle (hObject=0x90) returned 1
	[0091.573] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.573] CloseHandle (hObject=0x90) returned 1
	[0091.573] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif.boom")) returned 1
	[0091.576] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.576] CloseHandle (hObject=0x90) returned 1
	[0091.576] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif.boom")) returned 1
	[0091.578] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.578] CloseHandle (hObject=0x90) returned 1
	[0091.578] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif.boom")) returned 1
	[0091.580] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.580] CloseHandle (hObject=0x90) returned 1
	[0091.580] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif.boom")) returned 1
	[0091.583] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.583] CloseHandle (hObject=0x90) returned 1
	[0091.583] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif.boom")) returned 1
	[0091.585] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.585] CloseHandle (hObject=0x90) returned 1
	[0091.585] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif.boom")) returned 1
	[0091.587] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.587] CloseHandle (hObject=0x90) returned 1
	[0091.587] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif.boom")) returned 1
	[0091.589] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.589] CloseHandle (hObject=0x90) returned 1
	[0091.589] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif.boom")) returned 1
	[0091.591] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.591] CloseHandle (hObject=0x90) returned 1
	[0091.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif.boom")) returned 1
	[0091.593] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.593] CloseHandle (hObject=0x90) returned 1
	[0091.593] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif.boom")) returned 1
	[0091.596] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.596] CloseHandle (hObject=0x90) returned 1
	[0091.596] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif.boom")) returned 1
	[0091.598] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.598] CloseHandle (hObject=0x90) returned 1
	[0091.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif.boom")) returned 1
	[0091.600] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.600] CloseHandle (hObject=0x90) returned 1
	[0091.600] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif.boom")) returned 1
	[0091.602] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.602] CloseHandle (hObject=0x90) returned 1
	[0091.602] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif.boom")) returned 1
	[0091.604] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.604] CloseHandle (hObject=0x90) returned 1
	[0091.604] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif.boom")) returned 1
	[0091.607] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.607] CloseHandle (hObject=0x90) returned 1
	[0091.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif.boom")) returned 1
	[0091.608] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.609] CloseHandle (hObject=0x90) returned 1
	[0091.609] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif.boom")) returned 1
	[0091.610] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.610] CloseHandle (hObject=0x90) returned 1
	[0091.611] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif.boom")) returned 1
	[0091.612] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.612] CloseHandle (hObject=0x90) returned 1
	[0091.613] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif.boom")) returned 1
	[0091.615] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.615] CloseHandle (hObject=0x90) returned 1
	[0091.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif.boom")) returned 1
	[0091.617] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.617] CloseHandle (hObject=0x90) returned 1
	[0091.617] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif.boom")) returned 1
	[0091.619] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.619] CloseHandle (hObject=0x90) returned 1
	[0091.619] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif.boom")) returned 1
	[0091.622] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.622] CloseHandle (hObject=0x90) returned 1
	[0091.622] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif.boom")) returned 1
	[0091.641] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.641] CloseHandle (hObject=0x90) returned 1
	[0091.641] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif.boom")) returned 1
	[0091.643] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.643] CloseHandle (hObject=0x90) returned 1
	[0091.643] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif.boom")) returned 1
	[0091.645] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.645] CloseHandle (hObject=0x90) returned 1
	[0091.645] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif.boom")) returned 1
	[0091.647] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.647] CloseHandle (hObject=0x90) returned 1
	[0091.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif.boom")) returned 1
	[0091.649] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.649] CloseHandle (hObject=0x90) returned 1
	[0091.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif.boom")) returned 1
	[0091.652] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.652] CloseHandle (hObject=0x90) returned 1
	[0091.652] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif.boom")) returned 1
	[0091.654] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.654] CloseHandle (hObject=0x90) returned 1
	[0091.654] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif.boom")) returned 1
	[0091.656] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.656] CloseHandle (hObject=0x90) returned 1
	[0091.656] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif.boom")) returned 1
	[0091.658] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.658] CloseHandle (hObject=0x90) returned 1
	[0091.658] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif.boom")) returned 1
	[0091.660] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.660] CloseHandle (hObject=0x90) returned 1
	[0091.660] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif.boom")) returned 1
	[0091.662] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.662] CloseHandle (hObject=0x90) returned 1
	[0091.662] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif.boom")) returned 1
	[0091.664] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.664] CloseHandle (hObject=0x90) returned 1
	[0091.664] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif.boom")) returned 1
	[0091.670] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.670] CloseHandle (hObject=0x90) returned 1
	[0091.670] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif.boom")) returned 1
	[0091.672] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.672] CloseHandle (hObject=0x90) returned 1
	[0091.672] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif.boom")) returned 1
	[0091.673] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.673] CloseHandle (hObject=0x90) returned 1
	[0091.673] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif.boom")) returned 1
	[0091.691] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.692] CloseHandle (hObject=0x8c) returned 1
	[0091.692] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\wow_helper.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\wow_helper.exe.boom")) returned 1
	[0091.901] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.901] CloseHandle (hObject=0x88) returned 1
	[0091.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm.boom")) returned 1
	[0091.908] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0091.908] CloseHandle (hObject=0x88) returned 1
	[0091.908] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm.boom")) returned 1
	[0092.003] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.003] CloseHandle (hObject=0x88) returned 1
	[0092.003] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm.boom")) returned 1
	[0092.109] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.109] CloseHandle (hObject=0x88) returned 1
	[0092.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm.boom")) returned 1
	[0092.248] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.248] CloseHandle (hObject=0x88) returned 1
	[0092.248] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm.boom")) returned 1
	[0092.263] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.263] CloseHandle (hObject=0x88) returned 1
	[0092.263] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm.boom")) returned 1
	[0092.335] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.335] CloseHandle (hObject=0x88) returned 1
	[0092.335] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm.boom")) returned 1
	[0092.404] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.404] CloseHandle (hObject=0x88) returned 1
	[0092.404] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm.boom")) returned 1
	[0092.448] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.448] CloseHandle (hObject=0x88) returned 1
	[0092.449] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm.boom")) returned 1
	[0092.452] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.452] CloseHandle (hObject=0x88) returned 1
	[0092.452] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm.boom")) returned 1
	[0092.546] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.546] CloseHandle (hObject=0x88) returned 1
	[0092.546] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm.boom")) returned 1
	[0092.549] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.549] CloseHandle (hObject=0x88) returned 1
	[0092.549] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm.boom")) returned 1
	[0092.604] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0092.604] CloseHandle (hObject=0x88) returned 1
	[0092.605] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm.boom")) returned 1
	[0092.606] lstrcmpA (lpString1=".", lpString2="Resource") returned -1
	[0092.606] lstrcmpA (lpString1="..", lpString2="Resource") returned -1
	[0092.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0092.975] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0092.975] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0092.975] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0092.975] lstrcmpA (lpString1=".", lpString2="CIDFont") returned -1
	[0092.975] lstrcmpA (lpString1="..", lpString2="CIDFont") returned -1
	[0092.975] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0093.266] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0093.266] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0093.266] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0093.267] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0093.268] CloseHandle (hObject=0x90) returned 1
	[0093.268] lstrcmpA (lpString1=".", lpString2="CMap") returned -1
	[0093.268] lstrcmpA (lpString1="..", lpString2="CMap") returned -1
	[0093.268] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0093.661] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0093.964] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0093.964] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0093.974] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.974] CloseHandle (hObject=0xffffffff) returned 0
	[0093.974] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.974] CloseHandle (hObject=0xffffffff) returned 0
	[0093.974] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.974] CloseHandle (hObject=0xffffffff) returned 0
	[0093.975] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.975] CloseHandle (hObject=0xffffffff) returned 0
	[0093.975] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.975] CloseHandle (hObject=0xffffffff) returned 0
	[0093.975] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.975] CloseHandle (hObject=0xffffffff) returned 0
	[0093.975] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.975] CloseHandle (hObject=0xffffffff) returned 0
	[0093.976] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.976] CloseHandle (hObject=0xffffffff) returned 0
	[0093.976] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.976] CloseHandle (hObject=0xffffffff) returned 0
	[0093.976] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.976] CloseHandle (hObject=0xffffffff) returned 0
	[0093.976] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.976] CloseHandle (hObject=0xffffffff) returned 0
	[0093.977] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.977] CloseHandle (hObject=0xffffffff) returned 0
	[0093.977] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.977] CloseHandle (hObject=0xffffffff) returned 0
	[0093.977] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.977] CloseHandle (hObject=0xffffffff) returned 0
	[0093.977] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.977] CloseHandle (hObject=0xffffffff) returned 0
	[0093.978] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.978] CloseHandle (hObject=0xffffffff) returned 0
	[0093.978] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.978] CloseHandle (hObject=0xffffffff) returned 0
	[0093.978] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.978] CloseHandle (hObject=0xffffffff) returned 0
	[0093.978] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.978] CloseHandle (hObject=0xffffffff) returned 0
	[0093.978] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.978] CloseHandle (hObject=0xffffffff) returned 0
	[0093.978] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.979] CloseHandle (hObject=0xffffffff) returned 0
	[0093.979] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.979] CloseHandle (hObject=0xffffffff) returned 0
	[0093.979] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.979] CloseHandle (hObject=0xffffffff) returned 0
	[0093.979] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.979] CloseHandle (hObject=0xffffffff) returned 0
	[0093.979] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.979] CloseHandle (hObject=0xffffffff) returned 0
	[0093.979] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.979] CloseHandle (hObject=0xffffffff) returned 0
	[0093.980] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.980] CloseHandle (hObject=0xffffffff) returned 0
	[0093.980] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.980] CloseHandle (hObject=0xffffffff) returned 0
	[0093.980] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.980] CloseHandle (hObject=0xffffffff) returned 0
	[0093.980] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.980] CloseHandle (hObject=0xffffffff) returned 0
	[0093.980] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.980] CloseHandle (hObject=0xffffffff) returned 0
	[0093.980] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.981] CloseHandle (hObject=0xffffffff) returned 0
	[0093.981] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.981] CloseHandle (hObject=0xffffffff) returned 0
	[0093.981] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.982] CloseHandle (hObject=0xffffffff) returned 0
	[0093.982] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.982] CloseHandle (hObject=0xffffffff) returned 0
	[0093.982] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.982] CloseHandle (hObject=0xffffffff) returned 0
	[0093.982] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.982] CloseHandle (hObject=0xffffffff) returned 0
	[0093.982] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.982] CloseHandle (hObject=0xffffffff) returned 0
	[0093.982] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.982] CloseHandle (hObject=0xffffffff) returned 0
	[0093.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.983] CloseHandle (hObject=0xffffffff) returned 0
	[0093.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.983] CloseHandle (hObject=0xffffffff) returned 0
	[0093.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.983] CloseHandle (hObject=0xffffffff) returned 0
	[0093.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.983] CloseHandle (hObject=0xffffffff) returned 0
	[0093.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.983] CloseHandle (hObject=0xffffffff) returned 0
	[0093.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.984] CloseHandle (hObject=0xffffffff) returned 0
	[0093.984] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.984] CloseHandle (hObject=0xffffffff) returned 0
	[0093.984] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.984] CloseHandle (hObject=0xffffffff) returned 0
	[0093.984] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.984] CloseHandle (hObject=0xffffffff) returned 0
	[0093.984] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.984] CloseHandle (hObject=0xffffffff) returned 0
	[0093.984] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.984] CloseHandle (hObject=0xffffffff) returned 0
	[0093.985] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.985] CloseHandle (hObject=0xffffffff) returned 0
	[0093.985] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.985] CloseHandle (hObject=0xffffffff) returned 0
	[0093.985] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.985] CloseHandle (hObject=0xffffffff) returned 0
	[0093.985] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.985] CloseHandle (hObject=0xffffffff) returned 0
	[0093.986] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.986] CloseHandle (hObject=0xffffffff) returned 0
	[0093.986] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.986] CloseHandle (hObject=0xffffffff) returned 0
	[0093.986] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.986] CloseHandle (hObject=0xffffffff) returned 0
	[0093.986] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.986] CloseHandle (hObject=0xffffffff) returned 0
	[0093.987] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.987] CloseHandle (hObject=0xffffffff) returned 0
	[0093.987] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.987] CloseHandle (hObject=0xffffffff) returned 0
	[0093.987] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.987] CloseHandle (hObject=0xffffffff) returned 0
	[0093.987] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.987] CloseHandle (hObject=0xffffffff) returned 0
	[0093.988] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.988] CloseHandle (hObject=0xffffffff) returned 0
	[0093.991] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.991] CloseHandle (hObject=0xffffffff) returned 0
	[0093.991] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.991] CloseHandle (hObject=0xffffffff) returned 0
	[0093.991] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.991] CloseHandle (hObject=0xffffffff) returned 0
	[0093.991] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.991] CloseHandle (hObject=0xffffffff) returned 0
	[0093.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.992] CloseHandle (hObject=0xffffffff) returned 0
	[0093.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.992] CloseHandle (hObject=0xffffffff) returned 0
	[0093.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.992] CloseHandle (hObject=0xffffffff) returned 0
	[0093.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.992] CloseHandle (hObject=0xffffffff) returned 0
	[0093.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.992] CloseHandle (hObject=0xffffffff) returned 0
	[0093.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.993] CloseHandle (hObject=0xffffffff) returned 0
	[0093.993] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.993] CloseHandle (hObject=0xffffffff) returned 0
	[0093.993] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.993] CloseHandle (hObject=0xffffffff) returned 0
	[0093.993] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.993] CloseHandle (hObject=0xffffffff) returned 0
	[0093.993] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.993] CloseHandle (hObject=0xffffffff) returned 0
	[0093.994] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.994] CloseHandle (hObject=0xffffffff) returned 0
	[0093.994] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.994] CloseHandle (hObject=0xffffffff) returned 0
	[0093.994] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.994] CloseHandle (hObject=0xffffffff) returned 0
	[0093.994] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.994] CloseHandle (hObject=0xffffffff) returned 0
	[0093.994] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.994] CloseHandle (hObject=0xffffffff) returned 0
	[0093.995] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.995] CloseHandle (hObject=0xffffffff) returned 0
	[0093.995] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0093.995] CloseHandle (hObject=0xffffffff) returned 0
	[0094.002] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.002] CloseHandle (hObject=0xffffffff) returned 0
	[0094.002] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.002] CloseHandle (hObject=0xffffffff) returned 0
	[0094.002] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.002] CloseHandle (hObject=0xffffffff) returned 0
	[0094.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.003] CloseHandle (hObject=0xffffffff) returned 0
	[0094.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.003] CloseHandle (hObject=0xffffffff) returned 0
	[0094.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.003] CloseHandle (hObject=0xffffffff) returned 0
	[0094.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.003] CloseHandle (hObject=0xffffffff) returned 0
	[0094.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.003] CloseHandle (hObject=0xffffffff) returned 0
	[0094.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.003] CloseHandle (hObject=0xffffffff) returned 0
	[0094.004] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.004] CloseHandle (hObject=0xffffffff) returned 0
	[0094.004] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.004] CloseHandle (hObject=0xffffffff) returned 0
	[0094.004] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.004] CloseHandle (hObject=0xffffffff) returned 0
	[0094.004] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.004] CloseHandle (hObject=0xffffffff) returned 0
	[0094.004] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.004] CloseHandle (hObject=0xffffffff) returned 0
	[0094.012] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.012] CloseHandle (hObject=0xffffffff) returned 0
	[0094.012] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.013] CloseHandle (hObject=0xffffffff) returned 0
	[0094.013] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.013] CloseHandle (hObject=0xffffffff) returned 0
	[0094.013] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.013] CloseHandle (hObject=0xffffffff) returned 0
	[0094.013] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.013] CloseHandle (hObject=0xffffffff) returned 0
	[0094.013] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.013] CloseHandle (hObject=0xffffffff) returned 0
	[0094.013] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.013] CloseHandle (hObject=0xffffffff) returned 0
	[0094.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.014] CloseHandle (hObject=0xffffffff) returned 0
	[0094.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.014] CloseHandle (hObject=0xffffffff) returned 0
	[0094.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.014] CloseHandle (hObject=0xffffffff) returned 0
	[0094.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.014] CloseHandle (hObject=0xffffffff) returned 0
	[0094.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.014] CloseHandle (hObject=0xffffffff) returned 0
	[0094.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.014] CloseHandle (hObject=0xffffffff) returned 0
	[0094.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.015] CloseHandle (hObject=0xffffffff) returned 0
	[0094.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.015] CloseHandle (hObject=0xffffffff) returned 0
	[0094.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.015] CloseHandle (hObject=0xffffffff) returned 0
	[0094.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.015] CloseHandle (hObject=0xffffffff) returned 0
	[0094.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.015] CloseHandle (hObject=0xffffffff) returned 0
	[0094.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.015] CloseHandle (hObject=0xffffffff) returned 0
	[0094.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.016] CloseHandle (hObject=0xffffffff) returned 0
	[0094.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.016] CloseHandle (hObject=0xffffffff) returned 0
	[0094.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.016] CloseHandle (hObject=0xffffffff) returned 0
	[0094.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.016] CloseHandle (hObject=0xffffffff) returned 0
	[0094.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.016] CloseHandle (hObject=0xffffffff) returned 0
	[0094.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.017] CloseHandle (hObject=0xffffffff) returned 0
	[0094.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.017] CloseHandle (hObject=0xffffffff) returned 0
	[0094.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.017] CloseHandle (hObject=0xffffffff) returned 0
	[0094.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.017] CloseHandle (hObject=0xffffffff) returned 0
	[0094.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.017] CloseHandle (hObject=0xffffffff) returned 0
	[0094.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.018] CloseHandle (hObject=0xffffffff) returned 0
	[0094.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.018] CloseHandle (hObject=0xffffffff) returned 0
	[0094.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.018] CloseHandle (hObject=0xffffffff) returned 0
	[0094.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.018] CloseHandle (hObject=0xffffffff) returned 0
	[0094.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.018] CloseHandle (hObject=0xffffffff) returned 0
	[0094.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.018] CloseHandle (hObject=0xffffffff) returned 0
	[0094.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.019] CloseHandle (hObject=0xffffffff) returned 0
	[0094.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.019] CloseHandle (hObject=0xffffffff) returned 0
	[0094.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.019] CloseHandle (hObject=0xffffffff) returned 0
	[0094.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.019] CloseHandle (hObject=0xffffffff) returned 0
	[0094.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.019] CloseHandle (hObject=0xffffffff) returned 0
	[0094.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.019] CloseHandle (hObject=0xffffffff) returned 0
	[0094.020] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.020] CloseHandle (hObject=0xffffffff) returned 0
	[0094.020] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.020] CloseHandle (hObject=0xffffffff) returned 0
	[0094.020] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.020] CloseHandle (hObject=0xffffffff) returned 0
	[0094.020] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0094.020] CloseHandle (hObject=0xffffffff) returned 0
	[0094.022] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0094.022] CloseHandle (hObject=0x8c) returned 1
	[0094.024] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.024] CloseHandle (hObject=0x8c) returned 1
	[0094.024] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf.boom")) returned 1
	[0094.025] lstrcmpA (lpString1=".", lpString2="Font") returned -1
	[0094.025] lstrcmpA (lpString1="..", lpString2="Font") returned -1
	[0094.025] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0094.107] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0094.222] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0094.222] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0094.223] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0094.223] CloseHandle (hObject=0x90) returned 1
	[0094.224] lstrcmpA (lpString1=".", lpString2="PFM") returned -1
	[0094.224] lstrcmpA (lpString1="..", lpString2="PFM") returned -1
	[0094.224] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0094.224] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0094.224] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0094.224] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0094.225] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0094.225] CloseHandle (hObject=0x94) returned 1
	[0094.226] lstrcmpA (lpString1=".", lpString2="Linguistics") returned -1
	[0094.226] lstrcmpA (lpString1="..", lpString2="Linguistics") returned -1
	[0094.226] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0094.226] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0094.226] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0094.226] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0094.226] lstrcmpA (lpString1=".", lpString2="LanguageNames2") returned -1
	[0094.226] lstrcmpA (lpString1="..", lpString2="LanguageNames2") returned -1
	[0094.226] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0094.342] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0094.357] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0094.357] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0094.359] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0094.359] CloseHandle (hObject=0x94) returned 1
	[0094.465] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.465] CloseHandle (hObject=0x94) returned 1
	[0094.465] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt.boom")) returned 1
	[0094.485] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.486] CloseHandle (hObject=0x94) returned 1
	[0094.486] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt.boom")) returned 1
	[0094.489] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.489] CloseHandle (hObject=0x94) returned 1
	[0094.489] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt.boom")) returned 1
	[0094.519] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.523] CloseHandle (hObject=0x94) returned 1
	[0094.523] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt.boom")) returned 1
	[0094.826] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.826] CloseHandle (hObject=0x94) returned 1
	[0094.827] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt.boom")) returned 1
	[0094.876] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.876] CloseHandle (hObject=0x94) returned 1
	[0094.876] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt.boom")) returned 1
	[0094.969] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.970] CloseHandle (hObject=0x94) returned 1
	[0094.970] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt.boom")) returned 1
	[0094.983] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0094.983] CloseHandle (hObject=0x94) returned 1
	[0094.983] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt.boom")) returned 1
	[0095.026] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.026] CloseHandle (hObject=0x94) returned 1
	[0095.026] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt.boom")) returned 1
	[0095.051] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.051] CloseHandle (hObject=0x94) returned 1
	[0095.051] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt.boom")) returned 1
	[0095.066] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.066] CloseHandle (hObject=0x94) returned 1
	[0095.066] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt.boom")) returned 1
	[0095.074] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.074] CloseHandle (hObject=0x94) returned 1
	[0095.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt.boom")) returned 1
	[0095.077] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.077] CloseHandle (hObject=0x94) returned 1
	[0095.077] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt.boom")) returned 1
	[0095.090] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.090] CloseHandle (hObject=0x94) returned 1
	[0095.090] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt.boom")) returned 1
	[0095.097] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.097] CloseHandle (hObject=0x94) returned 1
	[0095.098] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt.boom")) returned 1
	[0095.108] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.108] CloseHandle (hObject=0x94) returned 1
	[0095.108] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt.boom")) returned 1
	[0095.111] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.112] CloseHandle (hObject=0x94) returned 1
	[0095.112] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt.boom")) returned 1
	[0095.130] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.130] CloseHandle (hObject=0x94) returned 1
	[0095.130] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt.boom")) returned 1
	[0095.148] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.148] CloseHandle (hObject=0x94) returned 1
	[0095.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt.boom")) returned 1
	[0095.296] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.296] CloseHandle (hObject=0x94) returned 1
	[0095.296] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt.boom")) returned 1
	[0095.312] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.312] CloseHandle (hObject=0x94) returned 1
	[0095.312] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt.boom")) returned 1
	[0095.319] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.319] CloseHandle (hObject=0x94) returned 1
	[0095.319] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt.boom")) returned 1
	[0095.354] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.354] CloseHandle (hObject=0x94) returned 1
	[0095.354] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt.boom")) returned 1
	[0095.364] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.364] CloseHandle (hObject=0x94) returned 1
	[0095.364] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt.boom")) returned 1
	[0095.379] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.379] CloseHandle (hObject=0x94) returned 1
	[0095.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt.boom")) returned 1
	[0095.521] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0095.521] CloseHandle (hObject=0x94) returned 1
	[0095.521] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt.boom")) returned 1
	[0096.018] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.018] CloseHandle (hObject=0x94) returned 1
	[0096.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt.boom")) returned 1
	[0096.116] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.116] CloseHandle (hObject=0x94) returned 1
	[0096.117] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt.boom")) returned 1
	[0096.119] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.120] CloseHandle (hObject=0x94) returned 1
	[0096.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt.boom")) returned 1
	[0096.154] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.154] CloseHandle (hObject=0x94) returned 1
	[0096.154] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt.boom")) returned 1
	[0096.158] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.158] CloseHandle (hObject=0x94) returned 1
	[0096.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt.boom")) returned 1
	[0096.801] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.801] CloseHandle (hObject=0x94) returned 1
	[0096.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt.boom")) returned 1
	[0096.807] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.807] CloseHandle (hObject=0x94) returned 1
	[0096.807] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt.boom")) returned 1
	[0096.873] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.873] CloseHandle (hObject=0x94) returned 1
	[0096.873] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt.boom")) returned 1
	[0096.896] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.897] CloseHandle (hObject=0x94) returned 1
	[0096.897] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt.boom")) returned 1
	[0096.901] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.901] CloseHandle (hObject=0x94) returned 1
	[0096.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt.boom")) returned 1
	[0096.979] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.979] CloseHandle (hObject=0x94) returned 1
	[0096.980] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt.boom")) returned 1
	[0096.996] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0096.996] CloseHandle (hObject=0x94) returned 1
	[0096.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt.boom")) returned 1
	[0097.018] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.018] CloseHandle (hObject=0x94) returned 1
	[0097.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt.boom")) returned 1
	[0097.022] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.022] CloseHandle (hObject=0x94) returned 1
	[0097.022] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt.boom")) returned 1
	[0097.124] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.124] CloseHandle (hObject=0x94) returned 1
	[0097.124] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt.boom")) returned 1
	[0097.144] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.144] CloseHandle (hObject=0x94) returned 1
	[0097.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt.boom")) returned 1
	[0097.242] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.256] CloseHandle (hObject=0x94) returned 1
	[0097.256] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt.boom")) returned 1
	[0097.269] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.269] CloseHandle (hObject=0x94) returned 1
	[0097.269] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt.boom")) returned 1
	[0097.419] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.419] CloseHandle (hObject=0x94) returned 1
	[0097.419] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt.boom")) returned 1
	[0097.427] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.428] CloseHandle (hObject=0x94) returned 1
	[0097.428] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt.boom")) returned 1
	[0097.454] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.454] CloseHandle (hObject=0x94) returned 1
	[0097.454] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt.boom")) returned 1
	[0097.553] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.553] CloseHandle (hObject=0x94) returned 1
	[0097.553] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt.boom")) returned 1
	[0097.693] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.693] CloseHandle (hObject=0x94) returned 1
	[0097.693] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt.boom")) returned 1
	[0097.708] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.708] CloseHandle (hObject=0x94) returned 1
	[0097.708] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt.boom")) returned 1
	[0097.784] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.784] CloseHandle (hObject=0x94) returned 1
	[0097.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt.boom")) returned 1
	[0097.787] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.787] CloseHandle (hObject=0x94) returned 1
	[0097.787] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt.boom")) returned 1
	[0097.824] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.824] CloseHandle (hObject=0x94) returned 1
	[0097.824] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt.boom")) returned 1
	[0097.831] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.832] CloseHandle (hObject=0x94) returned 1
	[0097.832] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt.boom")) returned 1
	[0097.864] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.865] CloseHandle (hObject=0x94) returned 1
	[0097.865] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt.boom")) returned 1
	[0097.894] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.894] CloseHandle (hObject=0x94) returned 1
	[0097.894] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt.boom")) returned 1
	[0097.905] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.905] CloseHandle (hObject=0x94) returned 1
	[0097.905] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt.boom")) returned 1
	[0097.909] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.909] CloseHandle (hObject=0x94) returned 1
	[0097.909] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt.boom")) returned 1
	[0097.912] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.912] CloseHandle (hObject=0x94) returned 1
	[0097.912] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt.boom")) returned 1
	[0097.921] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.922] CloseHandle (hObject=0x94) returned 1
	[0097.922] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt.boom")) returned 1
	[0097.925] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.925] CloseHandle (hObject=0x94) returned 1
	[0097.925] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt.boom")) returned 1
	[0097.928] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.928] CloseHandle (hObject=0x94) returned 1
	[0097.928] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt.boom")) returned 1
	[0097.978] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.979] CloseHandle (hObject=0x94) returned 1
	[0097.979] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt.boom")) returned 1
	[0097.994] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.995] CloseHandle (hObject=0x94) returned 1
	[0097.995] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt.boom")) returned 1
	[0097.998] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0097.999] CloseHandle (hObject=0x94) returned 1
	[0097.999] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt.boom")) returned 1
	[0098.016] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.016] CloseHandle (hObject=0x94) returned 1
	[0098.016] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt.boom")) returned 1
	[0098.021] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.021] CloseHandle (hObject=0x94) returned 1
	[0098.021] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt.boom")) returned 1
	[0098.036] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.037] CloseHandle (hObject=0x94) returned 1
	[0098.037] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt.boom")) returned 1
	[0098.105] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.105] CloseHandle (hObject=0x94) returned 1
	[0098.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt.boom")) returned 1
	[0098.113] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.113] CloseHandle (hObject=0x94) returned 1
	[0098.113] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt.boom")) returned 1
	[0098.147] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.147] CloseHandle (hObject=0x94) returned 1
	[0098.147] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt.boom")) returned 1
	[0098.157] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.158] CloseHandle (hObject=0x94) returned 1
	[0098.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt.boom")) returned 1
	[0098.161] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.161] CloseHandle (hObject=0x94) returned 1
	[0098.161] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt.boom")) returned 1
	[0098.164] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.164] CloseHandle (hObject=0x94) returned 1
	[0098.164] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt.boom")) returned 1
	[0098.409] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.409] CloseHandle (hObject=0x94) returned 1
	[0098.409] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt.boom")) returned 1
	[0098.414] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.414] CloseHandle (hObject=0x94) returned 1
	[0098.415] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt.boom")) returned 1
	[0098.612] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.612] CloseHandle (hObject=0x94) returned 1
	[0098.612] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt.boom")) returned 1
	[0098.760] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.760] CloseHandle (hObject=0x94) returned 1
	[0098.760] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt.boom")) returned 1
	[0098.763] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.763] CloseHandle (hObject=0x94) returned 1
	[0098.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt.boom")) returned 1
	[0098.766] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.766] CloseHandle (hObject=0x94) returned 1
	[0098.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt.boom")) returned 1
	[0098.826] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.826] CloseHandle (hObject=0x94) returned 1
	[0098.826] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt.boom")) returned 1
	[0098.852] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.853] CloseHandle (hObject=0x94) returned 1
	[0098.853] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt.boom")) returned 1
	[0098.980] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.981] CloseHandle (hObject=0x94) returned 1
	[0098.981] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt.boom")) returned 1
	[0098.985] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0098.985] CloseHandle (hObject=0x94) returned 1
	[0098.985] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt.boom")) returned 1
	[0099.011] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.024] CloseHandle (hObject=0x94) returned 1
	[0099.024] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt.boom")) returned 1
	[0099.282] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.282] CloseHandle (hObject=0x94) returned 1
	[0099.282] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt.boom")) returned 1
	[0099.467] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.467] CloseHandle (hObject=0x94) returned 1
	[0099.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt.boom")) returned 1
	[0099.511] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.511] CloseHandle (hObject=0x94) returned 1
	[0099.511] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt.boom")) returned 1
	[0099.519] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.519] CloseHandle (hObject=0x94) returned 1
	[0099.519] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt.boom")) returned 1
	[0099.646] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.646] CloseHandle (hObject=0x94) returned 1
	[0099.646] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt.boom")) returned 1
	[0099.681] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.682] CloseHandle (hObject=0x94) returned 1
	[0099.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt.boom")) returned 1
	[0099.816] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.817] CloseHandle (hObject=0x94) returned 1
	[0099.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt.boom")) returned 1
	[0099.876] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.876] CloseHandle (hObject=0x94) returned 1
	[0099.876] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt.boom")) returned 1
	[0099.887] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.887] CloseHandle (hObject=0x94) returned 1
	[0099.887] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt.boom")) returned 1
	[0099.927] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.927] CloseHandle (hObject=0x94) returned 1
	[0099.927] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt.boom")) returned 1
	[0099.947] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.947] CloseHandle (hObject=0x94) returned 1
	[0099.947] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt.boom")) returned 1
	[0099.956] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.956] CloseHandle (hObject=0x94) returned 1
	[0099.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt.boom")) returned 1
	[0099.973] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.973] CloseHandle (hObject=0x94) returned 1
	[0099.973] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt.boom")) returned 1
	[0099.984] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0099.984] CloseHandle (hObject=0x94) returned 1
	[0099.984] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt.boom")) returned 1
	[0100.207] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.207] CloseHandle (hObject=0x94) returned 1
	[0100.207] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt.boom")) returned 1
	[0100.211] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.211] CloseHandle (hObject=0x94) returned 1
	[0100.211] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt.boom")) returned 1
	[0100.213] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.214] CloseHandle (hObject=0x94) returned 1
	[0100.214] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt.boom")) returned 1
	[0100.315] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.315] CloseHandle (hObject=0x94) returned 1
	[0100.315] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt.boom")) returned 1
	[0100.357] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.357] CloseHandle (hObject=0x94) returned 1
	[0100.357] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt.boom")) returned 1
	[0100.380] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.380] CloseHandle (hObject=0x94) returned 1
	[0100.380] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt.boom")) returned 1
	[0100.415] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.415] CloseHandle (hObject=0x94) returned 1
	[0100.415] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt.boom")) returned 1
	[0100.419] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.419] CloseHandle (hObject=0x94) returned 1
	[0100.419] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt.boom")) returned 1
	[0100.512] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.512] CloseHandle (hObject=0x94) returned 1
	[0100.513] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt.boom")) returned 1
	[0100.524] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.524] CloseHandle (hObject=0x94) returned 1
	[0100.524] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt.boom")) returned 1
	[0100.554] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.555] CloseHandle (hObject=0x94) returned 1
	[0100.555] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt.boom")) returned 1
	[0100.710] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.710] CloseHandle (hObject=0x94) returned 1
	[0100.710] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt.boom")) returned 1
	[0100.732] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.732] CloseHandle (hObject=0x94) returned 1
	[0100.732] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt.boom")) returned 1
	[0100.735] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.735] CloseHandle (hObject=0x94) returned 1
	[0100.735] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt.boom")) returned 1
	[0100.754] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.755] CloseHandle (hObject=0x94) returned 1
	[0100.755] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt.boom")) returned 1
	[0100.778] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.778] CloseHandle (hObject=0x94) returned 1
	[0100.778] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt.boom")) returned 1
	[0100.790] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.790] CloseHandle (hObject=0x94) returned 1
	[0100.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt.boom")) returned 1
	[0100.799] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.799] CloseHandle (hObject=0x94) returned 1
	[0100.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt.boom")) returned 1
	[0100.802] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.802] CloseHandle (hObject=0x94) returned 1
	[0100.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt.boom")) returned 1
	[0100.806] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.806] CloseHandle (hObject=0x94) returned 1
	[0100.806] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt.boom")) returned 1
	[0100.823] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.823] CloseHandle (hObject=0x94) returned 1
	[0100.823] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt.boom")) returned 1
	[0100.836] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0100.836] CloseHandle (hObject=0x94) returned 1
	[0100.836] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt.boom")) returned 1
	[0100.838] lstrcmpA (lpString1=".", lpString2="Providers") returned -1
	[0100.838] lstrcmpA (lpString1="..", lpString2="Providers") returned -1
	[0100.838] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0100.838] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.838] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.838] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.838] lstrcmpA (lpString1=".", lpString2="Proximity") returned -1
	[0100.838] lstrcmpA (lpString1="..", lpString2="Proximity") returned -1
	[0100.838] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0100.838] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.838] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.838] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.838] lstrcmpA (lpString1=".", lpString2="11.00") returned -1
	[0100.838] lstrcmpA (lpString1="..", lpString2="11.00") returned -1
	[0100.838] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0100.933] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.942] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.942] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.946] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0100.946] CloseHandle (hObject=0x9c) returned 1
	[0100.967] lstrcmpA (lpString1=".", lpString2="SaslPrep") returned -1
	[0100.967] lstrcmpA (lpString1="..", lpString2="SaslPrep") returned -1
	[0100.967] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0100.967] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.967] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.967] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.968] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0100.968] CloseHandle (hObject=0x90) returned 1
	[0100.968] lstrcmpA (lpString1=".", lpString2="TypeSupport") returned -1
	[0100.968] lstrcmpA (lpString1="..", lpString2="TypeSupport") returned -1
	[0100.968] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0100.977] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.977] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.977] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.978] lstrcmpA (lpString1=".", lpString2="Unicode") returned -1
	[0100.978] lstrcmpA (lpString1="..", lpString2="Unicode") returned -1
	[0100.978] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0100.978] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.978] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.978] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.978] lstrcmpA (lpString1=".", lpString2="ICU") returned -1
	[0100.978] lstrcmpA (lpString1="..", lpString2="ICU") returned -1
	[0100.978] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0100.979] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.979] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.979] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.980] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0100.980] CloseHandle (hObject=0x98) returned 1
	[0100.980] lstrcmpA (lpString1=".", lpString2="Mappings") returned -1
	[0100.980] lstrcmpA (lpString1="..", lpString2="Mappings") returned -1
	[0100.980] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0100.981] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0100.981] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0100.981] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0100.981] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1
	[0100.981] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1
	[0100.981] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0101.021] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0101.021] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0101.021] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0101.023] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0101.023] CloseHandle (hObject=0x9c) returned 1
	[0101.145] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.145] CloseHandle (hObject=0x9c) returned 1
	[0101.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt.boom")) returned 1
	[0101.185] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.186] CloseHandle (hObject=0x9c) returned 1
	[0101.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt.boom")) returned 1
	[0101.235] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.235] CloseHandle (hObject=0x9c) returned 1
	[0101.235] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt.boom")) returned 1
	[0101.240] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.240] CloseHandle (hObject=0x9c) returned 1
	[0101.240] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt.boom")) returned 1
	[0101.245] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.246] CloseHandle (hObject=0x9c) returned 1
	[0101.246] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt.boom")) returned 1
	[0101.248] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.248] CloseHandle (hObject=0x9c) returned 1
	[0101.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt.boom")) returned 1
	[0101.250] lstrcmpA (lpString1=".", lpString2="Mac") returned -1
	[0101.250] lstrcmpA (lpString1="..", lpString2="Mac") returned -1
	[0101.250] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0101.259] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0101.259] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0101.259] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0101.260] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0101.260] CloseHandle (hObject=0x9c) returned 1
	[0101.309] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.309] CloseHandle (hObject=0x9c) returned 1
	[0101.309] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt.boom")) returned 1
	[0101.332] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.333] CloseHandle (hObject=0x9c) returned 1
	[0101.333] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt.boom")) returned 1
	[0101.428] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.428] CloseHandle (hObject=0x9c) returned 1
	[0101.428] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt.boom")) returned 1
	[0101.457] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.457] CloseHandle (hObject=0x9c) returned 1
	[0101.457] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt.boom")) returned 1
	[0101.461] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.461] CloseHandle (hObject=0x9c) returned 1
	[0101.461] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt.boom")) returned 1
	[0101.470] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.470] CloseHandle (hObject=0x9c) returned 1
	[0101.470] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt.boom")) returned 1
	[0101.473] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.473] CloseHandle (hObject=0x9c) returned 1
	[0101.473] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt.boom")) returned 1
	[0101.487] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.487] CloseHandle (hObject=0x9c) returned 1
	[0101.487] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt.boom")) returned 1
	[0101.490] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.490] CloseHandle (hObject=0x9c) returned 1
	[0101.490] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt.boom")) returned 1
	[0101.503] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.503] CloseHandle (hObject=0x9c) returned 1
	[0101.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt.boom")) returned 1
	[0101.514] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0101.514] CloseHandle (hObject=0x9c) returned 1
	[0101.514] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt.boom")) returned 1
	[0107.290] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.290] CloseHandle (hObject=0x9c) returned 1
	[0107.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt.boom")) returned 1
	[0107.351] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.351] CloseHandle (hObject=0x9c) returned 1
	[0107.351] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt.boom")) returned 1
	[0107.354] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.354] CloseHandle (hObject=0x9c) returned 1
	[0107.354] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt.boom")) returned 1
	[0107.391] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.391] CloseHandle (hObject=0x9c) returned 1
	[0107.391] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt.boom")) returned 1
	[0107.422] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.422] CloseHandle (hObject=0x9c) returned 1
	[0107.422] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt.boom")) returned 1
	[0107.467] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.467] CloseHandle (hObject=0x9c) returned 1
	[0107.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt.boom")) returned 1
	[0107.485] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.485] CloseHandle (hObject=0x9c) returned 1
	[0107.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt.boom")) returned 1
	[0107.511] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.511] CloseHandle (hObject=0x9c) returned 1
	[0107.511] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt.boom")) returned 1
	[0107.512] lstrcmpA (lpString1=".", lpString2="win") returned -1
	[0107.512] lstrcmpA (lpString1="..", lpString2="win") returned -1
	[0107.512] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0107.514] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0107.514] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0107.514] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0107.515] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0107.515] CloseHandle (hObject=0x9c) returned 1
	[0107.536] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.536] CloseHandle (hObject=0x9c) returned 1
	[0107.536] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt.boom")) returned 1
	[0107.690] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.690] CloseHandle (hObject=0x9c) returned 1
	[0107.690] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt.boom")) returned 1
	[0107.726] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.726] CloseHandle (hObject=0x9c) returned 1
	[0107.726] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt.boom")) returned 1
	[0107.869] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.869] CloseHandle (hObject=0x9c) returned 1
	[0107.869] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt.boom")) returned 1
	[0107.896] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.896] CloseHandle (hObject=0x9c) returned 1
	[0107.897] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt.boom")) returned 1
	[0107.926] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.926] CloseHandle (hObject=0x9c) returned 1
	[0107.926] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt.boom")) returned 1
	[0107.963] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.963] CloseHandle (hObject=0x9c) returned 1
	[0107.963] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt.boom")) returned 1
	[0107.999] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0107.999] CloseHandle (hObject=0x9c) returned 1
	[0107.999] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt.boom")) returned 1
	[0108.009] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.009] CloseHandle (hObject=0x9c) returned 1
	[0108.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt.boom")) returned 1
	[0108.049] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.050] CloseHandle (hObject=0x9c) returned 1
	[0108.050] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt.boom")) returned 1
	[0108.068] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.068] CloseHandle (hObject=0x9c) returned 1
	[0108.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt.boom")) returned 1
	[0108.087] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.087] CloseHandle (hObject=0x9c) returned 1
	[0108.088] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt.boom")) returned 1
	[0108.131] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.131] CloseHandle (hObject=0x9c) returned 1
	[0108.131] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt.boom")) returned 1
	[0108.147] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.148] CloseHandle (hObject=0x9c) returned 1
	[0108.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt.boom")) returned 1
	[0108.149] lstrcmpA (lpString1=".", lpString2="Setup Files") returned -1
	[0108.149] lstrcmpA (lpString1="..", lpString2="Setup Files") returned -1
	[0108.149] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.150] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.150] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.150] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.150] lstrcmpA (lpString1=".", lpString2="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned -1
	[0108.150] lstrcmpA (lpString1="..", lpString2="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned -1
	[0108.150] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.151] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.151] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.151] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.153] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.153] CloseHandle (hObject=0x90) returned 1
	[0108.158] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.158] CloseHandle (hObject=0x88) returned 1
	[0108.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm.boom")) returned 1
	[0108.175] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.175] CloseHandle (hObject=0x88) returned 1
	[0108.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm.boom")) returned 1
	[0108.203] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.203] CloseHandle (hObject=0x88) returned 1
	[0108.203] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.Boom" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm.boom")) returned 1
	[0108.204] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1
	[0108.204] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1
	[0108.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0108.205] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.205] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.205] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.205] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1
	[0108.205] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1
	[0108.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0108.205] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.205] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.205] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.205] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1
	[0108.205] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1
	[0108.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.205] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.205] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.205] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.205] lstrcmpA (lpString1=".", lpString2="ActiveX") returned -1
	[0108.205] lstrcmpA (lpString1="..", lpString2="ActiveX") returned -1
	[0108.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.206] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.206] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.206] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.206] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.206] CloseHandle (hObject=0xffffffff) returned 0
	[0108.206] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.206] CloseHandle (hObject=0xffffffff) returned 0
	[0108.206] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.206] CloseHandle (hObject=0xffffffff) returned 0
	[0108.206] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.206] CloseHandle (hObject=0xffffffff) returned 0
	[0108.207] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.207] CloseHandle (hObject=0xffffffff) returned 0
	[0108.207] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.207] CloseHandle (hObject=0xffffffff) returned 0
	[0108.207] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.207] CloseHandle (hObject=0xffffffff) returned 0
	[0108.207] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.207] CloseHandle (hObject=0xffffffff) returned 0
	[0108.207] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.207] CloseHandle (hObject=0xffffffff) returned 0
	[0108.207] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.208] CloseHandle (hObject=0xffffffff) returned 0
	[0108.208] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.208] CloseHandle (hObject=0xffffffff) returned 0
	[0108.208] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.208] CloseHandle (hObject=0xffffffff) returned 0
	[0108.208] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.208] CloseHandle (hObject=0xffffffff) returned 0
	[0108.208] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.208] CloseHandle (hObject=0xffffffff) returned 0
	[0108.208] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.208] CloseHandle (hObject=0xffffffff) returned 0
	[0108.209] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.209] CloseHandle (hObject=0xffffffff) returned 0
	[0108.209] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.209] CloseHandle (hObject=0xffffffff) returned 0
	[0108.209] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.209] CloseHandle (hObject=0xffffffff) returned 0
	[0108.209] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.209] CloseHandle (hObject=0xffffffff) returned 0
	[0108.209] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.209] CloseHandle (hObject=0xffffffff) returned 0
	[0108.210] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.210] CloseHandle (hObject=0xffffffff) returned 0
	[0108.210] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.210] CloseHandle (hObject=0xffffffff) returned 0
	[0108.210] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.210] CloseHandle (hObject=0xffffffff) returned 0
	[0108.210] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.210] CloseHandle (hObject=0xffffffff) returned 0
	[0108.210] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.210] CloseHandle (hObject=0xffffffff) returned 0
	[0108.211] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.211] CloseHandle (hObject=0xffffffff) returned 0
	[0108.211] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.211] CloseHandle (hObject=0xffffffff) returned 0
	[0108.211] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.211] CloseHandle (hObject=0xffffffff) returned 0
	[0108.211] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.211] CloseHandle (hObject=0xffffffff) returned 0
	[0108.211] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.211] CloseHandle (hObject=0xffffffff) returned 0
	[0108.212] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.212] CloseHandle (hObject=0xffffffff) returned 0
	[0108.212] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.212] CloseHandle (hObject=0xffffffff) returned 0
	[0108.212] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.212] CloseHandle (hObject=0xffffffff) returned 0
	[0108.266] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.266] CloseHandle (hObject=0xffffffff) returned 0
	[0108.266] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.266] CloseHandle (hObject=0xffffffff) returned 0
	[0108.267] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.267] CloseHandle (hObject=0xffffffff) returned 0
	[0108.267] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.267] CloseHandle (hObject=0xffffffff) returned 0
	[0108.267] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.267] CloseHandle (hObject=0xffffffff) returned 0
	[0108.267] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.267] CloseHandle (hObject=0xffffffff) returned 0
	[0108.267] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.267] CloseHandle (hObject=0xffffffff) returned 0
	[0108.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.268] CloseHandle (hObject=0xffffffff) returned 0
	[0108.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.268] CloseHandle (hObject=0xffffffff) returned 0
	[0108.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.268] CloseHandle (hObject=0xffffffff) returned 0
	[0108.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.268] CloseHandle (hObject=0xffffffff) returned 0
	[0108.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.268] CloseHandle (hObject=0xffffffff) returned 0
	[0108.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.269] CloseHandle (hObject=0xffffffff) returned 0
	[0108.269] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.269] CloseHandle (hObject=0xffffffff) returned 0
	[0108.269] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.269] CloseHandle (hObject=0xffffffff) returned 0
	[0108.269] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.269] CloseHandle (hObject=0xffffffff) returned 0
	[0108.269] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.269] CloseHandle (hObject=0xffffffff) returned 0
	[0108.269] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.270] CloseHandle (hObject=0xffffffff) returned 0
	[0108.270] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.270] CloseHandle (hObject=0xffffffff) returned 0
	[0108.271] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.271] CloseHandle (hObject=0xffffffff) returned 0
	[0108.271] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.271] CloseHandle (hObject=0xffffffff) returned 0
	[0108.271] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.271] CloseHandle (hObject=0xffffffff) returned 0
	[0108.271] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0
	[0108.271] CloseHandle (hObject=0xffffffff) returned 0
	[0108.271] lstrcmpA (lpString1=".", lpString2="ARM") returned -1
	[0108.271] lstrcmpA (lpString1="..", lpString2="ARM") returned -1
	[0108.271] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.288] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.289] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.289] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.289] lstrcmpA (lpString1=".", lpString2="1.0") returned -1
	[0108.289] lstrcmpA (lpString1="..", lpString2="1.0") returned -1
	[0108.289] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.320] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.320] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.320] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.321] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.321] CloseHandle (hObject=0x90) returned 1
	[0108.381] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.383] CloseHandle (hObject=0x90) returned 1
	[0108.383] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AcrobatUpdater.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\acrobatupdater.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AcrobatUpdater.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\acrobatupdater.exe.boom")) returned 1
	[0108.403] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.403] CloseHandle (hObject=0x90) returned 1
	[0108.403] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\adobearm.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\adobearm.exe.boom")) returned 1
	[0108.422] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.422] CloseHandle (hObject=0x90) returned 1
	[0108.422] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\ReaderUpdater.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\readerupdater.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\ReaderUpdater.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\readerupdater.exe.boom")) returned 1
	[0108.424] lstrcmpA (lpString1=".", lpString2="HelpCfg") returned -1
	[0108.424] lstrcmpA (lpString1="..", lpString2="HelpCfg") returned -1
	[0108.424] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.426] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.426] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.426] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.426] lstrcmpA (lpString1=".", lpString2="ca_ES") returned -1
	[0108.426] lstrcmpA (lpString1="..", lpString2="ca_ES") returned -1
	[0108.426] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.427] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.427] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.427] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.428] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.428] CloseHandle (hObject=0x90) returned 1
	[0108.428] lstrcmpA (lpString1=".", lpString2="cs_CZ") returned -1
	[0108.428] lstrcmpA (lpString1="..", lpString2="cs_CZ") returned -1
	[0108.428] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.429] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.429] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.429] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.430] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.430] CloseHandle (hObject=0x90) returned 1
	[0108.431] lstrcmpA (lpString1=".", lpString2="da_DK") returned -1
	[0108.431] lstrcmpA (lpString1="..", lpString2="da_DK") returned -1
	[0108.431] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.432] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.433] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.433] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.434] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.435] CloseHandle (hObject=0x90) returned 1
	[0108.435] lstrcmpA (lpString1=".", lpString2="de_DE") returned -1
	[0108.435] lstrcmpA (lpString1="..", lpString2="de_DE") returned -1
	[0108.435] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.436] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.436] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.436] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.437] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.438] CloseHandle (hObject=0x90) returned 1
	[0108.438] lstrcmpA (lpString1=".", lpString2="en_US") returned -1
	[0108.438] lstrcmpA (lpString1="..", lpString2="en_US") returned -1
	[0108.438] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.438] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.438] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.438] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.440] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.440] CloseHandle (hObject=0x90) returned 1
	[0108.440] lstrcmpA (lpString1=".", lpString2="es_ES") returned -1
	[0108.440] lstrcmpA (lpString1="..", lpString2="es_ES") returned -1
	[0108.440] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.441] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.441] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.441] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.443] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.443] CloseHandle (hObject=0x90) returned 1
	[0108.443] lstrcmpA (lpString1=".", lpString2="eu_ES") returned -1
	[0108.443] lstrcmpA (lpString1="..", lpString2="eu_ES") returned -1
	[0108.443] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.443] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.443] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.443] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.445] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.445] CloseHandle (hObject=0x90) returned 1
	[0108.445] lstrcmpA (lpString1=".", lpString2="fi_FI") returned -1
	[0108.445] lstrcmpA (lpString1="..", lpString2="fi_FI") returned -1
	[0108.445] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.446] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.446] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.446] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.449] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.449] CloseHandle (hObject=0x90) returned 1
	[0108.449] lstrcmpA (lpString1=".", lpString2="fr_FR") returned -1
	[0108.449] lstrcmpA (lpString1="..", lpString2="fr_FR") returned -1
	[0108.449] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.450] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.451] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.451] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.452] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.452] CloseHandle (hObject=0x90) returned 1
	[0108.452] lstrcmpA (lpString1=".", lpString2="hr_HR") returned -1
	[0108.452] lstrcmpA (lpString1="..", lpString2="hr_HR") returned -1
	[0108.452] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.452] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.453] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.453] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.454] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.454] CloseHandle (hObject=0x90) returned 1
	[0108.454] lstrcmpA (lpString1=".", lpString2="hu_HU") returned -1
	[0108.454] lstrcmpA (lpString1="..", lpString2="hu_HU") returned -1
	[0108.454] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.455] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.455] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.455] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.467] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.467] CloseHandle (hObject=0x90) returned 1
	[0108.467] lstrcmpA (lpString1=".", lpString2="it_IT") returned -1
	[0108.467] lstrcmpA (lpString1="..", lpString2="it_IT") returned -1
	[0108.467] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.469] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.470] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.470] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.471] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.471] CloseHandle (hObject=0x90) returned 1
	[0108.471] lstrcmpA (lpString1=".", lpString2="ja_JP") returned -1
	[0108.471] lstrcmpA (lpString1="..", lpString2="ja_JP") returned -1
	[0108.471] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.472] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.472] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.472] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.473] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.473] CloseHandle (hObject=0x90) returned 1
	[0108.473] lstrcmpA (lpString1=".", lpString2="ko_KR") returned -1
	[0108.473] lstrcmpA (lpString1="..", lpString2="ko_KR") returned -1
	[0108.474] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.475] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.475] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.475] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.476] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.477] CloseHandle (hObject=0x90) returned 1
	[0108.477] lstrcmpA (lpString1=".", lpString2="nb_NO") returned -1
	[0108.477] lstrcmpA (lpString1="..", lpString2="nb_NO") returned -1
	[0108.477] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.478] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.478] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.478] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.479] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.479] CloseHandle (hObject=0x90) returned 1
	[0108.480] lstrcmpA (lpString1=".", lpString2="nl_NL") returned -1
	[0108.480] lstrcmpA (lpString1="..", lpString2="nl_NL") returned -1
	[0108.480] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.480] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.480] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.480] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.482] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.482] CloseHandle (hObject=0x90) returned 1
	[0108.482] lstrcmpA (lpString1=".", lpString2="pl_PL") returned -1
	[0108.482] lstrcmpA (lpString1="..", lpString2="pl_PL") returned -1
	[0108.482] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.482] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.483] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.483] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.484] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.484] CloseHandle (hObject=0x90) returned 1
	[0108.484] lstrcmpA (lpString1=".", lpString2="pt_BR") returned -1
	[0108.484] lstrcmpA (lpString1="..", lpString2="pt_BR") returned -1
	[0108.484] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.485] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.485] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.485] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.486] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.486] CloseHandle (hObject=0x90) returned 1
	[0108.486] lstrcmpA (lpString1=".", lpString2="ro_RO") returned -1
	[0108.486] lstrcmpA (lpString1="..", lpString2="ro_RO") returned -1
	[0108.486] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.487] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.487] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.487] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.489] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.489] CloseHandle (hObject=0x90) returned 1
	[0108.489] lstrcmpA (lpString1=".", lpString2="ru_RU") returned -1
	[0108.489] lstrcmpA (lpString1="..", lpString2="ru_RU") returned -1
	[0108.489] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.489] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.490] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.490] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.491] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.491] CloseHandle (hObject=0x90) returned 1
	[0108.491] lstrcmpA (lpString1=".", lpString2="sk_SK") returned -1
	[0108.491] lstrcmpA (lpString1="..", lpString2="sk_SK") returned -1
	[0108.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.492] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.492] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.493] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.494] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.494] CloseHandle (hObject=0x90) returned 1
	[0108.494] lstrcmpA (lpString1=".", lpString2="sl_SI") returned -1
	[0108.494] lstrcmpA (lpString1="..", lpString2="sl_SI") returned -1
	[0108.494] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.495] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.495] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.495] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.496] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.496] CloseHandle (hObject=0x90) returned 1
	[0108.496] lstrcmpA (lpString1=".", lpString2="sv_SE") returned -1
	[0108.496] lstrcmpA (lpString1="..", lpString2="sv_SE") returned -1
	[0108.497] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.497] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.497] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.497] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.498] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.498] CloseHandle (hObject=0x90) returned 1
	[0108.498] lstrcmpA (lpString1=".", lpString2="tr_TR") returned -1
	[0108.498] lstrcmpA (lpString1="..", lpString2="tr_TR") returned -1
	[0108.499] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.501] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.501] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.502] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.503] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.503] CloseHandle (hObject=0x90) returned 1
	[0108.503] lstrcmpA (lpString1=".", lpString2="uk_UA") returned -1
	[0108.503] lstrcmpA (lpString1="..", lpString2="uk_UA") returned -1
	[0108.503] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.504] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.504] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.504] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.505] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.505] CloseHandle (hObject=0x90) returned 1
	[0108.505] lstrcmpA (lpString1=".", lpString2="zh_CN") returned -1
	[0108.505] lstrcmpA (lpString1="..", lpString2="zh_CN") returned -1
	[0108.506] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.506] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.506] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.506] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.507] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.507] CloseHandle (hObject=0x90) returned 1
	[0108.508] lstrcmpA (lpString1=".", lpString2="zh_TW") returned -1
	[0108.508] lstrcmpA (lpString1="..", lpString2="zh_TW") returned -1
	[0108.508] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.508] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.508] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.508] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.511] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.511] CloseHandle (hObject=0x90) returned 1
	[0108.512] lstrcmpA (lpString1=".", lpString2="Java") returned -1
	[0108.512] lstrcmpA (lpString1="..", lpString2="Java") returned -1
	[0108.512] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0108.512] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.512] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.512] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.513] lstrcmpA (lpString1=".", lpString2="Java Update") returned -1
	[0108.513] lstrcmpA (lpString1="..", lpString2="Java Update") returned -1
	[0108.513] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.514] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.515] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.515] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.516] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.516] CloseHandle (hObject=0x8c) returned 1
	[0108.534] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.534] CloseHandle (hObject=0x8c) returned 1
	[0108.534] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jaucheck.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jaucheck.exe.boom")) returned 1
	[0108.566] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.566] CloseHandle (hObject=0x8c) returned 1
	[0108.566] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jaureg.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jaureg.exe.boom")) returned 1
	[0108.659] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.659] CloseHandle (hObject=0x8c) returned 1
	[0108.660] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jucheck.exe" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jucheck.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jucheck.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jucheck.exe.boom")) returned 1
	[0108.729] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.729] CloseHandle (hObject=0x8c) returned 1
	[0108.729] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jusched.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\jusched.exe.boom")) returned 1
	[0108.731] lstrcmpA (lpString1=".", lpString2="microsoft shared") returned -1
	[0108.731] lstrcmpA (lpString1="..", lpString2="microsoft shared") returned -1
	[0108.731] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0108.731] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.731] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.731] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.731] lstrcmpA (lpString1=".", lpString2="DAO") returned -1
	[0108.731] lstrcmpA (lpString1="..", lpString2="DAO") returned -1
	[0108.731] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.732] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.732] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.732] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.733] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.733] CloseHandle (hObject=0x8c) returned 1
	[0108.733] lstrcmpA (lpString1=".", lpString2="Help") returned -1
	[0108.733] lstrcmpA (lpString1="..", lpString2="Help") returned -1
	[0108.733] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.753] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.754] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.754] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.754] lstrcmpA (lpString1=".", lpString2="1028") returned -1
	[0108.754] lstrcmpA (lpString1="..", lpString2="1028") returned -1
	[0108.754] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.755] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.755] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.755] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.756] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.756] CloseHandle (hObject=0x90) returned 1
	[0108.756] lstrcmpA (lpString1=".", lpString2="1031") returned -1
	[0108.756] lstrcmpA (lpString1="..", lpString2="1031") returned -1
	[0108.756] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.756] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.757] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.757] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.757] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.757] CloseHandle (hObject=0x90) returned 1
	[0108.758] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0108.758] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0108.758] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.759] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.759] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.759] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.761] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.761] CloseHandle (hObject=0x90) returned 1
	[0108.762] lstrcmpA (lpString1=".", lpString2="1036") returned -1
	[0108.762] lstrcmpA (lpString1="..", lpString2="1036") returned -1
	[0108.762] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.763] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.763] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.763] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.764] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.764] CloseHandle (hObject=0x90) returned 1
	[0108.764] lstrcmpA (lpString1=".", lpString2="1040") returned -1
	[0108.764] lstrcmpA (lpString1="..", lpString2="1040") returned -1
	[0108.764] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.764] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.764] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.764] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.765] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.765] CloseHandle (hObject=0x90) returned 1
	[0108.765] lstrcmpA (lpString1=".", lpString2="1041") returned -1
	[0108.765] lstrcmpA (lpString1="..", lpString2="1041") returned -1
	[0108.766] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.766] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.766] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.766] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.767] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.767] CloseHandle (hObject=0x90) returned 1
	[0108.768] lstrcmpA (lpString1=".", lpString2="1042") returned -1
	[0108.768] lstrcmpA (lpString1="..", lpString2="1042") returned -1
	[0108.768] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.768] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.768] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.768] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.769] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.769] CloseHandle (hObject=0x90) returned 1
	[0108.769] lstrcmpA (lpString1=".", lpString2="1046") returned -1
	[0108.769] lstrcmpA (lpString1="..", lpString2="1046") returned -1
	[0108.769] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.770] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.770] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.770] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.771] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.771] CloseHandle (hObject=0x90) returned 1
	[0108.771] lstrcmpA (lpString1=".", lpString2="1049") returned -1
	[0108.771] lstrcmpA (lpString1="..", lpString2="1049") returned -1
	[0108.771] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.771] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.771] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.771] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.772] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.772] CloseHandle (hObject=0x90) returned 1
	[0108.772] lstrcmpA (lpString1=".", lpString2="2052") returned -1
	[0108.772] lstrcmpA (lpString1="..", lpString2="2052") returned -1
	[0108.773] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.773] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.773] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.773] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.774] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.774] CloseHandle (hObject=0x90) returned 1
	[0108.774] lstrcmpA (lpString1=".", lpString2="3082") returned -1
	[0108.774] lstrcmpA (lpString1="..", lpString2="3082") returned -1
	[0108.774] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.774] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.774] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.774] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.776] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.776] CloseHandle (hObject=0x90) returned 1
	[0108.777] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.777] CloseHandle (hObject=0x8c) returned 1
	[0108.777] lstrcmpA (lpString1=".", lpString2="ink") returned -1
	[0108.777] lstrcmpA (lpString1="..", lpString2="ink") returned -1
	[0108.777] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.779] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.779] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.779] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.779] lstrcmpA (lpString1=".", lpString2="1.0") returned -1
	[0108.779] lstrcmpA (lpString1="..", lpString2="1.0") returned -1
	[0108.779] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.780] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.780] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.780] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.781] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.781] CloseHandle (hObject=0x90) returned 1
	[0108.781] lstrcmpA (lpString1=".", lpString2="1.7") returned -1
	[0108.781] lstrcmpA (lpString1="..", lpString2="1.7") returned -1
	[0108.781] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.781] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.782] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.782] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.783] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.783] CloseHandle (hObject=0x90) returned 1
	[0108.783] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0108.783] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0108.783] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.786] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.786] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.786] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.787] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.787] CloseHandle (hObject=0x90) returned 1
	[0108.787] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1
	[0108.787] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1
	[0108.787] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.787] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.788] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.788] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.788] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.788] CloseHandle (hObject=0x8c) returned 1
	[0108.795] lstrcmpA (lpString1=".", lpString2="MSEnv") returned -1
	[0108.795] lstrcmpA (lpString1="..", lpString2="MSEnv") returned -1
	[0108.795] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.796] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.796] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.796] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.796] lstrcmpA (lpString1=".", lpString2="PublicAssemblies") returned -1
	[0108.796] lstrcmpA (lpString1="..", lpString2="PublicAssemblies") returned -1
	[0108.796] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.797] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.797] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.797] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.798] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.798] CloseHandle (hObject=0x90) returned 1
	[0108.799] lstrcmpA (lpString1=".", lpString2="MSInfo") returned -1
	[0108.799] lstrcmpA (lpString1="..", lpString2="MSInfo") returned -1
	[0108.799] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.800] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.800] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.800] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.800] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0108.800] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0108.800] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.800] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.800] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.800] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.801] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.801] CloseHandle (hObject=0x90) returned 1
	[0108.802] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.802] CloseHandle (hObject=0x8c) returned 1
	[0108.803] lstrcmpA (lpString1=".", lpString2="OFFICE14") returned -1
	[0108.803] lstrcmpA (lpString1="..", lpString2="OFFICE14") returned -1
	[0108.803] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.803] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.803] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.803] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.803] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0108.803] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0108.803] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.804] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.804] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.804] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.870] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.870] CloseHandle (hObject=0x90) returned 1
	[0108.871] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.872] CloseHandle (hObject=0x8c) returned 1
	[0108.872] lstrcmpA (lpString1=".", lpString2="Cultures") returned -1
	[0108.872] lstrcmpA (lpString1="..", lpString2="Cultures") returned -1
	[0108.872] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.872] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.872] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.872] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.873] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.873] CloseHandle (hObject=0x90) returned 1
	[0108.874] lstrcmpA (lpString1=".", lpString2="Office Setup Controller") returned -1
	[0108.874] lstrcmpA (lpString1="..", lpString2="Office Setup Controller") returned -1
	[0108.874] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.874] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.875] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.875] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.875] lstrcmpA (lpString1=".", lpString2="Portal") returned -1
	[0108.875] lstrcmpA (lpString1="..", lpString2="Portal") returned -1
	[0108.875] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.877] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.877] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.877] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.877] lstrcmpA (lpString1=".", lpString2="1033") returned -1
	[0108.877] lstrcmpA (lpString1="..", lpString2="1033") returned -1
	[0108.877] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.877] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.877] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.877] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.878] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.879] CloseHandle (hObject=0x90) returned 1
	[0108.879] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.879] CloseHandle (hObject=0x8c) returned 1
	[0108.880] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1
	[0108.880] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1
	[0108.880] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.881] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.881] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.881] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.882] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.882] CloseHandle (hObject=0x8c) returned 1
	[0108.886] lstrcmpA (lpString1=".", lpString2="TextConv") returned -1
	[0108.886] lstrcmpA (lpString1="..", lpString2="TextConv") returned -1
	[0108.886] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.887] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.887] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.887] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.887] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0108.887] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0108.887] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.888] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.888] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.888] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.888] lstrcmpA (lpString1=".", lpString2="WksConv") returned -1
	[0108.888] lstrcmpA (lpString1="..", lpString2="WksConv") returned -1
	[0108.888] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.889] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.889] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.889] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.890] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.890] CloseHandle (hObject=0x90) returned 1
	[0108.969] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.969] CloseHandle (hObject=0x90) returned 1
	[0108.969] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\Wkconv.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wksconv\\wkconv.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\Wkconv.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wksconv\\wkconv.exe.boom")) returned 1
	[0108.970] lstrcmpA (lpString1=".", lpString2="Triedit") returned -1
	[0108.970] lstrcmpA (lpString1="..", lpString2="Triedit") returned -1
	[0108.970] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.971] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.971] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.971] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.971] lstrcmpA (lpString1=".", lpString2="en-US") returned -1
	[0108.971] lstrcmpA (lpString1="..", lpString2="en-US") returned -1
	[0108.971] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.971] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.971] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.971] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.971] lstrcmpA (lpString1=".", lpString2="VBA") returned -1
	[0108.971] lstrcmpA (lpString1="..", lpString2="VBA") returned -1
	[0108.972] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.973] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.973] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.973] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.973] lstrcmpA (lpString1=".", lpString2="VBA6") returned -1
	[0108.973] lstrcmpA (lpString1="..", lpString2="VBA6") returned -1
	[0108.973] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.973] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.973] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.973] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.974] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.974] CloseHandle (hObject=0x90) returned 1
	[0108.974] lstrcmpA (lpString1=".", lpString2="VC") returned -1
	[0108.974] lstrcmpA (lpString1="..", lpString2="VC") returned -1
	[0108.974] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.975] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.975] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.975] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.975] lstrcmpA (lpString1=".", lpString2="amd64") returned -1
	[0108.975] lstrcmpA (lpString1="..", lpString2="amd64") returned -1
	[0108.975] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.976] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.976] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.976] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.977] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.977] CloseHandle (hObject=0x90) returned 1
	[0108.979] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.979] CloseHandle (hObject=0x8c) returned 1
	[0108.980] lstrcmpA (lpString1=".", lpString2="VGX") returned -1
	[0108.980] lstrcmpA (lpString1="..", lpString2="VGX") returned -1
	[0108.980] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.980] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.980] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.980] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.981] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.981] CloseHandle (hObject=0x8c) returned 1
	[0108.981] lstrcmpA (lpString1=".", lpString2="VSTA") returned -1
	[0108.981] lstrcmpA (lpString1="..", lpString2="VSTA") returned -1
	[0108.981] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0108.982] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.982] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.982] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.982] lstrcmpA (lpString1=".", lpString2="8.0") returned -1
	[0108.982] lstrcmpA (lpString1="..", lpString2="8.0") returned -1
	[0108.982] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.984] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.984] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.984] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.985] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.985] CloseHandle (hObject=0x90) returned 1
	[0108.985] lstrcmpA (lpString1=".", lpString2="x86") returned -1
	[0108.986] lstrcmpA (lpString1="..", lpString2="x86") returned -1
	[0108.986] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0108.987] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.987] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.987] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.988] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.988] CloseHandle (hObject=0x94) returned 1
	[0108.990] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1
	[0108.990] CloseHandle (hObject=0x94) returned 1
	[0108.990] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\vsta_ep32.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\8.0\\x86\\vsta_ep32.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\vsta_ep32.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\8.0\\x86\\vsta_ep32.exe.boom")) returned 1
	[0108.992] lstrcmpA (lpString1=".", lpString2="AppInfoDocument") returned -1
	[0108.992] lstrcmpA (lpString1="..", lpString2="AppInfoDocument") returned -1
	[0108.992] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.992] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.992] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.992] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.995] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.995] CloseHandle (hObject=0x90) returned 1
	[0108.995] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument") returned -1
	[0108.995] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument") returned -1
	[0108.995] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0108.996] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.996] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.996] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0108.998] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0108.998] CloseHandle (hObject=0x94) returned 1
	[0108.998] lstrcmpA (lpString1=".", lpString2="Pipeline.v10.0") returned -1
	[0108.998] lstrcmpA (lpString1="..", lpString2="Pipeline.v10.0") returned -1
	[0108.998] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0108.999] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0108.999] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0108.999] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0109.000] lstrcmpA (lpString1=".", lpString2="AddInSideAdapters") returned -1
	[0109.000] lstrcmpA (lpString1="..", lpString2="AddInSideAdapters") returned -1
	[0109.000] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.001] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0109.001] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0109.001] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0109.002] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0109.002] CloseHandle (hObject=0x94) returned 1
	[0109.003] lstrcmpA (lpString1=".", lpString2="AddInViews") returned -1
	[0109.003] lstrcmpA (lpString1="..", lpString2="AddInViews") returned -1
	[0109.003] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.005] lstrcmpA (lpString1=".", lpString2=".") returned 0
	[0109.005] lstrcmpA (lpString1=".", lpString2="..") returned -1
	[0109.005] lstrcmpA (lpString1="..", lpString2="..") returned 0
	[0109.006] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1
	[0109.006] CloseHandle (hObject=0x94) returned 1
	[0109.006] lstrcmpA (lpString1=".", lpString2="Contracts") returned -1
	[0109.006] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.015] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.019] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.021] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0109.022] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.051] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.Boom" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.boom")) returned 1
	[0109.053] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.055] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0109.056] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.057] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0109.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0109.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0109.060] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.060] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0109.063] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0109.065] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.067] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0109.070] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.072] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.074] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0109.077] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.081] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0109.088] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0109.088] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0109.088] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0109.090] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0109.114] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.117] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.119] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.171] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe.boom")) returned 1
	[0109.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z.boom")) returned 1
	[0109.348] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe.boom")) returned 1
	[0109.350] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0109.999] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0110.156] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png.boom")) returned 1
	[0110.284] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png.boom")) returned 1
	[0110.590] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png.boom")) returned 1
	[0110.615] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png.boom")) returned 1
	[0110.617] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0110.621] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0110.621] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0110.907] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe.Boom" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe.boom")) returned 1
	[0110.909] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0110.910] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0110.910] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0110.911] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0110.916] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0110.917] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0110.918] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0110.918] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0110.919] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0110.999] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt.boom")) returned 1
	[0111.000] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.010] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jabswitch.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jabswitch.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jabswitch.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jabswitch.exe.boom")) returned 1
	[0111.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java-rmi.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java-rmi.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java-rmi.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java-rmi.exe.boom")) returned 1
	[0111.164] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java.exe.boom")) returned 1
	[0111.195] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javacpl.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javacpl.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javacpl.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javacpl.exe.boom")) returned 1
	[0111.219] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaw.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaw.exe.boom")) returned 1
	[0111.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaws.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaws.exe.boom")) returned 1
	[0111.253] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2launcher.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2launcher.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2launcher.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2launcher.exe.boom")) returned 1
	[0111.275] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jqs.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jqs.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jqs.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jqs.exe.boom")) returned 1
	[0111.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\keytool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\keytool.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\keytool.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\keytool.exe.boom")) returned 1
	[0111.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\kinit.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\kinit.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\kinit.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\kinit.exe.boom")) returned 1
	[0111.323] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\klist.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\klist.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\klist.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\klist.exe.boom")) returned 1
	[0111.342] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ktab.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ktab.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ktab.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ktab.exe.boom")) returned 1
	[0111.371] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\orbd.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\orbd.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\orbd.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\orbd.exe.boom")) returned 1
	[0111.395] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\pack200.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\pack200.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\pack200.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\pack200.exe.boom")) returned 1
	[0111.396] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.447] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\policytool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\policytool.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\policytool.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\policytool.exe.boom")) returned 1
	[0111.463] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmid.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmid.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmid.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmid.exe.boom")) returned 1
	[0111.471] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmiregistry.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmiregistry.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmiregistry.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmiregistry.exe.boom")) returned 1
	[0111.487] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\servertool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\servertool.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\servertool.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\servertool.exe.boom")) returned 1
	[0111.493] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ssvagent.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssvagent.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ssvagent.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssvagent.exe.boom")) returned 1
	[0111.509] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\tnameserv.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\tnameserv.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\tnameserv.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\tnameserv.exe.boom")) returned 1
	[0111.556] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\unpack200.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\unpack200.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\unpack200.exe.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\unpack200.exe.boom")) returned 1
	[0111.561] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0111.652] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.652] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.656] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.712] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip.boom")) returned 1
	[0111.713] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0111.738] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif.boom")) returned 1
	[0111.740] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.753] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.866] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.868] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.869] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0111.904] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.boom")) returned 1
	[0111.906] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif.boom")) returned 1
	[0111.908] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif.boom")) returned 1
	[0111.911] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif.boom")) returned 1
	[0111.913] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif.boom")) returned 1
	[0111.915] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif.boom")) returned 1
	[0111.917] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif.boom")) returned 1
	[0111.918] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.931] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt.boom")) returned 1
	[0111.933] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.936] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.948] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0111.949] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0111.999] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.014] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0112.074] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0112.103] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0112.115] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0112.118] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.135] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.178] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.210] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.302] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.365] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.395] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.412] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.450] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.469] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt.boom")) returned 1
	[0112.525] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt.boom")) returned 1
	[0112.540] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt.boom")) returned 1
	[0112.547] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.Boom" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html.boom")) returned 1
	[0112.550] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0112.550] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0112.552] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0112.553] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0112.609] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0112.609] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.610] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0112.611] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0112.611] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0112.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohtmed.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHTMED.EXE.Boom" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohtmed.exe.boom")) returned 1
	[0112.651] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0112.651] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0112.652] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0112.652] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0112.654] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0112.669] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0112.669] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0112.670] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0112.670] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0112.731] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip.boom")) returned 1
	[0112.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip.boom")) returned 1
	[0112.791] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip.boom")) returned 1
	[0112.798] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip.boom")) returned 1
	[0112.866] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip.boom")) returned 1
	[0112.869] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip.boom")) returned 1
	[0112.872] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip.boom")) returned 1
	[0112.920] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip.boom")) returned 1
	[0112.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip.boom")) returned 1
	[0112.937] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip.boom")) returned 1
	[0112.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip.boom")) returned 1
	[0113.063] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip.boom")) returned 1
	[0113.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip.boom")) returned 1
	[0113.080] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip.boom")) returned 1
	[0113.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip.boom")) returned 1
	[0113.154] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip.boom")) returned 1
	[0113.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip.boom")) returned 1
	[0113.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip.boom")) returned 1
	[0113.218] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip.boom")) returned 1
	[0113.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip.boom")) returned 1
	[0113.222] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0113.223] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0113.229] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip.boom")) returned 1
	[0113.231] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip.boom")) returned 1
	[0113.233] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip.boom")) returned 1
	[0113.296] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip.boom")) returned 1
	[0113.303] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip.boom")) returned 1
	[0113.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip.boom")) returned 1
	[0113.430] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip.boom")) returned 1
	[0113.529] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip.boom")) returned 1
	[0113.532] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip.boom")) returned 1
	[0113.550] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip.boom")) returned 1
	[0113.553] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip.boom")) returned 1
	[0113.622] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip.boom")) returned 1
	[0113.721] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip.boom")) returned 1
	[0113.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip.boom")) returned 1
	[0113.747] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip.boom")) returned 1
	[0113.896] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip.Boom" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip.boom")) returned 1
	[0113.908] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0113.909] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0113.911] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0113.911] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0113.912] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0113.912] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0113.916] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0113.917] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.041] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.044] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.046] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.209] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.210] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.240] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.boom")) returned 1
	[0114.243] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\searchplugins\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.267] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.exe.boom")) returned 1
	[0114.269] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.270] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.271] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.318] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe.boom")) returned 1
	[0114.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice.exe.boom")) returned 1
	[0114.391] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice_installer.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice_installer.exe.boom")) returned 1
	[0114.396] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-container.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-container.exe.boom")) returned 1
	[0114.416] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-hang-ui.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-hang-ui.exe.boom")) returned 1
	[0114.418] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.477] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\helper.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\helper.exe.boom")) returned 1
	[0114.534] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.exe.boom")) returned 1
	[0114.560] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapp-uninstaller.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapp-uninstaller.exe.boom")) returned 1
	[0114.561] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.565] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt-stub.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt-stub.exe.boom")) returned 1
	[0114.567] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.641] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe.boom")) returned 1
	[0114.692] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\uninstall.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe.Boom" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\uninstall.exe.boom")) returned 1
	[0114.694] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.694] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.694] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.695] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.698] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.702] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.703] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.703] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.704] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.708] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.709] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.712] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.715] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.717] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.720] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.721] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.722] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.724] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.726] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.736] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.736] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.741] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.741] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.792] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.794] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.795] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.797] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.797] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.798] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.802] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.804] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.806] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.809] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.875] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.876] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0114.877] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.879] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0114.881] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.883] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.884] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.886] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.887] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.940] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0114.942] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0114.945] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.947] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0114.948] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.003] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.006] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.007] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.009] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.011] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.015] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.017] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.018] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.020] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.023] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.049] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.051] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.051] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.055] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.056] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.061] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.063] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.064] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.067] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.069] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.072] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.075] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.075] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.079] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.080] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.083] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.084] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.086] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.089] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.089] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.092] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.096] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.101] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.105] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.118] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0115.119] FindFirstFileA (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b7e28
	[0115.119] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0115.120] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.120] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.120] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.120] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.121] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.122] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.209] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Application Data\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0xffffffff
	[0115.210] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Desktop\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0xffffffff
	[0115.210] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Documents\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0xffffffff
	[0115.211] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Favorites\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0xffffffff
	[0115.211] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0115.211] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.212] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.212] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.212] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.217] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.218] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.219] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.219] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.220] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.220] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.221] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.224] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.225] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.226] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.230] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.233] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.235] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.237] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.240] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.242] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.247] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.248] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.248] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.249] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.249] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.250] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.251] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.252] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.252] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.254] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.254] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.256] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.256] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.257] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.257] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.258] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.258] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.258] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.259] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.262] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.263] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.389] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.465] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.466] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.469] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.469] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.469] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.471] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.473] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.476] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.481] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.482] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.482] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0115.488] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0115.489] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0115.492] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0115.549] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0115.549] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0115.572] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0115.641] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0115.755] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0115.756] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0115.758] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.759] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.762] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.792] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.Boom" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.boom")) returned 1
	[0115.794] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.Boom" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.boom")) returned 1
	[0115.797] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.797] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.798] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0115.798] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.798] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.800] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.800] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.801] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.802] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0115.802] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.802] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.905] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.boom")) returned 1
	[0115.907] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0115.933] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma.boom")) returned 1
	[0116.047] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma.boom")) returned 1
	[0116.225] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma.boom")) returned 1
	[0116.311] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma.boom")) returned 1
	[0116.334] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma.boom")) returned 1
	[0116.345] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma.boom")) returned 1
	[0116.357] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma.boom")) returned 1
	[0116.407] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma.boom")) returned 1
	[0116.461] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma.boom")) returned 1
	[0116.728] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma.boom")) returned 1
	[0116.730] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0116.732] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0116.733] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0116.734] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0116.740] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0116.746] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk.boom")) returned 1
	[0116.749] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0116.749] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0116.750] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0116.970] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.boom")) returned 1
	[0116.975] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.boom")) returned 1
	[0117.044] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.boom")) returned 1
	[0117.048] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.boom")) returned 1
	[0117.052] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.boom")) returned 1
	[0117.055] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.boom")) returned 1
	[0117.058] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.boom")) returned 1
	[0117.062] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.boom")) returned 1
	[0117.065] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.boom")) returned 1
	[0117.069] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.boom")) returned 1
	[0117.073] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.boom")) returned 1
	[0117.467] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.boom")) returned 1
	[0117.469] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0117.475] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.boom")) returned 1
	[0117.481] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.boom")) returned 1
	[0117.657] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.boom")) returned 1
	[0117.673] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.boom")) returned 1
	[0117.676] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.boom")) returned 1
	[0117.685] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.boom")) returned 1
	[0117.735] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.boom")) returned 1
	[0117.764] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.boom")) returned 1
	[0117.806] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.boom")) returned 1
	[0117.885] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0117.931] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.boom")) returned 1
	[0117.941] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.boom")) returned 1
	[0117.954] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.boom")) returned 1
	[0117.959] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.boom")) returned 1
	[0117.961] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0118.021] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.boom")) returned 1
	[0118.102] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.boom")) returned 1
	[0118.202] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.boom")) returned 1
	[0118.251] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.boom")) returned 1
	[0118.254] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.boom")) returned 1
	[0118.255] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0118.297] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.boom")) returned 1
	[0118.333] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.boom")) returned 1
	[0118.344] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.boom")) returned 1
	[0118.385] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.boom")) returned 1
	[0118.406] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.boom")) returned 1
	[0118.414] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.boom")) returned 1
	[0118.434] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.boom")) returned 1
	[0118.448] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.boom")) returned 1
	[0118.459] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.boom")) returned 1
	[0118.469] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.boom")) returned 1
	[0118.504] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.boom")) returned 1
	[0118.518] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.boom")) returned 1
	[0118.541] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.boom")) returned 1
	[0118.571] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk.boom")) returned 1
	[0118.580] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk.boom")) returned 1
	[0118.581] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0118.583] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.boom")) returned 1
	[0118.600] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.boom")) returned 1
	[0118.602] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0118.605] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.boom")) returned 1
	[0118.616] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.boom")) returned 1
	[0118.627] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.boom")) returned 1
	[0118.650] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk.boom")) returned 1
	[0118.698] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk.boom")) returned 1
	[0118.699] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0118.706] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.boom")) returned 1
	[0118.718] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.boom")) returned 1
	[0118.725] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.boom")) returned 1
	[0118.740] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk.boom")) returned 1
	[0118.742] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0118.755] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk.boom")) returned 1
	[0118.770] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk.boom")) returned 1
	[0118.784] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk.boom")) returned 1
	[0118.793] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk.boom")) returned 1
	[0118.795] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0118.870] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk.boom")) returned 1
	[0118.878] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk.boom")) returned 1
	[0118.905] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk.boom")) returned 1
	[0118.917] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk.boom")) returned 1
	[0118.924] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk.boom")) returned 1
	[0119.051] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk.boom")) returned 1
	[0119.087] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk.boom")) returned 1
	[0119.103] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk.boom")) returned 1
	[0119.107] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk.boom")) returned 1
	[0119.144] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk.boom")) returned 1
	[0119.148] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk.boom")) returned 1
	[0119.161] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk.boom")) returned 1
	[0119.166] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk.boom")) returned 1
	[0119.189] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk.boom")) returned 1
	[0119.227] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.boom")) returned 1
	[0119.229] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.276] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk.boom")) returned 1
	[0119.280] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.boom")) returned 1
	[0119.282] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.283] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.314] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.boom")) returned 1
	[0119.322] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.boom")) returned 1
	[0119.326] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.boom")) returned 1
	[0119.339] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.boom")) returned 1
	[0119.343] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.boom")) returned 1
	[0119.346] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.Boom" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk.boom")) returned 1
	[0119.347] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.348] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.348] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.348] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.349] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.351] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.351] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.351] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.352] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.367] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.369] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.369] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.370] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.370] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.371] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.372] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0119.373] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.374] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.375] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.376] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.377] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.379] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.379] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.379] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.380] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.381] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.381] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.382] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.382] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.386] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.388] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.388] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.388] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0119.514] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7de8
	[0119.514] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7e68
	[0119.517] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Oracle\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0119.517] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0119.594] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.594] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.594] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.595] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.596] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.597] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.597] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.598] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0119.604] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.648] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.658] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.773] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.813] MoveFileA (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.Boom" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.boom")) returned 1
	[0119.815] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.816] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.816] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.819] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.840] MoveFileA (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.Boom" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.boom")) returned 1
	[0119.842] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.843] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.843] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.845] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.846] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.846] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.849] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.850] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.915] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.917] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.918] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.918] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.921] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.922] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.922] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.934] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.944] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.945] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.948] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.949] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0119.950] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0119.953] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0119.970] MoveFileA (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.Boom" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.boom")) returned 1
	[0119.972] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0120.007] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0120.007] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0120.072] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0120.073] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0120.074] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0120.076] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0120.141] MoveFileA (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.Boom" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.boom")) returned 1
	[0120.142] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0120.168] MoveFileA (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.Boom" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.boom")) returned 1
	[0120.170] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0120.424] MoveFileA (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.Boom" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.boom")) returned 1
	[0120.426] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0120.426] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0120.427] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0120.437] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Start Menu\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0xffffffff
	[0120.438] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0120.438] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0120.439] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0120.441] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Templates\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0xffffffff
	[0120.441] FindFirstFileA (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b7e28
	[0120.442] FindFirstFileA (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0120.443] FindFirstFileA (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0xffffffff
	[0120.443] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8) returned 0x8b7e28
	[0120.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0120.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0120.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0120.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0120.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0120.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0120.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0120.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0120.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0120.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0xffffffff
	[0120.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0120.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0120.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0120.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0120.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0120.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0120.792] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0120.792] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0120.792] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0120.922] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0120.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.boom")) returned 1
	[0120.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.boom")) returned 1
	[0121.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.boom")) returned 1
	[0121.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0121.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0121.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0121.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0121.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0121.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0121.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0121.169] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0121.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0121.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0121.295] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.boom")) returned 1
	[0121.298] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.boom")) returned 1
	[0121.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.boom")) returned 1
	[0121.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0121.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.325] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.326] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.327] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.329] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.418] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.430] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.440] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0121.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0121.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0121.635] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.boom")) returned 1
	[0121.642] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.boom")) returned 1
	[0121.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.boom")) returned 1
	[0121.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0121.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.649] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.653] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.654] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.670] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.671] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.718] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0121.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0121.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0121.950] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.boom")) returned 1
	[0121.951] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0121.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.996] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0121.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.008] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.054] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.059] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.125] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.137] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.149] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.151] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0122.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0122.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0122.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.boom")) returned 1
	[0122.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0122.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.281] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.394] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.430] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.436] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.440] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.589] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.615] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.621] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0122.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0122.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0122.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.boom")) returned 1
	[0122.680] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.boom")) returned 1
	[0122.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.boom")) returned 1
	[0122.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0122.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.718] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.720] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.757] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.789] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.792] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.795] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0122.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0122.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0122.869] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.boom")) returned 1
	[0122.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0122.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0122.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.026] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.032] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.037] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.049] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.051] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.054] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.093] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.154] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0123.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0123.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0123.642] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0123.827] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0123.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.boom")) returned 1
	[0124.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.boom")) returned 1
	[0124.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.boom")) returned 1
	[0124.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.boom")) returned 1
	[0124.024] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.boom")) returned 1
	[0124.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.boom")) returned 1
	[0124.029] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.boom")) returned 1
	[0124.033] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.boom")) returned 1
	[0124.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.boom")) returned 1
	[0124.037] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.049] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.050] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.163] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.214] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.223] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.235] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.242] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.245] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.253] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.256] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0124.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0124.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.boom")) returned 1
	[0124.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.304] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.350] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.362] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0124.371] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0124.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.boom")) returned 1
	[0124.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.boom")) returned 1
	[0124.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.boom")) returned 1
	[0124.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.boom")) returned 1
	[0124.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.boom")) returned 1
	[0124.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.boom")) returned 1
	[0124.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.616] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.boom")) returned 1
	[0124.689] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.boom")) returned 1
	[0124.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0124.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.765] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.824] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0124.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.032] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.366] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0125.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0125.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0125.649] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0125.651] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0125.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0125.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0125.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0125.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0125.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0125.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0125.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0125.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0125.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0125.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0125.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0125.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0xffffffff
	[0126.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0126.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.350] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.491] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.605] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.boom")) returned 1
	[0126.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0126.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0126.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0126.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0126.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0126.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0126.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0127.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0127.094] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0127.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0127.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0127.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019010520190106\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0127.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0127.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\WAtTEJaue52[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\wattejaue52[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\WAtTEJaue52[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\wattejaue52[1].png.boom")) returned 1
	[0127.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\favicon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\favicon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\favicon[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\favicon[1].png.boom")) returned 1
	[0127.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\jisb6C9OFYl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\jisb6c9ofyl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\jisb6C9OFYl[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\jisb6c9ofyl[1].png.boom")) returned 1
	[0127.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\JiSN03RNZjX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\jisn03rnzjx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\JiSN03RNZjX[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\jisn03rnzjx[1].png.boom")) returned 1
	[0127.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0127.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0127.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0127.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.boom")) returned 1
	[0127.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.boom")) returned 1
	[0127.296] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.boom")) returned 1
	[0127.299] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.boom")) returned 1
	[0127.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.boom")) returned 1
	[0127.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.boom")) returned 1
	[0127.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.boom")) returned 1
	[0127.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.boom")) returned 1
	[0127.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.boom")) returned 1
	[0127.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.boom")) returned 1
	[0127.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.boom")) returned 1
	[0127.606] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.boom")) returned 1
	[0127.621] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.boom")) returned 1
	[0127.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.boom")) returned 1
	[0127.668] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.boom")) returned 1
	[0127.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.boom")) returned 1
	[0127.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.boom")) returned 1
	[0127.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.boom")) returned 1
	[0127.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.boom")) returned 1
	[0127.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.boom")) returned 1
	[0127.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.boom")) returned 1
	[0127.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.boom")) returned 1
	[0127.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.boom")) returned 1
	[0127.800] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.boom")) returned 1
	[0127.812] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.boom")) returned 1
	[0127.859] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.boom")) returned 1
	[0127.873] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.boom")) returned 1
	[0127.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.boom")) returned 1
	[0128.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.boom")) returned 1
	[0128.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.boom")) returned 1
	[0128.024] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.boom")) returned 1
	[0128.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.boom")) returned 1
	[0128.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.boom")) returned 1
	[0128.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.boom")) returned 1
	[0128.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.boom")) returned 1
	[0128.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.boom")) returned 1
	[0128.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.boom")) returned 1
	[0128.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.boom")) returned 1
	[0128.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.boom")) returned 1
	[0128.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.boom")) returned 1
	[0128.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.boom")) returned 1
	[0128.351] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.boom")) returned 1
	[0128.393] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.boom")) returned 1
	[0128.430] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.boom")) returned 1
	[0128.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.boom")) returned 1
	[0128.467] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.boom")) returned 1
	[0128.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.boom")) returned 1
	[0128.530] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.boom")) returned 1
	[0128.536] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.boom")) returned 1
	[0128.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.boom")) returned 1
	[0128.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.boom")) returned 1
	[0128.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.boom")) returned 1
	[0128.680] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.boom")) returned 1
	[0128.685] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.boom")) returned 1
	[0128.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.boom")) returned 1
	[0128.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.boom")) returned 1
	[0128.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.boom")) returned 1
	[0128.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.boom")) returned 1
	[0129.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.boom")) returned 1
	[0129.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.boom")) returned 1
	[0129.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.boom")) returned 1
	[0129.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.boom")) returned 1
	[0129.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.boom")) returned 1
	[0129.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.boom")) returned 1
	[0129.152] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.boom")) returned 1
	[0129.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.boom")) returned 1
	[0129.171] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.boom")) returned 1
	[0129.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.boom")) returned 1
	[0129.202] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.boom")) returned 1
	[0129.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.boom")) returned 1
	[0129.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.boom")) returned 1
	[0129.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.boom")) returned 1
	[0129.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.boom")) returned 1
	[0129.378] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.boom")) returned 1
	[0129.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.boom")) returned 1
	[0129.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.boom")) returned 1
	[0129.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.boom")) returned 1
	[0129.555] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.boom")) returned 1
	[0129.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.boom")) returned 1
	[0129.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.boom")) returned 1
	[0129.627] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.boom")) returned 1
	[0129.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.boom")) returned 1
	[0129.636] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.boom")) returned 1
	[0129.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0129.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.boom")) returned 1
	[0129.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.boom")) returned 1
	[0129.649] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.boom")) returned 1
	[0129.652] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.boom")) returned 1
	[0129.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.boom")) returned 1
	[0129.658] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.boom")) returned 1
	[0129.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.boom")) returned 1
	[0129.664] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.boom")) returned 1
	[0129.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.boom")) returned 1
	[0129.711] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.boom")) returned 1
	[0129.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.boom")) returned 1
	[0129.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.boom")) returned 1
	[0129.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.boom")) returned 1
	[0129.872] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.boom")) returned 1
	[0129.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.boom")) returned 1
	[0129.878] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.boom")) returned 1
	[0130.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.boom")) returned 1
	[0130.042] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.boom")) returned 1
	[0130.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.boom")) returned 1
	[0130.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.boom")) returned 1
	[0130.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.boom")) returned 1
	[0130.057] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.boom")) returned 1
	[0130.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.boom")) returned 1
	[0130.063] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.boom")) returned 1
	[0130.112] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.boom")) returned 1
	[0130.301] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.boom")) returned 1
	[0130.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.boom")) returned 1
	[0130.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.boom")) returned 1
	[0130.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.boom")) returned 1
	[0130.377] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.boom")) returned 1
	[0130.388] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.boom")) returned 1
	[0130.438] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.boom")) returned 1
	[0130.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.boom")) returned 1
	[0130.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.boom")) returned 1
	[0130.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.boom")) returned 1
	[0130.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.boom")) returned 1
	[0130.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.boom")) returned 1
	[0130.523] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.boom")) returned 1
	[0130.596] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.boom")) returned 1
	[0130.604] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.boom")) returned 1
	[0130.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.boom")) returned 1
	[0130.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.boom")) returned 1
	[0130.822] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.boom")) returned 1
	[0130.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.boom")) returned 1
	[0130.854] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.boom")) returned 1
	[0130.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.boom")) returned 1
	[0130.881] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.boom")) returned 1
	[0130.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.boom")) returned 1
	[0131.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.boom")) returned 1
	[0131.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.boom")) returned 1
	[0131.029] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.boom")) returned 1
	[0131.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.boom")) returned 1
	[0131.083] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.boom")) returned 1
	[0131.086] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.boom")) returned 1
	[0131.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.boom")) returned 1
	[0131.104] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.boom")) returned 1
	[0131.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.boom")) returned 1
	[0131.254] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.boom")) returned 1
	[0131.263] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.boom")) returned 1
	[0131.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.boom")) returned 1
	[0131.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.boom")) returned 1
	[0131.308] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.boom")) returned 1
	[0131.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.boom")) returned 1
	[0131.347] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.boom")) returned 1
	[0131.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.boom")) returned 1
	[0131.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.boom")) returned 1
	[0131.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.boom")) returned 1
	[0131.387] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.boom")) returned 1
	[0131.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.boom")) returned 1
	[0131.423] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.boom")) returned 1
	[0131.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.boom")) returned 1
	[0131.433] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.boom")) returned 1
	[0131.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.boom")) returned 1
	[0131.453] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.boom")) returned 1
	[0131.462] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.boom")) returned 1
	[0131.502] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.boom")) returned 1
	[0131.509] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.boom")) returned 1
	[0131.528] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.boom")) returned 1
	[0131.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.boom")) returned 1
	[0131.614] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.boom")) returned 1
	[0131.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm.boom")) returned 1
	[0131.626] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif.boom")) returned 1
	[0131.634] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif.boom")) returned 1
	[0131.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.boom")) returned 1
	[0131.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm.boom")) returned 1
	[0131.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.boom")) returned 1
	[0131.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.boom")) returned 1
	[0131.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm.boom")) returned 1
	[0131.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.boom")) returned 1
	[0131.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.boom")) returned 1
	[0131.757] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0131.776] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif.boom")) returned 1
	[0131.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.boom")) returned 1
	[0131.809] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.boom")) returned 1
	[0131.813] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.boom")) returned 1
	[0131.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.boom")) returned 1
	[0131.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.boom")) returned 1
	[0131.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.boom")) returned 1
	[0132.001] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.boom")) returned 1
	[0132.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.boom")) returned 1
	[0132.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.boom")) returned 1
	[0132.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.boom")) returned 1
	[0132.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.boom")) returned 1
	[0132.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.boom")) returned 1
	[0132.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.boom")) returned 1
	[0132.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.boom")) returned 1
	[0132.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.boom")) returned 1
	[0132.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.boom")) returned 1
	[0132.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.boom")) returned 1
	[0132.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.boom")) returned 1
	[0132.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.boom")) returned 1
	[0132.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.boom")) returned 1
	[0132.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.boom")) returned 1
	[0132.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.boom")) returned 1
	[0132.066] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.boom")) returned 1
	[0132.071] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.boom")) returned 1
	[0132.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.boom")) returned 1
	[0132.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.boom")) returned 1
	[0132.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.boom")) returned 1
	[0132.098] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.boom")) returned 1
	[0132.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.boom")) returned 1
	[0132.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.boom")) returned 1
	[0132.117] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.boom")) returned 1
	[0132.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.boom")) returned 1
	[0132.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.boom")) returned 1
	[0132.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.boom")) returned 1
	[0132.213] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.boom")) returned 1
	[0132.216] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.boom")) returned 1
	[0132.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.boom")) returned 1
	[0132.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.boom")) returned 1
	[0132.254] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.boom")) returned 1
	[0132.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.boom")) returned 1
	[0132.464] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.boom")) returned 1
	[0132.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.boom")) returned 1
	[0132.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.boom")) returned 1
	[0132.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.boom")) returned 1
	[0132.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.boom")) returned 1
	[0132.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.boom")) returned 1
	[0132.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.boom")) returned 1
	[0132.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.boom")) returned 1
	[0132.552] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.boom")) returned 1
	[0132.555] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.boom")) returned 1
	[0132.563] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.boom")) returned 1
	[0132.566] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.boom")) returned 1
	[0132.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.boom")) returned 1
	[0132.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.boom")) returned 1
	[0132.575] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.boom")) returned 1
	[0132.602] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.boom")) returned 1
	[0132.606] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.boom")) returned 1
	[0132.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.boom")) returned 1
	[0132.675] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.boom")) returned 1
	[0132.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.boom")) returned 1
	[0132.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.boom")) returned 1
	[0132.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.boom")) returned 1
	[0132.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.boom")) returned 1
	[0132.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.boom")) returned 1
	[0132.799] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.boom")) returned 1
	[0132.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.boom")) returned 1
	[0132.836] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.boom")) returned 1
	[0132.839] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.boom")) returned 1
	[0132.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.boom")) returned 1
	[0132.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.boom")) returned 1
	[0132.866] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.boom")) returned 1
	[0132.888] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.boom")) returned 1
	[0133.001] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.boom")) returned 1
	[0133.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.boom")) returned 1
	[0133.009] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif.boom")) returned 1
	[0133.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif.boom")) returned 1
	[0133.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.boom")) returned 1
	[0133.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.boom")) returned 1
	[0133.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm.boom")) returned 1
	[0133.080] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.boom")) returned 1
	[0133.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0133.253] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.boom")) returned 1
	[0133.257] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.boom")) returned 1
	[0133.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.boom")) returned 1
	[0133.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.boom")) returned 1
	[0133.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.boom")) returned 1
	[0133.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.boom")) returned 1
	[0133.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.boom")) returned 1
	[0133.330] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.boom")) returned 1
	[0133.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.boom")) returned 1
	[0133.362] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.boom")) returned 1
	[0133.366] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.boom")) returned 1
	[0133.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm.boom")) returned 1
	[0133.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.boom")) returned 1
	[0133.411] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.boom")) returned 1
	[0133.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.boom")) returned 1
	[0133.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.boom")) returned 1
	[0133.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.boom")) returned 1
	[0133.435] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.boom")) returned 1
	[0133.438] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.boom")) returned 1
	[0133.465] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.boom")) returned 1
	[0133.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.boom")) returned 1
	[0133.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.boom")) returned 1
	[0133.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.boom")) returned 1
	[0133.479] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.boom")) returned 1
	[0133.529] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.boom")) returned 1
	[0133.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.boom")) returned 1
	[0133.534] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.boom")) returned 1
	[0133.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.boom")) returned 1
	[0133.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.boom")) returned 1
	[0133.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.boom")) returned 1
	[0133.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.boom")) returned 1
	[0133.550] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.boom")) returned 1
	[0133.553] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.boom")) returned 1
	[0133.556] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.boom")) returned 1
	[0133.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.boom")) returned 1
	[0133.571] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.boom")) returned 1
	[0133.578] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.boom")) returned 1
	[0133.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.boom")) returned 1
	[0133.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.boom")) returned 1
	[0133.604] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.boom")) returned 1
	[0133.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.boom")) returned 1
	[0133.612] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.boom")) returned 1
	[0133.616] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.boom")) returned 1
	[0133.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.boom")) returned 1
	[0133.621] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.boom")) returned 1
	[0133.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.boom")) returned 1
	[0133.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.boom")) returned 1
	[0133.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.boom")) returned 1
	[0133.685] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.boom")) returned 1
	[0133.692] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.boom")) returned 1
	[0133.695] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.boom")) returned 1
	[0133.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.boom")) returned 1
	[0133.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.boom")) returned 1
	[0133.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.boom")) returned 1
	[0133.761] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.boom")) returned 1
	[0133.763] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.boom")) returned 1
	[0133.767] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.boom")) returned 1
	[0133.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.boom")) returned 1
	[0133.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.boom")) returned 1
	[0133.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.boom")) returned 1
	[0133.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.boom")) returned 1
	[0133.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.boom")) returned 1
	[0133.847] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.boom")) returned 1
	[0133.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.boom")) returned 1
	[0133.854] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.boom")) returned 1
	[0133.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.boom")) returned 1
	[0133.864] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.boom")) returned 1
	[0133.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.boom")) returned 1
	[0133.878] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.boom")) returned 1
	[0134.049] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.boom")) returned 1
	[0134.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.boom")) returned 1
	[0134.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.boom")) returned 1
	[0134.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.boom")) returned 1
	[0134.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.boom")) returned 1
	[0134.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.boom")) returned 1
	[0134.064] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.boom")) returned 1
	[0134.068] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.boom")) returned 1
	[0134.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.boom")) returned 1
	[0134.074] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.boom")) returned 1
	[0134.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.boom")) returned 1
	[0134.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm.boom")) returned 1
	[0134.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm.boom")) returned 1
	[0134.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0134.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0134.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0134.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28) returned 0x8b80e8
	[0134.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18ebd8 | out: lpFindFileData=0x18ebd8) returned 0x8b8128
	[0134.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18ea88 | out: lpFindFileData=0x18ea88) returned 0x8b8168
	[0134.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18e938 | out: lpFindFileData=0x18e938) returned 0x8b81a8
	[0134.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18e7e8 | out: lpFindFileData=0x18e7e8) returned 0x8b81e8
	[0134.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0134.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0134.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0134.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0134.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.boom")) returned 1
	[0134.196] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.boom")) returned 1
	[0134.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.boom")) returned 1
	[0134.204] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.boom")) returned 1
	[0134.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.boom")) returned 1
	[0134.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.boom")) returned 1
	[0134.213] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.boom")) returned 1
	[0134.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.boom")) returned 1
	[0134.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.boom")) returned 1
	[0134.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.boom")) returned 1
	[0134.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.boom")) returned 1
	[0134.242] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.boom")) returned 1
	[0134.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.boom")) returned 1
	[0134.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.boom")) returned 1
	[0134.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.boom")) returned 1
	[0134.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.boom")) returned 1
	[0134.265] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.boom")) returned 1
	[0134.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.boom")) returned 1
	[0134.286] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.boom")) returned 1
	[0134.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.boom")) returned 1
	[0134.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0134.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0134.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0134.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0134.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0134.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0134.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0134.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.326] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.327] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.329] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.343] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.344] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.357] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.357] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.362] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.368] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0134.369] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.372] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0134.377] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0134.380] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0134.385] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0134.387] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0134.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.boom")) returned 1
	[0134.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.boom")) returned 1
	[0134.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.boom")) returned 1
	[0134.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0134.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0134.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0134.454] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0134.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0134.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5SXX0dmrjbpZiI.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5sxx0dmrjbpzii.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5SXX0dmrjbpZiI.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5sxx0dmrjbpzii.avi.boom")) returned 1
	[0134.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdx48saerp3j6l1.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Bdx48saERp3j6l1.exe.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdx48saerp3j6l1.exe.boom")) returned 1
	[0134.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bOi1iGUVDRngR_l.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\boi1iguvdrngr_l.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bOi1iGUVDRngR_l.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\boi1iguvdrngr_l.mp3.boom")) returned 1
	[0134.511] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\C6JmKm0MEWYU kE.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\c6jmkm0mewyu ke.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\C6JmKm0MEWYU kE.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\c6jmkm0mewyu ke.flv.boom")) returned 1
	[0134.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0134.552] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DsMcecb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dsmcecb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DsMcecb.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dsmcecb.wav.boom")) returned 1
	[0134.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EhLtQ p4E8DjIOjo.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ehltq p4e8djiojo.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EhLtQ p4E8DjIOjo.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ehltq p4e8djiojo.mkv.boom")) returned 1
	[0134.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GWXgkpDz.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gwxgkpdz.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GWXgkpDz.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gwxgkpdz.png.boom")) returned 1
	[0134.761] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h7MH1rgQAcV jS5w1.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h7mh1rgqacv js5w1.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h7MH1rgQAcV jS5w1.doc.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h7mh1rgqacv js5w1.doc.boom")) returned 1
	[0134.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0134.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.068] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jONinqCVDjZVxc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\joninqcvdjzvxc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jONinqCVDjZVxc.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\joninqcvdjzvxc.avi.boom")) returned 1
	[0135.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KAOWwRsYNfuFwD-sRZX.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kaowwrsynfufwd-srzx.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KAOWwRsYNfuFwD-sRZX.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kaowwrsynfufwd-srzx.mp4.boom")) returned 1
	[0135.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kEZGp8nwohtImsjqpFDZ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kezgp8nwohtimsjqpfdz.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kEZGp8nwohtImsjqpFDZ.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kezgp8nwohtimsjqpfdz.bmp.boom")) returned 1
	[0135.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Low\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mIYO CkOSz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\miyo ckosz.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mIYO CkOSz.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\miyo ckosz.mp3.boom")) returned 1
	[0135.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\nL02.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\nl02.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\nL02.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\nl02.mp3.boom")) returned 1
	[0135.092] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Q1A2ZidgvQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\q1a2zidgvq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Q1A2ZidgvQ.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\q1a2zidgvq.mp3.boom")) returned 1
	[0135.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\QhBY1OS4GxaHX.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\qhby1os4gxahx.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\QhBY1OS4GxaHX.xls.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\qhby1os4gxahx.xls.boom")) returned 1
	[0135.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rOggWv6Y-99KVkaMJgh.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\roggwv6y-99kvkamjgh.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rOggWv6Y-99KVkaMJgh.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\roggwv6y-99kvkamjgh.docx.boom")) returned 1
	[0135.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sDE1nlApY7.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sde1nlapy7.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sDE1nlApY7.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sde1nlapy7.mp4.boom")) returned 1
	[0135.244] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sKzPrElotdD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\skzprelotdd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sKzPrElotdD.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\skzprelotdd.wav.boom")) returned 1
	[0135.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SU1lvG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\su1lvg.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SU1lvG.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\su1lvg.mp4.boom")) returned 1
	[0135.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\syuWjbTPKK.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\syuwjbtpkk.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\syuWjbTPKK.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\syuwjbtpkk.gif.boom")) returned 1
	[0135.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tQwI3wjS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tqwi3wjs.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tQwI3wjS.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tqwi3wjs.flv.boom")) returned 1
	[0135.269] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UyPVYGCunrD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\uypvygcunrd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UyPVYGCunrD.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\uypvygcunrd.wav.boom")) returned 1
	[0135.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\v8862yyISdPK0bn0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v8862yyisdpk0bn0.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\v8862yyISdPK0bn0.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v8862yyisdpk0bn0.mp4.boom")) returned 1
	[0135.343] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YkTXXO44_8fMa3UaN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yktxxo44_8fma3uan.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YkTXXO44_8fMa3UaN.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yktxxo44_8fma3uan.wav.boom")) returned 1
	[0135.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zu1s2Yf0ZCj8TP8UGWES.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\zu1s2yf0zcj8tp8ugwes.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zu1s2Yf0ZCj8TP8UGWES.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\zu1s2yf0zcj8tp8ugwes.png.boom")) returned 1
	[0135.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_-Nal4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_-nal4.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_-Nal4.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_-nal4.gif.boom")) returned 1
	[0135.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.422] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\~nsu.tmp\\au_.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\~nsu.tmp\\au_.exe.boom")) returned 1
	[0135.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0xffffffff
	[0135.424] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.424] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0135.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.426] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.boom")) returned 1
	[0135.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.494] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.649] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.649] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.649] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.651] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0135.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2xdOkXB8NpBh.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2xdokxb8npbh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2xdOkXB8NpBh.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2xdokxb8npbh.mp3.boom")) returned 1
	[0135.721] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6KqkuI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6kqkui.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6KqkuI.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6kqkui.mkv.boom")) returned 1
	[0135.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.725] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.725] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aL sYSz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\al sysz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aL sYSz.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\al sysz.flv.boom")) returned 1
	[0135.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ay2Ej9N3NwkK7iXhcT.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ay2ej9n3nwkk7ixhct.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ay2Ej9N3NwkK7iXhcT.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ay2ej9n3nwkk7ixhct.mp4.boom")) returned 1
	[0135.747] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B2AG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b2ag.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B2AG.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b2ag.wav.boom")) returned 1
	[0135.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B5d5g_994wpy0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b5d5g_994wpy0.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B5d5g_994wpy0.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b5d5g_994wpy0.mp3.boom")) returned 1
	[0135.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DjZsGBHs33tFzcMzhWgG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\djzsgbhs33tfzcmzhwgg.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DjZsGBHs33tFzcMzhWgG.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\djzsgbhs33tfzcmzhwgg.gif.boom")) returned 1
	[0135.759] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fV_nwyigF.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fv_nwyigf.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fV_nwyigF.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fv_nwyigf.mkv.boom")) returned 1
	[0135.762] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gzXGwjlz-o8EWNzJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gzxgwjlz-o8ewnzj.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gzXGwjlz-o8EWNzJ.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gzxgwjlz-o8ewnzj.jpg.boom")) returned 1
	[0135.769] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H7SUO2.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h7suo2.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H7SUO2.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h7suo2.wav.boom")) returned 1
	[0135.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ircck.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ircck.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ircck.xls.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ircck.xls.boom")) returned 1
	[0135.779] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\islJcWoNPzd7_2KDaLAk.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\isljcwonpzd7_2kdalak.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\islJcWoNPzd7_2KDaLAk.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\isljcwonpzd7_2kdalak.gif.boom")) returned 1
	[0135.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KCVNrm.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kcvnrm.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KCVNrm.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kcvnrm.flv.boom")) returned 1
	[0135.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LSwu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lswu.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LSwu.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lswu.wav.boom")) returned 1
	[0135.790] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LwnJ3GYvZHE.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lwnj3gyvzhe.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LwnJ3GYvZHE.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lwnj3gyvzhe.pptx.boom")) returned 1
	[0135.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M70viSZYIYiOepf1O.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m70viszyiyioepf1o.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M70viSZYIYiOepf1O.pdf.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m70viszyiyioepf1o.pdf.boom")) returned 1
	[0135.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0135.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mcEt4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mcet4.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mcEt4.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mcet4.mp3.boom")) returned 1
	[0135.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0135.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.boom")) returned 1
	[0135.826] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.boom")) returned 1
	[0135.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.boom")) returned 1
	[0135.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.839] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.boom")) returned 1
	[0135.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.boom")) returned 1
	[0135.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.boom")) returned 1
	[0135.855] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.boom")) returned 1
	[0135.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.boom")) returned 1
	[0135.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.boom")) returned 1
	[0135.877] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.boom")) returned 1
	[0135.886] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.boom")) returned 1
	[0135.890] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.boom")) returned 1
	[0135.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0135.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0135.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0135.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0135.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0136.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.boom")) returned 1
	[0136.017] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.boom")) returned 1
	[0136.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.030] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.034] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0136.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.boom")) returned 1
	[0136.052] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.boom")) returned 1
	[0136.065] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.boom")) returned 1
	[0136.068] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.boom")) returned 1
	[0136.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.boom")) returned 1
	[0136.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.boom")) returned 1
	[0136.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.boom")) returned 1
	[0136.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.boom")) returned 1
	[0136.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.boom")) returned 1
	[0136.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.boom")) returned 1
	[0136.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.boom")) returned 1
	[0136.127] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.boom")) returned 1
	[0136.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.boom")) returned 1
	[0136.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.boom")) returned 1
	[0136.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.boom")) returned 1
	[0136.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.boom")) returned 1
	[0136.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.boom")) returned 1
	[0136.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.boom")) returned 1
	[0136.141] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.boom")) returned 1
	[0136.143] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.boom")) returned 1
	[0136.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.boom")) returned 1
	[0136.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.boom")) returned 1
	[0136.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.boom")) returned 1
	[0136.152] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.boom")) returned 1
	[0136.154] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.boom")) returned 1
	[0136.156] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.boom")) returned 1
	[0136.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.boom")) returned 1
	[0136.160] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.boom")) returned 1
	[0136.162] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.boom")) returned 1
	[0136.165] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.boom")) returned 1
	[0136.167] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.boom")) returned 1
	[0136.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.boom")) returned 1
	[0136.172] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.boom")) returned 1
	[0136.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.boom")) returned 1
	[0136.178] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.boom")) returned 1
	[0136.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0136.192] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-OY7VO-cEu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-oy7vo-ceu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-OY7VO-cEu.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-oy7vo-ceu.lnk.boom")) returned 1
	[0136.196] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-rnxG8aDq6LI9EWT_nS8.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-rnxg8adq6li9ewt_ns8.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-rnxG8aDq6LI9EWT_nS8.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-rnxg8adq6li9ewt_ns8.mkv.lnk.boom")) returned 1
	[0136.200] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-SrRzOOplH54w.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-srrzooplh54w.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-SrRzOOplH54w.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-srrzooplh54w.mkv.lnk.boom")) returned 1
	[0136.204] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-vbfog8rBRXlmPLKlV1.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-vbfog8rbrxlmplklv1.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-vbfog8rBRXlmPLKlV1.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-vbfog8rbrxlmplklv1.flv.lnk.boom")) returned 1
	[0136.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BTPHl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0btphl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BTPHl.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0btphl.lnk.boom")) returned 1
	[0136.213] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11Il.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11il.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11Il.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11il.lnk.boom")) returned 1
	[0136.217] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1PhbmiQrN83g 0 t--.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1phbmiqrn83g 0 t--.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1PhbmiQrN83g 0 t--.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1phbmiqrn83g 0 t--.lnk.boom")) returned 1
	[0136.222] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2kJwThv_dQH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2kjwthv_dqh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2kJwThv_dQH.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2kjwthv_dqh.lnk.boom")) returned 1
	[0136.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Pdh-X019JvWc.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pdh-x019jvwc.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Pdh-X019JvWc.ots.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pdh-x019jvwc.ots.lnk.boom")) returned 1
	[0136.232] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4dpdquHsHnnxXa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4dpdquhshnnxxa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4dpdquHsHnnxXa.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4dpdquhshnnxxa.lnk.boom")) returned 1
	[0136.236] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Qr 7tsn7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qr 7tsn7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Qr 7tsn7.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qr 7tsn7.lnk.boom")) returned 1
	[0136.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5SzIB_-AR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5szib_-ar.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5SzIB_-AR.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5szib_-ar.lnk.boom")) returned 1
	[0136.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\60q3E6t3vzPft.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\60q3e6t3vzpft.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\60q3E6t3vzPft.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\60q3e6t3vzpft.lnk.boom")) returned 1
	[0136.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6CdWCCr.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cdwccr.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6CdWCCr.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cdwccr.flv.lnk.boom")) returned 1
	[0136.253] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6KqkuI.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6kqkui.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6KqkuI.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6kqkui.mkv.lnk.boom")) returned 1
	[0136.257] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7a r_tyaYecpZD e4hbm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a r_tyayecpzd e4hbm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7a r_tyaYecpZD e4hbm.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7a r_tyayecpzd e4hbm.lnk.boom")) returned 1
	[0136.263] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7aR6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7ar6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7aR6.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7ar6.lnk.boom")) returned 1
	[0136.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7gis0fuiaLJX Sdr52.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7gis0fuialjx sdr52.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7gis0fuiaLJX Sdr52.ots.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7gis0fuialjx sdr52.ots.lnk.boom")) returned 1
	[0136.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\83-NoF5Bz3dC _XG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\83-nof5bz3dc _xg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\83-NoF5Bz3dC _XG.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\83-nof5bz3dc _xg.lnk.boom")) returned 1
	[0136.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\84MzQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\84mzq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\84MzQ.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\84mzq.lnk.boom")) returned 1
	[0136.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8hMtzAdjSIhc3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8hmtzadjsihc3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8hMtzAdjSIhc3.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8hmtzadjsihc3.lnk.boom")) returned 1
	[0136.285] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AM 8nHz5l06wBaM0K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9am 8nhz5l06wbam0k.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AM 8nHz5l06wBaM0K.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9am 8nhz5l06wbam0k.lnk.boom")) returned 1
	[0136.289] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a6gkF2RqBv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6gkf2rqbv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a6gkF2RqBv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6gkf2rqbv.lnk.boom")) returned 1
	[0136.293] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ad9lanfBNY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ad9lanfbny.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ad9lanfBNY.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ad9lanfbny.lnk.boom")) returned 1
	[0136.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aL sYSz.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\al sysz.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aL sYSz.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\al sysz.flv.lnk.boom")) returned 1
	[0136.299] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.303] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aYzKtDe_KIo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ayzktde_kio.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aYzKtDe_KIo.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ayzktde_kio.lnk.boom")) returned 1
	[0136.308] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bIt7L X3DXH-l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bit7l x3dxh-l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bIt7L X3DXH-l.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bit7l x3dxh-l.lnk.boom")) returned 1
	[0136.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKl L5jMY7bpS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkl l5jmy7bps.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKl L5jMY7bpS.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkl l5jmy7bps.lnk.boom")) returned 1
	[0136.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bNX8bw8DY-x6jSX2OMN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bnx8bw8dy-x6jsx2omn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bNX8bw8DY-x6jSX2OMN.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bnx8bw8dy-x6jsx2omn.lnk.boom")) returned 1
	[0136.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bUgKX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bugkx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bUgKX.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bugkx.lnk.boom")) returned 1
	[0136.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bw83 LE1gqWw3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bw83 le1gqww3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bw83 LE1gqWw3.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bw83 le1gqww3.lnk.boom")) returned 1
	[0136.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CfC7DxZgTT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfc7dxzgtt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CfC7DxZgTT.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfc7dxzgtt.lnk.boom")) returned 1
	[0136.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ckk94ALA02Y2AP5nq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ckk94ala02y2ap5nq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ckk94ALA02Y2AP5nq.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ckk94ala02y2ap5nq.lnk.boom")) returned 1
	[0136.344] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CT5se03ue.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ct5se03ue.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CT5se03ue.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ct5se03ue.lnk.boom")) returned 1
	[0136.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cufsUc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cufsuc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cufsUc.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cufsuc.lnk.boom")) returned 1
	[0136.350] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0136.355] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_5YIU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c_5yiu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_5YIU.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c_5yiu.lnk.boom")) returned 1
	[0136.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DEEV.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\deev.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DEEV.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\deev.flv.lnk.boom")) returned 1
	[0136.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dk 3vNUs2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk 3vnus2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dk 3vNUs2.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk 3vnus2.lnk.boom")) returned 1
	[0136.368] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e3l6kpa9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e3l6kpa9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e3l6kpa9.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e3l6kpa9.lnk.boom")) returned 1
	[0136.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EfN9E2XTzgOqh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efn9e2xtzgoqh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EfN9E2XTzgOqh.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efn9e2xtzgoqh.lnk.boom")) returned 1
	[0136.377] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EmGsYUI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emgsyui.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EmGsYUI.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emgsyui.lnk.boom")) returned 1
	[0136.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enYYiTQ1Hduh8v.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\enyyitq1hduh8v.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\enYYiTQ1Hduh8v.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\enyyitq1hduh8v.lnk.boom")) returned 1
	[0136.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EX0HrR.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ex0hrr.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EX0HrR.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ex0hrr.mkv.lnk.boom")) returned 1
	[0136.389] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExgS-oVzmmfwwv-YRb-_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\exgs-ovzmmfwwv-yrb-_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExgS-oVzmmfwwv-YRb-_.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\exgs-ovzmmfwwv-yrb-_.lnk.boom")) returned 1
	[0136.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F CtuGtA32p4NzBir45F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f ctugta32p4nzbir45f.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F CtuGtA32p4NzBir45F.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f ctugta32p4nzbir45f.lnk.boom")) returned 1
	[0136.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F1f6eY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f1f6ey.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F1f6eY.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f1f6ey.lnk.boom")) returned 1
	[0136.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fc0u_ZFFA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fc0u_zffa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fc0u_ZFFA.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fc0u_zffa.lnk.boom")) returned 1
	[0136.419] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ffdf8BTH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffdf8bth.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ffdf8BTH.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffdf8bth.lnk.boom")) returned 1
	[0136.423] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FHtjNJlBJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fhtjnjlbj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FHtjNJlBJ.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fhtjnjlbj.lnk.boom")) returned 1
	[0136.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLQWLmPmNFU9AvXF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\flqwlmpmnfu9avxf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLQWLmPmNFU9AvXF.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\flqwlmpmnfu9avxf.lnk.boom")) returned 1
	[0136.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g-JFXSNQt2BI C0BNh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g-jfxsnqt2bi c0bnh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g-JFXSNQt2BI C0BNh.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g-jfxsnqt2bi c0bnh.lnk.boom")) returned 1
	[0136.437] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g3K0z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g3k0z.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g3K0z.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g3k0z.lnk.boom")) returned 1
	[0136.441] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gDZzGKrt7gLtvkiE4AV3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gdzzgkrt7gltvkie4av3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gDZzGKrt7gLtvkiE4AV3.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gdzzgkrt7gltvkie4av3.lnk.boom")) returned 1
	[0136.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqPYl9Vy25pBfd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gqpyl9vy25pbfd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqPYl9Vy25pBfd.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gqpyl9vy25pbfd.lnk.boom")) returned 1
	[0136.449] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqQlcc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gqqlcc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqQlcc.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gqqlcc.lnk.boom")) returned 1
	[0136.452] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gW6IM8Cmmokgb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gw6im8cmmokgb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gW6IM8Cmmokgb.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gw6im8cmmokgb.lnk.boom")) returned 1
	[0136.455] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gyu5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gyu5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gyu5.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gyu5.lnk.boom")) returned 1
	[0136.459] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h c0z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h c0z.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h c0z.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h c0z.lnk.boom")) returned 1
	[0136.462] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H26En6hb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h26en6hb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H26En6hb.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h26en6hb.lnk.boom")) returned 1
	[0136.465] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hdlh.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hdlh.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hdlh.ots.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hdlh.ots.lnk.boom")) returned 1
	[0136.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HLqGlxGXPoeIqx_J.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hlqglxgxpoeiqx_j.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HLqGlxGXPoeIqx_J.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hlqglxgxpoeiqx_j.lnk.boom")) returned 1
	[0136.471] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hlykeuAmn.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hlykeuamn.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hlykeuAmn.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hlykeuamn.mkv.lnk.boom")) returned 1
	[0136.474] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\huoeNTuaq.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\huoentuaq.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\huoeNTuaq.ots.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\huoentuaq.ots.lnk.boom")) returned 1
	[0136.478] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i1y1oGx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i1y1ogx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i1y1oGx.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i1y1ogx.lnk.boom")) returned 1
	[0136.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4NW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i4nw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4NW.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i4nw.lnk.boom")) returned 1
	[0136.485] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I5qCTpwqMyyVpbiX1pZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i5qctpwqmyyvpbix1pz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I5qCTpwqMyyVpbiX1pZ.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i5qctpwqmyyvpbix1pz.lnk.boom")) returned 1
	[0136.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Im6PWCui6pvna-G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\im6pwcui6pvna-g.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Im6PWCui6pvna-G.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\im6pwcui6pvna-g.lnk.boom")) returned 1
	[0136.492] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ircck.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ircck.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ircck.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ircck.lnk.boom")) returned 1
	[0136.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iV9I3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iv9i3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iV9I3.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iv9i3.lnk.boom")) returned 1
	[0136.594] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iy0FrxhdbRGiDSG4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iy0frxhdbrgidsg4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iy0FrxhdbRGiDSG4.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iy0frxhdbrgidsg4.lnk.boom")) returned 1
	[0136.598] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J5t5lirOUkXfFE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5t5liroukxffe.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J5t5lirOUkXfFE.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5t5liroukxffe.lnk.boom")) returned 1
	[0136.603] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JMhEVGU2kDhb0ai.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jmhevgu2kdhb0ai.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JMhEVGU2kDhb0ai.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jmhevgu2kdhb0ai.flv.lnk.boom")) returned 1
	[0136.612] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxZZ5-jgE1dUABrU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jxzz5-jge1duabru.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxZZ5-jgE1dUABrU.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jxzz5-jge1duabru.lnk.boom")) returned 1
	[0136.626] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KMrmQB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kmrmqb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KMrmQB.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kmrmqb.lnk.boom")) returned 1
	[0136.629] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KnkY.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\knky.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KnkY.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\knky.mkv.lnk.boom")) returned 1
	[0136.633] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KOC5LghJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\koc5lghj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KOC5LghJ.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\koc5lghj.lnk.boom")) returned 1
	[0136.637] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kUweFY9pTvx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kuwefy9ptvx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kUweFY9pTvx.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kuwefy9ptvx.lnk.boom")) returned 1
	[0136.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kWsGQXWq7T9q35XfTu4m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kwsgqxwq7t9q35xftu4m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kWsGQXWq7T9q35XfTu4m.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kwsgqxwq7t9q35xftu4m.lnk.boom")) returned 1
	[0136.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M70viSZYIYiOepf1O.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m70viszyiyioepf1o.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M70viSZYIYiOepf1O.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m70viszyiyioepf1o.lnk.boom")) returned 1
	[0136.650] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mad-0e.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mad-0e.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mad-0e.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mad-0e.lnk.boom")) returned 1
	[0136.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeqQdyc2i4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\meqqdyc2i4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeqQdyc2i4.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\meqqdyc2i4.lnk.boom")) returned 1
	[0136.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mJDBo6z8A_53M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mjdbo6z8a_53m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mJDBo6z8A_53M.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mjdbo6z8a_53m.lnk.boom")) returned 1
	[0136.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mKtPX_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mktpx_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mKtPX_.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mktpx_.lnk.boom")) returned 1
	[0136.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mvwg-qa Vxoy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mvwg-qa vxoy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mvwg-qa Vxoy.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mvwg-qa vxoy.lnk.boom")) returned 1
	[0136.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MwKYoFrPpRhL9jPH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwkyofrpprhl9jph.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MwKYoFrPpRhL9jPH.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwkyofrpprhl9jph.lnk.boom")) returned 1
	[0136.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.boom")) returned 1
	[0136.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.boom")) returned 1
	[0136.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n13xM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n13xm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n13xM.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n13xm.lnk.boom")) returned 1
	[0136.703] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NaGdLq9z.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nagdlq9z.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NaGdLq9z.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nagdlq9z.mkv.lnk.boom")) returned 1
	[0136.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ndf4cRqlCFLdKEctT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ndf4crqlcfldkectt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ndf4cRqlCFLdKEctT.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ndf4crqlcfldkectt.lnk.boom")) returned 1
	[0136.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ns29br73Dds7trMssbr7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ns29br73dds7trmssbr7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ns29br73Dds7trMssbr7.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ns29br73dds7trmssbr7.lnk.boom")) returned 1
	[0136.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NSWhZ-s0nqMeCvifYa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nswhz-s0nqmecvifya.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NSWhZ-s0nqMeCvifYa.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nswhz-s0nqmecvifya.lnk.boom")) returned 1
	[0136.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuEkoymIO5sRH QGE1i.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nuekoymio5srh qge1i.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuEkoymIO5sRH QGE1i.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nuekoymio5srh qge1i.flv.lnk.boom")) returned 1
	[0136.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nymZnGkeYxa08dkaKP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nymzngkeyxa08dkakp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nymZnGkeYxa08dkaKP.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nymzngkeyxa08dkakp.lnk.boom")) returned 1
	[0136.725] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NyXz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nyxz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NyXz.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nyxz.lnk.boom")) returned 1
	[0136.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OfMvEv-slDxnfZGtRc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofmvev-sldxnfzgtrc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OfMvEv-slDxnfZGtRc.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofmvev-sldxnfzgtrc.lnk.boom")) returned 1
	[0136.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OqTEBYaHC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oqtebyahc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OqTEBYaHC.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oqtebyahc.lnk.boom")) returned 1
	[0136.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ovwDKm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ovwdkm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ovwDKm.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ovwdkm.lnk.boom")) returned 1
	[0136.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OwaE6 7apE19TnQEQ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\owae6 7ape19tnqeq.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OwaE6 7apE19TnQEQ.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\owae6 7ape19tnqeq.flv.lnk.boom")) returned 1
	[0136.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OzmppfCkq8qNZQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ozmppfckq8qnzq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OzmppfCkq8qNZQ.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ozmppfckq8qnzq.lnk.boom")) returned 1
	[0136.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PbUkMl5.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pbukml5.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PbUkMl5.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pbukml5.flv.lnk.boom")) returned 1
	[0136.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pc7-mOir.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pc7-moir.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pc7-mOir.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pc7-moir.lnk.boom")) returned 1
	[0136.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pdfepev.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pdfepev.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pdfepev.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pdfepev.lnk.boom")) returned 1
	[0136.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PNbea.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnbea.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PNbea.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnbea.lnk.boom")) returned 1
	[0136.763] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPJHxbdGqekEv4CZ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppjhxbdgqekev4cz.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPJHxbdGqekEv4CZ.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppjhxbdgqekev4cz.mkv.lnk.boom")) returned 1
	[0136.767] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pq27.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pq27.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pq27.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pq27.lnk.boom")) returned 1
	[0136.773] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P_v180yBadVUXZIL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_v180ybadvuxzil.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P_v180yBadVUXZIL.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_v180ybadvuxzil.lnk.boom")) returned 1
	[0136.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qaz__FvwngSffLQB-q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qaz__fvwngsfflqb-q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qaz__FvwngSffLQB-q.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qaz__fvwngsfflqb-q.lnk.boom")) returned 1
	[0136.780] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qh1NPHTK38r.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qh1nphtk38r.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qh1NPHTK38r.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qh1nphtk38r.lnk.boom")) returned 1
	[0136.784] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkkO_Gpi6W.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qkko_gpi6w.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkkO_Gpi6W.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qkko_gpi6w.lnk.boom")) returned 1
	[0136.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qOl6egDDlz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qol6egddlz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qOl6egDDlz.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qol6egddlz.lnk.boom")) returned 1
	[0136.792] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qOxPhEp7aZIQGU2NC0.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qoxphep7aziqgu2nc0.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qOxPhEp7aZIQGU2NC0.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qoxphep7aziqgu2nc0.mkv.lnk.boom")) returned 1
	[0136.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qsAM wWylQ2f9OZ_U6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qsam wwylq2f9oz_u6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qsAM wWylQ2f9OZ_U6.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qsam wwylq2f9oz_u6.lnk.boom")) returned 1
	[0136.800] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rmE5Ifx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rme5ifx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rmE5Ifx.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rme5ifx.lnk.boom")) returned 1
	[0136.804] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.boom")) returned 1
	[0136.809] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsJYcz8DkJ4P.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsjycz8dkj4p.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsJYcz8DkJ4P.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsjycz8dkj4p.lnk.boom")) returned 1
	[0136.813] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rweUvu 6akFQB8n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rweuvu 6akfqb8n.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rweUvu 6akFQB8n.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rweuvu 6akfqb8n.lnk.boom")) returned 1
	[0136.816] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-fprG7HWT.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\s-fprg7hwt.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-fprG7HWT.ots.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\s-fprg7hwt.ots.lnk.boom")) returned 1
	[0136.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sDz7B43KSXKszZpTVmSE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sdz7b43ksxkszzptvmse.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sDz7B43KSXKszZpTVmSE.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sdz7b43ksxkszzptvmse.lnk.boom")) returned 1
	[0136.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sF1ONUA-Su86 XSVCG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sf1onua-su86 xsvcg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sF1ONUA-Su86 XSVCG.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sf1onua-su86 xsvcg.lnk.boom")) returned 1
	[0136.830] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sm26sIAzqJK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sm26siazqjk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sm26sIAzqJK.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sm26siazqjk.lnk.boom")) returned 1
	[0136.834] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SnlcC8fNeqUZpR7_Oc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snlcc8fnequzpr7_oc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SnlcC8fNeqUZpR7_Oc.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snlcc8fnequzpr7_oc.lnk.boom")) returned 1
	[0136.837] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sRrY2NWZC_i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srry2nwzc_i.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sRrY2NWZC_i.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srry2nwzc_i.lnk.boom")) returned 1
	[0136.901] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Trog98gPqXaYIACib_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\trog98gpqxayiacib_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Trog98gPqXaYIACib_.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\trog98gpqxayiacib_.lnk.boom")) returned 1
	[0137.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TW0CWfW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tw0cwfw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TW0CWfW.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tw0cwfw.lnk.boom")) returned 1
	[0137.017] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxLi92b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\txli92b.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxLi92b.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\txli92b.lnk.boom")) returned 1
	[0137.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UFtT  ZdJfJf1l7D Fca.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uftt  zdjfjf1l7d fca.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UFtT  ZdJfJf1l7D Fca.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uftt  zdjfjf1l7d fca.lnk.boom")) returned 1
	[0137.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiPLJh3_qRuvQUh8Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uipljh3_qruvquh8q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiPLJh3_qRuvQUh8Q.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uipljh3_qruvquh8q.lnk.boom")) returned 1
	[0137.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Usxomg4CBz56mme4-Csh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usxomg4cbz56mme4-csh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Usxomg4CBz56mme4-Csh.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usxomg4cbz56mme4-csh.lnk.boom")) returned 1
	[0137.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uX3 czGD7Uv7Uw6OM32.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ux3 czgd7uv7uw6om32.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uX3 czGD7Uv7Uw6OM32.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ux3 czgd7uv7uw6om32.lnk.boom")) returned 1
	[0137.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v7zY7eX9g1FX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v7zy7ex9g1fx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v7zY7eX9g1FX.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v7zy7ex9g1fx.lnk.boom")) returned 1
	[0137.052] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VOdb3e.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vodb3e.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VOdb3e.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vodb3e.lnk.boom")) returned 1
	[0137.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wJd BUz.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wjd buz.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wJd BUz.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wjd buz.flv.lnk.boom")) returned 1
	[0137.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wn5unweVFKq6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wn5unwevfkq6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wn5unweVFKq6.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wn5unwevfkq6.lnk.boom")) returned 1
	[0137.064] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WY PbT8AQD0dCi8dv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wy pbt8aqd0dci8dv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WY PbT8AQD0dCi8dv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wy pbt8aqd0dci8dv.lnk.boom")) returned 1
	[0137.068] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnHi5Bq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xnhi5bq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnHi5Bq.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xnhi5bq.lnk.boom")) returned 1
	[0137.072] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XTiYzN5h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xtiyzn5h.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XTiYzN5h.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xtiyzn5h.lnk.boom")) returned 1
	[0137.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuzgQ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xuzgq.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuzgQ.flv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xuzgq.flv.lnk.boom")) returned 1
	[0137.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xw0ZdmuxedfOlsUP3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xw0zdmuxedfolsup3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xw0ZdmuxedfOlsUP3.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xw0zdmuxedfolsup3.lnk.boom")) returned 1
	[0137.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xzqB3IzqSUrTwZYEkU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xzqb3izqsurtwzyeku.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xzqB3IzqSUrTwZYEkU.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xzqb3izqsurtwzyeku.lnk.boom")) returned 1
	[0137.093] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YKKY6jA kVIYfhcba.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ykky6ja kviyfhcba.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YKKY6jA kVIYfhcba.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ykky6ja kviyfhcba.lnk.boom")) returned 1
	[0137.098] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YNNyKKr_UebTTPGqJ_.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynnykkr_uebttpgqj_.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YNNyKKr_UebTTPGqJ_.mkv.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynnykkr_uebttpgqj_.mkv.lnk.boom")) returned 1
	[0137.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNtELS6cQeXqo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yntels6cqexqo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNtELS6cQeXqo.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yntels6cqexqo.lnk.boom")) returned 1
	[0137.108] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQRcB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yqrcb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQRcB.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yqrcb.lnk.boom")) returned 1
	[0137.112] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_b2Ug-8p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y_b2ug-8p.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_b2Ug-8p.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y_b2ug-8p.lnk.boom")) returned 1
	[0137.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zAHXxG8315GC1XZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zahxxg8315gc1xz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zAHXxG8315GC1XZ.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zahxxg8315gc1xz.lnk.boom")) returned 1
	[0137.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zCvUY5Cysgs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zcvuy5cysgs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zCvUY5Cysgs.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zcvuy5cysgs.lnk.boom")) returned 1
	[0137.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_C8zf4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_c8zf4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_C8zf4.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_c8zf4.lnk.boom")) returned 1
	[0137.127] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_D1vYTFItOzig7Nq5f.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_d1vytfitozig7nq5f.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_D1vYTFItOzig7Nq5f.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_d1vytfitozig7nq5f.lnk.boom")) returned 1
	[0137.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XE-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xe-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XE-.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xe-.lnk.boom")) returned 1
	[0137.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.boom")) returned 1
	[0137.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0137.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0137.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.boom")) returned 1
	[0137.155] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.boom")) returned 1
	[0137.160] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.boom")) returned 1
	[0137.163] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.boom")) returned 1
	[0137.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.boom")) returned 1
	[0137.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.boom")) returned 1
	[0137.178] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.boom")) returned 1
	[0137.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0137.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.boom")) returned 1
	[0137.187] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.boom")) returned 1
	[0137.190] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.boom")) returned 1
	[0137.194] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.boom")) returned 1
	[0137.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.boom")) returned 1
	[0137.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.204] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.boom")) returned 1
	[0137.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.boom")) returned 1
	[0137.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.213] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.boom")) returned 1
	[0137.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.boom")) returned 1
	[0137.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0137.234] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mJDBo6z8A_53M.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mjdbo6z8a_53m.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mJDBo6z8A_53M.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mjdbo6z8a_53m.xlsx.boom")) returned 1
	[0137.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mKtPX_.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mktpx_.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mKtPX_.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mktpx_.pptx.boom")) returned 1
	[0137.243] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0137.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0137.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0137.245] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0137.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0137.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0137.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78) returned 0x8b80a8
	[0137.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0137.269] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdfepev.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdfepev.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdfepev.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdfepev.bmp.boom")) returned 1
	[0137.273] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pdzXlG-VWTyJTGeB94y1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdzxlg-vwtyjtgeb94y1.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pdzXlG-VWTyJTGeB94y1.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdzxlg-vwtyjtgeb94y1.gif.boom")) returned 1
	[0137.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qsAM wWylQ2f9OZ_U6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qsam wwylq2f9oz_u6.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qsAM wWylQ2f9OZ_U6.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qsam wwylq2f9oz_u6.png.boom")) returned 1
	[0137.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sbBOJ 4fL.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sbboj 4fl.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sbBOJ 4fL.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sbboj 4fl.mp4.boom")) returned 1
	[0137.285] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TxLi92b.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\txli92b.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TxLi92b.doc.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\txli92b.doc.boom")) returned 1
	[0137.289] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uHmdEEI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uhmdeei.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uHmdEEI.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uhmdeei.wav.boom")) returned 1
	[0137.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\v-6ipz_Uy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\v-6ipz_uy.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\v-6ipz_Uy.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\v-6ipz_uy.avi.boom")) returned 1
	[0137.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YNNyKKr_UebTTPGqJ_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ynnykkr_uebttpgqj_.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YNNyKKr_UebTTPGqJ_.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ynnykkr_uebttpgqj_.mkv.boom")) returned 1
	[0137.302] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YQRcB.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yqrcb.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YQRcB.ppt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yqrcb.ppt.boom")) returned 1
	[0137.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YYmDO.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yymdo.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YYmDO.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yymdo.avi.boom")) returned 1
	[0137.311] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_C8zf4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_c8zf4.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_C8zf4.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_c8zf4.jpg.boom")) returned 1
	[0137.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_UKd33JHVOtieuE.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_ukd33jhvotieue.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_UKd33JHVOtieuE.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_ukd33jhvotieue.avi.boom")) returned 1
	[0137.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0137.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0137.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0137.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0137.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4Bxqj2x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4bxqj2x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4Bxqj2x.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4bxqj2x.bmp.boom")) returned 1
	[0137.330] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6PcAtl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6pcatl.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6PcAtl.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6pcatl.avi.boom")) returned 1
	[0137.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7UTWrEvCPNxN2D.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7utwrevcpnxn2d.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7UTWrEvCPNxN2D.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7utwrevcpnxn2d.gif.boom")) returned 1
	[0137.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8B9yUWjmpFFnZm YMxx1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8b9yuwjmpffnzm ymxx1.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8B9yUWjmpFFnZm YMxx1.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8b9yuwjmpffnzm ymxx1.avi.boom")) returned 1
	[0137.344] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\B8t3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b8t3.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\B8t3.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b8t3.mp4.boom")) returned 1
	[0137.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c_5YIU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c_5yiu.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c_5YIU.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c_5yiu.gif.boom")) returned 1
	[0137.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DqAhpPEh_uy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dqahppeh_uy.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DqAhpPEh_uy.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dqahppeh_uy.mkv.boom")) returned 1
	[0137.356] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gW6IM8Cmmokgb.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gw6im8cmmokgb.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gW6IM8Cmmokgb.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gw6im8cmmokgb.bmp.boom")) returned 1
	[0137.360] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iV9I3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iv9i3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iV9I3.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iv9i3.jpg.boom")) returned 1
	[0137.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jxZZ5-jgE1dUABrU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jxzz5-jge1duabru.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jxZZ5-jgE1dUABrU.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jxzz5-jge1duabru.gif.boom")) returned 1
	[0137.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZNgJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kzngj.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZNgJ.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kzngj.flv.boom")) returned 1
	[0137.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\miZ_dQ3BTX0iiAgmAjAx.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\miz_dq3btx0iiagmajax.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\miZ_dQ3BTX0iiAgmAjAx.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\miz_dq3btx0iiagmajax.flv.boom")) returned 1
	[0137.378] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nymZnGkeYxa08dkaKP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nymzngkeyxa08dkakp.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nymZnGkeYxa08dkaKP.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nymzngkeyxa08dkakp.png.boom")) returned 1
	[0137.383] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NyXz.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nyxz.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NyXz.pdf.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nyxz.pdf.boom")) returned 1
	[0137.387] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PPJHxbdGqekEv4CZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ppjhxbdgqekev4cz.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PPJHxbdGqekEv4CZ.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ppjhxbdgqekev4cz.mkv.boom")) returned 1
	[0137.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sm26sIAzqJK.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sm26siazqjk.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sm26sIAzqJK.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sm26siazqjk.gif.boom")) returned 1
	[0137.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0137.400] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\8iXiHHhVNSiPd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\8ixihhhvnsipd.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\8iXiHHhVNSiPd.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\8ixihhhvnsipd.mp4.boom")) returned 1
	[0137.471] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\kWsGQXWq7T9q35XfTu4m.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\kwsgqxwq7t9q35xftu4m.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\kWsGQXWq7T9q35XfTu4m.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\kwsgqxwq7t9q35xftu4m.pptx.boom")) returned 1
	[0137.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\TjUevdxbnb a.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\tjuevdxbnb a.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\TjUevdxbnb a.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\tjuevdxbnb a.avi.boom")) returned 1
	[0137.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\zm6G4LTBqJG6aBeX_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\zm6g4ltbqjg6abex_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\bIt7L X3DXH-l\\zm6G4LTBqJG6aBeX_.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\bit7l x3dxh-l\\zm6g4ltbqjg6abex_.mp3.boom")) returned 1
	[0137.484] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\OwaE6 7apE19TnQEQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\owae6 7ape19tnqeq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\OwaE6 7apE19TnQEQ.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\owae6 7ape19tnqeq.flv.boom")) returned 1
	[0137.486] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0137.490] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EfN9E2XTzgOqh.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efn9e2xtzgoqh.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EfN9E2XTzgOqh.pdf.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efn9e2xtzgoqh.pdf.boom")) returned 1
	[0137.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0137.494] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.542] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\6CdWCCr.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\6cdwccr.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\6CdWCCr.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\6cdwccr.flv.boom")) returned 1
	[0137.583] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\6kLFrdnYo-Epbh.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\6klfrdnyo-epbh.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\6kLFrdnYo-Epbh.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\6klfrdnyo-epbh.avi.boom")) returned 1
	[0137.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\hlykeuAmn.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\hlykeuamn.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\hlykeuAmn.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\hlykeuamn.mkv.boom")) returned 1
	[0137.590] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\xzqB3IzqSUrTwZYEkU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\xzqb3izqsurtwzyeku.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\I4NW\\xzqB3IzqSUrTwZYEkU.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\i4nw\\xzqb3izqsurtwzyeku.gif.boom")) returned 1
	[0137.593] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\NSWhZ-s0nqMeCvifYa.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\nswhz-s0nqmecvifya.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\NSWhZ-s0nqMeCvifYa.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\nswhz-s0nqmecvifya.gif.boom")) returned 1
	[0137.596] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\ruI7liMIMhITq.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\rui7limimhitq.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\ruI7liMIMhITq.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\rui7limimhitq.mp4.boom")) returned 1
	[0137.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\Trog98gPqXaYIACib_.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\trog98gpqxayiacib_.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\Trog98gPqXaYIACib_.odt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\trog98gpqxayiacib_.odt.boom")) returned 1
	[0137.604] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\uX3 czGD7Uv7Uw6OM32.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\ux3 czgd7uv7uw6om32.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sRrY2NWZC_i\\Wuqe1r1k5b\\EFSGR W\\uX3 czGD7Uv7Uw6OM32.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\srry2nwzc_i\\wuqe1r1k5b\\efsgr w\\ux3 czgd7uv7uw6om32.jpg.boom")) returned 1
	[0137.607] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sS1Gvpm5sA6PSXQWj.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss1gvpm5sa6psxqwj.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sS1Gvpm5sA6PSXQWj.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss1gvpm5sa6psxqwj.mkv.boom")) returned 1
	[0137.654] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wJd BUz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wjd buz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wJd BUz.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wjd buz.flv.boom")) returned 1
	[0137.658] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\X3iIOzjhwJvRWc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x3iiozjhwjvrwc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\X3iIOzjhwJvRWc.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x3iiozjhwjvrwc.avi.boom")) returned 1
	[0137.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xnHi5Bq.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xnhi5bq.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xnHi5Bq.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xnhi5bq.docx.boom")) returned 1
	[0137.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zsvpvV5MpuMY2VWzPl-n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zsvpvv5mpumy2vwzpl-n.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zsvpvV5MpuMY2VWzPl-n.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zsvpvv5mpumy2vwzpl-n.jpg.boom")) returned 1
	[0137.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0137.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-OY7VO-cEu.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-oy7vo-ceu.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-OY7VO-cEu.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-oy7vo-ceu.pptx.boom")) returned 1
	[0137.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bKl L5jMY7bpS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bkl l5jmy7bps.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bKl L5jMY7bpS.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bkl l5jmy7bps.pptx.boom")) returned 1
	[0137.680] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dk 3vNUs2.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk 3vnus2.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dk 3vNUs2.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk 3vnus2.xlsx.boom")) returned 1
	[0137.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Fc0u_ZFFA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fc0u_zffa.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Fc0u_ZFFA.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fc0u_zffa.docx.boom")) returned 1
	[0137.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FHtjNJlBJ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fhtjnjlbj.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FHtjNJlBJ.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fhtjnjlbj.docx.boom")) returned 1
	[0137.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g-JFXSNQt2BI C0BNh.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g-jfxsnqt2bi c0bnh.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g-JFXSNQt2BI C0BNh.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g-jfxsnqt2bi c0bnh.docx.boom")) returned 1
	[0137.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gqQlcc.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqqlcc.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gqQlcc.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqqlcc.docx.boom")) returned 1
	[0137.747] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gyu5.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gyu5.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gyu5.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gyu5.pptx.boom")) returned 1
	[0137.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Iy0FrxhdbRGiDSG4.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\iy0frxhdbrgidsg4.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Iy0FrxhdbRGiDSG4.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\iy0frxhdbrgidsg4.docx.boom")) returned 1
	[0137.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J5t5lirOUkXfFE.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5t5liroukxffe.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J5t5lirOUkXfFE.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5t5liroukxffe.pptx.boom")) returned 1
	[0137.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mad-0e.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mad-0e.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mad-0e.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mad-0e.xlsx.boom")) returned 1
	[0137.762] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MwKYoFrPpRhL9jPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mwkyofrpprhl9jph.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MwKYoFrPpRhL9jPH.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mwkyofrpprhl9jph.docx.boom")) returned 1
	[0137.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0xffffffff
	[0137.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0xffffffff
	[0137.765] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0137.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0xffffffff
	[0137.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.774] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc7-mOir.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pc7-moir.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc7-mOir.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pc7-moir.xlsx.boom")) returned 1
	[0137.776] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.781] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\ExgS-oVzmmfwwv-YRb-_.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\exgs-ovzmmfwwv-yrb-_.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\ExgS-oVzmmfwwv-YRb-_.ppt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\exgs-ovzmmfwwv-yrb-_.ppt.boom")) returned 1
	[0137.782] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0137.786] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\sDz7B43KSXKszZpTVmSE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\sdz7b43ksxkszzptvmse.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\sDz7B43KSXKszZpTVmSE.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\sdz7b43ksxkszzptvmse.xlsx.boom")) returned 1
	[0137.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0137.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\60q3E6t3vzPft.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\60q3e6t3vzpft.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\60q3E6t3vzPft.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\60q3e6t3vzpft.docx.boom")) returned 1
	[0137.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\F1f6eY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\f1f6ey.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\F1f6eY.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\f1f6ey.xlsx.boom")) returned 1
	[0137.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zAHXxG8315GC1XZ\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.800] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zAHXxG8315GC1XZ\\8hMtzAdjSIhc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\zahxxg8315gc1xz\\8hmtzadjsihc3.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zAHXxG8315GC1XZ\\8hMtzAdjSIhc3.pdf.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\zahxxg8315gc1xz\\8hmtzadjsihc3.pdf.boom")) returned 1
	[0137.801] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zCvUY5Cysgs\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0137.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zCvUY5Cysgs\\gqPYl9Vy25pBfd.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\zcvuy5cysgs\\gqpyl9vy25pbfd.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zCvUY5Cysgs\\gqPYl9Vy25pBfd.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\zcvuy5cysgs\\gqpyl9vy25pbfd.pptx.boom")) returned 1
	[0137.810] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zCvUY5Cysgs\\WY PbT8AQD0dCi8dv.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\zcvuy5cysgs\\wy pbt8aqd0dci8dv.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\SnlcC8fNeqUZpR7_Oc\\zCvUY5Cysgs\\WY PbT8AQD0dCi8dv.xls.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\snlcc8fnequzpr7_oc\\zcvuy5cysgs\\wy pbt8aqd0dci8dv.xls.boom")) returned 1
	[0137.813] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\UFtT  ZdJfJf1l7D Fca.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\uftt  zdjfjf1l7d fca.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\UFtT  ZdJfJf1l7D Fca.xls.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\uftt  zdjfjf1l7d fca.xls.boom")) returned 1
	[0137.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\_D1vYTFItOzig7Nq5f.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\_d1vytfitozig7nq5f.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\F CtuGtA32p4NzBir45F\\_D1vYTFItOzig7Nq5f.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\f ctugta32p4nzbir45f\\_d1vytfitozig7nq5f.docx.boom")) returned 1
	[0137.821] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\Mvwg-qa Vxoy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\mvwg-qa vxoy.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\Mvwg-qa Vxoy.ppt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\mvwg-qa vxoy.ppt.boom")) returned 1
	[0137.824] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\Ndf4cRqlCFLdKEctT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\ndf4crqlcfldkectt.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qaz__FvwngSffLQB-q\\Ndf4cRqlCFLdKEctT.docx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qaz__fvwngsfflqb-q\\ndf4crqlcfldkectt.docx.boom")) returned 1
	[0137.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qh1NPHTK38r.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qh1nphtk38r.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qh1NPHTK38r.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qh1nphtk38r.xlsx.boom")) returned 1
	[0137.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qOl6egDDlz.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qol6egddlz.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qOl6egDDlz.xls.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qol6egddlz.xls.boom")) returned 1
	[0137.830] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UiPLJh3_qRuvQUh8Q\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.834] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UiPLJh3_qRuvQUh8Q\\5SzIB_-AR.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uipljh3_qruvquh8q\\5szib_-ar.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UiPLJh3_qRuvQUh8Q\\5SzIB_-AR.odt.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uipljh3_qruvquh8q\\5szib_-ar.odt.boom")) returned 1
	[0137.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UiPLJh3_qRuvQUh8Q\\bNX8bw8DY-x6jSX2OMN.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uipljh3_qruvquh8q\\bnx8bw8dy-x6jsx2omn.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UiPLJh3_qRuvQUh8Q\\bNX8bw8DY-x6jSX2OMN.pdf.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uipljh3_qruvquh8q\\bnx8bw8dy-x6jsx2omn.pdf.boom")) returned 1
	[0137.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UiPLJh3_qRuvQUh8Q\\ovwDKm.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uipljh3_qruvquh8q\\ovwdkm.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UiPLJh3_qRuvQUh8Q\\ovwDKm.xls.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uipljh3_qruvquh8q\\ovwdkm.xls.boom")) returned 1
	[0137.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Usxomg4CBz56mme4-Csh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usxomg4cbz56mme4-csh.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Usxomg4CBz56mme4-Csh.pptx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usxomg4cbz56mme4-csh.pptx.boom")) returned 1
	[0137.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YKKY6jA kVIYfhcba.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ykky6ja kviyfhcba.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YKKY6jA kVIYfhcba.xlsx.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ykky6ja kviyfhcba.xlsx.boom")) returned 1
	[0137.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zfUeFt\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.853] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zfUeFt\\OfMvEv-slDxnfZGtRc.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zfueft\\ofmvev-sldxnfzgtrc.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zfUeFt\\OfMvEv-slDxnfZGtRc.xls.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zfueft\\ofmvev-sldxnfzgtrc.xls.boom")) returned 1
	[0137.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0137.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0137.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0137.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.boom")) returned 1
	[0137.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.boom")) returned 1
	[0137.885] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.boom")) returned 1
	[0137.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0137.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0137.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0TXDY7WJr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0137.898] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0TXDY7WJr\\Ok 82v-oCJ2y1sa.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0txdy7wjr\\ok 82v-ocj2y1sa.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0TXDY7WJr\\Ok 82v-oCJ2y1sa.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0txdy7wjr\\ok 82v-ocj2y1sa.wav.boom")) returned 1
	[0138.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0TXDY7WJr\\Tin31sg3MH0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0txdy7wjr\\tin31sg3mh0.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0TXDY7WJr\\Tin31sg3MH0.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0txdy7wjr\\tin31sg3mh0.wav.boom")) returned 1
	[0138.204] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0TXDY7WJr\\vdj-LH.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0txdy7wjr\\vdj-lh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0TXDY7WJr\\vdj-LH.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0txdy7wjr\\vdj-lh.mp3.boom")) returned 1
	[0138.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5d4S9sIU5.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5d4s9siu5.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5d4S9sIU5.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5d4s9siu5.wav.boom")) returned 1
	[0138.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0138.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\1KdBHQeJ1P8pisdlmx.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\1kdbhqej1p8pisdlmx.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\1KdBHQeJ1P8pisdlmx.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\1kdbhqej1p8pisdlmx.mp3.boom")) returned 1
	[0138.223] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\1WBT9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\1wbt9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\1WBT9.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\1wbt9.mp3.boom")) returned 1
	[0138.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\5dy2041W_o_2x\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0138.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\5dy2041W_o_2x\\jwfqkv.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\5dy2041w_o_2x\\jwfqkv.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\5dy2041W_o_2x\\jwfqkv.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\5dy2041w_o_2x\\jwfqkv.wav.boom")) returned 1
	[0138.513] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\5dy2041W_o_2x\\UDqwXCh.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\5dy2041w_o_2x\\udqwxch.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\5dy2041W_o_2x\\UDqwXCh.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\5dy2041w_o_2x\\udqwxch.wav.boom")) returned 1
	[0138.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\_m62M4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0138.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\_m62M4\\IkKIWBolPovhdJxor.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\_m62m4\\ikkiwbolpovhdjxor.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AtUAXVyLBv5xt\\_m62M4\\IkKIWBolPovhdJxor.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\atuaxvylbv5xt\\_m62m4\\ikkiwbolpovhdjxor.mp3.boom")) returned 1
	[0138.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0138.528] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\1mvtuQBNXUtVf-tOd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\1mvtuqbnxutvf-tod.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\1mvtuQBNXUtVf-tOd.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\1mvtuqbnxutvf-tod.mp3.boom")) returned 1
	[0138.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\IYbW-Ck.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\iybw-ck.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\IYbW-Ck.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\iybw-ck.mp3.boom")) returned 1
	[0138.563] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\nyUQNLgG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\nyuqnlgg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\nyUQNLgG.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\nyuqnlgg.wav.boom")) returned 1
	[0138.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\yyfu-TPXvk4w.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\yyfu-tpxvk4w.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\aYzKtDe_KIo\\yyfu-TPXvk4w.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ayzktde_kio\\yyfu-tpxvk4w.wav.boom")) returned 1
	[0138.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0138.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\6dey00.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\6dey00.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\6dey00.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\6dey00.mp3.boom")) returned 1
	[0138.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\a9vkg4IZPhR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\a9vkg4izphr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\a9vkg4IZPhR.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\a9vkg4izphr.wav.boom")) returned 1
	[0138.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\qkVRTFUJsTdv.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\qkvrtfujstdv.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\qkVRTFUJsTdv.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\qkvrtfujstdv.wav.boom")) returned 1
	[0138.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\SH2E8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\sh2e8.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Im6PWCui6pvna-G\\SH2E8.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\im6pwcui6pvna-g\\sh2e8.wav.boom")) returned 1
	[0138.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0138.752] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\1ttGIMxxmUfd-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\1ttgimxxmufd-.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\1ttGIMxxmUfd-.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\1ttgimxxmufd-.wav.boom")) returned 1
	[0138.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\dF0Z.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\df0z.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\dF0Z.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\df0z.wav.boom")) returned 1
	[0138.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\i5x1GR_F DeP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\i5x1gr_f dep.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\i5x1GR_F DeP.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\i5x1gr_f dep.mp3.boom")) returned 1
	[0138.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\izwFiWy821O1pmFyVCV.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\izwfiwy821o1pmfyvcv.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\izwFiWy821O1pmFyVCV.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\izwfiwy821o1pmfyvcv.wav.boom")) returned 1
	[0138.795] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\MZ1EVA6Kb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\mz1eva6kb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\MZ1EVA6Kb.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\mz1eva6kb.wav.boom")) returned 1
	[0138.799] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\vXzHLTcYAMoaYh4b.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\vxzhltcyamoayh4b.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\KOC5LghJ\\vXzHLTcYAMoaYh4b.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\koc5lghj\\vxzhltcyamoayh4b.wav.boom")) returned 1
	[0138.800] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kUweFY9pTvx\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0138.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kUweFY9pTvx\\1IlUwFBSyVr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kuwefy9ptvx\\1iluwfbsyvr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kUweFY9pTvx\\1IlUwFBSyVr.wav.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kuwefy9ptvx\\1iluwfbsyvr.wav.boom")) returned 1
	[0138.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kUweFY9pTvx\\QXv8TPQPahzXZElLq.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kuwefy9ptvx\\qxv8tpqpahzxzellq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kUweFY9pTvx\\QXv8TPQPahzXZElLq.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kuwefy9ptvx\\qxv8tpqpahzxzellq.mp3.boom")) returned 1
	[0138.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rcH2kFc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0138.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rcH2kFc\\mDBCAFfKtSCO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rch2kfc\\mdbcaffktsco.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rcH2kFc\\mDBCAFfKtSCO.mp3.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rch2kfc\\mdbcaffktsco.mp3.boom")) returned 1
	[0138.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0138.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0138.868] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.314] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4dpdquHsHnnxXa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4dpdquhshnnxxa.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4dpdquHsHnnxXa.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4dpdquhshnnxxa.jpg.boom")) returned 1
	[0139.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5Qr 7tsn7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5qr 7tsn7.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5Qr 7tsn7.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5qr 7tsn7.bmp.boom")) returned 1
	[0139.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\1PhbmiQrN83g 0 t--.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\1phbmiqrn83g 0 t--.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\1PhbmiQrN83g 0 t--.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\1phbmiqrn83g 0 t--.bmp.boom")) returned 1
	[0139.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\84MzQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\84mzq.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\84MzQ.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\84mzq.gif.boom")) returned 1
	[0139.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\9AM 8nHz5l06wBaM0K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\9am 8nhz5l06wbam0k.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\9AM 8nHz5l06wBaM0K.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\9am 8nhz5l06wbam0k.jpg.boom")) returned 1
	[0139.346] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\Bw83 LE1gqWw3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\bw83 le1gqww3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\Bw83 LE1gqWw3.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\bw83 le1gqww3.jpg.boom")) returned 1
	[0139.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\CfC7DxZgTT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\cfc7dxzgtt.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\CfC7DxZgTT.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\cfc7dxzgtt.jpg.boom")) returned 1
	[0139.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\XTiYzN5h.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\xtiyzn5h.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\bUgKX\\XTiYzN5h.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\bugkx\\xtiyzn5h.jpg.boom")) returned 1
	[0139.360] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\egVl1hIGc3Rff8.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\egvl1higc3rff8.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\egVl1hIGc3Rff8.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\egvl1higc3rff8.jpg.boom")) returned 1
	[0139.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\KMrmQB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\kmrmqb.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\KMrmQB.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\kmrmqb.png.boom")) returned 1
	[0139.377] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\OeLpAH6JpmM BdUuMp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\oelpah6jpmm bduump.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\OeLpAH6JpmM BdUuMp.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\oelpah6jpmm bduump.jpg.boom")) returned 1
	[0139.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\VOdb3e.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\vodb3e.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\CT5se03ue\\VOdb3e.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ct5se03ue\\vodb3e.png.boom")) returned 1
	[0139.386] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\e3l6kpa9.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\e3l6kpa9.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\e3l6kpa9.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\e3l6kpa9.bmp.boom")) returned 1
	[0139.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\iFjhgK0tQwRZp N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ifjhgk0tqwrzp n.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\iFjhgK0tQwRZp N.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\ifjhgk0tqwrzp n.png.boom")) returned 1
	[0139.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\OqTEBYaHC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\oqtebyahc.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\OqTEBYaHC.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\oqtebyahc.gif.boom")) returned 1
	[0139.397] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\P_v180yBadVUXZIL.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\p_v180ybadvuxzil.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\P_v180yBadVUXZIL.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\p_v180ybadvuxzil.png.boom")) returned 1
	[0139.401] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\WvvV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\wvvv.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\0BTPHl\\WvvV.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\0btphl\\wvvv.jpg.boom")) returned 1
	[0139.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.408] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\EmGsYUI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\emgsyui.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\EmGsYUI.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\emgsyui.jpg.boom")) returned 1
	[0139.411] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\h c0z.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\h c0z.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\h c0z.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\h c0z.bmp.boom")) returned 1
	[0139.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\NKcqj.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\nkcqj.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\NKcqj.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\nkcqj.bmp.boom")) returned 1
	[0139.419] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\OzmppfCkq8qNZQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\ozmppfckq8qnzq.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\I5qCTpwqMyyVpbiX1pZ\\OzmppfCkq8qNZQ.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\i5qctpwqmyyvpbix1pz\\ozmppfckq8qnzq.jpg.boom")) returned 1
	[0139.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\11Il.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\11il.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\11Il.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\11il.gif.boom")) returned 1
	[0139.430] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\7a r_tyaYecpZD e4hbm.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\7a r_tyayecpzd e4hbm.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\7a r_tyaYecpZD e4hbm.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\7a r_tyayecpzd e4hbm.bmp.boom")) returned 1
	[0139.435] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\7aR6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\7ar6.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\7aR6.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\7ar6.png.boom")) returned 1
	[0139.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\7ua_mAdLEjttr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\7ua_madlejttr.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\7ua_mAdLEjttr.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\7ua_madlejttr.gif.boom")) returned 1
	[0139.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\89UnSNsl7lx7Xh rx9mX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\89unsnsl7lx7xh rx9mx.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\89UnSNsl7lx7Xh rx9mX.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\89unsnsl7lx7xh rx9mx.gif.boom")) returned 1
	[0139.451] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\H26En6hb.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\h26en6hb.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\H26En6hb.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\h26en6hb.bmp.boom")) returned 1
	[0139.456] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\kHtB0Fgm-nxd.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\khtb0fgm-nxd.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\kHtB0Fgm-nxd.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\khtb0fgm-nxd.jpg.boom")) returned 1
	[0139.462] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\rweUvu 6akFQB8n.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\rweuvu 6akfqb8n.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\rweUvu 6akFQB8n.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\rweuvu 6akfqb8n.gif.boom")) returned 1
	[0139.474] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\_XE-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\_xe-.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\Ns29br73Dds7trMssbr7\\_XE-.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\ns29br73dds7trmssbr7\\_xe-.png.boom")) returned 1
	[0139.479] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\QkkO_Gpi6W.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\qkko_gpi6w.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\QkkO_Gpi6W.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\qkko_gpi6w.bmp.boom")) returned 1
	[0139.484] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\TW0CWfW.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\tw0cwfw.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\TW0CWfW.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\tw0cwfw.png.boom")) returned 1
	[0139.489] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\UPb9Tk1qBEqhMHDd.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\upb9tk1qbeqhmhdd.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\UPb9Tk1qBEqhMHDd.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\upb9tk1qbeqhmhdd.jpg.boom")) returned 1
	[0139.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\v7zY7eX9g1FX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\v7zy7ex9g1fx.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\pq27\\v7zY7eX9g1FX.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\pq27\\v7zy7ex9g1fx.bmp.boom")) returned 1
	[0139.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\TeZVy9t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\tezvy9t.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\TeZVy9t.jpg.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\tezvy9t.jpg.boom")) returned 1
	[0139.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\y_b2Ug-8p.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\y_b2ug-8p.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ad9lanfBNY\\y_b2Ug-8p.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ad9lanfbny\\y_b2ug-8p.png.boom")) returned 1
	[0139.511] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\bcObt8xsLw-.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcobt8xslw-.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\bcObt8xsLw-.bmp.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcobt8xslw-.bmp.boom")) returned 1
	[0139.516] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\g3K0z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\g3k0z.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\g3K0z.png.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\g3k0z.png.boom")) returned 1
	[0139.521] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MeqQdyc2i4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\meqqdyc2i4.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MeqQdyc2i4.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\meqqdyc2i4.gif.boom")) returned 1
	[0139.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Op4o1ePoI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\op4o1epoi.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Op4o1ePoI.gif.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\op4o1epoi.gif.boom")) returned 1
	[0139.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.535] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-SrRzOOplH54w.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-srrzooplh54w.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-SrRzOOplH54w.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-srrzooplh54w.mkv.boom")) returned 1
	[0139.539] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AxfMUzA2mA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\axfmuza2ma.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AxfMUzA2mA.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\axfmuza2ma.avi.boom")) returned 1
	[0139.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.550] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\hOyWPj5qxxL3c.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\hoywpj5qxxl3c.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\hOyWPj5qxxL3c.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\hoywpj5qxxl3c.mkv.boom")) returned 1
	[0139.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\gDZzGKrt7gLtvkiE4AV3\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.560] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\gDZzGKrt7gLtvkiE4AV3\\3bjQ0sUbT bDU_7aMpbm.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\gdzzgkrt7gltvkie4av3\\3bjq0subt bdu_7ampbm.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\gDZzGKrt7gLtvkiE4AV3\\3bjQ0sUbT bDU_7aMpbm.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\gdzzgkrt7gltvkie4av3\\3bjq0subt bdu_7ampbm.mp4.boom")) returned 1
	[0139.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\gDZzGKrt7gLtvkiE4AV3\\bFpoR1I.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\gdzzgkrt7gltvkie4av3\\bfpor1i.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\gDZzGKrt7gLtvkiE4AV3\\bFpoR1I.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\gdzzgkrt7gltvkie4av3\\bfpor1i.avi.boom")) returned 1
	[0139.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\QRmbYhJQRYz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\qrmbyhjqryz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\QRmbYhJQRYz.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\qrmbyhjqryz.avi.boom")) returned 1
	[0139.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\VRBq4o_sR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\vrbq4o_sr.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\cufsUc\\yNtELS6cQeXqo\\VRBq4o_sR.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\cufsuc\\yntels6cqexqo\\vrbq4o_sr.avi.boom")) returned 1
	[0139.577] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\JMhEVGU2kDhb0ai.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\jmhevgu2kdhb0ai.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\JMhEVGU2kDhb0ai.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\jmhevgu2kdhb0ai.flv.boom")) returned 1
	[0139.583] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\md9JsP4 b55T.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\md9jsp4 b55t.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\md9JsP4 b55T.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\md9jsp4 b55t.mp4.boom")) returned 1
	[0139.588] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\qOxPhEp7aZIQGU2NC0.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\qoxphep7aziqgu2nc0.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\qOxPhEp7aZIQGU2NC0.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\qoxphep7aziqgu2nc0.mkv.boom")) returned 1
	[0139.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\TflVLqNAw9.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\tflvlqnaw9.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\TflVLqNAw9.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\tflvlqnaw9.avi.boom")) returned 1
	[0139.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\-vbfog8rBRXlmPLKlV1.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\-vbfog8rbrxlmplklv1.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\-vbfog8rBRXlmPLKlV1.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\-vbfog8rbrxlmplklv1.flv.boom")) returned 1
	[0139.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\bT6lJWrjq6KennBJ-.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\bt6ljwrjq6kennbj-.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\bT6lJWrjq6KennBJ-.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\bt6ljwrjq6kennbj-.mp4.boom")) returned 1
	[0139.605] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\EX0HrR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\ex0hrr.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\EX0HrR.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\ex0hrr.mkv.boom")) returned 1
	[0139.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\RCOjYFMjfcj6M4oKCA.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\rcojyfmjfcj6m4okca.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\RCOjYFMjfcj6M4oKCA.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\rcojyfmjfcj6m4okca.mkv.boom")) returned 1
	[0139.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.617] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\AEk11fWW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\aek11fww.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\AEk11fWW.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\aek11fww.mkv.boom")) returned 1
	[0139.621] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\D0rP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\d0rp.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\D0rP.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\d0rp.mkv.boom")) returned 1
	[0139.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\enYYiTQ1Hduh8v\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0139.628] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\enYYiTQ1Hduh8v\\-8F4eYP9.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\enyyitq1hduh8v\\-8f4eyp9.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\enYYiTQ1Hduh8v\\-8F4eYP9.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\enyyitq1hduh8v\\-8f4eyp9.avi.boom")) returned 1
	[0139.633] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\enYYiTQ1Hduh8v\\-rnxG8aDq6LI9EWT_nS8.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\enyyitq1hduh8v\\-rnxg8adq6li9ewt_ns8.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\enYYiTQ1Hduh8v\\-rnxG8aDq6LI9EWT_nS8.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\enyyitq1hduh8v\\-rnxg8adq6li9ewt_ns8.mkv.boom")) returned 1
	[0139.638] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\enYYiTQ1Hduh8v\\nuEkoymIO5sRH QGE1i.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\enyyitq1hduh8v\\nuekoymio5srh qge1i.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\enYYiTQ1Hduh8v\\nuEkoymIO5sRH QGE1i.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\enyyitq1hduh8v\\nuekoymio5srh qge1i.flv.boom")) returned 1
	[0139.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\ghEdJF4trYd.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\ghedjf4tryd.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\ghEdJF4trYd.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\ghedjf4tryd.flv.boom")) returned 1
	[0139.653] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\KnkY.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\knky.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\KnkY.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\knky.mkv.boom")) returned 1
	[0139.658] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\yF1hfF8y1qYGzY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\yf1hff8y1qygzy.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\X2eWOqU\\hdzTMVjRqe2MA5P\\Ffdf8BTH\\yF1hfF8y1qYGzY.mp4.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\x2ewoqu\\hdztmvjrqe2ma5p\\ffdf8bth\\yf1hff8y1qygzy.mp4.boom")) returned 1
	[0139.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\xuzgQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\xuzgq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ckk94ALA02Y2AP5nq\\Zi_fP\\xuzgQ.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ckk94ala02y2ap5nq\\zi_fp\\xuzgq.flv.boom")) returned 1
	[0139.666] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HwQWBE5TK2g2EuXM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hwqwbe5tk2g2euxm.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HwQWBE5TK2g2EuXM.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hwqwbe5tk2g2euxm.avi.boom")) returned 1
	[0139.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PbUkMl5.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pbukml5.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PbUkMl5.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pbukml5.flv.boom")) returned 1
	[0139.671] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNbea\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNbea\\DEEV.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnbea\\deev.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNbea\\DEEV.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnbea\\deev.flv.boom")) returned 1
	[0139.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNbea\\mOOHiUw7q.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnbea\\moohiuw7q.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNbea\\mOOHiUw7q.avi.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnbea\\moohiuw7q.avi.boom")) returned 1
	[0139.685] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNbea\\NaGdLq9z.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnbea\\nagdlq9z.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNbea\\NaGdLq9z.mkv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnbea\\nagdlq9z.mkv.boom")) returned 1
	[0139.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UnDyFnKZiU_aR J4.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\undyfnkziu_ar j4.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UnDyFnKZiU_aR J4.flv.Boom" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\undyfnkziu_ar j4.flv.boom")) returned 1
	[0139.690] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0139.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.693] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.693] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.700] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.700] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.701] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.701] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.702] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.702] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.702] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.703] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.703] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.703] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.705] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.705] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.708] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.711] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.713] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.713] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.714] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.714] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.714] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.714] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.715] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.715] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.715] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.717] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0139.717] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.717] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0139.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0139.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8) returned 0x8b8068
	[0139.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0139.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118) returned 0x8b8028
	[0139.720] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.720] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.721] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.724] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.724] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.725] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.725] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.726] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.726] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.727] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.727] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.728] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.729] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.729] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.730] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.730] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.730] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.730] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.731] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.732] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.733] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.733] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.734] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.735] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.735] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.736] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.736] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.737] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.738] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.738] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.739] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.739] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.747] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.747] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.747] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.748] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.748] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.748] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.749] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.749] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.751] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.752] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.752] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.752] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7ea8
	[0139.752] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.753] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.753] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.753] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.754] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.756] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.756] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.756] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.759] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.759] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.759] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.760] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.760] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.760] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.761] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.761] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.761] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.761] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.762] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.762] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.762] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.764] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.764] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.764] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.765] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.765] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.765] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.766] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.766] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.766] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.767] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.767] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.768] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.768] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7de8
	[0139.768] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.769] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.769] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.769] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0139.770] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0139.770] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.770] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0xffffffff
	[0139.771] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98) returned 0x8b7e68
	[0139.775] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48) returned 0x8b7de8
	[0139.775] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8) returned 0x8b7ea8
	[0139.778] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0xffffffff
	[0139.779] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0xffffffff
	[0139.781] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8) returned 0x8b7ee8
	[0139.783] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.784] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.787] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.791] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.791] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.793] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.795] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.797] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.800] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.802] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.813] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.827] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.boom")) returned 1
	[0139.834] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.839] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.839] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.840] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268) returned 0x8b7fe8
	[0139.843] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658) returned 0x8b7f28
	[0139.844] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.844] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0139.846] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.846] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.849] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.849] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508) returned 0x8b7f68
	[0139.851] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8) returned 0x8b7fa8
	[0140.245] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.boom")) returned 1
	[0140.276] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.boom")) returned 1
	[0140.278] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.boom")) returned 1
	[0140.299] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.boom")) returned 1
	[0140.302] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.boom")) returned 1
	[0140.315] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.boom")) returned 1
	[0140.318] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.boom")) returned 1
	[0140.323] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.boom")) returned 1
	[0140.326] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.boom")) returned 1
	[0140.353] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.boom")) returned 1
	[0140.356] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.boom")) returned 1
	[0140.373] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.boom")) returned 1
	[0140.415] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.boom")) returned 1
	[0140.458] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.boom")) returned 1
	[0140.461] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.boom")) returned 1
	[0140.472] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.boom")) returned 1
	[0140.475] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.boom")) returned 1
	[0140.485] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.boom")) returned 1
	[0140.489] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.boom")) returned 1
	[0140.495] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.boom")) returned 1
	[0141.044] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.boom")) returned 1
	[0141.165] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.boom")) returned 1
	[0141.212] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.boom")) returned 1
	[0141.340] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.boom")) returned 1
	[0141.344] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.boom")) returned 1
	[0141.673] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.boom")) returned 1
	[0141.782] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.boom")) returned 1
	[0141.786] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.boom")) returned 1
	[0141.789] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.boom")) returned 1
	[0141.794] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.boom")) returned 1
	[0141.799] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.boom")) returned 1
	[0141.804] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.boom")) returned 1
	[0141.807] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.boom")) returned 1
	[0141.858] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.boom")) returned 1
	[0142.089] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.boom")) returned 1
	[0142.147] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.boom")) returned 1
	[0142.215] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.boom")) returned 1
	[0142.219] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.boom")) returned 1
	[0142.230] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.boom")) returned 1
	[0142.233] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.boom")) returned 1
	[0142.236] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.boom")) returned 1
	[0142.320] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.Boom" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.boom")) returned 1
	[0142.374] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Desktop.lnk.Boom" (normalized: "c:\\users\\default\\links\\desktop.lnk.boom")) returned 1
	[0142.393] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Downloads.lnk.Boom" (normalized: "c:\\users\\default\\links\\downloads.lnk.boom")) returned 1
	[0142.396] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.Boom" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.boom")) returned 1
	[0142.411] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.Boom" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.boom")) returned 1
	[0142.413] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.Boom" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.boom")) returned 1
	[0142.418] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.Boom" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.boom")) returned 1
	[0142.484] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.Boom" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.boom")) returned 1
	[0142.587] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.Boom" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.boom")) returned 1
	[0142.697] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.Boom" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.boom")) returned 1
	[0142.715] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.boom")) returned 1
	[0142.728] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.boom")) returned 1
	[0142.742] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.boom")) returned 1
	[0142.756] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.boom")) returned 1
	[0142.772] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.boom")) returned 1
	[0142.794] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.boom")) returned 1
	[0142.805] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.boom")) returned 1
	[0142.825] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.Boom" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.boom")) returned 1
	[0143.080] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.Boom" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.boom")) returned 1
	[0148.144] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ComSvcConfig\\5f1a06c0108b2c81cde1dc491d74043d\\ComSvcConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\comsvcconfig\\5f1a06c0108b2c81cde1dc491d74043d\\comsvcconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ComSvcConfig\\5f1a06c0108b2c81cde1dc491d74043d\\ComSvcConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\comsvcconfig\\5f1a06c0108b2c81cde1dc491d74043d\\comsvcconfig.ni.exe.boom")) returned 1
	[0148.362] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\dfsvc\\2c3e7fda8de40e45e7f5e004094dc7c9\\dfsvc.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\dfsvc\\2c3e7fda8de40e45e7f5e004094dc7c9\\dfsvc.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\dfsvc\\2c3e7fda8de40e45e7f5e004094dc7c9\\dfsvc.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\dfsvc\\2c3e7fda8de40e45e7f5e004094dc7c9\\dfsvc.ni.exe.boom")) returned 1
	[0148.453] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehExtHost32\\c899de3549784161aa66610d5735e4f0\\ehExtHost32.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\ehexthost32\\c899de3549784161aa66610d5735e4f0\\ehexthost32.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehExtHost32\\c899de3549784161aa66610d5735e4f0\\ehExtHost32.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\ehexthost32\\c899de3549784161aa66610d5735e4f0\\ehexthost32.ni.exe.boom")) returned 1
	[0149.095] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\msbuild\\af28543d9b3e7d9f110448ecce53cd72\\msbuild.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\msbuild\\af28543d9b3e7d9f110448ecce53cd72\\msbuild.ni.exe.boom")) returned 1
	[0149.355] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\narrator\\0bae62c3fc6c327ed24989263988173d\\narrator.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\narrator\\0bae62c3fc6c327ed24989263988173d\\narrator.ni.exe.boom")) returned 1
	[0149.379] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationfontcac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\presentationfontcache.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationfontcac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\presentationfontcache.ni.exe.boom")) returned 1
	[0149.416] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\smsvchost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\smsvchost.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\smsvchost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\smsvchost.ni.exe.boom")) returned 1
	[0149.654] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\WsatConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\wsatconfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\wsatconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\WsatConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\wsatconfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\wsatconfig.ni.exe.boom")) returned 1
	[0149.686] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\ComSvcConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\comsvcconfig\\d632b7434f821829827657e23ac98589\\comsvcconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\ComSvcConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\comsvcconfig\\d632b7434f821829827657e23ac98589\\comsvcconfig.ni.exe.boom")) returned 1
	[0149.720] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\dfsvc.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\dfsvc.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\dfsvc.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\dfsvc.ni.exe.boom")) returned 1
	[0149.749] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\ehExtHost.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehexthost\\ad37b6e3a1cb1081592f1c5797ae9dad\\ehexthost.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\ehExtHost.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehexthost\\ad37b6e3a1cb1081592f1c5797ae9dad\\ehexthost.ni.exe.boom")) returned 1
	[0150.100] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\LoadMxf.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\loadmxf\\d09b54cd68bc772b3be3832926e940d4\\loadmxf.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\LoadMxf.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\loadmxf\\d09b54cd68bc772b3be3832926e940d4\\loadmxf.ni.exe.boom")) returned 1
	[0150.163] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\mcupdate.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\mcupdate.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\mcupdate.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\mcupdate.ni.exe.boom")) returned 1
	[0152.983] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\msbuild\\1a154709cdfe214029ea88c51ab2b579\\msbuild.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\msbuild\\1a154709cdfe214029ea88c51ab2b579\\msbuild.ni.exe.boom")) returned 1
	[0153.075] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\narrator\\4cc02fad33053737088d4c18267ca0a0\\narrator.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\narrator\\4cc02fad33053737088d4c18267ca0a0\\narrator.ni.exe.boom")) returned 1
	[0153.128] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationfontcac#\\0246845f487e5f33d3564eff578665a3\\presentationfontcache.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationfontcac#\\0246845f487e5f33d3564eff578665a3\\presentationfontcache.ni.exe.boom")) returned 1
	[0153.213] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\smsvchost\\04d794428d635f6a82ac57dd3d6f3628\\smsvchost.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\smsvchost\\04d794428d635f6a82ac57dd3d6f3628\\smsvchost.ni.exe.boom")) returned 1
	[0154.429] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\WsatConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\wsatconfig\\36ca2928b2191011831ab673861c6ac6\\wsatconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\WsatConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\wsatconfig\\36ca2928b2191011831ab673861c6ac6\\wsatconfig.ni.exe.boom")) returned 1
	[0154.517] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ComSvcConfig\\0441adebf5f6cc0d82652240a999db0c\\ComSvcConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\comsvcconfig\\0441adebf5f6cc0d82652240a999db0c\\comsvcconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ComSvcConfig\\0441adebf5f6cc0d82652240a999db0c\\ComSvcConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\comsvcconfig\\0441adebf5f6cc0d82652240a999db0c\\comsvcconfig.ni.exe.boom")) returned 1
	[0154.613] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\dfsvc\\c9beed205edb46e7045f1d71a10a0e3e\\dfsvc.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\dfsvc\\c9beed205edb46e7045f1d71a10a0e3e\\dfsvc.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\dfsvc\\c9beed205edb46e7045f1d71a10a0e3e\\dfsvc.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\dfsvc\\c9beed205edb46e7045f1d71a10a0e3e\\dfsvc.ni.exe.boom")) returned 1
	[0157.270] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.W71daf281#\\75db5140d703c2ba2c0d6c42d7143432\\Microsoft.Workflow.Compiler.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.w71daf281#\\75db5140d703c2ba2c0d6c42d7143432\\microsoft.workflow.compiler.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.W71daf281#\\75db5140d703c2ba2c0d6c42d7143432\\Microsoft.Workflow.Compiler.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.w71daf281#\\75db5140d703c2ba2c0d6c42d7143432\\microsoft.workflow.compiler.ni.exe.boom")) returned 1
	[0157.335] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\MSBuild\\e8dca170b34839f04acc1ffb1f703533\\MSBuild.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\msbuild\\e8dca170b34839f04acc1ffb1f703533\\msbuild.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\MSBuild\\e8dca170b34839f04acc1ffb1f703533\\MSBuild.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\msbuild\\e8dca170b34839f04acc1ffb1f703533\\msbuild.ni.exe.boom")) returned 1
	[0157.884] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMSvcHost\\4f305ba7b576bf553ec8e00b07e9604c\\SMSvcHost.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\smsvchost\\4f305ba7b576bf553ec8e00b07e9604c\\smsvchost.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMSvcHost\\4f305ba7b576bf553ec8e00b07e9604c\\SMSvcHost.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\smsvchost\\4f305ba7b576bf553ec8e00b07e9604c\\smsvchost.ni.exe.boom")) returned 1
	[0160.337] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WsatConfig\\4406e6261e7a1abc4a5273ac6d7160d1\\WsatConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\wsatconfig\\4406e6261e7a1abc4a5273ac6d7160d1\\wsatconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WsatConfig\\4406e6261e7a1abc4a5273ac6d7160d1\\WsatConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\wsatconfig\\4406e6261e7a1abc4a5273ac6d7160d1\\wsatconfig.ni.exe.boom")) returned 1
	[0160.379] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\ComSvcConfig\\0d4368112ebc32fed4136faafd2ee26b\\ComSvcConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\comsvcconfig\\0d4368112ebc32fed4136faafd2ee26b\\comsvcconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\ComSvcConfig\\0d4368112ebc32fed4136faafd2ee26b\\ComSvcConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\comsvcconfig\\0d4368112ebc32fed4136faafd2ee26b\\comsvcconfig.ni.exe.boom")) returned 1
	[0160.592] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\dfsvc\\0fd9fa3a9fc57cda0ed39f2095fdc4f2\\dfsvc.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\dfsvc\\0fd9fa3a9fc57cda0ed39f2095fdc4f2\\dfsvc.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\dfsvc\\0fd9fa3a9fc57cda0ed39f2095fdc4f2\\dfsvc.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\dfsvc\\0fd9fa3a9fc57cda0ed39f2095fdc4f2\\dfsvc.ni.exe.boom")) returned 1
	[0162.797] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W71daf281#\\18e1dbb4d094e45ddd251eafa3743d9e\\Microsoft.Workflow.Compiler.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w71daf281#\\18e1dbb4d094e45ddd251eafa3743d9e\\microsoft.workflow.compiler.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W71daf281#\\18e1dbb4d094e45ddd251eafa3743d9e\\Microsoft.Workflow.Compiler.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.w71daf281#\\18e1dbb4d094e45ddd251eafa3743d9e\\microsoft.workflow.compiler.ni.exe.boom")) returned 1
	[0162.855] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MSBuild\\429eaf12731314ca0cab92f0da677daf\\MSBuild.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\msbuild\\429eaf12731314ca0cab92f0da677daf\\msbuild.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MSBuild\\429eaf12731314ca0cab92f0da677daf\\MSBuild.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\msbuild\\429eaf12731314ca0cab92f0da677daf\\msbuild.ni.exe.boom")) returned 1
	[0163.148] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMSvcHost\\bb73e15ff00f3c7246e3a560277d09b1\\SMSvcHost.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\smsvchost\\bb73e15ff00f3c7246e3a560277d09b1\\smsvchost.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMSvcHost\\bb73e15ff00f3c7246e3a560277d09b1\\SMSvcHost.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\smsvchost\\bb73e15ff00f3c7246e3a560277d09b1\\smsvchost.ni.exe.boom")) returned 1
	[0166.068] MoveFileA (lpExistingFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\wsatconfig\\93576f0aca370337022c4e4d07012e94\\wsatconfig.ni.exe"), lpNewFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.Boom" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\wsatconfig\\93576f0aca370337022c4e4d07012e94\\wsatconfig.ni.exe.boom")) returned 1
	[0176.676] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Workflow.Compiler\\v4.0_4.0.0.0__31bf3856ad364e35\\Microsoft.Workflow.Compiler.exe" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.workflow.compiler\\v4.0_4.0.0.0__31bf3856ad364e35\\microsoft.workflow.compiler.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Workflow.Compiler\\v4.0_4.0.0.0__31bf3856ad364e35\\Microsoft.Workflow.Compiler.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.workflow.compiler\\v4.0_4.0.0.0__31bf3856ad364e35\\microsoft.workflow.compiler.exe.boom")) returned 1
	[0179.322] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\addinprocess.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\addinprocess.exe.boom")) returned 1
	[0179.353] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\addinprocess32.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\addinprocess32.exe.boom")) returned 1
	[0179.437] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\addinutil.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\addinutil.exe.boom")) returned 1
	[0179.453] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe.boom")) returned 1
	[0180.115] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.boom")) returned 1
	[0180.121] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.boom")) returned 1
	[0180.126] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.boom")) returned 1
	[0180.183] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.boom")) returned 1
	[0180.203] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.boom")) returned 1
	[0180.206] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.boom")) returned 1
	[0180.236] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.boom")) returned 1
	[0180.239] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.boom")) returned 1
	[0180.242] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.boom")) returned 1
	[0180.245] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.boom")) returned 1
	[0180.275] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.boom")) returned 1
	[0180.357] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.boom")) returned 1
	[0180.360] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.boom")) returned 1
	[0180.364] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.boom")) returned 1
	[0180.396] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.boom")) returned 1
	[0180.399] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.boom")) returned 1
	[0180.405] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.boom")) returned 1
	[0180.411] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.boom")) returned 1
	[0180.415] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.boom")) returned 1
	[0180.536] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.boom")) returned 1
	[0180.543] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.boom")) returned 1
	[0180.546] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.boom")) returned 1
	[0180.570] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.boom")) returned 1
	[0182.193] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe.boom")) returned 1
	[0182.212] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regbrowsers.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_regbrowsers.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regbrowsers.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_regbrowsers.exe.boom")) returned 1
	[0182.234] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regiis.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_regiis.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regiis.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_regiis.exe.boom")) returned 1
	[0182.301] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regsql.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_regsql.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regsql.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_regsql.exe.boom")) returned 1
	[0182.313] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_state.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_state.exe.boom")) returned 1
	[0182.361] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_wp.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_wp.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_wp.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_wp.exe.boom")) returned 1
	[0182.402] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CasPol.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\caspol.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CasPol.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\caspol.exe.boom")) returned 1
	[0182.438] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ComSvcConfig.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\comsvcconfig.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ComSvcConfig.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\comsvcconfig.exe.boom")) returned 1
	[0182.546] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\csc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\csc.exe.boom")) returned 1
	[0182.563] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\cvtres.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\cvtres.exe.boom")) returned 1
	[0182.623] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\datasvcutil.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\datasvcutil.exe.boom")) returned 1
	[0182.649] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\dfsvc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\dfsvc.exe.boom")) returned 1
	[0182.791] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EdmGen.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\edmgen.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EdmGen.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\edmgen.exe.boom")) returned 1
	[0182.871] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\ilasm.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\ilasm.exe.boom")) returned 1
	[0182.917] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installutil.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installutil.exe.boom")) returned 1
	[0182.935] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\jsc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\jsc.exe.boom")) returned 1
	[0182.976] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Workflow.Compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\microsoft.workflow.compiler.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Workflow.Compiler.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\microsoft.workflow.compiler.exe.boom")) returned 1
	[0183.184] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.boom")) returned 1
	[0183.248] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe.boom")) returned 1
	[0183.316] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\ngen.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\ngen.exe.boom")) returned 1
	[0183.392] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe.boom")) returned 1
	[0183.455] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regsvcs.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regsvcs.exe.boom")) returned 1
	[0183.486] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regtlibv12.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regtlibv12.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regtlibv12.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regtlibv12.exe.boom")) returned 1
	[0183.498] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelReg.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\servicemodelreg.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelReg.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\servicemodelreg.exe.boom")) returned 1
	[0183.548] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\smsvchost.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SMSvcHost.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\smsvchost.exe.boom")) returned 1
	[0184.418] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt.boom")) returned 1
	[0184.512] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\vbc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\vbc.exe.boom")) returned 1
	[0184.558] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WsatConfig.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wsatconfig.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WsatConfig.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wsatconfig.exe.boom")) returned 1
	[0184.604] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.boom")) returned 1
	[0184.609] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif.boom")) returned 1
	[0184.612] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.boom")) returned 1
	[0184.616] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.boom")) returned 1
	[0184.645] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.boom")) returned 1
	[0184.699] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.boom")) returned 1
	[0184.705] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.boom")) returned 1
	[0184.802] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.boom")) returned 1
	[0184.805] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.boom")) returned 1
	[0184.810] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.boom")) returned 1
	[0184.813] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.boom")) returned 1
	[0184.818] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.boom")) returned 1
	[0184.823] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.boom")) returned 1
	[0184.828] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.boom")) returned 1
	[0184.830] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.boom")) returned 1
	[0184.851] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.boom")) returned 1
	[0184.853] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.boom")) returned 1
	[0184.856] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.boom")) returned 1
	[0184.859] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.boom")) returned 1
	[0184.863] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.boom")) returned 1
	[0184.867] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.boom")) returned 1
	[0184.870] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.boom")) returned 1
	[0184.873] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.boom")) returned 1
	[0184.877] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.boom")) returned 1
	[0185.304] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInProcess.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\addinprocess.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInProcess.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\addinprocess.exe.boom")) returned 1
	[0185.342] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInProcess32.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\addinprocess32.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInProcess32.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\addinprocess32.exe.boom")) returned 1
	[0185.377] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInUtil.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\addinutil.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInUtil.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\addinutil.exe.boom")) returned 1
	[0185.407] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AppLaunch.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\applaunch.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AppLaunch.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\applaunch.exe.boom")) returned 1
	[0186.255] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.boom")) returned 1
	[0186.306] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.boom")) returned 1
	[0186.321] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.boom")) returned 1
	[0186.374] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.boom")) returned 1
	[0186.387] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.boom")) returned 1
	[0186.390] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.boom")) returned 1
	[0186.404] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.boom")) returned 1
	[0186.408] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.boom")) returned 1
	[0186.410] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.boom")) returned 1
	[0186.413] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.boom")) returned 1
	[0186.425] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.boom")) returned 1
	[0186.432] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.boom")) returned 1
	[0186.435] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.boom")) returned 1
	[0186.437] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.boom")) returned 1
	[0186.440] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.boom")) returned 1
	[0186.442] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.boom")) returned 1
	[0186.444] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.boom")) returned 1
	[0186.447] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.boom")) returned 1
	[0186.450] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.boom")) returned 1
	[0186.504] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.boom")) returned 1
	[0186.507] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.boom")) returned 1
	[0186.509] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.boom")) returned 1
	[0186.538] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.boom")) returned 1
	[0186.813] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_compiler.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_compiler.exe.boom")) returned 1
	[0186.896] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_regbrowsers.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_regbrowsers.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_regbrowsers.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_regbrowsers.exe.boom")) returned 1
	[0187.103] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_regiis.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_regiis.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_regiis.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_regiis.exe.boom")) returned 1
	[0187.154] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_regsql.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_regsql.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_regsql.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_regsql.exe.boom")) returned 1
	[0187.254] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_state.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_state.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_state.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_state.exe.boom")) returned 1
	[0187.410] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_wp.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_wp.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_wp.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\aspnet_wp.exe.boom")) returned 1
	[0187.483] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\CasPol.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\caspol.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\CasPol.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\caspol.exe.boom")) returned 1
	[0187.589] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ComSvcConfig.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\comsvcconfig.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ComSvcConfig.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\comsvcconfig.exe.boom")) returned 1
	[0187.789] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\csc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\csc.exe.boom")) returned 1
	[0187.821] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\cvtres.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\cvtres.exe.boom")) returned 1
	[0187.937] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\DataSvcUtil.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\datasvcutil.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\DataSvcUtil.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\datasvcutil.exe.boom")) returned 1
	[0187.941] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\dfsvc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\dfsvc.exe.boom")) returned 1
	[0187.960] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\EdmGen.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\edmgen.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\EdmGen.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\edmgen.exe.boom")) returned 1
	[0187.988] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ilasm.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\ilasm.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ilasm.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\ilasm.exe.boom")) returned 1
	[0188.143] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installutil.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installutil.exe.boom")) returned 1
	[0188.258] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\jsc.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\jsc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\jsc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\jsc.exe.boom")) returned 1
	[0188.437] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Microsoft.Workflow.Compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\microsoft.workflow.compiler.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Microsoft.Workflow.Compiler.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\microsoft.workflow.compiler.exe.boom")) returned 1
	[0188.459] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\msbuild.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\msbuild.exe.boom")) returned 1
	[0188.488] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorsvw.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorsvw.exe.boom")) returned 1
	[0188.501] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\ngen.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\ngen.exe.boom")) returned 1
	[0188.520] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\regasm.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegAsm.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\regasm.exe.boom")) returned 1
	[0188.541] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegSvcs.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\regsvcs.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegSvcs.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\regsvcs.exe.boom")) returned 1
	[0188.546] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\regtlibv12.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\regtlibv12.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\regtlibv12.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\regtlibv12.exe.boom")) returned 1
	[0188.564] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelReg.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelreg.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelReg.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelreg.exe.boom")) returned 1
	[0188.673] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html.boom")) returned 1
	[0188.708] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp.boom")) returned 1
	[0188.727] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\Setup.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\setup.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\Setup.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\setup.exe.boom")) returned 1
	[0188.750] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\SetupUtility.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\setuputility.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\SetupUtility.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\setuputility.exe.boom")) returned 1
	[0188.799] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp.boom")) returned 1
	[0188.806] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp.boom")) returned 1
	[0188.813] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SMSvcHost.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\smsvchost.exe.boom")) returned 1
	[0188.886] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\thirdpartynotices.txt"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ThirdPartyNotices.txt.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\thirdpartynotices.txt.boom")) returned 1
	[0188.957] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\vbc.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\vbc.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\vbc.exe.boom")) returned 1
	[0189.090] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WsatConfig.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\wsatconfig.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WsatConfig.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\wsatconfig.exe.boom")) returned 1
	[0189.109] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\NETFXRepair.exe" (normalized: "c:\\windows\\microsoft.net\\netfxrepair.exe"), lpNewFileName="C:\\Windows\\Microsoft.NET\\NETFXRepair.exe.Boom" (normalized: "c:\\windows\\microsoft.net\\netfxrepair.exe.boom")) returned 1
	[0189.502] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX" (normalized: "c:\\windows\\shellnew\\excel12.xlsx"), lpNewFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX.Boom" (normalized: "c:\\windows\\shellnew\\excel12.xlsx.boom")) returned 1
	[0189.539] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX" (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx"), lpNewFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX.Boom" (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx.boom")) returned 1
	[0189.751] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\catroot2\\dberr.txt" (normalized: "c:\\windows\\system32\\catroot2\\dberr.txt"), lpNewFileName="C:\\Windows\\System32\\catroot2\\dberr.txt.Boom" (normalized: "c:\\windows\\system32\\catroot2\\dberr.txt.boom")) returned 1
	[0192.401] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\FlashPlayerApp.exe" (normalized: "c:\\windows\\system32\\flashplayerapp.exe"), lpNewFileName="C:\\Windows\\System32\\FlashPlayerApp.exe.Boom" (normalized: "c:\\windows\\system32\\flashplayerapp.exe.boom")) returned 1
	[0192.547] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\java.exe" (normalized: "c:\\windows\\system32\\java.exe"), lpNewFileName="C:\\Windows\\System32\\java.exe.Boom" (normalized: "c:\\windows\\system32\\java.exe.boom")) returned 1
	[0192.581] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\javaw.exe" (normalized: "c:\\windows\\system32\\javaw.exe"), lpNewFileName="C:\\Windows\\System32\\javaw.exe.Boom" (normalized: "c:\\windows\\system32\\javaw.exe.boom")) returned 1
	[0192.611] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\javaws.exe" (normalized: "c:\\windows\\system32\\javaws.exe"), lpNewFileName="C:\\Windows\\System32\\javaws.exe.Boom" (normalized: "c:\\windows\\system32\\javaws.exe.boom")) returned 1
	[0192.662] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\Macromed\\Flash\\FlashPlayerUpdateService.exe" (normalized: "c:\\windows\\system32\\macromed\\flash\\flashplayerupdateservice.exe"), lpNewFileName="C:\\Windows\\System32\\Macromed\\Flash\\FlashPlayerUpdateService.exe.Boom" (normalized: "c:\\windows\\system32\\macromed\\flash\\flashplayerupdateservice.exe.boom")) returned 1
	[0192.701] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\Macromed\\Flash\\FlashUtil10zp_Plugin.exe" (normalized: "c:\\windows\\system32\\macromed\\flash\\flashutil10zp_plugin.exe"), lpNewFileName="C:\\Windows\\System32\\Macromed\\Flash\\FlashUtil10zp_Plugin.exe.Boom" (normalized: "c:\\windows\\system32\\macromed\\flash\\flashutil10zp_plugin.exe.boom")) returned 1
	[0192.720] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe" (normalized: "c:\\windows\\system32\\macromed\\flash\\flashutil32_11_2_202_233_activex.exe"), lpNewFileName="C:\\Windows\\System32\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe.Boom" (normalized: "c:\\windows\\system32\\macromed\\flash\\flashutil32_11_2_202_233_activex.exe.boom")) returned 1
	[0213.758] MoveFileA (lpExistingFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\\FreeCell.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\\freecell.exe"), lpNewFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\\FreeCell.exe.Boom" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\\freecell.exe.boom")) returned 0
	[0214.068] MoveFileA (lpExistingFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\\Hearts.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\\hearts.exe"), lpNewFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\\Hearts.exe.Boom" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\\hearts.exe.boom")) returned 0
	[0214.176] MoveFileA (lpExistingFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_dead260d8f002b73\\SpiderSolitaire.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_dead260d8f002b73\\spidersolitaire.exe"), lpNewFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_dead260d8f002b73\\SpiderSolitaire.exe.Boom" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_dead260d8f002b73\\spidersolitaire.exe.boom")) returned 0
	[0214.757] MoveFileA (lpExistingFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\\Solitaire.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\\solitaire.exe"), lpNewFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\\Solitaire.exe.Boom" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\\solitaire.exe.boom")) returned 0
	[0215.125] MoveFileA (lpExistingFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\\MineSweeper.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\\minesweeper.exe"), lpNewFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\\MineSweeper.exe.Boom" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\\minesweeper.exe.boom")) returned 0
	[0215.595] MoveFileA (lpExistingFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\\PurblePlace.exe" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\\purbleplace.exe"), lpNewFileName="C:\\Windows\\winsxs\\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\\PurblePlace.exe.Boom" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\\purbleplace.exe.boom")) returned 0
	[0247.753] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x405250, csidl=16, fCreate=1 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0247.769] MessageBoxA (hWnd=0x0, lpText="How to decrypt files\r\nGet your pin\r\nPut it in the virus\r\nIn order to extract the password to decrypt the files\r\nIn a folder on your desktop\r\nThen put it in a password in the small window that will show you\r\nFor pin\r\nTalk to me on Facebook\r\nMy name = Mohamed Naser Ahmed\r\nmy ID = 100027091457754", lpCaption=0x0, uType=0x10) 

Thread:
	id = 12
	os_tid = 0x690


Process:
	id = "3"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x149e6000"
	os_pid = "0x5e8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x474"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 473
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 474
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 475
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 476
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 477
	        start_va = 0x190000
	          end_va = 0x1cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 478
	        start_va = 0x240000
	          end_va = 0x33ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000240000"
	        filename = ""

Region:
	              id = 479
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 480
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 481
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 482
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 483
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 484
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 485
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 486
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 487
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 488
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 489
	        start_va = 0xf0000
	          end_va = 0x16ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 490
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 491
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 492
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 493
	        start_va = 0x3d0000
	          end_va = 0x4cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 494
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 495
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 496
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 497
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 498
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 499
	        start_va = 0x60000
	          end_va = 0xc6fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 500
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 501
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 502
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 503
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 504
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 505
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 506
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 507
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 508
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 509
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 510
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 511
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 512
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 513
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 514
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 515
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 516
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 517
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 518
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 519
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 520
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 521
	        start_va = 0x5d0000
	          end_va = 0x5dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 522
	        start_va = 0x5e0000
	          end_va = 0x767fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005e0000"
	        filename = ""

Region:
	              id = 523
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 524
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 525
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 526
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 527
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0xd0000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 528
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 529
	        start_va = 0x170000
	          end_va = 0x170fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 530
	        start_va = 0x770000
	          end_va = 0x8f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""

Region:
	              id = 531
	        start_va = 0x900000
	          end_va = 0xbcefff
	     entry_point = 0x900000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 532
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 533
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 534
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 535
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 536
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x180000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 537
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 538
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 539
	        start_va = 0x1e0000
	          end_va = 0x1e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 540
	        start_va = 0x1f0000
	          end_va = 0x1f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 541
	        start_va = 0x200000
	          end_va = 0x200fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000200000"
	        filename = ""

Region:
	              id = 542
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 543
	        start_va = 0x210000
	          end_va = 0x21ffff
	     entry_point = 0x210000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 544
	        start_va = 0x220000
	          end_va = 0x227fff
	     entry_point = 0x220000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 545
	        start_va = 0x340000
	          end_va = 0x353fff
	     entry_point = 0x340000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 546
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 547
	        start_va = 0xd70000
	          end_va = 0xe6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d70000"
	        filename = ""

Region:
	              id = 548
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 549
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 550
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 551
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 552
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 553
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 554
	        start_va = 0xbd0000
	          end_va = 0xccffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000bd0000"
	        filename = ""

Region:
	              id = 555
	        start_va = 0xfb0000
	          end_va = 0xfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fb0000"
	        filename = ""

Region:
	              id = 556
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 557
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 558
	        start_va = 0x230000
	          end_va = 0x230fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 559
	        start_va = 0x530000
	          end_va = 0x56ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 560
	        start_va = 0xeb0000
	          end_va = 0xfaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000eb0000"
	        filename = ""

Region:
	              id = 561
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 562
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 563
	        start_va = 0x360000
	          end_va = 0x360fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000360000"
	        filename = ""

Region:
	              id = 564
	        start_va = 0x74cd0000
	          end_va = 0x74cdffff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 565
	        start_va = 0x74e40000
	          end_va = 0x74e99fff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 566
	        start_va = 0x10d0000
	          end_va = 0x110ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010d0000"
	        filename = ""

Region:
	              id = 567
	        start_va = 0x1120000
	          end_va = 0x112ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001120000"
	        filename = ""

Region:
	              id = 568
	        start_va = 0x2830000
	          end_va = 0x292ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002830000"
	        filename = ""

Region:
	              id = 569
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 570
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 571
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 572
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 573
	        start_va = 0xcd0000
	          end_va = 0xd0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cd0000"
	        filename = ""

Region:
	              id = 574
	        start_va = 0x1090000
	          end_va = 0x10cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 575
	        start_va = 0x2960000
	          end_va = 0x2a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002960000"
	        filename = ""

Region:
	              id = 576
	        start_va = 0x2a80000
	          end_va = 0x2b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a80000"
	        filename = ""

Region:
	              id = 577
	        start_va = 0x74c50000
	          end_va = 0x74c57fff
	     entry_point = 0x74c50000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 578
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 579
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 710
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 711
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 712
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 713
	        start_va = 0x1110000
	          end_va = 0x11eefff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001110000"
	        filename = ""

Region:
	              id = 714
	        start_va = 0x1250000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 715
	        start_va = 0x74e60000
	          end_va = 0x74e92fff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 716
	        start_va = 0x370000
	          end_va = 0x370fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000370000"
	        filename = ""

Region:
	              id = 717
	        start_va = 0x380000
	          end_va = 0x380fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000380000"
	        filename = ""

Region:
	              id = 718
	        start_va = 0x390000
	          end_va = 0x390fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000390000"
	        filename = ""

Region:
	              id = 719
	        start_va = 0x3a0000
	          end_va = 0x3a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003a0000"
	        filename = ""

Region:
	              id = 720
	        start_va = 0x3b0000
	          end_va = 0x3b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003b0000"
	        filename = ""

Region:
	              id = 721
	        start_va = 0x3c0000
	          end_va = 0x3c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003c0000"
	        filename = ""

Region:
	              id = 722
	        start_va = 0x590000
	          end_va = 0x5cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 723
	        start_va = 0xff0000
	          end_va = 0x105dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 724
	        start_va = 0x2c00000
	          end_va = 0x2c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 725
	        start_va = 0x2c40000
	          end_va = 0x2d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c40000"
	        filename = ""

Region:
	              id = 726
	        start_va = 0x2d60000
	          end_va = 0x2e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d60000"
	        filename = ""

Region:
	              id = 727
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 728
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 729
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 730
	        start_va = 0x510000
	          end_va = 0x510fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000510000"
	        filename = ""

Region:
	              id = 731
	        start_va = 0x2bb0000
	          end_va = 0x2beffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bb0000"
	        filename = ""

Region:
	              id = 732
	        start_va = 0x2e80000
	          end_va = 0x2f7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e80000"
	        filename = ""

Region:
	              id = 733
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 734
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 738
	        start_va = 0x520000
	          end_va = 0x521fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000520000"
	        filename = ""

Region:
	              id = 739
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 740
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 741
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 742
	        start_va = 0x570000
	          end_va = 0x570fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000570000"
	        filename = ""

Region:
	              id = 743
	        start_va = 0x11f0000
	          end_va = 0x122ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011f0000"
	        filename = ""

Region:
	              id = 744
	        start_va = 0x30e0000
	          end_va = 0x31dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030e0000"
	        filename = ""

Region:
	              id = 745
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 746
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 747
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 748
	        start_va = 0x3390000
	          end_va = 0x339ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003390000"
	        filename = ""

Region:
	              id = 749
	        start_va = 0x3590000
	          end_va = 0x359ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003590000"
	        filename = ""

Region:
	              id = 750
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 751
	        start_va = 0xd10000
	          end_va = 0xd6cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d10000"
	        filename = ""

Region:
	              id = 752
	        start_va = 0xe70000
	          end_va = 0xe8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e70000"
	        filename = ""

Region:
	              id = 753
	        start_va = 0x27e0000
	          end_va = 0x281ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027e0000"
	        filename = ""

Region:
	              id = 754
	        start_va = 0x2fb0000
	          end_va = 0x2feffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fb0000"
	        filename = ""

Region:
	              id = 755
	        start_va = 0x3260000
	          end_va = 0x335ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003260000"
	        filename = ""

Region:
	              id = 756
	        start_va = 0x33d0000
	          end_va = 0x34cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033d0000"
	        filename = ""

Region:
	              id = 757
	        start_va = 0x35a0000
	          end_va = 0x3992fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035a0000"
	        filename = ""

Region:
	              id = 758
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")

Region:
	              id = 759
	        start_va = 0x74bd0000
	          end_va = 0x74bfcfff
	     entry_point = 0x74bd0000
	     region_type = mapped_file
	            name = "ieui.dll"
	        filename = "\\Windows\\SysWOW64\\ieui.dll" (normalized: "c:\\windows\\syswow64\\ieui.dll")

Region:
	              id = 760
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 761
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 762
	        start_va = 0x3530000
	          end_va = 0x356ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003530000"
	        filename = ""

Region:
	              id = 763
	        start_va = 0x3a40000
	          end_va = 0x3b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a40000"
	        filename = ""

Region:
	              id = 764
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 765
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 766
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 767
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 768
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 769
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 770
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 771
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 772
	        start_va = 0x580000
	          end_va = 0x580fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000580000"
	        filename = ""

Region:
	              id = 773
	        start_va = 0x2740000
	          end_va = 0x27bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 774
	        start_va = 0x39d0000
	          end_va = 0x3a0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039d0000"
	        filename = ""

Region:
	              id = 775
	        start_va = 0x3c60000
	          end_va = 0x3c9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c60000"
	        filename = ""

Region:
	              id = 776
	        start_va = 0x3d70000
	          end_va = 0x3e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d70000"
	        filename = ""

Region:
	              id = 777
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 778
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 779
	        start_va = 0xe90000
	          end_va = 0xe91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 780
	        start_va = 0xea0000
	          end_va = 0xea0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 781
	        start_va = 0x1060000
	          end_va = 0x1060fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 782
	        start_va = 0x1070000
	          end_va = 0x1072fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001070000"
	        filename = ""

Region:
	              id = 783
	        start_va = 0x1080000
	          end_va = 0x1082fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001080000"
	        filename = ""

Region:
	              id = 784
	        start_va = 0x1230000
	          end_va = 0x1230fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001230000"
	        filename = ""

Region:
	              id = 785
	        start_va = 0x1240000
	          end_va = 0x1242fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 786
	        start_va = 0x27c0000
	          end_va = 0x27c2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027c0000"
	        filename = ""

Region:
	              id = 787
	        start_va = 0x27d0000
	          end_va = 0x27d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027d0000"
	        filename = ""

Region:
	              id = 788
	        start_va = 0x2820000
	          end_va = 0x2820fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002820000"
	        filename = ""

Region:
	              id = 789
	        start_va = 0x2930000
	          end_va = 0x2941fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002930000"
	        filename = ""

Region:
	              id = 790
	        start_va = 0x2950000
	          end_va = 0x2950fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002950000"
	        filename = ""

Region:
	              id = 791
	        start_va = 0x2a60000
	          end_va = 0x2a60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a60000"
	        filename = ""

Region:
	              id = 792
	        start_va = 0x2a70000
	          end_va = 0x2a70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a70000"
	        filename = ""

Region:
	              id = 793
	        start_va = 0x2b80000
	          end_va = 0x2b83fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b80000"
	        filename = ""

Region:
	              id = 794
	        start_va = 0x2ba0000
	          end_va = 0x2ba0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ba0000"
	        filename = ""

Region:
	              id = 795
	        start_va = 0x2bf0000
	          end_va = 0x2bf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 796
	        start_va = 0x2d50000
	          end_va = 0x2d5dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d50000"
	        filename = ""

Region:
	              id = 797
	        start_va = 0x3fb0000
	          end_va = 0x3feffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003fb0000"
	        filename = ""

Region:
	              id = 798
	        start_va = 0x3ff0000
	          end_va = 0x491ffff
	     entry_point = 0x3ff0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 799
	        start_va = 0x4920000
	          end_va = 0x4c62fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004920000"
	        filename = ""

Region:
	              id = 800
	        start_va = 0x74a80000
	          end_va = 0x74aaefff
	     entry_point = 0x74a80000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll")

Region:
	              id = 801
	        start_va = 0x2b90000
	          end_va = 0x2b90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b90000"
	        filename = ""

Region:
	              id = 802
	        start_va = 0x2d40000
	          end_va = 0x2d40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d40000"
	        filename = ""

Region:
	              id = 803
	        start_va = 0x2e60000
	          end_va = 0x2e60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e60000"
	        filename = ""

Region:
	              id = 804
	        start_va = 0x2e70000
	          end_va = 0x2e70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e70000"
	        filename = ""

Region:
	              id = 805
	        start_va = 0x2f80000
	          end_va = 0x2f80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f80000"
	        filename = ""

Region:
	              id = 806
	        start_va = 0x2f90000
	          end_va = 0x2f90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f90000"
	        filename = ""

Region:
	              id = 807
	        start_va = 0x2fa0000
	          end_va = 0x2fa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fa0000"
	        filename = ""

Region:
	              id = 808
	        start_va = 0x2ff0000
	          end_va = 0x2ff0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ff0000"
	        filename = ""

Region:
	              id = 809
	        start_va = 0x3000000
	          end_va = 0x3000fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003000000"
	        filename = ""

Region:
	              id = 810
	        start_va = 0x3010000
	          end_va = 0x3010fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003010000"
	        filename = ""

Region:
	              id = 811
	        start_va = 0x3020000
	          end_va = 0x3020fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003020000"
	        filename = ""

Region:
	              id = 812
	        start_va = 0x3030000
	          end_va = 0x3030fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003030000"
	        filename = ""

Region:
	              id = 813
	        start_va = 0x3040000
	          end_va = 0x3040fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003040000"
	        filename = ""

Region:
	              id = 814
	        start_va = 0x3050000
	          end_va = 0x3050fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003050000"
	        filename = ""

Region:
	              id = 815
	        start_va = 0x3060000
	          end_va = 0x3060fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003060000"
	        filename = ""

Region:
	              id = 816
	        start_va = 0x3070000
	          end_va = 0x3070fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003070000"
	        filename = ""

Region:
	              id = 817
	        start_va = 0x3080000
	          end_va = 0x3080fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003080000"
	        filename = ""

Region:
	              id = 818
	        start_va = 0x3090000
	          end_va = 0x3090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003090000"
	        filename = ""

Region:
	              id = 819
	        start_va = 0x30a0000
	          end_va = 0x30a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030a0000"
	        filename = ""

Region:
	              id = 820
	        start_va = 0x30b0000
	          end_va = 0x30b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030b0000"
	        filename = ""

Region:
	              id = 821
	        start_va = 0x30c0000
	          end_va = 0x30c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030c0000"
	        filename = ""

Region:
	              id = 822
	        start_va = 0x30d0000
	          end_va = 0x30d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030d0000"
	        filename = ""

Region:
	              id = 823
	        start_va = 0x31e0000
	          end_va = 0x31e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000031e0000"
	        filename = ""

Region:
	              id = 824
	        start_va = 0x31f0000
	          end_va = 0x31f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000031f0000"
	        filename = ""

Region:
	              id = 825
	        start_va = 0x3200000
	          end_va = 0x3200fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003200000"
	        filename = ""

Region:
	              id = 826
	        start_va = 0x3210000
	          end_va = 0x3210fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003210000"
	        filename = ""

Region:
	              id = 827
	        start_va = 0x3220000
	          end_va = 0x3220fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003220000"
	        filename = ""

Region:
	              id = 828
	        start_va = 0x3230000
	          end_va = 0x3230fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003230000"
	        filename = ""

Region:
	              id = 829
	        start_va = 0x3240000
	          end_va = 0x3240fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003240000"
	        filename = ""

Region:
	              id = 830
	        start_va = 0x3250000
	          end_va = 0x3250fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003250000"
	        filename = ""

Region:
	              id = 831
	        start_va = 0x3360000
	          end_va = 0x3360fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003360000"
	        filename = ""

Region:
	              id = 832
	        start_va = 0x3370000
	          end_va = 0x3370fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003370000"
	        filename = ""

Region:
	              id = 833
	        start_va = 0x3380000
	          end_va = 0x3380fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003380000"
	        filename = ""

Region:
	              id = 834
	        start_va = 0x33a0000
	          end_va = 0x33a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033a0000"
	        filename = ""

Region:
	              id = 835
	        start_va = 0x33b0000
	          end_va = 0x33b5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033b0000"
	        filename = ""

Region:
	              id = 836
	        start_va = 0x33c0000
	          end_va = 0x33c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033c0000"
	        filename = ""

Region:
	              id = 837
	        start_va = 0x34d0000
	          end_va = 0x34d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034d0000"
	        filename = ""

Region:
	              id = 838
	        start_va = 0x34e0000
	          end_va = 0x34fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034e0000"
	        filename = ""

Region:
	              id = 839
	        start_va = 0x3bc0000
	          end_va = 0x3bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003bc0000"
	        filename = ""

Region:
	              id = 840
	        start_va = 0x4da0000
	          end_va = 0x4e9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004da0000"
	        filename = ""

Region:
	              id = 841
	        start_va = 0x74820000
	          end_va = 0x748d1fff
	     entry_point = 0x74820000
	     region_type = mapped_file
	            name = "dui70.dll"
	        filename = "\\Windows\\SysWOW64\\dui70.dll" (normalized: "c:\\windows\\syswow64\\dui70.dll")

Region:
	              id = 842
	        start_va = 0x748e0000
	          end_va = 0x7490efff
	     entry_point = 0x748e0000
	     region_type = mapped_file
	            name = "duser.dll"
	        filename = "\\Windows\\SysWOW64\\duser.dll" (normalized: "c:\\windows\\syswow64\\duser.dll")

Region:
	              id = 843
	        start_va = 0x74910000
	          end_va = 0x74a7efff
	     entry_point = 0x74910000
	     region_type = mapped_file
	            name = "explorerframe.dll"
	        filename = "\\Windows\\SysWOW64\\ExplorerFrame.dll" (normalized: "c:\\windows\\syswow64\\explorerframe.dll")

Region:
	              id = 844
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 845
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 846
	        start_va = 0x3510000
	          end_va = 0x352efff
	     entry_point = 0x3510000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 847
	        start_va = 0x3570000
	          end_va = 0x3570fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003570000"
	        filename = ""

Region:
	              id = 848
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 849
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 850
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 923
	        start_va = 0x33b0000
	          end_va = 0x33bdfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033b0000"
	        filename = ""

Region:
	              id = 924
	        start_va = 0x3500000
	          end_va = 0x3500fff
	     entry_point = 0x3500000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 925
	        start_va = 0x3580000
	          end_va = 0x3581fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003580000"
	        filename = ""

Region:
	              id = 926
	        start_va = 0x3e70000
	          end_va = 0x3f6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e70000"
	        filename = ""

Region:
	              id = 927
	        start_va = 0x74680000
	          end_va = 0x74715fff
	     entry_point = 0x74680000
	     region_type = mapped_file
	            name = "msfeeds.dll"
	        filename = "\\Windows\\SysWOW64\\msfeeds.dll" (normalized: "c:\\windows\\syswow64\\msfeeds.dll")

Region:
	              id = 978
	        start_va = 0x33b0000
	          end_va = 0x33b2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033b0000"
	        filename = ""

Region:
	              id = 979
	        start_va = 0x39a0000
	          end_va = 0x39adfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039a0000"
	        filename = ""

Region:
	              id = 980
	        start_va = 0x39b0000
	          end_va = 0x39b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039b0000"
	        filename = ""

Region:
	              id = 981
	        start_va = 0x39c0000
	          end_va = 0x39c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039c0000"
	        filename = ""

Region:
	              id = 982
	        start_va = 0x3a10000
	          end_va = 0x3a10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a10000"
	        filename = ""

Region:
	              id = 983
	        start_va = 0x3a20000
	          end_va = 0x3a20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a20000"
	        filename = ""

Region:
	              id = 984
	        start_va = 0x3a30000
	          end_va = 0x3a35fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a30000"
	        filename = ""

Region:
	              id = 985
	        start_va = 0x3b40000
	          end_va = 0x3b4afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b40000"
	        filename = ""

Region:
	              id = 986
	        start_va = 0x3b50000
	          end_va = 0x3b50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b50000"
	        filename = ""

Region:
	              id = 987
	        start_va = 0x3ca0000
	          end_va = 0x3d25fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003ca0000"
	        filename = ""

Region:
	              id = 988
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 989
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 990
	        start_va = 0x745b0000
	          end_va = 0x745c1fff
	     entry_point = 0x745b0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll")

Region:
	              id = 991
	        start_va = 0x745a0000
	          end_va = 0x745acfff
	     entry_point = 0x745a0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll")

Region:
	              id = 1091
	        start_va = 0x3b60000
	          end_va = 0x3b74fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b60000"
	        filename = ""

Region:
	              id = 1092
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 1532
	        start_va = 0x3b40000
	          end_va = 0x3b43fff
	     entry_point = 0x3b40000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1533
	        start_va = 0x3b80000
	          end_va = 0x3baffff
	     entry_point = 0x3b80000
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db")

Region:
	              id = 1534
	        start_va = 0x3bb0000
	          end_va = 0x3bb3fff
	     entry_point = 0x3bb0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1535
	        start_va = 0x3c00000
	          end_va = 0x3c01fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c00000"
	        filename = ""

Region:
	              id = 1536
	        start_va = 0x3c10000
	          end_va = 0x3c17fff
	     entry_point = 0x3c10000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 1537
	        start_va = 0x3c20000
	          end_va = 0x3c21fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003c20000"
	        filename = ""

Region:
	              id = 1538
	        start_va = 0x4c70000
	          end_va = 0x4cd5fff
	     entry_point = 0x4c70000
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 1539
	        start_va = 0x4cf0000
	          end_va = 0x4d2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cf0000"
	        filename = ""

Region:
	              id = 1540
	        start_va = 0x4ea0000
	          end_va = 0x4f1ffff
	     entry_point = 0x4ea0000
	     region_type = mapped_file
	            name = "~df80a73760a4e0e7de.tmp"
	        filename = "\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~DF80A73760A4E0E7DE.TMP" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~df80a73760a4e0e7de.tmp")

Region:
	              id = 1541
	        start_va = 0x4f50000
	          end_va = 0x4f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f50000"
	        filename = ""

Region:
	              id = 1542
	        start_va = 0x4fb0000
	          end_va = 0x50affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fb0000"
	        filename = ""

Region:
	              id = 1543
	        start_va = 0x50b0000
	          end_va = 0x512ffff
	     entry_point = 0x50b0000
	     region_type = mapped_file
	            name = "~dfb5950adfcd681681.tmp"
	        filename = "\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~DFB5950ADFCD681681.TMP" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~dfb5950adfcd681681.tmp")

Region:
	              id = 1544
	        start_va = 0x51d0000
	          end_va = 0x52cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051d0000"
	        filename = ""

Region:
	              id = 1545
	        start_va = 0x52d0000
	          end_va = 0x56cffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000052d0000"
	        filename = ""

Region:
	              id = 1546
	        start_va = 0x73880000
	          end_va = 0x739b2fff
	     entry_point = 0x73880000
	     region_type = mapped_file
	            name = "msxml3.dll"
	        filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll")

Region:
	              id = 1547
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 1548
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 1549
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 1591
	        start_va = 0x2fb0000
	          end_va = 0x2fc0fff
	     entry_point = 0x2fb0000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 1592
	        start_va = 0x3260000
	          end_va = 0x32bcfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003260000"
	        filename = ""

Region:
	              id = 1593
	        start_va = 0x3c30000
	          end_va = 0x3c30fff
	     entry_point = 0x3c30000
	     region_type = mapped_file
	            name = "msxml3r.dll"
	        filename = "\\Windows\\SysWOW64\\msxml3r.dll" (normalized: "c:\\windows\\syswow64\\msxml3r.dll")

Region:
	              id = 1594
	        start_va = 0x3c40000
	          end_va = 0x3c5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c40000"
	        filename = ""

Region:
	              id = 1595
	        start_va = 0x5130000
	          end_va = 0x51affff
	     entry_point = 0x5130000
	     region_type = mapped_file
	            name = "~dfffb854326a0f1561.tmp"
	        filename = "\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~DFFFB854326A0F1561.TMP" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~dfffb854326a0f1561.tmp")

Region:
	              id = 1596
	        start_va = 0x56d0000
	          end_va = 0x578ffff
	     entry_point = 0x56d0000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1597
	        start_va = 0x5790000
	          end_va = 0x580ffff
	     entry_point = 0x5790000
	     region_type = mapped_file
	            name = "~dff47e8c1ad1464838.tmp"
	        filename = "\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~DFF47E8C1AD1464838.TMP" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~dff47e8c1ad1464838.tmp")

Region:
	              id = 1598
	        start_va = 0x5880000
	          end_va = 0x58bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005880000"
	        filename = ""

Region:
	              id = 1599
	        start_va = 0x58c0000
	          end_va = 0x58fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058c0000"
	        filename = ""

Region:
	              id = 1600
	        start_va = 0x5900000
	          end_va = 0x597ffff
	     entry_point = 0x5900000
	     region_type = mapped_file
	            name = "~dfd835d2db51b24b9b.tmp"
	        filename = "\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~DFD835D2DB51B24B9B.TMP" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~dfd835d2db51b24b9b.tmp")

Region:
	              id = 1601
	        start_va = 0x5980000
	          end_va = 0x59fffff
	     entry_point = 0x5980000
	     region_type = mapped_file
	            name = "~df0121fc58a1de47d7.tmp"
	        filename = "\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~DF0121FC58A1DE47D7.TMP" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~df0121fc58a1de47d7.tmp")

Region:
	              id = 1602
	        start_va = 0x5ad0000
	          end_va = 0x5b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ad0000"
	        filename = ""

Region:
	              id = 1603
	        start_va = 0x5b10000
	          end_va = 0x5f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005b10000"
	        filename = ""

Region:
	              id = 1604
	        start_va = 0x5f10000
	          end_va = 0x630ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005f10000"
	        filename = ""

Region:
	              id = 1605
	        start_va = 0x6330000
	          end_va = 0x636ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006330000"
	        filename = ""

Region:
	              id = 1606
	        start_va = 0x6530000
	          end_va = 0x662ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006530000"
	        filename = ""

Region:
	              id = 1607
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 1777
	        start_va = 0x2fd0000
	          end_va = 0x2fd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fd0000"
	        filename = ""

Region:
	              id = 1778
	        start_va = 0x32c0000
	          end_va = 0x32cdfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032c0000"
	        filename = ""

Region:
	              id = 1779
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 1780
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 1781
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 1782
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 1784
	        start_va = 0x5a40000
	          end_va = 0x5a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a40000"
	        filename = ""

Region:
	              id = 1785
	        start_va = 0x66e0000
	          end_va = 0x67dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000066e0000"
	        filename = ""

Region:
	              id = 1786
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 1787
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 1804
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 1805
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1806
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 1807
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1849
	        start_va = 0x67e0000
	          end_va = 0x69dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000067e0000"
	        filename = ""

Region:
	              id = 1850
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 2616
	        start_va = 0x2fe0000
	          end_va = 0x2fe3fff
	     entry_point = 0x2fe0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 2617
	        start_va = 0x32d0000
	          end_va = 0x32d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032d0000"
	        filename = ""

Region:
	              id = 2618
	        start_va = 0x32e0000
	          end_va = 0x3303fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032e0000"
	        filename = ""

Region:
	              id = 2619
	        start_va = 0x717b0000
	          end_va = 0x718aafff
	     entry_point = 0x717b0000
	     region_type = mapped_file
	            name = "windowscodecs.dll"
	        filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll")

Region:
	              id = 2620
	        start_va = 0x3310000
	          end_va = 0x3318fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003310000"
	        filename = ""

Region:
	              id = 2621
	        start_va = 0x3320000
	          end_va = 0x3320fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003320000"
	        filename = ""

Region:
	              id = 2622
	        start_va = 0x3330000
	          end_va = 0x3353fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003330000"
	        filename = ""

Region:
	              id = 2623
	        start_va = 0x39a0000
	          end_va = 0x39a8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039a0000"
	        filename = ""

Region:
	              id = 2624
	        start_va = 0x6370000
	          end_va = 0x646ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006370000"
	        filename = ""

Region:
	              id = 2625
	        start_va = 0x71770000
	          end_va = 0x717a0fff
	     entry_point = 0x71770000
	     region_type = mapped_file
	            name = "ehstorshell.dll"
	        filename = "\\Windows\\SysWOW64\\EhStorShell.dll" (normalized: "c:\\windows\\syswow64\\ehstorshell.dll")

Region:
	              id = 2626
	        start_va = 0x3a30000
	          end_va = 0x3a32fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003a30000"
	        filename = ""

Region:
	              id = 2627
	        start_va = 0x4d70000
	          end_va = 0x4d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d70000"
	        filename = ""

Region:
	              id = 2628
	        start_va = 0x6ba0000
	          end_va = 0x6baffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ba0000"
	        filename = ""

Region:
	              id = 2629
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 2630
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 2631
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 2632
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 2633
	        start_va = 0x3d30000
	          end_va = 0x3d33fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d30000"
	        filename = ""

Region:
	              id = 2634
	        start_va = 0x3d40000
	          end_va = 0x3d57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d40000"
	        filename = ""

Region:
	              id = 2635
	        start_va = 0x3d60000
	          end_va = 0x3d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d60000"
	        filename = ""

Region:
	              id = 2636
	        start_va = 0x3f70000
	          end_va = 0x3f70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f70000"
	        filename = ""

Region:
	              id = 2637
	        start_va = 0x3f80000
	          end_va = 0x3f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f80000"
	        filename = ""

Region:
	              id = 2638
	        start_va = 0x3f90000
	          end_va = 0x3f9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f90000"
	        filename = ""

Region:
	              id = 2639
	        start_va = 0x3fa0000
	          end_va = 0x3faffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003fa0000"
	        filename = ""

Region:
	              id = 2640
	        start_va = 0x4ce0000
	          end_va = 0x4ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ce0000"
	        filename = ""

Region:
	              id = 2641
	        start_va = 0x4d30000
	          end_va = 0x4d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d30000"
	        filename = ""

Region:
	              id = 2642
	        start_va = 0x4d40000
	          end_va = 0x4d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d40000"
	        filename = ""

Region:
	              id = 2643
	        start_va = 0x4d50000
	          end_va = 0x4d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d50000"
	        filename = ""

Region:
	              id = 2644
	        start_va = 0x4d60000
	          end_va = 0x4d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d60000"
	        filename = ""

Region:
	              id = 2645
	        start_va = 0x4d80000
	          end_va = 0x4d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d80000"
	        filename = ""

Region:
	              id = 2646
	        start_va = 0x4d90000
	          end_va = 0x4d9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d90000"
	        filename = ""

Region:
	              id = 2647
	        start_va = 0x4f20000
	          end_va = 0x4f2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f20000"
	        filename = ""

Region:
	              id = 2648
	        start_va = 0x4f30000
	          end_va = 0x4f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f30000"
	        filename = ""

Region:
	              id = 2649
	        start_va = 0x71700000
	          end_va = 0x7176ffff
	     entry_point = 0x71700000
	     region_type = mapped_file
	            name = "ntshrui.dll"
	        filename = "\\Windows\\SysWOW64\\ntshrui.dll" (normalized: "c:\\windows\\syswow64\\ntshrui.dll")

Region:
	              id = 2650
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 2651
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 2652
	        start_va = 0x73740000
	          end_va = 0x73758fff
	     entry_point = 0x73740000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2653
	        start_va = 0x716f0000
	          end_va = 0x716fafff
	     entry_point = 0x716f0000
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll")

Region:
	              id = 2654
	        start_va = 0x716e0000
	          end_va = 0x716e9fff
	     entry_point = 0x716e0000
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll")


Thread:
	id = 15
	os_tid = 0x674


Thread:
	id = 16
	os_tid = 0x32c


Thread:
	id = 17
	os_tid = 0x4e0


Thread:
	id = 18
	os_tid = 0x608


Thread:
	id = 19
	os_tid = 0x4c4


Thread:
	id = 20
	os_tid = 0x7f4


Thread:
	id = 35
	os_tid = 0x7b4


Thread:
	id = 36
	os_tid = 0x6b4


Thread:
	id = 37
	os_tid = 0x5c4


Thread:
	id = 39
	os_tid = 0x628


Thread:
	id = 40
	os_tid = 0x310


Thread:
	id = 41
	os_tid = 0x128


Thread:
	id = 42
	os_tid = 0x4bc


Thread:
	id = 43
	os_tid = 0x51c


Thread:
	id = 44
	os_tid = 0x6ac


Thread:
	id = 97
	os_tid = 0x808


Thread:
	id = 99
	os_tid = 0x824


Thread:
	id = 102
	os_tid = 0x83c


Thread:
	id = 121
	os_tid = 0x88c


Thread:
	id = 390
	os_tid = 0xc48


Process:
	id = "4"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x9c04000"
	os_pid = "0x3fc"
	os_integrity_level = "0x4000"
	os_privileges = "0x60801000"
	monitor_reason = "rpc_server"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dd65" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 580
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 581
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 582
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 583
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 584
	        start_va = 0x50000
	          end_va = 0xb6fff
	     entry_point = 0x50000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 585
	        start_va = 0xc0000
	          end_va = 0xc1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 586
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 587
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 588
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 589
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000100000"
	        filename = ""

Region:
	              id = 590
	        start_va = 0x110000
	          end_va = 0x18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 591
	        start_va = 0x190000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 592
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 593
	        start_va = 0x330000
	          end_va = 0x331fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000330000"
	        filename = ""

Region:
	              id = 594
	        start_va = 0x340000
	          end_va = 0x34ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000340000"
	        filename = ""

Region:
	              id = 595
	        start_va = 0x350000
	          end_va = 0x350fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000350000"
	        filename = ""

Region:
	              id = 596
	        start_va = 0x360000
	          end_va = 0x360fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000360000"
	        filename = ""

Region:
	              id = 597
	        start_va = 0x3c0000
	          end_va = 0x3cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003c0000"
	        filename = ""

Region:
	              id = 598
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 599
	        start_va = 0x3e0000
	          end_va = 0x4dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 600
	        start_va = 0x4e0000
	          end_va = 0x667fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004e0000"
	        filename = ""

Region:
	              id = 601
	        start_va = 0x670000
	          end_va = 0x7f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000670000"
	        filename = ""

Region:
	              id = 602
	        start_va = 0x800000
	          end_va = 0x8bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000800000"
	        filename = ""

Region:
	              id = 603
	        start_va = 0x8c0000
	          end_va = 0xcb2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008c0000"
	        filename = ""

Region:
	              id = 604
	        start_va = 0xce0000
	          end_va = 0xd5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ce0000"
	        filename = ""

Region:
	              id = 605
	        start_va = 0xd60000
	          end_va = 0xe5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d60000"
	        filename = ""

Region:
	              id = 606
	        start_va = 0xe60000
	          end_va = 0xedffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 607
	        start_va = 0xf40000
	          end_va = 0x120efff
	     entry_point = 0xf40000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 608
	        start_va = 0x1240000
	          end_va = 0x12bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 609
	        start_va = 0x12e0000
	          end_va = 0x135ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012e0000"
	        filename = ""

Region:
	              id = 610
	        start_va = 0x13d0000
	          end_va = 0x144ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013d0000"
	        filename = ""

Region:
	              id = 611
	        start_va = 0x1480000
	          end_va = 0x14fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001480000"
	        filename = ""

Region:
	              id = 612
	        start_va = 0x15c0000
	          end_va = 0x16bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000015c0000"
	        filename = ""

Region:
	              id = 613
	        start_va = 0x1770000
	          end_va = 0x17effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001770000"
	        filename = ""

Region:
	              id = 614
	        start_va = 0x18b0000
	          end_va = 0x18bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000018b0000"
	        filename = ""

Region:
	              id = 615
	        start_va = 0x1940000
	          end_va = 0x19bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001940000"
	        filename = ""

Region:
	              id = 616
	        start_va = 0x19c0000
	          end_va = 0x1a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000019c0000"
	        filename = ""

Region:
	              id = 617
	        start_va = 0x1a70000
	          end_va = 0x1b6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a70000"
	        filename = ""

Region:
	              id = 618
	        start_va = 0x1bb0000
	          end_va = 0x1c2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001bb0000"
	        filename = ""

Region:
	              id = 619
	        start_va = 0x1ce0000
	          end_va = 0x1d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ce0000"
	        filename = ""

Region:
	              id = 620
	        start_va = 0x1d60000
	          end_va = 0x1e1ffff
	     entry_point = 0x1d60000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 621
	        start_va = 0x1ea0000
	          end_va = 0x1f1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 622
	        start_va = 0x1fd0000
	          end_va = 0x204ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fd0000"
	        filename = ""

Region:
	              id = 623
	        start_va = 0x2050000
	          end_va = 0x224ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002050000"
	        filename = ""

Region:
	              id = 624
	        start_va = 0x2320000
	          end_va = 0x239ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002320000"
	        filename = ""

Region:
	              id = 625
	        start_va = 0x23b0000
	          end_va = 0x242ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000023b0000"
	        filename = ""

Region:
	              id = 626
	        start_va = 0x73e50000
	          end_va = 0x73e52fff
	     entry_point = 0x73e50000
	     region_type = mapped_file
	            name = "sfc.dll"
	        filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll")

Region:
	              id = 627
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x77450000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 628
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x77550000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 629
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 630
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 631
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 632
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 633
	        start_va = 0xff1c0000
	          end_va = 0xff1cafff
	     entry_point = 0xff1c0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 634
	        start_va = 0x7fef4940000
	          end_va = 0x7fef4957fff
	     entry_point = 0x7fef4940000
	     region_type = mapped_file
	            name = "vmictimeprovider.dll"
	        filename = "\\Windows\\System32\\vmictimeprovider.dll" (normalized: "c:\\windows\\system32\\vmictimeprovider.dll")

Region:
	              id = 635
	        start_va = 0x7fef4960000
	          end_va = 0x7fef49bffff
	     entry_point = 0x7fef4960000
	     region_type = mapped_file
	            name = "w32time.dll"
	        filename = "\\Windows\\System32\\w32time.dll" (normalized: "c:\\windows\\system32\\w32time.dll")

Region:
	              id = 636
	        start_va = 0x7fef69e0000
	          end_va = 0x7fef69f8fff
	     entry_point = 0x7fef69e0000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")

Region:
	              id = 637
	        start_va = 0x7fef6a00000
	          end_va = 0x7fef6a14fff
	     entry_point = 0x7fef6a00000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")

Region:
	              id = 638
	        start_va = 0x7fef6a30000
	          end_va = 0x7fef6a3afff
	     entry_point = 0x7fef6a30000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")

Region:
	              id = 639
	        start_va = 0x7fef7750000
	          end_va = 0x7fef7768fff
	     entry_point = 0x7fef7750000
	     region_type = mapped_file
	            name = "wdi.dll"
	        filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll")

Region:
	              id = 640
	        start_va = 0x7fef7770000
	          end_va = 0x7fef777ffff
	     entry_point = 0x7fef7770000
	     region_type = mapped_file
	            name = "sfc_os.dll"
	        filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll")

Region:
	              id = 641
	        start_va = 0x7fef7780000
	          end_va = 0x7fef7791fff
	     entry_point = 0x7fef7780000
	     region_type = mapped_file
	            name = "aepic.dll"
	        filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll")

Region:
	              id = 642
	        start_va = 0x7fef7800000
	          end_va = 0x7fef7863fff
	     entry_point = 0x7fef7800000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 643
	        start_va = 0x7fef7870000
	          end_va = 0x7fef78e0fff
	     entry_point = 0x7fef7870000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 644
	        start_va = 0x7fef8740000
	          end_va = 0x7fef87bbfff
	     entry_point = 0x7fef8740000
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")

Region:
	              id = 645
	        start_va = 0x7fefada0000
	          end_va = 0x7fefadb7fff
	     entry_point = 0x7fefada0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 646
	        start_va = 0x7fefadc0000
	          end_va = 0x7fefadd0fff
	     entry_point = 0x7fefadc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 647
	        start_va = 0x7fefadf0000
	          end_va = 0x7fefae42fff
	     entry_point = 0x7fefadf0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 648
	        start_va = 0x7fefaf30000
	          end_va = 0x7fefaf39fff
	     entry_point = 0x7fefaf30000
	     region_type = mapped_file
	            name = "nsisvc.dll"
	        filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll")

Region:
	              id = 649
	        start_va = 0x7fefaf50000
	          end_va = 0x7fefaf5afff
	     entry_point = 0x7fefaf50000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 650
	        start_va = 0x7fefaf60000
	          end_va = 0x7fefaf86fff
	     entry_point = 0x7fefaf60000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 651
	        start_va = 0x7fefafd0000
	          end_va = 0x7fefb036fff
	     entry_point = 0x7fefafd0000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 652
	        start_va = 0x7fefb050000
	          end_va = 0x7fefb05bfff
	     entry_point = 0x7fefb050000
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 653
	        start_va = 0x7fefb0d0000
	          end_va = 0x7fefb0e4fff
	     entry_point = 0x7fefb0d0000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 654
	        start_va = 0x7fefb590000
	          end_va = 0x7fefb667fff
	     entry_point = 0x7fefb590000
	     region_type = mapped_file
	            name = "perftrack.dll"
	        filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll")

Region:
	              id = 655
	        start_va = 0x7fefb700000
	          end_va = 0x7fefb70bfff
	     entry_point = 0x7fefb700000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 656
	        start_va = 0x7fefb830000
	          end_va = 0x7fefb837fff
	     entry_point = 0x7fefb830000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 657
	        start_va = 0x7fefb8c0000
	          end_va = 0x7fefb933fff
	     entry_point = 0x7fefb8c0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 658
	        start_va = 0x7fefbae0000
	          end_va = 0x7fefbaf7fff
	     entry_point = 0x7fefbae0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 659
	        start_va = 0x7fefc780000
	          end_va = 0x7fefc78bfff
	     entry_point = 0x7fefc780000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 660
	        start_va = 0x7fefc850000
	          end_va = 0x7fefc856fff
	     entry_point = 0x7fefc850000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 661
	        start_va = 0x7fefc940000
	          end_va = 0x7fefc95afff
	     entry_point = 0x7fefc940000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 662
	        start_va = 0x7fefc960000
	          end_va = 0x7fefc97dfff
	     entry_point = 0x7fefc960000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 663
	        start_va = 0x7fefcab0000
	          end_va = 0x7fefcab9fff
	     entry_point = 0x7fefcab0000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 664
	        start_va = 0x7fefcbb0000
	          end_va = 0x7fefcbf6fff
	     entry_point = 0x7fefcbb0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 665
	        start_va = 0x7fefcca0000
	          end_va = 0x7fefcccffff
	     entry_point = 0x7fefcca0000
	     region_type = mapped_file
	            name = "logoncli.dll"
	        filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")

Region:
	              id = 666
	        start_va = 0x7fefccd0000
	          end_va = 0x7fefcd2afff
	     entry_point = 0x7fefccd0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 667
	        start_va = 0x7fefce40000
	          end_va = 0x7fefce46fff
	     entry_point = 0x7fefce40000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 668
	        start_va = 0x7fefce50000
	          end_va = 0x7fefcea4fff
	     entry_point = 0x7fefce50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 669
	        start_va = 0x7fefceb0000
	          end_va = 0x7fefcec6fff
	     entry_point = 0x7fefceb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 670
	        start_va = 0x7fefd150000
	          end_va = 0x7fefd163fff
	     entry_point = 0x7fefd150000
	     region_type = mapped_file
	            name = "cryptdll.dll"
	        filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll")

Region:
	              id = 671
	        start_va = 0x7fefd450000
	          end_va = 0x7fefd45afff
	     entry_point = 0x7fefd450000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 672
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd4a4fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 673
	        start_va = 0x7fefd4b0000
	          end_va = 0x7fefd4befff
	     entry_point = 0x7fefd4b0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 674
	        start_va = 0x7fefd4c0000
	          end_va = 0x7fefd550fff
	     entry_point = 0x7fefd4c0000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 675
	        start_va = 0x7fefd5a0000
	          end_va = 0x7fefd5b3fff
	     entry_point = 0x7fefd5a0000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 676
	        start_va = 0x7fefd5c0000
	          end_va = 0x7fefd5cefff
	     entry_point = 0x7fefd5c0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 677
	        start_va = 0x7fefd920000
	          end_va = 0x7fefd98afff
	     entry_point = 0x7fefd920000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 678
	        start_va = 0x7fefdb10000
	          end_va = 0x7fefdbaefff
	     entry_point = 0x7fefdb10000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 679
	        start_va = 0x7fefdbb0000
	          end_va = 0x7fefdc86fff
	     entry_point = 0x7fefdbb0000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 680
	        start_va = 0x7fefdc90000
	          end_va = 0x7fefdcf6fff
	     entry_point = 0x7fefdc90000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 681
	        start_va = 0x7fefdd00000
	          end_va = 0x7fefddc8fff
	     entry_point = 0x7fefdd00000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 682
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdff2fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 683
	        start_va = 0x7fefe000000
	          end_va = 0x7fefe098fff
	     entry_point = 0x7fefe000000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 684
	        start_va = 0x7fefe0a0000
	          end_va = 0x7fefe1a8fff
	     entry_point = 0x7fefe0a0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 685
	        start_va = 0x7fefe330000
	          end_va = 0x7fefe34efff
	     entry_point = 0x7fefe330000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 686
	        start_va = 0x7fefe350000
	          end_va = 0x7fefe35dfff
	     entry_point = 0x7fefe350000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 687
	        start_va = 0x7feff2d0000
	          end_va = 0x7feff2d7fff
	     entry_point = 0x7feff2d0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 688
	        start_va = 0x7feff2e0000
	          end_va = 0x7feff350fff
	     entry_point = 0x7feff2e0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 689
	        start_va = 0x7feff490000
	          end_va = 0x7feff4dcfff
	     entry_point = 0x7feff490000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 690
	        start_va = 0x7feff740000
	          end_va = 0x7feff81afff
	     entry_point = 0x7feff740000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 691
	        start_va = 0x7feff820000
	          end_va = 0x7feff94cfff
	     entry_point = 0x7feff820000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 692
	        start_va = 0x7feff950000
	          end_va = 0x7feff97dfff
	     entry_point = 0x7feff950000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 693
	        start_va = 0x7feff990000
	          end_va = 0x7feff990fff
	     entry_point = 0x7feff990000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 694
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 695
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 696
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 697
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 698
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 699
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 700
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 701
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 702
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 703
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 704
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 705
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 706
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 707
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 708
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 709
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""


Thread:
	id = 21
	os_tid = 0x7f8


Thread:
	id = 22
	os_tid = 0x260


Thread:
	id = 23
	os_tid = 0x5b0


Thread:
	id = 24
	os_tid = 0x698


Thread:
	id = 25
	os_tid = 0x75c


Thread:
	id = 26
	os_tid = 0x754


Thread:
	id = 27
	os_tid = 0x730


Thread:
	id = 28
	os_tid = 0x72c


Thread:
	id = 29
	os_tid = 0x728


Thread:
	id = 30
	os_tid = 0x158


Thread:
	id = 31
	os_tid = 0x154


Thread:
	id = 32
	os_tid = 0x130


Thread:
	id = 33
	os_tid = 0x12c


Thread:
	id = 34
	os_tid = 0xc8


Thread:
	id = 290
	os_tid = 0xbe4


Process:
	id = "5"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x3a10f000"
	os_pid = "0x784"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:14337"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 851
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 852
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 853
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 854
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 855
	        start_va = 0xb0000
	          end_va = 0xeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 856
	        start_va = 0x210000
	          end_va = 0x30ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 857
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 858
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 859
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 860
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 861
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 862
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 863
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 864
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 865
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 866
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 867
	        start_va = 0x3f0000
	          end_va = 0x46ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 868
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 869
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 870
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 871
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 872
	        start_va = 0xf0000
	          end_va = 0x156fff
	     entry_point = 0xf0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 873
	        start_va = 0x1b0000
	          end_va = 0x1bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 874
	        start_va = 0x550000
	          end_va = 0x64ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 875
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 876
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 877
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 878
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 879
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 880
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 881
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 882
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 883
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 884
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 885
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 886
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 887
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 888
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 889
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 890
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 891
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 892
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 893
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 894
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 895
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 896
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 897
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 898
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 899
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 900
	        start_va = 0x650000
	          end_va = 0x7d7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""

Region:
	              id = 901
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 902
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 903
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 904
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 905
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 906
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 907
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 908
	        start_va = 0x7e0000
	          end_va = 0x960fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 909
	        start_va = 0x970000
	          end_va = 0xc3efff
	     entry_point = 0x970000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 910
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 911
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 912
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 913
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 914
	        start_va = 0x90000
	          end_va = 0x90fff
	     entry_point = 0x90000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 915
	        start_va = 0xa0000
	          end_va = 0xa1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000a0000"
	        filename = ""

Region:
	              id = 916
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 917
	        start_va = 0x170000
	          end_va = 0x171fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 918
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 919
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 920
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 928
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 929
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 930
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 931
	        start_va = 0x1a0000
	          end_va = 0x1a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 932
	        start_va = 0x380000
	          end_va = 0x3bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000380000"
	        filename = ""

Region:
	              id = 933
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 934
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 935
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 936
	        start_va = 0x1e0000
	          end_va = 0x1e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 937
	        start_va = 0x310000
	          end_va = 0x37dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000310000"
	        filename = ""

Region:
	              id = 938
	        start_va = 0x470000
	          end_va = 0x54efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000470000"
	        filename = ""

Region:
	              id = 939
	        start_va = 0xd00000
	          end_va = 0xd3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d00000"
	        filename = ""

Region:
	              id = 940
	        start_va = 0xe00000
	          end_va = 0xefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 941
	        start_va = 0xf00000
	          end_va = 0xf3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f00000"
	        filename = ""

Region:
	              id = 942
	        start_va = 0xf60000
	          end_va = 0x105ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f60000"
	        filename = ""

Region:
	              id = 943
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 944
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 945
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 946
	        start_va = 0xd70000
	          end_va = 0xdaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d70000"
	        filename = ""

Region:
	              id = 947
	        start_va = 0x10c0000
	          end_va = 0x10fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010c0000"
	        filename = ""

Region:
	              id = 948
	        start_va = 0x1110000
	          end_va = 0x114ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001110000"
	        filename = ""

Region:
	              id = 949
	        start_va = 0x2760000
	          end_va = 0x285ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002760000"
	        filename = ""

Region:
	              id = 950
	        start_va = 0x29b0000
	          end_va = 0x2aaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029b0000"
	        filename = ""

Region:
	              id = 951
	        start_va = 0x2c70000
	          end_va = 0x2e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c70000"
	        filename = ""

Region:
	              id = 952
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 953
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 954
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 955
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 956
	        start_va = 0x74600000
	          end_va = 0x74632fff
	     entry_point = 0x74600000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 957
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 958
	        start_va = 0x1150000
	          end_va = 0x124ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001150000"
	        filename = ""

Region:
	              id = 959
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 960
	        start_va = 0x200000
	          end_va = 0x200fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000200000"
	        filename = ""

Region:
	              id = 961
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 962
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 963
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 964
	        start_va = 0x3c0000
	          end_va = 0x3c3fff
	     entry_point = 0x3c0000
	     region_type = mapped_file
	            name = "cversions.1.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")

Region:
	              id = 965
	        start_va = 0x3d0000
	          end_va = 0x3eefff
	     entry_point = 0x3d0000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 966
	        start_va = 0xc40000
	          end_va = 0xc40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c40000"
	        filename = ""

Region:
	              id = 967
	        start_va = 0x28a0000
	          end_va = 0x28dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028a0000"
	        filename = ""

Region:
	              id = 968
	        start_va = 0x2f80000
	          end_va = 0x307ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f80000"
	        filename = ""

Region:
	              id = 969
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 970
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 971
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 972
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 973
	        start_va = 0x3080000
	          end_va = 0x3472fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003080000"
	        filename = ""

Region:
	              id = 974
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 975
	        start_va = 0x3c0000
	          end_va = 0x3c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003c0000"
	        filename = ""

Region:
	              id = 976
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 977
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 992
	        start_va = 0xc50000
	          end_va = 0xc51fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c50000"
	        filename = ""

Region:
	              id = 993
	        start_va = 0xc60000
	          end_va = 0xc61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c60000"
	        filename = ""

Region:
	              id = 994
	        start_va = 0xc70000
	          end_va = 0xc7ffff
	     entry_point = 0xc70000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 995
	        start_va = 0xc80000
	          end_va = 0xc87fff
	     entry_point = 0xc80000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 996
	        start_va = 0xc90000
	          end_va = 0xca3fff
	     entry_point = 0xc90000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 997
	        start_va = 0xcb0000
	          end_va = 0xceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cb0000"
	        filename = ""

Region:
	              id = 998
	        start_va = 0x2920000
	          end_va = 0x295ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002920000"
	        filename = ""

Region:
	              id = 999
	        start_va = 0x2b70000
	          end_va = 0x2c6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b70000"
	        filename = ""

Region:
	              id = 1000
	        start_va = 0x35c0000
	          end_va = 0x36bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035c0000"
	        filename = ""

Region:
	              id = 1001
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 1002
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1003
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 1004
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 1005
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 1006
	        start_va = 0x3810000
	          end_va = 0x384ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003810000"
	        filename = ""

Region:
	              id = 1007
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 1008
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 1009
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 1010
	        start_va = 0xcf0000
	          end_va = 0xcf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000cf0000"
	        filename = ""

Region:
	              id = 1011
	        start_va = 0xdb0000
	          end_va = 0xdb1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 1012
	        start_va = 0x39e0000
	          end_va = 0x3a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039e0000"
	        filename = ""

Region:
	              id = 1013
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 1014
	        start_va = 0xd40000
	          end_va = 0xd5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d40000"
	        filename = ""

Region:
	              id = 1015
	        start_va = 0x3a20000
	          end_va = 0x434ffff
	     entry_point = 0x3a20000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 1016
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 1017
	        start_va = 0xd60000
	          end_va = 0xd60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d60000"
	        filename = ""

Region:
	              id = 1018
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 1019
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 1020
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 1021
	        start_va = 0x4500000
	          end_va = 0x450ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004500000"
	        filename = ""

Region:
	              id = 1022
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 1023
	        start_va = 0xdc0000
	          end_va = 0xdc0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 1024
	        start_va = 0x3590000
	          end_va = 0x359ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003590000"
	        filename = ""

Region:
	              id = 1025
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 1026
	        start_va = 0xdd0000
	          end_va = 0xdd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 1027
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 1028
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 1031
	        start_va = 0xde0000
	          end_va = 0xde3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 1032
	        start_va = 0xdf0000
	          end_va = 0xdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 1033
	        start_va = 0xf40000
	          end_va = 0xf57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f40000"
	        filename = ""

Region:
	              id = 1034
	        start_va = 0x1060000
	          end_va = 0x1060fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 1035
	        start_va = 0x1070000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001070000"
	        filename = ""

Region:
	              id = 1036
	        start_va = 0x1080000
	          end_va = 0x108ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001080000"
	        filename = ""

Region:
	              id = 1037
	        start_va = 0x1090000
	          end_va = 0x109ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 1038
	        start_va = 0x10a0000
	          end_va = 0x10affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 1039
	        start_va = 0x10b0000
	          end_va = 0x10bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010b0000"
	        filename = ""

Region:
	              id = 1040
	        start_va = 0x1100000
	          end_va = 0x110ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001100000"
	        filename = ""

Region:
	              id = 1041
	        start_va = 0x1250000
	          end_va = 0x125ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 1042
	        start_va = 0x1260000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001260000"
	        filename = ""

Region:
	              id = 1043
	        start_va = 0x37a0000
	          end_va = 0x37dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037a0000"
	        filename = ""

Region:
	              id = 1044
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 1045
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 1046
	        start_va = 0x1270000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001270000"
	        filename = ""

Region:
	              id = 1047
	        start_va = 0x1280000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 1048
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 1049
	        start_va = 0x2750000
	          end_va = 0x2750fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002750000"
	        filename = ""

Region:
	              id = 1050
	        start_va = 0x2860000
	          end_va = 0x2860fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002860000"
	        filename = ""

Region:
	              id = 1051
	        start_va = 0x2ea0000
	          end_va = 0x2edffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ea0000"
	        filename = ""

Region:
	              id = 1052
	        start_va = 0x3930000
	          end_va = 0x396ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003930000"
	        filename = ""

Region:
	              id = 1053
	        start_va = 0x43b0000
	          end_va = 0x44affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000043b0000"
	        filename = ""

Region:
	              id = 1054
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 1055
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 1056
	        start_va = 0x2870000
	          end_va = 0x2870fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002870000"
	        filename = ""

Region:
	              id = 1057
	        start_va = 0x2880000
	          end_va = 0x288ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002880000"
	        filename = ""

Region:
	              id = 1058
	        start_va = 0x2b00000
	          end_va = 0x2b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b00000"
	        filename = ""

Region:
	              id = 1059
	        start_va = 0x3480000
	          end_va = 0x34bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003480000"
	        filename = ""

Region:
	              id = 1060
	        start_va = 0x3540000
	          end_va = 0x357ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003540000"
	        filename = ""

Region:
	              id = 1061
	        start_va = 0x4530000
	          end_va = 0x462ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004530000"
	        filename = ""

Region:
	              id = 1062
	        start_va = 0x4690000
	          end_va = 0x478ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004690000"
	        filename = ""

Region:
	              id = 1063
	        start_va = 0x4970000
	          end_va = 0x4a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004970000"
	        filename = ""

Region:
	              id = 1064
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 1065
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1066
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 1067
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 1068
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 1069
	        start_va = 0x2890000
	          end_va = 0x2890fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002890000"
	        filename = ""

Region:
	              id = 1070
	        start_va = 0x28e0000
	          end_va = 0x28e2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000028e0000"
	        filename = ""

Region:
	              id = 1071
	        start_va = 0x2f30000
	          end_va = 0x2f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f30000"
	        filename = ""

Region:
	              id = 1072
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 1073
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 1074
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 1075
	        start_va = 0x28f0000
	          end_va = 0x28f3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028f0000"
	        filename = ""

Region:
	              id = 1076
	        start_va = 0x2900000
	          end_va = 0x2917fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002900000"
	        filename = ""

Region:
	              id = 1077
	        start_va = 0x2960000
	          end_va = 0x296ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002960000"
	        filename = ""

Region:
	              id = 1078
	        start_va = 0x2970000
	          end_va = 0x2970fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002970000"
	        filename = ""

Region:
	              id = 1079
	        start_va = 0x2980000
	          end_va = 0x298ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002980000"
	        filename = ""

Region:
	              id = 1080
	        start_va = 0x2990000
	          end_va = 0x299ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002990000"
	        filename = ""

Region:
	              id = 1081
	        start_va = 0x29a0000
	          end_va = 0x29affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029a0000"
	        filename = ""

Region:
	              id = 1082
	        start_va = 0x2ab0000
	          end_va = 0x2abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ab0000"
	        filename = ""

Region:
	              id = 1083
	        start_va = 0x2ac0000
	          end_va = 0x2acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ac0000"
	        filename = ""

Region:
	              id = 1084
	        start_va = 0x2ad0000
	          end_va = 0x2adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ad0000"
	        filename = ""

Region:
	              id = 1085
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 1086
	        start_va = 0x3520000
	          end_va = 0x352ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003520000"
	        filename = ""

Region:
	              id = 1087
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 1088
	        start_va = 0x2ae0000
	          end_va = 0x2ae1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002ae0000"
	        filename = ""

Region:
	              id = 1089
	        start_va = 0x48b0000
	          end_va = 0x48bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048b0000"
	        filename = ""

Region:
	              id = 1090
	        start_va = 0x74040000
	          end_va = 0x7409afff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 1480
	        start_va = 0x2ae0000
	          end_va = 0x2af1fff
	     entry_point = 0x2ae0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 1481
	        start_va = 0x2b40000
	          end_va = 0x2b47fff
	     entry_point = 0x2b40000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 1482
	        start_va = 0x2b50000
	          end_va = 0x2b5cfff
	     entry_point = 0x2b50000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 1483
	        start_va = 0x2b60000
	          end_va = 0x2b60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b60000"
	        filename = ""

Region:
	              id = 1484
	        start_va = 0x2e70000
	          end_va = 0x2e70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e70000"
	        filename = ""

Region:
	              id = 1485
	        start_va = 0x2e80000
	          end_va = 0x2e80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e80000"
	        filename = ""

Region:
	              id = 1486
	        start_va = 0x2e90000
	          end_va = 0x2e90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e90000"
	        filename = ""

Region:
	              id = 1487
	        start_va = 0x36c0000
	          end_va = 0x373ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036c0000"
	        filename = ""

Region:
	              id = 1488
	        start_va = 0x4a70000
	          end_va = 0x4db2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004a70000"
	        filename = ""

Region:
	              id = 1489
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 1490
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 1491
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 1492
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 1493
	        start_va = 0x2ee0000
	          end_va = 0x2ee0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002ee0000"
	        filename = ""

Region:
	              id = 1494
	        start_va = 0x3880000
	          end_va = 0x38bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003880000"
	        filename = ""

Region:
	              id = 1495
	        start_va = 0x4f70000
	          end_va = 0x506ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f70000"
	        filename = ""

Region:
	              id = 1496
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 1497
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 1500
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 1501
	        start_va = 0x4890000
	          end_va = 0x489ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004890000"
	        filename = ""

Region:
	              id = 1502
	        start_va = 0x4f00000
	          end_va = 0x4f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f00000"
	        filename = ""

Region:
	              id = 1503
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 1504
	        start_va = 0x38c0000
	          end_va = 0x38fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000038c0000"
	        filename = ""

Region:
	              id = 1505
	        start_va = 0x47f0000
	          end_va = 0x482ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000047f0000"
	        filename = ""

Region:
	              id = 1506
	        start_va = 0x51c0000
	          end_va = 0x52bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051c0000"
	        filename = ""

Region:
	              id = 1507
	        start_va = 0x52f0000
	          end_va = 0x53effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000052f0000"
	        filename = ""

Region:
	              id = 1508
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 1509
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 1510
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 1511
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 1512
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 1513
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 1514
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 1515
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 1516
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 1517
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 1518
	        start_va = 0x2ef0000
	          end_va = 0x2f2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ef0000"
	        filename = ""

Region:
	              id = 1519
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 1520
	        start_va = 0x745b0000
	          end_va = 0x745c1fff
	     entry_point = 0x745b0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll")

Region:
	              id = 1521
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 1522
	        start_va = 0x745a0000
	          end_va = 0x745acfff
	     entry_point = 0x745a0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll")

Region:
	              id = 1523
	        start_va = 0x3740000
	          end_va = 0x377ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003740000"
	        filename = ""

Region:
	              id = 1524
	        start_va = 0x4dc0000
	          end_va = 0x4ebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004dc0000"
	        filename = ""

Region:
	              id = 1525
	        start_va = 0x50c0000
	          end_va = 0x51bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050c0000"
	        filename = ""

Region:
	              id = 1526
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 1527
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 1528
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 1529
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 1550
	        start_va = 0x2f40000
	          end_va = 0x2f40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f40000"
	        filename = ""

Region:
	              id = 1551
	        start_va = 0x2f50000
	          end_va = 0x2f50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f50000"
	        filename = ""

Region:
	              id = 1552
	        start_va = 0x2f60000
	          end_va = 0x2f60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f60000"
	        filename = ""

Region:
	              id = 1553
	        start_va = 0x2f70000
	          end_va = 0x2f70fff
	     entry_point = 0x2f70000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 1554
	        start_va = 0x34c0000
	          end_va = 0x351cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034c0000"
	        filename = ""

Region:
	              id = 1555
	        start_va = 0x3990000
	          end_va = 0x39cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003990000"
	        filename = ""

Region:
	              id = 1556
	        start_va = 0x47a0000
	          end_va = 0x47dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000047a0000"
	        filename = ""

Region:
	              id = 1557
	        start_va = 0x5070000
	          end_va = 0x50affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005070000"
	        filename = ""

Region:
	              id = 1558
	        start_va = 0x5490000
	          end_va = 0x558ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005490000"
	        filename = ""

Region:
	              id = 1559
	        start_va = 0x5590000
	          end_va = 0x568ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005590000"
	        filename = ""

Region:
	              id = 1560
	        start_va = 0x5710000
	          end_va = 0x580ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005710000"
	        filename = ""

Region:
	              id = 1561
	        start_va = 0x5990000
	          end_va = 0x5a8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005990000"
	        filename = ""

Region:
	              id = 1562
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 1563
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 1564
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 1565
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 1568
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1569
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 1570
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1571
	        start_va = 0x5a90000
	          end_va = 0x5c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a90000"
	        filename = ""

Region:
	              id = 1572
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 1573
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 1574
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 1575
	        start_va = 0x3530000
	          end_va = 0x3530fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003530000"
	        filename = ""

Region:
	              id = 1576
	        start_va = 0x3580000
	          end_va = 0x3580fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003580000"
	        filename = ""

Region:
	              id = 1577
	        start_va = 0x35b0000
	          end_va = 0x35b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035b0000"
	        filename = ""

Region:
	              id = 1578
	        start_va = 0x4830000
	          end_va = 0x486ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004830000"
	        filename = ""

Region:
	              id = 1579
	        start_va = 0x4930000
	          end_va = 0x496ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004930000"
	        filename = ""

Region:
	              id = 1580
	        start_va = 0x4ec0000
	          end_va = 0x4efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ec0000"
	        filename = ""

Region:
	              id = 1581
	        start_va = 0x5410000
	          end_va = 0x544ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005410000"
	        filename = ""

Region:
	              id = 1582
	        start_va = 0x5d00000
	          end_va = 0x5dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d00000"
	        filename = ""

Region:
	              id = 1583
	        start_va = 0x5f10000
	          end_va = 0x600ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005f10000"
	        filename = ""

Region:
	              id = 1584
	        start_va = 0x6100000
	          end_va = 0x61fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006100000"
	        filename = ""

Region:
	              id = 1585
	        start_va = 0x6210000
	          end_va = 0x630ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006210000"
	        filename = ""

Region:
	              id = 1586
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 1587
	        start_va = 0x7ef71000
	          end_va = 0x7ef73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef71000"
	        filename = ""

Region:
	              id = 1588
	        start_va = 0x7ef74000
	          end_va = 0x7ef76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef74000"
	        filename = ""

Region:
	              id = 1589
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 1590
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 1608
	        start_va = 0x35a0000
	          end_va = 0x35a7fff
	     entry_point = 0x35a0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 1609
	        start_va = 0x3780000
	          end_va = 0x3790fff
	     entry_point = 0x3780000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 1610
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 1611
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 1612
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 1613
	        start_va = 0x37e0000
	          end_va = 0x37e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000037e0000"
	        filename = ""

Region:
	              id = 1614
	        start_va = 0x5890000
	          end_va = 0x589ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005890000"
	        filename = ""

Region:
	              id = 1615
	        start_va = 0x6310000
	          end_va = 0x670ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006310000"
	        filename = ""

Region:
	              id = 1616
	        start_va = 0x73740000
	          end_va = 0x7375dfff
	     entry_point = 0x73740000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 1617
	        start_va = 0x37f0000
	          end_va = 0x37f3fff
	     entry_point = 0x37f0000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 1618
	        start_va = 0x4f10000
	          end_va = 0x4f4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f10000"
	        filename = ""

Region:
	              id = 1619
	        start_va = 0x58a0000
	          end_va = 0x5947fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058a0000"
	        filename = ""

Region:
	              id = 1620
	        start_va = 0x5e00000
	          end_va = 0x5e97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e00000"
	        filename = ""

Region:
	              id = 1621
	        start_va = 0x6710000
	          end_va = 0x690ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006710000"
	        filename = ""

Region:
	              id = 1622
	        start_va = 0x6910000
	          end_va = 0x6d0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006910000"
	        filename = ""

Region:
	              id = 1623
	        start_va = 0x6d10000
	          end_va = 0x6e51fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006d10000"
	        filename = ""

Region:
	              id = 1624
	        start_va = 0x6e60000
	          end_va = 0x765ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e60000"
	        filename = ""

Region:
	              id = 1625
	        start_va = 0x7660000
	          end_va = 0x7774fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007660000"
	        filename = ""

Region:
	              id = 1626
	        start_va = 0x7860000
	          end_va = 0x795ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007860000"
	        filename = ""

Region:
	              id = 1627
	        start_va = 0x7aa0000
	          end_va = 0x7b9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007aa0000"
	        filename = ""

Region:
	              id = 1628
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 1629
	        start_va = 0x7ef6e000
	          end_va = 0x7ef70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef6e000"
	        filename = ""

Region:
	              id = 1630
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 1631
	        start_va = 0x3800000
	          end_va = 0x3801fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003800000"
	        filename = ""

Region:
	              id = 1632
	        start_va = 0x3850000
	          end_va = 0x3850fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003850000"
	        filename = ""

Region:
	              id = 1633
	        start_va = 0x3860000
	          end_va = 0x3860fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003860000"
	        filename = ""

Region:
	              id = 1634
	        start_va = 0x4350000
	          end_va = 0x4397fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004350000"
	        filename = ""

Region:
	              id = 1635
	        start_va = 0x44b0000
	          end_va = 0x44fbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044b0000"
	        filename = ""

Region:
	              id = 1636
	        start_va = 0x7bb0000
	          end_va = 0x7caffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007bb0000"
	        filename = ""

Region:
	              id = 1637
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")

Region:
	              id = 1708
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")


Thread:
	id = 45
	os_tid = 0x788


Thread:
	id = 46
	os_tid = 0x510


Thread:
	id = 47
	os_tid = 0x6fc


Thread:
	id = 48
	os_tid = 0x528


Thread:
	id = 49
	os_tid = 0x4ec


Thread:
	id = 50
	os_tid = 0x1c8


Thread:
	id = 51
	os_tid = 0x62c


Thread:
	id = 52
	os_tid = 0x6c0


Thread:
	id = 53
	os_tid = 0x738


Thread:
	id = 55
	os_tid = 0x518


Thread:
	id = 56
	os_tid = 0x154


Thread:
	id = 57
	os_tid = 0x560


Thread:
	id = 58
	os_tid = 0x308


Thread:
	id = 91
	os_tid = 0x5f4


Thread:
	id = 92
	os_tid = 0x618


Thread:
	id = 93
	os_tid = 0x6a4


Thread:
	id = 94
	os_tid = 0x748


Thread:
	id = 95
	os_tid = 0xf0


Thread:
	id = 96
	os_tid = 0x804


Thread:
	id = 101
	os_tid = 0x838


Thread:
	id = 105
	os_tid = 0x848


Thread:
	id = 106
	os_tid = 0x84c


Thread:
	id = 107
	os_tid = 0x850


Thread:
	id = 108
	os_tid = 0x854


Thread:
	id = 109
	os_tid = 0x858


Thread:
	id = 120
	os_tid = 0x888


Thread:
	id = 156
	os_tid = 0x92c


Thread:
	id = 248
	os_tid = 0xb28


Thread:
	id = 409
	os_tid = 0xc94


Process:
	id = "6"
	image_name = "explorer.exe"
	filename = "c:\\windows\\explorer.exe"
	page_root = "0x767b000"
	os_pid = "0x458"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0x784"
	cmd_line = "C:\\Windows\\Explorer.EXE"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1093
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1094
	        start_va = 0x20000
	          end_va = 0x21fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1095
	        start_va = 0x30000
	          end_va = 0x33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1096
	        start_va = 0x40000
	          end_va = 0x41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1097
	        start_va = 0x50000
	          end_va = 0x56fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1098
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1099
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 1100
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 1101
	        start_va = 0x90000
	          end_va = 0x10ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000090000"
	        filename = ""

Region:
	              id = 1102
	        start_va = 0x110000
	          end_va = 0x176fff
	     entry_point = 0x110000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1103
	        start_va = 0x180000
	          end_va = 0x1bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 1104
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1105
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1106
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 1107
	        start_va = 0x1f0000
	          end_va = 0x1f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1108
	        start_va = 0x200000
	          end_va = 0x217fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1109
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 1110
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 1111
	        start_va = 0x330000
	          end_va = 0x42ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000330000"
	        filename = ""

Region:
	              id = 1112
	        start_va = 0x430000
	          end_va = 0x50efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000430000"
	        filename = ""

Region:
	              id = 1113
	        start_va = 0x510000
	          end_va = 0x510fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 1114
	        start_va = 0x520000
	          end_va = 0x52ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 1115
	        start_va = 0x530000
	          end_va = 0x6b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000530000"
	        filename = ""

Region:
	              id = 1116
	        start_va = 0x6c0000
	          end_va = 0x840fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006c0000"
	        filename = ""

Region:
	              id = 1117
	        start_va = 0x850000
	          end_va = 0x1c4ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000850000"
	        filename = ""

Region:
	              id = 1118
	        start_va = 0x1c50000
	          end_va = 0x2042fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001c50000"
	        filename = ""

Region:
	              id = 1119
	        start_va = 0x2050000
	          end_va = 0x206bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002050000"
	        filename = ""

Region:
	              id = 1120
	        start_va = 0x2070000
	          end_va = 0x2072fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002070000"
	        filename = ""

Region:
	              id = 1121
	        start_va = 0x2080000
	          end_va = 0x2084fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002080000"
	        filename = ""

Region:
	              id = 1122
	        start_va = 0x2090000
	          end_va = 0x2091fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002090000"
	        filename = ""

Region:
	              id = 1123
	        start_va = 0x20a0000
	          end_va = 0x20a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000020a0000"
	        filename = ""

Region:
	              id = 1124
	        start_va = 0x20b0000
	          end_va = 0x20b2fff
	     entry_point = 0x20b0000
	     region_type = mapped_file
	            name = "comctl32.dll.mui"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui")

Region:
	              id = 1125
	        start_va = 0x20c0000
	          end_va = 0x20c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020c0000"
	        filename = ""

Region:
	              id = 1126
	        start_va = 0x20d0000
	          end_va = 0x20ebfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020d0000"
	        filename = ""

Region:
	              id = 1127
	        start_va = 0x20f0000
	          end_va = 0x20f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020f0000"
	        filename = ""

Region:
	              id = 1128
	        start_va = 0x2100000
	          end_va = 0x2108fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002100000"
	        filename = ""

Region:
	              id = 1129
	        start_va = 0x2110000
	          end_va = 0x2117fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002110000"
	        filename = ""

Region:
	              id = 1130
	        start_va = 0x2120000
	          end_va = 0x213efff
	     entry_point = 0x2120000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 1131
	        start_va = 0x2140000
	          end_va = 0x2140fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002140000"
	        filename = ""

Region:
	              id = 1132
	        start_va = 0x2150000
	          end_va = 0x2153fff
	     entry_point = 0x2150000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1133
	        start_va = 0x2160000
	          end_va = 0x218ffff
	     entry_point = 0x2160000
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db")

Region:
	              id = 1134
	        start_va = 0x2190000
	          end_va = 0x219ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002190000"
	        filename = ""

Region:
	              id = 1135
	        start_va = 0x21a0000
	          end_va = 0x221ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021a0000"
	        filename = ""

Region:
	              id = 1136
	        start_va = 0x2220000
	          end_va = 0x229ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002220000"
	        filename = ""

Region:
	              id = 1137
	        start_va = 0x22a0000
	          end_va = 0x256efff
	     entry_point = 0x22a0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1138
	        start_va = 0x2570000
	          end_va = 0x25cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002570000"
	        filename = ""

Region:
	              id = 1139
	        start_va = 0x25d0000
	          end_va = 0x263bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000025d0000"
	        filename = ""

Region:
	              id = 1140
	        start_va = 0x2640000
	          end_va = 0x266ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002640000"
	        filename = ""

Region:
	              id = 1141
	        start_va = 0x2670000
	          end_va = 0x2670fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002670000"
	        filename = ""

Region:
	              id = 1142
	        start_va = 0x2680000
	          end_va = 0x268ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002680000"
	        filename = ""

Region:
	              id = 1143
	        start_va = 0x2690000
	          end_va = 0x269ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002690000"
	        filename = ""

Region:
	              id = 1144
	        start_va = 0x26a0000
	          end_va = 0x26affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026a0000"
	        filename = ""

Region:
	              id = 1145
	        start_va = 0x26b0000
	          end_va = 0x26bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026b0000"
	        filename = ""

Region:
	              id = 1146
	        start_va = 0x26c0000
	          end_va = 0x26cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026c0000"
	        filename = ""

Region:
	              id = 1147
	        start_va = 0x26d0000
	          end_va = 0x26dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026d0000"
	        filename = ""

Region:
	              id = 1148
	        start_va = 0x26e0000
	          end_va = 0x26effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026e0000"
	        filename = ""

Region:
	              id = 1149
	        start_va = 0x26f0000
	          end_va = 0x26fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026f0000"
	        filename = ""

Region:
	              id = 1150
	        start_va = 0x2700000
	          end_va = 0x270ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002700000"
	        filename = ""

Region:
	              id = 1151
	        start_va = 0x2710000
	          end_va = 0x271ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002710000"
	        filename = ""

Region:
	              id = 1152
	        start_va = 0x2720000
	          end_va = 0x281ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002720000"
	        filename = ""

Region:
	              id = 1153
	        start_va = 0x2820000
	          end_va = 0x291ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002820000"
	        filename = ""

Region:
	              id = 1154
	        start_va = 0x2920000
	          end_va = 0x292ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002920000"
	        filename = ""

Region:
	              id = 1155
	        start_va = 0x2930000
	          end_va = 0x2931fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002930000"
	        filename = ""

Region:
	              id = 1156
	        start_va = 0x2940000
	          end_va = 0x2940fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002940000"
	        filename = ""

Region:
	              id = 1157
	        start_va = 0x2950000
	          end_va = 0x295ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002950000"
	        filename = ""

Region:
	              id = 1158
	        start_va = 0x2960000
	          end_va = 0x2960fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002960000"
	        filename = ""

Region:
	              id = 1159
	        start_va = 0x2970000
	          end_va = 0x2973fff
	     entry_point = 0x2970000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1160
	        start_va = 0x2980000
	          end_va = 0x29c7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002980000"
	        filename = ""

Region:
	              id = 1161
	        start_va = 0x29d0000
	          end_va = 0x29d3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029d0000"
	        filename = ""

Region:
	              id = 1162
	        start_va = 0x29e0000
	          end_va = 0x29e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000029e0000"
	        filename = ""

Region:
	              id = 1163
	        start_va = 0x29f0000
	          end_va = 0x29f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000029f0000"
	        filename = ""

Region:
	              id = 1164
	        start_va = 0x2a00000
	          end_va = 0x2afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a00000"
	        filename = ""

Region:
	              id = 1165
	        start_va = 0x2b00000
	          end_va = 0x2bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b00000"
	        filename = ""

Region:
	              id = 1166
	        start_va = 0x2c00000
	          end_va = 0x2dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 1167
	        start_va = 0x2e00000
	          end_va = 0x3142fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e00000"
	        filename = ""

Region:
	              id = 1168
	        start_va = 0x3150000
	          end_va = 0x3151fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003150000"
	        filename = ""

Region:
	              id = 1169
	        start_va = 0x3160000
	          end_va = 0x3161fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003160000"
	        filename = ""

Region:
	              id = 1170
	        start_va = 0x3170000
	          end_va = 0x3173fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003170000"
	        filename = ""

Region:
	              id = 1171
	        start_va = 0x3180000
	          end_va = 0x3183fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003180000"
	        filename = ""

Region:
	              id = 1172
	        start_va = 0x3190000
	          end_va = 0x320ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003190000"
	        filename = ""

Region:
	              id = 1173
	        start_va = 0x3210000
	          end_va = 0x3211fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003210000"
	        filename = ""

Region:
	              id = 1174
	        start_va = 0x3220000
	          end_va = 0x3220fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003220000"
	        filename = ""

Region:
	              id = 1175
	        start_va = 0x3230000
	          end_va = 0x3230fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003230000"
	        filename = ""

Region:
	              id = 1176
	        start_va = 0x3240000
	          end_va = 0x3240fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003240000"
	        filename = ""

Region:
	              id = 1177
	        start_va = 0x3250000
	          end_va = 0x32cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003250000"
	        filename = ""

Region:
	              id = 1178
	        start_va = 0x32d0000
	          end_va = 0x3335fff
	     entry_point = 0x32d0000
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 1179
	        start_va = 0x3340000
	          end_va = 0x3340fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003340000"
	        filename = ""

Region:
	              id = 1180
	        start_va = 0x3350000
	          end_va = 0x33cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003350000"
	        filename = ""

Region:
	              id = 1181
	        start_va = 0x33d0000
	          end_va = 0x33d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033d0000"
	        filename = ""

Region:
	              id = 1182
	        start_va = 0x33e0000
	          end_va = 0x33e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033e0000"
	        filename = ""

Region:
	              id = 1183
	        start_va = 0x33f0000
	          end_va = 0x33f3fff
	     entry_point = 0x33f0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1184
	        start_va = 0x3400000
	          end_va = 0x3401fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003400000"
	        filename = ""

Region:
	              id = 1185
	        start_va = 0x3410000
	          end_va = 0x3410fff
	     entry_point = 0x3410000
	     region_type = mapped_file
	            name = "{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db")

Region:
	              id = 1186
	        start_va = 0x3420000
	          end_va = 0x3423fff
	     entry_point = 0x3420000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1187
	        start_va = 0x3430000
	          end_va = 0x3430fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003430000"
	        filename = ""

Region:
	              id = 1188
	        start_va = 0x3440000
	          end_va = 0x34bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003440000"
	        filename = ""

Region:
	              id = 1189
	        start_va = 0x34c0000
	          end_va = 0x34c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034c0000"
	        filename = ""

Region:
	              id = 1190
	        start_va = 0x34d0000
	          end_va = 0x34d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034d0000"
	        filename = ""

Region:
	              id = 1191
	        start_va = 0x34e0000
	          end_va = 0x34e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034e0000"
	        filename = ""

Region:
	              id = 1192
	        start_va = 0x34f0000
	          end_va = 0x356ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034f0000"
	        filename = ""

Region:
	              id = 1193
	        start_va = 0x3570000
	          end_va = 0x3570fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003570000"
	        filename = ""

Region:
	              id = 1194
	        start_va = 0x3580000
	          end_va = 0x35fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003580000"
	        filename = ""

Region:
	              id = 1195
	        start_va = 0x3600000
	          end_va = 0x3600fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003600000"
	        filename = ""

Region:
	              id = 1196
	        start_va = 0x3610000
	          end_va = 0x3610fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003610000"
	        filename = ""

Region:
	              id = 1197
	        start_va = 0x3620000
	          end_va = 0x3620fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003620000"
	        filename = ""

Region:
	              id = 1198
	        start_va = 0x3630000
	          end_va = 0x3630fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003630000"
	        filename = ""

Region:
	              id = 1199
	        start_va = 0x3640000
	          end_va = 0x3640fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003640000"
	        filename = ""

Region:
	              id = 1200
	        start_va = 0x3650000
	          end_va = 0x3650fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003650000"
	        filename = ""

Region:
	              id = 1201
	        start_va = 0x3660000
	          end_va = 0x366ffff
	     entry_point = 0x3660000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 1202
	        start_va = 0x3670000
	          end_va = 0x3677fff
	     entry_point = 0x3670000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 1203
	        start_va = 0x3680000
	          end_va = 0x3680fff
	     entry_point = 0x3680000
	     region_type = mapped_file
	            name = "{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db")

Region:
	              id = 1204
	        start_va = 0x3690000
	          end_va = 0x3693fff
	     entry_point = 0x3690000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1205
	        start_va = 0x36a0000
	          end_va = 0x36a0fff
	     entry_point = 0x36a0000
	     region_type = mapped_file
	            name = "{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db")

Region:
	              id = 1206
	        start_va = 0x36b0000
	          end_va = 0x36b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000036b0000"
	        filename = ""

Region:
	              id = 1207
	        start_va = 0x36c0000
	          end_va = 0x373ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036c0000"
	        filename = ""

Region:
	              id = 1208
	        start_va = 0x3740000
	          end_va = 0x37bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003740000"
	        filename = ""

Region:
	              id = 1209
	        start_va = 0x37c0000
	          end_va = 0x40effff
	     entry_point = 0x37c0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 1210
	        start_va = 0x40f0000
	          end_va = 0x40f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000040f0000"
	        filename = ""

Region:
	              id = 1211
	        start_va = 0x4100000
	          end_va = 0x4101fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004100000"
	        filename = ""

Region:
	              id = 1212
	        start_va = 0x4110000
	          end_va = 0x4113fff
	     entry_point = 0x4110000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1213
	        start_va = 0x4120000
	          end_va = 0x4120fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004120000"
	        filename = ""

Region:
	              id = 1214
	        start_va = 0x4130000
	          end_va = 0x4131fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004130000"
	        filename = ""

Region:
	              id = 1215
	        start_va = 0x4140000
	          end_va = 0x4140fff
	     entry_point = 0x4140000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctf.dll.mui")

Region:
	              id = 1216
	        start_va = 0x4150000
	          end_va = 0x4150fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004150000"
	        filename = ""

Region:
	              id = 1217
	        start_va = 0x4160000
	          end_va = 0x416ffff
	     entry_point = 0x4160000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019010520190106\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019010520190106\\index.dat")

Region:
	              id = 1218
	        start_va = 0x4170000
	          end_va = 0x41effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004170000"
	        filename = ""

Region:
	              id = 1219
	        start_va = 0x41f0000
	          end_va = 0x41f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000041f0000"
	        filename = ""

Region:
	              id = 1220
	        start_va = 0x4200000
	          end_va = 0x4200fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004200000"
	        filename = ""

Region:
	              id = 1221
	        start_va = 0x4210000
	          end_va = 0x425ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004210000"
	        filename = ""

Region:
	              id = 1222
	        start_va = 0x4260000
	          end_va = 0x4260fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004260000"
	        filename = ""

Region:
	              id = 1223
	        start_va = 0x4270000
	          end_va = 0x4271fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004270000"
	        filename = ""

Region:
	              id = 1224
	        start_va = 0x4280000
	          end_va = 0x4281fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004280000"
	        filename = ""

Region:
	              id = 1225
	        start_va = 0x4290000
	          end_va = 0x4290fff
	     entry_point = 0x4290000
	     region_type = mapped_file
	            name = "wdmaud.drv.mui"
	        filename = "\\Windows\\System32\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\system32\\en-us\\wdmaud.drv.mui")

Region:
	              id = 1226
	        start_va = 0x42a0000
	          end_va = 0x431ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000042a0000"
	        filename = ""

Region:
	              id = 1227
	        start_va = 0x4320000
	          end_va = 0x439ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004320000"
	        filename = ""

Region:
	              id = 1228
	        start_va = 0x43a0000
	          end_va = 0x43a0fff
	     entry_point = 0x43a0000
	     region_type = mapped_file
	            name = "mmdevapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui")

Region:
	              id = 1229
	        start_va = 0x43b0000
	          end_va = 0x43b1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000043b0000"
	        filename = ""

Region:
	              id = 1230
	        start_va = 0x43c0000
	          end_va = 0x43c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000043c0000"
	        filename = ""

Region:
	              id = 1231
	        start_va = 0x43d0000
	          end_va = 0x444ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000043d0000"
	        filename = ""

Region:
	              id = 1232
	        start_va = 0x4450000
	          end_va = 0x4450fff
	     entry_point = 0x4450000
	     region_type = mapped_file
	            name = "thumbcache_32.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")

Region:
	              id = 1233
	        start_va = 0x4460000
	          end_va = 0x4460fff
	     entry_point = 0x4460000
	     region_type = mapped_file
	            name = "thumbcache_96.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")

Region:
	              id = 1234
	        start_va = 0x4470000
	          end_va = 0x4470fff
	     entry_point = 0x4470000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll")

Region:
	              id = 1235
	        start_va = 0x4480000
	          end_va = 0x4481fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004480000"
	        filename = ""

Region:
	              id = 1236
	        start_va = 0x4490000
	          end_va = 0x4496fff
	     entry_point = 0x4490000
	     region_type = mapped_file
	            name = "bthprops.cpl.mui"
	        filename = "\\Windows\\System32\\en-US\\bthprops.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\bthprops.cpl.mui")

Region:
	              id = 1237
	        start_va = 0x44a0000
	          end_va = 0x44a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000044a0000"
	        filename = ""

Region:
	              id = 1238
	        start_va = 0x44b0000
	          end_va = 0x44e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044b0000"
	        filename = ""

Region:
	              id = 1239
	        start_va = 0x44f0000
	          end_va = 0x44f2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044f0000"
	        filename = ""

Region:
	              id = 1240
	        start_va = 0x4500000
	          end_va = 0x4500fff
	     entry_point = 0x4500000
	     region_type = mapped_file
	            name = "thumbcache_1024.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")

Region:
	              id = 1241
	        start_va = 0x4510000
	          end_va = 0x4510fff
	     entry_point = 0x4510000
	     region_type = mapped_file
	            name = "thumbcache_sr.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")

Region:
	              id = 1242
	        start_va = 0x4520000
	          end_va = 0x4521fff
	     entry_point = 0x4520000
	     region_type = mapped_file
	            name = "msutb.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\msutb.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msutb.dll.mui")

Region:
	              id = 1243
	        start_va = 0x4530000
	          end_va = 0x4530fff
	     entry_point = 0x4530000
	     region_type = mapped_file
	            name = "thumbcache_idx.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")

Region:
	              id = 1244
	        start_va = 0x4540000
	          end_va = 0x45bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004540000"
	        filename = ""

Region:
	              id = 1245
	        start_va = 0x45e0000
	          end_va = 0x45e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000045e0000"
	        filename = ""

Region:
	              id = 1246
	        start_va = 0x45f0000
	          end_va = 0x466ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045f0000"
	        filename = ""

Region:
	              id = 1247
	        start_va = 0x4670000
	          end_va = 0x4670fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004670000"
	        filename = ""

Region:
	              id = 1248
	        start_va = 0x4680000
	          end_va = 0x4680fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004680000"
	        filename = ""

Region:
	              id = 1249
	        start_va = 0x4690000
	          end_va = 0x4690fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004690000"
	        filename = ""

Region:
	              id = 1250
	        start_va = 0x46a0000
	          end_va = 0x471ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046a0000"
	        filename = ""

Region:
	              id = 1251
	        start_va = 0x4720000
	          end_va = 0x4720fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004720000"
	        filename = ""

Region:
	              id = 1252
	        start_va = 0x4730000
	          end_va = 0x4730fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004730000"
	        filename = ""

Region:
	              id = 1253
	        start_va = 0x4740000
	          end_va = 0x4741fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004740000"
	        filename = ""

Region:
	              id = 1254
	        start_va = 0x4750000
	          end_va = 0x4751fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004750000"
	        filename = ""

Region:
	              id = 1255
	        start_va = 0x4800000
	          end_va = 0x49fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004800000"
	        filename = ""

Region:
	              id = 1256
	        start_va = 0x4a20000
	          end_va = 0x4a9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a20000"
	        filename = ""

Region:
	              id = 1257
	        start_va = 0x4aa0000
	          end_va = 0x4ea2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004aa0000"
	        filename = ""

Region:
	              id = 1258
	        start_va = 0x4ec0000
	          end_va = 0x4f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ec0000"
	        filename = ""

Region:
	              id = 1259
	        start_va = 0x4f60000
	          end_va = 0x4fdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f60000"
	        filename = ""

Region:
	              id = 1260
	        start_va = 0x4fe0000
	          end_va = 0x50dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fe0000"
	        filename = ""

Region:
	              id = 1261
	        start_va = 0x5110000
	          end_va = 0x518ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005110000"
	        filename = ""

Region:
	              id = 1262
	        start_va = 0x5190000
	          end_va = 0x51a3fff
	     entry_point = 0x5190000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 1263
	        start_va = 0x51b0000
	          end_va = 0x51b4fff
	     entry_point = 0x51b0000
	     region_type = mapped_file
	            name = "actioncenter.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\ActionCenter.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\actioncenter.dll.mui")

Region:
	              id = 1264
	        start_va = 0x51c0000
	          end_va = 0x51cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051c0000"
	        filename = ""

Region:
	              id = 1265
	        start_va = 0x52c0000
	          end_va = 0x6614fff
	     entry_point = 0x52c0000
	     region_type = mapped_file
	            name = "imageres.dll"
	        filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll")

Region:
	              id = 1266
	        start_va = 0x6620000
	          end_va = 0x669ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006620000"
	        filename = ""

Region:
	              id = 1267
	        start_va = 0x66d0000
	          end_va = 0x674ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000066d0000"
	        filename = ""

Region:
	              id = 1268
	        start_va = 0x6750000
	          end_va = 0x67cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006750000"
	        filename = ""

Region:
	              id = 1269
	        start_va = 0x67d0000
	          end_va = 0x680ffff
	     entry_point = 0x67d0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")

Region:
	              id = 1270
	        start_va = 0x6890000
	          end_va = 0x698ffff
	     entry_point = 0x6890000
	     region_type = mapped_file
	            name = "thumbcache_256.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")

Region:
	              id = 1271
	        start_va = 0x69b0000
	          end_va = 0x69bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000069b0000"
	        filename = ""

Region:
	              id = 1272
	        start_va = 0x6ac0000
	          end_va = 0x6b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ac0000"
	        filename = ""

Region:
	              id = 1273
	        start_va = 0x6b50000
	          end_va = 0x6bcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006b50000"
	        filename = ""

Region:
	              id = 1274
	        start_va = 0x6c20000
	          end_va = 0x6c9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006c20000"
	        filename = ""

Region:
	              id = 1275
	        start_va = 0x6ce0000
	          end_va = 0x6d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ce0000"
	        filename = ""

Region:
	              id = 1276
	        start_va = 0x6e00000
	          end_va = 0x6e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e00000"
	        filename = ""

Region:
	              id = 1277
	        start_va = 0x6ec0000
	          end_va = 0x6ecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ec0000"
	        filename = ""

Region:
	              id = 1278
	        start_va = 0x6f80000
	          end_va = 0x6f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f80000"
	        filename = ""

Region:
	              id = 1279
	        start_va = 0x6f90000
	          end_va = 0x704ffff
	     entry_point = 0x6f90000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1280
	        start_va = 0x7060000
	          end_va = 0x70dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007060000"
	        filename = ""

Region:
	              id = 1281
	        start_va = 0x7180000
	          end_va = 0x71fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007180000"
	        filename = ""

Region:
	              id = 1282
	        start_va = 0x7290000
	          end_va = 0x730ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007290000"
	        filename = ""

Region:
	              id = 1283
	        start_va = 0x73f0000
	          end_va = 0x746ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000073f0000"
	        filename = ""

Region:
	              id = 1284
	        start_va = 0x75d0000
	          end_va = 0x764ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000075d0000"
	        filename = ""

Region:
	              id = 1285
	        start_va = 0x7650000
	          end_va = 0x7a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007650000"
	        filename = ""

Region:
	              id = 1286
	        start_va = 0x73730000
	          end_va = 0x73735fff
	     entry_point = 0x73730000
	     region_type = mapped_file
	            name = "ksuser.dll"
	        filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll")

Region:
	              id = 1287
	        start_va = 0x73e70000
	          end_va = 0x73e9efff
	     entry_point = 0x73e70000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895\\atl90.dll")

Region:
	              id = 1288
	        start_va = 0x73ea0000
	          end_va = 0x73f72fff
	     entry_point = 0x73ea0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcp90.dll")

Region:
	              id = 1289
	        start_va = 0x73f80000
	          end_va = 0x74022fff
	     entry_point = 0x73f80000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcr90.dll")

Region:
	              id = 1290
	        start_va = 0x752a0000
	          end_va = 0x75382fff
	     entry_point = 0x752a0000
	     region_type = mapped_file
	            name = "fxsresm.dll"
	        filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll")

Region:
	              id = 1291
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x77450000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1292
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x77550000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1293
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1294
	        start_va = 0x77830000
	          end_va = 0x77836fff
	     entry_point = 0x77830000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")

Region:
	              id = 1295
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1296
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1297
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1298
	        start_va = 0xffff0000
	          end_va = 0x1002affff
	     entry_point = 0xffff0000
	     region_type = mapped_file
	            name = "explorer.exe"
	        filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe")

Region:
	              id = 1299
	        start_va = 0x7fef01e0000
	          end_va = 0x7fef0252fff
	     entry_point = 0x7fef01e0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll")

Region:
	              id = 1300
	        start_va = 0x7fef0260000
	          end_va = 0x7fef026afff
	     entry_point = 0x7fef0260000
	     region_type = mapped_file
	            name = "hcproviders.dll"
	        filename = "\\Windows\\System32\\hcproviders.dll" (normalized: "c:\\windows\\system32\\hcproviders.dll")

Region:
	              id = 1301
	        start_va = 0x7fef0270000
	          end_va = 0x7fef0288fff
	     entry_point = 0x7fef0270000
	     region_type = mapped_file
	            name = "wercplsupport.dll"
	        filename = "\\Windows\\System32\\wercplsupport.dll" (normalized: "c:\\windows\\system32\\wercplsupport.dll")

Region:
	              id = 1302
	        start_va = 0x7fef0290000
	          end_va = 0x7fef02dbfff
	     entry_point = 0x7fef0290000
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll")

Region:
	              id = 1303
	        start_va = 0x7fef02e0000
	          end_va = 0x7fef041bfff
	     entry_point = 0x7fef02e0000
	     region_type = mapped_file
	            name = "werconcpl.dll"
	        filename = "\\Windows\\System32\\werconcpl.dll" (normalized: "c:\\windows\\system32\\werconcpl.dll")

Region:
	              id = 1304
	        start_va = 0x7fef0420000
	          end_va = 0x7fef053efff
	     entry_point = 0x7fef0420000
	     region_type = mapped_file
	            name = "wscui.cpl"
	        filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl")

Region:
	              id = 1305
	        start_va = 0x7fef0540000
	          end_va = 0x7fef0567fff
	     entry_point = 0x7fef0540000
	     region_type = mapped_file
	            name = "wscinterop.dll"
	        filename = "\\Windows\\System32\\wscinterop.dll" (normalized: "c:\\windows\\system32\\wscinterop.dll")

Region:
	              id = 1306
	        start_va = 0x7fef0940000
	          end_va = 0x7fef0952fff
	     entry_point = 0x7fef0940000
	     region_type = mapped_file
	            name = "wscapi.dll"
	        filename = "\\Windows\\System32\\wscapi.dll" (normalized: "c:\\windows\\system32\\wscapi.dll")

Region:
	              id = 1307
	        start_va = 0x7fef4d30000
	          end_va = 0x7fef4e06fff
	     entry_point = 0x7fef4d30000
	     region_type = mapped_file
	            name = "fxsst.dll"
	        filename = "\\Windows\\System32\\FXSST.dll" (normalized: "c:\\windows\\system32\\fxsst.dll")

Region:
	              id = 1308
	        start_va = 0x7fef4e10000
	          end_va = 0x7fef4e40fff
	     entry_point = 0x7fef4e10000
	     region_type = mapped_file
	            name = "provsvc.dll"
	        filename = "\\Windows\\System32\\provsvc.dll" (normalized: "c:\\windows\\system32\\provsvc.dll")

Region:
	              id = 1309
	        start_va = 0x7fef4e50000
	          end_va = 0x7fef4ea4fff
	     entry_point = 0x7fef4e50000
	     region_type = mapped_file
	            name = "hgcpl.dll"
	        filename = "\\Windows\\System32\\hgcpl.dll" (normalized: "c:\\windows\\system32\\hgcpl.dll")

Region:
	              id = 1310
	        start_va = 0x7fef4eb0000
	          end_va = 0x7fef4f2efff
	     entry_point = 0x7fef4eb0000
	     region_type = mapped_file
	            name = "imapi2.dll"
	        filename = "\\Windows\\System32\\imapi2.dll" (normalized: "c:\\windows\\system32\\imapi2.dll")

Region:
	              id = 1311
	        start_va = 0x7fef4f30000
	          end_va = 0x7fef4ff1fff
	     entry_point = 0x7fef4f30000
	     region_type = mapped_file
	            name = "actioncenter.dll"
	        filename = "\\Windows\\System32\\ActionCenter.dll" (normalized: "c:\\windows\\system32\\actioncenter.dll")

Region:
	              id = 1312
	        start_va = 0x7fef5000000
	          end_va = 0x7fef522afff
	     entry_point = 0x7fef5000000
	     region_type = mapped_file
	            name = "synccenter.dll"
	        filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll")

Region:
	              id = 1313
	        start_va = 0x7fef5230000
	          end_va = 0x7fef5283fff
	     entry_point = 0x7fef5230000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll")

Region:
	              id = 1314
	        start_va = 0x7fef5290000
	          end_va = 0x7fef5e46fff
	     entry_point = 0x7fef5290000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll")

Region:
	              id = 1315
	        start_va = 0x7fef5e50000
	          end_va = 0x7fef5f04fff
	     entry_point = 0x7fef5e50000
	     region_type = mapped_file
	            name = "bthprops.cpl"
	        filename = "\\Windows\\System32\\bthprops.cpl" (normalized: "c:\\windows\\system32\\bthprops.cpl")

Region:
	              id = 1316
	        start_va = 0x7fef5f10000
	          end_va = 0x7fef5f67fff
	     entry_point = 0x7fef5f10000
	     region_type = mapped_file
	            name = "srchadmin.dll"
	        filename = "\\Windows\\System32\\srchadmin.dll" (normalized: "c:\\windows\\system32\\srchadmin.dll")

Region:
	              id = 1317
	        start_va = 0x7fef5f70000
	          end_va = 0x7fef5fb4fff
	     entry_point = 0x7fef5f70000
	     region_type = mapped_file
	            name = "qagent.dll"
	        filename = "\\Windows\\System32\\QAGENT.DLL" (normalized: "c:\\windows\\system32\\qagent.dll")

Region:
	              id = 1318
	        start_va = 0x7fef5fc0000
	          end_va = 0x7fef5fccfff
	     entry_point = 0x7fef5fc0000
	     region_type = mapped_file
	            name = "wwapi.dll"
	        filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll")

Region:
	              id = 1319
	        start_va = 0x7fef5fd0000
	          end_va = 0x7fef602dfff
	     entry_point = 0x7fef5fd0000
	     region_type = mapped_file
	            name = "wwanapi.dll"
	        filename = "\\Windows\\System32\\WWanAPI.dll" (normalized: "c:\\windows\\system32\\wwanapi.dll")

Region:
	              id = 1320
	        start_va = 0x7fef6030000
	          end_va = 0x7fef6036fff
	     entry_point = 0x7fef6030000
	     region_type = mapped_file
	            name = "wlanutil.dll"
	        filename = "\\Windows\\System32\\wlanutil.dll" (normalized: "c:\\windows\\system32\\wlanutil.dll")

Region:
	              id = 1321
	        start_va = 0x7fef6040000
	          end_va = 0x7fef605ffff
	     entry_point = 0x7fef6040000
	     region_type = mapped_file
	            name = "wlanapi.dll"
	        filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")

Region:
	              id = 1322
	        start_va = 0x7fef6060000
	          end_va = 0x7fef609efff
	     entry_point = 0x7fef6060000
	     region_type = mapped_file
	            name = "cscobj.dll"
	        filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll")

Region:
	              id = 1323
	        start_va = 0x7fef6270000
	          end_va = 0x7fef628efff
	     entry_point = 0x7fef6270000
	     region_type = mapped_file
	            name = "qutil.dll"
	        filename = "\\Windows\\System32\\QUTIL.DLL" (normalized: "c:\\windows\\system32\\qutil.dll")

Region:
	              id = 1324
	        start_va = 0x7fef6290000
	          end_va = 0x7fef644cfff
	     entry_point = 0x7fef6290000
	     region_type = mapped_file
	            name = "pnidui.dll"
	        filename = "\\Windows\\System32\\pnidui.dll" (normalized: "c:\\windows\\system32\\pnidui.dll")

Region:
	              id = 1325
	        start_va = 0x7fef6450000
	          end_va = 0x7fef6488fff
	     entry_point = 0x7fef6450000
	     region_type = mapped_file
	            name = "portabledevicetypes.dll"
	        filename = "\\Windows\\System32\\PortableDeviceTypes.dll" (normalized: "c:\\windows\\system32\\portabledevicetypes.dll")

Region:
	              id = 1326
	        start_va = 0x7fef6490000
	          end_va = 0x7fef64affff
	     entry_point = 0x7fef6490000
	     region_type = mapped_file
	            name = "wpdshserviceobj.dll"
	        filename = "\\Windows\\System32\\WPDShServiceObj.dll" (normalized: "c:\\windows\\system32\\wpdshserviceobj.dll")

Region:
	              id = 1327
	        start_va = 0x7fef64b0000
	          end_va = 0x7fef64bffff
	     entry_point = 0x7fef64b0000
	     region_type = mapped_file
	            name = "alttab.dll"
	        filename = "\\Windows\\System32\\AltTab.dll" (normalized: "c:\\windows\\system32\\alttab.dll")

Region:
	              id = 1328
	        start_va = 0x7fef64c0000
	          end_va = 0x7fef674afff
	     entry_point = 0x7fef64c0000
	     region_type = mapped_file
	            name = "netshell.dll"
	        filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll")

Region:
	              id = 1329
	        start_va = 0x7fef6750000
	          end_va = 0x7fef67c3fff
	     entry_point = 0x7fef6750000
	     region_type = mapped_file
	            name = "dxp.dll"
	        filename = "\\Windows\\System32\\DXP.dll" (normalized: "c:\\windows\\system32\\dxp.dll")

Region:
	              id = 1330
	        start_va = 0x7fef67d0000
	          end_va = 0x7fef6840fff
	     entry_point = 0x7fef67d0000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")

Region:
	              id = 1331
	        start_va = 0x7fef6850000
	          end_va = 0x7fef6909fff
	     entry_point = 0x7fef6850000
	     region_type = mapped_file
	            name = "batmeter.dll"
	        filename = "\\Windows\\System32\\batmeter.dll" (normalized: "c:\\windows\\system32\\batmeter.dll")

Region:
	              id = 1332
	        start_va = 0x7fef6910000
	          end_va = 0x7fef69d5fff
	     entry_point = 0x7fef6910000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll")

Region:
	              id = 1333
	        start_va = 0x7fef6a40000
	          end_va = 0x7fef6a60fff
	     entry_point = 0x7fef6a40000
	     region_type = mapped_file
	            name = "uianimation.dll"
	        filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll")

Region:
	              id = 1334
	        start_va = 0x7fef6a70000
	          end_va = 0x7fef6b2cfff
	     entry_point = 0x7fef6a70000
	     region_type = mapped_file
	            name = "portabledeviceapi.dll"
	        filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll")

Region:
	              id = 1335
	        start_va = 0x7fef7ee0000
	          end_va = 0x7fef7ee8fff
	     entry_point = 0x7fef7ee0000
	     region_type = mapped_file
	            name = "midimap.dll"
	        filename = "\\Windows\\System32\\midimap.dll" (normalized: "c:\\windows\\system32\\midimap.dll")

Region:
	              id = 1336
	        start_va = 0x7fef7ef0000
	          end_va = 0x7fef7f07fff
	     entry_point = 0x7fef7ef0000
	     region_type = mapped_file
	            name = "msacm32.dll"
	        filename = "\\Windows\\System32\\msacm32.dll" (normalized: "c:\\windows\\system32\\msacm32.dll")

Region:
	              id = 1337
	        start_va = 0x7fef7f10000
	          end_va = 0x7fef7f19fff
	     entry_point = 0x7fef7f10000
	     region_type = mapped_file
	            name = "msacm32.drv"
	        filename = "\\Windows\\System32\\msacm32.drv" (normalized: "c:\\windows\\system32\\msacm32.drv")

Region:
	              id = 1338
	        start_va = 0x7fef7ff0000
	          end_va = 0x7fef803efff
	     entry_point = 0x7fef7ff0000
	     region_type = mapped_file
	            name = "audioses.dll"
	        filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll")

Region:
	              id = 1339
	        start_va = 0x7fef8040000
	          end_va = 0x7fef807afff
	     entry_point = 0x7fef8040000
	     region_type = mapped_file
	            name = "wdmaud.drv"
	        filename = "\\Windows\\System32\\wdmaud.drv" (normalized: "c:\\windows\\system32\\wdmaud.drv")

Region:
	              id = 1340
	        start_va = 0x7fef8080000
	          end_va = 0x7fef80bafff
	     entry_point = 0x7fef8080000
	     region_type = mapped_file
	            name = "winmm.dll"
	        filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll")

Region:
	              id = 1341
	        start_va = 0x7fef80c0000
	          end_va = 0x7fef825bfff
	     entry_point = 0x7fef80c0000
	     region_type = mapped_file
	            name = "networkexplorer.dll"
	        filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll")

Region:
	              id = 1342
	        start_va = 0x7fef8280000
	          end_va = 0x7fef82fefff
	     entry_point = 0x7fef8280000
	     region_type = mapped_file
	            name = "tiptsf.dll"
	        filename = "\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")

Region:
	              id = 1343
	        start_va = 0x7fef8300000
	          end_va = 0x7fef833afff
	     entry_point = 0x7fef8300000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\System32\\msls31.dll" (normalized: "c:\\windows\\system32\\msls31.dll")

Region:
	              id = 1344
	        start_va = 0x7fef8340000
	          end_va = 0x7fef834afff
	     entry_point = 0x7fef8340000
	     region_type = mapped_file
	            name = "ehsso.dll"
	        filename = "\\Windows\\ehome\\ehSSO.dll" (normalized: "c:\\windows\\ehome\\ehsso.dll")

Region:
	              id = 1345
	        start_va = 0x7fef8350000
	          end_va = 0x7fef83b8fff
	     entry_point = 0x7fef8350000
	     region_type = mapped_file
	            name = "prnfldr.dll"
	        filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll")

Region:
	              id = 1346
	        start_va = 0x7fef83c0000
	          end_va = 0x7fef8402fff
	     entry_point = 0x7fef83c0000
	     region_type = mapped_file
	            name = "stobject.dll"
	        filename = "\\Windows\\System32\\stobject.dll" (normalized: "c:\\windows\\system32\\stobject.dll")

Region:
	              id = 1347
	        start_va = 0x7fef8410000
	          end_va = 0x7fef8725fff
	     entry_point = 0x7fef8410000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 1348
	        start_va = 0x7fef8730000
	          end_va = 0x7fef8738fff
	     entry_point = 0x7fef8730000
	     region_type = mapped_file
	            name = "msiltcfg.dll"
	        filename = "\\Windows\\System32\\msiltcfg.dll" (normalized: "c:\\windows\\system32\\msiltcfg.dll")

Region:
	              id = 1349
	        start_va = 0x7fef8740000
	          end_va = 0x7fef87bbfff
	     entry_point = 0x7fef8740000
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")

Region:
	              id = 1350
	        start_va = 0x7fef87c0000
	          end_va = 0x7fef8a62fff
	     entry_point = 0x7fef87c0000
	     region_type = mapped_file
	            name = "gameux.dll"
	        filename = "\\Windows\\System32\\gameux.dll" (normalized: "c:\\windows\\system32\\gameux.dll")

Region:
	              id = 1351
	        start_va = 0x7fef8a70000
	          end_va = 0x7fef8a7bfff
	     entry_point = 0x7fef8a70000
	     region_type = mapped_file
	            name = "linkinfo.dll"
	        filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll")

Region:
	              id = 1352
	        start_va = 0x7fef8a80000
	          end_va = 0x7fef8ab3fff
	     entry_point = 0x7fef8a80000
	     region_type = mapped_file
	            name = "shdocvw.dll"
	        filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll")

Region:
	              id = 1353
	        start_va = 0x7fef8ac0000
	          end_va = 0x7fef8badfff
	     entry_point = 0x7fef8ac0000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 1354
	        start_va = 0x7fef8bb0000
	          end_va = 0x7fef8becfff
	     entry_point = 0x7fef8bb0000
	     region_type = mapped_file
	            name = "msutb.dll"
	        filename = "\\Windows\\System32\\msutb.dll" (normalized: "c:\\windows\\system32\\msutb.dll")

Region:
	              id = 1355
	        start_va = 0x7fef8c00000
	          end_va = 0x7fef8c82fff
	     entry_point = 0x7fef8c00000
	     region_type = mapped_file
	            name = "timedate.cpl"
	        filename = "\\Windows\\System32\\timedate.cpl" (normalized: "c:\\windows\\system32\\timedate.cpl")

Region:
	              id = 1356
	        start_va = 0x7fef8ed0000
	          end_va = 0x7fef8eeefff
	     entry_point = 0x7fef8ed0000
	     region_type = mapped_file
	            name = "thumbcache.dll"
	        filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll")

Region:
	              id = 1357
	        start_va = 0x7fef8f00000
	          end_va = 0x7fef8f3afff
	     entry_point = 0x7fef8f00000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll")

Region:
	              id = 1358
	        start_va = 0x7fef9050000
	          end_va = 0x7fef9057fff
	     entry_point = 0x7fef9050000
	     region_type = mapped_file
	            name = "iconcodecservice.dll"
	        filename = "\\Windows\\System32\\IconCodecService.dll" (normalized: "c:\\windows\\system32\\iconcodecservice.dll")

Region:
	              id = 1359
	        start_va = 0x7fef9060000
	          end_va = 0x7fef90dffff
	     entry_point = 0x7fef9060000
	     region_type = mapped_file
	            name = "ntshrui.dll"
	        filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll")

Region:
	              id = 1360
	        start_va = 0x7fef90e0000
	          end_va = 0x7fef90eefff
	     entry_point = 0x7fef90e0000
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 1361
	        start_va = 0x7fef90f0000
	          end_va = 0x7fef90fbfff
	     entry_point = 0x7fef90f0000
	     region_type = mapped_file
	            name = "cscdll.dll"
	        filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll")

Region:
	              id = 1362
	        start_va = 0x7fef9100000
	          end_va = 0x7fef917dfff
	     entry_point = 0x7fef9100000
	     region_type = mapped_file
	            name = "cscui.dll"
	        filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll")

Region:
	              id = 1363
	        start_va = 0x7fef9180000
	          end_va = 0x7fef99e3fff
	     entry_point = 0x7fef9180000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~1\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~1\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 1364
	        start_va = 0x7fef99f0000
	          end_va = 0x7fef9e09fff
	     entry_point = 0x7fef99f0000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~1\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~1\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 1365
	        start_va = 0x7fef9e10000
	          end_va = 0x7fefa480fff
	     entry_point = 0x7fef9e10000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\PROGRA~1\\MICROS~1\\Office14\\GROOVEEX.DLL" (normalized: "c:\\progra~1\\micros~1\\office14\\grooveex.dll")

Region:
	              id = 1366
	        start_va = 0x7fefa490000
	          end_va = 0x7fefa4c4fff
	     entry_point = 0x7fefa490000
	     region_type = mapped_file
	            name = "ehstorshell.dll"
	        filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll")

Region:
	              id = 1367
	        start_va = 0x7fefa4d0000
	          end_va = 0x7fefa526fff
	     entry_point = 0x7fefa4d0000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 1368
	        start_va = 0x7fefa530000
	          end_va = 0x7fefa6f9fff
	     entry_point = 0x7fefa530000
	     region_type = mapped_file
	            name = "explorerframe.dll"
	        filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll")

Region:
	              id = 1369
	        start_va = 0x7fefaaa0000
	          end_va = 0x7fefaab7fff
	     entry_point = 0x7fefaaa0000
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")

Region:
	              id = 1370
	        start_va = 0x7fefaac0000
	          end_va = 0x7fefaad5fff
	     entry_point = 0x7fefaac0000
	     region_type = mapped_file
	            name = "syncreg.dll"
	        filename = "\\Windows\\System32\\Syncreg.dll" (normalized: "c:\\windows\\system32\\syncreg.dll")

Region:
	              id = 1371
	        start_va = 0x7fefaae0000
	          end_va = 0x7fefab7cfff
	     entry_point = 0x7fefaae0000
	     region_type = mapped_file
	            name = "fxsapi.dll"
	        filename = "\\Windows\\System32\\FXSAPI.dll" (normalized: "c:\\windows\\system32\\fxsapi.dll")

Region:
	              id = 1372
	        start_va = 0x7fefada0000
	          end_va = 0x7fefadb7fff
	     entry_point = 0x7fefada0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 1373
	        start_va = 0x7fefadc0000
	          end_va = 0x7fefadd0fff
	     entry_point = 0x7fefadc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 1374
	        start_va = 0x7fefaf50000
	          end_va = 0x7fefaf5afff
	     entry_point = 0x7fefaf50000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 1375
	        start_va = 0x7fefaf60000
	          end_va = 0x7fefaf86fff
	     entry_point = 0x7fefaf60000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 1376
	        start_va = 0x7fefafd0000
	          end_va = 0x7fefb036fff
	     entry_point = 0x7fefafd0000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 1377
	        start_va = 0x7fefb040000
	          end_va = 0x7fefb04afff
	     entry_point = 0x7fefb040000
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")

Region:
	              id = 1378
	        start_va = 0x7fefb070000
	          end_va = 0x7fefb088fff
	     entry_point = 0x7fefb070000
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")

Region:
	              id = 1379
	        start_va = 0x7fefb0d0000
	          end_va = 0x7fefb0e4fff
	     entry_point = 0x7fefb0d0000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 1380
	        start_va = 0x7fefb200000
	          end_va = 0x7fefb326fff
	     entry_point = 0x7fefb200000
	     region_type = mapped_file
	            name = "taskschd.dll"
	        filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")

Region:
	              id = 1381
	        start_va = 0x7fefb430000
	          end_va = 0x7fefb438fff
	     entry_point = 0x7fefb430000
	     region_type = mapped_file
	            name = "avrt.dll"
	        filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll")

Region:
	              id = 1382
	        start_va = 0x7fefb440000
	          end_va = 0x7fefb46bfff
	     entry_point = 0x7fefb440000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1383
	        start_va = 0x7fefb520000
	          end_va = 0x7fefb54cfff
	     entry_point = 0x7fefb520000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1384
	        start_va = 0x7fefb700000
	          end_va = 0x7fefb70bfff
	     entry_point = 0x7fefb700000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 1385
	        start_va = 0x7fefb7c0000
	          end_va = 0x7fefb7d3fff
	     entry_point = 0x7fefb7c0000
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 1386
	        start_va = 0x7fefb7e0000
	          end_va = 0x7fefb7f4fff
	     entry_point = 0x7fefb7e0000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 1387
	        start_va = 0x7fefb800000
	          end_va = 0x7fefb80bfff
	     entry_point = 0x7fefb800000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 1388
	        start_va = 0x7fefb8c0000
	          end_va = 0x7fefb933fff
	     entry_point = 0x7fefb8c0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 1389
	        start_va = 0x7fefb940000
	          end_va = 0x7fefb950fff
	     entry_point = 0x7fefb940000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1390
	        start_va = 0x7fefb970000
	          end_va = 0x7fefba99fff
	     entry_point = 0x7fefb970000
	     region_type = mapped_file
	            name = "windowscodecs.dll"
	        filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")

Region:
	              id = 1391
	        start_va = 0x7fefbaa0000
	          end_va = 0x7fefbad4fff
	     entry_point = 0x7fefbaa0000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 1392
	        start_va = 0x7fefbae0000
	          end_va = 0x7fefbaf7fff
	     entry_point = 0x7fefbae0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 1393
	        start_va = 0x7fefbb00000
	          end_va = 0x7fefbb4afff
	     entry_point = 0x7fefbb00000
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 1394
	        start_va = 0x7fefbb50000
	          end_va = 0x7fefbb5afff
	     entry_point = 0x7fefbb50000
	     region_type = mapped_file
	            name = "hid.dll"
	        filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")

Region:
	              id = 1395
	        start_va = 0x7fefbb60000
	          end_va = 0x7fefbb9afff
	     entry_point = 0x7fefbb60000
	     region_type = mapped_file
	            name = "sndvolsso.dll"
	        filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll")

Region:
	              id = 1396
	        start_va = 0x7fefbba0000
	          end_va = 0x7fefbbe2fff
	     entry_point = 0x7fefbba0000
	     region_type = mapped_file
	            name = "duser.dll"
	        filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll")

Region:
	              id = 1397
	        start_va = 0x7fefbbf0000
	          end_va = 0x7fefbce1fff
	     entry_point = 0x7fefbbf0000
	     region_type = mapped_file
	            name = "dui70.dll"
	        filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll")

Region:
	              id = 1398
	        start_va = 0x7fefbcf0000
	          end_va = 0x7fefbf04fff
	     entry_point = 0x7fefbcf0000
	     region_type = mapped_file
	            name = "gdiplus.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll")

Region:
	              id = 1399
	        start_va = 0x7fefbf10000
	          end_va = 0x7fefbf65fff
	     entry_point = 0x7fefbf10000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 1400
	        start_va = 0x7fefbf70000
	          end_va = 0x7fefc09bfff
	     entry_point = 0x7fefbf70000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 1401
	        start_va = 0x7fefc0a0000
	          end_va = 0x7fefc0bcfff
	     entry_point = 0x7fefc0a0000
	     region_type = mapped_file
	            name = "samlib.dll"
	        filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")

Region:
	              id = 1402
	        start_va = 0x7fefc0c0000
	          end_va = 0x7fefc0e3fff
	     entry_point = 0x7fefc0c0000
	     region_type = mapped_file
	            name = "shacct.dll"
	        filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll")

Region:
	              id = 1403
	        start_va = 0x7fefc0f0000
	          end_va = 0x7fefc2e3fff
	     entry_point = 0x7fefc0f0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 1404
	        start_va = 0x7fefc2f0000
	          end_va = 0x7fefc3f8fff
	     entry_point = 0x7fefc2f0000
	     region_type = mapped_file
	            name = "cryptui.dll"
	        filename = "\\Windows\\System32\\cryptui.dll" (normalized: "c:\\windows\\system32\\cryptui.dll")

Region:
	              id = 1405
	        start_va = 0x7fefc400000
	          end_va = 0x7fefc5d9fff
	     entry_point = 0x7fefc400000
	     region_type = mapped_file
	            name = "authui.dll"
	        filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll")

Region:
	              id = 1406
	        start_va = 0x7fefc780000
	          end_va = 0x7fefc78bfff
	     entry_point = 0x7fefc780000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 1407
	        start_va = 0x7fefc960000
	          end_va = 0x7fefc97dfff
	     entry_point = 0x7fefc960000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 1408
	        start_va = 0x7fefcab0000
	          end_va = 0x7fefcab9fff
	     entry_point = 0x7fefcab0000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 1409
	        start_va = 0x7fefcbb0000
	          end_va = 0x7fefcbf6fff
	     entry_point = 0x7fefcbb0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1410
	        start_va = 0x7fefceb0000
	          end_va = 0x7fefcec6fff
	     entry_point = 0x7fefceb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1411
	        start_va = 0x7fefcfc0000
	          end_va = 0x7fefcff1fff
	     entry_point = 0x7fefcfc0000
	     region_type = mapped_file
	            name = "netjoin.dll"
	        filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")

Region:
	              id = 1412
	        start_va = 0x7fefd0e0000
	          end_va = 0x7fefd14cfff
	     entry_point = 0x7fefd0e0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 1413
	        start_va = 0x7fefd3b0000
	          end_va = 0x7fefd3d2fff
	     entry_point = 0x7fefd3b0000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1414
	        start_va = 0x7fefd450000
	          end_va = 0x7fefd45afff
	     entry_point = 0x7fefd450000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 1415
	        start_va = 0x7fefd480000
	          end_va = 0x7fefd4a4fff
	     entry_point = 0x7fefd480000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1416
	        start_va = 0x7fefd4b0000
	          end_va = 0x7fefd4befff
	     entry_point = 0x7fefd4b0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1417
	        start_va = 0x7fefd4c0000
	          end_va = 0x7fefd550fff
	     entry_point = 0x7fefd4c0000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 1418
	        start_va = 0x7fefd560000
	          end_va = 0x7fefd59cfff
	     entry_point = 0x7fefd560000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1419
	        start_va = 0x7fefd5a0000
	          end_va = 0x7fefd5b3fff
	     entry_point = 0x7fefd5a0000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 1420
	        start_va = 0x7fefd5c0000
	          end_va = 0x7fefd5cefff
	     entry_point = 0x7fefd5c0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1421
	        start_va = 0x7fefd660000
	          end_va = 0x7fefd66efff
	     entry_point = 0x7fefd660000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1422
	        start_va = 0x7fefd670000
	          end_va = 0x7fefd6a5fff
	     entry_point = 0x7fefd670000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1423
	        start_va = 0x7fefd750000
	          end_va = 0x7fefd8b6fff
	     entry_point = 0x7fefd750000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1424
	        start_va = 0x7fefd8c0000
	          end_va = 0x7fefd8f9fff
	     entry_point = 0x7fefd8c0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 1425
	        start_va = 0x7fefd900000
	          end_va = 0x7fefd919fff
	     entry_point = 0x7fefd900000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1426
	        start_va = 0x7fefd920000
	          end_va = 0x7fefd98afff
	     entry_point = 0x7fefd920000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1427
	        start_va = 0x7fefd990000
	          end_va = 0x7fefdb07fff
	     entry_point = 0x7fefd990000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 1428
	        start_va = 0x7fefdb10000
	          end_va = 0x7fefdbaefff
	     entry_point = 0x7fefdb10000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1429
	        start_va = 0x7fefdbb0000
	          end_va = 0x7fefdc86fff
	     entry_point = 0x7fefdbb0000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1430
	        start_va = 0x7fefdc90000
	          end_va = 0x7fefdcf6fff
	     entry_point = 0x7fefdc90000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1431
	        start_va = 0x7fefdd00000
	          end_va = 0x7fefddc8fff
	     entry_point = 0x7fefdd00000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1432
	        start_va = 0x7fefddf0000
	          end_va = 0x7fefdff2fff
	     entry_point = 0x7fefddf0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1433
	        start_va = 0x7fefe000000
	          end_va = 0x7fefe098fff
	     entry_point = 0x7fefe000000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1434
	        start_va = 0x7fefe0a0000
	          end_va = 0x7fefe1a8fff
	     entry_point = 0x7fefe0a0000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1435
	        start_va = 0x7fefe1b0000
	          end_va = 0x7fefe201fff
	     entry_point = 0x7fefe1b0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 1436
	        start_va = 0x7fefe330000
	          end_va = 0x7fefe34efff
	     entry_point = 0x7fefe330000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1437
	        start_va = 0x7fefe350000
	          end_va = 0x7fefe35dfff
	     entry_point = 0x7fefe350000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1438
	        start_va = 0x7fefe360000
	          end_va = 0x7feff0e7fff
	     entry_point = 0x7fefe360000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 1439
	        start_va = 0x7feff0f0000
	          end_va = 0x7feff2c6fff
	     entry_point = 0x7feff0f0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 1440
	        start_va = 0x7feff2d0000
	          end_va = 0x7feff2d7fff
	     entry_point = 0x7feff2d0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1441
	        start_va = 0x7feff2e0000
	          end_va = 0x7feff350fff
	     entry_point = 0x7feff2e0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1442
	        start_va = 0x7feff360000
	          end_va = 0x7feff489fff
	     entry_point = 0x7feff360000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 1443
	        start_va = 0x7feff490000
	          end_va = 0x7feff4dcfff
	     entry_point = 0x7feff490000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1444
	        start_va = 0x7feff4e0000
	          end_va = 0x7feff738fff
	     entry_point = 0x7feff4e0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 1445
	        start_va = 0x7feff740000
	          end_va = 0x7feff81afff
	     entry_point = 0x7feff740000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1446
	        start_va = 0x7feff820000
	          end_va = 0x7feff94cfff
	     entry_point = 0x7feff820000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1447
	        start_va = 0x7feff950000
	          end_va = 0x7feff97dfff
	     entry_point = 0x7feff950000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1448
	        start_va = 0x7feff990000
	          end_va = 0x7feff990fff
	     entry_point = 0x7feff990000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1449
	        start_va = 0x7fffff7a000
	          end_va = 0x7fffff7bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7a000"
	        filename = ""

Region:
	              id = 1450
	        start_va = 0x7fffff7c000
	          end_va = 0x7fffff7dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7c000"
	        filename = ""

Region:
	              id = 1451
	        start_va = 0x7fffff7e000
	          end_va = 0x7fffff7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7e000"
	        filename = ""

Region:
	              id = 1452
	        start_va = 0x7fffff82000
	          end_va = 0x7fffff83fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff82000"
	        filename = ""

Region:
	              id = 1453
	        start_va = 0x7fffff86000
	          end_va = 0x7fffff87fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff86000"
	        filename = ""

Region:
	              id = 1454
	        start_va = 0x7fffff88000
	          end_va = 0x7fffff89fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff88000"
	        filename = ""

Region:
	              id = 1455
	        start_va = 0x7fffff8a000
	          end_va = 0x7fffff8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8a000"
	        filename = ""

Region:
	              id = 1456
	        start_va = 0x7fffff90000
	          end_va = 0x7fffff91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff90000"
	        filename = ""

Region:
	              id = 1457
	        start_va = 0x7fffff92000
	          end_va = 0x7fffff93fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff92000"
	        filename = ""

Region:
	              id = 1458
	        start_va = 0x7fffff94000
	          end_va = 0x7fffff95fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff94000"
	        filename = ""

Region:
	              id = 1459
	        start_va = 0x7fffff96000
	          end_va = 0x7fffff97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff96000"
	        filename = ""

Region:
	              id = 1460
	        start_va = 0x7fffff98000
	          end_va = 0x7fffff99fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff98000"
	        filename = ""

Region:
	              id = 1461
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 1462
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 1463
	        start_va = 0x7fffff9e000
	          end_va = 0x7fffff9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9e000"
	        filename = ""

Region:
	              id = 1464
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 1465
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 1466
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 1467
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 1468
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 1469
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 1470
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 1471
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1472
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 1473
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 1474
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 1475
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 1476
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 1477
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""


Thread:
	id = 59
	os_tid = 0x73c


Thread:
	id = 60
	os_tid = 0x69c


Thread:
	id = 61
	os_tid = 0x610


Thread:
	id = 62
	os_tid = 0x5cc


Thread:
	id = 63
	os_tid = 0x5a4


Thread:
	id = 64
	os_tid = 0x56c


Thread:
	id = 65
	os_tid = 0x58c


Thread:
	id = 66
	os_tid = 0x4f4


Thread:
	id = 67
	os_tid = 0x574


Thread:
	id = 68
	os_tid = 0x670


Thread:
	id = 69
	os_tid = 0x650


Thread:
	id = 70
	os_tid = 0x648


Thread:
	id = 71
	os_tid = 0x644


Thread:
	id = 72
	os_tid = 0x5b8


Thread:
	id = 73
	os_tid = 0x558


Thread:
	id = 74
	os_tid = 0x534


Thread:
	id = 75
	os_tid = 0x530


Thread:
	id = 76
	os_tid = 0x52c


Thread:
	id = 77
	os_tid = 0x524


Thread:
	id = 78
	os_tid = 0x51c


Thread:
	id = 79
	os_tid = 0x514


Thread:
	id = 80
	os_tid = 0x510


Thread:
	id = 81
	os_tid = 0x50c


Thread:
	id = 82
	os_tid = 0x504


Thread:
	id = 83
	os_tid = 0x4d8


Thread:
	id = 84
	os_tid = 0x4c8


Thread:
	id = 85
	os_tid = 0x4b8


Thread:
	id = 86
	os_tid = 0x4b4


Thread:
	id = 87
	os_tid = 0x4ac


Thread:
	id = 88
	os_tid = 0x470


Thread:
	id = 89
	os_tid = 0x45c


Thread:
	id = 144
	os_tid = 0x8f0


Thread:
	id = 190
	os_tid = 0x9ec


Thread:
	id = 201
	os_tid = 0xa34


Thread:
	id = 202
	os_tid = 0xa38


Thread:
	id = 204
	os_tid = 0xa68


Thread:
	id = 249
	os_tid = 0xb2c


Thread:
	id = 354
	os_tid = 0x834


Thread:
	id = 356
	os_tid = 0x850


Process:
	id = "7"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x356e3000"
	os_pid = "0x860"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:14340"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1638
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1639
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1640
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1641
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1642
	        start_va = 0x230000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 1643
	        start_va = 0x300000
	          end_va = 0x3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000300000"
	        filename = ""

Region:
	              id = 1644
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 1645
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1646
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1647
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 1648
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 1649
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 1650
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 1651
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1652
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1653
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1654
	        start_va = 0x190000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 1655
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1656
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1657
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1658
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1659
	        start_va = 0x60000
	          end_va = 0xc6fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1660
	        start_va = 0x530000
	          end_va = 0x62ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 1661
	        start_va = 0x810000
	          end_va = 0x81ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000810000"
	        filename = ""

Region:
	              id = 1662
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1663
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1664
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 1665
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1666
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1667
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 1668
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1669
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1670
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 1671
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1672
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1673
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1674
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 1675
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1676
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 1677
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 1678
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1679
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 1680
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 1681
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1682
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1683
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 1684
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 1685
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1686
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1687
	        start_va = 0x630000
	          end_va = 0x7b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000630000"
	        filename = ""

Region:
	              id = 1688
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 1689
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1690
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1691
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1692
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0xd0000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 1693
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1694
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1695
	        start_va = 0x820000
	          end_va = 0x9a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000820000"
	        filename = ""

Region:
	              id = 1696
	        start_va = 0x9b0000
	          end_va = 0xc7efff
	     entry_point = 0x9b0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1697
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 1698
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 1699
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 1700
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 1701
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x100000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 1702
	        start_va = 0x110000
	          end_va = 0x111fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000110000"
	        filename = ""

Region:
	              id = 1703
	        start_va = 0x120000
	          end_va = 0x120fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000120000"
	        filename = ""

Region:
	              id = 1704
	        start_va = 0x130000
	          end_va = 0x131fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000130000"
	        filename = ""

Region:
	              id = 1705
	        start_va = 0x140000
	          end_va = 0x140fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000140000"
	        filename = ""

Region:
	              id = 1706
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 1707
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 1709
	        start_va = 0x150000
	          end_va = 0x150fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 1710
	        start_va = 0x160000
	          end_va = 0x161fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 1711
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 1712
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 1713
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 1714
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 1715
	        start_va = 0x170000
	          end_va = 0x170fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 1716
	        start_va = 0x180000
	          end_va = 0x181fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000180000"
	        filename = ""

Region:
	              id = 1717
	        start_va = 0x210000
	          end_va = 0x211fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000210000"
	        filename = ""

Region:
	              id = 1718
	        start_va = 0x270000
	          end_va = 0x2ddfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000270000"
	        filename = ""

Region:
	              id = 1719
	        start_va = 0x480000
	          end_va = 0x4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1720
	        start_va = 0xc80000
	          end_va = 0xd5efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c80000"
	        filename = ""

Region:
	              id = 1721
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 1722
	        start_va = 0xee0000
	          end_va = 0xfdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ee0000"
	        filename = ""

Region:
	              id = 1723
	        start_va = 0x10a0000
	          end_va = 0x119ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 1724
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 1725
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 1726
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 1727
	        start_va = 0xe40000
	          end_va = 0xe7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 1728
	        start_va = 0xe80000
	          end_va = 0xebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 1729
	        start_va = 0x1200000
	          end_va = 0x123ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001200000"
	        filename = ""

Region:
	              id = 1730
	        start_va = 0x2780000
	          end_va = 0x287ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002780000"
	        filename = ""

Region:
	              id = 1731
	        start_va = 0x2900000
	          end_va = 0x29fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002900000"
	        filename = ""

Region:
	              id = 1732
	        start_va = 0x2b40000
	          end_va = 0x2d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b40000"
	        filename = ""

Region:
	              id = 1733
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 1734
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 1735
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 1736
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 1737
	        start_va = 0x718d0000
	          end_va = 0x71902fff
	     entry_point = 0x718d0000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 1738
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 1739
	        start_va = 0x2a00000
	          end_va = 0x2afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a00000"
	        filename = ""

Region:
	              id = 1740
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1741
	        start_va = 0x2e0000
	          end_va = 0x2e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002e0000"
	        filename = ""

Region:
	              id = 1742
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 1743
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 1744
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 1745
	        start_va = 0x2f0000
	          end_va = 0x2f3fff
	     entry_point = 0x2f0000
	     region_type = mapped_file
	            name = "cversions.1.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")

Region:
	              id = 1746
	        start_va = 0x400000
	          end_va = 0x41efff
	     entry_point = 0x400000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 1747
	        start_va = 0x420000
	          end_va = 0x420fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000420000"
	        filename = ""

Region:
	              id = 1748
	        start_va = 0xfe0000
	          end_va = 0x101ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 1749
	        start_va = 0x2d60000
	          end_va = 0x2e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d60000"
	        filename = ""

Region:
	              id = 1750
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 1751
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 1752
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 1753
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 1754
	        start_va = 0x2e60000
	          end_va = 0x3252fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e60000"
	        filename = ""

Region:
	              id = 1755
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 1756
	        start_va = 0x2f0000
	          end_va = 0x2f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002f0000"
	        filename = ""

Region:
	              id = 1757
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 1758
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 1759
	        start_va = 0x430000
	          end_va = 0x46ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000430000"
	        filename = ""

Region:
	              id = 1760
	        start_va = 0x470000
	          end_va = 0x471fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 1761
	        start_va = 0x4c0000
	          end_va = 0x4c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1762
	        start_va = 0x510000
	          end_va = 0x51ffff
	     entry_point = 0x510000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 1763
	        start_va = 0x520000
	          end_va = 0x527fff
	     entry_point = 0x520000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 1764
	        start_va = 0x7c0000
	          end_va = 0x7d3fff
	     entry_point = 0x7c0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 1765
	        start_va = 0x1020000
	          end_va = 0x105ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 1766
	        start_va = 0x33c0000
	          end_va = 0x34bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033c0000"
	        filename = ""

Region:
	              id = 1767
	        start_va = 0x35d0000
	          end_va = 0x36cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035d0000"
	        filename = ""

Region:
	              id = 1768
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 1769
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1770
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 1771
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 1772
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 1773
	        start_va = 0x32c0000
	          end_va = 0x32fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032c0000"
	        filename = ""

Region:
	              id = 1774
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 1775
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 1776
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 1783
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1788
	        start_va = 0x36d0000
	          end_va = 0x3a12fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000036d0000"
	        filename = ""

Region:
	              id = 1789
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 1790
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 1791
	        start_va = 0xdc0000
	          end_va = 0xdcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 1792
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 1793
	        start_va = 0x7e0000
	          end_va = 0x7e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 1794
	        start_va = 0xd70000
	          end_va = 0xd71fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d70000"
	        filename = ""

Region:
	              id = 1795
	        start_va = 0x3bf0000
	          end_va = 0x3c2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003bf0000"
	        filename = ""

Region:
	              id = 1796
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 1797
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 1798
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 1799
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 1800
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 1801
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 1802
	        start_va = 0x3b20000
	          end_va = 0x3b5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b20000"
	        filename = ""

Region:
	              id = 1803
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 1808
	        start_va = 0x7f0000
	          end_va = 0x80ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007f0000"
	        filename = ""

Region:
	              id = 1809
	        start_va = 0xd60000
	          end_va = 0xd60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d60000"
	        filename = ""

Region:
	              id = 1810
	        start_va = 0x35a0000
	          end_va = 0x35affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035a0000"
	        filename = ""

Region:
	              id = 1811
	        start_va = 0x3c30000
	          end_va = 0x455ffff
	     entry_point = 0x3c30000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 1812
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 1813
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 1814
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 1815
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 1816
	        start_va = 0xd80000
	          end_va = 0xd8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d80000"
	        filename = ""

Region:
	              id = 1817
	        start_va = 0xd90000
	          end_va = 0xd90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d90000"
	        filename = ""

Region:
	              id = 1818
	        start_va = 0xda0000
	          end_va = 0xda2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000da0000"
	        filename = ""

Region:
	              id = 1819
	        start_va = 0x46c0000
	          end_va = 0x46cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046c0000"
	        filename = ""

Region:
	              id = 1820
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 1821
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 1822
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 1823
	        start_va = 0xdb0000
	          end_va = 0xdb3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 1824
	        start_va = 0xe10000
	          end_va = 0xe27fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 1825
	        start_va = 0xe30000
	          end_va = 0xe3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e30000"
	        filename = ""

Region:
	              id = 1826
	        start_va = 0xec0000
	          end_va = 0xec0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 1827
	        start_va = 0xed0000
	          end_va = 0xedffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ed0000"
	        filename = ""

Region:
	              id = 1828
	        start_va = 0x1060000
	          end_va = 0x106ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 1829
	        start_va = 0x1070000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001070000"
	        filename = ""

Region:
	              id = 1830
	        start_va = 0x1080000
	          end_va = 0x108ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001080000"
	        filename = ""

Region:
	              id = 1831
	        start_va = 0x1090000
	          end_va = 0x109ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 1832
	        start_va = 0x11a0000
	          end_va = 0x11affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011a0000"
	        filename = ""

Region:
	              id = 1833
	        start_va = 0x11b0000
	          end_va = 0x11bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011b0000"
	        filename = ""

Region:
	              id = 1834
	        start_va = 0x3360000
	          end_va = 0x339ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003360000"
	        filename = ""

Region:
	              id = 1835
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 1836
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 1839
	        start_va = 0x11c0000
	          end_va = 0x11cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011c0000"
	        filename = ""

Region:
	              id = 1840
	        start_va = 0x11d0000
	          end_va = 0x11dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011d0000"
	        filename = ""

Region:
	              id = 1841
	        start_va = 0x11e0000
	          end_va = 0x11effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011e0000"
	        filename = ""

Region:
	              id = 1842
	        start_va = 0x11f0000
	          end_va = 0x11f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000011f0000"
	        filename = ""

Region:
	              id = 1843
	        start_va = 0x1240000
	          end_va = 0x1240fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 1844
	        start_va = 0x2890000
	          end_va = 0x28cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002890000"
	        filename = ""

Region:
	              id = 1845
	        start_va = 0x4590000
	          end_va = 0x468ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004590000"
	        filename = ""

Region:
	              id = 1846
	        start_va = 0x4870000
	          end_va = 0x48affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004870000"
	        filename = ""

Region:
	              id = 1847
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 1848
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 1851
	        start_va = 0x1250000
	          end_va = 0x1250fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001250000"
	        filename = ""

Region:
	              id = 1852
	        start_va = 0x1260000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001260000"
	        filename = ""

Region:
	              id = 1853
	        start_va = 0x1270000
	          end_va = 0x1270fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001270000"
	        filename = ""

Region:
	              id = 1854
	        start_va = 0x1280000
	          end_va = 0x1282fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001280000"
	        filename = ""

Region:
	              id = 1855
	        start_va = 0x2740000
	          end_va = 0x277ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 1856
	        start_va = 0x3310000
	          end_va = 0x334ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003310000"
	        filename = ""

Region:
	              id = 1857
	        start_va = 0x3560000
	          end_va = 0x359ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003560000"
	        filename = ""

Region:
	              id = 1858
	        start_va = 0x3a20000
	          end_va = 0x3b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a20000"
	        filename = ""

Region:
	              id = 1859
	        start_va = 0x46e0000
	          end_va = 0x47dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046e0000"
	        filename = ""

Region:
	              id = 1860
	        start_va = 0x4980000
	          end_va = 0x4a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004980000"
	        filename = ""

Region:
	              id = 1861
	        start_va = 0x4c00000
	          end_va = 0x4c0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c00000"
	        filename = ""

Region:
	              id = 1862
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 1863
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 1864
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 1865
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 1866
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 1867
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 1868
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 1869
	        start_va = 0x2880000
	          end_va = 0x2883fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002880000"
	        filename = ""

Region:
	              id = 1870
	        start_va = 0x28d0000
	          end_va = 0x28e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028d0000"
	        filename = ""

Region:
	              id = 1871
	        start_va = 0x28f0000
	          end_va = 0x28fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028f0000"
	        filename = ""

Region:
	              id = 1872
	        start_va = 0x2b00000
	          end_va = 0x2b00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b00000"
	        filename = ""

Region:
	              id = 1873
	        start_va = 0x2b10000
	          end_va = 0x2b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b10000"
	        filename = ""

Region:
	              id = 1874
	        start_va = 0x2b20000
	          end_va = 0x2b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b20000"
	        filename = ""

Region:
	              id = 1875
	        start_va = 0x2b30000
	          end_va = 0x2b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b30000"
	        filename = ""

Region:
	              id = 1876
	        start_va = 0x2d40000
	          end_va = 0x2d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d40000"
	        filename = ""

Region:
	              id = 1877
	        start_va = 0x2d50000
	          end_va = 0x2d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d50000"
	        filename = ""

Region:
	              id = 1878
	        start_va = 0x3260000
	          end_va = 0x326ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003260000"
	        filename = ""

Region:
	              id = 1879
	        start_va = 0x3270000
	          end_va = 0x3271fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003270000"
	        filename = ""

Region:
	              id = 1880
	        start_va = 0x3290000
	          end_va = 0x329ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003290000"
	        filename = ""

Region:
	              id = 1881
	        start_va = 0x4b80000
	          end_va = 0x4b8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b80000"
	        filename = ""

Region:
	              id = 1882
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 1883
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 1884
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 1885
	        start_va = 0x3280000
	          end_va = 0x3287fff
	     entry_point = 0x3280000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 1886
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 1887
	        start_va = 0x32a0000
	          end_va = 0x32acfff
	     entry_point = 0x32a0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 1888
	        start_va = 0x32b0000
	          end_va = 0x32b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032b0000"
	        filename = ""

Region:
	              id = 1889
	        start_va = 0x3300000
	          end_va = 0x3300fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003300000"
	        filename = ""

Region:
	              id = 1890
	        start_va = 0x3350000
	          end_va = 0x3350fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003350000"
	        filename = ""

Region:
	              id = 1891
	        start_va = 0x33a0000
	          end_va = 0x33b1fff
	     entry_point = 0x33a0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 1892
	        start_va = 0x34c0000
	          end_va = 0x34c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034c0000"
	        filename = ""

Region:
	              id = 1893
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 1894
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 1895
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 1896
	        start_va = 0x34d0000
	          end_va = 0x34d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034d0000"
	        filename = ""

Region:
	              id = 1897
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 1898
	        start_va = 0x3520000
	          end_va = 0x355ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003520000"
	        filename = ""

Region:
	              id = 1899
	        start_va = 0x3b70000
	          end_va = 0x3baffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b70000"
	        filename = ""

Region:
	              id = 1900
	        start_va = 0x4860000
	          end_va = 0x486ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004860000"
	        filename = ""

Region:
	              id = 1901
	        start_va = 0x48c0000
	          end_va = 0x48fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048c0000"
	        filename = ""

Region:
	              id = 1902
	        start_va = 0x4a80000
	          end_va = 0x4b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a80000"
	        filename = ""

Region:
	              id = 1903
	        start_va = 0x4c20000
	          end_va = 0x4d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c20000"
	        filename = ""

Region:
	              id = 1904
	        start_va = 0x4d70000
	          end_va = 0x4daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d70000"
	        filename = ""

Region:
	              id = 1905
	        start_va = 0x4e70000
	          end_va = 0x4f6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e70000"
	        filename = ""

Region:
	              id = 1906
	        start_va = 0x5050000
	          end_va = 0x514ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005050000"
	        filename = ""

Region:
	              id = 1907
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 1908
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 1909
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 1910
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 1911
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 1912
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 1913
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 1914
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 1915
	        start_va = 0x34e0000
	          end_va = 0x34e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034e0000"
	        filename = ""

Region:
	              id = 1916
	        start_va = 0x47e0000
	          end_va = 0x485ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000047e0000"
	        filename = ""

Region:
	              id = 1917
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 1918
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 1919
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 1920
	        start_va = 0x34f0000
	          end_va = 0x34f3fff
	     entry_point = 0x34f0000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 1921
	        start_va = 0x3500000
	          end_va = 0x3500fff
	     entry_point = 0x3500000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 1922
	        start_va = 0x4900000
	          end_va = 0x495cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004900000"
	        filename = ""

Region:
	              id = 1923
	        start_va = 0x4ff0000
	          end_va = 0x502ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ff0000"
	        filename = ""

Region:
	              id = 1924
	        start_va = 0x5150000
	          end_va = 0x524ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005150000"
	        filename = ""

Region:
	              id = 1925
	        start_va = 0x5290000
	          end_va = 0x538ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005290000"
	        filename = ""

Region:
	              id = 1926
	        start_va = 0x5390000
	          end_va = 0x548ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005390000"
	        filename = ""

Region:
	              id = 1927
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 1928
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 1929
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1930
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 1931
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1981
	        start_va = 0x3510000
	          end_va = 0x3510fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003510000"
	        filename = ""

Region:
	              id = 1982
	        start_va = 0x35b0000
	          end_va = 0x35b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035b0000"
	        filename = ""

Region:
	              id = 1983
	        start_va = 0x5490000
	          end_va = 0x568ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005490000"
	        filename = ""

Region:
	              id = 1984
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 2058
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 2059
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 2060
	        start_va = 0x35c0000
	          end_va = 0x35c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035c0000"
	        filename = ""

Region:
	              id = 2061
	        start_va = 0x3b60000
	          end_va = 0x3b60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003b60000"
	        filename = ""

Region:
	              id = 2062
	        start_va = 0x3bb0000
	          end_va = 0x3bb7fff
	     entry_point = 0x3bb0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 2063
	        start_va = 0x3bc0000
	          end_va = 0x3bc1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003bc0000"
	        filename = ""

Region:
	              id = 2064
	        start_va = 0x3bd0000
	          end_va = 0x3be0fff
	     entry_point = 0x3bd0000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 2065
	        start_va = 0x56e0000
	          end_va = 0x571ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000056e0000"
	        filename = ""

Region:
	              id = 2066
	        start_va = 0x5820000
	          end_va = 0x591ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005820000"
	        filename = ""

Region:
	              id = 2067
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 2068
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 2069
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 2070
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 2071
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 2072
	        start_va = 0x4560000
	          end_va = 0x4561fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004560000"
	        filename = ""

Region:
	              id = 2073
	        start_va = 0x4570000
	          end_va = 0x4573fff
	     entry_point = 0x4570000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 2074
	        start_va = 0x4580000
	          end_va = 0x4580fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 2075
	        start_va = 0x4db0000
	          end_va = 0x4e58fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004db0000"
	        filename = ""

Region:
	              id = 2076
	        start_va = 0x5720000
	          end_va = 0x57b8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005720000"
	        filename = ""

Region:
	              id = 2077
	        start_va = 0x5990000
	          end_va = 0x59cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005990000"
	        filename = ""

Region:
	              id = 2078
	        start_va = 0x59f0000
	          end_va = 0x5a2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059f0000"
	        filename = ""

Region:
	              id = 2079
	        start_va = 0x5a50000
	          end_va = 0x5a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a50000"
	        filename = ""

Region:
	              id = 2080
	        start_va = 0x5a60000
	          end_va = 0x5e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a60000"
	        filename = ""

Region:
	              id = 2081
	        start_va = 0x5e60000
	          end_va = 0x605ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e60000"
	        filename = ""

Region:
	              id = 2082
	        start_va = 0x6060000
	          end_va = 0x645ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006060000"
	        filename = ""

Region:
	              id = 2083
	        start_va = 0x6460000
	          end_va = 0x65a1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006460000"
	        filename = ""

Region:
	              id = 2084
	        start_va = 0x65b0000
	          end_va = 0x6daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000065b0000"
	        filename = ""

Region:
	              id = 2085
	        start_va = 0x6db0000
	          end_va = 0x6ec6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006db0000"
	        filename = ""

Region:
	              id = 2086
	        start_va = 0x6fd0000
	          end_va = 0x70cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fd0000"
	        filename = ""

Region:
	              id = 2087
	        start_va = 0x7120000
	          end_va = 0x721ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007120000"
	        filename = ""

Region:
	              id = 2088
	        start_va = 0x73f0000
	          end_va = 0x74effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000073f0000"
	        filename = ""

Region:
	              id = 2089
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 2090
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 2091
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 2092
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 2093
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 2094
	        start_va = 0x4690000
	          end_va = 0x4691fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004690000"
	        filename = ""

Region:
	              id = 2095
	        start_va = 0x46a0000
	          end_va = 0x46a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046a0000"
	        filename = ""

Region:
	              id = 2096
	        start_va = 0x4b90000
	          end_va = 0x4bd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b90000"
	        filename = ""

Region:
	              id = 2097
	        start_va = 0x4d20000
	          end_va = 0x4d6bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d20000"
	        filename = ""

Region:
	              id = 2098
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 111
	os_tid = 0x864


Thread:
	id = 112
	os_tid = 0x868


Thread:
	id = 113
	os_tid = 0x86c


Thread:
	id = 114
	os_tid = 0x870


Thread:
	id = 115
	os_tid = 0x874


Thread:
	id = 116
	os_tid = 0x878


Thread:
	id = 117
	os_tid = 0x87c


Thread:
	id = 118
	os_tid = 0x880


Thread:
	id = 119
	os_tid = 0x884


Thread:
	id = 122
	os_tid = 0x894


Thread:
	id = 123
	os_tid = 0x898


Thread:
	id = 124
	os_tid = 0x89c


Thread:
	id = 125
	os_tid = 0x8a0


Thread:
	id = 126
	os_tid = 0x8a4


Thread:
	id = 127
	os_tid = 0x8a8


Thread:
	id = 128
	os_tid = 0x8ac


Thread:
	id = 129
	os_tid = 0x8b0


Thread:
	id = 130
	os_tid = 0x8b4


Thread:
	id = 141
	os_tid = 0x8e4


Thread:
	id = 142
	os_tid = 0x8e8


Thread:
	id = 143
	os_tid = 0x8ec


Thread:
	id = 149
	os_tid = 0x904


Thread:
	id = 188
	os_tid = 0x9e0


Thread:
	id = 189
	os_tid = 0x9e8


Thread:
	id = 278
	os_tid = 0xba8


Thread:
	id = 411
	os_tid = 0xca0


Process:
	id = "8"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x33af4000"
	os_pid = "0x8bc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:79876"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1932
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1933
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1934
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1935
	        start_va = 0x50000
	          end_va = 0x14ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 1936
	        start_va = 0x150000
	          end_va = 0x18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 1937
	        start_va = 0x190000
	          end_va = 0x193fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 1938
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 1939
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1940
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1941
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 1942
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 1943
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 1944
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 1945
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1946
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1947
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1948
	        start_va = 0x1f0000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1949
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1950
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1951
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1952
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1953
	        start_va = 0x2c0000
	          end_va = 0x3bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 1954
	        start_va = 0x3c0000
	          end_va = 0x426fff
	     entry_point = 0x3c0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1955
	        start_va = 0x5f0000
	          end_va = 0x5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 1956
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1957
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1958
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 1959
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1960
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1961
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 1962
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1963
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1964
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 1965
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1966
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1967
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1968
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 1969
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1970
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 1971
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 1972
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1973
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 1974
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 1975
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1976
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1977
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 1978
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 1979
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1980
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1985
	        start_va = 0x430000
	          end_va = 0x5b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000430000"
	        filename = ""

Region:
	              id = 1986
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 1987
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1988
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1989
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1990
	        start_va = 0x1a0000
	          end_va = 0x1a1fff
	     entry_point = 0x1a0000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 1991
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1992
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1993
	        start_va = 0x600000
	          end_va = 0x780fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000600000"
	        filename = ""

Region:
	              id = 1994
	        start_va = 0x790000
	          end_va = 0xa5efff
	     entry_point = 0x790000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1995
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 1996
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 1997
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 1998
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 1999
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	     entry_point = 0x1d0000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 2000
	        start_va = 0x1e0000
	          end_va = 0x1e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 2001
	        start_va = 0x270000
	          end_va = 0x270fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000270000"
	        filename = ""

Region:
	              id = 2002
	        start_va = 0x280000
	          end_va = 0x281fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000280000"
	        filename = ""

Region:
	              id = 2003
	        start_va = 0x290000
	          end_va = 0x290fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 2004
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 2005
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 2006
	        start_va = 0x2a0000
	          end_va = 0x2a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002a0000"
	        filename = ""

Region:
	              id = 2007
	        start_va = 0x2b0000
	          end_va = 0x2b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002b0000"
	        filename = ""

Region:
	              id = 2008
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 2009
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 2010
	        start_va = 0xbc0000
	          end_va = 0xbfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000bc0000"
	        filename = ""

Region:
	              id = 2011
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 2012
	        start_va = 0x5c0000
	          end_va = 0x5c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 2013
	        start_va = 0x5d0000
	          end_va = 0x5d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005d0000"
	        filename = ""

Region:
	              id = 2014
	        start_va = 0x5e0000
	          end_va = 0x5e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005e0000"
	        filename = ""

Region:
	              id = 2015
	        start_va = 0xa60000
	          end_va = 0xb3efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a60000"
	        filename = ""

Region:
	              id = 2016
	        start_va = 0xb40000
	          end_va = 0xbadfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b40000"
	        filename = ""

Region:
	              id = 2017
	        start_va = 0xc80000
	          end_va = 0xcbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c80000"
	        filename = ""

Region:
	              id = 2018
	        start_va = 0xe60000
	          end_va = 0xf5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2019
	        start_va = 0xf80000
	          end_va = 0xfbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f80000"
	        filename = ""

Region:
	              id = 2020
	        start_va = 0x1090000
	          end_va = 0x118ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 2021
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 2022
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 2023
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 2024
	        start_va = 0xd50000
	          end_va = 0xd8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d50000"
	        filename = ""

Region:
	              id = 2025
	        start_va = 0xdc0000
	          end_va = 0xdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 2026
	        start_va = 0xfe0000
	          end_va = 0x101ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 2027
	        start_va = 0x27c0000
	          end_va = 0x28bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027c0000"
	        filename = ""

Region:
	              id = 2028
	        start_va = 0x28f0000
	          end_va = 0x29effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028f0000"
	        filename = ""

Region:
	              id = 2029
	        start_va = 0x2b90000
	          end_va = 0x2d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b90000"
	        filename = ""

Region:
	              id = 2030
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 2031
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2032
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 2033
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 2034
	        start_va = 0x71870000
	          end_va = 0x718a2fff
	     entry_point = 0x71870000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 2035
	        start_va = 0xbb0000
	          end_va = 0xbb0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000bb0000"
	        filename = ""

Region:
	              id = 2036
	        start_va = 0x1190000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001190000"
	        filename = ""

Region:
	              id = 2037
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2038
	        start_va = 0xc00000
	          end_va = 0xc00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c00000"
	        filename = ""

Region:
	              id = 2039
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 2040
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 2041
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 2042
	        start_va = 0x2a30000
	          end_va = 0x2a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a30000"
	        filename = ""

Region:
	              id = 2043
	        start_va = 0x2ec0000
	          end_va = 0x2fbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ec0000"
	        filename = ""

Region:
	              id = 2044
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 2045
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 2046
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 2047
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 2048
	        start_va = 0xc20000
	          end_va = 0xc3efff
	     entry_point = 0xc20000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 2049
	        start_va = 0xc40000
	          end_va = 0xc40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c40000"
	        filename = ""

Region:
	              id = 2050
	        start_va = 0x2fc0000
	          end_va = 0x33b2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002fc0000"
	        filename = ""

Region:
	              id = 2051
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 2052
	        start_va = 0xc10000
	          end_va = 0xc10fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c10000"
	        filename = ""

Region:
	              id = 2053
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 2054
	        start_va = 0x33d0000
	          end_va = 0x34cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033d0000"
	        filename = ""

Region:
	              id = 2055
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2056
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 2057
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 2099
	        start_va = 0xc50000
	          end_va = 0xc51fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c50000"
	        filename = ""

Region:
	              id = 2100
	        start_va = 0xc60000
	          end_va = 0xc61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c60000"
	        filename = ""

Region:
	              id = 2101
	        start_va = 0xc70000
	          end_va = 0xc7ffff
	     entry_point = 0xc70000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 2102
	        start_va = 0xcc0000
	          end_va = 0xcc7fff
	     entry_point = 0xcc0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 2103
	        start_va = 0xcd0000
	          end_va = 0xce3fff
	     entry_point = 0xcd0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 2104
	        start_va = 0x2a90000
	          end_va = 0x2acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a90000"
	        filename = ""

Region:
	              id = 2105
	        start_va = 0x35d0000
	          end_va = 0x36cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035d0000"
	        filename = ""

Region:
	              id = 2106
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 2107
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2108
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 2109
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 2110
	        start_va = 0x3800000
	          end_va = 0x383ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003800000"
	        filename = ""

Region:
	              id = 2111
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 2112
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 2113
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 2114
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2115
	        start_va = 0x3840000
	          end_va = 0x3b82fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003840000"
	        filename = ""

Region:
	              id = 2116
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 2117
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 2118
	        start_va = 0xd40000
	          end_va = 0xd4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d40000"
	        filename = ""

Region:
	              id = 2119
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 2120
	        start_va = 0xcf0000
	          end_va = 0xcf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000cf0000"
	        filename = ""

Region:
	              id = 2121
	        start_va = 0xd30000
	          end_va = 0xd31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d30000"
	        filename = ""

Region:
	              id = 2122
	        start_va = 0x3d30000
	          end_va = 0x3d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d30000"
	        filename = ""

Region:
	              id = 2123
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 2124
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 2125
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 2126
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 2127
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 2128
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 2129
	        start_va = 0x3ce0000
	          end_va = 0x3d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ce0000"
	        filename = ""

Region:
	              id = 2130
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 2131
	        start_va = 0xd00000
	          end_va = 0xd1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d00000"
	        filename = ""

Region:
	              id = 2132
	        start_va = 0xd20000
	          end_va = 0xd20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d20000"
	        filename = ""

Region:
	              id = 2133
	        start_va = 0x2b60000
	          end_va = 0x2b6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b60000"
	        filename = ""

Region:
	              id = 2134
	        start_va = 0x3d70000
	          end_va = 0x469ffff
	     entry_point = 0x3d70000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 2135
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 2136
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 2137
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 2138
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 2139
	        start_va = 0xd90000
	          end_va = 0xd90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d90000"
	        filename = ""

Region:
	              id = 2140
	        start_va = 0xda0000
	          end_va = 0xda2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000da0000"
	        filename = ""

Region:
	              id = 2141
	        start_va = 0x1040000
	          end_va = 0x104ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001040000"
	        filename = ""

Region:
	              id = 2142
	        start_va = 0x1070000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001070000"
	        filename = ""

Region:
	              id = 2143
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 2144
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 2145
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 2146
	        start_va = 0xdb0000
	          end_va = 0xdb3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 2147
	        start_va = 0xe40000
	          end_va = 0xe57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 2148
	        start_va = 0xf60000
	          end_va = 0xf6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f60000"
	        filename = ""

Region:
	              id = 2149
	        start_va = 0xf70000
	          end_va = 0xf70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f70000"
	        filename = ""

Region:
	              id = 2150
	        start_va = 0xfc0000
	          end_va = 0xfcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fc0000"
	        filename = ""

Region:
	              id = 2151
	        start_va = 0xfd0000
	          end_va = 0xfdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fd0000"
	        filename = ""

Region:
	              id = 2152
	        start_va = 0x1020000
	          end_va = 0x102ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 2153
	        start_va = 0x1030000
	          end_va = 0x103ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001030000"
	        filename = ""

Region:
	              id = 2154
	        start_va = 0x1050000
	          end_va = 0x105ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001050000"
	        filename = ""

Region:
	              id = 2155
	        start_va = 0x1060000
	          end_va = 0x106ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 2156
	        start_va = 0x1080000
	          end_va = 0x108ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001080000"
	        filename = ""

Region:
	              id = 2157
	        start_va = 0x2e10000
	          end_va = 0x2e4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e10000"
	        filename = ""

Region:
	              id = 2158
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 2159
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 2160
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 2161
	        start_va = 0x2750000
	          end_va = 0x275ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 2162
	        start_va = 0x2760000
	          end_va = 0x276ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002760000"
	        filename = ""

Region:
	              id = 2163
	        start_va = 0x2770000
	          end_va = 0x2770fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002770000"
	        filename = ""

Region:
	              id = 2164
	        start_va = 0x2780000
	          end_va = 0x2780fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002780000"
	        filename = ""

Region:
	              id = 2165
	        start_va = 0x3500000
	          end_va = 0x353ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003500000"
	        filename = ""

Region:
	              id = 2166
	        start_va = 0x3580000
	          end_va = 0x35bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003580000"
	        filename = ""

Region:
	              id = 2167
	        start_va = 0x46a0000
	          end_va = 0x479ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046a0000"
	        filename = ""

Region:
	              id = 2168
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 2169
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 2170
	        start_va = 0x2790000
	          end_va = 0x2790fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002790000"
	        filename = ""

Region:
	              id = 2171
	        start_va = 0x27a0000
	          end_va = 0x27affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027a0000"
	        filename = ""

Region:
	              id = 2172
	        start_va = 0x27b0000
	          end_va = 0x27b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000027b0000"
	        filename = ""

Region:
	              id = 2173
	        start_va = 0x28c0000
	          end_va = 0x28c2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000028c0000"
	        filename = ""

Region:
	              id = 2174
	        start_va = 0x2b00000
	          end_va = 0x2b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b00000"
	        filename = ""

Region:
	              id = 2175
	        start_va = 0x2dc0000
	          end_va = 0x2dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002dc0000"
	        filename = ""

Region:
	              id = 2176
	        start_va = 0x36f0000
	          end_va = 0x37effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036f0000"
	        filename = ""

Region:
	              id = 2177
	        start_va = 0x3bb0000
	          end_va = 0x3beffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003bb0000"
	        filename = ""

Region:
	              id = 2178
	        start_va = 0x47a0000
	          end_va = 0x489ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000047a0000"
	        filename = ""

Region:
	              id = 2179
	        start_va = 0x4900000
	          end_va = 0x49fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004900000"
	        filename = ""

Region:
	              id = 2180
	        start_va = 0x4bb0000
	          end_va = 0x4bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bb0000"
	        filename = ""

Region:
	              id = 2181
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 2182
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 2183
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 2184
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 2185
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 2186
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 2187
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 2188
	        start_va = 0x28d0000
	          end_va = 0x28d3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028d0000"
	        filename = ""

Region:
	              id = 2189
	        start_va = 0x28e0000
	          end_va = 0x28effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028e0000"
	        filename = ""

Region:
	              id = 2190
	        start_va = 0x29f0000
	          end_va = 0x2a07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029f0000"
	        filename = ""

Region:
	              id = 2191
	        start_va = 0x2a10000
	          end_va = 0x2a10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a10000"
	        filename = ""

Region:
	              id = 2192
	        start_va = 0x2a20000
	          end_va = 0x2a2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a20000"
	        filename = ""

Region:
	              id = 2193
	        start_va = 0x2a70000
	          end_va = 0x2a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a70000"
	        filename = ""

Region:
	              id = 2194
	        start_va = 0x2a80000
	          end_va = 0x2a8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a80000"
	        filename = ""

Region:
	              id = 2195
	        start_va = 0x2ad0000
	          end_va = 0x2adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ad0000"
	        filename = ""

Region:
	              id = 2196
	        start_va = 0x2ae0000
	          end_va = 0x2aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ae0000"
	        filename = ""

Region:
	              id = 2197
	        start_va = 0x2af0000
	          end_va = 0x2afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002af0000"
	        filename = ""

Region:
	              id = 2198
	        start_va = 0x2b40000
	          end_va = 0x2b41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002b40000"
	        filename = ""

Region:
	              id = 2199
	        start_va = 0x3c80000
	          end_va = 0x3c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c80000"
	        filename = ""

Region:
	              id = 2200
	        start_va = 0x4d90000
	          end_va = 0x4d9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d90000"
	        filename = ""

Region:
	              id = 2201
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 2202
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 2203
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 2204
	        start_va = 0x2b50000
	          end_va = 0x2b57fff
	     entry_point = 0x2b50000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 2205
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 2206
	        start_va = 0x2b70000
	          end_va = 0x2b7cfff
	     entry_point = 0x2b70000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 2207
	        start_va = 0x2b80000
	          end_va = 0x2b80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b80000"
	        filename = ""

Region:
	              id = 2208
	        start_va = 0x2d90000
	          end_va = 0x2da1fff
	     entry_point = 0x2d90000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 2209
	        start_va = 0x2db0000
	          end_va = 0x2db0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002db0000"
	        filename = ""

Region:
	              id = 2210
	        start_va = 0x2e00000
	          end_va = 0x2e00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e00000"
	        filename = ""

Region:
	              id = 2211
	        start_va = 0x2e50000
	          end_va = 0x2e50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e50000"
	        filename = ""

Region:
	              id = 2212
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 2213
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 2214
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 2215
	        start_va = 0x2e60000
	          end_va = 0x2e60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e60000"
	        filename = ""

Region:
	              id = 2216
	        start_va = 0x4ae0000
	          end_va = 0x4b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ae0000"
	        filename = ""

Region:
	              id = 2217
	        start_va = 0x4e40000
	          end_va = 0x4f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e40000"
	        filename = ""

Region:
	              id = 2218
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 2219
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 2220
	        start_va = 0x3c00000
	          end_va = 0x3c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c00000"
	        filename = ""

Region:
	              id = 2221
	        start_va = 0x4a30000
	          end_va = 0x4a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a30000"
	        filename = ""

Region:
	              id = 2222
	        start_va = 0x4b40000
	          end_va = 0x4b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b40000"
	        filename = ""

Region:
	              id = 2223
	        start_va = 0x4be0000
	          end_va = 0x4cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004be0000"
	        filename = ""

Region:
	              id = 2224
	        start_va = 0x4ce0000
	          end_va = 0x4ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ce0000"
	        filename = ""

Region:
	              id = 2225
	        start_va = 0x4fd0000
	          end_va = 0x50cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fd0000"
	        filename = ""

Region:
	              id = 2226
	        start_va = 0x5250000
	          end_va = 0x534ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005250000"
	        filename = ""

Region:
	              id = 2227
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 2228
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 2229
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 2230
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 2231
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 2232
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 2233
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 2234
	        start_va = 0x2e70000
	          end_va = 0x2e70fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e70000"
	        filename = ""

Region:
	              id = 2235
	        start_va = 0x4cf0000
	          end_va = 0x4d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cf0000"
	        filename = ""

Region:
	              id = 2236
	        start_va = 0x50d0000
	          end_va = 0x51cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050d0000"
	        filename = ""

Region:
	              id = 2237
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 2238
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 2239
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 2240
	        start_va = 0x2e80000
	          end_va = 0x2e83fff
	     entry_point = 0x2e80000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 2241
	        start_va = 0x48a0000
	          end_va = 0x48fcfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000048a0000"
	        filename = ""

Region:
	              id = 2242
	        start_va = 0x4de0000
	          end_va = 0x4e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004de0000"
	        filename = ""

Region:
	              id = 2243
	        start_va = 0x5530000
	          end_va = 0x562ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005530000"
	        filename = ""

Region:
	              id = 2244
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 2245
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 2246
	        start_va = 0x2e90000
	          end_va = 0x2e90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e90000"
	        filename = ""

Region:
	              id = 2247
	        start_va = 0x2ea0000
	          end_va = 0x2ea0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002ea0000"
	        filename = ""

Region:
	              id = 2248
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2249
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 2250
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2251
	        start_va = 0x5350000
	          end_va = 0x544ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005350000"
	        filename = ""

Region:
	              id = 2252
	        start_va = 0x5630000
	          end_va = 0x582ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005630000"
	        filename = ""

Region:
	              id = 2253
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 2254
	        start_va = 0x2eb0000
	          end_va = 0x2eb0fff
	     entry_point = 0x2eb0000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 2255
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 2256
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 2257
	        start_va = 0x33c0000
	          end_va = 0x33c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033c0000"
	        filename = ""

Region:
	              id = 2258
	        start_va = 0x34d0000
	          end_va = 0x34d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034d0000"
	        filename = ""

Region:
	              id = 2259
	        start_va = 0x34f0000
	          end_va = 0x34f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034f0000"
	        filename = ""

Region:
	              id = 2260
	        start_va = 0x4f50000
	          end_va = 0x4f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f50000"
	        filename = ""

Region:
	              id = 2261
	        start_va = 0x5850000
	          end_va = 0x594ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005850000"
	        filename = ""

Region:
	              id = 2262
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 2263
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 2264
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 2265
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 2266
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 2269
	        start_va = 0x34e0000
	          end_va = 0x34e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034e0000"
	        filename = ""

Region:
	              id = 2270
	        start_va = 0x3540000
	          end_va = 0x3550fff
	     entry_point = 0x3540000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 2271
	        start_va = 0x3560000
	          end_va = 0x3567fff
	     entry_point = 0x3560000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 2272
	        start_va = 0x3570000
	          end_va = 0x3573fff
	     entry_point = 0x3570000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 2273
	        start_va = 0x51e0000
	          end_va = 0x521ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051e0000"
	        filename = ""

Region:
	              id = 2274
	        start_va = 0x5450000
	          end_va = 0x54f7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005450000"
	        filename = ""

Region:
	              id = 2275
	        start_va = 0x5950000
	          end_va = 0x5a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005950000"
	        filename = ""

Region:
	              id = 2276
	        start_va = 0x5a50000
	          end_va = 0x5a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a50000"
	        filename = ""

Region:
	              id = 2277
	        start_va = 0x5a60000
	          end_va = 0x5e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a60000"
	        filename = ""

Region:
	              id = 2278
	        start_va = 0x5e60000
	          end_va = 0x605ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e60000"
	        filename = ""

Region:
	              id = 2279
	        start_va = 0x6060000
	          end_va = 0x645ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006060000"
	        filename = ""

Region:
	              id = 2280
	        start_va = 0x6460000
	          end_va = 0x65a1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006460000"
	        filename = ""

Region:
	              id = 2281
	        start_va = 0x65b0000
	          end_va = 0x6daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000065b0000"
	        filename = ""

Region:
	              id = 2282
	        start_va = 0x6e60000
	          end_va = 0x6f76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e60000"
	        filename = ""

Region:
	              id = 2283
	        start_va = 0x6fd0000
	          end_va = 0x70cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fd0000"
	        filename = ""

Region:
	              id = 2284
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 2285
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 2286
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 2287
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 2785
	        start_va = 0x35c0000
	          end_va = 0x35c1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035c0000"
	        filename = ""

Region:
	              id = 2786
	        start_va = 0x36d0000
	          end_va = 0x36d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036d0000"
	        filename = ""

Region:
	              id = 2787
	        start_va = 0x36e0000
	          end_va = 0x36e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036e0000"
	        filename = ""

Region:
	              id = 2788
	        start_va = 0x37f0000
	          end_va = 0x37f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037f0000"
	        filename = ""

Region:
	              id = 2789
	        start_va = 0x3b90000
	          end_va = 0x3b90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b90000"
	        filename = ""

Region:
	              id = 2790
	        start_va = 0x3ba0000
	          end_va = 0x3ba0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ba0000"
	        filename = ""

Region:
	              id = 2791
	        start_va = 0x3bf0000
	          end_va = 0x3bf1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003bf0000"
	        filename = ""

Region:
	              id = 2792
	        start_va = 0x3c90000
	          end_va = 0x3cd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c90000"
	        filename = ""

Region:
	              id = 2793
	        start_va = 0x4a70000
	          end_va = 0x4abbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a70000"
	        filename = ""

Region:
	              id = 2794
	        start_va = 0x6db0000
	          end_va = 0x6e47fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006db0000"
	        filename = ""

Region:
	              id = 2795
	        start_va = 0x7140000
	          end_va = 0x717ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007140000"
	        filename = ""

Region:
	              id = 2796
	        start_va = 0x71d0000
	          end_va = 0x720ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000071d0000"
	        filename = ""

Region:
	              id = 2797
	        start_va = 0x7280000
	          end_va = 0x737ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007280000"
	        filename = ""

Region:
	              id = 2798
	        start_va = 0x7380000
	          end_va = 0x7427fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007380000"
	        filename = ""

Region:
	              id = 2799
	        start_va = 0x7490000
	          end_va = 0x758ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007490000"
	        filename = ""

Region:
	              id = 2800
	        start_va = 0x75b0000
	          end_va = 0x77affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000075b0000"
	        filename = ""

Region:
	              id = 2801
	        start_va = 0x7850000
	          end_va = 0x7991fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007850000"
	        filename = ""

Region:
	              id = 2802
	        start_va = 0x7b20000
	          end_va = 0x7c34fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007b20000"
	        filename = ""

Region:
	              id = 2803
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")

Region:
	              id = 2804
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 2805
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""


Thread:
	id = 132
	os_tid = 0x8c0


Thread:
	id = 133
	os_tid = 0x8c4


Thread:
	id = 134
	os_tid = 0x8c8


Thread:
	id = 135
	os_tid = 0x8cc


Thread:
	id = 136
	os_tid = 0x8d0


Thread:
	id = 137
	os_tid = 0x8d4


Thread:
	id = 138
	os_tid = 0x8d8


Thread:
	id = 139
	os_tid = 0x8dc


Thread:
	id = 140
	os_tid = 0x8e0


Thread:
	id = 145
	os_tid = 0x8f4


Thread:
	id = 146
	os_tid = 0x8f8


Thread:
	id = 147
	os_tid = 0x8fc


Thread:
	id = 148
	os_tid = 0x900


Thread:
	id = 150
	os_tid = 0x908


Thread:
	id = 151
	os_tid = 0x90c


Thread:
	id = 152
	os_tid = 0x910


Thread:
	id = 153
	os_tid = 0x914


Thread:
	id = 154
	os_tid = 0x918


Thread:
	id = 157
	os_tid = 0x930


Thread:
	id = 158
	os_tid = 0x93c


Thread:
	id = 167
	os_tid = 0x970


Thread:
	id = 187
	os_tid = 0x9dc


Thread:
	id = 293
	os_tid = 0xbf0


Thread:
	id = 441
	os_tid = 0xd24


Thread:
	id = 442
	os_tid = 0xd28


Process:
	id = "9"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x1d772000"
	os_pid = "0x954"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:79881"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2293
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2294
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2295
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2296
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 2297
	        start_va = 0x70000
	          end_va = 0xaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 2298
	        start_va = 0x110000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 2299
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 2300
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2301
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2302
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 2303
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 2304
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 2305
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 2306
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2307
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2308
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2309
	        start_va = 0x320000
	          end_va = 0x39ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000320000"
	        filename = ""

Region:
	              id = 2310
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2311
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2312
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2313
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2314
	        start_va = 0x210000
	          end_va = 0x276fff
	     entry_point = 0x210000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2315
	        start_va = 0x470000
	          end_va = 0x47ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 2316
	        start_va = 0x4b0000
	          end_va = 0x5affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 2317
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2318
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2319
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 2320
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2321
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2322
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 2323
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2324
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2325
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 2326
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2327
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2328
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2329
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 2330
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2331
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 2332
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 2333
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2334
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 2335
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 2336
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2337
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2338
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 2339
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 2340
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2341
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2342
	        start_va = 0x5b0000
	          end_va = 0x737fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005b0000"
	        filename = ""

Region:
	              id = 2343
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 2344
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2345
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 2346
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2347
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 2348
	        start_va = 0xb0000
	          end_va = 0xb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 2349
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 2350
	        start_va = 0x740000
	          end_va = 0x8c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000740000"
	        filename = ""

Region:
	              id = 2351
	        start_va = 0x8d0000
	          end_va = 0xb9efff
	     entry_point = 0x8d0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2352
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 2353
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 2354
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 2355
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 2356
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0xd0000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 2357
	        start_va = 0xe0000
	          end_va = 0xe1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2358
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2359
	        start_va = 0x100000
	          end_va = 0x101fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000100000"
	        filename = ""

Region:
	              id = 2360
	        start_va = 0x280000
	          end_va = 0x280fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000280000"
	        filename = ""

Region:
	              id = 2361
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 2362
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 2363
	        start_va = 0x290000
	          end_va = 0x290fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000290000"
	        filename = ""

Region:
	              id = 2364
	        start_va = 0x2a0000
	          end_va = 0x2a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002a0000"
	        filename = ""

Region:
	              id = 2365
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 2366
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 2367
	        start_va = 0xd50000
	          end_va = 0xd8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d50000"
	        filename = ""

Region:
	              id = 2368
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 2369
	        start_va = 0x2b0000
	          end_va = 0x2b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002b0000"
	        filename = ""

Region:
	              id = 2370
	        start_va = 0x2c0000
	          end_va = 0x2c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002c0000"
	        filename = ""

Region:
	              id = 2371
	        start_va = 0x2d0000
	          end_va = 0x2d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002d0000"
	        filename = ""

Region:
	              id = 2372
	        start_va = 0x3a0000
	          end_va = 0x40dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003a0000"
	        filename = ""

Region:
	              id = 2373
	        start_va = 0xba0000
	          end_va = 0xc7efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ba0000"
	        filename = ""

Region:
	              id = 2374
	        start_va = 0xdf0000
	          end_va = 0xe2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 2375
	        start_va = 0xe90000
	          end_va = 0xf8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 2376
	        start_va = 0xfd0000
	          end_va = 0x100ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fd0000"
	        filename = ""

Region:
	              id = 2377
	        start_va = 0x2750000
	          end_va = 0x284ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 2378
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 2379
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 2380
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 2381
	        start_va = 0xcc0000
	          end_va = 0xcfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cc0000"
	        filename = ""

Region:
	              id = 2382
	        start_va = 0xe30000
	          end_va = 0xe6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e30000"
	        filename = ""

Region:
	              id = 2383
	        start_va = 0x1110000
	          end_va = 0x120ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001110000"
	        filename = ""

Region:
	              id = 2384
	        start_va = 0x1250000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 2385
	        start_va = 0x28a0000
	          end_va = 0x299ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028a0000"
	        filename = ""

Region:
	              id = 2386
	        start_va = 0x2ae0000
	          end_va = 0x2cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ae0000"
	        filename = ""

Region:
	              id = 2387
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 2388
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2389
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 2390
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 2391
	        start_va = 0x71830000
	          end_va = 0x71862fff
	     entry_point = 0x71830000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 2392
	        start_va = 0x2e0000
	          end_va = 0x2e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002e0000"
	        filename = ""

Region:
	              id = 2393
	        start_va = 0x1010000
	          end_va = 0x110ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 2394
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2395
	        start_va = 0x2f0000
	          end_va = 0x2f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002f0000"
	        filename = ""

Region:
	              id = 2396
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 2397
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 2398
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 2399
	        start_va = 0x310000
	          end_va = 0x310fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000310000"
	        filename = ""

Region:
	              id = 2400
	        start_va = 0x410000
	          end_va = 0x42efff
	     entry_point = 0x410000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 2401
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 2402
	        start_va = 0x300000
	          end_va = 0x300fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000300000"
	        filename = ""

Region:
	              id = 2403
	        start_va = 0x2a50000
	          end_va = 0x2a8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a50000"
	        filename = ""

Region:
	              id = 2404
	        start_va = 0x2d80000
	          end_va = 0x2e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d80000"
	        filename = ""

Region:
	              id = 2405
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 2406
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 2407
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 2408
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 2409
	        start_va = 0x2e80000
	          end_va = 0x3272fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e80000"
	        filename = ""

Region:
	              id = 2410
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2411
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 2412
	        start_va = 0x430000
	          end_va = 0x431fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000430000"
	        filename = ""

Region:
	              id = 2413
	        start_va = 0x440000
	          end_va = 0x441fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000440000"
	        filename = ""

Region:
	              id = 2414
	        start_va = 0x450000
	          end_va = 0x45ffff
	     entry_point = 0x450000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 2415
	        start_va = 0x460000
	          end_va = 0x467fff
	     entry_point = 0x460000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 2416
	        start_va = 0x480000
	          end_va = 0x493fff
	     entry_point = 0x480000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 2417
	        start_va = 0x2860000
	          end_va = 0x289ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002860000"
	        filename = ""

Region:
	              id = 2418
	        start_va = 0x29f0000
	          end_va = 0x2a2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029f0000"
	        filename = ""

Region:
	              id = 2419
	        start_va = 0x32e0000
	          end_va = 0x33dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032e0000"
	        filename = ""

Region:
	              id = 2420
	        start_va = 0x3480000
	          end_va = 0x357ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003480000"
	        filename = ""

Region:
	              id = 2421
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 2422
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2423
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 2424
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 2425
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 2426
	        start_va = 0x3660000
	          end_va = 0x369ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003660000"
	        filename = ""

Region:
	              id = 2427
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 2428
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 2429
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 2430
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2431
	        start_va = 0x36a0000
	          end_va = 0x39e2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000036a0000"
	        filename = ""

Region:
	              id = 2432
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 2433
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 2434
	        start_va = 0x2d40000
	          end_va = 0x2d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d40000"
	        filename = ""

Region:
	              id = 2435
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 2436
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 2437
	        start_va = 0xcb0000
	          end_va = 0xcb1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cb0000"
	        filename = ""

Region:
	              id = 2438
	        start_va = 0xdb0000
	          end_va = 0xdeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 2439
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 2440
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 2441
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 2442
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 2443
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 2444
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 2445
	        start_va = 0x3bc0000
	          end_va = 0x3bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003bc0000"
	        filename = ""

Region:
	              id = 2446
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 2447
	        start_va = 0xc80000
	          end_va = 0xc9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c80000"
	        filename = ""

Region:
	              id = 2448
	        start_va = 0xca0000
	          end_va = 0xca0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ca0000"
	        filename = ""

Region:
	              id = 2449
	        start_va = 0x3b10000
	          end_va = 0x3b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b10000"
	        filename = ""

Region:
	              id = 2450
	        start_va = 0x3c00000
	          end_va = 0x452ffff
	     entry_point = 0x3c00000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 2451
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 2452
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 2453
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 2454
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 2455
	        start_va = 0xd00000
	          end_va = 0xd00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d00000"
	        filename = ""

Region:
	              id = 2456
	        start_va = 0xd10000
	          end_va = 0xd12fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d10000"
	        filename = ""

Region:
	              id = 2457
	        start_va = 0x46b0000
	          end_va = 0x46bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046b0000"
	        filename = ""

Region:
	              id = 2458
	        start_va = 0x4720000
	          end_va = 0x472ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004720000"
	        filename = ""

Region:
	              id = 2459
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 2460
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 2461
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 2462
	        start_va = 0xd20000
	          end_va = 0xd23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d20000"
	        filename = ""

Region:
	              id = 2463
	        start_va = 0xd30000
	          end_va = 0xd47fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d30000"
	        filename = ""

Region:
	              id = 2464
	        start_va = 0xd90000
	          end_va = 0xd9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d90000"
	        filename = ""

Region:
	              id = 2465
	        start_va = 0xda0000
	          end_va = 0xda0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000da0000"
	        filename = ""

Region:
	              id = 2466
	        start_va = 0xe70000
	          end_va = 0xe7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e70000"
	        filename = ""

Region:
	              id = 2467
	        start_va = 0xe80000
	          end_va = 0xe8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 2468
	        start_va = 0xf90000
	          end_va = 0xf9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f90000"
	        filename = ""

Region:
	              id = 2469
	        start_va = 0xfa0000
	          end_va = 0xfaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fa0000"
	        filename = ""

Region:
	              id = 2470
	        start_va = 0xfb0000
	          end_va = 0xfbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fb0000"
	        filename = ""

Region:
	              id = 2471
	        start_va = 0xfc0000
	          end_va = 0xfcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fc0000"
	        filename = ""

Region:
	              id = 2472
	        start_va = 0x1210000
	          end_va = 0x121ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001210000"
	        filename = ""

Region:
	              id = 2473
	        start_va = 0x29b0000
	          end_va = 0x29effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029b0000"
	        filename = ""

Region:
	              id = 2474
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 2475
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 2476
	        start_va = 0x1220000
	          end_va = 0x122ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001220000"
	        filename = ""

Region:
	              id = 2477
	        start_va = 0x1230000
	          end_va = 0x123ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001230000"
	        filename = ""

Region:
	              id = 2478
	        start_va = 0x1240000
	          end_va = 0x124ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 2479
	        start_va = 0x2740000
	          end_va = 0x2740fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002740000"
	        filename = ""

Region:
	              id = 2480
	        start_va = 0x2850000
	          end_va = 0x2850fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002850000"
	        filename = ""

Region:
	              id = 2481
	        start_va = 0x3a10000
	          end_va = 0x3a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a10000"
	        filename = ""

Region:
	              id = 2482
	        start_va = 0x4660000
	          end_va = 0x469ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004660000"
	        filename = ""

Region:
	              id = 2483
	        start_va = 0x4750000
	          end_va = 0x484ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004750000"
	        filename = ""

Region:
	              id = 2484
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 2485
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 2486
	        start_va = 0x29a0000
	          end_va = 0x29a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000029a0000"
	        filename = ""

Region:
	              id = 2487
	        start_va = 0x2a30000
	          end_va = 0x2a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a30000"
	        filename = ""

Region:
	              id = 2488
	        start_va = 0x2a40000
	          end_va = 0x2a40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a40000"
	        filename = ""

Region:
	              id = 2489
	        start_va = 0x2a90000
	          end_va = 0x2a92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a90000"
	        filename = ""

Region:
	              id = 2490
	        start_va = 0x35b0000
	          end_va = 0x35effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035b0000"
	        filename = ""

Region:
	              id = 2491
	        start_va = 0x3a50000
	          end_va = 0x3a8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a50000"
	        filename = ""

Region:
	              id = 2492
	        start_va = 0x3a90000
	          end_va = 0x3acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a90000"
	        filename = ""

Region:
	              id = 2493
	        start_va = 0x4610000
	          end_va = 0x461ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004610000"
	        filename = ""

Region:
	              id = 2494
	        start_va = 0x4850000
	          end_va = 0x494ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004850000"
	        filename = ""

Region:
	              id = 2495
	        start_va = 0x4970000
	          end_va = 0x4a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004970000"
	        filename = ""

Region:
	              id = 2496
	        start_va = 0x4ac0000
	          end_va = 0x4bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ac0000"
	        filename = ""

Region:
	              id = 2497
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 2498
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 2499
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 2500
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 2501
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 2502
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 2503
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 2504
	        start_va = 0x2aa0000
	          end_va = 0x2aa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002aa0000"
	        filename = ""

Region:
	              id = 2505
	        start_va = 0x2ab0000
	          end_va = 0x2ac7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ab0000"
	        filename = ""

Region:
	              id = 2506
	        start_va = 0x2ad0000
	          end_va = 0x2adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ad0000"
	        filename = ""

Region:
	              id = 2507
	        start_va = 0x2ce0000
	          end_va = 0x2ce0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ce0000"
	        filename = ""

Region:
	              id = 2508
	        start_va = 0x2cf0000
	          end_va = 0x2cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cf0000"
	        filename = ""

Region:
	              id = 2509
	        start_va = 0x2d00000
	          end_va = 0x2d0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d00000"
	        filename = ""

Region:
	              id = 2510
	        start_va = 0x2d10000
	          end_va = 0x2d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d10000"
	        filename = ""

Region:
	              id = 2511
	        start_va = 0x2d20000
	          end_va = 0x2d2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d20000"
	        filename = ""

Region:
	              id = 2512
	        start_va = 0x2d30000
	          end_va = 0x2d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d30000"
	        filename = ""

Region:
	              id = 2513
	        start_va = 0x2d50000
	          end_va = 0x2d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d50000"
	        filename = ""

Region:
	              id = 2514
	        start_va = 0x2d60000
	          end_va = 0x2d61fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002d60000"
	        filename = ""

Region:
	              id = 2515
	        start_va = 0x3460000
	          end_va = 0x346ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003460000"
	        filename = ""

Region:
	              id = 2516
	        start_va = 0x4cf0000
	          end_va = 0x4cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cf0000"
	        filename = ""

Region:
	              id = 2517
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 2518
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 2519
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 2520
	        start_va = 0x2d70000
	          end_va = 0x2d77fff
	     entry_point = 0x2d70000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 2521
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 2522
	        start_va = 0x3280000
	          end_va = 0x328cfff
	     entry_point = 0x3280000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 2523
	        start_va = 0x3290000
	          end_va = 0x32a1fff
	     entry_point = 0x3290000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 2524
	        start_va = 0x32b0000
	          end_va = 0x32b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032b0000"
	        filename = ""

Region:
	              id = 2525
	        start_va = 0x32c0000
	          end_va = 0x32c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032c0000"
	        filename = ""

Region:
	              id = 2526
	        start_va = 0x32d0000
	          end_va = 0x32d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032d0000"
	        filename = ""

Region:
	              id = 2527
	        start_va = 0x33e0000
	          end_va = 0x33e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033e0000"
	        filename = ""

Region:
	              id = 2528
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 2529
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 2530
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 2531
	        start_va = 0x33f0000
	          end_va = 0x33f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033f0000"
	        filename = ""

Region:
	              id = 2532
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 2533
	        start_va = 0x4560000
	          end_va = 0x459ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004560000"
	        filename = ""

Region:
	              id = 2534
	        start_va = 0x45d0000
	          end_va = 0x460ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045d0000"
	        filename = ""

Region:
	              id = 2535
	        start_va = 0x46e0000
	          end_va = 0x471ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046e0000"
	        filename = ""

Region:
	              id = 2536
	        start_va = 0x4bc0000
	          end_va = 0x4cbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bc0000"
	        filename = ""

Region:
	              id = 2537
	        start_va = 0x4d80000
	          end_va = 0x4dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d80000"
	        filename = ""

Region:
	              id = 2538
	        start_va = 0x4e60000
	          end_va = 0x4f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e60000"
	        filename = ""

Region:
	              id = 2539
	        start_va = 0x4fb0000
	          end_va = 0x50affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fb0000"
	        filename = ""

Region:
	              id = 2540
	        start_va = 0x5140000
	          end_va = 0x514ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005140000"
	        filename = ""

Region:
	              id = 2541
	        start_va = 0x5190000
	          end_va = 0x528ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005190000"
	        filename = ""

Region:
	              id = 2542
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 2543
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 2544
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 2545
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 2546
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 2547
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 2548
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 2549
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 2550
	        start_va = 0x3400000
	          end_va = 0x3400fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003400000"
	        filename = ""

Region:
	              id = 2551
	        start_va = 0x3b20000
	          end_va = 0x3b9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b20000"
	        filename = ""

Region:
	              id = 2552
	        start_va = 0x5290000
	          end_va = 0x538ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005290000"
	        filename = ""

Region:
	              id = 2553
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 2554
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 2555
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 2556
	        start_va = 0x3410000
	          end_va = 0x3413fff
	     entry_point = 0x3410000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 2557
	        start_va = 0x35f0000
	          end_va = 0x364cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035f0000"
	        filename = ""

Region:
	              id = 2558
	        start_va = 0x4d20000
	          end_va = 0x4d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d20000"
	        filename = ""

Region:
	              id = 2559
	        start_va = 0x54d0000
	          end_va = 0x55cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054d0000"
	        filename = ""

Region:
	              id = 2560
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 2561
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 2562
	        start_va = 0x3420000
	          end_va = 0x3420fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003420000"
	        filename = ""

Region:
	              id = 2563
	        start_va = 0x3430000
	          end_va = 0x3430fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003430000"
	        filename = ""

Region:
	              id = 2564
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2565
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 2566
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2567
	        start_va = 0x5390000
	          end_va = 0x548ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005390000"
	        filename = ""

Region:
	              id = 2568
	        start_va = 0x55d0000
	          end_va = 0x57cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000055d0000"
	        filename = ""

Region:
	              id = 2569
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 2570
	        start_va = 0x3440000
	          end_va = 0x3440fff
	     entry_point = 0x3440000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 2571
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 2572
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 2573
	        start_va = 0x3450000
	          end_va = 0x3450fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003450000"
	        filename = ""

Region:
	              id = 2574
	        start_va = 0x3470000
	          end_va = 0x3470fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003470000"
	        filename = ""

Region:
	              id = 2575
	        start_va = 0x3580000
	          end_va = 0x3587fff
	     entry_point = 0x3580000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 2576
	        start_va = 0x3590000
	          end_va = 0x3591fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003590000"
	        filename = ""

Region:
	              id = 2577
	        start_va = 0x39f0000
	          end_va = 0x3a00fff
	     entry_point = 0x39f0000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 2578
	        start_va = 0x4dc0000
	          end_va = 0x4dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004dc0000"
	        filename = ""

Region:
	              id = 2579
	        start_va = 0x4e20000
	          end_va = 0x4e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e20000"
	        filename = ""

Region:
	              id = 2580
	        start_va = 0x5810000
	          end_va = 0x584ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005810000"
	        filename = ""

Region:
	              id = 2581
	        start_va = 0x58b0000
	          end_va = 0x59affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058b0000"
	        filename = ""

Region:
	              id = 2582
	        start_va = 0x59b0000
	          end_va = 0x5aaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059b0000"
	        filename = ""

Region:
	              id = 2583
	        start_va = 0x5b50000
	          end_va = 0x5c4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005b50000"
	        filename = ""

Region:
	              id = 2584
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 2585
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 2586
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 2587
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 2588
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 2589
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 2590
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 2591
	        start_va = 0x35a0000
	          end_va = 0x35a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035a0000"
	        filename = ""

Region:
	              id = 2592
	        start_va = 0x3650000
	          end_va = 0x3653fff
	     entry_point = 0x3650000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 2593
	        start_va = 0x3b00000
	          end_va = 0x3b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b00000"
	        filename = ""

Region:
	              id = 2594
	        start_va = 0x5c50000
	          end_va = 0x604ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c50000"
	        filename = ""

Region:
	              id = 2595
	        start_va = 0x60b0000
	          end_va = 0x60effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000060b0000"
	        filename = ""

Region:
	              id = 2596
	        start_va = 0x60f0000
	          end_va = 0x62effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000060f0000"
	        filename = ""

Region:
	              id = 2597
	        start_va = 0x62f0000
	          end_va = 0x66effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000062f0000"
	        filename = ""

Region:
	              id = 2598
	        start_va = 0x66f0000
	          end_va = 0x6831fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000066f0000"
	        filename = ""

Region:
	              id = 2599
	        start_va = 0x6840000
	          end_va = 0x703ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006840000"
	        filename = ""

Region:
	              id = 2600
	        start_va = 0x7110000
	          end_va = 0x71b7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007110000"
	        filename = ""

Region:
	              id = 2601
	        start_va = 0x7270000
	          end_va = 0x7384fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007270000"
	        filename = ""

Region:
	              id = 2602
	        start_va = 0x73b0000
	          end_va = 0x74affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000073b0000"
	        filename = ""

Region:
	              id = 2603
	        start_va = 0x7590000
	          end_va = 0x768ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007590000"
	        filename = ""

Region:
	              id = 2604
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 2605
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 2606
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 2607
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 2610
	        start_va = 0x3ad0000
	          end_va = 0x3ad1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ad0000"
	        filename = ""

Region:
	              id = 2611
	        start_va = 0x3ae0000
	          end_va = 0x3ae0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ae0000"
	        filename = ""

Region:
	              id = 2612
	        start_va = 0x4a70000
	          end_va = 0x4ab7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a70000"
	        filename = ""

Region:
	              id = 2613
	        start_va = 0x4f60000
	          end_va = 0x4fabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f60000"
	        filename = ""

Region:
	              id = 2614
	        start_va = 0x5ab0000
	          end_va = 0x5b47fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ab0000"
	        filename = ""

Region:
	              id = 2615
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 161
	os_tid = 0x958


Thread:
	id = 162
	os_tid = 0x95c


Thread:
	id = 163
	os_tid = 0x960


Thread:
	id = 164
	os_tid = 0x964


Thread:
	id = 165
	os_tid = 0x968


Thread:
	id = 166
	os_tid = 0x96c


Thread:
	id = 168
	os_tid = 0x974


Thread:
	id = 169
	os_tid = 0x978


Thread:
	id = 170
	os_tid = 0x97c


Thread:
	id = 171
	os_tid = 0x980


Thread:
	id = 172
	os_tid = 0x984


Thread:
	id = 173
	os_tid = 0x988


Thread:
	id = 174
	os_tid = 0x98c


Thread:
	id = 175
	os_tid = 0x990


Thread:
	id = 176
	os_tid = 0x994


Thread:
	id = 177
	os_tid = 0x998


Thread:
	id = 178
	os_tid = 0x99c


Thread:
	id = 179
	os_tid = 0x9a0


Thread:
	id = 180
	os_tid = 0x9a4


Thread:
	id = 181
	os_tid = 0x9a8


Thread:
	id = 182
	os_tid = 0x9ac


Thread:
	id = 184
	os_tid = 0x9b4


Thread:
	id = 185
	os_tid = 0x9b8


Thread:
	id = 205
	os_tid = 0xa6c


Thread:
	id = 307
	os_tid = 0x128


Thread:
	id = 444
	os_tid = 0xd38


Process:
	id = "10"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x1e3a5000"
	os_pid = "0xa0c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:79886"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2661
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2662
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2663
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2664
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 2665
	        start_va = 0xb0000
	          end_va = 0xeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 2666
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 2667
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 2668
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2669
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2670
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 2671
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 2672
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 2673
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 2674
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2675
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2676
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2677
	        start_va = 0x4f0000
	          end_va = 0x56ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 2678
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2679
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2680
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2681
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2682
	        start_va = 0xf0000
	          end_va = 0x156fff
	     entry_point = 0xf0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2683
	        start_va = 0x1d0000
	          end_va = 0x1dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2684
	        start_va = 0x730000
	          end_va = 0x82ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 2685
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2686
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2687
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 2688
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2689
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2690
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 2691
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2692
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2693
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 2694
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2695
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2696
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2697
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 2698
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2699
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 2700
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 2701
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2702
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 2703
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 2704
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2705
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2706
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 2707
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 2708
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2709
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2710
	        start_va = 0x330000
	          end_va = 0x4b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000330000"
	        filename = ""

Region:
	              id = 2711
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 2712
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2713
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 2714
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2715
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 2716
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 2717
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 2718
	        start_va = 0x570000
	          end_va = 0x6f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000570000"
	        filename = ""

Region:
	              id = 2719
	        start_va = 0x830000
	          end_va = 0xafefff
	     entry_point = 0x830000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2720
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 2721
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 2722
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 2723
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 2724
	        start_va = 0x90000
	          end_va = 0x90fff
	     entry_point = 0x90000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 2725
	        start_va = 0xa0000
	          end_va = 0xa1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2726
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 2727
	        start_va = 0x170000
	          end_va = 0x171fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 2728
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 2729
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 2730
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 2731
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 2732
	        start_va = 0x1a0000
	          end_va = 0x1a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2733
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 2734
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 2735
	        start_va = 0xc60000
	          end_va = 0xc9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c60000"
	        filename = ""

Region:
	              id = 2736
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 2737
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2738
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2739
	        start_va = 0x1e0000
	          end_va = 0x1e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 2740
	        start_va = 0xb00000
	          end_va = 0xbdefff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b00000"
	        filename = ""

Region:
	              id = 2741
	        start_va = 0xbe0000
	          end_va = 0xc4dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000be0000"
	        filename = ""

Region:
	              id = 2742
	        start_va = 0xcf0000
	          end_va = 0xd2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cf0000"
	        filename = ""

Region:
	              id = 2743
	        start_va = 0xdb0000
	          end_va = 0xdeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 2744
	        start_va = 0xed0000
	          end_va = 0xfcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ed0000"
	        filename = ""

Region:
	              id = 2745
	        start_va = 0x2750000
	          end_va = 0x284ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 2746
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 2747
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 2748
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 2749
	        start_va = 0xd40000
	          end_va = 0xd7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d40000"
	        filename = ""

Region:
	              id = 2750
	        start_va = 0xe70000
	          end_va = 0xeaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e70000"
	        filename = ""

Region:
	              id = 2751
	        start_va = 0x1010000
	          end_va = 0x110ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 2752
	        start_va = 0x1190000
	          end_va = 0x11cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001190000"
	        filename = ""

Region:
	              id = 2753
	        start_va = 0x2a30000
	          end_va = 0x2b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a30000"
	        filename = ""

Region:
	              id = 2754
	        start_va = 0x2c50000
	          end_va = 0x2e4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c50000"
	        filename = ""

Region:
	              id = 2755
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 2756
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2757
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 2758
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 2759
	        start_va = 0x716a0000
	          end_va = 0x716d2fff
	     entry_point = 0x716a0000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 2760
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2761
	        start_va = 0x2850000
	          end_va = 0x294ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002850000"
	        filename = ""

Region:
	              id = 2762
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2763
	        start_va = 0x200000
	          end_va = 0x200fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000200000"
	        filename = ""

Region:
	              id = 2764
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 2765
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 2766
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 2767
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 2768
	        start_va = 0x4c0000
	          end_va = 0x4defff
	     entry_point = 0x4c0000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 2769
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 2770
	        start_va = 0x210000
	          end_va = 0x210fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000210000"
	        filename = ""

Region:
	              id = 2771
	        start_va = 0x1240000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 2772
	        start_va = 0x2fe0000
	          end_va = 0x30dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fe0000"
	        filename = ""

Region:
	              id = 2773
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 2774
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 2775
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 2776
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 2777
	        start_va = 0x1200000
	          end_va = 0x123ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001200000"
	        filename = ""

Region:
	              id = 2778
	        start_va = 0x30e0000
	          end_va = 0x34d2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000030e0000"
	        filename = ""

Region:
	              id = 2779
	        start_va = 0x34f0000
	          end_va = 0x35effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034f0000"
	        filename = ""

Region:
	              id = 2780
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2781
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 2782
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 2808
	        start_va = 0x4e0000
	          end_va = 0x4e1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 2809
	        start_va = 0x700000
	          end_va = 0x701fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000700000"
	        filename = ""

Region:
	              id = 2810
	        start_va = 0x710000
	          end_va = 0x71ffff
	     entry_point = 0x710000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 2811
	        start_va = 0x720000
	          end_va = 0x727fff
	     entry_point = 0x720000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 2812
	        start_va = 0xca0000
	          end_va = 0xcb3fff
	     entry_point = 0xca0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 2813
	        start_va = 0x2b30000
	          end_va = 0x2b6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b30000"
	        filename = ""

Region:
	              id = 2814
	        start_va = 0x36b0000
	          end_va = 0x37affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036b0000"
	        filename = ""

Region:
	              id = 2815
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 2816
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2817
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 2818
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 2819
	        start_va = 0x3910000
	          end_va = 0x394ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003910000"
	        filename = ""

Region:
	              id = 2820
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 2821
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 2822
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 2823
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2824
	        start_va = 0x3950000
	          end_va = 0x3c92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003950000"
	        filename = ""

Region:
	              id = 2825
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 2826
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 2827
	        start_va = 0x3e90000
	          end_va = 0x3e9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e90000"
	        filename = ""

Region:
	              id = 2828
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 2829
	        start_va = 0xc50000
	          end_va = 0xc50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c50000"
	        filename = ""

Region:
	              id = 2830
	        start_va = 0xd30000
	          end_va = 0xd31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d30000"
	        filename = ""

Region:
	              id = 2831
	        start_va = 0x2f20000
	          end_va = 0x2f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f20000"
	        filename = ""

Region:
	              id = 2832
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 2833
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 2834
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 2835
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 2836
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 2837
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 2838
	        start_va = 0x38a0000
	          end_va = 0x38dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000038a0000"
	        filename = ""

Region:
	              id = 2839
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 2840
	        start_va = 0xcc0000
	          end_va = 0xcdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cc0000"
	        filename = ""

Region:
	              id = 2841
	        start_va = 0xce0000
	          end_va = 0xce0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ce0000"
	        filename = ""

Region:
	              id = 2842
	        start_va = 0xe30000
	          end_va = 0xe3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e30000"
	        filename = ""

Region:
	              id = 2843
	        start_va = 0x3ea0000
	          end_va = 0x47cffff
	     entry_point = 0x3ea0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 2844
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 2845
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 2846
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 2847
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 2848
	        start_va = 0xd80000
	          end_va = 0xd80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d80000"
	        filename = ""

Region:
	              id = 2849
	        start_va = 0xd90000
	          end_va = 0xd92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d90000"
	        filename = ""

Region:
	              id = 2850
	        start_va = 0x3e20000
	          end_va = 0x3e2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e20000"
	        filename = ""

Region:
	              id = 2851
	        start_va = 0x3e60000
	          end_va = 0x3e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e60000"
	        filename = ""

Region:
	              id = 2852
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 2853
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 2854
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 2855
	        start_va = 0xda0000
	          end_va = 0xda3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000da0000"
	        filename = ""

Region:
	              id = 2856
	        start_va = 0xdf0000
	          end_va = 0xe07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 2857
	        start_va = 0xe10000
	          end_va = 0xe1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 2858
	        start_va = 0xe20000
	          end_va = 0xe20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 2859
	        start_va = 0xe40000
	          end_va = 0xe4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 2860
	        start_va = 0xe50000
	          end_va = 0xe5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 2861
	        start_va = 0xe60000
	          end_va = 0xe6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2862
	        start_va = 0xeb0000
	          end_va = 0xebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000eb0000"
	        filename = ""

Region:
	              id = 2863
	        start_va = 0xec0000
	          end_va = 0xecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 2864
	        start_va = 0xfd0000
	          end_va = 0xfdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fd0000"
	        filename = ""

Region:
	              id = 2865
	        start_va = 0xfe0000
	          end_va = 0xfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 2866
	        start_va = 0x29c0000
	          end_va = 0x29fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029c0000"
	        filename = ""

Region:
	              id = 2867
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 2868
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 2869
	        start_va = 0xff0000
	          end_va = 0xffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 2870
	        start_va = 0x1000000
	          end_va = 0x100ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 2871
	        start_va = 0x1110000
	          end_va = 0x111ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001110000"
	        filename = ""

Region:
	              id = 2872
	        start_va = 0x1120000
	          end_va = 0x1120fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001120000"
	        filename = ""

Region:
	              id = 2873
	        start_va = 0x1130000
	          end_va = 0x1130fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001130000"
	        filename = ""

Region:
	              id = 2874
	        start_va = 0x2c10000
	          end_va = 0x2c4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c10000"
	        filename = ""

Region:
	              id = 2875
	        start_va = 0x3600000
	          end_va = 0x363ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003600000"
	        filename = ""

Region:
	              id = 2876
	        start_va = 0x4880000
	          end_va = 0x497ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004880000"
	        filename = ""

Region:
	              id = 2877
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 2878
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 2879
	        start_va = 0x1140000
	          end_va = 0x1140fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001140000"
	        filename = ""

Region:
	              id = 2880
	        start_va = 0x1150000
	          end_va = 0x118ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001150000"
	        filename = ""

Region:
	              id = 2881
	        start_va = 0x11d0000
	          end_va = 0x11dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011d0000"
	        filename = ""

Region:
	              id = 2882
	        start_va = 0x11e0000
	          end_va = 0x11e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000011e0000"
	        filename = ""

Region:
	              id = 2883
	        start_va = 0x11f0000
	          end_va = 0x11f2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000011f0000"
	        filename = ""

Region:
	              id = 2884
	        start_va = 0x2b80000
	          end_va = 0x2bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b80000"
	        filename = ""

Region:
	              id = 2885
	        start_va = 0x3670000
	          end_va = 0x36affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003670000"
	        filename = ""

Region:
	              id = 2886
	        start_va = 0x4a10000
	          end_va = 0x4b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a10000"
	        filename = ""

Region:
	              id = 2887
	        start_va = 0x4ba0000
	          end_va = 0x4c9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ba0000"
	        filename = ""

Region:
	              id = 2888
	        start_va = 0x4d10000
	          end_va = 0x4e0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d10000"
	        filename = ""

Region:
	              id = 2889
	        start_va = 0x4f90000
	          end_va = 0x4f9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f90000"
	        filename = ""

Region:
	              id = 2890
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 2891
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 2892
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 2893
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 2894
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 2895
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 2896
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 2897
	        start_va = 0x1280000
	          end_va = 0x1283fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 2898
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 2899
	        start_va = 0x2950000
	          end_va = 0x2967fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002950000"
	        filename = ""

Region:
	              id = 2900
	        start_va = 0x2970000
	          end_va = 0x2970fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002970000"
	        filename = ""

Region:
	              id = 2901
	        start_va = 0x2980000
	          end_va = 0x298ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002980000"
	        filename = ""

Region:
	              id = 2902
	        start_va = 0x2990000
	          end_va = 0x299ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002990000"
	        filename = ""

Region:
	              id = 2903
	        start_va = 0x29a0000
	          end_va = 0x29affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029a0000"
	        filename = ""

Region:
	              id = 2904
	        start_va = 0x29b0000
	          end_va = 0x29bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029b0000"
	        filename = ""

Region:
	              id = 2905
	        start_va = 0x2a00000
	          end_va = 0x2a0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a00000"
	        filename = ""

Region:
	              id = 2906
	        start_va = 0x2a10000
	          end_va = 0x2a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a10000"
	        filename = ""

Region:
	              id = 2907
	        start_va = 0x2a20000
	          end_va = 0x2a21fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a20000"
	        filename = ""

Region:
	              id = 2908
	        start_va = 0x2c00000
	          end_va = 0x2c0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 2909
	        start_va = 0x3db0000
	          end_va = 0x3dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003db0000"
	        filename = ""

Region:
	              id = 2910
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 2911
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 2912
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 2913
	        start_va = 0x2b70000
	          end_va = 0x2b77fff
	     entry_point = 0x2b70000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 2914
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 2915
	        start_va = 0x2bc0000
	          end_va = 0x2bccfff
	     entry_point = 0x2bc0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 2916
	        start_va = 0x2bd0000
	          end_va = 0x2be1fff
	     entry_point = 0x2bd0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 2917
	        start_va = 0x2bf0000
	          end_va = 0x2bf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 2918
	        start_va = 0x2e50000
	          end_va = 0x2e50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e50000"
	        filename = ""

Region:
	              id = 2919
	        start_va = 0x2e60000
	          end_va = 0x2e60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e60000"
	        filename = ""

Region:
	              id = 2920
	        start_va = 0x2e70000
	          end_va = 0x2e70fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e70000"
	        filename = ""

Region:
	              id = 2921
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 2922
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 2923
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 2924
	        start_va = 0x2e80000
	          end_va = 0x2e80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e80000"
	        filename = ""

Region:
	              id = 2925
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 2926
	        start_va = 0x2e90000
	          end_va = 0x2ecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e90000"
	        filename = ""

Region:
	              id = 2927
	        start_va = 0x2fa0000
	          end_va = 0x2fdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002fa0000"
	        filename = ""

Region:
	              id = 2928
	        start_va = 0x3cd0000
	          end_va = 0x3d0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003cd0000"
	        filename = ""

Region:
	              id = 2929
	        start_va = 0x4800000
	          end_va = 0x483ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004800000"
	        filename = ""

Region:
	              id = 2930
	        start_va = 0x4e90000
	          end_va = 0x4f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e90000"
	        filename = ""

Region:
	              id = 2931
	        start_va = 0x5100000
	          end_va = 0x510ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005100000"
	        filename = ""

Region:
	              id = 2932
	        start_va = 0x5120000
	          end_va = 0x521ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005120000"
	        filename = ""

Region:
	              id = 2933
	        start_va = 0x5310000
	          end_va = 0x540ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005310000"
	        filename = ""

Region:
	              id = 2934
	        start_va = 0x5560000
	          end_va = 0x565ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005560000"
	        filename = ""

Region:
	              id = 2935
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 2936
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 2937
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 2938
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 2939
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 2940
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 2941
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 2942
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 2943
	        start_va = 0x2ed0000
	          end_va = 0x2ed0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002ed0000"
	        filename = ""

Region:
	              id = 2944
	        start_va = 0x37b0000
	          end_va = 0x382ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037b0000"
	        filename = ""

Region:
	              id = 2945
	        start_va = 0x4fa0000
	          end_va = 0x509ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fa0000"
	        filename = ""

Region:
	              id = 2946
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 2947
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 2948
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 2949
	        start_va = 0x2ee0000
	          end_va = 0x2ee3fff
	     entry_point = 0x2ee0000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 2950
	        start_va = 0x3830000
	          end_va = 0x388cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003830000"
	        filename = ""

Region:
	              id = 2951
	        start_va = 0x3d10000
	          end_va = 0x3d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d10000"
	        filename = ""

Region:
	              id = 2952
	        start_va = 0x5410000
	          end_va = 0x550ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005410000"
	        filename = ""

Region:
	              id = 2953
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 2954
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 2955
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2956
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 2957
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2962
	        start_va = 0x2ef0000
	          end_va = 0x2ef0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ef0000"
	        filename = ""

Region:
	              id = 2963
	        start_va = 0x2f00000
	          end_va = 0x2f00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f00000"
	        filename = ""

Region:
	              id = 2964
	        start_va = 0x2f10000
	          end_va = 0x2f10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f10000"
	        filename = ""

Region:
	              id = 2965
	        start_va = 0x2f60000
	          end_va = 0x2f61fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f60000"
	        filename = ""

Region:
	              id = 2966
	        start_va = 0x2f70000
	          end_va = 0x2f70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f70000"
	        filename = ""

Region:
	              id = 2967
	        start_va = 0x2f80000
	          end_va = 0x2f80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f80000"
	        filename = ""

Region:
	              id = 2968
	        start_va = 0x2f90000
	          end_va = 0x2f90fff
	     entry_point = 0x2f90000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 2969
	        start_va = 0x3d70000
	          end_va = 0x3daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d70000"
	        filename = ""

Region:
	              id = 2970
	        start_va = 0x4b10000
	          end_va = 0x4b4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b10000"
	        filename = ""

Region:
	              id = 2971
	        start_va = 0x5250000
	          end_va = 0x528ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005250000"
	        filename = ""

Region:
	              id = 2972
	        start_va = 0x56e0000
	          end_va = 0x58dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000056e0000"
	        filename = ""

Region:
	              id = 2973
	        start_va = 0x58e0000
	          end_va = 0x59dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058e0000"
	        filename = ""

Region:
	              id = 2974
	        start_va = 0x5aa0000
	          end_va = 0x5b9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005aa0000"
	        filename = ""

Region:
	              id = 2975
	        start_va = 0x5c80000
	          end_va = 0x5d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c80000"
	        filename = ""

Region:
	              id = 2976
	        start_va = 0x5d80000
	          end_va = 0x5f7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d80000"
	        filename = ""

Region:
	              id = 2977
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 2978
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 2979
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 2980
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 2981
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 2982
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 2983
	        start_va = 0x34e0000
	          end_va = 0x34e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034e0000"
	        filename = ""

Region:
	              id = 2984
	        start_va = 0x35f0000
	          end_va = 0x35f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035f0000"
	        filename = ""

Region:
	              id = 2985
	        start_va = 0x3650000
	          end_va = 0x3651fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003650000"
	        filename = ""

Region:
	              id = 2986
	        start_va = 0x52d0000
	          end_va = 0x530ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000052d0000"
	        filename = ""

Region:
	              id = 2987
	        start_va = 0x6140000
	          end_va = 0x623ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006140000"
	        filename = ""

Region:
	              id = 2988
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 2989
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 2990
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 2991
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 2992
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 3045
	        start_va = 0x3640000
	          end_va = 0x364ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003640000"
	        filename = ""

Region:
	              id = 3046
	        start_va = 0x3660000
	          end_va = 0x3661fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003660000"
	        filename = ""

Region:
	              id = 3047
	        start_va = 0x3890000
	          end_va = 0x3897fff
	     entry_point = 0x3890000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 3048
	        start_va = 0x38e0000
	          end_va = 0x38f0fff
	     entry_point = 0x38e0000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 3049
	        start_va = 0x3900000
	          end_va = 0x3903fff
	     entry_point = 0x3900000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 3050
	        start_va = 0x3dc0000
	          end_va = 0x3dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003dc0000"
	        filename = ""

Region:
	              id = 3051
	        start_va = 0x59e0000
	          end_va = 0x5a87fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059e0000"
	        filename = ""

Region:
	              id = 3052
	        start_va = 0x5f80000
	          end_va = 0x60c1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005f80000"
	        filename = ""

Region:
	              id = 3053
	        start_va = 0x6240000
	          end_va = 0x663ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006240000"
	        filename = ""

Region:
	              id = 3054
	        start_va = 0x6640000
	          end_va = 0x6e3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006640000"
	        filename = ""

Region:
	              id = 3055
	        start_va = 0x6e40000
	          end_va = 0x703ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e40000"
	        filename = ""

Region:
	              id = 3056
	        start_va = 0x7040000
	          end_va = 0x743ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007040000"
	        filename = ""

Region:
	              id = 3057
	        start_va = 0x74f0000
	          end_va = 0x7604fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000074f0000"
	        filename = ""

Region:
	              id = 3058
	        start_va = 0x7750000
	          end_va = 0x784ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007750000"
	        filename = ""

Region:
	              id = 3059
	        start_va = 0x79c0000
	          end_va = 0x7abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000079c0000"
	        filename = ""

Region:
	              id = 3060
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 3061
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 3062
	        start_va = 0x7ef74000
	          end_va = 0x7ef76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef74000"
	        filename = ""

Region:
	              id = 3063
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 3100
	        start_va = 0x3ca0000
	          end_va = 0x3ca1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ca0000"
	        filename = ""

Region:
	              id = 3101
	        start_va = 0x3cb0000
	          end_va = 0x3cb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003cb0000"
	        filename = ""

Region:
	              id = 3102
	        start_va = 0x4980000
	          end_va = 0x49c7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004980000"
	        filename = ""

Region:
	              id = 3103
	        start_va = 0x4b50000
	          end_va = 0x4b9bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b50000"
	        filename = ""

Region:
	              id = 3104
	        start_va = 0x5ba0000
	          end_va = 0x5c47fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ba0000"
	        filename = ""

Region:
	              id = 3105
	        start_va = 0x7440000
	          end_va = 0x74d7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007440000"
	        filename = ""

Region:
	              id = 3106
	        start_va = 0x7610000
	          end_va = 0x76a7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007610000"
	        filename = ""

Region:
	              id = 3107
	        start_va = 0x7850000
	          end_va = 0x7991fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007850000"
	        filename = ""

Region:
	              id = 3108
	        start_va = 0x7b70000
	          end_va = 0x7c84fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007b70000"
	        filename = ""

Region:
	              id = 3109
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 192
	os_tid = 0xa10


Thread:
	id = 193
	os_tid = 0xa14


Thread:
	id = 194
	os_tid = 0xa18


Thread:
	id = 195
	os_tid = 0xa1c


Thread:
	id = 196
	os_tid = 0xa20


Thread:
	id = 197
	os_tid = 0xa24


Thread:
	id = 198
	os_tid = 0xa28


Thread:
	id = 199
	os_tid = 0xa2c


Thread:
	id = 200
	os_tid = 0xa30


Thread:
	id = 206
	os_tid = 0xa70


Thread:
	id = 207
	os_tid = 0xa74


Thread:
	id = 208
	os_tid = 0xa78


Thread:
	id = 209
	os_tid = 0xa7c


Thread:
	id = 210
	os_tid = 0xa80


Thread:
	id = 211
	os_tid = 0xa84


Thread:
	id = 212
	os_tid = 0xa88


Thread:
	id = 213
	os_tid = 0xa8c


Thread:
	id = 214
	os_tid = 0xa90


Thread:
	id = 216
	os_tid = 0xa98


Thread:
	id = 217
	os_tid = 0xa9c


Thread:
	id = 218
	os_tid = 0xaa0


Thread:
	id = 219
	os_tid = 0xaa4


Thread:
	id = 222
	os_tid = 0xab8


Thread:
	id = 233
	os_tid = 0xae8


Thread:
	id = 338
	os_tid = 0x9f4


Thread:
	id = 473
	os_tid = 0xe40


Thread:
	id = 474
	os_tid = 0xe44


Process:
	id = "11"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x239ed000"
	os_pid = "0xab0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:145412"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2993
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2994
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2995
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2996
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 2997
	        start_va = 0xd0000
	          end_va = 0x10ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 2998
	        start_va = 0x170000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 2999
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 3000
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3001
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3002
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 3003
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 3004
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 3005
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 3006
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 3007
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3008
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3009
	        start_va = 0x3a0000
	          end_va = 0x41ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003a0000"
	        filename = ""

Region:
	              id = 3010
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3011
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3012
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3013
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3014
	        start_va = 0x60000
	          end_va = 0xc6fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3015
	        start_va = 0x390000
	          end_va = 0x39ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000390000"
	        filename = ""

Region:
	              id = 3016
	        start_va = 0x550000
	          end_va = 0x64ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 3017
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3018
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3019
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 3020
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3021
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3022
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 3023
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3024
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3025
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 3026
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3027
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3028
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3029
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 3030
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3031
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 3032
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 3033
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3034
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 3035
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 3036
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3037
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3038
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 3039
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 3040
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 3041
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 3042
	        start_va = 0x650000
	          end_va = 0x7d7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""

Region:
	              id = 3043
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 3044
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3064
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 3065
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3066
	        start_va = 0x110000
	          end_va = 0x111fff
	     entry_point = 0x110000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 3067
	        start_va = 0x120000
	          end_va = 0x120fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000120000"
	        filename = ""

Region:
	              id = 3068
	        start_va = 0x130000
	          end_va = 0x130fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 3069
	        start_va = 0x7e0000
	          end_va = 0x960fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 3070
	        start_va = 0x970000
	          end_va = 0xc3efff
	     entry_point = 0x970000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3071
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 3072
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 3073
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 3074
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 3075
	        start_va = 0x140000
	          end_va = 0x140fff
	     entry_point = 0x140000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 3076
	        start_va = 0x150000
	          end_va = 0x151fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 3077
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 3078
	        start_va = 0x270000
	          end_va = 0x271fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000270000"
	        filename = ""

Region:
	              id = 3079
	        start_va = 0x280000
	          end_va = 0x280fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000280000"
	        filename = ""

Region:
	              id = 3080
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 3081
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 3082
	        start_va = 0x290000
	          end_va = 0x290fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000290000"
	        filename = ""

Region:
	              id = 3083
	        start_va = 0x2a0000
	          end_va = 0x2a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002a0000"
	        filename = ""

Region:
	              id = 3084
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 3085
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 3086
	        start_va = 0xd40000
	          end_va = 0xd7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d40000"
	        filename = ""

Region:
	              id = 3087
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 3088
	        start_va = 0x2b0000
	          end_va = 0x38efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002b0000"
	        filename = ""

Region:
	              id = 3089
	        start_va = 0x420000
	          end_va = 0x420fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000420000"
	        filename = ""

Region:
	              id = 3090
	        start_va = 0x430000
	          end_va = 0x49dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000430000"
	        filename = ""

Region:
	              id = 3091
	        start_va = 0x4a0000
	          end_va = 0x4a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 3092
	        start_va = 0x4b0000
	          end_va = 0x4b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 3093
	        start_va = 0xce0000
	          end_va = 0xd1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ce0000"
	        filename = ""

Region:
	              id = 3094
	        start_va = 0xe60000
	          end_va = 0xf5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 3095
	        start_va = 0xfa0000
	          end_va = 0xfdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fa0000"
	        filename = ""

Region:
	              id = 3096
	        start_va = 0x2760000
	          end_va = 0x285ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002760000"
	        filename = ""

Region:
	              id = 3097
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 3098
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 3099
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 3110
	        start_va = 0xc80000
	          end_va = 0xcbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c80000"
	        filename = ""

Region:
	              id = 3111
	        start_va = 0xff0000
	          end_va = 0x102ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 3112
	        start_va = 0x1060000
	          end_va = 0x109ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 3113
	        start_va = 0x1120000
	          end_va = 0x121ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001120000"
	        filename = ""

Region:
	              id = 3114
	        start_va = 0x2890000
	          end_va = 0x298ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002890000"
	        filename = ""

Region:
	              id = 3115
	        start_va = 0x2b50000
	          end_va = 0x2d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b50000"
	        filename = ""

Region:
	              id = 3116
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 3117
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 3118
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 3119
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 3120
	        start_va = 0x71660000
	          end_va = 0x71692fff
	     entry_point = 0x71660000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 3121
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3122
	        start_va = 0x2990000
	          end_va = 0x2a8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002990000"
	        filename = ""

Region:
	              id = 3123
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3124
	        start_va = 0x4d0000
	          end_va = 0x4d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004d0000"
	        filename = ""

Region:
	              id = 3125
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 3126
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 3127
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 3128
	        start_va = 0x4f0000
	          end_va = 0x50efff
	     entry_point = 0x4f0000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 3129
	        start_va = 0x510000
	          end_va = 0x510fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000510000"
	        filename = ""

Region:
	              id = 3130
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 3131
	        start_va = 0x4e0000
	          end_va = 0x4e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004e0000"
	        filename = ""

Region:
	              id = 3132
	        start_va = 0xdb0000
	          end_va = 0xdeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 3133
	        start_va = 0x2d70000
	          end_va = 0x2e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d70000"
	        filename = ""

Region:
	              id = 3134
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 3135
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 3136
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 3137
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 3138
	        start_va = 0x2e70000
	          end_va = 0x3262fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e70000"
	        filename = ""

Region:
	              id = 3139
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 3140
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 3141
	        start_va = 0x520000
	          end_va = 0x521fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 3142
	        start_va = 0x530000
	          end_va = 0x531fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000530000"
	        filename = ""

Region:
	              id = 3143
	        start_va = 0x540000
	          end_va = 0x54ffff
	     entry_point = 0x540000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 3144
	        start_va = 0xc40000
	          end_va = 0xc47fff
	     entry_point = 0xc40000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 3145
	        start_va = 0xc50000
	          end_va = 0xc63fff
	     entry_point = 0xc50000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 3146
	        start_va = 0x32d0000
	          end_va = 0x330ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032d0000"
	        filename = ""

Region:
	              id = 3147
	        start_va = 0x3320000
	          end_va = 0x335ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003320000"
	        filename = ""

Region:
	              id = 3148
	        start_va = 0x3360000
	          end_va = 0x345ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003360000"
	        filename = ""

Region:
	              id = 3149
	        start_va = 0x34b0000
	          end_va = 0x35affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034b0000"
	        filename = ""

Region:
	              id = 3150
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 3151
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3152
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 3153
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 3154
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 3155
	        start_va = 0x3690000
	          end_va = 0x36cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003690000"
	        filename = ""

Region:
	              id = 3156
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 3157
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 3158
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 3159
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3160
	        start_va = 0x36d0000
	          end_va = 0x3a12fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000036d0000"
	        filename = ""

Region:
	              id = 3161
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 3162
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 3163
	        start_va = 0x3b20000
	          end_va = 0x3b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b20000"
	        filename = ""

Region:
	              id = 3164
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 3165
	        start_va = 0xc70000
	          end_va = 0xc70fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c70000"
	        filename = ""

Region:
	              id = 3166
	        start_va = 0xd30000
	          end_va = 0xd31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d30000"
	        filename = ""

Region:
	              id = 3167
	        start_va = 0x3d00000
	          end_va = 0x3d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d00000"
	        filename = ""

Region:
	              id = 3168
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 3169
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 3170
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 3171
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 3172
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 3173
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 3174
	        start_va = 0x3c70000
	          end_va = 0x3caffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c70000"
	        filename = ""

Region:
	              id = 3175
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 3176
	        start_va = 0xcc0000
	          end_va = 0xcdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cc0000"
	        filename = ""

Region:
	              id = 3177
	        start_va = 0xd20000
	          end_va = 0xd20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d20000"
	        filename = ""

Region:
	              id = 3178
	        start_va = 0x3b00000
	          end_va = 0x3b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b00000"
	        filename = ""

Region:
	              id = 3179
	        start_va = 0x3d40000
	          end_va = 0x466ffff
	     entry_point = 0x3d40000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 3180
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 3181
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 3182
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 3183
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 3184
	        start_va = 0xd80000
	          end_va = 0xd80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d80000"
	        filename = ""

Region:
	              id = 3185
	        start_va = 0xd90000
	          end_va = 0xd92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d90000"
	        filename = ""

Region:
	              id = 3186
	        start_va = 0xe20000
	          end_va = 0xe2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 3187
	        start_va = 0x4800000
	          end_va = 0x480ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004800000"
	        filename = ""

Region:
	              id = 3188
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 3189
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 3190
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 3191
	        start_va = 0xda0000
	          end_va = 0xda3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000da0000"
	        filename = ""

Region:
	              id = 3192
	        start_va = 0xdf0000
	          end_va = 0xe07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 3193
	        start_va = 0xe10000
	          end_va = 0xe1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 3194
	        start_va = 0xe30000
	          end_va = 0xe30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e30000"
	        filename = ""

Region:
	              id = 3195
	        start_va = 0xe40000
	          end_va = 0xe4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 3196
	        start_va = 0xe50000
	          end_va = 0xe5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 3197
	        start_va = 0xf60000
	          end_va = 0xf6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f60000"
	        filename = ""

Region:
	              id = 3198
	        start_va = 0xf70000
	          end_va = 0xf7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f70000"
	        filename = ""

Region:
	              id = 3199
	        start_va = 0xf80000
	          end_va = 0xf8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f80000"
	        filename = ""

Region:
	              id = 3200
	        start_va = 0xf90000
	          end_va = 0xf9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f90000"
	        filename = ""

Region:
	              id = 3201
	        start_va = 0xfe0000
	          end_va = 0xfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 3202
	        start_va = 0x3bf0000
	          end_va = 0x3c2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003bf0000"
	        filename = ""

Region:
	              id = 3203
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 3204
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 3205
	        start_va = 0x1030000
	          end_va = 0x103ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001030000"
	        filename = ""

Region:
	              id = 3206
	        start_va = 0x1040000
	          end_va = 0x104ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001040000"
	        filename = ""

Region:
	              id = 3207
	        start_va = 0x1050000
	          end_va = 0x105ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001050000"
	        filename = ""

Region:
	              id = 3208
	        start_va = 0x10a0000
	          end_va = 0x10a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010a0000"
	        filename = ""

Region:
	              id = 3209
	        start_va = 0x10b0000
	          end_va = 0x10b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010b0000"
	        filename = ""

Region:
	              id = 3210
	        start_va = 0x3460000
	          end_va = 0x349ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003460000"
	        filename = ""

Region:
	              id = 3211
	        start_va = 0x46f0000
	          end_va = 0x47effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046f0000"
	        filename = ""

Region:
	              id = 3212
	        start_va = 0x4970000
	          end_va = 0x49affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004970000"
	        filename = ""

Region:
	              id = 3213
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 3214
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 3215
	        start_va = 0x10c0000
	          end_va = 0x10c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010c0000"
	        filename = ""

Region:
	              id = 3216
	        start_va = 0x10d0000
	          end_va = 0x10dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010d0000"
	        filename = ""

Region:
	              id = 3217
	        start_va = 0x10e0000
	          end_va = 0x10e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010e0000"
	        filename = ""

Region:
	              id = 3218
	        start_va = 0x10f0000
	          end_va = 0x10f2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000010f0000"
	        filename = ""

Region:
	              id = 3219
	        start_va = 0x2ad0000
	          end_va = 0x2b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ad0000"
	        filename = ""

Region:
	              id = 3220
	        start_va = 0x35f0000
	          end_va = 0x362ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035f0000"
	        filename = ""

Region:
	              id = 3221
	        start_va = 0x3650000
	          end_va = 0x368ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003650000"
	        filename = ""

Region:
	              id = 3222
	        start_va = 0x4850000
	          end_va = 0x494ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004850000"
	        filename = ""

Region:
	              id = 3223
	        start_va = 0x4a40000
	          end_va = 0x4b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a40000"
	        filename = ""

Region:
	              id = 3224
	        start_va = 0x4c30000
	          end_va = 0x4c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c30000"
	        filename = ""

Region:
	              id = 3225
	        start_va = 0x4c80000
	          end_va = 0x4d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c80000"
	        filename = ""

Region:
	              id = 3226
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 3227
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 3228
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 3229
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 3230
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 3231
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 3232
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 3233
	        start_va = 0x1100000
	          end_va = 0x1103fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001100000"
	        filename = ""

Region:
	              id = 3234
	        start_va = 0x1110000
	          end_va = 0x111ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001110000"
	        filename = ""

Region:
	              id = 3235
	        start_va = 0x1220000
	          end_va = 0x1237fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001220000"
	        filename = ""

Region:
	              id = 3236
	        start_va = 0x1240000
	          end_va = 0x1240fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 3237
	        start_va = 0x1250000
	          end_va = 0x125ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 3238
	        start_va = 0x1260000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001260000"
	        filename = ""

Region:
	              id = 3239
	        start_va = 0x1270000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001270000"
	        filename = ""

Region:
	              id = 3240
	        start_va = 0x1280000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 3241
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 3242
	        start_va = 0x2750000
	          end_va = 0x275ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 3243
	        start_va = 0x2860000
	          end_va = 0x286ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002860000"
	        filename = ""

Region:
	              id = 3244
	        start_va = 0x2870000
	          end_va = 0x2871fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002870000"
	        filename = ""

Region:
	              id = 3245
	        start_va = 0x3a90000
	          end_va = 0x3a9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a90000"
	        filename = ""

Region:
	              id = 3246
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 3247
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 3248
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 3249
	        start_va = 0x2880000
	          end_va = 0x2887fff
	     entry_point = 0x2880000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 3250
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 3251
	        start_va = 0x2a90000
	          end_va = 0x2a9cfff
	     entry_point = 0x2a90000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 3252
	        start_va = 0x2aa0000
	          end_va = 0x2ab1fff
	     entry_point = 0x2aa0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 3253
	        start_va = 0x2ac0000
	          end_va = 0x2ac0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ac0000"
	        filename = ""

Region:
	              id = 3254
	        start_va = 0x2b10000
	          end_va = 0x2b10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b10000"
	        filename = ""

Region:
	              id = 3255
	        start_va = 0x2b20000
	          end_va = 0x2b20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b20000"
	        filename = ""

Region:
	              id = 3256
	        start_va = 0x2b30000
	          end_va = 0x2b30fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002b30000"
	        filename = ""

Region:
	              id = 3257
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 3258
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 3259
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 3260
	        start_va = 0x2b40000
	          end_va = 0x2b40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002b40000"
	        filename = ""

Region:
	              id = 3261
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 3262
	        start_va = 0x3a20000
	          end_va = 0x3a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a20000"
	        filename = ""

Region:
	              id = 3263
	        start_va = 0x3b80000
	          end_va = 0x3bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b80000"
	        filename = ""

Region:
	              id = 3264
	        start_va = 0x4810000
	          end_va = 0x484ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004810000"
	        filename = ""

Region:
	              id = 3265
	        start_va = 0x49e0000
	          end_va = 0x4a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049e0000"
	        filename = ""

Region:
	              id = 3266
	        start_va = 0x4e20000
	          end_va = 0x4f1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e20000"
	        filename = ""

Region:
	              id = 3267
	        start_va = 0x4fa0000
	          end_va = 0x509ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fa0000"
	        filename = ""

Region:
	              id = 3268
	        start_va = 0x50d0000
	          end_va = 0x50dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050d0000"
	        filename = ""

Region:
	              id = 3269
	        start_va = 0x5220000
	          end_va = 0x531ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005220000"
	        filename = ""

Region:
	              id = 3270
	        start_va = 0x5350000
	          end_va = 0x544ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005350000"
	        filename = ""

Region:
	              id = 3271
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 3272
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 3273
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 3274
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 3275
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 3276
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 3277
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 3278
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 3279
	        start_va = 0x2d50000
	          end_va = 0x2d50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002d50000"
	        filename = ""

Region:
	              id = 3280
	        start_va = 0x4670000
	          end_va = 0x46effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004670000"
	        filename = ""

Region:
	              id = 3281
	        start_va = 0x50e0000
	          end_va = 0x51dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050e0000"
	        filename = ""

Region:
	              id = 3282
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 3283
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 3284
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 3285
	        start_va = 0x2d60000
	          end_va = 0x2d63fff
	     entry_point = 0x2d60000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 3286
	        start_va = 0x3270000
	          end_va = 0x32ccfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003270000"
	        filename = ""

Region:
	              id = 3287
	        start_va = 0x4d80000
	          end_va = 0x4dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d80000"
	        filename = ""

Region:
	              id = 3288
	        start_va = 0x5450000
	          end_va = 0x554ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005450000"
	        filename = ""

Region:
	              id = 3289
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 3290
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 3291
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3292
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 3293
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3294
	        start_va = 0x5550000
	          end_va = 0x564ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005550000"
	        filename = ""

Region:
	              id = 3295
	        start_va = 0x5650000
	          end_va = 0x584ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005650000"
	        filename = ""

Region:
	              id = 3296
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 3297
	        start_va = 0x3310000
	          end_va = 0x3310fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003310000"
	        filename = ""

Region:
	              id = 3298
	        start_va = 0x34a0000
	          end_va = 0x34a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034a0000"
	        filename = ""

Region:
	              id = 3299
	        start_va = 0x35b0000
	          end_va = 0x35b0fff
	     entry_point = 0x35b0000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 3300
	        start_va = 0x4dc0000
	          end_va = 0x4dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004dc0000"
	        filename = ""

Region:
	              id = 3301
	        start_va = 0x5910000
	          end_va = 0x5a0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005910000"
	        filename = ""

Region:
	              id = 3302
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 3303
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 3304
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 3305
	        start_va = 0x35c0000
	          end_va = 0x35c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035c0000"
	        filename = ""

Region:
	              id = 3306
	        start_va = 0x35d0000
	          end_va = 0x35d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035d0000"
	        filename = ""

Region:
	              id = 3307
	        start_va = 0x3630000
	          end_va = 0x3631fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003630000"
	        filename = ""

Region:
	              id = 3308
	        start_va = 0x4f30000
	          end_va = 0x4f6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f30000"
	        filename = ""

Region:
	              id = 3309
	        start_va = 0x5bb0000
	          end_va = 0x5caffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005bb0000"
	        filename = ""

Region:
	              id = 3310
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 3311
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 3312
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 3313
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 3314
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 3315
	        start_va = 0x35e0000
	          end_va = 0x35e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035e0000"
	        filename = ""

Region:
	              id = 3316
	        start_va = 0x3640000
	          end_va = 0x3647fff
	     entry_point = 0x3640000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 3317
	        start_va = 0x3a60000
	          end_va = 0x3a70fff
	     entry_point = 0x3a60000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 3318
	        start_va = 0x3a80000
	          end_va = 0x3a83fff
	     entry_point = 0x3a80000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 3319
	        start_va = 0x3aa0000
	          end_va = 0x3aa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003aa0000"
	        filename = ""

Region:
	              id = 3320
	        start_va = 0x3ab0000
	          end_va = 0x3ab0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ab0000"
	        filename = ""

Region:
	              id = 3321
	        start_va = 0x3ac0000
	          end_va = 0x3ac0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ac0000"
	        filename = ""

Region:
	              id = 3322
	        start_va = 0x3ad0000
	          end_va = 0x3ad1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ad0000"
	        filename = ""

Region:
	              id = 3323
	        start_va = 0x3ae0000
	          end_va = 0x3ae0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ae0000"
	        filename = ""

Region:
	              id = 3324
	        start_va = 0x3b30000
	          end_va = 0x3b6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b30000"
	        filename = ""

Region:
	              id = 3325
	        start_va = 0x4b40000
	          end_va = 0x4be7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b40000"
	        filename = ""

Region:
	              id = 3326
	        start_va = 0x58d0000
	          end_va = 0x590ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058d0000"
	        filename = ""

Region:
	              id = 3327
	        start_va = 0x5a10000
	          end_va = 0x5aa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a10000"
	        filename = ""

Region:
	              id = 3328
	        start_va = 0x5cb0000
	          end_va = 0x5df1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005cb0000"
	        filename = ""

Region:
	              id = 3329
	        start_va = 0x5e50000
	          end_va = 0x5e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e50000"
	        filename = ""

Region:
	              id = 3330
	        start_va = 0x5e60000
	          end_va = 0x625ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e60000"
	        filename = ""

Region:
	              id = 3331
	        start_va = 0x6260000
	          end_va = 0x6376fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006260000"
	        filename = ""

Region:
	              id = 3332
	        start_va = 0x63a0000
	          end_va = 0x659ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000063a0000"
	        filename = ""

Region:
	              id = 3333
	        start_va = 0x65a0000
	          end_va = 0x679ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000065a0000"
	        filename = ""

Region:
	              id = 3334
	        start_va = 0x67a0000
	          end_va = 0x6b9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000067a0000"
	        filename = ""

Region:
	              id = 3335
	        start_va = 0x6ba0000
	          end_va = 0x739ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ba0000"
	        filename = ""

Region:
	              id = 3336
	        start_va = 0x73d0000
	          end_va = 0x74cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000073d0000"
	        filename = ""

Region:
	              id = 3337
	        start_va = 0x74e0000
	          end_va = 0x75dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000074e0000"
	        filename = ""

Region:
	              id = 3338
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 3339
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 3340
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 3341
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 3342
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 3343
	        start_va = 0x3af0000
	          end_va = 0x3af1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003af0000"
	        filename = ""

Region:
	              id = 3344
	        start_va = 0x3cb0000
	          end_va = 0x3cf7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003cb0000"
	        filename = ""

Region:
	              id = 3345
	        start_va = 0x5850000
	          end_va = 0x589bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005850000"
	        filename = ""

Region:
	              id = 3346
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 221
	os_tid = 0xab4


Thread:
	id = 223
	os_tid = 0xabc


Thread:
	id = 224
	os_tid = 0xac0


Thread:
	id = 225
	os_tid = 0xac8


Thread:
	id = 226
	os_tid = 0xacc


Thread:
	id = 227
	os_tid = 0xad0


Thread:
	id = 228
	os_tid = 0xad4


Thread:
	id = 229
	os_tid = 0xad8


Thread:
	id = 230
	os_tid = 0xadc


Thread:
	id = 231
	os_tid = 0xae0


Thread:
	id = 232
	os_tid = 0xae4


Thread:
	id = 234
	os_tid = 0xaec


Thread:
	id = 235
	os_tid = 0xaf0


Thread:
	id = 236
	os_tid = 0xaf4


Thread:
	id = 237
	os_tid = 0xaf8


Thread:
	id = 238
	os_tid = 0xafc


Thread:
	id = 239
	os_tid = 0xb00


Thread:
	id = 240
	os_tid = 0xb04


Thread:
	id = 241
	os_tid = 0xb08


Thread:
	id = 242
	os_tid = 0xb10


Thread:
	id = 244
	os_tid = 0xb18


Thread:
	id = 245
	os_tid = 0xb1c


Thread:
	id = 246
	os_tid = 0xb20


Thread:
	id = 340
	os_tid = 0x570


Thread:
	id = 476
	os_tid = 0xe50


Thread:
	id = 477
	os_tid = 0xe54


Process:
	id = "12"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x60740000"
	os_pid = "0xb34"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:210955"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3351
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3352
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3353
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 3354
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 3355
	        start_va = 0x190000
	          end_va = 0x1cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 3356
	        start_va = 0x1e0000
	          end_va = 0x2dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 3357
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 3358
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3359
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3360
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 3361
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 3362
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 3363
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 3364
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 3365
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3366
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3367
	        start_va = 0x70000
	          end_va = 0xeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 3368
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3369
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3370
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3371
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3372
	        start_va = 0xf0000
	          end_va = 0x156fff
	     entry_point = 0xf0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3373
	        start_va = 0x2f0000
	          end_va = 0x3effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002f0000"
	        filename = ""

Region:
	              id = 3374
	        start_va = 0x4b0000
	          end_va = 0x4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 3375
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3376
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3377
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 3378
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3379
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3380
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 3381
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3382
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3383
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 3384
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3385
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3386
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3387
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 3388
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3389
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 3390
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 3391
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3392
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 3393
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 3394
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3395
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3396
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 3397
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 3398
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 3399
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 3400
	        start_va = 0x4c0000
	          end_va = 0x647fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3401
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 3402
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3403
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 3404
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3405
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 3406
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000160000"
	        filename = ""

Region:
	              id = 3407
	        start_va = 0x170000
	          end_va = 0x170fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 3408
	        start_va = 0x650000
	          end_va = 0x7d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""

Region:
	              id = 3409
	        start_va = 0x7e0000
	          end_va = 0xaaefff
	     entry_point = 0x7e0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3410
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 3411
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 3412
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 3413
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 3414
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x180000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 3415
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3416
	        start_va = 0x2e0000
	          end_va = 0x2e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002e0000"
	        filename = ""

Region:
	              id = 3417
	        start_va = 0x3f0000
	          end_va = 0x3f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003f0000"
	        filename = ""

Region:
	              id = 3418
	        start_va = 0x400000
	          end_va = 0x400fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3419
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 3420
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 3421
	        start_va = 0x410000
	          end_va = 0x410fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000410000"
	        filename = ""

Region:
	              id = 3422
	        start_va = 0x420000
	          end_va = 0x421fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000420000"
	        filename = ""

Region:
	              id = 3423
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 3424
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 3425
	        start_va = 0xb10000
	          end_va = 0xb4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b10000"
	        filename = ""

Region:
	              id = 3426
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 3427
	        start_va = 0x430000
	          end_va = 0x430fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000430000"
	        filename = ""

Region:
	              id = 3428
	        start_va = 0x440000
	          end_va = 0x4adfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000440000"
	        filename = ""

Region:
	              id = 3429
	        start_va = 0xab0000
	          end_va = 0xab1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ab0000"
	        filename = ""

Region:
	              id = 3430
	        start_va = 0xac0000
	          end_va = 0xac1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ac0000"
	        filename = ""

Region:
	              id = 3431
	        start_va = 0xb50000
	          end_va = 0xc2efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b50000"
	        filename = ""

Region:
	              id = 3432
	        start_va = 0xcd0000
	          end_va = 0xdcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cd0000"
	        filename = ""

Region:
	              id = 3433
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 3434
	        start_va = 0xe80000
	          end_va = 0xebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 3435
	        start_va = 0x10a0000
	          end_va = 0x119ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 3436
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 3437
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 3438
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 3439
	        start_va = 0xad0000
	          end_va = 0xb0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ad0000"
	        filename = ""

Region:
	              id = 3440
	        start_va = 0xec0000
	          end_va = 0xfbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 3441
	        start_va = 0xfc0000
	          end_va = 0xffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fc0000"
	        filename = ""

Region:
	              id = 3442
	        start_va = 0x1040000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001040000"
	        filename = ""

Region:
	              id = 3443
	        start_va = 0x27d0000
	          end_va = 0x28cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027d0000"
	        filename = ""

Region:
	              id = 3444
	        start_va = 0x2a10000
	          end_va = 0x2c0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a10000"
	        filename = ""

Region:
	              id = 3445
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 3446
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 3447
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 3448
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 3449
	        start_va = 0x716a0000
	          end_va = 0x716d2fff
	     entry_point = 0x716a0000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 3450
	        start_va = 0xc30000
	          end_va = 0xc30fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c30000"
	        filename = ""

Region:
	              id = 3451
	        start_va = 0x28d0000
	          end_va = 0x29cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028d0000"
	        filename = ""

Region:
	              id = 3452
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3453
	        start_va = 0xc40000
	          end_va = 0xc40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c40000"
	        filename = ""

Region:
	              id = 3454
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 3455
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 3456
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 3457
	        start_va = 0xc60000
	          end_va = 0xc7efff
	     entry_point = 0xc60000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 3458
	        start_va = 0xc80000
	          end_va = 0xc80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c80000"
	        filename = ""

Region:
	              id = 3459
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 3460
	        start_va = 0xc50000
	          end_va = 0xc50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c50000"
	        filename = ""

Region:
	              id = 3461
	        start_va = 0x2c50000
	          end_va = 0x2c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c50000"
	        filename = ""

Region:
	              id = 3462
	        start_va = 0x2e10000
	          end_va = 0x2f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e10000"
	        filename = ""

Region:
	              id = 3463
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 3464
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 3465
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 3466
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 3467
	        start_va = 0x2f10000
	          end_va = 0x3302fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f10000"
	        filename = ""

Region:
	              id = 3468
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 3469
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 3470
	        start_va = 0xc90000
	          end_va = 0xc91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c90000"
	        filename = ""

Region:
	              id = 3471
	        start_va = 0xca0000
	          end_va = 0xca1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ca0000"
	        filename = ""

Region:
	              id = 3472
	        start_va = 0xcb0000
	          end_va = 0xcbffff
	     entry_point = 0xcb0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 3473
	        start_va = 0xcc0000
	          end_va = 0xcc7fff
	     entry_point = 0xcc0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 3474
	        start_va = 0xdd0000
	          end_va = 0xde3fff
	     entry_point = 0xdd0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 3475
	        start_va = 0x11d0000
	          end_va = 0x120ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011d0000"
	        filename = ""

Region:
	              id = 3476
	        start_va = 0x2770000
	          end_va = 0x27affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002770000"
	        filename = ""

Region:
	              id = 3477
	        start_va = 0x3440000
	          end_va = 0x353ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003440000"
	        filename = ""

Region:
	              id = 3478
	        start_va = 0x3630000
	          end_va = 0x372ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003630000"
	        filename = ""

Region:
	              id = 3479
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 3480
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3481
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 3482
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 3483
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 3484
	        start_va = 0x2da0000
	          end_va = 0x2ddffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002da0000"
	        filename = ""

Region:
	              id = 3485
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 3486
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 3487
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 3488
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3489
	        start_va = 0x3730000
	          end_va = 0x3a72fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003730000"
	        filename = ""

Region:
	              id = 3490
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 3491
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 3492
	        start_va = 0x3420000
	          end_va = 0x342ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003420000"
	        filename = ""

Region:
	              id = 3493
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 3494
	        start_va = 0xdf0000
	          end_va = 0xdf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000df0000"
	        filename = ""

Region:
	              id = 3495
	        start_va = 0xe70000
	          end_va = 0xe71fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e70000"
	        filename = ""

Region:
	              id = 3496
	        start_va = 0x1000000
	          end_va = 0x103ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 3497
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 3498
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 3499
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 3500
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 3501
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 3502
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 3503
	        start_va = 0x3c20000
	          end_va = 0x3c5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c20000"
	        filename = ""

Region:
	              id = 3504
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 3505
	        start_va = 0xe40000
	          end_va = 0xe5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 3506
	        start_va = 0xe60000
	          end_va = 0xe60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000e60000"
	        filename = ""

Region:
	              id = 3507
	        start_va = 0x2d40000
	          end_va = 0x2d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d40000"
	        filename = ""

Region:
	              id = 3508
	        start_va = 0x3c60000
	          end_va = 0x458ffff
	     entry_point = 0x3c60000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 3509
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 3510
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 3511
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 3512
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 3513
	        start_va = 0x1080000
	          end_va = 0x1080fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001080000"
	        filename = ""

Region:
	              id = 3514
	        start_va = 0x1090000
	          end_va = 0x109ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 3515
	        start_va = 0x11a0000
	          end_va = 0x11a2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000011a0000"
	        filename = ""

Region:
	              id = 3516
	        start_va = 0x1250000
	          end_va = 0x125ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 3517
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 3518
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 3519
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 3520
	        start_va = 0x11b0000
	          end_va = 0x11b3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011b0000"
	        filename = ""

Region:
	              id = 3521
	        start_va = 0x11c0000
	          end_va = 0x11cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011c0000"
	        filename = ""

Region:
	              id = 3522
	        start_va = 0x1210000
	          end_va = 0x1227fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001210000"
	        filename = ""

Region:
	              id = 3523
	        start_va = 0x1230000
	          end_va = 0x1230fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001230000"
	        filename = ""

Region:
	              id = 3524
	        start_va = 0x1240000
	          end_va = 0x124ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 3525
	        start_va = 0x1260000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001260000"
	        filename = ""

Region:
	              id = 3526
	        start_va = 0x1270000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001270000"
	        filename = ""

Region:
	              id = 3527
	        start_va = 0x1280000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 3528
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 3529
	        start_va = 0x2750000
	          end_va = 0x275ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 3530
	        start_va = 0x2760000
	          end_va = 0x276ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002760000"
	        filename = ""

Region:
	              id = 3531
	        start_va = 0x29d0000
	          end_va = 0x2a0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029d0000"
	        filename = ""

Region:
	              id = 3532
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 3533
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 3534
	        start_va = 0x27b0000
	          end_va = 0x27bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027b0000"
	        filename = ""

Region:
	              id = 3535
	        start_va = 0x27c0000
	          end_va = 0x27cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027c0000"
	        filename = ""

Region:
	              id = 3536
	        start_va = 0x2c10000
	          end_va = 0x2c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c10000"
	        filename = ""

Region:
	              id = 3537
	        start_va = 0x2c20000
	          end_va = 0x2c20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c20000"
	        filename = ""

Region:
	              id = 3538
	        start_va = 0x2c30000
	          end_va = 0x2c30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c30000"
	        filename = ""

Region:
	              id = 3539
	        start_va = 0x2cd0000
	          end_va = 0x2d0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cd0000"
	        filename = ""

Region:
	              id = 3540
	        start_va = 0x35b0000
	          end_va = 0x35effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035b0000"
	        filename = ""

Region:
	              id = 3541
	        start_va = 0x3aa0000
	          end_va = 0x3b9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003aa0000"
	        filename = ""

Region:
	              id = 3542
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 3543
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 3544
	        start_va = 0x2c40000
	          end_va = 0x2c40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c40000"
	        filename = ""

Region:
	              id = 3545
	        start_va = 0x2c90000
	          end_va = 0x2c9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c90000"
	        filename = ""

Region:
	              id = 3546
	        start_va = 0x2ca0000
	          end_va = 0x2ca0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002ca0000"
	        filename = ""

Region:
	              id = 3547
	        start_va = 0x2cb0000
	          end_va = 0x2cb2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002cb0000"
	        filename = ""

Region:
	              id = 3548
	        start_va = 0x3320000
	          end_va = 0x335ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003320000"
	        filename = ""

Region:
	              id = 3549
	        start_va = 0x45f0000
	          end_va = 0x462ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045f0000"
	        filename = ""

Region:
	              id = 3550
	        start_va = 0x4680000
	          end_va = 0x46bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004680000"
	        filename = ""

Region:
	              id = 3551
	        start_va = 0x4710000
	          end_va = 0x480ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004710000"
	        filename = ""

Region:
	              id = 3552
	        start_va = 0x48f0000
	          end_va = 0x48fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048f0000"
	        filename = ""

Region:
	              id = 3553
	        start_va = 0x4950000
	          end_va = 0x4a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004950000"
	        filename = ""

Region:
	              id = 3554
	        start_va = 0x4a60000
	          end_va = 0x4b5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a60000"
	        filename = ""

Region:
	              id = 3555
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 3556
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 3557
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 3558
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 3559
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 3560
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 3561
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 3562
	        start_va = 0x2cc0000
	          end_va = 0x2cc3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cc0000"
	        filename = ""

Region:
	              id = 3563
	        start_va = 0x2d10000
	          end_va = 0x2d27fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d10000"
	        filename = ""

Region:
	              id = 3564
	        start_va = 0x2d30000
	          end_va = 0x2d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d30000"
	        filename = ""

Region:
	              id = 3565
	        start_va = 0x2d50000
	          end_va = 0x2d50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d50000"
	        filename = ""

Region:
	              id = 3566
	        start_va = 0x2d60000
	          end_va = 0x2d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d60000"
	        filename = ""

Region:
	              id = 3567
	        start_va = 0x2d70000
	          end_va = 0x2d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d70000"
	        filename = ""

Region:
	              id = 3568
	        start_va = 0x2d80000
	          end_va = 0x2d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d80000"
	        filename = ""

Region:
	              id = 3569
	        start_va = 0x2d90000
	          end_va = 0x2d9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d90000"
	        filename = ""

Region:
	              id = 3570
	        start_va = 0x2de0000
	          end_va = 0x2deffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002de0000"
	        filename = ""

Region:
	              id = 3571
	        start_va = 0x2df0000
	          end_va = 0x2dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002df0000"
	        filename = ""

Region:
	              id = 3572
	        start_va = 0x2e00000
	          end_va = 0x2e01fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e00000"
	        filename = ""

Region:
	              id = 3573
	        start_va = 0x4c50000
	          end_va = 0x4c5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c50000"
	        filename = ""

Region:
	              id = 3574
	        start_va = 0x4d00000
	          end_va = 0x4d0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d00000"
	        filename = ""

Region:
	              id = 3575
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 3576
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 3577
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 3578
	        start_va = 0x3310000
	          end_va = 0x3317fff
	     entry_point = 0x3310000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 3579
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 3580
	        start_va = 0x3360000
	          end_va = 0x336cfff
	     entry_point = 0x3360000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 3581
	        start_va = 0x3370000
	          end_va = 0x3381fff
	     entry_point = 0x3370000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 3582
	        start_va = 0x3390000
	          end_va = 0x3390fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003390000"
	        filename = ""

Region:
	              id = 3583
	        start_va = 0x33a0000
	          end_va = 0x33a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033a0000"
	        filename = ""

Region:
	              id = 3584
	        start_va = 0x33b0000
	          end_va = 0x33b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033b0000"
	        filename = ""

Region:
	              id = 3585
	        start_va = 0x33c0000
	          end_va = 0x33c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033c0000"
	        filename = ""

Region:
	              id = 3586
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 3587
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 3588
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 3589
	        start_va = 0x33d0000
	          end_va = 0x33d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033d0000"
	        filename = ""

Region:
	              id = 3590
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 3591
	        start_va = 0x3c10000
	          end_va = 0x3c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c10000"
	        filename = ""

Region:
	              id = 3592
	        start_va = 0x4640000
	          end_va = 0x467ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004640000"
	        filename = ""

Region:
	              id = 3593
	        start_va = 0x4850000
	          end_va = 0x488ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004850000"
	        filename = ""

Region:
	              id = 3594
	        start_va = 0x48b0000
	          end_va = 0x48effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048b0000"
	        filename = ""

Region:
	              id = 3595
	        start_va = 0x4bc0000
	          end_va = 0x4bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bc0000"
	        filename = ""

Region:
	              id = 3596
	        start_va = 0x4db0000
	          end_va = 0x4eaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004db0000"
	        filename = ""

Region:
	              id = 3597
	        start_va = 0x4ed0000
	          end_va = 0x4fcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ed0000"
	        filename = ""

Region:
	              id = 3598
	        start_va = 0x5060000
	          end_va = 0x515ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005060000"
	        filename = ""

Region:
	              id = 3599
	        start_va = 0x5190000
	          end_va = 0x528ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005190000"
	        filename = ""

Region:
	              id = 3600
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 3601
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 3602
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 3603
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 3604
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 3605
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 3606
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 3607
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 3608
	        start_va = 0x33e0000
	          end_va = 0x33e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000033e0000"
	        filename = ""

Region:
	              id = 3609
	        start_va = 0x4c60000
	          end_va = 0x4cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c60000"
	        filename = ""

Region:
	              id = 3610
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 3611
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 3612
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 3613
	        start_va = 0x33f0000
	          end_va = 0x33f3fff
	     entry_point = 0x33f0000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 3614
	        start_va = 0x3540000
	          end_va = 0x359cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003540000"
	        filename = ""

Region:
	              id = 3615
	        start_va = 0x5020000
	          end_va = 0x505ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005020000"
	        filename = ""

Region:
	              id = 3616
	        start_va = 0x5290000
	          end_va = 0x538ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005290000"
	        filename = ""

Region:
	              id = 3617
	        start_va = 0x54d0000
	          end_va = 0x55cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054d0000"
	        filename = ""

Region:
	              id = 3618
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 3619
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 3620
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3621
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 3622
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3623
	        start_va = 0x5390000
	          end_va = 0x548ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005390000"
	        filename = ""

Region:
	              id = 3624
	        start_va = 0x55d0000
	          end_va = 0x57cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000055d0000"
	        filename = ""

Region:
	              id = 3625
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 3626
	        start_va = 0x3400000
	          end_va = 0x3400fff
	     entry_point = 0x3400000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 3627
	        start_va = 0x3410000
	          end_va = 0x3410fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003410000"
	        filename = ""

Region:
	              id = 3628
	        start_va = 0x3430000
	          end_va = 0x3430fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003430000"
	        filename = ""

Region:
	              id = 3629
	        start_va = 0x35f0000
	          end_va = 0x362ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035f0000"
	        filename = ""

Region:
	              id = 3630
	        start_va = 0x5850000
	          end_va = 0x594ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005850000"
	        filename = ""

Region:
	              id = 3631
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 3632
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 3633
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 3634
	        start_va = 0x35a0000
	          end_va = 0x35a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035a0000"
	        filename = ""

Region:
	              id = 3635
	        start_va = 0x3a80000
	          end_va = 0x3a80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003a80000"
	        filename = ""

Region:
	              id = 3636
	        start_va = 0x3ba0000
	          end_va = 0x3ba1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003ba0000"
	        filename = ""

Region:
	              id = 3637
	        start_va = 0x4c00000
	          end_va = 0x4c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c00000"
	        filename = ""

Region:
	              id = 3638
	        start_va = 0x57f0000
	          end_va = 0x582ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057f0000"
	        filename = ""

Region:
	              id = 3639
	        start_va = 0x5ab0000
	          end_va = 0x5baffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ab0000"
	        filename = ""

Region:
	              id = 3640
	        start_va = 0x5be0000
	          end_va = 0x5cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005be0000"
	        filename = ""

Region:
	              id = 3641
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 3642
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 3643
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 3644
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 3645
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 3646
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 3647
	        start_va = 0x3a90000
	          end_va = 0x3a91fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003a90000"
	        filename = ""

Region:
	              id = 3648
	        start_va = 0x3bb0000
	          end_va = 0x3bc0fff
	     entry_point = 0x3bb0000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 3649
	        start_va = 0x3bd0000
	          end_va = 0x3bd7fff
	     entry_point = 0x3bd0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 3650
	        start_va = 0x3be0000
	          end_va = 0x3be3fff
	     entry_point = 0x3be0000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 3651
	        start_va = 0x4590000
	          end_va = 0x45cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004590000"
	        filename = ""

Region:
	              id = 3652
	        start_va = 0x4d10000
	          end_va = 0x4da7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d10000"
	        filename = ""

Region:
	              id = 3653
	        start_va = 0x59b0000
	          end_va = 0x5aaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059b0000"
	        filename = ""

Region:
	              id = 3654
	        start_va = 0x5d40000
	          end_va = 0x5d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d40000"
	        filename = ""

Region:
	              id = 3655
	        start_va = 0x5db0000
	          end_va = 0x5e57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005db0000"
	        filename = ""

Region:
	              id = 3656
	        start_va = 0x5ea0000
	          end_va = 0x5eaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ea0000"
	        filename = ""

Region:
	              id = 3657
	        start_va = 0x5eb0000
	          end_va = 0x62affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005eb0000"
	        filename = ""

Region:
	              id = 3658
	        start_va = 0x62b0000
	          end_va = 0x64affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000062b0000"
	        filename = ""

Region:
	              id = 3659
	        start_va = 0x64b0000
	          end_va = 0x68affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000064b0000"
	        filename = ""

Region:
	              id = 3660
	        start_va = 0x68b0000
	          end_va = 0x69f1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000068b0000"
	        filename = ""

Region:
	              id = 3661
	        start_va = 0x6a00000
	          end_va = 0x71fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006a00000"
	        filename = ""

Region:
	              id = 3662
	        start_va = 0x72b0000
	          end_va = 0x73c4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000072b0000"
	        filename = ""

Region:
	              id = 3663
	        start_va = 0x7430000
	          end_va = 0x752ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007430000"
	        filename = ""

Region:
	              id = 3664
	        start_va = 0x76b0000
	          end_va = 0x77affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000076b0000"
	        filename = ""

Region:
	              id = 3665
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 3666
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 3667
	        start_va = 0x7ef74000
	          end_va = 0x7ef76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef74000"
	        filename = ""

Region:
	              id = 3668
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 3669
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 3670
	        start_va = 0x3bf0000
	          end_va = 0x3bf1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003bf0000"
	        filename = ""

Region:
	              id = 3671
	        start_va = 0x3c00000
	          end_va = 0x3c00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c00000"
	        filename = ""

Region:
	              id = 3672
	        start_va = 0x46c0000
	          end_va = 0x4707fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046c0000"
	        filename = ""

Region:
	              id = 3673
	        start_va = 0x4900000
	          end_va = 0x494bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004900000"
	        filename = ""

Region:
	              id = 3674
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 251
	os_tid = 0xb38


Thread:
	id = 252
	os_tid = 0xb3c


Thread:
	id = 253
	os_tid = 0xb40


Thread:
	id = 254
	os_tid = 0xb44


Thread:
	id = 255
	os_tid = 0xb48


Thread:
	id = 256
	os_tid = 0xb4c


Thread:
	id = 257
	os_tid = 0xb50


Thread:
	id = 258
	os_tid = 0xb54


Thread:
	id = 259
	os_tid = 0xb58


Thread:
	id = 260
	os_tid = 0xb5c


Thread:
	id = 261
	os_tid = 0xb60


Thread:
	id = 262
	os_tid = 0xb64


Thread:
	id = 263
	os_tid = 0xb68


Thread:
	id = 264
	os_tid = 0xb6c


Thread:
	id = 265
	os_tid = 0xb70


Thread:
	id = 266
	os_tid = 0xb74


Thread:
	id = 267
	os_tid = 0xb78


Thread:
	id = 268
	os_tid = 0xb7c


Thread:
	id = 269
	os_tid = 0xb80


Thread:
	id = 270
	os_tid = 0xb84


Thread:
	id = 271
	os_tid = 0xb88


Thread:
	id = 272
	os_tid = 0xb8c


Thread:
	id = 273
	os_tid = 0xb94


Thread:
	id = 274
	os_tid = 0xb98


Thread:
	id = 276
	os_tid = 0xba0


Thread:
	id = 342
	os_tid = 0x780


Thread:
	id = 479
	os_tid = 0xe64


Process:
	id = "13"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x59977000"
	os_pid = "0xbb4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:145422"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3677
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3678
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3679
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 3680
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 3681
	        start_va = 0x130000
	          end_va = 0x16ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 3682
	        start_va = 0x2f0000
	          end_va = 0x3effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002f0000"
	        filename = ""

Region:
	              id = 3683
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 3684
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3685
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3686
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 3687
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 3688
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 3689
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 3690
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 3691
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3692
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3693
	        start_va = 0x250000
	          end_va = 0x2cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 3694
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3695
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3696
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3697
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3698
	        start_va = 0x60000
	          end_va = 0xc6fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3699
	        start_va = 0x220000
	          end_va = 0x22ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000220000"
	        filename = ""

Region:
	              id = 3700
	        start_va = 0x4d0000
	          end_va = 0x5cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 3701
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3702
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3703
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 3704
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3705
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3706
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 3707
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3708
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3709
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 3710
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3711
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3712
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3713
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 3714
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3715
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 3716
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 3717
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3718
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 3719
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 3720
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3721
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3722
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 3723
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 3724
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 3725
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 3726
	        start_va = 0x5d0000
	          end_va = 0x757fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005d0000"
	        filename = ""

Region:
	              id = 3727
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 3728
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3729
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 3730
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3731
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0xd0000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 3732
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3733
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3734
	        start_va = 0x760000
	          end_va = 0x8e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000760000"
	        filename = ""

Region:
	              id = 3735
	        start_va = 0x8f0000
	          end_va = 0xbbefff
	     entry_point = 0x8f0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3736
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 3737
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 3738
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 3739
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 3740
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x100000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 3741
	        start_va = 0x110000
	          end_va = 0x111fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000110000"
	        filename = ""

Region:
	              id = 3742
	        start_va = 0x120000
	          end_va = 0x120fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000120000"
	        filename = ""

Region:
	              id = 3743
	        start_va = 0x170000
	          end_va = 0x171fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 3744
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 3745
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 3746
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 3747
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 3748
	        start_va = 0x1a0000
	          end_va = 0x1a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3749
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 3750
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 3751
	        start_va = 0x440000
	          end_va = 0x47ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 3752
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 3753
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3754
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3755
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3756
	        start_va = 0x1e0000
	          end_va = 0x21ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 3757
	        start_va = 0x3f0000
	          end_va = 0x42ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 3758
	        start_va = 0xbc0000
	          end_va = 0xc9efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000bc0000"
	        filename = ""

Region:
	              id = 3759
	        start_va = 0xca0000
	          end_va = 0xd0dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ca0000"
	        filename = ""

Region:
	              id = 3760
	        start_va = 0xdf0000
	          end_va = 0xeeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 3761
	        start_va = 0xef0000
	          end_va = 0xfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ef0000"
	        filename = ""

Region:
	              id = 3762
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 3763
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 3764
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 3765
	        start_va = 0x1020000
	          end_va = 0x105ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 3766
	        start_va = 0x1060000
	          end_va = 0x115ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 3767
	        start_va = 0x1230000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001230000"
	        filename = ""

Region:
	              id = 3768
	        start_va = 0x2750000
	          end_va = 0x278ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 3769
	        start_va = 0x2830000
	          end_va = 0x292ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002830000"
	        filename = ""

Region:
	              id = 3770
	        start_va = 0x29b0000
	          end_va = 0x2baffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029b0000"
	        filename = ""

Region:
	              id = 3771
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 3772
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 3773
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 3774
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 3775
	        start_va = 0x71660000
	          end_va = 0x71692fff
	     entry_point = 0x71660000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 3776
	        start_va = 0x230000
	          end_va = 0x230fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 3777
	        start_va = 0x2bb0000
	          end_va = 0x2caffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bb0000"
	        filename = ""

Region:
	              id = 3778
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3779
	        start_va = 0x240000
	          end_va = 0x240fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000240000"
	        filename = ""

Region:
	              id = 3780
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 3781
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 3782
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 3783
	        start_va = 0x2e0000
	          end_va = 0x2e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002e0000"
	        filename = ""

Region:
	              id = 3784
	        start_va = 0x480000
	          end_va = 0x49efff
	     entry_point = 0x480000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 3785
	        start_va = 0x1190000
	          end_va = 0x11cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001190000"
	        filename = ""

Region:
	              id = 3786
	        start_va = 0x2e10000
	          end_va = 0x2f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e10000"
	        filename = ""

Region:
	              id = 3787
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 3788
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 3789
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 3790
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 3791
	        start_va = 0x2f10000
	          end_va = 0x3302fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f10000"
	        filename = ""

Region:
	              id = 3792
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 3793
	        start_va = 0x2d0000
	          end_va = 0x2d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000002d0000"
	        filename = ""

Region:
	              id = 3794
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 3795
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 3799
	        start_va = 0x430000
	          end_va = 0x431fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000430000"
	        filename = ""

Region:
	              id = 3800
	        start_va = 0x4a0000
	          end_va = 0x4a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 3801
	        start_va = 0x4b0000
	          end_va = 0x4bffff
	     entry_point = 0x4b0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 3802
	        start_va = 0x4c0000
	          end_va = 0x4c7fff
	     entry_point = 0x4c0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 3803
	        start_va = 0xd10000
	          end_va = 0xd23fff
	     entry_point = 0xd10000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 3804
	        start_va = 0xdb0000
	          end_va = 0xdeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 3805
	        start_va = 0x2790000
	          end_va = 0x27cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002790000"
	        filename = ""

Region:
	              id = 3806
	        start_va = 0x3380000
	          end_va = 0x347ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003380000"
	        filename = ""

Region:
	              id = 3807
	        start_va = 0x3550000
	          end_va = 0x364ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003550000"
	        filename = ""

Region:
	              id = 3808
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 3809
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3810
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 3811
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 3812
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 3813
	        start_va = 0x37e0000
	          end_va = 0x381ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037e0000"
	        filename = ""

Region:
	              id = 3814
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 3815
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 3816
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 3819
	        start_va = 0x2d70000
	          end_va = 0x2daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d70000"
	        filename = ""

Region:
	              id = 3820
	        start_va = 0x3880000
	          end_va = 0x3a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003880000"
	        filename = ""

Region:
	              id = 3821
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3822
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 3823
	        start_va = 0x3a80000
	          end_va = 0x3dc2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003a80000"
	        filename = ""

Region:
	              id = 3824
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 3825
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 3826
	        start_va = 0xd30000
	          end_va = 0xd30fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d30000"
	        filename = ""

Region:
	              id = 3827
	        start_va = 0xd70000
	          end_va = 0xd71fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d70000"
	        filename = ""

Region:
	              id = 3828
	        start_va = 0x3f40000
	          end_va = 0x3f7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f40000"
	        filename = ""

Region:
	              id = 3829
	        start_va = 0x3fc0000
	          end_va = 0x3fcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003fc0000"
	        filename = ""

Region:
	              id = 3830
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 3831
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 3832
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 3833
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 3834
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 3835
	        start_va = 0xd80000
	          end_va = 0xd80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d80000"
	        filename = ""

Region:
	              id = 3836
	        start_va = 0xd90000
	          end_va = 0xd91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d90000"
	        filename = ""

Region:
	              id = 3837
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 3838
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 3839
	        start_va = 0x2970000
	          end_va = 0x29affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002970000"
	        filename = ""

Region:
	              id = 3840
	        start_va = 0x2d00000
	          end_va = 0x2d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d00000"
	        filename = ""

Region:
	              id = 3841
	        start_va = 0x3e10000
	          end_va = 0x3f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e10000"
	        filename = ""

Region:
	              id = 3842
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 3843
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 3844
	        start_va = 0xd40000
	          end_va = 0xd5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d40000"
	        filename = ""

Region:
	              id = 3845
	        start_va = 0xd60000
	          end_va = 0xd60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d60000"
	        filename = ""

Region:
	              id = 3846
	        start_va = 0x37a0000
	          end_va = 0x37affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037a0000"
	        filename = ""

Region:
	              id = 3847
	        start_va = 0x3fd0000
	          end_va = 0x48fffff
	     entry_point = 0x3fd0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 3848
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 3849
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 3850
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 3851
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 3852
	        start_va = 0xda0000
	          end_va = 0xda0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000da0000"
	        filename = ""

Region:
	              id = 3853
	        start_va = 0xff0000
	          end_va = 0xff2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 3854
	        start_va = 0x3540000
	          end_va = 0x354ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003540000"
	        filename = ""

Region:
	              id = 3855
	        start_va = 0x3760000
	          end_va = 0x376ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003760000"
	        filename = ""

Region:
	              id = 3856
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 3857
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 3858
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 3859
	        start_va = 0x1000000
	          end_va = 0x1003fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 3860
	        start_va = 0x1010000
	          end_va = 0x101ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 3861
	        start_va = 0x1160000
	          end_va = 0x1177fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001160000"
	        filename = ""

Region:
	              id = 3862
	        start_va = 0x1180000
	          end_va = 0x1180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001180000"
	        filename = ""

Region:
	              id = 3863
	        start_va = 0x11d0000
	          end_va = 0x11dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011d0000"
	        filename = ""

Region:
	              id = 3864
	        start_va = 0x11e0000
	          end_va = 0x11effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011e0000"
	        filename = ""

Region:
	              id = 3865
	        start_va = 0x11f0000
	          end_va = 0x11fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011f0000"
	        filename = ""

Region:
	              id = 3866
	        start_va = 0x1200000
	          end_va = 0x120ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001200000"
	        filename = ""

Region:
	              id = 3867
	        start_va = 0x1210000
	          end_va = 0x121ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001210000"
	        filename = ""

Region:
	              id = 3868
	        start_va = 0x1220000
	          end_va = 0x122ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001220000"
	        filename = ""

Region:
	              id = 3869
	        start_va = 0x1270000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001270000"
	        filename = ""

Region:
	              id = 3870
	        start_va = 0x4a40000
	          end_va = 0x4a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a40000"
	        filename = ""

Region:
	              id = 3871
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 3872
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 3873
	        start_va = 0x1280000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 3874
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 3875
	        start_va = 0x27d0000
	          end_va = 0x27dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027d0000"
	        filename = ""

Region:
	              id = 3876
	        start_va = 0x27e0000
	          end_va = 0x27e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000027e0000"
	        filename = ""

Region:
	              id = 3877
	        start_va = 0x27f0000
	          end_va = 0x27f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027f0000"
	        filename = ""

Region:
	              id = 3878
	        start_va = 0x36b0000
	          end_va = 0x36effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036b0000"
	        filename = ""

Region:
	              id = 3879
	        start_va = 0x4c40000
	          end_va = 0x4c7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c40000"
	        filename = ""

Region:
	              id = 3880
	        start_va = 0x4d00000
	          end_va = 0x4dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d00000"
	        filename = ""

Region:
	              id = 3881
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 3882
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 3883
	        start_va = 0x2800000
	          end_va = 0x2800fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002800000"
	        filename = ""

Region:
	              id = 3884
	        start_va = 0x2810000
	          end_va = 0x281ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002810000"
	        filename = ""

Region:
	              id = 3885
	        start_va = 0x2820000
	          end_va = 0x2820fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002820000"
	        filename = ""

Region:
	              id = 3886
	        start_va = 0x2930000
	          end_va = 0x296ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002930000"
	        filename = ""

Region:
	              id = 3887
	        start_va = 0x2cb0000
	          end_va = 0x2cb2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002cb0000"
	        filename = ""

Region:
	              id = 3888
	        start_va = 0x2db0000
	          end_va = 0x2deffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002db0000"
	        filename = ""

Region:
	              id = 3889
	        start_va = 0x34d0000
	          end_va = 0x350ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034d0000"
	        filename = ""

Region:
	              id = 3890
	        start_va = 0x4a90000
	          end_va = 0x4b8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a90000"
	        filename = ""

Region:
	              id = 3891
	        start_va = 0x4e60000
	          end_va = 0x4f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e60000"
	        filename = ""

Region:
	              id = 3892
	        start_va = 0x5030000
	          end_va = 0x512ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005030000"
	        filename = ""

Region:
	              id = 3893
	        start_va = 0x52c0000
	          end_va = 0x52cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000052c0000"
	        filename = ""

Region:
	              id = 3894
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 3895
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 3896
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 3897
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 3898
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 3899
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 3900
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 3901
	        start_va = 0x2cc0000
	          end_va = 0x2cc3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cc0000"
	        filename = ""

Region:
	              id = 3902
	        start_va = 0x2cd0000
	          end_va = 0x2ce7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cd0000"
	        filename = ""

Region:
	              id = 3903
	        start_va = 0x2cf0000
	          end_va = 0x2cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cf0000"
	        filename = ""

Region:
	              id = 3904
	        start_va = 0x2d40000
	          end_va = 0x2d40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d40000"
	        filename = ""

Region:
	              id = 3905
	        start_va = 0x2d50000
	          end_va = 0x2d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d50000"
	        filename = ""

Region:
	              id = 3906
	        start_va = 0x2d60000
	          end_va = 0x2d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d60000"
	        filename = ""

Region:
	              id = 3907
	        start_va = 0x2df0000
	          end_va = 0x2dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002df0000"
	        filename = ""

Region:
	              id = 3908
	        start_va = 0x2e00000
	          end_va = 0x2e0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e00000"
	        filename = ""

Region:
	              id = 3909
	        start_va = 0x3310000
	          end_va = 0x331ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003310000"
	        filename = ""

Region:
	              id = 3910
	        start_va = 0x3320000
	          end_va = 0x332ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003320000"
	        filename = ""

Region:
	              id = 3911
	        start_va = 0x3330000
	          end_va = 0x3331fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003330000"
	        filename = ""

Region:
	              id = 3912
	        start_va = 0x3340000
	          end_va = 0x334ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003340000"
	        filename = ""

Region:
	              id = 3913
	        start_va = 0x4a10000
	          end_va = 0x4a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a10000"
	        filename = ""

Region:
	              id = 3914
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 3915
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 3916
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 3917
	        start_va = 0x3350000
	          end_va = 0x3357fff
	     entry_point = 0x3350000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 3918
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 3919
	        start_va = 0x3360000
	          end_va = 0x336cfff
	     entry_point = 0x3360000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 3920
	        start_va = 0x3370000
	          end_va = 0x3370fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003370000"
	        filename = ""

Region:
	              id = 3921
	        start_va = 0x3480000
	          end_va = 0x3491fff
	     entry_point = 0x3480000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 3922
	        start_va = 0x34a0000
	          end_va = 0x34a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034a0000"
	        filename = ""

Region:
	              id = 3923
	        start_va = 0x34b0000
	          end_va = 0x34b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034b0000"
	        filename = ""

Region:
	              id = 3924
	        start_va = 0x34c0000
	          end_va = 0x34c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034c0000"
	        filename = ""

Region:
	              id = 3925
	        start_va = 0x3510000
	          end_va = 0x3510fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003510000"
	        filename = ""

Region:
	              id = 3926
	        start_va = 0x3520000
	          end_va = 0x3520fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003520000"
	        filename = ""

Region:
	              id = 3927
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 3928
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 3929
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 3930
	        start_va = 0x3530000
	          end_va = 0x3530fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003530000"
	        filename = ""

Region:
	              id = 3931
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 3932
	        start_va = 0x3650000
	          end_va = 0x365ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003650000"
	        filename = ""

Region:
	              id = 3933
	        start_va = 0x3700000
	          end_va = 0x373ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003700000"
	        filename = ""

Region:
	              id = 3934
	        start_va = 0x3820000
	          end_va = 0x385ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003820000"
	        filename = ""

Region:
	              id = 3935
	        start_va = 0x3dd0000
	          end_va = 0x3e0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003dd0000"
	        filename = ""

Region:
	              id = 3936
	        start_va = 0x4900000
	          end_va = 0x493ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004900000"
	        filename = ""

Region:
	              id = 3937
	        start_va = 0x51b0000
	          end_va = 0x52affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051b0000"
	        filename = ""

Region:
	              id = 3938
	        start_va = 0x52d0000
	          end_va = 0x53cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000052d0000"
	        filename = ""

Region:
	              id = 3939
	        start_va = 0x53d0000
	          end_va = 0x54cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3940
	        start_va = 0x55d0000
	          end_va = 0x56cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000055d0000"
	        filename = ""

Region:
	              id = 3941
	        start_va = 0x57a0000
	          end_va = 0x589ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057a0000"
	        filename = ""

Region:
	              id = 3942
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 3943
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 3944
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 3945
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 3946
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 3947
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 3948
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 3949
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 3950
	        start_va = 0x3660000
	          end_va = 0x3660fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003660000"
	        filename = ""

Region:
	              id = 3951
	        start_va = 0x4940000
	          end_va = 0x49bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004940000"
	        filename = ""

Region:
	              id = 3952
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 3953
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 3954
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 3955
	        start_va = 0x3670000
	          end_va = 0x3673fff
	     entry_point = 0x3670000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 3956
	        start_va = 0x4b90000
	          end_va = 0x4becfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004b90000"
	        filename = ""

Region:
	              id = 3957
	        start_va = 0x4c00000
	          end_va = 0x4c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c00000"
	        filename = ""

Region:
	              id = 3958
	        start_va = 0x4f60000
	          end_va = 0x4f9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f60000"
	        filename = ""

Region:
	              id = 3959
	        start_va = 0x5140000
	          end_va = 0x517ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005140000"
	        filename = ""

Region:
	              id = 3960
	        start_va = 0x5950000
	          end_va = 0x5a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005950000"
	        filename = ""

Region:
	              id = 3961
	        start_va = 0x5c00000
	          end_va = 0x5cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c00000"
	        filename = ""

Region:
	              id = 3962
	        start_va = 0x5e10000
	          end_va = 0x5f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e10000"
	        filename = ""

Region:
	              id = 3963
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 3964
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 3965
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 3966
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 3967
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3968
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 3969
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3970
	        start_va = 0x54d0000
	          end_va = 0x55cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054d0000"
	        filename = ""

Region:
	              id = 3971
	        start_va = 0x5f10000
	          end_va = 0x610ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005f10000"
	        filename = ""

Region:
	              id = 3972
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 3976
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 3977
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 3978
	        start_va = 0x3680000
	          end_va = 0x3680fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003680000"
	        filename = ""

Region:
	              id = 3979
	        start_va = 0x3690000
	          end_va = 0x3690fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003690000"
	        filename = ""

Region:
	              id = 3980
	        start_va = 0x36a0000
	          end_va = 0x36a7fff
	     entry_point = 0x36a0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 3981
	        start_va = 0x36f0000
	          end_va = 0x36f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000036f0000"
	        filename = ""

Region:
	              id = 3982
	        start_va = 0x3740000
	          end_va = 0x3750fff
	     entry_point = 0x3740000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 3983
	        start_va = 0x5720000
	          end_va = 0x575ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005720000"
	        filename = ""

Region:
	              id = 3984
	        start_va = 0x6110000
	          end_va = 0x620ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006110000"
	        filename = ""

Region:
	              id = 3985
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 3986
	        start_va = 0x7ef74000
	          end_va = 0x7ef76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef74000"
	        filename = ""

Region:
	              id = 3987
	        start_va = 0x6210000
	          end_va = 0x660ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006210000"
	        filename = ""

Region:
	              id = 3988
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 3989
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 3990
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 3991
	        start_va = 0x3770000
	          end_va = 0x3771fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003770000"
	        filename = ""

Region:
	              id = 3992
	        start_va = 0x5bd0000
	          end_va = 0x5bdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005bd0000"
	        filename = ""

Region:
	              id = 3993
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 4046
	        start_va = 0x3780000
	          end_va = 0x3783fff
	     entry_point = 0x3780000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 4047
	        start_va = 0x56e0000
	          end_va = 0x571ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000056e0000"
	        filename = ""

Region:
	              id = 4048
	        start_va = 0x58a0000
	          end_va = 0x5947fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058a0000"
	        filename = ""

Region:
	              id = 4049
	        start_va = 0x5a50000
	          end_va = 0x5ae7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a50000"
	        filename = ""

Region:
	              id = 4050
	        start_va = 0x5af0000
	          end_va = 0x5bb1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005af0000"
	        filename = ""

Region:
	              id = 4051
	        start_va = 0x5d00000
	          end_va = 0x5da7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d00000"
	        filename = ""

Region:
	              id = 4052
	        start_va = 0x6610000
	          end_va = 0x6e0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006610000"
	        filename = ""

Region:
	              id = 4053
	        start_va = 0x6e10000
	          end_va = 0x700ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e10000"
	        filename = ""

Region:
	              id = 4054
	        start_va = 0x7010000
	          end_va = 0x740ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007010000"
	        filename = ""

Region:
	              id = 4055
	        start_va = 0x7410000
	          end_va = 0x7551fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007410000"
	        filename = ""

Region:
	              id = 4056
	        start_va = 0x7560000
	          end_va = 0x7674fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007560000"
	        filename = ""

Region:
	              id = 4057
	        start_va = 0x7680000
	          end_va = 0x77c1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007680000"
	        filename = ""

Region:
	              id = 4058
	        start_va = 0x77d0000
	          end_va = 0x7877fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000077d0000"
	        filename = ""

Region:
	              id = 4059
	        start_va = 0x7970000
	          end_va = 0x7a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007970000"
	        filename = ""

Region:
	              id = 4060
	        start_va = 0x7a70000
	          end_va = 0x7b84fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007a70000"
	        filename = ""

Region:
	              id = 4061
	        start_va = 0x7d70000
	          end_va = 0x7e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007d70000"
	        filename = ""

Region:
	              id = 4062
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 4063
	        start_va = 0x7ef71000
	          end_va = 0x7ef73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef71000"
	        filename = ""

Region:
	              id = 4064
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 4083
	        start_va = 0x3790000
	          end_va = 0x3791fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003790000"
	        filename = ""

Region:
	              id = 4084
	        start_va = 0x37b0000
	          end_va = 0x37b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037b0000"
	        filename = ""

Region:
	              id = 4085
	        start_va = 0x49c0000
	          end_va = 0x4a07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 4086
	        start_va = 0x4c80000
	          end_va = 0x4ccbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c80000"
	        filename = ""

Region:
	              id = 4087
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 280
	os_tid = 0xbb8


Thread:
	id = 281
	os_tid = 0xbc0


Thread:
	id = 282
	os_tid = 0xbc4


Thread:
	id = 283
	os_tid = 0xbc8


Thread:
	id = 284
	os_tid = 0xbcc


Thread:
	id = 285
	os_tid = 0xbd0


Thread:
	id = 286
	os_tid = 0xbd4


Thread:
	id = 287
	os_tid = 0xbd8


Thread:
	id = 288
	os_tid = 0xbdc


Thread:
	id = 292
	os_tid = 0xbec


Thread:
	id = 294
	os_tid = 0xbf4


Thread:
	id = 295
	os_tid = 0xbf8


Thread:
	id = 296
	os_tid = 0xbfc


Thread:
	id = 297
	os_tid = 0x6f8


Thread:
	id = 298
	os_tid = 0x218


Thread:
	id = 299
	os_tid = 0x38c


Thread:
	id = 300
	os_tid = 0x640


Thread:
	id = 301
	os_tid = 0x188


Thread:
	id = 302
	os_tid = 0x820


Thread:
	id = 303
	os_tid = 0x7f0


Thread:
	id = 304
	os_tid = 0x52c


Thread:
	id = 305
	os_tid = 0x828


Thread:
	id = 308
	os_tid = 0x840


Thread:
	id = 311
	os_tid = 0x928


Thread:
	id = 320
	os_tid = 0x224


Thread:
	id = 357
	os_tid = 0x6ac


Process:
	id = "14"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x577af000"
	os_pid = "0x85c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:210957"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3994
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3995
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3996
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 3997
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 3998
	        start_va = 0xd0000
	          end_va = 0x10ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 3999
	        start_va = 0x290000
	          end_va = 0x38ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 4000
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 4001
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4002
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4003
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 4004
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 4005
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 4006
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 4007
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 4008
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4009
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4010
	        start_va = 0x130000
	          end_va = 0x1affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 4011
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4012
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4013
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4014
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4015
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4016
	        start_va = 0x60000
	          end_va = 0xc6fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4017
	        start_va = 0x3b0000
	          end_va = 0x4affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 4018
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4019
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4020
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 4021
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4022
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4023
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 4024
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4025
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4026
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 4027
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4028
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4029
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4030
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 4031
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4032
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 4033
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 4034
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4035
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 4036
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 4037
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4038
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4039
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 4040
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 4041
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 4042
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 4043
	        start_va = 0x4b0000
	          end_va = 0x637fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 4044
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 4045
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4065
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4066
	        start_va = 0x110000
	          end_va = 0x111fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000110000"
	        filename = ""

Region:
	              id = 4067
	        start_va = 0x120000
	          end_va = 0x121fff
	     entry_point = 0x120000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 4068
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4069
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4070
	        start_va = 0x640000
	          end_va = 0x7c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000640000"
	        filename = ""

Region:
	              id = 4071
	        start_va = 0x7d0000
	          end_va = 0xa9efff
	     entry_point = 0x7d0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4072
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 4073
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 4074
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 4075
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 4076
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	     entry_point = 0x1d0000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 4077
	        start_va = 0x1e0000
	          end_va = 0x1e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 4078
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4079
	        start_va = 0x200000
	          end_va = 0x201fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000200000"
	        filename = ""

Region:
	              id = 4080
	        start_va = 0x210000
	          end_va = 0x210fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 4081
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 4082
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 4088
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 4089
	        start_va = 0x230000
	          end_va = 0x231fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 4090
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 4091
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 4092
	        start_va = 0xc80000
	          end_va = 0xcbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c80000"
	        filename = ""

Region:
	              id = 4093
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 4094
	        start_va = 0x240000
	          end_va = 0x240fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000240000"
	        filename = ""

Region:
	              id = 4095
	        start_va = 0x250000
	          end_va = 0x251fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000250000"
	        filename = ""

Region:
	              id = 4096
	        start_va = 0x260000
	          end_va = 0x261fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000260000"
	        filename = ""

Region:
	              id = 4097
	        start_va = 0xaa0000
	          end_va = 0xb7efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000aa0000"
	        filename = ""

Region:
	              id = 4098
	        start_va = 0xb80000
	          end_va = 0xbedfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b80000"
	        filename = ""

Region:
	              id = 4099
	        start_va = 0xd40000
	          end_va = 0xd7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d40000"
	        filename = ""

Region:
	              id = 4100
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 4101
	        start_va = 0xea0000
	          end_va = 0xf9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 4102
	        start_va = 0x1080000
	          end_va = 0x117ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001080000"
	        filename = ""

Region:
	              id = 4103
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 4104
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 4105
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 4106
	        start_va = 0xd90000
	          end_va = 0xdcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d90000"
	        filename = ""

Region:
	              id = 4107
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 4108
	        start_va = 0x1030000
	          end_va = 0x106ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001030000"
	        filename = ""

Region:
	              id = 4109
	        start_va = 0x2740000
	          end_va = 0x283ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 4110
	        start_va = 0x28a0000
	          end_va = 0x299ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028a0000"
	        filename = ""

Region:
	              id = 4111
	        start_va = 0x29c0000
	          end_va = 0x2bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029c0000"
	        filename = ""

Region:
	              id = 4112
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 4113
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 4114
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 4115
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 4116
	        start_va = 0x716a0000
	          end_va = 0x716d2fff
	     entry_point = 0x716a0000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 4117
	        start_va = 0x270000
	          end_va = 0x270fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000270000"
	        filename = ""

Region:
	              id = 4118
	        start_va = 0x1180000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001180000"
	        filename = ""

Region:
	              id = 4119
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4120
	        start_va = 0x280000
	          end_va = 0x280fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000280000"
	        filename = ""

Region:
	              id = 4121
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 4122
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 4123
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 4124
	        start_va = 0x3a0000
	          end_va = 0x3a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003a0000"
	        filename = ""

Region:
	              id = 4125
	        start_va = 0xbf0000
	          end_va = 0xc0efff
	     entry_point = 0xbf0000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 4126
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 4127
	        start_va = 0x390000
	          end_va = 0x390fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000390000"
	        filename = ""

Region:
	              id = 4128
	        start_va = 0xc30000
	          end_va = 0xc6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c30000"
	        filename = ""

Region:
	              id = 4129
	        start_va = 0x2d80000
	          end_va = 0x2e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d80000"
	        filename = ""

Region:
	              id = 4130
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 4131
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 4132
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 4133
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 4134
	        start_va = 0x2e80000
	          end_va = 0x3272fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e80000"
	        filename = ""

Region:
	              id = 4135
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 4136
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 4137
	        start_va = 0xc10000
	          end_va = 0xc11fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c10000"
	        filename = ""

Region:
	              id = 4138
	        start_va = 0xc20000
	          end_va = 0xc21fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c20000"
	        filename = ""

Region:
	              id = 4139
	        start_va = 0xc70000
	          end_va = 0xc7ffff
	     entry_point = 0xc70000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 4140
	        start_va = 0xcc0000
	          end_va = 0xcc7fff
	     entry_point = 0xcc0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 4141
	        start_va = 0xcd0000
	          end_va = 0xce3fff
	     entry_point = 0xcd0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 4142
	        start_va = 0xfa0000
	          end_va = 0xfdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fa0000"
	        filename = ""

Region:
	              id = 4143
	        start_va = 0x2840000
	          end_va = 0x287ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002840000"
	        filename = ""

Region:
	              id = 4144
	        start_va = 0x2c00000
	          end_va = 0x2cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 4145
	        start_va = 0x3440000
	          end_va = 0x353ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003440000"
	        filename = ""

Region:
	              id = 4146
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 4147
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4148
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 4149
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 4150
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 4151
	        start_va = 0x33b0000
	          end_va = 0x33effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033b0000"
	        filename = ""

Region:
	              id = 4152
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 4153
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 4154
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 4155
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4156
	        start_va = 0x3540000
	          end_va = 0x3882fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003540000"
	        filename = ""

Region:
	              id = 4157
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 4158
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 4159
	        start_va = 0x2d50000
	          end_va = 0x2d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d50000"
	        filename = ""

Region:
	              id = 4160
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 4161
	        start_va = 0xcf0000
	          end_va = 0xcf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000cf0000"
	        filename = ""

Region:
	              id = 4162
	        start_va = 0xd30000
	          end_va = 0xd31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d30000"
	        filename = ""

Region:
	              id = 4163
	        start_va = 0x3a80000
	          end_va = 0x3abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a80000"
	        filename = ""

Region:
	              id = 4164
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 4165
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 4166
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 4167
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 4168
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 4169
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 4170
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 4171
	        start_va = 0xd00000
	          end_va = 0xd1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d00000"
	        filename = ""

Region:
	              id = 4172
	        start_va = 0xd20000
	          end_va = 0xd20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d20000"
	        filename = ""

Region:
	              id = 4173
	        start_va = 0x39f0000
	          end_va = 0x3a2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000039f0000"
	        filename = ""

Region:
	              id = 4174
	        start_va = 0x3ac0000
	          end_va = 0x43effff
	     entry_point = 0x3ac0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 4175
	        start_va = 0x4590000
	          end_va = 0x459ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004590000"
	        filename = ""

Region:
	              id = 4176
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 4177
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 4178
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 4179
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 4180
	        start_va = 0xd80000
	          end_va = 0xd80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d80000"
	        filename = ""

Region:
	              id = 4181
	        start_va = 0xdd0000
	          end_va = 0xdd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 4182
	        start_va = 0x32d0000
	          end_va = 0x32dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032d0000"
	        filename = ""

Region:
	              id = 4183
	        start_va = 0x3310000
	          end_va = 0x331ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003310000"
	        filename = ""

Region:
	              id = 4184
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 4185
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 4186
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 4187
	        start_va = 0xde0000
	          end_va = 0xde3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 4188
	        start_va = 0xdf0000
	          end_va = 0xe07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 4189
	        start_va = 0xe90000
	          end_va = 0xe9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 4190
	        start_va = 0xfe0000
	          end_va = 0xfe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 4191
	        start_va = 0xff0000
	          end_va = 0xffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 4192
	        start_va = 0x1000000
	          end_va = 0x100ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 4193
	        start_va = 0x1010000
	          end_va = 0x101ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 4194
	        start_va = 0x1020000
	          end_va = 0x102ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 4195
	        start_va = 0x1070000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001070000"
	        filename = ""

Region:
	              id = 4196
	        start_va = 0x1280000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 4197
	        start_va = 0x2880000
	          end_va = 0x288ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002880000"
	        filename = ""

Region:
	              id = 4198
	        start_va = 0x3360000
	          end_va = 0x339ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003360000"
	        filename = ""

Region:
	              id = 4199
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 4200
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 4201
	        start_va = 0x2890000
	          end_va = 0x289ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002890000"
	        filename = ""

Region:
	              id = 4202
	        start_va = 0x29a0000
	          end_va = 0x29affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029a0000"
	        filename = ""

Region:
	              id = 4203
	        start_va = 0x29b0000
	          end_va = 0x29bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029b0000"
	        filename = ""

Region:
	              id = 4204
	        start_va = 0x2bc0000
	          end_va = 0x2bc0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002bc0000"
	        filename = ""

Region:
	              id = 4205
	        start_va = 0x2bd0000
	          end_va = 0x2bd0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bd0000"
	        filename = ""

Region:
	              id = 4206
	        start_va = 0x3900000
	          end_va = 0x393ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003900000"
	        filename = ""

Region:
	              id = 4207
	        start_va = 0x3990000
	          end_va = 0x39cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003990000"
	        filename = ""

Region:
	              id = 4208
	        start_va = 0x4650000
	          end_va = 0x474ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004650000"
	        filename = ""

Region:
	              id = 4209
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 4210
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 4211
	        start_va = 0x2be0000
	          end_va = 0x2be0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002be0000"
	        filename = ""

Region:
	              id = 4212
	        start_va = 0x2bf0000
	          end_va = 0x2bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 4213
	        start_va = 0x2d00000
	          end_va = 0x2d00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002d00000"
	        filename = ""

Region:
	              id = 4214
	        start_va = 0x2d10000
	          end_va = 0x2d12fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002d10000"
	        filename = ""

Region:
	              id = 4215
	        start_va = 0x3280000
	          end_va = 0x32bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003280000"
	        filename = ""

Region:
	              id = 4216
	        start_va = 0x4400000
	          end_va = 0x443ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004400000"
	        filename = ""

Region:
	              id = 4217
	        start_va = 0x44b0000
	          end_va = 0x44effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044b0000"
	        filename = ""

Region:
	              id = 4218
	        start_va = 0x4810000
	          end_va = 0x481ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004810000"
	        filename = ""

Region:
	              id = 4219
	        start_va = 0x4860000
	          end_va = 0x495ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004860000"
	        filename = ""

Region:
	              id = 4220
	        start_va = 0x49c0000
	          end_va = 0x4abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 4221
	        start_va = 0x4ac0000
	          end_va = 0x4bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ac0000"
	        filename = ""

Region:
	              id = 4222
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 4223
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 4224
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 4225
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 4226
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 4227
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 4228
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 4229
	        start_va = 0x2d20000
	          end_va = 0x2d23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d20000"
	        filename = ""

Region:
	              id = 4230
	        start_va = 0x2d30000
	          end_va = 0x2d47fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d30000"
	        filename = ""

Region:
	              id = 4231
	        start_va = 0x2d60000
	          end_va = 0x2d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d60000"
	        filename = ""

Region:
	              id = 4232
	        start_va = 0x2d70000
	          end_va = 0x2d70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d70000"
	        filename = ""

Region:
	              id = 4233
	        start_va = 0x32c0000
	          end_va = 0x32cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032c0000"
	        filename = ""

Region:
	              id = 4234
	        start_va = 0x32e0000
	          end_va = 0x32effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032e0000"
	        filename = ""

Region:
	              id = 4235
	        start_va = 0x32f0000
	          end_va = 0x32fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032f0000"
	        filename = ""

Region:
	              id = 4236
	        start_va = 0x3300000
	          end_va = 0x330ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003300000"
	        filename = ""

Region:
	              id = 4237
	        start_va = 0x3320000
	          end_va = 0x332ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003320000"
	        filename = ""

Region:
	              id = 4238
	        start_va = 0x3330000
	          end_va = 0x333ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003330000"
	        filename = ""

Region:
	              id = 4239
	        start_va = 0x3340000
	          end_va = 0x3341fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003340000"
	        filename = ""

Region:
	              id = 4240
	        start_va = 0x3350000
	          end_va = 0x335ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003350000"
	        filename = ""

Region:
	              id = 4241
	        start_va = 0x4d30000
	          end_va = 0x4d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d30000"
	        filename = ""

Region:
	              id = 4242
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 4243
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 4244
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 4245
	        start_va = 0x33a0000
	          end_va = 0x33a7fff
	     entry_point = 0x33a0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 4246
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 4247
	        start_va = 0x33f0000
	          end_va = 0x33fcfff
	     entry_point = 0x33f0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 4248
	        start_va = 0x3400000
	          end_va = 0x3411fff
	     entry_point = 0x3400000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 4249
	        start_va = 0x3420000
	          end_va = 0x3420fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003420000"
	        filename = ""

Region:
	              id = 4250
	        start_va = 0x3430000
	          end_va = 0x3430fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003430000"
	        filename = ""

Region:
	              id = 4251
	        start_va = 0x3890000
	          end_va = 0x3890fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003890000"
	        filename = ""

Region:
	              id = 4252
	        start_va = 0x38a0000
	          end_va = 0x38a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000038a0000"
	        filename = ""

Region:
	              id = 4253
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 4254
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 4255
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 4256
	        start_va = 0x38b0000
	          end_va = 0x38b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000038b0000"
	        filename = ""

Region:
	              id = 4257
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 4258
	        start_va = 0x3a40000
	          end_va = 0x3a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a40000"
	        filename = ""

Region:
	              id = 4259
	        start_va = 0x4450000
	          end_va = 0x448ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004450000"
	        filename = ""

Region:
	              id = 4260
	        start_va = 0x44a0000
	          end_va = 0x44affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044a0000"
	        filename = ""

Region:
	              id = 4261
	        start_va = 0x4750000
	          end_va = 0x478ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004750000"
	        filename = ""

Region:
	              id = 4262
	        start_va = 0x47c0000
	          end_va = 0x47fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000047c0000"
	        filename = ""

Region:
	              id = 4263
	        start_va = 0x4c00000
	          end_va = 0x4cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c00000"
	        filename = ""

Region:
	              id = 4264
	        start_va = 0x4d40000
	          end_va = 0x4e3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d40000"
	        filename = ""

Region:
	              id = 4265
	        start_va = 0x4e40000
	          end_va = 0x4f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e40000"
	        filename = ""

Region:
	              id = 4266
	        start_va = 0x4f50000
	          end_va = 0x504ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f50000"
	        filename = ""

Region:
	              id = 4267
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 4268
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 4269
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 4270
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 4271
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 4272
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 4273
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 4274
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 4275
	        start_va = 0x38c0000
	          end_va = 0x38c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000038c0000"
	        filename = ""

Region:
	              id = 4276
	        start_va = 0x44f0000
	          end_va = 0x456ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044f0000"
	        filename = ""

Region:
	              id = 4277
	        start_va = 0x5050000
	          end_va = 0x514ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005050000"
	        filename = ""

Region:
	              id = 4278
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 4279
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 4280
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 4281
	        start_va = 0x38d0000
	          end_va = 0x38d3fff
	     entry_point = 0x38d0000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 4282
	        start_va = 0x45a0000
	          end_va = 0x45fcfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000045a0000"
	        filename = ""

Region:
	              id = 4283
	        start_va = 0x51e0000
	          end_va = 0x521ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051e0000"
	        filename = ""

Region:
	              id = 4284
	        start_va = 0x53c0000
	          end_va = 0x54bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000053c0000"
	        filename = ""

Region:
	              id = 4285
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 4286
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 4287
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4288
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 4289
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4290
	        start_va = 0x5220000
	          end_va = 0x531ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005220000"
	        filename = ""

Region:
	              id = 4291
	        start_va = 0x54c0000
	          end_va = 0x56bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054c0000"
	        filename = ""

Region:
	              id = 4292
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 4293
	        start_va = 0x38e0000
	          end_va = 0x38e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000038e0000"
	        filename = ""

Region:
	              id = 4294
	        start_va = 0x38f0000
	          end_va = 0x38f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000038f0000"
	        filename = ""

Region:
	              id = 4295
	        start_va = 0x3940000
	          end_va = 0x3940fff
	     entry_point = 0x3940000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 4296
	        start_va = 0x56c0000
	          end_va = 0x56fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000056c0000"
	        filename = ""

Region:
	              id = 4297
	        start_va = 0x57a0000
	          end_va = 0x589ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057a0000"
	        filename = ""

Region:
	              id = 4298
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 4299
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 4300
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 4301
	        start_va = 0x3950000
	          end_va = 0x3950fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003950000"
	        filename = ""

Region:
	              id = 4302
	        start_va = 0x3960000
	          end_va = 0x3960fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003960000"
	        filename = ""

Region:
	              id = 4303
	        start_va = 0x3970000
	          end_va = 0x3977fff
	     entry_point = 0x3970000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 4304
	        start_va = 0x3980000
	          end_va = 0x3981fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003980000"
	        filename = ""

Region:
	              id = 4305
	        start_va = 0x39d0000
	          end_va = 0x39e0fff
	     entry_point = 0x39d0000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 4306
	        start_va = 0x5180000
	          end_va = 0x51bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005180000"
	        filename = ""

Region:
	              id = 4307
	        start_va = 0x5350000
	          end_va = 0x538ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005350000"
	        filename = ""

Region:
	              id = 4308
	        start_va = 0x5940000
	          end_va = 0x5a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005940000"
	        filename = ""

Region:
	              id = 4309
	        start_va = 0x5a40000
	          end_va = 0x5a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a40000"
	        filename = ""

Region:
	              id = 4310
	        start_va = 0x5c40000
	          end_va = 0x5d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c40000"
	        filename = ""

Region:
	              id = 4311
	        start_va = 0x5d60000
	          end_va = 0x5f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d60000"
	        filename = ""

Region:
	              id = 4312
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 4313
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 4314
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 4315
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 4316
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 4317
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 4318
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 4319
	        start_va = 0x3a30000
	          end_va = 0x3a31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003a30000"
	        filename = ""

Region:
	              id = 4320
	        start_va = 0x43f0000
	          end_va = 0x43f3fff
	     entry_point = 0x43f0000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 4321
	        start_va = 0x58e0000
	          end_va = 0x591ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058e0000"
	        filename = ""

Region:
	              id = 4322
	        start_va = 0x5a80000
	          end_va = 0x5bc1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a80000"
	        filename = ""

Region:
	              id = 4323
	        start_va = 0x6030000
	          end_va = 0x60d7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006030000"
	        filename = ""

Region:
	              id = 4324
	        start_va = 0x6150000
	          end_va = 0x615ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006150000"
	        filename = ""

Region:
	              id = 4325
	        start_va = 0x6160000
	          end_va = 0x655ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006160000"
	        filename = ""

Region:
	              id = 4326
	        start_va = 0x6560000
	          end_va = 0x675ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006560000"
	        filename = ""

Region:
	              id = 4327
	        start_va = 0x6760000
	          end_va = 0x6b5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006760000"
	        filename = ""

Region:
	              id = 4328
	        start_va = 0x6b60000
	          end_va = 0x735ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006b60000"
	        filename = ""

Region:
	              id = 4329
	        start_va = 0x7410000
	          end_va = 0x7524fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007410000"
	        filename = ""

Region:
	              id = 4330
	        start_va = 0x76d0000
	          end_va = 0x77cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000076d0000"
	        filename = ""

Region:
	              id = 4331
	        start_va = 0x7880000
	          end_va = 0x797ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007880000"
	        filename = ""

Region:
	              id = 4332
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 4333
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 4334
	        start_va = 0x7ef74000
	          end_va = 0x7ef76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef74000"
	        filename = ""

Region:
	              id = 4335
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 4336
	        start_va = 0x4440000
	          end_va = 0x4441fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004440000"
	        filename = ""

Region:
	              id = 4337
	        start_va = 0x4490000
	          end_va = 0x4490fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004490000"
	        filename = ""

Region:
	              id = 4338
	        start_va = 0x4570000
	          end_va = 0x4570fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004570000"
	        filename = ""

Region:
	              id = 4339
	        start_va = 0x4600000
	          end_va = 0x4647fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004600000"
	        filename = ""

Region:
	              id = 4340
	        start_va = 0x4960000
	          end_va = 0x49abfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004960000"
	        filename = ""

Region:
	              id = 4341
	        start_va = 0x5700000
	          end_va = 0x5797fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005700000"
	        filename = ""

Region:
	              id = 4342
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 310
	os_tid = 0x8b8


Thread:
	id = 312
	os_tid = 0x778


Thread:
	id = 313
	os_tid = 0x81c


Thread:
	id = 314
	os_tid = 0x950


Thread:
	id = 315
	os_tid = 0x9b0


Thread:
	id = 316
	os_tid = 0x9bc


Thread:
	id = 317
	os_tid = 0xa04


Thread:
	id = 318
	os_tid = 0xa08


Thread:
	id = 319
	os_tid = 0xa3c


Thread:
	id = 321
	os_tid = 0x31c


Thread:
	id = 322
	os_tid = 0x48c


Thread:
	id = 323
	os_tid = 0x424


Thread:
	id = 324
	os_tid = 0x948


Thread:
	id = 325
	os_tid = 0xa94


Thread:
	id = 326
	os_tid = 0x630


Thread:
	id = 327
	os_tid = 0x5fc


Thread:
	id = 328
	os_tid = 0x634


Thread:
	id = 329
	os_tid = 0x638


Thread:
	id = 330
	os_tid = 0x64


Thread:
	id = 332
	os_tid = 0x9fc


Thread:
	id = 333
	os_tid = 0xac4


Thread:
	id = 334
	os_tid = 0x9f8


Thread:
	id = 335
	os_tid = 0xaac


Thread:
	id = 336
	os_tid = 0x9e4


Thread:
	id = 373
	os_tid = 0x830


Process:
	id = "15"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x18f6c000"
	os_pid = "0xba4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:79897"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4349
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4350
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4351
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 4352
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 4353
	        start_va = 0xb0000
	          end_va = 0xeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 4354
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 4355
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 4356
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4357
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4358
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 4359
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 4360
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 4361
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 4362
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 4363
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4364
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4365
	        start_va = 0x400000
	          end_va = 0x47ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4366
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4367
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4368
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4369
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4370
	        start_va = 0xf0000
	          end_va = 0x156fff
	     entry_point = 0xf0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4371
	        start_va = 0x550000
	          end_va = 0x64ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4372
	        start_va = 0x7c0000
	          end_va = 0x7cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007c0000"
	        filename = ""

Region:
	              id = 4373
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4374
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4375
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 4376
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4377
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4378
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 4379
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4380
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4381
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 4382
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4383
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4384
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4385
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 4386
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4387
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 4388
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 4389
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4390
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 4391
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 4392
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4393
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4394
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 4395
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 4396
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 4397
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 4398
	        start_va = 0x7d0000
	          end_va = 0x957fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007d0000"
	        filename = ""

Region:
	              id = 4399
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 4400
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4401
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 4402
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4403
	        start_va = 0x60000
	          end_va = 0x61fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 4404
	        start_va = 0x70000
	          end_va = 0x70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 4405
	        start_va = 0x80000
	          end_va = 0x80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 4406
	        start_va = 0x960000
	          end_va = 0xae0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000960000"
	        filename = ""

Region:
	              id = 4407
	        start_va = 0xaf0000
	          end_va = 0xdbefff
	     entry_point = 0xaf0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4408
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 4409
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 4410
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 4411
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 4412
	        start_va = 0x90000
	          end_va = 0x90fff
	     entry_point = 0x90000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 4413
	        start_va = 0xa0000
	          end_va = 0xa1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4414
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 4415
	        start_va = 0x170000
	          end_va = 0x171fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 4416
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 4417
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 4418
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 4419
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 4420
	        start_va = 0x1a0000
	          end_va = 0x1a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4421
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 4422
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 4423
	        start_va = 0xf10000
	          end_va = 0xf4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f10000"
	        filename = ""

Region:
	              id = 4424
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 4425
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4426
	        start_va = 0x1c0000
	          end_va = 0x22dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4427
	        start_va = 0x330000
	          end_va = 0x331fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000330000"
	        filename = ""

Region:
	              id = 4428
	        start_va = 0x340000
	          end_va = 0x341fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000340000"
	        filename = ""

Region:
	              id = 4429
	        start_va = 0x370000
	          end_va = 0x3affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000370000"
	        filename = ""

Region:
	              id = 4430
	        start_va = 0x650000
	          end_va = 0x72efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""

Region:
	              id = 4431
	        start_va = 0x750000
	          end_va = 0x78ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 4432
	        start_va = 0xf50000
	          end_va = 0x104ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f50000"
	        filename = ""

Region:
	              id = 4433
	        start_va = 0x1190000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001190000"
	        filename = ""

Region:
	              id = 4434
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 4435
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 4436
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 4437
	        start_va = 0x480000
	          end_va = 0x4bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4438
	        start_va = 0xdc0000
	          end_va = 0xebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 4439
	        start_va = 0x1050000
	          end_va = 0x108ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001050000"
	        filename = ""

Region:
	              id = 4440
	        start_va = 0x10d0000
	          end_va = 0x110ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010d0000"
	        filename = ""

Region:
	              id = 4441
	        start_va = 0x2890000
	          end_va = 0x298ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002890000"
	        filename = ""

Region:
	              id = 4442
	        start_va = 0x2a90000
	          end_va = 0x2c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a90000"
	        filename = ""

Region:
	              id = 4443
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 4444
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 4445
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 4446
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 4447
	        start_va = 0x71660000
	          end_va = 0x71692fff
	     entry_point = 0x71660000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 4448
	        start_va = 0x350000
	          end_va = 0x350fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000350000"
	        filename = ""

Region:
	              id = 4449
	        start_va = 0x2740000
	          end_va = 0x283ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 4450
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4451
	        start_va = 0x360000
	          end_va = 0x360fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000360000"
	        filename = ""

Region:
	              id = 4452
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 4453
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 4454
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 4455
	        start_va = 0x3c0000
	          end_va = 0x3defff
	     entry_point = 0x3c0000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 4456
	        start_va = 0x3e0000
	          end_va = 0x3e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003e0000"
	        filename = ""

Region:
	              id = 4457
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 4458
	        start_va = 0x3b0000
	          end_va = 0x3b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003b0000"
	        filename = ""

Region:
	              id = 4459
	        start_va = 0xec0000
	          end_va = 0xefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 4460
	        start_va = 0x2dc0000
	          end_va = 0x2ebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002dc0000"
	        filename = ""

Region:
	              id = 4461
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 4462
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 4463
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 4464
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 4465
	        start_va = 0x2ec0000
	          end_va = 0x32b2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002ec0000"
	        filename = ""

Region:
	              id = 4466
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 4467
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 4472
	        start_va = 0x3f0000
	          end_va = 0x3f1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 4473
	        start_va = 0x4c0000
	          end_va = 0x4c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4474
	        start_va = 0x4d0000
	          end_va = 0x4dffff
	     entry_point = 0x4d0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 4475
	        start_va = 0x4e0000
	          end_va = 0x4e7fff
	     entry_point = 0x4e0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 4476
	        start_va = 0x4f0000
	          end_va = 0x503fff
	     entry_point = 0x4f0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 4477
	        start_va = 0x2840000
	          end_va = 0x287ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002840000"
	        filename = ""

Region:
	              id = 4478
	        start_va = 0x29b0000
	          end_va = 0x29effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029b0000"
	        filename = ""

Region:
	              id = 4479
	        start_va = 0x3390000
	          end_va = 0x348ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003390000"
	        filename = ""

Region:
	              id = 4480
	        start_va = 0x3510000
	          end_va = 0x360ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003510000"
	        filename = ""

Region:
	              id = 4481
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 4482
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4483
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 4484
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 4485
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 4486
	        start_va = 0x37d0000
	          end_va = 0x380ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037d0000"
	        filename = ""

Region:
	              id = 4487
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 4488
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 4489
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 4490
	        start_va = 0x32c0000
	          end_va = 0x32fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032c0000"
	        filename = ""

Region:
	              id = 4491
	        start_va = 0x3850000
	          end_va = 0x3a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003850000"
	        filename = ""

Region:
	              id = 4492
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4493
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 4494
	        start_va = 0x510000
	          end_va = 0x510fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000510000"
	        filename = ""

Region:
	              id = 4495
	        start_va = 0x730000
	          end_va = 0x731fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 4496
	        start_va = 0x3a50000
	          end_va = 0x3d92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003a50000"
	        filename = ""

Region:
	              id = 4497
	        start_va = 0x3f50000
	          end_va = 0x3f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f50000"
	        filename = ""

Region:
	              id = 4498
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 4499
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 4500
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 4501
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 4502
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 4503
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 4504
	        start_va = 0x3760000
	          end_va = 0x379ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003760000"
	        filename = ""

Region:
	              id = 4505
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 4506
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 4507
	        start_va = 0x2d40000
	          end_va = 0x2d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d40000"
	        filename = ""

Region:
	              id = 4508
	        start_va = 0x2d80000
	          end_va = 0x2dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d80000"
	        filename = ""

Region:
	              id = 4509
	        start_va = 0x3e20000
	          end_va = 0x3f1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e20000"
	        filename = ""

Region:
	              id = 4510
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 4511
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 4512
	        start_va = 0x520000
	          end_va = 0x53ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 4513
	        start_va = 0x540000
	          end_va = 0x540fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000540000"
	        filename = ""

Region:
	              id = 4514
	        start_va = 0x3f90000
	          end_va = 0x48bffff
	     entry_point = 0x3f90000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 4515
	        start_va = 0x4ab0000
	          end_va = 0x4abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ab0000"
	        filename = ""

Region:
	              id = 4516
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 4517
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 4518
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 4519
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 4520
	        start_va = 0x740000
	          end_va = 0x740fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000740000"
	        filename = ""

Region:
	              id = 4521
	        start_va = 0x790000
	          end_va = 0x792fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000790000"
	        filename = ""

Region:
	              id = 4522
	        start_va = 0x4a40000
	          end_va = 0x4a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a40000"
	        filename = ""

Region:
	              id = 4523
	        start_va = 0x4c60000
	          end_va = 0x4c6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c60000"
	        filename = ""

Region:
	              id = 4524
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 4525
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 4526
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 4527
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 4528
	        start_va = 0x7a0000
	          end_va = 0x7a3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007a0000"
	        filename = ""

Region:
	              id = 4529
	        start_va = 0x7b0000
	          end_va = 0x7bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 4530
	        start_va = 0xf00000
	          end_va = 0xf00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f00000"
	        filename = ""

Region:
	              id = 4531
	        start_va = 0x1090000
	          end_va = 0x10a7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 4532
	        start_va = 0x10b0000
	          end_va = 0x10bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010b0000"
	        filename = ""

Region:
	              id = 4533
	        start_va = 0x10c0000
	          end_va = 0x10cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010c0000"
	        filename = ""

Region:
	              id = 4534
	        start_va = 0x1110000
	          end_va = 0x111ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001110000"
	        filename = ""

Region:
	              id = 4535
	        start_va = 0x1120000
	          end_va = 0x112ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001120000"
	        filename = ""

Region:
	              id = 4536
	        start_va = 0x1130000
	          end_va = 0x113ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001130000"
	        filename = ""

Region:
	              id = 4537
	        start_va = 0x1140000
	          end_va = 0x114ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001140000"
	        filename = ""

Region:
	              id = 4538
	        start_va = 0x1150000
	          end_va = 0x115ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001150000"
	        filename = ""

Region:
	              id = 4539
	        start_va = 0x2a30000
	          end_va = 0x2a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a30000"
	        filename = ""

Region:
	              id = 4540
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 4541
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 4542
	        start_va = 0x1160000
	          end_va = 0x116ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001160000"
	        filename = ""

Region:
	              id = 4543
	        start_va = 0x1170000
	          end_va = 0x117ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001170000"
	        filename = ""

Region:
	              id = 4544
	        start_va = 0x1180000
	          end_va = 0x118ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001180000"
	        filename = ""

Region:
	              id = 4545
	        start_va = 0x2880000
	          end_va = 0x2880fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002880000"
	        filename = ""

Region:
	              id = 4546
	        start_va = 0x2990000
	          end_va = 0x2990fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002990000"
	        filename = ""

Region:
	              id = 4547
	        start_va = 0x2a00000
	          end_va = 0x2a00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a00000"
	        filename = ""

Region:
	              id = 4548
	        start_va = 0x2a10000
	          end_va = 0x2a11fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a10000"
	        filename = ""

Region:
	              id = 4549
	        start_va = 0x34c0000
	          end_va = 0x34fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034c0000"
	        filename = ""

Region:
	              id = 4550
	        start_va = 0x36d0000
	          end_va = 0x370ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036d0000"
	        filename = ""

Region:
	              id = 4551
	        start_va = 0x48c0000
	          end_va = 0x49bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048c0000"
	        filename = ""

Region:
	              id = 4552
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 4553
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 4554
	        start_va = 0x29a0000
	          end_va = 0x29a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000029a0000"
	        filename = ""

Region:
	              id = 4555
	        start_va = 0x29f0000
	          end_va = 0x29fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029f0000"
	        filename = ""

Region:
	              id = 4556
	        start_va = 0x2a20000
	          end_va = 0x2a20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a20000"
	        filename = ""

Region:
	              id = 4557
	        start_va = 0x2a70000
	          end_va = 0x2a72fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a70000"
	        filename = ""

Region:
	              id = 4558
	        start_va = 0x2cf0000
	          end_va = 0x2d2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cf0000"
	        filename = ""

Region:
	              id = 4559
	        start_va = 0x3680000
	          end_va = 0x36bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003680000"
	        filename = ""

Region:
	              id = 4560
	        start_va = 0x3720000
	          end_va = 0x375ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003720000"
	        filename = ""

Region:
	              id = 4561
	        start_va = 0x4b20000
	          end_va = 0x4c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b20000"
	        filename = ""

Region:
	              id = 4562
	        start_va = 0x4cf0000
	          end_va = 0x4deffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cf0000"
	        filename = ""

Region:
	              id = 4563
	        start_va = 0x4f10000
	          end_va = 0x500ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f10000"
	        filename = ""

Region:
	              id = 4564
	        start_va = 0x51c0000
	          end_va = 0x51cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051c0000"
	        filename = ""

Region:
	              id = 4565
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 4566
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 4567
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 4568
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 4569
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 4570
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 4571
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 4572
	        start_va = 0x2a80000
	          end_va = 0x2a83fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a80000"
	        filename = ""

Region:
	              id = 4573
	        start_va = 0x2c90000
	          end_va = 0x2ca7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c90000"
	        filename = ""

Region:
	              id = 4574
	        start_va = 0x2cb0000
	          end_va = 0x2cbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cb0000"
	        filename = ""

Region:
	              id = 4575
	        start_va = 0x2cc0000
	          end_va = 0x2cc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cc0000"
	        filename = ""

Region:
	              id = 4576
	        start_va = 0x2cd0000
	          end_va = 0x2cdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cd0000"
	        filename = ""

Region:
	              id = 4577
	        start_va = 0x2ce0000
	          end_va = 0x2ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ce0000"
	        filename = ""

Region:
	              id = 4578
	        start_va = 0x2d30000
	          end_va = 0x2d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d30000"
	        filename = ""

Region:
	              id = 4579
	        start_va = 0x2d50000
	          end_va = 0x2d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d50000"
	        filename = ""

Region:
	              id = 4580
	        start_va = 0x2d60000
	          end_va = 0x2d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d60000"
	        filename = ""

Region:
	              id = 4581
	        start_va = 0x2d70000
	          end_va = 0x2d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d70000"
	        filename = ""

Region:
	              id = 4582
	        start_va = 0x3300000
	          end_va = 0x3301fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003300000"
	        filename = ""

Region:
	              id = 4583
	        start_va = 0x3320000
	          end_va = 0x332ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003320000"
	        filename = ""

Region:
	              id = 4584
	        start_va = 0x4eb0000
	          end_va = 0x4ebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004eb0000"
	        filename = ""

Region:
	              id = 4585
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 4586
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 4587
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 4588
	        start_va = 0x3310000
	          end_va = 0x3317fff
	     entry_point = 0x3310000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 4589
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 4590
	        start_va = 0x3330000
	          end_va = 0x333cfff
	     entry_point = 0x3330000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 4591
	        start_va = 0x3340000
	          end_va = 0x3351fff
	     entry_point = 0x3340000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 4592
	        start_va = 0x3360000
	          end_va = 0x3360fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003360000"
	        filename = ""

Region:
	              id = 4593
	        start_va = 0x3370000
	          end_va = 0x3370fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003370000"
	        filename = ""

Region:
	              id = 4594
	        start_va = 0x3380000
	          end_va = 0x3380fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003380000"
	        filename = ""

Region:
	              id = 4595
	        start_va = 0x3490000
	          end_va = 0x3490fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003490000"
	        filename = ""

Region:
	              id = 4596
	        start_va = 0x34a0000
	          end_va = 0x34a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034a0000"
	        filename = ""

Region:
	              id = 4597
	        start_va = 0x34b0000
	          end_va = 0x34b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034b0000"
	        filename = ""

Region:
	              id = 4598
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 4599
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 4600
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 4601
	        start_va = 0x3500000
	          end_va = 0x3500fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003500000"
	        filename = ""

Region:
	              id = 4602
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 4603
	        start_va = 0x3610000
	          end_va = 0x364ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003610000"
	        filename = ""

Region:
	              id = 4604
	        start_va = 0x49c0000
	          end_va = 0x49fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 4605
	        start_va = 0x4e40000
	          end_va = 0x4e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e40000"
	        filename = ""

Region:
	              id = 4606
	        start_va = 0x5070000
	          end_va = 0x516ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005070000"
	        filename = ""

Region:
	              id = 4607
	        start_va = 0x5170000
	          end_va = 0x51affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005170000"
	        filename = ""

Region:
	              id = 4608
	        start_va = 0x5290000
	          end_va = 0x529ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005290000"
	        filename = ""

Region:
	              id = 4609
	        start_va = 0x5360000
	          end_va = 0x545ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005360000"
	        filename = ""

Region:
	              id = 4610
	        start_va = 0x5480000
	          end_va = 0x557ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005480000"
	        filename = ""

Region:
	              id = 4611
	        start_va = 0x5580000
	          end_va = 0x567ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005580000"
	        filename = ""

Region:
	              id = 4612
	        start_va = 0x5700000
	          end_va = 0x57fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005700000"
	        filename = ""

Region:
	              id = 4613
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 4614
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 4615
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 4616
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 4617
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 4618
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 4619
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 4620
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 4621
	        start_va = 0x3650000
	          end_va = 0x3650fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003650000"
	        filename = ""

Region:
	              id = 4622
	        start_va = 0x3da0000
	          end_va = 0x3e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003da0000"
	        filename = ""

Region:
	              id = 4623
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 4624
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 4625
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 4626
	        start_va = 0x3660000
	          end_va = 0x3663fff
	     entry_point = 0x3660000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 4627
	        start_va = 0x4a50000
	          end_va = 0x4aacfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004a50000"
	        filename = ""

Region:
	              id = 4628
	        start_va = 0x4c20000
	          end_va = 0x4c5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c20000"
	        filename = ""

Region:
	              id = 4629
	        start_va = 0x51e0000
	          end_va = 0x521ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051e0000"
	        filename = ""

Region:
	              id = 4630
	        start_va = 0x52f0000
	          end_va = 0x532ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000052f0000"
	        filename = ""

Region:
	              id = 4631
	        start_va = 0x58c0000
	          end_va = 0x59bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058c0000"
	        filename = ""

Region:
	              id = 4632
	        start_va = 0x5ac0000
	          end_va = 0x5bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ac0000"
	        filename = ""

Region:
	              id = 4633
	        start_va = 0x5d70000
	          end_va = 0x5e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d70000"
	        filename = ""

Region:
	              id = 4634
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 4635
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 4636
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 4637
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 4638
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4639
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 4640
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4643
	        start_va = 0x59c0000
	          end_va = 0x5abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059c0000"
	        filename = ""

Region:
	              id = 4644
	        start_va = 0x5e70000
	          end_va = 0x606ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e70000"
	        filename = ""

Region:
	              id = 4645
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 4646
	        start_va = 0x3670000
	          end_va = 0x3670fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003670000"
	        filename = ""

Region:
	              id = 4647
	        start_va = 0x36c0000
	          end_va = 0x36c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036c0000"
	        filename = ""

Region:
	              id = 4648
	        start_va = 0x37a0000
	          end_va = 0x37a1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037a0000"
	        filename = ""

Region:
	              id = 4649
	        start_va = 0x4ec0000
	          end_va = 0x4efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ec0000"
	        filename = ""

Region:
	              id = 4650
	        start_va = 0x6190000
	          end_va = 0x638ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006190000"
	        filename = ""

Region:
	              id = 4651
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 4652
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 4653
	        start_va = 0x7ef74000
	          end_va = 0x7ef76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef74000"
	        filename = ""

Region:
	              id = 4654
	        start_va = 0x3710000
	          end_va = 0x3710fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003710000"
	        filename = ""

Region:
	              id = 4655
	        start_va = 0x37b0000
	          end_va = 0x37b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000037b0000"
	        filename = ""

Region:
	              id = 4656
	        start_va = 0x37c0000
	          end_va = 0x37c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037c0000"
	        filename = ""

Region:
	              id = 4657
	        start_va = 0x3810000
	          end_va = 0x3811fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003810000"
	        filename = ""

Region:
	              id = 4658
	        start_va = 0x4cb0000
	          end_va = 0x4ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cb0000"
	        filename = ""

Region:
	              id = 4659
	        start_va = 0x6090000
	          end_va = 0x618ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006090000"
	        filename = ""

Region:
	              id = 4660
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 4661
	        start_va = 0x7ef71000
	          end_va = 0x7ef73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef71000"
	        filename = ""

Region:
	              id = 4662
	        start_va = 0x6390000
	          end_va = 0x678ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006390000"
	        filename = ""

Region:
	              id = 4663
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 4664
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 4665
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 4783
	        start_va = 0x3820000
	          end_va = 0x3821fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003820000"
	        filename = ""

Region:
	              id = 4784
	        start_va = 0x3830000
	          end_va = 0x3840fff
	     entry_point = 0x3830000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 4785
	        start_va = 0x3f20000
	          end_va = 0x3f27fff
	     entry_point = 0x3f20000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 4786
	        start_va = 0x3f30000
	          end_va = 0x3f30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f30000"
	        filename = ""

Region:
	              id = 4787
	        start_va = 0x3f40000
	          end_va = 0x3f40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003f40000"
	        filename = ""

Region:
	              id = 4788
	        start_va = 0x4a00000
	          end_va = 0x4a03fff
	     entry_point = 0x4a00000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 4789
	        start_va = 0x4df0000
	          end_va = 0x4e2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004df0000"
	        filename = ""

Region:
	              id = 4790
	        start_va = 0x5800000
	          end_va = 0x5897fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005800000"
	        filename = ""

Region:
	              id = 4791
	        start_va = 0x58a0000
	          end_va = 0x58affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058a0000"
	        filename = ""

Region:
	              id = 4792
	        start_va = 0x5c90000
	          end_va = 0x5d37fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c90000"
	        filename = ""

Region:
	              id = 4793
	        start_va = 0x6790000
	          end_va = 0x6f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006790000"
	        filename = ""

Region:
	              id = 4794
	        start_va = 0x6f90000
	          end_va = 0x718ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f90000"
	        filename = ""

Region:
	              id = 4795
	        start_va = 0x7190000
	          end_va = 0x758ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007190000"
	        filename = ""

Region:
	              id = 4796
	        start_va = 0x7590000
	          end_va = 0x76d1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007590000"
	        filename = ""

Region:
	              id = 4797
	        start_va = 0x7790000
	          end_va = 0x78a4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007790000"
	        filename = ""

Region:
	              id = 4798
	        start_va = 0x7a10000
	          end_va = 0x7b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007a10000"
	        filename = ""

Region:
	              id = 4799
	        start_va = 0x7bc0000
	          end_va = 0x7cbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007bc0000"
	        filename = ""

Region:
	              id = 4800
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 4801
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 4802
	        start_va = 0x7ef6e000
	          end_va = 0x7ef70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef6e000"
	        filename = ""

Region:
	              id = 4803
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 4809
	        start_va = 0x4a10000
	          end_va = 0x4a11fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a10000"
	        filename = ""

Region:
	              id = 4810
	        start_va = 0x4a20000
	          end_va = 0x4a20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a20000"
	        filename = ""

Region:
	              id = 4811
	        start_va = 0x4ac0000
	          end_va = 0x4b07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ac0000"
	        filename = ""

Region:
	              id = 4812
	        start_va = 0x5010000
	          end_va = 0x505bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005010000"
	        filename = ""

Region:
	              id = 4813
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 344
	os_tid = 0xa48


Thread:
	id = 345
	os_tid = 0xa50


Thread:
	id = 346
	os_tid = 0x53c


Thread:
	id = 347
	os_tid = 0x7f8


Thread:
	id = 348
	os_tid = 0x9d0


Thread:
	id = 349
	os_tid = 0x330


Thread:
	id = 350
	os_tid = 0x288


Thread:
	id = 351
	os_tid = 0xbe0


Thread:
	id = 352
	os_tid = 0x328


Thread:
	id = 358
	os_tid = 0x37c


Thread:
	id = 359
	os_tid = 0xb0c


Thread:
	id = 360
	os_tid = 0x654


Thread:
	id = 361
	os_tid = 0x7e8


Thread:
	id = 362
	os_tid = 0xc0


Thread:
	id = 364
	os_tid = 0x94c


Thread:
	id = 365
	os_tid = 0x660


Thread:
	id = 366
	os_tid = 0x758


Thread:
	id = 367
	os_tid = 0x974


Thread:
	id = 368
	os_tid = 0x9ac


Thread:
	id = 369
	os_tid = 0x49c


Thread:
	id = 370
	os_tid = 0x834


Thread:
	id = 371
	os_tid = 0x814


Thread:
	id = 374
	os_tid = 0xc04


Thread:
	id = 375
	os_tid = 0xc08


Thread:
	id = 383
	os_tid = 0xc2c


Thread:
	id = 387
	os_tid = 0xc3c


Process:
	id = "16"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x4d3c5000"
	os_pid = "0xc10"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:276485"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4666
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4667
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4668
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 4669
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 4670
	        start_va = 0x110000
	          end_va = 0x14ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 4671
	        start_va = 0x270000
	          end_va = 0x36ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000270000"
	        filename = ""

Region:
	              id = 4672
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 4673
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4674
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4675
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 4676
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 4677
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 4678
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 4679
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 4680
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4681
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4682
	        start_va = 0x4d0000
	          end_va = 0x54ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 4683
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4684
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4685
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4686
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4687
	        start_va = 0x60000
	          end_va = 0xc6fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4688
	        start_va = 0x6b0000
	          end_va = 0x7affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006b0000"
	        filename = ""

Region:
	              id = 4689
	        start_va = 0x930000
	          end_va = 0x93ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000930000"
	        filename = ""

Region:
	              id = 4690
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4691
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4692
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 4693
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4694
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4695
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 4696
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4697
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4698
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 4699
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4700
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4701
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4702
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 4703
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4704
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 4705
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 4706
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4707
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 4708
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 4709
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4710
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4711
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 4712
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 4713
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 4714
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 4715
	        start_va = 0x940000
	          end_va = 0xac7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000940000"
	        filename = ""

Region:
	              id = 4716
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 4717
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4718
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 4719
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4720
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0xd0000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 4721
	        start_va = 0xe0000
	          end_va = 0xe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4722
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4723
	        start_va = 0xad0000
	          end_va = 0xc50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ad0000"
	        filename = ""

Region:
	              id = 4724
	        start_va = 0xc60000
	          end_va = 0xf2efff
	     entry_point = 0xc60000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4725
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 4726
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 4727
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 4728
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 4729
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x100000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 4730
	        start_va = 0x150000
	          end_va = 0x151fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 4731
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 4732
	        start_va = 0x170000
	          end_va = 0x171fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 4733
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 4734
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 4735
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 4736
	        start_va = 0x190000
	          end_va = 0x190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 4737
	        start_va = 0x1a0000
	          end_va = 0x1a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4738
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 4739
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 4740
	        start_va = 0x1d0000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4741
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 4742
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4743
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4744
	        start_va = 0x210000
	          end_va = 0x211fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000210000"
	        filename = ""

Region:
	              id = 4745
	        start_va = 0x370000
	          end_va = 0x44efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000370000"
	        filename = ""

Region:
	              id = 4746
	        start_va = 0x450000
	          end_va = 0x4bdfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000450000"
	        filename = ""

Region:
	              id = 4747
	        start_va = 0x550000
	          end_va = 0x58ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4748
	        start_va = 0x610000
	          end_va = 0x64ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000610000"
	        filename = ""

Region:
	              id = 4749
	        start_va = 0x830000
	          end_va = 0x92ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000830000"
	        filename = ""

Region:
	              id = 4750
	        start_va = 0xfa0000
	          end_va = 0x109ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fa0000"
	        filename = ""

Region:
	              id = 4751
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 4752
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 4753
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 4754
	        start_va = 0x7b0000
	          end_va = 0x7effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 4755
	        start_va = 0x7f0000
	          end_va = 0x82ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007f0000"
	        filename = ""

Region:
	              id = 4756
	        start_va = 0x1140000
	          end_va = 0x123ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001140000"
	        filename = ""

Region:
	              id = 4757
	        start_va = 0x2750000
	          end_va = 0x278ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 4758
	        start_va = 0x28e0000
	          end_va = 0x29dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028e0000"
	        filename = ""

Region:
	              id = 4759
	        start_va = 0x2aa0000
	          end_va = 0x2c9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002aa0000"
	        filename = ""

Region:
	              id = 4760
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 4761
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 4762
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 4763
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 4764
	        start_va = 0x70ec0000
	          end_va = 0x70ef2fff
	     entry_point = 0x70ec0000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 4765
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 4766
	        start_va = 0x2790000
	          end_va = 0x288ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002790000"
	        filename = ""

Region:
	              id = 4767
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4768
	        start_va = 0x230000
	          end_va = 0x230fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 4769
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 4770
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 4771
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 4772
	        start_va = 0x240000
	          end_va = 0x243fff
	     entry_point = 0x240000
	     region_type = mapped_file
	            name = "cversions.1.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")

Region:
	              id = 4773
	        start_va = 0x250000
	          end_va = 0x26efff
	     entry_point = 0x250000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 4774
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4775
	        start_va = 0x29f0000
	          end_va = 0x2a2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029f0000"
	        filename = ""

Region:
	              id = 4776
	        start_va = 0x2d80000
	          end_va = 0x2e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d80000"
	        filename = ""

Region:
	              id = 4777
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 4778
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 4779
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 4780
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 4781
	        start_va = 0x2e80000
	          end_va = 0x3272fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e80000"
	        filename = ""

Region:
	              id = 4782
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 4804
	        start_va = 0x240000
	          end_va = 0x240fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000240000"
	        filename = ""

Region:
	              id = 4805
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 4806
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 4814
	        start_va = 0x590000
	          end_va = 0x591fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 4815
	        start_va = 0x5a0000
	          end_va = 0x5a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""

Region:
	              id = 4816
	        start_va = 0x5b0000
	          end_va = 0x5bffff
	     entry_point = 0x5b0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 4817
	        start_va = 0x5c0000
	          end_va = 0x5c7fff
	     entry_point = 0x5c0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 4818
	        start_va = 0x5d0000
	          end_va = 0x5e3fff
	     entry_point = 0x5d0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 4819
	        start_va = 0x2a60000
	          end_va = 0x2a9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a60000"
	        filename = ""

Region:
	              id = 4820
	        start_va = 0x2cf0000
	          end_va = 0x2d2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cf0000"
	        filename = ""

Region:
	              id = 4821
	        start_va = 0x32e0000
	          end_va = 0x33dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032e0000"
	        filename = ""

Region:
	              id = 4822
	        start_va = 0x3420000
	          end_va = 0x351ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003420000"
	        filename = ""

Region:
	              id = 4823
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 4824
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4825
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 4826
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 4827
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 4828
	        start_va = 0x10e0000
	          end_va = 0x111ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010e0000"
	        filename = ""

Region:
	              id = 4829
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 4830
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 4831
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 4835
	        start_va = 0x670000
	          end_va = 0x6affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 4836
	        start_va = 0x2cb0000
	          end_va = 0x2ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cb0000"
	        filename = ""

Region:
	              id = 4837
	        start_va = 0x36a0000
	          end_va = 0x389ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036a0000"
	        filename = ""

Region:
	              id = 4838
	        start_va = 0x38a0000
	          end_va = 0x3a9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000038a0000"
	        filename = ""

Region:
	              id = 4839
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4840
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 4841
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 4842
	        start_va = 0x3aa0000
	          end_va = 0x3de2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003aa0000"
	        filename = ""

Region:
	              id = 4843
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 4844
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 4845
	        start_va = 0x5f0000
	          end_va = 0x5f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005f0000"
	        filename = ""

Region:
	              id = 4846
	        start_va = 0xf30000
	          end_va = 0xf31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f30000"
	        filename = ""

Region:
	              id = 4847
	        start_va = 0xf40000
	          end_va = 0xf40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f40000"
	        filename = ""

Region:
	              id = 4848
	        start_va = 0xf50000
	          end_va = 0xf51fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f50000"
	        filename = ""

Region:
	              id = 4849
	        start_va = 0x35e0000
	          end_va = 0x35effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035e0000"
	        filename = ""

Region:
	              id = 4850
	        start_va = 0x3f80000
	          end_va = 0x3fbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f80000"
	        filename = ""

Region:
	              id = 4851
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 4852
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 4853
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 4854
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 4855
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 4856
	        start_va = 0xf60000
	          end_va = 0xf61fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f60000"
	        filename = ""

Region:
	              id = 4857
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 4858
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 4859
	        start_va = 0x3f10000
	          end_va = 0x3f4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f10000"
	        filename = ""

Region:
	              id = 4860
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 4861
	        start_va = 0x600000
	          end_va = 0x600fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000600000"
	        filename = ""

Region:
	              id = 4862
	        start_va = 0x650000
	          end_va = 0x66ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000650000"
	        filename = ""

Region:
	              id = 4863
	        start_va = 0xf80000
	          end_va = 0xf8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f80000"
	        filename = ""

Region:
	              id = 4864
	        start_va = 0x3fc0000
	          end_va = 0x48effff
	     entry_point = 0x3fc0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 4865
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 4866
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 4867
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 4868
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 4869
	        start_va = 0xf70000
	          end_va = 0xf70fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000f70000"
	        filename = ""

Region:
	              id = 4870
	        start_va = 0xf90000
	          end_va = 0xf92fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000f90000"
	        filename = ""

Region:
	              id = 4871
	        start_va = 0x32d0000
	          end_va = 0x32dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032d0000"
	        filename = ""

Region:
	              id = 4872
	        start_va = 0x4a60000
	          end_va = 0x4a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a60000"
	        filename = ""

Region:
	              id = 4873
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 4874
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 4875
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 4876
	        start_va = 0x10a0000
	          end_va = 0x10a3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 4877
	        start_va = 0x10b0000
	          end_va = 0x10c7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010b0000"
	        filename = ""

Region:
	              id = 4878
	        start_va = 0x10d0000
	          end_va = 0x10dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010d0000"
	        filename = ""

Region:
	              id = 4879
	        start_va = 0x1120000
	          end_va = 0x1120fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001120000"
	        filename = ""

Region:
	              id = 4880
	        start_va = 0x1130000
	          end_va = 0x113ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001130000"
	        filename = ""

Region:
	              id = 4881
	        start_va = 0x1240000
	          end_va = 0x124ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 4882
	        start_va = 0x1250000
	          end_va = 0x125ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 4883
	        start_va = 0x1260000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001260000"
	        filename = ""

Region:
	              id = 4884
	        start_va = 0x1270000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001270000"
	        filename = ""

Region:
	              id = 4885
	        start_va = 0x1280000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 4886
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 4887
	        start_va = 0x4a10000
	          end_va = 0x4a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a10000"
	        filename = ""

Region:
	              id = 4888
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 4889
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 4890
	        start_va = 0x2890000
	          end_va = 0x289ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002890000"
	        filename = ""

Region:
	              id = 4891
	        start_va = 0x28a0000
	          end_va = 0x28affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028a0000"
	        filename = ""

Region:
	              id = 4892
	        start_va = 0x28b0000
	          end_va = 0x28bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028b0000"
	        filename = ""

Region:
	              id = 4893
	        start_va = 0x28c0000
	          end_va = 0x28c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000028c0000"
	        filename = ""

Region:
	              id = 4894
	        start_va = 0x28d0000
	          end_va = 0x28d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028d0000"
	        filename = ""

Region:
	              id = 4895
	        start_va = 0x3530000
	          end_va = 0x356ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003530000"
	        filename = ""

Region:
	              id = 4896
	        start_va = 0x4bc0000
	          end_va = 0x4bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004bc0000"
	        filename = ""

Region:
	              id = 4897
	        start_va = 0x4d00000
	          end_va = 0x4dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d00000"
	        filename = ""

Region:
	              id = 4898
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 4899
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 4900
	        start_va = 0x29e0000
	          end_va = 0x29e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000029e0000"
	        filename = ""

Region:
	              id = 4901
	        start_va = 0x2a30000
	          end_va = 0x2a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a30000"
	        filename = ""

Region:
	              id = 4902
	        start_va = 0x2a40000
	          end_va = 0x2a40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a40000"
	        filename = ""

Region:
	              id = 4903
	        start_va = 0x2a50000
	          end_va = 0x2a52fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002a50000"
	        filename = ""

Region:
	              id = 4904
	        start_va = 0x2d30000
	          end_va = 0x2d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d30000"
	        filename = ""

Region:
	              id = 4905
	        start_va = 0x35a0000
	          end_va = 0x35dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035a0000"
	        filename = ""

Region:
	              id = 4906
	        start_va = 0x3e10000
	          end_va = 0x3f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e10000"
	        filename = ""

Region:
	              id = 4907
	        start_va = 0x48f0000
	          end_va = 0x492ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048f0000"
	        filename = ""

Region:
	              id = 4908
	        start_va = 0x4a90000
	          end_va = 0x4b8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a90000"
	        filename = ""

Region:
	              id = 4909
	        start_va = 0x4f10000
	          end_va = 0x4f1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f10000"
	        filename = ""

Region:
	              id = 4910
	        start_va = 0x4f40000
	          end_va = 0x503ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f40000"
	        filename = ""

Region:
	              id = 4911
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 4912
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 4913
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 4914
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 4915
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 4916
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 4917
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 4918
	        start_va = 0x2ca0000
	          end_va = 0x2ca3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ca0000"
	        filename = ""

Region:
	              id = 4919
	        start_va = 0x2d70000
	          end_va = 0x2d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d70000"
	        filename = ""

Region:
	              id = 4920
	        start_va = 0x3280000
	          end_va = 0x3297fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003280000"
	        filename = ""

Region:
	              id = 4921
	        start_va = 0x32a0000
	          end_va = 0x32a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032a0000"
	        filename = ""

Region:
	              id = 4922
	        start_va = 0x32b0000
	          end_va = 0x32bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032b0000"
	        filename = ""

Region:
	              id = 4923
	        start_va = 0x32c0000
	          end_va = 0x32cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000032c0000"
	        filename = ""

Region:
	              id = 4924
	        start_va = 0x33e0000
	          end_va = 0x33effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033e0000"
	        filename = ""

Region:
	              id = 4925
	        start_va = 0x33f0000
	          end_va = 0x33fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033f0000"
	        filename = ""

Region:
	              id = 4926
	        start_va = 0x3400000
	          end_va = 0x340ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003400000"
	        filename = ""

Region:
	              id = 4927
	        start_va = 0x3410000
	          end_va = 0x341ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003410000"
	        filename = ""

Region:
	              id = 4928
	        start_va = 0x3520000
	          end_va = 0x3521fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003520000"
	        filename = ""

Region:
	              id = 4929
	        start_va = 0x3680000
	          end_va = 0x368ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003680000"
	        filename = ""

Region:
	              id = 4930
	        start_va = 0x51e0000
	          end_va = 0x51effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051e0000"
	        filename = ""

Region:
	              id = 4931
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 4932
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 4933
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 4934
	        start_va = 0x3570000
	          end_va = 0x3577fff
	     entry_point = 0x3570000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 4935
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 4936
	        start_va = 0x3580000
	          end_va = 0x358cfff
	     entry_point = 0x3580000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 4937
	        start_va = 0x3590000
	          end_va = 0x3590fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003590000"
	        filename = ""

Region:
	              id = 4938
	        start_va = 0x35f0000
	          end_va = 0x3601fff
	     entry_point = 0x35f0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 4939
	        start_va = 0x3610000
	          end_va = 0x3610fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003610000"
	        filename = ""

Region:
	              id = 4940
	        start_va = 0x3620000
	          end_va = 0x3620fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003620000"
	        filename = ""

Region:
	              id = 4941
	        start_va = 0x3630000
	          end_va = 0x3630fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003630000"
	        filename = ""

Region:
	              id = 4942
	        start_va = 0x3640000
	          end_va = 0x3640fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003640000"
	        filename = ""

Region:
	              id = 4943
	        start_va = 0x3650000
	          end_va = 0x3650fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003650000"
	        filename = ""

Region:
	              id = 4944
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 4945
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 4946
	        start_va = 0x3660000
	          end_va = 0x3660fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003660000"
	        filename = ""

Region:
	              id = 4947
	        start_va = 0x3670000
	          end_va = 0x3670fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003670000"
	        filename = ""

Region:
	              id = 4948
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 4949
	        start_va = 0x3690000
	          end_va = 0x3690fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003690000"
	        filename = ""

Region:
	              id = 4950
	        start_va = 0x4c70000
	          end_va = 0x4caffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c70000"
	        filename = ""

Region:
	              id = 4951
	        start_va = 0x50c0000
	          end_va = 0x51bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000050c0000"
	        filename = ""

Region:
	              id = 4952
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 4953
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 4954
	        start_va = 0x4950000
	          end_va = 0x498ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004950000"
	        filename = ""

Region:
	              id = 4955
	        start_va = 0x4e50000
	          end_va = 0x4e8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e50000"
	        filename = ""

Region:
	              id = 4956
	        start_va = 0x4ed0000
	          end_va = 0x4f0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ed0000"
	        filename = ""

Region:
	              id = 4957
	        start_va = 0x51f0000
	          end_va = 0x52effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051f0000"
	        filename = ""

Region:
	              id = 4958
	        start_va = 0x5360000
	          end_va = 0x536ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005360000"
	        filename = ""

Region:
	              id = 4959
	        start_va = 0x53d0000
	          end_va = 0x54cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4960
	        start_va = 0x5510000
	          end_va = 0x560ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005510000"
	        filename = ""

Region:
	              id = 4961
	        start_va = 0x5630000
	          end_va = 0x572ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005630000"
	        filename = ""

Region:
	              id = 4962
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 4963
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 4964
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 4965
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 4966
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 4967
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 4968
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 4969
	        start_va = 0x3df0000
	          end_va = 0x3df0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003df0000"
	        filename = ""

Region:
	              id = 4970
	        start_va = 0x4990000
	          end_va = 0x4a0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004990000"
	        filename = ""

Region:
	              id = 4971
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 4972
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 4973
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 4974
	        start_va = 0x3e00000
	          end_va = 0x3e03fff
	     entry_point = 0x3e00000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 4975
	        start_va = 0x4c00000
	          end_va = 0x4c5cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004c00000"
	        filename = ""

Region:
	              id = 4976
	        start_va = 0x4e90000
	          end_va = 0x4ecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e90000"
	        filename = ""

Region:
	              id = 4977
	        start_va = 0x5050000
	          end_va = 0x508ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005050000"
	        filename = ""

Region:
	              id = 4978
	        start_va = 0x5320000
	          end_va = 0x535ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005320000"
	        filename = ""

Region:
	              id = 4979
	        start_va = 0x5810000
	          end_va = 0x590ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005810000"
	        filename = ""

Region:
	              id = 4980
	        start_va = 0x5970000
	          end_va = 0x5a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005970000"
	        filename = ""

Region:
	              id = 4981
	        start_va = 0x5a70000
	          end_va = 0x5b6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a70000"
	        filename = ""

Region:
	              id = 4982
	        start_va = 0x5be0000
	          end_va = 0x5c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005be0000"
	        filename = ""

Region:
	              id = 4983
	        start_va = 0x5d20000
	          end_va = 0x5e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d20000"
	        filename = ""

Region:
	              id = 4984
	        start_va = 0x5f70000
	          end_va = 0x606ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005f70000"
	        filename = ""

Region:
	              id = 4985
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 4986
	        start_va = 0x7ef74000
	          end_va = 0x7ef76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef74000"
	        filename = ""

Region:
	              id = 4987
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 4988
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 4989
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 4990
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4991
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 4992
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4993
	        start_va = 0x6070000
	          end_va = 0x626ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006070000"
	        filename = ""

Region:
	              id = 4994
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 4995
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 4996
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 4997
	        start_va = 0x3f50000
	          end_va = 0x3f50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003f50000"
	        filename = ""

Region:
	              id = 4998
	        start_va = 0x3f60000
	          end_va = 0x3f60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003f60000"
	        filename = ""

Region:
	              id = 4999
	        start_va = 0x4930000
	          end_va = 0x4931fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004930000"
	        filename = ""

Region:
	              id = 5000
	        start_va = 0x5770000
	          end_va = 0x57affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005770000"
	        filename = ""

Region:
	              id = 5001
	        start_va = 0x5e70000
	          end_va = 0x5f6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e70000"
	        filename = ""

Region:
	              id = 5002
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 5003
	        start_va = 0x7ef71000
	          end_va = 0x7ef73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef71000"
	        filename = ""

Region:
	              id = 5004
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 5005
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 5006
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 5009
	        start_va = 0x5b0000
	          end_va = 0x5b3fff
	     entry_point = 0x5b0000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 5010
	        start_va = 0x3f70000
	          end_va = 0x3f7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f70000"
	        filename = ""

Region:
	              id = 5011
	        start_va = 0x4940000
	          end_va = 0x4941fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004940000"
	        filename = ""

Region:
	              id = 5012
	        start_va = 0x4a50000
	          end_va = 0x4a50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a50000"
	        filename = ""

Region:
	              id = 5013
	        start_va = 0x4a70000
	          end_va = 0x4a80fff
	     entry_point = 0x4a70000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 5014
	        start_va = 0x4b90000
	          end_va = 0x4b97fff
	     entry_point = 0x4b90000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 5015
	        start_va = 0x4ba0000
	          end_va = 0x4bb3fff
	     entry_point = 0x4ba0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 5016
	        start_va = 0x5c20000
	          end_va = 0x5cc7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c20000"
	        filename = ""

Region:
	              id = 5017
	        start_va = 0x6270000
	          end_va = 0x666ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006270000"
	        filename = ""

Region:
	              id = 5018
	        start_va = 0x6670000
	          end_va = 0x6e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006670000"
	        filename = ""

Region:
	              id = 5019
	        start_va = 0x6e70000
	          end_va = 0x6f07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e70000"
	        filename = ""

Region:
	              id = 5020
	        start_va = 0x6f10000
	          end_va = 0x710ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f10000"
	        filename = ""

Region:
	              id = 5021
	        start_va = 0x7110000
	          end_va = 0x750ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007110000"
	        filename = ""

Region:
	              id = 5022
	        start_va = 0x7510000
	          end_va = 0x7651fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007510000"
	        filename = ""

Region:
	              id = 5023
	        start_va = 0x7670000
	          end_va = 0x76affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007670000"
	        filename = ""

Region:
	              id = 5024
	        start_va = 0x77e0000
	          end_va = 0x78f4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000077e0000"
	        filename = ""

Region:
	              id = 5025
	        start_va = 0x79e0000
	          end_va = 0x7adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000079e0000"
	        filename = ""

Region:
	              id = 5026
	        start_va = 0x7b60000
	          end_va = 0x7c5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007b60000"
	        filename = ""

Region:
	              id = 5027
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 5028
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 5029
	        start_va = 0x7ef6e000
	          end_va = 0x7ef70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef6e000"
	        filename = ""

Region:
	              id = 5030
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 5031
	        start_va = 0x4c60000
	          end_va = 0x4c61fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c60000"
	        filename = ""

Region:
	              id = 5032
	        start_va = 0x4cb0000
	          end_va = 0x4cf7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cb0000"
	        filename = ""

Region:
	              id = 5033
	        start_va = 0x4e00000
	          end_va = 0x4e4bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e00000"
	        filename = ""

Region:
	              id = 5034
	        start_va = 0x4f20000
	          end_va = 0x4f20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f20000"
	        filename = ""

Region:
	              id = 5035
	        start_va = 0x4f30000
	          end_va = 0x4f30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f30000"
	        filename = ""

Region:
	              id = 5036
	        start_va = 0x5040000
	          end_va = 0x5040fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005040000"
	        filename = ""

Region:
	              id = 5037
	        start_va = 0x5090000
	          end_va = 0x5090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005090000"
	        filename = ""

Region:
	              id = 5038
	        start_va = 0x50a0000
	          end_va = 0x50a0fff
	     entry_point = 0x50a0000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 5039
	        start_va = 0x5e30000
	          end_va = 0x5e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e30000"
	        filename = ""

Region:
	              id = 5040
	        start_va = 0x76d0000
	          end_va = 0x77cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000076d0000"
	        filename = ""

Region:
	              id = 5041
	        start_va = 0x7900000
	          end_va = 0x79a7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007900000"
	        filename = ""

Region:
	              id = 5042
	        start_va = 0x7cc0000
	          end_va = 0x7dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007cc0000"
	        filename = ""

Region:
	              id = 5043
	        start_va = 0x7dc0000
	          end_va = 0x7e57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007dc0000"
	        filename = ""

Region:
	              id = 5044
	        start_va = 0x7e60000
	          end_va = 0x7fa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007e60000"
	        filename = ""

Region:
	              id = 5045
	        start_va = 0x7fb0000
	          end_va = 0x8047fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007fb0000"
	        filename = ""

Region:
	              id = 5046
	        start_va = 0x8130000
	          end_va = 0x8244fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008130000"
	        filename = ""

Region:
	              id = 5047
	        start_va = 0x8250000
	          end_va = 0x921ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008250000"
	        filename = ""

Region:
	              id = 5048
	        start_va = 0x9220000
	          end_va = 0x9361fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009220000"
	        filename = ""

Region:
	              id = 5049
	        start_va = 0x9370000
	          end_va = 0x9417fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009370000"
	        filename = ""

Region:
	              id = 5050
	        start_va = 0x94d0000
	          end_va = 0x95e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000094d0000"
	        filename = ""

Region:
	              id = 5051
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")

Region:
	              id = 5052
	        start_va = 0x7ef6b000
	          end_va = 0x7ef6dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef6b000"
	        filename = ""


Thread:
	id = 377
	os_tid = 0xc14


Thread:
	id = 378
	os_tid = 0xc18


Thread:
	id = 379
	os_tid = 0xc1c


Thread:
	id = 380
	os_tid = 0xc20


Thread:
	id = 381
	os_tid = 0xc24


Thread:
	id = 382
	os_tid = 0xc28


Thread:
	id = 384
	os_tid = 0xc30


Thread:
	id = 385
	os_tid = 0xc34


Thread:
	id = 386
	os_tid = 0xc38


Thread:
	id = 391
	os_tid = 0xc4c


Thread:
	id = 392
	os_tid = 0xc50


Thread:
	id = 393
	os_tid = 0xc54


Thread:
	id = 394
	os_tid = 0xc58


Thread:
	id = 395
	os_tid = 0xc5c


Thread:
	id = 396
	os_tid = 0xc60


Thread:
	id = 397
	os_tid = 0xc64


Thread:
	id = 398
	os_tid = 0xc68


Thread:
	id = 399
	os_tid = 0xc6c


Thread:
	id = 400
	os_tid = 0xc70


Thread:
	id = 401
	os_tid = 0xc74


Thread:
	id = 402
	os_tid = 0xc78


Thread:
	id = 403
	os_tid = 0xc7c


Thread:
	id = 404
	os_tid = 0xc80


Thread:
	id = 405
	os_tid = 0xc84


Thread:
	id = 407
	os_tid = 0xc8c


Thread:
	id = 408
	os_tid = 0xc90


Process:
	id = "17"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x3edc4000"
	os_pid = "0xca8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:79910"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5057
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5058
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5059
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 5060
	        start_va = 0x50000
	          end_va = 0x8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 5061
	        start_va = 0x90000
	          end_va = 0x93fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000090000"
	        filename = ""

Region:
	              id = 5062
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 5063
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 5064
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5065
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5066
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 5067
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 5068
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 5069
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 5070
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 5071
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5072
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5073
	        start_va = 0xe0000
	          end_va = 0x15ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5074
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5075
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5076
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5077
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5078
	        start_va = 0x160000
	          end_va = 0x1c6fff
	     entry_point = 0x160000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5079
	        start_va = 0x370000
	          end_va = 0x46ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000370000"
	        filename = ""

Region:
	              id = 5080
	        start_va = 0x5d0000
	          end_va = 0x5dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 5081
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5082
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5083
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 5084
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5085
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5086
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 5087
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5088
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5089
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 5090
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5091
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5092
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5093
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 5094
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5095
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 5096
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 5097
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5098
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 5099
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 5100
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5101
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5102
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 5103
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 5104
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 5105
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 5106
	        start_va = 0x5e0000
	          end_va = 0x767fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005e0000"
	        filename = ""

Region:
	              id = 5107
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 5108
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5109
	        start_va = 0x20000
	          end_va = 0x26fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 5110
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5111
	        start_va = 0xa0000
	          end_va = 0xa1fff
	     entry_point = 0xa0000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 5112
	        start_va = 0xb0000
	          end_va = 0xb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 5113
	        start_va = 0xc0000
	          end_va = 0xc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 5114
	        start_va = 0x770000
	          end_va = 0x8f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""

Region:
	              id = 5115
	        start_va = 0x900000
	          end_va = 0xbcefff
	     entry_point = 0x900000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5116
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 5117
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 5118
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 5119
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 5120
	        start_va = 0xd0000
	          end_va = 0xd0fff
	     entry_point = 0xd0000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 5121
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5122
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 5123
	        start_va = 0x1f0000
	          end_va = 0x1f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 5124
	        start_va = 0x200000
	          end_va = 0x200fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5125
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 5126
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 5127
	        start_va = 0x210000
	          end_va = 0x210fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000210000"
	        filename = ""

Region:
	              id = 5128
	        start_va = 0x220000
	          end_va = 0x221fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 5129
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 5130
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 5131
	        start_va = 0x510000
	          end_va = 0x54ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 5132
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 5133
	        start_va = 0x330000
	          end_va = 0x330fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000330000"
	        filename = ""

Region:
	              id = 5134
	        start_va = 0x340000
	          end_va = 0x341fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000340000"
	        filename = ""

Region:
	              id = 5135
	        start_va = 0x350000
	          end_va = 0x351fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000350000"
	        filename = ""

Region:
	              id = 5136
	        start_va = 0x470000
	          end_va = 0x4ddfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000470000"
	        filename = ""

Region:
	              id = 5137
	        start_va = 0x570000
	          end_va = 0x5affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 5138
	        start_va = 0xbd0000
	          end_va = 0xcaefff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000bd0000"
	        filename = ""

Region:
	              id = 5139
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 5140
	        start_va = 0xf80000
	          end_va = 0x107ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f80000"
	        filename = ""

Region:
	              id = 5141
	        start_va = 0x1110000
	          end_va = 0x120ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001110000"
	        filename = ""

Region:
	              id = 5142
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 5143
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 5144
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 5145
	        start_va = 0xcb0000
	          end_va = 0xdaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000cb0000"
	        filename = ""

Region:
	              id = 5146
	        start_va = 0xe80000
	          end_va = 0xebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 5147
	        start_va = 0x1220000
	          end_va = 0x125ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001220000"
	        filename = ""

Region:
	              id = 5148
	        start_va = 0x2790000
	          end_va = 0x27cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002790000"
	        filename = ""

Region:
	              id = 5149
	        start_va = 0x2920000
	          end_va = 0x2a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002920000"
	        filename = ""

Region:
	              id = 5150
	        start_va = 0x2b40000
	          end_va = 0x2d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b40000"
	        filename = ""

Region:
	              id = 5151
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 5152
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 5153
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 5154
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 5155
	        start_va = 0x70ec0000
	          end_va = 0x70ef2fff
	     entry_point = 0x70ec0000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 5156
	        start_va = 0x27d0000
	          end_va = 0x28cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027d0000"
	        filename = ""

Region:
	              id = 5157
	        start_va = 0x2a70000
	          end_va = 0x2aaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a70000"
	        filename = ""

Region:
	              id = 5158
	        start_va = 0x2e40000
	          end_va = 0x2f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e40000"
	        filename = ""

Region:
	              id = 5159
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 5160
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 5161
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 5162
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 5163
	        start_va = 0x360000
	          end_va = 0x360fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000360000"
	        filename = ""

Region:
	              id = 5164
	        start_va = 0x2f40000
	          end_va = 0x3332fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f40000"
	        filename = ""

Region:
	              id = 5165
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5166
	        start_va = 0x4e0000
	          end_va = 0x4e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004e0000"
	        filename = ""

Region:
	              id = 5167
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 5168
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 5169
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 5170
	        start_va = 0x500000
	          end_va = 0x500fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000500000"
	        filename = ""

Region:
	              id = 5171
	        start_va = 0x550000
	          end_va = 0x56efff
	     entry_point = 0x550000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 5172
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 5173
	        start_va = 0x4f0000
	          end_va = 0x4f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004f0000"
	        filename = ""

Region:
	              id = 5174
	        start_va = 0x2750000
	          end_va = 0x278ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 5175
	        start_va = 0x3390000
	          end_va = 0x348ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003390000"
	        filename = ""

Region:
	              id = 5176
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 5177
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 5178
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 5179
	        start_va = 0x5b0000
	          end_va = 0x5b1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 5180
	        start_va = 0x5c0000
	          end_va = 0x5c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005c0000"
	        filename = ""

Region:
	              id = 5181
	        start_va = 0xdb0000
	          end_va = 0xdc3fff
	     entry_point = 0xdb0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 5182
	        start_va = 0xdd0000
	          end_va = 0xdd7fff
	     entry_point = 0xdd0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 5183
	        start_va = 0xde0000
	          end_va = 0xdf3fff
	     entry_point = 0xde0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 5184
	        start_va = 0xf40000
	          end_va = 0xf7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f40000"
	        filename = ""

Region:
	              id = 5185
	        start_va = 0x35a0000
	          end_va = 0x369ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035a0000"
	        filename = ""

Region:
	              id = 5186
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 5187
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5188
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 5189
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 5190
	        start_va = 0x3850000
	          end_va = 0x388ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003850000"
	        filename = ""

Region:
	              id = 5191
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 5192
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 5193
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 5194
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5195
	        start_va = 0x3890000
	          end_va = 0x3bd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003890000"
	        filename = ""

Region:
	              id = 5196
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 5197
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 5198
	        start_va = 0x2dd0000
	          end_va = 0x2ddffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002dd0000"
	        filename = ""

Region:
	              id = 5199
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 5200
	        start_va = 0xe00000
	          end_va = 0xe00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000e00000"
	        filename = ""

Region:
	              id = 5201
	        start_va = 0xec0000
	          end_va = 0xec1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 5202
	        start_va = 0x37a0000
	          end_va = 0x37dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000037a0000"
	        filename = ""

Region:
	              id = 5203
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 5204
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 5205
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 5206
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 5207
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 5208
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 5209
	        start_va = 0x3550000
	          end_va = 0x358ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003550000"
	        filename = ""

Region:
	              id = 5210
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 5211
	        start_va = 0xe10000
	          end_va = 0xe10fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000e10000"
	        filename = ""

Region:
	              id = 5212
	        start_va = 0xe60000
	          end_va = 0xe7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 5213
	        start_va = 0x3be0000
	          end_va = 0x450ffff
	     entry_point = 0x3be0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 5214
	        start_va = 0x46a0000
	          end_va = 0x46affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046a0000"
	        filename = ""

Region:
	              id = 5215
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 5216
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 5217
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 5218
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 5219
	        start_va = 0xed0000
	          end_va = 0xed0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ed0000"
	        filename = ""

Region:
	              id = 5220
	        start_va = 0xee0000
	          end_va = 0xee2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ee0000"
	        filename = ""

Region:
	              id = 5221
	        start_va = 0x10d0000
	          end_va = 0x10dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010d0000"
	        filename = ""

Region:
	              id = 5222
	        start_va = 0x4680000
	          end_va = 0x468ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004680000"
	        filename = ""

Region:
	              id = 5223
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 5224
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 5225
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 5226
	        start_va = 0xef0000
	          end_va = 0xef3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ef0000"
	        filename = ""

Region:
	              id = 5227
	        start_va = 0xf00000
	          end_va = 0xf17fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f00000"
	        filename = ""

Region:
	              id = 5228
	        start_va = 0xf20000
	          end_va = 0xf2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f20000"
	        filename = ""

Region:
	              id = 5229
	        start_va = 0xf30000
	          end_va = 0xf30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f30000"
	        filename = ""

Region:
	              id = 5230
	        start_va = 0x1080000
	          end_va = 0x108ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001080000"
	        filename = ""

Region:
	              id = 5231
	        start_va = 0x1090000
	          end_va = 0x109ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 5232
	        start_va = 0x10a0000
	          end_va = 0x10affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 5233
	        start_va = 0x10b0000
	          end_va = 0x10bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010b0000"
	        filename = ""

Region:
	              id = 5234
	        start_va = 0x10c0000
	          end_va = 0x10cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010c0000"
	        filename = ""

Region:
	              id = 5235
	        start_va = 0x10e0000
	          end_va = 0x10effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010e0000"
	        filename = ""

Region:
	              id = 5236
	        start_va = 0x10f0000
	          end_va = 0x10fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010f0000"
	        filename = ""

Region:
	              id = 5237
	        start_va = 0x2ad0000
	          end_va = 0x2b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ad0000"
	        filename = ""

Region:
	              id = 5238
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 5239
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 5240
	        start_va = 0x1100000
	          end_va = 0x110ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001100000"
	        filename = ""

Region:
	              id = 5241
	        start_va = 0x1210000
	          end_va = 0x121ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001210000"
	        filename = ""

Region:
	              id = 5242
	        start_va = 0x1260000
	          end_va = 0x126ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001260000"
	        filename = ""

Region:
	              id = 5243
	        start_va = 0x1270000
	          end_va = 0x1270fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001270000"
	        filename = ""

Region:
	              id = 5244
	        start_va = 0x1280000
	          end_va = 0x1280fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 5245
	        start_va = 0x34c0000
	          end_va = 0x34fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034c0000"
	        filename = ""

Region:
	              id = 5246
	        start_va = 0x3760000
	          end_va = 0x379ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003760000"
	        filename = ""

Region:
	              id = 5247
	        start_va = 0x46f0000
	          end_va = 0x47effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046f0000"
	        filename = ""

Region:
	              id = 5248
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 5249
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 5250
	        start_va = 0x2740000
	          end_va = 0x2740fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002740000"
	        filename = ""

Region:
	              id = 5251
	        start_va = 0x28d0000
	          end_va = 0x28dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028d0000"
	        filename = ""

Region:
	              id = 5252
	        start_va = 0x28e0000
	          end_va = 0x28e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000028e0000"
	        filename = ""

Region:
	              id = 5253
	        start_va = 0x28f0000
	          end_va = 0x28f2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000028f0000"
	        filename = ""

Region:
	              id = 5254
	        start_va = 0x2d60000
	          end_va = 0x2d9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d60000"
	        filename = ""

Region:
	              id = 5255
	        start_va = 0x2de0000
	          end_va = 0x2e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002de0000"
	        filename = ""

Region:
	              id = 5256
	        start_va = 0x4510000
	          end_va = 0x454ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004510000"
	        filename = ""

Region:
	              id = 5257
	        start_va = 0x4570000
	          end_va = 0x466ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004570000"
	        filename = ""

Region:
	              id = 5258
	        start_va = 0x48e0000
	          end_va = 0x48effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048e0000"
	        filename = ""

Region:
	              id = 5259
	        start_va = 0x4930000
	          end_va = 0x4a2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004930000"
	        filename = ""

Region:
	              id = 5260
	        start_va = 0x4b40000
	          end_va = 0x4c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b40000"
	        filename = ""

Region:
	              id = 5261
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 5262
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 5263
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 5264
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 5265
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 5266
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 5267
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 5268
	        start_va = 0x2900000
	          end_va = 0x2903fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002900000"
	        filename = ""

Region:
	              id = 5269
	        start_va = 0x2910000
	          end_va = 0x291ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002910000"
	        filename = ""

Region:
	              id = 5270
	        start_va = 0x2a20000
	          end_va = 0x2a37fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a20000"
	        filename = ""

Region:
	              id = 5271
	        start_va = 0x2a40000
	          end_va = 0x2a40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a40000"
	        filename = ""

Region:
	              id = 5272
	        start_va = 0x2a50000
	          end_va = 0x2a5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a50000"
	        filename = ""

Region:
	              id = 5273
	        start_va = 0x2a60000
	          end_va = 0x2a6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a60000"
	        filename = ""

Region:
	              id = 5274
	        start_va = 0x2ab0000
	          end_va = 0x2abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ab0000"
	        filename = ""

Region:
	              id = 5275
	        start_va = 0x2ac0000
	          end_va = 0x2acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ac0000"
	        filename = ""

Region:
	              id = 5276
	        start_va = 0x2b10000
	          end_va = 0x2b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b10000"
	        filename = ""

Region:
	              id = 5277
	        start_va = 0x2b20000
	          end_va = 0x2b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b20000"
	        filename = ""

Region:
	              id = 5278
	        start_va = 0x2b30000
	          end_va = 0x2b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b30000"
	        filename = ""

Region:
	              id = 5279
	        start_va = 0x2d40000
	          end_va = 0x2d41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002d40000"
	        filename = ""

Region:
	              id = 5280
	        start_va = 0x4dc0000
	          end_va = 0x4dcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004dc0000"
	        filename = ""

Region:
	              id = 5281
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 5282
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 5283
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 5284
	        start_va = 0x2d50000
	          end_va = 0x2d57fff
	     entry_point = 0x2d50000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 5285
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 5286
	        start_va = 0x2da0000
	          end_va = 0x2dacfff
	     entry_point = 0x2da0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 5287
	        start_va = 0x2db0000
	          end_va = 0x2dc1fff
	     entry_point = 0x2db0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 5288
	        start_va = 0x2e20000
	          end_va = 0x2e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e20000"
	        filename = ""

Region:
	              id = 5289
	        start_va = 0x2e30000
	          end_va = 0x2e30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e30000"
	        filename = ""

Region:
	              id = 5290
	        start_va = 0x3340000
	          end_va = 0x3340fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003340000"
	        filename = ""

Region:
	              id = 5291
	        start_va = 0x3350000
	          end_va = 0x3350fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003350000"
	        filename = ""

Region:
	              id = 5292
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 5293
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 5294
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 5295
	        start_va = 0x3360000
	          end_va = 0x3360fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003360000"
	        filename = ""

Region:
	              id = 5296
	        start_va = 0x3500000
	          end_va = 0x353ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003500000"
	        filename = ""

Region:
	              id = 5297
	        start_va = 0x4e60000
	          end_va = 0x4f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e60000"
	        filename = ""

Region:
	              id = 5298
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 5299
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 5300
	        start_va = 0x3720000
	          end_va = 0x375ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003720000"
	        filename = ""

Region:
	              id = 5301
	        start_va = 0x48f0000
	          end_va = 0x492ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048f0000"
	        filename = ""

Region:
	              id = 5302
	        start_va = 0x4a60000
	          end_va = 0x4a9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a60000"
	        filename = ""

Region:
	              id = 5303
	        start_va = 0x4d80000
	          end_va = 0x4d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d80000"
	        filename = ""

Region:
	              id = 5304
	        start_va = 0x5070000
	          end_va = 0x516ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005070000"
	        filename = ""

Region:
	              id = 5305
	        start_va = 0x5260000
	          end_va = 0x535ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005260000"
	        filename = ""

Region:
	              id = 5306
	        start_va = 0x5490000
	          end_va = 0x558ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005490000"
	        filename = ""

Region:
	              id = 5307
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 5308
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 5309
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 5310
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 5311
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 5312
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 5313
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 5314
	        start_va = 0x3370000
	          end_va = 0x3370fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003370000"
	        filename = ""

Region:
	              id = 5315
	        start_va = 0x36a0000
	          end_va = 0x371ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036a0000"
	        filename = ""

Region:
	              id = 5316
	        start_va = 0x4c40000
	          end_va = 0x4d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c40000"
	        filename = ""

Region:
	              id = 5317
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 5318
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 5319
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 5320
	        start_va = 0x3380000
	          end_va = 0x3383fff
	     entry_point = 0x3380000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 5321
	        start_va = 0x37e0000
	          end_va = 0x383cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000037e0000"
	        filename = ""

Region:
	              id = 5322
	        start_va = 0x4840000
	          end_va = 0x487ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004840000"
	        filename = ""

Region:
	              id = 5323
	        start_va = 0x56b0000
	          end_va = 0x57affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000056b0000"
	        filename = ""

Region:
	              id = 5324
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 5325
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 5326
	        start_va = 0x3490000
	          end_va = 0x3490fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003490000"
	        filename = ""

Region:
	              id = 5327
	        start_va = 0x34a0000
	          end_va = 0x34a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034a0000"
	        filename = ""

Region:
	              id = 5328
	        start_va = 0x34b0000
	          end_va = 0x34b0fff
	     entry_point = 0x34b0000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 5329
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5330
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 5331
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5334
	        start_va = 0x4f60000
	          end_va = 0x505ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f60000"
	        filename = ""

Region:
	              id = 5335
	        start_va = 0x57b0000
	          end_va = 0x59affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057b0000"
	        filename = ""

Region:
	              id = 5336
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 5337
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 5338
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 5339
	        start_va = 0x3540000
	          end_va = 0x3540fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003540000"
	        filename = ""

Region:
	              id = 5340
	        start_va = 0x3590000
	          end_va = 0x3590fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003590000"
	        filename = ""

Region:
	              id = 5341
	        start_va = 0x3840000
	          end_va = 0x3847fff
	     entry_point = 0x3840000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 5342
	        start_va = 0x4550000
	          end_va = 0x4551fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004550000"
	        filename = ""

Region:
	              id = 5343
	        start_va = 0x46b0000
	          end_va = 0x46c0fff
	     entry_point = 0x46b0000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 5344
	        start_va = 0x4b00000
	          end_va = 0x4b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b00000"
	        filename = ""

Region:
	              id = 5345
	        start_va = 0x51d0000
	          end_va = 0x520ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051d0000"
	        filename = ""

Region:
	              id = 5346
	        start_va = 0x53e0000
	          end_va = 0x541ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000053e0000"
	        filename = ""

Region:
	              id = 5347
	        start_va = 0x5590000
	          end_va = 0x568ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005590000"
	        filename = ""

Region:
	              id = 5348
	        start_va = 0x5a80000
	          end_va = 0x5b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a80000"
	        filename = ""

Region:
	              id = 5349
	        start_va = 0x5bb0000
	          end_va = 0x5caffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005bb0000"
	        filename = ""

Region:
	              id = 5350
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 5351
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 5352
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 5353
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 5354
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 5355
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 5356
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 5357
	        start_va = 0x4560000
	          end_va = 0x4561fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004560000"
	        filename = ""

Region:
	              id = 5358
	        start_va = 0x4670000
	          end_va = 0x4673fff
	     entry_point = 0x4670000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 5359
	        start_va = 0x4690000
	          end_va = 0x4690fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004690000"
	        filename = ""

Region:
	              id = 5360
	        start_va = 0x46d0000
	          end_va = 0x46d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000046d0000"
	        filename = ""

Region:
	              id = 5361
	        start_va = 0x4880000
	          end_va = 0x48bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004880000"
	        filename = ""

Region:
	              id = 5362
	        start_va = 0x5a40000
	          end_va = 0x5a4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a40000"
	        filename = ""

Region:
	              id = 5363
	        start_va = 0x5cb0000
	          end_va = 0x60affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005cb0000"
	        filename = ""

Region:
	              id = 5364
	        start_va = 0x60b0000
	          end_va = 0x6147fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000060b0000"
	        filename = ""

Region:
	              id = 5365
	        start_va = 0x61f0000
	          end_va = 0x63effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000061f0000"
	        filename = ""

Region:
	              id = 5366
	        start_va = 0x63f0000
	          end_va = 0x67effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000063f0000"
	        filename = ""

Region:
	              id = 5367
	        start_va = 0x67f0000
	          end_va = 0x6931fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000067f0000"
	        filename = ""

Region:
	              id = 5368
	        start_va = 0x6940000
	          end_va = 0x713ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006940000"
	        filename = ""

Region:
	              id = 5369
	        start_va = 0x7140000
	          end_va = 0x71e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007140000"
	        filename = ""

Region:
	              id = 5370
	        start_va = 0x72a0000
	          end_va = 0x73b4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000072a0000"
	        filename = ""

Region:
	              id = 5371
	        start_va = 0x7500000
	          end_va = 0x75fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007500000"
	        filename = ""

Region:
	              id = 5372
	        start_va = 0x7710000
	          end_va = 0x780ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007710000"
	        filename = ""

Region:
	              id = 5373
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 5374
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 5375
	        start_va = 0x7ef77000
	          end_va = 0x7ef79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef77000"
	        filename = ""

Region:
	              id = 5376
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 5377
	        start_va = 0x47f0000
	          end_va = 0x4837fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000047f0000"
	        filename = ""

Region:
	              id = 5378
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 413
	os_tid = 0xcac


Thread:
	id = 414
	os_tid = 0xcb0


Thread:
	id = 415
	os_tid = 0xcb4


Thread:
	id = 416
	os_tid = 0xcb8


Thread:
	id = 417
	os_tid = 0xcbc


Thread:
	id = 418
	os_tid = 0xcc0


Thread:
	id = 419
	os_tid = 0xcc4


Thread:
	id = 420
	os_tid = 0xcc8


Thread:
	id = 421
	os_tid = 0xccc


Thread:
	id = 422
	os_tid = 0xcd0


Thread:
	id = 423
	os_tid = 0xcd4


Thread:
	id = 424
	os_tid = 0xcd8


Thread:
	id = 425
	os_tid = 0xcdc


Thread:
	id = 426
	os_tid = 0xce0


Thread:
	id = 427
	os_tid = 0xce8


Thread:
	id = 428
	os_tid = 0xcec


Thread:
	id = 429
	os_tid = 0xcf0


Thread:
	id = 430
	os_tid = 0xcf4


Thread:
	id = 432
	os_tid = 0xcfc


Thread:
	id = 433
	os_tid = 0xd00


Thread:
	id = 434
	os_tid = 0xd04


Thread:
	id = 435
	os_tid = 0xd08


Thread:
	id = 436
	os_tid = 0xd0c


Thread:
	id = 437
	os_tid = 0xd10


Thread:
	id = 439
	os_tid = 0xd1c


Process:
	id = "18"
	image_name = "iexplore.exe"
	filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe"
	page_root = "0x15d2a000"
	os_pid = "0xd44"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x5e8"
	cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1512 CREDAT:79920"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5391
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5392
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5393
	        start_va = 0x40000
	          end_va = 0x40fff
	     entry_point = 0x40000
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 5394
	        start_va = 0x50000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 5395
	        start_va = 0x230000
	          end_va = 0x26ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 5396
	        start_va = 0x2a0000
	          end_va = 0x39ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 5397
	        start_va = 0x1290000
	          end_va = 0x1335fff
	     entry_point = 0x1290000
	     region_type = mapped_file
	            name = "iexplore.exe"
	        filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")

Region:
	              id = 5398
	        start_va = 0x77670000
	          end_va = 0x77818fff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5399
	        start_va = 0x77850000
	          end_va = 0x779cffff
	     entry_point = 0x77850000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5400
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 5401
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 5402
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 5403
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 5404
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 5405
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5406
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5407
	        start_va = 0x550000
	          end_va = 0x5cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 5408
	        start_va = 0x74d90000
	          end_va = 0x74d97fff
	     entry_point = 0x74d90000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5409
	        start_va = 0x74da0000
	          end_va = 0x74dfbfff
	     entry_point = 0x74da0000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5410
	        start_va = 0x74e00000
	          end_va = 0x74e3efff
	     entry_point = 0x74e00000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5411
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5412
	        start_va = 0x20000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5413
	        start_va = 0x60000
	          end_va = 0xc6fff
	     entry_point = 0x60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5414
	        start_va = 0x780000
	          end_va = 0x87ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000780000"
	        filename = ""

Region:
	              id = 5415
	        start_va = 0x753a0000
	          end_va = 0x753abfff
	     entry_point = 0x753a0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5416
	        start_va = 0x753b0000
	          end_va = 0x7540ffff
	     entry_point = 0x753b0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5417
	        start_va = 0x75410000
	          end_va = 0x754acfff
	     entry_point = 0x75410000
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 5418
	        start_va = 0x75540000
	          end_va = 0x7569bfff
	     entry_point = 0x75540000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5419
	        start_va = 0x756f0000
	          end_va = 0x757effff
	     entry_point = 0x756f0000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5420
	        start_va = 0x757f0000
	          end_va = 0x759eafff
	     entry_point = 0x757f0000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 5421
	        start_va = 0x75a20000
	          end_va = 0x75b2ffff
	     entry_point = 0x75a20000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5422
	        start_va = 0x75b30000
	          end_va = 0x75bcffff
	     entry_point = 0x75b30000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5423
	        start_va = 0x75be0000
	          end_va = 0x75cd4fff
	     entry_point = 0x75be0000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 5424
	        start_va = 0x75ce0000
	          end_va = 0x75d36fff
	     entry_point = 0x75ce0000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5425
	        start_va = 0x75e30000
	          end_va = 0x75edbfff
	     entry_point = 0x75e30000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5426
	        start_va = 0x75f60000
	          end_va = 0x75feefff
	     entry_point = 0x75f60000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5427
	        start_va = 0x76190000
	          end_va = 0x762acfff
	     entry_point = 0x76190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 5428
	        start_va = 0x762b0000
	          end_va = 0x762c8fff
	     entry_point = 0x762b0000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5429
	        start_va = 0x762d0000
	          end_va = 0x762d9fff
	     entry_point = 0x762d0000
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 5430
	        start_va = 0x762e0000
	          end_va = 0x76415fff
	     entry_point = 0x762e0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 5431
	        start_va = 0x765f0000
	          end_va = 0x76635fff
	     entry_point = 0x765f0000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5432
	        start_va = 0x76670000
	          end_va = 0x772b9fff
	     entry_point = 0x76670000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 5433
	        start_va = 0x772c0000
	          end_va = 0x772cbfff
	     entry_point = 0x772c0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 5434
	        start_va = 0x772d0000
	          end_va = 0x773bffff
	     entry_point = 0x772d0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5435
	        start_va = 0x773c0000
	          end_va = 0x7744ffff
	     entry_point = 0x773c0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5436
	        start_va = 0x77450000
	          end_va = 0x77549fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077450000"
	        filename = ""

Region:
	              id = 5437
	        start_va = 0x77550000
	          end_va = 0x7766efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000077550000"
	        filename = ""

Region:
	              id = 5438
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 5439
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 5440
	        start_va = 0x3a0000
	          end_va = 0x527fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003a0000"
	        filename = ""

Region:
	              id = 5441
	        start_va = 0x75d40000
	          end_va = 0x75e0bfff
	     entry_point = 0x75d40000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 5442
	        start_va = 0x76500000
	          end_va = 0x7655ffff
	     entry_point = 0x76500000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5443
	        start_va = 0x30000
	          end_va = 0x36fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5444
	        start_va = 0xd0000
	          end_va = 0xd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 5445
	        start_va = 0xe0000
	          end_va = 0xe1fff
	     entry_point = 0xe0000
	     region_type = mapped_file
	            name = "iexplore.exe.mui"
	        filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui")

Region:
	              id = 5446
	        start_va = 0xf0000
	          end_va = 0xf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5447
	        start_va = 0x100000
	          end_va = 0x100fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 5448
	        start_va = 0x5d0000
	          end_va = 0x750fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005d0000"
	        filename = ""

Region:
	              id = 5449
	        start_va = 0x880000
	          end_va = 0xb4efff
	     entry_point = 0x880000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5450
	        start_va = 0x1340000
	          end_va = 0x273ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001340000"
	        filename = ""

Region:
	              id = 5451
	        start_va = 0x72cb0000
	          end_va = 0x7372ffff
	     entry_point = 0x72cb0000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 5452
	        start_va = 0x750c0000
	          end_va = 0x750fbfff
	     entry_point = 0x750c0000
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 5453
	        start_va = 0x76420000
	          end_va = 0x76424fff
	     entry_point = 0x76420000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 5454
	        start_va = 0x110000
	          end_va = 0x110fff
	     entry_point = 0x110000
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 5455
	        start_va = 0x120000
	          end_va = 0x121fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000120000"
	        filename = ""

Region:
	              id = 5456
	        start_va = 0x130000
	          end_va = 0x130fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000130000"
	        filename = ""

Region:
	              id = 5457
	        start_va = 0x140000
	          end_va = 0x141fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000140000"
	        filename = ""

Region:
	              id = 5458
	        start_va = 0x150000
	          end_va = 0x150fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 5459
	        start_va = 0x74f20000
	          end_va = 0x750bdfff
	     entry_point = 0x74f20000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 5460
	        start_va = 0x75ee0000
	          end_va = 0x75f5afff
	     entry_point = 0x75ee0000
	     region_type = mapped_file
	            name = "comdlg32.dll"
	        filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll")

Region:
	              id = 5461
	        start_va = 0x160000
	          end_va = 0x160fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000160000"
	        filename = ""

Region:
	              id = 5462
	        start_va = 0x170000
	          end_va = 0x171fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 5463
	        start_va = 0x5fff0000
	          end_va = 0x5fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000005fff0000"
	        filename = ""

Region:
	              id = 5464
	        start_va = 0x74640000
	          end_va = 0x74674fff
	     entry_point = 0x74640000
	     region_type = mapped_file
	            name = "ieshims.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll")

Region:
	              id = 5465
	        start_va = 0x1e0000
	          end_va = 0x21ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 5466
	        start_va = 0x74d00000
	          end_va = 0x74d7ffff
	     entry_point = 0x74d00000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 5467
	        start_va = 0x180000
	          end_va = 0x180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 5468
	        start_va = 0x190000
	          end_va = 0x191fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 5469
	        start_va = 0x1a0000
	          end_va = 0x1a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5470
	        start_va = 0xb50000
	          end_va = 0xc2efff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b50000"
	        filename = ""

Region:
	              id = 5471
	        start_va = 0xc30000
	          end_va = 0xc9dfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c30000"
	        filename = ""

Region:
	              id = 5472
	        start_va = 0xca0000
	          end_va = 0xcdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ca0000"
	        filename = ""

Region:
	              id = 5473
	        start_va = 0xe80000
	          end_va = 0xebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 5474
	        start_va = 0xec0000
	          end_va = 0xfbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 5475
	        start_va = 0x10f0000
	          end_va = 0x11effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010f0000"
	        filename = ""

Region:
	              id = 5476
	        start_va = 0x74c60000
	          end_va = 0x74c6dfff
	     entry_point = 0x74c60000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 5477
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 5478
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 5479
	        start_va = 0xdc0000
	          end_va = 0xdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 5480
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 5481
	        start_va = 0x10a0000
	          end_va = 0x10dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 5482
	        start_va = 0x2750000
	          end_va = 0x284ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002750000"
	        filename = ""

Region:
	              id = 5483
	        start_va = 0x2930000
	          end_va = 0x2a2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002930000"
	        filename = ""

Region:
	              id = 5484
	        start_va = 0x2a30000
	          end_va = 0x2c2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a30000"
	        filename = ""

Region:
	              id = 5485
	        start_va = 0x74ce0000
	          end_va = 0x74cf2fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 5486
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 5487
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 5488
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 5489
	        start_va = 0x70e80000
	          end_va = 0x70eb2fff
	     entry_point = 0x70e80000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll")

Region:
	              id = 5490
	        start_va = 0x1060000
	          end_va = 0x109ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001060000"
	        filename = ""

Region:
	              id = 5491
	        start_va = 0x2c30000
	          end_va = 0x2d2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c30000"
	        filename = ""

Region:
	              id = 5492
	        start_va = 0x2e30000
	          end_va = 0x2f2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e30000"
	        filename = ""

Region:
	              id = 5493
	        start_va = 0x75e10000
	          end_va = 0x75e21fff
	     entry_point = 0x75e10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 5494
	        start_va = 0x75ff0000
	          end_va = 0x7618cfff
	     entry_point = 0x75ff0000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 5495
	        start_va = 0x76640000
	          end_va = 0x76666fff
	     entry_point = 0x76640000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 5496
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 5497
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 5498
	        start_va = 0x2f30000
	          end_va = 0x3322fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f30000"
	        filename = ""

Region:
	              id = 5499
	        start_va = 0x754b0000
	          end_va = 0x75532fff
	     entry_point = 0x754b0000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5500
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5501
	        start_va = 0x74720000
	          end_va = 0x74814fff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 5502
	        start_va = 0x75100000
	          end_va = 0x75120fff
	     entry_point = 0x75100000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 5503
	        start_va = 0x756a0000
	          end_va = 0x756e4fff
	     entry_point = 0x756a0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 5504
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000220000"
	        filename = ""

Region:
	              id = 5505
	        start_va = 0x270000
	          end_va = 0x28efff
	     entry_point = 0x270000
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")

Region:
	              id = 5506
	        start_va = 0x75130000
	          end_va = 0x7513afff
	     entry_point = 0x75130000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 5507
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5508
	        start_va = 0x74c70000
	          end_va = 0x74caafff
	     entry_point = 0x74c70000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 5509
	        start_va = 0x74cb0000
	          end_va = 0x74cc5fff
	     entry_point = 0x74cb0000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 5512
	        start_va = 0x290000
	          end_va = 0x291fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 5513
	        start_va = 0x530000
	          end_va = 0x531fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000530000"
	        filename = ""

Region:
	              id = 5514
	        start_va = 0x540000
	          end_va = 0x547fff
	     entry_point = 0x540000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")

Region:
	              id = 5515
	        start_va = 0x760000
	          end_va = 0x773fff
	     entry_point = 0x760000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")

Region:
	              id = 5516
	        start_va = 0xce0000
	          end_va = 0xcf3fff
	     entry_point = 0xce0000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")

Region:
	              id = 5517
	        start_va = 0xd00000
	          end_va = 0xd3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d00000"
	        filename = ""

Region:
	              id = 5518
	        start_va = 0xfc0000
	          end_va = 0xffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fc0000"
	        filename = ""

Region:
	              id = 5519
	        start_va = 0x33e0000
	          end_va = 0x34dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033e0000"
	        filename = ""

Region:
	              id = 5520
	        start_va = 0x3690000
	          end_va = 0x378ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003690000"
	        filename = ""

Region:
	              id = 5521
	        start_va = 0x74ab0000
	          end_va = 0x74adafff
	     entry_point = 0x74ab0000
	     region_type = mapped_file
	            name = "ieproxy.dll"
	        filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll")

Region:
	              id = 5522
	        start_va = 0x764c0000
	          end_va = 0x764f4fff
	     entry_point = 0x764c0000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5523
	        start_va = 0x77820000
	          end_va = 0x77825fff
	     entry_point = 0x77820000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 5524
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 5525
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 5526
	        start_va = 0x35b0000
	          end_va = 0x35effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035b0000"
	        filename = ""

Region:
	              id = 5527
	        start_va = 0x74ea0000
	          end_va = 0x74ea6fff
	     entry_point = 0x74ea0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 5528
	        start_va = 0x74eb0000
	          end_va = 0x74ecbfff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 5529
	        start_va = 0x74ed0000
	          end_va = 0x74f13fff
	     entry_point = 0x74ed0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 5530
	        start_va = 0x74e90000
	          end_va = 0x74e98fff
	     entry_point = 0x74e90000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5531
	        start_va = 0x3790000
	          end_va = 0x3ad2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003790000"
	        filename = ""

Region:
	              id = 5532
	        start_va = 0x745e0000
	          end_va = 0x74639fff
	     entry_point = 0x745e0000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")

Region:
	              id = 5533
	        start_va = 0x74e40000
	          end_va = 0x74e4ffff
	     entry_point = 0x74e40000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 5534
	        start_va = 0x3be0000
	          end_va = 0x3beffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003be0000"
	        filename = ""

Region:
	              id = 5535
	        start_va = 0x745d0000
	          end_va = 0x745d7fff
	     entry_point = 0x745d0000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")

Region:
	              id = 5536
	        start_va = 0xd40000
	          end_va = 0xd40fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d40000"
	        filename = ""

Region:
	              id = 5537
	        start_va = 0xd80000
	          end_va = 0xd81fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d80000"
	        filename = ""

Region:
	              id = 5538
	        start_va = 0x28f0000
	          end_va = 0x292ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028f0000"
	        filename = ""

Region:
	              id = 5539
	        start_va = 0x74520000
	          end_va = 0x7456bfff
	     entry_point = 0x74520000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 5540
	        start_va = 0x74b50000
	          end_va = 0x74b8bfff
	     entry_point = 0x74b50000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 5541
	        start_va = 0x74b30000
	          end_va = 0x74b34fff
	     entry_point = 0x74b30000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 5542
	        start_va = 0x74b20000
	          end_va = 0x74b25fff
	     entry_point = 0x74b20000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 5543
	        start_va = 0x74cd0000
	          end_va = 0x74cd5fff
	     entry_point = 0x74cd0000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 5544
	        start_va = 0x74ae0000
	          end_va = 0x74b17fff
	     entry_point = 0x74ae0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 5545
	        start_va = 0x1250000
	          end_va = 0x128ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001250000"
	        filename = ""

Region:
	              id = 5546
	        start_va = 0x74570000
	          end_va = 0x7459dfff
	     entry_point = 0x74570000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")

Region:
	              id = 5547
	        start_va = 0xd50000
	          end_va = 0xd6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d50000"
	        filename = ""

Region:
	              id = 5548
	        start_va = 0xd70000
	          end_va = 0xd70fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d70000"
	        filename = ""

Region:
	              id = 5549
	        start_va = 0x3bf0000
	          end_va = 0x451ffff
	     entry_point = 0x3bf0000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 5550
	        start_va = 0x4620000
	          end_va = 0x462ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004620000"
	        filename = ""

Region:
	              id = 5551
	        start_va = 0x743c0000
	          end_va = 0x7444dfff
	     entry_point = 0x743c0000
	     region_type = mapped_file
	            name = "msvcp90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcp90.dll")

Region:
	              id = 5552
	        start_va = 0x74450000
	          end_va = 0x744f2fff
	     entry_point = 0x74450000
	     region_type = mapped_file
	            name = "msvcr90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll")

Region:
	              id = 5553
	        start_va = 0x74500000
	          end_va = 0x74510fff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "acroiehelpershim.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelpershim.dll")

Region:
	              id = 5554
	        start_va = 0x75140000
	          end_va = 0x751c3fff
	     entry_point = 0x75140000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 5555
	        start_va = 0xd90000
	          end_va = 0xd90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d90000"
	        filename = ""

Region:
	              id = 5556
	        start_va = 0xda0000
	          end_va = 0xda2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000da0000"
	        filename = ""

Region:
	              id = 5557
	        start_va = 0x4750000
	          end_va = 0x475ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004750000"
	        filename = ""

Region:
	              id = 5558
	        start_va = 0x4920000
	          end_va = 0x492ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004920000"
	        filename = ""

Region:
	              id = 5559
	        start_va = 0x73a20000
	          end_va = 0x73e28fff
	     entry_point = 0x73a20000
	     region_type = mapped_file
	            name = "grooveex.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll")

Region:
	              id = 5560
	        start_va = 0x74380000
	          end_va = 0x743aafff
	     entry_point = 0x74380000
	     region_type = mapped_file
	            name = "atl90.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\\atl90.dll")

Region:
	              id = 5561
	        start_va = 0x743b0000
	          end_va = 0x743bffff
	     entry_point = 0x743b0000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 5562
	        start_va = 0xdb0000
	          end_va = 0xdb3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 5563
	        start_va = 0xe40000
	          end_va = 0xe57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 5564
	        start_va = 0xe60000
	          end_va = 0xe6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 5565
	        start_va = 0xe70000
	          end_va = 0xe70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e70000"
	        filename = ""

Region:
	              id = 5566
	        start_va = 0x1000000
	          end_va = 0x100ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 5567
	        start_va = 0x1010000
	          end_va = 0x101ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 5568
	        start_va = 0x1020000
	          end_va = 0x102ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 5569
	        start_va = 0x1030000
	          end_va = 0x103ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001030000"
	        filename = ""

Region:
	              id = 5570
	        start_va = 0x1040000
	          end_va = 0x104ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001040000"
	        filename = ""

Region:
	              id = 5571
	        start_va = 0x1050000
	          end_va = 0x105ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001050000"
	        filename = ""

Region:
	              id = 5572
	        start_va = 0x10e0000
	          end_va = 0x10effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010e0000"
	        filename = ""

Region:
	              id = 5573
	        start_va = 0x2dd0000
	          end_va = 0x2e0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002dd0000"
	        filename = ""

Region:
	              id = 5574
	        start_va = 0x72440000
	          end_va = 0x72ca4fff
	     entry_point = 0x72440000
	     region_type = mapped_file
	            name = "grooveintlresource.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~2\\micros~1\\office14\\1033\\grooveintlresource.dll")

Region:
	              id = 5575
	        start_va = 0x742e0000
	          end_va = 0x74373fff
	     entry_point = 0x742e0000
	     region_type = mapped_file
	            name = "msftedit.dll"
	        filename = "\\Windows\\SysWOW64\\msftedit.dll" (normalized: "c:\\windows\\syswow64\\msftedit.dll")

Region:
	              id = 5576
	        start_va = 0x11f0000
	          end_va = 0x11fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011f0000"
	        filename = ""

Region:
	              id = 5577
	        start_va = 0x1200000
	          end_va = 0x120ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001200000"
	        filename = ""

Region:
	              id = 5578
	        start_va = 0x1210000
	          end_va = 0x121ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001210000"
	        filename = ""

Region:
	              id = 5579
	        start_va = 0x1220000
	          end_va = 0x1220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001220000"
	        filename = ""

Region:
	              id = 5580
	        start_va = 0x1230000
	          end_va = 0x1230fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001230000"
	        filename = ""

Region:
	              id = 5581
	        start_va = 0x3390000
	          end_va = 0x33cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003390000"
	        filename = ""

Region:
	              id = 5582
	        start_va = 0x3ae0000
	          end_va = 0x3bdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ae0000"
	        filename = ""

Region:
	              id = 5583
	        start_va = 0x4880000
	          end_va = 0x48bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004880000"
	        filename = ""

Region:
	              id = 5584
	        start_va = 0x72020000
	          end_va = 0x72439fff
	     entry_point = 0x72020000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~2\\common~1\\micros~1\\office14\\cultures\\office.odf")

Region:
	              id = 5585
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 5586
	        start_va = 0x1240000
	          end_va = 0x1240fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001240000"
	        filename = ""

Region:
	              id = 5587
	        start_va = 0x2740000
	          end_va = 0x274ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002740000"
	        filename = ""

Region:
	              id = 5588
	        start_va = 0x2850000
	          end_va = 0x2850fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002850000"
	        filename = ""

Region:
	              id = 5589
	        start_va = 0x2860000
	          end_va = 0x2862fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002860000"
	        filename = ""

Region:
	              id = 5590
	        start_va = 0x2890000
	          end_va = 0x28cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002890000"
	        filename = ""

Region:
	              id = 5591
	        start_va = 0x2d40000
	          end_va = 0x2d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d40000"
	        filename = ""

Region:
	              id = 5592
	        start_va = 0x4540000
	          end_va = 0x457ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004540000"
	        filename = ""

Region:
	              id = 5593
	        start_va = 0x4650000
	          end_va = 0x474ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004650000"
	        filename = ""

Region:
	              id = 5594
	        start_va = 0x4a00000
	          end_va = 0x4afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a00000"
	        filename = ""

Region:
	              id = 5595
	        start_va = 0x4c40000
	          end_va = 0x4d3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c40000"
	        filename = ""

Region:
	              id = 5596
	        start_va = 0x4eb0000
	          end_va = 0x4ebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004eb0000"
	        filename = ""

Region:
	              id = 5597
	        start_va = 0x74190000
	          end_va = 0x741a3fff
	     entry_point = 0x74190000
	     region_type = mapped_file
	            name = "msohev.dll"
	        filename = "\\PROGRA~2\\MICROS~1\\Office14\\MSOHEV.DLL" (normalized: "c:\\progra~2\\micros~1\\office14\\msohev.dll")

Region:
	              id = 5598
	        start_va = 0x741b0000
	          end_va = 0x741b7fff
	     entry_point = 0x741b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 5599
	        start_va = 0x741c0000
	          end_va = 0x74250fff
	     entry_point = 0x741c0000
	     region_type = mapped_file
	            name = "urlredir.dll"
	        filename = "\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll")

Region:
	              id = 5600
	        start_va = 0x74260000
	          end_va = 0x742d3fff
	     entry_point = 0x74260000
	     region_type = mapped_file
	            name = "ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssv.dll")

Region:
	              id = 5601
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 5602
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 5603
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 5604
	        start_va = 0x2870000
	          end_va = 0x2873fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002870000"
	        filename = ""

Region:
	              id = 5605
	        start_va = 0x2880000
	          end_va = 0x288ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002880000"
	        filename = ""

Region:
	              id = 5606
	        start_va = 0x28d0000
	          end_va = 0x28e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028d0000"
	        filename = ""

Region:
	              id = 5607
	        start_va = 0x2d30000
	          end_va = 0x2d30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d30000"
	        filename = ""

Region:
	              id = 5608
	        start_va = 0x2d80000
	          end_va = 0x2d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d80000"
	        filename = ""

Region:
	              id = 5609
	        start_va = 0x2d90000
	          end_va = 0x2d9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d90000"
	        filename = ""

Region:
	              id = 5610
	        start_va = 0x2da0000
	          end_va = 0x2daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002da0000"
	        filename = ""

Region:
	              id = 5611
	        start_va = 0x2db0000
	          end_va = 0x2dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002db0000"
	        filename = ""

Region:
	              id = 5612
	        start_va = 0x2dc0000
	          end_va = 0x2dcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002dc0000"
	        filename = ""

Region:
	              id = 5613
	        start_va = 0x2e10000
	          end_va = 0x2e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e10000"
	        filename = ""

Region:
	              id = 5614
	        start_va = 0x2e20000
	          end_va = 0x2e21fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002e20000"
	        filename = ""

Region:
	              id = 5615
	        start_va = 0x3560000
	          end_va = 0x356ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003560000"
	        filename = ""

Region:
	              id = 5616
	        start_va = 0x4c30000
	          end_va = 0x4c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c30000"
	        filename = ""

Region:
	              id = 5617
	        start_va = 0x718b0000
	          end_va = 0x7190afff
	     entry_point = 0x718b0000
	     region_type = mapped_file
	            name = "deploy.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\deploy.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\deploy.dll")

Region:
	              id = 5618
	        start_va = 0x740a0000
	          end_va = 0x7415efff
	     entry_point = 0x740a0000
	     region_type = mapped_file
	            name = "msvcr100.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\msvcr100.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\msvcr100.dll")

Region:
	              id = 5619
	        start_va = 0x74160000
	          end_va = 0x7418dfff
	     entry_point = 0x74160000
	     region_type = mapped_file
	            name = "jp2ssv.dll"
	        filename = "\\Program Files (x86)\\Java\\jre7\\bin\\jp2ssv.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2ssv.dll")

Region:
	              id = 5620
	        start_va = 0x3330000
	          end_va = 0x3337fff
	     entry_point = 0x3330000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")

Region:
	              id = 5621
	        start_va = 0x74040000
	          end_va = 0x7409efff
	     entry_point = 0x74040000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 5622
	        start_va = 0x3340000
	          end_va = 0x334cfff
	     entry_point = 0x3340000
	     region_type = mapped_file
	            name = "acroiehelper.dll"
	        filename = "\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acroiehelper.dll")

Region:
	              id = 5623
	        start_va = 0x3350000
	          end_va = 0x3361fff
	     entry_point = 0x3350000
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 5624
	        start_va = 0x3370000
	          end_va = 0x3370fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003370000"
	        filename = ""

Region:
	              id = 5625
	        start_va = 0x3380000
	          end_va = 0x3380fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003380000"
	        filename = ""

Region:
	              id = 5626
	        start_va = 0x33d0000
	          end_va = 0x33d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000033d0000"
	        filename = ""

Region:
	              id = 5627
	        start_va = 0x34e0000
	          end_va = 0x34e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034e0000"
	        filename = ""

Region:
	              id = 5628
	        start_va = 0x74c00000
	          end_va = 0x74c51fff
	     entry_point = 0x74c00000
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")

Region:
	              id = 5629
	        start_va = 0x74e70000
	          end_va = 0x74e84fff
	     entry_point = 0x74e70000
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")

Region:
	              id = 5630
	        start_va = 0x74e60000
	          end_va = 0x74e6cfff
	     entry_point = 0x74e60000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")

Region:
	              id = 5631
	        start_va = 0x34f0000
	          end_va = 0x34f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000034f0000"
	        filename = ""

Region:
	              id = 5632
	        start_va = 0x74e50000
	          end_va = 0x74e55fff
	     entry_point = 0x74e50000
	     region_type = mapped_file
	            name = "sensapi.dll"
	        filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll")

Region:
	              id = 5633
	        start_va = 0x4590000
	          end_va = 0x45cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004590000"
	        filename = ""

Region:
	              id = 5634
	        start_va = 0x4790000
	          end_va = 0x47cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004790000"
	        filename = ""

Region:
	              id = 5635
	        start_va = 0x4800000
	          end_va = 0x480ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004800000"
	        filename = ""

Region:
	              id = 5636
	        start_va = 0x4820000
	          end_va = 0x485ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004820000"
	        filename = ""

Region:
	              id = 5637
	        start_va = 0x48d0000
	          end_va = 0x490ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000048d0000"
	        filename = ""

Region:
	              id = 5638
	        start_va = 0x4d40000
	          end_va = 0x4e3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d40000"
	        filename = ""

Region:
	              id = 5639
	        start_va = 0x4ec0000
	          end_va = 0x4fbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ec0000"
	        filename = ""

Region:
	              id = 5640
	        start_va = 0x5060000
	          end_va = 0x515ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005060000"
	        filename = ""

Region:
	              id = 5641
	        start_va = 0x5250000
	          end_va = 0x534ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005250000"
	        filename = ""

Region:
	              id = 5642
	        start_va = 0x73a00000
	          end_va = 0x73a16fff
	     entry_point = 0x73a00000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 5643
	        start_va = 0x75bd0000
	          end_va = 0x75bd2fff
	     entry_point = 0x75bd0000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")

Region:
	              id = 5644
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 5645
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 5646
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 5647
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 5648
	        start_va = 0x739c0000
	          end_va = 0x739f9fff
	     entry_point = 0x739c0000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")

Region:
	              id = 5649
	        start_va = 0x759f0000
	          end_va = 0x75a1cfff
	     entry_point = 0x759f0000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 5650
	        start_va = 0x3500000
	          end_va = 0x3500fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003500000"
	        filename = ""

Region:
	              id = 5651
	        start_va = 0x35f0000
	          end_va = 0x366ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000035f0000"
	        filename = ""

Region:
	              id = 5652
	        start_va = 0x4b00000
	          end_va = 0x4bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b00000"
	        filename = ""

Region:
	              id = 5653
	        start_va = 0x74bb0000
	          end_va = 0x74bbffff
	     entry_point = 0x74bb0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 5654
	        start_va = 0x74b90000
	          end_va = 0x74ba1fff
	     entry_point = 0x74b90000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 5655
	        start_va = 0x74b40000
	          end_va = 0x74b47fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 5656
	        start_va = 0x3510000
	          end_va = 0x3513fff
	     entry_point = 0x3510000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 5657
	        start_va = 0x4930000
	          end_va = 0x498cfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004930000"
	        filename = ""

Region:
	              id = 5658
	        start_va = 0x4fe0000
	          end_va = 0x501ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fe0000"
	        filename = ""

Region:
	              id = 5659
	        start_va = 0x54d0000
	          end_va = 0x55cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054d0000"
	        filename = ""

Region:
	              id = 5660
	        start_va = 0x74030000
	          end_va = 0x74037fff
	     entry_point = 0x74030000
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll")

Region:
	              id = 5661
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 5662
	        start_va = 0x73820000
	          end_va = 0x73836fff
	     entry_point = 0x73820000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5663
	        start_va = 0x73840000
	          end_va = 0x73877fff
	     entry_point = 0x73840000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 5664
	        start_va = 0x737e0000
	          end_va = 0x7381cfff
	     entry_point = 0x737e0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5665
	        start_va = 0x5350000
	          end_va = 0x544ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005350000"
	        filename = ""

Region:
	              id = 5666
	        start_va = 0x55d0000
	          end_va = 0x57cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000055d0000"
	        filename = ""

Region:
	              id = 5667
	        start_va = 0x737c0000
	          end_va = 0x737d5fff
	     entry_point = 0x737c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 5670
	        start_va = 0x3520000
	          end_va = 0x3520fff
	     entry_point = 0x3520000
	     region_type = mapped_file
	            name = "msctf.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui")

Region:
	              id = 5671
	        start_va = 0x3530000
	          end_va = 0x3530fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003530000"
	        filename = ""

Region:
	              id = 5672
	        start_va = 0x3540000
	          end_va = 0x3540fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003540000"
	        filename = ""

Region:
	              id = 5673
	        start_va = 0x71a60000
	          end_va = 0x72016fff
	     entry_point = 0x71a60000
	     region_type = mapped_file
	            name = "mshtml.dll"
	        filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")

Region:
	              id = 5674
	        start_va = 0x73790000
	          end_va = 0x737b9fff
	     entry_point = 0x73790000
	     region_type = mapped_file
	            name = "msls31.dll"
	        filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")

Region:
	              id = 5675
	        start_va = 0x3550000
	          end_va = 0x3550fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003550000"
	        filename = ""

Region:
	              id = 5676
	        start_va = 0x3570000
	          end_va = 0x3570fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003570000"
	        filename = ""

Region:
	              id = 5677
	        start_va = 0x3580000
	          end_va = 0x3587fff
	     entry_point = 0x3580000
	     region_type = mapped_file
	            name = "index.dat"
	        filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")

Region:
	              id = 5678
	        start_va = 0x3590000
	          end_va = 0x3591fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000003590000"
	        filename = ""

Region:
	              id = 5679
	        start_va = 0x3670000
	          end_va = 0x3680fff
	     entry_point = 0x3670000
	     region_type = mapped_file
	            name = "c_20127.nls"
	        filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls")

Region:
	              id = 5680
	        start_va = 0x51d0000
	          end_va = 0x520ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051d0000"
	        filename = ""

Region:
	              id = 5681
	        start_va = 0x5490000
	          end_va = 0x54cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005490000"
	        filename = ""

Region:
	              id = 5682
	        start_va = 0x5910000
	          end_va = 0x5a0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005910000"
	        filename = ""

Region:
	              id = 5683
	        start_va = 0x5bd0000
	          end_va = 0x5dcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005bd0000"
	        filename = ""

Region:
	              id = 5684
	        start_va = 0x73e60000
	          end_va = 0x73e6afff
	     entry_point = 0x73e60000
	     region_type = mapped_file
	            name = "msimtf.dll"
	        filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")

Region:
	              id = 5685
	        start_va = 0x7ef7d000
	          end_va = 0x7ef7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7d000"
	        filename = ""

Region:
	              id = 5686
	        start_va = 0x7ef80000
	          end_va = 0x7ef82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef80000"
	        filename = ""

Region:
	              id = 5687
	        start_va = 0x71940000
	          end_va = 0x71990fff
	     entry_point = 0x71940000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 5688
	        start_va = 0x719a0000
	          end_va = 0x71a51fff
	     entry_point = 0x719a0000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll")

Region:
	              id = 5689
	        start_va = 0x73760000
	          end_va = 0x7378ffff
	     entry_point = 0x73760000
	     region_type = mapped_file
	            name = "iepeers.dll"
	        filename = "\\Windows\\SysWOW64\\iepeers.dll" (normalized: "c:\\windows\\syswow64\\iepeers.dll")

Region:
	              id = 5690
	        start_va = 0x35a0000
	          end_va = 0x35a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000035a0000"
	        filename = ""

Region:
	              id = 5691
	        start_va = 0x4520000
	          end_va = 0x4523fff
	     entry_point = 0x4520000
	     region_type = mapped_file
	            name = "jscript.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\jscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\jscript.dll.mui")

Region:
	              id = 5692
	        start_va = 0x4530000
	          end_va = 0x4530fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004530000"
	        filename = ""

Region:
	              id = 5693
	        start_va = 0x4580000
	          end_va = 0x4580fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 5694
	        start_va = 0x4e40000
	          end_va = 0x4e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e40000"
	        filename = ""

Region:
	              id = 5695
	        start_va = 0x57d0000
	          end_va = 0x5877fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000057d0000"
	        filename = ""

Region:
	              id = 5696
	        start_va = 0x58c0000
	          end_va = 0x58cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058c0000"
	        filename = ""

Region:
	              id = 5697
	        start_va = 0x5a10000
	          end_va = 0x5aa7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a10000"
	        filename = ""

Region:
	              id = 5698
	        start_va = 0x5dd0000
	          end_va = 0x61cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005dd0000"
	        filename = ""

Region:
	              id = 5699
	        start_va = 0x61d0000
	          end_va = 0x63cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000061d0000"
	        filename = ""

Region:
	              id = 5700
	        start_va = 0x63d0000
	          end_va = 0x67cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000063d0000"
	        filename = ""

Region:
	              id = 5701
	        start_va = 0x67d0000
	          end_va = 0x6911fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000067d0000"
	        filename = ""

Region:
	              id = 5702
	        start_va = 0x6920000
	          end_va = 0x711ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006920000"
	        filename = ""

Region:
	              id = 5703
	        start_va = 0x7120000
	          end_va = 0x7234fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007120000"
	        filename = ""

Region:
	              id = 5704
	        start_va = 0x7350000
	          end_va = 0x744ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007350000"
	        filename = ""

Region:
	              id = 5705
	        start_va = 0x7540000
	          end_va = 0x763ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007540000"
	        filename = ""

Region:
	              id = 5706
	        start_va = 0x71910000
	          end_va = 0x7192dfff
	     entry_point = 0x71910000
	     region_type = mapped_file
	            name = "t2embed.dll"
	        filename = "\\Windows\\SysWOW64\\t2embed.dll" (normalized: "c:\\windows\\syswow64\\t2embed.dll")

Region:
	              id = 5707
	        start_va = 0x73e40000
	          end_va = 0x73e4afff
	     entry_point = 0x73e40000
	     region_type = mapped_file
	            name = "imgutil.dll"
	        filename = "\\Windows\\SysWOW64\\imgutil.dll" (normalized: "c:\\windows\\syswow64\\imgutil.dll")

Region:
	              id = 5708
	        start_va = 0x7ef7a000
	          end_va = 0x7ef7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef7a000"
	        filename = ""

Region:
	              id = 5709
	        start_va = 0x71930000
	          end_va = 0x7193dfff
	     entry_point = 0x71930000
	     region_type = mapped_file
	            name = "pngfilt.dll"
	        filename = "\\Windows\\SysWOW64\\pngfilt.dll" (normalized: "c:\\windows\\syswow64\\pngfilt.dll")

Region:
	              id = 5710
	        start_va = 0x45d0000
	          end_va = 0x4617fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045d0000"
	        filename = ""

Region:
	              id = 5711
	        start_va = 0x74bc0000
	          end_va = 0x74bc4fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "msimg32.dll"
	        filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")


Thread:
	id = 446
	os_tid = 0xd48


Thread:
	id = 447
	os_tid = 0xd50


Thread:
	id = 448
	os_tid = 0xd54


Thread:
	id = 449
	os_tid = 0xd58


Thread:
	id = 450
	os_tid = 0xd5c


Thread:
	id = 451
	os_tid = 0xd60


Thread:
	id = 452
	os_tid = 0xd64


Thread:
	id = 453
	os_tid = 0xd68


Thread:
	id = 454
	os_tid = 0xd6c


Thread:
	id = 455
	os_tid = 0xd70


Thread:
	id = 456
	os_tid = 0xd74


Thread:
	id = 457
	os_tid = 0xd78


Thread:
	id = 458
	os_tid = 0xd7c


Thread:
	id = 459
	os_tid = 0xd80


Thread:
	id = 460
	os_tid = 0xd84


Thread:
	id = 461
	os_tid = 0xd88


Thread:
	id = 462
	os_tid = 0xd8c


Thread:
	id = 463
	os_tid = 0xd90


Thread:
	id = 465
	os_tid = 0xd98


Thread:
	id = 466
	os_tid = 0xd9c


Thread:
	id = 467
	os_tid = 0xda0


Thread:
	id = 468
	os_tid = 0xda4


Thread:
	id = 469
	os_tid = 0xe14


Thread:
	id = 471
	os_tid = 0xe1c